1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge, 1995 - 2018 */
6 /* See the file NOTICE for conditions of use and distribution. */
8 /* Code for DKIM support. Other DKIM relevant code is in
9 receive.c, transport.c and transports/smtp.c */
15 # include "pdkim/pdkim.h"
18 # include "macro_predef.h"
23 builtin_macro_create_var(US"_DKIM_SIGN_HEADERS", US PDKIM_DEFAULT_SIGN_HEADERS);
25 # else /*!MACRO_PREDEF*/
29 pdkim_ctx dkim_sign_ctx;
31 int dkim_verify_oldpool;
32 pdkim_ctx *dkim_verify_ctx = NULL;
33 pdkim_signature *dkim_cur_sig = NULL;
34 static const uschar * dkim_collect_error = NULL;
36 #define DKIM_MAX_SIGNATURES 20
40 /* Look up the DKIM record in DNS for the given hostname.
41 Will use the first found if there are multiple.
42 The return string is tainted, having come from off-site.
46 dkim_exim_query_dns_txt(const uschar * name)
48 dns_answer * dnsa = store_get_dns_answer();
50 rmark reset_point = store_mark();
53 lookup_dnssec_authenticated = NULL;
54 if (dns_lookup(dnsa, name, T_TXT, NULL) != DNS_SUCCEED)
55 return NULL; /*XXX better error detail? logging? */
57 /* Search for TXT record */
59 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
61 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))
62 if (rr->type == T_TXT)
66 /* Copy record content to the answer buffer */
68 while (rr_offset < rr->size)
70 uschar len = rr->data[rr_offset++];
72 g = string_catn(g, US(rr->data + rr_offset), len);
73 if (g->ptr >= PDKIM_DNS_TXT_MAX_RECLEN)
79 /* check if this looks like a DKIM record */
80 if (Ustrncmp(g->s, "v=", 2) != 0 || strncasecmp(CS g->s, "v=dkim", 6) == 0)
82 gstring_release_unused(g);
83 return string_from_gstring(g);
86 if (g) g->ptr = 0; /* overwrite previous record */
90 store_reset(reset_point);
91 return NULL; /*XXX better error detail? logging? */
104 dkim_exim_verify_init(BOOL dot_stuffing)
106 /* There is a store-reset between header & body reception
107 so cannot use the main pool. Any allocs done by Exim
108 memory-handling must use the perm pool. */
110 dkim_verify_oldpool = store_pool;
111 store_pool = POOL_PERM;
113 /* Free previous context if there is one */
116 pdkim_free_ctx(dkim_verify_ctx);
118 /* Create new context */
120 dkim_verify_ctx = pdkim_init_verify(&dkim_exim_query_dns_txt, dot_stuffing);
121 dkim_collect_input = dkim_verify_ctx ? DKIM_MAX_SIGNATURES : 0;
122 dkim_collect_error = NULL;
124 /* Start feed up with any cached data */
127 store_pool = dkim_verify_oldpool;
132 dkim_exim_verify_feed(uschar * data, int len)
136 store_pool = POOL_PERM;
137 if ( dkim_collect_input
138 && (rc = pdkim_feed(dkim_verify_ctx, data, len)) != PDKIM_OK)
140 dkim_collect_error = pdkim_errstr(rc);
141 log_write(0, LOG_MAIN,
142 "DKIM: validation error: %.100s", dkim_collect_error);
143 dkim_collect_input = 0;
145 store_pool = dkim_verify_oldpool;
149 /* Log the result for the given signature */
151 dkim_exim_verify_log_sig(pdkim_signature * sig)
158 /* Remember the domain for the first pass result */
160 if ( !dkim_verify_overall
161 && dkim_verify_status
162 ? Ustrcmp(dkim_verify_status, US"pass") == 0
163 : sig->verify_status == PDKIM_VERIFY_PASS
165 dkim_verify_overall = string_copy(sig->domain);
167 /* Rewrite the sig result if the ACL overrode it. This is only
168 needed because the DMARC code (sigh) peeks at the dkim sigs.
169 Mark the sig for this having been done. */
171 if ( dkim_verify_status
172 && ( dkim_verify_status != dkim_exim_expand_query(DKIM_VERIFY_STATUS)
173 || dkim_verify_reason != dkim_exim_expand_query(DKIM_VERIFY_REASON)
175 { /* overridden by ACL */
176 sig->verify_ext_status = -1;
177 if (Ustrcmp(dkim_verify_status, US"fail") == 0)
178 sig->verify_status = PDKIM_VERIFY_POLICY | PDKIM_VERIFY_FAIL;
179 else if (Ustrcmp(dkim_verify_status, US"invalid") == 0)
180 sig->verify_status = PDKIM_VERIFY_POLICY | PDKIM_VERIFY_INVALID;
181 else if (Ustrcmp(dkim_verify_status, US"none") == 0)
182 sig->verify_status = PDKIM_VERIFY_POLICY | PDKIM_VERIFY_NONE;
183 else if (Ustrcmp(dkim_verify_status, US"pass") == 0)
184 sig->verify_status = PDKIM_VERIFY_POLICY | PDKIM_VERIFY_PASS;
186 sig->verify_status = -1;
189 if (!LOGGING(dkim_verbose)) return;
192 logmsg = string_catn(NULL, US"DKIM: ", 6);
193 if (!(s = sig->domain)) s = US"<UNSET>";
194 logmsg = string_append(logmsg, 2, "d=", s);
195 if (!(s = sig->selector)) s = US"<UNSET>";
196 logmsg = string_append(logmsg, 2, " s=", s);
197 logmsg = string_fmt_append(logmsg, " c=%s/%s a=%s b=" SIZE_T_FMT,
198 sig->canon_headers == PDKIM_CANON_SIMPLE ? "simple" : "relaxed",
199 sig->canon_body == PDKIM_CANON_SIMPLE ? "simple" : "relaxed",
200 dkim_sig_to_a_tag(sig),
201 (int)sig->sighash.len > -1 ? sig->sighash.len * 8 : (size_t)0);
202 if ((s= sig->identity)) logmsg = string_append(logmsg, 2, " i=", s);
203 if (sig->created > 0) logmsg = string_fmt_append(logmsg, " t=%lu",
205 if (sig->expires > 0) logmsg = string_fmt_append(logmsg, " x=%lu",
207 if (sig->bodylength > -1) logmsg = string_fmt_append(logmsg, " l=%lu",
210 if (sig->verify_status & PDKIM_VERIFY_POLICY)
211 logmsg = string_append(logmsg, 5,
212 US" [", dkim_verify_status, US" - ", dkim_verify_reason, US"]");
214 switch (sig->verify_status)
216 case PDKIM_VERIFY_NONE:
217 logmsg = string_cat(logmsg, US" [not verified]");
220 case PDKIM_VERIFY_INVALID:
221 logmsg = string_cat(logmsg, US" [invalid - ");
222 switch (sig->verify_ext_status)
224 case PDKIM_VERIFY_INVALID_PUBKEY_UNAVAILABLE:
225 logmsg = string_cat(logmsg,
226 US"public key record (currently?) unavailable]");
229 case PDKIM_VERIFY_INVALID_BUFFER_SIZE:
230 logmsg = string_cat(logmsg, US"overlong public key record]");
233 case PDKIM_VERIFY_INVALID_PUBKEY_DNSRECORD:
234 case PDKIM_VERIFY_INVALID_PUBKEY_IMPORT:
235 logmsg = string_cat(logmsg, US"syntax error in public key record]");
238 case PDKIM_VERIFY_INVALID_SIGNATURE_ERROR:
239 logmsg = string_cat(logmsg, US"signature tag missing or invalid]");
242 case PDKIM_VERIFY_INVALID_DKIM_VERSION:
243 logmsg = string_cat(logmsg, US"unsupported DKIM version]");
247 logmsg = string_cat(logmsg, US"unspecified problem]");
251 case PDKIM_VERIFY_FAIL:
252 logmsg = string_cat(logmsg, US" [verification failed - ");
253 switch (sig->verify_ext_status)
255 case PDKIM_VERIFY_FAIL_BODY:
256 logmsg = string_cat(logmsg,
257 US"body hash mismatch (body probably modified in transit)]");
260 case PDKIM_VERIFY_FAIL_MESSAGE:
261 logmsg = string_cat(logmsg,
262 US"signature did not verify "
263 "(headers probably modified in transit)]");
267 logmsg = string_cat(logmsg, US"unspecified reason]");
271 case PDKIM_VERIFY_PASS:
272 logmsg = string_cat(logmsg, US" [verification succeeded]");
276 log_write(0, LOG_MAIN, "%s", string_from_gstring(logmsg));
281 /* Log a line for each signature */
283 dkim_exim_verify_log_all(void)
285 for (pdkim_signature * sig = dkim_signatures; sig; sig = sig->next)
286 dkim_exim_verify_log_sig(sig);
291 dkim_exim_verify_finish(void)
295 const uschar * errstr = NULL;
297 store_pool = POOL_PERM;
299 /* Delete eventual previous signature chain */
302 dkim_signatures = NULL;
304 if (dkim_collect_error)
306 log_write(0, LOG_MAIN,
307 "DKIM: Error during validation, disabling signature verification: %.100s",
309 f.dkim_disable_verify = TRUE;
313 dkim_collect_input = 0;
315 /* Finish DKIM operation and fetch link to signatures chain */
317 rc = pdkim_feed_finish(dkim_verify_ctx, (pdkim_signature **)&dkim_signatures,
319 if (rc != PDKIM_OK && errstr)
320 log_write(0, LOG_MAIN, "DKIM: validation error: %s", errstr);
322 /* Build a colon-separated list of signing domains (and identities, if present) in dkim_signers */
324 for (pdkim_signature * sig = dkim_signatures; sig; sig = sig->next)
326 if (sig->domain) g = string_append_listele(g, ':', sig->domain);
327 if (sig->identity) g = string_append_listele(g, ':', sig->identity);
330 if (g) dkim_signers = g->s;
333 store_pool = dkim_verify_oldpool;
338 /* Args as per dkim_exim_acl_run() below */
340 dkim_acl_call(uschar * id, gstring ** res_ptr,
341 uschar ** user_msgptr, uschar ** log_msgptr)
345 debug_printf("calling acl_smtp_dkim for dkim_cur_signer='%s'\n", id);
347 rc = acl_check(ACL_WHERE_DKIM, NULL, acl_smtp_dkim, user_msgptr, log_msgptr);
348 dkim_exim_verify_log_sig(dkim_cur_sig);
349 *res_ptr = string_append_listele(*res_ptr, ':', dkim_verify_status);
355 /* For the given identity, run the DKIM ACL once for each matching signature.
358 id Identity to look for in dkim signatures
359 res_ptr ptr to growable string-list of status results,
360 appended to per ACL run
361 user_msgptr where to put a user error (for SMTP response)
362 log_msgptr where to put a logging message (not for SMTP response)
364 Returns: OK access is granted by an ACCEPT verb
365 DISCARD access is granted by a DISCARD verb
366 FAIL access is denied
367 FAIL_DROP access is denied; drop the connection
368 DEFER can't tell at the moment
373 dkim_exim_acl_run(uschar * id, gstring ** res_ptr,
374 uschar ** user_msgptr, uschar ** log_msgptr)
379 dkim_verify_status = US"none";
380 dkim_verify_reason = US"";
381 dkim_cur_signer = id;
383 if (f.dkim_disable_verify || !id || !dkim_verify_ctx)
386 /* Find signatures to run ACL on */
388 for (pdkim_signature * sig = dkim_signatures; sig; sig = sig->next)
389 if ( (cmp_val = Ustrchr(id, '@') != NULL ? US sig->identity : US sig->domain)
390 && strcmpic(cmp_val, id) == 0
393 /* The "dkim_domain" and "dkim_selector" expansion variables have
394 related globals, since they are used in the signing code too.
395 Instead of inventing separate names for verification, we set
396 them here. This is easy since a domain and selector is guaranteed
397 to be in a signature. The other dkim_* expansion items are
398 dynamically fetched from dkim_cur_sig at expansion time (see
399 dkim_exim_expand_query() below). */
402 dkim_signing_domain = US sig->domain;
403 dkim_signing_selector = US sig->selector;
404 dkim_key_length = sig->sighash.len * 8;
406 /* These two return static strings, so we can compare the addr
407 later to see if the ACL overwrote them. Check that when logging */
409 dkim_verify_status = dkim_exim_expand_query(DKIM_VERIFY_STATUS);
410 dkim_verify_reason = dkim_exim_expand_query(DKIM_VERIFY_REASON);
412 if ((rc = dkim_acl_call(id, res_ptr, user_msgptr, log_msgptr)) != OK)
419 /* No matching sig found. Call ACL once anyway. */
422 return dkim_acl_call(id, res_ptr, user_msgptr, log_msgptr);
427 dkim_exim_expand_defaults(int what)
431 case DKIM_ALGO: return US"";
432 case DKIM_BODYLENGTH: return US"9999999999999";
433 case DKIM_CANON_BODY: return US"";
434 case DKIM_CANON_HEADERS: return US"";
435 case DKIM_COPIEDHEADERS: return US"";
436 case DKIM_CREATED: return US"0";
437 case DKIM_EXPIRES: return US"9999999999999";
438 case DKIM_HEADERNAMES: return US"";
439 case DKIM_IDENTITY: return US"";
440 case DKIM_KEY_GRANULARITY: return US"*";
441 case DKIM_KEY_SRVTYPE: return US"*";
442 case DKIM_KEY_NOTES: return US"";
443 case DKIM_KEY_TESTING: return US"0";
444 case DKIM_NOSUBDOMAINS: return US"0";
445 case DKIM_VERIFY_STATUS: return US"none";
446 case DKIM_VERIFY_REASON: return US"";
447 default: return US"";
453 dkim_exim_expand_query(int what)
455 if (!dkim_verify_ctx || f.dkim_disable_verify || !dkim_cur_sig)
456 return dkim_exim_expand_defaults(what);
461 return dkim_sig_to_a_tag(dkim_cur_sig);
463 case DKIM_BODYLENGTH:
464 return dkim_cur_sig->bodylength >= 0
465 ? string_sprintf("%ld", dkim_cur_sig->bodylength)
466 : dkim_exim_expand_defaults(what);
468 case DKIM_CANON_BODY:
469 switch (dkim_cur_sig->canon_body)
471 case PDKIM_CANON_RELAXED: return US"relaxed";
472 case PDKIM_CANON_SIMPLE:
473 default: return US"simple";
476 case DKIM_CANON_HEADERS:
477 switch (dkim_cur_sig->canon_headers)
479 case PDKIM_CANON_RELAXED: return US"relaxed";
480 case PDKIM_CANON_SIMPLE:
481 default: return US"simple";
484 case DKIM_COPIEDHEADERS:
485 return dkim_cur_sig->copiedheaders
486 ? US dkim_cur_sig->copiedheaders : dkim_exim_expand_defaults(what);
489 return dkim_cur_sig->created > 0
490 ? string_sprintf("%lu", dkim_cur_sig->created)
491 : dkim_exim_expand_defaults(what);
494 return dkim_cur_sig->expires > 0
495 ? string_sprintf("%lu", dkim_cur_sig->expires)
496 : dkim_exim_expand_defaults(what);
498 case DKIM_HEADERNAMES:
499 return dkim_cur_sig->headernames
500 ? dkim_cur_sig->headernames : dkim_exim_expand_defaults(what);
503 return dkim_cur_sig->identity
504 ? US dkim_cur_sig->identity : dkim_exim_expand_defaults(what);
506 case DKIM_KEY_GRANULARITY:
507 return dkim_cur_sig->pubkey
508 ? dkim_cur_sig->pubkey->granularity
509 ? US dkim_cur_sig->pubkey->granularity
510 : dkim_exim_expand_defaults(what)
511 : dkim_exim_expand_defaults(what);
513 case DKIM_KEY_SRVTYPE:
514 return dkim_cur_sig->pubkey
515 ? dkim_cur_sig->pubkey->srvtype
516 ? US dkim_cur_sig->pubkey->srvtype
517 : dkim_exim_expand_defaults(what)
518 : dkim_exim_expand_defaults(what);
521 return dkim_cur_sig->pubkey
522 ? dkim_cur_sig->pubkey->notes
523 ? US dkim_cur_sig->pubkey->notes
524 : dkim_exim_expand_defaults(what)
525 : dkim_exim_expand_defaults(what);
527 case DKIM_KEY_TESTING:
528 return dkim_cur_sig->pubkey
529 ? dkim_cur_sig->pubkey->testing
531 : dkim_exim_expand_defaults(what)
532 : dkim_exim_expand_defaults(what);
534 case DKIM_NOSUBDOMAINS:
535 return dkim_cur_sig->pubkey
536 ? dkim_cur_sig->pubkey->no_subdomaining
538 : dkim_exim_expand_defaults(what)
539 : dkim_exim_expand_defaults(what);
541 case DKIM_VERIFY_STATUS:
542 switch (dkim_cur_sig->verify_status)
544 case PDKIM_VERIFY_INVALID: return US"invalid";
545 case PDKIM_VERIFY_FAIL: return US"fail";
546 case PDKIM_VERIFY_PASS: return US"pass";
547 case PDKIM_VERIFY_NONE:
548 default: return US"none";
551 case DKIM_VERIFY_REASON:
552 switch (dkim_cur_sig->verify_ext_status)
554 case PDKIM_VERIFY_INVALID_PUBKEY_UNAVAILABLE:
555 return US"pubkey_unavailable";
556 case PDKIM_VERIFY_INVALID_PUBKEY_DNSRECORD:return US"pubkey_dns_syntax";
557 case PDKIM_VERIFY_INVALID_PUBKEY_IMPORT: return US"pubkey_der_syntax";
558 case PDKIM_VERIFY_FAIL_BODY: return US"bodyhash_mismatch";
559 case PDKIM_VERIFY_FAIL_MESSAGE: return US"signature_incorrect";
569 dkim_exim_sign_init(void)
571 int old_pool = store_pool;
572 store_pool = POOL_MAIN;
573 pdkim_init_context(&dkim_sign_ctx, FALSE, &dkim_exim_query_dns_txt);
574 store_pool = old_pool;
578 /* Generate signatures for the given file.
579 If a prefix is given, prepend it to the file for the calculations.
582 NULL: error; error string written
583 string: signature header(s), or a zero-length string (not an error)
587 dkim_exim_sign(int fd, off_t off, uschar * prefix,
588 struct ob_dkim * dkim, const uschar ** errstr)
590 const uschar * dkim_domain = NULL;
592 gstring * seen_doms = NULL;
593 pdkim_signature * sig;
599 int old_pool = store_pool;
603 if (dkim->dot_stuffed)
604 dkim_sign_ctx.flags |= PDKIM_DOT_TERM;
606 store_pool = POOL_MAIN;
608 if ((s = dkim->dkim_domain) && !(dkim_domain = expand_cstring(s)))
609 /* expansion error, do not send message. */
610 { errwhen = US"dkim_domain"; goto expand_bad; }
612 /* Set $dkim_domain expansion variable to each unique domain in list. */
615 while ((dkim_signing_domain = string_nextinlist(&dkim_domain, &sep, NULL, 0)))
617 const uschar * dkim_sel;
620 if (dkim_signing_domain[0] == '\0')
623 /* Only sign once for each domain, no matter how often it
624 appears in the expanded list. */
626 dkim_signing_domain = string_copylc(dkim_signing_domain);
627 if (match_isinlist(dkim_signing_domain, CUSS &seen_doms,
628 0, NULL, NULL, MCL_STRING, TRUE, NULL) == OK)
631 seen_doms = string_append_listele(seen_doms, ':', dkim_signing_domain);
633 /* Set $dkim_selector expansion variable to each selector in list,
636 if (!(dkim_sel = expand_string(dkim->dkim_selector)))
637 { errwhen = US"dkim_selector"; goto expand_bad; }
639 while ((dkim_signing_selector = string_nextinlist(&dkim_sel, &sel_sep,
642 uschar * dkim_canon_expanded;
644 uschar * dkim_sign_headers_expanded = NULL;
645 uschar * dkim_private_key_expanded;
646 uschar * dkim_hash_expanded;
647 uschar * dkim_identity_expanded = NULL;
648 uschar * dkim_timestamps_expanded = NULL;
649 unsigned long tval = 0, xval = 0;
651 /* Get canonicalization to use */
653 dkim_canon_expanded = dkim->dkim_canon
654 ? expand_string(dkim->dkim_canon) : US"relaxed";
655 if (!dkim_canon_expanded) /* expansion error, do not send message. */
656 { errwhen = US"dkim_canon"; goto expand_bad; }
658 if (Ustrcmp(dkim_canon_expanded, "relaxed") == 0)
659 pdkim_canon = PDKIM_CANON_RELAXED;
660 else if (Ustrcmp(dkim_canon_expanded, "simple") == 0)
661 pdkim_canon = PDKIM_CANON_SIMPLE;
664 log_write(0, LOG_MAIN,
665 "DKIM: unknown canonicalization method '%s', defaulting to 'relaxed'.\n",
666 dkim_canon_expanded);
667 pdkim_canon = PDKIM_CANON_RELAXED;
670 if ( dkim->dkim_sign_headers
671 && !(dkim_sign_headers_expanded = expand_string(dkim->dkim_sign_headers)))
672 { errwhen = US"dkim_sign_header"; goto expand_bad; }
673 /* else pass NULL, which means default header list */
675 /* Get private key to use. */
677 if (!(dkim_private_key_expanded = expand_string(dkim->dkim_private_key)))
678 { errwhen = US"dkim_private_key"; goto expand_bad; }
680 if ( Ustrlen(dkim_private_key_expanded) == 0
681 || Ustrcmp(dkim_private_key_expanded, "0") == 0
682 || Ustrcmp(dkim_private_key_expanded, "false") == 0
684 continue; /* don't sign, but no error */
686 if ( dkim_private_key_expanded[0] == '/'
687 && !(dkim_private_key_expanded =
688 expand_file_big_buffer(dkim_private_key_expanded)))
691 if (!(dkim_hash_expanded = expand_string(dkim->dkim_hash)))
692 { errwhen = US"dkim_hash"; goto expand_bad; }
694 if (dkim->dkim_identity)
695 if (!(dkim_identity_expanded = expand_string(dkim->dkim_identity)))
696 { errwhen = US"dkim_identity"; goto expand_bad; }
697 else if (!*dkim_identity_expanded)
698 dkim_identity_expanded = NULL;
700 if (dkim->dkim_timestamps)
701 if (!(dkim_timestamps_expanded = expand_string(dkim->dkim_timestamps)))
702 { errwhen = US"dkim_timestamps"; goto expand_bad; }
704 xval = (tval = (unsigned long) time(NULL))
705 + strtoul(CCS dkim_timestamps_expanded, NULL, 10);
707 if (!(sig = pdkim_init_sign(&dkim_sign_ctx, dkim_signing_domain,
708 dkim_signing_selector,
709 dkim_private_key_expanded,
714 dkim_private_key_expanded[0] = '\0';
716 pdkim_set_optional(sig,
717 CS dkim_sign_headers_expanded,
718 CS dkim_identity_expanded,
720 pdkim_canon, -1, tval, xval);
722 if (!pdkim_set_sig_bodyhash(&dkim_sign_ctx, sig))
725 if (!dkim_sign_ctx.sig) /* link sig to context chain */
726 dkim_sign_ctx.sig = sig;
729 pdkim_signature * n = dkim_sign_ctx.sig;
730 while (n->next) n = n->next;
736 /* We may need to carry on with the data-feed even if there are no DKIM sigs to
737 produce, if some other package (eg. ARC) is signing. */
739 if (!dkim_sign_ctx.sig && !dkim->force_bodyhash)
741 DEBUG(D_transport) debug_printf("DKIM: no viable signatures to use\n");
742 sigbuf = string_get(1); /* return a zero-len string */
746 if (prefix && (pdkim_rc = pdkim_feed(&dkim_sign_ctx, prefix, Ustrlen(prefix))) != PDKIM_OK)
749 if (lseek(fd, off, SEEK_SET) < 0)
752 while ((sread = read(fd, &buf, sizeof(buf))) > 0)
753 if ((pdkim_rc = pdkim_feed(&dkim_sign_ctx, buf, sread)) != PDKIM_OK)
756 /* Handle failed read above. */
759 debug_printf("DKIM: Error reading -K file.\n");
764 /* Build string of headers, one per signature */
766 if ((pdkim_rc = pdkim_feed_finish(&dkim_sign_ctx, &sig, errstr)) != PDKIM_OK)
771 DEBUG(D_transport) debug_printf("DKIM: no signatures to use\n");
772 sigbuf = string_get(1); /* return a zero-len string */
774 else for (sigbuf = NULL; sig; sig = sig->next)
775 sigbuf = string_append(sigbuf, 2, US sig->signature_header, US"\r\n");
779 (void) string_from_gstring(sigbuf);
780 store_pool = old_pool;
785 log_write(0, LOG_MAIN|LOG_PANIC,
786 "DKIM: signing failed: %.100s", pdkim_errstr(pdkim_rc));
792 *errstr = string_sprintf("failed to expand %s: %s",
793 errwhen, expand_string_message);
794 log_write(0, LOG_MAIN | LOG_PANIC, "%s", *errstr);
802 authres_dkim(gstring * g)
804 int start = 0; /* compiler quietening */
806 DEBUG(D_acl) start = g->ptr;
808 for (pdkim_signature * sig = dkim_signatures; sig; sig = sig->next)
810 g = string_catn(g, US";\n\tdkim=", 8);
812 if (sig->verify_status & PDKIM_VERIFY_POLICY)
813 g = string_append(g, 5,
814 US"policy (", dkim_verify_status, US" - ", dkim_verify_reason, US")");
815 else switch(sig->verify_status)
817 case PDKIM_VERIFY_NONE: g = string_cat(g, US"none"); break;
818 case PDKIM_VERIFY_INVALID:
819 switch (sig->verify_ext_status)
821 case PDKIM_VERIFY_INVALID_PUBKEY_UNAVAILABLE:
822 g = string_cat(g, US"tmperror (pubkey unavailable)\n\t\t"); break;
823 case PDKIM_VERIFY_INVALID_BUFFER_SIZE:
824 g = string_cat(g, US"permerror (overlong public key record)\n\t\t"); break;
825 case PDKIM_VERIFY_INVALID_PUBKEY_DNSRECORD:
826 case PDKIM_VERIFY_INVALID_PUBKEY_IMPORT:
827 g = string_cat(g, US"neutral (public key record import problem)\n\t\t");
829 case PDKIM_VERIFY_INVALID_SIGNATURE_ERROR:
830 g = string_cat(g, US"neutral (signature tag missing or invalid)\n\t\t");
832 case PDKIM_VERIFY_INVALID_DKIM_VERSION:
833 g = string_cat(g, US"neutral (unsupported DKIM version)\n\t\t");
836 g = string_cat(g, US"permerror (unspecified problem)\n\t\t"); break;
839 case PDKIM_VERIFY_FAIL:
840 switch (sig->verify_ext_status)
842 case PDKIM_VERIFY_FAIL_BODY:
844 US"fail (body hash mismatch; body probably modified in transit)\n\t\t");
846 case PDKIM_VERIFY_FAIL_MESSAGE:
848 US"fail (signature did not verify; headers probably modified in transit)\n\t\t");
851 g = string_cat(g, US"fail (unspecified reason)\n\t\t");
855 case PDKIM_VERIFY_PASS: g = string_cat(g, US"pass"); break;
856 default: g = string_cat(g, US"permerror"); break;
858 if (sig->domain) g = string_append(g, 2, US" header.d=", sig->domain);
859 if (sig->identity) g = string_append(g, 2, US" header.i=", sig->identity);
860 if (sig->selector) g = string_append(g, 2, US" header.s=", sig->selector);
861 g = string_append(g, 2, US" header.a=", dkim_sig_to_a_tag(sig));
866 debug_printf("DKIM: no authres\n");
868 debug_printf("DKIM: authres '%.*s'\n", g->ptr - start - 3, g->s + start + 3);
873 # endif /*!MACRO_PREDEF*/
874 #endif /*!DISABLE_DKIM*/