2 * Copyright 2008-2020 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
10 #include <openssl/asn1t.h>
11 #include <openssl/x509v3.h>
12 #include <openssl/err.h>
13 #include <openssl/pem.h>
14 #include <openssl/bio.h>
15 #include <openssl/asn1.h>
16 #include <openssl/cms.h>
17 #include <openssl/cms.h>
18 #include "crypto/x509.h"
19 #include "cms_local.h"
21 static STACK_OF(CMS_CertificateChoices
)
22 **cms_get0_certificate_choices(CMS_ContentInfo
*cms
);
24 DEFINE_STACK_OF(CMS_RevocationInfoChoice
)
26 DEFINE_STACK_OF(X509_CRL
)
28 IMPLEMENT_ASN1_PRINT_FUNCTION(CMS_ContentInfo
)
30 CMS_ContentInfo
*d2i_CMS_ContentInfo(CMS_ContentInfo
**a
,
31 const unsigned char **in
, long len
)
35 ci
= (CMS_ContentInfo
*)ASN1_item_d2i((ASN1_VALUE
**)a
, in
, len
,
36 (CMS_ContentInfo_it()));
37 if (ci
!= NULL
&& a
!= NULL
)
38 cms_resolve_libctx(ci
);
42 int i2d_CMS_ContentInfo(const CMS_ContentInfo
*a
, unsigned char **out
)
44 return ASN1_item_i2d((const ASN1_VALUE
*)a
, out
, (CMS_ContentInfo_it()));
47 CMS_ContentInfo
*CMS_ContentInfo_new_with_libctx(OPENSSL_CTX
*libctx
,
52 ci
= (CMS_ContentInfo
*)ASN1_item_new(ASN1_ITEM_rptr(CMS_ContentInfo
));
54 ci
->ctx
.libctx
= libctx
;
57 ci
->ctx
.propq
= OPENSSL_strdup(propq
);
58 if (ci
->ctx
.propq
== NULL
) {
59 CMS_ContentInfo_free(ci
);
61 ERR_raise(ERR_LIB_PROV
, ERR_R_MALLOC_FAILURE
);
68 CMS_ContentInfo
*CMS_ContentInfo_new(void)
70 return CMS_ContentInfo_new_with_libctx(NULL
, NULL
);
73 void CMS_ContentInfo_free(CMS_ContentInfo
*cms
)
76 OPENSSL_free(cms
->ctx
.propq
);
77 ASN1_item_free((ASN1_VALUE
*)cms
, ASN1_ITEM_rptr(CMS_ContentInfo
));
81 const CMS_CTX
*cms_get0_cmsctx(const CMS_ContentInfo
*cms
)
83 return cms
!= NULL
? &cms
->ctx
: NULL
;
86 OPENSSL_CTX
*cms_ctx_get0_libctx(const CMS_CTX
*ctx
)
91 const char *cms_ctx_get0_propq(const CMS_CTX
*ctx
)
96 void cms_resolve_libctx(CMS_ContentInfo
*ci
)
99 CMS_CertificateChoices
*cch
;
100 STACK_OF(CMS_CertificateChoices
) **pcerts
;
106 ctx
= cms_get0_cmsctx(ci
);
107 cms_SignerInfos_set_cmsctx(ci
);
108 cms_RecipientInfos_set_cmsctx(ci
);
110 pcerts
= cms_get0_certificate_choices(ci
);
111 if (pcerts
!= NULL
) {
112 for (i
= 0; i
< sk_CMS_CertificateChoices_num(*pcerts
); i
++) {
113 cch
= sk_CMS_CertificateChoices_value(*pcerts
, i
);
114 if (cch
->type
== CMS_CERTCHOICE_CERT
)
115 x509_set0_libctx(cch
->d
.certificate
, ctx
->libctx
, ctx
->propq
);
120 const ASN1_OBJECT
*CMS_get0_type(const CMS_ContentInfo
*cms
)
122 return cms
->contentType
;
125 CMS_ContentInfo
*cms_Data_create(OPENSSL_CTX
*libctx
, const char *propq
)
127 CMS_ContentInfo
*cms
= CMS_ContentInfo_new_with_libctx(libctx
, propq
);
130 cms
->contentType
= OBJ_nid2obj(NID_pkcs7_data
);
132 CMS_set_detached(cms
, 0);
137 BIO
*cms_content_bio(CMS_ContentInfo
*cms
)
139 ASN1_OCTET_STRING
**pos
= CMS_get0_content(cms
);
143 /* If content detached data goes nowhere: create NULL BIO */
145 return BIO_new(BIO_s_null());
147 * If content not detached and created return memory BIO
149 if (*pos
== NULL
|| ((*pos
)->flags
== ASN1_STRING_FLAG_CONT
))
150 return BIO_new(BIO_s_mem());
151 /* Else content was read in: return read only BIO for it */
152 return BIO_new_mem_buf((*pos
)->data
, (*pos
)->length
);
155 BIO
*CMS_dataInit(CMS_ContentInfo
*cms
, BIO
*icont
)
161 cont
= cms_content_bio(cms
);
163 CMSerr(CMS_F_CMS_DATAINIT
, CMS_R_NO_CONTENT
);
166 switch (OBJ_obj2nid(cms
->contentType
)) {
171 case NID_pkcs7_signed
:
172 cmsbio
= cms_SignedData_init_bio(cms
);
175 case NID_pkcs7_digest
:
176 cmsbio
= cms_DigestedData_init_bio(cms
);
179 case NID_id_smime_ct_compressedData
:
180 cmsbio
= cms_CompressedData_init_bio(cms
);
184 case NID_pkcs7_encrypted
:
185 cmsbio
= cms_EncryptedData_init_bio(cms
);
188 case NID_pkcs7_enveloped
:
189 cmsbio
= cms_EnvelopedData_init_bio(cms
);
193 CMSerr(CMS_F_CMS_DATAINIT
, CMS_R_UNSUPPORTED_TYPE
);
198 return BIO_push(cmsbio
, cont
);
206 /* unfortunately cannot constify SMIME_write_ASN1() due to this function */
207 int CMS_dataFinal(CMS_ContentInfo
*cms
, BIO
*cmsbio
)
209 ASN1_OCTET_STRING
**pos
= CMS_get0_content(cms
);
213 /* If embedded content find memory BIO and set content */
214 if (*pos
&& ((*pos
)->flags
& ASN1_STRING_FLAG_CONT
)) {
218 mbio
= BIO_find_type(cmsbio
, BIO_TYPE_MEM
);
220 CMSerr(CMS_F_CMS_DATAFINAL
, CMS_R_CONTENT_NOT_FOUND
);
223 contlen
= BIO_get_mem_data(mbio
, &cont
);
224 /* Set bio as read only so its content can't be clobbered */
225 BIO_set_flags(mbio
, BIO_FLAGS_MEM_RDONLY
);
226 BIO_set_mem_eof_return(mbio
, 0);
227 ASN1_STRING_set0(*pos
, cont
, contlen
);
228 (*pos
)->flags
&= ~ASN1_STRING_FLAG_CONT
;
231 switch (OBJ_obj2nid(cms
->contentType
)) {
234 case NID_pkcs7_encrypted
:
235 case NID_id_smime_ct_compressedData
:
239 case NID_pkcs7_enveloped
:
240 return cms_EnvelopedData_final(cms
, cmsbio
);
242 case NID_pkcs7_signed
:
243 return cms_SignedData_final(cms
, cmsbio
);
245 case NID_pkcs7_digest
:
246 return cms_DigestedData_do_final(cms
, cmsbio
, 0);
249 CMSerr(CMS_F_CMS_DATAFINAL
, CMS_R_UNSUPPORTED_TYPE
);
255 * Return an OCTET STRING pointer to content. This allows it to be accessed
259 ASN1_OCTET_STRING
**CMS_get0_content(CMS_ContentInfo
*cms
)
261 switch (OBJ_obj2nid(cms
->contentType
)) {
266 case NID_pkcs7_signed
:
267 return &cms
->d
.signedData
->encapContentInfo
->eContent
;
269 case NID_pkcs7_enveloped
:
270 return &cms
->d
.envelopedData
->encryptedContentInfo
->encryptedContent
;
272 case NID_pkcs7_digest
:
273 return &cms
->d
.digestedData
->encapContentInfo
->eContent
;
275 case NID_pkcs7_encrypted
:
276 return &cms
->d
.encryptedData
->encryptedContentInfo
->encryptedContent
;
278 case NID_id_smime_ct_authData
:
279 return &cms
->d
.authenticatedData
->encapContentInfo
->eContent
;
281 case NID_id_smime_ct_compressedData
:
282 return &cms
->d
.compressedData
->encapContentInfo
->eContent
;
285 if (cms
->d
.other
->type
== V_ASN1_OCTET_STRING
)
286 return &cms
->d
.other
->value
.octet_string
;
287 CMSerr(CMS_F_CMS_GET0_CONTENT
, CMS_R_UNSUPPORTED_CONTENT_TYPE
);
294 * Return an ASN1_OBJECT pointer to content type. This allows it to be
295 * accessed or set later.
298 static ASN1_OBJECT
**cms_get0_econtent_type(CMS_ContentInfo
*cms
)
300 switch (OBJ_obj2nid(cms
->contentType
)) {
302 case NID_pkcs7_signed
:
303 return &cms
->d
.signedData
->encapContentInfo
->eContentType
;
305 case NID_pkcs7_enveloped
:
306 return &cms
->d
.envelopedData
->encryptedContentInfo
->contentType
;
308 case NID_pkcs7_digest
:
309 return &cms
->d
.digestedData
->encapContentInfo
->eContentType
;
311 case NID_pkcs7_encrypted
:
312 return &cms
->d
.encryptedData
->encryptedContentInfo
->contentType
;
314 case NID_id_smime_ct_authData
:
315 return &cms
->d
.authenticatedData
->encapContentInfo
->eContentType
;
317 case NID_id_smime_ct_compressedData
:
318 return &cms
->d
.compressedData
->encapContentInfo
->eContentType
;
321 CMSerr(CMS_F_CMS_GET0_ECONTENT_TYPE
, CMS_R_UNSUPPORTED_CONTENT_TYPE
);
327 const ASN1_OBJECT
*CMS_get0_eContentType(CMS_ContentInfo
*cms
)
329 ASN1_OBJECT
**petype
;
330 petype
= cms_get0_econtent_type(cms
);
336 int CMS_set1_eContentType(CMS_ContentInfo
*cms
, const ASN1_OBJECT
*oid
)
338 ASN1_OBJECT
**petype
, *etype
;
340 petype
= cms_get0_econtent_type(cms
);
345 etype
= OBJ_dup(oid
);
348 ASN1_OBJECT_free(*petype
);
353 int CMS_is_detached(CMS_ContentInfo
*cms
)
355 ASN1_OCTET_STRING
**pos
;
357 pos
= CMS_get0_content(cms
);
365 int CMS_set_detached(CMS_ContentInfo
*cms
, int detached
)
367 ASN1_OCTET_STRING
**pos
;
369 pos
= CMS_get0_content(cms
);
373 ASN1_OCTET_STRING_free(*pos
);
378 *pos
= ASN1_OCTET_STRING_new();
381 * NB: special flag to show content is created and not read in.
383 (*pos
)->flags
|= ASN1_STRING_FLAG_CONT
;
386 CMSerr(CMS_F_CMS_SET_DETACHED
, ERR_R_MALLOC_FAILURE
);
390 /* Create a digest BIO from an X509_ALGOR structure */
392 BIO
*cms_DigestAlgorithm_init_bio(X509_ALGOR
*digestAlgorithm
,
396 const ASN1_OBJECT
*digestoid
;
397 EVP_MD
*digest
= NULL
;
400 X509_ALGOR_get0(&digestoid
, NULL
, NULL
, digestAlgorithm
);
401 alg
= OBJ_nid2sn(OBJ_obj2nid(digestoid
));
402 digest
= EVP_MD_fetch(ctx
->libctx
, alg
, ctx
->propq
);
403 if (digest
== NULL
) {
404 CMSerr(CMS_F_CMS_DIGESTALGORITHM_INIT_BIO
,
405 CMS_R_UNKNOWN_DIGEST_ALGORITHM
);
408 mdbio
= BIO_new(BIO_f_md());
409 if (mdbio
== NULL
|| !BIO_set_md(mdbio
, digest
)) {
410 CMSerr(CMS_F_CMS_DIGESTALGORITHM_INIT_BIO
, CMS_R_MD_BIO_INIT_ERROR
);
421 /* Locate a message digest content from a BIO chain based on SignerInfo */
423 int cms_DigestAlgorithm_find_ctx(EVP_MD_CTX
*mctx
, BIO
*chain
,
427 const ASN1_OBJECT
*mdoid
;
428 X509_ALGOR_get0(&mdoid
, NULL
, NULL
, mdalg
);
429 nid
= OBJ_obj2nid(mdoid
);
430 /* Look for digest type to match signature */
433 chain
= BIO_find_type(chain
, BIO_TYPE_MD
);
435 CMSerr(CMS_F_CMS_DIGESTALGORITHM_FIND_CTX
,
436 CMS_R_NO_MATCHING_DIGEST
);
439 BIO_get_md_ctx(chain
, &mtmp
);
440 if (EVP_MD_CTX_type(mtmp
) == nid
442 * Workaround for broken implementations that use signature
443 * algorithm OID instead of digest.
445 || EVP_MD_pkey_type(EVP_MD_CTX_md(mtmp
)) == nid
)
446 return EVP_MD_CTX_copy_ex(mctx
, mtmp
);
447 chain
= BIO_next(chain
);
451 static STACK_OF(CMS_CertificateChoices
)
452 **cms_get0_certificate_choices(CMS_ContentInfo
*cms
)
454 switch (OBJ_obj2nid(cms
->contentType
)) {
456 case NID_pkcs7_signed
:
457 return &cms
->d
.signedData
->certificates
;
459 case NID_pkcs7_enveloped
:
460 if (cms
->d
.envelopedData
->originatorInfo
== NULL
)
462 return &cms
->d
.envelopedData
->originatorInfo
->certificates
;
465 CMSerr(CMS_F_CMS_GET0_CERTIFICATE_CHOICES
,
466 CMS_R_UNSUPPORTED_CONTENT_TYPE
);
472 CMS_CertificateChoices
*CMS_add0_CertificateChoices(CMS_ContentInfo
*cms
)
474 STACK_OF(CMS_CertificateChoices
) **pcerts
;
475 CMS_CertificateChoices
*cch
;
477 pcerts
= cms_get0_certificate_choices(cms
);
481 *pcerts
= sk_CMS_CertificateChoices_new_null();
484 cch
= M_ASN1_new_of(CMS_CertificateChoices
);
487 if (!sk_CMS_CertificateChoices_push(*pcerts
, cch
)) {
488 M_ASN1_free_of(cch
, CMS_CertificateChoices
);
494 int CMS_add0_cert(CMS_ContentInfo
*cms
, X509
*cert
)
496 CMS_CertificateChoices
*cch
;
497 STACK_OF(CMS_CertificateChoices
) **pcerts
;
500 pcerts
= cms_get0_certificate_choices(cms
);
503 for (i
= 0; i
< sk_CMS_CertificateChoices_num(*pcerts
); i
++) {
504 cch
= sk_CMS_CertificateChoices_value(*pcerts
, i
);
505 if (cch
->type
== CMS_CERTCHOICE_CERT
) {
506 if (!X509_cmp(cch
->d
.certificate
, cert
)) {
507 CMSerr(CMS_F_CMS_ADD0_CERT
,
508 CMS_R_CERTIFICATE_ALREADY_PRESENT
);
513 cch
= CMS_add0_CertificateChoices(cms
);
516 cch
->type
= CMS_CERTCHOICE_CERT
;
517 cch
->d
.certificate
= cert
;
521 int CMS_add1_cert(CMS_ContentInfo
*cms
, X509
*cert
)
524 r
= CMS_add0_cert(cms
, cert
);
530 static STACK_OF(CMS_RevocationInfoChoice
)
531 **cms_get0_revocation_choices(CMS_ContentInfo
*cms
)
533 switch (OBJ_obj2nid(cms
->contentType
)) {
535 case NID_pkcs7_signed
:
536 return &cms
->d
.signedData
->crls
;
538 case NID_pkcs7_enveloped
:
539 if (cms
->d
.envelopedData
->originatorInfo
== NULL
)
541 return &cms
->d
.envelopedData
->originatorInfo
->crls
;
544 CMSerr(CMS_F_CMS_GET0_REVOCATION_CHOICES
,
545 CMS_R_UNSUPPORTED_CONTENT_TYPE
);
551 CMS_RevocationInfoChoice
*CMS_add0_RevocationInfoChoice(CMS_ContentInfo
*cms
)
553 STACK_OF(CMS_RevocationInfoChoice
) **pcrls
;
554 CMS_RevocationInfoChoice
*rch
;
556 pcrls
= cms_get0_revocation_choices(cms
);
560 *pcrls
= sk_CMS_RevocationInfoChoice_new_null();
563 rch
= M_ASN1_new_of(CMS_RevocationInfoChoice
);
566 if (!sk_CMS_RevocationInfoChoice_push(*pcrls
, rch
)) {
567 M_ASN1_free_of(rch
, CMS_RevocationInfoChoice
);
573 int CMS_add0_crl(CMS_ContentInfo
*cms
, X509_CRL
*crl
)
575 CMS_RevocationInfoChoice
*rch
;
576 rch
= CMS_add0_RevocationInfoChoice(cms
);
579 rch
->type
= CMS_REVCHOICE_CRL
;
584 int CMS_add1_crl(CMS_ContentInfo
*cms
, X509_CRL
*crl
)
587 r
= CMS_add0_crl(cms
, crl
);
589 X509_CRL_up_ref(crl
);
593 STACK_OF(X509
) *CMS_get1_certs(CMS_ContentInfo
*cms
)
595 STACK_OF(X509
) *certs
= NULL
;
596 CMS_CertificateChoices
*cch
;
597 STACK_OF(CMS_CertificateChoices
) **pcerts
;
600 pcerts
= cms_get0_certificate_choices(cms
);
603 for (i
= 0; i
< sk_CMS_CertificateChoices_num(*pcerts
); i
++) {
604 cch
= sk_CMS_CertificateChoices_value(*pcerts
, i
);
605 if (cch
->type
== 0) {
606 if (!X509_add_cert_new(&certs
, cch
->d
.certificate
,
607 X509_ADD_FLAG_UP_REF
)) {
608 sk_X509_pop_free(certs
, X509_free
);
617 STACK_OF(X509_CRL
) *CMS_get1_crls(CMS_ContentInfo
*cms
)
619 STACK_OF(X509_CRL
) *crls
= NULL
;
620 STACK_OF(CMS_RevocationInfoChoice
) **pcrls
;
621 CMS_RevocationInfoChoice
*rch
;
624 pcrls
= cms_get0_revocation_choices(cms
);
627 for (i
= 0; i
< sk_CMS_RevocationInfoChoice_num(*pcrls
); i
++) {
628 rch
= sk_CMS_RevocationInfoChoice_value(*pcrls
, i
);
629 if (rch
->type
== 0) {
631 crls
= sk_X509_CRL_new_null();
635 if (!sk_X509_CRL_push(crls
, rch
->d
.crl
)) {
636 sk_X509_CRL_pop_free(crls
, X509_CRL_free
);
639 X509_CRL_up_ref(rch
->d
.crl
);
645 int cms_ias_cert_cmp(CMS_IssuerAndSerialNumber
*ias
, X509
*cert
)
648 ret
= X509_NAME_cmp(ias
->issuer
, X509_get_issuer_name(cert
));
651 return ASN1_INTEGER_cmp(ias
->serialNumber
, X509_get0_serialNumber(cert
));
654 int cms_keyid_cert_cmp(ASN1_OCTET_STRING
*keyid
, X509
*cert
)
656 const ASN1_OCTET_STRING
*cert_keyid
= X509_get0_subject_key_id(cert
);
658 if (cert_keyid
== NULL
)
660 return ASN1_OCTET_STRING_cmp(keyid
, cert_keyid
);
663 int cms_set1_ias(CMS_IssuerAndSerialNumber
**pias
, X509
*cert
)
665 CMS_IssuerAndSerialNumber
*ias
;
666 ias
= M_ASN1_new_of(CMS_IssuerAndSerialNumber
);
669 if (!X509_NAME_set(&ias
->issuer
, X509_get_issuer_name(cert
)))
671 if (!ASN1_STRING_copy(ias
->serialNumber
, X509_get0_serialNumber(cert
)))
673 M_ASN1_free_of(*pias
, CMS_IssuerAndSerialNumber
);
677 M_ASN1_free_of(ias
, CMS_IssuerAndSerialNumber
);
678 CMSerr(CMS_F_CMS_SET1_IAS
, ERR_R_MALLOC_FAILURE
);
682 int cms_set1_keyid(ASN1_OCTET_STRING
**pkeyid
, X509
*cert
)
684 ASN1_OCTET_STRING
*keyid
= NULL
;
685 const ASN1_OCTET_STRING
*cert_keyid
;
686 cert_keyid
= X509_get0_subject_key_id(cert
);
687 if (cert_keyid
== NULL
) {
688 CMSerr(CMS_F_CMS_SET1_KEYID
, CMS_R_CERTIFICATE_HAS_NO_KEYID
);
691 keyid
= ASN1_STRING_dup(cert_keyid
);
693 CMSerr(CMS_F_CMS_SET1_KEYID
, ERR_R_MALLOC_FAILURE
);
696 ASN1_OCTET_STRING_free(*pkeyid
);