X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/4dc2379ac1ab6c21f265abed06dd9aaa214976af..bd8fbe3606d80e5a3fc02fe71b521146c6938448:/src/src/pdkim/pdkim.c

diff --git a/src/src/pdkim/pdkim.c b/src/src/pdkim/pdkim.c
index 7bfcdf4aa..4309675e6 100644
--- a/src/src/pdkim/pdkim.c
+++ b/src/src/pdkim/pdkim.c
@@ -603,90 +603,87 @@ pub = store_get(sizeof(pdkim_pubkey));
 memset(pub, 0, sizeof(pdkim_pubkey));
 
 for (p = raw_record; ; p++)
-  {
-  char c = *p;
-
-  /* Ignore FWS */
-  if (c == '\r' || c == '\n')
-    goto NEXT_CHAR;
-
-  if (where == PDKIM_HDR_LIMBO)
-    {
-    /* In limbo, just wait for a tag-char to appear */
-    if (!(c >= 'a' && c <= 'z'))
-      goto NEXT_CHAR;
-
-    where = PDKIM_HDR_TAG;
-    }
-
-  if (where == PDKIM_HDR_TAG)
     {
-    if (c >= 'a' && c <= 'z')
-      cur_tag = string_catn(cur_tag, &ts, &tl, p, 1);
+    uschar c = *p;
 
-    if (c == '=')
+    /* Ignore FWS */
+    if (c != '\r' && c != '\n') switch (where)
       {
-      cur_tag[tl] = '\0';
-      where = PDKIM_HDR_VALUE;
-      goto NEXT_CHAR;
-      }
-    }
+      case PDKIM_HDR_LIMBO:		/* In limbo, just wait for a tag-char to appear */
+	if (!(c >= 'a' && c <= 'z'))
+	  break;
+	where = PDKIM_HDR_TAG;
+	/*FALLTHROUGH*/
 
-  if (where == PDKIM_HDR_VALUE)
-    {
-    if (c == ';' || c == '\0')
-      {
-      if (tl && vl)
-        {
-	cur_val[vl] = '\0';
-	pdkim_strtrim(cur_val);
-	DEBUG(D_acl) debug_printf(" %s=%s\n", cur_tag, cur_val);
+      case PDKIM_HDR_TAG:
+	if (c >= 'a' && c <= 'z')
+	  cur_tag = string_catn(cur_tag, &ts, &tl, p, 1);
 
-	switch (cur_tag[0])
+	if (c == '=')
 	  {
-	  case 'v':
-	    /* This tag isn't evaluated because:
-	       - We only support version DKIM1.
-	       - Which is the default for this value (set below)
-	       - Other versions are currently not specified.      */
-	    break;
-	  case 'h':
-	  case 'k':
-	    pub->hashes = string_copy(cur_val); break;
-	  case 'g':
-	    pub->granularity = string_copy(cur_val); break;
-	  case 'n':
-	    pub->notes = pdkim_decode_qp(cur_val); break;
-	  case 'p':
-	    pdkim_decode_base64(US cur_val, &pub->key);
-            break;
-	  case 's':
-	    pub->srvtype = string_copy(cur_val); break;
-	  case 't':
-	    if (Ustrchr(cur_val, 'y') != NULL) pub->testing = 1;
-	    if (Ustrchr(cur_val, 's') != NULL) pub->no_subdomaining = 1;
-	    break;
-	  default:
-	    DEBUG(D_acl) debug_printf(" Unknown tag encountered\n");
-	    break;
+	  cur_tag[tl] = '\0';
+	  where = PDKIM_HDR_VALUE;
 	  }
-	}
-      tl = 0;
-      vl = 0;
-      where = PDKIM_HDR_LIMBO;
+	break;
+
+      case PDKIM_HDR_VALUE:
+	if (c == ';' || c == '\0')
+	  {
+	  if (tl && vl)
+	    {
+	    cur_val[vl] = '\0';
+	    pdkim_strtrim(cur_val);
+	    DEBUG(D_acl) debug_printf(" %s=%s\n", cur_tag, cur_val);
+
+	    switch (cur_tag[0])
+	      {
+	      case 'v':
+		pub->version = string_copy(cur_val); break;
+	      case 'h':
+	      case 'k':
+/* This field appears to never be used. Also, unclear why
+a 'k' (key-type_ would go in this field name.  There is a field
+"keytype", also never used.
+		pub->hashes = string_copy(cur_val);
+*/
+		break;
+	      case 'g':
+		pub->granularity = string_copy(cur_val); break;
+	      case 'n':
+		pub->notes = pdkim_decode_qp(cur_val); break;
+	      case 'p':
+		pdkim_decode_base64(US cur_val, &pub->key); break;
+	      case 's':
+		pub->srvtype = string_copy(cur_val); break;
+	      case 't':
+		if (Ustrchr(cur_val, 'y') != NULL) pub->testing = 1;
+		if (Ustrchr(cur_val, 's') != NULL) pub->no_subdomaining = 1;
+		break;
+	      default:
+		DEBUG(D_acl) debug_printf(" Unknown tag encountered\n");
+		break;
+	      }
+	    }
+	  tl = 0;
+	  vl = 0;
+	  where = PDKIM_HDR_LIMBO;
+	  }
+	else
+	  cur_val = string_catn(cur_val, &vs, &vl, p, 1);
+	break;
       }
-    else
-      cur_val = string_catn(cur_val, &vs, &vl, p, 1);
-    }
 
-NEXT_CHAR:
-  if (c == '\0') break;
-  }
+    if (c == '\0') break;
+    }
 
 /* Set fallback defaults */
 if (!pub->version    ) pub->version     = string_copy(PDKIM_PUB_RECORD_VERSION);
+else if (Ustrcmp(pub->version, PDKIM_PUB_RECORD_VERSION) != 0) return NULL;
+
 if (!pub->granularity) pub->granularity = string_copy(US"*");
+/*
 if (!pub->keytype    ) pub->keytype     = string_copy(US"rsa");
+*/
 if (!pub->srvtype    ) pub->srvtype     = string_copy(US"*");
 
 /* p= is required */
@@ -794,7 +791,7 @@ for (sig = ctx->sig; sig; sig = sig->next)
   DEBUG(D_acl)
     {
     debug_printf("PDKIM [%s] Body bytes hashed: %lu\n"
-		 "PDKIM [%s] bh  computed: ",
+		 "PDKIM [%s] Body hash computed: ",
 		sig->domain, sig->signed_body_bytes, sig->domain);
     pdkim_hexprint(CUS bh.data, bh.len);
     }
@@ -822,7 +819,7 @@ for (sig = ctx->sig; sig; sig = sig->next)
       {
       DEBUG(D_acl)
         {
-	debug_printf("PDKIM [%s] bh signature: ", sig->domain);
+	debug_printf("PDKIM [%s] Body hash signature from headers: ", sig->domain);
 	pdkim_hexprint(sig->bodyhash.data,
 			 exim_sha_hashlen(&sig->body_hash));
 	debug_printf("PDKIM [%s] Body hash did NOT verify\n", sig->domain);
@@ -879,7 +876,7 @@ ctx->linebuf[ctx->linebuf_offset] = '\0';
 /* Terminate on EOD marker */
 if (ctx->flags & PDKIM_DOT_TERM)
   {
-  if ( memcmp(p, ".\r\n", 3) == 0)
+  if (memcmp(p, ".\r\n", 3) == 0)
     return pdkim_body_complete(ctx);
 
   /* Unstuff dots */
@@ -962,6 +959,11 @@ if (ctx->flags & PDKIM_MODE_SIGN)
 /* DKIM-Signature: headers are added to the verification list */
 else
   {
+  DEBUG(D_acl)
+    {
+    debug_printf("PDKIM >> raw hdr: ");
+    pdkim_quoteprint(CUS ctx->cur_header, Ustrlen(ctx->cur_header));
+    }
   if (strncasecmp(CCS ctx->cur_header,
 		  DKIM_SIGNATURE_HEADERNAME,
 		  Ustrlen(DKIM_SIGNATURE_HEADERNAME)) == 0)
@@ -1020,45 +1022,60 @@ else for (p = 0; p<len; p++)
 
   if (ctx->flags & PDKIM_PAST_HDRS)
     {
+    if (c == '\n' && !(ctx->flags & PDKIM_SEEN_CR))	/* emulate the CR */
+      {
+      ctx->linebuf[ctx->linebuf_offset++] = '\r';
+      if (ctx->linebuf_offset == PDKIM_MAX_BODY_LINE_LEN-1)
+	return PDKIM_ERR_LONG_LINE;
+      }
+
     /* Processing body byte */
     ctx->linebuf[ctx->linebuf_offset++] = c;
-    if (c == '\n')
+    if (c == '\r')
+      ctx->flags |= PDKIM_SEEN_CR;
+    else if (c == '\n')
       {
-      int rc = pdkim_bodyline_complete(ctx); /* End of line */
-      if (rc != PDKIM_OK) return rc;
+      int rc;
+      ctx->flags &= ~PDKIM_SEEN_CR;
+      if ((rc = pdkim_bodyline_complete(ctx)) != PDKIM_OK)
+	return rc;
       }
-    if (ctx->linebuf_offset == (PDKIM_MAX_BODY_LINE_LEN-1))
+
+    if (ctx->linebuf_offset == PDKIM_MAX_BODY_LINE_LEN-1)
       return PDKIM_ERR_LONG_LINE;
     }
   else
     {
     /* Processing header byte */
-    if (c != '\r')
+    if (c == '\r')
+      ctx->flags |= PDKIM_SEEN_CR;
+    else if (c == '\n')
       {
-      if (c == '\n')
-        {
-	if (ctx->flags & PDKIM_SEEN_LF)
-	  {
-	  int rc = pdkim_header_complete(ctx); /* Seen last header line */
-	  if (rc != PDKIM_OK) return rc;
+      if (!(ctx->flags & PDKIM_SEEN_CR))		/* emulate the CR */
+	ctx->cur_header = string_catn(ctx->cur_header, &ctx->cur_header_size,
+				&ctx->cur_header_len, CUS "\r", 1);
 
-	  ctx->flags = ctx->flags & ~PDKIM_SEEN_LF | PDKIM_PAST_HDRS;
-	  DEBUG(D_acl) debug_printf(
-	      "PDKIM >> Body data for hash, canonicalized >>>>>>>>>>>>>>>>>>>>>>\n");
-	  continue;
-	  }
-	else
-	  ctx->flags |= PDKIM_SEEN_LF;
+      if (ctx->flags & PDKIM_SEEN_LF)
+	{
+	int rc = pdkim_header_complete(ctx); /* Seen last header line */
+	if (rc != PDKIM_OK) return rc;
+
+	ctx->flags = ctx->flags & ~(PDKIM_SEEN_LF|PDKIM_SEEN_CR) | PDKIM_PAST_HDRS;
+	DEBUG(D_acl) debug_printf(
+	    "PDKIM >> Body data for hash, canonicalized >>>>>>>>>>>>>>>>>>>>>>\n");
+	continue;
 	}
-      else if (ctx->flags & PDKIM_SEEN_LF)
-        {
-	if (!(c == '\t' || c == ' '))
-	  {
-	  int rc = pdkim_header_complete(ctx); /* End of header */
-	  if (rc != PDKIM_OK) return rc;
-	  }
-	ctx->flags &= ~PDKIM_SEEN_LF;
+      else
+	ctx->flags = ctx->flags & ~PDKIM_SEEN_CR | PDKIM_SEEN_LF;
+      }
+    else if (ctx->flags & PDKIM_SEEN_LF)
+      {
+      if (!(c == '\t' || c == ' '))
+	{
+	int rc = pdkim_header_complete(ctx); /* End of header */
+	if (rc != PDKIM_OK) return rc;
 	}
+      ctx->flags &= ~PDKIM_SEEN_LF;
       }
 
     if (ctx->cur_header_len < PDKIM_MAX_HEADER_LEN)
@@ -1303,6 +1320,74 @@ return hdr;
 }
 
 
+/* -------------------------------------------------------------------------- */
+
+static pdkim_pubkey *
+pdkim_key_from_dns(pdkim_ctx * ctx, pdkim_signature * sig, ev_ctx * vctx)
+{
+uschar * dns_txt_name, * dns_txt_reply;
+pdkim_pubkey * p;
+const uschar * errstr;
+
+/* Fetch public key for signing domain, from DNS */
+
+dns_txt_name = string_sprintf("%s._domainkey.%s.", sig->selector, sig->domain);
+
+dns_txt_reply = store_get(PDKIM_DNS_TXT_MAX_RECLEN);
+memset(dns_txt_reply, 0, PDKIM_DNS_TXT_MAX_RECLEN);
+
+if (  ctx->dns_txt_callback(CS dns_txt_name, CS dns_txt_reply) != PDKIM_OK 
+   || dns_txt_reply[0] == '\0'
+   )
+  {
+  sig->verify_status =      PDKIM_VERIFY_INVALID;
+  sig->verify_ext_status =  PDKIM_VERIFY_INVALID_PUBKEY_UNAVAILABLE;
+  return NULL;
+  }
+
+DEBUG(D_acl)
+  {
+  debug_printf(
+    "PDKIM >> Parsing public key record >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n"
+    " Raw record: ");
+  pdkim_quoteprint(CUS dns_txt_reply, Ustrlen(dns_txt_reply));
+  }
+
+if (  !(p = pdkim_parse_pubkey_record(ctx, CUS dns_txt_reply))
+   || (Ustrcmp(p->srvtype, "*") != 0 && Ustrcmp(p->srvtype, "email") != 0)
+   )
+  {
+  sig->verify_status =      PDKIM_VERIFY_INVALID;
+  sig->verify_ext_status =  PDKIM_VERIFY_INVALID_PUBKEY_DNSRECORD;
+
+  DEBUG(D_acl)
+    {
+    if (p)
+      debug_printf(" Invalid public key service type '%s'\n", p->srvtype);
+    else
+      debug_printf(" Error while parsing public key record\n");
+    debug_printf(
+      "PDKIM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n");
+    }
+  return NULL;
+  }
+
+DEBUG(D_acl) debug_printf(
+      "PDKIM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n");
+
+/* Import public key */
+if ((errstr = exim_rsa_verify_init(&p->key, vctx)))
+  {
+  DEBUG(D_acl) debug_printf("verify_init: %s\n", errstr);
+  sig->verify_status =      PDKIM_VERIFY_INVALID;
+  sig->verify_ext_status =  PDKIM_VERIFY_INVALID_PUBKEY_IMPORT;
+  return NULL;
+  }
+
+return p;
+}
+
+
 /* -------------------------------------------------------------------------- */
 
 DLLEXPORT int
@@ -1341,7 +1426,7 @@ while (sig)
   exim_sha_init(&hhash_ctx, is_sha1 ? HASH_SHA1 : HASH_SHA256);
 
   DEBUG(D_acl) debug_printf(
-      "PDKIM >> Hashed header data, canonicalized, in sequence >>>>>>>>>>>>>>\n");
+      "PDKIM >> Header data for hash, canonicalized, in sequence >>>>>>>>>>>>>>\n");
 
   /* SIGNING ---------------------------------------------------------------- */
   /* When signing, walk through our header list and add them to the hash. As we
@@ -1471,7 +1556,7 @@ while (sig)
 
   DEBUG(D_acl)
     {
-    debug_printf("PDKIM [%s] hh computed: ", sig->domain);
+    debug_printf("PDKIM [%s] Header hash computed: ", sig->domain);
     pdkim_hexprint(hhash.data, hhash.len);
     }
 
@@ -1520,8 +1605,7 @@ while (sig)
     {
     ev_ctx vctx;
     const uschar * errstr;
-
-    uschar *dns_txt_name, *dns_txt_reply;
+    pdkim_pubkey * p;
 
     /* Make sure we have all required signature tags */
     if (!(  sig->domain        && *sig->domain
@@ -1554,52 +1638,8 @@ while (sig)
       goto NEXT_VERIFY;
       }
 
-    /* Fetch public key for signing domain, from DNS */
-
-    dns_txt_name = string_sprintf("%s._domainkey.%s.",
-				 sig->selector, sig->domain);
-
-    dns_txt_reply = store_get(PDKIM_DNS_TXT_MAX_RECLEN);
-    memset(dns_txt_reply, 0, PDKIM_DNS_TXT_MAX_RECLEN);
-
-    if (  ctx->dns_txt_callback(CS dns_txt_name, CS dns_txt_reply) != PDKIM_OK 
-       || dns_txt_reply[0] == '\0')
-      {
-      sig->verify_status =      PDKIM_VERIFY_INVALID;
-      sig->verify_ext_status =  PDKIM_VERIFY_INVALID_PUBKEY_UNAVAILABLE;
-      goto NEXT_VERIFY;
-      }
-
-    DEBUG(D_acl)
-      {
-      debug_printf(
-          "PDKIM >> Parsing public key record >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n"
-          " Raw record: ");
-      pdkim_quoteprint(CUS dns_txt_reply, Ustrlen(dns_txt_reply));
-      }
-
-    if (!(sig->pubkey = pdkim_parse_pubkey_record(ctx, CUS dns_txt_reply)))
-      {
-      sig->verify_status =      PDKIM_VERIFY_INVALID;
-      sig->verify_ext_status =  PDKIM_VERIFY_INVALID_PUBKEY_DNSRECORD;
-
-      DEBUG(D_acl) debug_printf(
-	  " Error while parsing public key record\n"
-	  "PDKIM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n");
-      goto NEXT_VERIFY;
-      }
-
-    DEBUG(D_acl) debug_printf(
-	  "PDKIM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n");
-
-    /* Import public key */
-    if ((errstr = exim_rsa_verify_init(&sig->pubkey->key, &vctx)))
-      {
-      DEBUG(D_acl) debug_printf("verify_init: %s\n", errstr);
-      sig->verify_status =      PDKIM_VERIFY_INVALID;
-      sig->verify_ext_status =  PDKIM_VERIFY_INVALID_PUBKEY_IMPORT;
+    if (!(sig->pubkey = pdkim_key_from_dns(ctx, sig, &vctx)))
       goto NEXT_VERIFY;
-      }
 
     /* Check the signature */
     if ((errstr = exim_rsa_verify(&vctx, is_sha1, &hhash, &sig->sigdata)))
@@ -1611,7 +1651,7 @@ while (sig)
       }
 
 
-    /* We have a winner! (if bodydhash was correct earlier) */
+    /* We have a winner! (if bodyhash was correct earlier) */
     if (sig->verify_status == PDKIM_VERIFY_NONE)
       sig->verify_status = PDKIM_VERIFY_PASS;
 
@@ -1661,22 +1701,24 @@ return ctx;
 /* -------------------------------------------------------------------------- */
 
 DLLEXPORT pdkim_ctx *
-pdkim_init_sign(char *domain, char *selector, char *rsa_privkey, int algo,
-  BOOL dot_stuffed)
+pdkim_init_sign(char * domain, char * selector, char * rsa_privkey, int algo,
+  BOOL dot_stuffed, int(*dns_txt_callback)(char *, char *))
 {
-pdkim_ctx *ctx;
-pdkim_signature *sig;
+pdkim_ctx * ctx;
+pdkim_signature * sig;
 
 if (!domain || !selector || !rsa_privkey)
   return NULL;
 
-ctx = store_get(sizeof(pdkim_ctx));
+ctx = store_get(sizeof(pdkim_ctx) + PDKIM_MAX_BODY_LINE_LEN + sizeof(pdkim_signature));
 memset(ctx, 0, sizeof(pdkim_ctx));
 
 ctx->flags = dot_stuffed ? PDKIM_MODE_SIGN | PDKIM_DOT_TERM : PDKIM_MODE_SIGN;
-ctx->linebuf = store_get(PDKIM_MAX_BODY_LINE_LEN);
+ctx->linebuf = CS (ctx+1);
 
-sig = store_get(sizeof(pdkim_signature));
+DEBUG(D_acl) ctx->dns_txt_callback = dns_txt_callback;
+
+sig = (pdkim_signature *)(ctx->linebuf + PDKIM_MAX_BODY_LINE_LEN);
 memset(sig, 0, sizeof(pdkim_signature));
 
 sig->bodylength = -1;
@@ -1688,6 +1730,18 @@ sig->rsa_privkey = string_copy(US rsa_privkey);
 sig->algo = algo;
 
 exim_sha_init(&sig->body_hash, algo == PDKIM_ALGO_RSA_SHA1 ? HASH_SHA1 : HASH_SHA256);
+
+DEBUG(D_acl)
+  {
+  pdkim_signature s = *sig;
+  ev_ctx vctx;
+
+  debug_printf("PDKIM (checking verify key)<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n");
+  if (!pdkim_key_from_dns(ctx, &s, &vctx))
+    debug_printf("WARNING: bad dkim key in dns\n");
+  debug_printf("PDKIM (finished checking verify key)<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n");
+  }
+
 return ctx;
 }