Re: dns.c modification patch for getting TLSA RR records

On 26 May 2018 at 17:16, Manvendra Bhangui <[email protected]> wrote:
> As part of DANE implementation, I have added a new function
> to dns.c library. I have made the following modifications but
> am stuck because of lack of knowledge about DNSSEC.
>
> 1. Modified dns.c and added dns_tlsarr() function
> 2. New source tlsarralloc.c, tlsarralloc.h which uses
>    gen_alloc, gen_allocdefs
> 3. New program dnstlsarr which uses the above dns_tlsarr()
>    function to query TLSA Resource Records

So finally I managed to get DANE verification for qmail. Did some
rudimentary testing and released it as part of indimail-mta-2.5. I
have also backported the changes to netqmail-1.06, after removing
IPV6, SPF, BATV code. I have backported from indimail-mta to netqmail
in a hurry and hence there could be bugs. If someone is really
interested in testing this, improving it and killing the bugs, I will
provide whatever help I can give. In that case just email me so that
we don't trouble the other subscribers of this list. This patch
provides SMTP AUTH and TLS in qmail-remote. Entire code has been
written using djb functions. No stdio.h, no string.h, etc. Also I have
not included qmail-daned - TLSA RR caching daemon for qmail in this
patch because that will require another few hours to back port it from
indimail-mta. Probably I will do it in the coming few days.

The link to the dane patch is here.
https://sourceforge.net/projects/indimail/files/netqmail-addons/dane.patch.gz

Please note that I have not tested it, other than testing the
dnstlsarr program. The same functions in dnstlsarr program are used by
qmail-remote.

Example usage of dnstlsarr (which can also function as a DANE tester)
are given below

Example 1 - Just Display the TLSA Resource Records.
$ dnstlsarr postino.cesnet.cz
terenasslca3ta.cesnet.cz ttl=3282 2 0 1
be6a0d9e1d115f2293f6abf11b3ec8e882e24426eeeb09aaa503597993e77a25
terenasslca3ta.cesnet.cz ttl=3282 2 0 1
beb8efe9b1a73c841b375a90e5fff8048848e3a2af66f6c4dd7b938d6fe8c5d8

Example 2
$ dnstlsarr -v 2 -s mail.ietf.org
checking mail.ietf.org
TLSARR[0]:_25._tcp.mail.ietf.org IN TLSA ( 3 1 1
0c72ac70b745ac19998811b131d662c9ac69dbdbe7cb23e5b514b56664c5d3d6 )
220 ietfa.amsl.com ESMTP
Client: EHLO argos
250-ietfa.amsl.com
250-PIPELINING
250-SIZE 67108864
250-ETRN
250-STARTTLS
250-AUTH PLAIN LOGIN
250-AUTH=PLAIN LOGIN
250-ENHANCEDSTATUSCODES
250 8BITMIME
Client: STARTTLS
220 2.0.0 Ready to start TLS
matched sha256 fingerprint
[0c72ac70b745ac19998811b131d662c9ac69dbdbe7cb23e5b514b56664c5d3d6] of
subjectPublicKeyInfo
Client: QUIT
221 2.0.0 Bye

Example 3 - querying the MX record to get the TLSA RR
$ dnstlsarr -v 2 -s postino.cesnet.cz
checking postino.cesnet.cz
TLSARR[0]:terenasslca3ta.cesnet.cz IN TLSA ( 2 0 1
be6a0d9e1d115f2293f6abf11b3ec8e882e24426eeeb09aaa503597993e77a25 )
TLSARR[1]:terenasslca3ta.cesnet.cz IN TLSA ( 2 0 1
beb8efe9b1a73c841b375a90e5fff8048848e3a2af66f6c4dd7b938d6fe8c5d8 )
220 postino.cesnet.cz ESMTP
Client: EHLO argos
250-postino.cesnet.cz
250-PIPELINING
250-SIZE 41943040
250-VRFY
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
Client: STARTTLS
220 2.0.0 Ready to start TLS
failed  sha256 fingerprint
[be6a0d9e1d115f2293f6abf11b3ec8e882e24426eeeb09aaa503597993e77a25] of
full certificate
matched sha256 fingerprint
[beb8efe9b1a73c841b375a90e5fff8048848e3a2af66f6c4dd7b938d6fe8c5d8] of
full certificate
Client: QUIT
221 2.0.0 Bye

Example 4 - getting TLSA RR by giving the domain name instead of the MX host
$ dnstlsarr -m cesnet.cz
MX postino.cesnet.cz IPv6 2001:718:1:101::144:24210
terenasslca3ta.cesnet.cz ttl=2974 2 0 1
be6a0d9e1d115f2293f6abf11b3ec8e882e24426eeeb09aaa503597993e77a25
terenasslca3ta.cesnet.cz ttl=2974 2 0 1
beb8efe9b1a73c841b375a90e5fff8048848e3a2af66f6c4dd7b938d6fe8c5d8
MX postino.cesnet.cz IPv4 195.113.144.24210
terenasslca3ta.cesnet.cz ttl=2974 2 0 1
be6a0d9e1d115f2293f6abf11b3ec8e882e24426eeeb09aaa503597993e77a25
terenasslca3ta.cesnet.cz ttl=2974 2 0 1
beb8efe9b1a73c841b375a90e5fff8048848e3a2af66f6c4dd7b938d6fe8c5d8
MX cartero.cesnet.cz IPv6 2001:718:ff05:202::1650
terenasslca3ta.cesnet.cz ttl=2974 2 0 1
be6a0d9e1d115f2293f6abf11b3ec8e882e24426eeeb09aaa503597993e77a25
terenasslca3ta.cesnet.cz ttl=2974 2 0 1
beb8efe9b1a73c841b375a90e5fff8048848e3a2af66f6c4dd7b938d6fe8c5d8
MX cartero.cesnet.cz IPv4 78.128.216.1650
terenasslca3ta.cesnet.cz ttl=2974 2 0 1
be6a0d9e1d115f2293f6abf11b3ec8e882e24426eeeb09aaa503597993e77a25
terenasslca3ta.cesnet.cz ttl=2974 2 0 1
beb8efe9b1a73c841b375a90e5fff8048848e3a2af66f6c4dd7b938d6fe8c5d8
MX mail.cesnet.cz IPv4 195.113.144.234100
terenasslca3ta.cesnet.cz ttl=2974 2 0 1
be6a0d9e1d115f2293f6abf11b3ec8e882e24426eeeb09aaa503597993e77a25
terenasslca3ta.cesnet.cz ttl=2974 2 0 1
beb8efe9b1a73c841b375a90e5fff8048848e3a2af66f6c4dd7b938d6fe8c5d8


The current implementation does not use DNSSEC. At the moment, I still
have not figured out how to do DNSSEC. So this feature could come in
future release. Also the code is largely untested. Use it at your own
risk.

The original announcement is here
https://groups.google.com/forum/#!topic/indimail/LSTKnbwDWps