DKIM: fix $dkim_key_length in verify
[exim.git] / src / src / pdkim / signing.c
CommitLineData
2592e6c0
JH
1/*
2 * PDKIM - a RFC4871 (DKIM) implementation
3 *
f9ba5e22 4 * Copyright (C) 1995 - 2018 Exim maintainers
2592e6c0 5 *
d73e45df 6 * signing/verification interface
2592e6c0
JH
7 */
8
9#include "../exim.h"
260958d6
JH
10#include "crypt_ver.h"
11#include "signing.h"
12
13
14#ifdef MACRO_PREDEF
15# include "../macro_predef.h"
16
17void
18features_crypto(void)
19{
20# ifdef SIGN_HAVE_ED25519
21 builtin_macro_create(US"_CRYPTO_SIGN_ED25519");
22# endif
23# ifdef EXIM_HAVE_SHA3
24 builtin_macro_create(US"_CRYPTO_HASH_SHA3");
25# endif
26}
27#else
2592e6c0 28
260958d6 29#ifndef DISABLE_DKIM /* rest of file */
2592e6c0 30
01603eec
JH
31#ifdef DISABLE_TLS
32# error Must no DISABLE_TLS, for DKIM
2592e6c0
JH
33#endif
34
2592e6c0
JH
35
36/******************************************************************************/
d73e45df 37#ifdef SIGN_GNUTLS
286b9d5f
JH
38# define EXIM_GNUTLS_LIBRARY_LOG_LEVEL 3
39
40
41/* Logging function which can be registered with
42 * gnutls_global_set_log_function()
43 * gnutls_global_set_log_level() 0..9
44 */
45#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
46static void
47exim_gnutls_logger_cb(int level, const char *message)
48{
49size_t len = strlen(message);
50if (len < 1)
51 {
52 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
53 return;
54 }
55DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
56 message[len-1] == '\n' ? "" : "\n");
57}
58#endif
59
60
2592e6c0
JH
61
62void
9b2583c4 63exim_dkim_init(void)
2592e6c0 64{
286b9d5f
JH
65#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
66DEBUG(D_tls)
67 {
68 gnutls_global_set_log_function(exim_gnutls_logger_cb);
69 /* arbitrarily chosen level; bump upto 9 for more */
70 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
71 }
72#endif
2592e6c0
JH
73}
74
75
76/* accumulate data (gnutls-only). String to be appended must be nul-terminated. */
acec9514
JH
77gstring *
78exim_dkim_data_append(gstring * g, uschar * s)
2592e6c0 79{
acec9514 80return string_cat(g, s);
2592e6c0
JH
81}
82
83
84
85/* import private key from PEM string in memory.
86Return: NULL for success, or an error string */
87
88const uschar *
617d3932 89exim_dkim_signing_init(const uschar * privkey_pem, es_ctx * sign_ctx)
2592e6c0 90{
cb78c1a8 91gnutls_datum_t k = { .data = (void *)privkey_pem, .size = Ustrlen(privkey_pem) };
286b9d5f 92gnutls_x509_privkey_t x509_key;
c59b09dc 93const uschar * where;
2592e6c0
JH
94int rc;
95
c59b09dc 96if ( (where = US"internal init", rc = gnutls_x509_privkey_init(&x509_key))
286b9d5f 97 || (rc = gnutls_privkey_init(&sign_ctx->key))
c59b09dc
JH
98 || (where = US"privkey PEM-block import",
99 rc = gnutls_x509_privkey_import(x509_key, &k, GNUTLS_X509_FMT_PEM))
100 || (where = US"internal privkey transfer",
101 rc = gnutls_privkey_import_x509(sign_ctx->key, x509_key, 0))
2592e6c0 102 )
c59b09dc 103 return string_sprintf("%s: %s", where, gnutls_strerror(rc));
286b9d5f
JH
104
105switch (rc = gnutls_privkey_get_pk_algorithm(sign_ctx->key, NULL))
106 {
107 case GNUTLS_PK_RSA: sign_ctx->keytype = KEYTYPE_RSA; break;
108#ifdef SIGN_HAVE_ED25519
109 case GNUTLS_PK_EDDSA_ED25519: sign_ctx->keytype = KEYTYPE_ED25519; break;
110#endif
111 default: return rc < 0
112 ? CUS gnutls_strerror(rc)
113 : string_sprintf("Unhandled key type: %d '%s'", rc, gnutls_pk_get_name(rc));
114 }
2592e6c0
JH
115
116return NULL;
117}
118
119
120
121/* allocate mem for signature (when signing) */
286b9d5f 122/* hash & sign data. No way to do incremental.
2592e6c0
JH
123
124Return: NULL for success, or an error string */
125
126const uschar *
d73e45df 127exim_dkim_sign(es_ctx * sign_ctx, hashmethod hash, blob * data, blob * sig)
2592e6c0 128{
286b9d5f 129gnutls_datum_t k_data = { .data = data->data, .size = data->len };
d73e45df 130gnutls_digest_algorithm_t dig;
286b9d5f 131gnutls_datum_t k_sig;
2592e6c0 132int rc;
2592e6c0 133
d73e45df
JH
134switch (hash)
135 {
136 case HASH_SHA1: dig = GNUTLS_DIG_SHA1; break;
137 case HASH_SHA2_256: dig = GNUTLS_DIG_SHA256; break;
138 case HASH_SHA2_512: dig = GNUTLS_DIG_SHA512; break;
139 default: return US"nonhandled hash type";
140 }
141
286b9d5f
JH
142if ((rc = gnutls_privkey_sign_data(sign_ctx->key, dig, 0, &k_data, &k_sig)))
143 return CUS gnutls_strerror(rc);
2592e6c0 144
286b9d5f 145/* Don't care about deinit for the key; shortlived process */
2592e6c0 146
286b9d5f
JH
147sig->data = k_sig.data;
148sig->len = k_sig.size;
149return NULL;
2592e6c0
JH
150}
151
152
153
286b9d5f 154/* import public key (from blob in memory)
2592e6c0
JH
155Return: NULL for success, or an error string */
156
157const uschar *
a841a6ec
JH
158exim_dkim_verify_init(blob * pubkey, keyformat fmt, ev_ctx * verify_ctx,
159 unsigned * bits)
2592e6c0
JH
160{
161gnutls_datum_t k;
162int rc;
163const uschar * ret = NULL;
164
d73e45df 165gnutls_pubkey_init(&verify_ctx->key);
286b9d5f
JH
166k.data = pubkey->data;
167k.size = pubkey->len;
2592e6c0 168
286b9d5f
JH
169switch(fmt)
170 {
171 case KEYFMT_DER:
172 if ((rc = gnutls_pubkey_import(verify_ctx->key, &k, GNUTLS_X509_FMT_DER)))
48224640 173 ret = US gnutls_strerror(rc);
286b9d5f
JH
174 break;
175#ifdef SIGN_HAVE_ED25519
176 case KEYFMT_ED25519_BARE:
177 if ((rc = gnutls_pubkey_import_ecc_raw(verify_ctx->key,
178 GNUTLS_ECC_CURVE_ED25519, &k, NULL)))
48224640 179 ret = US gnutls_strerror(rc);
286b9d5f
JH
180 break;
181#endif
182 default:
183 ret = US"pubkey format not handled";
184 break;
185 }
a841a6ec 186if (!ret && bits) gnutls_pubkey_get_pk_algorithm(verify_ctx->key, bits);
2592e6c0
JH
187return ret;
188}
189
190
286b9d5f
JH
191/* verify signature (of hash if RSA sig, of data if EC sig. No way to do incremental)
192(given pubkey & alleged sig)
2592e6c0
JH
193Return: NULL for success, or an error string */
194
195const uschar *
d73e45df 196exim_dkim_verify(ev_ctx * verify_ctx, hashmethod hash, blob * data_hash, blob * sig)
2592e6c0 197{
286b9d5f
JH
198gnutls_datum_t k = { .data = data_hash->data, .size = data_hash->len };
199gnutls_datum_t s = { .data = sig->data, .size = sig->len };
2592e6c0
JH
200int rc;
201const uschar * ret = NULL;
202
286b9d5f
JH
203#ifdef SIGN_HAVE_ED25519
204if (verify_ctx->keytype == KEYTYPE_ED25519)
d73e45df 205 {
286b9d5f
JH
206 if ((rc = gnutls_pubkey_verify_data2(verify_ctx->key,
207 GNUTLS_SIGN_EDDSA_ED25519, 0, &k, &s)) < 0)
48224640 208 ret = US gnutls_strerror(rc);
d73e45df 209 }
286b9d5f
JH
210else
211#endif
212 {
213 gnutls_sign_algorithm_t algo;
214 switch (hash)
215 {
216 case HASH_SHA1: algo = GNUTLS_SIGN_RSA_SHA1; break;
217 case HASH_SHA2_256: algo = GNUTLS_SIGN_RSA_SHA256; break;
218 case HASH_SHA2_512: algo = GNUTLS_SIGN_RSA_SHA512; break;
219 default: return US"nonhandled hash type";
220 }
d73e45df 221
286b9d5f 222 if ((rc = gnutls_pubkey_verify_hash2(verify_ctx->key, algo, 0, &k, &s)) < 0)
48224640 223 ret = US gnutls_strerror(rc);
286b9d5f 224 }
2592e6c0 225
d73e45df 226gnutls_pubkey_deinit(verify_ctx->key);
2592e6c0
JH
227return ret;
228}
229
230
231
232
d73e45df 233#elif defined(SIGN_GCRYPT)
2592e6c0 234/******************************************************************************/
d73e45df 235/* This variant is used under pre-3.0.0 GnuTLS. Only rsa-sha1 and rsa-sha256 */
2592e6c0
JH
236
237
238/* Internal service routine:
239Read and move past an asn.1 header, checking class & tag,
240optionally returning the data-length */
241
242static int
243as_tag(blob * der, uschar req_cls, long req_tag, long * alen)
244{
245int rc;
246uschar tag_class;
247int taglen;
248long tag, len;
249
286b9d5f
JH
250debug_printf_indent("as_tag: %02x %02x %02x %02x\n",
251 der->data[0], der->data[1], der->data[2], der->data[3]);
2592e6c0
JH
252
253if ((rc = asn1_get_tag_der(der->data++, der->len--, &tag_class, &taglen, &tag))
254 != ASN1_SUCCESS)
255 return rc;
256
257if (tag_class != req_cls || tag != req_tag) return ASN1_ELEMENT_NOT_FOUND;
258
259if ((len = asn1_get_length_der(der->data, der->len, &taglen)) < 0)
260 return ASN1_DER_ERROR;
261if (alen) *alen = len;
262
6e4aaa85 263/* debug_printf_indent("as_tag: tlen %d dlen %d\n", taglen, (int)len); */
2592e6c0
JH
264
265der->data += taglen;
266der->len -= taglen;
267return rc;
268}
269
270/* Internal service routine:
271Read and move over an asn.1 integer, setting an MPI to the value
272*/
273
274static uschar *
275as_mpi(blob * der, gcry_mpi_t * mpi)
276{
277long alen;
278int rc;
279gcry_error_t gerr;
280
286b9d5f
JH
281debug_printf_indent("%s\n", __FUNCTION__);
282
2592e6c0
JH
283/* integer; move past the header */
284if ((rc = as_tag(der, 0, ASN1_TAG_INTEGER, &alen)) != ASN1_SUCCESS)
285 return US asn1_strerror(rc);
286
287/* read to an MPI */
288if ((gerr = gcry_mpi_scan(mpi, GCRYMPI_FMT_STD, der->data, alen, NULL)))
289 return US gcry_strerror(gerr);
290
291/* move over the data */
292der->data += alen; der->len -= alen;
293return NULL;
294}
295
296
297
298void
9b2583c4 299exim_dkim_init(void)
2592e6c0
JH
300{
301/* Version check should be the very first call because it
302makes sure that important subsystems are initialized. */
303if (!gcry_check_version (GCRYPT_VERSION))
304 {
305 fputs ("libgcrypt version mismatch\n", stderr);
306 exit (2);
307 }
308
309/* We don't want to see any warnings, e.g. because we have not yet
310parsed program options which might be used to suppress such
311warnings. */
312gcry_control (GCRYCTL_SUSPEND_SECMEM_WARN);
313
314/* ... If required, other initialization goes here. Note that the
315process might still be running with increased privileges and that
316the secure memory has not been initialized. */
317
318/* Allocate a pool of 16k secure memory. This make the secure memory
319available and also drops privileges where needed. */
320gcry_control (GCRYCTL_INIT_SECMEM, 16384, 0);
321
322/* It is now okay to let Libgcrypt complain when there was/is
323a problem with the secure memory. */
324gcry_control (GCRYCTL_RESUME_SECMEM_WARN);
325
326/* ... If required, other initialization goes here. */
327
328/* Tell Libgcrypt that initialization has completed. */
329gcry_control (GCRYCTL_INITIALIZATION_FINISHED, 0);
330
331return;
332}
333
334
335
336
337/* Accumulate data (gnutls-only).
338String to be appended must be nul-terminated. */
339
acec9514
JH
340gstring *
341exim_dkim_data_append(gstring * g, uschar * s)
2592e6c0 342{
acec9514 343return g; /*dummy*/
2592e6c0
JH
344}
345
346
347
348/* import private key from PEM string in memory.
286b9d5f 349Only handles RSA keys.
2592e6c0
JH
350Return: NULL for success, or an error string */
351
352const uschar *
617d3932 353exim_dkim_signing_init(const uschar * privkey_pem, es_ctx * sign_ctx)
2592e6c0
JH
354{
355uschar * s1, * s2;
356blob der;
357long alen;
358int rc;
359
9b2583c4 360/*XXX will need extension to _spot_ as well as handle a
286b9d5f
JH
361non-RSA key? I think...
362So... this is not a PrivateKeyInfo - which would have a field
363identifying the keytype - PrivateKeyAlgorithmIdentifier -
364but a plain RSAPrivateKey (wrapped in PEM-headers. Can we
365use those as a type tag? What forms are there? "BEGIN EC PRIVATE KEY" (cf. ec(1ssl))
366
367How does OpenSSL PEM_read_bio_PrivateKey() deal with it?
368gnutls_x509_privkey_import() ?
369*/
9b2583c4 370
2592e6c0
JH
371/*
372 * RSAPrivateKey ::= SEQUENCE
373 * version Version,
374 * modulus INTEGER, -- n
375 * publicExponent INTEGER, -- e
376 * privateExponent INTEGER, -- d
377 * prime1 INTEGER, -- p
378 * prime2 INTEGER, -- q
379 * exponent1 INTEGER, -- d mod (p-1)
380 * exponent2 INTEGER, -- d mod (q-1)
381 * coefficient INTEGER, -- (inverse of q) mod p
382 * otherPrimeInfos OtherPrimeInfos OPTIONAL
286b9d5f
JH
383
384 * ECPrivateKey ::= SEQUENCE {
385 * version INTEGER { ecPrivkeyVer1(1) } (ecPrivkeyVer1),
386 * privateKey OCTET STRING,
387 * parameters [0] ECParameters {{ NamedCurve }} OPTIONAL,
388 * publicKey [1] BIT STRING OPTIONAL
389 * }
390 * Hmm, only 1 useful item, and not even an integer? Wonder how we might use it...
391
392- actually, gnutls_x509_privkey_import() appears to require a curve name parameter
393 value for that is an OID? a local-only integer (it's an enum in GnuTLS)?
394
395
396Useful cmds:
397 ssh-keygen -t ecdsa -f foo.privkey
398 ssh-keygen -t ecdsa -b384 -f foo.privkey
399 ssh-keygen -t ecdsa -b521 -f foo.privkey
400 ssh-keygen -t ed25519 -f foo.privkey
401
402 < foo openssl pkcs8 -in /dev/stdin -inform PEM -nocrypt -topk8 -outform DER | od -x
403
404 openssl asn1parse -in foo -inform PEM -dump
405 openssl asn1parse -in foo -inform PEM -dump -stroffset 24 (??)
406(not good for ed25519)
407
2592e6c0 408 */
f9ba5e22 409
2592e6c0
JH
410if ( !(s1 = Ustrstr(CS privkey_pem, "-----BEGIN RSA PRIVATE KEY-----"))
411 || !(s2 = Ustrstr(CS (s1+=31), "-----END RSA PRIVATE KEY-----" ))
412 )
413 return US"Bad PEM wrapper";
414
415*s2 = '\0';
416
428cdca7 417if ((rc = b64decode(s1, &der.data) < 0))
2592e6c0 418 return US"Bad PEM-DER b64 decode";
428cdca7 419der.len = rc;
2592e6c0
JH
420
421/* untangle asn.1 */
422
423/* sequence; just move past the header */
424if ((rc = as_tag(&der, ASN1_CLASS_STRUCTURED, ASN1_TAG_SEQUENCE, NULL))
425 != ASN1_SUCCESS) goto asn_err;
426
427/* integer version; move past the header, check is zero */
428if ((rc = as_tag(&der, 0, ASN1_TAG_INTEGER, &alen)) != ASN1_SUCCESS)
429 goto asn_err;
430if (alen != 1 || *der.data != 0)
431 return US"Bad version number";
432der.data++; der.len--;
433
434if ( (s1 = as_mpi(&der, &sign_ctx->n))
435 || (s1 = as_mpi(&der, &sign_ctx->e))
436 || (s1 = as_mpi(&der, &sign_ctx->d))
437 || (s1 = as_mpi(&der, &sign_ctx->p))
438 || (s1 = as_mpi(&der, &sign_ctx->q))
439 || (s1 = as_mpi(&der, &sign_ctx->dp))
440 || (s1 = as_mpi(&der, &sign_ctx->dq))
441 || (s1 = as_mpi(&der, &sign_ctx->qp))
442 )
443 return s1;
444
349d0869 445#ifdef extreme_debug
6e4aaa85 446DEBUG(D_acl) debug_printf_indent("rsa_signing_init:\n");
2592e6c0
JH
447 {
448 uschar * s;
449 gcry_mpi_aprint (GCRYMPI_FMT_HEX, &s, NULL, sign_ctx->n);
6e4aaa85 450 debug_printf_indent(" N : %s\n", s);
2592e6c0 451 gcry_mpi_aprint (GCRYMPI_FMT_HEX, &s, NULL, sign_ctx->e);
6e4aaa85 452 debug_printf_indent(" E : %s\n", s);
2592e6c0 453 gcry_mpi_aprint (GCRYMPI_FMT_HEX, &s, NULL, sign_ctx->d);
6e4aaa85 454 debug_printf_indent(" D : %s\n", s);
2592e6c0 455 gcry_mpi_aprint (GCRYMPI_FMT_HEX, &s, NULL, sign_ctx->p);
6e4aaa85 456 debug_printf_indent(" P : %s\n", s);
2592e6c0 457 gcry_mpi_aprint (GCRYMPI_FMT_HEX, &s, NULL, sign_ctx->q);
6e4aaa85 458 debug_printf_indent(" Q : %s\n", s);
2592e6c0 459 gcry_mpi_aprint (GCRYMPI_FMT_HEX, &s, NULL, sign_ctx->dp);
6e4aaa85 460 debug_printf_indent(" DP: %s\n", s);
2592e6c0 461 gcry_mpi_aprint (GCRYMPI_FMT_HEX, &s, NULL, sign_ctx->dq);
6e4aaa85 462 debug_printf_indent(" DQ: %s\n", s);
2592e6c0 463 gcry_mpi_aprint (GCRYMPI_FMT_HEX, &s, NULL, sign_ctx->qp);
6e4aaa85 464 debug_printf_indent(" QP: %s\n", s);
2592e6c0 465 }
349d0869 466#endif
286b9d5f
JH
467
468sign_ctx->keytype = KEYTYPE_RSA;
2592e6c0
JH
469return NULL;
470
471asn_err: return US asn1_strerror(rc);
472}
473
474
475
476/* allocate mem for signature (when signing) */
286b9d5f 477/* sign already-hashed data.
2592e6c0
JH
478
479Return: NULL for success, or an error string */
480
481const uschar *
d73e45df 482exim_dkim_sign(es_ctx * sign_ctx, hashmethod hash, blob * data, blob * sig)
2592e6c0 483{
349d0869 484char * sexp_hash;
2592e6c0
JH
485gcry_sexp_t s_hash = NULL, s_key = NULL, s_sig = NULL;
486gcry_mpi_t m_sig;
487uschar * errstr;
488gcry_error_t gerr;
489
9b2583c4
JH
490/*XXX will need extension for hash types (though, possibly, should
491be re-specced to not rehash but take an already-hashed value? Actually
d73e45df 492current impl looks WRONG - it _is_ given a hash so should not be
9b2583c4
JH
493re-hashing. Has this been tested?
494
495Will need extension for non-RSA sugning algos. */
496
d73e45df
JH
497switch (hash)
498 {
349d0869
JH
499 case HASH_SHA1: sexp_hash = "(data(flags pkcs1)(hash sha1 %b))"; break;
500 case HASH_SHA2_256: sexp_hash = "(data(flags pkcs1)(hash sha256 %b))"; break;
d73e45df
JH
501 default: return US"nonhandled hash type";
502 }
503
2592e6c0 504#define SIGSPACE 128
f3ebb786 505sig->data = store_get(SIGSPACE, FALSE);
2592e6c0
JH
506
507if (gcry_mpi_cmp (sign_ctx->p, sign_ctx->q) > 0)
508 {
509 gcry_mpi_swap (sign_ctx->p, sign_ctx->q);
510 gcry_mpi_invm (sign_ctx->qp, sign_ctx->p, sign_ctx->q);
511 }
512
513if ( (gerr = gcry_sexp_build (&s_key, NULL,
514 "(private-key (rsa (n%m)(e%m)(d%m)(p%m)(q%m)(u%m)))",
515 sign_ctx->n, sign_ctx->e,
516 sign_ctx->d, sign_ctx->p,
517 sign_ctx->q, sign_ctx->qp))
349d0869 518 || (gerr = gcry_sexp_build (&s_hash, NULL, sexp_hash,
2592e6c0
JH
519 (int) data->len, CS data->data))
520 || (gerr = gcry_pk_sign (&s_sig, s_hash, s_key))
521 )
522 return US gcry_strerror(gerr);
523
524/* gcry_sexp_dump(s_sig); */
525
526if ( !(s_sig = gcry_sexp_find_token(s_sig, "s", 0))
527 )
528 return US"no sig result";
529
530m_sig = gcry_sexp_nth_mpi(s_sig, 1, GCRYMPI_FMT_USG);
531
349d0869 532#ifdef extreme_debug
2592e6c0
JH
533DEBUG(D_acl)
534 {
535 uschar * s;
536 gcry_mpi_aprint (GCRYMPI_FMT_HEX, &s, NULL, m_sig);
6e4aaa85 537 debug_printf_indent(" SG: %s\n", s);
2592e6c0 538 }
349d0869 539#endif
2592e6c0
JH
540
541gerr = gcry_mpi_print(GCRYMPI_FMT_USG, sig->data, SIGSPACE, &sig->len, m_sig);
542if (gerr)
543 {
6e4aaa85 544 debug_printf_indent("signature conversion from MPI to buffer failed\n");
2592e6c0
JH
545 return US gcry_strerror(gerr);
546 }
547#undef SIGSPACE
548
549return NULL;
550}
551
552
286b9d5f 553/* import public key (from blob in memory)
2592e6c0
JH
554Return: NULL for success, or an error string */
555
556const uschar *
a841a6ec
JH
557exim_dkim_verify_init(blob * pubkey, keyformat fmt, ev_ctx * verify_ctx,
558 unsigned * bits)
2592e6c0
JH
559{
560/*
561in code sequence per b81207d2bfa92 rsa_parse_public_key() and asn1_get_mpi()
562*/
563uschar tag_class;
564int taglen;
565long alen;
a841a6ec 566unsigned nbits;
2592e6c0
JH
567int rc;
568uschar * errstr;
569gcry_error_t gerr;
570uschar * stage = US"S1";
571
286b9d5f
JH
572if (fmt != KEYFMT_DER) return US"pubkey format not handled";
573
2592e6c0
JH
574/*
575sequence
576 sequence
577 OBJECT:rsaEncryption
578 NULL
579 BIT STRING:RSAPublicKey
580 sequence
581 INTEGER:Public modulus
582 INTEGER:Public exponent
583
584openssl rsa -in aux-fixed/dkim/dkim.private -pubout -outform DER | od -t x1 | head;
585openssl rsa -in aux-fixed/dkim/dkim.private -pubout | openssl asn1parse -dump;
586openssl rsa -in aux-fixed/dkim/dkim.private -pubout | openssl asn1parse -dump -offset 22;
587*/
588
589/* sequence; just move past the header */
286b9d5f 590if ((rc = as_tag(pubkey, ASN1_CLASS_STRUCTURED, ASN1_TAG_SEQUENCE, NULL))
2592e6c0
JH
591 != ASN1_SUCCESS) goto asn_err;
592
593/* sequence; skip the entire thing */
594DEBUG(D_acl) stage = US"S2";
286b9d5f 595if ((rc = as_tag(pubkey, ASN1_CLASS_STRUCTURED, ASN1_TAG_SEQUENCE, &alen))
2592e6c0 596 != ASN1_SUCCESS) goto asn_err;
286b9d5f 597pubkey->data += alen; pubkey->len -= alen;
2592e6c0
JH
598
599
600/* bitstring: limit range to size of bitstring;
601move over header + content wrapper */
602DEBUG(D_acl) stage = US"BS";
286b9d5f 603if ((rc = as_tag(pubkey, 0, ASN1_TAG_BIT_STRING, &alen)) != ASN1_SUCCESS)
2592e6c0 604 goto asn_err;
286b9d5f
JH
605pubkey->len = alen;
606pubkey->data++; pubkey->len--;
2592e6c0
JH
607
608/* sequence; just move past the header */
609DEBUG(D_acl) stage = US"S3";
286b9d5f 610if ((rc = as_tag(pubkey, ASN1_CLASS_STRUCTURED, ASN1_TAG_SEQUENCE, NULL))
2592e6c0
JH
611 != ASN1_SUCCESS) goto asn_err;
612
613/* read two integers */
614DEBUG(D_acl) stage = US"MPI";
a841a6ec
JH
615nbits = pubkey->len;
616if ((errstr = as_mpi(pubkey, &verify_ctx->n))) return errstr;
617nbits = (nbits - pubkey->len) * 8;
618if ((errstr = as_mpi(pubkey, &verify_ctx->e))) return errstr;
2592e6c0 619
349d0869 620#ifdef extreme_debug
6e4aaa85 621DEBUG(D_acl) debug_printf_indent("rsa_verify_init:\n");
2592e6c0
JH
622 {
623 uschar * s;
624 gcry_mpi_aprint (GCRYMPI_FMT_HEX, &s, NULL, verify_ctx->n);
6e4aaa85 625 debug_printf_indent(" N : %s\n", s);
2592e6c0 626 gcry_mpi_aprint (GCRYMPI_FMT_HEX, &s, NULL, verify_ctx->e);
6e4aaa85 627 debug_printf_indent(" E : %s\n", s);
2592e6c0
JH
628 }
629
349d0869 630#endif
a841a6ec 631if (bits) *bits = nbits;
2592e6c0
JH
632return NULL;
633
634asn_err:
635DEBUG(D_acl) return string_sprintf("%s: %s", stage, asn1_strerror(rc));
636 return US asn1_strerror(rc);
637}
638
639
286b9d5f
JH
640/* verify signature (of hash)
641XXX though we appear to be doing a hash, too!
642(given pubkey & alleged sig)
2592e6c0
JH
643Return: NULL for success, or an error string */
644
645const uschar *
d73e45df 646exim_dkim_verify(ev_ctx * verify_ctx, hashmethod hash, blob * data_hash, blob * sig)
2592e6c0
JH
647{
648/*
649cf. libgnutls 2.8.5 _wrap_gcry_pk_verify()
650*/
349d0869 651char * sexp_hash;
2592e6c0
JH
652gcry_mpi_t m_sig;
653gcry_sexp_t s_sig = NULL, s_hash = NULL, s_pkey = NULL;
654gcry_error_t gerr;
655uschar * stage;
656
349d0869 657/*XXX needs extension for SHA512 */
d73e45df
JH
658switch (hash)
659 {
349d0869
JH
660 case HASH_SHA1: sexp_hash = "(data(flags pkcs1)(hash sha1 %b))"; break;
661 case HASH_SHA2_256: sexp_hash = "(data(flags pkcs1)(hash sha256 %b))"; break;
662 default: return US"nonhandled hash type";
d73e45df
JH
663 }
664
2592e6c0
JH
665if ( (stage = US"pkey sexp build",
666 gerr = gcry_sexp_build (&s_pkey, NULL, "(public-key(rsa(n%m)(e%m)))",
667 verify_ctx->n, verify_ctx->e))
668 || (stage = US"data sexp build",
349d0869 669 gerr = gcry_sexp_build (&s_hash, NULL, sexp_hash,
2592e6c0
JH
670 (int) data_hash->len, CS data_hash->data))
671 || (stage = US"sig mpi scan",
672 gerr = gcry_mpi_scan(&m_sig, GCRYMPI_FMT_USG, sig->data, sig->len, NULL))
673 || (stage = US"sig sexp build",
674 gerr = gcry_sexp_build (&s_sig, NULL, "(sig-val(rsa(s%m)))", m_sig))
675 || (stage = US"verify",
676 gerr = gcry_pk_verify (s_sig, s_hash, s_pkey))
677 )
678 {
6e4aaa85 679 DEBUG(D_acl) debug_printf_indent("verify: error in stage '%s'\n", stage);
2592e6c0
JH
680 return US gcry_strerror(gerr);
681 }
682
683if (s_sig) gcry_sexp_release (s_sig);
684if (s_hash) gcry_sexp_release (s_hash);
685if (s_pkey) gcry_sexp_release (s_pkey);
686gcry_mpi_release (m_sig);
687gcry_mpi_release (verify_ctx->n);
688gcry_mpi_release (verify_ctx->e);
689
690return NULL;
691}
692
693
694
695
d73e45df 696#elif defined(SIGN_OPENSSL)
2592e6c0
JH
697/******************************************************************************/
698
699void
9b2583c4 700exim_dkim_init(void)
2592e6c0 701{
9e70917d 702ERR_load_crypto_strings();
2592e6c0
JH
703}
704
705
617d3932 706/* accumulate data (was gnutls-only but now needed for OpenSSL non-EC too
286b9d5f 707because now using hash-and-sign interface) */
acec9514
JH
708gstring *
709exim_dkim_data_append(gstring * g, uschar * s)
2592e6c0 710{
286b9d5f 711return string_cat(g, s);
2592e6c0
JH
712}
713
714
715/* import private key from PEM string in memory.
716Return: NULL for success, or an error string */
717
718const uschar *
617d3932 719exim_dkim_signing_init(const uschar * privkey_pem, es_ctx * sign_ctx)
2592e6c0 720{
d70fc283 721BIO * bp = BIO_new_mem_buf((void *)privkey_pem, -1);
2592e6c0 722
d73e45df 723if (!(sign_ctx->key = PEM_read_bio_PrivateKey(bp, NULL, NULL, NULL)))
c59b09dc
JH
724 return string_sprintf("privkey PEM-block import: %s",
725 ERR_error_string(ERR_get_error(), NULL));
286b9d5f
JH
726
727sign_ctx->keytype =
728#ifdef SIGN_HAVE_ED25519
cb78c1a8 729 EVP_PKEY_type(EVP_PKEY_id(sign_ctx->key)) == EVP_PKEY_ED25519
286b9d5f
JH
730 ? KEYTYPE_ED25519 : KEYTYPE_RSA;
731#else
732 KEYTYPE_RSA;
733#endif
2592e6c0
JH
734return NULL;
735}
736
737
738
739/* allocate mem for signature (when signing) */
cb78c1a8 740/* hash & sign data. Incremental not supported.
2592e6c0 741
9e70917d 742Return: NULL for success with the signaature in the sig blob, or an error string */
2592e6c0
JH
743
744const uschar *
d73e45df 745exim_dkim_sign(es_ctx * sign_ctx, hashmethod hash, blob * data, blob * sig)
2592e6c0 746{
d73e45df 747const EVP_MD * md;
286b9d5f 748EVP_MD_CTX * ctx;
d73e45df 749size_t siglen;
9b2583c4 750
d73e45df
JH
751switch (hash)
752 {
cb78c1a8 753 case HASH_NULL: md = NULL; break; /* Ed25519 signing */
d73e45df
JH
754 case HASH_SHA1: md = EVP_sha1(); break;
755 case HASH_SHA2_256: md = EVP_sha256(); break;
756 case HASH_SHA2_512: md = EVP_sha512(); break;
757 default: return US"nonhandled hash type";
758 }
2592e6c0 759
cb78c1a8
JH
760#ifdef SIGN_HAVE_ED25519
761if ( (ctx = EVP_MD_CTX_new())
762 && EVP_DigestSignInit(ctx, NULL, md, NULL, sign_ctx->key) > 0
763 && EVP_DigestSign(ctx, NULL, &siglen, NULL, 0) > 0
f3ebb786 764 && (sig->data = store_get(siglen, FALSE))
f9ba5e22 765
cb78c1a8 766 /* Obtain the signature (slen could change here!) */
39e02651 767 && EVP_DigestSign(ctx, sig->data, &siglen, data->data, data->len) > 0
cb78c1a8
JH
768 )
769 {
770 EVP_MD_CTX_destroy(ctx);
771 sig->len = siglen;
772 return NULL;
773 }
774#else
775/*XXX renamed to EVP_MD_CTX_new() in 1.1.0 */
776if ( (ctx = EVP_MD_CTX_create())
777 && EVP_DigestSignInit(ctx, NULL, md, NULL, sign_ctx->key) > 0
286b9d5f 778 && EVP_DigestSignUpdate(ctx, data->data, data->len) > 0
286b9d5f 779 && EVP_DigestSignFinal(ctx, NULL, &siglen) > 0
f3ebb786 780 && (sig->data = store_get(siglen, FALSE))
cb78c1a8
JH
781
782 /* Obtain the signature (slen could change here!) */
286b9d5f 783 && EVP_DigestSignFinal(ctx, sig->data, &siglen) > 0
d73e45df 784 )
2592e6c0 785 {
286b9d5f
JH
786 EVP_MD_CTX_destroy(ctx);
787 sig->len = siglen;
788 return NULL;
2592e6c0 789 }
cb78c1a8 790#endif
2592e6c0 791
286b9d5f 792if (ctx) EVP_MD_CTX_destroy(ctx);
7845dbb3 793return US ERR_error_string(ERR_get_error(), NULL);
2592e6c0
JH
794}
795
796
797
286b9d5f 798/* import public key (from blob in memory)
9b2583c4 799Return: NULL for success, or an error string */
2592e6c0
JH
800
801const uschar *
a841a6ec
JH
802exim_dkim_verify_init(blob * pubkey, keyformat fmt, ev_ctx * verify_ctx,
803 unsigned * bits)
2592e6c0 804{
286b9d5f
JH
805const uschar * s = pubkey->data;
806uschar * ret = NULL;
2592e6c0 807
286b9d5f
JH
808switch(fmt)
809 {
810 case KEYFMT_DER:
286b9d5f
JH
811 /*XXX hmm, we never free this */
812 if (!(verify_ctx->key = d2i_PUBKEY(NULL, &s, pubkey->len)))
813 ret = US ERR_error_string(ERR_get_error(), NULL);
814 break;
815#ifdef SIGN_HAVE_ED25519
816 case KEYFMT_ED25519_BARE:
cb78c1a8
JH
817 if (!(verify_ctx->key = EVP_PKEY_new_raw_public_key(EVP_PKEY_ED25519, NULL,
818 s, pubkey->len)))
286b9d5f 819 ret = US ERR_error_string(ERR_get_error(), NULL);
286b9d5f
JH
820 break;
821#endif
822 default:
823 ret = US"pubkey format not handled";
824 break;
825 }
9b2583c4 826
a841a6ec 827if (!ret && bits) *bits = EVP_PKEY_bits(verify_ctx->key);
286b9d5f 828return ret;
2592e6c0
JH
829}
830
831
832
833
cb78c1a8 834/* verify signature (of hash, except Ed25519 where of-data)
286b9d5f 835(given pubkey & alleged sig)
2592e6c0
JH
836Return: NULL for success, or an error string */
837
838const uschar *
286b9d5f 839exim_dkim_verify(ev_ctx * verify_ctx, hashmethod hash, blob * data, blob * sig)
2592e6c0 840{
d73e45df 841const EVP_MD * md;
286b9d5f 842
d73e45df 843switch (hash)
2592e6c0 844 {
cb78c1a8 845 case HASH_NULL: md = NULL; break;
d73e45df
JH
846 case HASH_SHA1: md = EVP_sha1(); break;
847 case HASH_SHA2_256: md = EVP_sha256(); break;
848 case HASH_SHA2_512: md = EVP_sha512(); break;
849 default: return US"nonhandled hash type";
2592e6c0 850 }
d73e45df 851
cb78c1a8
JH
852#ifdef SIGN_HAVE_ED25519
853if (!md)
286b9d5f
JH
854 {
855 EVP_MD_CTX * ctx;
d73e45df 856
c8b2f374
JH
857 if ((ctx = EVP_MD_CTX_new()))
858 {
859 if ( EVP_DigestVerifyInit(ctx, NULL, md, NULL, verify_ctx->key) > 0
860 && EVP_DigestVerify(ctx, sig->data, sig->len, data->data, data->len) > 0
861 )
862 { EVP_MD_CTX_free(ctx); return NULL; }
863 EVP_MD_CTX_free(ctx);
864 }
286b9d5f 865 }
cb78c1a8
JH
866else
867#endif
286b9d5f
JH
868 {
869 EVP_PKEY_CTX * ctx;
870
c8b2f374 871 if ((ctx = EVP_PKEY_CTX_new(verify_ctx->key, NULL)))
25fa0868 872 {
c8b2f374
JH
873 if ( EVP_PKEY_verify_init(ctx) > 0
874 && EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) > 0
875 && EVP_PKEY_CTX_set_signature_md(ctx, md) > 0
876 && EVP_PKEY_verify(ctx, sig->data, sig->len,
877 data->data, data->len) == 1
25fa0868
JH
878 )
879 { EVP_PKEY_CTX_free(ctx); return NULL; }
25fa0868 880 EVP_PKEY_CTX_free(ctx);
c8b2f374
JH
881
882 DEBUG(D_tls)
883 if (Ustrcmp(ERR_reason_error_string(ERR_peek_error()), "wrong signature length") == 0)
884 debug_printf("sig len (from msg hdr): %d, expected (from dns pubkey) %d\n",
885 (int) sig->len, EVP_PKEY_size(verify_ctx->key));
25fa0868 886 }
286b9d5f 887 }
c8b2f374
JH
888
889return US ERR_error_string(ERR_get_error(), NULL);
2592e6c0
JH
890}
891
892
d73e45df 893
2592e6c0
JH
894#endif
895/******************************************************************************/
896
897#endif /*DISABLE_DKIM*/
260958d6 898#endif /*MACRO_PREDEF*/
2592e6c0 899/* End of File */