Re: [exim] Exim 4.94.2 - security update released (DANE fix)

Página superior
Eliminar este mensaje
Responder a este mensaje
Autor: Viktor Dukhovni
Fecha:  
A: Heiko Schlittermann
Cc: exim-users
Temas antiguos: [exim] Exim 4.94.2 - security update released
Asunto: Re: [exim] Exim 4.94.2 - security update released (DANE fix)

The DANE fix:

-            ob->tls_sni = sx->first_addr->domain;    /* force SNI */
+                       ob->tls_sni = sx->conn_args.host->name; /* force SNI */


replaces the recipient domain with the MX hostname.

When the MX host is a CNAME, is that necessarily the same as
the TLSA base domain?

How does Exim handle MX hosts that are CNAMEs? Are fully
expanded (secure at every step, with fallback to the original
name) CNAMEs used for TLSA lookups (per RFC7672?)?

-- 
    Viktor.