2 * Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
11 #include "internal/cryptlib.h"
12 #include <openssl/asn1t.h>
13 #include <openssl/pkcs7.h>
14 #include <openssl/x509.h>
15 #include "pk7_local.h"
17 /* PKCS#7 ASN1 module */
19 /* This is the ANY DEFINED BY table for the top level PKCS#7 structure */
21 ASN1_ADB_TEMPLATE(p7default
) = ASN1_EXP_OPT(PKCS7
, d
.other
, ASN1_ANY
, 0);
24 ADB_ENTRY(NID_pkcs7_data
, ASN1_NDEF_EXP_OPT(PKCS7
, d
.data
, ASN1_OCTET_STRING_NDEF
, 0)),
25 ADB_ENTRY(NID_pkcs7_signed
, ASN1_NDEF_EXP_OPT(PKCS7
, d
.sign
, PKCS7_SIGNED
, 0)),
26 ADB_ENTRY(NID_pkcs7_enveloped
, ASN1_NDEF_EXP_OPT(PKCS7
, d
.enveloped
, PKCS7_ENVELOPE
, 0)),
27 ADB_ENTRY(NID_pkcs7_signedAndEnveloped
, ASN1_NDEF_EXP_OPT(PKCS7
, d
.signed_and_enveloped
, PKCS7_SIGN_ENVELOPE
, 0)),
28 ADB_ENTRY(NID_pkcs7_digest
, ASN1_NDEF_EXP_OPT(PKCS7
, d
.digest
, PKCS7_DIGEST
, 0)),
29 ADB_ENTRY(NID_pkcs7_encrypted
, ASN1_NDEF_EXP_OPT(PKCS7
, d
.encrypted
, PKCS7_ENCRYPT
, 0))
30 } ASN1_ADB_END(PKCS7
, 0, type
, 0, &p7default_tt
, NULL
);
32 /* PKCS#7 streaming support */
33 static int pk7_cb(int operation
, ASN1_VALUE
**pval
, const ASN1_ITEM
*it
,
36 ASN1_STREAM_ARG
*sarg
= exarg
;
37 PKCS7
**pp7
= (PKCS7
**)pval
;
41 case ASN1_OP_STREAM_PRE
:
42 if (PKCS7_stream(&sarg
->boundary
, *pp7
) <= 0)
45 case ASN1_OP_DETACHED_PRE
:
46 sarg
->ndef_bio
= PKCS7_dataInit(*pp7
, sarg
->out
);
51 case ASN1_OP_STREAM_POST
:
52 case ASN1_OP_DETACHED_POST
:
53 if (PKCS7_dataFinal(*pp7
, sarg
->ndef_bio
) <= 0)
61 ASN1_NDEF_SEQUENCE_cb(PKCS7
, pk7_cb
) = {
62 ASN1_SIMPLE(PKCS7
, type
, ASN1_OBJECT
),
63 ASN1_ADB_OBJECT(PKCS7
)
64 }ASN1_NDEF_SEQUENCE_END_cb(PKCS7
, PKCS7
)
66 PKCS7
*d2i_PKCS7(PKCS7
**a
, const unsigned char **in
, long len
)
70 ret
= (PKCS7
*)ASN1_item_d2i((ASN1_VALUE
**)a
, in
, len
, (PKCS7_it()));
71 if (ret
!= NULL
&& a
!= NULL
)
72 pkcs7_resolve_libctx(ret
);
76 int i2d_PKCS7(const PKCS7
*a
, unsigned char **out
)
78 return ASN1_item_i2d((const ASN1_VALUE
*)a
, out
, (PKCS7_it()));\
81 PKCS7
*PKCS7_new(void)
83 return (PKCS7
*)ASN1_item_new(ASN1_ITEM_rptr(PKCS7
));
86 PKCS7
*PKCS7_new_ex(OSSL_LIB_CTX
*libctx
, const char *propq
)
88 PKCS7
*pkcs7
= PKCS7_new();
91 pkcs7
->ctx
.libctx
= libctx
;
92 pkcs7
->ctx
.propq
= NULL
;
94 pkcs7
->ctx
.propq
= OPENSSL_strdup(propq
);
95 if (pkcs7
->ctx
.propq
== NULL
) {
98 ERR_raise(ERR_LIB_PROV
, ERR_R_MALLOC_FAILURE
);
105 void PKCS7_free(PKCS7
*p7
)
108 OPENSSL_free(p7
->ctx
.propq
);
109 ASN1_item_free((ASN1_VALUE
*)p7
, ASN1_ITEM_rptr(PKCS7
));
113 IMPLEMENT_ASN1_NDEF_FUNCTION(PKCS7
)
115 IMPLEMENT_ASN1_DUP_FUNCTION(PKCS7
)
117 ASN1_NDEF_SEQUENCE(PKCS7_SIGNED
) = {
118 ASN1_SIMPLE(PKCS7_SIGNED
, version
, ASN1_INTEGER
),
119 ASN1_SET_OF(PKCS7_SIGNED
, md_algs
, X509_ALGOR
),
120 ASN1_SIMPLE(PKCS7_SIGNED
, contents
, PKCS7
),
121 ASN1_IMP_SEQUENCE_OF_OPT(PKCS7_SIGNED
, cert
, X509
, 0),
122 ASN1_IMP_SET_OF_OPT(PKCS7_SIGNED
, crl
, X509_CRL
, 1),
123 ASN1_SET_OF(PKCS7_SIGNED
, signer_info
, PKCS7_SIGNER_INFO
)
124 } ASN1_NDEF_SEQUENCE_END(PKCS7_SIGNED
)
126 IMPLEMENT_ASN1_FUNCTIONS(PKCS7_SIGNED
)
128 /* Minor tweak to operation: free up EVP_PKEY */
129 static int si_cb(int operation
, ASN1_VALUE
**pval
, const ASN1_ITEM
*it
,
132 if (operation
== ASN1_OP_FREE_POST
) {
133 PKCS7_SIGNER_INFO
*si
= (PKCS7_SIGNER_INFO
*)*pval
;
134 EVP_PKEY_free(si
->pkey
);
139 ASN1_SEQUENCE_cb(PKCS7_SIGNER_INFO
, si_cb
) = {
140 ASN1_SIMPLE(PKCS7_SIGNER_INFO
, version
, ASN1_INTEGER
),
141 ASN1_SIMPLE(PKCS7_SIGNER_INFO
, issuer_and_serial
, PKCS7_ISSUER_AND_SERIAL
),
142 ASN1_SIMPLE(PKCS7_SIGNER_INFO
, digest_alg
, X509_ALGOR
),
143 /* NB this should be a SET OF but we use a SEQUENCE OF so the
144 * original order * is retained when the structure is reencoded.
145 * Since the attributes are implicitly tagged this will not affect
148 ASN1_IMP_SEQUENCE_OF_OPT(PKCS7_SIGNER_INFO
, auth_attr
, X509_ATTRIBUTE
, 0),
149 ASN1_SIMPLE(PKCS7_SIGNER_INFO
, digest_enc_alg
, X509_ALGOR
),
150 ASN1_SIMPLE(PKCS7_SIGNER_INFO
, enc_digest
, ASN1_OCTET_STRING
),
151 ASN1_IMP_SET_OF_OPT(PKCS7_SIGNER_INFO
, unauth_attr
, X509_ATTRIBUTE
, 1)
152 } ASN1_SEQUENCE_END_cb(PKCS7_SIGNER_INFO
, PKCS7_SIGNER_INFO
)
154 IMPLEMENT_ASN1_FUNCTIONS(PKCS7_SIGNER_INFO
)
156 ASN1_SEQUENCE(PKCS7_ISSUER_AND_SERIAL
) = {
157 ASN1_SIMPLE(PKCS7_ISSUER_AND_SERIAL
, issuer
, X509_NAME
),
158 ASN1_SIMPLE(PKCS7_ISSUER_AND_SERIAL
, serial
, ASN1_INTEGER
)
159 } ASN1_SEQUENCE_END(PKCS7_ISSUER_AND_SERIAL
)
161 IMPLEMENT_ASN1_FUNCTIONS(PKCS7_ISSUER_AND_SERIAL
)
163 ASN1_NDEF_SEQUENCE(PKCS7_ENVELOPE
) = {
164 ASN1_SIMPLE(PKCS7_ENVELOPE
, version
, ASN1_INTEGER
),
165 ASN1_SET_OF(PKCS7_ENVELOPE
, recipientinfo
, PKCS7_RECIP_INFO
),
166 ASN1_SIMPLE(PKCS7_ENVELOPE
, enc_data
, PKCS7_ENC_CONTENT
)
167 } ASN1_NDEF_SEQUENCE_END(PKCS7_ENVELOPE
)
169 IMPLEMENT_ASN1_FUNCTIONS(PKCS7_ENVELOPE
)
171 /* Minor tweak to operation: free up X509 */
172 static int ri_cb(int operation
, ASN1_VALUE
**pval
, const ASN1_ITEM
*it
,
175 if (operation
== ASN1_OP_FREE_POST
) {
176 PKCS7_RECIP_INFO
*ri
= (PKCS7_RECIP_INFO
*)*pval
;
182 ASN1_SEQUENCE_cb(PKCS7_RECIP_INFO
, ri_cb
) = {
183 ASN1_SIMPLE(PKCS7_RECIP_INFO
, version
, ASN1_INTEGER
),
184 ASN1_SIMPLE(PKCS7_RECIP_INFO
, issuer_and_serial
, PKCS7_ISSUER_AND_SERIAL
),
185 ASN1_SIMPLE(PKCS7_RECIP_INFO
, key_enc_algor
, X509_ALGOR
),
186 ASN1_SIMPLE(PKCS7_RECIP_INFO
, enc_key
, ASN1_OCTET_STRING
)
187 } ASN1_SEQUENCE_END_cb(PKCS7_RECIP_INFO
, PKCS7_RECIP_INFO
)
189 IMPLEMENT_ASN1_FUNCTIONS(PKCS7_RECIP_INFO
)
191 ASN1_NDEF_SEQUENCE(PKCS7_ENC_CONTENT
) = {
192 ASN1_SIMPLE(PKCS7_ENC_CONTENT
, content_type
, ASN1_OBJECT
),
193 ASN1_SIMPLE(PKCS7_ENC_CONTENT
, algorithm
, X509_ALGOR
),
194 ASN1_IMP_OPT(PKCS7_ENC_CONTENT
, enc_data
, ASN1_OCTET_STRING_NDEF
, 0)
195 } ASN1_NDEF_SEQUENCE_END(PKCS7_ENC_CONTENT
)
197 IMPLEMENT_ASN1_FUNCTIONS(PKCS7_ENC_CONTENT
)
199 ASN1_NDEF_SEQUENCE(PKCS7_SIGN_ENVELOPE
) = {
200 ASN1_SIMPLE(PKCS7_SIGN_ENVELOPE
, version
, ASN1_INTEGER
),
201 ASN1_SET_OF(PKCS7_SIGN_ENVELOPE
, recipientinfo
, PKCS7_RECIP_INFO
),
202 ASN1_SET_OF(PKCS7_SIGN_ENVELOPE
, md_algs
, X509_ALGOR
),
203 ASN1_SIMPLE(PKCS7_SIGN_ENVELOPE
, enc_data
, PKCS7_ENC_CONTENT
),
204 ASN1_IMP_SET_OF_OPT(PKCS7_SIGN_ENVELOPE
, cert
, X509
, 0),
205 ASN1_IMP_SET_OF_OPT(PKCS7_SIGN_ENVELOPE
, crl
, X509_CRL
, 1),
206 ASN1_SET_OF(PKCS7_SIGN_ENVELOPE
, signer_info
, PKCS7_SIGNER_INFO
)
207 } ASN1_NDEF_SEQUENCE_END(PKCS7_SIGN_ENVELOPE
)
209 IMPLEMENT_ASN1_FUNCTIONS(PKCS7_SIGN_ENVELOPE
)
211 ASN1_NDEF_SEQUENCE(PKCS7_ENCRYPT
) = {
212 ASN1_SIMPLE(PKCS7_ENCRYPT
, version
, ASN1_INTEGER
),
213 ASN1_SIMPLE(PKCS7_ENCRYPT
, enc_data
, PKCS7_ENC_CONTENT
)
214 } ASN1_NDEF_SEQUENCE_END(PKCS7_ENCRYPT
)
216 IMPLEMENT_ASN1_FUNCTIONS(PKCS7_ENCRYPT
)
218 ASN1_NDEF_SEQUENCE(PKCS7_DIGEST
) = {
219 ASN1_SIMPLE(PKCS7_DIGEST
, version
, ASN1_INTEGER
),
220 ASN1_SIMPLE(PKCS7_DIGEST
, md
, X509_ALGOR
),
221 ASN1_SIMPLE(PKCS7_DIGEST
, contents
, PKCS7
),
222 ASN1_SIMPLE(PKCS7_DIGEST
, digest
, ASN1_OCTET_STRING
)
223 } ASN1_NDEF_SEQUENCE_END(PKCS7_DIGEST
)
225 IMPLEMENT_ASN1_FUNCTIONS(PKCS7_DIGEST
)
227 /* Specials for authenticated attributes */
230 * When signing attributes we want to reorder them to match the sorted
234 ASN1_ITEM_TEMPLATE(PKCS7_ATTR_SIGN
) =
235 ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SET_ORDER
, 0, PKCS7_ATTRIBUTES
, X509_ATTRIBUTE
)
236 ASN1_ITEM_TEMPLATE_END(PKCS7_ATTR_SIGN
)
239 * When verifying attributes we need to use the received order. So we use
240 * SEQUENCE OF and tag it to SET OF
243 ASN1_ITEM_TEMPLATE(PKCS7_ATTR_VERIFY
) =
244 ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF
| ASN1_TFLG_IMPTAG
| ASN1_TFLG_UNIVERSAL
,
245 V_ASN1_SET
, PKCS7_ATTRIBUTES
, X509_ATTRIBUTE
)
246 ASN1_ITEM_TEMPLATE_END(PKCS7_ATTR_VERIFY
)
248 IMPLEMENT_ASN1_PRINT_FUNCTION(PKCS7
)