[Fix] Reject invalid bh for DKIM signatures earlier

diff --git a/src/libserver/dkim.c b/src/libserver/dkim.c
index 06adab305bc060fd04a06bdac5a342873357d3cc..72cc7232f74324dc2bec2b84ad656a5fcffe0537 100644 (file)
--- a/src/libserver/dkim.c
+++ b/src/libserver/dkim.c
@@ -2196,6 +2196,14 @@ rspamd_dkim_check (rspamd_dkim_context_t *ctx,
                                        }
                                }
                        }
+                       else {
+                               msg_debug_dkim (
+                                               "bh value mismatch: %*xs versus %*xs",
+                                               dlen, ctx->bh,
+                                               dlen, cached_bh->digest_normal);
+
+                               return DKIM_REJECT;
+                       }
                }
 
                if (cpy_ctx) {