Sovite.Core.MTASTS (sovite v0.6.0)

Copy Markdown View Source

Finds the MTA-STS policies (RFC 8461) of the domains Sovite delivers to, when mta_sts.enabled is on. Sovite.Core.Delivery applies them.

policy/2 follows RFC 8461 §5.1 for a domain:

  1. It looks up the _mta-sts.<domain> TXT record.
  2. If its id is the one of the policy cached in the database (mta_sts_policies) and that policy has not expired, the cached policy is used.
  3. Otherwise the policy is fetched from https://mta-sts.<domain>/.well-known/mta-sts.txt and cached for its max_age.

When the record is missing or the lookup or fetch fails, a cached policy that has not expired is still used, so an attacker who blocks DNS or HTTPS cannot turn a policy off. Without one the domain has no policy, and the failure is returned for TLS-RPT.

Concurrent requests for a domain share one lookup, and answers are remembered for a minute, so a burst of deliveries to one domain makes one DNS query.

Options

Telemetry

  • [:sovite, :mta_sts, :fetched] - %{}, %{domain, policy_id, mode}
  • [:sovite, :mta_sts, :failed] - %{}, %{domain, reason}: no policy could be fetched, and no cached one was used.

Summary

Types

result()

The policy to apply, or nil, and why a policy that may exist could not be found: a TLS-RPT result type (RFC 8460 §4.3.2.2) and a description.

Functions

policy(server, domain, timeout \\ 90000)

Returns the policy of domain. Policies with mode none are returned as no policy.

start_link(opts)

Starts the policy cache.

Types

result()

@type result() :: %{
  policy: Sovite.TLS.MTASTS.Policy.t() | nil,
  failure:
    {:sts_policy_fetch_error | :sts_policy_invalid | :sts_webpki_invalid,
     String.t()}
    | nil
}

The policy to apply, or nil, and why a policy that may exist could not be found: a TLS-RPT result type (RFC 8460 §4.3.2.2) and a description.

Functions

policy(server, domain, timeout \\ 90000)

@spec policy(GenServer.server(), String.t(), timeout()) :: result()

Returns the policy of domain. Policies with mode none are returned as no policy.

start_link(opts)

@spec start_link(keyword()) :: GenServer.on_start()

Starts the policy cache.