2 * PDKIM - a RFC4871 (DKIM) implementation
4 * Copyright (C) 2009 - 2016 Tom Kistner <tom@duncanthrax.net>
5 * Copyright (C) 2016 - 2020 Jeremy Harris <jgh@exim.org>
7 * http://duncanthrax.net/pdkim/
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 2 of the License, or
12 * (at your option) any later version.
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
19 * You should have received a copy of the GNU General Public License along
20 * with this program; if not, write to the Free Software Foundation, Inc.,
21 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
27 #ifndef DISABLE_DKIM /* entire file */
30 # error Must not DISABLE_TLS, for DKIM
33 #include "crypt_ver.h"
36 # include <openssl/rsa.h>
37 # include <openssl/ssl.h>
38 # include <openssl/err.h>
39 #elif defined(SIGN_GNUTLS)
40 # include <gnutls/gnutls.h>
41 # include <gnutls/x509.h>
47 #define PDKIM_SIGNATURE_VERSION "1"
48 #define PDKIM_PUB_RECORD_VERSION US "DKIM1"
50 #define PDKIM_MAX_HEADER_LEN 65536
51 #define PDKIM_MAX_HEADERS 512
52 #define PDKIM_MAX_BODY_LINE_LEN 16384
53 #define PDKIM_DNS_TXT_MAX_NAMELEN 1024
55 /* -------------------------------------------------------------------------- */
56 struct pdkim_stringlist {
62 /* -------------------------------------------------------------------------- */
63 /* A bunch of list constants */
64 const uschar * pdkim_querymethods[] = {
68 const uschar * pdkim_canons[] = {
74 const pdkim_hashtype pdkim_hashes[] = {
75 { US"sha1", HASH_SHA1 },
76 { US"sha256", HASH_SHA2_256 },
77 { US"sha512", HASH_SHA2_512 }
80 const uschar * pdkim_keytypes[] = {
81 [KEYTYPE_RSA] = US"rsa",
82 #ifdef SIGN_HAVE_ED25519
83 [KEYTYPE_ED25519] = US"ed25519", /* Works for 3.6.0 GnuTLS, OpenSSL 1.1.1 */
86 #ifdef notyet_EC_dkim_extensions /* https://tools.ietf.org/html/draft-srose-dkim-ecc-00 */
93 typedef struct pdkim_combined_canon_entry {
97 } pdkim_combined_canon_entry;
99 pdkim_combined_canon_entry pdkim_combined_canons[] = {
100 { US"simple/simple", PDKIM_CANON_SIMPLE, PDKIM_CANON_SIMPLE },
101 { US"simple/relaxed", PDKIM_CANON_SIMPLE, PDKIM_CANON_RELAXED },
102 { US"relaxed/simple", PDKIM_CANON_RELAXED, PDKIM_CANON_SIMPLE },
103 { US"relaxed/relaxed", PDKIM_CANON_RELAXED, PDKIM_CANON_RELAXED },
104 { US"simple", PDKIM_CANON_SIMPLE, PDKIM_CANON_SIMPLE },
105 { US"relaxed", PDKIM_CANON_RELAXED, PDKIM_CANON_SIMPLE },
110 static blob lineending = {.data = US"\r\n", .len = 2};
112 /* -------------------------------------------------------------------------- */
114 dkim_sig_to_a_tag(const pdkim_signature * sig)
116 if ( sig->keytype < 0 || sig->keytype > nelem(pdkim_keytypes)
117 || sig->hashtype < 0 || sig->hashtype > nelem(pdkim_hashes))
119 return string_sprintf("%s-%s",
120 pdkim_keytypes[sig->keytype], pdkim_hashes[sig->hashtype].dkim_hashname);
125 pdkim_keyname_to_keytype(const uschar * s)
127 for (int i = 0; i < nelem(pdkim_keytypes); i++)
128 if (Ustrcmp(s, pdkim_keytypes[i]) == 0) return i;
133 pdkim_hashname_to_hashtype(const uschar * s, unsigned len)
135 if (!len) len = Ustrlen(s);
136 for (int i = 0; i < nelem(pdkim_hashes); i++)
137 if (Ustrncmp(s, pdkim_hashes[i].dkim_hashname, len) == 0)
143 pdkim_cstring_to_canons(const uschar * s, unsigned len,
144 int * canon_head, int * canon_body)
146 if (!len) len = Ustrlen(s);
147 for (int i = 0; pdkim_combined_canons[i].str; i++)
148 if ( Ustrncmp(s, pdkim_combined_canons[i].str, len) == 0
149 && len == Ustrlen(pdkim_combined_canons[i].str))
151 *canon_head = pdkim_combined_canons[i].canon_headers;
152 *canon_body = pdkim_combined_canons[i].canon_body;
160 pdkim_verify_status_str(int status)
164 case PDKIM_VERIFY_NONE: return "PDKIM_VERIFY_NONE";
165 case PDKIM_VERIFY_INVALID: return "PDKIM_VERIFY_INVALID";
166 case PDKIM_VERIFY_FAIL: return "PDKIM_VERIFY_FAIL";
167 case PDKIM_VERIFY_PASS: return "PDKIM_VERIFY_PASS";
168 default: return "PDKIM_VERIFY_UNKNOWN";
173 pdkim_verify_ext_status_str(int ext_status)
177 case PDKIM_VERIFY_FAIL_BODY: return "PDKIM_VERIFY_FAIL_BODY";
178 case PDKIM_VERIFY_FAIL_MESSAGE: return "PDKIM_VERIFY_FAIL_MESSAGE";
179 case PDKIM_VERIFY_FAIL_SIG_ALGO_MISMATCH: return "PDKIM_VERIFY_FAIL_SIG_ALGO_MISMATCH";
180 case PDKIM_VERIFY_INVALID_PUBKEY_UNAVAILABLE: return "PDKIM_VERIFY_INVALID_PUBKEY_UNAVAILABLE";
181 case PDKIM_VERIFY_INVALID_BUFFER_SIZE: return "PDKIM_VERIFY_INVALID_BUFFER_SIZE";
182 case PDKIM_VERIFY_INVALID_PUBKEY_DNSRECORD: return "PDKIM_VERIFY_INVALID_PUBKEY_DNSRECORD";
183 case PDKIM_VERIFY_INVALID_PUBKEY_IMPORT: return "PDKIM_VERIFY_INVALID_PUBKEY_IMPORT";
184 case PDKIM_VERIFY_INVALID_PUBKEY_KEYSIZE: return "PDKIM_VERIFY_INVALID_PUBKEY_KEYSIZE";
185 case PDKIM_VERIFY_INVALID_SIGNATURE_ERROR: return "PDKIM_VERIFY_INVALID_SIGNATURE_ERROR";
186 case PDKIM_VERIFY_INVALID_DKIM_VERSION: return "PDKIM_VERIFY_INVALID_DKIM_VERSION";
187 default: return "PDKIM_VERIFY_UNKNOWN";
192 pdkim_errstr(int status)
196 case PDKIM_OK: return US"OK";
197 case PDKIM_FAIL: return US"FAIL";
198 case PDKIM_ERR_RSA_PRIVKEY: return US"PRIVKEY";
199 case PDKIM_ERR_RSA_SIGNING: return US"SIGNING";
200 case PDKIM_ERR_LONG_LINE: return US"LONG_LINE";
201 case PDKIM_ERR_BUFFER_TOO_SMALL: return US"BUFFER_TOO_SMALL";
202 case PDKIM_ERR_EXCESS_SIGS: return US"EXCESS_SIGS";
203 case PDKIM_SIGN_PRIVKEY_WRAP: return US"PRIVKEY_WRAP";
204 case PDKIM_SIGN_PRIVKEY_B64D: return US"PRIVKEY_B64D";
205 default: return US"(unknown)";
210 /* -------------------------------------------------------------------------- */
211 /* Print debugging functions */
213 pdkim_quoteprint(const uschar *data, int len)
215 for (int i = 0; i < len; i++)
217 const int c = data[i];
220 case ' ' : debug_printf("{SP}"); break;
221 case '\t': debug_printf("{TB}"); break;
222 case '\r': debug_printf("{CR}"); break;
223 case '\n': debug_printf("{LF}"); break;
224 case '{' : debug_printf("{BO}"); break;
225 case '}' : debug_printf("{BC}"); break;
227 if ( (c < 32) || (c > 127) )
228 debug_printf("{%02x}", c);
230 debug_printf("%c", c);
238 pdkim_hexprint(const uschar *data, int len)
240 if (data) for (int i = 0 ; i < len; i++) debug_printf("%02x", data[i]);
241 else debug_printf("<NULL>");
247 static pdkim_stringlist *
248 pdkim_prepend_stringlist(pdkim_stringlist * base, const uschar * str)
250 pdkim_stringlist * new_entry = store_get(sizeof(pdkim_stringlist), FALSE);
252 memset(new_entry, 0, sizeof(pdkim_stringlist));
253 new_entry->value = string_copy(str);
254 if (base) new_entry->next = base;
260 /* Trim whitespace fore & aft */
263 pdkim_strtrim(gstring * str)
268 while (*p == '\t' || *p == ' ') /* dump the leading whitespace */
269 { str->size--; str->ptr--; str->s++; }
272 && ((q = str->s + str->ptr - 1), (*q == '\t' || *q == ' '))
274 str->ptr--; /* dump trailing whitespace */
276 (void) string_from_gstring(str);
281 /* -------------------------------------------------------------------------- */
284 pdkim_free_ctx(pdkim_ctx *ctx)
289 /* -------------------------------------------------------------------------- */
290 /* Matches the name of the passed raw "header" against
291 the passed colon-separated "tick", and invalidates
292 the entry in tick. Entries can be prefixed for multi- or over-signing,
293 in which case do not invalidate.
295 Returns OK for a match, or fail-code
299 header_name_match(const uschar * header, uschar * tick)
301 const uschar * ticklist = tick;
304 uschar * hname, * p, * ele;
305 uschar * hcolon = Ustrchr(header, ':'); /* Get header name */
308 return PDKIM_FAIL; /* This isn't a header */
310 /* if we had strncmpic() we wouldn't need this copy */
311 hname = string_copyn(header, hcolon-header);
313 while (p = US ticklist, ele = string_nextinlist(&ticklist, &sep, NULL, 0))
317 case '=': case '+': multisign = TRUE; ele++; break;
318 default: multisign = FALSE; break;
321 if (strcmpic(ele, hname) == 0)
324 *p = '_'; /* Invalidate this header name instance in tick-off list */
332 /* -------------------------------------------------------------------------- */
333 /* Performs "relaxed" canonicalization of a header. */
336 pdkim_relax_header_n(const uschar * header, int len, BOOL append_crlf)
338 BOOL past_field_name = FALSE;
339 BOOL seen_wsp = FALSE;
340 uschar * relaxed = store_get(len+3, TRUE); /* tainted */
341 uschar * q = relaxed;
343 for (const uschar * p = header; p - header < len; p++)
347 if (c == '\r' || c == '\n') /* Ignore CR & LF */
349 if (c == '\t' || c == ' ')
353 c = ' '; /* Turns WSP into SP */
357 if (!past_field_name && c == ':')
359 if (seen_wsp) q--; /* This removes WSP immediately before the colon */
360 seen_wsp = TRUE; /* This removes WSP immediately after the colon */
361 past_field_name = TRUE;
366 /* Lowercase header name */
367 if (!past_field_name) c = tolower(c);
371 if (q > relaxed && q[-1] == ' ') q--; /* Squash eventual trailing SP */
373 if (append_crlf) { *q++ = '\r'; *q++ = '\n'; }
380 pdkim_relax_header(const uschar * header, BOOL append_crlf)
382 return pdkim_relax_header_n(header, Ustrlen(header), append_crlf);
386 /* -------------------------------------------------------------------------- */
387 #define PDKIM_QP_ERROR_DECODE -1
389 static const uschar *
390 pdkim_decode_qp_char(const uschar *qp_p, int *c)
392 const uschar *initial_pos = qp_p;
394 /* Advance one char */
397 /* Check for two hex digits and decode them */
398 if (isxdigit(*qp_p) && isxdigit(qp_p[1]))
400 /* Do hex conversion */
401 *c = (isdigit(*qp_p) ? *qp_p - '0' : toupper(*qp_p) - 'A' + 10) << 4;
402 *c |= isdigit(qp_p[1]) ? qp_p[1] - '0' : toupper(qp_p[1]) - 'A' + 10;
406 /* Illegal char here */
407 *c = PDKIM_QP_ERROR_DECODE;
412 /* -------------------------------------------------------------------------- */
415 pdkim_decode_qp(const uschar * str)
419 const uschar * p = str;
420 uschar * n = store_get(Ustrlen(str)+1, TRUE);
428 p = pdkim_decode_qp_char(p, &nchar);
444 /* -------------------------------------------------------------------------- */
447 pdkim_decode_base64(const uschar * str, blob * b)
449 int dlen = b64decode(str, &b->data);
450 if (dlen < 0) b->data = NULL;
455 pdkim_encode_base64(blob * b)
457 return b64encode(CUS b->data, b->len);
461 /* -------------------------------------------------------------------------- */
462 #define PDKIM_HDR_LIMBO 0
463 #define PDKIM_HDR_TAG 1
464 #define PDKIM_HDR_VALUE 2
466 static pdkim_signature *
467 pdkim_parse_sig_header(pdkim_ctx * ctx, uschar * raw_hdr)
469 pdkim_signature * sig;
471 gstring * cur_tag = NULL;
472 gstring * cur_val = NULL;
473 BOOL past_hname = FALSE;
474 BOOL in_b_val = FALSE;
475 int where = PDKIM_HDR_LIMBO;
477 sig = store_get(sizeof(pdkim_signature), FALSE);
478 memset(sig, 0, sizeof(pdkim_signature));
479 sig->bodylength = -1;
481 /* Set so invalid/missing data error display is accurate */
486 q = sig->rawsig_no_b_val = store_get(Ustrlen(raw_hdr)+1, TRUE); /* tainted */
488 for (uschar * p = raw_hdr; ; p++)
493 if (c == '\r' || c == '\n')
496 /* Fast-forward through header name */
499 if (c == ':') past_hname = TRUE;
503 if (where == PDKIM_HDR_LIMBO)
505 /* In limbo, just wait for a tag-char to appear */
506 if (!(c >= 'a' && c <= 'z'))
509 where = PDKIM_HDR_TAG;
512 if (where == PDKIM_HDR_TAG)
514 if (c >= 'a' && c <= 'z')
515 cur_tag = string_catn(cur_tag, p, 1);
519 if (Ustrcmp(string_from_gstring(cur_tag), "b") == 0)
524 where = PDKIM_HDR_VALUE;
529 if (where == PDKIM_HDR_VALUE)
531 if (c == '\r' || c == '\n' || c == ' ' || c == '\t')
534 if (c == ';' || c == '\0')
536 /* We must have both tag and value, and tags must be one char except
537 for the possibility of "bh". */
539 if ( cur_tag && cur_val
540 && (cur_tag->ptr == 1 || *cur_tag->s == 'b')
543 (void) string_from_gstring(cur_val);
544 pdkim_strtrim(cur_val);
546 DEBUG(D_acl) debug_printf(" %s=%s\n", cur_tag->s, cur_val->s);
550 case 'b': /* sig-data or body-hash */
551 switch (cur_tag->s[1])
553 case '\0': pdkim_decode_base64(cur_val->s, &sig->sighash); break;
554 case 'h': if (cur_tag->ptr == 2)
555 pdkim_decode_base64(cur_val->s, &sig->bodyhash);
560 case 'v': /* version */
561 /* We only support version 1, and that is currently the
562 only version there is. */
564 Ustrcmp(cur_val->s, PDKIM_SIGNATURE_VERSION) == 0 ? 1 : -1;
566 case 'a': /* algorithm */
568 const uschar * list = cur_val->s;
572 if ((elem = string_nextinlist(&list, &sep, NULL, 0)))
573 sig->keytype = pdkim_keyname_to_keytype(elem);
574 if ((elem = string_nextinlist(&list, &sep, NULL, 0)))
575 for (int i = 0; i < nelem(pdkim_hashes); i++)
576 if (Ustrcmp(elem, pdkim_hashes[i].dkim_hashname) == 0)
577 { sig->hashtype = i; break; }
580 case 'c': /* canonicalization */
581 pdkim_cstring_to_canons(cur_val->s, 0,
582 &sig->canon_headers, &sig->canon_body);
584 case 'q': /* Query method (for pubkey)*/
585 for (int i = 0; pdkim_querymethods[i]; i++)
586 if (Ustrcmp(cur_val->s, pdkim_querymethods[i]) == 0)
588 sig->querymethod = i; /* we never actually use this */
592 case 's': /* Selector */
593 sig->selector = string_copyn(cur_val->s, cur_val->ptr); break;
595 sig->domain = string_copyn(cur_val->s, cur_val->ptr); break;
597 sig->identity = pdkim_decode_qp(cur_val->s); break;
598 case 't': /* Timestamp */
599 sig->created = strtoul(CS cur_val->s, NULL, 10); break;
600 case 'x': /* Expiration */
601 sig->expires = strtoul(CS cur_val->s, NULL, 10); break;
602 case 'l': /* Body length count */
603 sig->bodylength = strtol(CS cur_val->s, NULL, 10); break;
604 case 'h': /* signed header fields */
605 sig->headernames = string_copyn(cur_val->s, cur_val->ptr); break;
606 case 'z': /* Copied headfields */
607 sig->copiedheaders = pdkim_decode_qp(cur_val->s); break;
608 /*XXX draft-ietf-dcrup-dkim-crypto-05 would need 'p' tag support
609 for rsafp signatures. But later discussion is dropping those. */
611 DEBUG(D_acl) debug_printf(" Unknown tag encountered\n");
615 cur_tag = cur_val = NULL;
617 where = PDKIM_HDR_LIMBO;
620 cur_val = string_catn(cur_val, p, 1);
631 if (sig->keytype < 0 || sig->hashtype < 0) /* Cannot verify this signature */
635 /* Chomp raw header. The final newline must not be added to the signature. */
636 while (--q > sig->rawsig_no_b_val && (*q == '\r' || *q == '\n'))
642 "DKIM >> Raw signature w/o b= tag value >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
643 pdkim_quoteprint(US sig->rawsig_no_b_val, Ustrlen(sig->rawsig_no_b_val));
645 "DKIM >> Sig size: %4u bits\n", (unsigned) sig->sighash.len*8);
647 "DKIM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n");
650 if (!pdkim_set_sig_bodyhash(ctx, sig))
657 /* -------------------------------------------------------------------------- */
660 pdkim_parse_pubkey_record(const uschar *raw_record)
666 pub = store_get(sizeof(pdkim_pubkey), TRUE); /* tainted */
667 memset(pub, 0, sizeof(pdkim_pubkey));
669 while ((ele = string_nextinlist(&raw_record, &sep, NULL, 0)))
673 if ((val = Ustrchr(ele, '=')))
675 int taglen = val++ - ele;
677 DEBUG(D_acl) debug_printf(" %.*s=%s\n", taglen, ele, val);
680 case 'v': pub->version = val; break;
681 case 'h': pub->hashes = val; break;
682 case 'k': pub->keytype = val; break;
683 case 'g': pub->granularity = val; break;
684 case 'n': pub->notes = pdkim_decode_qp(val); break;
685 case 'p': pdkim_decode_base64(val, &pub->key); break;
686 case 's': pub->srvtype = val; break;
687 case 't': if (Ustrchr(val, 'y')) pub->testing = 1;
688 if (Ustrchr(val, 's')) pub->no_subdomaining = 1;
690 default: DEBUG(D_acl) debug_printf(" Unknown tag encountered\n"); break;
695 /* Set fallback defaults */
697 pub->version = string_copy(PDKIM_PUB_RECORD_VERSION);
698 else if (Ustrcmp(pub->version, PDKIM_PUB_RECORD_VERSION) != 0)
700 DEBUG(D_acl) debug_printf(" Bad v= field\n");
704 if (!pub->granularity) pub->granularity = US"*";
705 if (!pub->keytype ) pub->keytype = US"rsa";
706 if (!pub->srvtype ) pub->srvtype = US"*";
712 DEBUG(D_acl) debug_printf(" Missing p= field\n");
717 /* -------------------------------------------------------------------------- */
719 /* Update one bodyhash with some additional data.
720 If we have to relax the data for this sig, return our copy of it. */
723 pdkim_update_ctx_bodyhash(pdkim_bodyhash * b, blob * orig_data, blob * relaxed_data)
725 const blob const * canon_data = orig_data;
728 /* Defaults to simple canon (no further treatment necessary) */
730 if (b->canon_method == PDKIM_CANON_RELAXED)
732 /* Relax the line if not done already */
735 BOOL seen_wsp = FALSE;
738 /* We want to be able to free this else we allocate
739 for the entire message which could be many MB. Since
740 we don't know what allocations the SHA routines might
741 do, not safe to use store_get()/store_reset(). */
743 relaxed_data = store_malloc(sizeof(blob) + orig_data->len+1);
744 relaxed_data->data = US (relaxed_data+1);
746 for (const uschar * p = orig_data->data, * r = p + orig_data->len; p < r; p++)
751 if (q > 0 && relaxed_data->data[q-1] == ' ')
754 else if (c == '\t' || c == ' ')
756 c = ' '; /* Turns WSP into SP */
763 relaxed_data->data[q++] = c;
765 relaxed_data->data[q] = '\0';
766 relaxed_data->len = q;
768 canon_data = relaxed_data;
771 /* Make sure we don't exceed the to-be-signed body length */
772 if ( b->bodylength >= 0
773 && b->signed_body_bytes + (unsigned long)canon_data->len > b->bodylength
775 len = b->bodylength - b->signed_body_bytes;
779 exim_sha_update(&b->body_hash_ctx, CUS canon_data->data, len);
780 b->signed_body_bytes += len;
781 DEBUG(D_acl) pdkim_quoteprint(canon_data->data, len);
788 /* -------------------------------------------------------------------------- */
791 pdkim_finish_bodyhash(pdkim_ctx * ctx)
793 for (pdkim_bodyhash * b = ctx->bodyhash; b; b = b->next) /* Finish hashes */
795 DEBUG(D_acl) debug_printf("DKIM: finish bodyhash %d/%d/%ld len %ld\n",
796 b->hashtype, b->canon_method, b->bodylength, b->signed_body_bytes);
797 exim_sha_finish(&b->body_hash_ctx, &b->bh);
800 /* Traverse all signatures */
801 for (pdkim_signature * sig = ctx->sig; sig; sig = sig->next)
803 pdkim_bodyhash * b = sig->calc_body_hash;
807 debug_printf("DKIM [%s] Body bytes (%s) hashed: %lu\n"
808 "DKIM [%s] Body %s computed: ",
809 sig->domain, pdkim_canons[b->canon_method], b->signed_body_bytes,
810 sig->domain, pdkim_hashes[b->hashtype].dkim_hashname);
811 pdkim_hexprint(CUS b->bh.data, b->bh.len);
814 /* SIGNING -------------------------------------------------------------- */
815 if (ctx->flags & PDKIM_MODE_SIGN)
817 /* If bodylength limit is set, and we have received less bytes
818 than the requested amount, effectively remove the limit tag. */
819 if (b->signed_body_bytes < sig->bodylength)
820 sig->bodylength = -1;
824 /* VERIFICATION --------------------------------------------------------- */
825 /* Be careful that the header sig included a bodyash */
827 if ( sig->bodyhash.data
828 && memcmp(b->bh.data, sig->bodyhash.data, b->bh.len) == 0)
830 DEBUG(D_acl) debug_printf("DKIM [%s] Body hash compared OK\n", sig->domain);
836 debug_printf("DKIM [%s] Body hash signature from headers: ", sig->domain);
837 pdkim_hexprint(sig->bodyhash.data, sig->bodyhash.len);
838 debug_printf("DKIM [%s] Body hash did NOT verify\n", sig->domain);
840 sig->verify_status = PDKIM_VERIFY_FAIL;
841 sig->verify_ext_status = PDKIM_VERIFY_FAIL_BODY;
849 pdkim_body_complete(pdkim_ctx * ctx)
851 /* In simple body mode, if any empty lines were buffered,
852 replace with one. rfc 4871 3.4.3 */
853 /*XXX checking the signed-body-bytes is a gross hack; I think
854 it indicates that all linebreaks should be buffered, including
855 the one terminating a text line */
857 for (pdkim_bodyhash * b = ctx->bodyhash; b; b = b->next)
858 if ( b->canon_method == PDKIM_CANON_SIMPLE
859 && b->signed_body_bytes == 0
860 && b->num_buffered_blanklines > 0
862 (void) pdkim_update_ctx_bodyhash(b, &lineending, NULL);
864 ctx->flags |= PDKIM_SEEN_EOD;
865 ctx->linebuf_offset = 0;
870 /* -------------------------------------------------------------------------- */
871 /* Call from pdkim_feed below for processing complete body lines */
872 /* NOTE: the line is not NUL-terminated; but we have a count */
875 pdkim_bodyline_complete(pdkim_ctx * ctx)
877 blob line = {.data = ctx->linebuf, .len = ctx->linebuf_offset};
881 /* Ignore extra data if we've seen the end-of-data marker */
882 if (ctx->flags & PDKIM_SEEN_EOD) goto all_skip;
884 /* We've always got one extra byte to stuff a zero ... */
885 ctx->linebuf[line.len] = '\0';
887 /* Terminate on EOD marker */
888 if (ctx->flags & PDKIM_DOT_TERM)
890 if (memcmp(line.data, ".\r\n", 3) == 0)
891 { pdkim_body_complete(ctx); return; }
894 if (memcmp(line.data, "..", 2) == 0)
895 { line.data++; line.len--; }
898 /* Empty lines need to be buffered until we find a non-empty line */
899 if (memcmp(line.data, "\r\n", 2) == 0)
901 for (pdkim_bodyhash * b = ctx->bodyhash; b; b = b->next)
902 b->num_buffered_blanklines++;
906 /* Process line for each bodyhash separately */
907 for (pdkim_bodyhash * b = ctx->bodyhash; b; b = b->next)
909 if (b->canon_method == PDKIM_CANON_RELAXED)
911 /* Lines with just spaces need to be buffered too */
912 uschar * cp = line.data;
917 if (c == '\r' && cp[1] == '\n') break;
918 if (c != ' ' && c != '\t') goto hash_process;
922 b->num_buffered_blanklines++;
927 /* At this point, we have a non-empty line, so release the buffered ones. */
929 while (b->num_buffered_blanklines)
931 rnl = pdkim_update_ctx_bodyhash(b, &lineending, rnl);
932 b->num_buffered_blanklines--;
935 rline = pdkim_update_ctx_bodyhash(b, &line, rline);
939 if (rnl) store_free(rnl);
940 if (rline) store_free(rline);
944 ctx->linebuf_offset = 0;
949 /* -------------------------------------------------------------------------- */
950 /* Callback from pdkim_feed below for processing complete headers */
951 #define DKIM_SIGNATURE_HEADERNAME "DKIM-Signature:"
954 pdkim_header_complete(pdkim_ctx * ctx)
956 if ( (ctx->cur_header->ptr > 1) &&
957 (ctx->cur_header->s[ctx->cur_header->ptr-1] == '\r') )
958 --ctx->cur_header->ptr;
959 (void) string_from_gstring(ctx->cur_header);
961 #ifdef EXPERIMENTAL_ARC
962 /* Feed the header line to ARC processing */
963 (void) arc_header_feed(ctx->cur_header, !(ctx->flags & PDKIM_MODE_SIGN));
966 if (++ctx->num_headers > PDKIM_MAX_HEADERS) goto BAIL;
968 /* SIGNING -------------------------------------------------------------- */
969 if (ctx->flags & PDKIM_MODE_SIGN)
970 for (pdkim_signature * sig = ctx->sig; sig; sig = sig->next) /* Traverse all signatures */
972 /* Add header to the signed headers list (in reverse order) */
973 sig->headers = pdkim_prepend_stringlist(sig->headers, ctx->cur_header->s);
975 /* VERIFICATION ----------------------------------------------------------- */
976 /* DKIM-Signature: headers are added to the verification list */
982 debug_printf("DKIM >> raw hdr: ");
983 pdkim_quoteprint(CUS ctx->cur_header->s, ctx->cur_header->ptr);
986 if (strncasecmp(CCS ctx->cur_header->s,
987 DKIM_SIGNATURE_HEADERNAME,
988 Ustrlen(DKIM_SIGNATURE_HEADERNAME)) == 0)
990 pdkim_signature * sig, * last_sig;
991 /* Create and chain new signature block. We could error-check for all
992 required tags here, but prefer to create the internal sig and expicitly
993 fail verification of it later. */
995 DEBUG(D_acl) debug_printf(
996 "DKIM >> Found sig, trying to parse >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
998 sig = pdkim_parse_sig_header(ctx, ctx->cur_header->s);
1000 if (!(last_sig = ctx->sig))
1004 while (last_sig->next) last_sig = last_sig->next;
1005 last_sig->next = sig;
1008 if (dkim_collect_input && --dkim_collect_input == 0)
1010 ctx->headers = pdkim_prepend_stringlist(ctx->headers, ctx->cur_header->s);
1011 ctx->cur_header->s[ctx->cur_header->ptr = 0] = '\0';
1012 return PDKIM_ERR_EXCESS_SIGS;
1016 /* all headers are stored for signature verification */
1017 ctx->headers = pdkim_prepend_stringlist(ctx->headers, ctx->cur_header->s);
1021 ctx->cur_header->s[ctx->cur_header->ptr = 0] = '\0'; /* leave buffer for reuse */
1027 /* -------------------------------------------------------------------------- */
1028 #define HEADER_BUFFER_FRAG_SIZE 256
1031 pdkim_feed(pdkim_ctx * ctx, uschar * data, int len)
1033 /* Alternate EOD signal, used in non-dotstuffing mode */
1035 pdkim_body_complete(ctx);
1037 else for (int p = 0; p < len; p++)
1042 if (ctx->flags & PDKIM_PAST_HDRS)
1044 if (c == '\n' && !(ctx->flags & PDKIM_SEEN_CR)) /* emulate the CR */
1046 ctx->linebuf[ctx->linebuf_offset++] = '\r';
1047 if (ctx->linebuf_offset == PDKIM_MAX_BODY_LINE_LEN-1)
1048 return PDKIM_ERR_LONG_LINE;
1051 /* Processing body byte */
1052 ctx->linebuf[ctx->linebuf_offset++] = c;
1054 ctx->flags |= PDKIM_SEEN_CR;
1057 ctx->flags &= ~PDKIM_SEEN_CR;
1058 pdkim_bodyline_complete(ctx);
1061 if (ctx->linebuf_offset == PDKIM_MAX_BODY_LINE_LEN-1)
1062 return PDKIM_ERR_LONG_LINE;
1066 /* Processing header byte */
1068 ctx->flags |= PDKIM_SEEN_CR;
1071 if (!(ctx->flags & PDKIM_SEEN_CR)) /* emulate the CR */
1072 ctx->cur_header = string_catn(ctx->cur_header, CUS "\r", 1);
1074 if (ctx->flags & PDKIM_SEEN_LF) /* Seen last header line */
1076 if ((rc = pdkim_header_complete(ctx)) != PDKIM_OK)
1079 ctx->flags = (ctx->flags & ~(PDKIM_SEEN_LF|PDKIM_SEEN_CR)) | PDKIM_PAST_HDRS;
1080 DEBUG(D_acl) debug_printf(
1081 "DKIM >> Body data for hash, canonicalized >>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1085 ctx->flags = (ctx->flags & ~PDKIM_SEEN_CR) | PDKIM_SEEN_LF;
1087 else if (ctx->flags & PDKIM_SEEN_LF)
1089 if (!(c == '\t' || c == ' ')) /* End of header */
1090 if ((rc = pdkim_header_complete(ctx)) != PDKIM_OK)
1092 ctx->flags &= ~PDKIM_SEEN_LF;
1095 if (!ctx->cur_header || ctx->cur_header->ptr < PDKIM_MAX_HEADER_LEN)
1096 ctx->cur_header = string_catn(ctx->cur_header, CUS &data[p], 1);
1104 /* Extend a growing header with a continuation-linebreak */
1106 pdkim_hdr_cont(gstring * str, int * col)
1109 return string_catn(str, US"\r\n\t", 3);
1115 * RFC 5322 specifies that header line length SHOULD be no more than 78
1118 * Returns gstring (not nul-terminated) appending to one supplied
1120 * col: this int holds and receives column number (octets since last '\n')
1121 * str: partial string to append to
1122 * pad: padding, split line or space after before or after eg: ";".
1123 * Only the initial charater is used.
1124 * intro: - must join to payload eg "h=", usually the tag name
1125 * payload: eg base64 data - long data can be split arbitrarily.
1127 * this code doesn't fold the header in some of the places that RFC4871
1128 * allows: As per RFC5322(2.2.3) it only folds before or after tag-value
1129 * pairs and inside long values. it also always spaces or breaks after the
1132 * No guarantees are made for output given out-of range input. like tag
1133 * names longer than 78, or bogus col. Input is assumed to be free of line breaks.
1137 pdkim_headcat(int * col, gstring * str,
1138 const uschar * pad, const uschar * intro, const uschar * payload)
1140 int len, chomp, padded = 0;
1142 /* If we can fit at least the pad at the end of current line, do it now.
1143 Otherwise, wrap if there is a pad. */
1148 str = string_catn(str, pad, 1);
1154 str = pdkim_hdr_cont(str, col);
1156 /* Special case: if the whole addition does not fit at the end of the current
1157 line, but could fit on a new line, wrap to give it its full, dedicated line. */
1159 len = (pad ? 2 : padded)
1160 + (intro ? Ustrlen(intro) : 0)
1161 + (payload ? Ustrlen(payload) : 0);
1162 if (len <= 77 && *col+len > 78)
1164 str = pdkim_hdr_cont(str, col);
1168 /* Either we already dealt with the pad or we know there is room */
1172 str = string_catn(str, pad, 1);
1173 str = string_catn(str, US" ", 1);
1176 else if (padded && *col < 78)
1178 str = string_catn(str, US" ", 1);
1182 /* Call recursively with intro as payload: it gets the same, special treatment
1183 (that is, not split if < 78). */
1186 str = pdkim_headcat(col, str, NULL, NULL, intro);
1189 for (len = Ustrlen(payload); len; len -= chomp)
1192 str = pdkim_hdr_cont(str, col);
1193 chomp = *col+len > 78 ? 78 - *col : len;
1194 str = string_catn(str, payload, chomp);
1203 /* -------------------------------------------------------------------------- */
1205 /* Signing: create signature header
1208 pdkim_create_header(pdkim_signature * sig, BOOL final)
1214 gstring * canon_all;
1216 canon_all = string_cat (NULL, pdkim_canons[sig->canon_headers]);
1217 canon_all = string_catn(canon_all, US"/", 1);
1218 canon_all = string_cat (canon_all, pdkim_canons[sig->canon_body]);
1219 (void) string_from_gstring(canon_all);
1221 hdr = string_cat(NULL, US"DKIM-Signature: v="PDKIM_SIGNATURE_VERSION);
1224 /* Required and static bits */
1225 hdr = pdkim_headcat(&col, hdr, US";", US"a=", dkim_sig_to_a_tag(sig));
1226 hdr = pdkim_headcat(&col, hdr, US";", US"q=", pdkim_querymethods[sig->querymethod]);
1227 hdr = pdkim_headcat(&col, hdr, US";", US"c=", canon_all->s);
1228 hdr = pdkim_headcat(&col, hdr, US";", US"d=", sig->domain);
1229 hdr = pdkim_headcat(&col, hdr, US";", US"s=", sig->selector);
1231 /* list of header names can be split between items. */
1233 uschar * n = string_copy(sig->headernames);
1234 uschar * i = US"h=";
1239 uschar * c = Ustrchr(n, ':');
1244 hdr = pdkim_headcat(&col, hdr, NULL, NULL, US":");
1246 hdr = pdkim_headcat(&col, hdr, s, i, n);
1257 base64_bh = pdkim_encode_base64(&sig->calc_body_hash->bh);
1258 hdr = pdkim_headcat(&col, hdr, US";", US"bh=", base64_bh);
1262 hdr = pdkim_headcat(&col, hdr, US";", US"i=", sig->identity);
1264 if (sig->created > 0)
1268 snprintf(CS minibuf, sizeof(minibuf), "%lu", sig->created);
1269 hdr = pdkim_headcat(&col, hdr, US";", US"t=", minibuf);
1272 if (sig->expires > 0)
1276 snprintf(CS minibuf, sizeof(minibuf), "%lu", sig->expires);
1277 hdr = pdkim_headcat(&col, hdr, US";", US"x=", minibuf);
1280 if (sig->bodylength >= 0)
1284 snprintf(CS minibuf, sizeof(minibuf), "%lu", sig->bodylength);
1285 hdr = pdkim_headcat(&col, hdr, US";", US"l=", minibuf);
1288 /* Preliminary or final version? */
1291 base64_b = pdkim_encode_base64(&sig->sighash);
1292 hdr = pdkim_headcat(&col, hdr, US";", US"b=", base64_b);
1294 /* add trailing semicolon: I'm not sure if this is actually needed */
1295 hdr = pdkim_headcat(&col, hdr, NULL, US";", US"");
1299 /* To satisfy the rule "all surrounding whitespace [...] deleted"
1300 ( RFC 6376 section 3.7 ) we ensure there is no whitespace here. Otherwise
1301 the headcat routine could insert a linebreak which the relaxer would reduce
1302 to a single space preceding the terminating semicolon, resulting in an
1303 incorrect header-hash. */
1304 hdr = pdkim_headcat(&col, hdr, US";", US"b=;", US"");
1307 return string_from_gstring(hdr);
1311 /* -------------------------------------------------------------------------- */
1313 /* According to draft-ietf-dcrup-dkim-crypto-07 "keys are 256 bits" (referring
1314 to DNS, hence the pubkey). Check for more than 32 bytes; if so assume the
1315 alternate possible representation (still) being discussed: a
1316 SubjectPublickeyInfo wrapped key - and drop all but the trailing 32-bytes (it
1317 should be a DER, with exactly 12 leading bytes - but we could accept a BER also,
1318 which could be any size). We still rely on the crypto library for checking for
1321 When the RFC is published this should be re-addressed. */
1324 check_bare_ed25519_pubkey(pdkim_pubkey * p)
1326 int excess = p->key.len - 32;
1330 debug_printf("DKIM: unexpected pubkey len %lu\n", (unsigned long) p->key.len);
1331 p->key.data += excess; p->key.len = 32;
1336 static pdkim_pubkey *
1337 pdkim_key_from_dns(pdkim_ctx * ctx, pdkim_signature * sig, ev_ctx * vctx,
1338 const uschar ** errstr)
1340 uschar * dns_txt_name, * dns_txt_reply;
1343 /* Fetch public key for signing domain, from DNS */
1345 dns_txt_name = string_sprintf("%s._domainkey.%s.", sig->selector, sig->domain);
1347 if ( !(dns_txt_reply = ctx->dns_txt_callback(dns_txt_name))
1348 || dns_txt_reply[0] == '\0'
1351 sig->verify_status = PDKIM_VERIFY_INVALID;
1352 sig->verify_ext_status = PDKIM_VERIFY_INVALID_PUBKEY_UNAVAILABLE;
1359 "DKIM >> Parsing public key record >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n"
1363 pdkim_quoteprint(CUS dns_txt_reply, Ustrlen(dns_txt_reply));
1366 if ( !(p = pdkim_parse_pubkey_record(CUS dns_txt_reply))
1367 || (Ustrcmp(p->srvtype, "*") != 0 && Ustrcmp(p->srvtype, "email") != 0)
1370 sig->verify_status = PDKIM_VERIFY_INVALID;
1371 sig->verify_ext_status = PDKIM_VERIFY_INVALID_PUBKEY_DNSRECORD;
1376 debug_printf(" Invalid public key service type '%s'\n", p->srvtype);
1378 debug_printf(" Error while parsing public key record\n");
1380 "DKIM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n");
1385 DEBUG(D_acl) debug_printf(
1386 "DKIM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n");
1388 /* Import public key */
1390 /* Normally we use the signature a= tag to tell us the pubkey format.
1391 When signing under debug we do a test-import of the pubkey, and at that
1392 time we do not have a signature so we must interpret the pubkey k= tag
1393 instead. Assume writing on the sig is ok in that case. */
1395 if (sig->keytype < 0)
1396 if ((sig->keytype = pdkim_keyname_to_keytype(p->keytype)) < 0)
1398 DEBUG(D_acl) debug_printf("verify_init: unhandled keytype %s\n", p->keytype);
1399 sig->verify_status = PDKIM_VERIFY_INVALID;
1400 sig->verify_ext_status = PDKIM_VERIFY_INVALID_PUBKEY_IMPORT;
1404 if (sig->keytype == KEYTYPE_ED25519)
1405 check_bare_ed25519_pubkey(p);
1407 if ((*errstr = exim_dkim_verify_init(&p->key,
1408 sig->keytype == KEYTYPE_ED25519 ? KEYFMT_ED25519_BARE : KEYFMT_DER,
1409 vctx, &sig->keybits)))
1411 DEBUG(D_acl) debug_printf("verify_init: %s\n", *errstr);
1412 sig->verify_status = PDKIM_VERIFY_INVALID;
1413 sig->verify_ext_status = PDKIM_VERIFY_INVALID_PUBKEY_IMPORT;
1417 vctx->keytype = sig->keytype;
1422 /* -------------------------------------------------------------------------- */
1423 /* Sort and filter the sigs developed from the message */
1425 static pdkim_signature *
1426 sort_sig_methods(pdkim_signature * siglist)
1428 pdkim_signature * yield, ** ss;
1429 const uschar * prefs;
1433 if (!siglist) return NULL;
1435 /* first select in order of hashtypes */
1436 DEBUG(D_acl) debug_printf("DKIM: dkim_verify_hashes '%s'\n", dkim_verify_hashes);
1437 for (prefs = dkim_verify_hashes, sep = 0, yield = NULL, ss = &yield;
1438 ele = string_nextinlist(&prefs, &sep, NULL, 0); )
1440 int i = pdkim_hashname_to_hashtype(CUS ele, 0);
1441 for (pdkim_signature * s = siglist, * next, ** prev = &siglist; s;
1445 if (s->hashtype == i)
1446 { *prev = next; s->next = NULL; *ss = s; ss = &s->next; }
1452 /* then in order of keytypes */
1454 DEBUG(D_acl) debug_printf("DKIM: dkim_verify_keytypes '%s'\n", dkim_verify_keytypes);
1455 for (prefs = dkim_verify_keytypes, sep = 0, yield = NULL, ss = &yield;
1456 ele = string_nextinlist(&prefs, &sep, NULL, 0); )
1458 int i = pdkim_keyname_to_keytype(CUS ele);
1459 for (pdkim_signature * s = siglist, * next, ** prev = &siglist; s;
1463 if (s->keytype == i)
1464 { *prev = next; s->next = NULL; *ss = s; ss = &s->next; }
1470 DEBUG(D_acl) for (pdkim_signature * s = yield; s; s = s->next)
1471 debug_printf(" retain d=%s s=%s a=%s\n",
1472 s->domain, s->selector, dkim_sig_to_a_tag(s));
1477 /* -------------------------------------------------------------------------- */
1480 pdkim_feed_finish(pdkim_ctx * ctx, pdkim_signature ** return_signatures,
1481 const uschar ** err)
1483 BOOL verify_pass = FALSE;
1485 /* Check if we must still flush a (partial) header. If that is the
1486 case, the message has no body, and we must compute a body hash
1487 out of '<CR><LF>' */
1488 if (ctx->cur_header && ctx->cur_header->ptr > 0)
1493 if ((rc = pdkim_header_complete(ctx)) != PDKIM_OK)
1496 for (pdkim_bodyhash * b = ctx->bodyhash; b; b = b->next)
1497 rnl = pdkim_update_ctx_bodyhash(b, &lineending, rnl);
1498 if (rnl) store_free(rnl);
1501 DEBUG(D_acl) debug_printf(
1502 "DKIM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n");
1504 /* Build (and/or evaluate) body hash. Do this even if no DKIM sigs, in case we
1505 have a hash to do for ARC. */
1507 pdkim_finish_bodyhash(ctx);
1509 /* Sort and filter the recived signatures */
1511 if (!(ctx->flags & PDKIM_MODE_SIGN))
1512 ctx->sig = sort_sig_methods(ctx->sig);
1516 DEBUG(D_acl) debug_printf("DKIM: no signatures\n");
1517 *return_signatures = NULL;
1521 for (pdkim_signature * sig = ctx->sig; sig; sig = sig->next)
1524 uschar * sig_hdr = US"";
1526 gstring * hdata = NULL;
1529 if ( !(ctx->flags & PDKIM_MODE_SIGN)
1530 && sig->verify_status == PDKIM_VERIFY_FAIL)
1533 debug_printf("DKIM: [%s] abandoning this signature\n", sig->domain);
1537 /*XXX The hash of the headers is needed for GCrypt (for which we can do RSA
1538 signing only, as it happens) and for either GnuTLS and OpenSSL when we are
1539 signing with EC (specifically, Ed25519). The former is because the GCrypt
1540 signing operation is pure (does not do its own hash) so we must hash. The
1541 latter is because we (stupidly, but this is what the IETF draft is saying)
1542 must hash with the declared hash method, then pass the result to the library
1543 hash-and-sign routine (because that's all the libraries are providing. And
1544 we're stuck with whatever that hidden hash method is, too). We may as well
1545 do this hash incrementally.
1546 We don't need the hash we're calculating here for the GnuTLS and OpenSSL
1547 cases of RSA signing, since those library routines can do hash-and-sign.
1549 Some time in the future we could easily avoid doing the hash here for those
1550 cases (which will be common for a long while. We could also change from
1551 the current copy-all-the-headers-into-one-block, then call the hash-and-sign
1552 implementation - to a proper incremental one. Unfortunately, GnuTLS just
1553 cannot do incremental - either signing or verification. Unsure about GCrypt.
1556 /*XXX The header hash is also used (so far) by the verify operation */
1558 if (!exim_sha_init(&hhash_ctx, pdkim_hashes[sig->hashtype].exim_hashmethod))
1560 log_write(0, LOG_MAIN|LOG_PANIC,
1561 "DKIM: hash setup error, possibly nonhandled hashtype");
1565 if (ctx->flags & PDKIM_MODE_SIGN)
1566 DEBUG(D_acl) debug_printf(
1567 "DKIM >> Headers to be signed: >>>>>>>>>>>>\n"
1571 DEBUG(D_acl) debug_printf(
1572 "DKIM >> Header data for hash, canonicalized (%-7s), in sequence >>\n",
1573 pdkim_canons[sig->canon_headers]);
1576 /* SIGNING ---------------------------------------------------------------- */
1577 /* When signing, walk through our header list and add them to the hash. As we
1578 go, construct a list of the header's names to use for the h= parameter.
1579 Then append to that list any remaining header names for which there was no
1582 if (ctx->flags & PDKIM_MODE_SIGN)
1589 /* Import private key, including the keytype which we need for building
1590 the signature header */
1592 if ((*err = exim_dkim_signing_init(CUS sig->privkey, &sctx)))
1594 log_write(0, LOG_MAIN|LOG_PANIC, "signing_init: %s", *err);
1595 return PDKIM_ERR_RSA_PRIVKEY;
1597 sig->keytype = sctx.keytype;
1599 sig->headernames = NULL; /* Collected signed header names */
1600 for (pdkim_stringlist * p = sig->headers; p; p = p->next)
1602 uschar * rh = p->value;
1604 if (header_name_match(rh, sig->sign_headers) == PDKIM_OK)
1606 /* Collect header names (Note: colon presence is guaranteed here) */
1607 g = string_append_listele_n(g, ':', rh, Ustrchr(rh, ':') - rh);
1609 if (sig->canon_headers == PDKIM_CANON_RELAXED)
1610 rh = pdkim_relax_header(rh, TRUE); /* cook header for relaxed canon */
1612 /* Feed header to the hash algorithm */
1613 exim_sha_update(&hhash_ctx, CUS rh, Ustrlen(rh));
1615 /* Remember headers block for signing (when the library cannot do incremental) */
1616 /*XXX we could avoid doing this for all but the GnuTLS/RSA case */
1617 hdata = exim_dkim_data_append(hdata, rh);
1619 DEBUG(D_acl) pdkim_quoteprint(rh, Ustrlen(rh));
1623 /* Any headers we wanted to sign but were not present must also be listed.
1624 Ignore elements that have been ticked-off or are marked as never-oversign. */
1626 l = sig->sign_headers;
1627 while((s = string_nextinlist(&l, &sep, NULL, 0)))
1629 if (*s == '+') /* skip oversigning marker */
1631 if (*s != '_' && *s != '=')
1632 g = string_append_listele(g, ':', s);
1634 sig->headernames = string_from_gstring(g);
1636 /* Create signature header with b= omitted */
1637 sig_hdr = pdkim_create_header(sig, FALSE);
1640 /* VERIFICATION ----------------------------------------------------------- */
1641 /* When verifying, walk through the header name list in the h= parameter and
1642 add the headers to the hash in that order. */
1645 uschar * p = sig->headernames;
1651 for (pdkim_stringlist * hdrs = ctx->headers; hdrs; hdrs = hdrs->next)
1657 if ((q = Ustrchr(p, ':')))
1660 /*XXX walk the list of headers in same order as received. */
1661 for (pdkim_stringlist * hdrs = ctx->headers; hdrs; hdrs = hdrs->next)
1663 && strncasecmp(CCS hdrs->value, CCS p, Ustrlen(p)) == 0
1664 && (hdrs->value)[Ustrlen(p)] == ':'
1667 /* cook header for relaxed canon, or just copy it for simple */
1669 uschar * rh = sig->canon_headers == PDKIM_CANON_RELAXED
1670 ? pdkim_relax_header(hdrs->value, TRUE)
1671 : string_copy(CUS hdrs->value);
1673 /* Feed header to the hash algorithm */
1674 exim_sha_update(&hhash_ctx, CUS rh, Ustrlen(rh));
1676 DEBUG(D_acl) pdkim_quoteprint(rh, Ustrlen(rh));
1685 sig_hdr = string_copy(sig->rawsig_no_b_val);
1689 DEBUG(D_acl) debug_printf(
1690 "DKIM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n");
1695 "DKIM >> Signed DKIM-Signature header, pre-canonicalized >>>>>>>>>>>>>\n");
1696 pdkim_quoteprint(CUS sig_hdr, Ustrlen(sig_hdr));
1698 "DKIM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n");
1701 /* Relax header if necessary */
1702 if (sig->canon_headers == PDKIM_CANON_RELAXED)
1703 sig_hdr = pdkim_relax_header(sig_hdr, FALSE);
1707 debug_printf("DKIM >> Signed DKIM-Signature header, canonicalized (%-7s) >>>>>>>\n",
1708 pdkim_canons[sig->canon_headers]);
1709 pdkim_quoteprint(CUS sig_hdr, Ustrlen(sig_hdr));
1711 "DKIM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n");
1714 /* Finalize header hash */
1715 exim_sha_update(&hhash_ctx, CUS sig_hdr, Ustrlen(sig_hdr));
1716 exim_sha_finish(&hhash_ctx, &hhash);
1720 debug_printf("DKIM [%s] Header %s computed: ",
1721 sig->domain, pdkim_hashes[sig->hashtype].dkim_hashname);
1722 pdkim_hexprint(hhash.data, hhash.len);
1725 /* Remember headers block for signing (when the signing library cannot do
1727 if (ctx->flags & PDKIM_MODE_SIGN)
1728 hdata = exim_dkim_data_append(hdata, US sig_hdr);
1730 /* SIGNING ---------------------------------------------------------------- */
1731 if (ctx->flags & PDKIM_MODE_SIGN)
1733 hashmethod hm = sig->keytype == KEYTYPE_ED25519
1734 #if defined(SIGN_OPENSSL)
1739 : pdkim_hashes[sig->hashtype].exim_hashmethod;
1741 #ifdef SIGN_HAVE_ED25519
1742 /* For GCrypt, and for EC, we pass the hash-of-headers to the signing
1743 routine. For anything else we just pass the headers. */
1745 if (sig->keytype != KEYTYPE_ED25519)
1748 hhash.data = hdata->s;
1749 hhash.len = hdata->ptr;
1752 if ((*err = exim_dkim_sign(&sctx, hm, &hhash, &sig->sighash)))
1754 log_write(0, LOG_MAIN|LOG_PANIC, "signing: %s", *err);
1755 return PDKIM_ERR_RSA_SIGNING;
1760 debug_printf( "DKIM [%s] b computed: ", sig->domain);
1761 pdkim_hexprint(sig->sighash.data, sig->sighash.len);
1764 sig->signature_header = pdkim_create_header(sig, TRUE);
1767 /* VERIFICATION ----------------------------------------------------------- */
1773 /* Make sure we have all required signature tags */
1774 if (!( sig->domain && *sig->domain
1775 && sig->selector && *sig->selector
1776 && sig->headernames && *sig->headernames
1777 && sig->bodyhash.data
1778 && sig->sighash.data
1779 && sig->keytype >= 0
1780 && sig->hashtype >= 0
1784 sig->verify_status = PDKIM_VERIFY_INVALID;
1785 sig->verify_ext_status = PDKIM_VERIFY_INVALID_SIGNATURE_ERROR;
1787 DEBUG(D_acl) debug_printf(
1788 " Error in DKIM-Signature header: tags missing or invalid (%s)\n"
1789 "DKIM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n",
1790 !(sig->domain && *sig->domain) ? "d="
1791 : !(sig->selector && *sig->selector) ? "s="
1792 : !(sig->headernames && *sig->headernames) ? "h="
1793 : !sig->bodyhash.data ? "bh="
1794 : !sig->sighash.data ? "b="
1795 : sig->keytype < 0 || sig->hashtype < 0 ? "a="
1801 /* Make sure sig uses supported DKIM version (only v1) */
1802 if (sig->version != 1)
1804 sig->verify_status = PDKIM_VERIFY_INVALID;
1805 sig->verify_ext_status = PDKIM_VERIFY_INVALID_DKIM_VERSION;
1807 DEBUG(D_acl) debug_printf(
1808 " Error in DKIM-Signature header: unsupported DKIM version\n"
1809 "DKIM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n");
1815 debug_printf( "DKIM [%s] b from mail: ", sig->domain);
1816 pdkim_hexprint(sig->sighash.data, sig->sighash.len);
1819 if (!(sig->pubkey = pdkim_key_from_dns(ctx, sig, &vctx, err)))
1821 log_write(0, LOG_MAIN, "DKIM: %s%s %s%s [failed key import]",
1822 sig->domain ? "d=" : "", sig->domain ? sig->domain : US"",
1823 sig->selector ? "s=" : "", sig->selector ? sig->selector : US"");
1827 /* If the pubkey limits to a list of specific hashes, ignore sigs that
1828 do not have the hash part of the sig algorithm matching */
1830 if (sig->pubkey->hashes)
1832 const uschar * list = sig->pubkey->hashes, * ele;
1834 while ((ele = string_nextinlist(&list, &sep, NULL, 0)))
1835 if (Ustrcmp(ele, pdkim_hashes[sig->hashtype].dkim_hashname) == 0) break;
1838 DEBUG(D_acl) debug_printf("pubkey h=%s vs. sig a=%s_%s\n",
1839 sig->pubkey->hashes,
1840 pdkim_keytypes[sig->keytype],
1841 pdkim_hashes[sig->hashtype].dkim_hashname);
1842 sig->verify_status = PDKIM_VERIFY_FAIL;
1843 sig->verify_ext_status = PDKIM_VERIFY_FAIL_SIG_ALGO_MISMATCH;
1848 hm = sig->keytype == KEYTYPE_ED25519
1849 #if defined(SIGN_OPENSSL)
1854 : pdkim_hashes[sig->hashtype].exim_hashmethod;
1856 /* Check the signature */
1858 if ((*err = exim_dkim_verify(&vctx, hm, &hhash, &sig->sighash)))
1860 DEBUG(D_acl) debug_printf("headers verify: %s\n", *err);
1861 sig->verify_status = PDKIM_VERIFY_FAIL;
1862 sig->verify_ext_status = PDKIM_VERIFY_FAIL_MESSAGE;
1865 if (*dkim_verify_min_keysizes)
1868 uschar * ss = expand_getkeyed(US pdkim_keytypes[sig->keytype],
1869 dkim_verify_min_keysizes);
1870 if (ss && (minbits = atoi(CS ss)) > sig->keybits)
1872 DEBUG(D_acl) debug_printf("Key too short: Actual: %s %u Minima '%s'\n",
1873 pdkim_keytypes[sig->keytype], sig->keybits, dkim_verify_min_keysizes);
1874 sig->verify_status = PDKIM_VERIFY_FAIL;
1875 sig->verify_ext_status = PDKIM_VERIFY_INVALID_PUBKEY_KEYSIZE;
1880 /* We have a winner! (if bodyhash was correct earlier) */
1881 if (sig->verify_status == PDKIM_VERIFY_NONE)
1883 sig->verify_status = PDKIM_VERIFY_PASS;
1885 if (dkim_verify_minimal) break;
1892 debug_printf("DKIM [%s] %s signature status: %s",
1893 sig->domain, dkim_sig_to_a_tag(sig),
1894 pdkim_verify_status_str(sig->verify_status));
1895 if (sig->verify_ext_status > 0)
1896 debug_printf(" (%s)\n",
1897 pdkim_verify_ext_status_str(sig->verify_ext_status));
1904 /* If requested, set return pointer to signature(s) */
1905 if (return_signatures)
1906 *return_signatures = ctx->sig;
1908 return ctx->flags & PDKIM_MODE_SIGN || verify_pass
1909 ? PDKIM_OK : PDKIM_FAIL;
1913 /* -------------------------------------------------------------------------- */
1915 DLLEXPORT pdkim_ctx *
1916 pdkim_init_verify(uschar * (*dns_txt_callback)(const uschar *), BOOL dot_stuffing)
1920 ctx = store_get(sizeof(pdkim_ctx), FALSE);
1921 memset(ctx, 0, sizeof(pdkim_ctx));
1923 if (dot_stuffing) ctx->flags = PDKIM_DOT_TERM;
1924 /* The line-buffer is for message data, hence tainted */
1925 ctx->linebuf = store_get(PDKIM_MAX_BODY_LINE_LEN, TRUE);
1926 ctx->dns_txt_callback = dns_txt_callback;
1927 ctx->cur_header = string_get_tainted(36, TRUE);
1933 /* -------------------------------------------------------------------------- */
1935 DLLEXPORT pdkim_signature *
1936 pdkim_init_sign(pdkim_ctx * ctx,
1937 uschar * domain, uschar * selector, uschar * privkey,
1938 uschar * hashname, const uschar ** errstr)
1941 pdkim_signature * sig;
1943 if (!domain || !selector || !privkey)
1946 /* Allocate & init one signature struct */
1948 sig = store_get(sizeof(pdkim_signature), FALSE);
1949 memset(sig, 0, sizeof(pdkim_signature));
1951 sig->bodylength = -1;
1953 sig->domain = string_copy(US domain);
1954 sig->selector = string_copy(US selector);
1955 sig->privkey = string_copy(US privkey);
1958 for (hashtype = 0; hashtype < nelem(pdkim_hashes); hashtype++)
1959 if (Ustrcmp(hashname, pdkim_hashes[hashtype].dkim_hashname) == 0)
1960 { sig->hashtype = hashtype; break; }
1961 if (hashtype >= nelem(pdkim_hashes))
1963 log_write(0, LOG_MAIN|LOG_PANIC,
1964 "DKIM: unrecognised hashname '%s'", hashname);
1970 pdkim_signature s = *sig;
1973 debug_printf("DKIM (checking verify key)>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1974 if (!pdkim_key_from_dns(ctx, &s, &vctx, errstr))
1975 debug_printf("WARNING: bad dkim key in dns\n");
1976 debug_printf("DKIM (finished checking verify key)<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n");
1982 /* -------------------------------------------------------------------------- */
1985 pdkim_set_optional(pdkim_signature * sig,
1986 char * sign_headers,
1991 unsigned long created,
1992 unsigned long expires)
1995 sig->identity = string_copy(US identity);
1997 sig->sign_headers = string_copy(sign_headers
1998 ? US sign_headers : US PDKIM_DEFAULT_SIGN_HEADERS);
2000 sig->canon_headers = canon_headers;
2001 sig->canon_body = canon_body;
2002 sig->bodylength = bodylength;
2003 sig->created = created;
2004 sig->expires = expires;
2011 /* Set up a blob for calculating the bodyhash according to the
2012 given needs. Use an existing one if possible, or create a new one.
2014 Return: hashblob pointer, or NULL on error
2017 pdkim_set_bodyhash(pdkim_ctx * ctx, int hashtype, int canon_method,
2022 if (hashtype == -1 || canon_method == -1) return NULL;
2024 for (b = ctx->bodyhash; b; b = b->next)
2025 if ( hashtype == b->hashtype
2026 && canon_method == b->canon_method
2027 && bodylength == b->bodylength)
2029 DEBUG(D_receive) debug_printf("DKIM: using existing bodyhash %d/%d/%ld\n",
2030 hashtype, canon_method, bodylength);
2034 DEBUG(D_receive) debug_printf("DKIM: new bodyhash %d/%d/%ld\n",
2035 hashtype, canon_method, bodylength);
2036 b = store_get(sizeof(pdkim_bodyhash), FALSE);
2037 b->next = ctx->bodyhash;
2038 b->hashtype = hashtype;
2039 b->canon_method = canon_method;
2040 b->bodylength = bodylength;
2041 if (!exim_sha_init(&b->body_hash_ctx, /*XXX hash method: extend for sha512 */
2042 pdkim_hashes[hashtype].exim_hashmethod))
2045 debug_printf("DKIM: hash init error, possibly nonhandled hashtype\n");
2048 b->signed_body_bytes = 0;
2049 b->num_buffered_blanklines = 0;
2055 /* Set up a blob for calculating the bodyhash according to the
2056 needs of this signature. Use an existing one if possible, or
2059 Return: hashblob pointer, or NULL on error (only used as a boolean).
2062 pdkim_set_sig_bodyhash(pdkim_ctx * ctx, pdkim_signature * sig)
2064 pdkim_bodyhash * b = pdkim_set_bodyhash(ctx,
2065 sig->hashtype, sig->canon_body, sig->bodylength);
2066 sig->calc_body_hash = b;
2071 /* -------------------------------------------------------------------------- */
2075 pdkim_init_context(pdkim_ctx * ctx, BOOL dot_stuffed,
2076 uschar * (*dns_txt_callback)(const uschar *))
2078 memset(ctx, 0, sizeof(pdkim_ctx));
2079 ctx->flags = dot_stuffed ? PDKIM_MODE_SIGN | PDKIM_DOT_TERM : PDKIM_MODE_SIGN;
2080 /* The line buffer is for message data, hence tainted */
2081 ctx->linebuf = store_get(PDKIM_MAX_BODY_LINE_LEN, TRUE);
2082 DEBUG(D_acl) ctx->dns_txt_callback = dns_txt_callback;
2094 #endif /*DISABLE_DKIM*/