X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/a05d3e341fae03426a9caa9c5e9ce8fe60e3d384..286b9d5fa4344de72fe6575fa089237fd7dbb56f:/src/src/pdkim/pdkim.c diff --git a/src/src/pdkim/pdkim.c b/src/src/pdkim/pdkim.c index b884671da..eec1a9c16 100644 --- a/src/src/pdkim/pdkim.c +++ b/src/src/pdkim/pdkim.c @@ -82,13 +82,22 @@ static const pdkim_hashtype pdkim_hashes[] = { }; const uschar * pdkim_keytypes[] = { - US"rsa" + [KEYTYPE_RSA] = US"rsa", +#ifdef SIGN_HAVE_ED25519 + [KEYTYPE_ED25519] = US"ed25519", /* Works for 3.6.0 GnuTLS */ +#endif + +#ifdef notyet_EC_dkim_extensions /* https://tools.ietf.org/html/draft-srose-dkim-ecc-00 */ + US"eccp256", + US"eccp348", + US"ed448", +#endif }; typedef struct pdkim_combined_canon_entry { - const uschar * str; - int canon_headers; - int canon_body; + const uschar * str; + int canon_headers; + int canon_body; } pdkim_combined_canon_entry; pdkim_combined_canon_entry pdkim_combined_canons[] = { @@ -155,9 +164,9 @@ switch(status) { case PDKIM_OK: return US"OK"; case PDKIM_FAIL: return US"FAIL"; - case PDKIM_ERR_RSA_PRIVKEY: return US"RSA_PRIVKEY"; - case PDKIM_ERR_RSA_SIGNING: return US"RSA SIGNING"; - case PDKIM_ERR_LONG_LINE: return US"RSA_LONG_LINE"; + case PDKIM_ERR_RSA_PRIVKEY: return US"PRIVKEY"; + case PDKIM_ERR_RSA_SIGNING: return US"SIGNING"; + case PDKIM_ERR_LONG_LINE: return US"LONG_LINE"; case PDKIM_ERR_BUFFER_TOO_SMALL: return US"BUFFER_TOO_SMALL"; case PDKIM_SIGN_PRIVKEY_WRAP: return US"PRIVKEY_WRAP"; case PDKIM_SIGN_PRIVKEY_B64D: return US"PRIVKEY_B64D"; @@ -504,7 +513,7 @@ for (p = raw_hdr; ; p++) switch (*cur_tag->s) { - case 'b': + case 'b': /* sig-data or body-hash */ switch (cur_tag->s[1]) { case '\0': pdkim_decode_base64(cur_val->s, &sig->sighash); break; @@ -514,26 +523,35 @@ for (p = raw_hdr; ; p++) default: break; } break; - case 'v': + case 'v': /* version */ /* We only support version 1, and that is currently the only version there is. */ sig->version = Ustrcmp(cur_val->s, PDKIM_SIGNATURE_VERSION) == 0 ? 1 : -1; break; - case 'a': + case 'a': /* algorithm */ { uschar * s = Ustrchr(cur_val->s, '-'); for(i = 0; i < nelem(pdkim_keytypes); i++) if (Ustrncmp(cur_val->s, pdkim_keytypes[i], s - cur_val->s) == 0) { sig->keytype = i; break; } + if (sig->keytype < 0) + log_write(0, LOG_MAIN, + "DKIM: ignoring signature due to nonhandled keytype in a=%s", + cur_val->s); + for (++s, i = 0; i < nelem(pdkim_hashes); i++) if (Ustrcmp(s, pdkim_hashes[i].dkim_hashname) == 0) { sig->hashtype = i; break; } + if (sig->hashtype < 0) + log_write(0, LOG_MAIN, + "DKIM: ignoring signature due to nonhandled hashtype in a=%s", + cur_val); break; } - case 'c': + case 'c': /* canonicalization */ for (i = 0; pdkim_combined_canons[i].str; i++) if (Ustrcmp(cur_val->s, pdkim_combined_canons[i].str) == 0) { @@ -542,30 +560,32 @@ for (p = raw_hdr; ; p++) break; } break; - case 'q': + case 'q': /* Query method (for pubkey)*/ for (i = 0; pdkim_querymethods[i]; i++) if (Ustrcmp(cur_val->s, pdkim_querymethods[i]) == 0) { - sig->querymethod = i; + sig->querymethod = i; /* we never actually use this */ break; } break; - case 's': + case 's': /* Selector */ sig->selector = string_copyn(cur_val->s, cur_val->ptr); break; - case 'd': + case 'd': /* SDID */ sig->domain = string_copyn(cur_val->s, cur_val->ptr); break; - case 'i': + case 'i': /* AUID */ sig->identity = pdkim_decode_qp(cur_val->s); break; - case 't': + case 't': /* Timestamp */ sig->created = strtoul(CS cur_val->s, NULL, 10); break; - case 'x': + case 'x': /* Expiration */ sig->expires = strtoul(CS cur_val->s, NULL, 10); break; - case 'l': + case 'l': /* Body length count */ sig->bodylength = strtol(CS cur_val->s, NULL, 10); break; - case 'h': + case 'h': /* signed header fields */ sig->headernames = string_copyn(cur_val->s, cur_val->ptr); break; - case 'z': + case 'z': /* Copied headfields */ sig->copiedheaders = pdkim_decode_qp(cur_val->s); break; +/*XXX draft-ietf-dcrup-dkim-crypto-05 would need 'p' tag support +for rsafp signatures. But later discussion is dropping those. */ default: DEBUG(D_acl) debug_printf(" Unknown tag encountered\n"); break; @@ -587,6 +607,9 @@ NEXT_CHAR: *q++ = c; } +if (sig->keytype < 0 || sig->hashtype < 0) /* Cannot verify this signature */ + return NULL; + *q = '\0'; /* Chomp raw header. The final newline must not be added to the signature. */ while (--q > sig->rawsig_no_b_val && (*q == '\r' || *q == '\n')) @@ -603,14 +626,9 @@ DEBUG(D_acl) "PDKIM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n"); } -/*XXX hash method: extend for sha512 */ -if (!exim_sha_init(&sig->body_hash_ctx, - pdkim_hashes[sig->hashtype].exim_hashmethod)) - { - DEBUG(D_acl) - debug_printf("PDKIM: hash init error, possibly nonhandled hashtype\n"); +if (!pdkim_set_bodyhash(ctx, sig)) return NULL; - } + return sig; } @@ -640,7 +658,7 @@ while ((ele = string_nextinlist(&raw_record, &sep, NULL, 0))) { case 'v': pub->version = val; break; case 'h': pub->hashes = val; break; - case 'k': break; + case 'k': pub->keytype = val; break; case 'g': pub->granularity = val; break; case 'n': pub->notes = pdkim_decode_qp(val); break; case 'p': pdkim_decode_base64(val, &pub->key); break; @@ -654,7 +672,8 @@ while ((ele = string_nextinlist(&raw_record, &sep, NULL, 0))) } /* Set fallback defaults */ -if (!pub->version ) pub->version = string_copy(PDKIM_PUB_RECORD_VERSION); +if (!pub->version) + pub->version = string_copy(PDKIM_PUB_RECORD_VERSION); else if (Ustrcmp(pub->version, PDKIM_PUB_RECORD_VERSION) != 0) { DEBUG(D_acl) debug_printf(" Bad v= field\n"); @@ -662,9 +681,7 @@ else if (Ustrcmp(pub->version, PDKIM_PUB_RECORD_VERSION) != 0) } if (!pub->granularity) pub->granularity = US"*"; -/* if (!pub->keytype ) pub->keytype = US"rsa"; -*/ if (!pub->srvtype ) pub->srvtype = US"*"; /* p= is required */ @@ -678,23 +695,16 @@ return NULL; /* -------------------------------------------------------------------------- */ -/* Update the bodyhash for one sig, with some additional data. +/* Update one bodyhash with some additional data. If we have to relax the data for this sig, return our copy of it. */ -/*XXX Currently we calculate a hash for each sig. But it is possible -that multi-signing will be wanted using different signing algos -(rsa, ec) using the same hash and canonicalization. Consider in future -hanging the hash+cacnon from the ctx and only referencing from the sig, -so that it can be calculated only once - being over the body this -caould be meagbytes, hence expensive. */ - static blob * -pdkim_update_sig_bodyhash(pdkim_signature * sig, blob * orig_data, blob * relaxed_data) +pdkim_update_ctx_bodyhash(pdkim_bodyhash * b, blob * orig_data, blob * relaxed_data) { blob * canon_data = orig_data; /* Defaults to simple canon (no further treatment necessary) */ -if (sig->canon_body == PDKIM_CANON_RELAXED) +if (b->canon_method == PDKIM_CANON_RELAXED) { /* Relax the line if not done already */ if (!relaxed_data) @@ -737,15 +747,15 @@ if (sig->canon_body == PDKIM_CANON_RELAXED) } /* Make sure we don't exceed the to-be-signed body length */ -if ( sig->bodylength >= 0 - && sig->signed_body_bytes + (unsigned long)canon_data->len > sig->bodylength +if ( b->bodylength >= 0 + && b->signed_body_bytes + (unsigned long)canon_data->len > b->bodylength ) - canon_data->len = sig->bodylength - sig->signed_body_bytes; + canon_data->len = b->bodylength - b->signed_body_bytes; if (canon_data->len > 0) { - exim_sha_update(&sig->body_hash_ctx, CUS canon_data->data, canon_data->len); - sig->signed_body_bytes += canon_data->len; + exim_sha_update(&b->body_hash_ctx, CUS canon_data->data, canon_data->len); + b->signed_body_bytes += canon_data->len; DEBUG(D_acl) pdkim_quoteprint(canon_data->data, canon_data->len); } @@ -758,32 +768,32 @@ return relaxed_data; static void pdkim_finish_bodyhash(pdkim_ctx * ctx) { +pdkim_bodyhash * b; pdkim_signature * sig; +for (b = ctx->bodyhash; b; b = b->next) /* Finish hashes */ + exim_sha_finish(&b->body_hash_ctx, &b->bh); + /* Traverse all signatures */ for (sig = ctx->sig; sig; sig = sig->next) - { /* Finish hashes */ - blob bh; - - exim_sha_finish(&sig->body_hash_ctx, &bh); + { + b = sig->calc_body_hash; DEBUG(D_acl) { debug_printf("PDKIM [%s] Body bytes hashed: %lu\n" "PDKIM [%s] Body %s computed: ", - sig->domain, sig->signed_body_bytes, + sig->domain, b->signed_body_bytes, sig->domain, pdkim_hashes[sig->hashtype].dkim_hashname); - pdkim_hexprint(CUS bh.data, bh.len); + pdkim_hexprint(CUS b->bh.data, b->bh.len); } /* SIGNING -------------------------------------------------------------- */ if (ctx->flags & PDKIM_MODE_SIGN) { - sig->bodyhash = bh; - /* If bodylength limit is set, and we have received less bytes than the requested amount, effectively remove the limit tag. */ - if (sig->signed_body_bytes < sig->bodylength) + if (b->signed_body_bytes < sig->bodylength) sig->bodylength = -1; } @@ -791,7 +801,8 @@ for (sig = ctx->sig; sig; sig = sig->next) /* VERIFICATION --------------------------------------------------------- */ /* Be careful that the header sig included a bodyash */ - if (sig->bodyhash.data && memcmp(bh.data, sig->bodyhash.data, bh.len) == 0) + if ( sig->bodyhash.data + && memcmp(b->bh.data, sig->bodyhash.data, b->bh.len) == 0) { DEBUG(D_acl) debug_printf("PDKIM [%s] Body hash verified OK\n", sig->domain); } @@ -814,7 +825,7 @@ for (sig = ctx->sig; sig; sig = sig->next) static void pdkim_body_complete(pdkim_ctx * ctx) { -pdkim_signature * sig; +pdkim_bodyhash * b; /* In simple body mode, if any empty lines were buffered, replace with one. rfc 4871 3.4.3 */ @@ -822,12 +833,12 @@ replace with one. rfc 4871 3.4.3 */ it indicates that all linebreaks should be buffered, including the one terminating a text line */ -for (sig = ctx->sig; sig; sig = sig->next) - if ( sig->canon_body == PDKIM_CANON_SIMPLE - && sig->signed_body_bytes == 0 - && sig->num_buffered_blanklines > 0 +for (b = ctx->bodyhash; b; b = b->next) + if ( b->canon_method == PDKIM_CANON_SIMPLE + && b->signed_body_bytes == 0 + && b->num_buffered_blanklines > 0 ) - (void) pdkim_update_sig_bodyhash(sig, &lineending, NULL); + (void) pdkim_update_ctx_bodyhash(b, &lineending, NULL); ctx->flags |= PDKIM_SEEN_EOD; ctx->linebuf_offset = 0; @@ -842,7 +853,7 @@ static void pdkim_bodyline_complete(pdkim_ctx * ctx) { blob line = {.data = ctx->linebuf, .len = ctx->linebuf_offset}; -pdkim_signature * sig; +pdkim_bodyhash * b; blob * rnl = NULL; blob * rline = NULL; @@ -866,14 +877,14 @@ if (ctx->flags & PDKIM_DOT_TERM) /* Empty lines need to be buffered until we find a non-empty line */ if (memcmp(line.data, "\r\n", 2) == 0) { - for (sig = ctx->sig; sig; sig = sig->next) sig->num_buffered_blanklines++; + for (b = ctx->bodyhash; b; b = b->next) b->num_buffered_blanklines++; goto all_skip; } -/* Process line for each sig separately */ -for (sig = ctx->sig; sig; sig = sig->next) +/* Process line for each bodyhash separately */ +for (b = ctx->bodyhash; b; b = b->next) { - if (sig->canon_body == PDKIM_CANON_RELAXED) + if (b->canon_method == PDKIM_CANON_RELAXED) { /* Lines with just spaces need to be buffered too */ uschar * cp = line.data; @@ -882,25 +893,25 @@ for (sig = ctx->sig; sig; sig = sig->next) while ((c = *cp)) { if (c == '\r' && cp[1] == '\n') break; - if (c != ' ' && c != '\t') goto sig_process; + if (c != ' ' && c != '\t') goto hash_process; cp++; } - sig->num_buffered_blanklines++; - goto sig_skip; + b->num_buffered_blanklines++; + goto hash_skip; } -sig_process: +hash_process: /* At this point, we have a non-empty line, so release the buffered ones. */ - while (sig->num_buffered_blanklines) + while (b->num_buffered_blanklines) { - rnl = pdkim_update_sig_bodyhash(sig, &lineending, rnl); - sig->num_buffered_blanklines--; + rnl = pdkim_update_ctx_bodyhash(b, &lineending, rnl); + b->num_buffered_blanklines--; } - rline = pdkim_update_sig_bodyhash(sig, &line, rline); -sig_skip: ; + rline = pdkim_update_ctx_bodyhash(b, &line, rline); +hash_skip: ; } if (rnl) store_free(rnl); @@ -1188,6 +1199,8 @@ return str; /* -------------------------------------------------------------------------- */ +/* Signing: create signature header +*/ static uschar * pdkim_create_header(pdkim_signature * sig, BOOL final) { @@ -1238,7 +1251,7 @@ hdr = pdkim_headcat(&col, hdr, US";", US"s=", sig->selector); } } -base64_bh = pdkim_encode_base64(&sig->bodyhash); +base64_bh = pdkim_encode_base64(&sig->calc_body_hash->bh); hdr = pdkim_headcat(&col, hdr, US";", US"bh=", base64_bh); /* Optional bits */ @@ -1305,10 +1318,7 @@ pdkim_pubkey * p; dns_txt_name = string_sprintf("%s._domainkey.%s.", sig->selector, sig->domain); -dns_txt_reply = store_get(PDKIM_DNS_TXT_MAX_RECLEN); -memset(dns_txt_reply, 0, PDKIM_DNS_TXT_MAX_RECLEN); - -if ( ctx->dns_txt_callback(CS dns_txt_name, CS dns_txt_reply) != PDKIM_OK +if ( !(dns_txt_reply = ctx->dns_txt_callback(CS dns_txt_name)) || dns_txt_reply[0] == '\0' ) { @@ -1350,7 +1360,10 @@ DEBUG(D_acl) debug_printf( "PDKIM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n"); /* Import public key */ -if ((*errstr = exim_dkim_verify_init(&p->key, vctx))) + +if ((*errstr = exim_dkim_verify_init(&p->key, + sig->keytype == KEYTYPE_ED25519 ? KEYFMT_ED25519_BARE : KEYFMT_DER, + vctx))) { DEBUG(D_acl) debug_printf("verify_init: %s\n", *errstr); sig->verify_status = PDKIM_VERIFY_INVALID; @@ -1358,6 +1371,7 @@ if ((*errstr = exim_dkim_verify_init(&p->key, vctx))) return NULL; } +vctx->keytype = sig->keytype; return p; } @@ -1368,7 +1382,10 @@ DLLEXPORT int pdkim_feed_finish(pdkim_ctx * ctx, pdkim_signature ** return_signatures, const uschar ** err) { +pdkim_bodyhash * b; pdkim_signature * sig; +BOOL verify_pass = FALSE; +es_ctx sctx; /* Check if we must still flush a (partial) header. If that is the case, the message has no body, and we must compute a body hash @@ -1381,14 +1398,20 @@ if (ctx->cur_header && ctx->cur_header->ptr > 0) if ((rc = pdkim_header_complete(ctx)) != PDKIM_OK) return rc; - for (sig = ctx->sig; sig; sig = sig->next) - rnl = pdkim_update_sig_bodyhash(sig, &lineending, rnl); + for (b = ctx->bodyhash; b; b = b->next) + rnl = pdkim_update_ctx_bodyhash(b, &lineending, rnl); if (rnl) store_free(rnl); } else DEBUG(D_acl) debug_printf( "PDKIM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n"); +if (!ctx->sig) + { + DEBUG(D_acl) debug_printf("PDKIM: no signatures\n"); + return PDKIM_OK; + } + /* Build (and/or evaluate) body hash */ pdkim_finish_bodyhash(ctx); @@ -1398,11 +1421,33 @@ for (sig = ctx->sig; sig; sig = sig->next) uschar * sig_hdr = US""; blob hhash; gstring * hdata = NULL; + es_ctx sctx; + + /*XXX The hash of the headers is needed for GCrypt (for which we can do RSA + suging only, as it happens) and for either GnuTLS and OpenSSL when we are + signing with EC (specifically, Ed25519). The former is because the GCrypt + signing operation is pure (does not do its own hash) so we must hash. The + latter is because we (stupidly, but this is what the IETF draft is saying) + must hash with the declared hash method, then pass the result to the library + hash-and-sign routine (because that's all the libraries are providing. And + we're stuck with whatever that hidden hash method is, too). We may as well + do this hash incrementally. + We don't need the hash we're calculating here for the GnuTLS and OpenSSL + cases of RSA signing, since those library routines can do hash-and-sign. + + Some time in the future we could easily avoid doing the hash here for those + cases (which will be common for a long while. We could also change from + the current copy-all-the-headers-into-one-block, then call the hash-and-sign + implementation - to a proper incremental one. Unfortunately, GnuTLS just + cannot do incremental - either signing or verification. Unsure about GCrypt. + */ + + /*XXX The header hash is also used (so far) by the verify operation */ if (!exim_sha_init(&hhash_ctx, pdkim_hashes[sig->hashtype].exim_hashmethod)) { - DEBUG(D_acl) - debug_printf("PDKIM: hash setup error, possibly nonhandled hashtype\n"); + log_write(0, LOG_MAIN|LOG_PANIC, + "PDKIM: hash setup error, possibly nonhandled hashtype"); break; } @@ -1430,9 +1475,19 @@ for (sig = ctx->sig; sig; sig = sig->next) uschar * s; int sep = 0; - sig->headernames = NULL; /* Collected signed header names */ + /* Import private key, including the keytype which we need for building + the signature header */ - for (p = sig->headers; p; p = p->next) +/*XXX extend for non-RSA algos */ + if ((*err = exim_dkim_signing_init(US sig->privkey, &sctx))) + { + log_write(0, LOG_MAIN|LOG_PANIC, "signing_init: %s", *err); + return PDKIM_ERR_RSA_PRIVKEY; + } + sig->keytype = sctx.keytype; + + for (sig->headernames = NULL, /* Collected signed header names */ + p = sig->headers; p; p = p->next) { uschar * rh = p->value; @@ -1448,6 +1503,7 @@ for (sig = ctx->sig; sig; sig = sig->next) exim_sha_update(&hhash_ctx, CUS rh, Ustrlen(rh)); /* Remember headers block for signing (when the library cannot do incremental) */ + /*XXX we could avoid doing this for all but the GnuTLS/RSA case */ hdata = exim_dkim_data_append(hdata, rh); DEBUG(D_acl) pdkim_quoteprint(rh, Ustrlen(rh)); @@ -1565,31 +1621,25 @@ for (sig = ctx->sig; sig; sig = sig->next) /* SIGNING ---------------------------------------------------------------- */ if (ctx->flags & PDKIM_MODE_SIGN) { - es_ctx sctx; - - /* Import private key, including the keytype */ -/*XXX extend for non-RSA algos */ - if ((*err = exim_dkim_signing_init(US sig->privkey, &sctx))) - { - DEBUG(D_acl) debug_printf("signing_init: %s\n", *err); - return PDKIM_ERR_RSA_PRIVKEY; - } + hashmethod hm = sig->keytype == KEYTYPE_ED25519 + ? HASH_SHA2_512 : pdkim_hashes[sig->hashtype].exim_hashmethod; - /* Do signing. With OpenSSL we are signing the hash of headers just - calculated, with GnuTLS we have to sign an entire block of headers - (due to available interfaces) and it recalculates the hash internally. */ +#ifdef SIGN_HAVE_ED25519 + /* For GCrypt, and for EC, we pass the hash-of-headers to the signing + routine. For anything else we just pass the headers. */ -#if defined(SIGN_GNUTLS) - hhash.data = hdata->s; - hhash.len = hdata->ptr; + if (sig->keytype != KEYTYPE_ED25519) #endif + { + hhash.data = hdata->s; + hhash.len = hdata->ptr; + } /*XXX extend for non-RSA algos */ - if ((*err = exim_dkim_sign(&sctx, - pdkim_hashes[sig->hashtype].exim_hashmethod, - &hhash, &sig->sighash))) +/*- done for GnuTLS */ + if ((*err = exim_dkim_sign(&sctx, hm, &hhash, &sig->sighash))) { - DEBUG(D_acl) debug_printf("signing: %s\n", *err); + log_write(0, LOG_MAIN|LOG_PANIC, "signing: %s", *err); return PDKIM_ERR_RSA_SIGNING; } @@ -1646,7 +1696,12 @@ for (sig = ctx->sig; sig; sig = sig->next) } if (!(sig->pubkey = pdkim_key_from_dns(ctx, sig, &vctx, err))) + { + log_write(0, LOG_MAIN, "PDKIM: %s%s %s%s [failed key import]", + sig->domain ? "d=" : "", sig->domain ? sig->domain : US"", + sig->selector ? "s=" : "", sig->selector ? sig->selector : US""); goto NEXT_VERIFY; + } /* If the pubkey limits to a list of specific hashes, ignore sigs that do not have the hash part of the sig algorithm matching */ @@ -1670,10 +1725,11 @@ for (sig = ctx->sig; sig; sig = sig->next) } /* Check the signature */ -/*XXX needs extension for non-RSA */ +/*XXX extend for non-RSA algos */ +/*- done for GnuTLS */ if ((*err = exim_dkim_verify(&vctx, - pdkim_hashes[sig->hashtype].exim_hashmethod, - &hhash, &sig->sighash))) + pdkim_hashes[sig->hashtype].exim_hashmethod, + &hhash, &sig->sighash))) { DEBUG(D_acl) debug_printf("headers verify: %s\n", *err); sig->verify_status = PDKIM_VERIFY_FAIL; @@ -1684,14 +1740,18 @@ for (sig = ctx->sig; sig; sig = sig->next) /* We have a winner! (if bodyhash was correct earlier) */ if (sig->verify_status == PDKIM_VERIFY_NONE) + { sig->verify_status = PDKIM_VERIFY_PASS; + verify_pass = TRUE; + } NEXT_VERIFY: DEBUG(D_acl) { - debug_printf("PDKIM [%s] signature status: %s", - sig->domain, pdkim_verify_status_str(sig->verify_status)); + debug_printf("PDKIM [%s] %s signature status: %s", + sig->domain, dkim_sig_to_a_tag(sig), + pdkim_verify_status_str(sig->verify_status)); if (sig->verify_ext_status > 0) debug_printf(" (%s)\n", pdkim_verify_ext_status_str(sig->verify_ext_status)); @@ -1705,14 +1765,15 @@ NEXT_VERIFY: if (return_signatures) *return_signatures = ctx->sig; -return PDKIM_OK; +return ctx->flags & PDKIM_MODE_SIGN || verify_pass + ? PDKIM_OK : PDKIM_FAIL; } /* -------------------------------------------------------------------------- */ DLLEXPORT pdkim_ctx * -pdkim_init_verify(int(*dns_txt_callback)(char *, char *), BOOL dot_stuffing) +pdkim_init_verify(uschar * (*dns_txt_callback)(char *), BOOL dot_stuffing) { pdkim_ctx * ctx; @@ -1729,8 +1790,6 @@ return ctx; /* -------------------------------------------------------------------------- */ -/*XXX ? needs extension to cover non-RSA algo? */ - DLLEXPORT pdkim_signature * pdkim_init_sign(pdkim_ctx * ctx, uschar * domain, uschar * selector, uschar * privkey, @@ -1752,22 +1811,15 @@ sig->bodylength = -1; sig->domain = string_copy(US domain); sig->selector = string_copy(US selector); sig->privkey = string_copy(US privkey); -/*XXX no keytype yet; comes from privkey */ +sig->keytype = -1; for (hashtype = 0; hashtype < nelem(pdkim_hashes); hashtype++) if (Ustrcmp(hashname, pdkim_hashes[hashtype].dkim_hashname) == 0) { sig->hashtype = hashtype; break; } if (hashtype >= nelem(pdkim_hashes)) { - DEBUG(D_acl) - debug_printf("PDKIM: unrecognised hashname '%s'\n", hashname); - return NULL; - } - -if (!exim_sha_init(&sig->body_hash_ctx, pdkim_hashes[hashtype].exim_hashmethod)) - { - DEBUG(D_acl) - debug_printf("PDKIM: hash setup error, possibly nonhandled hashtype\n"); + log_write(0, LOG_MAIN|LOG_PANIC, + "PDKIM: unrecognised hashname '%s'", hashname); return NULL; } @@ -1814,9 +1866,51 @@ return; +/* Set up a blob for calculating the bodyhash according to the +needs of this signature. Use an existing one if possible, or +create a new one. + +Return: hashblob pointer, or NULL on error (only used as a boolean). +*/ +pdkim_bodyhash * +pdkim_set_bodyhash(pdkim_ctx * ctx, pdkim_signature * sig) +{ +pdkim_bodyhash * b; + +for (b = ctx->bodyhash; b; b = b->next) + if ( sig->hashtype == b->hashtype + && sig->canon_body == b->canon_method + && sig->bodylength == b->bodylength) + goto old; + +b = store_get(sizeof(pdkim_bodyhash)); +b->next = ctx->bodyhash; +b->hashtype = sig->hashtype; +b->canon_method = sig->canon_body; +b->bodylength = sig->bodylength; +if (!exim_sha_init(&b->body_hash_ctx, /*XXX hash method: extend for sha512 */ + pdkim_hashes[sig->hashtype].exim_hashmethod)) + { + DEBUG(D_acl) + debug_printf("PDKIM: hash init error, possibly nonhandled hashtype\n"); + return NULL; + } +b->signed_body_bytes = 0; +b->num_buffered_blanklines = 0; +ctx->bodyhash = b; + +old: +sig->calc_body_hash = b; +return b; +} + + +/* -------------------------------------------------------------------------- */ + + void pdkim_init_context(pdkim_ctx * ctx, BOOL dot_stuffed, - int(*dns_txt_callback)(char *, char *)) + uschar * (*dns_txt_callback)(char *)) { memset(ctx, 0, sizeof(pdkim_ctx)); ctx->flags = dot_stuffed ? PDKIM_MODE_SIGN | PDKIM_DOT_TERM : PDKIM_MODE_SIGN;