]>
Commit | Line | Data |
---|---|---|
0f113f3e | 1 | /* |
fecb3aae | 2 | * Copyright 2008-2022 The OpenSSL Project Authors. All Rights Reserved. |
8931b30d | 3 | * |
08ddd302 | 4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
b1322259 RS |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
8931b30d DSH |
8 | */ |
9 | ||
10 | #include <openssl/asn1t.h> | |
17c2764d | 11 | #include <openssl/x509v3.h> |
8931b30d DSH |
12 | #include <openssl/err.h> |
13 | #include <openssl/pem.h> | |
14 | #include <openssl/bio.h> | |
15 | #include <openssl/asn1.h> | |
e52a3c3d | 16 | #include <openssl/cms.h> |
ad57a13b | 17 | #include "internal/sizes.h" |
c1669f41 | 18 | #include "crypto/x509.h" |
706457b7 | 19 | #include "cms_local.h" |
8931b30d | 20 | |
c1669f41 SL |
21 | static STACK_OF(CMS_CertificateChoices) |
22 | **cms_get0_certificate_choices(CMS_ContentInfo *cms); | |
23 | ||
8931b30d DSH |
24 | IMPLEMENT_ASN1_PRINT_FUNCTION(CMS_ContentInfo) |
25 | ||
c1669f41 SL |
26 | CMS_ContentInfo *d2i_CMS_ContentInfo(CMS_ContentInfo **a, |
27 | const unsigned char **in, long len) | |
28 | { | |
29 | CMS_ContentInfo *ci; | |
5dca2afc | 30 | const CMS_CTX *ctx = ossl_cms_get0_cmsctx(a == NULL ? NULL : *a); |
c1669f41 | 31 | |
5dca2afc MC |
32 | ci = (CMS_ContentInfo *)ASN1_item_d2i_ex((ASN1_VALUE **)a, in, len, |
33 | (CMS_ContentInfo_it()), | |
34 | ossl_cms_ctx_get0_libctx(ctx), | |
35 | ossl_cms_ctx_get0_propq(ctx)); | |
678b489a DF |
36 | if (ci != NULL) { |
37 | ERR_set_mark(); | |
53155f1c | 38 | ossl_cms_resolve_libctx(ci); |
678b489a DF |
39 | ERR_pop_to_mark(); |
40 | } | |
c1669f41 SL |
41 | return ci; |
42 | } | |
43 | ||
44 | int i2d_CMS_ContentInfo(const CMS_ContentInfo *a, unsigned char **out) | |
45 | { | |
46 | return ASN1_item_i2d((const ASN1_VALUE *)a, out, (CMS_ContentInfo_it())); | |
47 | } | |
48 | ||
b4250010 | 49 | CMS_ContentInfo *CMS_ContentInfo_new_ex(OSSL_LIB_CTX *libctx, const char *propq) |
c1669f41 SL |
50 | { |
51 | CMS_ContentInfo *ci; | |
52 | ||
5dca2afc MC |
53 | ci = (CMS_ContentInfo *)ASN1_item_new_ex(ASN1_ITEM_rptr(CMS_ContentInfo), |
54 | libctx, propq); | |
c1669f41 SL |
55 | if (ci != NULL) { |
56 | ci->ctx.libctx = libctx; | |
57 | ci->ctx.propq = NULL; | |
58 | if (propq != NULL) { | |
59 | ci->ctx.propq = OPENSSL_strdup(propq); | |
60 | if (ci->ctx.propq == NULL) { | |
61 | CMS_ContentInfo_free(ci); | |
62 | ci = NULL; | |
c1669f41 SL |
63 | } |
64 | } | |
65 | } | |
66 | return ci; | |
67 | } | |
68 | ||
69 | CMS_ContentInfo *CMS_ContentInfo_new(void) | |
70 | { | |
d8652be0 | 71 | return CMS_ContentInfo_new_ex(NULL, NULL); |
c1669f41 SL |
72 | } |
73 | ||
74 | void CMS_ContentInfo_free(CMS_ContentInfo *cms) | |
75 | { | |
76 | if (cms != NULL) { | |
77 | OPENSSL_free(cms->ctx.propq); | |
78 | ASN1_item_free((ASN1_VALUE *)cms, ASN1_ITEM_rptr(CMS_ContentInfo)); | |
79 | } | |
80 | } | |
81 | ||
53155f1c | 82 | const CMS_CTX *ossl_cms_get0_cmsctx(const CMS_ContentInfo *cms) |
c1669f41 SL |
83 | { |
84 | return cms != NULL ? &cms->ctx : NULL; | |
85 | } | |
86 | ||
53155f1c | 87 | OSSL_LIB_CTX *ossl_cms_ctx_get0_libctx(const CMS_CTX *ctx) |
c1669f41 | 88 | { |
84af8027 | 89 | return ctx != NULL ? ctx->libctx : NULL; |
c1669f41 SL |
90 | } |
91 | ||
53155f1c | 92 | const char *ossl_cms_ctx_get0_propq(const CMS_CTX *ctx) |
c1669f41 | 93 | { |
84af8027 | 94 | return ctx != NULL ? ctx->propq : NULL; |
c1669f41 SL |
95 | } |
96 | ||
53155f1c | 97 | void ossl_cms_resolve_libctx(CMS_ContentInfo *ci) |
c1669f41 SL |
98 | { |
99 | int i; | |
100 | CMS_CertificateChoices *cch; | |
101 | STACK_OF(CMS_CertificateChoices) **pcerts; | |
53155f1c SL |
102 | const CMS_CTX *ctx = ossl_cms_get0_cmsctx(ci); |
103 | OSSL_LIB_CTX *libctx = ossl_cms_ctx_get0_libctx(ctx); | |
104 | const char *propq = ossl_cms_ctx_get0_propq(ctx); | |
c1669f41 | 105 | |
53155f1c SL |
106 | ossl_cms_SignerInfos_set_cmsctx(ci); |
107 | ossl_cms_RecipientInfos_set_cmsctx(ci); | |
c1669f41 SL |
108 | |
109 | pcerts = cms_get0_certificate_choices(ci); | |
110 | if (pcerts != NULL) { | |
111 | for (i = 0; i < sk_CMS_CertificateChoices_num(*pcerts); i++) { | |
112 | cch = sk_CMS_CertificateChoices_value(*pcerts, i); | |
113 | if (cch->type == CMS_CERTCHOICE_CERT) | |
4669015d | 114 | ossl_x509_set0_libctx(cch->d.certificate, libctx, propq); |
c1669f41 SL |
115 | } |
116 | } | |
117 | } | |
118 | ||
dc423f89 | 119 | const ASN1_OBJECT *CMS_get0_type(const CMS_ContentInfo *cms) |
0f113f3e MC |
120 | { |
121 | return cms->contentType; | |
122 | } | |
8931b30d | 123 | |
53155f1c | 124 | CMS_ContentInfo *ossl_cms_Data_create(OSSL_LIB_CTX *libctx, const char *propq) |
0f113f3e | 125 | { |
d8652be0 | 126 | CMS_ContentInfo *cms = CMS_ContentInfo_new_ex(libctx, propq); |
c1669f41 | 127 | |
90945fa3 | 128 | if (cms != NULL) { |
0f113f3e MC |
129 | cms->contentType = OBJ_nid2obj(NID_pkcs7_data); |
130 | /* Never detached */ | |
131 | CMS_set_detached(cms, 0); | |
132 | } | |
133 | return cms; | |
134 | } | |
8931b30d | 135 | |
53155f1c | 136 | BIO *ossl_cms_content_bio(CMS_ContentInfo *cms) |
0f113f3e MC |
137 | { |
138 | ASN1_OCTET_STRING **pos = CMS_get0_content(cms); | |
12a765a5 RS |
139 | |
140 | if (pos == NULL) | |
0f113f3e MC |
141 | return NULL; |
142 | /* If content detached data goes nowhere: create NULL BIO */ | |
12a765a5 | 143 | if (*pos == NULL) |
0f113f3e MC |
144 | return BIO_new(BIO_s_null()); |
145 | /* | |
146 | * If content not detached and created return memory BIO | |
147 | */ | |
12a765a5 | 148 | if (*pos == NULL || ((*pos)->flags == ASN1_STRING_FLAG_CONT)) |
0f113f3e MC |
149 | return BIO_new(BIO_s_mem()); |
150 | /* Else content was read in: return read only BIO for it */ | |
151 | return BIO_new_mem_buf((*pos)->data, (*pos)->length); | |
152 | } | |
8931b30d DSH |
153 | |
154 | BIO *CMS_dataInit(CMS_ContentInfo *cms, BIO *icont) | |
0f113f3e MC |
155 | { |
156 | BIO *cmsbio, *cont; | |
157 | if (icont) | |
158 | cont = icont; | |
159 | else | |
53155f1c | 160 | cont = ossl_cms_content_bio(cms); |
0f113f3e | 161 | if (!cont) { |
9311d0c4 | 162 | ERR_raise(ERR_LIB_CMS, CMS_R_NO_CONTENT); |
0f113f3e MC |
163 | return NULL; |
164 | } | |
165 | switch (OBJ_obj2nid(cms->contentType)) { | |
166 | ||
167 | case NID_pkcs7_data: | |
168 | return cont; | |
169 | ||
170 | case NID_pkcs7_signed: | |
53155f1c | 171 | cmsbio = ossl_cms_SignedData_init_bio(cms); |
0f113f3e MC |
172 | break; |
173 | ||
174 | case NID_pkcs7_digest: | |
53155f1c | 175 | cmsbio = ossl_cms_DigestedData_init_bio(cms); |
0f113f3e | 176 | break; |
8931b30d | 177 | #ifdef ZLIB |
0f113f3e | 178 | case NID_id_smime_ct_compressedData: |
53155f1c | 179 | cmsbio = ossl_cms_CompressedData_init_bio(cms); |
0f113f3e | 180 | break; |
8931b30d DSH |
181 | #endif |
182 | ||
0f113f3e | 183 | case NID_pkcs7_encrypted: |
53155f1c | 184 | cmsbio = ossl_cms_EncryptedData_init_bio(cms); |
0f113f3e | 185 | break; |
b820455c | 186 | |
0f113f3e | 187 | case NID_pkcs7_enveloped: |
53155f1c | 188 | cmsbio = ossl_cms_EnvelopedData_init_bio(cms); |
0f113f3e | 189 | break; |
4f1aa191 | 190 | |
924663c3 | 191 | case NID_id_smime_ct_authEnvelopedData: |
53155f1c | 192 | cmsbio = ossl_cms_AuthEnvelopedData_init_bio(cms); |
924663c3 JZ |
193 | break; |
194 | ||
0f113f3e | 195 | default: |
9311d0c4 | 196 | ERR_raise(ERR_LIB_CMS, CMS_R_UNSUPPORTED_TYPE); |
19b4e6f8 | 197 | goto err; |
0f113f3e | 198 | } |
8931b30d | 199 | |
0f113f3e MC |
200 | if (cmsbio) |
201 | return BIO_push(cmsbio, cont); | |
19b4e6f8 | 202 | err: |
0f113f3e MC |
203 | if (!icont) |
204 | BIO_free(cont); | |
205 | return NULL; | |
8931b30d | 206 | |
0f113f3e | 207 | } |
b820455c | 208 | |
9fdcc21f | 209 | /* unfortunately cannot constify SMIME_write_ASN1() due to this function */ |
8931b30d | 210 | int CMS_dataFinal(CMS_ContentInfo *cms, BIO *cmsbio) |
07342bad VS |
211 | { |
212 | return ossl_cms_DataFinal(cms, cmsbio, NULL, 0); | |
213 | } | |
214 | ||
215 | int ossl_cms_DataFinal(CMS_ContentInfo *cms, BIO *cmsbio, | |
216 | const unsigned char *precomp_md, | |
217 | unsigned int precomp_mdlen) | |
0f113f3e MC |
218 | { |
219 | ASN1_OCTET_STRING **pos = CMS_get0_content(cms); | |
12a765a5 RS |
220 | |
221 | if (pos == NULL) | |
0f113f3e | 222 | return 0; |
0d4fb843 | 223 | /* If embedded content find memory BIO and set content */ |
0f113f3e MC |
224 | if (*pos && ((*pos)->flags & ASN1_STRING_FLAG_CONT)) { |
225 | BIO *mbio; | |
226 | unsigned char *cont; | |
227 | long contlen; | |
228 | mbio = BIO_find_type(cmsbio, BIO_TYPE_MEM); | |
229 | if (!mbio) { | |
9311d0c4 | 230 | ERR_raise(ERR_LIB_CMS, CMS_R_CONTENT_NOT_FOUND); |
0f113f3e MC |
231 | return 0; |
232 | } | |
233 | contlen = BIO_get_mem_data(mbio, &cont); | |
234 | /* Set bio as read only so its content can't be clobbered */ | |
235 | BIO_set_flags(mbio, BIO_FLAGS_MEM_RDONLY); | |
236 | BIO_set_mem_eof_return(mbio, 0); | |
237 | ASN1_STRING_set0(*pos, cont, contlen); | |
238 | (*pos)->flags &= ~ASN1_STRING_FLAG_CONT; | |
239 | } | |
240 | ||
241 | switch (OBJ_obj2nid(cms->contentType)) { | |
242 | ||
243 | case NID_pkcs7_data: | |
0f113f3e MC |
244 | case NID_pkcs7_encrypted: |
245 | case NID_id_smime_ct_compressedData: | |
246 | /* Nothing to do */ | |
247 | return 1; | |
248 | ||
71434aed | 249 | case NID_pkcs7_enveloped: |
53155f1c | 250 | return ossl_cms_EnvelopedData_final(cms, cmsbio); |
71434aed | 251 | |
924663c3 | 252 | case NID_id_smime_ct_authEnvelopedData: |
53155f1c | 253 | return ossl_cms_AuthEnvelopedData_final(cms, cmsbio); |
924663c3 | 254 | |
0f113f3e | 255 | case NID_pkcs7_signed: |
07342bad | 256 | return ossl_cms_SignedData_final(cms, cmsbio, precomp_md, precomp_mdlen); |
0f113f3e MC |
257 | |
258 | case NID_pkcs7_digest: | |
53155f1c | 259 | return ossl_cms_DigestedData_do_final(cms, cmsbio, 0); |
0f113f3e MC |
260 | |
261 | default: | |
9311d0c4 | 262 | ERR_raise(ERR_LIB_CMS, CMS_R_UNSUPPORTED_TYPE); |
0f113f3e MC |
263 | return 0; |
264 | } | |
265 | } | |
266 | ||
267 | /* | |
268 | * Return an OCTET STRING pointer to content. This allows it to be accessed | |
269 | * or set later. | |
8931b30d DSH |
270 | */ |
271 | ||
272 | ASN1_OCTET_STRING **CMS_get0_content(CMS_ContentInfo *cms) | |
0f113f3e MC |
273 | { |
274 | switch (OBJ_obj2nid(cms->contentType)) { | |
8931b30d | 275 | |
0f113f3e MC |
276 | case NID_pkcs7_data: |
277 | return &cms->d.data; | |
8931b30d | 278 | |
0f113f3e MC |
279 | case NID_pkcs7_signed: |
280 | return &cms->d.signedData->encapContentInfo->eContent; | |
8931b30d | 281 | |
0f113f3e MC |
282 | case NID_pkcs7_enveloped: |
283 | return &cms->d.envelopedData->encryptedContentInfo->encryptedContent; | |
8931b30d | 284 | |
0f113f3e MC |
285 | case NID_pkcs7_digest: |
286 | return &cms->d.digestedData->encapContentInfo->eContent; | |
8931b30d | 287 | |
0f113f3e MC |
288 | case NID_pkcs7_encrypted: |
289 | return &cms->d.encryptedData->encryptedContentInfo->encryptedContent; | |
8931b30d | 290 | |
924663c3 JZ |
291 | case NID_id_smime_ct_authEnvelopedData: |
292 | return &cms->d.authEnvelopedData->authEncryptedContentInfo | |
293 | ->encryptedContent; | |
294 | ||
0f113f3e MC |
295 | case NID_id_smime_ct_authData: |
296 | return &cms->d.authenticatedData->encapContentInfo->eContent; | |
8931b30d | 297 | |
0f113f3e MC |
298 | case NID_id_smime_ct_compressedData: |
299 | return &cms->d.compressedData->encapContentInfo->eContent; | |
8931b30d | 300 | |
0f113f3e MC |
301 | default: |
302 | if (cms->d.other->type == V_ASN1_OCTET_STRING) | |
303 | return &cms->d.other->value.octet_string; | |
9311d0c4 | 304 | ERR_raise(ERR_LIB_CMS, CMS_R_UNSUPPORTED_CONTENT_TYPE); |
0f113f3e | 305 | return NULL; |
8931b30d | 306 | |
0f113f3e MC |
307 | } |
308 | } | |
8931b30d | 309 | |
0f113f3e MC |
310 | /* |
311 | * Return an ASN1_OBJECT pointer to content type. This allows it to be | |
312 | * accessed or set later. | |
8931b30d DSH |
313 | */ |
314 | ||
315 | static ASN1_OBJECT **cms_get0_econtent_type(CMS_ContentInfo *cms) | |
0f113f3e MC |
316 | { |
317 | switch (OBJ_obj2nid(cms->contentType)) { | |
8931b30d | 318 | |
0f113f3e MC |
319 | case NID_pkcs7_signed: |
320 | return &cms->d.signedData->encapContentInfo->eContentType; | |
8931b30d | 321 | |
0f113f3e MC |
322 | case NID_pkcs7_enveloped: |
323 | return &cms->d.envelopedData->encryptedContentInfo->contentType; | |
8931b30d | 324 | |
0f113f3e MC |
325 | case NID_pkcs7_digest: |
326 | return &cms->d.digestedData->encapContentInfo->eContentType; | |
8931b30d | 327 | |
0f113f3e MC |
328 | case NID_pkcs7_encrypted: |
329 | return &cms->d.encryptedData->encryptedContentInfo->contentType; | |
8931b30d | 330 | |
924663c3 JZ |
331 | case NID_id_smime_ct_authEnvelopedData: |
332 | return &cms->d.authEnvelopedData->authEncryptedContentInfo | |
333 | ->contentType; | |
0f113f3e MC |
334 | case NID_id_smime_ct_authData: |
335 | return &cms->d.authenticatedData->encapContentInfo->eContentType; | |
8931b30d | 336 | |
0f113f3e MC |
337 | case NID_id_smime_ct_compressedData: |
338 | return &cms->d.compressedData->encapContentInfo->eContentType; | |
8931b30d | 339 | |
0f113f3e | 340 | default: |
9311d0c4 | 341 | ERR_raise(ERR_LIB_CMS, CMS_R_UNSUPPORTED_CONTENT_TYPE); |
0f113f3e | 342 | return NULL; |
8931b30d | 343 | |
0f113f3e MC |
344 | } |
345 | } | |
8931b30d DSH |
346 | |
347 | const ASN1_OBJECT *CMS_get0_eContentType(CMS_ContentInfo *cms) | |
0f113f3e MC |
348 | { |
349 | ASN1_OBJECT **petype; | |
350 | petype = cms_get0_econtent_type(cms); | |
351 | if (petype) | |
352 | return *petype; | |
353 | return NULL; | |
354 | } | |
8931b30d DSH |
355 | |
356 | int CMS_set1_eContentType(CMS_ContentInfo *cms, const ASN1_OBJECT *oid) | |
0f113f3e MC |
357 | { |
358 | ASN1_OBJECT **petype, *etype; | |
12a765a5 | 359 | |
0f113f3e | 360 | petype = cms_get0_econtent_type(cms); |
12a765a5 | 361 | if (petype == NULL) |
0f113f3e | 362 | return 0; |
12a765a5 | 363 | if (oid == NULL) |
0f113f3e MC |
364 | return 1; |
365 | etype = OBJ_dup(oid); | |
12a765a5 | 366 | if (etype == NULL) |
0f113f3e MC |
367 | return 0; |
368 | ASN1_OBJECT_free(*petype); | |
369 | *petype = etype; | |
370 | return 1; | |
371 | } | |
8931b30d DSH |
372 | |
373 | int CMS_is_detached(CMS_ContentInfo *cms) | |
0f113f3e MC |
374 | { |
375 | ASN1_OCTET_STRING **pos; | |
12a765a5 | 376 | |
0f113f3e | 377 | pos = CMS_get0_content(cms); |
12a765a5 | 378 | if (pos == NULL) |
0f113f3e | 379 | return -1; |
12a765a5 | 380 | if (*pos != NULL) |
0f113f3e MC |
381 | return 0; |
382 | return 1; | |
383 | } | |
8931b30d DSH |
384 | |
385 | int CMS_set_detached(CMS_ContentInfo *cms, int detached) | |
0f113f3e MC |
386 | { |
387 | ASN1_OCTET_STRING **pos; | |
12a765a5 | 388 | |
0f113f3e | 389 | pos = CMS_get0_content(cms); |
12a765a5 | 390 | if (pos == NULL) |
0f113f3e MC |
391 | return 0; |
392 | if (detached) { | |
2ace7450 RS |
393 | ASN1_OCTET_STRING_free(*pos); |
394 | *pos = NULL; | |
0f113f3e MC |
395 | return 1; |
396 | } | |
90945fa3 | 397 | if (*pos == NULL) |
0f113f3e | 398 | *pos = ASN1_OCTET_STRING_new(); |
90945fa3 | 399 | if (*pos != NULL) { |
0f113f3e MC |
400 | /* |
401 | * NB: special flag to show content is created and not read in. | |
402 | */ | |
403 | (*pos)->flags |= ASN1_STRING_FLAG_CONT; | |
404 | return 1; | |
405 | } | |
e077455e | 406 | ERR_raise(ERR_LIB_CMS, ERR_R_ASN1_LIB); |
0f113f3e MC |
407 | return 0; |
408 | } | |
8931b30d | 409 | |
8931b30d DSH |
410 | /* Create a digest BIO from an X509_ALGOR structure */ |
411 | ||
53155f1c SL |
412 | BIO *ossl_cms_DigestAlgorithm_init_bio(X509_ALGOR *digestAlgorithm, |
413 | const CMS_CTX *ctx) | |
0f113f3e MC |
414 | { |
415 | BIO *mdbio = NULL; | |
ac4e2577 | 416 | const ASN1_OBJECT *digestoid; |
1acb2e6f SL |
417 | const EVP_MD *digest = NULL; |
418 | EVP_MD *fetched_digest = NULL; | |
ad57a13b | 419 | char alg[OSSL_MAX_NAME_SIZE]; |
c1669f41 | 420 | |
0f113f3e | 421 | X509_ALGOR_get0(&digestoid, NULL, NULL, digestAlgorithm); |
ad57a13b | 422 | OBJ_obj2txt(alg, sizeof(alg), digestoid, 0); |
1acb2e6f SL |
423 | |
424 | (void)ERR_set_mark(); | |
53155f1c SL |
425 | fetched_digest = EVP_MD_fetch(ossl_cms_ctx_get0_libctx(ctx), alg, |
426 | ossl_cms_ctx_get0_propq(ctx)); | |
1acb2e6f SL |
427 | |
428 | if (fetched_digest != NULL) | |
429 | digest = fetched_digest; | |
430 | else | |
431 | digest = EVP_get_digestbyobj(digestoid); | |
c1669f41 | 432 | if (digest == NULL) { |
1acb2e6f | 433 | (void)ERR_clear_last_mark(); |
9311d0c4 | 434 | ERR_raise(ERR_LIB_CMS, CMS_R_UNKNOWN_DIGEST_ALGORITHM); |
0f113f3e MC |
435 | goto err; |
436 | } | |
1acb2e6f SL |
437 | (void)ERR_pop_to_mark(); |
438 | ||
0f113f3e | 439 | mdbio = BIO_new(BIO_f_md()); |
90945fa3 | 440 | if (mdbio == NULL || !BIO_set_md(mdbio, digest)) { |
9311d0c4 | 441 | ERR_raise(ERR_LIB_CMS, CMS_R_MD_BIO_INIT_ERROR); |
0f113f3e MC |
442 | goto err; |
443 | } | |
1acb2e6f | 444 | EVP_MD_free(fetched_digest); |
0f113f3e MC |
445 | return mdbio; |
446 | err: | |
1acb2e6f | 447 | EVP_MD_free(fetched_digest); |
ca3a82c3 | 448 | BIO_free(mdbio); |
0f113f3e MC |
449 | return NULL; |
450 | } | |
8931b30d DSH |
451 | |
452 | /* Locate a message digest content from a BIO chain based on SignerInfo */ | |
453 | ||
53155f1c SL |
454 | int ossl_cms_DigestAlgorithm_find_ctx(EVP_MD_CTX *mctx, BIO *chain, |
455 | X509_ALGOR *mdalg) | |
0f113f3e MC |
456 | { |
457 | int nid; | |
ac4e2577 | 458 | const ASN1_OBJECT *mdoid; |
0f113f3e MC |
459 | X509_ALGOR_get0(&mdoid, NULL, NULL, mdalg); |
460 | nid = OBJ_obj2nid(mdoid); | |
461 | /* Look for digest type to match signature */ | |
462 | for (;;) { | |
463 | EVP_MD_CTX *mtmp; | |
464 | chain = BIO_find_type(chain, BIO_TYPE_MD); | |
465 | if (chain == NULL) { | |
9311d0c4 | 466 | ERR_raise(ERR_LIB_CMS, CMS_R_NO_MATCHING_DIGEST); |
0f113f3e MC |
467 | return 0; |
468 | } | |
469 | BIO_get_md_ctx(chain, &mtmp); | |
ed576acd | 470 | if (EVP_MD_CTX_get_type(mtmp) == nid |
0f113f3e MC |
471 | /* |
472 | * Workaround for broken implementations that use signature | |
473 | * algorithm OID instead of digest. | |
474 | */ | |
ed576acd | 475 | || EVP_MD_get_pkey_type(EVP_MD_CTX_get0_md(mtmp)) == nid) |
0f113f3e MC |
476 | return EVP_MD_CTX_copy_ex(mctx, mtmp); |
477 | chain = BIO_next(chain); | |
478 | } | |
479 | } | |
480 | ||
481 | static STACK_OF(CMS_CertificateChoices) | |
482 | **cms_get0_certificate_choices(CMS_ContentInfo *cms) | |
483 | { | |
484 | switch (OBJ_obj2nid(cms->contentType)) { | |
485 | ||
486 | case NID_pkcs7_signed: | |
487 | return &cms->d.signedData->certificates; | |
488 | ||
489 | case NID_pkcs7_enveloped: | |
6b360288 PH |
490 | if (cms->d.envelopedData->originatorInfo == NULL) |
491 | return NULL; | |
0f113f3e MC |
492 | return &cms->d.envelopedData->originatorInfo->certificates; |
493 | ||
924663c3 JZ |
494 | case NID_id_smime_ct_authEnvelopedData: |
495 | if (cms->d.authEnvelopedData->originatorInfo == NULL) | |
496 | return NULL; | |
497 | return &cms->d.authEnvelopedData->originatorInfo->certificates; | |
498 | ||
0f113f3e | 499 | default: |
9311d0c4 | 500 | ERR_raise(ERR_LIB_CMS, CMS_R_UNSUPPORTED_CONTENT_TYPE); |
0f113f3e MC |
501 | return NULL; |
502 | ||
503 | } | |
504 | } | |
8931b30d DSH |
505 | |
506 | CMS_CertificateChoices *CMS_add0_CertificateChoices(CMS_ContentInfo *cms) | |
0f113f3e MC |
507 | { |
508 | STACK_OF(CMS_CertificateChoices) **pcerts; | |
509 | CMS_CertificateChoices *cch; | |
12a765a5 | 510 | |
0f113f3e | 511 | pcerts = cms_get0_certificate_choices(cms); |
12a765a5 | 512 | if (pcerts == NULL) |
0f113f3e | 513 | return NULL; |
12a765a5 | 514 | if (*pcerts == NULL) |
0f113f3e | 515 | *pcerts = sk_CMS_CertificateChoices_new_null(); |
12a765a5 | 516 | if (*pcerts == NULL) |
0f113f3e MC |
517 | return NULL; |
518 | cch = M_ASN1_new_of(CMS_CertificateChoices); | |
519 | if (!cch) | |
520 | return NULL; | |
521 | if (!sk_CMS_CertificateChoices_push(*pcerts, cch)) { | |
522 | M_ASN1_free_of(cch, CMS_CertificateChoices); | |
523 | return NULL; | |
524 | } | |
525 | return cch; | |
526 | } | |
8931b30d DSH |
527 | |
528 | int CMS_add0_cert(CMS_ContentInfo *cms, X509 *cert) | |
0f113f3e MC |
529 | { |
530 | CMS_CertificateChoices *cch; | |
531 | STACK_OF(CMS_CertificateChoices) **pcerts; | |
532 | int i; | |
12a765a5 | 533 | |
0f113f3e | 534 | pcerts = cms_get0_certificate_choices(cms); |
12a765a5 | 535 | if (pcerts == NULL) |
0f113f3e MC |
536 | return 0; |
537 | for (i = 0; i < sk_CMS_CertificateChoices_num(*pcerts); i++) { | |
538 | cch = sk_CMS_CertificateChoices_value(*pcerts, i); | |
539 | if (cch->type == CMS_CERTCHOICE_CERT) { | |
540 | if (!X509_cmp(cch->d.certificate, cert)) { | |
9311d0c4 | 541 | ERR_raise(ERR_LIB_CMS, CMS_R_CERTIFICATE_ALREADY_PRESENT); |
0f113f3e MC |
542 | return 0; |
543 | } | |
544 | } | |
545 | } | |
546 | cch = CMS_add0_CertificateChoices(cms); | |
547 | if (!cch) | |
548 | return 0; | |
549 | cch->type = CMS_CERTCHOICE_CERT; | |
550 | cch->d.certificate = cert; | |
551 | return 1; | |
552 | } | |
8931b30d DSH |
553 | |
554 | int CMS_add1_cert(CMS_ContentInfo *cms, X509 *cert) | |
0f113f3e MC |
555 | { |
556 | int r; | |
557 | r = CMS_add0_cert(cms, cert); | |
558 | if (r > 0) | |
05f0fb9f | 559 | X509_up_ref(cert); |
0f113f3e MC |
560 | return r; |
561 | } | |
8931b30d | 562 | |
0f113f3e MC |
563 | static STACK_OF(CMS_RevocationInfoChoice) |
564 | **cms_get0_revocation_choices(CMS_ContentInfo *cms) | |
565 | { | |
566 | switch (OBJ_obj2nid(cms->contentType)) { | |
8931b30d | 567 | |
0f113f3e MC |
568 | case NID_pkcs7_signed: |
569 | return &cms->d.signedData->crls; | |
8931b30d | 570 | |
0f113f3e | 571 | case NID_pkcs7_enveloped: |
6b360288 PH |
572 | if (cms->d.envelopedData->originatorInfo == NULL) |
573 | return NULL; | |
0f113f3e | 574 | return &cms->d.envelopedData->originatorInfo->crls; |
8931b30d | 575 | |
924663c3 JZ |
576 | case NID_id_smime_ct_authEnvelopedData: |
577 | if (cms->d.authEnvelopedData->originatorInfo == NULL) | |
578 | return NULL; | |
579 | return &cms->d.authEnvelopedData->originatorInfo->crls; | |
580 | ||
0f113f3e | 581 | default: |
9311d0c4 | 582 | ERR_raise(ERR_LIB_CMS, CMS_R_UNSUPPORTED_CONTENT_TYPE); |
0f113f3e | 583 | return NULL; |
8931b30d | 584 | |
0f113f3e MC |
585 | } |
586 | } | |
8931b30d DSH |
587 | |
588 | CMS_RevocationInfoChoice *CMS_add0_RevocationInfoChoice(CMS_ContentInfo *cms) | |
0f113f3e MC |
589 | { |
590 | STACK_OF(CMS_RevocationInfoChoice) **pcrls; | |
591 | CMS_RevocationInfoChoice *rch; | |
12a765a5 | 592 | |
0f113f3e | 593 | pcrls = cms_get0_revocation_choices(cms); |
12a765a5 | 594 | if (pcrls == NULL) |
0f113f3e | 595 | return NULL; |
12a765a5 | 596 | if (*pcrls == NULL) |
0f113f3e | 597 | *pcrls = sk_CMS_RevocationInfoChoice_new_null(); |
12a765a5 | 598 | if (*pcrls == NULL) |
0f113f3e MC |
599 | return NULL; |
600 | rch = M_ASN1_new_of(CMS_RevocationInfoChoice); | |
12a765a5 | 601 | if (rch == NULL) |
0f113f3e MC |
602 | return NULL; |
603 | if (!sk_CMS_RevocationInfoChoice_push(*pcrls, rch)) { | |
604 | M_ASN1_free_of(rch, CMS_RevocationInfoChoice); | |
605 | return NULL; | |
606 | } | |
607 | return rch; | |
608 | } | |
8931b30d DSH |
609 | |
610 | int CMS_add0_crl(CMS_ContentInfo *cms, X509_CRL *crl) | |
0f113f3e MC |
611 | { |
612 | CMS_RevocationInfoChoice *rch; | |
613 | rch = CMS_add0_RevocationInfoChoice(cms); | |
614 | if (!rch) | |
615 | return 0; | |
616 | rch->type = CMS_REVCHOICE_CRL; | |
617 | rch->d.crl = crl; | |
618 | return 1; | |
619 | } | |
8931b30d | 620 | |
19048b5c | 621 | int CMS_add1_crl(CMS_ContentInfo *cms, X509_CRL *crl) |
0f113f3e MC |
622 | { |
623 | int r; | |
624 | r = CMS_add0_crl(cms, crl); | |
625 | if (r > 0) | |
65cbf983 | 626 | X509_CRL_up_ref(crl); |
0f113f3e MC |
627 | return r; |
628 | } | |
19048b5c | 629 | |
8931b30d | 630 | STACK_OF(X509) *CMS_get1_certs(CMS_ContentInfo *cms) |
0f113f3e MC |
631 | { |
632 | STACK_OF(X509) *certs = NULL; | |
633 | CMS_CertificateChoices *cch; | |
634 | STACK_OF(CMS_CertificateChoices) **pcerts; | |
635 | int i; | |
12a765a5 | 636 | |
0f113f3e | 637 | pcerts = cms_get0_certificate_choices(cms); |
12a765a5 | 638 | if (pcerts == NULL) |
0f113f3e MC |
639 | return NULL; |
640 | for (i = 0; i < sk_CMS_CertificateChoices_num(*pcerts); i++) { | |
641 | cch = sk_CMS_CertificateChoices_value(*pcerts, i); | |
642 | if (cch->type == 0) { | |
c1be4d61 DDO |
643 | if (!ossl_x509_add_cert_new(&certs, cch->d.certificate, |
644 | X509_ADD_FLAG_UP_REF)) { | |
79b2a2f2 | 645 | OSSL_STACK_OF_X509_free(certs); |
0f113f3e MC |
646 | return NULL; |
647 | } | |
0f113f3e MC |
648 | } |
649 | } | |
650 | return certs; | |
651 | ||
652 | } | |
8931b30d DSH |
653 | |
654 | STACK_OF(X509_CRL) *CMS_get1_crls(CMS_ContentInfo *cms) | |
0f113f3e MC |
655 | { |
656 | STACK_OF(X509_CRL) *crls = NULL; | |
657 | STACK_OF(CMS_RevocationInfoChoice) **pcrls; | |
658 | CMS_RevocationInfoChoice *rch; | |
659 | int i; | |
12a765a5 | 660 | |
0f113f3e | 661 | pcrls = cms_get0_revocation_choices(cms); |
12a765a5 | 662 | if (pcrls == NULL) |
0f113f3e MC |
663 | return NULL; |
664 | for (i = 0; i < sk_CMS_RevocationInfoChoice_num(*pcrls); i++) { | |
665 | rch = sk_CMS_RevocationInfoChoice_value(*pcrls, i); | |
666 | if (rch->type == 0) { | |
667 | if (!crls) { | |
668 | crls = sk_X509_CRL_new_null(); | |
669 | if (!crls) | |
670 | return NULL; | |
671 | } | |
672 | if (!sk_X509_CRL_push(crls, rch->d.crl)) { | |
673 | sk_X509_CRL_pop_free(crls, X509_CRL_free); | |
674 | return NULL; | |
675 | } | |
65cbf983 | 676 | X509_CRL_up_ref(rch->d.crl); |
0f113f3e MC |
677 | } |
678 | } | |
679 | return crls; | |
680 | } | |
17c2764d | 681 | |
53155f1c | 682 | int ossl_cms_ias_cert_cmp(CMS_IssuerAndSerialNumber *ias, X509 *cert) |
0f113f3e MC |
683 | { |
684 | int ret; | |
685 | ret = X509_NAME_cmp(ias->issuer, X509_get_issuer_name(cert)); | |
686 | if (ret) | |
687 | return ret; | |
1337a3a9 | 688 | return ASN1_INTEGER_cmp(ias->serialNumber, X509_get0_serialNumber(cert)); |
0f113f3e | 689 | } |
17c2764d | 690 | |
53155f1c | 691 | int ossl_cms_keyid_cert_cmp(ASN1_OCTET_STRING *keyid, X509 *cert) |
0f113f3e | 692 | { |
d19a50c9 DSH |
693 | const ASN1_OCTET_STRING *cert_keyid = X509_get0_subject_key_id(cert); |
694 | ||
695 | if (cert_keyid == NULL) | |
0f113f3e | 696 | return -1; |
d19a50c9 | 697 | return ASN1_OCTET_STRING_cmp(keyid, cert_keyid); |
0f113f3e | 698 | } |
17c2764d | 699 | |
53155f1c | 700 | int ossl_cms_set1_ias(CMS_IssuerAndSerialNumber **pias, X509 *cert) |
0f113f3e MC |
701 | { |
702 | CMS_IssuerAndSerialNumber *ias; | |
703 | ias = M_ASN1_new_of(CMS_IssuerAndSerialNumber); | |
e077455e RL |
704 | if (!ias) { |
705 | ERR_raise(ERR_LIB_CMS, ERR_R_ASN1_LIB); | |
0f113f3e | 706 | goto err; |
e077455e RL |
707 | } |
708 | if (!X509_NAME_set(&ias->issuer, X509_get_issuer_name(cert))) { | |
709 | ERR_raise(ERR_LIB_CMS, ERR_R_X509_LIB); | |
0f113f3e | 710 | goto err; |
e077455e RL |
711 | } |
712 | if (!ASN1_STRING_copy(ias->serialNumber, X509_get0_serialNumber(cert))) { | |
713 | ERR_raise(ERR_LIB_CMS, ERR_R_ASN1_LIB); | |
0f113f3e | 714 | goto err; |
e077455e | 715 | } |
2ace7450 | 716 | M_ASN1_free_of(*pias, CMS_IssuerAndSerialNumber); |
0f113f3e MC |
717 | *pias = ias; |
718 | return 1; | |
719 | err: | |
2ace7450 | 720 | M_ASN1_free_of(ias, CMS_IssuerAndSerialNumber); |
0f113f3e MC |
721 | return 0; |
722 | } | |
17c2764d | 723 | |
53155f1c | 724 | int ossl_cms_set1_keyid(ASN1_OCTET_STRING **pkeyid, X509 *cert) |
0f113f3e MC |
725 | { |
726 | ASN1_OCTET_STRING *keyid = NULL; | |
d19a50c9 DSH |
727 | const ASN1_OCTET_STRING *cert_keyid; |
728 | cert_keyid = X509_get0_subject_key_id(cert); | |
729 | if (cert_keyid == NULL) { | |
9311d0c4 | 730 | ERR_raise(ERR_LIB_CMS, CMS_R_CERTIFICATE_HAS_NO_KEYID); |
0f113f3e MC |
731 | return 0; |
732 | } | |
d19a50c9 | 733 | keyid = ASN1_STRING_dup(cert_keyid); |
0f113f3e | 734 | if (!keyid) { |
e077455e | 735 | ERR_raise(ERR_LIB_CMS, ERR_R_ASN1_LIB); |
0f113f3e MC |
736 | return 0; |
737 | } | |
2ace7450 | 738 | ASN1_OCTET_STRING_free(*pkeyid); |
0f113f3e MC |
739 | *pkeyid = keyid; |
740 | return 1; | |
741 | } |