/*
* PDKIM - a RFC4871 (DKIM) implementation
- *
- * Copyright (C) 1995 - 2018 Exim maintainers
+ * Copyright (c) The Exim Maintainers 1995 - 2022
+ * SPDX-License-Identifier: GPL-2.0-or-later
*
* signing/verification interface
*/
#ifdef SIGN_GNUTLS
# define EXIM_GNUTLS_LIBRARY_LOG_LEVEL 3
+# ifndef GNUTLS_VERIFY_ALLOW_BROKEN
+# define GNUTLS_VERIFY_ALLOW_BROKEN 0
+# endif
+
/* Logging function which can be registered with
* gnutls_global_set_log_function()
default: return US"nonhandled hash type";
}
- if ((rc = gnutls_pubkey_verify_hash2(verify_ctx->key, algo, 0, &k, &s)) < 0)
+ if ((rc = gnutls_pubkey_verify_hash2(verify_ctx->key, algo,
+ GNUTLS_VERIFY_ALLOW_BROKEN, &k, &s)) < 0)
ret = US gnutls_strerror(rc);
}
*s2 = '\0';
-if ((rc = b64decode(s1, &der.data) < 0))
+if ((rc = b64decode(s1, &der.data, s1) < 0))
return US"Bad PEM-DER b64 decode";
der.len = rc;
}
#define SIGSPACE 128
-sig->data = store_get(SIGSPACE, FALSE);
+sig->data = store_get(SIGSPACE, GET_UNTAINTED);
if (gcry_mpi_cmp (sign_ctx->p, sign_ctx->q) > 0)
{
if ( (ctx = EVP_MD_CTX_new())
&& EVP_DigestSignInit(ctx, NULL, md, NULL, sign_ctx->key) > 0
&& EVP_DigestSign(ctx, NULL, &siglen, NULL, 0) > 0
- && (sig->data = store_get(siglen, FALSE))
+ && (sig->data = store_get(siglen, GET_UNTAINTED))
/* Obtain the signature (slen could change here!) */
&& EVP_DigestSign(ctx, sig->data, &siglen, data->data, data->len) > 0
&& EVP_DigestSignInit(ctx, NULL, md, NULL, sign_ctx->key) > 0
&& EVP_DigestSignUpdate(ctx, data->data, data->len) > 0
&& EVP_DigestSignFinal(ctx, NULL, &siglen) > 0
- && (sig->data = store_get(siglen, FALSE))
+ && (sig->data = store_get(siglen, GET_UNTAINTED))
/* Obtain the signature (slen could change here!) */
&& EVP_DigestSignFinal(ctx, sig->data, &siglen) > 0