badpenguin.dkim
Class Verifier

java.lang.Object
  badpenguin.dkim.Verifier

public class Verifier
extends java.lang.Object

This class provides all the necessary interfaces to check and verify a message for either a DKIM or DomainKey signature.

Author:

Mark Boddington <dk_NO_im@_SP_bad_AM_penguin.co.uk>
http://www.badpenguin.co.uk

Constructor Summary

Verifier(NSKeyStore keyStore)
Create a new Verifier object.

Verifier(NSKeyStore keyStore, java.lang.String sigPref)
Create a new Verifier object.

Verifier(NSKeyStore keyStore, java.lang.String sigPref, boolean tryBoth)
Create a new Verifier object.

Method Summary

void	addBadDomain(java.lang.String domain) Add the given domain to the list of Bad Domains.
int	getMaximumSigs() Get the number of Signatures that this Verifier will attempt to Verify.
void	setBadDomains(java.lang.String[] domains) Set up the list of bad domains.
void	setleniency(boolean leniency) Be more lenient when we encounter broken signatures or errors.
void	setMaximumSigs(int maxSigs) The Verifier will default to trying only one Signature, the last one we find (of you preferred type, if possible).
void	tryBoth(boolean tryBoth) Set the fail back option on or off.
void	verifyMail(java.io.InputStream msg) Verify the provided email message.
void	verifyMail(java.io.InputStream msg, long receivedTime) This function performs the same actions as verifyMail(msg), however, this one will accept a long representing the messages received time.

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

Verifier

public Verifier(NSKeyStore keyStore,
                java.lang.String sigPref,
                boolean tryBoth)

Create a new Verifier object. You must supply a NSKeyStore object, a signature preference, and the chose whether to try both signatures if the preferred signature is missing. The NSKeyStore will be used to lookup the public keys for verifying the Signatures, and if a mail should contain both key types, we will use the one you preferred. If we don't find your preferred signature and you have set arg2 to true then we will try the other type.

Parameters:

keyStore - - NSKeyStore

sigPref - - Signature Preference (DKIM | DomainKey)

tryBoth - - Try both signature types

Verifier

public Verifier(NSKeyStore keyStore,
                java.lang.String sigPref)

Create a new Verifier object. You must supply a NSKeyStore object, and a signature preference. Either DKIM or DomainKey. The NSKeyStore will be used to lookup the public keys for verifying the Signatures, and if a mail should contain both key types, we will use the one you preferred.

This instance will default to failing over to the other key type, should the preferred key type be missing. You can change this behaviour by calling Verifier.tryBoth(false);

Parameters:

keyStore - - NSKeyStore

sigPref - - Signature Preference (DKIM | DomainKey)

Verifier

public Verifier(NSKeyStore keyStore)

Create a new Verifier object. You must supply a NSKeyStore object. This verifier will default to using the DKIM-Signature, but will try to use a DomainKey-Signature if a DKIM one is not present.

If you wish to stop this verifier failing back to Domainkey signatures, then you should call Verifier.tryBoth(false), or use a different constructor.

Parameters:

keyStore - - NSKeyStore

Method Detail

setleniency

public void setleniency(boolean leniency)

Be more lenient when we encounter broken signatures or errors. Quietly fix what we can. For example, the DKIM RFC says an empty g tag in DNS will never match any addresses, therefore it should fail. With leniency set, we will treat g= as though it were g=*.

Parameters:

leniency - - turn on/off leniency

tryBoth

public void tryBoth(boolean tryBoth)

Set the fail back option on or off. If the signature of the type preferred is not available in the message, should we attempt to use the other type?

Parameters:

tryBoth - - Try other signatures?

setBadDomains

public void setBadDomains(java.lang.String[] domains)

Set up the list of bad domains. These are domains which we will not allow to be used in the d= tag. For example: TLDs such as .co.uk or .com

Parameters:

domains -

addBadDomain

public void addBadDomain(java.lang.String domain)

Add the given domain to the list of Bad Domains. These domains will be rejected should they appear in the d= tag of a DKIM signature.

Parameters:

domain -

setMaximumSigs

public void setMaximumSigs(int maxSigs)

The Verifier will default to trying only one Signature, the last one we find (of you preferred type, if possible). However you can change this behaviour by increasing the maxSigs variable. If you set it to a number greater than 1, then should we find an email with more than one Signature, we will try them in reverse order, until one verifies, or we hit maxSigs.
The minimum value for maxSigs is 1.

Parameters:

maxSigs - - Number of signatures to verify

getMaximumSigs

public int getMaximumSigs()

Get the number of Signatures that this Verifier will attempt to Verify. Use the setMaximumSigs() method to change this value.

Returns:

Number of signatures to verify

verifyMail

public void verifyMail(java.io.InputStream msg)
                throws java.io.IOException,
                       DkimException

Verify the provided email message. We will scan the message for DKIM and/or DomainKey signatures and attempt to verify one of them. If we fail to verify the Signature, then an exception indicating the reason for the failure will be thrown.
This function uses the systems current time when checking any expire headers in the signature. You may set a specific receive time, by using the other verifyMail method.

Parameters:

msg - - The message to be verified

Throws:

java.io.IOException

DkimException

verifyMail

public void verifyMail(java.io.InputStream msg,
                       long receivedTime)
                throws java.io.IOException,
                       DkimException

This function performs the same actions as verifyMail(msg), however, this one will accept a long representing the messages received time. The received time will then be used when verifying any expires headers which may be present in the signature.

Parameters:

msg -

receivedTime -

Throws:

java.io.IOException

DkimException