X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/9020463873374eb92b17e1f05145a78abaca7279..67932e542eb65f681779f5d49974afe8369a9b9a:/src/src/pdkim/pdkim.c

diff --git a/src/src/pdkim/pdkim.c b/src/src/pdkim/pdkim.c
index 2cf323366..de54c4a48 100644
--- a/src/src/pdkim/pdkim.c
+++ b/src/src/pdkim/pdkim.c
@@ -20,7 +20,7 @@
  *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  */
 
-/* $Cambridge: exim/src/src/pdkim/pdkim.c,v 1.8 2009/11/14 14:01:16 tom Exp $ */
+/* $Cambridge: exim/src/src/pdkim/pdkim.c,v 1.12 2009/12/07 13:05:07 tom Exp $ */
 
 #include <stdlib.h>
 #include <stdio.h>
@@ -105,6 +105,27 @@ pdkim_combined_canon_entry pdkim_combined_canons[] = {
 };
 
 
+char *pdkim_verify_status_str(int status) {
+  switch(status) {
+    case PDKIM_VERIFY_NONE:    return "PDKIM_VERIFY_NONE";
+    case PDKIM_VERIFY_INVALID: return "PDKIM_VERIFY_INVALID";
+    case PDKIM_VERIFY_FAIL:    return "PDKIM_VERIFY_FAIL";
+    case PDKIM_VERIFY_PASS:    return "PDKIM_VERIFY_PASS";
+    default:                   return "PDKIM_VERIFY_UNKNOWN";
+  }
+}
+char *pdkim_verify_ext_status_str(int ext_status) {
+  switch(ext_status) {
+    case PDKIM_VERIFY_FAIL_BODY: return "PDKIM_VERIFY_FAIL_BODY";
+    case PDKIM_VERIFY_FAIL_MESSAGE: return "PDKIM_VERIFY_FAIL_MESSAGE";
+    case PDKIM_VERIFY_INVALID_PUBKEY_UNAVAILABLE: return "PDKIM_VERIFY_INVALID_PUBKEY_UNAVAILABLE";
+    case PDKIM_VERIFY_INVALID_BUFFER_SIZE: return "PDKIM_VERIFY_INVALID_BUFFER_SIZE";
+    case PDKIM_VERIFY_INVALID_PUBKEY_PARSING: return "PDKIM_VERIFY_INVALID_PUBKEY_PARSING";
+    default: return "PDKIM_VERIFY_UNKNOWN";
+  }
+}
+
+
 /* -------------------------------------------------------------------------- */
 /* Print debugging functions */
 #ifdef PDKIM_DEBUG
@@ -801,7 +822,7 @@ pdkim_pubkey *pdkim_parse_pubkey_record(pdkim_ctx *ctx, char *raw_record) {
               pub->srvtype = strdup(cur_val->str);
             break;
             case 't':
-              if (strchr(cur_val->str,'t') != NULL) pub->testing = 1;
+              if (strchr(cur_val->str,'y') != NULL) pub->testing = 1;
               if (strchr(cur_val->str,'s') != NULL) pub->no_subdomaining = 1;
             break;
             default:
@@ -1473,7 +1494,7 @@ DLLEXPORT int pdkim_feed_finish(pdkim_ctx *ctx, pdkim_signature **return_signatu
 
       if (rsa_pkcs1_sign( &rsa, RSA_PRIVATE,
                           ((sig->algo == PDKIM_ALGO_RSA_SHA1)?
-                             RSA_SHA1:RSA_SHA256),
+                             SIG_RSA_SHA1:SIG_RSA_SHA256),
                           0,
                           (unsigned char *)headerhash,
                           (unsigned char *)sig->sigdata ) != 0) {
@@ -1567,32 +1588,36 @@ DLLEXPORT int pdkim_feed_finish(pdkim_ctx *ctx, pdkim_signature **return_signatu
       if (rsa_pkcs1_verify(&rsa,
                         RSA_PUBLIC,
                         ((sig->algo == PDKIM_ALGO_RSA_SHA1)?
-                             RSA_SHA1:RSA_SHA256),
+                             SIG_RSA_SHA1:SIG_RSA_SHA256),
                         0,
                         (unsigned char *)headerhash,
                         (unsigned char *)sig->sigdata) != 0) {
         sig->verify_status =      PDKIM_VERIFY_FAIL;
         sig->verify_ext_status =  PDKIM_VERIFY_FAIL_MESSAGE;
-        #ifdef PDKIM_DEBUG
-        if (ctx->debug_stream) {
-          fprintf(ctx->debug_stream, "PDKIM [%s] signature did NOT verify OK\n",
-                  sig->domain);
-        }
-        #endif
         goto NEXT_VERIFY;
       }
 
-      /* We have a winner! */
-      sig->verify_status = PDKIM_VERIFY_PASS;
+      /* We have a winner! (if bodydhash was correct earlier) */
+      if (sig->verify_status == PDKIM_VERIFY_NONE) {
+        sig->verify_status = PDKIM_VERIFY_PASS;
+      }
+
+      NEXT_VERIFY:
 
       #ifdef PDKIM_DEBUG
       if (ctx->debug_stream) {
-        fprintf(ctx->debug_stream, "PDKIM [%s] signature verified OK\n",
-                sig->domain);
+        fprintf(ctx->debug_stream, "PDKIM [%s] signature status: %s",
+                sig->domain, pdkim_verify_status_str(sig->verify_status));
+        if (sig->verify_ext_status > 0) {
+          fprintf(ctx->debug_stream, " (%s)\n",
+                  pdkim_verify_ext_status_str(sig->verify_ext_status));
+        }
+        else {
+          fprintf(ctx->debug_stream, "\n");
+        }
       }
       #endif
 
-      NEXT_VERIFY:
       rsa_free(&rsa);
       free(dns_txt_name);
       free(dns_txt_reply);