ARC: For signing, accept A-R header lacking ARC info as equivalent to "none"
[exim.git] / src / src / arc.c
CommitLineData
617d3932
JH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4/* Experimental ARC support for Exim
5 Copyright (c) Jeremy Harris 2018
6 License: GPL
7*/
8
9#include "exim.h"
10#ifdef EXPERIMENTAL_ARC
11# if !defined SUPPORT_SPF
12# error SPF must also be enabled for ARC
13# elif defined DISABLE_DKIM
14# error DKIM must also be enabled for ARC
15# else
16
17# include "functions.h"
18# include "pdkim/pdkim.h"
19# include "pdkim/signing.h"
20
21extern pdkim_ctx * dkim_verify_ctx;
22extern pdkim_ctx dkim_sign_ctx;
23
24/******************************************************************************/
25
26typedef struct hdr_rlist {
27 struct hdr_rlist * prev;
28 BOOL used;
29 header_line * h;
30} hdr_rlist;
31
32typedef struct arc_line {
33 header_line * complete; /* including the header name; nul-term */
34 uschar * relaxed;
35
36 /* identified tag contents */
37 /*XXX t= for AS? */
38 blob i;
39 blob cv;
40 blob a;
41 blob b;
42 blob bh;
43 blob d;
44 blob h;
45 blob s;
46 blob c;
47 blob l;
48
49 /* tag content sub-portions */
50 blob a_algo;
51 blob a_hash;
52
53 blob c_head;
54 blob c_body;
55
56 /* modified copy of b= field in line */
57 blob rawsig_no_b_val;
58} arc_line;
59
60typedef struct arc_set {
61 struct arc_set * next;
62 struct arc_set * prev;
63
64 unsigned instance;
65 arc_line * hdr_aar;
66 arc_line * hdr_ams;
67 arc_line * hdr_as;
68
93c931f8 69 const uschar * ams_verify_done;
617d3932
JH
70 BOOL ams_verify_passed;
71} arc_set;
72
73typedef struct arc_ctx {
74 arc_set * arcset_chain;
75 arc_set * arcset_chain_last;
76} arc_ctx;
77
78#define ARC_HDR_AAR US"ARC-Authentication-Results:"
79#define ARC_HDRLEN_AAR 27
80#define ARC_HDR_AMS US"ARC-Message-Signature:"
81#define ARC_HDRLEN_AMS 22
82#define ARC_HDR_AS US"ARC-Seal:"
83#define ARC_HDRLEN_AS 9
84#define HDR_AR US"Authentication-Results:"
85#define HDRLEN_AR 23
86
87static hdr_rlist * headers_rlist;
88static arc_ctx arc_sign_ctx = { NULL };
89
90
91/******************************************************************************/
92
93
94/* Get the instance number from the header.
95Return 0 on error */
96static unsigned
97arc_instance_from_hdr(const arc_line * al)
98{
978e78de 99const uschar * s = al->i.data;
617d3932 100if (!s || !al->i.len) return 0;
978e78de 101return (unsigned) atoi(CCS s);
617d3932
JH
102}
103
104
105static uschar *
106skip_fws(uschar * s)
107{
108uschar c = *s;
109while (c && (c == ' ' || c == '\t' || c == '\n' || c == '\r')) c = *++s;
110return s;
111}
112
113
114/* Locate instance struct on chain, inserting a new one if
115needed. The chain is in increasing-instance-number order
116by the "next" link, and we have a "prev" link also.
117*/
118
119static arc_set *
120arc_find_set(arc_ctx * ctx, unsigned i)
121{
122arc_set ** pas, * as, * next, * prev;
123
124for (pas = &ctx->arcset_chain, prev = NULL, next = ctx->arcset_chain;
125 as = *pas; pas = &as->next)
126 {
127 if (as->instance > i) break;
128 if (as->instance == i)
129 {
130 DEBUG(D_acl) debug_printf("ARC: existing instance %u\n", i);
131 return as;
132 }
133 next = as->next;
134 prev = as;
135 }
136
137DEBUG(D_acl) debug_printf("ARC: new instance %u\n", i);
138*pas = as = store_get(sizeof(arc_set));
139memset(as, 0, sizeof(arc_set));
140as->next = next;
141as->prev = prev;
142as->instance = i;
143if (next)
144 next->prev = as;
145else
146 ctx->arcset_chain_last = as;
147return as;
148}
149
150
151
152/* Insert a tag content into the line structure.
153Note this is a reference to existing data, not a copy.
154Check for already-seen tag.
155The string-pointer is on the '=' for entry. Update it past the
156content (to the ;) on return;
157*/
158
159static uschar *
160arc_insert_tagvalue(arc_line * al, unsigned loff, uschar ** ss)
161{
162uschar * s = *ss;
163uschar c = *++s;
164blob * b = (blob *)(US al + loff);
165size_t len = 0;
166
167/* [FWS] tag-value [FWS] */
168
169if (b->data) return US"fail";
170s = skip_fws(s); /* FWS */
171
172b->data = s;
173while ((c = *s) && c != ';') { len++; s++; }
174*ss = s;
175while (len && ((c = s[-1]) == ' ' || c == '\t' || c == '\n' || c == '\r'))
176 { s--; len--; } /* FWS */
177b->len = len;
178return NULL;
179}
180
181
182/* Inspect a header line, noting known tag fields.
183Check for duplicates. */
184
185static uschar *
186arc_parse_line(arc_line * al, header_line * h, unsigned off, BOOL instance_only)
187{
188uschar * s = h->text + off;
978e78de 189uschar * r = NULL; /* compiler-quietening */
617d3932
JH
190uschar c;
191
192al->complete = h;
193
194if (!instance_only)
195 {
196 al->rawsig_no_b_val.data = store_get(h->slen + 1);
197 memcpy(al->rawsig_no_b_val.data, h->text, off); /* copy the header name blind */
198 r = al->rawsig_no_b_val.data + off;
199 al->rawsig_no_b_val.len = off;
200 }
201
202/* tag-list = tag-spec *( ";" tag-spec ) [ ";" ] */
203
204while ((c = *s))
205 {
206 char tagchar;
207 uschar * t;
208 unsigned i = 0;
209 uschar * fieldstart = s;
210 uschar * bstart = NULL, * bend;
211
212 /* tag-spec = [FWS] tag-name [FWS] "=" [FWS] tag-value [FWS] */
213
214 s = skip_fws(s); /* FWS */
215 if (!*s) break;
216/* debug_printf("%s: consider '%s'\n", __FUNCTION__, s); */
217 tagchar = *s++;
218 s = skip_fws(s); /* FWS */
219 if (!*s) break;
220
221 if (!instance_only || tagchar == 'i') switch (tagchar)
222 {
223 case 'a': /* a= AMS algorithm */
224 {
225 if (*s != '=') return US"no 'a' value";
226 if (arc_insert_tagvalue(al, offsetof(arc_line, a), &s)) return US"a tag dup";
227
228 /* substructure: algo-hash (eg. rsa-sha256) */
229
230 t = al->a_algo.data = al->a.data;
231 while (*t != '-')
232 if (!*t++ || ++i > al->a.len) return US"no '-' in 'a' value";
233 al->a_algo.len = i;
234 if (*t++ != '-') return US"no '-' in 'a' value";
235 al->a_hash.data = t;
236 al->a_hash.len = al->a.len - i - 1;
237 }
238 break;
239 case 'b':
240 {
241 gstring * g = NULL;
242
243 switch (*s)
244 {
245 case '=': /* b= AMS signature */
246 if (al->b.data) return US"already b data";
247 bstart = s+1;
248
249 /* The signature can have FWS inserted in the content;
250 make a stripped copy */
251
252 while ((c = *++s) && c != ';')
253 if (c != ' ' && c != '\t' && c != '\n' && c != '\r')
254 g = string_catn(g, s, 1);
255 al->b.data = string_from_gstring(g);
256 al->b.len = g->ptr;
257 gstring_reset_unused(g);
258 bend = s;
259 break;
260 case 'h': /* bh= AMS body hash */
261 s = skip_fws(++s); /* FWS */
262 if (*s != '=') return US"no bh value";
263 if (al->bh.data) return US"already bh data";
264
265 /* The bodyhash can have FWS inserted in the content;
266 make a stripped copy */
267
268 while ((c = *++s) && c != ';')
269 if (c != ' ' && c != '\t' && c != '\n' && c != '\r')
270 g = string_catn(g, s, 1);
271 al->bh.data = string_from_gstring(g);
272 al->bh.len = g->ptr;
273 gstring_reset_unused(g);
274 break;
275 default:
276 return US"b? tag";
277 }
278 }
279 break;
280 case 'c':
281 switch (*s)
282 {
283 case '=': /* c= AMS canonicalisation */
284 if (arc_insert_tagvalue(al, offsetof(arc_line, c), &s)) return US"c tag dup";
285
286 /* substructure: head/body (eg. relaxed/simple)) */
287
288 t = al->c_head.data = al->c.data;
289 while (isalpha(*t))
290 if (!*t++ || ++i > al->a.len) break;
291 al->c_head.len = i;
292 if (*t++ == '/') /* /body is optional */
293 {
294 al->c_body.data = t;
295 al->c_body.len = al->c.len - i - 1;
296 }
297 else
298 {
299 al->c_body.data = US"simple";
300 al->c_body.len = 6;
301 }
302 break;
303 case 'v': /* cv= AS validity */
304 if (*++s != '=') return US"cv tag val";
305 if (arc_insert_tagvalue(al, offsetof(arc_line, cv), &s)) return US"cv tag dup";
306 break;
307 default:
308 return US"c? tag";
309 }
310 break;
311 case 'd': /* d= AMS domain */
312 if (*s != '=') return US"d tag val";
313 if (arc_insert_tagvalue(al, offsetof(arc_line, d), &s)) return US"d tag dup";
314 break;
315 case 'h': /* h= AMS headers */
316 if (*s != '=') return US"h tag val";
317 if (arc_insert_tagvalue(al, offsetof(arc_line, h), &s)) return US"h tag dup";
318 break;
319 case 'i': /* i= ARC set instance */
320 if (*s != '=') return US"i tag val";
321 if (arc_insert_tagvalue(al, offsetof(arc_line, i), &s)) return US"i tag dup";
322 if (instance_only) goto done;
323 break;
324 case 'l': /* l= bodylength */
325 if (*s != '=') return US"l tag val";
326 if (arc_insert_tagvalue(al, offsetof(arc_line, l), &s)) return US"l tag dup";
327 break;
328 case 's': /* s= AMS selector */
329 if (*s != '=') return US"s tag val";
330 if (arc_insert_tagvalue(al, offsetof(arc_line, s), &s)) return US"s tag dup";
331 break;
332 }
333
334 while ((c = *s) && c != ';') s++;
335 if (c) s++; /* ; after tag-spec */
336
337 /* for all but the b= tag, copy the field including FWS. For the b=,
338 drop the tag content. */
339
340 if (!instance_only)
341 if (bstart)
342 {
343 size_t n = bstart - fieldstart;
344 memcpy(r, fieldstart, n); /* FWS "b=" */
345 r += n;
346 al->rawsig_no_b_val.len += n;
347 n = s - bend;
348 memcpy(r, bend, n); /* FWS ";" */
349 r += n;
350 al->rawsig_no_b_val.len += n;
351 }
352 else
353 {
354 size_t n = s - fieldstart;
355 memcpy(r, fieldstart, n);
356 r += n;
357 al->rawsig_no_b_val.len += n;
358 }
359 }
360
361if (!instance_only)
362 *r = '\0';
363
364done:
365/* debug_printf("%s: finshed\n", __FUNCTION__); */
366return NULL;
367}
368
369
370/* Insert one header line in the correct set of the chain,
371adding instances as needed and checking for duplicate lines.
372*/
373
374static uschar *
375arc_insert_hdr(arc_ctx * ctx, header_line * h, unsigned off, unsigned hoff,
376 BOOL instance_only)
377{
378int i;
379arc_set * as;
380arc_line * al = store_get(sizeof(arc_line)), ** alp;
381uschar * e;
382
383memset(al, 0, sizeof(arc_line));
384
385if ((e = arc_parse_line(al, h, off, instance_only)))
386 {
387 DEBUG(D_acl) if (e) debug_printf("ARC: %s\n", e);
388 return US"line parse";
389 }
390if (!(i = arc_instance_from_hdr(al))) return US"instance find";
391if (!(as = arc_find_set(ctx, i))) return US"set find";
392if (*(alp = (arc_line **)(US as + hoff))) return US"dup hdr";
393
394*alp = al;
395return NULL;
396}
397
398
399
400
401static const uschar *
402arc_try_header(arc_ctx * ctx, header_line * h, BOOL instance_only)
403{
404const uschar * e;
405
406/*debug_printf("consider hdr '%s'\n", h->text);*/
407if (strncmpic(ARC_HDR_AAR, h->text, ARC_HDRLEN_AAR) == 0)
408 {
409 DEBUG(D_acl)
410 {
411 int len = h->slen;
412 uschar * s;
413 for (s = h->text + h->slen; s[-1] == '\r' || s[-1] == '\n'; )
414 s--, len--;
415 debug_printf("ARC: found AAR: %.*s\n", len, h->text);
416 }
417 if ((e = arc_insert_hdr(ctx, h, ARC_HDRLEN_AAR, offsetof(arc_set, hdr_aar),
418 TRUE)))
419 {
420 DEBUG(D_acl) debug_printf("inserting AAR: %s\n", e);
421 return US"inserting AAR";
422 }
423 }
424else if (strncmpic(ARC_HDR_AMS, h->text, ARC_HDRLEN_AMS) == 0)
425 {
426 arc_line * ams;
427
428 DEBUG(D_acl)
429 {
430 int len = h->slen;
431 uschar * s;
432 for (s = h->text + h->slen; s[-1] == '\r' || s[-1] == '\n'; )
433 s--, len--;
434 debug_printf("ARC: found AMS: %.*s\n", len, h->text);
435 }
436 if ((e = arc_insert_hdr(ctx, h, ARC_HDRLEN_AMS, offsetof(arc_set, hdr_ams),
437 instance_only)))
438 {
439 DEBUG(D_acl) debug_printf("inserting AMS: %s\n", e);
440 return US"inserting AMS";
441 }
442
443 /* defaults */
444 /*XXX dubious selection of ams here */
445 ams = ctx->arcset_chain->hdr_ams;
446 if (!ams->c.data)
447 {
448 ams->c_head.data = US"simple"; ams->c_head.len = 6;
449 ams->c_body = ams->c_head;
450 }
451 }
452else if (strncmpic(ARC_HDR_AS, h->text, ARC_HDRLEN_AS) == 0)
453 {
454 DEBUG(D_acl)
455 {
456 int len = h->slen;
457 uschar * s;
458 for (s = h->text + h->slen; s[-1] == '\r' || s[-1] == '\n'; )
459 s--, len--;
460 debug_printf("ARC: found AS: %.*s\n", len, h->text);
461 }
462 if ((e = arc_insert_hdr(ctx, h, ARC_HDRLEN_AS, offsetof(arc_set, hdr_as),
463 instance_only)))
464 {
465 DEBUG(D_acl) debug_printf("inserting AS: %s\n", e);
466 return US"inserting AS";
467 }
468 }
469return NULL;
470}
471
472
473
474/* Gather the chain of arc sets from the headers.
475Check for duplicates while that is done. Also build the
476reverse-order headers list;
477
478Return: ARC state if determined, eg. by lack of any ARC chain.
479*/
480
481static const uschar *
482arc_vfy_collect_hdrs(arc_ctx * ctx)
483{
484header_line * h;
978e78de 485hdr_rlist * r = NULL, * rprev = NULL;
617d3932
JH
486const uschar * e;
487
488DEBUG(D_acl) debug_printf("ARC: collecting arc sets\n");
489for (h = header_list; h; h = h->next)
490 {
491 r = store_get(sizeof(hdr_rlist));
492 r->prev = rprev;
493 r->used = FALSE;
494 r->h = h;
495 rprev = r;
496
497 if ((e = arc_try_header(ctx, h, FALSE)))
93c931f8
JH
498 {
499 arc_state_reason = string_sprintf("collecting headers: %s", e);
500 return US"fail";
501 }
617d3932
JH
502 }
503headers_rlist = r;
504
505if (!ctx->arcset_chain) return US"none";
506return NULL;
507}
508
509
510static BOOL
511arc_cv_match(arc_line * al, const uschar * s)
512{
513return Ustrncmp(s, al->cv.data, al->cv.len) == 0;
514}
515
516/******************************************************************************/
517
518/* Return the hash of headers from the message that the AMS claims it
519signed.
520*/
521
522static void
523arc_get_verify_hhash(arc_ctx * ctx, arc_line * ams, blob * hhash)
524{
525const uschar * headernames = string_copyn(ams->h.data, ams->h.len);
526const uschar * hn;
527int sep = ':';
528hdr_rlist * r;
529BOOL relaxed = Ustrncmp(US"relaxed", ams->c_head.data, ams->c_head.len) == 0;
530int hashtype = pdkim_hashname_to_hashtype(
531 ams->a_hash.data, ams->a_hash.len);
532hctx hhash_ctx;
533const uschar * s;
534int len;
535
536if (!exim_sha_init(&hhash_ctx, pdkim_hashes[hashtype].exim_hashmethod))
537 {
538 DEBUG(D_acl)
539 debug_printf("ARC: hash setup error, possibly nonhandled hashtype\n");
540 return;
541 }
542
543/* For each headername in the list from the AMS (walking in order)
544walk the message headers in reverse order, adding to the hash any
545found for the first time. For that last point, maintain used-marks
546on the list of message headers. */
547
548DEBUG(D_acl) debug_printf("ARC: AMS header data for verification:\n");
549
550for (r = headers_rlist; r; r = r->prev)
551 r->used = FALSE;
552while ((hn = string_nextinlist(&headernames, &sep, NULL, 0)))
553 for (r = headers_rlist; r; r = r->prev)
554 if ( !r->used
555 && strncasecmp(CCS (s = r->h->text), CCS hn, Ustrlen(hn)) == 0
556 )
557 {
558 if (relaxed) s = pdkim_relax_header_n(s, r->h->slen, TRUE);
559
560 len = Ustrlen(s);
561 DEBUG(D_acl) pdkim_quoteprint(s, len);
562 exim_sha_update(&hhash_ctx, s, Ustrlen(s));
563 r->used = TRUE;
564 break;
565 }
566
d9604f37 567/* Finally add in the signature header (with the b= tag stripped); no CRLF */
617d3932
JH
568
569s = ams->rawsig_no_b_val.data, len = ams->rawsig_no_b_val.len;
570if (relaxed)
d9604f37 571 len = Ustrlen(s = pdkim_relax_header_n(s, len, FALSE));
617d3932
JH
572DEBUG(D_acl) pdkim_quoteprint(s, len);
573exim_sha_update(&hhash_ctx, s, len);
574
575exim_sha_finish(&hhash_ctx, hhash);
576DEBUG(D_acl)
577 { debug_printf("ARC: header hash: "); pdkim_hexprint(hhash->data, hhash->len); }
578return;
579}
580
581
582
583
584static pdkim_pubkey *
585arc_line_to_pubkey(arc_line * al)
586{
587uschar * dns_txt;
588pdkim_pubkey * p;
589
590if (!(dns_txt = dkim_exim_query_dns_txt(string_sprintf("%.*s._domainkey.%.*s",
591 al->s.len, al->s.data, al->d.len, al->d.data))))
592 {
593 DEBUG(D_acl) debug_printf("pubkey dns lookup fail\n");
594 return NULL;
595 }
596
597if ( !(p = pdkim_parse_pubkey_record(dns_txt))
598 || (Ustrcmp(p->srvtype, "*") != 0 && Ustrcmp(p->srvtype, "email") != 0)
599 )
600 {
601 DEBUG(D_acl) debug_printf("pubkey dns lookup format error\n");
602 return NULL;
603 }
604
605/* If the pubkey limits use to specified hashes, reject unusable
606signatures. XXX should we have looked for multiple dns records? */
607
608if (p->hashes)
609 {
610 const uschar * list = p->hashes, * ele;
611 int sep = ':';
612
613 while ((ele = string_nextinlist(&list, &sep, NULL, 0)))
614 if (Ustrncmp(ele, al->a_hash.data, al->a_hash.len) == 0) break;
615 if (!ele)
616 {
617 DEBUG(D_acl) debug_printf("pubkey h=%s vs sig a=%.*s\n",
978e78de 618 p->hashes, (int)al->a.len, al->a.data);
617d3932
JH
619 return NULL;
620 }
621 }
622return p;
623}
624
625
626
627
628static pdkim_bodyhash *
629arc_ams_setup_vfy_bodyhash(arc_line * ams)
630{
631int canon_head, canon_body;
632long bodylen;
633
634pdkim_cstring_to_canons(ams->c.data, ams->c.len, &canon_head, &canon_body);
635bodylen = ams->l.data
636 ? strtol(CS string_copyn(ams->l.data, ams->l.len), NULL, 10) : -1;
637
638return pdkim_set_bodyhash(dkim_verify_ctx,
639 pdkim_hashname_to_hashtype(ams->a_hash.data, ams->a_hash.len),
640 canon_body,
641 bodylen);
642}
643
644
645
646/* Verify an AMS. This is a DKIM-sig header, but with an ARC i= tag
647and without a DKIM v= tag.
648*/
649
93c931f8 650static const uschar *
617d3932
JH
651arc_ams_verify(arc_ctx * ctx, arc_set * as)
652{
653arc_line * ams = as->hdr_ams;
654pdkim_bodyhash * b;
655pdkim_pubkey * p;
656blob sighash;
657blob hhash;
658ev_ctx vctx;
659int hashtype;
660const uschar * errstr;
661
93c931f8 662as->ams_verify_done = US"in-progress";
617d3932
JH
663
664/* Check the AMS has all the required tags:
665 "a=" algorithm
666 "b=" signature
667 "bh=" body hash
668 "d=" domain (for key lookup)
669 "h=" headers (included in signature)
670 "s=" key-selector (for key lookup)
671*/
672if ( !ams->a.data || !ams->b.data || !ams->bh.data || !ams->d.data
673 || !ams->h.data || !ams->s.data)
93c931f8
JH
674 {
675 as->ams_verify_done = arc_state_reason = US"required tag missing";
617d3932 676 return US"fail";
93c931f8 677 }
617d3932
JH
678
679
680/* The bodyhash should have been created earlier, and the dkim code should
681have managed calculating it during message input. Find the reference to it. */
682
683if (!(b = arc_ams_setup_vfy_bodyhash(ams)))
93c931f8
JH
684 {
685 as->ams_verify_done = arc_state_reason = US"internal hash setup error";
617d3932 686 return US"fail";
93c931f8 687 }
617d3932
JH
688
689DEBUG(D_acl)
690 {
691 debug_printf("ARC i=%d AMS Body bytes hashed: %lu\n"
692 " Body %.*s computed: ",
693 as->instance, b->signed_body_bytes,
978e78de 694 (int)ams->a_hash.len, ams->a_hash.data);
617d3932
JH
695 pdkim_hexprint(CUS b->bh.data, b->bh.len);
696 }
697
698/* We know the bh-tag blob is of a nul-term string, so safe as a string */
699
700if ( !ams->bh.data
701 || (pdkim_decode_base64(ams->bh.data, &sighash), sighash.len != b->bh.len)
702 || memcmp(sighash.data, b->bh.data, b->bh.len) != 0
703 )
704 {
705 DEBUG(D_acl)
706 {
707 debug_printf("ARC i=%d AMS Body hash from headers: ", as->instance);
708 pdkim_hexprint(sighash.data, sighash.len);
709 debug_printf("ARC i=%d AMS Body hash did NOT match\n", as->instance);
710 }
93c931f8 711 return as->ams_verify_done = arc_state_reason = US"AMS body hash miscompare";
617d3932
JH
712 }
713
714DEBUG(D_acl) debug_printf("ARC i=%d AMS Body hash compared OK\n", as->instance);
715
716/* Get the public key from DNS */
717
718if (!(p = arc_line_to_pubkey(ams)))
93c931f8 719 return as->ams_verify_done = arc_state_reason = US"pubkey problem";
617d3932
JH
720
721/* We know the b-tag blob is of a nul-term string, so safe as a string */
722pdkim_decode_base64(ams->b.data, &sighash);
723
724arc_get_verify_hhash(ctx, ams, &hhash);
725
726/* Setup the interface to the signing library */
727
728if ((errstr = exim_dkim_verify_init(&p->key, KEYFMT_DER, &vctx)))
729 {
730 DEBUG(D_acl) debug_printf("ARC verify init: %s\n", errstr);
93c931f8 731 as->ams_verify_done = arc_state_reason = US"internal sigverify init error";
617d3932
JH
732 return US"fail";
733 }
734
735hashtype = pdkim_hashname_to_hashtype(ams->a_hash.data, ams->a_hash.len);
736
737if ((errstr = exim_dkim_verify(&vctx,
738 pdkim_hashes[hashtype].exim_hashmethod, &hhash, &sighash)))
739 {
740 DEBUG(D_acl) debug_printf("ARC i=%d AMS verify %s\n", as->instance, errstr);
93c931f8 741 return as->ams_verify_done = arc_state_reason = US"AMS sig nonverify";
617d3932
JH
742 }
743
744DEBUG(D_acl) debug_printf("ARC i=%d AMS verify pass\n", as->instance);
745as->ams_verify_passed = TRUE;
746return NULL;
747}
748
749
750
751/* Check the sets are instance-continuous and that all
752members are present. Check that no arc_seals are "fail".
753Set the highest instance number global.
754Verify the latest AMS.
755*/
756static uschar *
757arc_headers_check(arc_ctx * ctx)
758{
759arc_set * as;
760int inst;
761BOOL ams_fail_found = FALSE;
762uschar * ret = NULL;
763
764if (!(as = ctx->arcset_chain))
765 return US"none";
766
767for(inst = 0; as; as = as->next)
768 {
769 if ( as->instance != ++inst
770 || !as->hdr_aar || !as->hdr_ams || !as->hdr_as
771 || arc_cv_match(as->hdr_as, US"fail")
772 )
773 {
93c931f8
JH
774 arc_state_reason = string_sprintf("i=%d fail"
775 " (cv, sequence or missing header)", as->instance);
776 DEBUG(D_acl) debug_printf("ARC %s\n", arc_state_reason);
617d3932
JH
777 ret = US"fail";
778 }
779
780 /* Evaluate the oldest-pass AMS validation while we're here.
781 It does not affect the AS chain validation but is reported as
782 auxilary info. */
783
784 if (!ams_fail_found)
785 if (arc_ams_verify(ctx, as))
786 ams_fail_found = TRUE;
787 else
788 arc_oldest_pass = inst;
93c931f8 789 arc_state_reason = NULL;
617d3932
JH
790 }
791
792arc_received = ctx->arcset_chain_last;
793arc_received_instance = inst;
794if (ret)
795 return ret;
796
797/* We can skip the latest-AMS validation, if we already did it. */
798
799as = ctx->arcset_chain_last;
93c931f8
JH
800if (as->ams_verify_done && !as->ams_verify_passed)
801 {
802 arc_state_reason = as->ams_verify_done;
803 return US"fail";
804 }
805if (!!arc_ams_verify(ctx, as))
617d3932
JH
806 return US"fail";
807
808return NULL;
809}
810
811
812/******************************************************************************/
813static const uschar *
814arc_seal_verify(arc_ctx * ctx, arc_set * as)
815{
816arc_line * hdr_as = as->hdr_as;
817arc_set * as2;
818int hashtype;
819hctx hhash_ctx;
820blob hhash_computed;
821blob sighash;
822ev_ctx vctx;
823pdkim_pubkey * p;
824const uschar * errstr;
825
826DEBUG(D_acl) debug_printf("ARC: AS vfy i=%d\n", as->instance);
827/*
828 1. If the value of the "cv" tag on that seal is "fail", the
829 chain state is "fail" and the algorithm stops here. (This
830 step SHOULD be skipped if the earlier step (2.1) was
831 performed) [it was]
832
833 2. In Boolean nomenclature: if ((i == 1 && cv != "none") or (cv
834 == "none" && i != 1)) then the chain state is "fail" and the
835 algorithm stops here (note that the ordering of the logic is
836 structured for short-circuit evaluation).
837*/
838
839if ( as->instance == 1 && !arc_cv_match(hdr_as, US"none")
840 || arc_cv_match(hdr_as, US"none") && as->instance != 1
841 )
93c931f8
JH
842 {
843 arc_state_reason = US"seal cv state";
617d3932 844 return US"fail";
93c931f8 845 }
617d3932
JH
846
847/*
848 3. Initialize a hash function corresponding to the "a" tag of
849 the ARC-Seal.
850*/
851
852hashtype = pdkim_hashname_to_hashtype(hdr_as->a_hash.data, hdr_as->a_hash.len);
853
854if (!exim_sha_init(&hhash_ctx, pdkim_hashes[hashtype].exim_hashmethod))
855 {
856 DEBUG(D_acl)
857 debug_printf("ARC: hash setup error, possibly nonhandled hashtype\n");
93c931f8 858 arc_state_reason = US"seal hash setup error";
617d3932
JH
859 return US"fail";
860 }
861
862/*
863 4. Compute the canonicalized form of the ARC header fields, in
864 the order described in Section 5.4.2, using the "relaxed"
865 header canonicalization defined in Section 3.4.2 of
866 [RFC6376]. Pass the canonicalized result to the hash
867 function.
d9604f37
JH
868
869Headers are CRLF-separated, but the last one is not crlf-terminated.
617d3932
JH
870*/
871
872DEBUG(D_acl) debug_printf("ARC: AS header data for verification:\n");
873for (as2 = ctx->arcset_chain;
874 as2 && as2->instance <= as->instance;
875 as2 = as2->next)
876 {
877 arc_line * al;
878 uschar * s;
879 int len;
880
881 al = as2->hdr_aar;
882 if (!(s = al->relaxed))
883 al->relaxed = s = pdkim_relax_header_n(al->complete->text,
884 al->complete->slen, TRUE);
885 len = Ustrlen(s);
886 DEBUG(D_acl) pdkim_quoteprint(s, len);
887 exim_sha_update(&hhash_ctx, s, len);
888
889 al = as2->hdr_ams;
890 if (!(s = al->relaxed))
891 al->relaxed = s = pdkim_relax_header_n(al->complete->text,
892 al->complete->slen, TRUE);
893 len = Ustrlen(s);
894 DEBUG(D_acl) pdkim_quoteprint(s, len);
895 exim_sha_update(&hhash_ctx, s, len);
896
897 al = as2->hdr_as;
898 if (as2->instance == as->instance)
899 s = pdkim_relax_header_n(al->rawsig_no_b_val.data,
d9604f37 900 al->rawsig_no_b_val.len, FALSE);
617d3932
JH
901 else if (!(s = al->relaxed))
902 al->relaxed = s = pdkim_relax_header_n(al->complete->text,
903 al->complete->slen, TRUE);
904 len = Ustrlen(s);
905 DEBUG(D_acl) pdkim_quoteprint(s, len);
906 exim_sha_update(&hhash_ctx, s, len);
907 }
908
909/*
910 5. Retrieve the final digest from the hash function.
911*/
912
913exim_sha_finish(&hhash_ctx, &hhash_computed);
914DEBUG(D_acl)
915 {
916 debug_printf("ARC i=%d AS Header %.*s computed: ",
978e78de 917 as->instance, (int)hdr_as->a_hash.len, hdr_as->a_hash.data);
617d3932
JH
918 pdkim_hexprint(hhash_computed.data, hhash_computed.len);
919 }
920
921
922/*
923 6. Retrieve the public key identified by the "s" and "d" tags in
924 the ARC-Seal, as described in Section 4.1.6.
925*/
926
927if (!(p = arc_line_to_pubkey(hdr_as)))
928 return US"pubkey problem";
929
930/*
931 7. Determine whether the signature portion ("b" tag) of the ARC-
932 Seal and the digest computed above are valid according to the
933 public key. (See also Section Section 8.4 for failure case
934 handling)
935
936 8. If the signature is not valid, the chain state is "fail" and
937 the algorithm stops here.
938*/
939
940/* We know the b-tag blob is of a nul-term string, so safe as a string */
941pdkim_decode_base64(hdr_as->b.data, &sighash);
942
943if ((errstr = exim_dkim_verify_init(&p->key, KEYFMT_DER, &vctx)))
944 {
945 DEBUG(D_acl) debug_printf("ARC verify init: %s\n", errstr);
946 return US"fail";
947 }
948
949hashtype = pdkim_hashname_to_hashtype(hdr_as->a_hash.data, hdr_as->a_hash.len);
950
951if ((errstr = exim_dkim_verify(&vctx,
952 pdkim_hashes[hashtype].exim_hashmethod,
953 &hhash_computed, &sighash)))
954 {
955 DEBUG(D_acl)
956 debug_printf("ARC i=%d AS headers verify: %s\n", as->instance, errstr);
d9604f37 957 arc_state_reason = US"seal sigverify error";
617d3932
JH
958 return US"fail";
959 }
960
961DEBUG(D_acl) debug_printf("ARC: AS vfy i=%d pass\n", as->instance);
962return NULL;
963}
964
965
966static const uschar *
967arc_verify_seals(arc_ctx * ctx)
968{
969arc_set * as = ctx->arcset_chain;
970
971if (!as)
972 return US"none";
973
974while (as)
975 {
976 if (arc_seal_verify(ctx, as)) return US"fail";
977 as = as->next;
978 }
979DEBUG(D_acl) debug_printf("ARC: AS vfy overall pass\n");
980return NULL;
981}
982/******************************************************************************/
983
984/* Do ARC verification. Called from DATA ACL, on a verify = arc
985condition. No arguments; we are checking globals.
986
987Return: The ARC state, or NULL on error.
988*/
989
990const uschar *
991acl_verify_arc(void)
992{
993arc_ctx ctx = { NULL };
994const uschar * res;
995
996/* AS evaluation, per
997https://tools.ietf.org/html/draft-ietf-dmarc-arc-protocol-10#section-6
998*/
999/* 1. Collect all ARC sets currently on the message. If there were
1000 none, the ARC state is "none" and the algorithm stops here.
1001*/
1002
1003if ((res = arc_vfy_collect_hdrs(&ctx)))
1004 goto out;
1005
1006/* 2. If the form of any ARC set is invalid (e.g., does not contain
1007 exactly one of each of the three ARC-specific header fields),
1008 then the chain state is "fail" and the algorithm stops here.
1009
1010 1. To avoid the overhead of unnecessary computation and delay
1011 from crypto and DNS operations, the cv value for all ARC-
1012 Seal(s) MAY be checked at this point. If any of the values
1013 are "fail", then the overall state of the chain is "fail" and
1014 the algorithm stops here.
1015
1016 3. Conduct verification of the ARC-Message-Signature header field
1017 bearing the highest instance number. If this verification fails,
1018 then the chain state is "fail" and the algorithm stops here.
1019*/
1020
1021if ((res = arc_headers_check(&ctx)))
1022 goto out;
1023
1024/* 4. For each ARC-Seal from the "N"th instance to the first, apply the
1025 following logic:
1026
1027 1. If the value of the "cv" tag on that seal is "fail", the
1028 chain state is "fail" and the algorithm stops here. (This
1029 step SHOULD be skipped if the earlier step (2.1) was
1030 performed)
1031
1032 2. In Boolean nomenclature: if ((i == 1 && cv != "none") or (cv
1033 == "none" && i != 1)) then the chain state is "fail" and the
1034 algorithm stops here (note that the ordering of the logic is
1035 structured for short-circuit evaluation).
1036
1037 3. Initialize a hash function corresponding to the "a" tag of
1038 the ARC-Seal.
1039
1040 4. Compute the canonicalized form of the ARC header fields, in
1041 the order described in Section 5.4.2, using the "relaxed"
1042 header canonicalization defined in Section 3.4.2 of
1043 [RFC6376]. Pass the canonicalized result to the hash
1044 function.
1045
1046 5. Retrieve the final digest from the hash function.
1047
1048 6. Retrieve the public key identified by the "s" and "d" tags in
1049 the ARC-Seal, as described in Section 4.1.6.
1050
1051 7. Determine whether the signature portion ("b" tag) of the ARC-
1052 Seal and the digest computed above are valid according to the
1053 public key. (See also Section Section 8.4 for failure case
1054 handling)
1055
1056 8. If the signature is not valid, the chain state is "fail" and
1057 the algorithm stops here.
1058
1059 5. If all seals pass validation, then the chain state is "pass", and
1060 the algorithm is complete.
1061*/
1062
1063if ((res = arc_verify_seals(&ctx)))
1064 goto out;
1065
1066res = US"pass";
1067
1068out:
1069 return res;
1070}
1071
1072/******************************************************************************/
1073
1074/* Prepend the header to the rlist */
1075
1076static hdr_rlist *
1077arc_rlist_entry(hdr_rlist * list, const uschar * s, int len)
1078{
1079hdr_rlist * r = store_get(sizeof(hdr_rlist) + sizeof(header_line));
1080header_line * h = r->h = (header_line *)(r+1);
1081
1082r->prev = list;
1083r->used = FALSE;
1084h->next = NULL;
1085h->type = 0;
1086h->slen = len;
1087h->text = US s;
1088
1089/* This works for either NL or CRLF lines; also nul-termination */
1090while (*++s)
1091 if (*s == '\n' && s[1] != '\t' && s[1] != ' ') break;
1092s++; /* move past end of line */
1093
1094return r;
1095}
1096
1097
1098/* Walk the given headers strings identifying each header, and construct
1099a reverse-order list. Also parse ARC-chain headers and build the chain
1100struct, retaining pointers into the string.
1101*/
1102
1103static hdr_rlist *
1104arc_sign_scan_headers(arc_ctx * ctx, gstring * sigheaders)
1105{
1106const uschar * s;
1107hdr_rlist * rheaders = NULL;
1108
1109s = sigheaders ? sigheaders->s : NULL;
1110if (s) while (*s)
1111 {
978e78de 1112 const uschar * s2 = s;
617d3932
JH
1113
1114 /* This works for either NL or CRLF lines; also nul-termination */
1115 while (*++s2)
1116 if (*s2 == '\n' && s2[1] != '\t' && s2[1] != ' ') break;
1117 s2++; /* move past end of line */
1118
1119 rheaders = arc_rlist_entry(rheaders, s, s2 - s);
1120 s = s2;
1121 }
1122return rheaders;
1123}
1124
1125
1126
1127/* Return the A-R content, without identity, with line-ending and
1128NUL termination. */
1129
1130static BOOL
1131arc_sign_find_ar(header_line * headers, const uschar * identity, blob * ret)
1132{
1133header_line * h;
1134int ilen = Ustrlen(identity);
1135
1136ret->data = NULL;
1137for(h = headers; h; h = h->next)
1138 {
1139 uschar * s = h->text, c;
1140 int len = h->slen;
1141
1142 if (Ustrncmp(s, HDR_AR, HDRLEN_AR) != 0) continue;
1143 s += HDRLEN_AR, len -= HDRLEN_AR; /* header name */
1144 while ( len > 0
1145 && (c = *s) && (c == ' ' || c == '\t' || c == '\r' || c == '\n'))
1146 s++, len--; /* FWS */
1147 if (Ustrncmp(s, identity, ilen) != 0) continue;
1148 s += ilen; len -= ilen; /* identity */
1149 if (len <= 0) continue;
1150 if ((c = *s) && c == ';') s++, len--; /* identity terminator */
1151 while ( len > 0
1152 && (c = *s) && (c == ' ' || c == '\t' || c == '\r' || c == '\n'))
1153 s++, len--; /* FWS */
1154 if (len <= 0) continue;
1155 ret->data = s;
1156 ret->len = len;
1157 return TRUE;
1158 }
1159return FALSE;
1160}
1161
1162
1163
1164/* Append a constructed AAR including CRLF. Add it to the arc_ctx too. */
1165
1166static gstring *
1167arc_sign_append_aar(gstring * g, arc_ctx * ctx,
1168 const uschar * identity, int instance, blob * ar)
1169{
1170int aar_off = g ? g->ptr : 0;
1171arc_set * as = store_get(sizeof(arc_set) + sizeof(arc_line) + sizeof(header_line));
1172arc_line * al = (arc_line *)(as+1);
1173header_line * h = (header_line *)(al+1);
1174
1175g = string_catn(g, ARC_HDR_AAR, ARC_HDRLEN_AAR);
1176g = string_cat(g, string_sprintf(" i=%d; %s;\r\n\t", instance, identity));
1177g = string_catn(g, US ar->data, ar->len);
1178
1179h->slen = g->ptr - aar_off;
1180h->text = g->s + aar_off;
1181al->complete = h;
1182as->next = NULL;
1183as->prev = ctx->arcset_chain_last;
1184as->instance = instance;
1185as->hdr_aar = al;
1186if (instance == 1)
1187 ctx->arcset_chain = as;
1188else
1189 ctx->arcset_chain_last->next = as;
1190ctx->arcset_chain_last = as;
1191
1192DEBUG(D_transport) debug_printf("ARC: AAR '%.*s'\n", h->slen - 2, h->text);
1193return g;
1194}
1195
1196
1197
1198static BOOL
1199arc_sig_from_pseudoheader(gstring * hdata, int hashtype, const uschar * privkey,
1200 blob * sig, const uschar * why)
1201{
1202hashmethod hm = /*sig->keytype == KEYTYPE_ED25519*/ FALSE
1203 ? HASH_SHA2_512 : pdkim_hashes[hashtype].exim_hashmethod;
1204blob hhash;
1205es_ctx sctx;
1206const uschar * errstr;
1207
1208DEBUG(D_transport)
1209 {
1210 hctx hhash_ctx;
1211 debug_printf("ARC: %s header data for signing:\n", why);
1212 pdkim_quoteprint(hdata->s, hdata->ptr);
1213
1214 (void) exim_sha_init(&hhash_ctx, pdkim_hashes[hashtype].exim_hashmethod);
1215 exim_sha_update(&hhash_ctx, hdata->s, hdata->ptr);
1216 exim_sha_finish(&hhash_ctx, &hhash);
1217 debug_printf("ARC: header hash: "); pdkim_hexprint(hhash.data, hhash.len);
1218 }
1219
1220if (FALSE /*need hash for Ed25519 or GCrypt signing*/ )
1221 {
1222 hctx hhash_ctx;
1223 (void) exim_sha_init(&hhash_ctx, pdkim_hashes[hashtype].exim_hashmethod);
1224 exim_sha_update(&hhash_ctx, hdata->s, hdata->ptr);
1225 exim_sha_finish(&hhash_ctx, &hhash);
1226 }
1227else
1228 {
1229 hhash.data = hdata->s;
1230 hhash.len = hdata->ptr;
1231 }
1232
1233if ( (errstr = exim_dkim_signing_init(privkey, &sctx))
1234 || (errstr = exim_dkim_sign(&sctx, hm, &hhash, sig)))
1235 {
1236 log_write(0, LOG_MAIN|LOG_PANIC, "ARC: %s signing: %s\n", why, errstr);
1237 return FALSE;
1238 }
1239return TRUE;
1240}
1241
1242
1243
1244static gstring *
1245arc_sign_append_sig(gstring * g, blob * sig)
1246{
1247/*debug_printf("%s: raw sig ", __FUNCTION__); pdkim_hexprint(sig->data, sig->len);*/
1248sig->data = pdkim_encode_base64(sig);
1249sig->len = Ustrlen(sig->data);
1250for (;;)
1251 {
1252 int len = MIN(sig->len, 74);
1253 g = string_catn(g, sig->data, len);
1254 if ((sig->len -= len) == 0) break;
1255 sig->data += len;
1256 g = string_catn(g, US"\r\n\t ", 5);
1257 }
1258g = string_catn(g, US";\r\n", 3);
1259gstring_reset_unused(g);
1260string_from_gstring(g);
1261return g;
1262}
1263
1264
1265/* Append a constructed AMS including CRLF. Add it to the arc_ctx too. */
1266
1267static gstring *
1268arc_sign_append_ams(gstring * g, arc_ctx * ctx, int instance,
1269 const uschar * identity, const uschar * selector, blob * bodyhash,
1270 hdr_rlist * rheaders, const uschar * privkey)
1271{
1272uschar * s;
1273gstring * hdata = NULL;
1274int col;
1275int hashtype = pdkim_hashname_to_hashtype(US"sha256", 6); /*XXX hardwired */
1276blob sig;
1277int ams_off;
1278arc_line * al = store_get(sizeof(header_line) + sizeof(arc_line));
1279header_line * h = (header_line *)(al+1);
1280
1281/* debug_printf("%s\n", __FUNCTION__); */
1282
1283/* Construct the to-be-signed AMS pseudo-header: everything but the sig. */
1284
1285ams_off = g->ptr;
1286g = string_append(g, 10,
1287 ARC_HDR_AMS,
1288 US" i=", string_sprintf("%d", instance),
1289 US"; a=rsa-sha256; c=relaxed; d=", identity, /*XXX hardwired */
1290 US"; s=", selector,
1291 US";\r\n\tbh=", pdkim_encode_base64(bodyhash),
1292 US";\r\n\th=");
1293
1294for(col = 3; rheaders; rheaders = rheaders->prev)
1295 {
1296 const uschar * hnames = US"DKIM-Signature:" PDKIM_DEFAULT_SIGN_HEADERS;
1297 uschar * name, * htext = rheaders->h->text;
1298 int sep = ':';
1299
1300 /* Spot headers of interest */
1301
1302 while ((name = string_nextinlist(&hnames, &sep, NULL, 0)))
1303 {
1304 int len = Ustrlen(name);
1305 if (strncasecmp(CCS htext, CCS name, len) == 0)
1306 {
1307 /* If too long, fold line in h= field */
1308
1309 if (col + len > 78) g = string_catn(g, US"\r\n\t ", 5), col = 3;
1310
1311 /* Add name to h= list */
1312
1313 g = string_catn(g, name, len);
1314 g = string_catn(g, US":", 1);
1315 col += len + 1;
1316
1317 /* Accumulate header for hashing/signing */
1318
1319 hdata = string_cat(hdata,
1320 pdkim_relax_header_n(htext, rheaders->h->slen, TRUE)); /*XXX hardwired */
1321 break;
1322 }
1323 }
1324 }
1325
1326/* Lose the last colon from the h= list */
1327
1328if (g->s[g->ptr - 1] == ':') g->ptr--;
1329
1330g = string_catn(g, US";\r\n\tb=;", 7);
1331
1332/* Include the pseudo-header in the accumulation */
617d3932 1333
d9604f37 1334s = pdkim_relax_header_n(g->s + ams_off, g->ptr - ams_off, FALSE);
617d3932
JH
1335hdata = string_cat(hdata, s);
1336
1337/* Calculate the signature from the accumulation */
1338/*XXX does that need further relaxation? there are spaces embedded in the b= strings! */
1339
1340if (!arc_sig_from_pseudoheader(hdata, hashtype, privkey, &sig, US"AMS"))
1341 return NULL;
1342
1343/* Lose the trailing semicolon from the psuedo-header, and append the signature
1344(folded over lines) and termination to complete it. */
1345
1346g->ptr--;
1347g = arc_sign_append_sig(g, &sig);
1348
1349h->slen = g->ptr - ams_off;
1350h->text = g->s + ams_off;
1351al->complete = h;
1352ctx->arcset_chain_last->hdr_ams = al;
1353
1354DEBUG(D_transport) debug_printf("ARC: AMS '%.*s'\n", h->slen - 2, h->text);
1355return g;
1356}
1357
1358
1359
1360/* Look for an arc= result in an A-R header blob. We know that its data
1361happens to be a NUL-term string. */
1362
1363static uschar *
1364arc_ar_cv_status(blob * ar)
1365{
1366const uschar * resinfo = ar->data;
1367int sep = ';';
1368uschar * methodspec, * s;
1369
1370while ((methodspec = string_nextinlist(&resinfo, &sep, NULL, 0)))
1371 if (Ustrncmp(methodspec, US"arc=", 4) == 0)
1372 {
1373 uschar c;
1374 for (s = methodspec += 4;
1375 (c = *s) && c != ';' && c != ' ' && c != '\r' && c != '\n'; ) s++;
1376 return string_copyn(methodspec, s - methodspec);
1377 }
3d0a6e0f 1378return US"none";
617d3932
JH
1379}
1380
1381
1382
1383/* Build the AS header and prepend it */
1384
1385static gstring *
1386arc_sign_prepend_as(gstring * arcset_interim, arc_ctx * ctx,
1387 int instance, const uschar * identity, const uschar * selector, blob * ar,
1388 const uschar * privkey)
1389{
1390gstring * arcset;
1391arc_set * as;
1392uschar * status = arc_ar_cv_status(ar);
1393arc_line * al = store_get(sizeof(header_line) + sizeof(arc_line));
1394header_line * h = (header_line *)(al+1);
617d3932
JH
1395
1396gstring * hdata = NULL;
1397int hashtype = pdkim_hashname_to_hashtype(US"sha256", 6); /*XXX hardwired */
1398blob sig;
1399
1400/*
1401- Generate AS
1402 - no body coverage
1403 - no h= tag; implicit coverage
1404 - arc status from A-R
1405 - if fail:
1406 - coverage is just the new ARC set
1407 including self (but with an empty b= in self)
1408 - if non-fail:
1409 - all ARC set headers, set-number order, aar then ams then as,
1410 including self (but with an empty b= in self)
1411*/
1412
1413/* Construct the AS except for the signature */
1414
1415arcset = string_append(NULL, 10,
1416 ARC_HDR_AS,
1417 US" i=", string_sprintf("%d", instance),
1418 US"; cv=", status,
d4772796 1419 US"; a=rsa-sha256; d=", identity, /*XXX hardwired */
617d3932
JH
1420 US"; s=", selector, /*XXX same as AMS */
1421 US";\r\n\t b=;");
1422
1423h->slen = arcset->ptr;
1424h->text = arcset->s;
1425al->complete = h;
1426ctx->arcset_chain_last->hdr_as = al;
1427
1428/* For any but "fail" chain-verify status, walk the entire chain in order by
1429instance. For fail, only the new arc-set. Accumulate the elements walked. */
1430
1431for (as = Ustrcmp(status, US"fail") == 0
1432 ? ctx->arcset_chain_last : ctx->arcset_chain;
1433 as; as = as->next)
1434 {
1435 /* Accumulate AAR then AMS then AS. Relaxed canonicalisation
1436 is required per standard. */
1437
1438 h = as->hdr_aar->complete;
1439 hdata = string_cat(hdata, pdkim_relax_header_n(h->text, h->slen, TRUE));
1440 h = as->hdr_ams->complete;
1441 hdata = string_cat(hdata, pdkim_relax_header_n(h->text, h->slen, TRUE));
1442 h = as->hdr_as->complete;
d9604f37 1443 hdata = string_cat(hdata, pdkim_relax_header_n(h->text, h->slen, !!as->next));
617d3932
JH
1444 }
1445
1446/* Calculate the signature from the accumulation */
1447
1448if (!arc_sig_from_pseudoheader(hdata, hashtype, privkey, &sig, US"AS"))
1449 return NULL;
1450
1451/* Lose the trailing semicolon */
1452arcset->ptr--;
1453arcset = arc_sign_append_sig(arcset, &sig);
1454DEBUG(D_transport) debug_printf("ARC: AS '%.*s'\n", arcset->ptr - 2, arcset->s);
1455
1456/* Finally, append the AMS and AAR to the new AS */
1457
1458return string_catn(arcset, arcset_interim->s, arcset_interim->ptr);
1459}
1460
1461
1462/**************************************/
1463
1464/* Return pointer to pdkim_bodyhash for given hash method, creating new
1465method if needed.
1466*/
1467
1468void *
1469arc_ams_setup_sign_bodyhash(void)
1470{
1471int canon_head, canon_body;
1472
1473DEBUG(D_transport) debug_printf("ARC: requesting bodyhash\n");
1474pdkim_cstring_to_canons(US"relaxed", 7, &canon_head, &canon_body); /*XXX hardwired */
1475return pdkim_set_bodyhash(&dkim_sign_ctx,
1476 pdkim_hashname_to_hashtype(US"sha256", 6), /*XXX hardwired */
1477 canon_body,
1478 -1);
1479}
1480
1481
1482
1483/* A "normal" header line, identified by DKIM processing. These arrive before
1484the call to arc_sign(), which carries any newly-created DKIM headers - and
1485those go textually before the normal ones in the message.
1486
1487We have to take the feed from DKIM as, in the transport-filter case, the
1488headers are not in memory at the time of the call to arc_sign().
1489
1490Take a copy of the header and construct a reverse-order list.
1491Also parse ARC-chain headers and build the chain struct, retaining pointers
1492into the copies.
1493*/
1494
1495static const uschar *
1496arc_header_sign_feed(gstring * g)
1497{
1498uschar * s = string_copyn(g->s, g->ptr);
1499headers_rlist = arc_rlist_entry(headers_rlist, s, g->ptr);
1500return arc_try_header(&arc_sign_ctx, headers_rlist->h, TRUE);
1501}
1502
1503
1504
1505/* ARC signing. Called from the smtp transport, if the arc_sign option is set.
1506The dkim_exim_sign() function has already been called, so will have hashed the
1507message body for us so long as we requested a hash previously.
1508
1509Arguments:
1510 signspec Three-element colon-sep list: identity, selector, privkey
1511 Already expanded
1512 sigheaders Any signature headers already generated, eg. by DKIM, or NULL
1513 errstr Error string
1514
1515Return value
1516 Set of headers to prepend to the message, including the supplied sigheaders
1517 but not the plainheaders.
1518*/
1519
1520gstring *
1521arc_sign(const uschar * signspec, gstring * sigheaders, uschar ** errstr)
1522{
1523const uschar * identity, * selector, * privkey;
1524int sep = 0;
1525header_line * headers;
1526hdr_rlist * rheaders;
1527blob ar;
1528int instance;
1529gstring * g = NULL;
1530pdkim_bodyhash * b;
1531
1532/* Parse the signing specification */
1533
1534identity = string_nextinlist(&signspec, &sep, NULL, 0);
1535selector = string_nextinlist(&signspec, &sep, NULL, 0);
1536if ( !*identity | !*selector
1537 || !(privkey = string_nextinlist(&signspec, &sep, NULL, 0)) || !*privkey)
1538 {
1539 log_write(0, LOG_MAIN|LOG_PANIC, "ARC: bad signing-specification");
1540 return NULL;
1541 }
1542if (*privkey == '/' && !(privkey = expand_file_big_buffer(privkey)))
1543 return NULL;
1544
1545DEBUG(D_transport) debug_printf("ARC: sign for %s\n", identity);
1546
1547/*
1548- scan headers for existing ARC chain & A-R (with matching system-identfier)
1549 - paniclog & skip on problems (no A-R)
1550*/
1551
1552/* Make an rlist of any new DKIM headers, then add the "normals" rlist to it */
1553
1554string_from_gstring(sigheaders);
1555if ((rheaders = arc_sign_scan_headers(&arc_sign_ctx, sigheaders)))
1556 {
1557 hdr_rlist ** rp;
1558 for (rp = &rheaders; *rp; ) rp = &(*rp)->prev;
1559 *rp = headers_rlist;
1560 headers_rlist = rheaders;
1561 }
1562else
1563 rheaders = headers_rlist;
1564/* Finally, build a normal-order headers list */
1565/*XXX only needed for hunt-the-AR? */
1566{
1567header_line * hnext = NULL;
1568for (; rheaders; hnext = rheaders->h, rheaders = rheaders->prev)
1569 rheaders->h->next = hnext;
1570headers = hnext;
1571}
1572
1573instance = arc_sign_ctx.arcset_chain_last ? arc_sign_ctx.arcset_chain_last->instance + 1 : 1;
1574
1575if (!(arc_sign_find_ar(headers, identity, &ar)))
1576 {
1577 log_write(0, LOG_MAIN|LOG_PANIC, "ARC: no Authentication-Results header for signing");
1578 return sigheaders ? sigheaders : string_get(0);
1579 }
1580
1581/*
1582- Generate AAR
1583 - copy the A-R; prepend i= & identity
1584*/
1585
1586g = arc_sign_append_aar(g, &arc_sign_ctx, identity, instance, &ar);
1587
1588/*
1589- Generate AMS
1590 - Looks fairly like a DKIM sig
1591 - Cover all DKIM sig headers as well as the usuals
1592 - ? oversigning?
1593 - Covers the data
1594 - we must have requested a suitable bodyhash previously
1595*/
1596
1597b = arc_ams_setup_sign_bodyhash();
1598g = arc_sign_append_ams(g, &arc_sign_ctx, instance, identity, selector,
1599 &b->bh, headers_rlist, privkey);
1600
1601/*
1602- Generate AS
1603 - no body coverage
1604 - no h= tag; implicit coverage
1605 - arc status from A-R
1606 - if fail:
1607 - coverage is just the new ARC set
1608 including self (but with an empty b= in self)
1609 - if non-fail:
1610 - all ARC set headers, set-number order, aar then ams then as,
1611 including self (but with an empty b= in self)
1612*/
1613
1614g = arc_sign_prepend_as(g, &arc_sign_ctx, instance, identity, selector, &ar, privkey);
1615
1616/* Finally, append the dkim headers and return the lot. */
1617
1618g = string_catn(g, sigheaders->s, sigheaders->ptr);
1619(void) string_from_gstring(g);
1620gstring_reset_unused(g);
1621return g;
1622}
1623
1624
1625/******************************************************************************/
1626
1627/* Check to see if the line is an AMS and if so, set up to validate it.
1628Called from the DKIM input processing. This must be done now as the message
1629body data is hashed during input.
1630
1631We call the DKIM code to request a body-hash; it has the facility already
1632and the hash parameters might be common with other requests.
1633*/
1634
1635static const uschar *
1636arc_header_vfy_feed(gstring * g)
1637{
1638header_line h;
1639arc_line al;
1640pdkim_bodyhash * b;
1641uschar * errstr;
1642
1643if (!dkim_verify_ctx) return US"no dkim context";
1644
1645if (strncmpic(ARC_HDR_AMS, g->s, ARC_HDRLEN_AMS) != 0) return US"not AMS";
1646
1647DEBUG(D_receive) debug_printf("ARC: spotted AMS header\n");
1648/* Parse the AMS header */
1649
1650h.next = NULL;
1651h.slen = g->size;
1652h.text = g->s;
1653memset(&al, 0, sizeof(arc_line));
1654if ((errstr = arc_parse_line(&al, &h, ARC_HDRLEN_AMS, FALSE)))
1655 {
1656 DEBUG(D_acl) if (errstr) debug_printf("ARC: %s\n", errstr);
1657 return US"line parsing error";
1658 }
1659
1660/* defaults */
1661if (!al.c.data)
1662 {
1663 al.c_body.data = US"simple"; al.c_body.len = 6;
1664 al.c_head = al.c_body;
1665 }
1666
1667/* Ask the dkim code to calc a bodyhash with those specs */
1668
1669if (!(b = arc_ams_setup_vfy_bodyhash(&al)))
1670 return US"dkim hash setup fail";
1671
1672/* Discard the reference; search again at verify time, knowing that one
1673should have been created here. */
1674
1675return NULL;
1676}
1677
1678
1679
1680/* A header line has been identified by DKIM processing.
1681
1682Arguments:
1683 g Header line
1684 is_vfy TRUE for verify mode or FALSE for signing mode
1685
1686Return:
1687 NULL for success, or an error string (probably unused)
1688*/
1689
1690const uschar *
1691arc_header_feed(gstring * g, BOOL is_vfy)
1692{
1693return is_vfy ? arc_header_vfy_feed(g) : arc_header_sign_feed(g);
1694}
1695
1696
1697
1698/******************************************************************************/
1699
1700/* Construct an Authenticate-Results header portion, for the ARC module */
1701
1702gstring *
1703authres_arc(gstring * g)
1704{
1705if (arc_state)
1706 {
1707 arc_line * highest_ams;
978e78de 1708 int start = 0; /* Compiler quietening */
617d3932
JH
1709 DEBUG(D_acl) start = g->ptr;
1710
1711 g = string_append(g, 2, US";\n\tarc=", arc_state);
1712 if (arc_received_instance > 0)
1713 {
1714 g = string_append(g, 3, US" (i=",
93c931f8
JH
1715 string_sprintf("%d", arc_received_instance), US")");
1716 if (arc_state_reason)
1717 g = string_append(g, 3, US"(", arc_state_reason, US")");
1718 g = string_catn(g, US" header.s=", 10);
617d3932
JH
1719 highest_ams = arc_received->hdr_ams;
1720 g = string_catn(g, highest_ams->s.data, highest_ams->s.len);
1721
1722 g = string_append(g, 2,
1723 US" arc.oldest-pass=", string_sprintf("%d", arc_oldest_pass));
1724
1725 if (sender_host_address)
1726 g = string_append(g, 2, US" smtp.client-ip=", sender_host_address);
1727 }
1728 DEBUG(D_acl) debug_printf("ARC: authres '%.*s'\n",
1729 g->ptr - start - 3, g->s + start + 3);
1730 }
1731else
1732 DEBUG(D_acl) debug_printf("ARC: no authres\n");
1733return g;
1734}
1735
1736
1737# endif /* SUPPORT_SPF */
1738#endif /* EXPERIMENTAL_ARC */
1739/* vi: aw ai sw=2
1740 */