libopendkim,opendkim: add DKIM_SIGERROR_UNSUPPORTED_A and warn when skipping unsupported algorithm

Distinguish between a genuinely invalid a= tag value (DKIM_SIGERROR_INVALID_A)
and a valid algorithm that was not compiled into this build
(DKIM_SIGERROR_UNSUPPORTED_A, e.g. ed25519-sha256 without Ed25519 support).

Ed25519 is in wide deployment now; silently skipping these signatures without
any log output makes it hard to diagnose why valid signatures are being ignored.

opendkim now logs LOG_WARNING when a signature is skipped for this reason,
naming the algorithm so operators know exactly what support to add.

Author: thegushi

libopendkim/dkim-tables.c

@@ -194,6 +194,7 @@ static struct dkim_nametable prv_sigerrors[] =	/* signature parsing errors */
 	{ "conditional signature not satisfied", DKIM_SIGERROR_CONDITIONAL },
 	{ "too many signature indirections",	DKIM_SIGERROR_CONDLOOP },
 #endif /* _FFR_CONDITIONAL */
+	{ "algorithm not supported in this build", DKIM_SIGERROR_UNSUPPORTED_A },
 	{ NULL,					-1 },
 };
 DKIM_NAMETABLE *dkim_table_sigerrors = prv_sigerrors;

libopendkim/dkim.c

@@ -2144,7 +2144,7 @@ dkim_siglist_setup(DKIM *dkim)
 				}
 				else
 				{
-					dkim->dkim_siglist[c]->sig_error = DKIM_SIGERROR_INVALID_A;
+					dkim->dkim_siglist[c]->sig_error = DKIM_SIGERROR_UNSUPPORTED_A;
 					continue;
 				}
 				break;
@@ -2156,7 +2156,7 @@ dkim_siglist_setup(DKIM *dkim)
 				}
 				else
 				{
-					dkim->dkim_siglist[c]->sig_error = DKIM_SIGERROR_INVALID_A;
+					dkim->dkim_siglist[c]->sig_error = DKIM_SIGERROR_UNSUPPORTED_A;
 					continue;
 				}
 				break;

libopendkim/dkim.h

@@ -168,6 +168,7 @@ typedef int DKIM_SIGERROR;
 #define	DKIM_SIGERROR_KEYTOOSMALL	46	/* too few key bits */
 #define DKIM_SIGERROR_CONDITIONAL	47	/* conditional sig error */
 #define DKIM_SIGERROR_CONDLOOP		48	/* conditional sig loop */
+#define DKIM_SIGERROR_UNSUPPORTED_A	49	/* a= algorithm not supported in this build */
 
 extern DKIM_NAMETABLE *dkim_table_sigerrors;
 

opendkim/opendkim.c

@@ -5503,6 +5503,7 @@ dkimf_arfdkim(msgctx dfc)
 	  case DKIM_SIGERROR_INVALID_BC:
 	  case DKIM_SIGERROR_MISSING_A:
 	  case DKIM_SIGERROR_INVALID_A:
+	  case DKIM_SIGERROR_UNSUPPORTED_A:
 	  case DKIM_SIGERROR_MISSING_H:
 	  case DKIM_SIGERROR_INVALID_L:
 	  case DKIM_SIGERROR_INVALID_Q:
@@ -10732,6 +10733,20 @@ dkimf_ar_all_sigs(char *hdr, size_t hdrlen, struct dkimf_dstring *tmpstr,
 
 			sigerror = dkim_sig_geterror(sigs[c]);
 
+			if (sigerror == DKIM_SIGERROR_UNSUPPORTED_A)
+			{
+				dkim_alg_t unsup_alg;
+				if (dkim_sig_getsignalg(sigs[c],
+				                        &unsup_alg) == DKIM_STAT_OK)
+				{
+					dkimf_log(conf, LOG_WARNING,
+					          "%s: signature ignored: algorithm '%s' not supported in this build",
+					          JOBID(dfc->mctx_jobid),
+					          dkim_code_to_name(dkim_table_algorithms,
+					                            unsup_alg));
+				}
+			}
+
 			if (dkim_sig_getkeysize(sigs[c],
 			                        &keybits) != DKIM_STAT_OK)
 				keybits = 0;