/*
* PDKIM - a RFC4871 (DKIM) implementation
*
- * Copyright (C) 1995 - 2018 Exim maintainers
+ * Copyright (C) 1995 - 2020 Exim maintainers
*
* signing/verification interface
*/
#ifndef DISABLE_DKIM /* rest of file */
-#ifndef SUPPORT_TLS
-# error Need SUPPORT_TLS for DKIM
+#ifdef DISABLE_TLS
+# error Must no DISABLE_TLS, for DKIM
#endif
Return: NULL for success, or an error string */
const uschar *
-exim_dkim_verify_init(blob * pubkey, keyformat fmt, ev_ctx * verify_ctx)
+exim_dkim_verify_init(blob * pubkey, keyformat fmt, ev_ctx * verify_ctx,
+ unsigned * bits)
{
gnutls_datum_t k;
int rc;
ret = US"pubkey format not handled";
break;
}
+if (!ret && bits) gnutls_pubkey_get_pk_algorithm(verify_ctx->key, bits);
return ret;
}
*s2 = '\0';
-if ((der.len = b64decode(s1, &der.data)) < 0)
+if ((rc = b64decode(s1, &der.data) < 0))
return US"Bad PEM-DER b64 decode";
+der.len = rc;
/* untangle asn.1 */
}
#define SIGSPACE 128
-sig->data = store_get(SIGSPACE);
+sig->data = store_get(SIGSPACE, FALSE);
if (gcry_mpi_cmp (sign_ctx->p, sign_ctx->q) > 0)
{
Return: NULL for success, or an error string */
const uschar *
-exim_dkim_verify_init(blob * pubkey, keyformat fmt, ev_ctx * verify_ctx)
+exim_dkim_verify_init(blob * pubkey, keyformat fmt, ev_ctx * verify_ctx,
+ unsigned * bits)
{
/*
in code sequence per b81207d2bfa92 rsa_parse_public_key() and asn1_get_mpi()
uschar tag_class;
int taglen;
long alen;
+unsigned nbits;
int rc;
uschar * errstr;
gcry_error_t gerr;
/* read two integers */
DEBUG(D_acl) stage = US"MPI";
-if ( (errstr = as_mpi(pubkey, &verify_ctx->n))
- || (errstr = as_mpi(pubkey, &verify_ctx->e))
- )
- return errstr;
+nbits = pubkey->len;
+if ((errstr = as_mpi(pubkey, &verify_ctx->n))) return errstr;
+nbits = (nbits - pubkey->len) * 8;
+if ((errstr = as_mpi(pubkey, &verify_ctx->e))) return errstr;
#ifdef extreme_debug
DEBUG(D_acl) debug_printf_indent("rsa_verify_init:\n");
}
#endif
+if (bits) *bits = nbits;
return NULL;
asn_err:
const uschar *
exim_dkim_signing_init(const uschar * privkey_pem, es_ctx * sign_ctx)
{
-BIO * bp = BIO_new_mem_buf(privkey_pem, -1);
+BIO * bp = BIO_new_mem_buf((void *)privkey_pem, -1);
if (!(sign_ctx->key = PEM_read_bio_PrivateKey(bp, NULL, NULL, NULL)))
return string_sprintf("privkey PEM-block import: %s",
if ( (ctx = EVP_MD_CTX_new())
&& EVP_DigestSignInit(ctx, NULL, md, NULL, sign_ctx->key) > 0
&& EVP_DigestSign(ctx, NULL, &siglen, NULL, 0) > 0
- && (sig->data = store_get(siglen))
+ && (sig->data = store_get(siglen, FALSE))
/* Obtain the signature (slen could change here!) */
&& EVP_DigestSign(ctx, sig->data, &siglen, data->data, data->len) > 0
&& EVP_DigestSignInit(ctx, NULL, md, NULL, sign_ctx->key) > 0
&& EVP_DigestSignUpdate(ctx, data->data, data->len) > 0
&& EVP_DigestSignFinal(ctx, NULL, &siglen) > 0
- && (sig->data = store_get(siglen))
+ && (sig->data = store_get(siglen, FALSE))
/* Obtain the signature (slen could change here!) */
&& EVP_DigestSignFinal(ctx, sig->data, &siglen) > 0
Return: NULL for success, or an error string */
const uschar *
-exim_dkim_verify_init(blob * pubkey, keyformat fmt, ev_ctx * verify_ctx)
+exim_dkim_verify_init(blob * pubkey, keyformat fmt, ev_ctx * verify_ctx,
+ unsigned * bits)
{
const uschar * s = pubkey->data;
uschar * ret = NULL;
break;
}
+if (!ret && bits) *bits = EVP_PKEY_bits(verify_ctx->key);
return ret;
}