mirror of
https://github.com/mailscope/kumomta.git
synced 2026-08-21 03:48:17 +00:00
kay ozaki
1109639c0d
Surface the underlying DKIM signature tags and the published DMARC policy tags as auth-result props, so callers (and downstream Authentication-Results headers) can see what was actually checked. DKIM (crates/dkim): * Factor populate_props() over the parsed tagged-header and emit header.d, header.i, header.a, header.s, header.c, header.t and header.x. The previous code only emitted d/i/a/s on the success path. * On DKIMHeader::parse failure, fall back to a generic TaggedHeader parse so the resulting permerror AuthenticationResult still carries whatever tags were extractable (e.g. for expired signatures we now surface header.d and header.x). Covered by a new roundtrip test. DMARC (crates/kumo-dmarc, crates/kumod): * Record now retains the raw key=value tags it parsed, exposed via Record::tags(). * DispositionWithContext carries a new props map. Record::evaluate initialises it empty; drop the no-longer-relevant ToXml derive. * DmarcContext::check copies the matched record's tags into the result props as policy.<tag> via a new policy_tags() helper. * kumod's dmarc.rs threads result.props through into the AuthenticationResult returned to Lua (rather than starting empty), preserving the existing policy.published-domain-policy insertion for Quarantine/Reject.
kumo-dkim
DKIM (RFC6376) implementation
Features
Verifying email signatures
Example:
let res: DKIMResult = kumo_dkim::verify_email(&from_domain, &parsed_email).await?;
if let Some(err) = &res.error() {
error!(logger, "dkim verify fail: {}", err);
}
println!("dkim={}", res.with_detail());
Signing an email
Example:
let private_key =
rsa::RsaPrivateKey::read_pkcs1_pem_file(Path::new("./test/keys/2022.private"))?;
let signer = SignerBuilder::new()
.with_signed_headers(["From", "Subject"])?
.with_private_key(private_key)
.with_selector("2020")
.with_signing_domain("example.com")
.build()?;
let signature = signer.sign(&email)?;
println!("{}", signature); // DKIM-Signature: ...
See the SignerBuilder object documentation for more information.
Generate a test DKIM key
Using OpenDKIM:
opendkim-genkey \
--testmode \
--domain=example.com \
--selector=2022 \
--nosubdomains