From: Jeremy Harris Date: Sun, 7 May 2017 16:49:58 +0000 (+0100) Subject: DANE: do not trust a non-dnssec NXDOMAIN return for the TLSA lookup X-Git-Url: https://git.exim.org/users/jgh/exim.git/commitdiff_plain/5d6bdf01a921a88030e9baec7ba5f238da90e979?ds=sidebyside;hp=58c30e4788427fe3ee1f2e058602c23f911b0d63 DANE: do not trust a non-dnssec NXDOMAIN return for the TLSA lookup --- diff --git a/src/src/transports/smtp.c b/src/src/transports/smtp.c index 8f1e0bff8..9c95a4124 100644 --- a/src/src/transports/smtp.c +++ b/src/src/transports/smtp.c @@ -1209,7 +1209,7 @@ switch (rc) case DNS_NODATA: /* no TLSA RR for this lookup */ case DNS_NOMATCH: /* no records at all for this lookup */ - return dane_required ? FAIL : FAIL_FORCED; + return dane_required ? FAIL : sec ? FAIL_FORCED : DEFER; default: case DNS_FAIL: diff --git a/test/log/5840 b/test/log/5840 index 6d65bf25e..8d309e088 100644 --- a/test/log/5840 +++ b/test/log/5840 @@ -33,10 +33,8 @@ 1999-03-02 09:44:33 10HmbI-0005vi-00 ** CALLER@dane.no.1.test.ex R=client T=send_to_server: DANE error: tlsa lookup FAIL 1999-03-02 09:44:33 10HmbI-0005vi-00 CALLER@dane.no.1.test.ex: error ignored 1999-03-02 09:44:33 10HmbI-0005vi-00 Completed -1999-03-02 09:44:33 10HmbJ-0005vi-00 [127.0.0.1] SSL verify error: depth=0 error=self signed certificate cert=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock -1999-03-02 09:44:33 10HmbJ-0005vi-00 [127.0.0.1] SSL verify error: certificate name mismatch: DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" H="dane.no.2.test.ex" -1999-03-02 09:44:33 10HmbJ-0005vi-00 => CALLER@dane.no.2.test.ex R=client T=send_to_server H=dane.no.2.test.ex [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmbK-0005vi-00" -1999-03-02 09:44:33 10HmbJ-0005vi-00 Completed +1999-03-02 09:44:33 10HmbJ-0005vi-00 H=dane.no.2.test.ex [127.0.0.1]: DANE error: tlsa lookup DEFER +1999-03-02 09:44:33 10HmbJ-0005vi-00 == CALLER@dane.no.2.test.ex R=client T=send_to_server defer (-36): DANE error: tlsa lookup DEFER 1999-03-02 09:44:33 End queue run: pid=pppp -qf ******** SERVER ******** @@ -60,6 +58,3 @@ 1999-03-02 09:44:33 10HmbG-0005vi-00 => :blackhole: R=server 1999-03-02 09:44:33 10HmbG-0005vi-00 Completed 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225 -1999-03-02 09:44:33 10HmbK-0005vi-00 <= <> H=localhost (myhost.test.ex) [127.0.0.1] P=esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmbJ-0005vi-00@myhost.test.ex for CALLER@dane.no.2.test.ex -1999-03-02 09:44:33 10HmbK-0005vi-00 => :blackhole: R=server -1999-03-02 09:44:33 10HmbK-0005vi-00 Completed