crypto/pkcs7/pk7_lib.c

   1 /*
   2  * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include <stdio.h>
  11 #include "internal/cryptlib.h"
  12 #include <openssl/objects.h>
  13 #include <openssl/x509.h>
  14 #include "crypto/asn1.h"
  15 #include "crypto/evp.h"
  16 #include "crypto/x509.h" /* for sk_X509_add1_cert() */
  17 #include "pk7_local.h"
  18
  19 long PKCS7_ctrl(PKCS7 *p7, int cmd, long larg, char *parg)
  20 {
  21     int nid;
  22     long ret;
  23
  24     nid = OBJ_obj2nid(p7->type);
  25
  26     switch (cmd) {
  27     /* NOTE(emilia): does not support detached digested data. */
  28     case PKCS7_OP_SET_DETACHED_SIGNATURE:
  29         if (nid == NID_pkcs7_signed) {
  30             ret = p7->detached = (int)larg;
  31             if (ret && PKCS7_type_is_data(p7->d.sign->contents)) {
  32                 ASN1_OCTET_STRING *os;
  33                 os = p7->d.sign->contents->d.data;
  34                 ASN1_OCTET_STRING_free(os);
  35                 p7->d.sign->contents->d.data = NULL;
  36             }
  37         } else {
  38             PKCS7err(PKCS7_F_PKCS7_CTRL,
  39                      PKCS7_R_OPERATION_NOT_SUPPORTED_ON_THIS_TYPE);
  40             ret = 0;
  41         }
  42         break;
  43     case PKCS7_OP_GET_DETACHED_SIGNATURE:
  44         if (nid == NID_pkcs7_signed) {
  45             if (p7->d.sign == NULL || p7->d.sign->contents->d.ptr == NULL)
  46                 ret = 1;
  47             else
  48                 ret = 0;
  49
  50             p7->detached = ret;
  51         } else {
  52             PKCS7err(PKCS7_F_PKCS7_CTRL,
  53                      PKCS7_R_OPERATION_NOT_SUPPORTED_ON_THIS_TYPE);
  54             ret = 0;
  55         }
  56
  57         break;
  58     default:
  59         PKCS7err(PKCS7_F_PKCS7_CTRL, PKCS7_R_UNKNOWN_OPERATION);
  60         ret = 0;
  61     }
  62     return ret;
  63 }
  64
  65 int PKCS7_content_new(PKCS7 *p7, int type)
  66 {
  67     PKCS7 *ret = NULL;
  68
  69     if ((ret = PKCS7_new()) == NULL)
  70         goto err;
  71     if (!PKCS7_set_type(ret, type))
  72         goto err;
  73     if (!PKCS7_set_content(p7, ret))
  74         goto err;
  75
  76     return 1;
  77  err:
  78     PKCS7_free(ret);
  79     return 0;
  80 }
  81
  82 int PKCS7_set_content(PKCS7 *p7, PKCS7 *p7_data)
  83 {
  84     int i;
  85
  86     i = OBJ_obj2nid(p7->type);
  87     switch (i) {
  88     case NID_pkcs7_signed:
  89         PKCS7_free(p7->d.sign->contents);
  90         p7->d.sign->contents = p7_data;
  91         break;
  92     case NID_pkcs7_digest:
  93         PKCS7_free(p7->d.digest->contents);
  94         p7->d.digest->contents = p7_data;
  95         break;
  96     case NID_pkcs7_data:
  97     case NID_pkcs7_enveloped:
  98     case NID_pkcs7_signedAndEnveloped:
  99     case NID_pkcs7_encrypted:
 100     default:
 101         PKCS7err(PKCS7_F_PKCS7_SET_CONTENT, PKCS7_R_UNSUPPORTED_CONTENT_TYPE);
 102         goto err;
 103     }
 104     return 1;
 105  err:
 106     return 0;
 107 }
 108
 109 int PKCS7_set_type(PKCS7 *p7, int type)
 110 {
 111     ASN1_OBJECT *obj;
 112
 113     /*
 114      * PKCS7_content_free(p7);
 115      */
 116     obj = OBJ_nid2obj(type);    /* will not fail */
 117
 118     switch (type) {
 119     case NID_pkcs7_signed:
 120         p7->type = obj;
 121         if ((p7->d.sign = PKCS7_SIGNED_new()) == NULL)
 122             goto err;
 123         if (!ASN1_INTEGER_set(p7->d.sign->version, 1)) {
 124             PKCS7_SIGNED_free(p7->d.sign);
 125             p7->d.sign = NULL;
 126             goto err;
 127         }
 128         break;
 129     case NID_pkcs7_data:
 130         p7->type = obj;
 131         if ((p7->d.data = ASN1_OCTET_STRING_new()) == NULL)
 132             goto err;
 133         break;
 134     case NID_pkcs7_signedAndEnveloped:
 135         p7->type = obj;
 136         if ((p7->d.signed_and_enveloped = PKCS7_SIGN_ENVELOPE_new())
 137             == NULL)
 138             goto err;
 139         if (!ASN1_INTEGER_set(p7->d.signed_and_enveloped->version, 1))
 140             goto err;
 141         p7->d.signed_and_enveloped->enc_data->content_type
 142             = OBJ_nid2obj(NID_pkcs7_data);
 143         break;
 144     case NID_pkcs7_enveloped:
 145         p7->type = obj;
 146         if ((p7->d.enveloped = PKCS7_ENVELOPE_new())
 147             == NULL)
 148             goto err;
 149         if (!ASN1_INTEGER_set(p7->d.enveloped->version, 0))
 150             goto err;
 151         p7->d.enveloped->enc_data->content_type = OBJ_nid2obj(NID_pkcs7_data);
 152         break;
 153     case NID_pkcs7_encrypted:
 154         p7->type = obj;
 155         if ((p7->d.encrypted = PKCS7_ENCRYPT_new())
 156             == NULL)
 157             goto err;
 158         if (!ASN1_INTEGER_set(p7->d.encrypted->version, 0))
 159             goto err;
 160         p7->d.encrypted->enc_data->content_type = OBJ_nid2obj(NID_pkcs7_data);
 161         break;
 162
 163     case NID_pkcs7_digest:
 164         p7->type = obj;
 165         if ((p7->d.digest = PKCS7_DIGEST_new())
 166             == NULL)
 167             goto err;
 168         if (!ASN1_INTEGER_set(p7->d.digest->version, 0))
 169             goto err;
 170         break;
 171     default:
 172         PKCS7err(PKCS7_F_PKCS7_SET_TYPE, PKCS7_R_UNSUPPORTED_CONTENT_TYPE);
 173         goto err;
 174     }
 175     return 1;
 176  err:
 177     return 0;
 178 }
 179
 180 int PKCS7_set0_type_other(PKCS7 *p7, int type, ASN1_TYPE *other)
 181 {
 182     p7->type = OBJ_nid2obj(type);
 183     p7->d.other = other;
 184     return 1;
 185 }
 186
 187 int PKCS7_add_signer(PKCS7 *p7, PKCS7_SIGNER_INFO *psi)
 188 {
 189     int i, j, nid;
 190     X509_ALGOR *alg;
 191     STACK_OF(PKCS7_SIGNER_INFO) *signer_sk;
 192     STACK_OF(X509_ALGOR) *md_sk;
 193
 194     i = OBJ_obj2nid(p7->type);
 195     switch (i) {
 196     case NID_pkcs7_signed:
 197         signer_sk = p7->d.sign->signer_info;
 198         md_sk = p7->d.sign->md_algs;
 199         break;
 200     case NID_pkcs7_signedAndEnveloped:
 201         signer_sk = p7->d.signed_and_enveloped->signer_info;
 202         md_sk = p7->d.signed_and_enveloped->md_algs;
 203         break;
 204     default:
 205         PKCS7err(PKCS7_F_PKCS7_ADD_SIGNER, PKCS7_R_WRONG_CONTENT_TYPE);
 206         return 0;
 207     }
 208
 209     nid = OBJ_obj2nid(psi->digest_alg->algorithm);
 210
 211     /* If the digest is not currently listed, add it */
 212     j = 0;
 213     for (i = 0; i < sk_X509_ALGOR_num(md_sk); i++) {
 214         alg = sk_X509_ALGOR_value(md_sk, i);
 215         if (OBJ_obj2nid(alg->algorithm) == nid) {
 216             j = 1;
 217             break;
 218         }
 219     }
 220     if (!j) {                   /* we need to add another algorithm */
 221         if ((alg = X509_ALGOR_new()) == NULL
 222             || (alg->parameter = ASN1_TYPE_new()) == NULL) {
 223             X509_ALGOR_free(alg);
 224             PKCS7err(PKCS7_F_PKCS7_ADD_SIGNER, ERR_R_MALLOC_FAILURE);
 225             return 0;
 226         }
 227         alg->algorithm = OBJ_nid2obj(nid);
 228         alg->parameter->type = V_ASN1_NULL;
 229         if (!sk_X509_ALGOR_push(md_sk, alg)) {
 230             X509_ALGOR_free(alg);
 231             return 0;
 232         }
 233     }
 234
 235     psi->ctx = pkcs7_get0_ctx(p7);
 236     if (!sk_PKCS7_SIGNER_INFO_push(signer_sk, psi))
 237         return 0;
 238     return 1;
 239 }
 240
 241 int PKCS7_add_certificate(PKCS7 *p7, X509 *x509)
 242 {
 243     int i;
 244     STACK_OF(X509) **sk;
 245
 246     i = OBJ_obj2nid(p7->type);
 247     switch (i) {
 248     case NID_pkcs7_signed:
 249         sk = &(p7->d.sign->cert);
 250         break;
 251     case NID_pkcs7_signedAndEnveloped:
 252         sk = &(p7->d.signed_and_enveloped->cert);
 253         break;
 254     default:
 255         PKCS7err(PKCS7_F_PKCS7_ADD_CERTIFICATE, PKCS7_R_WRONG_CONTENT_TYPE);
 256         return 0;
 257     }
 258
 259     return X509_add_cert_new(sk, x509, X509_ADD_FLAG_UP_REF);
 260 }
 261
 262 int PKCS7_add_crl(PKCS7 *p7, X509_CRL *crl)
 263 {
 264     int i;
 265     STACK_OF(X509_CRL) **sk;
 266
 267     i = OBJ_obj2nid(p7->type);
 268     switch (i) {
 269     case NID_pkcs7_signed:
 270         sk = &(p7->d.sign->crl);
 271         break;
 272     case NID_pkcs7_signedAndEnveloped:
 273         sk = &(p7->d.signed_and_enveloped->crl);
 274         break;
 275     default:
 276         PKCS7err(PKCS7_F_PKCS7_ADD_CRL, PKCS7_R_WRONG_CONTENT_TYPE);
 277         return 0;
 278     }
 279
 280     if (*sk == NULL)
 281         *sk = sk_X509_CRL_new_null();
 282     if (*sk == NULL) {
 283         PKCS7err(PKCS7_F_PKCS7_ADD_CRL, ERR_R_MALLOC_FAILURE);
 284         return 0;
 285     }
 286
 287     X509_CRL_up_ref(crl);
 288     if (!sk_X509_CRL_push(*sk, crl)) {
 289         X509_CRL_free(crl);
 290         return 0;
 291     }
 292     return 1;
 293 }
 294
 295 int PKCS7_SIGNER_INFO_set(PKCS7_SIGNER_INFO *p7i, X509 *x509, EVP_PKEY *pkey,
 296                           const EVP_MD *dgst)
 297 {
 298     int ret;
 299
 300     /* We now need to add another PKCS7_SIGNER_INFO entry */
 301     if (!ASN1_INTEGER_set(p7i->version, 1))
 302         goto err;
 303     if (!X509_NAME_set(&p7i->issuer_and_serial->issuer,
 304                        X509_get_issuer_name(x509)))
 305         goto err;
 306
 307     /*
 308      * because ASN1_INTEGER_set is used to set a 'long' we will do things the
 309      * ugly way.
 310      */
 311     ASN1_INTEGER_free(p7i->issuer_and_serial->serial);
 312     if (!(p7i->issuer_and_serial->serial =
 313           ASN1_INTEGER_dup(X509_get0_serialNumber(x509))))
 314         goto err;
 315
 316     /*
 317      * TODO(3.0) Adapt for provider-native keys
 318      * Meanwhile, we downgrade the key.
 319      * #legacy
 320      */
 321     if (!evp_pkey_downgrade(pkey)) {
 322         PKCS7err(PKCS7_F_PKCS7_SIGNER_INFO_SET,
 323                  PKCS7_R_SIGNING_NOT_SUPPORTED_FOR_THIS_KEY_TYPE);
 324         goto err;
 325     }
 326
 327     /* lets keep the pkey around for a while */
 328     EVP_PKEY_up_ref(pkey);
 329     p7i->pkey = pkey;
 330
 331     /* Set the algorithms */
 332
 333     X509_ALGOR_set0(p7i->digest_alg, OBJ_nid2obj(EVP_MD_type(dgst)),
 334                     V_ASN1_NULL, NULL);
 335
 336     if (pkey->ameth && pkey->ameth->pkey_ctrl) {
 337         ret = pkey->ameth->pkey_ctrl(pkey, ASN1_PKEY_CTRL_PKCS7_SIGN, 0, p7i);
 338         if (ret > 0)
 339             return 1;
 340         if (ret != -2) {
 341             PKCS7err(PKCS7_F_PKCS7_SIGNER_INFO_SET,
 342                      PKCS7_R_SIGNING_CTRL_FAILURE);
 343             return 0;
 344         }
 345     }
 346     PKCS7err(PKCS7_F_PKCS7_SIGNER_INFO_SET,
 347              PKCS7_R_SIGNING_NOT_SUPPORTED_FOR_THIS_KEY_TYPE);
 348  err:
 349     return 0;
 350 }
 351
 352 PKCS7_SIGNER_INFO *PKCS7_add_signature(PKCS7 *p7, X509 *x509, EVP_PKEY *pkey,
 353                                        const EVP_MD *dgst)
 354 {
 355     PKCS7_SIGNER_INFO *si = NULL;
 356
 357     if (dgst == NULL) {
 358         int def_nid;
 359         if (EVP_PKEY_get_default_digest_nid(pkey, &def_nid) <= 0)
 360             goto err;
 361         dgst = EVP_get_digestbynid(def_nid);
 362         if (dgst == NULL) {
 363             PKCS7err(PKCS7_F_PKCS7_ADD_SIGNATURE, PKCS7_R_NO_DEFAULT_DIGEST);
 364             goto err;
 365         }
 366     }
 367
 368     if ((si = PKCS7_SIGNER_INFO_new()) == NULL)
 369         goto err;
 370     if (!PKCS7_SIGNER_INFO_set(si, x509, pkey, dgst))
 371         goto err;
 372     if (!PKCS7_add_signer(p7, si))
 373         goto err;
 374     return si;
 375  err:
 376     PKCS7_SIGNER_INFO_free(si);
 377     return NULL;
 378 }
 379
 380 static STACK_OF(X509) *pkcs7_get_signer_certs(const PKCS7 *p7)
 381 {
 382     if (PKCS7_type_is_signed(p7))
 383         return p7->d.sign->cert;
 384     if (PKCS7_type_is_signedAndEnveloped(p7))
 385         return p7->d.signed_and_enveloped->cert;
 386     return NULL;
 387 }
 388
 389 static STACK_OF(PKCS7_RECIP_INFO) *pkcs7_get_recipient_info(const PKCS7 *p7)
 390 {
 391     if (PKCS7_type_is_signedAndEnveloped(p7))
 392         return p7->d.signed_and_enveloped->recipientinfo;
 393     if (PKCS7_type_is_enveloped(p7))
 394         return p7->d.enveloped->recipientinfo;
 395     return NULL;
 396 }
 397
 398 /*
 399  * Set up the library context into any loaded structure that needs it.
 400  * i.e loaded X509 objects.
 401  */
 402 void pkcs7_resolve_libctx(PKCS7 *p7)
 403 {
 404     int i;
 405     const PKCS7_CTX *ctx = pkcs7_get0_ctx(p7);
 406     STACK_OF(PKCS7_RECIP_INFO) *rinfos = pkcs7_get_recipient_info(p7);
 407     STACK_OF(PKCS7_SIGNER_INFO) *sinfos = PKCS7_get_signer_info(p7);
 408     STACK_OF(X509) *certs = pkcs7_get_signer_certs(p7);
 409
 410     if (ctx == NULL)
 411         return;
 412
 413     for (i = 0; i < sk_X509_num(certs); i++)
 414         x509_set0_libctx(sk_X509_value(certs, i), ctx->libctx, ctx->propq);
 415
 416     for (i = 0; i < sk_PKCS7_RECIP_INFO_num(rinfos); i++) {
 417         PKCS7_RECIP_INFO *ri = sk_PKCS7_RECIP_INFO_value(rinfos, i);
 418
 419         x509_set0_libctx(ri->cert, ctx->libctx, ctx->propq);
 420     }
 421
 422     for (i = 0; i < sk_PKCS7_SIGNER_INFO_num(sinfos); i++) {
 423         PKCS7_SIGNER_INFO *si = sk_PKCS7_SIGNER_INFO_value(sinfos, i);
 424
 425         if (si != NULL)
 426             si->ctx = ctx;
 427     }
 428 }
 429
 430 const PKCS7_CTX *pkcs7_get0_ctx(const PKCS7 *p7)
 431 {
 432     return p7 != NULL ? &p7->ctx : NULL;
 433 }
 434
 435 OSSL_LIB_CTX *pkcs7_ctx_get0_libctx(const PKCS7_CTX *ctx)
 436 {
 437     return ctx != NULL ? ctx->libctx : NULL;
 438 }
 439 const char *pkcs7_ctx_get0_propq(const PKCS7_CTX *ctx)
 440 {
 441     return ctx != NULL ? ctx->propq : NULL;
 442 }
 443
 444 int PKCS7_set_digest(PKCS7 *p7, const EVP_MD *md)
 445 {
 446     if (PKCS7_type_is_digest(p7)) {
 447         if ((p7->d.digest->md->parameter = ASN1_TYPE_new()) == NULL) {
 448             PKCS7err(PKCS7_F_PKCS7_SET_DIGEST, ERR_R_MALLOC_FAILURE);
 449             return 0;
 450         }
 451         p7->d.digest->md->parameter->type = V_ASN1_NULL;
 452         p7->d.digest->md->algorithm = OBJ_nid2obj(EVP_MD_nid(md));
 453         return 1;
 454     }
 455
 456     PKCS7err(PKCS7_F_PKCS7_SET_DIGEST, PKCS7_R_WRONG_CONTENT_TYPE);
 457     return 1;
 458 }
 459
 460 STACK_OF(PKCS7_SIGNER_INFO) *PKCS7_get_signer_info(PKCS7 *p7)
 461 {
 462     if (p7 == NULL || p7->d.ptr == NULL)
 463         return NULL;
 464     if (PKCS7_type_is_signed(p7)) {
 465         return p7->d.sign->signer_info;
 466     } else if (PKCS7_type_is_signedAndEnveloped(p7)) {
 467         return p7->d.signed_and_enveloped->signer_info;
 468     } else
 469         return NULL;
 470 }
 471
 472 void PKCS7_SIGNER_INFO_get0_algs(PKCS7_SIGNER_INFO *si, EVP_PKEY **pk,
 473                                  X509_ALGOR **pdig, X509_ALGOR **psig)
 474 {
 475     if (pk)
 476         *pk = si->pkey;
 477     if (pdig)
 478         *pdig = si->digest_alg;
 479     if (psig)
 480         *psig = si->digest_enc_alg;
 481 }
 482
 483 void PKCS7_RECIP_INFO_get0_alg(PKCS7_RECIP_INFO *ri, X509_ALGOR **penc)
 484 {
 485     if (penc)
 486         *penc = ri->key_enc_algor;
 487 }
 488
 489 PKCS7_RECIP_INFO *PKCS7_add_recipient(PKCS7 *p7, X509 *x509)
 490 {
 491     PKCS7_RECIP_INFO *ri;
 492
 493     if ((ri = PKCS7_RECIP_INFO_new()) == NULL)
 494         goto err;
 495     if (!PKCS7_RECIP_INFO_set(ri, x509))
 496         goto err;
 497     if (!PKCS7_add_recipient_info(p7, ri))
 498         goto err;
 499     ri->ctx = pkcs7_get0_ctx(p7);
 500     return ri;
 501  err:
 502     PKCS7_RECIP_INFO_free(ri);
 503     return NULL;
 504 }
 505
 506 int PKCS7_add_recipient_info(PKCS7 *p7, PKCS7_RECIP_INFO *ri)
 507 {
 508     int i;
 509     STACK_OF(PKCS7_RECIP_INFO) *sk;
 510
 511     i = OBJ_obj2nid(p7->type);
 512     switch (i) {
 513     case NID_pkcs7_signedAndEnveloped:
 514         sk = p7->d.signed_and_enveloped->recipientinfo;
 515         break;
 516     case NID_pkcs7_enveloped:
 517         sk = p7->d.enveloped->recipientinfo;
 518         break;
 519     default:
 520         PKCS7err(PKCS7_F_PKCS7_ADD_RECIPIENT_INFO,
 521                  PKCS7_R_WRONG_CONTENT_TYPE);
 522         return 0;
 523     }
 524
 525     if (!sk_PKCS7_RECIP_INFO_push(sk, ri))
 526         return 0;
 527     return 1;
 528 }
 529
 530 int PKCS7_RECIP_INFO_set(PKCS7_RECIP_INFO *p7i, X509 *x509)
 531 {
 532     int ret;
 533     EVP_PKEY *pkey = NULL;
 534     if (!ASN1_INTEGER_set(p7i->version, 0))
 535         return 0;
 536     if (!X509_NAME_set(&p7i->issuer_and_serial->issuer,
 537                        X509_get_issuer_name(x509)))
 538         return 0;
 539
 540     ASN1_INTEGER_free(p7i->issuer_and_serial->serial);
 541     if (!(p7i->issuer_and_serial->serial =
 542           ASN1_INTEGER_dup(X509_get0_serialNumber(x509))))
 543         return 0;
 544
 545     pkey = X509_get0_pubkey(x509);
 546
 547     if (!pkey || !pkey->ameth || !pkey->ameth->pkey_ctrl) {
 548         PKCS7err(PKCS7_F_PKCS7_RECIP_INFO_SET,
 549                  PKCS7_R_ENCRYPTION_NOT_SUPPORTED_FOR_THIS_KEY_TYPE);
 550         goto err;
 551     }
 552
 553     ret = pkey->ameth->pkey_ctrl(pkey, ASN1_PKEY_CTRL_PKCS7_ENCRYPT, 0, p7i);
 554     if (ret == -2) {
 555         PKCS7err(PKCS7_F_PKCS7_RECIP_INFO_SET,
 556                  PKCS7_R_ENCRYPTION_NOT_SUPPORTED_FOR_THIS_KEY_TYPE);
 557         goto err;
 558     }
 559     if (ret <= 0) {
 560         PKCS7err(PKCS7_F_PKCS7_RECIP_INFO_SET,
 561                  PKCS7_R_ENCRYPTION_CTRL_FAILURE);
 562         goto err;
 563     }
 564
 565     X509_up_ref(x509);
 566     p7i->cert = x509;
 567
 568     return 1;
 569
 570  err:
 571     return 0;
 572 }
 573
 574 X509 *PKCS7_cert_from_signer_info(PKCS7 *p7, PKCS7_SIGNER_INFO *si)
 575 {
 576     if (PKCS7_type_is_signed(p7))
 577         return (X509_find_by_issuer_and_serial(p7->d.sign->cert,
 578                                                si->issuer_and_serial->issuer,
 579                                                si->
 580                                                issuer_and_serial->serial));
 581     else
 582         return NULL;
 583 }
 584
 585 int PKCS7_set_cipher(PKCS7 *p7, const EVP_CIPHER *cipher)
 586 {
 587     int i;
 588     PKCS7_ENC_CONTENT *ec;
 589
 590     i = OBJ_obj2nid(p7->type);
 591     switch (i) {
 592     case NID_pkcs7_signedAndEnveloped:
 593         ec = p7->d.signed_and_enveloped->enc_data;
 594         break;
 595     case NID_pkcs7_enveloped:
 596         ec = p7->d.enveloped->enc_data;
 597         break;
 598     default:
 599         PKCS7err(PKCS7_F_PKCS7_SET_CIPHER, PKCS7_R_WRONG_CONTENT_TYPE);
 600         return 0;
 601     }
 602
 603     /* Check cipher OID exists and has data in it */
 604     i = EVP_CIPHER_type(cipher);
 605     if (i == NID_undef) {
 606         PKCS7err(PKCS7_F_PKCS7_SET_CIPHER,
 607                  PKCS7_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER);
 608         return 0;
 609     }
 610
 611     ec->cipher = cipher;
 612     ec->ctx = pkcs7_get0_ctx(p7);
 613     return 1;
 614 }
 615
 616 /* unfortunately cannot constify BIO_new_NDEF() due to this and CMS_stream() */
 617 int PKCS7_stream(unsigned char ***boundary, PKCS7 *p7)
 618 {
 619     ASN1_OCTET_STRING *os = NULL;
 620
 621     switch (OBJ_obj2nid(p7->type)) {
 622     case NID_pkcs7_data:
 623         os = p7->d.data;
 624         break;
 625
 626     case NID_pkcs7_signedAndEnveloped:
 627         os = p7->d.signed_and_enveloped->enc_data->enc_data;
 628         if (os == NULL) {
 629             os = ASN1_OCTET_STRING_new();
 630             p7->d.signed_and_enveloped->enc_data->enc_data = os;
 631         }
 632         break;
 633
 634     case NID_pkcs7_enveloped:
 635         os = p7->d.enveloped->enc_data->enc_data;
 636         if (os == NULL) {
 637             os = ASN1_OCTET_STRING_new();
 638             p7->d.enveloped->enc_data->enc_data = os;
 639         }
 640         break;
 641
 642     case NID_pkcs7_signed:
 643         os = p7->d.sign->contents->d.data;
 644         break;
 645
 646     default:
 647         os = NULL;
 648         break;
 649     }
 650
 651     if (os == NULL)
 652         return 0;
 653
 654     os->flags |= ASN1_STRING_FLAG_NDEF;
 655     *boundary = &os->data;
 656
 657     return 1;
 658 }