Fix fakens TLSA generation and DANE TLSA lookup

diff --git a/src/src/tls-openssl.c b/src/src/tls-openssl.c
index 1ec7786bd55c39e122d6fc077b6b56ab40c79a36..79beffadf222175d9005a6a02b681a7b6d925ea1 100644 (file)
--- a/src/src/tls-openssl.c
+++ b/src/src/tls-openssl.c
@@ -1806,6 +1806,7 @@ if (dane)
   dns_record * rr;
   dns_scan dnss;
   uschar * hostnames[2] = { host->name, NULL };
+  int found = 0;
 
   if (DANESSL_init(client_ssl, NULL, hostnames) != 1)
     return tls_error(US"hostnames load", host, NULL);
@@ -1819,13 +1820,16 @@ if (dane)
     int usage, selector, mtype;
     const char * mdname;
 
-    GETSHORT(usage, p);
-    GETSHORT(selector, p);
-    GETSHORT(mtype, p);
+    found++;
+    usage = *p++;
+    selector = *p++;
+    mtype = *p++;
 
     switch (mtype)
       {
-      default: /* log bad */ return FAIL;
+      default:
+       log_write(0, LOG_MAIN, "DANE error: TLSA record w/bad mtype 0x%x", mtype);
+       return FAIL;
       case 0:  mdname = NULL; break;
       case 1:  mdname = "sha256"; break;
       case 2:  mdname = "sha512"; break;
@@ -1841,6 +1845,12 @@ if (dane)
       case 1:  break;
       }
     }
+
+  if (!found)
+    {
+    log_write(0, LOG_MAIN, "DANE error: No TLSA records");
+    return FAIL;
+    }
   }
 #endif
 

diff --git a/test/src/fakens.c b/test/src/fakens.c
index 912f41984d1da3c91f342a0004e44e3f5ad206b5..fd3604a3c6c5e2e50617db08b1178a536066fce2 100644 (file)
--- a/test/src/fakens.c
+++ b/test/src/fakens.c
@@ -194,6 +194,19 @@ while (*name != 0)
 return pk;
 }
 
+uschar *
+bytefield(uschar ** pp, uschar * pk)
+{
+unsigned value = 0;
+uschar * p = *pp;
+
+while (isdigit(*p)) value = value*10 + *p++ - '0';
+while (isspace(*p)) p++;
+*pp = p;
+*pk++ = value & 255;
+return pk;
+}
+
 uschar *
 shortfield(uschar ** pp, uschar * pk)
 {
@@ -420,9 +433,9 @@ while (fgets(CS buffer, sizeof(buffer), f) != NULL)
     break;
 
     case ns_t_tlsa:
-    pk = shortfield(&p, pk);   /* usage */
-    pk = shortfield(&p, pk);   /* selector */
-    pk = shortfield(&p, pk);   /* match type */
+    pk = bytefield(&p, pk);    /* usage */
+    pk = bytefield(&p, pk);    /* selector */
+    pk = bytefield(&p, pk);    /* match type */
     while (isxdigit(*p))
       {
       value = toupper(*p) - (isdigit(*p) ? '0' : '7') << 4;

diff --git a/test/stdout/5800 b/test/stdout/5800
index bcbbd88e0b61666e309b24b923e03c1c3cc3d011..b9c64fea027d1e1529aecb35f3b39800246081f0 100644 (file)
--- a/test/stdout/5800
+++ b/test/stdout/5800
@@ -1,4 +1,4 @@
 > 
-> dnslookup tlsa: 3 1 2 3d5eb81b1dfc3f93c1fa8819e3fb3fdb41bb590441d5f3811db17772f4bc6de29bdd7c4f4b723750dda871b99379192b3f979f03db1252c4f08b03ef7176528d000000
+> dnslookup tlsa: 3 1 2 3d5eb81b1dfc3f93c1fa8819e3fb3fdb41bb590441d5f3811db17772f4bc6de29bdd7c4f4b723750dda871b99379192b3f979f03db1252c4f08b03ef7176528d
 > 
 >