From 5e7bd3f6be329674bba6476f341bd34ce5809f75 Mon Sep 17 00:00:00 2001 From: mdecimus Date: Thu, 27 Jun 2024 11:50:27 +0200 Subject: [PATCH] DANE success on EndEntity match regardless of TrustAnchor validation --- crates/smtp/src/outbound/dane/verify.rs | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/crates/smtp/src/outbound/dane/verify.rs b/crates/smtp/src/outbound/dane/verify.rs index 8e001a05..f119223c 100644 --- a/crates/smtp/src/outbound/dane/verify.rs +++ b/crates/smtp/src/outbound/dane/verify.rs @@ -123,8 +123,13 @@ impl TlsaVerify for Tlsa { } } - if (self.has_end_entities == matched_end_entity) - && (self.has_intermediates == matched_intermediate) + // DANE is valid if: + // - EE matched even if no TA matched + // - Both EE and TA matched + // - EE is not present and TA matched + if (self.has_end_entities && matched_end_entity) + || ((self.has_end_entities == matched_end_entity) + && (self.has_intermediates == matched_intermediate)) { tracing::info!( parent: span,