mirror of
https://github.com/mailscope/kumomta.git
synced 2026-08-24 13:18:18 +00:00
Wez Furlong
75 lines
2.6 KiB
Markdown
75 lines
2.6 KiB
Markdown
# arc_seal
|
|
|
|
```lua
|
|
message:arc_seal(signer, server_id, authentication_results, opt_resolver_name)
|
|
```
|
|
|
|
{{since('2025.12.02-67ee9e96')}}
|
|
|
|
This method will sign and seal an ARC set to record the current hop as part of
|
|
the [Authenticated Received Chain](https://datatracker.ietf.org/doc/html/rfc8617).
|
|
|
|
The parameters are:
|
|
|
|
* `signer` - a signer object created through either
|
|
[kumo.dkim.rsa_sha256_signer](../kumo.dkim/rsa_sha256_signer.md) or
|
|
[kumo.dkim.ed25519_signer](../kumo.dkim/ed25519_signer.md).
|
|
* `server_id` - the hostname to use in the `ARC-Authentication-Results` header
|
|
that is generated as part of the sealing process.
|
|
* `authentication_results` - an array style table holding the set of authentication
|
|
results that should be signed as part of the ARC seal.
|
|
* `opt_resolver_name` parameter is an optional string parameter that specifies
|
|
the name of a alternate resolver defined via
|
|
[kumo.dns.define_resolver](../kumo.dns/define_resolver.md). You can omit
|
|
this parameter and the default resolver will be used.
|
|
|
|
Sealing will implicity verify the ARC chain in the message; if that
|
|
verification indicates that the chain of custody has been broken, then the seal
|
|
operation will return without modifying the message.
|
|
|
|
!!! note
|
|
Sealing the message MUST occur after all header and body modification,
|
|
otherwise those operations risk invalidating the signatures.
|
|
|
|
|
|
|
|
## Example
|
|
|
|
```lua
|
|
kumo.on('smtp_server_message_received', function(msg, conn_meta)
|
|
-- Collect together various authentication results.
|
|
-- dkim verification returns a possibly empty list
|
|
local results = msg:dkim_verify()
|
|
local arc = msg:arc_verify()
|
|
-- add the arc result to the list we got from dkim
|
|
table.insert(results, arc)
|
|
local spf = kumo.spf.check_msg(msg)
|
|
-- add the spf result to the list we got from dkim
|
|
table.insert(results, spf.result)
|
|
|
|
local server_id = msg:get_meta 'hostname'
|
|
|
|
-- Add a regular Authentication-Results header for the
|
|
-- sake of consistency with ARC
|
|
msg:add_authentication_results(server_id, results)
|
|
|
|
-- Set up a signer; this is just an example that loads
|
|
-- a key from a file on disk.
|
|
local signer = kumo.dkim.rsa_sha256_signer {
|
|
domain = msg:from_header().domain,
|
|
selector = 'default',
|
|
headers = { 'From', 'To', 'Subject' },
|
|
key = 'example-private-dkim-key.pem',
|
|
}
|
|
|
|
-- Emits an ARC-Authentication-Results header,
|
|
-- computes an ARC-Message-Signature header based on the settings
|
|
-- in the signer, and then computes a final ARC-Seal header
|
|
-- to seal the ARC chain of custody. Those 3 headers are
|
|
-- added to the message.
|
|
msg:arc_seal(signer, server_id, results)
|
|
end)
|
|
```
|
|
|
|
|