TLS: move from SUPPORT_TLS to DISABLE_TLS macro for the build

[exim.git] / src / src / pdkim / signing.c

diff --git a/src/src/pdkim/signing.c b/src/src/pdkim/signing.c
index 18b357eaafe70cf003b62eb11b989f4dbbcbcfcd..53a8a7b45143b1a2f6c7f49c33ba27a38d1f418e 100644 (file)
--- a/src/src/pdkim/signing.c
+++ b/src/src/pdkim/signing.c
@@ -28,8 +28,8 @@ features_crypto(void)
 
 #ifndef DISABLE_DKIM   /* rest of file */
 
-#ifndef SUPPORT_TLS
-# error Need SUPPORT_TLS for DKIM
+#ifdef DISABLE_TLS
+# error Must no DISABLE_TLS, for DKIM
 #endif
 
 
@@ -169,13 +169,13 @@ switch(fmt)
   {
   case KEYFMT_DER:
     if ((rc = gnutls_pubkey_import(verify_ctx->key, &k, GNUTLS_X509_FMT_DER)))
-      ret = gnutls_strerror(rc);
+      ret = US gnutls_strerror(rc);
     break;
 #ifdef SIGN_HAVE_ED25519
   case KEYFMT_ED25519_BARE:
     if ((rc = gnutls_pubkey_import_ecc_raw(verify_ctx->key,
                                          GNUTLS_ECC_CURVE_ED25519, &k, NULL)))
-      ret = gnutls_strerror(rc);
+      ret = US gnutls_strerror(rc);
     break;
 #endif
   default:
@@ -203,7 +203,7 @@ if (verify_ctx->keytype == KEYTYPE_ED25519)
   {
   if ((rc = gnutls_pubkey_verify_data2(verify_ctx->key,
                                      GNUTLS_SIGN_EDDSA_ED25519, 0, &k, &s)) < 0)
-    ret = gnutls_strerror(rc);
+    ret = US gnutls_strerror(rc);
   }
 else
 #endif
@@ -218,7 +218,7 @@ else
     }
 
   if ((rc = gnutls_pubkey_verify_hash2(verify_ctx->key, algo, 0, &k, &s)) < 0)
-    ret = gnutls_strerror(rc);
+    ret = US gnutls_strerror(rc);
   }
 
 gnutls_pubkey_deinit(verify_ctx->key);
@@ -846,30 +846,38 @@ if (!md)
   {
   EVP_MD_CTX * ctx;
 
-  if (  (ctx = EVP_MD_CTX_new())
-     && EVP_DigestVerifyInit(ctx, NULL, md, NULL, verify_ctx->key) > 0
-     && EVP_DigestVerify(ctx, sig->data, sig->len, data->data, data->len) > 0
-     )
-    { EVP_MD_CTX_free(ctx); return NULL; }
-
-  if (ctx) EVP_MD_CTX_free(ctx);
+  if ((ctx = EVP_MD_CTX_new()))
+    {
+    if (  EVP_DigestVerifyInit(ctx, NULL, md, NULL, verify_ctx->key) > 0
+       && EVP_DigestVerify(ctx, sig->data, sig->len, data->data, data->len) > 0
+       )
+      { EVP_MD_CTX_free(ctx); return NULL; }
+    EVP_MD_CTX_free(ctx);
+    }
   }
 else
 #endif
   {
   EVP_PKEY_CTX * ctx;
 
-  if (  (ctx = EVP_PKEY_CTX_new(verify_ctx->key, NULL))
-     && EVP_PKEY_verify_init(ctx) > 0
-     && EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) > 0
-     && EVP_PKEY_CTX_set_signature_md(ctx, md) > 0
-     && EVP_PKEY_verify(ctx, sig->data, sig->len,
-         data->data, data->len) == 1
-     )
-    { EVP_PKEY_CTX_free(ctx); return NULL; }
-
-  if (ctx) EVP_PKEY_CTX_free(ctx);
+  if ((ctx = EVP_PKEY_CTX_new(verify_ctx->key, NULL)))
+    {
+    if (  EVP_PKEY_verify_init(ctx) > 0
+       && EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) > 0
+       && EVP_PKEY_CTX_set_signature_md(ctx, md) > 0
+       && EVP_PKEY_verify(ctx, sig->data, sig->len,
+                                     data->data, data->len) == 1
+       )
+      { EVP_PKEY_CTX_free(ctx); return NULL; }
+    EVP_PKEY_CTX_free(ctx);
+
+    DEBUG(D_tls)
+      if (Ustrcmp(ERR_reason_error_string(ERR_peek_error()), "wrong signature length") == 0)
+       debug_printf("sig len (from msg hdr): %d, expected (from dns pubkey) %d\n",
+        (int) sig->len, EVP_PKEY_size(verify_ctx->key));
+    }
   }
+
 return US ERR_error_string(ERR_get_error(), NULL);
 }