crypto/asn1/asn_mime.c

   1 /*
   2  * Copyright 2008-2018 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include <stdio.h>
  11 #include "crypto/ctype.h"
  12 #include "internal/cryptlib.h"
  13 #include <openssl/rand.h>
  14 #include <openssl/x509.h>
  15 #include <openssl/asn1.h>
  16 #include <openssl/asn1t.h>
  17 #include "crypto/evp.h"
  18 #include "internal/bio.h"
  19 #include "asn1_local.h"
  20
  21 /*
  22  * Generalised MIME like utilities for streaming ASN1. Although many have a
  23  * PKCS7/CMS like flavour others are more general purpose.
  24  */
  25
  26 /*
  27  * MIME format structures Note that all are translated to lower case apart
  28  * from parameter values. Quotes are stripped off
  29  */
  30
  31 struct mime_param_st {
  32     char *param_name;           /* Param name e.g. "micalg" */
  33     char *param_value;          /* Param value e.g. "sha1" */
  34 };
  35
  36 struct mime_header_st {
  37     char *name;                 /* Name of line e.g. "content-type" */
  38     char *value;                /* Value of line e.g. "text/plain" */
  39     STACK_OF(MIME_PARAM) *params; /* Zero or more parameters */
  40 };
  41
  42 static int asn1_output_data(BIO *out, BIO *data, ASN1_VALUE *val, int flags,
  43                             const ASN1_ITEM *it);
  44 static char *strip_ends(char *name);
  45 static char *strip_start(char *name);
  46 static char *strip_end(char *name);
  47 static MIME_HEADER *mime_hdr_new(const char *name, const char *value);
  48 static int mime_hdr_addparam(MIME_HEADER *mhdr, const char *name, const char *value);
  49 static STACK_OF(MIME_HEADER) *mime_parse_hdr(BIO *bio);
  50 static int mime_hdr_cmp(const MIME_HEADER *const *a,
  51                         const MIME_HEADER *const *b);
  52 static int mime_param_cmp(const MIME_PARAM *const *a,
  53                           const MIME_PARAM *const *b);
  54 static void mime_param_free(MIME_PARAM *param);
  55 static int mime_bound_check(char *line, int linelen, const char *bound, int blen);
  56 static int multi_split(BIO *bio, const char *bound, STACK_OF(BIO) **ret);
  57 static int strip_eol(char *linebuf, int *plen, int flags);
  58 static MIME_HEADER *mime_hdr_find(STACK_OF(MIME_HEADER) *hdrs, const char *name);
  59 static MIME_PARAM *mime_param_find(MIME_HEADER *hdr, const char *name);
  60 static void mime_hdr_free(MIME_HEADER *hdr);
  61
  62 #define MAX_SMLEN 1024
  63 #define mime_debug(x)           /* x */
  64
  65 /* Output an ASN1 structure in BER format streaming if necessary */
  66
  67 /* unfortunately cannot constify this due to CMS_stream() and PKCS7_stream() */
  68 int i2d_ASN1_bio_stream(BIO *out, ASN1_VALUE *val, BIO *in, int flags,
  69                         const ASN1_ITEM *it)
  70 {
  71     /* If streaming create stream BIO and copy all content through it */
  72     if (flags & SMIME_STREAM) {
  73         BIO *bio, *tbio;
  74         bio = BIO_new_NDEF(out, val, it);
  75         if (!bio) {
  76             ASN1err(ASN1_F_I2D_ASN1_BIO_STREAM, ERR_R_MALLOC_FAILURE);
  77             return 0;
  78         }
  79         SMIME_crlf_copy(in, bio, flags);
  80         (void)BIO_flush(bio);
  81         /* Free up successive BIOs until we hit the old output BIO */
  82         do {
  83             tbio = BIO_pop(bio);
  84             BIO_free(bio);
  85             bio = tbio;
  86         } while (bio != out);
  87     }
  88     /*
  89      * else just write out ASN1 structure which will have all content stored
  90      * internally
  91      */
  92     else
  93         ASN1_item_i2d_bio(it, out, val);
  94     return 1;
  95 }
  96
  97 /* Base 64 read and write of ASN1 structure */
  98
  99 static int B64_write_ASN1(BIO *out, ASN1_VALUE *val, BIO *in, int flags,
 100                           const ASN1_ITEM *it)
 101 {
 102     BIO *b64;
 103     int r;
 104     b64 = BIO_new(BIO_f_base64());
 105     if (b64 == NULL) {
 106         ASN1err(ASN1_F_B64_WRITE_ASN1, ERR_R_MALLOC_FAILURE);
 107         return 0;
 108     }
 109     /*
 110      * prepend the b64 BIO so all data is base64 encoded.
 111      */
 112     out = BIO_push(b64, out);
 113     r = i2d_ASN1_bio_stream(out, val, in, flags, it);
 114     (void)BIO_flush(out);
 115     BIO_pop(out);
 116     BIO_free(b64);
 117     return r;
 118 }
 119
 120 /* Streaming ASN1 PEM write */
 121
 122 int PEM_write_bio_ASN1_stream(BIO *out, ASN1_VALUE *val, BIO *in, int flags,
 123                               const char *hdr, const ASN1_ITEM *it)
 124 {
 125     int r;
 126     BIO_printf(out, "-----BEGIN %s-----\n", hdr);
 127     r = B64_write_ASN1(out, val, in, flags, it);
 128     BIO_printf(out, "-----END %s-----\n", hdr);
 129     return r;
 130 }
 131
 132 static ASN1_VALUE *b64_read_asn1(BIO *bio, const ASN1_ITEM *it)
 133 {
 134     BIO *b64;
 135     ASN1_VALUE *val;
 136
 137     if ((b64 = BIO_new(BIO_f_base64())) == NULL) {
 138         ASN1err(ASN1_F_B64_READ_ASN1, ERR_R_MALLOC_FAILURE);
 139         return 0;
 140     }
 141     bio = BIO_push(b64, bio);
 142     val = ASN1_item_d2i_bio(it, bio, NULL);
 143     if (!val)
 144         ASN1err(ASN1_F_B64_READ_ASN1, ASN1_R_DECODE_ERROR);
 145     (void)BIO_flush(bio);
 146     BIO_pop(bio);
 147     BIO_free(b64);
 148     return val;
 149 }
 150
 151 /* Generate the MIME "micalg" parameter from RFC3851, RFC4490 */
 152
 153 static int asn1_write_micalg(BIO *out, STACK_OF(X509_ALGOR) *mdalgs)
 154 {
 155     const EVP_MD *md;
 156     int i, have_unknown = 0, write_comma, ret = 0, md_nid;
 157     have_unknown = 0;
 158     write_comma = 0;
 159     for (i = 0; i < sk_X509_ALGOR_num(mdalgs); i++) {
 160         if (write_comma)
 161             BIO_write(out, ",", 1);
 162         write_comma = 1;
 163         md_nid = OBJ_obj2nid(sk_X509_ALGOR_value(mdalgs, i)->algorithm);
 164         md = EVP_get_digestbynid(md_nid);
 165         if (md && md->md_ctrl) {
 166             int rv;
 167             char *micstr;
 168             rv = md->md_ctrl(NULL, EVP_MD_CTRL_MICALG, 0, &micstr);
 169             if (rv > 0) {
 170                 BIO_puts(out, micstr);
 171                 OPENSSL_free(micstr);
 172                 continue;
 173             }
 174             if (rv != -2)
 175                 goto err;
 176         }
 177         switch (md_nid) {
 178         case NID_sha1:
 179             BIO_puts(out, "sha1");
 180             break;
 181
 182         case NID_md5:
 183             BIO_puts(out, "md5");
 184             break;
 185
 186         case NID_sha256:
 187             BIO_puts(out, "sha-256");
 188             break;
 189
 190         case NID_sha384:
 191             BIO_puts(out, "sha-384");
 192             break;
 193
 194         case NID_sha512:
 195             BIO_puts(out, "sha-512");
 196             break;
 197
 198         case NID_id_GostR3411_94:
 199             BIO_puts(out, "gostr3411-94");
 200             goto err;
 201
 202         default:
 203             if (have_unknown)
 204                 write_comma = 0;
 205             else {
 206                 BIO_puts(out, "unknown");
 207                 have_unknown = 1;
 208             }
 209             break;
 210
 211         }
 212     }
 213
 214     ret = 1;
 215  err:
 216
 217     return ret;
 218
 219 }
 220
 221 /* SMIME sender */
 222
 223 int SMIME_write_ASN1(BIO *bio, ASN1_VALUE *val, BIO *data, int flags,
 224                      int ctype_nid, int econt_nid,
 225                      STACK_OF(X509_ALGOR) *mdalgs, const ASN1_ITEM *it)
 226 {
 227     char bound[33], c;
 228     int i;
 229     const char *mime_prefix, *mime_eol, *cname = "smime.p7m";
 230     const char *msg_type = NULL;
 231     if (flags & SMIME_OLDMIME)
 232         mime_prefix = "application/x-pkcs7-";
 233     else
 234         mime_prefix = "application/pkcs7-";
 235
 236     if (flags & SMIME_CRLFEOL)
 237         mime_eol = "\r\n";
 238     else
 239         mime_eol = "\n";
 240     if ((flags & SMIME_DETACHED) && data) {
 241         /* We want multipart/signed */
 242         /* Generate a random boundary */
 243         if (RAND_bytes((unsigned char *)bound, 32) <= 0)
 244             return 0;
 245         for (i = 0; i < 32; i++) {
 246             c = bound[i] & 0xf;
 247             if (c < 10)
 248                 c += '0';
 249             else
 250                 c += 'A' - 10;
 251             bound[i] = c;
 252         }
 253         bound[32] = 0;
 254         BIO_printf(bio, "MIME-Version: 1.0%s", mime_eol);
 255         BIO_printf(bio, "Content-Type: multipart/signed;");
 256         BIO_printf(bio, " protocol=\"%ssignature\";", mime_prefix);
 257         BIO_puts(bio, " micalg=\"");
 258         asn1_write_micalg(bio, mdalgs);
 259         BIO_printf(bio, "\"; boundary=\"----%s\"%s%s",
 260                    bound, mime_eol, mime_eol);
 261         BIO_printf(bio, "This is an S/MIME signed message%s%s",
 262                    mime_eol, mime_eol);
 263         /* Now write out the first part */
 264         BIO_printf(bio, "------%s%s", bound, mime_eol);
 265         if (!asn1_output_data(bio, data, val, flags, it))
 266             return 0;
 267         BIO_printf(bio, "%s------%s%s", mime_eol, bound, mime_eol);
 268
 269         /* Headers for signature */
 270
 271         BIO_printf(bio, "Content-Type: %ssignature;", mime_prefix);
 272         BIO_printf(bio, " name=\"smime.p7s\"%s", mime_eol);
 273         BIO_printf(bio, "Content-Transfer-Encoding: base64%s", mime_eol);
 274         BIO_printf(bio, "Content-Disposition: attachment;");
 275         BIO_printf(bio, " filename=\"smime.p7s\"%s%s", mime_eol, mime_eol);
 276         B64_write_ASN1(bio, val, NULL, 0, it);
 277         BIO_printf(bio, "%s------%s--%s%s", mime_eol, bound,
 278                    mime_eol, mime_eol);
 279         return 1;
 280     }
 281
 282     /* Determine smime-type header */
 283
 284     if (ctype_nid == NID_pkcs7_enveloped)
 285         msg_type = "enveloped-data";
 286     else if (ctype_nid == NID_pkcs7_signed) {
 287         if (econt_nid == NID_id_smime_ct_receipt)
 288             msg_type = "signed-receipt";
 289         else if (sk_X509_ALGOR_num(mdalgs) >= 0)
 290             msg_type = "signed-data";
 291         else
 292             msg_type = "certs-only";
 293     } else if (ctype_nid == NID_id_smime_ct_compressedData) {
 294         msg_type = "compressed-data";
 295         cname = "smime.p7z";
 296     }
 297     /* MIME headers */
 298     BIO_printf(bio, "MIME-Version: 1.0%s", mime_eol);
 299     BIO_printf(bio, "Content-Disposition: attachment;");
 300     BIO_printf(bio, " filename=\"%s\"%s", cname, mime_eol);
 301     BIO_printf(bio, "Content-Type: %smime;", mime_prefix);
 302     if (msg_type)
 303         BIO_printf(bio, " smime-type=%s;", msg_type);
 304     BIO_printf(bio, " name=\"%s\"%s", cname, mime_eol);
 305     BIO_printf(bio, "Content-Transfer-Encoding: base64%s%s",
 306                mime_eol, mime_eol);
 307     if (!B64_write_ASN1(bio, val, data, flags, it))
 308         return 0;
 309     BIO_printf(bio, "%s", mime_eol);
 310     return 1;
 311 }
 312
 313 /* Handle output of ASN1 data */
 314
 315 /* cannot constify val because of CMS_dataFinal() */
 316 static int asn1_output_data(BIO *out, BIO *data, ASN1_VALUE *val, int flags,
 317                             const ASN1_ITEM *it)
 318 {
 319     BIO *tmpbio;
 320     const ASN1_AUX *aux = it->funcs;
 321     ASN1_STREAM_ARG sarg;
 322     int rv = 1;
 323
 324     /*
 325      * If data is not detached or resigning then the output BIO is already
 326      * set up to finalise when it is written through.
 327      */
 328     if (!(flags & SMIME_DETACHED) || (flags & PKCS7_REUSE_DIGEST)) {
 329         SMIME_crlf_copy(data, out, flags);
 330         return 1;
 331     }
 332
 333     if (!aux || !aux->asn1_cb) {
 334         ASN1err(ASN1_F_ASN1_OUTPUT_DATA, ASN1_R_STREAMING_NOT_SUPPORTED);
 335         return 0;
 336     }
 337
 338     sarg.out = out;
 339     sarg.ndef_bio = NULL;
 340     sarg.boundary = NULL;
 341
 342     /* Let ASN1 code prepend any needed BIOs */
 343
 344     if (aux->asn1_cb(ASN1_OP_DETACHED_PRE, &val, it, &sarg) <= 0)
 345         return 0;
 346
 347     /* Copy data across, passing through filter BIOs for processing */
 348     SMIME_crlf_copy(data, sarg.ndef_bio, flags);
 349
 350     /* Finalize structure */
 351     if (aux->asn1_cb(ASN1_OP_DETACHED_POST, &val, it, &sarg) <= 0)
 352         rv = 0;
 353
 354     /* Now remove any digests prepended to the BIO */
 355
 356     while (sarg.ndef_bio != out) {
 357         tmpbio = BIO_pop(sarg.ndef_bio);
 358         BIO_free(sarg.ndef_bio);
 359         sarg.ndef_bio = tmpbio;
 360     }
 361
 362     return rv;
 363
 364 }
 365
 366 /*
 367  * SMIME reader: handle multipart/signed and opaque signing. in multipart
 368  * case the content is placed in a memory BIO pointed to by "bcont". In
 369  * opaque this is set to NULL
 370  */
 371
 372 ASN1_VALUE *SMIME_read_ASN1(BIO *bio, BIO **bcont, const ASN1_ITEM *it)
 373 {
 374     BIO *asnin;
 375     STACK_OF(MIME_HEADER) *headers = NULL;
 376     STACK_OF(BIO) *parts = NULL;
 377     MIME_HEADER *hdr;
 378     MIME_PARAM *prm;
 379     ASN1_VALUE *val;
 380     int ret;
 381
 382     if (bcont)
 383         *bcont = NULL;
 384
 385     if ((headers = mime_parse_hdr(bio)) == NULL) {
 386         ASN1err(ASN1_F_SMIME_READ_ASN1, ASN1_R_MIME_PARSE_ERROR);
 387         return NULL;
 388     }
 389
 390     if ((hdr = mime_hdr_find(headers, "content-type")) == NULL
 391         || hdr->value == NULL) {
 392         sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
 393         ASN1err(ASN1_F_SMIME_READ_ASN1, ASN1_R_NO_CONTENT_TYPE);
 394         return NULL;
 395     }
 396
 397     /* Handle multipart/signed */
 398
 399     if (strcmp(hdr->value, "multipart/signed") == 0) {
 400         /* Split into two parts */
 401         prm = mime_param_find(hdr, "boundary");
 402         if (!prm || !prm->param_value) {
 403             sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
 404             ASN1err(ASN1_F_SMIME_READ_ASN1, ASN1_R_NO_MULTIPART_BOUNDARY);
 405             return NULL;
 406         }
 407         ret = multi_split(bio, prm->param_value, &parts);
 408         sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
 409         if (!ret || (sk_BIO_num(parts) != 2)) {
 410             ASN1err(ASN1_F_SMIME_READ_ASN1, ASN1_R_NO_MULTIPART_BODY_FAILURE);
 411             sk_BIO_pop_free(parts, BIO_vfree);
 412             return NULL;
 413         }
 414
 415         /* Parse the signature piece */
 416         asnin = sk_BIO_value(parts, 1);
 417
 418         if ((headers = mime_parse_hdr(asnin)) == NULL) {
 419             ASN1err(ASN1_F_SMIME_READ_ASN1, ASN1_R_MIME_SIG_PARSE_ERROR);
 420             sk_BIO_pop_free(parts, BIO_vfree);
 421             return NULL;
 422         }
 423
 424         /* Get content type */
 425
 426         if ((hdr = mime_hdr_find(headers, "content-type")) == NULL
 427             || hdr->value == NULL) {
 428             sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
 429             ASN1err(ASN1_F_SMIME_READ_ASN1, ASN1_R_NO_SIG_CONTENT_TYPE);
 430             sk_BIO_pop_free(parts, BIO_vfree);
 431             return NULL;
 432         }
 433
 434         if (strcmp(hdr->value, "application/x-pkcs7-signature") &&
 435             strcmp(hdr->value, "application/pkcs7-signature")) {
 436             ASN1err(ASN1_F_SMIME_READ_ASN1, ASN1_R_SIG_INVALID_MIME_TYPE);
 437             ERR_add_error_data(2, "type: ", hdr->value);
 438             sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
 439             sk_BIO_pop_free(parts, BIO_vfree);
 440             return NULL;
 441         }
 442         sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
 443         /* Read in ASN1 */
 444         if ((val = b64_read_asn1(asnin, it)) == NULL) {
 445             ASN1err(ASN1_F_SMIME_READ_ASN1, ASN1_R_ASN1_SIG_PARSE_ERROR);
 446             sk_BIO_pop_free(parts, BIO_vfree);
 447             return NULL;
 448         }
 449
 450         if (bcont) {
 451             *bcont = sk_BIO_value(parts, 0);
 452             BIO_free(asnin);
 453             sk_BIO_free(parts);
 454         } else
 455             sk_BIO_pop_free(parts, BIO_vfree);
 456         return val;
 457     }
 458
 459     /* OK, if not multipart/signed try opaque signature */
 460
 461     if (strcmp(hdr->value, "application/x-pkcs7-mime") &&
 462         strcmp(hdr->value, "application/pkcs7-mime")) {
 463         ASN1err(ASN1_F_SMIME_READ_ASN1, ASN1_R_INVALID_MIME_TYPE);
 464         ERR_add_error_data(2, "type: ", hdr->value);
 465         sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
 466         return NULL;
 467     }
 468
 469     sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
 470
 471     if ((val = b64_read_asn1(bio, it)) == NULL) {
 472         ASN1err(ASN1_F_SMIME_READ_ASN1, ASN1_R_ASN1_PARSE_ERROR);
 473         return NULL;
 474     }
 475     return val;
 476
 477 }
 478
 479 /* Copy text from one BIO to another making the output CRLF at EOL */
 480 int SMIME_crlf_copy(BIO *in, BIO *out, int flags)
 481 {
 482     BIO *bf;
 483     char eol;
 484     int len;
 485     char linebuf[MAX_SMLEN];
 486     /*
 487      * Buffer output so we don't write one line at a time. This is useful
 488      * when streaming as we don't end up with one OCTET STRING per line.
 489      */
 490     bf = BIO_new(BIO_f_buffer());
 491     if (bf == NULL)
 492         return 0;
 493     out = BIO_push(bf, out);
 494     if (flags & SMIME_BINARY) {
 495         while ((len = BIO_read(in, linebuf, MAX_SMLEN)) > 0)
 496             BIO_write(out, linebuf, len);
 497     } else {
 498         int eolcnt = 0;
 499         if (flags & SMIME_TEXT)
 500             BIO_printf(out, "Content-Type: text/plain\r\n\r\n");
 501         while ((len = BIO_gets(in, linebuf, MAX_SMLEN)) > 0) {
 502             eol = strip_eol(linebuf, &len, flags);
 503             if (len) {
 504                 /* Not EOF: write out all CRLF */
 505                 if (flags & SMIME_ASCIICRLF) {
 506                     int i;
 507                     for (i = 0; i < eolcnt; i++)
 508                         BIO_write(out, "\r\n", 2);
 509                     eolcnt = 0;
 510                 }
 511                 BIO_write(out, linebuf, len);
 512                 if (eol)
 513                     BIO_write(out, "\r\n", 2);
 514             } else if (flags & SMIME_ASCIICRLF)
 515                 eolcnt++;
 516             else if (eol)
 517                 BIO_write(out, "\r\n", 2);
 518         }
 519     }
 520     (void)BIO_flush(out);
 521     BIO_pop(out);
 522     BIO_free(bf);
 523     return 1;
 524 }
 525
 526 /* Strip off headers if they are text/plain */
 527 int SMIME_text(BIO *in, BIO *out)
 528 {
 529     char iobuf[4096];
 530     int len;
 531     STACK_OF(MIME_HEADER) *headers;
 532     MIME_HEADER *hdr;
 533
 534     if ((headers = mime_parse_hdr(in)) == NULL) {
 535         ASN1err(ASN1_F_SMIME_TEXT, ASN1_R_MIME_PARSE_ERROR);
 536         return 0;
 537     }
 538     if ((hdr = mime_hdr_find(headers, "content-type")) == NULL
 539         || hdr->value == NULL) {
 540         ASN1err(ASN1_F_SMIME_TEXT, ASN1_R_MIME_NO_CONTENT_TYPE);
 541         sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
 542         return 0;
 543     }
 544     if (strcmp(hdr->value, "text/plain")) {
 545         ASN1err(ASN1_F_SMIME_TEXT, ASN1_R_INVALID_MIME_TYPE);
 546         ERR_add_error_data(2, "type: ", hdr->value);
 547         sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
 548         return 0;
 549     }
 550     sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
 551     while ((len = BIO_read(in, iobuf, sizeof(iobuf))) > 0)
 552         BIO_write(out, iobuf, len);
 553     if (len < 0)
 554         return 0;
 555     return 1;
 556 }
 557
 558 /*
 559  * Split a multipart/XXX message body into component parts: result is
 560  * canonical parts in a STACK of bios
 561  */
 562
 563 static int multi_split(BIO *bio, const char *bound, STACK_OF(BIO) **ret)
 564 {
 565     char linebuf[MAX_SMLEN];
 566     int len, blen;
 567     int eol = 0, next_eol = 0;
 568     BIO *bpart = NULL;
 569     STACK_OF(BIO) *parts;
 570     char state, part, first;
 571
 572     blen = strlen(bound);
 573     part = 0;
 574     state = 0;
 575     first = 1;
 576     parts = sk_BIO_new_null();
 577     *ret = parts;
 578     if (*ret == NULL)
 579         return 0;
 580     while ((len = BIO_gets(bio, linebuf, MAX_SMLEN)) > 0) {
 581         state = mime_bound_check(linebuf, len, bound, blen);
 582         if (state == 1) {
 583             first = 1;
 584             part++;
 585         } else if (state == 2) {
 586             if (!sk_BIO_push(parts, bpart)) {
 587                 BIO_free(bpart);
 588                 return 0;
 589             }
 590             return 1;
 591         } else if (part) {
 592             /* Strip CR+LF from linebuf */
 593             next_eol = strip_eol(linebuf, &len, 0);
 594             if (first) {
 595                 first = 0;
 596                 if (bpart)
 597                     if (!sk_BIO_push(parts, bpart)) {
 598                         BIO_free(bpart);
 599                         return 0;
 600                     }
 601                 bpart = BIO_new(BIO_s_mem());
 602                 if (bpart == NULL)
 603                     return 0;
 604                 BIO_set_mem_eof_return(bpart, 0);
 605             } else if (eol)
 606                 BIO_write(bpart, "\r\n", 2);
 607             eol = next_eol;
 608             if (len)
 609                 BIO_write(bpart, linebuf, len);
 610         }
 611     }
 612     BIO_free(bpart);
 613     return 0;
 614 }
 615
 616 /* This is the big one: parse MIME header lines up to message body */
 617
 618 #define MIME_INVALID    0
 619 #define MIME_START      1
 620 #define MIME_TYPE       2
 621 #define MIME_NAME       3
 622 #define MIME_VALUE      4
 623 #define MIME_QUOTE      5
 624 #define MIME_COMMENT    6
 625
 626 static STACK_OF(MIME_HEADER) *mime_parse_hdr(BIO *bio)
 627 {
 628     char *p, *q, c;
 629     char *ntmp;
 630     char linebuf[MAX_SMLEN];
 631     MIME_HEADER *mhdr = NULL, *new_hdr = NULL;
 632     STACK_OF(MIME_HEADER) *headers;
 633     int len, state, save_state = 0;
 634
 635     headers = sk_MIME_HEADER_new(mime_hdr_cmp);
 636     if (headers == NULL)
 637         return NULL;
 638     while ((len = BIO_gets(bio, linebuf, MAX_SMLEN)) > 0) {
 639         /* If whitespace at line start then continuation line */
 640         if (mhdr && ossl_isspace(linebuf[0]))
 641             state = MIME_NAME;
 642         else
 643             state = MIME_START;
 644         ntmp = NULL;
 645         /* Go through all characters */
 646         for (p = linebuf, q = linebuf; (c = *p) && (c != '\r') && (c != '\n');
 647              p++) {
 648
 649             /*
 650              * State machine to handle MIME headers if this looks horrible
 651              * that's because it *is*
 652              */
 653
 654             switch (state) {
 655             case MIME_START:
 656                 if (c == ':') {
 657                     state = MIME_TYPE;
 658                     *p = 0;
 659                     ntmp = strip_ends(q);
 660                     q = p + 1;
 661                 }
 662                 break;
 663
 664             case MIME_TYPE:
 665                 if (c == ';') {
 666                     mime_debug("Found End Value\n");
 667                     *p = 0;
 668                     new_hdr = mime_hdr_new(ntmp, strip_ends(q));
 669                     if (new_hdr == NULL)
 670                         goto err;
 671                     if (!sk_MIME_HEADER_push(headers, new_hdr))
 672                         goto err;
 673                     mhdr = new_hdr;
 674                     new_hdr = NULL;
 675                     ntmp = NULL;
 676                     q = p + 1;
 677                     state = MIME_NAME;
 678                 } else if (c == '(') {
 679                     save_state = state;
 680                     state = MIME_COMMENT;
 681                 }
 682                 break;
 683
 684             case MIME_COMMENT:
 685                 if (c == ')') {
 686                     state = save_state;
 687                 }
 688                 break;
 689
 690             case MIME_NAME:
 691                 if (c == '=') {
 692                     state = MIME_VALUE;
 693                     *p = 0;
 694                     ntmp = strip_ends(q);
 695                     q = p + 1;
 696                 }
 697                 break;
 698
 699             case MIME_VALUE:
 700                 if (c == ';') {
 701                     state = MIME_NAME;
 702                     *p = 0;
 703                     mime_hdr_addparam(mhdr, ntmp, strip_ends(q));
 704                     ntmp = NULL;
 705                     q = p + 1;
 706                 } else if (c == '"') {
 707                     mime_debug("Found Quote\n");
 708                     state = MIME_QUOTE;
 709                 } else if (c == '(') {
 710                     save_state = state;
 711                     state = MIME_COMMENT;
 712                 }
 713                 break;
 714
 715             case MIME_QUOTE:
 716                 if (c == '"') {
 717                     mime_debug("Found Match Quote\n");
 718                     state = MIME_VALUE;
 719                 }
 720                 break;
 721             }
 722         }
 723
 724         if (state == MIME_TYPE) {
 725             new_hdr = mime_hdr_new(ntmp, strip_ends(q));
 726             if (new_hdr == NULL)
 727                 goto err;
 728             if (!sk_MIME_HEADER_push(headers, new_hdr))
 729                 goto err;
 730             mhdr = new_hdr;
 731             new_hdr = NULL;
 732         } else if (state == MIME_VALUE)
 733             mime_hdr_addparam(mhdr, ntmp, strip_ends(q));
 734         if (p == linebuf)
 735             break;              /* Blank line means end of headers */
 736     }
 737
 738     return headers;
 739
 740 err:
 741     mime_hdr_free(new_hdr);
 742     sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
 743     return NULL;
 744 }
 745
 746 static char *strip_ends(char *name)
 747 {
 748     return strip_end(strip_start(name));
 749 }
 750
 751 /* Strip a parameter of whitespace from start of param */
 752 static char *strip_start(char *name)
 753 {
 754     char *p, c;
 755     /* Look for first non white space or quote */
 756     for (p = name; (c = *p); p++) {
 757         if (c == '"') {
 758             /* Next char is start of string if non null */
 759             if (p[1])
 760                 return p + 1;
 761             /* Else null string */
 762             return NULL;
 763         }
 764         if (!ossl_isspace(c))
 765             return p;
 766     }
 767     return NULL;
 768 }
 769
 770 /* As above but strip from end of string : maybe should handle brackets? */
 771 static char *strip_end(char *name)
 772 {
 773     char *p, c;
 774     if (!name)
 775         return NULL;
 776     /* Look for first non white space or quote */
 777     for (p = name + strlen(name) - 1; p >= name; p--) {
 778         c = *p;
 779         if (c == '"') {
 780             if (p - 1 == name)
 781                 return NULL;
 782             *p = 0;
 783             return name;
 784         }
 785         if (ossl_isspace(c))
 786             *p = 0;
 787         else
 788             return name;
 789     }
 790     return NULL;
 791 }
 792
 793 static MIME_HEADER *mime_hdr_new(const char *name, const char *value)
 794 {
 795     MIME_HEADER *mhdr = NULL;
 796     char *tmpname = NULL, *tmpval = NULL, *p;
 797
 798     if (name) {
 799         if ((tmpname = OPENSSL_strdup(name)) == NULL)
 800             return NULL;
 801         for (p = tmpname; *p; p++)
 802             *p = ossl_tolower(*p);
 803     }
 804     if (value) {
 805         if ((tmpval = OPENSSL_strdup(value)) == NULL)
 806             goto err;
 807         for (p = tmpval; *p; p++)
 808             *p = ossl_tolower(*p);
 809     }
 810     mhdr = OPENSSL_malloc(sizeof(*mhdr));
 811     if (mhdr == NULL)
 812         goto err;
 813     mhdr->name = tmpname;
 814     mhdr->value = tmpval;
 815     if ((mhdr->params = sk_MIME_PARAM_new(mime_param_cmp)) == NULL)
 816         goto err;
 817     return mhdr;
 818
 819  err:
 820     OPENSSL_free(tmpname);
 821     OPENSSL_free(tmpval);
 822     OPENSSL_free(mhdr);
 823     return NULL;
 824 }
 825
 826 static int mime_hdr_addparam(MIME_HEADER *mhdr, const char *name, const char *value)
 827 {
 828     char *tmpname = NULL, *tmpval = NULL, *p;
 829     MIME_PARAM *mparam = NULL;
 830
 831     if (name) {
 832         tmpname = OPENSSL_strdup(name);
 833         if (!tmpname)
 834             goto err;
 835         for (p = tmpname; *p; p++)
 836             *p = ossl_tolower(*p);
 837     }
 838     if (value) {
 839         tmpval = OPENSSL_strdup(value);
 840         if (!tmpval)
 841             goto err;
 842     }
 843     /* Parameter values are case sensitive so leave as is */
 844     mparam = OPENSSL_malloc(sizeof(*mparam));
 845     if (mparam == NULL)
 846         goto err;
 847     mparam->param_name = tmpname;
 848     mparam->param_value = tmpval;
 849     if (!sk_MIME_PARAM_push(mhdr->params, mparam))
 850         goto err;
 851     return 1;
 852  err:
 853     OPENSSL_free(tmpname);
 854     OPENSSL_free(tmpval);
 855     OPENSSL_free(mparam);
 856     return 0;
 857 }
 858
 859 static int mime_hdr_cmp(const MIME_HEADER *const *a,
 860                         const MIME_HEADER *const *b)
 861 {
 862     if (!(*a)->name || !(*b)->name)
 863         return ! !(*a)->name - ! !(*b)->name;
 864
 865     return strcmp((*a)->name, (*b)->name);
 866 }
 867
 868 static int mime_param_cmp(const MIME_PARAM *const *a,
 869                           const MIME_PARAM *const *b)
 870 {
 871     if (!(*a)->param_name || !(*b)->param_name)
 872         return ! !(*a)->param_name - ! !(*b)->param_name;
 873     return strcmp((*a)->param_name, (*b)->param_name);
 874 }
 875
 876 /* Find a header with a given name (if possible) */
 877
 878 static MIME_HEADER *mime_hdr_find(STACK_OF(MIME_HEADER) *hdrs, const char *name)
 879 {
 880     MIME_HEADER htmp;
 881     int idx;
 882
 883     htmp.name = (char *)name;
 884     htmp.value = NULL;
 885     htmp.params = NULL;
 886
 887     idx = sk_MIME_HEADER_find(hdrs, &htmp);
 888     return sk_MIME_HEADER_value(hdrs, idx);
 889 }
 890
 891 static MIME_PARAM *mime_param_find(MIME_HEADER *hdr, const char *name)
 892 {
 893     MIME_PARAM param;
 894     int idx;
 895
 896     param.param_name = (char *)name;
 897     param.param_value = NULL;
 898     idx = sk_MIME_PARAM_find(hdr->params, &param);
 899     return sk_MIME_PARAM_value(hdr->params, idx);
 900 }
 901
 902 static void mime_hdr_free(MIME_HEADER *hdr)
 903 {
 904     if (hdr == NULL)
 905         return;
 906     OPENSSL_free(hdr->name);
 907     OPENSSL_free(hdr->value);
 908     if (hdr->params)
 909         sk_MIME_PARAM_pop_free(hdr->params, mime_param_free);
 910     OPENSSL_free(hdr);
 911 }
 912
 913 static void mime_param_free(MIME_PARAM *param)
 914 {
 915     OPENSSL_free(param->param_name);
 916     OPENSSL_free(param->param_value);
 917     OPENSSL_free(param);
 918 }
 919
 920 /*-
 921  * Check for a multipart boundary. Returns:
 922  * 0 : no boundary
 923  * 1 : part boundary
 924  * 2 : final boundary
 925  */
 926 static int mime_bound_check(char *line, int linelen, const char *bound, int blen)
 927 {
 928     if (linelen == -1)
 929         linelen = strlen(line);
 930     if (blen == -1)
 931         blen = strlen(bound);
 932     /* Quickly eliminate if line length too short */
 933     if (blen + 2 > linelen)
 934         return 0;
 935     /* Check for part boundary */
 936     if ((strncmp(line, "--", 2) == 0)
 937         && strncmp(line + 2, bound, blen) == 0) {
 938         if (strncmp(line + blen + 2, "--", 2) == 0)
 939             return 2;
 940         else
 941             return 1;
 942     }
 943     return 0;
 944 }
 945
 946 static int strip_eol(char *linebuf, int *plen, int flags)
 947 {
 948     int len = *plen;
 949     char *p, c;
 950     int is_eol = 0;
 951
 952     for (p = linebuf + len - 1; len > 0; len--, p--) {
 953         c = *p;
 954         if (c == '\n') {
 955             is_eol = 1;
 956         } else if (is_eol && flags & SMIME_ASCIICRLF && c == 32) {
 957             /* Strip trailing space on a line; 32 == ASCII for ' ' */
 958             continue;
 959         } else if (c != '\r') {
 960             break;
 961         }
 962     }
 963     *plen = len;
 964     return is_eol;
 965 }