diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/src/pdkim/signing.c | 30 | ||||
| -rw-r--r-- | src/src/tls-openssl.c | 2 |
2 files changed, 21 insertions, 11 deletions
diff --git a/src/src/pdkim/signing.c b/src/src/pdkim/signing.c index 7b8a6a0df..2a086b1e2 100644 --- a/src/src/pdkim/signing.c +++ b/src/src/pdkim/signing.c @@ -831,6 +831,7 @@ const uschar * exim_dkim_verify(ev_ctx * verify_ctx, hashmethod hash, blob * data, blob * sig) { const EVP_MD * md; +const uschar * where; switch (hash) { @@ -859,18 +860,25 @@ else { EVP_PKEY_CTX * ctx; - if ( (ctx = EVP_PKEY_CTX_new(verify_ctx->key, NULL)) - && EVP_PKEY_verify_init(ctx) > 0 - && EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) > 0 - && EVP_PKEY_CTX_set_signature_md(ctx, md) > 0 - && EVP_PKEY_verify(ctx, sig->data, sig->len, - data->data, data->len) == 1 - ) - { EVP_PKEY_CTX_free(ctx); return NULL; } - - if (ctx) EVP_PKEY_CTX_free(ctx); + if ((where = US"EVP_PKEY_CTX_new", + (ctx = EVP_PKEY_CTX_new(verify_ctx->key, NULL)))) + { + if ( (where = US"EVP_PKEY_verify_init", + EVP_PKEY_verify_init(ctx) > 0) + && (where = US"EVP_PKEY_CTX_set_rsa_padding", + EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) > 0) + && (where = US"EVP_PKEY_CTX_set_signature_md", + EVP_PKEY_CTX_set_signature_md(ctx, md) > 0) + && (where = US"EVP_PKEY_verify", + EVP_PKEY_verify(ctx, sig->data, sig->len, + data->data, data->len) == 1) + ) + { EVP_PKEY_CTX_free(ctx); return NULL; } + + EVP_PKEY_CTX_free(ctx); + } } -return US ERR_error_string(ERR_get_error(), NULL); +return string_sprintf("%s: %s", where, ERR_error_string(ERR_get_error(), NULL)); } diff --git a/src/src/tls-openssl.c b/src/src/tls-openssl.c index 8a1fec6a9..8f4cf4d82 100644 --- a/src/src/tls-openssl.c +++ b/src/src/tls-openssl.c @@ -2281,6 +2281,8 @@ if (rc <= 0) } DEBUG(D_tls) debug_printf("SSL_accept was successful\n"); +ERR_clear_error(); /* Even success can leave errors in the stack. Seen with + anon-authentication ciphersuite negociated. */ /* TLS has been set up. Adjust the input functions to read via TLS, and initialize things. */ |