DKIM: support multiple hash methods
[exim.git] / src / src / dkim.c
CommitLineData
80a47a2c
TK
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
d4e5e70b 5/* Copyright (c) University of Cambridge, 1995 - 2017 */
80a47a2c
TK
6/* See the file NOTICE for conditions of use and distribution. */
7
8/* Code for DKIM support. Other DKIM relevant code is in
9 receive.c, transport.c and transports/smtp.c */
10
11#include "exim.h"
12
13#ifndef DISABLE_DKIM
14
15#include "pdkim/pdkim.h"
16
ca9cb170 17int dkim_verify_oldpool;
1cfe5c1c 18pdkim_ctx *dkim_verify_ctx = NULL;
80a47a2c 19pdkim_signature *dkim_signatures = NULL;
1cfe5c1c 20pdkim_signature *dkim_cur_sig = NULL;
b9df1829 21static const uschar * dkim_collect_error = NULL;
80a47a2c 22
d73e45df
JH
23
24
25/*XXX the caller only uses the first record if we return multiple.
26Could we hand back an allocated string?
27*/
28
1cfe5c1c
JH
29static int
30dkim_exim_query_dns_txt(char *name, char *answer)
31{
32dns_answer dnsa;
33dns_scan dnss;
34dns_record *rr;
80a47a2c 35
1cfe5c1c
JH
36lookup_dnssec_authenticated = NULL;
37if (dns_lookup(&dnsa, US name, T_TXT, NULL) != DNS_SUCCEED)
f7302073 38 return PDKIM_FAIL; /*XXX better error detail? logging? */
80a47a2c 39
1cfe5c1c 40/* Search for TXT record */
80a47a2c 41
1cfe5c1c
JH
42for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
43 rr;
44 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
45 if (rr->type == T_TXT)
46 {
80a47a2c
TK
47 int rr_offset = 0;
48 int answer_offset = 0;
1cfe5c1c
JH
49
50 /* Copy record content to the answer buffer */
51
52 while (rr_offset < rr->size)
53 {
54 uschar len = rr->data[rr_offset++];
55 snprintf(answer + answer_offset,
56 PDKIM_DNS_TXT_MAX_RECLEN - answer_offset,
5903c6ff 57 "%.*s", (int)len, CS (rr->data + rr_offset));
1cfe5c1c
JH
58 rr_offset += len;
59 answer_offset += len;
60 if (answer_offset >= PDKIM_DNS_TXT_MAX_RECLEN)
f7302073 61 return PDKIM_FAIL; /*XXX better error detail? logging? */
4263f395 62 }
1cfe5c1c 63 return PDKIM_OK;
80a47a2c 64 }
80a47a2c 65
f7302073 66return PDKIM_FAIL; /*XXX better error detail? logging? */
80a47a2c
TK
67}
68
69
1cfe5c1c 70void
2592e6c0
JH
71dkim_exim_init(void)
72{
73pdkim_init();
74}
75
76
ca9cb170 77
2592e6c0 78void
e983e85a 79dkim_exim_verify_init(BOOL dot_stuffing)
1cfe5c1c 80{
ca9cb170
JH
81/* There is a store-reset between header & body reception
82so cannot use the main pool. Any allocs done by Exim
83memory-handling must use the perm pool. */
84
85dkim_verify_oldpool = store_pool;
86store_pool = POOL_PERM;
87
1cfe5c1c 88/* Free previous context if there is one */
80a47a2c 89
1cfe5c1c
JH
90if (dkim_verify_ctx)
91 pdkim_free_ctx(dkim_verify_ctx);
80a47a2c 92
1cfe5c1c 93/* Create new context */
80a47a2c 94
e983e85a 95dkim_verify_ctx = pdkim_init_verify(&dkim_exim_query_dns_txt, dot_stuffing);
3b957582 96dkim_collect_input = !!dkim_verify_ctx;
b9df1829 97dkim_collect_error = NULL;
ca9cb170 98
584e96c6
JH
99/* Start feed up with any cached data */
100receive_get_cache();
101
ca9cb170 102store_pool = dkim_verify_oldpool;
80a47a2c
TK
103}
104
105
1cfe5c1c
JH
106void
107dkim_exim_verify_feed(uschar * data, int len)
108{
f7302073
JH
109int rc;
110
ca9cb170 111store_pool = POOL_PERM;
1cfe5c1c 112if ( dkim_collect_input
ef698bf6 113 && (rc = pdkim_feed(dkim_verify_ctx, data, len)) != PDKIM_OK)
f7302073 114 {
b9df1829 115 dkim_collect_error = pdkim_errstr(rc);
f7302073 116 log_write(0, LOG_MAIN,
b9df1829 117 "DKIM: validation error: %.100s", dkim_collect_error);
1cfe5c1c 118 dkim_collect_input = FALSE;
f7302073 119 }
ca9cb170 120store_pool = dkim_verify_oldpool;
80a47a2c
TK
121}
122
123
1cfe5c1c
JH
124void
125dkim_exim_verify_finish(void)
126{
41468ba1 127pdkim_signature * sig = NULL;
b9df1829
JH
128int dkim_signers_size = 0, dkim_signers_ptr = 0, rc;
129const uschar * errstr;
1cfe5c1c 130
ca9cb170
JH
131store_pool = POOL_PERM;
132
1cfe5c1c
JH
133/* Delete eventual previous signature chain */
134
41468ba1 135dkim_signers = NULL;
1cfe5c1c
JH
136dkim_signatures = NULL;
137
bd8fbe36 138if (dkim_collect_error)
1cfe5c1c
JH
139 {
140 log_write(0, LOG_MAIN,
b9df1829
JH
141 "DKIM: Error during validation, disabling signature verification: %.100s",
142 dkim_collect_error);
1cfe5c1c 143 dkim_disable_verify = TRUE;
ca9cb170 144 goto out;
1cfe5c1c 145 }
80a47a2c 146
1cfe5c1c 147dkim_collect_input = FALSE;
80a47a2c 148
1cfe5c1c 149/* Finish DKIM operation and fetch link to signatures chain */
80a47a2c 150
b9df1829
JH
151rc = pdkim_feed_finish(dkim_verify_ctx, &dkim_signatures, &errstr);
152if (rc != PDKIM_OK)
f7302073 153 {
b9df1829
JH
154 log_write(0, LOG_MAIN, "DKIM: validation error: %.100s%s%s", pdkim_errstr(rc),
155 errstr ? ": " : "", errstr ? errstr : US"");
ca9cb170 156 goto out;
f7302073 157 }
1cfe5c1c
JH
158
159for (sig = dkim_signatures; sig; sig = sig->next)
160 {
41468ba1
JH
161 int size = 0, ptr = 0;
162 uschar * logmsg = NULL, * s;
1cfe5c1c
JH
163
164 /* Log a line for each signature */
165
41468ba1
JH
166 if (!(s = sig->domain)) s = US"<UNSET>";
167 logmsg = string_append(logmsg, &size, &ptr, 2, "d=", s);
168 if (!(s = sig->selector)) s = US"<UNSET>";
169 logmsg = string_append(logmsg, &size, &ptr, 2, " s=", s);
170 logmsg = string_append(logmsg, &size, &ptr, 7,
171 " c=", sig->canon_headers == PDKIM_CANON_SIMPLE ? "simple" : "relaxed",
172 "/", sig->canon_body == PDKIM_CANON_SIMPLE ? "simple" : "relaxed",
d73e45df 173 " a=", dkim_sig_to_a_tag(sig),
41468ba1
JH
174 string_sprintf(" b=%d",
175 (int)sig->sighash.len > -1 ? sig->sighash.len * 8 : 0));
31323b30
HSHR
176 if ((s= sig->identity)) logmsg = string_append(logmsg, &size, &ptr, 2, " i=", s);
177 if (sig->created > 0) logmsg = string_append(logmsg, &size, &ptr, 1,
41468ba1 178 string_sprintf(" t=%lu", sig->created));
31323b30 179 if (sig->expires > 0) logmsg = string_append(logmsg, &size, &ptr, 1,
41468ba1 180 string_sprintf(" x=%lu", sig->expires));
31323b30 181 if (sig->bodylength > -1) logmsg = string_append(logmsg, &size, &ptr, 1,
41468ba1 182 string_sprintf(" l=%lu", sig->bodylength));
1cfe5c1c
JH
183
184 switch (sig->verify_status)
185 {
186 case PDKIM_VERIFY_NONE:
41468ba1 187 logmsg = string_append(logmsg, &size, &ptr, 1, " [not verified]");
80a47a2c 188 break;
1cfe5c1c
JH
189
190 case PDKIM_VERIFY_INVALID:
41468ba1 191 logmsg = string_append(logmsg, &size, &ptr, 1, " [invalid - ");
1cfe5c1c
JH
192 switch (sig->verify_ext_status)
193 {
194 case PDKIM_VERIFY_INVALID_PUBKEY_UNAVAILABLE:
195 logmsg = string_append(logmsg, &size, &ptr, 1,
196 "public key record (currently?) unavailable]");
197 break;
198
199 case PDKIM_VERIFY_INVALID_BUFFER_SIZE:
200 logmsg = string_append(logmsg, &size, &ptr, 1,
201 "overlong public key record]");
202 break;
203
df3def24
JH
204 case PDKIM_VERIFY_INVALID_PUBKEY_DNSRECORD:
205 case PDKIM_VERIFY_INVALID_PUBKEY_IMPORT:
1cfe5c1c
JH
206 logmsg = string_append(logmsg, &size, &ptr, 1,
207 "syntax error in public key record]");
208 break;
07eeb4df 209
210 case PDKIM_VERIFY_INVALID_SIGNATURE_ERROR:
211 logmsg = string_append(logmsg, &size, &ptr, 1,
212 "signature tag missing or invalid]");
213 break;
214
215 case PDKIM_VERIFY_INVALID_DKIM_VERSION:
216 logmsg = string_append(logmsg, &size, &ptr, 1,
217 "unsupported DKIM version]");
218 break;
1cfe5c1c
JH
219
220 default:
221 logmsg = string_append(logmsg, &size, &ptr, 1,
222 "unspecified problem]");
223 }
80a47a2c 224 break;
1cfe5c1c
JH
225
226 case PDKIM_VERIFY_FAIL:
227 logmsg =
41468ba1 228 string_append(logmsg, &size, &ptr, 1, " [verification failed - ");
1cfe5c1c
JH
229 switch (sig->verify_ext_status)
230 {
231 case PDKIM_VERIFY_FAIL_BODY:
232 logmsg = string_append(logmsg, &size, &ptr, 1,
233 "body hash mismatch (body probably modified in transit)]");
234 break;
235
236 case PDKIM_VERIFY_FAIL_MESSAGE:
237 logmsg = string_append(logmsg, &size, &ptr, 1,
238 "signature did not verify (headers probably modified in transit)]");
239 break;
240
241 default:
242 logmsg = string_append(logmsg, &size, &ptr, 1, "unspecified reason]");
243 }
80a47a2c 244 break;
1cfe5c1c
JH
245
246 case PDKIM_VERIFY_PASS:
247 logmsg =
41468ba1 248 string_append(logmsg, &size, &ptr, 1, " [verification succeeded]");
80a47a2c
TK
249 break;
250 }
251
1cfe5c1c
JH
252 logmsg[ptr] = '\0';
253 log_write(0, LOG_MAIN, "DKIM: %s", logmsg);
80a47a2c 254
1cfe5c1c
JH
255 /* Build a colon-separated list of signing domains (and identities, if present) in dkim_signers */
256
41468ba1 257 if (sig->domain)
4226691b
JH
258 dkim_signers = string_append_listele(dkim_signers, &dkim_signers_size,
259 &dkim_signers_ptr, ':', sig->domain);
1cfe5c1c
JH
260
261 if (sig->identity)
4226691b
JH
262 dkim_signers = string_append_listele(dkim_signers, &dkim_signers_size,
263 &dkim_signers_ptr, ':', sig->identity);
80a47a2c 264
1cfe5c1c 265 /* Process next signature */
80a47a2c
TK
266 }
267
ca9cb170
JH
268out:
269store_pool = dkim_verify_oldpool;
80a47a2c
TK
270}
271
272
1cfe5c1c
JH
273void
274dkim_exim_acl_setup(uschar * id)
275{
276pdkim_signature * sig;
277uschar * cmp_val;
278
1cfe5c1c
JH
279dkim_cur_sig = NULL;
280dkim_cur_signer = id;
281
282if (dkim_disable_verify || !id || !dkim_verify_ctx)
283 return;
284
285/* Find signature to run ACL on */
286
287for (sig = dkim_signatures; sig; sig = sig->next)
288 if ( (cmp_val = Ustrchr(id, '@') != NULL ? US sig->identity : US sig->domain)
289 && strcmpic(cmp_val, id) == 0
290 )
291 {
292 dkim_cur_sig = sig;
293
294 /* The "dkim_domain" and "dkim_selector" expansion variables have
295 related globals, since they are used in the signing code too.
296 Instead of inventing separate names for verification, we set
297 them here. This is easy since a domain and selector is guaranteed
298 to be in a signature. The other dkim_* expansion items are
299 dynamically fetched from dkim_cur_sig at expansion time (see
300 function below). */
301
302 dkim_signing_domain = US sig->domain;
303 dkim_signing_selector = US sig->selector;
dcd03763 304 dkim_key_length = sig->sighash.len * 8;
1cfe5c1c 305 return;
80a47a2c 306 }
80a47a2c
TK
307}
308
309
1cfe5c1c
JH
310static uschar *
311dkim_exim_expand_defaults(int what)
312{
313switch (what)
314 {
315 case DKIM_ALGO: return US"";
316 case DKIM_BODYLENGTH: return US"9999999999999";
317 case DKIM_CANON_BODY: return US"";
318 case DKIM_CANON_HEADERS: return US"";
319 case DKIM_COPIEDHEADERS: return US"";
320 case DKIM_CREATED: return US"0";
321 case DKIM_EXPIRES: return US"9999999999999";
322 case DKIM_HEADERNAMES: return US"";
323 case DKIM_IDENTITY: return US"";
324 case DKIM_KEY_GRANULARITY: return US"*";
325 case DKIM_KEY_SRVTYPE: return US"*";
326 case DKIM_KEY_NOTES: return US"";
327 case DKIM_KEY_TESTING: return US"0";
328 case DKIM_NOSUBDOMAINS: return US"0";
329 case DKIM_VERIFY_STATUS: return US"none";
330 case DKIM_VERIFY_REASON: return US"";
331 default: return US"";
332 }
333}
80a47a2c 334
80a47a2c 335
1cfe5c1c
JH
336uschar *
337dkim_exim_expand_query(int what)
338{
339if (!dkim_verify_ctx || dkim_disable_verify || !dkim_cur_sig)
340 return dkim_exim_expand_defaults(what);
341
342switch (what)
343 {
344 case DKIM_ALGO:
d73e45df 345 return dkim_sig_to_a_tag(dkim_cur_sig);
1cfe5c1c
JH
346
347 case DKIM_BODYLENGTH:
348 return dkim_cur_sig->bodylength >= 0
349 ? string_sprintf(OFF_T_FMT, (LONGLONG_T) dkim_cur_sig->bodylength)
350 : dkim_exim_expand_defaults(what);
351
352 case DKIM_CANON_BODY:
353 switch (dkim_cur_sig->canon_body)
354 {
355 case PDKIM_CANON_RELAXED: return US"relaxed";
356 case PDKIM_CANON_SIMPLE:
357 default: return US"simple";
80a47a2c 358 }
1cfe5c1c
JH
359
360 case DKIM_CANON_HEADERS:
361 switch (dkim_cur_sig->canon_headers)
362 {
363 case PDKIM_CANON_RELAXED: return US"relaxed";
364 case PDKIM_CANON_SIMPLE:
365 default: return US"simple";
366 }
367
368 case DKIM_COPIEDHEADERS:
369 return dkim_cur_sig->copiedheaders
370 ? US dkim_cur_sig->copiedheaders : dkim_exim_expand_defaults(what);
371
372 case DKIM_CREATED:
373 return dkim_cur_sig->created > 0
374 ? string_sprintf("%llu", dkim_cur_sig->created)
375 : dkim_exim_expand_defaults(what);
376
377 case DKIM_EXPIRES:
378 return dkim_cur_sig->expires > 0
379 ? string_sprintf("%llu", dkim_cur_sig->expires)
380 : dkim_exim_expand_defaults(what);
381
382 case DKIM_HEADERNAMES:
383 return dkim_cur_sig->headernames
2592e6c0 384 ? dkim_cur_sig->headernames : dkim_exim_expand_defaults(what);
1cfe5c1c
JH
385
386 case DKIM_IDENTITY:
387 return dkim_cur_sig->identity
388 ? US dkim_cur_sig->identity : dkim_exim_expand_defaults(what);
389
390 case DKIM_KEY_GRANULARITY:
391 return dkim_cur_sig->pubkey
392 ? dkim_cur_sig->pubkey->granularity
393 ? US dkim_cur_sig->pubkey->granularity
394 : dkim_exim_expand_defaults(what)
395 : dkim_exim_expand_defaults(what);
396
397 case DKIM_KEY_SRVTYPE:
398 return dkim_cur_sig->pubkey
399 ? dkim_cur_sig->pubkey->srvtype
400 ? US dkim_cur_sig->pubkey->srvtype
401 : dkim_exim_expand_defaults(what)
402 : dkim_exim_expand_defaults(what);
403
404 case DKIM_KEY_NOTES:
405 return dkim_cur_sig->pubkey
406 ? dkim_cur_sig->pubkey->notes
407 ? US dkim_cur_sig->pubkey->notes
408 : dkim_exim_expand_defaults(what)
409 : dkim_exim_expand_defaults(what);
410
411 case DKIM_KEY_TESTING:
412 return dkim_cur_sig->pubkey
413 ? dkim_cur_sig->pubkey->testing
414 ? US"1"
415 : dkim_exim_expand_defaults(what)
416 : dkim_exim_expand_defaults(what);
417
418 case DKIM_NOSUBDOMAINS:
419 return dkim_cur_sig->pubkey
420 ? dkim_cur_sig->pubkey->no_subdomaining
421 ? US"1"
422 : dkim_exim_expand_defaults(what)
423 : dkim_exim_expand_defaults(what);
424
425 case DKIM_VERIFY_STATUS:
426 switch (dkim_cur_sig->verify_status)
427 {
428 case PDKIM_VERIFY_INVALID: return US"invalid";
429 case PDKIM_VERIFY_FAIL: return US"fail";
430 case PDKIM_VERIFY_PASS: return US"pass";
431 case PDKIM_VERIFY_NONE:
432 default: return US"none";
80a47a2c 433 }
80a47a2c 434
1cfe5c1c
JH
435 case DKIM_VERIFY_REASON:
436 switch (dkim_cur_sig->verify_ext_status)
437 {
438 case PDKIM_VERIFY_INVALID_PUBKEY_UNAVAILABLE:
439 return US"pubkey_unavailable";
df3def24
JH
440 case PDKIM_VERIFY_INVALID_PUBKEY_DNSRECORD:return US"pubkey_dns_syntax";
441 case PDKIM_VERIFY_INVALID_PUBKEY_IMPORT: return US"pubkey_der_syntax";
1cfe5c1c
JH
442 case PDKIM_VERIFY_FAIL_BODY: return US"bodyhash_mismatch";
443 case PDKIM_VERIFY_FAIL_MESSAGE: return US"signature_incorrect";
444 }
80a47a2c 445
1cfe5c1c
JH
446 default:
447 return US"";
80a47a2c
TK
448 }
449}
450
451
42055a33
JH
452/* Generate signatures for the given file, returning a string.
453If a prefix is given, prepend it to the file for the calculations.
454*/
455
55414b25 456uschar *
42055a33
JH
457dkim_exim_sign(int fd, off_t off, uschar * prefix,
458 struct ob_dkim * dkim, const uschar ** errstr)
55414b25 459{
e983e85a 460const uschar * dkim_domain;
1cfe5c1c
JH
461int sep = 0;
462uschar *seen_items = NULL;
463int seen_items_size = 0;
464int seen_items_offset = 0;
1cfe5c1c
JH
465uschar *dkim_canon_expanded;
466uschar *dkim_sign_headers_expanded;
467uschar *dkim_private_key_expanded;
d73e45df 468uschar *dkim_hash_expanded;
1cfe5c1c
JH
469pdkim_ctx *ctx = NULL;
470uschar *rc = NULL;
471uschar *sigbuf = NULL;
472int sigsize = 0;
473int sigptr = 0;
474pdkim_signature *signature;
475int pdkim_canon;
476int pdkim_rc;
477int sread;
ef698bf6 478uschar buf[4096];
1cfe5c1c
JH
479int save_errno = 0;
480int old_pool = store_pool;
481
482store_pool = POOL_MAIN;
483
e983e85a 484if (!(dkim_domain = expand_cstring(dkim->dkim_domain)))
1cfe5c1c
JH
485 {
486 /* expansion error, do not send message. */
487 log_write(0, LOG_MAIN | LOG_PANIC, "failed to expand "
488 "dkim_domain: %s", expand_string_message);
f7302073 489 goto bad;
1cfe5c1c
JH
490 }
491
492/* Set $dkim_domain expansion variable to each unique domain in list. */
493
42055a33 494while ((dkim_signing_domain = string_nextinlist(&dkim_domain, &sep, NULL, 0)))
1cfe5c1c 495 {
42055a33 496 if (dkim_signing_domain[0] == '\0')
1cfe5c1c
JH
497 continue;
498
499 /* Only sign once for each domain, no matter how often it
500 appears in the expanded list. */
501
502 if (seen_items)
503 {
504 const uschar *seen_items_list = seen_items;
505 if (match_isinlist(dkim_signing_domain,
506 &seen_items_list, 0, NULL, NULL, MCL_STRING, TRUE,
507 NULL) == OK)
508 continue;
509
510 seen_items =
511 string_append(seen_items, &seen_items_size, &seen_items_offset, 1, ":");
512 }
513
514 seen_items =
515 string_append(seen_items, &seen_items_size, &seen_items_offset, 1,
516 dkim_signing_domain);
517 seen_items[seen_items_offset] = '\0';
518
519 /* Set up $dkim_selector expansion variable. */
520
e983e85a 521 if (!(dkim_signing_selector = expand_string(dkim->dkim_selector)))
1cfe5c1c
JH
522 {
523 log_write(0, LOG_MAIN | LOG_PANIC, "failed to expand "
524 "dkim_selector: %s", expand_string_message);
f7302073 525 goto bad;
1cfe5c1c
JH
526 }
527
528 /* Get canonicalization to use */
529
e983e85a
JH
530 dkim_canon_expanded = dkim->dkim_canon
531 ? expand_string(dkim->dkim_canon) : US"relaxed";
1cfe5c1c
JH
532 if (!dkim_canon_expanded)
533 {
80a47a2c 534 /* expansion error, do not send message. */
1cfe5c1c
JH
535 log_write(0, LOG_MAIN | LOG_PANIC, "failed to expand "
536 "dkim_canon: %s", expand_string_message);
f7302073 537 goto bad;
1cfe5c1c 538 }
80a47a2c 539
1cfe5c1c
JH
540 if (Ustrcmp(dkim_canon_expanded, "relaxed") == 0)
541 pdkim_canon = PDKIM_CANON_RELAXED;
542 else if (Ustrcmp(dkim_canon_expanded, "simple") == 0)
543 pdkim_canon = PDKIM_CANON_SIMPLE;
544 else
545 {
546 log_write(0, LOG_MAIN,
547 "DKIM: unknown canonicalization method '%s', defaulting to 'relaxed'.\n",
548 dkim_canon_expanded);
549 pdkim_canon = PDKIM_CANON_RELAXED;
a8e1eeba 550 }
1cfe5c1c
JH
551
552 dkim_sign_headers_expanded = NULL;
e983e85a
JH
553 if (dkim->dkim_sign_headers)
554 if (!(dkim_sign_headers_expanded = expand_string(dkim->dkim_sign_headers)))
1cfe5c1c
JH
555 {
556 log_write(0, LOG_MAIN | LOG_PANIC, "failed to expand "
557 "dkim_sign_headers: %s", expand_string_message);
f7302073 558 goto bad;
1cfe5c1c
JH
559 }
560 /* else pass NULL, which means default header list */
561
562 /* Get private key to use. */
563
e983e85a 564 if (!(dkim_private_key_expanded = expand_string(dkim->dkim_private_key)))
1cfe5c1c
JH
565 {
566 log_write(0, LOG_MAIN | LOG_PANIC, "failed to expand "
567 "dkim_private_key: %s", expand_string_message);
f7302073 568 goto bad;
a8e1eeba 569 }
80a47a2c 570
1cfe5c1c
JH
571 if ( Ustrlen(dkim_private_key_expanded) == 0
572 || Ustrcmp(dkim_private_key_expanded, "0") == 0
573 || Ustrcmp(dkim_private_key_expanded, "false") == 0
574 )
575 continue; /* don't sign, but no error */
576
577 if (dkim_private_key_expanded[0] == '/')
578 {
59d98039 579 int privkey_fd, off = 0, len;
1cfe5c1c
JH
580
581 /* Looks like a filename, load the private key. */
582
583 memset(big_buffer, 0, big_buffer_size);
e983e85a
JH
584
585 if ((privkey_fd = open(CS dkim_private_key_expanded, O_RDONLY)) < 0)
1cfe5c1c
JH
586 {
587 log_write(0, LOG_MAIN | LOG_PANIC, "unable to open "
588 "private key file for reading: %s",
589 dkim_private_key_expanded);
f7302073 590 goto bad;
db4d0902 591 }
80a47a2c 592
59d98039 593 do
1cfe5c1c 594 {
59d98039
JH
595 if ((len = read(privkey_fd, big_buffer + off, big_buffer_size - 2 - off)) < 0)
596 {
597 (void) close(privkey_fd);
598 log_write(0, LOG_MAIN|LOG_PANIC, "unable to read private key file: %s",
599 dkim_private_key_expanded);
600 goto bad;
601 }
602 off += len;
1ac6b2e7 603 }
59d98039 604 while (len > 0);
80a47a2c 605
1cfe5c1c 606 (void) close(privkey_fd);
59d98039 607 big_buffer[off] = '\0';
1cfe5c1c 608 dkim_private_key_expanded = big_buffer;
a8e1eeba 609 }
1cfe5c1c 610
d73e45df
JH
611 if (!(dkim_hash_expanded = expand_string(dkim->dkim_hash)))
612 {
613 log_write(0, LOG_MAIN | LOG_PANIC, "failed to expand "
614 "dkim_hash: %s", expand_string_message);
615 goto bad;
616 }
617
618/*XXX so we currently nail signing to RSA + given hash.
619Need to extract algo from privkey and check for disallowed combos. */
9b2583c4 620
d73e45df
JH
621 if (!(ctx = pdkim_init_sign(dkim_signing_domain,
622 dkim_signing_selector,
623 dkim_private_key_expanded,
624 dkim_hash_expanded,
cd1a5fe0 625 dkim->dot_stuffed,
b9df1829
JH
626 &dkim_exim_query_dns_txt,
627 errstr
628 )))
629 goto bad;
87cb4a16 630 dkim_private_key_expanded[0] = '\0';
1cfe5c1c 631 pdkim_set_optional(ctx,
e983e85a 632 CS dkim_sign_headers_expanded,
1cfe5c1c
JH
633 NULL,
634 pdkim_canon,
f444c2c7 635 pdkim_canon, -1, 0, 0);
1cfe5c1c 636
42055a33
JH
637 if (prefix)
638 pdkim_feed(ctx, prefix, Ustrlen(prefix));
639
d315eda1
JH
640 if (lseek(fd, off, SEEK_SET) < 0)
641 sread = -1;
642 else
643 while ((sread = read(fd, &buf, sizeof(buf))) > 0)
644 if ((pdkim_rc = pdkim_feed(ctx, buf, sread)) != PDKIM_OK)
645 goto pk_bad;
1cfe5c1c
JH
646
647 /* Handle failed read above. */
648 if (sread == -1)
649 {
650 debug_printf("DKIM: Error reading -K file.\n");
651 save_errno = errno;
f7302073 652 goto bad;
80a47a2c 653 }
80a47a2c 654
b9df1829 655 if ((pdkim_rc = pdkim_feed_finish(ctx, &signature, errstr)) != PDKIM_OK)
f7302073 656 goto pk_bad;
80a47a2c 657
1cfe5c1c
JH
658 sigbuf = string_append(sigbuf, &sigsize, &sigptr, 2,
659 US signature->signature_header, US"\r\n");
80a47a2c 660
1cfe5c1c
JH
661 pdkim_free_ctx(ctx);
662 ctx = NULL;
80a47a2c 663 }
a8e1eeba 664
1cfe5c1c
JH
665if (sigbuf)
666 {
667 sigbuf[sigptr] = '\0';
668 rc = sigbuf;
669 }
670else
671 rc = US"";
672
673CLEANUP:
f7302073
JH
674 if (ctx)
675 pdkim_free_ctx(ctx);
676 store_pool = old_pool;
677 errno = save_errno;
678 return rc;
679
680pk_bad:
681 log_write(0, LOG_MAIN|LOG_PANIC,
682 "DKIM: signing failed: %.100s", pdkim_errstr(pdkim_rc));
683bad:
684 rc = NULL;
685 goto CLEANUP;
93f2d376 686}
80a47a2c
TK
687
688#endif