crypto/pkcs7/pk7_lib.c

   1 /*
   2  * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include <stdio.h>
  11 #include "internal/cryptlib.h"
  12 #include <openssl/objects.h>
  13 #include <openssl/x509.h>
  14 #include "crypto/asn1.h"
  15 #include "crypto/evp.h"
  16 #include "crypto/x509.h" /* for sk_X509_add1_cert() */
  17 #include "pk7_local.h"
  18
  19 long PKCS7_ctrl(PKCS7 *p7, int cmd, long larg, char *parg)
  20 {
  21     int nid;
  22     long ret;
  23
  24     nid = OBJ_obj2nid(p7->type);
  25
  26     switch (cmd) {
  27     /* NOTE(emilia): does not support detached digested data. */
  28     case PKCS7_OP_SET_DETACHED_SIGNATURE:
  29         if (nid == NID_pkcs7_signed) {
  30             ret = p7->detached = (int)larg;
  31             if (ret && PKCS7_type_is_data(p7->d.sign->contents)) {
  32                 ASN1_OCTET_STRING *os;
  33                 os = p7->d.sign->contents->d.data;
  34                 ASN1_OCTET_STRING_free(os);
  35                 p7->d.sign->contents->d.data = NULL;
  36             }
  37         } else {
  38             ERR_raise(ERR_LIB_PKCS7,
  39                       PKCS7_R_OPERATION_NOT_SUPPORTED_ON_THIS_TYPE);
  40             ret = 0;
  41         }
  42         break;
  43     case PKCS7_OP_GET_DETACHED_SIGNATURE:
  44         if (nid == NID_pkcs7_signed) {
  45             if (p7->d.sign == NULL || p7->d.sign->contents->d.ptr == NULL)
  46                 ret = 1;
  47             else
  48                 ret = 0;
  49
  50             p7->detached = ret;
  51         } else {
  52             ERR_raise(ERR_LIB_PKCS7,
  53                       PKCS7_R_OPERATION_NOT_SUPPORTED_ON_THIS_TYPE);
  54             ret = 0;
  55         }
  56
  57         break;
  58     default:
  59         ERR_raise(ERR_LIB_PKCS7, PKCS7_R_UNKNOWN_OPERATION);
  60         ret = 0;
  61     }
  62     return ret;
  63 }
  64
  65 int PKCS7_content_new(PKCS7 *p7, int type)
  66 {
  67     PKCS7 *ret = NULL;
  68
  69     if ((ret = PKCS7_new()) == NULL)
  70         goto err;
  71     if (!PKCS7_set_type(ret, type))
  72         goto err;
  73     if (!PKCS7_set_content(p7, ret))
  74         goto err;
  75
  76     return 1;
  77  err:
  78     PKCS7_free(ret);
  79     return 0;
  80 }
  81
  82 int PKCS7_set_content(PKCS7 *p7, PKCS7 *p7_data)
  83 {
  84     int i;
  85
  86     i = OBJ_obj2nid(p7->type);
  87     switch (i) {
  88     case NID_pkcs7_signed:
  89         PKCS7_free(p7->d.sign->contents);
  90         p7->d.sign->contents = p7_data;
  91         break;
  92     case NID_pkcs7_digest:
  93         PKCS7_free(p7->d.digest->contents);
  94         p7->d.digest->contents = p7_data;
  95         break;
  96     case NID_pkcs7_data:
  97     case NID_pkcs7_enveloped:
  98     case NID_pkcs7_signedAndEnveloped:
  99     case NID_pkcs7_encrypted:
 100     default:
 101         ERR_raise(ERR_LIB_PKCS7, PKCS7_R_UNSUPPORTED_CONTENT_TYPE);
 102         goto err;
 103     }
 104     return 1;
 105  err:
 106     return 0;
 107 }
 108
 109 int PKCS7_set_type(PKCS7 *p7, int type)
 110 {
 111     ASN1_OBJECT *obj;
 112
 113     /*
 114      * PKCS7_content_free(p7);
 115      */
 116     obj = OBJ_nid2obj(type);    /* will not fail */
 117
 118     switch (type) {
 119     case NID_pkcs7_signed:
 120         p7->type = obj;
 121         if ((p7->d.sign = PKCS7_SIGNED_new()) == NULL)
 122             goto err;
 123         if (!ASN1_INTEGER_set(p7->d.sign->version, 1)) {
 124             PKCS7_SIGNED_free(p7->d.sign);
 125             p7->d.sign = NULL;
 126             goto err;
 127         }
 128         break;
 129     case NID_pkcs7_data:
 130         p7->type = obj;
 131         if ((p7->d.data = ASN1_OCTET_STRING_new()) == NULL)
 132             goto err;
 133         break;
 134     case NID_pkcs7_signedAndEnveloped:
 135         p7->type = obj;
 136         if ((p7->d.signed_and_enveloped = PKCS7_SIGN_ENVELOPE_new())
 137             == NULL)
 138             goto err;
 139         if (!ASN1_INTEGER_set(p7->d.signed_and_enveloped->version, 1))
 140             goto err;
 141         p7->d.signed_and_enveloped->enc_data->content_type
 142             = OBJ_nid2obj(NID_pkcs7_data);
 143         break;
 144     case NID_pkcs7_enveloped:
 145         p7->type = obj;
 146         if ((p7->d.enveloped = PKCS7_ENVELOPE_new())
 147             == NULL)
 148             goto err;
 149         if (!ASN1_INTEGER_set(p7->d.enveloped->version, 0))
 150             goto err;
 151         p7->d.enveloped->enc_data->content_type = OBJ_nid2obj(NID_pkcs7_data);
 152         break;
 153     case NID_pkcs7_encrypted:
 154         p7->type = obj;
 155         if ((p7->d.encrypted = PKCS7_ENCRYPT_new())
 156             == NULL)
 157             goto err;
 158         if (!ASN1_INTEGER_set(p7->d.encrypted->version, 0))
 159             goto err;
 160         p7->d.encrypted->enc_data->content_type = OBJ_nid2obj(NID_pkcs7_data);
 161         break;
 162
 163     case NID_pkcs7_digest:
 164         p7->type = obj;
 165         if ((p7->d.digest = PKCS7_DIGEST_new())
 166             == NULL)
 167             goto err;
 168         if (!ASN1_INTEGER_set(p7->d.digest->version, 0))
 169             goto err;
 170         break;
 171     default:
 172         ERR_raise(ERR_LIB_PKCS7, PKCS7_R_UNSUPPORTED_CONTENT_TYPE);
 173         goto err;
 174     }
 175     return 1;
 176  err:
 177     return 0;
 178 }
 179
 180 int PKCS7_set0_type_other(PKCS7 *p7, int type, ASN1_TYPE *other)
 181 {
 182     p7->type = OBJ_nid2obj(type);
 183     p7->d.other = other;
 184     return 1;
 185 }
 186
 187 int PKCS7_add_signer(PKCS7 *p7, PKCS7_SIGNER_INFO *psi)
 188 {
 189     int i, j, nid;
 190     X509_ALGOR *alg;
 191     STACK_OF(PKCS7_SIGNER_INFO) *signer_sk;
 192     STACK_OF(X509_ALGOR) *md_sk;
 193
 194     i = OBJ_obj2nid(p7->type);
 195     switch (i) {
 196     case NID_pkcs7_signed:
 197         signer_sk = p7->d.sign->signer_info;
 198         md_sk = p7->d.sign->md_algs;
 199         break;
 200     case NID_pkcs7_signedAndEnveloped:
 201         signer_sk = p7->d.signed_and_enveloped->signer_info;
 202         md_sk = p7->d.signed_and_enveloped->md_algs;
 203         break;
 204     default:
 205         ERR_raise(ERR_LIB_PKCS7, PKCS7_R_WRONG_CONTENT_TYPE);
 206         return 0;
 207     }
 208
 209     nid = OBJ_obj2nid(psi->digest_alg->algorithm);
 210
 211     /* If the digest is not currently listed, add it */
 212     j = 0;
 213     for (i = 0; i < sk_X509_ALGOR_num(md_sk); i++) {
 214         alg = sk_X509_ALGOR_value(md_sk, i);
 215         if (OBJ_obj2nid(alg->algorithm) == nid) {
 216             j = 1;
 217             break;
 218         }
 219     }
 220     if (!j) {                   /* we need to add another algorithm */
 221         if ((alg = X509_ALGOR_new()) == NULL
 222             || (alg->parameter = ASN1_TYPE_new()) == NULL) {
 223             X509_ALGOR_free(alg);
 224             ERR_raise(ERR_LIB_PKCS7, ERR_R_MALLOC_FAILURE);
 225             return 0;
 226         }
 227         alg->algorithm = OBJ_nid2obj(nid);
 228         alg->parameter->type = V_ASN1_NULL;
 229         if (!sk_X509_ALGOR_push(md_sk, alg)) {
 230             X509_ALGOR_free(alg);
 231             return 0;
 232         }
 233     }
 234
 235     psi->ctx = pkcs7_get0_ctx(p7);
 236     if (!sk_PKCS7_SIGNER_INFO_push(signer_sk, psi))
 237         return 0;
 238     return 1;
 239 }
 240
 241 int PKCS7_add_certificate(PKCS7 *p7, X509 *x509)
 242 {
 243     int i;
 244     STACK_OF(X509) **sk;
 245
 246     i = OBJ_obj2nid(p7->type);
 247     switch (i) {
 248     case NID_pkcs7_signed:
 249         sk = &(p7->d.sign->cert);
 250         break;
 251     case NID_pkcs7_signedAndEnveloped:
 252         sk = &(p7->d.signed_and_enveloped->cert);
 253         break;
 254     default:
 255         ERR_raise(ERR_LIB_PKCS7, PKCS7_R_WRONG_CONTENT_TYPE);
 256         return 0;
 257     }
 258
 259     return X509_add_cert_new(sk, x509, X509_ADD_FLAG_UP_REF);
 260 }
 261
 262 int PKCS7_add_crl(PKCS7 *p7, X509_CRL *crl)
 263 {
 264     int i;
 265     STACK_OF(X509_CRL) **sk;
 266
 267     i = OBJ_obj2nid(p7->type);
 268     switch (i) {
 269     case NID_pkcs7_signed:
 270         sk = &(p7->d.sign->crl);
 271         break;
 272     case NID_pkcs7_signedAndEnveloped:
 273         sk = &(p7->d.signed_and_enveloped->crl);
 274         break;
 275     default:
 276         ERR_raise(ERR_LIB_PKCS7, PKCS7_R_WRONG_CONTENT_TYPE);
 277         return 0;
 278     }
 279
 280     if (*sk == NULL)
 281         *sk = sk_X509_CRL_new_null();
 282     if (*sk == NULL) {
 283         ERR_raise(ERR_LIB_PKCS7, ERR_R_MALLOC_FAILURE);
 284         return 0;
 285     }
 286
 287     X509_CRL_up_ref(crl);
 288     if (!sk_X509_CRL_push(*sk, crl)) {
 289         X509_CRL_free(crl);
 290         return 0;
 291     }
 292     return 1;
 293 }
 294
 295 int PKCS7_SIGNER_INFO_set(PKCS7_SIGNER_INFO *p7i, X509 *x509, EVP_PKEY *pkey,
 296                           const EVP_MD *dgst)
 297 {
 298     int ret;
 299
 300     /* We now need to add another PKCS7_SIGNER_INFO entry */
 301     if (!ASN1_INTEGER_set(p7i->version, 1))
 302         goto err;
 303     if (!X509_NAME_set(&p7i->issuer_and_serial->issuer,
 304                        X509_get_issuer_name(x509)))
 305         goto err;
 306
 307     /*
 308      * because ASN1_INTEGER_set is used to set a 'long' we will do things the
 309      * ugly way.
 310      */
 311     ASN1_INTEGER_free(p7i->issuer_and_serial->serial);
 312     if (!(p7i->issuer_and_serial->serial =
 313           ASN1_INTEGER_dup(X509_get0_serialNumber(x509))))
 314         goto err;
 315
 316     /*
 317      * TODO(3.0) Adapt for provider-native keys
 318      * Meanwhile, we downgrade the key.
 319      * #legacy
 320      */
 321     if (!evp_pkey_downgrade(pkey)) {
 322         ERR_raise(ERR_LIB_PKCS7,
 323                   PKCS7_R_SIGNING_NOT_SUPPORTED_FOR_THIS_KEY_TYPE);
 324         goto err;
 325     }
 326
 327     /* lets keep the pkey around for a while */
 328     EVP_PKEY_up_ref(pkey);
 329     p7i->pkey = pkey;
 330
 331     /* Set the algorithms */
 332
 333     X509_ALGOR_set0(p7i->digest_alg, OBJ_nid2obj(EVP_MD_type(dgst)),
 334                     V_ASN1_NULL, NULL);
 335
 336     if (pkey->ameth && pkey->ameth->pkey_ctrl) {
 337         ret = pkey->ameth->pkey_ctrl(pkey, ASN1_PKEY_CTRL_PKCS7_SIGN, 0, p7i);
 338         if (ret > 0)
 339             return 1;
 340         if (ret != -2) {
 341             ERR_raise(ERR_LIB_PKCS7, PKCS7_R_SIGNING_CTRL_FAILURE);
 342             return 0;
 343         }
 344     }
 345     ERR_raise(ERR_LIB_PKCS7, PKCS7_R_SIGNING_NOT_SUPPORTED_FOR_THIS_KEY_TYPE);
 346  err:
 347     return 0;
 348 }
 349
 350 PKCS7_SIGNER_INFO *PKCS7_add_signature(PKCS7 *p7, X509 *x509, EVP_PKEY *pkey,
 351                                        const EVP_MD *dgst)
 352 {
 353     PKCS7_SIGNER_INFO *si = NULL;
 354
 355     if (dgst == NULL) {
 356         int def_nid;
 357         if (EVP_PKEY_get_default_digest_nid(pkey, &def_nid) <= 0)
 358             goto err;
 359         dgst = EVP_get_digestbynid(def_nid);
 360         if (dgst == NULL) {
 361             ERR_raise(ERR_LIB_PKCS7, PKCS7_R_NO_DEFAULT_DIGEST);
 362             goto err;
 363         }
 364     }
 365
 366     if ((si = PKCS7_SIGNER_INFO_new()) == NULL)
 367         goto err;
 368     if (!PKCS7_SIGNER_INFO_set(si, x509, pkey, dgst))
 369         goto err;
 370     if (!PKCS7_add_signer(p7, si))
 371         goto err;
 372     return si;
 373  err:
 374     PKCS7_SIGNER_INFO_free(si);
 375     return NULL;
 376 }
 377
 378 static STACK_OF(X509) *pkcs7_get_signer_certs(const PKCS7 *p7)
 379 {
 380     if (PKCS7_type_is_signed(p7))
 381         return p7->d.sign->cert;
 382     if (PKCS7_type_is_signedAndEnveloped(p7))
 383         return p7->d.signed_and_enveloped->cert;
 384     return NULL;
 385 }
 386
 387 static STACK_OF(PKCS7_RECIP_INFO) *pkcs7_get_recipient_info(const PKCS7 *p7)
 388 {
 389     if (PKCS7_type_is_signedAndEnveloped(p7))
 390         return p7->d.signed_and_enveloped->recipientinfo;
 391     if (PKCS7_type_is_enveloped(p7))
 392         return p7->d.enveloped->recipientinfo;
 393     return NULL;
 394 }
 395
 396 /*
 397  * Set up the library context into any loaded structure that needs it.
 398  * i.e loaded X509 objects.
 399  */
 400 void pkcs7_resolve_libctx(PKCS7 *p7)
 401 {
 402     int i;
 403     const PKCS7_CTX *ctx = pkcs7_get0_ctx(p7);
 404     OSSL_LIB_CTX *libctx = pkcs7_ctx_get0_libctx(ctx);
 405     const char *propq = pkcs7_ctx_get0_propq(ctx);
 406     STACK_OF(PKCS7_RECIP_INFO) *rinfos = pkcs7_get_recipient_info(p7);
 407     STACK_OF(PKCS7_SIGNER_INFO) *sinfos = PKCS7_get_signer_info(p7);
 408     STACK_OF(X509) *certs = pkcs7_get_signer_certs(p7);
 409
 410     if (ctx == NULL)
 411         return;
 412
 413     for (i = 0; i < sk_X509_num(certs); i++)
 414         x509_set0_libctx(sk_X509_value(certs, i), libctx, propq);
 415
 416     for (i = 0; i < sk_PKCS7_RECIP_INFO_num(rinfos); i++) {
 417         PKCS7_RECIP_INFO *ri = sk_PKCS7_RECIP_INFO_value(rinfos, i);
 418
 419         x509_set0_libctx(ri->cert, libctx, propq);
 420     }
 421
 422     for (i = 0; i < sk_PKCS7_SIGNER_INFO_num(sinfos); i++) {
 423         PKCS7_SIGNER_INFO *si = sk_PKCS7_SIGNER_INFO_value(sinfos, i);
 424
 425         if (si != NULL)
 426             si->ctx = ctx;
 427     }
 428 }
 429
 430 const PKCS7_CTX *pkcs7_get0_ctx(const PKCS7 *p7)
 431 {
 432     return p7 != NULL ? &p7->ctx : NULL;
 433 }
 434
 435 OSSL_LIB_CTX *pkcs7_ctx_get0_libctx(const PKCS7_CTX *ctx)
 436 {
 437     return ctx != NULL ? ctx->libctx : NULL;
 438 }
 439 const char *pkcs7_ctx_get0_propq(const PKCS7_CTX *ctx)
 440 {
 441     return ctx != NULL ? ctx->propq : NULL;
 442 }
 443
 444 int PKCS7_set_digest(PKCS7 *p7, const EVP_MD *md)
 445 {
 446     if (PKCS7_type_is_digest(p7)) {
 447         if ((p7->d.digest->md->parameter = ASN1_TYPE_new()) == NULL) {
 448             ERR_raise(ERR_LIB_PKCS7, ERR_R_MALLOC_FAILURE);
 449             return 0;
 450         }
 451         p7->d.digest->md->parameter->type = V_ASN1_NULL;
 452         p7->d.digest->md->algorithm = OBJ_nid2obj(EVP_MD_nid(md));
 453         return 1;
 454     }
 455
 456     ERR_raise(ERR_LIB_PKCS7, PKCS7_R_WRONG_CONTENT_TYPE);
 457     return 1;
 458 }
 459
 460 STACK_OF(PKCS7_SIGNER_INFO) *PKCS7_get_signer_info(PKCS7 *p7)
 461 {
 462     if (p7 == NULL || p7->d.ptr == NULL)
 463         return NULL;
 464     if (PKCS7_type_is_signed(p7)) {
 465         return p7->d.sign->signer_info;
 466     } else if (PKCS7_type_is_signedAndEnveloped(p7)) {
 467         return p7->d.signed_and_enveloped->signer_info;
 468     } else
 469         return NULL;
 470 }
 471
 472 void PKCS7_SIGNER_INFO_get0_algs(PKCS7_SIGNER_INFO *si, EVP_PKEY **pk,
 473                                  X509_ALGOR **pdig, X509_ALGOR **psig)
 474 {
 475     if (pk)
 476         *pk = si->pkey;
 477     if (pdig)
 478         *pdig = si->digest_alg;
 479     if (psig)
 480         *psig = si->digest_enc_alg;
 481 }
 482
 483 void PKCS7_RECIP_INFO_get0_alg(PKCS7_RECIP_INFO *ri, X509_ALGOR **penc)
 484 {
 485     if (penc)
 486         *penc = ri->key_enc_algor;
 487 }
 488
 489 PKCS7_RECIP_INFO *PKCS7_add_recipient(PKCS7 *p7, X509 *x509)
 490 {
 491     PKCS7_RECIP_INFO *ri;
 492
 493     if ((ri = PKCS7_RECIP_INFO_new()) == NULL)
 494         goto err;
 495     if (!PKCS7_RECIP_INFO_set(ri, x509))
 496         goto err;
 497     if (!PKCS7_add_recipient_info(p7, ri))
 498         goto err;
 499     ri->ctx = pkcs7_get0_ctx(p7);
 500     return ri;
 501  err:
 502     PKCS7_RECIP_INFO_free(ri);
 503     return NULL;
 504 }
 505
 506 int PKCS7_add_recipient_info(PKCS7 *p7, PKCS7_RECIP_INFO *ri)
 507 {
 508     int i;
 509     STACK_OF(PKCS7_RECIP_INFO) *sk;
 510
 511     i = OBJ_obj2nid(p7->type);
 512     switch (i) {
 513     case NID_pkcs7_signedAndEnveloped:
 514         sk = p7->d.signed_and_enveloped->recipientinfo;
 515         break;
 516     case NID_pkcs7_enveloped:
 517         sk = p7->d.enveloped->recipientinfo;
 518         break;
 519     default:
 520         ERR_raise(ERR_LIB_PKCS7, PKCS7_R_WRONG_CONTENT_TYPE);
 521         return 0;
 522     }
 523
 524     if (!sk_PKCS7_RECIP_INFO_push(sk, ri))
 525         return 0;
 526     return 1;
 527 }
 528
 529 int PKCS7_RECIP_INFO_set(PKCS7_RECIP_INFO *p7i, X509 *x509)
 530 {
 531     int ret;
 532     EVP_PKEY *pkey = NULL;
 533     if (!ASN1_INTEGER_set(p7i->version, 0))
 534         return 0;
 535     if (!X509_NAME_set(&p7i->issuer_and_serial->issuer,
 536                        X509_get_issuer_name(x509)))
 537         return 0;
 538
 539     ASN1_INTEGER_free(p7i->issuer_and_serial->serial);
 540     if (!(p7i->issuer_and_serial->serial =
 541           ASN1_INTEGER_dup(X509_get0_serialNumber(x509))))
 542         return 0;
 543
 544     pkey = X509_get0_pubkey(x509);
 545
 546     if (!pkey || !pkey->ameth || !pkey->ameth->pkey_ctrl) {
 547         ERR_raise(ERR_LIB_PKCS7,
 548                   PKCS7_R_ENCRYPTION_NOT_SUPPORTED_FOR_THIS_KEY_TYPE);
 549         goto err;
 550     }
 551
 552     ret = pkey->ameth->pkey_ctrl(pkey, ASN1_PKEY_CTRL_PKCS7_ENCRYPT, 0, p7i);
 553     if (ret == -2) {
 554         ERR_raise(ERR_LIB_PKCS7,
 555                   PKCS7_R_ENCRYPTION_NOT_SUPPORTED_FOR_THIS_KEY_TYPE);
 556         goto err;
 557     }
 558     if (ret <= 0) {
 559         ERR_raise(ERR_LIB_PKCS7, PKCS7_R_ENCRYPTION_CTRL_FAILURE);
 560         goto err;
 561     }
 562
 563     X509_up_ref(x509);
 564     p7i->cert = x509;
 565
 566     return 1;
 567
 568  err:
 569     return 0;
 570 }
 571
 572 X509 *PKCS7_cert_from_signer_info(PKCS7 *p7, PKCS7_SIGNER_INFO *si)
 573 {
 574     if (PKCS7_type_is_signed(p7))
 575         return (X509_find_by_issuer_and_serial(p7->d.sign->cert,
 576                                                si->issuer_and_serial->issuer,
 577                                                si->
 578                                                issuer_and_serial->serial));
 579     else
 580         return NULL;
 581 }
 582
 583 int PKCS7_set_cipher(PKCS7 *p7, const EVP_CIPHER *cipher)
 584 {
 585     int i;
 586     PKCS7_ENC_CONTENT *ec;
 587
 588     i = OBJ_obj2nid(p7->type);
 589     switch (i) {
 590     case NID_pkcs7_signedAndEnveloped:
 591         ec = p7->d.signed_and_enveloped->enc_data;
 592         break;
 593     case NID_pkcs7_enveloped:
 594         ec = p7->d.enveloped->enc_data;
 595         break;
 596     default:
 597         ERR_raise(ERR_LIB_PKCS7, PKCS7_R_WRONG_CONTENT_TYPE);
 598         return 0;
 599     }
 600
 601     /* Check cipher OID exists and has data in it */
 602     i = EVP_CIPHER_type(cipher);
 603     if (i == NID_undef) {
 604         ERR_raise(ERR_LIB_PKCS7, PKCS7_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER);
 605         return 0;
 606     }
 607
 608     ec->cipher = cipher;
 609     ec->ctx = pkcs7_get0_ctx(p7);
 610     return 1;
 611 }
 612
 613 /* unfortunately cannot constify BIO_new_NDEF() due to this and CMS_stream() */
 614 int PKCS7_stream(unsigned char ***boundary, PKCS7 *p7)
 615 {
 616     ASN1_OCTET_STRING *os = NULL;
 617
 618     switch (OBJ_obj2nid(p7->type)) {
 619     case NID_pkcs7_data:
 620         os = p7->d.data;
 621         break;
 622
 623     case NID_pkcs7_signedAndEnveloped:
 624         os = p7->d.signed_and_enveloped->enc_data->enc_data;
 625         if (os == NULL) {
 626             os = ASN1_OCTET_STRING_new();
 627             p7->d.signed_and_enveloped->enc_data->enc_data = os;
 628         }
 629         break;
 630
 631     case NID_pkcs7_enveloped:
 632         os = p7->d.enveloped->enc_data->enc_data;
 633         if (os == NULL) {
 634             os = ASN1_OCTET_STRING_new();
 635             p7->d.enveloped->enc_data->enc_data = os;
 636         }
 637         break;
 638
 639     case NID_pkcs7_signed:
 640         os = p7->d.sign->contents->d.data;
 641         break;
 642
 643     default:
 644         os = NULL;
 645         break;
 646     }
 647
 648     if (os == NULL)
 649         return 0;
 650
 651     os->flags |= ASN1_STRING_FLAG_NDEF;
 652     *boundary = &os->data;
 653
 654     return 1;
 655 }