search

PennockTech / smtpdane

SMTP DANE testing tool
MIT License
22 stars 1 forks source link

MX domain is added to list of hostnames #3

Closed MASHtm closed 2 years ago

MASHtm commented 2 years ago

Hi! If I call smtpdane with -mx option it seems to add the domain as hostname as well into the list of hostnames to check.

For example:

# ./smtpdane -mx univie.ac.at
found 4 MX records for "univie.ac.at" across 1 preference levels
  "univie.ac.at" MX preference 10: [zidmx4.univie.ac.at. zidmx3.univie.ac.at. zidmx2.univie.ac.at. zidmx1.univie.ac.at.]
found 2 secure addresses for "zidmx1.univie.ac.at.": [2001:62a:4:25::25:100 131.130.3.100]
found 2 TLSA records for "_25._tcp.zidmx1.univie.ac.at."
  3 1 1 c0578936f55c1800aa6ac8f74116da06c0f8910f8081732cae8f0967ef320425
  2 1 1 f3ae75c0490c907e5fb6268ba79ee8aa6c772874c5cc3829ed97895d1d13a01b
[zidmx1.univie.ac.at. 131.130.3.100] issuing STARTTLS [port 25]
[zidmx1.univie.ac.at. 131.130.3.100] TLSA DANE-EE(3) match: 3 1 1 ...ae8f0967ef320425
[zidmx1.univie.ac.at. 131.130.3.100] 1 chains to TA; first length 2, is: ["zidmx1.univie.ac.at" "TERENA SSL CA 3"]
[zidmx1.univie.ac.at. 131.130.3.100] no valid TA chains for hostname "univie.ac.at"
[zidmx1.univie.ac.at. 131.130.3.100] TLSA DANE-TA(2) match against chain position 2: 2 1 1 ...ed97895d1d13a01b
....

This results in 

...no valid TA chains for hostname "univie.ac.at"

messages. Should "univie.ac.at" be tested in this setting? IMO no, or do I miss something? The same happens with "-submission(s)" and "-srv".

philpennock commented 2 years ago

That's an informational message; there are multiple names which can be tried. RFC 7672 specifies that the "unexpanded input domain" is a candidate name and it's one of the things looked for. It's really a fallback given the secure MX records though.

This should report the hostname which did succeed though, to be clearer that another hostname did work. Also, the program exit status is always meaningful.

philpennock commented 2 years ago

Before:

[zidmx2.univie.ac.at. 2001:62a:4:25::25:101] 1 chains to TA; first length 2, is: ["zidmx2.univie.ac.at" "TERENA SSL CA 3"]
[zidmx2.univie.ac.at. 2001:62a:4:25::25:101] no valid TA chains for hostname "univie.ac.at"

Here we see the hostnames tried in the correct order, but the hostname is not explicitly in the first record; the Subject.CommonName is in the list in square brackets, but that's not necessarily the hostname.

With the just-pushed commit 9bff1e8:

[zidmx1.univie.ac.at. 131.130.3.100] hostname "zidmx1.univie.ac.at." has 1 chains to TA; first length 2, is: ["zidmx1.univie.ac.at" "TERENA SSL CA 3"]
[zidmx1.univie.ac.at. 131.130.3.100] no valid TA chains for hostname "univie.ac.at"

The lines are uncomfortably long, but the precision is worth it. I think.

philpennock commented 2 years ago

Closing this as "behaving as intended" -- checking all the RFC candidate names, and reporting on each, is correct for a validation tool. At least one needs to match and the ultimate success is correctly indicated.