# error Need SUPPORT_TLS for DKIM
#endif
+#include "crypt_ver.h"
-#ifdef USE_GNUTLS
-# include <gnutls/gnutls.h>
-# include <gnutls/x509.h>
-# include <gnutls/abstract.h>
-# include <gnutls/crypto.h>
-#else
+#ifdef RSA_OPENSSL
# include <openssl/rsa.h>
# include <openssl/ssl.h>
# include <openssl/err.h>
+#elif defined(RSA_GNUTLS)
+# include <gnutls/gnutls.h>
+# include <gnutls/x509.h>
#endif
#include "pdkim.h"
+#include "rsa.h"
#define PDKIM_SIGNATURE_VERSION "1"
-#define PDKIM_PUB_RECORD_VERSION "DKIM1"
+#define PDKIM_PUB_RECORD_VERSION US "DKIM1"
#define PDKIM_MAX_HEADER_LEN 65536
#define PDKIM_MAX_HEADERS 512
/* -------------------------------------------------------------------------- */
struct pdkim_stringlist {
- char *value;
- int tag;
- void *next;
-};
-
-#define PDKIM_STR_ALLOC_FRAG 256
-struct pdkim_str {
- char *str;
- unsigned int len;
- unsigned int allocated;
+ uschar * value;
+ int tag;
+ void * next;
};
/* -------------------------------------------------------------------------- */
/* A bunch of list constants */
-const char *pdkim_querymethods[] = {
- "dns/txt",
+const uschar * pdkim_querymethods[] = {
+ US"dns/txt",
NULL
};
-const char *pdkim_algos[] = {
- "rsa-sha256",
- "rsa-sha1",
+const uschar * pdkim_algos[] = {
+ US"rsa-sha256",
+ US"rsa-sha1",
NULL
};
-const char *pdkim_canons[] = {
- "simple",
- "relaxed",
+const uschar * pdkim_canons[] = {
+ US"simple",
+ US"relaxed",
NULL
};
-const char *pdkim_hashes[] = {
- "sha256",
- "sha1",
+const uschar * pdkim_hashes[] = {
+ US"sha256",
+ US"sha1",
NULL
};
-const char *pdkim_keytypes[] = {
- "rsa",
+const uschar * pdkim_keytypes[] = {
+ US"rsa",
NULL
};
typedef struct pdkim_combined_canon_entry {
- const char *str;
+ const uschar * str;
int canon_headers;
int canon_body;
} pdkim_combined_canon_entry;
pdkim_combined_canon_entry pdkim_combined_canons[] = {
- { "simple/simple", PDKIM_CANON_SIMPLE, PDKIM_CANON_SIMPLE },
- { "simple/relaxed", PDKIM_CANON_SIMPLE, PDKIM_CANON_RELAXED },
- { "relaxed/simple", PDKIM_CANON_RELAXED, PDKIM_CANON_SIMPLE },
- { "relaxed/relaxed", PDKIM_CANON_RELAXED, PDKIM_CANON_RELAXED },
- { "simple", PDKIM_CANON_SIMPLE, PDKIM_CANON_SIMPLE },
- { "relaxed", PDKIM_CANON_RELAXED, PDKIM_CANON_SIMPLE },
- { NULL, 0, 0 }
+ { US"simple/simple", PDKIM_CANON_SIMPLE, PDKIM_CANON_SIMPLE },
+ { US"simple/relaxed", PDKIM_CANON_SIMPLE, PDKIM_CANON_RELAXED },
+ { US"relaxed/simple", PDKIM_CANON_RELAXED, PDKIM_CANON_SIMPLE },
+ { US"relaxed/relaxed", PDKIM_CANON_RELAXED, PDKIM_CANON_RELAXED },
+ { US"simple", PDKIM_CANON_SIMPLE, PDKIM_CANON_SIMPLE },
+ { US"relaxed", PDKIM_CANON_RELAXED, PDKIM_CANON_SIMPLE },
+ { NULL, 0, 0 }
};
case PDKIM_VERIFY_FAIL_MESSAGE: return "PDKIM_VERIFY_FAIL_MESSAGE";
case PDKIM_VERIFY_INVALID_PUBKEY_UNAVAILABLE: return "PDKIM_VERIFY_INVALID_PUBKEY_UNAVAILABLE";
case PDKIM_VERIFY_INVALID_BUFFER_SIZE: return "PDKIM_VERIFY_INVALID_BUFFER_SIZE";
- case PDKIM_VERIFY_INVALID_PUBKEY_PARSING: return "PDKIM_VERIFY_INVALID_PUBKEY_PARSING";
+ case PDKIM_VERIFY_INVALID_PUBKEY_DNSRECORD: return "PDKIM_VERIFY_INVALID_PUBKEY_DNSRECORD";
+ case PDKIM_VERIFY_INVALID_PUBKEY_IMPORT: return "PDKIM_VERIFY_INVALID_PUBKEY_IMPORT";
default: return "PDKIM_VERIFY_UNKNOWN";
}
}
/* -------------------------------------------------------------------------- */
/* Print debugging functions */
-void
-pdkim_quoteprint(const char *data, int len, int lf)
+static void
+pdkim_quoteprint(const uschar *data, int len)
{
int i;
-const unsigned char *p = (const unsigned char *)data;
-
for (i = 0; i < len; i++)
{
- const int c = p[i];
+ const int c = data[i];
switch (c)
{
case ' ' : debug_printf("{SP}"); break;
break;
}
}
-if (lf)
- debug_printf("\n");
+debug_printf("\n");
}
-void
-pdkim_hexprint(const char *data, int len, int lf)
+static void
+pdkim_hexprint(const uschar *data, int len)
{
int i;
-const unsigned char *p = (const unsigned char *)data;
-
-for (i = 0 ; i < len; i++)
- debug_printf("%02x", p[i]);
-if (lf)
- debug_printf("\n");
+for (i = 0 ; i < len; i++) debug_printf("%02x", data[i]);
+debug_printf("\n");
}
-/* String package: should be replaced by Exim standard ones */
-
static pdkim_stringlist *
-pdkim_prepend_stringlist(pdkim_stringlist *base, char *str)
+pdkim_prepend_stringlist(pdkim_stringlist * base, const uschar * str)
{
-pdkim_stringlist *new_entry = malloc(sizeof(pdkim_stringlist));
+pdkim_stringlist * new_entry = store_get(sizeof(pdkim_stringlist));
-if (!new_entry) return NULL;
memset(new_entry, 0, sizeof(pdkim_stringlist));
-if (!(new_entry->value = strdup(str))) return NULL;
-if (base)
- {
- pdkim_stringlist *last = base;
- while (last->next != NULL) { last = last->next; }
- last->next = new_entry;
- return base;
- }
-else
- return new_entry;
+new_entry->value = string_copy(str);
+if (base) new_entry->next = base;
+return new_entry;
}
-/* -------------------------------------------------------------------------- */
-/* A small "growing string" implementation to escape malloc/realloc hell */
-static pdkim_str *
-pdkim_strnew (const char *cstr)
-{
-unsigned int len = cstr ? strlen(cstr) : 0;
-pdkim_str *p = malloc(sizeof(pdkim_str));
+/* Trim whitespace fore & aft */
-if (!p) return NULL;
-memset(p, 0, sizeof(pdkim_str));
-if (!(p->str = malloc(len+1)))
- {
- free(p);
- return NULL;
- }
-p->allocated = len+1;
-p->len = len;
-if (cstr)
- strcpy(p->str, cstr);
-else
- p->str[p->len] = '\0';
-return p;
-}
-
-static char *
-pdkim_strncat(pdkim_str *str, const char *data, int len)
-{
-if ((str->allocated - str->len) < (len+1))
- {
- /* Extend the buffer */
- int num_frags = ((len+1)/PDKIM_STR_ALLOC_FRAG)+1;
- char *n = realloc(str->str,
- (str->allocated+(num_frags*PDKIM_STR_ALLOC_FRAG)));
- if (n == NULL) return NULL;
- str->str = n;
- str->allocated += (num_frags*PDKIM_STR_ALLOC_FRAG);
- }
-strncpy(&(str->str[str->len]), data, len);
-str->len += len;
-str->str[str->len] = '\0';
-return str->str;
-}
-
-static char *
-pdkim_strcat(pdkim_str *str, const char *cstr)
-{
-return pdkim_strncat(str, cstr, strlen(cstr));
-}
-
-static char *
-pdkim_strtrim(pdkim_str *str)
+static void
+pdkim_strtrim(uschar * str)
{
-char *p = str->str;
-char *q = str->str;
-while ( (*p != '\0') && ((*p == '\t') || (*p == ' ')) ) p++;
-while (*p != '\0') {*q = *p; q++; p++;}
+uschar * p = str;
+uschar * q = str;
+while (*p == '\t' || *p == ' ') p++; /* skip whitespace */
+while (*p) {*q = *p; q++; p++;} /* dump the leading whitespace */
*q = '\0';
-while ( (q != str->str) && ( (*q == '\0') || (*q == '\t') || (*q == ' ') ) )
- {
+while (q != str && ( (*q == '\0') || (*q == '\t') || (*q == ' ') ) )
+ { /* dump trailing whitespace */
*q = '\0';
q--;
}
-str->len = strlen(str->str);
-return str->str;
-}
-
-static char *
-pdkim_strclear(pdkim_str *str)
-{
-str->str[0] = '\0';
-str->len = 0;
-return str->str;
-}
-
-static void
-pdkim_strfree(pdkim_str *str)
-{
-if (!str) return;
-if (str->str) free(str->str);
-free(str);
-}
-
-
-
-/* -------------------------------------------------------------------------- */
-
-static void
-pdkim_free_pubkey(pdkim_pubkey *pub)
-{
-if (pub)
- {
- if (pub->version ) free(pub->version);
- if (pub->granularity) free(pub->granularity);
- if (pub->hashes ) free(pub->hashes);
- if (pub->keytype ) free(pub->keytype);
- if (pub->srvtype ) free(pub->srvtype);
- if (pub->notes ) free(pub->notes);
-/* if (pub->key ) free(pub->key); */
- free(pub);
- }
}
-/* -------------------------------------------------------------------------- */
-
-static void
-pdkim_free_sig(pdkim_signature *sig)
-{
-if (sig)
- {
- pdkim_signature *next = (pdkim_signature *)sig->next;
-
- pdkim_stringlist *e = sig->headers;
- while(e)
- {
- pdkim_stringlist *c = e;
- if (e->value) free(e->value);
- e = e->next;
- free(c);
- }
-
- if (sig->selector ) free(sig->selector);
- if (sig->domain ) free(sig->domain);
- if (sig->identity ) free(sig->identity);
- if (sig->headernames ) free(sig->headernames);
- if (sig->copiedheaders ) free(sig->copiedheaders);
- if (sig->rsa_privkey ) free(sig->rsa_privkey);
- if (sig->sign_headers ) free(sig->sign_headers);
- if (sig->signature_header) free(sig->signature_header);
-
- if (sig->pubkey) pdkim_free_pubkey(sig->pubkey);
-
- free(sig);
- if (next) pdkim_free_sig(next);
- }
-}
-
/* -------------------------------------------------------------------------- */
DLLEXPORT void
pdkim_free_ctx(pdkim_ctx *ctx)
{
-if (ctx)
- {
- pdkim_stringlist *e = ctx->headers;
- while(e)
- {
- pdkim_stringlist *c = e;
- if (e->value) free(e->value);
- e = e->next;
- free(c);
- }
- pdkim_free_sig(ctx->sig);
- pdkim_strfree(ctx->cur_header);
- free(ctx);
- }
}
/* -------------------------------------------------------------------------- */
/* Matches the name of the passed raw "header" against
- the passed colon-separated "list", starting at entry
- "start". Returns the position of the header name in
- the list. */
+ the passed colon-separated "tick", and invalidates
+ the entry in tick. Returns OK or fail-code */
+/*XXX might be safer done using a pdkim_stringlist for "tick" */
static int
-header_name_match(const char *header,
- char *tick,
- int do_tick)
+header_name_match(const uschar * header, uschar * tick)
{
-char *hname;
-char *lcopy;
-char *p;
-char *q;
-int rc = PDKIM_FAIL;
-
-/* Get header name */
-char *hcolon = strchr(header, ':');
+uschar * hname;
+uschar * lcopy;
+uschar * p;
+uschar * q;
+uschar * hcolon = Ustrchr(header, ':'); /* Get header name */
-if (!hcolon) return rc; /* This isn't a header */
+if (!hcolon)
+ return PDKIM_FAIL; /* This isn't a header */
-if (!(hname = malloc((hcolon-header)+1)))
- return PDKIM_ERR_OOM;
-memset(hname, 0, (hcolon-header)+1);
-strncpy(hname, header, (hcolon-header));
+/* if we had strncmpic() we wouldn't need this copy */
+hname = string_copyn(header, hcolon-header);
/* Copy tick-off list locally, so we can punch zeroes into it */
-if (!(lcopy = strdup(tick)))
- {
- free(hname);
- return PDKIM_ERR_OOM;
- }
-p = lcopy;
-q = strchr(p, ':');
-while (q)
+p = lcopy = string_copy(tick);
+
+for (q = Ustrchr(p, ':'); q; q = Ustrchr(p, ':'))
{
*q = '\0';
-
- if (strcasecmp(p, hname) == 0)
- {
- rc = PDKIM_OK;
- /* Invalidate header name instance in tick-off list */
- if (do_tick) tick[p-lcopy] = '_';
- goto BAIL;
- }
+ if (strcmpic(p, hname) == 0)
+ goto found;
p = q+1;
- q = strchr(p, ':');
}
-if (strcasecmp(p, hname) == 0)
- {
- rc = PDKIM_OK;
- /* Invalidate header name instance in tick-off list */
- if (do_tick) tick[p-lcopy] = '_';
- }
+if (strcmpic(p, hname) == 0)
+ goto found;
-BAIL:
-free(hname);
-free(lcopy);
-return rc;
+return PDKIM_FAIL;
+
+found:
+ /* Invalidate header name instance in tick-off list */
+ tick[p-lcopy] = '_';
+ return PDKIM_OK;
}
/* -------------------------------------------------------------------------- */
-/* Performs "relaxed" canonicalization of a header. The returned pointer needs
- to be free()d. */
+/* Performs "relaxed" canonicalization of a header. */
-static char *
-pdkim_relax_header (char *header, int crlf)
+static uschar *
+pdkim_relax_header(const uschar * header, int crlf)
{
BOOL past_field_name = FALSE;
BOOL seen_wsp = FALSE;
-char *p;
-char *q;
-char *relaxed = malloc(strlen(header)+3);
+const uschar * p;
+uschar * relaxed = store_get(Ustrlen(header)+3);
+uschar * q = relaxed;
-if (!relaxed) return NULL;
-
-q = relaxed;
-for (p = header; *p != '\0'; p++)
+for (p = header; *p; p++)
{
- int c = *p;
+ uschar c = *p;
/* Ignore CR & LF */
if (c == '\r' || c == '\n')
continue;
}
if (q > relaxed && q[-1] == ' ') q--; /* Squash eventual trailing SP */
-*q = '\0';
-if (crlf) strcat(relaxed, "\r\n");
+if (crlf) { *q++ = '\r'; *q++ = '\n'; }
+*q = '\0';
return relaxed;
}
/* -------------------------------------------------------------------------- */
#define PDKIM_QP_ERROR_DECODE -1
-static char *
-pdkim_decode_qp_char(char *qp_p, int *c)
+static uschar *
+pdkim_decode_qp_char(uschar *qp_p, int *c)
{
-char *initial_pos = qp_p;
+uschar *initial_pos = qp_p;
/* Advance one char */
qp_p++;
/* -------------------------------------------------------------------------- */
-static char *
-pdkim_decode_qp(char *str)
+static uschar *
+pdkim_decode_qp(uschar * str)
{
int nchar = 0;
-char *q;
-char *p = str;
-char *n = malloc(strlen(p)+1);
-
-if (!n) return NULL;
+uschar * q;
+uschar * p = str;
+uschar * n = store_get(Ustrlen(str)+1);
*n = '\0';
q = n;
-while (*p != '\0')
+while (*p)
{
if (*p == '=')
{
/* -------------------------------------------------------------------------- */
-static char *
-pdkim_decode_base64(char *str, int *num_decoded)
+static void
+pdkim_decode_base64(uschar *str, blob * b)
{
-int dlen = 0;
-char *res;
-int old_pool = store_pool;
-
-/* There is a store-reset between header & body reception
-so cannot use the main pool */
-
-store_pool = POOL_PERM;
-dlen = b64decode(US str, USS &res);
-store_pool = old_pool;
-
-if (dlen < 0) return NULL;
-
-if (num_decoded) *num_decoded = dlen;
-return res;
+int dlen;
+dlen = b64decode(str, &b->data);
+if (dlen < 0) b->data = NULL;
+b->len = dlen;
}
-
-/* -------------------------------------------------------------------------- */
-
-static char *
-pdkim_encode_base64(char *str, int num)
+static uschar *
+pdkim_encode_base64(blob * b)
{
-char * ret;
-int old_pool = store_pool;
-
-store_pool = POOL_PERM;
-ret = CS b64encode(US str, num);
-store_pool = old_pool;
-return ret;
+return b64encode(b->data, b->len);
}
#define PDKIM_HDR_VALUE 2
static pdkim_signature *
-pdkim_parse_sig_header(pdkim_ctx *ctx, char *raw_hdr)
+pdkim_parse_sig_header(pdkim_ctx *ctx, uschar * raw_hdr)
{
pdkim_signature *sig ;
-char *p, *q;
-pdkim_str *cur_tag = NULL;
-pdkim_str *cur_val = NULL;
+uschar *p, *q;
+uschar * cur_tag = NULL; int ts = 0, tl = 0;
+uschar * cur_val = NULL; int vs = 0, vl = 0;
BOOL past_hname = FALSE;
BOOL in_b_val = FALSE;
int where = PDKIM_HDR_LIMBO;
int i;
-if (!(sig = malloc(sizeof(pdkim_signature)))) return NULL;
+sig = store_get(sizeof(pdkim_signature));
memset(sig, 0, sizeof(pdkim_signature));
sig->bodylength = -1;
-if (!(sig->rawsig_no_b_val = malloc(strlen(raw_hdr)+1)))
- {
- free(sig);
- return NULL;
- }
-
-q = sig->rawsig_no_b_val;
+q = sig->rawsig_no_b_val = store_get(Ustrlen(raw_hdr)+1);
for (p = raw_hdr; ; p++)
{
if (where == PDKIM_HDR_TAG)
{
- if (!cur_tag)
- cur_tag = pdkim_strnew(NULL);
-
if (c >= 'a' && c <= 'z')
- pdkim_strncat(cur_tag, p, 1);
+ cur_tag = string_catn(cur_tag, &ts, &tl, p, 1);
if (c == '=')
{
- if (strcmp(cur_tag->str, "b") == 0)
+ cur_tag[tl] = '\0';
+ if (Ustrcmp(cur_tag, "b") == 0)
{
- *q = '='; q++;
+ *q++ = '=';
in_b_val = TRUE;
}
where = PDKIM_HDR_VALUE;
if (where == PDKIM_HDR_VALUE)
{
- if (!cur_val)
- cur_val = pdkim_strnew(NULL);
-
if (c == '\r' || c == '\n' || c == ' ' || c == '\t')
goto NEXT_CHAR;
if (c == ';' || c == '\0')
{
- if (cur_tag->len > 0)
+ if (tl && vl)
{
+ cur_val[vl] = '\0';
pdkim_strtrim(cur_val);
- DEBUG(D_acl) debug_printf(" %s=%s\n", cur_tag->str, cur_val->str);
+ DEBUG(D_acl) debug_printf(" %s=%s\n", cur_tag, cur_val);
- switch (cur_tag->str[0])
+ switch (*cur_tag)
{
case 'b':
- if (cur_tag->str[1] == 'h')
- sig->bodyhash = pdkim_decode_base64(cur_val->str,
- &sig->bodyhash_len);
+ if (cur_tag[1] == 'h')
+ pdkim_decode_base64(cur_val, &sig->bodyhash);
else
- sig->sigdata = pdkim_decode_base64(cur_val->str,
- &sig->sigdata_len);
+ pdkim_decode_base64(cur_val, &sig->sigdata);
break;
case 'v':
/* We only support version 1, and that is currently the
only version there is. */
- if (strcmp(cur_val->str, PDKIM_SIGNATURE_VERSION) == 0)
+ if (Ustrcmp(cur_val, PDKIM_SIGNATURE_VERSION) == 0)
sig->version = 1;
break;
case 'a':
for (i = 0; pdkim_algos[i]; i++)
- if (strcmp(cur_val->str, pdkim_algos[i]) == 0)
+ if (Ustrcmp(cur_val, pdkim_algos[i]) == 0)
{
sig->algo = i;
break;
break;
case 'c':
for (i = 0; pdkim_combined_canons[i].str; i++)
- if (strcmp(cur_val->str, pdkim_combined_canons[i].str) == 0)
+ if (Ustrcmp(cur_val, pdkim_combined_canons[i].str) == 0)
{
sig->canon_headers = pdkim_combined_canons[i].canon_headers;
sig->canon_body = pdkim_combined_canons[i].canon_body;
break;
case 'q':
for (i = 0; pdkim_querymethods[i]; i++)
- if (strcmp(cur_val->str, pdkim_querymethods[i]) == 0)
+ if (Ustrcmp(cur_val, pdkim_querymethods[i]) == 0)
{
sig->querymethod = i;
break;
}
break;
case 's':
- sig->selector = strdup(cur_val->str); break;
+ sig->selector = string_copy(cur_val); break;
case 'd':
- sig->domain = strdup(cur_val->str); break;
+ sig->domain = string_copy(cur_val); break;
case 'i':
- sig->identity = pdkim_decode_qp(cur_val->str); break;
+ sig->identity = pdkim_decode_qp(cur_val); break;
case 't':
- sig->created = strtoul(cur_val->str, NULL, 10); break;
+ sig->created = strtoul(CS cur_val, NULL, 10); break;
case 'x':
- sig->expires = strtoul(cur_val->str, NULL, 10); break;
+ sig->expires = strtoul(CS cur_val, NULL, 10); break;
case 'l':
- sig->bodylength = strtol(cur_val->str, NULL, 10); break;
+ sig->bodylength = strtol(CS cur_val, NULL, 10); break;
case 'h':
- sig->headernames = strdup(cur_val->str); break;
+ sig->headernames = string_copy(cur_val); break;
case 'z':
- sig->copiedheaders = pdkim_decode_qp(cur_val->str); break;
+ sig->copiedheaders = pdkim_decode_qp(cur_val); break;
default:
DEBUG(D_acl) debug_printf(" Unknown tag encountered\n");
break;
}
}
- pdkim_strclear(cur_tag);
- pdkim_strclear(cur_val);
+ tl = 0;
+ vl = 0;
in_b_val = FALSE;
where = PDKIM_HDR_LIMBO;
}
else
- pdkim_strncat(cur_val, p, 1);
+ cur_val = string_catn(cur_val, &vs, &vl, p, 1);
}
NEXT_CHAR:
}
/* Make sure the most important bits are there. */
-if (!(sig->domain && (*(sig->domain) != '\0') &&
- sig->selector && (*(sig->selector) != '\0') &&
- sig->headernames && (*(sig->headernames) != '\0') &&
- sig->bodyhash &&
- sig->sigdata &&
- sig->version))
- {
- pdkim_free_sig(sig);
+if (!sig->version)
return NULL;
- }
*q = '\0';
/* Chomp raw header. The final newline must not be added to the signature. */
-q--;
-while (q > sig->rawsig_no_b_val && (*q == '\r' || *q == '\n'))
- *q = '\0'; q--; /*XXX questionable code layout; possible bug */
+while (--q > sig->rawsig_no_b_val && (*q == '\r' || *q == '\n'))
+ *q = '\0';
DEBUG(D_acl)
{
debug_printf(
"PDKIM >> Raw signature w/o b= tag value >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
- pdkim_quoteprint(sig->rawsig_no_b_val, strlen(sig->rawsig_no_b_val), 1);
+ pdkim_quoteprint(US sig->rawsig_no_b_val, Ustrlen(sig->rawsig_no_b_val));
debug_printf(
- "PDKIM >> Sig size: %4d bits\n", sig->sigdata_len*8);
+ "PDKIM >> Sig size: %4u bits\n", (unsigned) sig->sigdata.len*8);
debug_printf(
"PDKIM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n");
}
-#ifdef USE_GNUTLS
-gnutls_hash_init(&sig->sha_body,
- sig->algo == PDKIM_ALGO_RSA_SHA1 ? GNUTLS_DIG_SHA1 : GNUTLS_DIG_SHA256);
-
-#else
-SHA1_Init (&sig->sha1_body);
-SHA256_Init(&sig->sha2_body);
-#endif
-
+exim_sha_init(&sig->body_hash, sig->algo == PDKIM_ALGO_RSA_SHA1 ? HASH_SHA1 : HASH_SHA256);
return sig;
}
/* -------------------------------------------------------------------------- */
static pdkim_pubkey *
-pdkim_parse_pubkey_record(pdkim_ctx *ctx, char *raw_record)
+pdkim_parse_pubkey_record(pdkim_ctx *ctx, const uschar *raw_record)
{
pdkim_pubkey *pub;
-char *p;
-pdkim_str *cur_tag = NULL;
-pdkim_str *cur_val = NULL;
+const uschar *p;
+uschar * cur_tag = NULL; int ts = 0, tl = 0;
+uschar * cur_val = NULL; int vs = 0, vl = 0;
int where = PDKIM_HDR_LIMBO;
-if (!(pub = malloc(sizeof(pdkim_pubkey)))) return NULL;
+pub = store_get(sizeof(pdkim_pubkey));
memset(pub, 0, sizeof(pdkim_pubkey));
for (p = raw_record; ; p++)
if (where == PDKIM_HDR_TAG)
{
- if (!cur_tag)
- cur_tag = pdkim_strnew(NULL);
-
if (c >= 'a' && c <= 'z')
- pdkim_strncat(cur_tag, p, 1);
+ cur_tag = string_catn(cur_tag, &ts, &tl, p, 1);
if (c == '=')
{
+ cur_tag[tl] = '\0';
where = PDKIM_HDR_VALUE;
goto NEXT_CHAR;
}
if (where == PDKIM_HDR_VALUE)
{
- if (!cur_val)
- cur_val = pdkim_strnew(NULL);
-
- if (c == '\r' || c == '\n')
- goto NEXT_CHAR;
-
if (c == ';' || c == '\0')
{
- if (cur_tag->len > 0)
+ if (tl && vl)
{
+ cur_val[vl] = '\0';
pdkim_strtrim(cur_val);
- DEBUG(D_acl) debug_printf(" %s=%s\n", cur_tag->str, cur_val->str);
+ DEBUG(D_acl) debug_printf(" %s=%s\n", cur_tag, cur_val);
- switch (cur_tag->str[0])
+ switch (cur_tag[0])
{
case 'v':
/* This tag isn't evaluated because:
- Other versions are currently not specified. */
break;
case 'h':
- pub->hashes = strdup(cur_val->str); break;
+ case 'k':
+ pub->hashes = string_copy(cur_val); break;
case 'g':
- pub->granularity = strdup(cur_val->str); break;
+ pub->granularity = string_copy(cur_val); break;
case 'n':
- pub->notes = pdkim_decode_qp(cur_val->str); break;
+ pub->notes = pdkim_decode_qp(cur_val); break;
case 'p':
- pub->key = pdkim_decode_base64(cur_val->str, &(pub->key_len)); break;
- case 'k':
- pub->hashes = strdup(cur_val->str); break;
+ pdkim_decode_base64(US cur_val, &pub->key);
+ break;
case 's':
- pub->srvtype = strdup(cur_val->str); break;
+ pub->srvtype = string_copy(cur_val); break;
case 't':
- if (strchr(cur_val->str, 'y') != NULL) pub->testing = 1;
- if (strchr(cur_val->str, 's') != NULL) pub->no_subdomaining = 1;
+ if (Ustrchr(cur_val, 'y') != NULL) pub->testing = 1;
+ if (Ustrchr(cur_val, 's') != NULL) pub->no_subdomaining = 1;
break;
default:
DEBUG(D_acl) debug_printf(" Unknown tag encountered\n");
break;
}
}
- pdkim_strclear(cur_tag);
- pdkim_strclear(cur_val);
+ tl = 0;
+ vl = 0;
where = PDKIM_HDR_LIMBO;
}
else
- pdkim_strncat(cur_val, p, 1);
+ cur_val = string_catn(cur_val, &vs, &vl, p, 1);
}
NEXT_CHAR:
}
/* Set fallback defaults */
-if (!pub->version ) pub->version = strdup(PDKIM_PUB_RECORD_VERSION);
-if (!pub->granularity) pub->granularity = strdup("*");
-if (!pub->keytype ) pub->keytype = strdup("rsa");
-if (!pub->srvtype ) pub->srvtype = strdup("*");
+if (!pub->version ) pub->version = string_copy(PDKIM_PUB_RECORD_VERSION);
+if (!pub->granularity) pub->granularity = string_copy(US"*");
+if (!pub->keytype ) pub->keytype = string_copy(US"rsa");
+if (!pub->srvtype ) pub->srvtype = string_copy(US"*");
/* p= is required */
-if (pub->key)
+if (pub->key.data)
return pub;
-pdkim_free_pubkey(pub);
return NULL;
}
{
pdkim_signature *sig = ctx->sig;
/* Cache relaxed version of data */
-char *relaxed_data = NULL;
-int relaxed_len = 0;
+uschar *relaxed_data = NULL;
+int relaxed_len = 0;
/* Traverse all signatures, updating their hashes. */
while (sig)
{
/* Defaults to simple canon (no further treatment necessary) */
- const char *canon_data = data;
- int canon_len = len;
+ const uschar *canon_data = CUS data;
+ int canon_len = len;
if (sig->canon_body == PDKIM_CANON_RELAXED)
{
const char *p;
int q = 0;
- if (!(relaxed_data = malloc(len+1)))
- return PDKIM_ERR_OOM;
+ relaxed_data = store_get(len+1);
for (p = data; *p; p++)
{
if (canon_len > 0)
{
-#ifdef USE_GNUTLS
- gnutls_hash(sig->sha_body, canon_data, canon_len);
-#else
- if (sig->algo == PDKIM_ALGO_RSA_SHA1)
- SHA1_Update (&sig->sha1_body, canon_data, canon_len);
- else
- SHA256_Update(&sig->sha2_body, canon_data, canon_len);
-#endif
-
+ exim_sha_update(&sig->body_hash, CUS canon_data, canon_len);
sig->signed_body_bytes += canon_len;
- DEBUG(D_acl) pdkim_quoteprint(canon_data, canon_len, 1);
+ DEBUG(D_acl) pdkim_quoteprint(canon_data, canon_len);
}
sig = sig->next;
}
-if (relaxed_data) free(relaxed_data);
return PDKIM_OK;
}
/* -------------------------------------------------------------------------- */
-static int
+static void
pdkim_finish_bodyhash(pdkim_ctx *ctx)
{
pdkim_signature *sig;
/* Traverse all signatures */
for (sig = ctx->sig; sig; sig = sig->next)
{ /* Finish hashes */
- uschar bh[32]; /* SHA-256 = 32 Bytes, SHA-1 = 20 Bytes */
+ blob bh;
-#ifdef USE_GNUTLS
- gnutls_hash_output(sig->sha_body, bh);
-#else
- if (sig->algo == PDKIM_ALGO_RSA_SHA1)
- SHA1_Final (bh, &sig->sha1_body);
- else
- SHA256_Final(bh, &sig->sha2_body);
-#endif
+ exim_sha_finish(&sig->body_hash, &bh);
DEBUG(D_acl)
{
debug_printf("PDKIM [%s] Body bytes hashed: %lu\n"
"PDKIM [%s] bh computed: ",
sig->domain, sig->signed_body_bytes, sig->domain);
- pdkim_hexprint((char *)bh, sig->algo == PDKIM_ALGO_RSA_SHA1 ? 20 : 32, 1);
+ pdkim_hexprint(CUS bh.data, bh.len);
}
/* SIGNING -------------------------------------------------------------- */
if (ctx->mode == PDKIM_MODE_SIGN)
{
- sig->bodyhash_len = sig->algo == PDKIM_ALGO_RSA_SHA1 ? 20:32;
- sig->bodyhash = string_copyn(US bh, sig->bodyhash_len);
+ sig->bodyhash = bh;
/* If bodylength limit is set, and we have received less bytes
than the requested amount, effectively remove the limit tag. */
else
{
/* Compare bodyhash */
- if (memcmp(bh, sig->bodyhash,
- (sig->algo == PDKIM_ALGO_RSA_SHA1)?20:32) == 0)
+ if (memcmp(bh.data, sig->bodyhash.data, bh.len) == 0)
{
DEBUG(D_acl) debug_printf("PDKIM [%s] Body hash verified OK\n", sig->domain);
}
DEBUG(D_acl)
{
debug_printf("PDKIM [%s] bh signature: ", sig->domain);
- pdkim_hexprint(sig->bodyhash,
- sig->algo == PDKIM_ALGO_RSA_SHA1 ? 20 : 32, 1);
+ pdkim_hexprint(sig->bodyhash.data,
+ exim_sha_hashlen(&sig->body_hash));
debug_printf("PDKIM [%s] Body hash did NOT verify\n", sig->domain);
}
sig->verify_status = PDKIM_VERIFY_FAIL;
}
}
}
-
-return PDKIM_OK;
}
pdkim_header_complete(pdkim_ctx *ctx)
{
/* Special case: The last header can have an extra \r appended */
-if ( (ctx->cur_header->len > 1) &&
- (ctx->cur_header->str[(ctx->cur_header->len)-1] == '\r') )
- {
- ctx->cur_header->str[(ctx->cur_header->len)-1] = '\0';
- ctx->cur_header->len--;
- }
+if ( (ctx->cur_header_len > 1) &&
+ (ctx->cur_header[(ctx->cur_header_len)-1] == '\r') )
+ --ctx->cur_header_len;
+ctx->cur_header[ctx->cur_header_len] = '\0';
ctx->num_headers++;
if (ctx->num_headers > PDKIM_MAX_HEADERS) goto BAIL;
pdkim_signature *sig;
for (sig = ctx->sig; sig; sig = sig->next) /* Traverse all signatures */
- if (header_name_match(ctx->cur_header->str,
- sig->sign_headers?
- sig->sign_headers:
- PDKIM_DEFAULT_SIGN_HEADERS, 0) == PDKIM_OK)
- {
- pdkim_stringlist *list;
- /* Add header to the signed headers list (in reverse order) */
- if (!(list = pdkim_prepend_stringlist(sig->headers,
- ctx->cur_header->str)))
- return PDKIM_ERR_OOM;
- sig->headers = list;
- }
+ /* Add header to the signed headers list (in reverse order) */
+ sig->headers = pdkim_prepend_stringlist(sig->headers,
+ ctx->cur_header);
}
/* VERIFICATION ----------------------------------------------------------- */
/* DKIM-Signature: headers are added to the verification list */
if (ctx->mode == PDKIM_MODE_VERIFY)
{
- if (strncasecmp(ctx->cur_header->str,
+ if (strncasecmp(CCS ctx->cur_header,
DKIM_SIGNATURE_HEADERNAME,
- strlen(DKIM_SIGNATURE_HEADERNAME)) == 0)
+ Ustrlen(DKIM_SIGNATURE_HEADERNAME)) == 0)
{
pdkim_signature *new_sig;
DEBUG(D_acl) debug_printf(
"PDKIM >> Found sig, trying to parse >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
- if ((new_sig = pdkim_parse_sig_header(ctx, ctx->cur_header->str)))
+ if ((new_sig = pdkim_parse_sig_header(ctx, ctx->cur_header)))
{
pdkim_signature *last_sig = ctx->sig;
if (!last_sig)
/* every other header is stored for signature verification */
else
- {
- pdkim_stringlist *list;
-
- if (!(list = pdkim_prepend_stringlist(ctx->headers, ctx->cur_header->str)))
- return PDKIM_ERR_OOM;
- ctx->headers = list;
- }
+ ctx->headers = pdkim_prepend_stringlist(ctx->headers, ctx->cur_header);
}
BAIL:
-pdkim_strclear(ctx->cur_header); /* Re-use existing pdkim_str */
+*ctx->cur_header = '\0';
+ctx->cur_header_len = 0; /* leave buffer for reuse */
return PDKIM_OK;
}
#define HEADER_BUFFER_FRAG_SIZE 256
DLLEXPORT int
-pdkim_feed (pdkim_ctx *ctx, char *data, int len)
+pdkim_feed(pdkim_ctx *ctx, char *data, int len)
{
int p;
for (p = 0; p<len; p++)
{
- char c = data[p];
+ uschar c = data[p];
if (ctx->past_headers)
{
ctx->past_headers = TRUE;
ctx->seen_lf = 0;
DEBUG(D_acl) debug_printf(
- "PDKIM >> Hashed body data, canonicalized >>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
+ "PDKIM >> Body data for hash, canonicalized >>>>>>>>>>>>>>>>>>>>>>\n");
continue;
}
else
}
}
- if (!ctx->cur_header)
- if (!(ctx->cur_header = pdkim_strnew(NULL)))
- return PDKIM_ERR_OOM;
-
- if (ctx->cur_header->len < PDKIM_MAX_HEADER_LEN)
- if (!pdkim_strncat(ctx->cur_header, &data[p], 1))
- return PDKIM_ERR_OOM;
+ if (ctx->cur_header_len < PDKIM_MAX_HEADER_LEN)
+ ctx->cur_header = string_catn(ctx->cur_header, &ctx->cur_header_size,
+ &ctx->cur_header_len, CUS &data[p], 1);
}
}
return PDKIM_OK;
}
+
+
+/* Extend a grwong header with a continuation-linebreak */
+static uschar *
+pdkim_hdr_cont(uschar * str, int * size, int * ptr, int * col)
+{
+*col = 1;
+return string_catn(str, size, ptr, US"\r\n\t", 3);
+}
+
+
+
/*
* RFC 5322 specifies that header line length SHOULD be no more than 78
* lets make it so!
* pdkim_headcat
- * returns char*
+ *
+ * returns uschar * (not nul-terminated)
*
* col: this int holds and receives column number (octets since last '\n')
* str: partial string to append to
+ * size: current buffer size for str
+ * ptr: current tail-pointer for str
* pad: padding, split line or space after before or after eg: ";"
* intro: - must join to payload eg "h=", usually the tag name
* payload: eg base64 data - long data can be split arbitrarily.
* names longer than 78, or bogus col. Input is assumed to be free of line breaks.
*/
-static char *
-pdkim_headcat(int *col, pdkim_str *str, const char * pad,
- const char *intro, const char *payload)
+static uschar *
+pdkim_headcat(int * col, uschar * str, int * size, int * ptr,
+ const uschar * pad, const uschar * intro, const uschar * payload)
{
size_t l;
if (pad)
{
- l = strlen(pad);
+ l = Ustrlen(pad);
if (*col + l > 78)
- {
- pdkim_strcat(str, "\r\n\t");
- *col = 1;
- }
- pdkim_strncat(str, pad, l);
+ str = pdkim_hdr_cont(str, size, ptr, col);
+ str = string_catn(str, size, ptr, pad, l);
*col += l;
}
-l = (pad?1:0) + (intro?strlen(intro):0);
+l = (pad?1:0) + (intro?Ustrlen(intro):0);
if (*col + l > 78)
{ /*can't fit intro - start a new line to make room.*/
- pdkim_strcat(str, "\r\n\t");
- *col = 1;
- l = intro?strlen(intro):0;
+ str = pdkim_hdr_cont(str, size, ptr, col);
+ l = intro?Ustrlen(intro):0;
}
-l += payload ? strlen(payload):0 ;
+l += payload ? Ustrlen(payload):0 ;
while (l>77)
{ /* this fragment will not fit on a single line */
if (pad)
{
- pdkim_strcat(str, " ");
+ str = string_catn(str, size, ptr, US" ", 1);
*col += 1;
pad = NULL; /* only want this once */
l--;
if (intro)
{
- size_t sl = strlen(intro);
+ size_t sl = Ustrlen(intro);
- pdkim_strncat(str, intro, sl);
+ str = string_catn(str, size, ptr, intro, sl);
*col += sl;
l -= sl;
intro = NULL; /* only want this once */
if (payload)
{
- size_t sl = strlen(payload);
+ size_t sl = Ustrlen(payload);
size_t chomp = *col+sl < 77 ? sl : 78-*col;
- pdkim_strncat(str, payload, chomp);
+ str = string_catn(str, size, ptr, payload, chomp);
*col += chomp;
payload += chomp;
l -= chomp-1;
}
/* the while precondition tells us it didn't fit. */
- pdkim_strcat(str, "\r\n\t");
- *col = 1;
+ str = pdkim_hdr_cont(str, size, ptr, col);
}
if (*col + l > 78)
{
- pdkim_strcat(str, "\r\n\t");
- *col = 1;
+ str = pdkim_hdr_cont(str, size, ptr, col);
pad = NULL;
}
if (pad)
{
- pdkim_strcat(str, " ");
+ str = string_catn(str, size, ptr, US" ", 1);
*col += 1;
pad = NULL;
}
if (intro)
{
- size_t sl = strlen(intro);
+ size_t sl = Ustrlen(intro);
- pdkim_strncat(str, intro, sl);
+ str = string_catn(str, size, ptr, intro, sl);
*col += sl;
l -= sl;
intro = NULL;
if (payload)
{
- size_t sl = strlen(payload);
+ size_t sl = Ustrlen(payload);
- pdkim_strncat(str, payload, sl);
+ str = string_catn(str, size, ptr, payload, sl);
*col += sl;
}
-return str->str;
+return str;
}
/* -------------------------------------------------------------------------- */
-static char *
-pdkim_create_header(pdkim_signature *sig, int final)
+static uschar *
+pdkim_create_header(pdkim_signature *sig, BOOL final)
{
-char *rc = NULL;
-char *base64_bh = NULL;
-char *base64_b = NULL;
+uschar * base64_bh;
+uschar * base64_b;
int col = 0;
-pdkim_str *hdr;
-pdkim_str *canon_all;
+uschar * hdr; int hdr_size = 0, hdr_len = 0;
+uschar * canon_all; int can_size = 0, can_len = 0;
-if (!(hdr = pdkim_strnew("DKIM-Signature: v="PDKIM_SIGNATURE_VERSION)))
- return NULL;
+canon_all = string_cat (NULL, &can_size, &can_len,
+ pdkim_canons[sig->canon_headers]);
+canon_all = string_catn(canon_all, &can_size, &can_len, US"/", 1);
+canon_all = string_cat (canon_all, &can_size, &can_len,
+ pdkim_canons[sig->canon_body]);
+canon_all[can_len] = '\0';
-if (!(canon_all = pdkim_strnew(pdkim_canons[sig->canon_headers])))
- goto BAIL;
-
-if (!(base64_bh = pdkim_encode_base64(sig->bodyhash, sig->bodyhash_len)))
- goto BAIL;
-
-col = strlen(hdr->str);
+hdr = string_cat(NULL, &hdr_size, &hdr_len,
+ US"DKIM-Signature: v="PDKIM_SIGNATURE_VERSION);
+col = hdr_len;
/* Required and static bits */
-if ( pdkim_headcat(&col, hdr, ";", "a=", pdkim_algos[sig->algo])
- && pdkim_headcat(&col, hdr, ";", "q=", pdkim_querymethods[sig->querymethod])
- && pdkim_strcat(canon_all, "/")
- && pdkim_strcat(canon_all, pdkim_canons[sig->canon_body])
- && pdkim_headcat(&col, hdr, ";", "c=", canon_all->str)
- && pdkim_headcat(&col, hdr, ";", "d=", sig->domain)
- && pdkim_headcat(&col, hdr, ";", "s=", sig->selector)
- )
+hdr = pdkim_headcat(&col, hdr, &hdr_size, &hdr_len, US";", US"a=",
+ pdkim_algos[sig->algo]);
+hdr = pdkim_headcat(&col, hdr, &hdr_size, &hdr_len, US";", US"q=",
+ pdkim_querymethods[sig->querymethod]);
+hdr = pdkim_headcat(&col, hdr, &hdr_size, &hdr_len, US";", US"c=",
+ canon_all);
+hdr = pdkim_headcat(&col, hdr, &hdr_size, &hdr_len, US";", US"d=",
+ sig->domain);
+hdr = pdkim_headcat(&col, hdr, &hdr_size, &hdr_len, US";", US"s=",
+ sig->selector);
+
+/* list of header names can be split between items. */
{
- /* list of eader names can be split between items. */
- {
- char *n = strdup(sig->headernames);
- char *f = n;
- char *i = "h=";
- char *s = ";";
+ uschar * n = string_copy(sig->headernames);
+ uschar * i = US"h=";
+ uschar * s = US";";
- if (!n) goto BAIL;
- while (*n)
- {
- char *c = strchr(n, ':');
+ while (*n)
+ {
+ uschar * c = Ustrchr(n, ':');
- if (c) *c ='\0';
+ if (c) *c ='\0';
- if (!i)
- if (!pdkim_headcat(&col, hdr, NULL, NULL, ":"))
- {
- free(f);
- goto BAIL;
- }
+ if (!i)
+ hdr = pdkim_headcat(&col, hdr, &hdr_size, &hdr_len, NULL, NULL, US":");
- if (!pdkim_headcat(&col, hdr, s, i, n))
- {
- free(f);
- goto BAIL;
- }
+ hdr = pdkim_headcat(&col, hdr, &hdr_size, &hdr_len, s, i, n);
- if (!c)
- break;
+ if (!c)
+ break;
- n = c+1;
- s = NULL;
- i = NULL;
- }
- free(f);
+ n = c+1;
+ s = NULL;
+ i = NULL;
}
+ }
- if(!pdkim_headcat(&col, hdr, ";", "bh=", base64_bh))
- goto BAIL;
-
- /* Optional bits */
- if (sig->identity)
- if(!pdkim_headcat(&col, hdr, ";", "i=", sig->identity))
- goto BAIL;
+base64_bh = pdkim_encode_base64(&sig->bodyhash);
+hdr = pdkim_headcat(&col, hdr, &hdr_size, &hdr_len, US";", US"bh=", base64_bh);
- if (sig->created > 0)
- {
- char minibuf[20];
+/* Optional bits */
+if (sig->identity)
+ hdr = pdkim_headcat(&col, hdr, &hdr_size, &hdr_len, US";", US"i=", sig->identity);
- snprintf(minibuf, 20, "%lu", sig->created);
- if(!pdkim_headcat(&col, hdr, ";", "t=", minibuf))
- goto BAIL;
- }
+if (sig->created > 0)
+ {
+ uschar minibuf[20];
- if (sig->expires > 0)
- {
- char minibuf[20];
+ snprintf(CS minibuf, sizeof(minibuf), "%lu", sig->created);
+ hdr = pdkim_headcat(&col, hdr, &hdr_size, &hdr_len, US";", US"t=", minibuf);
+}
- snprintf(minibuf, 20, "%lu", sig->expires);
- if(!pdkim_headcat(&col, hdr, ";", "x=", minibuf))
- goto BAIL;
- }
+if (sig->expires > 0)
+ {
+ uschar minibuf[20];
- if (sig->bodylength >= 0)
- {
- char minibuf[20];
+ snprintf(CS minibuf, sizeof(minibuf), "%lu", sig->expires);
+ hdr = pdkim_headcat(&col, hdr, &hdr_size, &hdr_len, US";", US"x=", minibuf);
+ }
- snprintf(minibuf, 20, "%lu", sig->bodylength);
- if(!pdkim_headcat(&col, hdr, ";", "l=", minibuf))
- goto BAIL;
- }
+if (sig->bodylength >= 0)
+ {
+ uschar minibuf[20];
- /* Preliminary or final version? */
- if (final)
- {
- if (!(base64_b = pdkim_encode_base64(sig->sigdata, sig->sigdata_len)))
- goto BAIL;
- if (!pdkim_headcat(&col, hdr, ";", "b=", base64_b))
- goto BAIL;
+ snprintf(CS minibuf, sizeof(minibuf), "%lu", sig->bodylength);
+ hdr = pdkim_headcat(&col, hdr, &hdr_size, &hdr_len, US";", US"l=", minibuf);
}
- else
- if(!pdkim_headcat(&col, hdr, ";", "b=", ""))
- goto BAIL;
- /* add trailing semicolon: I'm not sure if this is actually needed */
- if (!pdkim_headcat(&col, hdr, NULL, ";", ""))
- goto BAIL;
- }
+/* Preliminary or final version? */
+base64_b = final ? pdkim_encode_base64(&sig->sigdata) : US"";
+hdr = pdkim_headcat(&col, hdr, &hdr_size, &hdr_len, US";", US"b=", base64_b);
-rc = strdup(hdr->str);
+/* add trailing semicolon: I'm not sure if this is actually needed */
+hdr = pdkim_headcat(&col, hdr, &hdr_size, &hdr_len, NULL, US";", US"");
-BAIL:
-pdkim_strfree(hdr);
-if (canon_all) pdkim_strfree(canon_all);
-return rc;
+hdr[hdr_len] = '\0';
+return hdr;
}
pdkim_feed_finish(pdkim_ctx *ctx, pdkim_signature **return_signatures)
{
pdkim_signature *sig = ctx->sig;
-pdkim_str *headernames = NULL; /* Collected signed header names */
+uschar * headernames = NULL; /* Collected signed header names */
+int hs = 0, hl = 0;
/* Check if we must still flush a (partial) header. If that is the
case, the message has no body, and we must compute a body hash
out of '<CR><LF>' */
-if (ctx->cur_header && ctx->cur_header->len)
+if (ctx->cur_header && ctx->cur_header_len)
{
int rc = pdkim_header_complete(ctx);
if (rc != PDKIM_OK) return rc;
"PDKIM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n");
/* Build (and/or evaluate) body hash */
-if (pdkim_finish_bodyhash(ctx) != PDKIM_OK)
- return PDKIM_ERR_OOM;
-
-/* SIGNING -------------------------------------------------------------- */
-if (ctx->mode == PDKIM_MODE_SIGN)
- if (!(headernames = pdkim_strnew(NULL)))
- return PDKIM_ERR_OOM;
-/* ---------------------------------------------------------------------- */
+pdkim_finish_bodyhash(ctx);
while (sig)
{
-#ifdef USE_GNUTLS
- gnutls_hash_hd_t sha_headers;
- uschar * hdata = NULL;
+ BOOL is_sha1 = sig->algo == PDKIM_ALGO_RSA_SHA1;
+ hctx hhash_ctx;
+ uschar * sig_hdr;
+ blob hhash;
+ blob hdata;
int hdata_alloc = 0;
- int hdata_size = 0;
-#else
- SHA_CTX sha1_headers;
- SHA256_CTX sha2_headers;
-#endif
- char *sig_hdr;
- char headerhash[32];
-
-#ifdef USE_GNUTLS
- gnutls_hash_init(&sha_headers,
- sig->algo == PDKIM_ALGO_RSA_SHA1 ? GNUTLS_DIG_SHA1 : GNUTLS_DIG_SHA256);
-#else
- if (sig->algo == PDKIM_ALGO_RSA_SHA1)
- SHA1_Init(&sha1_headers);
- else
- SHA256_Init(&sha2_headers);
-#endif
+
+ hdata.data = NULL;
+ hdata.len = 0;
+
+ exim_sha_init(&hhash_ctx, is_sha1 ? HASH_SHA1 : HASH_SHA256);
DEBUG(D_acl) debug_printf(
"PDKIM >> Hashed header data, canonicalized, in sequence >>>>>>>>>>>>>>\n");
/* SIGNING ---------------------------------------------------------------- */
/* When signing, walk through our header list and add them to the hash. As we
- go, construct a list of the header's names to use for the h= parameter. */
+ go, construct a list of the header's names to use for the h= parameter.
+ Then append to that list any remaining header names for which there was no
+ header to sign. */
if (ctx->mode == PDKIM_MODE_SIGN)
{
pdkim_stringlist *p;
+ const uschar * l;
+ uschar * s;
+ int sep = 0;
for (p = sig->headers; p; p = p->next)
- {
- char *rh = NULL;
- /* Collect header names (Note: colon presence is guaranteed here) */
- char *q = strchr(p->value, ':');
-
- if (!(pdkim_strncat(headernames, p->value,
- (q-(p->value)) + (p->next ? 1 : 0))))
- return PDKIM_ERR_OOM;
-
- rh = sig->canon_headers == PDKIM_CANON_RELAXED
- ? pdkim_relax_header(p->value, 1) /* cook header for relaxed canon */
- : strdup(p->value); /* just copy it for simple canon */
- if (!rh)
- return PDKIM_ERR_OOM;
-
- /* Feed header to the hash algorithm */
-#ifdef USE_GNUTLS
- gnutls_hash(sha_headers, rh, strlen(rh));
-#else
- if (sig->algo == PDKIM_ALGO_RSA_SHA1)
- SHA1_Update (&sha1_headers, rh, strlen(rh));
- else
- SHA256_Update(&sha2_headers, rh, strlen(rh));
-#endif
+ if (header_name_match(p->value, sig->sign_headers) == PDKIM_OK)
+ {
+ uschar * rh;
+ /* Collect header names (Note: colon presence is guaranteed here) */
+ uschar * q = Ustrchr(p->value, ':');
-#ifdef USE_GNUTLS
- /* Remember headers block for signing */
- hdata = string_append(hdata, &hdata_alloc, &hdata_size, 1, rh);
-#endif
+ headernames = string_catn(headernames, &hs, &hl,
+ p->value, (q - US p->value) + (p->next ? 1 : 0));
- DEBUG(D_acl) pdkim_quoteprint(rh, strlen(rh), 1);
- free(rh);
- }
+ rh = sig->canon_headers == PDKIM_CANON_RELAXED
+ ? pdkim_relax_header(p->value, 1) /* cook header for relaxed canon */
+ : string_copy(CUS p->value); /* just copy it for simple canon */
+
+ /* Feed header to the hash algorithm */
+ exim_sha_update(&hhash_ctx, CUS rh, Ustrlen(rh));
+
+ /* Remember headers block for signing (when the library cannot do incremental) */
+ (void) exim_rsa_data_append(&hdata, &hdata_alloc, rh);
+
+ DEBUG(D_acl) pdkim_quoteprint(rh, Ustrlen(rh));
+ }
+
+ l = sig->sign_headers;
+ while((s = string_nextinlist(&l, &sep, NULL, 0)))
+ if (*s != '_')
+ { /*SSS string_append_listele() */
+ if (hl > 0 && headernames[hl-1] != ':')
+ headernames = string_catn(headernames, &hs, &hl, US":", 1);
+
+ headernames = string_cat(headernames, &hs, &hl, s);
+ }
+ headernames[hl] = '\0';
+
+ /* Copy headernames to signature struct */
+ sig->headernames = headernames;
+ headernames = NULL, hs = hl = 0;
+
+ /* Create signature header with b= omitted */
+ sig_hdr = pdkim_create_header(sig, FALSE);
}
/* VERIFICATION ----------------------------------------------------------- */
add the headers to the hash in that order. */
else
{
- char *b = strdup(sig->headernames);
- char *p = b;
- char *q = NULL;
- pdkim_stringlist *hdrs;
-
- if (!b) return PDKIM_ERR_OOM;
+ uschar * b = string_copy(sig->headernames);
+ uschar * p = b;
+ uschar * q;
+ pdkim_stringlist * hdrs;
/* clear tags */
for (hdrs = ctx->headers; hdrs; hdrs = hdrs->next)
while(1)
{
- if ((q = strchr(p, ':')))
+ if ((q = Ustrchr(p, ':')))
*q = '\0';
+/*XXX walk the list of headers in same order as received. */
for (hdrs = ctx->headers; hdrs; hdrs = hdrs->next)
if ( hdrs->tag == 0
- && strncasecmp(hdrs->value, p, strlen(p)) == 0
- && (hdrs->value)[strlen(p)] == ':'
+ && strncasecmp(hdrs->value, CS p, Ustrlen(p)) == 0
+ && (hdrs->value)[Ustrlen(p)] == ':'
)
{
- char *rh;
-
- rh = sig->canon_headers == PDKIM_CANON_RELAXED
+ uschar * rh = sig->canon_headers == PDKIM_CANON_RELAXED
? pdkim_relax_header(hdrs->value, 1) /* cook header for relaxed canon */
- : strdup(hdrs->value); /* just copy it for simple canon */
- if (!rh)
- return PDKIM_ERR_OOM;
+ : string_copy(CUS hdrs->value); /* just copy it for simple canon */
/* Feed header to the hash algorithm */
-#ifdef USE_GNUTLS
- gnutls_hash(sha_headers, rh, strlen(rh));
-#else
- if (sig->algo == PDKIM_ALGO_RSA_SHA1)
- SHA1_Update (&sha1_headers, rh, strlen(rh));
- else
- SHA256_Update(&sha2_headers, rh, strlen(rh));
-#endif
+ exim_sha_update(&hhash_ctx, CUS rh, Ustrlen(rh));
- DEBUG(D_acl) pdkim_quoteprint(rh, strlen(rh), 1);
- free(rh);
+ DEBUG(D_acl) pdkim_quoteprint(rh, Ustrlen(rh));
hdrs->tag = 1;
break;
}
if (!q) break;
p = q+1;
}
- free(b);
+
+ sig_hdr = string_copy(sig->rawsig_no_b_val);
}
DEBUG(D_acl) debug_printf(
"PDKIM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n");
- /* SIGNING ---------------------------------------------------------------- */
- if (ctx->mode == PDKIM_MODE_SIGN)
- {
- /* Copy headernames to signature struct */
- sig->headernames = strdup(headernames->str);
- pdkim_strfree(headernames);
-
- /* Create signature header with b= omitted */
- sig_hdr = pdkim_create_header(ctx->sig, 0);
- }
-
- /* VERIFICATION ----------------------------------------------------------- */
- else
- sig_hdr = strdup(sig->rawsig_no_b_val);
- /* ------------------------------------------------------------------------ */
-
- if (!sig_hdr)
- return PDKIM_ERR_OOM;
-
/* Relax header if necessary */
if (sig->canon_headers == PDKIM_CANON_RELAXED)
- {
- char *relaxed_hdr = pdkim_relax_header(sig_hdr, 0);
-
- free(sig_hdr);
- if (!relaxed_hdr)
- return PDKIM_ERR_OOM;
- sig_hdr = relaxed_hdr;
- }
+ sig_hdr = pdkim_relax_header(sig_hdr, 0);
DEBUG(D_acl)
{
debug_printf(
"PDKIM >> Signed DKIM-Signature header, canonicalized >>>>>>>>>>>>>>>>>\n");
- pdkim_quoteprint(sig_hdr, strlen(sig_hdr), 1);
+ pdkim_quoteprint(CUS sig_hdr, Ustrlen(sig_hdr));
debug_printf(
"PDKIM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n");
}
/* Finalize header hash */
-#ifdef USE_GNUTLS
- gnutls_hash(sha_headers, sig_hdr, strlen(sig_hdr));
- gnutls_hash_output(sha_headers, headerhash);
-#else
- if (sig->algo == PDKIM_ALGO_RSA_SHA1)
- {
- SHA1_Update(&sha1_headers, sig_hdr, strlen(sig_hdr));
- SHA1_Final(US headerhash, &sha1_headers);
- }
- else
- {
- SHA256_Update(&sha2_headers, sig_hdr, strlen(sig_hdr));
- SHA256_Final(US headerhash, &sha2_headers);
- }
-#endif
+ exim_sha_update(&hhash_ctx, CUS sig_hdr, Ustrlen(sig_hdr));
+ exim_sha_finish(&hhash_ctx, &hhash);
DEBUG(D_acl)
{
debug_printf("PDKIM [%s] hh computed: ", sig->domain);
- pdkim_hexprint(headerhash, sig->algo == PDKIM_ALGO_RSA_SHA1 ? 20:32, 1);
+ pdkim_hexprint(hhash.data, hhash.len);
}
-#ifdef USE_GNUTLS
+ /* Remember headers block for signing (when the library cannot do incremental) */
if (ctx->mode == PDKIM_MODE_SIGN)
- hdata = string_append(hdata, &hdata_alloc, &hdata_size, 1, sig_hdr);
-#endif
-
- free(sig_hdr);
+ (void) exim_rsa_data_append(&hdata, &hdata_alloc, US sig_hdr);
/* SIGNING ---------------------------------------------------------------- */
if (ctx->mode == PDKIM_MODE_SIGN)
{
-#ifdef USE_GNUTLS
- gnutls_x509_privkey_t rsa;
- gnutls_datum_t k;
- int rc;
- size_t sigsize;
-#else
- RSA * rsa;
- uschar * p, * q;
- int len;
-#endif
+ es_ctx sctx;
+ const uschar * errstr;
/* Import private key */
-#ifdef USE_GNUTLS
-
- k.data = sig->rsa_privkey;
- k.size = strlen(sig->rsa_privkey);
- if ( (rc = gnutls_x509_privkey_init(&rsa)) != GNUTLS_E_SUCCESS
- || (rc = gnutls_x509_privkey_import2(rsa, &k,
- GNUTLS_X509_FMT_PEM, NULL, GNUTLS_PKCS_PLAIN)) != GNUTLS_E_SUCCESS
- )
+ if ((errstr = exim_rsa_signing_init(US sig->rsa_privkey, &sctx)))
{
- DEBUG(D_acl) debug_printf("gnutls_x509_privkey_import2: %s\n",
- gnutls_strerror(rc));
+ DEBUG(D_acl) debug_printf("signing_init: %s\n", errstr);
return PDKIM_ERR_RSA_PRIVKEY;
}
-#else
-
- if ( !(p = Ustrstr(sig->rsa_privkey, "-----BEGIN RSA PRIVATE KEY-----"))
- || !(q = Ustrstr(p+=31, "-----END RSA PRIVATE KEY-----"))
- )
- return PDKIM_ERR_RSA_PRIVKEY;
- *q = '\0';
- if ( (len = b64decode(p, &p)) < 0
- || !(rsa = d2i_RSAPrivateKey(NULL, CUSS &p, len))
- )
- /*XXX todo: get errstring from library */
- return PDKIM_ERR_RSA_PRIVKEY;
-
-#endif
-
+ /* Do signing. With OpenSSL we are signing the hash of headers just
+ calculated, with GnuTLS we have to sign an entire block of headers
+ (due to available interfaces) and it recalculates the hash internally. */
- /* Allocate mem for signature */
-#ifdef USE_GNUTLS
- k.data = hdata;
- k.size = hdata_size;
- (void) gnutls_x509_privkey_sign_data(rsa,
- sig->algo == PDKIM_ALGO_RSA_SHA1 ? GNUTLS_DIG_SHA1 : GNUTLS_DIG_SHA256,
- 0, &k, NULL, &sigsize);
- sig->sigdata = store_get(sig->sigdata_len = sigsize);
-#else
- sig->sigdata = store_get(RSA_size(rsa));
+#if defined(RSA_OPENSSL) || defined(RSA_GCRYPT)
+ hdata = hhash;
#endif
- /* Do signing */
-#ifdef USE_GNUTLS
-
- if ((rc = gnutls_x509_privkey_sign_data(rsa,
- sig->algo == PDKIM_ALGO_RSA_SHA1 ? GNUTLS_DIG_SHA1 : GNUTLS_DIG_SHA256,
- 0, &k, sig->sigdata, &sigsize)) != GNUTLS_E_SUCCESS
- )
+ if ((errstr = exim_rsa_sign(&sctx, is_sha1, &hdata, &sig->sigdata)))
{
- DEBUG(D_acl) debug_printf("gnutls_x509_privkey_sign_data: %s\n",
- gnutls_strerror(rc));
+ DEBUG(D_acl) debug_printf("signing: %s\n", errstr);
return PDKIM_ERR_RSA_SIGNING;
}
- gnutls_x509_privkey_deinit(rsa);
-
-#else
-
- if (RSA_sign(sig->algo == PDKIM_ALGO_RSA_SHA1 ? NID_sha1 : NID_sha256,
- CUS headerhash, sig->algo == PDKIM_ALGO_RSA_SHA1 ? 20 : 32,
- US sig->sigdata, (unsigned int *)&sig->sigdata_len,
- rsa) != 1)
- return PDKIM_ERR_RSA_SIGNING;
- RSA_free(rsa);
-
-#endif
-
DEBUG(D_acl)
{
debug_printf( "PDKIM [%s] b computed: ", sig->domain);
- pdkim_hexprint(sig->sigdata, sig->sigdata_len, 1);
+ pdkim_hexprint(sig->sigdata.data, sig->sigdata.len);
}
- if (!(sig->signature_header = pdkim_create_header(ctx->sig, 1)))
- return PDKIM_ERR_OOM;
+ sig->signature_header = pdkim_create_header(sig, TRUE);
}
/* VERIFICATION ----------------------------------------------------------- */
else
{
-#ifdef USE_GNUTLS
- gnutls_pubkey_t rsa;
- gnutls_datum_t k, s;
- int rc;
-#else
- RSA * rsa;
- const unsigned char * p;
-#endif
- char *dns_txt_name, *dns_txt_reply;
+ ev_ctx vctx;
+ const uschar * errstr;
-#ifdef USE_GNUTLS
- gnutls_pubkey_init(&rsa);
-#endif
+ uschar *dns_txt_name, *dns_txt_reply;
/* Fetch public key for signing domain, from DNS */
- if (!(dns_txt_name = malloc(PDKIM_DNS_TXT_MAX_NAMELEN)))
- return PDKIM_ERR_OOM;
-
- if (!(dns_txt_reply = malloc(PDKIM_DNS_TXT_MAX_RECLEN)))
- {
- free(dns_txt_name);
- return PDKIM_ERR_OOM;
- }
+ dns_txt_name = string_sprintf("%s._domainkey.%s.",
+ sig->selector, sig->domain);
+ dns_txt_reply = store_get(PDKIM_DNS_TXT_MAX_RECLEN);
memset(dns_txt_reply, 0, PDKIM_DNS_TXT_MAX_RECLEN);
- memset(dns_txt_name , 0, PDKIM_DNS_TXT_MAX_NAMELEN);
- if (snprintf(dns_txt_name, PDKIM_DNS_TXT_MAX_NAMELEN,
- "%s._domainkey.%s.",
- sig->selector, sig->domain) >= PDKIM_DNS_TXT_MAX_NAMELEN)
- {
- sig->verify_status = PDKIM_VERIFY_INVALID;
- sig->verify_ext_status = PDKIM_VERIFY_INVALID_BUFFER_SIZE;
- goto NEXT_VERIFY;
- }
-
- if ( ctx->dns_txt_callback(dns_txt_name, dns_txt_reply) != PDKIM_OK
+ if ( ctx->dns_txt_callback(CS dns_txt_name, CS dns_txt_reply) != PDKIM_OK
|| dns_txt_reply[0] == '\0')
{
sig->verify_status = PDKIM_VERIFY_INVALID;
DEBUG(D_acl)
{
debug_printf(
- "PDKIM >> Parsing public key record >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n"
- " Raw record: ");
- pdkim_quoteprint(dns_txt_reply, strlen(dns_txt_reply), 1);
+ "PDKIM >> Parsing public key record >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n"
+ " Raw record: ");
+ pdkim_quoteprint(CUS dns_txt_reply, Ustrlen(dns_txt_reply));
}
- if (!(sig->pubkey = pdkim_parse_pubkey_record(ctx, dns_txt_reply)))
+ if (!(sig->pubkey = pdkim_parse_pubkey_record(ctx, CUS dns_txt_reply)))
{
sig->verify_status = PDKIM_VERIFY_INVALID;
- sig->verify_ext_status = PDKIM_VERIFY_INVALID_PUBKEY_PARSING;
+ sig->verify_ext_status = PDKIM_VERIFY_INVALID_PUBKEY_DNSRECORD;
DEBUG(D_acl) debug_printf(
" Error while parsing public key record\n"
}
DEBUG(D_acl) debug_printf(
- "PDKIM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n");
+ "PDKIM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n");
/* Import public key */
-#ifdef USE_GNUTLS
-
- k.data = sig->pubkey->key;
- k.size = sig->pubkey->key_len;
- if ((rc = gnutls_pubkey_import(rsa, &k, GNUTLS_X509_FMT_DER))
- != GNUTLS_E_SUCCESS)
-
-#else
-
- p = CUS sig->pubkey->key;
- if (!(rsa = d2i_RSA_PUBKEY(NULL, &p, (long) sig->pubkey->key_len)))
-
-#endif
+ if ((errstr = exim_rsa_verify_init(&sig->pubkey->key, &vctx)))
{
- DEBUG(D_acl)
- {
-#ifdef USE_GNUTLS
- debug_printf("gnutls_pubkey_import: %s\n", gnutls_strerror(rc));
-#else
- long e;
- ERR_load_crypto_strings(); /*XXX move to a startup routine */
- while ((e = ERR_get_error()))
- debug_printf("Az: %.120s\n", ERR_error_string(e, NULL));
-#endif
- }
-
+ DEBUG(D_acl) debug_printf("verify_init: %s\n", errstr);
sig->verify_status = PDKIM_VERIFY_INVALID;
- sig->verify_ext_status = PDKIM_VERIFY_INVALID_PUBKEY_PARSING;
+ sig->verify_ext_status = PDKIM_VERIFY_INVALID_PUBKEY_IMPORT;
goto NEXT_VERIFY;
}
/* Check the signature */
-#ifdef USE_GNUTLS
-
- k.data = headerhash;
- k.size = sig->algo == PDKIM_ALGO_RSA_SHA1 ? 20 : 32;
- s.data = sig->sigdata;
- s.size = sig->sigdata_len;
- if ((rc = gnutls_pubkey_verify_hash2(rsa,
- sig->algo == PDKIM_ALGO_RSA_SHA1
- ? GNUTLS_SIGN_RSA_SHA1 : GNUTLS_SIGN_RSA_SHA256,
- 0, &k, &s)) < 0)
-
-#else
-
- if (RSA_verify(sig->algo == PDKIM_ALGO_RSA_SHA1 ? NID_sha1 : NID_sha256,
- CUS headerhash, sig->algo == PDKIM_ALGO_RSA_SHA1 ? 20 : 32,
- US sig->sigdata, (unsigned int)sig->sigdata_len,
- rsa) != 1)
-
-#endif
+ if ((errstr = exim_rsa_verify(&vctx, is_sha1, &hhash, &sig->sigdata)))
{
-#ifdef USE_GNUTLS
- debug_printf("gnutls_pubkey_verify_hash2: %s\n", gnutls_strerror(rc));
-#endif
+ DEBUG(D_acl) debug_printf("headers verify: %s\n", errstr);
sig->verify_status = PDKIM_VERIFY_FAIL;
sig->verify_ext_status = PDKIM_VERIFY_FAIL_MESSAGE;
goto NEXT_VERIFY;
}
+
/* We have a winner! (if bodydhash was correct earlier) */
if (sig->verify_status == PDKIM_VERIFY_NONE)
sig->verify_status = PDKIM_VERIFY_PASS;
else
debug_printf("\n");
}
-
-#ifdef USE_GNUTLS
- gnutls_pubkey_deinit(rsa);
-#endif
- free(dns_txt_name);
- free(dns_txt_reply);
}
sig = sig->next;
DLLEXPORT pdkim_ctx *
pdkim_init_verify(int(*dns_txt_callback)(char *, char *))
{
-pdkim_ctx *ctx = malloc(sizeof(pdkim_ctx));
+pdkim_ctx * ctx;
-if (!ctx)
- return NULL;
+ctx = store_get(sizeof(pdkim_ctx));
memset(ctx, 0, sizeof(pdkim_ctx));
-if (!(ctx->linebuf = malloc(PDKIM_MAX_BODY_LINE_LEN)))
- {
- free(ctx);
- return NULL;
- }
-
+ctx->linebuf = store_get(PDKIM_MAX_BODY_LINE_LEN);
ctx->mode = PDKIM_MODE_VERIFY;
ctx->dns_txt_callback = dns_txt_callback;
if (!domain || !selector || !rsa_privkey)
return NULL;
-if (!(ctx = malloc(sizeof(pdkim_ctx))))
- return NULL;
+ctx = store_get(sizeof(pdkim_ctx));
memset(ctx, 0, sizeof(pdkim_ctx));
-if (!(ctx->linebuf = malloc(PDKIM_MAX_BODY_LINE_LEN)))
- {
- free(ctx);
- return NULL;
- }
+ctx->linebuf = store_get(PDKIM_MAX_BODY_LINE_LEN);
-if (!(sig = malloc(sizeof(pdkim_signature))))
- {
- free(ctx->linebuf);
- free(ctx);
- return NULL;
- }
+sig = store_get(sizeof(pdkim_signature));
memset(sig, 0, sizeof(pdkim_signature));
sig->bodylength = -1;
ctx->mode = PDKIM_MODE_SIGN;
ctx->sig = sig;
-ctx->sig->domain = strdup(domain);
-ctx->sig->selector = strdup(selector);
-ctx->sig->rsa_privkey = strdup(rsa_privkey);
-ctx->sig->algo = algo;
-
-if (!ctx->sig->domain || !ctx->sig->selector || !ctx->sig->rsa_privkey)
- goto BAIL;
-
-#ifdef USE_GNUTLS
-gnutls_hash_init(&ctx->sig->sha_body,
- algo == PDKIM_ALGO_RSA_SHA1 ? GNUTLS_DIG_SHA1 : GNUTLS_DIG_SHA256);
-
-#else
-SHA1_Init (&ctx->sig->sha1_body);
-SHA256_Init(&ctx->sig->sha2_body);
-
-#endif
+sig->domain = string_copy(US domain);
+sig->selector = string_copy(US selector);
+sig->rsa_privkey = string_copy(US rsa_privkey);
+sig->algo = algo;
+exim_sha_init(&sig->body_hash, algo == PDKIM_ALGO_RSA_SHA1 ? HASH_SHA1 : HASH_SHA256);
return ctx;
-
-BAIL:
- pdkim_free_ctx(ctx);
- return NULL;
}
unsigned long created,
unsigned long expires)
{
+pdkim_signature * sig = ctx->sig;
+
if (identity)
- if (!(ctx->sig->identity = strdup(identity)))
- return PDKIM_ERR_OOM;
+ sig->identity = string_copy(US identity);
-if (sign_headers)
- if (!(ctx->sig->sign_headers = strdup(sign_headers)))
- return PDKIM_ERR_OOM;
+sig->sign_headers = string_copy(sign_headers
+ ? US sign_headers : US PDKIM_DEFAULT_SIGN_HEADERS);
-ctx->sig->canon_headers = canon_headers;
-ctx->sig->canon_body = canon_body;
-ctx->sig->bodylength = bodylength;
-ctx->sig->created = created;
-ctx->sig->expires = expires;
+sig->canon_headers = canon_headers;
+sig->canon_body = canon_body;
+sig->bodylength = bodylength;
+sig->created = created;
+sig->expires = expires;
return PDKIM_OK;
}
+void
+pdkim_init(void)
+{
+exim_rsa_init();
+}
+
+
+
#endif /*DISABLE_DKIM*/
projects / exim.git / blobdiff