src/src/pdkim/signing.c

   1 /*
   2  *  PDKIM - a RFC4871 (DKIM) implementation
   3  *
   4  *  Copyright (C) 2017  Exim maintainers
   5  *
   6  *  signing/verification interface
   7  */
   8
   9 #include "../exim.h"
  10
  11 #ifndef DISABLE_DKIM    /* entire file */
  12
  13 #ifndef SUPPORT_TLS
  14 # error Need SUPPORT_TLS for DKIM
  15 #endif
  16
  17 #include "crypt_ver.h"
  18 #include "signing.h"
  19
  20
  21 /******************************************************************************/
  22 #ifdef SIGN_GNUTLS
  23 # define EXIM_GNUTLS_LIBRARY_LOG_LEVEL 3
  24
  25
  26 /* Logging function which can be registered with
  27  *   gnutls_global_set_log_function()
  28  *   gnutls_global_set_log_level() 0..9
  29  */
  30 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
  31 static void
  32 exim_gnutls_logger_cb(int level, const char *message)
  33 {
  34 size_t len = strlen(message);
  35 if (len < 1)
  36   {
  37   DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
  38   return;
  39   }
  40 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
  41     message[len-1] == '\n' ? "" : "\n");
  42 }
  43 #endif
  44
  45
  46
  47 void
  48 exim_dkim_init(void)
  49 {
  50 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
  51 DEBUG(D_tls)
  52   {
  53   gnutls_global_set_log_function(exim_gnutls_logger_cb);
  54   /* arbitrarily chosen level; bump upto 9 for more */
  55   gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
  56   }
  57 #endif
  58 }
  59
  60
  61 /* accumulate data (gnutls-only).  String to be appended must be nul-terminated. */
  62 gstring *
  63 exim_dkim_data_append(gstring * g, uschar * s)
  64 {
  65 return string_cat(g, s);
  66 }
  67
  68
  69
  70 /* import private key from PEM string in memory.
  71 Return: NULL for success, or an error string */
  72
  73 const uschar *
  74 exim_dkim_signing_init(uschar * privkey_pem, es_ctx * sign_ctx)
  75 {
  76 gnutls_datum_t k = { .data = privkey_pem, .size = Ustrlen(privkey_pem) };
  77 gnutls_x509_privkey_t x509_key;
  78 int rc;
  79
  80 if (  (rc = gnutls_x509_privkey_init(&x509_key))
  81    || (rc = gnutls_x509_privkey_import(x509_key, &k, GNUTLS_X509_FMT_PEM))
  82    || (rc = gnutls_privkey_init(&sign_ctx->key))
  83    || (rc = gnutls_privkey_import_x509(sign_ctx->key, x509_key, 0))
  84    )
  85   return CUS gnutls_strerror(rc);
  86
  87 switch (rc = gnutls_privkey_get_pk_algorithm(sign_ctx->key, NULL))
  88   {
  89   case GNUTLS_PK_RSA:           sign_ctx->keytype = KEYTYPE_RSA;     break;
  90 #ifdef SIGN_HAVE_ED25519
  91   case GNUTLS_PK_EDDSA_ED25519: sign_ctx->keytype = KEYTYPE_ED25519; break;
  92 #endif
  93   default: return rc < 0
  94     ? CUS gnutls_strerror(rc)
  95     : string_sprintf("Unhandled key type: %d '%s'", rc, gnutls_pk_get_name(rc));
  96   }
  97
  98 return NULL;
  99 }
 100
 101
 102
 103 /* allocate mem for signature (when signing) */
 104 /* hash & sign data.   No way to do incremental.
 105
 106 Return: NULL for success, or an error string */
 107
 108 const uschar *
 109 exim_dkim_sign(es_ctx * sign_ctx, hashmethod hash, blob * data, blob * sig)
 110 {
 111 gnutls_datum_t k_data = { .data = data->data, .size = data->len };
 112 gnutls_digest_algorithm_t dig;
 113 gnutls_datum_t k_sig;
 114 int rc;
 115
 116 switch (hash)
 117   {
 118   case HASH_SHA1:       dig = GNUTLS_DIG_SHA1; break;
 119   case HASH_SHA2_256:   dig = GNUTLS_DIG_SHA256; break;
 120   case HASH_SHA2_512:   dig = GNUTLS_DIG_SHA512; break;
 121   default:              return US"nonhandled hash type";
 122   }
 123
 124 if ((rc = gnutls_privkey_sign_data(sign_ctx->key, dig, 0, &k_data, &k_sig)))
 125   return CUS gnutls_strerror(rc);
 126
 127 /* Don't care about deinit for the key; shortlived process */
 128
 129 sig->data = k_sig.data;
 130 sig->len = k_sig.size;
 131 return NULL;
 132 }
 133
 134
 135
 136 /* import public key (from blob in memory)
 137 Return: NULL for success, or an error string */
 138
 139 const uschar *
 140 exim_dkim_verify_init(blob * pubkey, keyformat fmt, ev_ctx * verify_ctx)
 141 {
 142 gnutls_datum_t k;
 143 int rc;
 144 const uschar * ret = NULL;
 145
 146 gnutls_pubkey_init(&verify_ctx->key);
 147 k.data = pubkey->data;
 148 k.size = pubkey->len;
 149
 150 switch(fmt)
 151   {
 152   case KEYFMT_DER:
 153     if ((rc = gnutls_pubkey_import(verify_ctx->key, &k, GNUTLS_X509_FMT_DER)))
 154       ret = gnutls_strerror(rc);
 155     break;
 156 #ifdef SIGN_HAVE_ED25519
 157   case KEYFMT_ED25519_BARE:
 158     if ((rc = gnutls_pubkey_import_ecc_raw(verify_ctx->key,
 159                                           GNUTLS_ECC_CURVE_ED25519, &k, NULL)))
 160       ret = gnutls_strerror(rc);
 161     break;
 162 #endif
 163   default:
 164     ret = US"pubkey format not handled";
 165     break;
 166   }
 167 return ret;
 168 }
 169
 170
 171 /* verify signature (of hash if RSA sig, of data if EC sig.  No way to do incremental)
 172 (given pubkey & alleged sig)
 173 Return: NULL for success, or an error string */
 174
 175 const uschar *
 176 exim_dkim_verify(ev_ctx * verify_ctx, hashmethod hash, blob * data_hash, blob * sig)
 177 {
 178 gnutls_datum_t k = { .data = data_hash->data, .size = data_hash->len };
 179 gnutls_datum_t s = { .data = sig->data,       .size = sig->len };
 180 int rc;
 181 const uschar * ret = NULL;
 182
 183 #ifdef SIGN_HAVE_ED25519
 184 if (verify_ctx->keytype == KEYTYPE_ED25519)
 185   {
 186   if ((rc = gnutls_pubkey_verify_data2(verify_ctx->key,
 187                                       GNUTLS_SIGN_EDDSA_ED25519, 0, &k, &s)) < 0)
 188     ret = gnutls_strerror(rc);
 189   }
 190 else
 191 #endif
 192   {
 193   gnutls_sign_algorithm_t algo;
 194   switch (hash)
 195     {
 196     case HASH_SHA1:     algo = GNUTLS_SIGN_RSA_SHA1;   break;
 197     case HASH_SHA2_256: algo = GNUTLS_SIGN_RSA_SHA256; break;
 198     case HASH_SHA2_512: algo = GNUTLS_SIGN_RSA_SHA512; break;
 199     default:            return US"nonhandled hash type";
 200     }
 201
 202   if ((rc = gnutls_pubkey_verify_hash2(verify_ctx->key, algo, 0, &k, &s)) < 0)
 203     ret = gnutls_strerror(rc);
 204   }
 205
 206 gnutls_pubkey_deinit(verify_ctx->key);
 207 return ret;
 208 }
 209
 210
 211
 212
 213 #elif defined(SIGN_GCRYPT)
 214 /******************************************************************************/
 215 /* This variant is used under pre-3.0.0 GnuTLS.  Only rsa-sha1 and rsa-sha256 */
 216
 217
 218 /* Internal service routine:
 219 Read and move past an asn.1 header, checking class & tag,
 220 optionally returning the data-length */
 221
 222 static int
 223 as_tag(blob * der, uschar req_cls, long req_tag, long * alen)
 224 {
 225 int rc;
 226 uschar tag_class;
 227 int taglen;
 228 long tag, len;
 229
 230 debug_printf_indent("as_tag: %02x %02x %02x %02x\n",
 231         der->data[0], der->data[1], der->data[2], der->data[3]);
 232
 233 if ((rc = asn1_get_tag_der(der->data++, der->len--, &tag_class, &taglen, &tag))
 234     != ASN1_SUCCESS)
 235   return rc;
 236
 237 if (tag_class != req_cls || tag != req_tag) return ASN1_ELEMENT_NOT_FOUND;
 238
 239 if ((len = asn1_get_length_der(der->data, der->len, &taglen)) < 0)
 240   return ASN1_DER_ERROR;
 241 if (alen) *alen = len;
 242
 243 /* debug_printf_indent("as_tag:  tlen %d dlen %d\n", taglen, (int)len); */
 244
 245 der->data += taglen;
 246 der->len -= taglen;
 247 return rc;
 248 }
 249
 250 /* Internal service routine:
 251 Read and move over an asn.1 integer, setting an MPI to the value
 252 */
 253
 254 static uschar *
 255 as_mpi(blob * der, gcry_mpi_t * mpi)
 256 {
 257 long alen;
 258 int rc;
 259 gcry_error_t gerr;
 260
 261 debug_printf_indent("%s\n", __FUNCTION__);
 262
 263 /* integer; move past the header */
 264 if ((rc = as_tag(der, 0, ASN1_TAG_INTEGER, &alen)) != ASN1_SUCCESS)
 265   return US asn1_strerror(rc);
 266
 267 /* read to an MPI */
 268 if ((gerr = gcry_mpi_scan(mpi, GCRYMPI_FMT_STD, der->data, alen, NULL)))
 269   return US gcry_strerror(gerr);
 270
 271 /* move over the data */
 272 der->data += alen; der->len -= alen;
 273 return NULL;
 274 }
 275
 276
 277
 278 void
 279 exim_dkim_init(void)
 280 {
 281 /* Version check should be the very first call because it
 282 makes sure that important subsystems are initialized. */
 283 if (!gcry_check_version (GCRYPT_VERSION))
 284   {
 285   fputs ("libgcrypt version mismatch\n", stderr);
 286   exit (2);
 287   }
 288
 289 /* We don't want to see any warnings, e.g. because we have not yet
 290 parsed program options which might be used to suppress such
 291 warnings. */
 292 gcry_control (GCRYCTL_SUSPEND_SECMEM_WARN);
 293
 294 /* ... If required, other initialization goes here.  Note that the
 295 process might still be running with increased privileges and that
 296 the secure memory has not been initialized.  */
 297
 298 /* Allocate a pool of 16k secure memory.  This make the secure memory
 299 available and also drops privileges where needed.  */
 300 gcry_control (GCRYCTL_INIT_SECMEM, 16384, 0);
 301
 302 /* It is now okay to let Libgcrypt complain when there was/is
 303 a problem with the secure memory. */
 304 gcry_control (GCRYCTL_RESUME_SECMEM_WARN);
 305
 306 /* ... If required, other initialization goes here.  */
 307
 308 /* Tell Libgcrypt that initialization has completed. */
 309 gcry_control (GCRYCTL_INITIALIZATION_FINISHED, 0);
 310
 311 return;
 312 }
 313
 314
 315
 316
 317 /* Accumulate data (gnutls-only).
 318 String to be appended must be nul-terminated. */
 319
 320 gstring *
 321 exim_dkim_data_append(gstring * g, uschar * s)
 322 {
 323 return g;       /*dummy*/
 324 }
 325
 326
 327
 328 /* import private key from PEM string in memory.
 329 Only handles RSA keys.
 330 Return: NULL for success, or an error string */
 331
 332 const uschar *
 333 exim_dkim_signing_init(uschar * privkey_pem, es_ctx * sign_ctx)
 334 {
 335 uschar * s1, * s2;
 336 blob der;
 337 long alen;
 338 int rc;
 339
 340 /*XXX will need extension to _spot_ as well as handle a
 341 non-RSA key?  I think...
 342 So... this is not a PrivateKeyInfo - which would have a field
 343 identifying the keytype - PrivateKeyAlgorithmIdentifier -
 344 but a plain RSAPrivateKey (wrapped in PEM-headers.  Can we
 345 use those as a type tag?  What forms are there?  "BEGIN EC PRIVATE KEY" (cf. ec(1ssl))
 346
 347 How does OpenSSL PEM_read_bio_PrivateKey() deal with it?
 348 gnutls_x509_privkey_import() ?
 349 */
 350
 351 /*
 352  *  RSAPrivateKey ::= SEQUENCE
 353  *      version           Version,
 354  *      modulus           INTEGER,  -- n
 355  *      publicExponent    INTEGER,  -- e
 356  *      privateExponent   INTEGER,  -- d
 357  *      prime1            INTEGER,  -- p
 358  *      prime2            INTEGER,  -- q
 359  *      exponent1         INTEGER,  -- d mod (p-1)
 360  *      exponent2         INTEGER,  -- d mod (q-1)
 361  *      coefficient       INTEGER,  -- (inverse of q) mod p
 362  *      otherPrimeInfos   OtherPrimeInfos OPTIONAL
 363
 364  * ECPrivateKey ::= SEQUENCE {
 365  *     version        INTEGER { ecPrivkeyVer1(1) } (ecPrivkeyVer1),
 366  *     privateKey     OCTET STRING,
 367  *     parameters [0] ECParameters {{ NamedCurve }} OPTIONAL,
 368  *     publicKey  [1] BIT STRING OPTIONAL
 369  *   }
 370  * Hmm, only 1 useful item, and not even an integer?  Wonder how we might use it...
 371
 372 - actually, gnutls_x509_privkey_import() appears to require a curve name parameter
 373         value for that is an OID? a local-only integer (it's an enum in GnuTLS)?
 374
 375
 376 Useful cmds:
 377   ssh-keygen -t ecdsa -f foo.privkey
 378   ssh-keygen -t ecdsa -b384 -f foo.privkey
 379   ssh-keygen -t ecdsa -b521 -f foo.privkey
 380   ssh-keygen -t ed25519 -f foo.privkey
 381
 382   < foo openssl pkcs8 -in /dev/stdin -inform PEM -nocrypt -topk8 -outform DER | od -x
 383
 384   openssl asn1parse -in foo -inform PEM -dump
 385   openssl asn1parse -in foo -inform PEM -dump -stroffset 24    (??)
 386 (not good for ed25519)
 387
 388  */
 389
 390 if (  !(s1 = Ustrstr(CS privkey_pem, "-----BEGIN RSA PRIVATE KEY-----"))
 391    || !(s2 = Ustrstr(CS (s1+=31),    "-----END RSA PRIVATE KEY-----" ))
 392    )
 393   return US"Bad PEM wrapper";
 394
 395 *s2 = '\0';
 396
 397 if ((der.len = b64decode(s1, &der.data)) < 0)
 398   return US"Bad PEM-DER b64 decode";
 399
 400 /* untangle asn.1 */
 401
 402 /* sequence; just move past the header */
 403 if ((rc = as_tag(&der, ASN1_CLASS_STRUCTURED, ASN1_TAG_SEQUENCE, NULL))
 404    != ASN1_SUCCESS) goto asn_err;
 405
 406 /* integer version; move past the header, check is zero */
 407 if ((rc = as_tag(&der, 0, ASN1_TAG_INTEGER, &alen)) != ASN1_SUCCESS)
 408   goto asn_err;
 409 if (alen != 1 || *der.data != 0)
 410   return US"Bad version number";
 411 der.data++; der.len--;
 412
 413 if (  (s1 = as_mpi(&der, &sign_ctx->n))
 414    || (s1 = as_mpi(&der, &sign_ctx->e))
 415    || (s1 = as_mpi(&der, &sign_ctx->d))
 416    || (s1 = as_mpi(&der, &sign_ctx->p))
 417    || (s1 = as_mpi(&der, &sign_ctx->q))
 418    || (s1 = as_mpi(&der, &sign_ctx->dp))
 419    || (s1 = as_mpi(&der, &sign_ctx->dq))
 420    || (s1 = as_mpi(&der, &sign_ctx->qp))
 421    )
 422   return s1;
 423
 424 #ifdef extreme_debug
 425 DEBUG(D_acl) debug_printf_indent("rsa_signing_init:\n");
 426   {
 427   uschar * s;
 428   gcry_mpi_aprint (GCRYMPI_FMT_HEX, &s, NULL, sign_ctx->n);
 429   debug_printf_indent(" N : %s\n", s);
 430   gcry_mpi_aprint (GCRYMPI_FMT_HEX, &s, NULL, sign_ctx->e);
 431   debug_printf_indent(" E : %s\n", s);
 432   gcry_mpi_aprint (GCRYMPI_FMT_HEX, &s, NULL, sign_ctx->d);
 433   debug_printf_indent(" D : %s\n", s);
 434   gcry_mpi_aprint (GCRYMPI_FMT_HEX, &s, NULL, sign_ctx->p);
 435   debug_printf_indent(" P : %s\n", s);
 436   gcry_mpi_aprint (GCRYMPI_FMT_HEX, &s, NULL, sign_ctx->q);
 437   debug_printf_indent(" Q : %s\n", s);
 438   gcry_mpi_aprint (GCRYMPI_FMT_HEX, &s, NULL, sign_ctx->dp);
 439   debug_printf_indent(" DP: %s\n", s);
 440   gcry_mpi_aprint (GCRYMPI_FMT_HEX, &s, NULL, sign_ctx->dq);
 441   debug_printf_indent(" DQ: %s\n", s);
 442   gcry_mpi_aprint (GCRYMPI_FMT_HEX, &s, NULL, sign_ctx->qp);
 443   debug_printf_indent(" QP: %s\n", s);
 444   }
 445 #endif
 446
 447 sign_ctx->keytype = KEYTYPE_RSA;
 448 return NULL;
 449
 450 asn_err: return US asn1_strerror(rc);
 451 }
 452
 453
 454
 455 /* allocate mem for signature (when signing) */
 456 /* sign already-hashed data.
 457
 458 Return: NULL for success, or an error string */
 459
 460 const uschar *
 461 exim_dkim_sign(es_ctx * sign_ctx, hashmethod hash, blob * data, blob * sig)
 462 {
 463 char * sexp_hash;
 464 gcry_sexp_t s_hash = NULL, s_key = NULL, s_sig = NULL;
 465 gcry_mpi_t m_sig;
 466 uschar * errstr;
 467 gcry_error_t gerr;
 468
 469 /*XXX will need extension for hash types (though, possibly, should
 470 be re-specced to not rehash but take an already-hashed value? Actually
 471 current impl looks WRONG - it _is_ given a hash so should not be
 472 re-hashing.  Has this been tested?
 473
 474 Will need extension for non-RSA sugning algos. */
 475
 476 switch (hash)
 477   {
 478   case HASH_SHA1:       sexp_hash = "(data(flags pkcs1)(hash sha1 %b))"; break;
 479   case HASH_SHA2_256:   sexp_hash = "(data(flags pkcs1)(hash sha256 %b))"; break;
 480   default:              return US"nonhandled hash type";
 481   }
 482
 483 #define SIGSPACE 128
 484 sig->data = store_get(SIGSPACE);
 485
 486 if (gcry_mpi_cmp (sign_ctx->p, sign_ctx->q) > 0)
 487   {
 488   gcry_mpi_swap (sign_ctx->p, sign_ctx->q);
 489   gcry_mpi_invm (sign_ctx->qp, sign_ctx->p, sign_ctx->q);
 490   }
 491
 492 if (  (gerr = gcry_sexp_build (&s_key, NULL,
 493                 "(private-key (rsa (n%m)(e%m)(d%m)(p%m)(q%m)(u%m)))",
 494                 sign_ctx->n, sign_ctx->e,
 495                 sign_ctx->d, sign_ctx->p,
 496                 sign_ctx->q, sign_ctx->qp))
 497    || (gerr = gcry_sexp_build (&s_hash, NULL, sexp_hash,
 498                 (int) data->len, CS data->data))
 499    ||  (gerr = gcry_pk_sign (&s_sig, s_hash, s_key))
 500    )
 501   return US gcry_strerror(gerr);
 502
 503 /* gcry_sexp_dump(s_sig); */
 504
 505 if (  !(s_sig = gcry_sexp_find_token(s_sig, "s", 0))
 506    )
 507   return US"no sig result";
 508
 509 m_sig = gcry_sexp_nth_mpi(s_sig, 1, GCRYMPI_FMT_USG);
 510
 511 #ifdef extreme_debug
 512 DEBUG(D_acl)
 513   {
 514   uschar * s;
 515   gcry_mpi_aprint (GCRYMPI_FMT_HEX, &s, NULL, m_sig);
 516   debug_printf_indent(" SG: %s\n", s);
 517   }
 518 #endif
 519
 520 gerr = gcry_mpi_print(GCRYMPI_FMT_USG, sig->data, SIGSPACE, &sig->len, m_sig);
 521 if (gerr)
 522   {
 523   debug_printf_indent("signature conversion from MPI to buffer failed\n");
 524   return US gcry_strerror(gerr);
 525   }
 526 #undef SIGSPACE
 527
 528 return NULL;
 529 }
 530
 531
 532 /* import public key (from blob in memory)
 533 Return: NULL for success, or an error string */
 534
 535 const uschar *
 536 exim_dkim_verify_init(blob * pubkey, keyformat fmt, ev_ctx * verify_ctx)
 537 {
 538 /*
 539 in code sequence per b81207d2bfa92 rsa_parse_public_key() and asn1_get_mpi()
 540 */
 541 uschar tag_class;
 542 int taglen;
 543 long alen;
 544 int rc;
 545 uschar * errstr;
 546 gcry_error_t gerr;
 547 uschar * stage = US"S1";
 548
 549 if (fmt != KEYFMT_DER) return US"pubkey format not handled";
 550
 551 /*
 552 sequence
 553  sequence
 554   OBJECT:rsaEncryption
 555   NULL
 556  BIT STRING:RSAPublicKey
 557   sequence
 558    INTEGER:Public modulus
 559    INTEGER:Public exponent
 560
 561 openssl rsa -in aux-fixed/dkim/dkim.private -pubout -outform DER | od -t x1 | head;
 562 openssl rsa -in aux-fixed/dkim/dkim.private -pubout | openssl asn1parse -dump;
 563 openssl rsa -in aux-fixed/dkim/dkim.private -pubout | openssl asn1parse -dump -offset 22;
 564 */
 565
 566 /* sequence; just move past the header */
 567 if ((rc = as_tag(pubkey, ASN1_CLASS_STRUCTURED, ASN1_TAG_SEQUENCE, NULL))
 568    != ASN1_SUCCESS) goto asn_err;
 569
 570 /* sequence; skip the entire thing */
 571 DEBUG(D_acl) stage = US"S2";
 572 if ((rc = as_tag(pubkey, ASN1_CLASS_STRUCTURED, ASN1_TAG_SEQUENCE, &alen))
 573    != ASN1_SUCCESS) goto asn_err;
 574 pubkey->data += alen; pubkey->len -= alen;
 575
 576
 577 /* bitstring: limit range to size of bitstring;
 578 move over header + content wrapper */
 579 DEBUG(D_acl) stage = US"BS";
 580 if ((rc = as_tag(pubkey, 0, ASN1_TAG_BIT_STRING, &alen)) != ASN1_SUCCESS)
 581   goto asn_err;
 582 pubkey->len = alen;
 583 pubkey->data++; pubkey->len--;
 584
 585 /* sequence; just move past the header */
 586 DEBUG(D_acl) stage = US"S3";
 587 if ((rc = as_tag(pubkey, ASN1_CLASS_STRUCTURED, ASN1_TAG_SEQUENCE, NULL))
 588    != ASN1_SUCCESS) goto asn_err;
 589
 590 /* read two integers */
 591 DEBUG(D_acl) stage = US"MPI";
 592 if (  (errstr = as_mpi(pubkey, &verify_ctx->n))
 593    || (errstr = as_mpi(pubkey, &verify_ctx->e))
 594    )
 595   return errstr;
 596
 597 #ifdef extreme_debug
 598 DEBUG(D_acl) debug_printf_indent("rsa_verify_init:\n");
 599         {
 600         uschar * s;
 601         gcry_mpi_aprint (GCRYMPI_FMT_HEX, &s, NULL, verify_ctx->n);
 602         debug_printf_indent(" N : %s\n", s);
 603         gcry_mpi_aprint (GCRYMPI_FMT_HEX, &s, NULL, verify_ctx->e);
 604         debug_printf_indent(" E : %s\n", s);
 605         }
 606
 607 #endif
 608 return NULL;
 609
 610 asn_err:
 611 DEBUG(D_acl) return string_sprintf("%s: %s", stage, asn1_strerror(rc));
 612              return US asn1_strerror(rc);
 613 }
 614
 615
 616 /* verify signature (of hash)
 617 XXX though we appear to be doing a hash, too!
 618 (given pubkey & alleged sig)
 619 Return: NULL for success, or an error string */
 620
 621 const uschar *
 622 exim_dkim_verify(ev_ctx * verify_ctx, hashmethod hash, blob * data_hash, blob * sig)
 623 {
 624 /*
 625 cf. libgnutls 2.8.5 _wrap_gcry_pk_verify()
 626 */
 627 char * sexp_hash;
 628 gcry_mpi_t m_sig;
 629 gcry_sexp_t s_sig = NULL, s_hash = NULL, s_pkey = NULL;
 630 gcry_error_t gerr;
 631 uschar * stage;
 632
 633 /*XXX needs extension for SHA512 */
 634 switch (hash)
 635   {
 636   case HASH_SHA1:     sexp_hash = "(data(flags pkcs1)(hash sha1 %b))"; break;
 637   case HASH_SHA2_256: sexp_hash = "(data(flags pkcs1)(hash sha256 %b))"; break;
 638   default:            return US"nonhandled hash type";
 639   }
 640
 641 if (  (stage = US"pkey sexp build",
 642        gerr = gcry_sexp_build (&s_pkey, NULL, "(public-key(rsa(n%m)(e%m)))",
 643                         verify_ctx->n, verify_ctx->e))
 644    || (stage = US"data sexp build",
 645        gerr = gcry_sexp_build (&s_hash, NULL, sexp_hash,
 646                 (int) data_hash->len, CS data_hash->data))
 647    || (stage = US"sig mpi scan",
 648        gerr = gcry_mpi_scan(&m_sig, GCRYMPI_FMT_USG, sig->data, sig->len, NULL))
 649    || (stage = US"sig sexp build",
 650        gerr = gcry_sexp_build (&s_sig, NULL, "(sig-val(rsa(s%m)))", m_sig))
 651    || (stage = US"verify",
 652        gerr = gcry_pk_verify (s_sig, s_hash, s_pkey))
 653    )
 654   {
 655   DEBUG(D_acl) debug_printf_indent("verify: error in stage '%s'\n", stage);
 656   return US gcry_strerror(gerr);
 657   }
 658
 659 if (s_sig) gcry_sexp_release (s_sig);
 660 if (s_hash) gcry_sexp_release (s_hash);
 661 if (s_pkey) gcry_sexp_release (s_pkey);
 662 gcry_mpi_release (m_sig);
 663 gcry_mpi_release (verify_ctx->n);
 664 gcry_mpi_release (verify_ctx->e);
 665
 666 return NULL;
 667 }
 668
 669
 670
 671
 672 #elif defined(SIGN_OPENSSL)
 673 /******************************************************************************/
 674
 675 void
 676 exim_dkim_init(void)
 677 {
 678 ERR_load_crypto_strings();
 679 }
 680
 681
 682 /* accumulate data (was gnutls-onl but now needed for OpenSSL non-EC too
 683 because now using hash-and-sign interface) */
 684 gstring *
 685 exim_dkim_data_append(gstring * g, uschar * s)
 686 {
 687 return string_cat(g, s);
 688 }
 689
 690
 691 /* import private key from PEM string in memory.
 692 Return: NULL for success, or an error string */
 693
 694 const uschar *
 695 exim_dkim_signing_init(uschar * privkey_pem, es_ctx * sign_ctx)
 696 {
 697 BIO * bp = BIO_new_mem_buf(privkey_pem, -1);
 698
 699 if (!(sign_ctx->key = PEM_read_bio_PrivateKey(bp, NULL, NULL, NULL)))
 700   return US ERR_error_string(ERR_get_error(), NULL);
 701
 702 sign_ctx->keytype =
 703 #ifdef SIGN_HAVE_ED25519
 704         EVP_PKEY_type(EVP_PKEY_id(sign_ctx->key)) == EVP_PKEY_EC
 705           ? KEYTYPE_ED25519 : KEYTYPE_RSA;
 706 #else
 707         KEYTYPE_RSA;
 708 #endif
 709 return NULL;
 710 }
 711
 712
 713
 714 /* allocate mem for signature (when signing) */
 715 /* hash & sign data.  Could be incremental
 716
 717 Return: NULL for success with the signaature in the sig blob, or an error string */
 718
 719 const uschar *
 720 exim_dkim_sign(es_ctx * sign_ctx, hashmethod hash, blob * data, blob * sig)
 721 {
 722 const EVP_MD * md;
 723 EVP_MD_CTX * ctx;
 724 size_t siglen;
 725
 726 switch (hash)
 727   {
 728   case HASH_SHA1:       md = EVP_sha1();   break;
 729   case HASH_SHA2_256:   md = EVP_sha256(); break;
 730   case HASH_SHA2_512:   md = EVP_sha512(); break;
 731   default:              return US"nonhandled hash type";
 732   }
 733
 734 /* Create the Message Digest Context */
 735 /*XXX renamed to EVP_MD_CTX_new() in 1.1.0 */
 736 if(  (ctx = EVP_MD_CTX_create())
 737
 738 /* Initialise the DigestSign operation */
 739   && EVP_DigestSignInit(ctx, NULL, md, NULL, sign_ctx->key) > 0
 740
 741  /* Call update with the message */
 742    && EVP_DigestSignUpdate(ctx, data->data, data->len) > 0
 743
 744  /* Finalise the DigestSign operation */
 745  /* First call EVP_DigestSignFinal with a NULL sig parameter to obtain the length of the
 746   * signature. Length is returned in slen */
 747    && EVP_DigestSignFinal(ctx, NULL, &siglen) > 0
 748
 749  /* Allocate memory for the signature based on size in slen */
 750    && (sig->data = store_get(siglen))
 751
 752  /* Obtain the signature (slen could change here!) */
 753    && EVP_DigestSignFinal(ctx, sig->data, &siglen) > 0
 754    )
 755   {
 756   EVP_MD_CTX_destroy(ctx);
 757   sig->len = siglen;
 758   return NULL;
 759   }
 760
 761 if (ctx) EVP_MD_CTX_destroy(ctx);
 762 return US ERR_error_string(ERR_get_error(), NULL);
 763 }
 764
 765
 766
 767 /* import public key (from blob in memory)
 768 Return: NULL for success, or an error string */
 769
 770 const uschar *
 771 exim_dkim_verify_init(blob * pubkey, keyformat fmt, ev_ctx * verify_ctx)
 772 {
 773 const uschar * s = pubkey->data;
 774 uschar * ret = NULL;
 775
 776 if (fmt != KEYFMT_DER) return US"pubkey format not handled";
 777 switch(fmt)
 778   {
 779   case KEYFMT_DER:
 780     /*XXX ok, this fails for EC:
 781     error:0609E09C:digital envelope routines:pkey_set_type:unsupported algorithm
 782     */
 783
 784     /*XXX hmm, we never free this */
 785     if (!(verify_ctx->key = d2i_PUBKEY(NULL, &s, pubkey->len)))
 786       ret = US ERR_error_string(ERR_get_error(), NULL);
 787     break;
 788 #ifdef SIGN_HAVE_ED25519
 789   case KEYFMT_ED25519_BARE:
 790     {
 791     BIGNUM * x;
 792     EC_KEY * eck;
 793     if (  !(x = BN_bin2bn(s, pubkey->len, NULL))
 794        || !(eck = EC_KEY_new_by_curve_name(NID_ED25519))
 795        || !EC_KEY_set_public_key_affine_coordinates(eck, x, NULL)
 796        || !(verify_ctx->key = EVP_PKEY_new())
 797        || !EVP_PKEY_assign_EC_KEY(verify_ctx->key, eck)
 798        )
 799       ret = US ERR_error_string(ERR_get_error(), NULL);
 800     }
 801     break;
 802 #endif
 803   default:
 804     ret = US"pubkey format not handled";
 805     break;
 806   }
 807
 808 return ret;
 809 }
 810
 811
 812
 813
 814 /* verify signature (of hash)
 815 (pre-EC coding; of data if "notyet" code, The latter could be incremental)
 816 (given pubkey & alleged sig)
 817 Return: NULL for success, or an error string */
 818
 819 const uschar *
 820 exim_dkim_verify(ev_ctx * verify_ctx, hashmethod hash, blob * data, blob * sig)
 821 {
 822 const EVP_MD * md;
 823
 824 /*XXX OpenSSL does not seem to have Ed25519 support yet. Reportedly BoringSSL does,
 825 but that's a nonstable API and not recommended (by its owner, Google) for external use. */
 826
 827 switch (hash)
 828   {
 829   case HASH_SHA1:       md = EVP_sha1();   break;
 830   case HASH_SHA2_256:   md = EVP_sha256(); break;
 831   case HASH_SHA2_512:   md = EVP_sha512(); break;
 832   default:              return US"nonhandled hash type";
 833   }
 834
 835 #ifdef notyet_SIGN_HAVE_ED25519
 836   {
 837   EVP_MD_CTX * ctx;
 838
 839   /*XXX renamed to EVP_MD_CTX_new() in 1.1.0 */
 840   if (
 841         (ctx = EVP_MD_CTX_create())
 842
 843   /* Initialize `key` with a public key */
 844      && EVP_DigestVerifyInit(ctx, NULL, md, NULL, verify_ctx->key) > 0
 845
 846   /* add data to be hashed (call multiple times if needed) */
 847
 848      && EVP_DigestVerifyUpdate(ctx, data->data, data->len) > 0
 849
 850   /* finish off the hash and check the offered signature */
 851
 852      && EVP_DigestVerifyFinal(ctx, sig->data, sig->len) > 0
 853      )
 854     {
 855     EVP_MD_CTX_destroy(ctx);    /* renamed to _free in 1.1.0 */
 856     return NULL;
 857     }
 858
 859   if (ctx) EVP_MD_CTX_free(ctx);
 860   return US ERR_error_string(ERR_get_error(), NULL);
 861   }
 862 #else
 863   {
 864   EVP_PKEY_CTX * ctx;
 865
 866   if (  (ctx = EVP_PKEY_CTX_new(verify_ctx->key, NULL))
 867      && EVP_PKEY_verify_init(ctx) > 0
 868      && EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) > 0
 869      && EVP_PKEY_CTX_set_signature_md(ctx, md) > 0
 870      && EVP_PKEY_verify(ctx, sig->data, sig->len,
 871           data->data, data->len) == 1
 872      )
 873     { EVP_PKEY_CTX_free(ctx); return NULL; }
 874
 875   if (ctx) EVP_PKEY_CTX_free(ctx);
 876   return US ERR_error_string(ERR_get_error(), NULL);
 877   }
 878 #endif
 879 }
 880
 881
 882
 883 #endif
 884 /******************************************************************************/
 885
 886 #endif  /*DISABLE_DKIM*/
 887 /* End of File */