crypto/pkcs7/pk7_lib.c

   1 /*
   2  * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include <stdio.h>
  11 #include "internal/cryptlib.h"
  12 #include <openssl/objects.h>
  13 #include <openssl/x509.h>
  14 #include "crypto/asn1.h"
  15 #include "crypto/evp.h"
  16 #include "crypto/x509.h" /* for sk_X509_add1_cert() */
  17 #include "pk7_local.h"
  18
  19 long PKCS7_ctrl(PKCS7 *p7, int cmd, long larg, char *parg)
  20 {
  21     int nid;
  22     long ret;
  23
  24     nid = OBJ_obj2nid(p7->type);
  25
  26     switch (cmd) {
  27     /* NOTE(emilia): does not support detached digested data. */
  28     case PKCS7_OP_SET_DETACHED_SIGNATURE:
  29         if (nid == NID_pkcs7_signed) {
  30             ret = p7->detached = (int)larg;
  31             if (ret && PKCS7_type_is_data(p7->d.sign->contents)) {
  32                 ASN1_OCTET_STRING *os;
  33                 os = p7->d.sign->contents->d.data;
  34                 ASN1_OCTET_STRING_free(os);
  35                 p7->d.sign->contents->d.data = NULL;
  36             }
  37         } else {
  38             ERR_raise(ERR_LIB_PKCS7,
  39                       PKCS7_R_OPERATION_NOT_SUPPORTED_ON_THIS_TYPE);
  40             ret = 0;
  41         }
  42         break;
  43     case PKCS7_OP_GET_DETACHED_SIGNATURE:
  44         if (nid == NID_pkcs7_signed) {
  45             if (p7->d.sign == NULL || p7->d.sign->contents->d.ptr == NULL)
  46                 ret = 1;
  47             else
  48                 ret = 0;
  49
  50             p7->detached = ret;
  51         } else {
  52             ERR_raise(ERR_LIB_PKCS7,
  53                       PKCS7_R_OPERATION_NOT_SUPPORTED_ON_THIS_TYPE);
  54             ret = 0;
  55         }
  56
  57         break;
  58     default:
  59         ERR_raise(ERR_LIB_PKCS7, PKCS7_R_UNKNOWN_OPERATION);
  60         ret = 0;
  61     }
  62     return ret;
  63 }
  64
  65 int PKCS7_content_new(PKCS7 *p7, int type)
  66 {
  67     PKCS7 *ret = NULL;
  68
  69     if ((ret = PKCS7_new()) == NULL)
  70         goto err;
  71     if (!PKCS7_set_type(ret, type))
  72         goto err;
  73     if (!PKCS7_set_content(p7, ret))
  74         goto err;
  75
  76     return 1;
  77  err:
  78     PKCS7_free(ret);
  79     return 0;
  80 }
  81
  82 int PKCS7_set_content(PKCS7 *p7, PKCS7 *p7_data)
  83 {
  84     int i;
  85
  86     i = OBJ_obj2nid(p7->type);
  87     switch (i) {
  88     case NID_pkcs7_signed:
  89         PKCS7_free(p7->d.sign->contents);
  90         p7->d.sign->contents = p7_data;
  91         break;
  92     case NID_pkcs7_digest:
  93         PKCS7_free(p7->d.digest->contents);
  94         p7->d.digest->contents = p7_data;
  95         break;
  96     case NID_pkcs7_data:
  97     case NID_pkcs7_enveloped:
  98     case NID_pkcs7_signedAndEnveloped:
  99     case NID_pkcs7_encrypted:
 100     default:
 101         ERR_raise(ERR_LIB_PKCS7, PKCS7_R_UNSUPPORTED_CONTENT_TYPE);
 102         goto err;
 103     }
 104     return 1;
 105  err:
 106     return 0;
 107 }
 108
 109 int PKCS7_set_type(PKCS7 *p7, int type)
 110 {
 111     ASN1_OBJECT *obj;
 112
 113     /*
 114      * PKCS7_content_free(p7);
 115      */
 116     obj = OBJ_nid2obj(type);    /* will not fail */
 117
 118     switch (type) {
 119     case NID_pkcs7_signed:
 120         p7->type = obj;
 121         if ((p7->d.sign = PKCS7_SIGNED_new()) == NULL)
 122             goto err;
 123         if (!ASN1_INTEGER_set(p7->d.sign->version, 1)) {
 124             PKCS7_SIGNED_free(p7->d.sign);
 125             p7->d.sign = NULL;
 126             goto err;
 127         }
 128         break;
 129     case NID_pkcs7_data:
 130         p7->type = obj;
 131         if ((p7->d.data = ASN1_OCTET_STRING_new()) == NULL)
 132             goto err;
 133         break;
 134     case NID_pkcs7_signedAndEnveloped:
 135         p7->type = obj;
 136         if ((p7->d.signed_and_enveloped = PKCS7_SIGN_ENVELOPE_new())
 137             == NULL)
 138             goto err;
 139         if (!ASN1_INTEGER_set(p7->d.signed_and_enveloped->version, 1))
 140             goto err;
 141         p7->d.signed_and_enveloped->enc_data->content_type
 142             = OBJ_nid2obj(NID_pkcs7_data);
 143         break;
 144     case NID_pkcs7_enveloped:
 145         p7->type = obj;
 146         if ((p7->d.enveloped = PKCS7_ENVELOPE_new())
 147             == NULL)
 148             goto err;
 149         if (!ASN1_INTEGER_set(p7->d.enveloped->version, 0))
 150             goto err;
 151         p7->d.enveloped->enc_data->content_type = OBJ_nid2obj(NID_pkcs7_data);
 152         break;
 153     case NID_pkcs7_encrypted:
 154         p7->type = obj;
 155         if ((p7->d.encrypted = PKCS7_ENCRYPT_new())
 156             == NULL)
 157             goto err;
 158         if (!ASN1_INTEGER_set(p7->d.encrypted->version, 0))
 159             goto err;
 160         p7->d.encrypted->enc_data->content_type = OBJ_nid2obj(NID_pkcs7_data);
 161         break;
 162
 163     case NID_pkcs7_digest:
 164         p7->type = obj;
 165         if ((p7->d.digest = PKCS7_DIGEST_new())
 166             == NULL)
 167             goto err;
 168         if (!ASN1_INTEGER_set(p7->d.digest->version, 0))
 169             goto err;
 170         break;
 171     default:
 172         ERR_raise(ERR_LIB_PKCS7, PKCS7_R_UNSUPPORTED_CONTENT_TYPE);
 173         goto err;
 174     }
 175     return 1;
 176  err:
 177     return 0;
 178 }
 179
 180 int PKCS7_set0_type_other(PKCS7 *p7, int type, ASN1_TYPE *other)
 181 {
 182     p7->type = OBJ_nid2obj(type);
 183     p7->d.other = other;
 184     return 1;
 185 }
 186
 187 int PKCS7_add_signer(PKCS7 *p7, PKCS7_SIGNER_INFO *psi)
 188 {
 189     int i, j, nid;
 190     X509_ALGOR *alg;
 191     STACK_OF(PKCS7_SIGNER_INFO) *signer_sk;
 192     STACK_OF(X509_ALGOR) *md_sk;
 193
 194     i = OBJ_obj2nid(p7->type);
 195     switch (i) {
 196     case NID_pkcs7_signed:
 197         signer_sk = p7->d.sign->signer_info;
 198         md_sk = p7->d.sign->md_algs;
 199         break;
 200     case NID_pkcs7_signedAndEnveloped:
 201         signer_sk = p7->d.signed_and_enveloped->signer_info;
 202         md_sk = p7->d.signed_and_enveloped->md_algs;
 203         break;
 204     default:
 205         ERR_raise(ERR_LIB_PKCS7, PKCS7_R_WRONG_CONTENT_TYPE);
 206         return 0;
 207     }
 208
 209     nid = OBJ_obj2nid(psi->digest_alg->algorithm);
 210
 211     /* If the digest is not currently listed, add it */
 212     j = 0;
 213     for (i = 0; i < sk_X509_ALGOR_num(md_sk); i++) {
 214         alg = sk_X509_ALGOR_value(md_sk, i);
 215         if (OBJ_obj2nid(alg->algorithm) == nid) {
 216             j = 1;
 217             break;
 218         }
 219     }
 220     if (!j) {                   /* we need to add another algorithm */
 221         if ((alg = X509_ALGOR_new()) == NULL
 222             || (alg->parameter = ASN1_TYPE_new()) == NULL) {
 223             X509_ALGOR_free(alg);
 224             ERR_raise(ERR_LIB_PKCS7, ERR_R_MALLOC_FAILURE);
 225             return 0;
 226         }
 227         alg->algorithm = OBJ_nid2obj(nid);
 228         alg->parameter->type = V_ASN1_NULL;
 229         if (!sk_X509_ALGOR_push(md_sk, alg)) {
 230             X509_ALGOR_free(alg);
 231             return 0;
 232         }
 233     }
 234
 235     psi->ctx = pkcs7_get0_ctx(p7);
 236     if (!sk_PKCS7_SIGNER_INFO_push(signer_sk, psi))
 237         return 0;
 238     return 1;
 239 }
 240
 241 int PKCS7_add_certificate(PKCS7 *p7, X509 *x509)
 242 {
 243     int i;
 244     STACK_OF(X509) **sk;
 245
 246     i = OBJ_obj2nid(p7->type);
 247     switch (i) {
 248     case NID_pkcs7_signed:
 249         sk = &(p7->d.sign->cert);
 250         break;
 251     case NID_pkcs7_signedAndEnveloped:
 252         sk = &(p7->d.signed_and_enveloped->cert);
 253         break;
 254     default:
 255         ERR_raise(ERR_LIB_PKCS7, PKCS7_R_WRONG_CONTENT_TYPE);
 256         return 0;
 257     }
 258
 259     return X509_add_cert_new(sk, x509, X509_ADD_FLAG_UP_REF);
 260 }
 261
 262 int PKCS7_add_crl(PKCS7 *p7, X509_CRL *crl)
 263 {
 264     int i;
 265     STACK_OF(X509_CRL) **sk;
 266
 267     i = OBJ_obj2nid(p7->type);
 268     switch (i) {
 269     case NID_pkcs7_signed:
 270         sk = &(p7->d.sign->crl);
 271         break;
 272     case NID_pkcs7_signedAndEnveloped:
 273         sk = &(p7->d.signed_and_enveloped->crl);
 274         break;
 275     default:
 276         ERR_raise(ERR_LIB_PKCS7, PKCS7_R_WRONG_CONTENT_TYPE);
 277         return 0;
 278     }
 279
 280     if (*sk == NULL)
 281         *sk = sk_X509_CRL_new_null();
 282     if (*sk == NULL) {
 283         ERR_raise(ERR_LIB_PKCS7, ERR_R_MALLOC_FAILURE);
 284         return 0;
 285     }
 286
 287     X509_CRL_up_ref(crl);
 288     if (!sk_X509_CRL_push(*sk, crl)) {
 289         X509_CRL_free(crl);
 290         return 0;
 291     }
 292     return 1;
 293 }
 294
 295 int PKCS7_SIGNER_INFO_set(PKCS7_SIGNER_INFO *p7i, X509 *x509, EVP_PKEY *pkey,
 296                           const EVP_MD *dgst)
 297 {
 298     int ret;
 299
 300     /* We now need to add another PKCS7_SIGNER_INFO entry */
 301     if (!ASN1_INTEGER_set(p7i->version, 1))
 302         goto err;
 303     if (!X509_NAME_set(&p7i->issuer_and_serial->issuer,
 304                        X509_get_issuer_name(x509)))
 305         goto err;
 306
 307     /*
 308      * because ASN1_INTEGER_set is used to set a 'long' we will do things the
 309      * ugly way.
 310      */
 311     ASN1_INTEGER_free(p7i->issuer_and_serial->serial);
 312     if (!(p7i->issuer_and_serial->serial =
 313           ASN1_INTEGER_dup(X509_get0_serialNumber(x509))))
 314         goto err;
 315
 316     /*
 317      * TODO(3.0) Adapt for provider-native keys
 318      * Meanwhile, we downgrade the key.
 319      * #legacy
 320      */
 321     if (!evp_pkey_downgrade(pkey)) {
 322         ERR_raise(ERR_LIB_PKCS7,
 323                   PKCS7_R_SIGNING_NOT_SUPPORTED_FOR_THIS_KEY_TYPE);
 324         goto err;
 325     }
 326
 327     /* lets keep the pkey around for a while */
 328     EVP_PKEY_up_ref(pkey);
 329     p7i->pkey = pkey;
 330
 331     /* Set the algorithms */
 332
 333     X509_ALGOR_set0(p7i->digest_alg, OBJ_nid2obj(EVP_MD_type(dgst)),
 334                     V_ASN1_NULL, NULL);
 335
 336     if (pkey->ameth && pkey->ameth->pkey_ctrl) {
 337         ret = pkey->ameth->pkey_ctrl(pkey, ASN1_PKEY_CTRL_PKCS7_SIGN, 0, p7i);
 338         if (ret > 0)
 339             return 1;
 340         if (ret != -2) {
 341             ERR_raise(ERR_LIB_PKCS7, PKCS7_R_SIGNING_CTRL_FAILURE);
 342             return 0;
 343         }
 344     }
 345     ERR_raise(ERR_LIB_PKCS7, PKCS7_R_SIGNING_NOT_SUPPORTED_FOR_THIS_KEY_TYPE);
 346  err:
 347     return 0;
 348 }
 349
 350 PKCS7_SIGNER_INFO *PKCS7_add_signature(PKCS7 *p7, X509 *x509, EVP_PKEY *pkey,
 351                                        const EVP_MD *dgst)
 352 {
 353     PKCS7_SIGNER_INFO *si = NULL;
 354
 355     if (dgst == NULL) {
 356         int def_nid;
 357         if (EVP_PKEY_get_default_digest_nid(pkey, &def_nid) <= 0)
 358             goto err;
 359         dgst = EVP_get_digestbynid(def_nid);
 360         if (dgst == NULL) {
 361             ERR_raise(ERR_LIB_PKCS7, PKCS7_R_NO_DEFAULT_DIGEST);
 362             goto err;
 363         }
 364     }
 365
 366     if ((si = PKCS7_SIGNER_INFO_new()) == NULL)
 367         goto err;
 368     if (!PKCS7_SIGNER_INFO_set(si, x509, pkey, dgst))
 369         goto err;
 370     if (!PKCS7_add_signer(p7, si))
 371         goto err;
 372     return si;
 373  err:
 374     PKCS7_SIGNER_INFO_free(si);
 375     return NULL;
 376 }
 377
 378 static STACK_OF(X509) *pkcs7_get_signer_certs(const PKCS7 *p7)
 379 {
 380     if (PKCS7_type_is_signed(p7))
 381         return p7->d.sign->cert;
 382     if (PKCS7_type_is_signedAndEnveloped(p7))
 383         return p7->d.signed_and_enveloped->cert;
 384     return NULL;
 385 }
 386
 387 static STACK_OF(PKCS7_RECIP_INFO) *pkcs7_get_recipient_info(const PKCS7 *p7)
 388 {
 389     if (PKCS7_type_is_signedAndEnveloped(p7))
 390         return p7->d.signed_and_enveloped->recipientinfo;
 391     if (PKCS7_type_is_enveloped(p7))
 392         return p7->d.enveloped->recipientinfo;
 393     return NULL;
 394 }
 395
 396 /*
 397  * Set up the library context into any loaded structure that needs it.
 398  * i.e loaded X509 objects.
 399  */
 400 void pkcs7_resolve_libctx(PKCS7 *p7)
 401 {
 402     int i;
 403     const PKCS7_CTX *ctx = pkcs7_get0_ctx(p7);
 404     STACK_OF(PKCS7_RECIP_INFO) *rinfos = pkcs7_get_recipient_info(p7);
 405     STACK_OF(PKCS7_SIGNER_INFO) *sinfos = PKCS7_get_signer_info(p7);
 406     STACK_OF(X509) *certs = pkcs7_get_signer_certs(p7);
 407
 408     if (ctx == NULL)
 409         return;
 410
 411     for (i = 0; i < sk_X509_num(certs); i++)
 412         x509_set0_libctx(sk_X509_value(certs, i), ctx->libctx, ctx->propq);
 413
 414     for (i = 0; i < sk_PKCS7_RECIP_INFO_num(rinfos); i++) {
 415         PKCS7_RECIP_INFO *ri = sk_PKCS7_RECIP_INFO_value(rinfos, i);
 416
 417         x509_set0_libctx(ri->cert, ctx->libctx, ctx->propq);
 418     }
 419
 420     for (i = 0; i < sk_PKCS7_SIGNER_INFO_num(sinfos); i++) {
 421         PKCS7_SIGNER_INFO *si = sk_PKCS7_SIGNER_INFO_value(sinfos, i);
 422
 423         if (si != NULL)
 424             si->ctx = ctx;
 425     }
 426 }
 427
 428 const PKCS7_CTX *pkcs7_get0_ctx(const PKCS7 *p7)
 429 {
 430     return p7 != NULL ? &p7->ctx : NULL;
 431 }
 432
 433 OSSL_LIB_CTX *pkcs7_ctx_get0_libctx(const PKCS7_CTX *ctx)
 434 {
 435     return ctx != NULL ? ctx->libctx : NULL;
 436 }
 437 const char *pkcs7_ctx_get0_propq(const PKCS7_CTX *ctx)
 438 {
 439     return ctx != NULL ? ctx->propq : NULL;
 440 }
 441
 442 int PKCS7_set_digest(PKCS7 *p7, const EVP_MD *md)
 443 {
 444     if (PKCS7_type_is_digest(p7)) {
 445         if ((p7->d.digest->md->parameter = ASN1_TYPE_new()) == NULL) {
 446             ERR_raise(ERR_LIB_PKCS7, ERR_R_MALLOC_FAILURE);
 447             return 0;
 448         }
 449         p7->d.digest->md->parameter->type = V_ASN1_NULL;
 450         p7->d.digest->md->algorithm = OBJ_nid2obj(EVP_MD_nid(md));
 451         return 1;
 452     }
 453
 454     ERR_raise(ERR_LIB_PKCS7, PKCS7_R_WRONG_CONTENT_TYPE);
 455     return 1;
 456 }
 457
 458 STACK_OF(PKCS7_SIGNER_INFO) *PKCS7_get_signer_info(PKCS7 *p7)
 459 {
 460     if (p7 == NULL || p7->d.ptr == NULL)
 461         return NULL;
 462     if (PKCS7_type_is_signed(p7)) {
 463         return p7->d.sign->signer_info;
 464     } else if (PKCS7_type_is_signedAndEnveloped(p7)) {
 465         return p7->d.signed_and_enveloped->signer_info;
 466     } else
 467         return NULL;
 468 }
 469
 470 void PKCS7_SIGNER_INFO_get0_algs(PKCS7_SIGNER_INFO *si, EVP_PKEY **pk,
 471                                  X509_ALGOR **pdig, X509_ALGOR **psig)
 472 {
 473     if (pk)
 474         *pk = si->pkey;
 475     if (pdig)
 476         *pdig = si->digest_alg;
 477     if (psig)
 478         *psig = si->digest_enc_alg;
 479 }
 480
 481 void PKCS7_RECIP_INFO_get0_alg(PKCS7_RECIP_INFO *ri, X509_ALGOR **penc)
 482 {
 483     if (penc)
 484         *penc = ri->key_enc_algor;
 485 }
 486
 487 PKCS7_RECIP_INFO *PKCS7_add_recipient(PKCS7 *p7, X509 *x509)
 488 {
 489     PKCS7_RECIP_INFO *ri;
 490
 491     if ((ri = PKCS7_RECIP_INFO_new()) == NULL)
 492         goto err;
 493     if (!PKCS7_RECIP_INFO_set(ri, x509))
 494         goto err;
 495     if (!PKCS7_add_recipient_info(p7, ri))
 496         goto err;
 497     ri->ctx = pkcs7_get0_ctx(p7);
 498     return ri;
 499  err:
 500     PKCS7_RECIP_INFO_free(ri);
 501     return NULL;
 502 }
 503
 504 int PKCS7_add_recipient_info(PKCS7 *p7, PKCS7_RECIP_INFO *ri)
 505 {
 506     int i;
 507     STACK_OF(PKCS7_RECIP_INFO) *sk;
 508
 509     i = OBJ_obj2nid(p7->type);
 510     switch (i) {
 511     case NID_pkcs7_signedAndEnveloped:
 512         sk = p7->d.signed_and_enveloped->recipientinfo;
 513         break;
 514     case NID_pkcs7_enveloped:
 515         sk = p7->d.enveloped->recipientinfo;
 516         break;
 517     default:
 518         ERR_raise(ERR_LIB_PKCS7, PKCS7_R_WRONG_CONTENT_TYPE);
 519         return 0;
 520     }
 521
 522     if (!sk_PKCS7_RECIP_INFO_push(sk, ri))
 523         return 0;
 524     return 1;
 525 }
 526
 527 int PKCS7_RECIP_INFO_set(PKCS7_RECIP_INFO *p7i, X509 *x509)
 528 {
 529     int ret;
 530     EVP_PKEY *pkey = NULL;
 531     if (!ASN1_INTEGER_set(p7i->version, 0))
 532         return 0;
 533     if (!X509_NAME_set(&p7i->issuer_and_serial->issuer,
 534                        X509_get_issuer_name(x509)))
 535         return 0;
 536
 537     ASN1_INTEGER_free(p7i->issuer_and_serial->serial);
 538     if (!(p7i->issuer_and_serial->serial =
 539           ASN1_INTEGER_dup(X509_get0_serialNumber(x509))))
 540         return 0;
 541
 542     pkey = X509_get0_pubkey(x509);
 543
 544     if (!pkey || !pkey->ameth || !pkey->ameth->pkey_ctrl) {
 545         ERR_raise(ERR_LIB_PKCS7,
 546                   PKCS7_R_ENCRYPTION_NOT_SUPPORTED_FOR_THIS_KEY_TYPE);
 547         goto err;
 548     }
 549
 550     ret = pkey->ameth->pkey_ctrl(pkey, ASN1_PKEY_CTRL_PKCS7_ENCRYPT, 0, p7i);
 551     if (ret == -2) {
 552         ERR_raise(ERR_LIB_PKCS7,
 553                   PKCS7_R_ENCRYPTION_NOT_SUPPORTED_FOR_THIS_KEY_TYPE);
 554         goto err;
 555     }
 556     if (ret <= 0) {
 557         ERR_raise(ERR_LIB_PKCS7, PKCS7_R_ENCRYPTION_CTRL_FAILURE);
 558         goto err;
 559     }
 560
 561     X509_up_ref(x509);
 562     p7i->cert = x509;
 563
 564     return 1;
 565
 566  err:
 567     return 0;
 568 }
 569
 570 X509 *PKCS7_cert_from_signer_info(PKCS7 *p7, PKCS7_SIGNER_INFO *si)
 571 {
 572     if (PKCS7_type_is_signed(p7))
 573         return (X509_find_by_issuer_and_serial(p7->d.sign->cert,
 574                                                si->issuer_and_serial->issuer,
 575                                                si->
 576                                                issuer_and_serial->serial));
 577     else
 578         return NULL;
 579 }
 580
 581 int PKCS7_set_cipher(PKCS7 *p7, const EVP_CIPHER *cipher)
 582 {
 583     int i;
 584     PKCS7_ENC_CONTENT *ec;
 585
 586     i = OBJ_obj2nid(p7->type);
 587     switch (i) {
 588     case NID_pkcs7_signedAndEnveloped:
 589         ec = p7->d.signed_and_enveloped->enc_data;
 590         break;
 591     case NID_pkcs7_enveloped:
 592         ec = p7->d.enveloped->enc_data;
 593         break;
 594     default:
 595         ERR_raise(ERR_LIB_PKCS7, PKCS7_R_WRONG_CONTENT_TYPE);
 596         return 0;
 597     }
 598
 599     /* Check cipher OID exists and has data in it */
 600     i = EVP_CIPHER_type(cipher);
 601     if (i == NID_undef) {
 602         ERR_raise(ERR_LIB_PKCS7, PKCS7_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER);
 603         return 0;
 604     }
 605
 606     ec->cipher = cipher;
 607     ec->ctx = pkcs7_get0_ctx(p7);
 608     return 1;
 609 }
 610
 611 /* unfortunately cannot constify BIO_new_NDEF() due to this and CMS_stream() */
 612 int PKCS7_stream(unsigned char ***boundary, PKCS7 *p7)
 613 {
 614     ASN1_OCTET_STRING *os = NULL;
 615
 616     switch (OBJ_obj2nid(p7->type)) {
 617     case NID_pkcs7_data:
 618         os = p7->d.data;
 619         break;
 620
 621     case NID_pkcs7_signedAndEnveloped:
 622         os = p7->d.signed_and_enveloped->enc_data->enc_data;
 623         if (os == NULL) {
 624             os = ASN1_OCTET_STRING_new();
 625             p7->d.signed_and_enveloped->enc_data->enc_data = os;
 626         }
 627         break;
 628
 629     case NID_pkcs7_enveloped:
 630         os = p7->d.enveloped->enc_data->enc_data;
 631         if (os == NULL) {
 632             os = ASN1_OCTET_STRING_new();
 633             p7->d.enveloped->enc_data->enc_data = os;
 634         }
 635         break;
 636
 637     case NID_pkcs7_signed:
 638         os = p7->d.sign->contents->d.data;
 639         break;
 640
 641     default:
 642         os = NULL;
 643         break;
 644     }
 645
 646     if (os == NULL)
 647         return 0;
 648
 649     os->flags |= ASN1_STRING_FLAG_NDEF;
 650     *boundary = &os->data;
 651
 652     return 1;
 653 }