Struct CaaValue 

pub struct CaaValue {
    pub flags: u8,
    pub tag: String,
    pub value: String,
}

One CAA property: RFC 8659’s flags, tag and value.

A CAA record set is a statement about which certificate authority may issue for a name and everything under it. It is not a defence against whoever holds this zone’s credential — that holder can rewrite this record as easily as any other. What it does is narrow issuance to one authority and one account at that authority, so a certificate for a name in this zone cannot be obtained through any other path that does not first change this record; and changing it is a second, separately visible act.

Only issue and iodef are constructed here. issuewild is deliberately absent: RFC 8659 says a wildcard request falls back to issue when no issuewild is present, and this deployment’s certificate covers a zone and its wildcard from one order through one account, so a second property could only ever say the same thing or disagree with it.

Fields

flags: u8

RFC 8659 flags octet. 0 for every property this crate writes: the critical bit tells a certificate authority to refuse issuance rather than ignore a property it does not understand, and issue and iodef are understood everywhere.

tag: String

The property tag: issue or iodef.

value: String

The property value, unquoted.

Implementations

impl CaaValue

pub fn issue(issuer: impl Into<String>) -> Self

issue, authorising issuer — a domain name such as letsencrypt.org — and no one else.

pub fn issue_for_account( issuer: impl AsRef<str>, account_uri: impl AsRef<str>, ) -> Self

issue with RFC 8657’s accounturi parameter, authorising issuer only when the request comes from the ACME account at account_uri.

This is the half that matters. issue "letsencrypt.org" alone authorises anyone who can create an account at that authority, which is anyone; naming the account narrows it to the one this deployment holds the key for. An authority that does not implement RFC 8657 ignores the parameter and enforces the issuer name only, which is what makes publishing it safe against an authority that has not caught up.

pub fn iodef(target: impl Into<String>) -> Self

iodef, naming where a certificate authority should report a request this record made it refuse.

A refused issuance is the signal that someone tried to obtain a certificate for this zone through an account that is not ours, and it arrives from the authority rather than from this host — which is the point, since a host holding the zone credential cannot be trusted to report on its own misuse.

pub fn to_wire(&self) -> String

The record’s wire form: <flags> <tag> "<value>", with " and \ escaped inside the quoted value.

Trait Implementations

impl Clone for CaaValue

fn clone(&self) -> CaaValue

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CaaValue

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for CaaValue

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Ord for CaaValue

fn cmp(&self, other: &CaaValue) -> Ordering

This method returns an Ordering between self and other.

fn max(self, other: Self) -> Self

where Self: Sized,

Compares and returns the maximum of two values.

fn min(self, other: Self) -> Self

where Self: Sized,

Compares and returns the minimum of two values.

fn clamp(self, min: Self, max: Self) -> Self

where Self: Sized,

Restrict a value to a certain interval.

impl PartialEq for CaaValue

fn eq(&self, other: &CaaValue) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl PartialOrd for CaaValue

fn partial_cmp(&self, other: &CaaValue) -> Option<Ordering>

This method returns an ordering between self and other values if one exists.

fn lt(&self, other: &Rhs) -> bool

Tests less than (for self and other) and is used by the < operator.

fn le(&self, other: &Rhs) -> bool

Tests less than or equal to (for self and other) and is used by the <= operator.

fn gt(&self, other: &Rhs) -> bool

Tests greater than (for self and other) and is used by the > operator.

fn ge(&self, other: &Rhs) -> bool

Tests greater than or equal to (for self and other) and is used by the >= operator.

impl Eq for CaaValue

impl StructuralPartialEq for CaaValue