On Thu, Sep 19, 2024 at 12:36:23PM +0200, Geert Hendrickx via Postfix-users
wrote:
> It works, and it's even interoperable with gmail's MX. But provider
> key exchanges aren't logged for outbound connections by smtp(8) or
> posttls-finger:
That's unexpected, it is the same code generating the log message in
both the server and client, and the built-in curve name is getting
logged, as well as the provider curve in smtpd(8), so there's no good
reason for it to not be logged on the client side.
> $ posttls-finger -o tls_eecdh_auto_curves=X25519 gmail.com | grep established
> posttls-finger: Untrusted TLS connection established to
> gmail-smtp-in.l.google.com[142.250.102.26]:25: TLSv1.3 with cipher
> TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature
> ECDSA (prime256v1) server-digest SHA256
>
> $ posttls-finger -o tls_eecdh_auto_curves=x25519_kyber768 gmail.com | grep
> established
> posttls-finger: Untrusted TLS connection established to
> gmail-smtp-in.l.google.com[2a00:1450:4025:402::1b]:25: TLSv1.3 with cipher
> TLS_AES_128_GCM_SHA256 (128/128 bits) server-signature ECDSA (prime256v1)
> server-digest SHA256
>
> (it is properly using x25519_kyber768 on the wire, just not logging it)
>
> For inbound connections, exotic key exchanges are properly logged, as
> shown above, as well as in Received headers.
Can you build Postfix after running "makedefs" with "OPT='-g -ggdb3'",
and set a break-point in posttls-finger at line ~1054 of tls_misc.c:
1054 if (tls_get_peer_dh_pubkey(ssl, &dh_pkey)) {
1055 switch (nid = EVP_PKEY_id(dh_pkey)) {
1056 default:
1057 kex_name = OBJ_nid2sn(EVP_PKEY_type(nid));
1058 break;
1059
1060 #if defined(EVP_PKEY_KEYMGMT)
1061 case EVP_PKEY_KEYMGMT:
1062 kex_name = EVP_PKEY_get0_type_name(dh_pkey);
1063 TLScontext->kex_bits = 0;
1064 break;
1065 #endif
1066
1067 case EVP_PKEY_DH:
1068 kex_name = "DHE";
1069 TLScontext->kex_bits = EVP_PKEY_bits(dh_pkey);
1070 break;
1071
1072 #ifndef OPENSSL_NO_EC
1073 case EVP_PKEY_EC:
1074 kex_name = "ECDHE";
1075 kex_curve = ec_curve_name(dh_pkey);
1076 break;
1077 #endif
then single-step through the code reporting the "nid" value obtained,
and the "case" taken, as well as "kex_name", ...
--
Viktor.
_______________________________________________
Postfix-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
