[exim-cvs] dnsdb tlsa lookup

Gitweb: http://git.exim.org/exim.git/commitdiff/1e06383a8b5eaaf67910c94c737e8d9b5d16a00a

Commit:     1e06383a8b5eaaf67910c94c737e8d9b5d16a00a
Parent:     930407fb53c45465429f3ae16a43ab70308b6c2a
Author:     Todd Lyons <tlyons@???>
AuthorDate: Wed Apr 9 17:11:21 2014 +0100
Committer:  Jeremy Harris <jgh146exb@???>
CommitDate: Wed Apr 9 17:11:21 2014 +0100

    dnsdb tlsa lookup
---
 doc/doc-docbook/spec.xfpt |    2 +-
 doc/doc-txt/ChangeLog     |    2 ++
 src/src/dns.c             |    1 +
 src/src/exim.h            |    6 ++++++
 src/src/lookups/dnsdb.c   |   30 ++++++++++++++++++++++++++++++
 5 files changed, 40 insertions(+), 1 deletions(-)

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 8ddc3df..c00469b 100644
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -6840,7 +6840,7 @@ is used on its own as the result. If the lookup does not succeed, the
&`fail`& keyword causes a &'forced expansion failure'& &-- see section
&<<SECTforexpfai>>& for an explanation of what this means.

-The supported DNS record types are A, CNAME, MX, NS, PTR, SPF, SRV, and TXT,
+The supported DNS record types are A, CNAME, MX, NS, PTR, SPF, SRV, TLSA and TXT,
 and, when Exim is compiled with IPv6 support, AAAA (and A6 if that is also
 configured). If no type is given, TXT is assumed. When the type is PTR,
 the data can be an IP address, written as normal; inversion and the addition of
diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 974b957..6d9b283 100644
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -64,6 +64,8 @@ JH/09 Bugzilla 1431: Support (with limitations) headers_add/headers_remove in
 JH/10 Bugzilla 1005: ACL "condition =" should accept values which are negative
       numbers.  Touch up "bool" conditional to keep the same definition.

+JH/11 Add dnsdb tlsa lookup. From Todd Lyons.
+

 Exim version 4.82
 -----------------
diff --git a/src/src/dns.c b/src/src/dns.c
index 88fa36b..2aeb5af 100644
--- a/src/src/dns.c
+++ b/src/src/dns.c
@@ -479,6 +479,7 @@ switch(t)
   case T_SRV:   return US"SRV";
   case T_NS:    return US"NS";
   case T_CNAME: return US"CNAME";
+  case T_TLSA:  return US"TLSA";
   default:      return US"?";
   }
 }
diff --git a/src/src/exim.h b/src/src/exim.h
index b2d47d7..c72c1f1 100644
--- a/src/src/exim.h
+++ b/src/src/exim.h
@@ -321,6 +321,12 @@ header files. I don't suppose they have T_SRV either. */
 #define T_SPF 99
 #endif

+/* New TLSA record for DANE */
+#ifndef T_TLSA
+#define T_TLSA 52
+#endif
+#define MAX_TLSA_EXPANDED_SIZE 8192
+
/* It seems that some versions of arpa/nameser.h don't define *any* of the
T_xxx macros, which seem to be non-standard nowadays. Just to be on the safe
side, put in definitions for all the ones that Exim uses. */
diff --git a/src/src/lookups/dnsdb.c b/src/src/lookups/dnsdb.c
index a8eab2e..beba095 100644
--- a/src/src/lookups/dnsdb.c
+++ b/src/src/lookups/dnsdb.c
@@ -22,6 +22,11 @@ header files. */
#define T_SPF 99
#endif

+/* New TLSA record for DANE */
+#ifndef T_TLSA
+#define T_TLSA 52
+#endif
+
/* Table of recognized DNS record types and their integer values. */

 static const char *type_names[] = {
@@ -41,6 +46,7 @@ static const char *type_names[] = {
   "ptr",
   "spf",
   "srv",
+  "tlsa",
   "txt",
   "zns"
 };
@@ -62,6 +68,7 @@ static int type_values[] = {
   T_PTR,
   T_SPF,
   T_SRV,
+  T_TLSA,
   T_TXT,
   T_ZNS      /* Private type for "zone nameservers" */
 };
@@ -378,6 +385,29 @@ while ((domain = string_nextinlist(&keystring, &sep, buffer, sizeof(buffer)))
             }
           }
         }
+      else if (type == T_TLSA)
+        {
+        uint8_t usage, selector, matching_type;
+        uint16_t i, payload_length;
+        uschar s[MAX_TLSA_EXPANDED_SIZE];
+    uschar * sp = s;
+        uschar *p = (uschar *)(rr->data);
+
+        usage = *p++;
+        selector = *p++;
+        matching_type = *p++;
+        /* What's left after removing the first 3 bytes above */
+        payload_length = rr->size - 3;
+        sp += sprintf(CS s, "%d %d %d ", usage, selector, matching_type);
+        /* Now append the cert/identifier, one hex char at a time */
+        for (i=0;
+             i < payload_length && sp-s < (MAX_TLSA_EXPANDED_SIZE - 4);
+             i++)
+          {
+          sp += sprintf(CS sp, "%02x", (unsigned char)p[i]);
+          }
+        yield = string_cat(yield, &size, &ptr, s, Ustrlen(s));
+        }
       else   /* T_CNAME, T_CSA, T_MX, T_MXH, T_NS, T_PTR, T_SRV */
         {
         int priority, weight, port;