X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/a7538db17824b7fd70c12ef7561a67b85d6f247e..be36e5721725253b7529899884d7fe8ecd5120b9:/doc/doc-txt/experimental-spec.txt diff --git a/doc/doc-txt/experimental-spec.txt b/doc/doc-txt/experimental-spec.txt index b98ac7929..e7a0d0668 100644 --- a/doc/doc-txt/experimental-spec.txt +++ b/doc/doc-txt/experimental-spec.txt @@ -762,8 +762,10 @@ b. Configure, somewhere before the DATA ACL, the control option to Transport post-delivery actions -------------------------------------------------------------- -An arbitrary per-transport string can be expanded on successful delivery, +An arbitrary per-transport string can be expanded upon various transport events and (for SMTP transports) a second string on deferrals caused by a host error. +Additionally a main-section configuration option can be expanded on some +per-message events. This feature may be used, for example, to write exim internal log information (not available otherwise) into a database. @@ -773,18 +775,23 @@ EXPERIMENTAL_TPDA=yes in your Local/Makefile -and define the tpda_event_action option in the transport, to -be expanded when the event fires. +and define one or both of +- the tpda_event_action option in the transport +- the delivery_event_action +to be expanded when the event fires. A new variable, $tpda_event, is set to the event type when the expansion is done. The current list of events is: - msg:delivery - msg:host:defer - tcp:connect - tcp:close - tls:cert - smtp:connect + msg:complete main per message + msg:delivery transport per recipient + msg:host:defer transport per attempt + msg:fail:delivery main per recipient + msg:fail:internal main per recipient + tcp:connect transport per connection + tcp:close transport per connection + tls:cert transport per certificate in verification chain + smtp:connect transport per connection The expansion is called for all event types, and should use the $tpda_event value to decide when to act. The variable data is a colon-separated @@ -800,7 +807,7 @@ content is event_dependent: The msg:host:defer event populates one extra variable, $tpda_defer_errno. -The following variables are likely to be useful for most event types: +The following variables are likely to be useful depending on the event type: router_name, transport_name local_part, domain @@ -808,6 +815,7 @@ The following variables are likely to be useful for most event types: tls_out_peercert lookup_dnssec_authenticated, tls_out_dane sending_ip_address, sending_port + message_exim_id An example might look like: @@ -823,13 +831,10 @@ tpda_event_action = ${if = {msg:delivery}{$tpda_event} \ '${quote_pgsql:$message_exim_id}')}} \ } {}} -The string is expanded after the delivery completes and any +The string is expanded for each of the supported events and any side-effects will happen. The result is then discarded. Note that for complex operations an ACL expansion can be used. -During the expansion the tpda_event variable will contain the -string-list "msg:delivery". - The expansion of the tpda_event_action option should normally return an empty string. Should it return anything else the @@ -837,6 +842,7 @@ following will be forced: msg:delivery (ignored) msg:host:defer (ignored) + msg:fail:delivery (ignored) tcp:connect do not connect tcp:close (ignored) tls:cert refuse verification @@ -1131,6 +1137,7 @@ in a router. Exim will then send the success DSN himself if requested as if the next hop does not support DSN. Adding it to a redirect router makes no difference. + Certificate name checking -------------------------------------------------------------- The X509 certificates used for TLS are supposed be verified @@ -1149,6 +1156,151 @@ a single wildcard being the initial component of a 3-or-more component FQDN). +DANE +------------------------------------------------------------ +DNS-based Authentication of Named Entities, as applied +to SMTP over TLS, provides assurance to a client that +it is actually talking to the server it wants to rather +than some attacker operating a Man In The Middle (MITM) +operation. The latter can terminate the TLS connection +you make, and make another one to the server (so both +you and the server still think you have an encrypted +connection) and, if one of the "well known" set of +Certificate Authorities has been suborned - something +which *has* been seen already (2014), a verifiable +certificate (if you're using normal root CAs, eg. the +Mozilla set, as your trust anchors). + +What DANE does is replace the CAs with the DNS as the +trust anchor. The assurance is limited to a) the possibility +that the DNS has been suborned, b) mistakes made by the +admins of the target server. The attack surface presented +by (a) is thought to be smaller than that of the set +of root CAs. + +It also allows the server to declare (implicitly) that +connections to it should use TLS. An MITM could simply +fail to pass on a server's STARTTLS. + +DANE scales better than having to maintain (and +side-channel communicate) copies of server certificates +for every possible target server. It also scales +(slightly) better than having to maintain on an SMTP +client a copy of the standard CAs bundle. It also +means not having to pay a CA for certificates. + +DANE requires a server operator to do three things: +1) run DNSSEC. This provides assurance to clients +that DNS lookups they do for the server have not +been tampered with. The domain MX record applying +to this server, its A record, its TLSA record and +any associated CNAME records must all be covered by +DNSSEC. +2) add TLSA DNS records. These say what the server +certificate for a TLS connection should be. +3) offer a server certificate, or certificate chain, +in TLS connections which is traceable to the one +defined by (one of?) the TSLA records + +There are no changes to Exim specific to server-side +operation of DANE. + +The TLSA record for the server may have "certificate +usage" of DANE-TA(2) or DANE-EE(3). The latter specifies +the End Entity directly, i.e. the certificate involved +is that of the server (and should be the sole one transmitted +during the TLS handshake); this is appropriate for a +single system, using a self-signed certificate. + DANE-TA usage is effectively declaring a specific CA +to be used; this might be a private CA or a public, +well-known one. A private CA at simplest is just +a self-signed certificate which is used to sign +cerver certificates, but running one securely does +require careful arrangement. If a private CA is used +then either all clients must be primed with it, or +(probably simpler) the server TLS handshake must transmit +the entire certificate chain from CA to server-certificate. +If a public CA is used then all clients must be primed with it +(losing one advantage of DANE) - but the attack surface is +reduced from all public CAs to that single CA. +DANE-TA is commonly used for several services and/or +servers, each having a TLSA query-domain CNAME record, +all of which point to a single TLSA record. + +The TLSA record should have a Selector field of SPKI(1) +and a Matching Type field of SHA2-512(2). + +At the time of writing, https://www.huque.com/bin/gen_tlsa +is useful for quickly generating TLSA records; and commands like + + openssl x509 -in -pubkey -noout /dev/null \ + | openssl sha512 \ + | awk '{print $2}' + +are workable for 4th-field hashes. + +For use with the DANE-TA model, server certificates +must have a correct name (SubjectName or SubjectAltName). + +The use of OCSP-stapling should be considered, allowing +for fast revocation of certificates (which would otherwise +be limited by the DNS TTL on the TLSA records). However, +this is likely to only be usable with DANE-TA. NOTE: the +default of requesting OCSP for all hosts is modified iff +DANE is in use, to: + + hosts_request_ocsp = ${if or { {= {0}{$tls_out_tlsa_usage}} \ + {= {4}{$tls_out_tlsa_usage}} } \ + {*}{}} + +The (new) variable $tls_out_tlsa_usage is a bitfield with +numbered bits set for TLSA record usage codes. +The zero above means DANE was not in use, +the four means that only DANE-TA usage TLSA records were +found. If the definition of hosts_request_ocsp includes the +string "tls_out_tlsa_usage", they are re-expanded in time to +control the OCSP request. + +This modification of hosts_request_ocsp is only done if +it has the default value of "*". Admins who change it, and +those who use hosts_require_ocsp, should consider the interaction +with DANE in their OCSP settings. + + +For client-side DANE there are two new smtp transport options, +hosts_try_dane and hosts_require_dane. They do the obvious thing. +[ should they be domain-based rather than host-based? ] + +DANE will only be usable if the target host has DNSSEC-secured +MX, A and TLSA records. + +A TLSA lookup will be done if either of the above options match +and the host-lookup succeded using dnssec. +If the TLSA lookup succeeds, a TLS connection will be required +for the host. + +(TODO: specify when fallback happens vs. when the host is not used) + +If dane is in use the following transport options are ignored: + hosts_require_tls + tls_verify_hosts + tls_try_verify_hosts + tls_verify_certificates + tls_crl + tls_verify_cert_hostnames + +Currently dnssec_request_domains must be active (need to think about that) +and dnssec_require_domains is ignored. + +If verification was successful using DANE then the "CV" item +in the delivery log line will show as "CV=dane". + +There is a new variable $tls_out_dane which will have "yes" if +verification succeeded using DANE and "no" otherwise (only useful +in combination with EXPERIMENTAL_TPDA), and a new variable +$tls_out_tlsa_usage (detailed above). + -------------------------------------------------------------- End of file