Bump mail-auth to 0.9

2026-05-05 19:41:15 +02:00
parent 33cb0ee832
commit 015d437027
13 changed files with 157 additions and 66 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,7 @@ If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If
 ## Added

 ## Changed
+- Bump `mail-auth` to 0.9 (which bumps `hickory-resolver` to 0.26).

 ## Fixed
 - JMAP: 
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1075,7 +1075,7 @@ dependencies = [
 "dns-update",
 "futures",
 "hashify",
- "hickory-proto 0.25.2",
+ "hickory-proto 0.26.1",
 "hostname",
 "hyper",
 "idna",
@@ -1267,6 +1267,16 @@ dependencies = [
 "zenoh",
 ]

+[[package]]
+name = "core-foundation"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
 [[package]]
 name = "core-foundation"
 version = "0.10.1"
@@ -2804,6 +2814,39 @@ dependencies = [
 "tracing",
 ]

+[[package]]
+name = "hickory-net"
+version = "0.26.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2295ed2f9c31e471e1428a8f88a3f0e1f4b27c15049592138d1eebe9c35b183"
+dependencies = [
+ "async-trait",
+ "aws-lc-rs",
+ "bitflags",
+ "bytes",
+ "cfg-if",
+ "data-encoding",
+ "futures-channel",
+ "futures-io",
+ "futures-util",
+ "hickory-proto 0.26.1",
+ "idna",
+ "ipnet",
+ "jni 0.22.4",
+ "lru-cache",
+ "parking_lot",
+ "rand 0.10.1",
+ "rustls 0.23.40",
+ "rustls-pki-types",
+ "thiserror 2.0.18",
+ "time",
+ "tinyvec",
+ "tokio",
+ "tokio-rustls",
+ "tracing",
+ "url",
+]
+
 [[package]]
 name = "hickory-proto"
 version = "0.25.2"
@@ -2840,53 +2883,50 @@ dependencies = [

 [[package]]
 name = "hickory-proto"
-version = "0.26.0-alpha.1"
+version = "0.26.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a62d7684f766b0f96344be88c023f9b6650039aea09d526b4974cce302eb61b1"
+checksum = "0bab31817bfb44672a252e97fe81cd0c18d1b2cf892108922f6818820df8c643"
 dependencies = [
- "async-trait",
 "aws-lc-rs",
 "bitflags",
- "bytes",
- "cfg-if",
 "data-encoding",
- "enum-as-inner",
- "futures-channel",
- "futures-io",
- "futures-util",
 "idna",
 "ipnet",
+ "jni 0.22.4",
 "once_cell",
- "rand 0.9.4",
+ "prefix-trie",
+ "rand 0.10.1",
 "ring",
- "rustls 0.23.40",
 "rustls-pki-types",
 "thiserror 2.0.18",
 "time",
 "tinyvec",
- "tokio",
- "tokio-rustls",
 "tracing",
 "url",
 ]

 [[package]]
 name = "hickory-resolver"
-version = "0.26.0-alpha.1"
+version = "0.26.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbab5e26a7f82341145ba1fbd1f1858d0490624fcc46270db2d3c4a101f763f4"
+checksum = "f0d58d28879ceecde6607729660c2667a081ccdc082e082675042793960f178c"
 dependencies = [
 "cfg-if",
 "futures-util",
- "hickory-proto 0.26.0-alpha.1",
+ "hickory-net",
+ "hickory-proto 0.26.1",
 "ipconfig",
+ "ipnet",
+ "jni 0.22.4",
 "moka",
+ "ndk-context",
 "once_cell",
 "parking_lot",
- "rand 0.9.4",
+ "rand 0.10.1",
 "resolv-conf",
 "rustls 0.23.40",
 "smallvec",
+ "system-configuration",
 "thiserror 2.0.18",
 "tokio",
 "tokio-rustls",
@@ -3489,6 +3529,9 @@ name = "ipnet"
 version = "2.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
+dependencies = [
+ "serde",
+]

 [[package]]
 name = "ipnetwork"
@@ -4132,9 +4175,9 @@ dependencies = [

 [[package]]
 name = "mail-auth"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f026538d37471da028cd5c6a907777c3de2d84e2c71b2b47ae301a10977c5e6"
+checksum = "c99f0db3f1292f72149bd50fcca0354d243defda0d26532ef7281ca716c77592"
 dependencies = [
 "aws-lc-rs",
 "flate2",
@@ -4479,6 +4522,12 @@ dependencies = [
 "getrandom 0.2.17",
 ]

+[[package]]
+name = "ndk-context"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27b02d87554356db9e9a873add8782d4ea6e3e58ea071a9adb9a2e8ddb884a8b"
+
 [[package]]
 name = "new_debug_unreachable"
 version = "1.0.6"
@@ -5351,6 +5400,17 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"

+[[package]]
+name = "prefix-trie"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90f561214012d3fc240a1f9c817cc4d57f5310910d066069c1b093f766bb5966"
+dependencies = [
+ "either",
+ "ipnet",
+ "num-traits",
+]
+
 [[package]]
 name = "prettyplease"
 version = "0.2.37"
@@ -6489,7 +6549,7 @@ version = "0.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1d99feebc72bae7ab76ba994bb5e121b8d83d910ca40b36e0921f53becc41784"
 dependencies = [
- "core-foundation",
+ "core-foundation 0.10.1",
 "core-foundation-sys",
 "jni 0.21.1",
 "log",
@@ -6510,7 +6570,7 @@ version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "26d1e2536ce4f35f4846aa13bff16bd0ff40157cdb14cc056c7b14ba41233ba0"
 dependencies = [
- "core-foundation",
+ "core-foundation 0.10.1",
 "core-foundation-sys",
 "jni 0.22.4",
 "log",
@@ -6719,7 +6779,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
 dependencies = [
 "bitflags",
- "core-foundation",
+ "core-foundation 0.10.1",
 "core-foundation-sys",
 "libc",
 "security-framework-sys",
@@ -7615,6 +7675,27 @@ dependencies = [
 "windows",
 ]

+[[package]]
+name = "system-configuration"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b"
+dependencies = [
+ "bitflags",
+ "core-foundation 0.9.4",
+ "system-configuration-sys",
+]
+
+[[package]]
+name = "system-configuration-sys"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e1d1b10ced5ca923a1fcb8d03e96b8d3268065d724548c0211415ff6ac6bac4"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
 [[package]]
 name = "tagptr"
 version = "0.2.0"
--- a/crates/common/Cargo.toml
+++ b/crates/common/Cargo.toml
@@ -18,7 +18,7 @@ imap_proto = { path = "../imap-proto" }
 sieve-rs = { version = "0.7", features = ["rkyv", "serde"] }
 mail-parser = { version = "0.11", features = ["full_encoding"] } 
 mail-builder = { version = "0.4" }
-mail-auth = { version = "0.8" }
+mail-auth = { version = "0.9" }
 smtp-proto = { version = "0.2", features = ["rkyv"] }
 dns-update = { version = "0.2.1" }
 calcard = { version = "0.3", features = ["rkyv"] }
@@ -76,7 +76,7 @@ indexmap = "2.7.1"
 tinyvec = { version = "1.10.0", features = ["alloc"] }
 compact_str = { version = "0.9.0", features = ["rkyv", "serde"] }
 lz4_flex = { version = "0.13", features = ["frame"], default-features = false }
-hickory-proto = "0.25"
+hickory-proto = "0.26"
 nohash-hasher = "0.2.0"
 quick_cache = "0.6.9"
 rasn = "0.28"
--- a/crates/common/src/config/smtp/resolver.rs
+++ b/crates/common/src/config/smtp/resolver.rs
@@ -8,8 +8,11 @@ use mail_auth::{
    MessageAuthenticator,
    hickory_resolver::{
        TokioResolver,
-        config::{NameServerConfig, ProtocolConfig, ResolverConfig, ResolverOpts},
-        name_server::TokioConnectionProvider,
+        config::{
+            CLOUDFLARE, ConnectionConfig, GOOGLE, NameServerConfig, ProtocolConfig, QUAD9,
+            ResolverConfig, ResolverOpts,
+        },
+        net::runtime::TokioRuntimeProvider,
        system_conf::read_system_conf,
    },
 };
@@ -22,7 +25,6 @@ use serde::{Deserialize, Serialize};
 use std::{
    fmt::Display,
    hash::{DefaultHasher, Hash, Hasher},
-    net::SocketAddr,
    str::FromStr,
    sync::Arc,
 };
@@ -124,23 +126,25 @@ impl Resolvers {
                        ObjectType::DnsResolver.singleton(),
                        format!("Failed to read system DNS config: {err}"),
                    );
-                    resolver_config = ResolverConfig::cloudflare();
+                    resolver_config = ResolverConfig::udp_and_tcp(&CLOUDFLARE);
                }
            },
            DnsResolver::Custom(resolver) => {
                resolver_config = ResolverConfig::default();

                for server in resolver.servers {
-                    resolver_config.add_name_server(NameServerConfig::new(
-                        SocketAddr::new(server.address.into_inner(), server.port as u16),
-                        match server.protocol {
-                            DnsResolverProtocol::Udp => ProtocolConfig::Udp,
-                            DnsResolverProtocol::Tcp => ProtocolConfig::Tcp,
-                            DnsResolverProtocol::Tls => ProtocolConfig::Tls {
-                                server_name: Arc::from(server.address.to_string()),
-                            },
+                    let ip = server.address.into_inner();
+                    let port = server.port as u16;
+                    let protocol = match server.protocol {
+                        DnsResolverProtocol::Udp => ProtocolConfig::Udp,
+                        DnsResolverProtocol::Tcp => ProtocolConfig::Tcp,
+                        DnsResolverProtocol::Tls => ProtocolConfig::Tls {
+                            server_name: Arc::from(server.address.to_string()),
                        },
-                    ));
+                    };
+                    let mut connection = ConnectionConfig::new(protocol);
+                    connection.port = port;
+                    resolver_config.add_name_server(NameServerConfig::new(ip, true, vec![connection]));
                }

                opts.num_concurrent_reqs = resolver.concurrency as usize;
@@ -152,9 +156,9 @@ impl Resolvers {
            }
            DnsResolver::Cloudflare(resolver) => {
                resolver_config = if resolver.use_tls {
-                    ResolverConfig::cloudflare_tls()
+                    ResolverConfig::tls(&CLOUDFLARE)
                } else {
-                    ResolverConfig::cloudflare()
+                    ResolverConfig::udp_and_tcp(&CLOUDFLARE)
                };

                opts.num_concurrent_reqs = resolver.concurrency as usize;
@@ -166,9 +170,9 @@ impl Resolvers {
            }
            DnsResolver::Quad9(resolver) => {
                resolver_config = if resolver.use_tls {
-                    ResolverConfig::quad9_tls()
+                    ResolverConfig::tls(&QUAD9)
                } else {
-                    ResolverConfig::quad9()
+                    ResolverConfig::udp_and_tcp(&QUAD9)
                };
                opts.num_concurrent_reqs = resolver.concurrency as usize;
                opts.timeout = resolver.timeout.into_inner();
@@ -178,7 +182,7 @@ impl Resolvers {
                opts.edns0 = resolver.enable_edns;
            }
            DnsResolver::Google(resolver) => {
-                resolver_config = ResolverConfig::google();
+                resolver_config = ResolverConfig::udp_and_tcp(&GOOGLE);
                opts.num_concurrent_reqs = resolver.concurrency as usize;
                opts.timeout = resolver.timeout.into_inner();
                opts.preserve_intermediates = resolver.preserve_intermediates;
@@ -201,10 +205,11 @@ impl Resolvers {
            dnssec: DnssecResolver {
                resolver: TokioResolver::builder_with_config(
                    config_dnssec,
-                    TokioConnectionProvider::default(),
+                    TokioRuntimeProvider::default(),
                )
                .with_options(opts_dnssec)
-                .build(),
+                .build()
+                .expect("Failed to build DNSSEC resolver"),
            },
        }
    }
@@ -282,7 +287,10 @@ impl Default for Resolvers {
    fn default() -> Self {
        let (config, opts) = match read_system_conf() {
            Ok(conf) => conf,
-            Err(_) => (ResolverConfig::cloudflare(), ResolverOpts::default()),
+            Err(_) => (
+                ResolverConfig::udp_and_tcp(&CLOUDFLARE),
+                ResolverOpts::default(),
+            ),
        };

        let config_dnssec = config.clone();
@@ -294,10 +302,11 @@ impl Default for Resolvers {
            dnssec: DnssecResolver {
                resolver: TokioResolver::builder_with_config(
                    config_dnssec,
-                    TokioConnectionProvider::default(),
+                    TokioRuntimeProvider::default(),
                )
                .with_options(opts_dnssec)
-                .build(),
+                .build()
+                .expect("Failed to build DNSSEC resolver"),
            },
        }
    }
--- a/crates/http/Cargo.toml
+++ b/crates/http/Cargo.toml
@@ -23,7 +23,7 @@ registry = { path =  "../registry" }
 smtp-proto = { version = "0.2" }
 mail-parser = { version = "0.11", features = ["full_encoding", "rkyv"] } 
 mail-builder = { version = "0.4" }
-mail-auth = { version = "0.8", features = ["generate"] }
+mail-auth = { version = "0.9", features = ["generate"] }
 tokio = { version = "1.47", features = ["rt"] }
 hyper = { version = "1.0.1", features = ["server", "http1", "http2"] }
 hyper-util = { version = "0.1.1", features = ["tokio"] }
--- a/crates/jmap/Cargo.toml
+++ b/crates/jmap/Cargo.toml
@@ -23,7 +23,7 @@ calcard = { version = "0.3" }
 smtp-proto = { version = "0.2" }
 mail-parser = { version = "0.11", features = ["full_encoding", "rkyv"] } 
 mail-builder = { version = "0.4" }
-mail-auth = { version = "0.8", features = ["generate"] }
+mail-auth = { version = "0.9", features = ["generate"] }
 sieve-rs = { version = "0.7", features = ["rkyv"] } 
 jmap-tools = { version = "0.1", features = ["rkyv"] }
 serde = { version = "1.0", features = ["derive"]}
--- a/crates/registry/Cargo.toml
+++ b/crates/registry/Cargo.toml
@@ -13,7 +13,7 @@ hashify = "0.2.7"
 ahash = { version = "0.8" }
 jmap-tools = { version = "0.1" }
 xxhash-rust = { version = "0.8.5", features = ["xxh3"] }
-mail-auth = { version = "0.8" }
+mail-auth = { version = "0.9" }
 tokio = { version = "1.47", features = ["fs"] }
 lz4_flex = { version = "0.13", default-features = false }

--- a/crates/smtp/Cargo.toml
+++ b/crates/smtp/Cargo.toml
@@ -21,7 +21,7 @@ email = { path =  "../email" }
 registry = { path =  "../registry" }
 spam-filter = { path =  "../spam-filter" }
 trc = { path = "../trc" }
-mail-auth = { version = "0.8", features = ["rkyv"] }
+mail-auth = { version = "0.9", features = ["rkyv"] }
 mail-parser = { version = "0.11", features = ["full_encoding"] } 
 mail-builder = { version = "0.4" } 
 smtp-proto = { version = "0.2", features = ["rkyv", "serde"] }
--- a/crates/smtp/src/outbound/dane/dnssec.rs
+++ b/crates/smtp/src/outbound/dane/dnssec.rs
@@ -10,9 +10,9 @@ use common::{
 };
 use mail_auth::{
    common::resolver::ToFqdn,
-    hickory_resolver::{
-        Name,
-        proto::rr::rdata::tlsa::{CertUsage, Matching, Selector},
+    hickory_resolver::proto::rr::{
+        Name, RData,
+        rdata::tlsa::{CertUsage, Matching, Selector},
    },
 };
 use std::{future::Future, sync::Arc};
@@ -53,10 +53,10 @@ impl TlsaLookup for Server {
        let mut has_intermediates = false;
        let mut found_insecure = false;

-        for record in tlsa_lookup.as_lookup().record_iter() {
-            if let Some(tlsa) = record.data().as_tlsa() {
-                if record.proof().is_secure() {
-                    let is_end_entity = match tlsa.cert_usage() {
+        for record in tlsa_lookup.answers() {
+            if let RData::TLSA(tlsa) = &record.data {
+                if record.proof.is_secure() {
+                    let is_end_entity = match tlsa.cert_usage {
                        CertUsage::DaneEe => true,
                        CertUsage::DaneTa => false,
                        _ => continue,
@@ -68,17 +68,17 @@ impl TlsaLookup for Server {
                    }
                    entries.push(TlsaEntry {
                        is_end_entity,
-                        is_sha256: match tlsa.matching() {
+                        is_sha256: match tlsa.matching {
                            Matching::Sha256 => true,
                            Matching::Sha512 => false,
                            _ => continue,
                        },
-                        is_spki: match tlsa.selector() {
+                        is_spki: match tlsa.selector {
                            Selector::Spki => true,
                            Selector::Full => false,
                            _ => continue,
                        },
-                        data: tlsa.cert_data().to_vec(),
+                        data: tlsa.cert_data.clone(),
                    });
                } else {
                    found_insecure = true;
--- a/crates/spam-filter/Cargo.toml
+++ b/crates/spam-filter/Cargo.toml
@@ -14,7 +14,7 @@ registry = { path =  "../registry" }
 smtp-proto = { version = "0.2", features = ["rkyv"] }
 mail-parser = { version = "0.11", features = ["full_encoding"] } 
 mail-builder = { version = "0.4" }
-mail-auth = { version = "0.8" }
+mail-auth = { version = "0.9" }
 tokio = { version = "1.47", features = ["net", "macros"] }
 psl = "2"
 hyper = { version = "1.0.1", features = ["server", "http1", "http2"] }
--- a/crates/trc/Cargo.toml
+++ b/crates/trc/Cargo.toml
@@ -5,7 +5,7 @@ edition = "2024"

 [dependencies]
 event_macro = { path = "./event-macro" }
-mail-auth = { version = "0.8" }
+mail-auth = { version = "0.9" }
 mail-parser = { version = "0.11", features = ["full_encoding"] } 
 base64 = "0.22.1"
 serde = "1.0"
--- a/crates/utils/Cargo.toml
+++ b/crates/utils/Cargo.toml
@@ -12,7 +12,7 @@ rustls-platform-verifier = "0.7"
 tokio = { version = "1.47", features = ["net", "macros", "signal"] }
 tokio-rustls = { version = "0.26", default-features = false, features = ["aws_lc_rs", "tls12"] }
 serde = { version = "1.0", features = ["derive"]}
-mail-auth = { version = "0.8" }
+mail-auth = { version = "0.9" }
 smtp-proto = { version = "0.2" }
 ahash = { version = "0.8", features = ["serde"] }
 chrono = "0.4"
--- a/tests/Cargo.toml
+++ b/tests/Cargo.toml
@@ -45,7 +45,7 @@ migration = { path = "../crates/migration", features = ["test_mode", "enterprise
 trc = { path = "../crates/trc", features = ["enterprise"] }
 managesieve = { path = "../crates/managesieve", features = ["test_mode", "enterprise"] }
 smtp-proto = { version = "0.2" }
-mail-auth = { version = "0.8", features = ["test"] }
+mail-auth = { version = "0.9", features = ["test"] }
 mail-parser = { version = "0.11", features = ["full_encoding", "rkyv"] } 
 mail-builder = "0.4.4"
 sieve-rs = { version = "0.7", features = ["rkyv"] }