From: Vsevolod Stakhov <vsevolod@highsecure.ru>
Date: Wed, 9 Aug 2017 18:15:20 +0000 (+0100)
Subject: [Fix] Reject invalid bh for DKIM signatures earlier
X-Git-Tag: 1.7.0~750
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=2bf9da4b4d9a6658a9eb01d52a372caf50442521;p=thirdparty%2Frspamd.git

[Fix] Reject invalid bh for DKIM signatures earlier
---

diff --git a/src/libserver/dkim.c b/src/libserver/dkim.c
index 06adab305b..72cc7232f7 100644
--- a/src/libserver/dkim.c
+++ b/src/libserver/dkim.c
@@ -2196,6 +2196,14 @@ rspamd_dkim_check (rspamd_dkim_context_t *ctx,
 					}
 				}
 			}
+			else {
+				msg_debug_dkim (
+						"bh value mismatch: %*xs versus %*xs",
+						dlen, ctx->bh,
+						dlen, cached_bh->digest_normal);
+
+				return DKIM_REJECT;
+			}
 		}
 
 		if (cpy_ctx) {