infrastructure/mox
1
0
Fork 0
mirror of https://github.com/mjl-/mox.git synced 2025-07-12 11:44:38 +03:00
Code Issues Packages Projects Releases Wiki Activity

admin: better handling of disabled mta-sts during self-check

Browse Source 
if admin has disabled mta-sts for a domain, we still check for records &
policies, but won't mark it as error when they don't exist. we do now keep
warning that mta-sts isn't enabled, otherwise we would start showing a green
"ok".

this also fixes the mta-sts code returning ErrNoPolicy when mtasts.<domain>
doesn't exist. the dns lookup is done with the reguler "net" package dns lookup
code, not through adns, so we look for two types of DNSError's.

noticed a while ago when testing with MTA-STS while debugging TLS connection
issues with MS.
This commit is contained in:
Mechiel Lukkien
2024-11-24 13:30:29 +01:00
parent 726c0931f7
commit 7f5e1087d4
2 changed files with 16 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
webadmin/admin.go
View File

@ -1281,8 +1281,13 @@ Ensure a DNS TXT record like the following exists:
defer logPanic(ctx)
defer wg.Done()
// The admin has explicitly disabled mta-sts, keep warning about it.
if domConf.MTASTS == nil {
addf(&r.MTASTS.Warnings, "MTA-STS is not configured for this domain.")
}
record, txt, err := mtasts.LookupRecord(ctx, log.Logger, resolver, domain)
if err != nil {
if err != nil && !(domConf.MTASTS == nil && errors.Is(err, mtasts.ErrNoRecord)) {
addf(&r.MTASTS.Errors, "Looking up MTA-STS record: %s", err)
}
r.MTASTS.TXT = txt
@ -1292,7 +1297,9 @@ Ensure a DNS TXT record like the following exists:
policy, text, err := mtasts.FetchPolicy(ctx, log.Logger, domain)
if err != nil {
addf(&r.MTASTS.Errors, "Fetching MTA-STS policy: %s", err)
if !(domConf.MTASTS == nil && errors.Is(err, mtasts.ErrNoPolicy)) {
addf(&r.MTASTS.Errors, "Fetching MTA-STS policy: %s", err)
}
} else if policy.Mode == mtasts.ModeNone {
addf(&r.MTASTS.Warnings, "MTA-STS policy is present, but does not require TLS.")
} else if policy.Mode == mtasts.ModeTesting {