Merge pull request #334 from thegushi/issue-27-sig-signalg-early-assign

libopendkim: fix sig_signalg left as rsa-sha1 when unsupported algorithm skipped

Author: thegushi

libopendkim/dkim-tables.c

@@ -194,6 +194,7 @@ static struct dkim_nametable prv_sigerrors[] =	/* signature parsing errors */
 	{ "conditional signature not satisfied", DKIM_SIGERROR_CONDITIONAL },
 	{ "too many signature indirections",	DKIM_SIGERROR_CONDLOOP },
 #endif /* _FFR_CONDITIONAL */
+	{ "algorithm not supported in this build", DKIM_SIGERROR_UNSUPPORTED_A },
 	{ NULL,					-1 },
 };
 DKIM_NAMETABLE *dkim_table_sigerrors = prv_sigerrors;

libopendkim/dkim.c

@@ -2121,8 +2121,9 @@ dkim_siglist_setup(DKIM *dkim)
 		}
 		else
 		{
-			signalg = dkim_name_to_code(dkim_table_algorithms,
-			                            (char *) param);
+			dkim->dkim_siglist[c]->sig_signalg = signalg =
+				dkim_name_to_code(dkim_table_algorithms,
+				                  (char *) param);
 
 			if (signalg == -1)
 			{
@@ -2143,7 +2144,7 @@ dkim_siglist_setup(DKIM *dkim)
 				}
 				else
 				{
-					dkim->dkim_siglist[c]->sig_error = DKIM_SIGERROR_INVALID_A;
+					dkim->dkim_siglist[c]->sig_error = DKIM_SIGERROR_UNSUPPORTED_A;
 					continue;
 				}
 				break;
@@ -2155,7 +2156,7 @@ dkim_siglist_setup(DKIM *dkim)
 				}
 				else
 				{
-					dkim->dkim_siglist[c]->sig_error = DKIM_SIGERROR_INVALID_A;
+					dkim->dkim_siglist[c]->sig_error = DKIM_SIGERROR_UNSUPPORTED_A;
 					continue;
 				}
 				break;
@@ -2165,7 +2166,6 @@ dkim_siglist_setup(DKIM *dkim)
 				/* NOTREACHED */
 			}
 
-			dkim->dkim_siglist[c]->sig_signalg = signalg;
 			dkim->dkim_siglist[c]->sig_hashtype = hashtype;
 		}
 

libopendkim/dkim.h

@@ -168,6 +168,7 @@ typedef int DKIM_SIGERROR;
 #define	DKIM_SIGERROR_KEYTOOSMALL	46	/* too few key bits */
 #define DKIM_SIGERROR_CONDITIONAL	47	/* conditional sig error */
 #define DKIM_SIGERROR_CONDLOOP		48	/* conditional sig loop */
+#define DKIM_SIGERROR_UNSUPPORTED_A	49	/* a= algorithm not supported in this build */
 
 extern DKIM_NAMETABLE *dkim_table_sigerrors;
 

opendkim/opendkim.c

@@ -5473,6 +5473,7 @@ dkimf_arfdkim(msgctx dfc)
 	  case DKIM_SIGERROR_INVALID_BC:
 	  case DKIM_SIGERROR_MISSING_A:
 	  case DKIM_SIGERROR_INVALID_A:
+	  case DKIM_SIGERROR_UNSUPPORTED_A:
 	  case DKIM_SIGERROR_MISSING_H:
 	  case DKIM_SIGERROR_INVALID_L:
 	  case DKIM_SIGERROR_INVALID_Q:
@@ -10702,6 +10703,19 @@ dkimf_ar_all_sigs(char *hdr, size_t hdrlen, struct dkimf_dstring *tmpstr,
 
 			sigerror = dkim_sig_geterror(sigs[c]);
 
+			if (sigerror == DKIM_SIGERROR_UNSUPPORTED_A)
+			{
+				dkim_alg_t unsup_alg;
+				if (dkim_sig_getsignalg(sigs[c],
+				                        &unsup_alg) == DKIM_STAT_OK)
+				{
+					dkimf_log(conf, LOG_WARNING,
+					          "signature ignored: algorithm '%s' not supported in this build",
+					          dkim_code_to_name(dkim_table_algorithms,
+					                            unsup_alg));
+				}
+			}
+
 			if (dkim_sig_getkeysize(sigs[c],
 			                        &keybits) != DKIM_STAT_OK)
 				keybits = 0;