Verifiable conn with DANE-EE(3) / SPKI(1) / SHA2-512(2)

diff --git a/DANE-draft-notes b/DANE-draft-notes
new file mode 100644 (file)
index 0000000..21b3992
--- /dev/null
+++ b/DANE-draft-notes
@@ -0,0 +1,11 @@
+
+draft 11
+
+3.1.2 - Para 4 (records with Sel Full(0) are discouraged)
+==> There's a matching type Full but not such a Selector type.
+    Should this be "Cert(0), or Matching Type Full(0)" ?
+    Suspect the latter.
+
+3.1.2 Needs a para added regarding certificate date verification,
+    to contrast with the requirement to NOT check for
+    DANE-EE defined in 3.1.1

diff --git a/doc/doc-txt/experimental-spec.txt b/doc/doc-txt/experimental-spec.txt
index 6eeb5092c935874389ef975e69912d28ba2dc152..f1414287d64aa64fdf3a6124b6f4350827a2e557 100644 (file)
--- a/doc/doc-txt/experimental-spec.txt
+++ b/doc/doc-txt/experimental-spec.txt
@@ -1181,7 +1181,10 @@ means not having to pay a CA for certificates.
 DANE requires a server operator to do three things:
 1) run DNSSEC.  This provides assurance to clients
 that DNS lookups they do for the server have not
-been tampered with.
+been tampered with.  The domain MX record applying
+to this server, its A record, its TLSA record and
+any associated CNAME records must all be covered by
+DNSSEC.
 2) add TLSA DNS records.  These say what the server
 certificate for a TLS connection should be.
 3) offer a server certificate, or certificate chain,
@@ -1214,7 +1217,17 @@ servers, each having a TLSA query-domain CNAME record,
 all of which point to a single TLSA record.
 
 The TLSA record should have a Selector field of SPKI(1)
-and a Matching Type fiels of SHA2-512(2).
+and a Matching Type field of SHA2-512(2).
+
+At the time of writing, https://www.huque.com/bin/gen_tlsa
+is useful for quickly generating TLSA records; and commands like
+
+  openssl x509 -in -pubkey -noout <certificate.pem \
+  | openssl rsa -outform der -pubin 2>/dev/null \
+  | openssl sha512 \
+  | awk '{print $2}'
+
+are workable for 4th-field hashes.
 
 For use with the DANE_TA model, server certificates
 must have a correct name (SubjectName or SubjectAltName).

diff --git a/src/src/dane-openssl.c b/src/src/dane-openssl.c
index 4f90caa4a07647064df1f7b2079169abbc65d8e1..aab32cabd3618cd4f450f7bea2a3cfd6b1e9ee8a 100644 (file)
--- a/src/src/dane-openssl.c
+++ b/src/src/dane-openssl.c
@@ -859,7 +859,7 @@ X509 *cert = ctx->cert;             /* XXX: accessor? */
 int matched = 0;
 int chain_length = sk_X509_num(ctx->chain);
 
-DEBUG(D_tls) debug_printf("Dane library verify_chain fn called\n");
+DEBUG(D_tls) debug_printf("Dane verify_chain\n");
 
 issuer_rrs = dane->selectors[SSL_DANE_USAGE_LIMIT_ISSUER];
 leaf_rrs = dane->selectors[SSL_DANE_USAGE_LIMIT_LEAF];
@@ -952,7 +952,7 @@ int (*cb)(int, X509_STORE_CTX *) = ctx->verify_cb;
 int matched;
 X509 *cert = ctx->cert;             /* XXX: accessor? */
 
-DEBUG(D_tls) debug_printf("Dane library verify_cert fn called\n");
+DEBUG(D_tls) debug_printf("Dane verify_cert\n");
 
 if(ssl_idx < 0)
   ssl_idx = SSL_get_ex_data_X509_STORE_CTX_idx();

diff --git a/src/src/tls-openssl.c b/src/src/tls-openssl.c
index 70ac63f16bee0c286133a1469edf126eea00b715..0014034944934106832a2de0f2f4bec89c0e598a 100644 (file)
--- a/src/src/tls-openssl.c
+++ b/src/src/tls-openssl.c
@@ -1796,8 +1796,8 @@ if (dane)
       {
       default: /* log bad */ return FAIL;
       case 0:  mdname = NULL; break;
-      case 1:  mdname = "SHA2-256"; break;
-      case 2:  mdname = "SHA2-512"; break;
+      case 1:  mdname = "sha256"; break;
+      case 2:  mdname = "sha512"; break;
       }
 
     switch (DANESSL_add_tlsa(client_ssl,

diff --git a/test/confs/5850 b/test/confs/5850
index 0b132e29e26a712dfa00115a94a9399c1d4d27f7..cd4ccc59f25c5668af69e2c5d5859c066778942e 100644 (file)
--- a/test/confs/5850
+++ b/test/confs/5850
@@ -26,10 +26,7 @@ tls_advertise_hosts = *
 # Set certificate only if server
 
 tls_certificate = ${if eq {SERVER}{server}{DIR/aux-fixed/cert1}fail}
-tls_privatekey = ${if eq {SERVER}{server}{DIR/aux-fixed/cert1}fail}
-
-#tls_verify_hosts = *
-#tls_verify_certificates = ${if eq {SERVER}{server}{DIR/aux-fixed/cert2}fail}
+#tls_privatekey = ${if eq {SERVER}{server}{DIR/aux-fixed/cert1}fail}
 
 
 # ----- Routers -----
@@ -39,7 +36,6 @@ begin routers
 client:
   driver = dnslookup
   condition = ${if eq {SERVER}{server}{no}{yes}}
-#  retry_use_local_part
   dnssec_request_domains = *
   self = send
   transport = send_to_server
@@ -56,11 +52,7 @@ begin transports
 send_to_server:
   driver = smtp
   allow_localhost
-#  hosts = 127.0.0.1
   port = PORT_D
-#  tls_certificate = DIR/aux-fixed/cert2
-#  tls_privatekey = DIR/aux-fixed/cert2
-#  tls_verify_certificates = DIR/aux-fixed/cert2
 
 #  hosts_try_dane = *
   hosts_require_dane = *

diff --git a/test/dnszones-src/db.test.ex b/test/dnszones-src/db.test.ex
index bd334918bd5dcefed22b8444fca66ce3f4d5def2..fed44daf94e139cb6f27ef3cfd0748f0de3bf8a1 100644 (file)
--- a/test/dnszones-src/db.test.ex
+++ b/test/dnszones-src/db.test.ex
@@ -82,7 +82,7 @@ v6           AAAA    V6NET:ffff:836f:0a00:000a:0800:200a:c032
 DNSSEC eximtesthost     A       HOSTIPV4
 alias-eximtesthost CNAME eximtesthost.test.ex.
 
-DNSSEC _1225._tcp.eximtesthost TLSA    3 1 2 f000baaa
+DNSSEC _1225._tcp.eximtesthost TLSA    3 1 2 3d5eb81b1dfc3f93c1fa8819e3fb3fdb41bb590441d5f3811db17772f4bc6de29bdd7c4f4b723750dda871b99379192b3f979f03db1252c4f08b03ef7176528d
 
 ; A bad CNAME
 

diff --git a/test/log/5850 b/test/log/5850
index e8b37bb61f7d3230304b028570b5f461a8380f4c..aad1ade988f19d2c6f700d61ee4b3446cbcb2057 100644 (file)
--- a/test/log/5850
+++ b/test/log/5850
@@ -1,14 +1,13 @@
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
-1999-03-02 09:44:33 10HmaX-0005vi-00 TLS error on connection to eximtesthost.test.ex [ip4.ip4.ip4.ip4] (tlsa load): error:8006C067:DANE library:func(108):Bad TLSA record digest
-1999-03-02 09:44:33 10HmaX-0005vi-00 == CALLER@mxplain.test.ex R=client T=send_to_server defer (-37): failure while setting up TLS session
+1999-03-02 09:44:33 10HmaX-0005vi-00 => CALLER@mxplain.test.ex R=client T=send_to_server H=eximtesthost.test.ex [ip4.ip4.ip4.ip4] X=TLSv1:AES256-SHA:256 DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmaY-0005vi-00"
+1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
 
 ******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
-1999-03-02 09:44:33 TLS error on connection from the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] (SSL_accept): error: <<detail omitted>>
-1999-03-02 09:44:33 TLS client disconnected cleanly (rejected our certificate?)
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex H=the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] P=esmtps X=TLSv1:AES256-SHA:256 S=sss id=E10HmaX-0005vi-00@myhost.test.ex
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
-1999-03-02 09:44:33 10HmaX-0005vi-00 => :blackhole: <CALLER@mxplain.test.ex> R=server
-1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <CALLER@mxplain.test.ex> R=server
+1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf

diff --git a/test/scripts/5850-DANE-OpenSSL/5850 b/test/scripts/5850-DANE-OpenSSL/5850
index 963bf4f4e36f7ed8858f9c91620adc9b3a4c295a..449a75bf640d8d63074e506fa60d9d9c02805519 100644 (file)
--- a/test/scripts/5850-DANE-OpenSSL/5850
+++ b/test/scripts/5850-DANE-OpenSSL/5850
@@ -2,10 +2,11 @@
 #
 exim -DSERVER=server -bd -oX PORT_D
 ****
+# TLSA (3 1 2)
 exim CALLER@mxplain.test.ex
 Testing
 ****
-exim -d+all -qf
+exim -qf
 ****
 killdaemon
 exim -DSERVER=server -DNOTDAEMON -qf