Gitweb:
http://git.exim.org/exim.git/commitdiff/401a89359e1fcff59218ae2a05a5e9f3a603d915
Commit: 401a89359e1fcff59218ae2a05a5e9f3a603d915
Parent: a46255cd7d3a5e30068d5ac169545a2c0bd66f9a
Author: Jeremy Harris <jgh146exb@???>
AuthorDate: Sun Aug 10 15:00:27 2014 +0100
Committer: Jeremy Harris <jgh146exb@???>
CommitDate: Sun Aug 10 15:30:54 2014 +0100
Verifiable conn with DANE-EE(3) / SPKI(1) / SHA2-512(2)
---
DANE-draft-notes | 11 +++++++++++
doc/doc-txt/experimental-spec.txt | 17 +++++++++++++++--
src/src/dane-openssl.c | 4 ++--
src/src/tls-openssl.c | 4 ++--
test/confs/5850 | 10 +---------
test/dnszones-src/db.test.ex | 2 +-
test/log/5850 | 11 +++++------
test/scripts/5850-DANE-OpenSSL/5850 | 3 ++-
8 files changed, 39 insertions(+), 23 deletions(-)
diff --git a/DANE-draft-notes b/DANE-draft-notes
new file mode 100644
index 0000000..21b3992
--- /dev/null
+++ b/DANE-draft-notes
@@ -0,0 +1,11 @@
+
+draft 11
+
+3.1.2 - Para 4 (records with Sel Full(0) are discouraged)
+==> There's a matching type Full but not such a Selector type.
+ Should this be "Cert(0), or Matching Type Full(0)" ?
+ Suspect the latter.
+
+3.1.2 Needs a para added regarding certificate date verification,
+ to contrast with the requirement to NOT check for
+ DANE-EE defined in 3.1.1
diff --git a/doc/doc-txt/experimental-spec.txt b/doc/doc-txt/experimental-spec.txt
index 6eeb509..f141428 100644
--- a/doc/doc-txt/experimental-spec.txt
+++ b/doc/doc-txt/experimental-spec.txt
@@ -1181,7 +1181,10 @@ means not having to pay a CA for certificates.
DANE requires a server operator to do three things:
1) run DNSSEC. This provides assurance to clients
that DNS lookups they do for the server have not
-been tampered with.
+been tampered with. The domain MX record applying
+to this server, its A record, its TLSA record and
+any associated CNAME records must all be covered by
+DNSSEC.
2) add TLSA DNS records. These say what the server
certificate for a TLS connection should be.
3) offer a server certificate, or certificate chain,
@@ -1214,7 +1217,17 @@ servers, each having a TLSA query-domain CNAME record,
all of which point to a single TLSA record.
The TLSA record should have a Selector field of SPKI(1)
-and a Matching Type fiels of SHA2-512(2).
+and a Matching Type field of SHA2-512(2).
+
+At the time of writing,
https://www.huque.com/bin/gen_tlsa
+is useful for quickly generating TLSA records; and commands like
+
+ openssl x509 -in -pubkey -noout <certificate.pem \
+ | openssl rsa -outform der -pubin 2>/dev/null \
+ | openssl sha512 \
+ | awk '{print $2}'
+
+are workable for 4th-field hashes.
For use with the DANE_TA model, server certificates
must have a correct name (SubjectName or SubjectAltName).
diff --git a/src/src/dane-openssl.c b/src/src/dane-openssl.c
index 4f90caa..aab32ca 100644
--- a/src/src/dane-openssl.c
+++ b/src/src/dane-openssl.c
@@ -859,7 +859,7 @@ X509 *cert = ctx->cert; /* XXX: accessor? */
int matched = 0;
int chain_length = sk_X509_num(ctx->chain);
-DEBUG(D_tls) debug_printf("Dane library verify_chain fn called\n");
+DEBUG(D_tls) debug_printf("Dane verify_chain\n");
issuer_rrs = dane->selectors[SSL_DANE_USAGE_LIMIT_ISSUER];
leaf_rrs = dane->selectors[SSL_DANE_USAGE_LIMIT_LEAF];
@@ -952,7 +952,7 @@ int (*cb)(int, X509_STORE_CTX *) = ctx->verify_cb;
int matched;
X509 *cert = ctx->cert; /* XXX: accessor? */
-DEBUG(D_tls) debug_printf("Dane library verify_cert fn called\n");
+DEBUG(D_tls) debug_printf("Dane verify_cert\n");
if(ssl_idx < 0)
ssl_idx = SSL_get_ex_data_X509_STORE_CTX_idx();
diff --git a/src/src/tls-openssl.c b/src/src/tls-openssl.c
index 70ac63f..0014034 100644
--- a/src/src/tls-openssl.c
+++ b/src/src/tls-openssl.c
@@ -1796,8 +1796,8 @@ if (dane)
{
default: /* log bad */ return FAIL;
case 0: mdname = NULL; break;
- case 1: mdname = "SHA2-256"; break;
- case 2: mdname = "SHA2-512"; break;
+ case 1: mdname = "sha256"; break;
+ case 2: mdname = "sha512"; break;
}
switch (DANESSL_add_tlsa(client_ssl,
diff --git a/test/confs/5850 b/test/confs/5850
index 0b132e2..cd4ccc5 100644
--- a/test/confs/5850
+++ b/test/confs/5850
@@ -26,10 +26,7 @@ tls_advertise_hosts = *
# Set certificate only if server
tls_certificate = ${if eq {SERVER}{server}{DIR/aux-fixed/cert1}fail}
-tls_privatekey = ${if eq {SERVER}{server}{DIR/aux-fixed/cert1}fail}
-
-#tls_verify_hosts = *
-#tls_verify_certificates = ${if eq {SERVER}{server}{DIR/aux-fixed/cert2}fail}
+#tls_privatekey = ${if eq {SERVER}{server}{DIR/aux-fixed/cert1}fail}
# ----- Routers -----
@@ -39,7 +36,6 @@ begin routers
client:
driver = dnslookup
condition = ${if eq {SERVER}{server}{no}{yes}}
-# retry_use_local_part
dnssec_request_domains = *
self = send
transport = send_to_server
@@ -56,11 +52,7 @@ begin transports
send_to_server:
driver = smtp
allow_localhost
-# hosts = 127.0.0.1
port = PORT_D
-# tls_certificate = DIR/aux-fixed/cert2
-# tls_privatekey = DIR/aux-fixed/cert2
-# tls_verify_certificates = DIR/aux-fixed/cert2
# hosts_try_dane = *
hosts_require_dane = *
diff --git a/test/dnszones-src/db.test.ex b/test/dnszones-src/db.test.ex
index bd33491..fed44da 100644
--- a/test/dnszones-src/db.test.ex
+++ b/test/dnszones-src/db.test.ex
@@ -82,7 +82,7 @@ v6 AAAA V6NET:ffff:836f:0a00:000a:0800:200a:c032
DNSSEC eximtesthost A HOSTIPV4
alias-eximtesthost CNAME eximtesthost.test.ex.
-DNSSEC _1225._tcp.eximtesthost TLSA 3 1 2 f000baaa
+DNSSEC _1225._tcp.eximtesthost TLSA 3 1 2 3d5eb81b1dfc3f93c1fa8819e3fb3fdb41bb590441d5f3811db17772f4bc6de29bdd7c4f4b723750dda871b99379192b3f979f03db1252c4f08b03ef7176528d
; A bad CNAME
diff --git a/test/log/5850 b/test/log/5850
index e8b37bb..aad1ade 100644
--- a/test/log/5850
+++ b/test/log/5850
@@ -1,14 +1,13 @@
1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@??? U=CALLER P=local S=sss
1999-03-02 09:44:33 Start queue run: pid=pppp -qf
-1999-03-02 09:44:33 10HmaX-0005vi-00 TLS error on connection to eximtesthost.test.ex [ip4.ip4.ip4.ip4] (tlsa load): error:8006C067:DANE library:func(108):Bad TLSA record digest
-1999-03-02 09:44:33 10HmaX-0005vi-00 == CALLER@??? R=client T=send_to_server defer (-37): failure while setting up TLS session
+1999-03-02 09:44:33 10HmaX-0005vi-00 => CALLER@??? R=client T=send_to_server H=eximtesthost.test.ex [ip4.ip4.ip4.ip4] X=TLSv1:AES256-SHA:256 DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmaY-0005vi-00"
+1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
1999-03-02 09:44:33 End queue run: pid=pppp -qf
******** SERVER ********
1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
-1999-03-02 09:44:33 TLS error on connection from the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] (SSL_accept): error: <<detail omitted>>
-1999-03-02 09:44:33 TLS client disconnected cleanly (rejected our certificate?)
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@??? H=the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] P=esmtps X=TLSv1:AES256-SHA:256 S=sss id=E10HmaX-0005vi-00@???
1999-03-02 09:44:33 Start queue run: pid=pppp -qf
-1999-03-02 09:44:33 10HmaX-0005vi-00 => :blackhole: <CALLER@???> R=server
-1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <CALLER@???> R=server
+1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
1999-03-02 09:44:33 End queue run: pid=pppp -qf
diff --git a/test/scripts/5850-DANE-OpenSSL/5850 b/test/scripts/5850-DANE-OpenSSL/5850
index 963bf4f..449a75b 100644
--- a/test/scripts/5850-DANE-OpenSSL/5850
+++ b/test/scripts/5850-DANE-OpenSSL/5850
@@ -2,10 +2,11 @@
#
exim -DSERVER=server -bd -oX PORT_D
****
+# TLSA (3 1 2)
exim CALLER@???
Testing
****
-exim -d+all -qf
+exim -qf
****
killdaemon
exim -DSERVER=server -DNOTDAEMON -qf
