1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
|
# DANE client: general
#
exim -DSERVER=server -DDETAILS=ee -bd -oX PORT_D
****
### TLSA (3 1 1) (DANE-EE SPKI SHA2-256)
exim -odq t1@dane256ee.test.ex
Testing
****
### TLSA (3 1 2) ( SHA2-512)
exim -odq t2@mxdane512ee.test.ex
Testing
****
exim -qf
****
#
#
### Recipient callout
exim -DOPT=callout -bhc 127.0.0.1
HELO test
MAIL FROM: <t3@myhost.test.ex>
RCPT TO: <rcptuser@dane256ee.test.ex>
****
killdaemon
#
#
exim -DSERVER=server -DDETAILS=ta -bd -oX PORT_D
****
### TLSA (2 0 1) (DANE-TA CERT SHA2-256)
exim -odf t4@mxdane256ta.test.ex
Testing
****
killdaemon
#
# OpenSSL-specific regression testcase: certificate having Authority Key ID extension
exim -DSERVER=server -DCERT=DIR/aux-fixed/exim-ca/example.com/server2.example.com/fullchain.pem -DALLOW=DIR/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.unlocked.key -bd -oX PORT_D
****
### TLSA (2 1 1)
exim -odf t5@mxdane256tak.test.ex
Testing
****
killdaemon
#
### A server with a nonverifying cert and no TLSA
# Check we get a non-CV but TLS connection, with try_dane but no require_dane
exim -DSERVER=server -DDETAILS=no -bd -oX PORT_D
****
exim -odf t6@thishost.test.ex
Testing
****
killdaemon
#
### A server with a verifying cert and no TLSA
# Check we get a CV and TLS connection, with try_dane but no require_dane
exim -DSERVER=server -DDETAILS=ca -bd -oX PORT_D
****
exim -odf -DDETAILS=ca t7@thishost.test.ex
Testing
****
exim -DOPT=no_certname -qf
****
killdaemon
#
#
exim -DSERVER=server -DDETAILS=ee -bd -oX PORT_D
****
### A server with two MXs for which both TLSA lookups return defer (delivery should defer)
exim -odq t8@mxdanelazy.test.ex
Testing
****
### A server lacking a TLSA, dane required (should fail)
exim -odq t9@dane.no.1.test.ex
Testing
****
### A server lacking a TLSA, dane requested only (should deliver, non-DANE, as the NXDOMAIN is not DNSSEC)
exim -odq t10@dane.no.2.test.ex
Testing
****
### A server where the A is dnssec and the TLSA lookup _fails_ (delivery should defer)
exim -odq t11@danebroken1.test.ex
Testing
****
### A server securely saying "no TLSA records here", dane required (delivery should fail)
exim -odq t12@dane.no.3.test.ex
Testing
****
### A server securely saying "no TLSA records here", dane requested only (should deliver)
exim -odq t13@dane.no.4.test.ex
Testing
****
exim -qf
****
exim -Mrm $msg1 $msg2
****
#
### A server securely serving a wrong TLSA record, dane requested only (delivery should fail)
#XXX it defers.
exim -odf t14@danebroken2.test.ex
Testing
****
### A server insecurely serving a good TLSA record, dane requested only (should deliver, non-DANE)
exim -odf t15@danebroken3.test.ex
Testing
****
### A server insecurely serving a good TLSA record, dane required (delivery should fail)
exim -odf t16@danebroken4.test.ex
Testing
****
### A server insecurely serving a good A record, dane requested only (should deliver, non-DANE)
exim -odf t17@danebroken5.test.ex
Testing
****
### A server insecurely serving a good A record, dane required (delivery should fail)
exim -odf t18@danebroken6.test.ex
Testing
****
#
killdaemon
#
#
#
### A server with a name not matching the cert. TA-mode; should fail
exim -DSERVER=server -DDETAILS=cert.net -bd -oX PORT_D
****
exim -odf t19@danebroken7.example.com
Testing
****
#
### A server with a name not matching the cert. EE-mode; should deliver and claim DANE mode
exim -odf t20@danebroken8.example.com
Testing
****
killdaemon
#
#
sudo rm DIR/spool/db/retry
exim -DSERVER=server -DDETAILS=ca -bd -oX PORT_D
****
### A server securely serving a wrong TLSA record, dane not requested (delivery should work non-dane)
exim -odf -DCONTROL=: t21@danebroken2.test.ex
****
# sleep needed to see the t14 brokenness
sleep 1
killdaemon
sleep 1
#
no_msglog_check
|
