#ifndef DISABLE_DKIM /* rest of file */
-#ifndef SUPPORT_TLS
-# error Need SUPPORT_TLS for DKIM
+#ifdef DISABLE_TLS
+# error Must no DISABLE_TLS, for DKIM
#endif
}
#define SIGSPACE 128
-sig->data = store_get(SIGSPACE);
+sig->data = store_get(SIGSPACE, FALSE);
if (gcry_mpi_cmp (sign_ctx->p, sign_ctx->q) > 0)
{
const uschar *
exim_dkim_signing_init(const uschar * privkey_pem, es_ctx * sign_ctx)
{
-BIO * bp = BIO_new_mem_buf(privkey_pem, -1);
+BIO * bp = BIO_new_mem_buf((void *)privkey_pem, -1);
if (!(sign_ctx->key = PEM_read_bio_PrivateKey(bp, NULL, NULL, NULL)))
return string_sprintf("privkey PEM-block import: %s",
if ( (ctx = EVP_MD_CTX_new())
&& EVP_DigestSignInit(ctx, NULL, md, NULL, sign_ctx->key) > 0
&& EVP_DigestSign(ctx, NULL, &siglen, NULL, 0) > 0
- && (sig->data = store_get(siglen))
+ && (sig->data = store_get(siglen, FALSE))
/* Obtain the signature (slen could change here!) */
&& EVP_DigestSign(ctx, sig->data, &siglen, data->data, data->len) > 0
&& EVP_DigestSignInit(ctx, NULL, md, NULL, sign_ctx->key) > 0
&& EVP_DigestSignUpdate(ctx, data->data, data->len) > 0
&& EVP_DigestSignFinal(ctx, NULL, &siglen) > 0
- && (sig->data = store_get(siglen))
+ && (sig->data = store_get(siglen, FALSE))
/* Obtain the signature (slen could change here!) */
&& EVP_DigestSignFinal(ctx, sig->data, &siglen) > 0
exim_dkim_verify(ev_ctx * verify_ctx, hashmethod hash, blob * data, blob * sig)
{
const EVP_MD * md;
-const uschar * where;
switch (hash)
{
{
EVP_MD_CTX * ctx;
- if ( (ctx = EVP_MD_CTX_new())
- && EVP_DigestVerifyInit(ctx, NULL, md, NULL, verify_ctx->key) > 0
- && EVP_DigestVerify(ctx, sig->data, sig->len, data->data, data->len) > 0
- )
- { EVP_MD_CTX_free(ctx); return NULL; }
-
- if (ctx) EVP_MD_CTX_free(ctx);
+ if ((ctx = EVP_MD_CTX_new()))
+ {
+ if ( EVP_DigestVerifyInit(ctx, NULL, md, NULL, verify_ctx->key) > 0
+ && EVP_DigestVerify(ctx, sig->data, sig->len, data->data, data->len) > 0
+ )
+ { EVP_MD_CTX_free(ctx); return NULL; }
+ EVP_MD_CTX_free(ctx);
+ }
}
else
#endif
{
EVP_PKEY_CTX * ctx;
- if ((where = US"EVP_PKEY_CTX_new",
- (ctx = EVP_PKEY_CTX_new(verify_ctx->key, NULL))))
+ if ((ctx = EVP_PKEY_CTX_new(verify_ctx->key, NULL)))
{
- if ( (where = US"EVP_PKEY_verify_init",
- EVP_PKEY_verify_init(ctx) > 0)
- && (where = US"EVP_PKEY_CTX_set_rsa_padding",
- EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) > 0)
- && (where = US"EVP_PKEY_CTX_set_signature_md",
- EVP_PKEY_CTX_set_signature_md(ctx, md) > 0)
- && (where = US"EVP_PKEY_verify",
- EVP_PKEY_verify(ctx, sig->data, sig->len,
- data->data, data->len) == 1)
+ if ( EVP_PKEY_verify_init(ctx) > 0
+ && EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) > 0
+ && EVP_PKEY_CTX_set_signature_md(ctx, md) > 0
+ && EVP_PKEY_verify(ctx, sig->data, sig->len,
+ data->data, data->len) == 1
)
{ EVP_PKEY_CTX_free(ctx); return NULL; }
-
EVP_PKEY_CTX_free(ctx);
+
+ DEBUG(D_tls)
+ if (Ustrcmp(ERR_reason_error_string(ERR_peek_error()), "wrong signature length") == 0)
+ debug_printf("sig len (from msg hdr): %d, expected (from dns pubkey) %d\n",
+ (int) sig->len, EVP_PKEY_size(verify_ctx->key));
}
}
-return string_sprintf("%s: %s", where, ERR_error_string(ERR_get_error(), NULL));
+
+return US ERR_error_string(ERR_get_error(), NULL);
}