X-Git-Url: https://git.netwichtig.de/gitweb/?a=blobdiff_plain;f=src%2Fsrc%2Fpdkim%2Fsigning.c;h=de64ee4280ec104840b5f8e0a7b7ec834288f32b;hb=6d5f5cafb4c507abe36434bf7695573284eb8761;hp=d7491565f97d89b083e5e8c8598f9ebcc3abd1be;hpb=e690dc6c0215bc280336030da2b3bbc9bae75683;p=user%2Fhenk%2Fcode%2Fexim.git

diff --git a/src/src/pdkim/signing.c b/src/src/pdkim/signing.c
index d7491565f..de64ee428 100644
--- a/src/src/pdkim/signing.c
+++ b/src/src/pdkim/signing.c
@@ -28,8 +28,8 @@ features_crypto(void)
 
 #ifndef DISABLE_DKIM	/* rest of file */
 
-#ifndef SUPPORT_TLS
-# error Need SUPPORT_TLS for DKIM
+#ifdef DISABLE_TLS
+# error Must no DISABLE_TLS, for DKIM
 #endif
 
 
@@ -499,7 +499,7 @@ switch (hash)
   }
 
 #define SIGSPACE 128
-sig->data = store_get(SIGSPACE);
+sig->data = store_get(SIGSPACE, FALSE);
 
 if (gcry_mpi_cmp (sign_ctx->p, sign_ctx->q) > 0)
   {
@@ -755,7 +755,7 @@ switch (hash)
 if (  (ctx = EVP_MD_CTX_new())
    && EVP_DigestSignInit(ctx, NULL, md, NULL, sign_ctx->key) > 0
    && EVP_DigestSign(ctx, NULL, &siglen, NULL, 0) > 0
-   && (sig->data = store_get(siglen))
+   && (sig->data = store_get(siglen, FALSE))
 
    /* Obtain the signature (slen could change here!) */
    && EVP_DigestSign(ctx, sig->data, &siglen, data->data, data->len) > 0
@@ -771,7 +771,7 @@ if (  (ctx = EVP_MD_CTX_create())
    && EVP_DigestSignInit(ctx, NULL, md, NULL, sign_ctx->key) > 0
    && EVP_DigestSignUpdate(ctx, data->data, data->len) > 0
    && EVP_DigestSignFinal(ctx, NULL, &siglen) > 0
-   && (sig->data = store_get(siglen))
+   && (sig->data = store_get(siglen, FALSE))
  
    /* Obtain the signature (slen could change here!) */
    && EVP_DigestSignFinal(ctx, sig->data, &siglen) > 0
@@ -831,7 +831,6 @@ const uschar *
 exim_dkim_verify(ev_ctx * verify_ctx, hashmethod hash, blob * data, blob * sig)
 {
 const EVP_MD * md;
-const uschar * where;
 
 switch (hash)
   {
@@ -847,36 +846,39 @@ if (!md)
   {
   EVP_MD_CTX * ctx;
 
-  if (  (ctx = EVP_MD_CTX_new())
-     && EVP_DigestVerifyInit(ctx, NULL, md, NULL, verify_ctx->key) > 0
-     && EVP_DigestVerify(ctx, sig->data, sig->len, data->data, data->len) > 0
-     )
-    { EVP_MD_CTX_free(ctx); return NULL; }
-
-  if (ctx) EVP_MD_CTX_free(ctx);
+  if ((ctx = EVP_MD_CTX_new()))
+    {
+    if (  EVP_DigestVerifyInit(ctx, NULL, md, NULL, verify_ctx->key) > 0
+       && EVP_DigestVerify(ctx, sig->data, sig->len, data->data, data->len) > 0
+       )
+      { EVP_MD_CTX_free(ctx); return NULL; }
+    EVP_MD_CTX_free(ctx);
+    }
   }
 else
 #endif
   {
   EVP_PKEY_CTX * ctx;
 
-  if (  (where = US"EVP_PKEY_CTX_new",
-	     (ctx = EVP_PKEY_CTX_new(verify_ctx->key, NULL)))
-     && (where = US"EVP_PKEY_verify_init",
-		    EVP_PKEY_verify_init(ctx) > 0)
-     && (where = US"EVP_PKEY_CTX_set_rsa_padding",
-		    EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) > 0)
-     && (where = US"EVP_PKEY_CTX_set_signature_md",
-		    EVP_PKEY_CTX_set_signature_md(ctx, md) > 0)
-     && (where = US"EVP_PKEY_verify",
-		    EVP_PKEY_verify(ctx, sig->data, sig->len,
-				    data->data, data->len) == 1)
-     )
-    { EVP_PKEY_CTX_free(ctx); return NULL; }
-
-  if (ctx) EVP_PKEY_CTX_free(ctx);
+  if ((ctx = EVP_PKEY_CTX_new(verify_ctx->key, NULL)))
+    {
+    if (  EVP_PKEY_verify_init(ctx) > 0
+       && EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) > 0
+       && EVP_PKEY_CTX_set_signature_md(ctx, md) > 0
+       && EVP_PKEY_verify(ctx, sig->data, sig->len,
+				      data->data, data->len) == 1
+       )
+      { EVP_PKEY_CTX_free(ctx); return NULL; }
+    EVP_PKEY_CTX_free(ctx);
+
+    DEBUG(D_tls)
+      if (Ustrcmp(ERR_reason_error_string(ERR_peek_error()), "wrong signature length") == 0)
+	debug_printf("sig len (from msg hdr): %d, expected (from dns pubkey) %d\n",
+	 (int) sig->len, EVP_PKEY_size(verify_ctx->key));
+    }
   }
-return string_sprintf("%s: %s", where, ERR_error_string(ERR_get_error(), NULL));
+
+return US ERR_error_string(ERR_get_error(), NULL);
 }