diff options
| -rw-r--r-- | doc/doc-docbook/spec.xfpt | 2 | ||||
| -rw-r--r-- | doc/doc-txt/ChangeLog | 2 | ||||
| -rw-r--r-- | src/src/dns.c | 1 | ||||
| -rw-r--r-- | src/src/exim.h | 6 | ||||
| -rw-r--r-- | src/src/lookups/dnsdb.c | 30 |
5 files changed, 40 insertions, 1 deletions
diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt index 8ddc3df51..c00469b0d 100644 --- a/doc/doc-docbook/spec.xfpt +++ b/doc/doc-docbook/spec.xfpt @@ -6840,7 +6840,7 @@ is used on its own as the result. If the lookup does not succeed, the &`fail`& keyword causes a &'forced expansion failure'& &-- see section &<<SECTforexpfai>>& for an explanation of what this means. -The supported DNS record types are A, CNAME, MX, NS, PTR, SPF, SRV, and TXT, +The supported DNS record types are A, CNAME, MX, NS, PTR, SPF, SRV, TLSA and TXT, and, when Exim is compiled with IPv6 support, AAAA (and A6 if that is also configured). If no type is given, TXT is assumed. When the type is PTR, the data can be an IP address, written as normal; inversion and the addition of diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog index 974b9579c..6d9b28383 100644 --- a/doc/doc-txt/ChangeLog +++ b/doc/doc-txt/ChangeLog @@ -64,6 +64,8 @@ JH/09 Bugzilla 1431: Support (with limitations) headers_add/headers_remove in JH/10 Bugzilla 1005: ACL "condition =" should accept values which are negative numbers. Touch up "bool" conditional to keep the same definition. +JH/11 Add dnsdb tlsa lookup. From Todd Lyons. + Exim version 4.82 ----------------- diff --git a/src/src/dns.c b/src/src/dns.c index 88fa36baa..2aeb5af62 100644 --- a/src/src/dns.c +++ b/src/src/dns.c @@ -479,6 +479,7 @@ switch(t) case T_SRV: return US"SRV"; case T_NS: return US"NS"; case T_CNAME: return US"CNAME"; + case T_TLSA: return US"TLSA"; default: return US"?"; } } diff --git a/src/src/exim.h b/src/src/exim.h index b2d47d74e..c72c1f10a 100644 --- a/src/src/exim.h +++ b/src/src/exim.h @@ -321,6 +321,12 @@ header files. I don't suppose they have T_SRV either. */ #define T_SPF 99 #endif +/* New TLSA record for DANE */ +#ifndef T_TLSA +#define T_TLSA 52 +#endif +#define MAX_TLSA_EXPANDED_SIZE 8192 + /* It seems that some versions of arpa/nameser.h don't define *any* of the T_xxx macros, which seem to be non-standard nowadays. Just to be on the safe side, put in definitions for all the ones that Exim uses. */ diff --git a/src/src/lookups/dnsdb.c b/src/src/lookups/dnsdb.c index a8eab2e47..beba09508 100644 --- a/src/src/lookups/dnsdb.c +++ b/src/src/lookups/dnsdb.c @@ -22,6 +22,11 @@ header files. */ #define T_SPF 99 #endif +/* New TLSA record for DANE */ +#ifndef T_TLSA +#define T_TLSA 52 +#endif + /* Table of recognized DNS record types and their integer values. */ static const char *type_names[] = { @@ -41,6 +46,7 @@ static const char *type_names[] = { "ptr", "spf", "srv", + "tlsa", "txt", "zns" }; @@ -62,6 +68,7 @@ static int type_values[] = { T_PTR, T_SPF, T_SRV, + T_TLSA, T_TXT, T_ZNS /* Private type for "zone nameservers" */ }; @@ -378,6 +385,29 @@ while ((domain = string_nextinlist(&keystring, &sep, buffer, sizeof(buffer))) } } } + else if (type == T_TLSA) + { + uint8_t usage, selector, matching_type; + uint16_t i, payload_length; + uschar s[MAX_TLSA_EXPANDED_SIZE]; + uschar * sp = s; + uschar *p = (uschar *)(rr->data); + + usage = *p++; + selector = *p++; + matching_type = *p++; + /* What's left after removing the first 3 bytes above */ + payload_length = rr->size - 3; + sp += sprintf(CS s, "%d %d %d ", usage, selector, matching_type); + /* Now append the cert/identifier, one hex char at a time */ + for (i=0; + i < payload_length && sp-s < (MAX_TLSA_EXPANDED_SIZE - 4); + i++) + { + sp += sprintf(CS sp, "%02x", (unsigned char)p[i]); + } + yield = string_cat(yield, &size, &ptr, s, Ustrlen(s)); + } else /* T_CNAME, T_CSA, T_MX, T_MXH, T_NS, T_PTR, T_SRV */ { int priority, weight, port; |