DANE: Improper TLSA record validation (fixes #2328)

crates/common/src/config/inner.rs

@@ -178,6 +178,10 @@ impl Caches {
                 ((std::mem::size_of::<Ipv6Addr>() + 255) * 2) as u64,
             ),
             dns_tlsa: CacheWithTtl::new(cache.dns_tlsa, (std::mem::size_of::<Tlsa>() + 255) as u64),
+            dns_dnssec: CacheWithTtl::new(
+                cache.dns_tlsa,
+                (std::mem::size_of::<bool>() + 255) as u64,
+            ),
             dns_mta_sts: CacheWithTtl::new(
                 cache.dns_mta_sts,
                 (std::mem::size_of::<Policy>() + 255) as u64,

crates/common/src/config/smtp/resolver.rs

@@ -41,11 +41,18 @@ pub struct DnssecResolver {
     pub resolver: TokioResolver,
 }
 
+#[derive(Debug, Clone, Copy, Hash, PartialEq, Eq, Serialize, Deserialize)]
+pub enum TlsaMatching {
+    Full,
+    Sha256,
+    Sha512,
+}
+
 #[derive(Debug, Clone, Hash, PartialEq, Eq, Serialize, Deserialize)]
 pub struct TlsaEntry {
     pub is_end_entity: bool,
-    pub is_sha256: bool,
     pub is_spki: bool,
+    pub matching: TlsaMatching,
     pub data: Vec<u8>,
 }
 

crates/common/src/lib.rs

@@ -201,6 +201,7 @@ pub struct Caches {
     pub dns_ipv4: CacheWithTtl<Box<str>, Arc<[Ipv4Addr]>>,
     pub dns_ipv6: CacheWithTtl<Box<str>, Arc<[Ipv6Addr]>>,
     pub dns_tlsa: CacheWithTtl<Box<str>, Arc<Tlsa>>,
+    pub dns_dnssec: CacheWithTtl<Box<str>, bool>,
     pub dns_mta_sts: CacheWithTtl<Box<str>, Arc<Policy>>,
     pub dns_rbl: CacheWithTtl<Box<str>, Option<Arc<IpResolver>>>,