X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/d4fd1b83a197d73cbac114fe53f3448d8b5c7cc2..1eedc10f0c518d1878a5d94ff17b84cad233b23e:/src/src/dkim.c

diff --git a/src/src/dkim.c b/src/src/dkim.c
index 9731a63d9..867d45647 100644
--- a/src/src/dkim.c
+++ b/src/src/dkim.c
@@ -36,19 +36,19 @@ static const uschar * dkim_collect_error = NULL;
 
 
 /*XXX the caller only uses the first record if we return multiple.
-Could we hand back an allocated string?
 */
 
-static int
-dkim_exim_query_dns_txt(char *name, char *answer)
+static uschar *
+dkim_exim_query_dns_txt(char * name)
 {
 dns_answer dnsa;
 dns_scan dnss;
 dns_record *rr;
+gstring * g = NULL;
 
 lookup_dnssec_authenticated = NULL;
 if (dns_lookup(&dnsa, US name, T_TXT, NULL) != DNS_SUCCEED)
-  return PDKIM_FAIL;	/*XXX better error detail?  logging? */
+  return NULL;	/*XXX better error detail?  logging? */
 
 /* Search for TXT record */
 
@@ -65,21 +65,27 @@ for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
     while (rr_offset < rr->size)
       {
       uschar len = rr->data[rr_offset++];
-      snprintf(answer + answer_offset,
-		PDKIM_DNS_TXT_MAX_RECLEN - answer_offset,
-		"%.*s", (int)len, CS  (rr->data + rr_offset));
+
+      g = string_catn(g, US(rr->data + rr_offset), len);
+      if (g->ptr >= PDKIM_DNS_TXT_MAX_RECLEN)
+	goto bad;
+
       rr_offset += len;
-      answer_offset += len;
-      if (answer_offset >= PDKIM_DNS_TXT_MAX_RECLEN)
-	return PDKIM_FAIL;	/*XXX better error detail?  logging? */
       }
 
     /* check if this looks like a DKIM record */
-    if (strncasecmp(answer, "v=dkim", 6) != 0) continue;
-    return PDKIM_OK;
+    if (strncmp(g->s, "v=", 2) != 0 || strncasecmp(g->s, "v=dkim", 6) == 0)
+      {
+      store_reset(g->s + g->ptr + 1);
+      return string_from_gstring(g);
+      }
+
+    if (g) g->ptr = 0;		/* overwrite previous record */
     }
 
-return PDKIM_FAIL;	/*XXX better error detail?  logging? */
+bad:
+if (g) store_reset(g);
+return NULL;	/*XXX better error detail?  logging? */
 }
 
 
@@ -146,6 +152,15 @@ uschar * s;
 
 if (!sig) return;
 
+if (  !dkim_verify_overall
+   && dkim_verify_status
+      ? Ustrcmp(dkim_verify_status, US"pass") == 0
+      : sig->verify_status == PDKIM_VERIFY_PASS
+   )
+  dkim_verify_overall = string_copy(sig->domain);
+
+if (!LOGGING(dkim_verbose)) return;
+
 logmsg = string_catn(NULL, US"DKIM: ", 6);
 if (!(s = sig->domain)) s = US"<UNSET>";
 logmsg = string_append(logmsg, 2, "d=", s);
@@ -531,8 +546,12 @@ switch (what)
 }
 
 
-/* Generate signatures for the given file, returning a string.
+/* Generate signatures for the given file.
 If a prefix is given, prepend it to the file for the calculations.
+
+Return:
+  NULL:		error; error string written
+  string: 	signature header(s), or a zero-length string (not an error)
 */
 
 gstring *
@@ -702,9 +721,15 @@ while ((dkim_signing_domain = string_nextinlist(&dkim_domain, &sep, NULL, 0)))
       }
     }
   }
+if (!ctx.sig)
+  {
+  DEBUG(D_transport) debug_printf("DKIM: no viable signatures to use\n");
+  sigbuf = string_get(1);	/* return a zero-len string */
+  goto CLEANUP;
+  }
 
-if (prefix)
-  pdkim_feed(&ctx, prefix, Ustrlen(prefix));
+if (prefix && (pdkim_feed(&ctx, prefix, Ustrlen(prefix))) != PDKIM_OK)
+  goto pk_bad;
 
 if (lseek(fd, off, SEEK_SET) < 0)
   sread = -1;
@@ -729,9 +754,8 @@ if ((pdkim_rc = pdkim_feed_finish(&ctx, &sig, errstr)) != PDKIM_OK)
 for (sigbuf = NULL; sig; sig = sig->next)
   sigbuf = string_append(sigbuf, 2, US sig->signature_header, US"\r\n");
 
-(void) string_from_gstring(sigbuf);
-
 CLEANUP:
+  (void) string_from_gstring(sigbuf);
   store_pool = old_pool;
   errno = save_errno;
   return sigbuf;