src/src/pdkim/signing.c

   1 /*
   2  *  PDKIM - a RFC4871 (DKIM) implementation
   3  *
   4  *  Copyright (C) 2016  Exim maintainers
   5  *
   6  *  RSA signing/verification interface
   7 XXX rename interfaces to cover all signature methods.
   8 the method (algo) needs to be extracted from the supplied private-key
   9 and not only stashed as needed in the sign- or verify- context, but
  10 indicated to caller for protocol tag construction.
  11  */
  12
  13 #include "../exim.h"
  14
  15 #ifndef DISABLE_DKIM    /* entire file */
  16
  17 #ifndef SUPPORT_TLS
  18 # error Need SUPPORT_TLS for DKIM
  19 #endif
  20
  21 #include "crypt_ver.h"
  22 #include "signing.h"
  23
  24
  25 /******************************************************************************/
  26 #ifdef RSA_GNUTLS
  27
  28 void
  29 exim_dkim_init(void)
  30 {
  31 }
  32
  33
  34 /* accumulate data (gnutls-only).  String to be appended must be nul-terminated. */
  35 blob *
  36 exim_dkim_data_append(blob * b, int * alloc, uschar * s)
  37 {
  38 int len = b->len;
  39 b->data = string_append(b->data, alloc, &len, 1, s);
  40 b->len = len;
  41 return b;
  42 }
  43
  44
  45
  46 /* import private key from PEM string in memory.
  47 Return: NULL for success, or an error string */
  48
  49 const uschar *
  50 exim_dkim_signing_init(uschar * privkey_pem, es_ctx * sign_ctx)
  51 {
  52 gnutls_datum_t k;
  53 int rc;
  54
  55 k.data = privkey_pem;
  56 k.size = strlen(privkey_pem);
  57
  58 if (  (rc = gnutls_x509_privkey_init(&sign_ctx->rsa)) != GNUTLS_E_SUCCESS
  59    || (rc = gnutls_x509_privkey_import(sign_ctx->rsa, &k,
  60           GNUTLS_X509_FMT_PEM)) != GNUTLS_E_SUCCESS
  61    )
  62   return gnutls_strerror(rc);
  63
  64 return NULL;
  65 }
  66
  67
  68
  69 /* allocate mem for signature (when signing) */
  70 /* sign data (gnutls_only)
  71 OR
  72 sign hash.
  73
  74 Return: NULL for success, or an error string */
  75
  76 const uschar *
  77 exim_dkim_sign(es_ctx * sign_ctx, BOOL is_sha1, blob * data, blob * sig)
  78 {
  79 gnutls_datum_t k;
  80 size_t sigsize = 0;
  81 int rc;
  82 const uschar * ret = NULL;
  83
  84 /* Allocate mem for signature */
  85 k.data = data->data;
  86 k.size = data->len;
  87 (void) gnutls_x509_privkey_sign_data(sign_ctx->rsa,
  88   is_sha1 ? GNUTLS_DIG_SHA1 : GNUTLS_DIG_SHA256,
  89   0, &k, NULL, &sigsize);
  90
  91 sig->data = store_get(sigsize);
  92 sig->len = sigsize;
  93
  94 /* Do signing */
  95 /*XXX will need extension for hash type; looks ok for non-RSA algos
  96 so long as the privkey_import stage got them. */
  97 if ((rc = gnutls_x509_privkey_sign_data(sign_ctx->rsa,
  98             is_sha1 ? GNUTLS_DIG_SHA1 : GNUTLS_DIG_SHA256,
  99             0, &k, sig->data, &sigsize)) != GNUTLS_E_SUCCESS
 100    )
 101   ret = gnutls_strerror(rc);
 102
 103 gnutls_x509_privkey_deinit(sign_ctx->rsa);
 104 return ret;
 105 }
 106
 107
 108
 109 /* import public key (from DER in memory)
 110 Return: NULL for success, or an error string */
 111
 112 const uschar *
 113 exim_dkim_verify_init(blob * pubkey_der, ev_ctx * verify_ctx)
 114 {
 115 gnutls_datum_t k;
 116 int rc;
 117 const uschar * ret = NULL;
 118
 119 gnutls_pubkey_init(&verify_ctx->rsa);
 120
 121 k.data = pubkey_der->data;
 122 k.size = pubkey_der->len;
 123
 124 if ((rc = gnutls_pubkey_import(verify_ctx->rsa, &k, GNUTLS_X509_FMT_DER))
 125        != GNUTLS_E_SUCCESS)
 126   ret = gnutls_strerror(rc);
 127 return ret;
 128 }
 129
 130
 131 /* verify signature (of hash)  (given pubkey & alleged sig)
 132 Return: NULL for success, or an error string */
 133
 134 const uschar *
 135 exim_dkim_verify(ev_ctx * verify_ctx, BOOL is_sha1, blob * data_hash, blob * sig)
 136 {
 137 gnutls_datum_t k, s;
 138 int rc;
 139 const uschar * ret = NULL;
 140
 141 k.data = data_hash->data;
 142 k.size = data_hash->len;
 143 s.data = sig->data;
 144 s.size = sig->len;
 145 if ((rc = gnutls_pubkey_verify_hash2(verify_ctx->rsa,
 146 /*XXX needs extension for SHA512 */
 147             is_sha1 ? GNUTLS_SIGN_RSA_SHA1 : GNUTLS_SIGN_RSA_SHA256,
 148             0, &k, &s)) < 0)
 149   ret = gnutls_strerror(rc);
 150
 151 gnutls_pubkey_deinit(verify_ctx->rsa);
 152 return ret;
 153 }
 154
 155
 156
 157
 158 #elif defined(RSA_GCRYPT)
 159 /******************************************************************************/
 160
 161
 162 /* Internal service routine:
 163 Read and move past an asn.1 header, checking class & tag,
 164 optionally returning the data-length */
 165
 166 static int
 167 as_tag(blob * der, uschar req_cls, long req_tag, long * alen)
 168 {
 169 int rc;
 170 uschar tag_class;
 171 int taglen;
 172 long tag, len;
 173
 174 /* debug_printf_indent("as_tag: %02x %02x %02x %02x\n",
 175         der->data[0], der->data[1], der->data[2], der->data[3]); */
 176
 177 if ((rc = asn1_get_tag_der(der->data++, der->len--, &tag_class, &taglen, &tag))
 178     != ASN1_SUCCESS)
 179   return rc;
 180
 181 if (tag_class != req_cls || tag != req_tag) return ASN1_ELEMENT_NOT_FOUND;
 182
 183 if ((len = asn1_get_length_der(der->data, der->len, &taglen)) < 0)
 184   return ASN1_DER_ERROR;
 185 if (alen) *alen = len;
 186
 187 /* debug_printf_indent("as_tag:  tlen %d dlen %d\n", taglen, (int)len); */
 188
 189 der->data += taglen;
 190 der->len -= taglen;
 191 return rc;
 192 }
 193
 194 /* Internal service routine:
 195 Read and move over an asn.1 integer, setting an MPI to the value
 196 */
 197
 198 static uschar *
 199 as_mpi(blob * der, gcry_mpi_t * mpi)
 200 {
 201 long alen;
 202 int rc;
 203 gcry_error_t gerr;
 204
 205 /* integer; move past the header */
 206 if ((rc = as_tag(der, 0, ASN1_TAG_INTEGER, &alen)) != ASN1_SUCCESS)
 207   return US asn1_strerror(rc);
 208
 209 /* read to an MPI */
 210 if ((gerr = gcry_mpi_scan(mpi, GCRYMPI_FMT_STD, der->data, alen, NULL)))
 211   return US gcry_strerror(gerr);
 212
 213 /* move over the data */
 214 der->data += alen; der->len -= alen;
 215 return NULL;
 216 }
 217
 218
 219
 220 void
 221 exim_dkim_init(void)
 222 {
 223 /* Version check should be the very first call because it
 224 makes sure that important subsystems are initialized. */
 225 if (!gcry_check_version (GCRYPT_VERSION))
 226   {
 227   fputs ("libgcrypt version mismatch\n", stderr);
 228   exit (2);
 229   }
 230
 231 /* We don't want to see any warnings, e.g. because we have not yet
 232 parsed program options which might be used to suppress such
 233 warnings. */
 234 gcry_control (GCRYCTL_SUSPEND_SECMEM_WARN);
 235
 236 /* ... If required, other initialization goes here.  Note that the
 237 process might still be running with increased privileges and that
 238 the secure memory has not been initialized.  */
 239
 240 /* Allocate a pool of 16k secure memory.  This make the secure memory
 241 available and also drops privileges where needed.  */
 242 gcry_control (GCRYCTL_INIT_SECMEM, 16384, 0);
 243
 244 /* It is now okay to let Libgcrypt complain when there was/is
 245 a problem with the secure memory. */
 246 gcry_control (GCRYCTL_RESUME_SECMEM_WARN);
 247
 248 /* ... If required, other initialization goes here.  */
 249
 250 /* Tell Libgcrypt that initialization has completed. */
 251 gcry_control (GCRYCTL_INITIALIZATION_FINISHED, 0);
 252
 253 return;
 254 }
 255
 256
 257
 258
 259 /* Accumulate data (gnutls-only).
 260 String to be appended must be nul-terminated. */
 261
 262 blob *
 263 exim_dkim_data_append(blob * b, int * alloc, uschar * s)
 264 {
 265 return b;       /*dummy*/
 266 }
 267
 268
 269
 270 /* import private key from PEM string in memory.
 271 Return: NULL for success, or an error string */
 272
 273 const uschar *
 274 exim_dkim_signing_init(uschar * privkey_pem, es_ctx * sign_ctx)
 275 {
 276 uschar * s1, * s2;
 277 blob der;
 278 long alen;
 279 int rc;
 280
 281 /*XXX will need extension to _spot_ as well as handle a
 282 non-RSA key?  I think... */
 283
 284 /*
 285  *  RSAPrivateKey ::= SEQUENCE
 286  *      version           Version,
 287  *      modulus           INTEGER,  -- n
 288  *      publicExponent    INTEGER,  -- e
 289  *      privateExponent   INTEGER,  -- d
 290  *      prime1            INTEGER,  -- p
 291  *      prime2            INTEGER,  -- q
 292  *      exponent1         INTEGER,  -- d mod (p-1)
 293  *      exponent2         INTEGER,  -- d mod (q-1)
 294  *      coefficient       INTEGER,  -- (inverse of q) mod p
 295  *      otherPrimeInfos   OtherPrimeInfos OPTIONAL
 296  */
 297
 298 if (  !(s1 = Ustrstr(CS privkey_pem, "-----BEGIN RSA PRIVATE KEY-----"))
 299    || !(s2 = Ustrstr(CS (s1+=31),    "-----END RSA PRIVATE KEY-----" ))
 300    )
 301   return US"Bad PEM wrapper";
 302
 303 *s2 = '\0';
 304
 305 if ((der.len = b64decode(s1, &der.data)) < 0)
 306   return US"Bad PEM-DER b64 decode";
 307
 308 /* untangle asn.1 */
 309
 310 /* sequence; just move past the header */
 311 if ((rc = as_tag(&der, ASN1_CLASS_STRUCTURED, ASN1_TAG_SEQUENCE, NULL))
 312    != ASN1_SUCCESS) goto asn_err;
 313
 314 /* integer version; move past the header, check is zero */
 315 if ((rc = as_tag(&der, 0, ASN1_TAG_INTEGER, &alen)) != ASN1_SUCCESS)
 316   goto asn_err;
 317 if (alen != 1 || *der.data != 0)
 318   return US"Bad version number";
 319 der.data++; der.len--;
 320
 321 if (  (s1 = as_mpi(&der, &sign_ctx->n))
 322    || (s1 = as_mpi(&der, &sign_ctx->e))
 323    || (s1 = as_mpi(&der, &sign_ctx->d))
 324    || (s1 = as_mpi(&der, &sign_ctx->p))
 325    || (s1 = as_mpi(&der, &sign_ctx->q))
 326    || (s1 = as_mpi(&der, &sign_ctx->dp))
 327    || (s1 = as_mpi(&der, &sign_ctx->dq))
 328    || (s1 = as_mpi(&der, &sign_ctx->qp))
 329    )
 330   return s1;
 331
 332 DEBUG(D_acl) debug_printf_indent("rsa_signing_init:\n");
 333   {
 334   uschar * s;
 335   gcry_mpi_aprint (GCRYMPI_FMT_HEX, &s, NULL, sign_ctx->n);
 336   debug_printf_indent(" N : %s\n", s);
 337   gcry_mpi_aprint (GCRYMPI_FMT_HEX, &s, NULL, sign_ctx->e);
 338   debug_printf_indent(" E : %s\n", s);
 339   gcry_mpi_aprint (GCRYMPI_FMT_HEX, &s, NULL, sign_ctx->d);
 340   debug_printf_indent(" D : %s\n", s);
 341   gcry_mpi_aprint (GCRYMPI_FMT_HEX, &s, NULL, sign_ctx->p);
 342   debug_printf_indent(" P : %s\n", s);
 343   gcry_mpi_aprint (GCRYMPI_FMT_HEX, &s, NULL, sign_ctx->q);
 344   debug_printf_indent(" Q : %s\n", s);
 345   gcry_mpi_aprint (GCRYMPI_FMT_HEX, &s, NULL, sign_ctx->dp);
 346   debug_printf_indent(" DP: %s\n", s);
 347   gcry_mpi_aprint (GCRYMPI_FMT_HEX, &s, NULL, sign_ctx->dq);
 348   debug_printf_indent(" DQ: %s\n", s);
 349   gcry_mpi_aprint (GCRYMPI_FMT_HEX, &s, NULL, sign_ctx->qp);
 350   debug_printf_indent(" QP: %s\n", s);
 351   }
 352 return NULL;
 353
 354 asn_err: return US asn1_strerror(rc);
 355 }
 356
 357
 358
 359 /* allocate mem for signature (when signing) */
 360 /* sign data (gnutls_only)
 361 OR
 362 sign hash.
 363
 364 Return: NULL for success, or an error string */
 365
 366 const uschar *
 367 exim_dkim_sign(es_ctx * sign_ctx, BOOL is_sha1, blob * data, blob * sig)
 368 {
 369 gcry_sexp_t s_hash = NULL, s_key = NULL, s_sig = NULL;
 370 gcry_mpi_t m_sig;
 371 uschar * errstr;
 372 gcry_error_t gerr;
 373
 374 /*XXX will need extension for hash types (though, possibly, should
 375 be re-specced to not rehash but take an already-hashed value? Actually
 376 current impl looks WRONG - it _is_ given a has so should not be
 377 re-hashing.  Has this been tested?
 378
 379 Will need extension for non-RSA sugning algos. */
 380
 381 #define SIGSPACE 128
 382 sig->data = store_get(SIGSPACE);
 383
 384 if (gcry_mpi_cmp (sign_ctx->p, sign_ctx->q) > 0)
 385   {
 386   gcry_mpi_swap (sign_ctx->p, sign_ctx->q);
 387   gcry_mpi_invm (sign_ctx->qp, sign_ctx->p, sign_ctx->q);
 388   }
 389
 390 if (  (gerr = gcry_sexp_build (&s_key, NULL,
 391                 "(private-key (rsa (n%m)(e%m)(d%m)(p%m)(q%m)(u%m)))",
 392                 sign_ctx->n, sign_ctx->e,
 393                 sign_ctx->d, sign_ctx->p,
 394                 sign_ctx->q, sign_ctx->qp))
 395    || (gerr = gcry_sexp_build (&s_hash, NULL,
 396                 is_sha1
 397                 ? "(data(flags pkcs1)(hash sha1 %b))"
 398                 : "(data(flags pkcs1)(hash sha256 %b))",
 399                 (int) data->len, CS data->data))
 400    ||  (gerr = gcry_pk_sign (&s_sig, s_hash, s_key))
 401    )
 402   return US gcry_strerror(gerr);
 403
 404 /* gcry_sexp_dump(s_sig); */
 405
 406 if (  !(s_sig = gcry_sexp_find_token(s_sig, "s", 0))
 407    )
 408   return US"no sig result";
 409
 410 m_sig = gcry_sexp_nth_mpi(s_sig, 1, GCRYMPI_FMT_USG);
 411
 412 DEBUG(D_acl)
 413   {
 414   uschar * s;
 415   gcry_mpi_aprint (GCRYMPI_FMT_HEX, &s, NULL, m_sig);
 416   debug_printf_indent(" SG: %s\n", s);
 417   }
 418
 419 gerr = gcry_mpi_print(GCRYMPI_FMT_USG, sig->data, SIGSPACE, &sig->len, m_sig);
 420 if (gerr)
 421   {
 422   debug_printf_indent("signature conversion from MPI to buffer failed\n");
 423   return US gcry_strerror(gerr);
 424   }
 425 #undef SIGSPACE
 426
 427 return NULL;
 428 }
 429
 430
 431 /* import public key (from DER in memory)
 432 Return: NULL for success, or an error string */
 433
 434 const uschar *
 435 exim_dkim_verify_init(blob * pubkey_der, ev_ctx * verify_ctx)
 436 {
 437 /*
 438 in code sequence per b81207d2bfa92 rsa_parse_public_key() and asn1_get_mpi()
 439 */
 440 uschar tag_class;
 441 int taglen;
 442 long alen;
 443 int rc;
 444 uschar * errstr;
 445 gcry_error_t gerr;
 446 uschar * stage = US"S1";
 447
 448 /*
 449 sequence
 450  sequence
 451   OBJECT:rsaEncryption
 452   NULL
 453  BIT STRING:RSAPublicKey
 454   sequence
 455    INTEGER:Public modulus
 456    INTEGER:Public exponent
 457
 458 openssl rsa -in aux-fixed/dkim/dkim.private -pubout -outform DER | od -t x1 | head;
 459 openssl rsa -in aux-fixed/dkim/dkim.private -pubout | openssl asn1parse -dump;
 460 openssl rsa -in aux-fixed/dkim/dkim.private -pubout | openssl asn1parse -dump -offset 22;
 461 */
 462
 463 /* sequence; just move past the header */
 464 if ((rc = as_tag(pubkey_der, ASN1_CLASS_STRUCTURED, ASN1_TAG_SEQUENCE, NULL))
 465    != ASN1_SUCCESS) goto asn_err;
 466
 467 /* sequence; skip the entire thing */
 468 DEBUG(D_acl) stage = US"S2";
 469 if ((rc = as_tag(pubkey_der, ASN1_CLASS_STRUCTURED, ASN1_TAG_SEQUENCE, &alen))
 470    != ASN1_SUCCESS) goto asn_err;
 471 pubkey_der->data += alen; pubkey_der->len -= alen;
 472
 473
 474 /* bitstring: limit range to size of bitstring;
 475 move over header + content wrapper */
 476 DEBUG(D_acl) stage = US"BS";
 477 if ((rc = as_tag(pubkey_der, 0, ASN1_TAG_BIT_STRING, &alen)) != ASN1_SUCCESS)
 478   goto asn_err;
 479 pubkey_der->len = alen;
 480 pubkey_der->data++; pubkey_der->len--;
 481
 482 /* sequence; just move past the header */
 483 DEBUG(D_acl) stage = US"S3";
 484 if ((rc = as_tag(pubkey_der, ASN1_CLASS_STRUCTURED, ASN1_TAG_SEQUENCE, NULL))
 485    != ASN1_SUCCESS) goto asn_err;
 486
 487 /* read two integers */
 488 DEBUG(D_acl) stage = US"MPI";
 489 if (  (errstr = as_mpi(pubkey_der, &verify_ctx->n))
 490    || (errstr = as_mpi(pubkey_der, &verify_ctx->e))
 491    )
 492   return errstr;
 493
 494 DEBUG(D_acl) debug_printf_indent("rsa_verify_init:\n");
 495         {
 496         uschar * s;
 497         gcry_mpi_aprint (GCRYMPI_FMT_HEX, &s, NULL, verify_ctx->n);
 498         debug_printf_indent(" N : %s\n", s);
 499         gcry_mpi_aprint (GCRYMPI_FMT_HEX, &s, NULL, verify_ctx->e);
 500         debug_printf_indent(" E : %s\n", s);
 501         }
 502
 503 return NULL;
 504
 505 asn_err:
 506 DEBUG(D_acl) return string_sprintf("%s: %s", stage, asn1_strerror(rc));
 507              return US asn1_strerror(rc);
 508 }
 509
 510
 511 /* verify signature (of hash)  (given pubkey & alleged sig)
 512 Return: NULL for success, or an error string */
 513
 514 const uschar *
 515 exim_dkim_verify(ev_ctx * verify_ctx, BOOL is_sha1, blob * data_hash, blob * sig)
 516 {
 517 /*
 518 cf. libgnutls 2.8.5 _wrap_gcry_pk_verify()
 519 */
 520 gcry_mpi_t m_sig;
 521 gcry_sexp_t s_sig = NULL, s_hash = NULL, s_pkey = NULL;
 522 gcry_error_t gerr;
 523 uschar * stage;
 524
 525 if (  (stage = US"pkey sexp build",
 526        gerr = gcry_sexp_build (&s_pkey, NULL, "(public-key(rsa(n%m)(e%m)))",
 527                         verify_ctx->n, verify_ctx->e))
 528    || (stage = US"data sexp build",
 529        gerr = gcry_sexp_build (&s_hash, NULL,
 530 /*XXX needs extension for SHA512 */
 531                 is_sha1
 532                 ? "(data(flags pkcs1)(hash sha1 %b))"
 533                 : "(data(flags pkcs1)(hash sha256 %b))",
 534                 (int) data_hash->len, CS data_hash->data))
 535    || (stage = US"sig mpi scan",
 536        gerr = gcry_mpi_scan(&m_sig, GCRYMPI_FMT_USG, sig->data, sig->len, NULL))
 537    || (stage = US"sig sexp build",
 538        gerr = gcry_sexp_build (&s_sig, NULL, "(sig-val(rsa(s%m)))", m_sig))
 539    || (stage = US"verify",
 540        gerr = gcry_pk_verify (s_sig, s_hash, s_pkey))
 541    )
 542   {
 543   DEBUG(D_acl) debug_printf_indent("verify: error in stage '%s'\n", stage);
 544   return US gcry_strerror(gerr);
 545   }
 546
 547 if (s_sig) gcry_sexp_release (s_sig);
 548 if (s_hash) gcry_sexp_release (s_hash);
 549 if (s_pkey) gcry_sexp_release (s_pkey);
 550 gcry_mpi_release (m_sig);
 551 gcry_mpi_release (verify_ctx->n);
 552 gcry_mpi_release (verify_ctx->e);
 553
 554 return NULL;
 555 }
 556
 557
 558
 559
 560 #elif defined(RSA_OPENSSL)
 561 /******************************************************************************/
 562
 563 void
 564 exim_dkim_init(void)
 565 {
 566 }
 567
 568
 569 /* accumulate data (gnutls-only) */
 570 blob *
 571 exim_dkim_data_append(blob * b, int * alloc, uschar * s)
 572 {
 573 return b;       /*dummy*/
 574 }
 575
 576
 577 /* import private key from PEM string in memory.
 578 Return: NULL for success, or an error string */
 579
 580 const uschar *
 581 exim_dkim_signing_init(uschar * privkey_pem, es_ctx * sign_ctx)
 582 {
 583 uschar * p, * q;
 584 int len;
 585
 586 /*XXX maybe use PEM_read_bio_PrivateKey() ???
 587 The sign_ctx would need to have an EVP_PKEY* */
 588
 589 /* Convert PEM to DER */
 590 if (  !(p = Ustrstr(privkey_pem, "-----BEGIN RSA PRIVATE KEY-----"))
 591    || !(q = Ustrstr(p+=31,       "-----END RSA PRIVATE KEY-----"))
 592    )
 593   return US"Bad PEM wrapping";
 594
 595 *q = '\0';
 596 if ((len = b64decode(p, &p)) < 0)
 597   return US"b64decode failed";
 598
 599 if (!(sign_ctx->rsa = d2i_RSAPrivateKey(NULL, CUSS &p, len)))
 600   {
 601   char ssl_errstring[256];
 602   ERR_load_crypto_strings();    /*XXX move to a startup routine */
 603   ERR_error_string(ERR_get_error(), ssl_errstring);
 604   return string_copy(US ssl_errstring);
 605   }
 606
 607 return NULL;
 608 }
 609
 610
 611
 612 /* allocate mem for signature (when signing) */
 613 /* sign data (gnutls_only)
 614 OR
 615 sign hash.
 616
 617 Return: NULL for success, or an error string */
 618
 619 const uschar *
 620 exim_dkim_sign(es_ctx * sign_ctx, BOOL is_sha1, blob * data, blob * sig)
 621 {
 622 uint len;
 623 const uschar * ret = NULL;
 624
 625 /*XXX will need extension for non-RSA signing algo.  Maybe use
 626 https://www.openssl.org/docs/man1.0.2/crypto/EVP_PKEY_sign.html  ???  */
 627
 628 /* Allocate mem for signature */
 629 len = RSA_size(sign_ctx->rsa);
 630 sig->data = store_get(len);
 631 sig->len = len;
 632
 633 /* Do signing */
 634 if (RSA_sign(is_sha1 ? NID_sha1 : NID_sha256,
 635       CUS data->data, data->len,
 636       US sig->data, &len, sign_ctx->rsa) != 1)
 637   {
 638   char ssl_errstring[256];
 639   ERR_load_crypto_strings();    /*XXX move to a startup routine */
 640   ERR_error_string(ERR_get_error(), ssl_errstring);
 641   ret = string_copy(US ssl_errstring);
 642   }
 643
 644 RSA_free(sign_ctx->rsa);
 645 return ret;;
 646 }
 647
 648
 649
 650 /* import public key (from DER in memory)
 651 Return: NULL for success, or an error string */
 652
 653 const uschar *
 654 exim_dkim_verify_init(blob * pubkey_der, ev_ctx * verify_ctx)
 655 {
 656 const uschar * p = CUS pubkey_der->data;
 657 const uschar * ret = NULL;
 658
 659 /*XXX d2i_X509_PUBKEY, X509_get_pubkey(), and an EVP_PKEY* in verify_ctx. */
 660
 661 if (!(verify_ctx->rsa = d2i_RSA_PUBKEY(NULL, &p, (long) pubkey_der->len)))
 662   {
 663   char ssl_errstring[256];
 664   ERR_load_crypto_strings();    /*XXX move to a startup routine */
 665   ERR_error_string(ERR_get_error(), ssl_errstring);
 666   ret = string_copy(CUS ssl_errstring);
 667   }
 668 return ret;
 669 }
 670
 671
 672
 673
 674 /* verify signature (of hash)  (given pubkey & alleged sig)
 675 Return: NULL for success, or an error string */
 676
 677 const uschar *
 678 exim_dkim_verify(ev_ctx * verify_ctx, BOOL is_sha1, blob * data_hash, blob * sig)
 679 {
 680 const uschar * ret = NULL;
 681
 682 /*XXX needs extension for SHA512, Possibly EVP_PKEY_verify() is all we need???  */
 683 /* with EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING)
 684 - see example code at https://www.openssl.org/docs/man1.0.2/crypto/EVP_PKEY_verify.html
 685 and maybe also EVP_PKEY_CTX_set_signature_md(ctx, EVP_sha256()) though unclear
 686 if that only sets a pad/type field byte value, or sets up for an actual hash operation...
 687 Same on the signing side.
 688 https://www.openssl.org/docs/manmaster/man3/EVP_PKEY_CTX_set_rsa_padding.html says it does what we want. */
 689
 690 if (RSA_verify(is_sha1 ? NID_sha1 : NID_sha256,
 691       CUS data_hash->data, data_hash->len,
 692       US sig->data, (uint) sig->len, verify_ctx->rsa) != 1)
 693   {
 694   char ssl_errstring[256];
 695   ERR_load_crypto_strings();    /*XXX move to a startup routine */
 696   ERR_error_string(ERR_get_error(), ssl_errstring);
 697   ret = string_copy(US ssl_errstring);
 698   }
 699 return ret;
 700 }
 701
 702
 703 #endif
 704 /******************************************************************************/
 705
 706 #endif  /*DISABLE_DKIM*/
 707 /* End of File */