filip/Stalwart
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

Allow TLS name mismatch as per RFC7671 Section 5.1

Browse Source
This commit is contained in:
mdecimus
2025-03-21 20:05:02 +01:00
parent c0eb3a5ae8
commit a8bdf3949b
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
crates/smtp/src/outbound/delivery.rs
View File

@@ -967,7 +967,10 @@ impl QueuedMessage {
|| (message.flags & MAIL_REQUIRETLS) != 0
|| mta_sts_policy.is_some()
|| dane_policy.is_some();
let tls_connector = if allow_invalid_certs || remote_host.allow_invalid_certs()
// As per RFC7671 Section 5.1, DANE-EE(3) allows name mismatch
let tls_connector = if allow_invalid_certs
|| remote_host.allow_invalid_certs()
|| dane_policy.as_ref().is_some_and(|t| t.has_end_entities)
{
&server.inner.data.smtp_connectors.dummy_verify
} else {