Change the default for hosts_try_dane, enabling use by default

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 39757a1565ee4ac2d8b3eb2801c87f66593173c4..856bb0c15756ecc8516effb496a9461eb446eaa5 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -24696,7 +24696,7 @@ This option provides a list of servers to which, provided they announce
 CHUNKING support, Exim will attempt to use BDAT commands rather than DATA.
 BDAT will not be used in conjunction with a transport filter.
 
 CHUNKING support, Exim will attempt to use BDAT commands rather than DATA.
 BDAT will not be used in conjunction with a transport filter.
 

-.option hosts_try_dane smtp "host list&!!" unset
+.option hosts_try_dane smtp "host list&!!" *

 .cindex DANE "transport options"
 .cindex DANE "attempting for certain servers"
 If built with DANE support, Exim  will lookup a
 .cindex DANE "transport options"
 .cindex DANE "attempting for certain servers"
 If built with DANE support, Exim  will lookup a

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 065ec2812167d88272daea005f5c26623104002f..789593ab3a479fa2b68606c4df701ef1a4767700 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -107,6 +107,10 @@ JH/21 The smtp transport option "hosts_noproxy_tls" is now unset by default.
       for multiple message deliveries, by default.  Previoud the default was to
       not do so.
 
       for multiple message deliveries, by default.  Previoud the default was to
       not do so.
 

+JH/22 The smtp transport option "hosts_try_dane" now enables all hosts by
+      default.  If built with the facility, DANE will be used.  The facility is
+      now enabled in the prototype build Makefile "EDITME".
+

 
 
 Exim version 4.92
 
 
 Exim version 4.92

diff --git a/src/src/EDITME b/src/src/EDITME
index dea4e4cf834b74b611518c9b2aa8a48b198ac45a..415f021ee7f73aeb11abda8e6e0886cdd87cf3d1 100644 (file)
--- a/src/src/EDITME
+++ b/src/src/EDITME
@@ -367,10 +367,10 @@ PCRE_CONFIG=yes
 
 
 #------------------------------------------------------------------------------
 
 
 #------------------------------------------------------------------------------

-# Uncomment the following line to add DANE support
+# Comment out the following line to remove DANE support

 # Note: Enabling this unconditionally overrides DISABLE_DNSSEC
 # For DANE under GnuTLS we need an additional library.  See TLS_LIBS below.
 # Note: Enabling this unconditionally overrides DISABLE_DNSSEC
 # For DANE under GnuTLS we need an additional library.  See TLS_LIBS below.

-# SUPPORT_DANE=yes
+SUPPORT_DANE=yes

 
 #------------------------------------------------------------------------------
 # Additional libraries and include directories may be required for some
 
 #------------------------------------------------------------------------------
 # Additional libraries and include directories may be required for some

diff --git a/src/src/transports/smtp.c b/src/src/transports/smtp.c
index 041ed9393c4d0cf0cdcd9dca5938f64f24de67e2..3d7aaae6b587aade512cf30b851ed334e262114d 100644 (file)
--- a/src/src/transports/smtp.c
+++ b/src/src/transports/smtp.c
@@ -240,7 +240,7 @@ smtp_transport_options_block smtp_transport_option_defaults = {
   .hosts_require_auth =                NULL,
   .hosts_try_chunking =                US"*",
 #ifdef SUPPORT_DANE
   .hosts_require_auth =                NULL,
   .hosts_try_chunking =                US"*",
 #ifdef SUPPORT_DANE

-  .hosts_try_dane =            NULL,
+  .hosts_try_dane =            US"*",

   .hosts_require_dane =                NULL,
   .dane_require_tls_ciphers =  NULL,
 #endif
   .hosts_require_dane =                NULL,
   .dane_require_tls_ciphers =  NULL,
 #endif

diff --git a/test/confs/5820 b/test/confs/5820
index bcb1a8f34e22f11bbc301bc07930bba7465343d7..b038558deb02162499b77c3519100091e9a354f4 100644 (file)
--- a/test/confs/5820
+++ b/test/confs/5820
@@ -2,6 +2,7 @@
 # DANE/GnuTLS
 
 SERVER=
 # DANE/GnuTLS
 
 SERVER=

+CONTROL= *

 
 .include DIR/aux-var/tls_conf_prefix
 
 
 .include DIR/aux-var/tls_conf_prefix
 


@@ -66,7 +67,7 @@ send_to_server:
   allow_localhost
   port = PORT_D
 
   allow_localhost
   port = PORT_D
 

-  hosts_try_dane =     *
+  hosts_try_dane =     CONTROL

   hosts_require_dane = HOSTIPV4
   tls_verify_cert_hostnames = ${if eq {OPT}{no_certname} {}{*}}
   tls_try_verify_hosts = thishost.test.ex
   hosts_require_dane = HOSTIPV4
   tls_verify_cert_hostnames = ${if eq {OPT}{no_certname} {}{*}}
   tls_try_verify_hosts = thishost.test.ex

diff --git a/test/confs/5840 b/test/confs/5840
index 407846a8a9bd723afeacea39657c31fcf902120d..bda328a97668c59549503817150f16d24cd4b367 100644 (file)
--- a/test/confs/5840
+++ b/test/confs/5840
@@ -2,6 +2,7 @@
 # DANE/OpenSSL
 
 SERVER=
 # DANE/OpenSSL
 
 SERVER=

+CONTROL= *

 
 .include DIR/aux-var/tls_conf_prefix
 
 
 .include DIR/aux-var/tls_conf_prefix
 


@@ -71,7 +72,7 @@ send_to_server:
   allow_localhost
   port = PORT_D
 
   allow_localhost
   port = PORT_D
 

-  hosts_try_dane =     *
+  hosts_try_dane =     CONTROL

   hosts_require_dane = HOSTIPV4
   tls_verify_cert_hostnames = ${if eq {OPT}{no_certname} {}{*}}
   tls_try_verify_hosts = thishost.test.ex
   hosts_require_dane = HOSTIPV4
   tls_verify_cert_hostnames = ${if eq {OPT}{no_certname} {}{*}}
   tls_try_verify_hosts = thishost.test.ex

diff --git a/test/log/5820 b/test/log/5820
index 8b6cd5f4d8449da4d4944bddf904992526ea6f50..4952d8337cf29c366e3d41e4115d378eb7886f94 100644 (file)
--- a/test/log/5820
+++ b/test/log/5820
@@ -68,6 +68,9 @@
 1999-03-02 09:44:33 10HmbZ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@danebroken8.example.com
 1999-03-02 09:44:33 10HmbZ-0005vi-00 => CALLER@danebroken8.example.com R=client T=send_to_server H=danebroken8.example.com [127.0.0.1] X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=dane DN="CN=server1.example.net" C="250 OK id=10HmcA-0005vi-00"
 1999-03-02 09:44:33 10HmbZ-0005vi-00 Completed
 1999-03-02 09:44:33 10HmbZ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@danebroken8.example.com
 1999-03-02 09:44:33 10HmbZ-0005vi-00 => CALLER@danebroken8.example.com R=client T=send_to_server H=danebroken8.example.com [127.0.0.1] X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=dane DN="CN=server1.example.net" C="250 OK id=10HmcA-0005vi-00"
 1999-03-02 09:44:33 10HmbZ-0005vi-00 Completed

+1999-03-02 09:44:33 10HmcB-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@danebroken2.test.ex
+1999-03-02 09:44:33 10HmcB-0005vi-00 => CALLER@danebroken2.test.ex R=client T=send_to_server H=danebroken2.test.ex [127.0.0.1] X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no DN="CN=server1.example.com" C="250 OK id=10HmcC-0005vi-00"
+1999-03-02 09:44:33 10HmcB-0005vi-00 Completed

 
 ******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port PORT_D
 
 ******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port PORT_D


@@ -123,3 +126,8 @@
 1999-03-02 09:44:33 10HmcA-0005vi-00 <= <> H=localhost (myhost.test.ex) [127.0.0.1] P=esmtps X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no S=sss id=E10HmbZ-0005vi-00@myhost.test.ex for CALLER@danebroken8.example.com
 1999-03-02 09:44:33 10HmcA-0005vi-00 => :blackhole: <CALLER@danebroken8.example.com> R=server
 1999-03-02 09:44:33 10HmcA-0005vi-00 Completed
 1999-03-02 09:44:33 10HmcA-0005vi-00 <= <> H=localhost (myhost.test.ex) [127.0.0.1] P=esmtps X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no S=sss id=E10HmbZ-0005vi-00@myhost.test.ex for CALLER@danebroken8.example.com
 1999-03-02 09:44:33 10HmcA-0005vi-00 => :blackhole: <CALLER@danebroken8.example.com> R=server
 1999-03-02 09:44:33 10HmcA-0005vi-00 Completed

+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port PORT_D
+1999-03-02 09:44:33 "rcpt ACL"
+1999-03-02 09:44:33 10HmcC-0005vi-00 <= <> H=localhost (myhost.test.ex) [127.0.0.1] P=esmtps X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no S=sss id=E10HmcB-0005vi-00@myhost.test.ex for CALLER@danebroken2.test.ex
+1999-03-02 09:44:33 10HmcC-0005vi-00 => :blackhole: <CALLER@danebroken2.test.ex> R=server
+1999-03-02 09:44:33 10HmcC-0005vi-00 Completed

diff --git a/test/log/5840 b/test/log/5840
index 3cbc7d8bb05963164121f9290272f3e799051bec..581a19ba0d8f95f0bc1b468c739d68c726bf8f64 100644 (file)
--- a/test/log/5840
+++ b/test/log/5840
@@ -68,6 +68,9 @@
 1999-03-02 09:44:33 10HmbZ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@danebroken8.example.com
 1999-03-02 09:44:33 10HmbZ-0005vi-00 => CALLER@danebroken8.example.com R=client T=send_to_server H=danebroken8.example.com [127.0.0.1] X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=dane DN="/CN=server1.example.net" C="250 OK id=10HmcA-0005vi-00"
 1999-03-02 09:44:33 10HmbZ-0005vi-00 Completed
 1999-03-02 09:44:33 10HmbZ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@danebroken8.example.com
 1999-03-02 09:44:33 10HmbZ-0005vi-00 => CALLER@danebroken8.example.com R=client T=send_to_server H=danebroken8.example.com [127.0.0.1] X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=dane DN="/CN=server1.example.net" C="250 OK id=10HmcA-0005vi-00"
 1999-03-02 09:44:33 10HmbZ-0005vi-00 Completed

+1999-03-02 09:44:33 10HmcB-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@danebroken2.test.ex
+1999-03-02 09:44:33 10HmcB-0005vi-00 => CALLER@danebroken2.test.ex R=client T=send_to_server H=danebroken2.test.ex [127.0.0.1] X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no DN="/CN=server1.example.com" C="250 OK id=10HmcC-0005vi-00"
+1999-03-02 09:44:33 10HmcB-0005vi-00 Completed

 
 ******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port PORT_D
 
 ******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port PORT_D


@@ -124,3 +127,8 @@
 1999-03-02 09:44:33 10HmcA-0005vi-00 <= <> H=localhost (myhost.test.ex) [127.0.0.1] P=esmtps X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no S=sss id=E10HmbZ-0005vi-00@myhost.test.ex for CALLER@danebroken8.example.com
 1999-03-02 09:44:33 10HmcA-0005vi-00 => :blackhole: <CALLER@danebroken8.example.com> R=server
 1999-03-02 09:44:33 10HmcA-0005vi-00 Completed
 1999-03-02 09:44:33 10HmcA-0005vi-00 <= <> H=localhost (myhost.test.ex) [127.0.0.1] P=esmtps X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no S=sss id=E10HmbZ-0005vi-00@myhost.test.ex for CALLER@danebroken8.example.com
 1999-03-02 09:44:33 10HmcA-0005vi-00 => :blackhole: <CALLER@danebroken8.example.com> R=server
 1999-03-02 09:44:33 10HmcA-0005vi-00 Completed

+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port PORT_D
+1999-03-02 09:44:33 "rcpt ACL"
+1999-03-02 09:44:33 10HmcC-0005vi-00 <= <> H=localhost (myhost.test.ex) [127.0.0.1] P=esmtps X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no S=sss id=E10HmcB-0005vi-00@myhost.test.ex for CALLER@danebroken2.test.ex
+1999-03-02 09:44:33 10HmcC-0005vi-00 => :blackhole: <CALLER@danebroken2.test.ex> R=server
+1999-03-02 09:44:33 10HmcC-0005vi-00 Completed

diff --git a/test/scripts/5820-DANE-GnuTLS/5820 b/test/scripts/5820-DANE-GnuTLS/5820
index d7824a38c431a2b59f6372173c2de8412c278b60..4b5f9dd877e0158515b174a7233cd4359e674363 100644 (file)
--- a/test/scripts/5820-DANE-GnuTLS/5820
+++ b/test/scripts/5820-DANE-GnuTLS/5820
@@ -103,7 +103,7 @@ Testing
 ****
 #
 ### A server with a mixed-usage set of TLSAs - the EE-mode one failing verify (should deliver, DANE-mode)
 ****
 #
 ### A server with a mixed-usage set of TLSAs - the EE-mode one failing verify (should deliver, DANE-mode)

-# that way round to excersize more code in the implementation
+# that way round to exercise more code in the implementation

 exim -odf CALLER@danemixed.test.ex
 Testing
 ****
 exim -odf CALLER@danemixed.test.ex
 Testing
 ****


@@ -123,6 +123,15 @@ Testing
 exim -odf CALLER@danebroken8.example.com
 Testing
 ****
 exim -odf CALLER@danebroken8.example.com
 Testing
 ****

+killdaemon
+#

 #
 #

+sudo rm DIR/spool/db/retry
+exim -DSERVER=server -DDETAILS=ca -bd -oX PORT_D
+****
+### A server securely serving a wrong TLSA record, dane not requested (delivery should work non-dane)
+exim -odf -DCONTROL=: CALLER@danebroken2.test.ex
+****

 killdaemon
 killdaemon

+#

 no_msglog_check
 no_msglog_check

diff --git a/test/scripts/5840-DANE-OpenSSL/5840 b/test/scripts/5840-DANE-OpenSSL/5840
index 4d88131eac4eb0e593abf5ace1354e0e8cd5dce9..f988cd1cdfe9daf62976c50c677290ac3a0bdb9d 100644 (file)
--- a/test/scripts/5840-DANE-OpenSSL/5840
+++ b/test/scripts/5840-DANE-OpenSSL/5840
@@ -2,11 +2,11 @@
 #
 exim -DSERVER=server -DDETAILS=ee -bd -oX PORT_D
 ****
 #
 exim -DSERVER=server -DDETAILS=ee -bd -oX PORT_D
 ****

-### TLSA (3 1 1)
+### TLSA (3 1 1) (DANE-EE SPKI SHA2-256)

 exim -odq CALLER@dane256ee.test.ex
 Testing
 ****
 exim -odq CALLER@dane256ee.test.ex
 Testing
 ****

-### TLSA (3 1 2)
+### TLSA (3 1 2) (            SHA2-512)

 exim -odq CALLER@mxdane512ee.test.ex
 Testing
 ****
 exim -odq CALLER@mxdane512ee.test.ex
 Testing
 ****


@@ -24,7 +24,7 @@ killdaemon
 #
 exim -DSERVER=server -DDETAILS=ta -bd -oX PORT_D
 ****
 #
 exim -DSERVER=server -DDETAILS=ta -bd -oX PORT_D
 ****

-### TLSA (2 0 1)
+### TLSA (2 0 1) (DANE-TA CERT SHA2-256)

 exim -odf CALLER@mxdane256ta.test.ex
 Testing
 ****
 exim -odf CALLER@mxdane256ta.test.ex
 Testing
 ****


@@ -111,8 +111,9 @@ Testing
 ****
 #
 killdaemon
 ****
 #
 killdaemon

-
-
+#
+#
+#

 ### A server with a name not matching the cert.  TA-mode; should fail
 exim -DSERVER=server -DDETAILS=cert.net -bd -oX PORT_D
 ****
 ### A server with a name not matching the cert.  TA-mode; should fail
 exim -DSERVER=server -DDETAILS=cert.net -bd -oX PORT_D
 ****


@@ -124,6 +125,15 @@ Testing
 exim -odf CALLER@danebroken8.example.com
 Testing
 ****
 exim -odf CALLER@danebroken8.example.com
 Testing
 ****

+killdaemon
+#

 #
 #

+sudo rm DIR/spool/db/retry
+exim -DSERVER=server -DDETAILS=ca -bd -oX PORT_D
+****
+### A server securely serving a wrong TLSA record, dane not requested (delivery should work non-dane)
+exim -odf -DCONTROL=: CALLER@danebroken2.test.ex
+****

 killdaemon
 killdaemon

+#

 no_msglog_check
 no_msglog_check

diff --git a/test/stderr/5820 b/test/stderr/5820
index 84005afe3c247041defd7312e5849bf152698cc3..f218f0c519c8f7fcce19cdec306ada38ba88b889 100644 (file)
--- a/test/stderr/5820
+++ b/test/stderr/5820
@@ -9,7 +9,7 @@
 >>> host in helo_verify_hosts? no (option unset)
 >>> host in helo_try_verify_hosts? no (option unset)
 >>> host in helo_accept_junk_hosts? no (option unset)
 >>> host in helo_verify_hosts? no (option unset)
 >>> host in helo_try_verify_hosts? no (option unset)
 >>> host in helo_accept_junk_hosts? no (option unset)

->>> processing "accept" (TESTSUITE/test-config 85)
+>>> processing "accept" (TESTSUITE/test-config 86)

 >>> check verify = recipient/callout
 >>> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 >>> routing rcptuser@dane256ee.test.ex
 >>> check verify = recipient/callout
 >>> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 >>> routing rcptuser@dane256ee.test.ex


@@ -80,6 +80,7 @@ LOG: unexpected disconnection while reading SMTP command from [127.0.0.1] D=qqs
 ### A server with a mixed-usage set of TLSAs - the EE-mode one failing verify (should deliver, DANE-mode)
 ### A server with a name not matching the cert.  TA-mode; should fail
 ### A server with a name not matching the cert.  EE-mode; should deliver and claim DANE mode
 ### A server with a mixed-usage set of TLSAs - the EE-mode one failing verify (should deliver, DANE-mode)
 ### A server with a name not matching the cert.  TA-mode; should fail
 ### A server with a name not matching the cert.  EE-mode; should deliver and claim DANE mode

+### A server securely serving a wrong TLSA record, dane not requested (delivery should work non-dane)

 
 ******** SERVER ********
 ### TLSA (3 1 1) (DANE-EE SPKI SHA2-256)
 
 ******** SERVER ********
 ### TLSA (3 1 1) (DANE-EE SPKI SHA2-256)


@@ -102,3 +103,4 @@ LOG: unexpected disconnection while reading SMTP command from [127.0.0.1] D=qqs
 ### A server with a mixed-usage set of TLSAs - the EE-mode one failing verify (should deliver, DANE-mode)
 ### A server with a name not matching the cert.  TA-mode; should fail
 ### A server with a name not matching the cert.  EE-mode; should deliver and claim DANE mode
 ### A server with a mixed-usage set of TLSAs - the EE-mode one failing verify (should deliver, DANE-mode)
 ### A server with a name not matching the cert.  TA-mode; should fail
 ### A server with a name not matching the cert.  EE-mode; should deliver and claim DANE mode

+### A server securely serving a wrong TLSA record, dane not requested (delivery should work non-dane)

diff --git a/test/stderr/5840 b/test/stderr/5840
index 6a2b6e209657856d5cb8c58a5eb1c4eb8c93a9f9..0991dc695a9a9f92cb17560a99ef5d59b9f34fd5 100644 (file)
--- a/test/stderr/5840
+++ b/test/stderr/5840
@@ -1,5 +1,5 @@
-### TLSA (3 1 1)
-### TLSA (3 1 2)
+### TLSA (3 1 1) (DANE-EE SPKI SHA2-256)
+### TLSA (3 1 2) (            SHA2-512)

 ### Recipient callout
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 ### Recipient callout
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)


@@ -9,7 +9,7 @@
 >>> host in helo_verify_hosts? no (option unset)
 >>> host in helo_try_verify_hosts? no (option unset)
 >>> host in helo_accept_junk_hosts? no (option unset)
 >>> host in helo_verify_hosts? no (option unset)
 >>> host in helo_try_verify_hosts? no (option unset)
 >>> host in helo_accept_junk_hosts? no (option unset)

->>> processing "accept" (TESTSUITE/test-config 90)
+>>> processing "accept" (TESTSUITE/test-config 91)

 >>> check verify = recipient/callout
 >>> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 >>> routing rcptuser@dane256ee.test.ex
 >>> check verify = recipient/callout
 >>> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 >>> routing rcptuser@dane256ee.test.ex


@@ -63,7 +63,7 @@
 >>> accept: condition test succeeded in inline ACL
 >>> end of inline ACL: ACCEPT
 LOG: unexpected disconnection while reading SMTP command from [127.0.0.1] D=qqs
 >>> accept: condition test succeeded in inline ACL
 >>> end of inline ACL: ACCEPT
 LOG: unexpected disconnection while reading SMTP command from [127.0.0.1] D=qqs

-### TLSA (2 0 1)
+### TLSA (2 0 1) (DANE-TA CERT SHA2-256)

 ### TLSA (2 1 1)
 ### A server with a nonverifying cert and no TLSA
 ### A server with a verifying cert and no TLSA
 ### TLSA (2 1 1)
 ### A server with a nonverifying cert and no TLSA
 ### A server with a verifying cert and no TLSA


@@ -80,12 +80,13 @@ LOG: unexpected disconnection while reading SMTP command from [127.0.0.1] D=qqs
 ### A server insecurely serving a good A record, dane required (delivery should fail)
 ### A server with a name not matching the cert.  TA-mode; should fail
 ### A server with a name not matching the cert.  EE-mode; should deliver and claim DANE mode
 ### A server insecurely serving a good A record, dane required (delivery should fail)
 ### A server with a name not matching the cert.  TA-mode; should fail
 ### A server with a name not matching the cert.  EE-mode; should deliver and claim DANE mode

+### A server securely serving a wrong TLSA record, dane not requested (delivery should work non-dane)

 
 ******** SERVER ********
 
 ******** SERVER ********

-### TLSA (3 1 1)
-### TLSA (3 1 2)
+### TLSA (3 1 1) (DANE-EE SPKI SHA2-256)
+### TLSA (3 1 2) (            SHA2-512)

 ### Recipient callout
 ### Recipient callout

-### TLSA (2 0 1)
+### TLSA (2 0 1) (DANE-TA CERT SHA2-256)

 ### TLSA (2 1 1)
 ### A server with a nonverifying cert and no TLSA
 ### A server with a verifying cert and no TLSA
 ### TLSA (2 1 1)
 ### A server with a nonverifying cert and no TLSA
 ### A server with a verifying cert and no TLSA


@@ -102,3 +103,4 @@ LOG: unexpected disconnection while reading SMTP command from [127.0.0.1] D=qqs
 ### A server insecurely serving a good A record, dane required (delivery should fail)
 ### A server with a name not matching the cert.  TA-mode; should fail
 ### A server with a name not matching the cert.  EE-mode; should deliver and claim DANE mode
 ### A server insecurely serving a good A record, dane required (delivery should fail)
 ### A server with a name not matching the cert.  TA-mode; should fail
 ### A server with a name not matching the cert.  EE-mode; should deliver and claim DANE mode

+### A server securely serving a wrong TLSA record, dane not requested (delivery should work non-dane)

diff --git a/test/stdout/5820 b/test/stdout/5820
index 4b26b4c794e911f56efc2e9b5b0c70faee789b30..acaec1415bac652bbc0ad689b3e47b616785703f 100644 (file)
--- a/test/stdout/5820
+++ b/test/stdout/5820
@@ -27,6 +27,7 @@
 ### A server with a mixed-usage set of TLSAs - the EE-mode one failing verify (should deliver, DANE-mode)
 ### A server with a name not matching the cert.  TA-mode; should fail
 ### A server with a name not matching the cert.  EE-mode; should deliver and claim DANE mode
 ### A server with a mixed-usage set of TLSAs - the EE-mode one failing verify (should deliver, DANE-mode)
 ### A server with a name not matching the cert.  TA-mode; should fail
 ### A server with a name not matching the cert.  EE-mode; should deliver and claim DANE mode

+### A server securely serving a wrong TLSA record, dane not requested (delivery should work non-dane)

 
 ******** SERVER ********
 ### TLSA (3 1 1) (DANE-EE SPKI SHA2-256)
 
 ******** SERVER ********
 ### TLSA (3 1 1) (DANE-EE SPKI SHA2-256)


@@ -49,3 +50,4 @@
 ### A server with a mixed-usage set of TLSAs - the EE-mode one failing verify (should deliver, DANE-mode)
 ### A server with a name not matching the cert.  TA-mode; should fail
 ### A server with a name not matching the cert.  EE-mode; should deliver and claim DANE mode
 ### A server with a mixed-usage set of TLSAs - the EE-mode one failing verify (should deliver, DANE-mode)
 ### A server with a name not matching the cert.  TA-mode; should fail
 ### A server with a name not matching the cert.  EE-mode; should deliver and claim DANE mode

+### A server securely serving a wrong TLSA record, dane not requested (delivery should work non-dane)

diff --git a/test/stdout/5840 b/test/stdout/5840
index 947f802a7cce6998e6976386a98f00671d3e1504..e6bd55bf90a4bb0502318699367ffb8a6a66ad1a 100644 (file)
--- a/test/stdout/5840
+++ b/test/stdout/5840
@@ -1,5 +1,5 @@
-### TLSA (3 1 1)
-### TLSA (3 1 2)
+### TLSA (3 1 1) (DANE-EE SPKI SHA2-256)
+### TLSA (3 1 2) (            SHA2-512)

 ### Recipient callout
 
 **** SMTP testing session as if from host 127.0.0.1
 ### Recipient callout
 
 **** SMTP testing session as if from host 127.0.0.1


@@ -10,7 +10,7 @@
 250 OK\r
 250 Accepted\r
 421 myhost.test.ex lost input connection\r
 250 OK\r
 250 Accepted\r
 421 myhost.test.ex lost input connection\r

-### TLSA (2 0 1)
+### TLSA (2 0 1) (DANE-TA CERT SHA2-256)

 ### TLSA (2 1 1)
 ### A server with a nonverifying cert and no TLSA
 ### A server with a verifying cert and no TLSA
 ### TLSA (2 1 1)
 ### A server with a nonverifying cert and no TLSA
 ### A server with a verifying cert and no TLSA


@@ -27,12 +27,13 @@
 ### A server insecurely serving a good A record, dane required (delivery should fail)
 ### A server with a name not matching the cert.  TA-mode; should fail
 ### A server with a name not matching the cert.  EE-mode; should deliver and claim DANE mode
 ### A server insecurely serving a good A record, dane required (delivery should fail)
 ### A server with a name not matching the cert.  TA-mode; should fail
 ### A server with a name not matching the cert.  EE-mode; should deliver and claim DANE mode

+### A server securely serving a wrong TLSA record, dane not requested (delivery should work non-dane)

 
 ******** SERVER ********
 
 ******** SERVER ********

-### TLSA (3 1 1)
-### TLSA (3 1 2)
+### TLSA (3 1 1) (DANE-EE SPKI SHA2-256)
+### TLSA (3 1 2) (            SHA2-512)

 ### Recipient callout
 ### Recipient callout

-### TLSA (2 0 1)
+### TLSA (2 0 1) (DANE-TA CERT SHA2-256)

 ### TLSA (2 1 1)
 ### A server with a nonverifying cert and no TLSA
 ### A server with a verifying cert and no TLSA
 ### TLSA (2 1 1)
 ### A server with a nonverifying cert and no TLSA
 ### A server with a verifying cert and no TLSA


@@ -49,3 +50,4 @@
 ### A server insecurely serving a good A record, dane required (delivery should fail)
 ### A server with a name not matching the cert.  TA-mode; should fail
 ### A server with a name not matching the cert.  EE-mode; should deliver and claim DANE mode
 ### A server insecurely serving a good A record, dane required (delivery should fail)
 ### A server with a name not matching the cert.  TA-mode; should fail
 ### A server with a name not matching the cert.  EE-mode; should deliver and claim DANE mode

+### A server securely serving a wrong TLSA record, dane not requested (delivery should work non-dane)