aboutsummaryrefslogtreecommitdiffstats
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/fuzzy_storage.c9
-rw-r--r--src/libcryptobox/cryptobox.c55
-rw-r--r--src/libcryptobox/keypair.c151
-rw-r--r--src/libcryptobox/keypair.h51
-rw-r--r--src/libserver/http/http_connection.c6
-rw-r--r--src/libserver/maps/map.c6
-rw-r--r--src/lua/lua_cryptobox.c49
-rw-r--r--src/lua/lua_map.c4
-rw-r--r--src/lua/lua_rsa.c20
-rw-r--r--src/plugins/lua/dmarc.lua12
-rw-r--r--src/rspamadm/signtool.c3
11 files changed, 254 insertions, 112 deletions
diff --git a/src/fuzzy_storage.c b/src/fuzzy_storage.c
index 841d040b2..f21992a94 100644
--- a/src/fuzzy_storage.c
+++ b/src/fuzzy_storage.c
@@ -2453,7 +2453,8 @@ rspamd_fuzzy_key_stat_iter(const unsigned char *pk_iter, struct fuzzy_key *fuzzy
ucl_object_insert_key(elt, flags_ucl, "flags", 0, false);
ucl_object_insert_key(elt,
- rspamd_keypair_to_ucl(fuzzy_key->key, RSPAMD_KEYPAIR_DUMP_NO_SECRET | RSPAMD_KEYPAIR_DUMP_FLATTENED),
+ rspamd_keypair_to_ucl(fuzzy_key->key, RSPAMD_KEYPAIR_ENCODING_DEFAULT,
+ RSPAMD_KEYPAIR_DUMP_NO_SECRET | RSPAMD_KEYPAIR_DUMP_FLATTENED),
"keypair", 0, false);
ucl_object_insert_key(keys_obj, elt, keyname, 0, true);
}
@@ -2474,6 +2475,12 @@ rspamd_fuzzy_stat_to_ucl(struct rspamd_fuzzy_storage_ctx *ctx, gboolean ip_stat)
rspamd_fuzzy_key_stat_iter(pk_iter, fuzzy_key, keys_obj, ip_stat);
});
+ if (ctx->dynamic_keys) {
+ kh_foreach(ctx->dynamic_keys, pk_iter, fuzzy_key, {
+ rspamd_fuzzy_key_stat_iter(pk_iter, fuzzy_key, keys_obj, ip_stat);
+ });
+ }
+
ucl_object_insert_key(obj, keys_obj, "keys", 0, false);
/* Now generic stats */
diff --git a/src/libcryptobox/cryptobox.c b/src/libcryptobox/cryptobox.c
index eeeed020c..a976653df 100644
--- a/src/libcryptobox/cryptobox.c
+++ b/src/libcryptobox/cryptobox.c
@@ -86,6 +86,60 @@ rspamd_cryptobox_cpuid(int cpu[4], int info)
#endif
}
+#ifdef HAVE_BUILTIN_CPU_SUPPORTS
+RSPAMD_CONSTRUCTOR(cryptobox_cpu_init)
+{
+ __builtin_cpu_init();
+}
+static gboolean
+rspamd_cryptobox_test_instr(int instr)
+{
+ gboolean ret = FALSE;
+ switch (instr) {
+#if defined HAVE_SSE2 && defined(__x86_64__)
+ case CPUID_SSE2:
+ ret = __builtin_cpu_supports("sse2");
+ break;
+ case CPUID_RDRAND:
+ /* XXX: no check to test for rdrand, but all avx2 cpus are def. capable of rdrand */
+ ret = __builtin_cpu_supports("avx2");
+ break;
+#endif
+#ifdef HAVE_SSE3
+ case CPUID_SSE3:
+ ret = __builtin_cpu_supports("sse3");
+ break;
+#endif
+#ifdef HAVE_SSSE3
+ case CPUID_SSSE3:
+ ret = __builtin_cpu_supports("ssse3");
+ break;
+#endif
+#ifdef HAVE_SSE41
+ case CPUID_SSE41:
+ ret = __builtin_cpu_supports("sse4.1");
+ break;
+#endif
+#if defined HAVE_SSE42 && defined(__x86_64__)
+ case CPUID_SSE42:
+ ret = __builtin_cpu_supports("sse4.2");
+ break;
+#endif
+#ifdef HAVE_AVX
+ case CPUID_AVX:
+ ret = __builtin_cpu_supports("avx");
+ break;
+#endif
+#ifdef HAVE_AVX2
+ case CPUID_AVX2:
+ ret = __builtin_cpu_supports("avx2");
+ break;
+#endif
+ }
+
+ return ret;
+}
+#else
static sig_atomic_t ok = 0;
static jmp_buf j;
@@ -171,6 +225,7 @@ rspamd_cryptobox_test_instr(int instr)
/* We actually never return here if SIGILL has been caught */
return ok == 1;
}
+#endif /* HAVE_BUILTIN_CPU_SUPPORTS */
struct rspamd_cryptobox_library_ctx *
rspamd_cryptobox_init(void)
diff --git a/src/libcryptobox/keypair.c b/src/libcryptobox/keypair.c
index d3f81ee2d..3556e188f 100644
--- a/src/libcryptobox/keypair.c
+++ b/src/libcryptobox/keypair.c
@@ -34,7 +34,7 @@ rspamd_keypair_quark(void)
*/
static void *
rspamd_cryptobox_keypair_sk(struct rspamd_cryptobox_keypair *kp,
- unsigned int *len)
+ size_t *len)
{
g_assert(kp != NULL);
@@ -50,7 +50,7 @@ rspamd_cryptobox_keypair_sk(struct rspamd_cryptobox_keypair *kp,
static void *
rspamd_cryptobox_keypair_pk(struct rspamd_cryptobox_keypair *kp,
- unsigned int *len)
+ size_t *len)
{
g_assert(kp != NULL);
@@ -66,7 +66,7 @@ rspamd_cryptobox_keypair_pk(struct rspamd_cryptobox_keypair *kp,
static void *
rspamd_cryptobox_pubkey_pk(const struct rspamd_cryptobox_pubkey *kp,
- unsigned int *len)
+ size_t *len)
{
g_assert(kp != NULL);
@@ -139,7 +139,7 @@ void rspamd_cryptobox_nm_dtor(struct rspamd_cryptobox_nm *nm)
void rspamd_cryptobox_keypair_dtor(struct rspamd_cryptobox_keypair *kp)
{
void *sk;
- unsigned int len = 0;
+ size_t len = 0;
sk = rspamd_cryptobox_keypair_sk(kp, &len);
g_assert(sk != NULL && len > 0);
@@ -168,7 +168,7 @@ rspamd_keypair_new(enum rspamd_cryptobox_keypair_type type)
{
struct rspamd_cryptobox_keypair *kp;
void *pk, *sk;
- unsigned int size;
+ size_t size;
kp = rspamd_cryptobox_keypair_alloc(type);
kp->type = type;
@@ -241,7 +241,7 @@ rspamd_pubkey_from_base32(const char *b32,
{
unsigned char *decoded;
gsize dlen, expected_len;
- unsigned int pklen;
+ size_t pklen;
struct rspamd_cryptobox_pubkey *pk;
unsigned char *pk_data;
@@ -283,7 +283,7 @@ rspamd_pubkey_from_hex(const char *hex,
{
unsigned char *decoded;
gsize dlen, expected_len;
- unsigned int pklen;
+ size_t pklen;
struct rspamd_cryptobox_pubkey *pk;
unsigned char *pk_data;
@@ -325,7 +325,7 @@ rspamd_pubkey_from_bin(const unsigned char *raw,
gsize len,
enum rspamd_cryptobox_keypair_type type)
{
- unsigned int pklen;
+ size_t pklen;
struct rspamd_cryptobox_pubkey *pk;
unsigned char *pk_data;
@@ -421,7 +421,7 @@ rspamd_pubkey_get_pk(struct rspamd_cryptobox_pubkey *pk,
unsigned int *len)
{
unsigned char *ret = NULL;
- unsigned int rlen;
+ size_t rlen;
ret = rspamd_cryptobox_pubkey_pk(pk, &rlen);
@@ -434,7 +434,8 @@ rspamd_pubkey_get_pk(struct rspamd_cryptobox_pubkey *pk,
static void
rspamd_keypair_print_component(unsigned char *data, gsize datalen,
- GString *res, unsigned int how, const char *description)
+ GString *res, unsigned int how, const char *description,
+ enum rspamd_cryptobox_keypair_encoding encoding)
{
int olen, b32_len;
@@ -442,7 +443,7 @@ rspamd_keypair_print_component(unsigned char *data, gsize datalen,
rspamd_printf_gstring(res, "%s: ", description);
}
- if (how & RSPAMD_KEYPAIR_BASE32) {
+ if (encoding == RSPAMD_KEYPAIR_ENCODING_ZBASE32) {
b32_len = (datalen * 8 / 5) + 2;
g_string_set_size(res, res->len + b32_len);
res->len -= b32_len;
@@ -454,9 +455,12 @@ rspamd_keypair_print_component(unsigned char *data, gsize datalen,
res->str[res->len] = '\0';
}
}
- else if (how & RSPAMD_KEYPAIR_HEX) {
+ else if (encoding == RSPAMD_KEYPAIR_ENCODING_HEX) {
rspamd_printf_gstring(res, "%*xs", (int) datalen, data);
}
+ else if (encoding == RSPAMD_KEYPAIR_ENCODING_BASE64) {
+ rspamd_printf_gstring(res, "%*Bs", (int) datalen, data);
+ }
else {
g_string_append_len(res, data, datalen);
}
@@ -467,10 +471,12 @@ rspamd_keypair_print_component(unsigned char *data, gsize datalen,
}
GString *
-rspamd_keypair_print(struct rspamd_cryptobox_keypair *kp, unsigned int how)
+rspamd_keypair_print(struct rspamd_cryptobox_keypair *kp,
+ enum rspamd_cryptobox_keypair_encoding encoding,
+ unsigned int how)
{
GString *res;
- unsigned int len;
+ size_t len;
gpointer p;
g_assert(kp != NULL);
@@ -479,28 +485,30 @@ rspamd_keypair_print(struct rspamd_cryptobox_keypair *kp, unsigned int how)
if ((how & RSPAMD_KEYPAIR_PUBKEY)) {
p = rspamd_cryptobox_keypair_pk(kp, &len);
- rspamd_keypair_print_component(p, len, res, how, "Public key");
+ rspamd_keypair_print_component(p, len, res, how, "Public key", encoding);
}
if ((how & RSPAMD_KEYPAIR_PRIVKEY)) {
p = rspamd_cryptobox_keypair_sk(kp, &len);
- rspamd_keypair_print_component(p, len, res, how, "Private key");
+ rspamd_keypair_print_component(p, len, res, how, "Private key", encoding);
}
if ((how & RSPAMD_KEYPAIR_ID_SHORT)) {
rspamd_keypair_print_component(kp->id, RSPAMD_KEYPAIR_SHORT_ID_LEN,
- res, how, "Short key ID");
+ res, how, "Short key ID", encoding);
}
if ((how & RSPAMD_KEYPAIR_ID)) {
- rspamd_keypair_print_component(kp->id, sizeof(kp->id), res, how, "Key ID");
+ rspamd_keypair_print_component(kp->id, sizeof(kp->id), res, how, "Key ID", encoding);
}
return res;
}
GString *
-rspamd_pubkey_print(struct rspamd_cryptobox_pubkey *pk, unsigned int how)
+rspamd_pubkey_print(struct rspamd_cryptobox_pubkey *pk,
+ enum rspamd_cryptobox_keypair_encoding encoding,
+ unsigned int how)
{
GString *res;
- unsigned int len;
+ size_t len;
gpointer p;
g_assert(pk != NULL);
@@ -509,15 +517,15 @@ rspamd_pubkey_print(struct rspamd_cryptobox_pubkey *pk, unsigned int how)
if ((how & RSPAMD_KEYPAIR_PUBKEY)) {
p = rspamd_cryptobox_pubkey_pk(pk, &len);
- rspamd_keypair_print_component(p, len, res, how, "Public key");
+ rspamd_keypair_print_component(p, len, res, how, "Public key", encoding);
}
if ((how & RSPAMD_KEYPAIR_ID_SHORT)) {
rspamd_keypair_print_component(pk->id, RSPAMD_KEYPAIR_SHORT_ID_LEN,
- res, how, "Short key ID");
+ res, how, "Short key ID", encoding);
}
if ((how & RSPAMD_KEYPAIR_ID)) {
rspamd_keypair_print_component(pk->id, sizeof(pk->id), res, how,
- "Key ID");
+ "Key ID", encoding);
}
return res;
@@ -527,7 +535,7 @@ const unsigned char *
rspamd_keypair_component(struct rspamd_cryptobox_keypair *kp,
unsigned int ncomp, unsigned int *len)
{
- unsigned int rlen = 0;
+ size_t rlen = 0;
const unsigned char *ret = NULL;
g_assert(kp != NULL);
@@ -558,11 +566,11 @@ rspamd_keypair_from_ucl(const ucl_object_t *obj)
const ucl_object_t *privkey, *pubkey, *elt;
const char *str;
enum rspamd_cryptobox_keypair_type type = RSPAMD_KEYPAIR_KEX;
- gboolean is_hex = FALSE;
+ enum rspamd_cryptobox_keypair_encoding encoding = RSPAMD_KEYPAIR_ENCODING_DEFAULT;
struct rspamd_cryptobox_keypair *kp;
- unsigned int len;
- gsize ucl_len;
- int dec_len;
+ size_t len;
+ size_t ucl_len;
+ size_t dec_len;
gpointer target;
if (ucl_object_type(obj) != UCL_OBJECT) {
@@ -605,7 +613,10 @@ rspamd_keypair_from_ucl(const ucl_object_t *obj)
str = ucl_object_tostring(elt);
if (g_ascii_strcasecmp(str, "hex") == 0) {
- is_hex = TRUE;
+ encoding = RSPAMD_KEYPAIR_ENCODING_HEX;
+ }
+ else if (g_ascii_strcasecmp(str, "base64") == 0) {
+ encoding = RSPAMD_KEYPAIR_ENCODING_BASE64;
}
/* TODO: handle errors */
}
@@ -618,13 +629,29 @@ rspamd_keypair_from_ucl(const ucl_object_t *obj)
target = rspamd_cryptobox_keypair_sk(kp, &len);
str = ucl_object_tolstring(privkey, &ucl_len);
- if (is_hex) {
+ switch (encoding) {
+ case RSPAMD_KEYPAIR_ENCODING_HEX:
dec_len = rspamd_decode_hex_buf(str, ucl_len, target, len);
- }
- else {
+ break;
+ case RSPAMD_KEYPAIR_ENCODING_ZBASE32:
dec_len = rspamd_decode_base32_buf(str, ucl_len, target, len, RSPAMD_BASE32_DEFAULT);
+ break;
+ case RSPAMD_KEYPAIR_ENCODING_BASE64:
+ dec_len = rspamd_cryptobox_base64_decode(str, ucl_len, target, &len);
+ break;
+ case RSPAMD_KEYPAIR_ENCODING_BINARY:
+ if (len >= ucl_len) {
+ memcpy(target, str, ucl_len);
+ dec_len = ucl_len;
+ }
+ else {
+ memcpy(target, str, len);
+ dec_len = len;
+ }
+ break;
}
+
if (dec_len != (int) len) {
rspamd_keypair_unref(kp);
@@ -634,11 +661,26 @@ rspamd_keypair_from_ucl(const ucl_object_t *obj)
target = rspamd_cryptobox_keypair_pk(kp, &len);
str = ucl_object_tolstring(pubkey, &ucl_len);
- if (is_hex) {
+ switch (encoding) {
+ case RSPAMD_KEYPAIR_ENCODING_HEX:
dec_len = rspamd_decode_hex_buf(str, ucl_len, target, len);
- }
- else {
+ break;
+ case RSPAMD_KEYPAIR_ENCODING_ZBASE32:
dec_len = rspamd_decode_base32_buf(str, ucl_len, target, len, RSPAMD_BASE32_DEFAULT);
+ break;
+ case RSPAMD_KEYPAIR_ENCODING_BASE64:
+ dec_len = rspamd_cryptobox_base64_decode(str, ucl_len, target, &len);
+ break;
+ case RSPAMD_KEYPAIR_ENCODING_BINARY:
+ if (len >= ucl_len) {
+ memcpy(target, str, ucl_len);
+ dec_len = ucl_len;
+ }
+ else {
+ memcpy(target, str, len);
+ dec_len = len;
+ }
+ break;
}
if (dec_len != (int) len) {
@@ -660,24 +702,15 @@ rspamd_keypair_from_ucl(const ucl_object_t *obj)
ucl_object_t *
rspamd_keypair_to_ucl(struct rspamd_cryptobox_keypair *kp,
+ enum rspamd_cryptobox_keypair_encoding encoding,
enum rspamd_keypair_dump_flags flags)
{
ucl_object_t *ucl_out, *elt;
- int how = 0;
GString *keypair_out;
- const char *encoding;
+ const char *encoding_str = NULL;
g_assert(kp != NULL);
- if (flags & RSPAMD_KEYPAIR_DUMP_HEX) {
- how |= RSPAMD_KEYPAIR_HEX;
- encoding = "hex";
- }
- else {
- how |= RSPAMD_KEYPAIR_BASE32;
- encoding = "base32";
- }
-
if (flags & RSPAMD_KEYPAIR_DUMP_FLATTENED) {
ucl_out = ucl_object_typed_new(UCL_OBJECT);
elt = ucl_out;
@@ -688,10 +721,17 @@ rspamd_keypair_to_ucl(struct rspamd_cryptobox_keypair *kp,
ucl_object_insert_key(ucl_out, elt, "keypair", 0, false);
}
+ if (encoding == RSPAMD_KEYPAIR_ENCODING_HEX) {
+ encoding_str = "hex";
+ }
+ else if (encoding == RSPAMD_KEYPAIR_ENCODING_BASE64) {
+ encoding_str = "base64";
+ }
+ /* XXX: maybe support binary here ? */
/* pubkey part */
- keypair_out = rspamd_keypair_print(kp,
- RSPAMD_KEYPAIR_PUBKEY | how);
+ keypair_out = rspamd_keypair_print(kp, encoding,
+ RSPAMD_KEYPAIR_PUBKEY | flags);
ucl_object_insert_key(elt,
ucl_object_fromlstring(keypair_out->str, keypair_out->len),
"pubkey", 0, false);
@@ -699,8 +739,8 @@ rspamd_keypair_to_ucl(struct rspamd_cryptobox_keypair *kp,
if (!(flags & RSPAMD_KEYPAIR_DUMP_NO_SECRET)) {
/* privkey part */
- keypair_out = rspamd_keypair_print(kp,
- RSPAMD_KEYPAIR_PRIVKEY | how);
+ keypair_out = rspamd_keypair_print(kp, encoding,
+ RSPAMD_KEYPAIR_PRIVKEY | flags);
ucl_object_insert_key(elt,
ucl_object_fromlstring(keypair_out->str, keypair_out->len),
"privkey", 0, false);
@@ -708,15 +748,18 @@ rspamd_keypair_to_ucl(struct rspamd_cryptobox_keypair *kp,
}
keypair_out = rspamd_keypair_print(kp,
- RSPAMD_KEYPAIR_ID | how);
+ encoding,
+ RSPAMD_KEYPAIR_ID | flags);
ucl_object_insert_key(elt,
ucl_object_fromlstring(keypair_out->str, keypair_out->len),
"id", 0, false);
g_string_free(keypair_out, TRUE);
- ucl_object_insert_key(elt,
- ucl_object_fromstring(encoding),
- "encoding", 0, false);
+ if (encoding_str) {
+ ucl_object_insert_key(elt,
+ ucl_object_fromstring(encoding_str),
+ "encoding", 0, false);
+ }
ucl_object_insert_key(elt,
ucl_object_fromstring("curve25519"),
diff --git a/src/libcryptobox/keypair.h b/src/libcryptobox/keypair.h
index 97b46cbf5..80f4c4bd7 100644
--- a/src/libcryptobox/keypair.h
+++ b/src/libcryptobox/keypair.h
@@ -181,29 +181,8 @@ const unsigned char *rspamd_pubkey_get_pk(struct rspamd_cryptobox_pubkey *pk,
#define RSPAMD_KEYPAIR_ID 0x4
/** Print short key id */
#define RSPAMD_KEYPAIR_ID_SHORT 0x8
-/** Encode output with base 32 */
-#define RSPAMD_KEYPAIR_BASE32 0x10
/** Human readable output */
#define RSPAMD_KEYPAIR_HUMAN 0x20
-#define RSPAMD_KEYPAIR_HEX 0x40
-
-/**
- * Print keypair encoding it if needed
- * @param key key to print
- * @param how flags that specifies printing behaviour
- * @return newly allocated string with keypair
- */
-GString *rspamd_keypair_print(struct rspamd_cryptobox_keypair *kp,
- unsigned int how);
-
-/**
- * Print pubkey encoding it if needed
- * @param key key to print
- * @param how flags that specifies printing behaviour
- * @return newly allocated string with keypair
- */
-GString *rspamd_pubkey_print(struct rspamd_cryptobox_pubkey *pk,
- unsigned int how);
/** Get keypair pubkey ID */
#define RSPAMD_KEYPAIR_COMPONENT_ID 0
@@ -232,17 +211,45 @@ struct rspamd_cryptobox_keypair *rspamd_keypair_from_ucl(const ucl_object_t *obj
enum rspamd_keypair_dump_flags {
RSPAMD_KEYPAIR_DUMP_DEFAULT = 0,
- RSPAMD_KEYPAIR_DUMP_HEX = 1u << 0u,
RSPAMD_KEYPAIR_DUMP_NO_SECRET = 1u << 1u,
RSPAMD_KEYPAIR_DUMP_FLATTENED = 1u << 2u,
};
+enum rspamd_cryptobox_keypair_encoding {
+ RSPAMD_KEYPAIR_ENCODING_ZBASE32 = 0,
+ RSPAMD_KEYPAIR_ENCODING_HEX = 1,
+ RSPAMD_KEYPAIR_ENCODING_BASE64 = 2,
+ RSPAMD_KEYPAIR_ENCODING_BINARY = 3,
+ RSPAMD_KEYPAIR_ENCODING_DEFAULT = RSPAMD_KEYPAIR_ENCODING_ZBASE32,
+};
+
+
+/**
+ * Print pubkey encoding it if needed
+ * @param key key to print
+ * @param how flags that specifies printing behaviour
+ * @return newly allocated string with keypair
+ */
+GString *rspamd_pubkey_print(struct rspamd_cryptobox_pubkey *pk,
+ enum rspamd_cryptobox_keypair_encoding encoding,
+ unsigned int how);
+/**
+ * Print keypair encoding it if needed
+ * @param key key to print
+ * @param how flags that specifies printing behaviour
+ * @return newly allocated string with keypair
+ */
+GString *rspamd_keypair_print(struct rspamd_cryptobox_keypair *kp,
+ enum rspamd_cryptobox_keypair_encoding encoding,
+ unsigned int how);
/**
* Converts keypair to ucl object
* @param kp
* @return
*/
+
ucl_object_t *rspamd_keypair_to_ucl(struct rspamd_cryptobox_keypair *kp,
+ enum rspamd_cryptobox_keypair_encoding encoding,
enum rspamd_keypair_dump_flags flags);
diff --git a/src/libserver/http/http_connection.c b/src/libserver/http/http_connection.c
index 1ae9bb034..baf37a385 100644
--- a/src/libserver/http/http_connection.c
+++ b/src/libserver/http/http_connection.c
@@ -1987,9 +1987,11 @@ int rspamd_http_message_write_header(const char *mime_type, gboolean encrypted,
GString *b32_key, *b32_id;
b32_key = rspamd_keypair_print(priv->local_key,
- RSPAMD_KEYPAIR_PUBKEY | RSPAMD_KEYPAIR_BASE32);
+ RSPAMD_KEYPAIR_ENCODING_DEFAULT,
+ RSPAMD_KEYPAIR_PUBKEY);
b32_id = rspamd_pubkey_print(peer_key,
- RSPAMD_KEYPAIR_ID_SHORT | RSPAMD_KEYPAIR_BASE32);
+ RSPAMD_KEYPAIR_ENCODING_DEFAULT,
+ RSPAMD_KEYPAIR_ID_SHORT);
/* XXX: add some fuzz here */
rspamd_printf_fstring(&*buf, "Key: %v=%v\r\n", b32_id, b32_key);
g_string_free(b32_key, TRUE);
diff --git a/src/libserver/maps/map.c b/src/libserver/maps/map.c
index 631455755..43a9d5d86 100644
--- a/src/libserver/maps/map.c
+++ b/src/libserver/maps/map.c
@@ -685,7 +685,8 @@ rspamd_map_check_sig_pk_mem(const unsigned char *sig,
if (ret) {
b32_key = rspamd_pubkey_print(pk,
- RSPAMD_KEYPAIR_BASE32 | RSPAMD_KEYPAIR_PUBKEY);
+ RSPAMD_KEYPAIR_ENCODING_DEFAULT,
+ RSPAMD_KEYPAIR_PUBKEY);
msg_info_map("verified signature for %s using trusted key %v",
map->name, b32_key);
g_string_free(b32_key, TRUE);
@@ -728,7 +729,8 @@ rspamd_map_check_file_sig(const char *fname,
/* We just check pk against the trusted db of keys */
b32_key = rspamd_pubkey_print(pk,
- RSPAMD_KEYPAIR_BASE32 | RSPAMD_KEYPAIR_PUBKEY);
+ RSPAMD_KEYPAIR_ENCODING_DEFAULT,
+ RSPAMD_KEYPAIR_PUBKEY);
g_assert(b32_key != NULL);
if (g_hash_table_lookup(map->cfg->trusted_keys, b32_key->str) == NULL) {
diff --git a/src/lua/lua_cryptobox.c b/src/lua/lua_cryptobox.c
index c9cac1562..9600a4732 100644
--- a/src/lua/lua_cryptobox.c
+++ b/src/lua/lua_cryptobox.c
@@ -503,7 +503,7 @@ lua_cryptobox_keypair_gc(lua_State *L)
}
/***
- * @method keypair:totable([hex=false]])
+ * @method keypair:totable([encoding="zbase32"])
* Converts keypair to table (not very safe due to memory leftovers)
*/
static int
@@ -512,16 +512,39 @@ lua_cryptobox_keypair_totable(lua_State *L)
LUA_TRACE_POINT;
struct rspamd_cryptobox_keypair *kp = lua_check_cryptobox_keypair(L, 1);
ucl_object_t *obj;
- gboolean hex = FALSE;
+ enum rspamd_cryptobox_keypair_encoding encoding = RSPAMD_KEYPAIR_ENCODING_DEFAULT;
int ret = 1;
if (kp != NULL) {
if (lua_isboolean(L, 2)) {
- hex = lua_toboolean(L, 2);
+ if (lua_toboolean(L, 2)) {
+ encoding = RSPAMD_KEYPAIR_ENCODING_HEX;
+ }
}
+ else if (lua_isstring(L, 2)) {
+ const char *enc = lua_tostring(L, 2);
- obj = rspamd_keypair_to_ucl(kp, hex ? RSPAMD_KEYPAIR_DUMP_HEX : RSPAMD_KEYPAIR_DUMP_DEFAULT);
+ if (g_ascii_strcasecmp(enc, "hex") == 0) {
+ encoding = RSPAMD_KEYPAIR_ENCODING_HEX;
+ }
+ else if (g_ascii_strcasecmp(enc, "zbase32") == 0 ||
+ g_ascii_strcasecmp(enc, "default") == 0 ||
+ g_ascii_strcasecmp(enc, "base32") == 0) {
+ encoding = RSPAMD_KEYPAIR_ENCODING_ZBASE32;
+ }
+ else if (g_ascii_strcasecmp(enc, "base64") == 0) {
+ encoding = RSPAMD_KEYPAIR_ENCODING_BASE64;
+ }
+ else if (g_ascii_strcasecmp(enc, "binary") == 0) {
+ encoding = RSPAMD_KEYPAIR_ENCODING_BINARY;
+ }
+ else {
+ return luaL_error(L, "unknown encoding (known are: hex, zbase32/default, base64, binary: %s", enc);
+ }
+ }
+
+ obj = rspamd_keypair_to_ucl(kp, encoding, RSPAMD_KEYPAIR_DUMP_DEFAULT);
ret = ucl_object_push_lua(L, obj, true);
ucl_object_unref(obj);
@@ -1415,7 +1438,11 @@ lua_cryptobox_hash_reset(lua_State *L)
rspamd_cryptobox_hash_init(h->content.h, NULL, 0);
break;
case LUA_CRYPTOBOX_HASH_SSL:
+#if OPENSSL_VERSION_MAJOR >= 3
EVP_DigestInit(h->content.c, EVP_MD_CTX_get0_md(h->content.c));
+#else
+ EVP_DigestInit(h->content.c, EVP_MD_CTX_md(h->content.c));
+#endif
break;
case LUA_CRYPTOBOX_HASH_HMAC:
#if OPENSSL_VERSION_NUMBER < 0x10100000L || \
@@ -2508,31 +2535,20 @@ lua_cryptobox_gen_dkim_keypair(lua_State *L)
}
if (strcmp(alg_str, "rsa") == 0) {
- BIGNUM *e;
EVP_PKEY *pk;
- e = BN_new();
pk = EVP_PKEY_new();
- if (BN_set_word(e, RSA_F4) != 1) {
- BN_free(e);
- EVP_PKEY_free(pk);
-
- return luaL_error(L, "BN_set_word failed");
- }
EVP_PKEY_CTX *pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_RSA, NULL);
if (EVP_PKEY_keygen_init(pctx) != 1) {
- BN_free(e);
EVP_PKEY_free(pk);
EVP_PKEY_CTX_free(pctx);
return luaL_error(L, "EVP_PKEY_keygen_init failed");
}
EVP_PKEY_CTX_set_rsa_keygen_bits(pctx, nbits);
- EVP_PKEY_CTX_set1_rsa_keygen_pubexp(pctx, e);
if (EVP_PKEY_keygen(pctx, &pk) != 1) {
- BN_free(e);
EVP_PKEY_free(pk);
EVP_PKEY_CTX_free(pctx);
@@ -2552,7 +2568,6 @@ lua_cryptobox_gen_dkim_keypair(lua_State *L)
if (rc == 0) {
BIO_free(mbio);
- BN_free(e);
EVP_PKEY_free(pk);
return luaL_error(L, "i2d_RSAPrivateKey_bio failed");
@@ -2574,7 +2589,6 @@ lua_cryptobox_gen_dkim_keypair(lua_State *L)
if (rc == 0) {
BIO_free(mbio);
- BN_free(e);
EVP_PKEY_free(pk);
return luaL_error(L, "i2d_RSA_PUBKEY_bio failed");
@@ -2590,7 +2604,6 @@ lua_cryptobox_gen_dkim_keypair(lua_State *L)
pub_out->len = b64_len;
pub_out->flags = RSPAMD_TEXT_FLAG_OWN;
- BN_free(e);
EVP_PKEY_free(pk);
BIO_free(mbio);
}
diff --git a/src/lua/lua_map.c b/src/lua/lua_map.c
index 1cc2ce1bd..062613bd7 100644
--- a/src/lua/lua_map.c
+++ b/src/lua/lua_map.c
@@ -1256,8 +1256,8 @@ lua_map_get_sign_key(lua_State *L)
bk = g_ptr_array_index(map->map->backends, i);
if (bk->trusted_pubkey) {
- ret = rspamd_pubkey_print(bk->trusted_pubkey,
- RSPAMD_KEYPAIR_PUBKEY | RSPAMD_KEYPAIR_BASE32);
+ ret = rspamd_pubkey_print(bk->trusted_pubkey, RSPAMD_KEYPAIR_ENCODING_DEFAULT,
+ RSPAMD_KEYPAIR_PUBKEY);
}
else {
ret = NULL;
diff --git a/src/lua/lua_rsa.c b/src/lua/lua_rsa.c
index b7be612b0..4b9aa0354 100644
--- a/src/lua/lua_rsa.c
+++ b/src/lua/lua_rsa.c
@@ -261,6 +261,7 @@ lua_rsa_pubkey_gc(lua_State *L)
EVP_PKEY *pkey = lua_check_rsa_pubkey(L, 1);
if (pkey != NULL) {
+ /* It's actually EVP_PKEY_unref, thanks for that API */
EVP_PKEY_free(pkey);
}
@@ -522,6 +523,7 @@ lua_rsa_privkey_gc(lua_State *L)
EVP_PKEY *pkey = lua_check_rsa_privkey(L, 1);
if (pkey != NULL) {
+ /* It's actually EVP_PKEY_unref, thanks for that API */
EVP_PKEY_free(pkey);
}
@@ -758,7 +760,7 @@ lua_rsa_sign_memory(lua_State *L)
data = luaL_checklstring(L, 2, &sz);
if (pkey != NULL && data != NULL) {
- signature = rspamd_fstring_sized_new(EVP_PKEY_get_size(pkey));
+ signature = rspamd_fstring_sized_new(EVP_PKEY_size(pkey));
EVP_PKEY_CTX *pctx = EVP_PKEY_CTX_new(pkey, NULL);
g_assert(pctx != NULL);
@@ -791,7 +793,6 @@ lua_rsa_sign_memory(lua_State *L)
static int
lua_rsa_keypair(lua_State *L)
{
- BIGNUM *e;
EVP_PKEY *pkey = NULL, *pub_pkey, *priv_pkey, **ppkey;
int bits = lua_gettop(L) > 0 ? lua_tointeger(L, 1) : 1024;
@@ -799,32 +800,31 @@ lua_rsa_keypair(lua_State *L)
return luaL_error(L, "invalid bits count");
}
- e = BN_new();
-
- g_assert(BN_set_word(e, RSA_F4) == 1);
EVP_PKEY_CTX *pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_RSA, NULL);
g_assert(pctx != NULL);
g_assert(EVP_PKEY_keygen_init(pctx) == 1);
g_assert(EVP_PKEY_CTX_set_rsa_keygen_bits(pctx, bits) == 1);
- g_assert(EVP_PKEY_CTX_set1_rsa_keygen_pubexp(pctx, e) == 1);
-
g_assert(EVP_PKEY_keygen(pctx, &pkey) == 1);
g_assert(pkey != NULL);
- priv_pkey = EVP_PKEY_dup(pkey);
+ /* Increase refcount and share */
+ g_assert(EVP_PKEY_up_ref(pkey) == 1);
+ priv_pkey = pkey;
+
ppkey = lua_newuserdata(L, sizeof(EVP_PKEY *));
rspamd_lua_setclass(L, rspamd_rsa_privkey_classname, -1);
*ppkey = priv_pkey;
- pub_pkey = EVP_PKEY_dup(pkey);
+ /* Increase refcount and share */
+ g_assert(EVP_PKEY_up_ref(pkey) == 1);
+ pub_pkey = pkey;
ppkey = lua_newuserdata(L, sizeof(EVP_PKEY *));
rspamd_lua_setclass(L, rspamd_rsa_pubkey_classname, -1);
*ppkey = pub_pkey;
EVP_PKEY_free(pkey);
EVP_PKEY_CTX_free(pctx);
- BN_free(e);
return 2;
}
diff --git a/src/plugins/lua/dmarc.lua b/src/plugins/lua/dmarc.lua
index 792672bd0..28b3db867 100644
--- a/src/plugins/lua/dmarc.lua
+++ b/src/plugins/lua/dmarc.lua
@@ -264,6 +264,13 @@ local function dmarc_validate_policy(task, policy, hdrfromdom, dmarc_esld)
end
if policy.rua and redis_params and settings.reporting.enabled then
+ if settings.reporting.only_domains then
+ if not (settings.reporting.only_domains:get_key(policy.domain) or
+ settings.reporting.only_domains:get_key(rspamd_util.get_tld(policy.domain))) then
+ rspamd_logger.info(task, 'DMARC reporting suppressed for sender domain %s', policy.domain)
+ return
+ end
+ end
if settings.reporting.exclude_domains then
if settings.reporting.exclude_domains:get_key(policy.domain) or
settings.reporting.exclude_domains:get_key(rspamd_util.get_tld(policy.domain)) then
@@ -527,6 +534,11 @@ if type(settings.reporting) == 'table' then
type = 'map',
description = 'Recipients not to store DMARC reports for'
},
+ only_domains = {
+ optional = true,
+ type = 'map',
+ description = 'Domains to store DMARC reports about'
+ },
})
end
diff --git a/src/rspamadm/signtool.c b/src/rspamadm/signtool.c
index ddc3d45df..6d60e6700 100644
--- a/src/rspamadm/signtool.c
+++ b/src/rspamadm/signtool.c
@@ -366,7 +366,8 @@ rspamadm_sign_file(const char *fname, struct rspamd_cryptobox_keypair *kp)
}
else {
b32_pk = rspamd_keypair_print(kp,
- RSPAMD_KEYPAIR_PUBKEY | RSPAMD_KEYPAIR_BASE32);
+ RSPAMD_KEYPAIR_ENCODING_DEFAULT,
+ RSPAMD_KEYPAIR_PUBKEY);
if (b32_pk) {
rspamd_fprintf(pub_fp, "%v", b32_pk);
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-11 10:37:01 +0000