From ab0e957b09b73546a58b27fbce42569d56c1382b Mon Sep 17 00:00:00 2001 From: "Heiko Schlittermann (HS12-RIPE)" Date: Fri, 27 Sep 2019 03:42:46 +0200 Subject: [PATCH] Change the default of dnssec_request_domains to '*' --- doc/doc-docbook/spec.xfpt | 9 +++++---- doc/doc-txt/ChangeLog | 1 + src/src/configure.default | 3 --- src/src/globals.c | 2 +- src/src/lookups/dnsdb.c | 4 ++-- src/src/transports/smtp.c | 2 +- 6 files changed, 10 insertions(+), 11 deletions(-) diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt index 6cfe0bf63..da9d616ae 100644 --- a/doc/doc-docbook/spec.xfpt +++ b/doc/doc-docbook/spec.xfpt @@ -7331,7 +7331,7 @@ with the lookup. With &"strict"& a response from the DNS resolver that is not labelled as authenticated data is treated as equivalent to a temporary DNS error. -The default is &"never"&. +The default is &"lax"&. See also the &$lookup_dnssec_authenticated$& variable. @@ -18382,7 +18382,7 @@ or for any deliveries caused by this router. You should not set this option unless you really, really know what you are doing. See also the generic transport option of the same name. -.option dnssec_request_domains routers "domain list&!!" unset +.option dnssec_request_domains routers "domain list&!!" * .cindex "MX record" "security" .cindex "DNSSEC" "MX lookup" .cindex "security" "MX lookup" @@ -24571,7 +24571,7 @@ See the &%search_parents%& option in chapter &<>& for more details. -.option dnssec_request_domains smtp "domain list&!!" unset +.option dnssec_request_domains smtp "domain list&!!" * .cindex "MX record" "security" .cindex "DNSSEC" "MX lookup" .cindex "security" "MX lookup" @@ -29055,7 +29055,8 @@ If DANE is requested and useable (see above) the following transport options are If DANE is not usable, whether requested or not, and CA-anchored verification evaluation is wanted, the above variables should be set appropriately. -Currently the (router or transport options) &%dnssec_request_domains%& must be active and &%dnssec_require_domains%& is ignored. +The router and transport option &%dnssec_request_domains%& must not be +set to "never" and &%dnssec_require_domains%& is ignored. If verification was successful using DANE then the "CV" item in the delivery log line will show as "CV=dane". diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog index 93f4a1eb2..7568d2e0c 100644 --- a/doc/doc-txt/ChangeLog +++ b/doc/doc-txt/ChangeLog @@ -192,6 +192,7 @@ JH/41 With GnuTLS 3.6.0 (and later) do not attempt to manage Diffie-Hellman function is unnecessary and discouraged on GnuTLS 3.6.0 or later. Since 3.6.0, DH parameters are negotiated following RFC7919." +HS/06 Change the default of dnssec_request_domains to "*" Exim version 4.92 ----------------- diff --git a/src/src/configure.default b/src/src/configure.default index 245cc3925..8681499d8 100644 --- a/src/src/configure.default +++ b/src/src/configure.default @@ -690,9 +690,6 @@ dnslookup: ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8 # if ipv6-enabled then instead use: # ignore_target_hosts = <; 0.0.0.0 ; 127.0.0.0/8 ; ::1 -.ifdef _HAVE_DNSSEC - dnssec_request_domains = * -.endif no_more # This closes the ROUTER_SMARTHOST ifdef around the choice of routing for diff --git a/src/src/globals.c b/src/src/globals.c index 24281f239..677c03e77 100644 --- a/src/src/globals.c +++ b/src/src/globals.c @@ -1362,7 +1362,7 @@ router_instance router_defaults = { .pass_router = NULL, .redirect_router = NULL, - .dnssec = { NULL, NULL }, /* dnssec_domains {require,request} */ + .dnssec = { .request= US"*", .require=NULL }, }; uschar *router_name = NULL; diff --git a/src/src/lookups/dnsdb.c b/src/src/lookups/dnsdb.c index 272734456..1cf8df739 100644 --- a/src/src/lookups/dnsdb.c +++ b/src/src/lookups/dnsdb.c @@ -112,7 +112,7 @@ terminates option processing. Recognised options are: causes the whole lookup to defer only if none of the DNS queries succeeds; and 'never', where all defers are as if the lookup failed. The default is 'lax'. -- 'dnssec_FOO', with 'strict', 'lax' and 'never' (default). The meanings are +- 'dnssec_FOO', with 'strict', 'lax' (default), and 'never'. The meanings are require, try and don't-try dnssec respectively. - 'retrans_VAL', set the timeout value. VAL is an Exim time specification @@ -136,7 +136,7 @@ dnsdb_find(void *handle, uschar *filename, const uschar *keystring, int length, int rc; int sep = 0; int defer_mode = PASS; -int dnssec_mode = OK; +int dnssec_mode = PASS; int save_retrans = dns_retrans; int save_retry = dns_retry; int type; diff --git a/src/src/transports/smtp.c b/src/src/transports/smtp.c index c547c87fa..fe28d8606 100644 --- a/src/src/transports/smtp.c +++ b/src/src/transports/smtp.c @@ -281,7 +281,7 @@ smtp_transport_options_block smtp_transport_option_defaults = { .gethostbyname = FALSE, .dns_qualify_single = TRUE, .dns_search_parents = FALSE, - .dnssec = { .request=NULL, .require=NULL }, + .dnssec = { .request= US"*", .require=NULL }, .delay_after_cutoff = TRUE, .hosts_override = FALSE, .hosts_randomize = FALSE, -- 2.25.1