filip/Stalwart
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Encryption-at-rest: Support for AES-256-GCM and ChaCha20-Poly1305 for S/MIME (closes #161)

Browse Source
This commit is contained in:
Maurus Decimus
2026-06-25 09:53:07 +02:00
parent 9525a891f3
commit ab7d81e486
13 changed files with 406 additions and 88 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
crates/common/src/auth/mod.rs
View File

@@ -94,6 +94,8 @@ pub const ACCOUNT_FLAG_ENCRYPT_METHOD_PGP: u64 = 1 << 3;
pub const ACCOUNT_FLAG_ENCRYPT_ALGO_AES256: u64 = 1 << 4;
pub const ACCOUNT_FLAG_ENCRYPT_ALGO_AES128: u64 = 1 << 5;
pub const ACCOUNT_FLAG_ENCRYPT_APPEND: u64 = 1 << 6;
pub const ACCOUNT_FLAG_ENCRYPT_ALGO_AES256_GCM: u64 = 1 << 7;
pub const ACCOUNT_FLAG_ENCRYPT_ALGO_CHACHA20_POLY1305: u64 = 1 << 8;
#[derive(Debug, Clone)]
pub struct RoleCache {

9
crates/common/src/cache/principals.rs vendored
View File

@@ -8,6 +8,7 @@ use crate::{
Server,
auth::{
ACCOUNT_FLAG_ENCRYPT_ALGO_AES128, ACCOUNT_FLAG_ENCRYPT_ALGO_AES256,
ACCOUNT_FLAG_ENCRYPT_ALGO_AES256_GCM, ACCOUNT_FLAG_ENCRYPT_ALGO_CHACHA20_POLY1305,
ACCOUNT_FLAG_ENCRYPT_APPEND, ACCOUNT_FLAG_ENCRYPT_METHOD_PGP,
ACCOUNT_FLAG_ENCRYPT_METHOD_SMIME, ACCOUNT_FLAG_ENCRYPT_TRAIN_SPAM_FILTER, ACCOUNT_IS_USER,
AccountCache, AccountInfo, AccountTenantIds, DOMAIN_FLAG_RELAY, DOMAIN_FLAG_SUB_ADDRESSING,
@@ -412,6 +413,14 @@ impl Server {
flags |= ACCOUNT_FLAG_ENCRYPT_ALGO_AES128;
settings.into()
}
EncryptionAtRest::Aes256Gcm(settings) => {
flags |= ACCOUNT_FLAG_ENCRYPT_ALGO_AES256_GCM;
settings.into()
}
EncryptionAtRest::ChaCha20Poly1305(settings) => {
flags |= ACCOUNT_FLAG_ENCRYPT_ALGO_CHACHA20_POLY1305;
settings.into()
}
};
let encryption_key = if let Some(settings) = encryption_settings {
if settings.allow_spam_training {