X-Git-Url: https://vcs.fsf.org/?p=exim.git;a=blobdiff_plain;f=src%2Fsrc%2Fpdkim%2Fsigning.c;h=2a086b1e2793d69887beee01d919d0cd533bfb3d;hp=0545e483a16f68ba143320e98b22046444284c89;hb=25fa08681506fa01e9e15406f9d35a853da19476;hpb=39e02651ac166a6f5c8dc30070e9cca309570280

diff --git a/src/src/pdkim/signing.c b/src/src/pdkim/signing.c
index 0545e483a..2a086b1e2 100644
--- a/src/src/pdkim/signing.c
+++ b/src/src/pdkim/signing.c
@@ -90,14 +90,17 @@ exim_dkim_signing_init(const uschar * privkey_pem, es_ctx * sign_ctx)
 {
 gnutls_datum_t k = { .data = (void *)privkey_pem, .size = Ustrlen(privkey_pem) };
 gnutls_x509_privkey_t x509_key;
+const uschar * where;
 int rc;
 
-if (  (rc = gnutls_x509_privkey_init(&x509_key))
-   || (rc = gnutls_x509_privkey_import(x509_key, &k, GNUTLS_X509_FMT_PEM))
+if (  (where = US"internal init", rc = gnutls_x509_privkey_init(&x509_key))
    || (rc = gnutls_privkey_init(&sign_ctx->key))
-   || (rc = gnutls_privkey_import_x509(sign_ctx->key, x509_key, 0))
+   || (where = US"privkey PEM-block import",
+       rc = gnutls_x509_privkey_import(x509_key, &k, GNUTLS_X509_FMT_PEM))
+   || (where = US"internal privkey transfer",
+       rc = gnutls_privkey_import_x509(sign_ctx->key, x509_key, 0))
    )
-  return CUS gnutls_strerror(rc);
+  return string_sprintf("%s: %s", where, gnutls_strerror(rc));
 
 switch (rc = gnutls_privkey_get_pk_algorithm(sign_ctx->key, NULL))
   {
@@ -166,13 +169,13 @@ switch(fmt)
   {
   case KEYFMT_DER:
     if ((rc = gnutls_pubkey_import(verify_ctx->key, &k, GNUTLS_X509_FMT_DER)))
-      ret = gnutls_strerror(rc);
+      ret = US gnutls_strerror(rc);
     break;
 #ifdef SIGN_HAVE_ED25519
   case KEYFMT_ED25519_BARE:
     if ((rc = gnutls_pubkey_import_ecc_raw(verify_ctx->key,
 					  GNUTLS_ECC_CURVE_ED25519, &k, NULL)))
-      ret = gnutls_strerror(rc);
+      ret = US gnutls_strerror(rc);
     break;
 #endif
   default:
@@ -200,7 +203,7 @@ if (verify_ctx->keytype == KEYTYPE_ED25519)
   {
   if ((rc = gnutls_pubkey_verify_data2(verify_ctx->key,
 				      GNUTLS_SIGN_EDDSA_ED25519, 0, &k, &s)) < 0)
-    ret = gnutls_strerror(rc);
+    ret = US gnutls_strerror(rc);
   }
 else
 #endif
@@ -215,7 +218,7 @@ else
     }
 
   if ((rc = gnutls_pubkey_verify_hash2(verify_ctx->key, algo, 0, &k, &s)) < 0)
-    ret = gnutls_strerror(rc);
+    ret = US gnutls_strerror(rc);
   }
 
 gnutls_pubkey_deinit(verify_ctx->key);
@@ -712,7 +715,8 @@ exim_dkim_signing_init(const uschar * privkey_pem, es_ctx * sign_ctx)
 BIO * bp = BIO_new_mem_buf(privkey_pem, -1);
 
 if (!(sign_ctx->key = PEM_read_bio_PrivateKey(bp, NULL, NULL, NULL)))
-  return US ERR_error_string(ERR_get_error(), NULL);
+  return string_sprintf("privkey PEM-block import: %s",
+		       	ERR_error_string(ERR_get_error(), NULL));
 
 sign_ctx->keytype =
 #ifdef SIGN_HAVE_ED25519
@@ -827,6 +831,7 @@ const uschar *
 exim_dkim_verify(ev_ctx * verify_ctx, hashmethod hash, blob * data, blob * sig)
 {
 const EVP_MD * md;
+const uschar * where;
 
 switch (hash)
   {
@@ -855,18 +860,25 @@ else
   {
   EVP_PKEY_CTX * ctx;
 
-  if (  (ctx = EVP_PKEY_CTX_new(verify_ctx->key, NULL))
-     && EVP_PKEY_verify_init(ctx) > 0
-     && EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) > 0
-     && EVP_PKEY_CTX_set_signature_md(ctx, md) > 0
-     && EVP_PKEY_verify(ctx, sig->data, sig->len,
-	  data->data, data->len) == 1
-     )
-    { EVP_PKEY_CTX_free(ctx); return NULL; }
-
-  if (ctx) EVP_PKEY_CTX_free(ctx);
+  if ((where = US"EVP_PKEY_CTX_new",
+	   (ctx = EVP_PKEY_CTX_new(verify_ctx->key, NULL))))
+    {
+    if (  (where = US"EVP_PKEY_verify_init",
+		      EVP_PKEY_verify_init(ctx) > 0)
+       && (where = US"EVP_PKEY_CTX_set_rsa_padding",
+		      EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) > 0)
+       && (where = US"EVP_PKEY_CTX_set_signature_md",
+		      EVP_PKEY_CTX_set_signature_md(ctx, md) > 0)
+       && (where = US"EVP_PKEY_verify",
+		      EVP_PKEY_verify(ctx, sig->data, sig->len,
+				      data->data, data->len) == 1)
+       )
+      { EVP_PKEY_CTX_free(ctx); return NULL; }
+
+    EVP_PKEY_CTX_free(ctx);
+    }
   }
-return US ERR_error_string(ERR_get_error(), NULL);
+return string_sprintf("%s: %s", where, ERR_error_string(ERR_get_error(), NULL));
 }