/*XXX the caller only uses the first record if we return multiple.
-Could we hand back an allocated string?
*/
-static int
-dkim_exim_query_dns_txt(char *name, char *answer)
+static uschar *
+dkim_exim_query_dns_txt(char * name)
{
dns_answer dnsa;
dns_scan dnss;
dns_record *rr;
+gstring * g = NULL;
lookup_dnssec_authenticated = NULL;
if (dns_lookup(&dnsa, US name, T_TXT, NULL) != DNS_SUCCEED)
- return PDKIM_FAIL; /*XXX better error detail? logging? */
+ return NULL; /*XXX better error detail? logging? */
/* Search for TXT record */
if (rr->type == T_TXT)
{
int rr_offset = 0;
- int answer_offset = 0;
/* Copy record content to the answer buffer */
while (rr_offset < rr->size)
{
uschar len = rr->data[rr_offset++];
- snprintf(answer + answer_offset,
- PDKIM_DNS_TXT_MAX_RECLEN - answer_offset,
- "%.*s", (int)len, CS (rr->data + rr_offset));
+
+ g = string_catn(g, US(rr->data + rr_offset), len);
+ if (g->ptr >= PDKIM_DNS_TXT_MAX_RECLEN)
+ goto bad;
+
rr_offset += len;
- answer_offset += len;
- if (answer_offset >= PDKIM_DNS_TXT_MAX_RECLEN)
- return PDKIM_FAIL; /*XXX better error detail? logging? */
}
/* check if this looks like a DKIM record */
- if (strncasecmp(answer, "v=dkim", 6) != 0) continue;
- return PDKIM_OK;
+ if (Ustrncmp(g->s, "v=", 2) != 0 || strncasecmp(CS g->s, "v=dkim", 6) == 0)
+ {
+ store_reset(g->s + g->ptr + 1);
+ return string_from_gstring(g);
+ }
+
+ if (g) g->ptr = 0; /* overwrite previous record */
}
-return PDKIM_FAIL; /*XXX better error detail? logging? */
+bad:
+if (g) store_reset(g);
+return NULL; /*XXX better error detail? logging? */
}
pdkim_signature * sig;
int rc;
gstring * g = NULL;
-const uschar * errstr;
+const uschar * errstr = NULL;
store_pool = POOL_PERM;
/* Finish DKIM operation and fetch link to signatures chain */
rc = pdkim_feed_finish(dkim_verify_ctx, &dkim_signatures, &errstr);
-if (rc != PDKIM_OK)
- {
- log_write(0, LOG_MAIN, "DKIM: validation error: %.100s%s%s", pdkim_errstr(rc),
- errstr ? ": " : "", errstr ? errstr : US"");
- goto out;
- }
+if (rc != PDKIM_OK && errstr)
+ log_write(0, LOG_MAIN, "DKIM: validation error: %s", errstr);
/* Build a colon-separated list of signing domains (and identities, if present) in dkim_signers */
}
-/* Generate signatures for the given file, returning a string.
+/* Generate signatures for the given file.
If a prefix is given, prepend it to the file for the calculations.
+
+Return:
+ NULL: error; error string written
+ string: signature header(s), or a zero-length string (not an error)
*/
gstring *
pdkim_canon,
pdkim_canon, -1, 0, 0);
+ if (!pdkim_set_bodyhash(&ctx, sig))
+ goto bad;
+
if (!ctx.sig) /* link sig to context chain */
ctx.sig = sig;
else
}
}
}
+if (!ctx.sig)
+ {
+ DEBUG(D_transport) debug_printf("DKIM: no viable signatures to use\n");
+ sigbuf = string_get(1); /* return a zero-len string */
+ goto CLEANUP;
+ }
-if (prefix)
- pdkim_feed(&ctx, prefix, Ustrlen(prefix));
+if (prefix && (pdkim_rc = pdkim_feed(&ctx, prefix, Ustrlen(prefix))) != PDKIM_OK)
+ goto pk_bad;
if (lseek(fd, off, SEEK_SET) < 0)
sread = -1;
for (sigbuf = NULL; sig; sig = sig->next)
sigbuf = string_append(sigbuf, 2, US sig->signature_header, US"\r\n");
-(void) string_from_gstring(sigbuf);
-
CLEANUP:
+ (void) string_from_gstring(sigbuf);
store_pool = old_pool;
errno = save_errno;
return sigbuf;