]> git.ipfire.org Git - thirdparty/openssl.git/blame - apps/cms.c
projects / thirdparty / openssl.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Fix safestack issues in cms.h
[thirdparty/openssl.git] / apps / cms.c
CommitLineData
0f113f3e 1/*
33388b44 2 * Copyright 2008-2020 The OpenSSL Project Authors. All Rights Reserved.
8931b30d 3 *
dffa7520 4 * Licensed under the Apache License 2.0 (the "License"). You may not use
846e33c7
RS		 5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8931b30d
DSH		 8 */
9
10/* CMS utility function */
11
12#include <stdio.h>
13#include <string.h>
14#include "apps.h"
dab2cd68 15#include "progs.h"
8931b30d
DSH		 16
17#ifndef OPENSSL_NO_CMS
18
0f113f3e
MC		 19# include <openssl/crypto.h>
20# include <openssl/pem.h>
21# include <openssl/err.h>
22# include <openssl/x509_vfy.h>
23# include <openssl/x509v3.h>
24# include <openssl/cms.h>
8931b30d 25
8931b30d 26static int save_certs(char *signerfile, STACK_OF(X509) *signers);
7f50d9a4 27static int cms_cb(int ok, X509_STORE_CTX *ctx);
ecf3a1fb 28static void receipt_request_print(CMS_ContentInfo *cms);
c1669f41
SL		 29static CMS_ReceiptRequest *make_receipt_request(
30 STACK_OF(OPENSSL_STRING) *rr_to, int rr_allorfirst,
31 STACK_OF(OPENSSL_STRING) *rr_from, OPENSSL_CTX *libctx, const char *propq);
02498cc8 32static int cms_set_pkey_param(EVP_PKEY_CTX *pctx,
0f113f3e
MC		 33 STACK_OF(OPENSSL_STRING) *param);
34
35# define SMIME_OP 0x10
36# define SMIME_IP 0x20
37# define SMIME_SIGNERS 0x40
38# define SMIME_ENCRYPT (1 | SMIME_OP)
39# define SMIME_DECRYPT (2 | SMIME_IP)
40# define SMIME_SIGN (3 | SMIME_OP | SMIME_SIGNERS)
41# define SMIME_VERIFY (4 | SMIME_IP)
42# define SMIME_CMSOUT (5 | SMIME_IP | SMIME_OP)
43# define SMIME_RESIGN (6 | SMIME_IP | SMIME_OP | SMIME_SIGNERS)
44# define SMIME_DATAOUT (7 | SMIME_IP)
45# define SMIME_DATA_CREATE (8 | SMIME_OP)
46# define SMIME_DIGEST_VERIFY (9 | SMIME_IP)
47# define SMIME_DIGEST_CREATE (10 | SMIME_OP)
48# define SMIME_UNCOMPRESS (11 | SMIME_IP)
49# define SMIME_COMPRESS (12 | SMIME_OP)
50# define SMIME_ENCRYPTED_DECRYPT (13 | SMIME_IP)
51# define SMIME_ENCRYPTED_ENCRYPT (14 | SMIME_OP)
52# define SMIME_SIGN_RECEIPT (15 | SMIME_IP | SMIME_OP)
53# define SMIME_VERIFY_RECEIPT (16 | SMIME_IP)
8931b30d 54
df2ee0e2 55static int verify_err = 0;
db50661f 56
02498cc8
DSH		 57typedef struct cms_key_param_st cms_key_param;
58
0f113f3e
MC		 59struct cms_key_param_st {
60 int idx;
61 STACK_OF(OPENSSL_STRING) *param;
62 cms_key_param *next;
63};
02498cc8 64
7e1b7485
RS		 65typedef enum OPTION_choice {
66 OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
67 OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_ENCRYPT,
e85d19c6 68 OPT_DECRYPT, OPT_SIGN, OPT_CADES, OPT_SIGN_RECEIPT, OPT_RESIGN,
7e1b7485
RS		 69 OPT_VERIFY, OPT_VERIFY_RETCODE, OPT_VERIFY_RECEIPT,
70 OPT_CMSOUT, OPT_DATA_OUT, OPT_DATA_CREATE, OPT_DIGEST_VERIFY,
71 OPT_DIGEST_CREATE, OPT_COMPRESS, OPT_UNCOMPRESS,
72 OPT_ED_DECRYPT, OPT_ED_ENCRYPT, OPT_DEBUG_DECRYPT, OPT_TEXT,
73 OPT_ASCIICRLF, OPT_NOINTERN, OPT_NOVERIFY, OPT_NOCERTS,
74 OPT_NOATTR, OPT_NODETACH, OPT_NOSMIMECAP, OPT_BINARY, OPT_KEYID,
75 OPT_NOSIGS, OPT_NO_CONTENT_VERIFY, OPT_NO_ATTR_VERIFY, OPT_INDEF,
28aef3d9 76 OPT_NOINDEF, OPT_CRLFEOL, OPT_NOOUT, OPT_RR_PRINT,
7e1b7485 77 OPT_RR_ALL, OPT_RR_FIRST, OPT_RCTFORM, OPT_CERTFILE, OPT_CAFILE,
fd3397fc 78 OPT_CAPATH, OPT_CASTORE, OPT_NOCAPATH, OPT_NOCAFILE, OPT_NOCASTORE,
6ec351f4 79 OPT_CONTENT, OPT_PRINT, OPT_NAMEOPT,
2b6bcb70 80 OPT_SECRETKEY, OPT_SECRETKEYID, OPT_PWRI_PASSWORD, OPT_ECONTENT_TYPE,
3ee1eac2 81 OPT_PASSIN, OPT_TO, OPT_FROM, OPT_SUBJECT, OPT_SIGNER, OPT_RECIP,
7e1b7485
RS		 82 OPT_CERTSOUT, OPT_MD, OPT_INKEY, OPT_KEYFORM, OPT_KEYOPT, OPT_RR_FROM,
83 OPT_RR_TO, OPT_AES128_WRAP, OPT_AES192_WRAP, OPT_AES256_WRAP,
71434aed 84 OPT_3DES_WRAP, OPT_WRAP, OPT_ENGINE,
3ee1eac2 85 OPT_R_ENUM,
c1669f41 86 OPT_PROV_ENUM, OPT_CONFIG,
7e1b7485 87 OPT_V_ENUM,
71434aed
DB		 88 OPT_CIPHER,
89 OPT_ORIGINATOR
7e1b7485
RS		 90} OPTION_CHOICE;
91
44c83ebd 92const OPTIONS cms_options[] = {
92de469f 93 {OPT_HELP_STR, 1, '-', "Usage: %s [options] [cert...]\n"},
5388f986
RS		 94
95 OPT_SECTION("General"),
7e1b7485 96 {"help", OPT_HELP, '-', "Display this summary"},
f47e5647
DSH		 97 {"inform", OPT_INFORM, 'c', "Input format SMIME (default), PEM or DER"},
98 {"outform", OPT_OUTFORM, 'c',
7e1b7485
RS		 99 "Output format SMIME (default), PEM or DER"},
100 {"in", OPT_IN, '<', "Input file"},
101 {"out", OPT_OUT, '>', "Output file"},
5388f986
RS		 102 {"debug_decrypt", OPT_DEBUG_DECRYPT, '-',
103 "Disable MMA protection and return an error if no recipient found"
104 " (see documentation)"},
105 {"stream", OPT_INDEF, '-', "Enable CMS streaming"},
106 {"indef", OPT_INDEF, '-', "Same as -stream"},
107 {"noindef", OPT_NOINDEF, '-', "Disable CMS streaming"},
108 {"crlfeol", OPT_CRLFEOL, '-', "Use CRLF as EOL termination instead of CR only" },
109 {"CAfile", OPT_CAFILE, '<', "Trusted certificates file"},
110 {"CApath", OPT_CAPATH, '/', "trusted certificates directory"},
111 {"CAstore", OPT_CASTORE, ':', "trusted certificates store URI"},
112 {"no-CAfile", OPT_NOCAFILE, '-',
113 "Do not load the default certificates file"},
114 {"no-CApath", OPT_NOCAPATH, '-',
115 "Do not load certificates from the default certificates directory"},
116 {"no-CAstore", OPT_NOCASTORE, '-',
117 "Do not load certificates from the default certificates store"},
118# ifndef OPENSSL_NO_ENGINE
119 {"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"},
120# endif
c1669f41 121 OPT_CONFIG_OPTION,
5388f986
RS		 122
123 OPT_SECTION("Action"),
7e1b7485
RS		 124 {"encrypt", OPT_ENCRYPT, '-', "Encrypt message"},
125 {"decrypt", OPT_DECRYPT, '-', "Decrypt encrypted message"},
126 {"sign", OPT_SIGN, '-', "Sign message"},
16e1b281 127 {"sign_receipt", OPT_SIGN_RECEIPT, '-', "Generate a signed receipt for the message"},
12d56b29 128 {"resign", OPT_RESIGN, '-', "Resign a signed message"},
e85d19c6 129 {"cades", OPT_CADES, '-', "Include signer certificate digest"},
7e1b7485 130 {"verify", OPT_VERIFY, '-', "Verify signed message"},
38546024
RS		 131 {"verify_retcode", OPT_VERIFY_RETCODE, '-',
132 "Exit non-zero on verification failure"},
133 {"verify_receipt", OPT_VERIFY_RECEIPT, '<',
134 "Verify receipts; exit if receipt signatures do not verify"},
38546024
RS		 135 {"digest_verify", OPT_DIGEST_VERIFY, '-',
136 "Verify a CMS \"DigestedData\" object and output it"},
137 {"digest_create", OPT_DIGEST_CREATE, '-',
138 "Create a CMS \"DigestedData\" object"},
139 {"compress", OPT_COMPRESS, '-', "Create a CMS \"CompressedData\" object"},
5388f986
RS		 140 {"uncompress", OPT_UNCOMPRESS, '-',
141 "Uncompress a CMS \"CompressedData\" object"},
38546024
RS		 142 {"EncryptedData_decrypt", OPT_ED_DECRYPT, '-',
143 "Decrypt CMS \"EncryptedData\" object using symmetric key"},
144 {"EncryptedData_encrypt", OPT_ED_ENCRYPT, '-',
145 "Create CMS \"EncryptedData\" object using symmetric key"},
5388f986
RS		 146 {"data_out", OPT_DATA_OUT, '-', "Copy CMS \"Data\" object to output"},
147 {"data_create", OPT_DATA_CREATE, '-', "Create a CMS \"Data\" object"},
148 {"cmsout", OPT_CMSOUT, '-', "Output CMS structure"},
149 {"no_content_verify", OPT_NO_CONTENT_VERIFY, '-',
150 "Do not verify signed content signatures"},
151 {"no_attr_verify", OPT_NO_ATTR_VERIFY, '-',
152 "Do not verify signed attribute signatures"},
153 {"nointern", OPT_NOINTERN, '-',
154 "Don't search certificates in message for signer"},
155 {"noverify", OPT_NOVERIFY, '-', "Don't verify signers certificate"},
156
157 OPT_SECTION("Formatting"),
7e1b7485 158 {"text", OPT_TEXT, '-', "Include or delete text MIME headers"},
38546024
RS		 159 {"asciicrlf", OPT_ASCIICRLF, '-',
160 "Perform CRLF canonicalisation when signing"},
7e1b7485 161 {"nodetach", OPT_NODETACH, '-', "Use opaque signing"},
12d56b29 162 {"nosmimecap", OPT_NOSMIMECAP, '-', "Omit the SMIMECapabilities attribute"},
5388f986 163 {"noattr", OPT_NOATTR, '-', "Don't include any signed attributes"},
7e1b7485
RS		 164 {"binary", OPT_BINARY, '-', "Don't translate message to text"},
165 {"keyid", OPT_KEYID, '-', "Use subject key identifier"},
166 {"nosigs", OPT_NOSIGS, '-', "Don't verify message signature"},
5388f986
RS		 167 {"nocerts", OPT_NOCERTS, '-',
168 "Don't include signers certificate when signing"},
169 {"noout", OPT_NOOUT, '-',
170 "For the -cmsout operation do not output the parsed CMS structure"},
12d56b29 171 {"receipt_request_print", OPT_RR_PRINT, '-', "Print CMS Receipt Request" },
38546024
RS		 172 {"receipt_request_all", OPT_RR_ALL, '-',
173 "When signing, create a receipt request for all recipients"},
174 {"receipt_request_first", OPT_RR_FIRST, '-',
175 "When signing, create a receipt request for first recipient"},
12d56b29 176 {"rctform", OPT_RCTFORM, 'F', "Receipt file format"},
7e1b7485 177 {"certfile", OPT_CERTFILE, '<', "Other certificates file"},
7e1b7485
RS		 178 {"content", OPT_CONTENT, '<',
179 "Supply or override content for detached signature"},
609b0852 180 {"print", OPT_PRINT, '-',
12d56b29 181 "For the -cmsout operation print out all fields of the CMS structure"},
6ec351f4
DB		 182 {"nameopt", OPT_NAMEOPT, 's',
183 "For the -print option specifies various strings printing options"},
5388f986
RS		 184 {"certsout", OPT_CERTSOUT, '>', "Certificate output file"},
185
186 OPT_SECTION("Keying"),
38546024
RS		 187 {"secretkey", OPT_SECRETKEY, 's',
188 "Use specified hex-encoded key to decrypt/encrypt recipients or content"},
189 {"secretkeyid", OPT_SECRETKEYID, 's',
190 "Identity of the -secretkey for CMS \"KEKRecipientInfo\" object"},
191 {"pwri_password", OPT_PWRI_PASSWORD, 's',
192 "Specific password for recipient"},
7e1b7485 193 {"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
5388f986
RS		 194 {"inkey", OPT_INKEY, 's',
195 "Input private key (if not signer or recipient)"},
6d382c74 196 {"keyform", OPT_KEYFORM, 'f', "Input private key format (ENGINE, other values ignored)"},
5388f986
RS		 197 {"keyopt", OPT_KEYOPT, 's', "Set public key parameters as n:v pairs"},
198
199 OPT_SECTION("Mail header"),
200 {"econtent_type", OPT_ECONTENT_TYPE, 's', "OID for external content"},
7e1b7485
RS		 201 {"to", OPT_TO, 's', "To address"},
202 {"from", OPT_FROM, 's', "From address"},
203 {"subject", OPT_SUBJECT, 's', "Subject"},
204 {"signer", OPT_SIGNER, 's', "Signer certificate file"},
71434aed 205 {"originator", OPT_ORIGINATOR, 's', "Originator certificate file"},
7e1b7485 206 {"recip", OPT_RECIP, '<', "Recipient cert file for decryption"},
38546024
RS		 207 {"receipt_request_from", OPT_RR_FROM, 's',
208 "Create signed receipt request with specified email address"},
209 {"receipt_request_to", OPT_RR_TO, 's',
210 "Create signed receipt targeted to specified address"},
5388f986
RS		 211
212 OPT_SECTION("Encryption"),
213 {"md", OPT_MD, 's', "Digest algorithm to use when signing or resigning"},
9c3bcfa0 214 {"", OPT_CIPHER, '-', "Any supported cipher"},
5388f986
RS		 215
216 OPT_SECTION("Key-wrapping"),
7e1b7485
RS		 217 {"aes128-wrap", OPT_AES128_WRAP, '-', "Use AES128 to wrap key"},
218 {"aes192-wrap", OPT_AES192_WRAP, '-', "Use AES192 to wrap key"},
219 {"aes256-wrap", OPT_AES256_WRAP, '-', "Use AES256 to wrap key"},
7e1b7485
RS		 220# ifndef OPENSSL_NO_DES
221 {"des3-wrap", OPT_3DES_WRAP, '-', "Use 3DES-EDE to wrap key"},
222# endif
71434aed 223 {"wrap", OPT_WRAP, 's', "Any wrap cipher to wrap key"},
5388f986
RS		 224
225 OPT_R_OPTIONS,
226 OPT_V_OPTIONS,
6bd4e3f2 227 OPT_PROV_OPTIONS,
92de469f
RS		 228
229 OPT_PARAMETERS(),
230 {"cert", 0, 0, "Recipient certs (optional; used only when encrypting)"},
9c3bcfa0 231 {NULL}
7e1b7485 232};
8931b30d 233
c1669f41
SL		 234static CMS_ContentInfo *load_content_info(int informat, BIO *in, BIO **indata,
235 const char *name,
236 OPENSSL_CTX *libctx, const char *propq)
237{
238 CMS_ContentInfo *ret, *ci;
239
240 ret = CMS_ContentInfo_new_with_libctx(libctx, propq);
241 if (ret == NULL) {
242 BIO_printf(bio_err, "Error allocating CMS_contentinfo\n");
243 return NULL;
244 }
245 switch (informat) {
246 case FORMAT_SMIME:
247 ci = SMIME_read_CMS_ex(in, indata, &ret);
248 break;
249 case FORMAT_PEM:
250 ci = PEM_read_bio_CMS(in, &ret, NULL, NULL);
251 break;
252 case FORMAT_ASN1:
253 ci = d2i_CMS_bio(in, &ret);
254 break;
255 default:
256 BIO_printf(bio_err, "Bad input format for %s\n", name);
257 goto err;
258 }
259 if (ci == NULL) {
260 BIO_printf(bio_err, "Error reading %s Content Info\n", name);
261 goto err;
262 }
263 return ret;
264err:
265 CMS_ContentInfo_free(ret);
266 return NULL;
267}
268
7e1b7485 269int cms_main(int argc, char **argv)
0f113f3e 270{
c1669f41 271 CONF *conf = NULL;
7e1b7485 272 ASN1_OBJECT *econtent_type = NULL;
0f113f3e 273 BIO *in = NULL, *out = NULL, *indata = NULL, *rctin = NULL;
7e1b7485 274 CMS_ContentInfo *cms = NULL, *rcms = NULL;
0f113f3e 275 CMS_ReceiptRequest *rr = NULL;
7e1b7485
RS		 276 ENGINE *e = NULL;
277 EVP_PKEY *key = NULL;
278 const EVP_CIPHER *cipher = NULL, *wrap_cipher = NULL;
0f113f3e 279 const EVP_MD *sign_md = NULL;
7e1b7485
RS		 280 STACK_OF(OPENSSL_STRING) *rr_to = NULL, *rr_from = NULL;
281 STACK_OF(OPENSSL_STRING) *sksigners = NULL, *skkeys = NULL;
282 STACK_OF(X509) *encerts = NULL, *other = NULL;
71434aed 283 X509 *cert = NULL, *recip = NULL, *signer = NULL, *originator = NULL;
7e1b7485
RS		 284 X509_STORE *store = NULL;
285 X509_VERIFY_PARAM *vpm = NULL;
286 char *certfile = NULL, *keyfile = NULL, *contfile = NULL;
fd3397fc 287 const char *CAfile = NULL, *CApath = NULL, *CAstore = NULL;
cc696296 288 char *certsoutfile = NULL;
fd3397fc 289 int noCAfile = 0, noCApath = 0, noCAstore = 0;
3ee1eac2 290 char *infile = NULL, *outfile = NULL, *rctfile = NULL;
71434aed 291 char *passinarg = NULL, *passin = NULL, *signerfile = NULL, *originatorfile = NULL, *recipfile = NULL;
7e1b7485
RS		 292 char *to = NULL, *from = NULL, *subject = NULL, *prog;
293 cms_key_param *key_first = NULL, *key_param = NULL;
3ee1eac2 294 int flags = CMS_DETACHED, noout = 0, print = 0, keyidx = -1, vpmtouched = 0;
0f113f3e 295 int informat = FORMAT_SMIME, outformat = FORMAT_SMIME;
3ee1eac2 296 int operation = 0, ret = 1, rr_print = 0, rr_allorfirst = -1;
7e1b7485 297 int verify_retcode = 0, rctformat = FORMAT_SMIME, keyform = FORMAT_PEM;
0f113f3e 298 size_t secret_keylen = 0, secret_keyidlen = 0;
7e1b7485
RS		 299 unsigned char *pwri_pass = NULL, *pwri_tmp = NULL;
300 unsigned char *secret_key = NULL, *secret_keyid = NULL;
301 long ltmp;
2197494d 302 const char *mime_eol = "\n";
7e1b7485 303 OPTION_CHOICE o;
c1669f41
SL		 304 OPENSSL_CTX *libctx = app_get0_libctx();
305 const char *propq = app_get0_propq();
0f113f3e 306
7e1b7485
RS		 307 if ((vpm = X509_VERIFY_PARAM_new()) == NULL)
308 return 1;
0f113f3e 309
7e1b7485
RS		 310 prog = opt_init(argc, argv, cms_options);
311 while ((o = opt_next()) != OPT_EOF) {
312 switch (o) {
313 case OPT_EOF:
314 case OPT_ERR:
315 opthelp:
316 BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
317 goto end;
318 case OPT_HELP:
319 opt_help(cms_options);
320 ret = 0;
321 goto end;
322 case OPT_INFORM:
f47e5647 323 if (!opt_format(opt_arg(), OPT_FMT_PDS, &informat))
7e1b7485
RS		 324 goto opthelp;
325 break;
326 case OPT_OUTFORM:
f47e5647 327 if (!opt_format(opt_arg(), OPT_FMT_PDS, &outformat))
7e1b7485
RS		 328 goto opthelp;
329 break;
330 case OPT_OUT:
331 outfile = opt_arg();
332 break;
333 case OPT_ENCRYPT:
0f113f3e 334 operation = SMIME_ENCRYPT;
7e1b7485
RS		 335 break;
336 case OPT_DECRYPT:
0f113f3e 337 operation = SMIME_DECRYPT;
7e1b7485
RS		 338 break;
339 case OPT_SIGN:
0f113f3e 340 operation = SMIME_SIGN;
7e1b7485
RS		 341 break;
342 case OPT_SIGN_RECEIPT:
0f113f3e 343 operation = SMIME_SIGN_RECEIPT;
7e1b7485
RS		 344 break;
345 case OPT_RESIGN:
0f113f3e 346 operation = SMIME_RESIGN;
7e1b7485
RS		 347 break;
348 case OPT_VERIFY:
0f113f3e 349 operation = SMIME_VERIFY;
7e1b7485
RS		 350 break;
351 case OPT_VERIFY_RETCODE:
0f113f3e 352 verify_retcode = 1;
7e1b7485
RS		 353 break;
354 case OPT_VERIFY_RECEIPT:
0f113f3e 355 operation = SMIME_VERIFY_RECEIPT;
7e1b7485
RS		 356 rctfile = opt_arg();
357 break;
358 case OPT_CMSOUT:
0f113f3e 359 operation = SMIME_CMSOUT;
7e1b7485
RS		 360 break;
361 case OPT_DATA_OUT:
0f113f3e 362 operation = SMIME_DATAOUT;
7e1b7485
RS		 363 break;
364 case OPT_DATA_CREATE:
0f113f3e 365 operation = SMIME_DATA_CREATE;
7e1b7485
RS		 366 break;
367 case OPT_DIGEST_VERIFY:
0f113f3e 368 operation = SMIME_DIGEST_VERIFY;
7e1b7485
RS		 369 break;
370 case OPT_DIGEST_CREATE:
0f113f3e 371 operation = SMIME_DIGEST_CREATE;
7e1b7485
RS		 372 break;
373 case OPT_COMPRESS:
0f113f3e 374 operation = SMIME_COMPRESS;
7e1b7485
RS		 375 break;
376 case OPT_UNCOMPRESS:
0f113f3e 377 operation = SMIME_UNCOMPRESS;
7e1b7485
RS		 378 break;
379 case OPT_ED_DECRYPT:
0f113f3e 380 operation = SMIME_ENCRYPTED_DECRYPT;
7e1b7485
RS		 381 break;
382 case OPT_ED_ENCRYPT:
0f113f3e 383 operation = SMIME_ENCRYPTED_ENCRYPT;
7e1b7485
RS		 384 break;
385 case OPT_DEBUG_DECRYPT:
0f113f3e 386 flags |= CMS_DEBUG_DECRYPT;
7e1b7485
RS		 387 break;
388 case OPT_TEXT:
0f113f3e 389 flags |= CMS_TEXT;
7e1b7485
RS		 390 break;
391 case OPT_ASCIICRLF:
0f113f3e 392 flags |= CMS_ASCIICRLF;
7e1b7485
RS		 393 break;
394 case OPT_NOINTERN:
0f113f3e 395 flags |= CMS_NOINTERN;
7e1b7485
RS		 396 break;
397 case OPT_NOVERIFY:
0f113f3e 398 flags |= CMS_NO_SIGNER_CERT_VERIFY;
7e1b7485
RS		 399 break;
400 case OPT_NOCERTS:
0f113f3e 401 flags |= CMS_NOCERTS;
7e1b7485
RS		 402 break;
403 case OPT_NOATTR:
0f113f3e 404 flags |= CMS_NOATTR;
7e1b7485
RS		 405 break;
406 case OPT_NODETACH:
0f113f3e 407 flags &= ~CMS_DETACHED;
7e1b7485
RS		 408 break;
409 case OPT_NOSMIMECAP:
0f113f3e 410 flags |= CMS_NOSMIMECAP;
7e1b7485
RS		 411 break;
412 case OPT_BINARY:
0f113f3e 413 flags |= CMS_BINARY;
e85d19c6
AI		 414 break;
415 case OPT_CADES:
416 flags |= CMS_CADES;
7e1b7485
RS		 417 break;
418 case OPT_KEYID:
0f113f3e 419 flags |= CMS_USE_KEYID;
7e1b7485
RS		 420 break;
421 case OPT_NOSIGS:
0f113f3e 422 flags |= CMS_NOSIGS;
7e1b7485
RS		 423 break;
424 case OPT_NO_CONTENT_VERIFY:
0f113f3e 425 flags |= CMS_NO_CONTENT_VERIFY;
7e1b7485
RS		 426 break;
427 case OPT_NO_ATTR_VERIFY:
0f113f3e 428 flags |= CMS_NO_ATTR_VERIFY;
7e1b7485
RS		 429 break;
430 case OPT_INDEF:
0f113f3e 431 flags |= CMS_STREAM;
7e1b7485
RS		 432 break;
433 case OPT_NOINDEF:
0f113f3e 434 flags &= ~CMS_STREAM;
7e1b7485 435 break;
7e1b7485 436 case OPT_CRLFEOL:
2197494d 437 mime_eol = "\r\n";
0f113f3e 438 flags |= CMS_CRLFEOL;
7e1b7485
RS		 439 break;
440 case OPT_NOOUT:
0f113f3e 441 noout = 1;
7e1b7485
RS		 442 break;
443 case OPT_RR_PRINT:
0f113f3e 444 rr_print = 1;
7e1b7485
RS		 445 break;
446 case OPT_RR_ALL:
0f113f3e 447 rr_allorfirst = 0;
7e1b7485
RS		 448 break;
449 case OPT_RR_FIRST:
0f113f3e 450 rr_allorfirst = 1;
7e1b7485
RS		 451 break;
452 case OPT_RCTFORM:
c1669f41 453 if (rctformat == FORMAT_ASN1) {
7e1b7485
RS		 454 if (!opt_format(opt_arg(),
455 OPT_FMT_PEMDER | OPT_FMT_SMIME, &rctformat))
456 goto opthelp;
c1669f41
SL		 457 } else {
458 rcms = load_content_info(rctformat, rctin, NULL, "recipient",
459 libctx, propq);
460 }
7e1b7485
RS		 461 break;
462 case OPT_CERTFILE:
463 certfile = opt_arg();
464 break;
465 case OPT_CAFILE:
466 CAfile = opt_arg();
467 break;
468 case OPT_CAPATH:
469 CApath = opt_arg();
470 break;
fd3397fc
RL		 471 case OPT_CASTORE:
472 CAstore = opt_arg();
473 break;
2b6bcb70
MC		 474 case OPT_NOCAFILE:
475 noCAfile = 1;
476 break;
477 case OPT_NOCAPATH:
478 noCApath = 1;
479 break;
fd3397fc
RL		 480 case OPT_NOCASTORE:
481 noCAstore = 1;
482 break;
7e1b7485
RS		 483 case OPT_IN:
484 infile = opt_arg();
485 break;
486 case OPT_CONTENT:
487 contfile = opt_arg();
488 break;
489 case OPT_RR_FROM:
490 if (rr_from == NULL
491 && (rr_from = sk_OPENSSL_STRING_new_null()) == NULL)
492 goto end;
493 sk_OPENSSL_STRING_push(rr_from, opt_arg());
494 break;
495 case OPT_RR_TO:
496 if (rr_to == NULL
497 && (rr_to = sk_OPENSSL_STRING_new_null()) == NULL)
498 goto end;
499 sk_OPENSSL_STRING_push(rr_to, opt_arg());
500 break;
501 case OPT_PRINT:
502 noout = print = 1;
503 break;
6ec351f4
DB		 504 case OPT_NAMEOPT:
505 if (!set_nameopt(opt_arg()))
506 goto opthelp;
507 break;
7e1b7485 508 case OPT_SECRETKEY:
08f6ae5b 509 if (secret_key != NULL) {
efba7787
MC		 510 BIO_printf(bio_err, "Invalid key (supplied twice) %s\n",
511 opt_arg());
08f6ae5b
MC		 512 goto opthelp;
513 }
14f051a0 514 secret_key = OPENSSL_hexstr2buf(opt_arg(), &ltmp);
7e1b7485
RS		 515 if (secret_key == NULL) {
516 BIO_printf(bio_err, "Invalid key %s\n", opt_arg());
517 goto end;
0f113f3e
MC		 518 }
519 secret_keylen = (size_t)ltmp;
7e1b7485
RS		 520 break;
521 case OPT_SECRETKEYID:
08f6ae5b 522 if (secret_keyid != NULL) {
efba7787
MC		 523 BIO_printf(bio_err, "Invalid id (supplied twice) %s\n",
524 opt_arg());
08f6ae5b
MC		 525 goto opthelp;
526 }
14f051a0 527 secret_keyid = OPENSSL_hexstr2buf(opt_arg(), &ltmp);
7e1b7485
RS		 528 if (secret_keyid == NULL) {
529 BIO_printf(bio_err, "Invalid id %s\n", opt_arg());
530 goto opthelp;
0f113f3e
MC		 531 }
532 secret_keyidlen = (size_t)ltmp;
7e1b7485
RS		 533 break;
534 case OPT_PWRI_PASSWORD:
535 pwri_pass = (unsigned char *)opt_arg();
536 break;
537 case OPT_ECONTENT_TYPE:
08f6ae5b 538 if (econtent_type != NULL) {
efba7787
MC		 539 BIO_printf(bio_err, "Invalid OID (supplied twice) %s\n",
540 opt_arg());
08f6ae5b
MC		 541 goto opthelp;
542 }
7e1b7485
RS		 543 econtent_type = OBJ_txt2obj(opt_arg(), 0);
544 if (econtent_type == NULL) {
545 BIO_printf(bio_err, "Invalid OID %s\n", opt_arg());
546 goto opthelp;
0f113f3e 547 }
7e1b7485 548 break;
7e1b7485 549 case OPT_ENGINE:
333b070e 550 e = setup_engine(opt_arg(), 0);
7e1b7485
RS		 551 break;
552 case OPT_PASSIN:
553 passinarg = opt_arg();
554 break;
555 case OPT_TO:
556 to = opt_arg();
557 break;
558 case OPT_FROM:
559 from = opt_arg();
560 break;
561 case OPT_SUBJECT:
562 subject = opt_arg();
563 break;
564 case OPT_CERTSOUT:
565 certsoutfile = opt_arg();
566 break;
567 case OPT_MD:
568 if (!opt_md(opt_arg(), &sign_md))
569 goto end;
570 break;
571 case OPT_SIGNER:
0f113f3e 572 /* If previous -signer argument add signer to list */
2234212c 573 if (signerfile != NULL) {
7e1b7485
RS		 574 if (sksigners == NULL
575 && (sksigners = sk_OPENSSL_STRING_new_null()) == NULL)
576 goto end;
0f113f3e 577 sk_OPENSSL_STRING_push(sksigners, signerfile);
7e1b7485 578 if (keyfile == NULL)
0f113f3e 579 keyfile = signerfile;
7e1b7485
RS		 580 if (skkeys == NULL
581 && (skkeys = sk_OPENSSL_STRING_new_null()) == NULL)
582 goto end;
0f113f3e
MC		 583 sk_OPENSSL_STRING_push(skkeys, keyfile);
584 keyfile = NULL;
585 }
7e1b7485
RS		 586 signerfile = opt_arg();
587 break;
71434aed
DB		 588 case OPT_ORIGINATOR:
589 originatorfile = opt_arg();
590 break;
7e1b7485 591 case OPT_INKEY:
ceab33e2 592 /* If previous -inkey argument add signer to list */
2234212c 593 if (keyfile != NULL) {
7e1b7485 594 if (signerfile == NULL) {
0f113f3e 595 BIO_puts(bio_err, "Illegal -inkey without -signer\n");
7e1b7485 596 goto end;
0f113f3e 597 }
7e1b7485
RS		 598 if (sksigners == NULL
599 && (sksigners = sk_OPENSSL_STRING_new_null()) == NULL)
600 goto end;
0f113f3e
MC		 601 sk_OPENSSL_STRING_push(sksigners, signerfile);
602 signerfile = NULL;
7e1b7485
RS		 603 if (skkeys == NULL
604 && (skkeys = sk_OPENSSL_STRING_new_null()) == NULL)
605 goto end;
0f113f3e
MC		 606 sk_OPENSSL_STRING_push(skkeys, keyfile);
607 }
7e1b7485
RS		 608 keyfile = opt_arg();
609 break;
610 case OPT_KEYFORM:
611 if (!opt_format(opt_arg(), OPT_FMT_ANY, &keyform))
612 goto opthelp;
613 break;
614 case OPT_RECIP:
615 if (operation == SMIME_ENCRYPT) {
616 if (encerts == NULL && (encerts = sk_X509_new_null()) == NULL)
617 goto end;
6d382c74 618 cert = load_cert(opt_arg(), FORMAT_UNDEF,
7e1b7485
RS		 619 "recipient certificate file");
620 if (cert == NULL)
621 goto end;
622 sk_X509_push(encerts, cert);
623 cert = NULL;
2234212c 624 } else {
7e1b7485 625 recipfile = opt_arg();
2234212c 626 }
7e1b7485
RS		 627 break;
628 case OPT_CIPHER:
629 if (!opt_cipher(opt_unknown(), &cipher))
630 goto end;
631 break;
632 case OPT_KEYOPT:
633 keyidx = -1;
0f113f3e 634 if (operation == SMIME_ENCRYPT) {
2234212c 635 if (encerts != NULL)
0f113f3e
MC		 636 keyidx += sk_X509_num(encerts);
637 } else {
2234212c 638 if (keyfile != NULL || signerfile != NULL)
0f113f3e 639 keyidx++;
2234212c 640 if (skkeys != NULL)
0f113f3e
MC		 641 keyidx += sk_OPENSSL_STRING_num(skkeys);
642 }
643 if (keyidx < 0) {
644 BIO_printf(bio_err, "No key specified\n");
7e1b7485 645 goto opthelp;
0f113f3e
MC		 646 }
647 if (key_param == NULL || key_param->idx != keyidx) {
648 cms_key_param *nparam;
b4faea50 649 nparam = app_malloc(sizeof(*nparam), "key param buffer");
0f113f3e 650 nparam->idx = keyidx;
7e1b7485
RS		 651 if ((nparam->param = sk_OPENSSL_STRING_new_null()) == NULL)
652 goto end;
0f113f3e
MC		 653 nparam->next = NULL;
654 if (key_first == NULL)
655 key_first = nparam;
656 else
657 key_param->next = nparam;
658 key_param = nparam;
659 }
7e1b7485
RS		 660 sk_OPENSSL_STRING_push(key_param->param, opt_arg());
661 break;
662 case OPT_V_CASES:
663 if (!opt_verify(o, vpm))
664 goto end;
665 vpmtouched++;
666 break;
3ee1eac2
RS		 667 case OPT_R_CASES:
668 if (!opt_rand(o))
669 goto end;
670 break;
6bd4e3f2
P		 671 case OPT_PROV_CASES:
672 if (!opt_provider(o))
673 goto end;
674 break;
c1669f41
SL		 675 case OPT_CONFIG:
676 conf = app_load_config_modules(opt_arg());
677 if (conf == NULL)
678 goto end;
679 break;
7e1b7485 680 case OPT_3DES_WRAP:
9c3bcfa0 681# ifndef OPENSSL_NO_DES
7e1b7485 682 wrap_cipher = EVP_des_ede3_wrap();
7e1b7485 683# endif
9c3bcfa0 684 break;
7e1b7485
RS		 685 case OPT_AES128_WRAP:
686 wrap_cipher = EVP_aes_128_wrap();
687 break;
688 case OPT_AES192_WRAP:
689 wrap_cipher = EVP_aes_192_wrap();
690 break;
691 case OPT_AES256_WRAP:
692 wrap_cipher = EVP_aes_256_wrap();
693 break;
71434aed
DB		 694 case OPT_WRAP:
695 if (!opt_cipher(opt_unknown(), &wrap_cipher))
696 goto end;
697 break;
7e1b7485 698 }
0f113f3e 699 }
7e1b7485
RS		 700 argc = opt_num_rest();
701 argv = opt_rest();
0f113f3e 702
2234212c 703 if ((rr_allorfirst != -1 || rr_from != NULL) && rr_to == NULL) {
0f113f3e 704 BIO_puts(bio_err, "No Signed Receipts Recipients\n");
7e1b7485 705 goto opthelp;
0f113f3e
MC		 706 }
707
2234212c 708 if (!(operation & SMIME_SIGNERS) && (rr_to != NULL || rr_from != NULL)) {
0f113f3e 709 BIO_puts(bio_err, "Signed receipts only allowed with -sign\n");
7e1b7485 710 goto opthelp;
0f113f3e 711 }
2234212c 712 if (!(operation & SMIME_SIGNERS) && (skkeys != NULL || sksigners != NULL)) {
0f113f3e 713 BIO_puts(bio_err, "Multiple signers or keys not allowed\n");
7e1b7485 714 goto opthelp;
0f113f3e
MC		 715 }
716
9e3c510b
F		 717 if ((flags & CMS_CADES) != 0) {
718 if ((flags & CMS_NOATTR) != 0) {
8c89c80a
F		 719 BIO_puts(bio_err, "Incompatible options: "
720 "CAdES required signed attributes\n");
721 goto opthelp;
722 }
9e3c510b
F		 723 if (operation == SMIME_VERIFY
724 && (flags & (CMS_NO_SIGNER_CERT_VERIFY | CMS_NO_ATTR_VERIFY)) != 0) {
725 BIO_puts(bio_err, "Incompatible options: CAdES validation require"
726 " certs and signed attributes validations\n");
727 goto opthelp;
728 }
8c89c80a
F		 729 }
730
0f113f3e 731 if (operation & SMIME_SIGNERS) {
2234212c 732 if (keyfile != NULL && signerfile == NULL) {
0f113f3e 733 BIO_puts(bio_err, "Illegal -inkey without -signer\n");
7e1b7485 734 goto opthelp;
0f113f3e
MC		 735 }
736 /* Check to see if any final signer needs to be appended */
2234212c
PY		 737 if (signerfile != NULL) {
738 if (sksigners == NULL
7e1b7485
RS		 739 && (sksigners = sk_OPENSSL_STRING_new_null()) == NULL)
740 goto end;
0f113f3e 741 sk_OPENSSL_STRING_push(sksigners, signerfile);
2234212c 742 if (skkeys == NULL && (skkeys = sk_OPENSSL_STRING_new_null()) == NULL)
7e1b7485 743 goto end;
2234212c 744 if (keyfile == NULL)
0f113f3e
MC		 745 keyfile = signerfile;
746 sk_OPENSSL_STRING_push(skkeys, keyfile);
747 }
2234212c 748 if (sksigners == NULL) {
0f113f3e 749 BIO_printf(bio_err, "No signer certificate specified\n");
7e1b7485 750 goto opthelp;
0f113f3e
MC		 751 }
752 signerfile = NULL;
753 keyfile = NULL;
2234212c
PY		 754 } else if (operation == SMIME_DECRYPT) {
755 if (recipfile == NULL && keyfile == NULL
756 && secret_key == NULL && pwri_pass == NULL) {
0f113f3e
MC		 757 BIO_printf(bio_err,
758 "No recipient certificate or key specified\n");
7e1b7485 759 goto opthelp;
0f113f3e
MC		 760 }
761 } else if (operation == SMIME_ENCRYPT) {
2234212c
PY		 762 if (*argv == NULL && secret_key == NULL
763 && pwri_pass == NULL && encerts == NULL) {
0f113f3e 764 BIO_printf(bio_err, "No recipient(s) certificate(s) specified\n");
7e1b7485 765 goto opthelp;
0f113f3e 766 }
2234212c 767 } else if (!operation) {
42151b8e 768 BIO_printf(bio_err, "No operation option (-encrypt|-decrypt|-sign|-verify|...) specified.\n");
7e1b7485 769 goto opthelp;
2234212c 770 }
7e1b7485 771
7e1b7485 772 if (!app_passwd(passinarg, NULL, &passin, NULL)) {
0f113f3e
MC		 773 BIO_printf(bio_err, "Error getting password\n");
774 goto end;
775 }
776
0f113f3e
MC		 777 ret = 2;
778
779 if (!(operation & SMIME_SIGNERS))
780 flags &= ~CMS_DETACHED;
781
2234212c 782 if (!(operation & SMIME_OP))
0f113f3e 783 if (flags & CMS_BINARY)
bdd58d98 784 outformat = FORMAT_BINARY;
0f113f3e 785
2234212c 786 if (!(operation & SMIME_IP))
0f113f3e 787 if (flags & CMS_BINARY)
bdd58d98 788 informat = FORMAT_BINARY;
0f113f3e
MC		 789
790 if (operation == SMIME_ENCRYPT) {
791 if (!cipher) {
792# ifndef OPENSSL_NO_DES
793 cipher = EVP_des_ede3_cbc();
794# else
795 BIO_printf(bio_err, "No cipher selected\n");
796 goto end;
797# endif
798 }
799
800 if (secret_key && !secret_keyid) {
801 BIO_printf(bio_err, "No secret key id\n");
802 goto end;
803 }
804
2234212c 805 if (*argv && encerts == NULL)
7e1b7485
RS		 806 if ((encerts = sk_X509_new_null()) == NULL)
807 goto end;
808 while (*argv) {
6d382c74 809 if ((cert = load_cert(*argv, FORMAT_UNDEF,
75ebbd9a 810 "recipient certificate file")) == NULL)
0f113f3e
MC		 811 goto end;
812 sk_X509_push(encerts, cert);
813 cert = NULL;
7e1b7485 814 argv++;
0f113f3e
MC		 815 }
816 }
817
2234212c 818 if (certfile != NULL) {
b3c5aadf 819 if (!load_certs(certfile, &other, NULL, "certificate file")) {
0f113f3e
MC		 820 ERR_print_errors(bio_err);
821 goto end;
822 }
823 }
824
2234212c 825 if (recipfile != NULL && (operation == SMIME_DECRYPT)) {
6d382c74 826 if ((recip = load_cert(recipfile, FORMAT_UNDEF,
75ebbd9a 827 "recipient certificate file")) == NULL) {
0f113f3e
MC		 828 ERR_print_errors(bio_err);
829 goto end;
830 }
831 }
832
71434aed 833 if (originatorfile != NULL) {
6d382c74 834 if ((originator = load_cert(originatorfile, FORMAT_UNDEF,
71434aed
DB		 835 "originator certificate file")) == NULL) {
836 ERR_print_errors(bio_err);
837 goto end;
838 }
839 }
840
0f113f3e 841 if (operation == SMIME_SIGN_RECEIPT) {
6d382c74 842 if ((signer = load_cert(signerfile, FORMAT_UNDEF,
75ebbd9a 843 "receipt signer certificate file")) == NULL) {
0f113f3e
MC		 844 ERR_print_errors(bio_err);
845 goto end;
846 }
847 }
848
71434aed 849 if ((operation == SMIME_DECRYPT) || (operation == SMIME_ENCRYPT)) {
2234212c 850 if (keyfile == NULL)
0f113f3e
MC		 851 keyfile = recipfile;
852 } else if ((operation == SMIME_SIGN) || (operation == SMIME_SIGN_RECEIPT)) {
2234212c 853 if (keyfile == NULL)
0f113f3e 854 keyfile = signerfile;
2234212c 855 } else {
0f113f3e 856 keyfile = NULL;
2234212c 857 }
0f113f3e 858
2234212c 859 if (keyfile != NULL) {
7e1b7485 860 key = load_key(keyfile, keyform, 0, passin, e, "signing key file");
2234212c 861 if (key == NULL)
0f113f3e 862 goto end;
a10847c4
RL		 863
864 /*
865 * TODO: Remove this when CMS has full support for provider-native
866 * EVP_PKEYs
867 */
868 if (EVP_PKEY_get0(key) == NULL)
869 goto end;
0f113f3e
MC		 870 }
871
bdd58d98 872 in = bio_open_default(infile, 'r', informat);
7e1b7485
RS		 873 if (in == NULL)
874 goto end;
0f113f3e
MC		 875
876 if (operation & SMIME_IP) {
c1669f41
SL		 877 cms = load_content_info(informat, in, &indata, "SMIME", libctx, propq);
878 if (cms == NULL)
0f113f3e 879 goto end;
2234212c 880 if (contfile != NULL) {
0f113f3e 881 BIO_free(indata);
75ebbd9a 882 if ((indata = BIO_new_file(contfile, "rb")) == NULL) {
0f113f3e
MC		 883 BIO_printf(bio_err, "Can't read content file %s\n", contfile);
884 goto end;
885 }
886 }
2234212c 887 if (certsoutfile != NULL) {
0f113f3e
MC		 888 STACK_OF(X509) *allcerts;
889 allcerts = CMS_get1_certs(cms);
890 if (!save_certs(certsoutfile, allcerts)) {
891 BIO_printf(bio_err,
892 "Error writing certs to %s\n", certsoutfile);
893 ret = 5;
894 goto end;
895 }
896 sk_X509_pop_free(allcerts, X509_free);
897 }
898 }
899
2234212c 900 if (rctfile != NULL) {
0f113f3e 901 char *rctmode = (rctformat == FORMAT_ASN1) ? "rb" : "r";
75ebbd9a 902 if ((rctin = BIO_new_file(rctfile, rctmode)) == NULL) {
0f113f3e
MC		 903 BIO_printf(bio_err, "Can't open receipt file %s\n", rctfile);
904 goto end;
905 }
906
c1669f41
SL		 907 rcms = load_content_info(rctformat, rctin, NULL, "recipient", libctx,
908 propq);
909 if (rcms == NULL)
0f113f3e 910 goto end;
0f113f3e
MC		 911 }
912
bdd58d98 913 out = bio_open_default(outfile, 'w', outformat);
7e1b7485
RS		 914 if (out == NULL)
915 goto end;
0f113f3e
MC		 916
917 if ((operation == SMIME_VERIFY) || (operation == SMIME_VERIFY_RECEIPT)) {
fd3397fc
RL		 918 if ((store = setup_verify(CAfile, noCAfile, CApath, noCApath,
919 CAstore, noCAstore)) == NULL)
0f113f3e
MC		 920 goto end;
921 X509_STORE_set_verify_cb(store, cms_cb);
7e1b7485 922 if (vpmtouched)
0f113f3e
MC		 923 X509_STORE_set1_param(store, vpm);
924 }
925
926 ret = 3;
927
928 if (operation == SMIME_DATA_CREATE) {
c1669f41 929 cms = CMS_data_create_with_libctx(in, flags, libctx, propq);
0f113f3e 930 } else if (operation == SMIME_DIGEST_CREATE) {
c1669f41 931 cms = CMS_digest_create_with_libctx(in, sign_md, flags, libctx, propq);
0f113f3e
MC		 932 } else if (operation == SMIME_COMPRESS) {
933 cms = CMS_compress(in, -1, flags);
934 } else if (operation == SMIME_ENCRYPT) {
935 int i;
936 flags |= CMS_PARTIAL;
c1669f41 937 cms = CMS_encrypt_with_libctx(NULL, in, cipher, flags, libctx, propq);
2234212c 938 if (cms == NULL)
0f113f3e
MC		 939 goto end;
940 for (i = 0; i < sk_X509_num(encerts); i++) {
941 CMS_RecipientInfo *ri;
942 cms_key_param *kparam;
71434aed
DB		 943 int tflags = flags | CMS_KEY_PARAM; /* This flag enforces allocating the EVP_PKEY_CTX for the recipient here */
944 EVP_PKEY_CTX *pctx;
0f113f3e 945 X509 *x = sk_X509_value(encerts, i);
71434aed
DB		 946 int res;
947
0f113f3e
MC		 948 for (kparam = key_first; kparam; kparam = kparam->next) {
949 if (kparam->idx == i) {
0f113f3e
MC		 950 break;
951 }
952 }
71434aed 953 ri = CMS_add1_recipient(cms, x, key, originator, tflags);
2234212c 954 if (ri == NULL)
0f113f3e 955 goto end;
71434aed
DB		 956
957 pctx = CMS_RecipientInfo_get0_pkey_ctx(ri);
2234212c 958 if (kparam != NULL) {
0f113f3e
MC		 959 if (!cms_set_pkey_param(pctx, kparam->param))
960 goto end;
961 }
71434aed
DB		 962
963 res = EVP_PKEY_CTX_ctrl(pctx, -1, -1,
964 EVP_PKEY_CTRL_CIPHER,
965 EVP_CIPHER_nid(cipher), NULL);
966 if (res <= 0 && res != -2)
967 goto end;
968
0f113f3e
MC		 969 if (CMS_RecipientInfo_type(ri) == CMS_RECIPINFO_AGREE
970 && wrap_cipher) {
971 EVP_CIPHER_CTX *wctx;
972 wctx = CMS_RecipientInfo_kari_get0_ctx(ri);
973 EVP_EncryptInit_ex(wctx, wrap_cipher, NULL, NULL, NULL);
974 }
975 }
976
2234212c 977 if (secret_key != NULL) {
0f113f3e
MC		 978 if (!CMS_add0_recipient_key(cms, NID_undef,
979 secret_key, secret_keylen,
980 secret_keyid, secret_keyidlen,
981 NULL, NULL, NULL))
982 goto end;
983 /* NULL these because call absorbs them */
984 secret_key = NULL;
985 secret_keyid = NULL;
986 }
2234212c 987 if (pwri_pass != NULL) {
7644a9ae 988 pwri_tmp = (unsigned char *)OPENSSL_strdup((char *)pwri_pass);
2234212c 989 if (pwri_tmp == NULL)
0f113f3e 990 goto end;
2234212c
PY		 991 if (CMS_add0_recipient_password(cms,
992 -1, NID_undef, NID_undef,
993 pwri_tmp, -1, NULL) == NULL)
0f113f3e
MC		 994 goto end;
995 pwri_tmp = NULL;
996 }
997 if (!(flags & CMS_STREAM)) {
998 if (!CMS_final(cms, in, NULL, flags))
999 goto end;
1000 }
1001 } else if (operation == SMIME_ENCRYPTED_ENCRYPT) {
c1669f41
SL		 1002 cms = CMS_EncryptedData_encrypt_with_libctx(in, cipher, secret_key,
1003 secret_keylen, flags,
1004 libctx, propq);
0f113f3e
MC		 1005
1006 } else if (operation == SMIME_SIGN_RECEIPT) {
1007 CMS_ContentInfo *srcms = NULL;
1008 STACK_OF(CMS_SignerInfo) *sis;
1009 CMS_SignerInfo *si;
1010 sis = CMS_get0_SignerInfos(cms);
2234212c 1011 if (sis == NULL)
0f113f3e
MC		 1012 goto end;
1013 si = sk_CMS_SignerInfo_value(sis, 0);
1014 srcms = CMS_sign_receipt(si, signer, key, other, flags);
2234212c 1015 if (srcms == NULL)
0f113f3e
MC		 1016 goto end;
1017 CMS_ContentInfo_free(cms);
1018 cms = srcms;
1019 } else if (operation & SMIME_SIGNERS) {
1020 int i;
1021 /*
1022 * If detached data content we enable streaming if S/MIME output
1023 * format.
1024 */
1025 if (operation == SMIME_SIGN) {
1026
1027 if (flags & CMS_DETACHED) {
1028 if (outformat == FORMAT_SMIME)
1029 flags |= CMS_STREAM;
1030 }
1031 flags |= CMS_PARTIAL;
c1669f41 1032 cms = CMS_sign_with_libctx(NULL, NULL, other, in, flags, libctx, propq);
2234212c 1033 if (cms == NULL)
0f113f3e 1034 goto end;
2234212c 1035 if (econtent_type != NULL)
0f113f3e
MC		 1036 CMS_set1_eContentType(cms, econtent_type);
1037
2234212c 1038 if (rr_to != NULL) {
c1669f41
SL		 1039 rr = make_receipt_request(rr_to, rr_allorfirst, rr_from, libctx,
1040 propq);
2234212c 1041 if (rr == NULL) {
0f113f3e
MC		 1042 BIO_puts(bio_err,
1043 "Signed Receipt Request Creation Error\n");
1044 goto end;
1045 }
1046 }
2234212c 1047 } else {
0f113f3e 1048 flags |= CMS_REUSE_DIGEST;
2234212c 1049 }
0f113f3e
MC		 1050 for (i = 0; i < sk_OPENSSL_STRING_num(sksigners); i++) {
1051 CMS_SignerInfo *si;
1052 cms_key_param *kparam;
1053 int tflags = flags;
1054 signerfile = sk_OPENSSL_STRING_value(sksigners, i);
1055 keyfile = sk_OPENSSL_STRING_value(skkeys, i);
1056
6d382c74
DDO		 1057 signer = load_cert(signerfile, FORMAT_UNDEF,
1058 "signer certificate");
a032ed0a
KS		 1059 if (signer == NULL) {
1060 ret = 2;
0f113f3e 1061 goto end;
a032ed0a 1062 }
7e1b7485 1063 key = load_key(keyfile, keyform, 0, passin, e, "signing key file");
a032ed0a
KS		 1064 if (key == NULL) {
1065 ret = 2;
0f113f3e 1066 goto end;
a032ed0a 1067 }
a10847c4
RL		 1068
1069 /*
1070 * TODO: Remove this when CMS has full support for provider-native
1071 * EVP_PKEYs
1072 */
1073 if (EVP_PKEY_get0(key) == NULL)
1074 goto end;
1075
0f113f3e
MC		 1076 for (kparam = key_first; kparam; kparam = kparam->next) {
1077 if (kparam->idx == i) {
1078 tflags |= CMS_KEY_PARAM;
1079 break;
1080 }
1081 }
1082 si = CMS_add1_signer(cms, signer, key, sign_md, tflags);
2234212c 1083 if (si == NULL)
0f113f3e 1084 goto end;
2234212c 1085 if (kparam != NULL) {
0f113f3e
MC		 1086 EVP_PKEY_CTX *pctx;
1087 pctx = CMS_SignerInfo_get0_pkey_ctx(si);
1088 if (!cms_set_pkey_param(pctx, kparam->param))
1089 goto end;
1090 }
2234212c 1091 if (rr != NULL && !CMS_add1_ReceiptRequest(si, rr))
0f113f3e
MC		 1092 goto end;
1093 X509_free(signer);
1094 signer = NULL;
1095 EVP_PKEY_free(key);
1096 key = NULL;
1097 }
1098 /* If not streaming or resigning finalize structure */
1099 if ((operation == SMIME_SIGN) && !(flags & CMS_STREAM)) {
1100 if (!CMS_final(cms, in, NULL, flags))
1101 goto end;
1102 }
1103 }
1104
2234212c 1105 if (cms == NULL) {
0f113f3e
MC		 1106 BIO_printf(bio_err, "Error creating CMS structure\n");
1107 goto end;
1108 }
1109
1110 ret = 4;
1111 if (operation == SMIME_DECRYPT) {
1112 if (flags & CMS_DEBUG_DECRYPT)
1113 CMS_decrypt(cms, NULL, NULL, NULL, NULL, flags);
1114
2234212c 1115 if (secret_key != NULL) {
0f113f3e
MC		 1116 if (!CMS_decrypt_set1_key(cms,
1117 secret_key, secret_keylen,
1118 secret_keyid, secret_keyidlen)) {
1119 BIO_puts(bio_err, "Error decrypting CMS using secret key\n");
1120 goto end;
1121 }
1122 }
1123
2234212c 1124 if (key != NULL) {
71434aed 1125 if (!CMS_decrypt_set1_pkey_and_peer(cms, key, recip, originator)) {
0f113f3e
MC		 1126 BIO_puts(bio_err, "Error decrypting CMS using private key\n");
1127 goto end;
1128 }
1129 }
1130
2234212c 1131 if (pwri_pass != NULL) {
0f113f3e
MC		 1132 if (!CMS_decrypt_set1_password(cms, pwri_pass, -1)) {
1133 BIO_puts(bio_err, "Error decrypting CMS using password\n");
1134 goto end;
1135 }
1136 }
1137
1138 if (!CMS_decrypt(cms, NULL, NULL, indata, out, flags)) {
1139 BIO_printf(bio_err, "Error decrypting CMS structure\n");
1140 goto end;
1141 }
1142 } else if (operation == SMIME_DATAOUT) {
1143 if (!CMS_data(cms, out, flags))
1144 goto end;
1145 } else if (operation == SMIME_UNCOMPRESS) {
1146 if (!CMS_uncompress(cms, indata, out, flags))
1147 goto end;
1148 } else if (operation == SMIME_DIGEST_VERIFY) {
2234212c 1149 if (CMS_digest_verify(cms, indata, out, flags) > 0) {
0f113f3e 1150 BIO_printf(bio_err, "Verification successful\n");
2234212c 1151 } else {
0f113f3e
MC		 1152 BIO_printf(bio_err, "Verification failure\n");
1153 goto end;
1154 }
1155 } else if (operation == SMIME_ENCRYPTED_DECRYPT) {
1156 if (!CMS_EncryptedData_decrypt(cms, secret_key, secret_keylen,
1157 indata, out, flags))
1158 goto end;
1159 } else if (operation == SMIME_VERIFY) {
2234212c 1160 if (CMS_verify(cms, other, store, indata, out, flags) > 0) {
9e3c510b
F		 1161 BIO_printf(bio_err, "%s Verification successful\n",
1162 (flags & CMS_CADES) ? "CAdES" : "CMS");
2234212c 1163 } else {
0f113f3e
MC		 1164 BIO_printf(bio_err, "Verification failure\n");
1165 if (verify_retcode)
1166 ret = verify_err + 32;
1167 goto end;
1168 }
2234212c 1169 if (signerfile != NULL) {
0f113f3e
MC		 1170 STACK_OF(X509) *signers;
1171 signers = CMS_get0_signers(cms);
1172 if (!save_certs(signerfile, signers)) {
1173 BIO_printf(bio_err,
1174 "Error writing signers to %s\n", signerfile);
1175 ret = 5;
1176 goto end;
1177 }
1178 sk_X509_free(signers);
1179 }
1180 if (rr_print)
ecf3a1fb 1181 receipt_request_print(cms);
0f113f3e
MC		 1182
1183 } else if (operation == SMIME_VERIFY_RECEIPT) {
2234212c 1184 if (CMS_verify_receipt(rcms, cms, other, store, flags) > 0) {
0f113f3e 1185 BIO_printf(bio_err, "Verification successful\n");
2234212c 1186 } else {
0f113f3e
MC		 1187 BIO_printf(bio_err, "Verification failure\n");
1188 goto end;
1189 }
1190 } else {
1191 if (noout) {
6ec351f4
DB		 1192 if (print) {
1193 ASN1_PCTX *pctx = NULL;
1194 if (get_nameopt() != XN_FLAG_ONELINE) {
1195 pctx = ASN1_PCTX_new();
1196 if (pctx != NULL) { /* Print anyway if malloc failed */
1197 ASN1_PCTX_set_flags(pctx, ASN1_PCTX_FLAGS_SHOW_ABSENT);
1198 ASN1_PCTX_set_str_flags(pctx, get_nameopt());
1199 ASN1_PCTX_set_nm_flags(pctx, get_nameopt());
1200 }
1201 }
1202 CMS_ContentInfo_print_ctx(out, cms, 0, pctx);
1203 ASN1_PCTX_free(pctx);
1204 }
0f113f3e
MC		 1205 } else if (outformat == FORMAT_SMIME) {
1206 if (to)
2197494d 1207 BIO_printf(out, "To: %s%s", to, mime_eol);
0f113f3e 1208 if (from)
2197494d 1209 BIO_printf(out, "From: %s%s", from, mime_eol);
0f113f3e 1210 if (subject)
2197494d 1211 BIO_printf(out, "Subject: %s%s", subject, mime_eol);
0f113f3e
MC		 1212 if (operation == SMIME_RESIGN)
1213 ret = SMIME_write_CMS(out, cms, indata, flags);
1214 else
1215 ret = SMIME_write_CMS(out, cms, in, flags);
2234212c 1216 } else if (outformat == FORMAT_PEM) {
0f113f3e 1217 ret = PEM_write_bio_CMS_stream(out, cms, in, flags);
2234212c 1218 } else if (outformat == FORMAT_ASN1) {
0f113f3e 1219 ret = i2d_CMS_bio_stream(out, cms, in, flags);
2234212c 1220 } else {
0f113f3e
MC		 1221 BIO_printf(bio_err, "Bad output format for CMS file\n");
1222 goto end;
1223 }
1224 if (ret <= 0) {
1225 ret = 6;
1226 goto end;
1227 }
1228 }
1229 ret = 0;
1230 end:
1231 if (ret)
1232 ERR_print_errors(bio_err);
0f113f3e
MC		 1233 sk_X509_pop_free(encerts, X509_free);
1234 sk_X509_pop_free(other, X509_free);
7e1b7485 1235 X509_VERIFY_PARAM_free(vpm);
25aaa98a
RS		 1236 sk_OPENSSL_STRING_free(sksigners);
1237 sk_OPENSSL_STRING_free(skkeys);
b548a1f1
RS		 1238 OPENSSL_free(secret_key);
1239 OPENSSL_free(secret_keyid);
1240 OPENSSL_free(pwri_tmp);
0dfb9398 1241 ASN1_OBJECT_free(econtent_type);
25aaa98a
RS		 1242 CMS_ReceiptRequest_free(rr);
1243 sk_OPENSSL_STRING_free(rr_to);
1244 sk_OPENSSL_STRING_free(rr_from);
0f113f3e
MC		 1245 for (key_param = key_first; key_param;) {
1246 cms_key_param *tparam;
1247 sk_OPENSSL_STRING_free(key_param->param);
1248 tparam = key_param->next;
1249 OPENSSL_free(key_param);
1250 key_param = tparam;
1251 }
1252 X509_STORE_free(store);
1253 X509_free(cert);
1254 X509_free(recip);
1255 X509_free(signer);
1256 EVP_PKEY_free(key);
1257 CMS_ContentInfo_free(cms);
1258 CMS_ContentInfo_free(rcms);
dd1abd44 1259 release_engine(e);
0f113f3e
MC		 1260 BIO_free(rctin);
1261 BIO_free(in);
1262 BIO_free(indata);
1263 BIO_free_all(out);
b548a1f1 1264 OPENSSL_free(passin);
c1669f41 1265 NCONF_free(conf);
26a7d938 1266 return ret;
8931b30d
DSH		 1267}
1268
1269static int save_certs(char *signerfile, STACK_OF(X509) *signers)
0f113f3e
MC		 1270{
1271 int i;
1272 BIO *tmp;
2234212c 1273 if (signerfile == NULL)
0f113f3e
MC		 1274 return 1;
1275 tmp = BIO_new_file(signerfile, "w");
2234212c 1276 if (tmp == NULL)
0f113f3e
MC		 1277 return 0;
1278 for (i = 0; i < sk_X509_num(signers); i++)
1279 PEM_write_bio_X509(tmp, sk_X509_value(signers, i));
1280 BIO_free(tmp);
1281 return 1;
1282}
8931b30d
DSH		 1283
1284/* Minimal callback just to output policy info (if any) */
1285
7f50d9a4 1286static int cms_cb(int ok, X509_STORE_CTX *ctx)
0f113f3e
MC		 1287{
1288 int error;
8931b30d 1289
0f113f3e 1290 error = X509_STORE_CTX_get_error(ctx);
8931b30d 1291
0f113f3e 1292 verify_err = error;
db50661f 1293
0f113f3e
MC		 1294 if ((error != X509_V_ERR_NO_EXPLICIT_POLICY)
1295 && ((error != X509_V_OK) || (ok != 2)))
1296 return ok;
8931b30d 1297
ecf3a1fb 1298 policies_print(ctx);
8931b30d 1299
0f113f3e 1300 return ok;
8931b30d 1301
0f113f3e 1302}
8931b30d 1303
ecf3a1fb 1304static void gnames_stack_print(STACK_OF(GENERAL_NAMES) *gns)
0f113f3e
MC		 1305{
1306 STACK_OF(GENERAL_NAME) *gens;
1307 GENERAL_NAME *gen;
1308 int i, j;
ecf3a1fb 1309
0f113f3e
MC		 1310 for (i = 0; i < sk_GENERAL_NAMES_num(gns); i++) {
1311 gens = sk_GENERAL_NAMES_value(gns, i);
1312 for (j = 0; j < sk_GENERAL_NAME_num(gens); j++) {
1313 gen = sk_GENERAL_NAME_value(gens, j);
ecf3a1fb
RS		 1314 BIO_puts(bio_err, " ");
1315 GENERAL_NAME_print(bio_err, gen);
1316 BIO_puts(bio_err, "\n");
0f113f3e
MC		 1317 }
1318 }
1319 return;
1320}
f4cc56f4 1321
ecf3a1fb 1322static void receipt_request_print(CMS_ContentInfo *cms)
0f113f3e
MC		 1323{
1324 STACK_OF(CMS_SignerInfo) *sis;
1325 CMS_SignerInfo *si;
1326 CMS_ReceiptRequest *rr;
1327 int allorfirst;
1328 STACK_OF(GENERAL_NAMES) *rto, *rlist;
1329 ASN1_STRING *scid;
1330 int i, rv;
1331 sis = CMS_get0_SignerInfos(cms);
1332 for (i = 0; i < sk_CMS_SignerInfo_num(sis); i++) {
1333 si = sk_CMS_SignerInfo_value(sis, i);
1334 rv = CMS_get1_ReceiptRequest(si, &rr);
1335 BIO_printf(bio_err, "Signer %d:\n", i + 1);
2234212c 1336 if (rv == 0) {
0f113f3e 1337 BIO_puts(bio_err, " No Receipt Request\n");
2234212c 1338 } else if (rv < 0) {
0f113f3e
MC		 1339 BIO_puts(bio_err, " Receipt Request Parse Error\n");
1340 ERR_print_errors(bio_err);
1341 } else {
17ebf85a 1342 const char *id;
0f113f3e
MC		 1343 int idlen;
1344 CMS_ReceiptRequest_get0_values(rr, &scid, &allorfirst,
1345 &rlist, &rto);
ecf3a1fb 1346 BIO_puts(bio_err, " Signed Content ID:\n");
0f113f3e 1347 idlen = ASN1_STRING_length(scid);
17ebf85a 1348 id = (const char *)ASN1_STRING_get0_data(scid);
ecf3a1fb
RS		 1349 BIO_dump_indent(bio_err, id, idlen, 4);
1350 BIO_puts(bio_err, " Receipts From");
2234212c 1351 if (rlist != NULL) {
ecf3a1fb
RS		 1352 BIO_puts(bio_err, " List:\n");
1353 gnames_stack_print(rlist);
2234212c 1354 } else if (allorfirst == 1) {
ecf3a1fb 1355 BIO_puts(bio_err, ": First Tier\n");
2234212c 1356 } else if (allorfirst == 0) {
ecf3a1fb 1357 BIO_puts(bio_err, ": All\n");
2234212c 1358 } else {
ecf3a1fb 1359 BIO_printf(bio_err, " Unknown (%d)\n", allorfirst);
2234212c 1360 }
ecf3a1fb
RS		 1361 BIO_puts(bio_err, " Receipts To:\n");
1362 gnames_stack_print(rto);
0f113f3e 1363 }
25aaa98a 1364 CMS_ReceiptRequest_free(rr);
0f113f3e
MC		 1365 }
1366}
f4cc56f4 1367
c869da88 1368static STACK_OF(GENERAL_NAMES) *make_names_stack(STACK_OF(OPENSSL_STRING) *ns)
0f113f3e
MC		 1369{
1370 int i;
1371 STACK_OF(GENERAL_NAMES) *ret;
1372 GENERAL_NAMES *gens = NULL;
1373 GENERAL_NAME *gen = NULL;
1374 ret = sk_GENERAL_NAMES_new_null();
2234212c 1375 if (ret == NULL)
0f113f3e
MC		 1376 goto err;
1377 for (i = 0; i < sk_OPENSSL_STRING_num(ns); i++) {
1378 char *str = sk_OPENSSL_STRING_value(ns, i);
1379 gen = a2i_GENERAL_NAME(NULL, NULL, NULL, GEN_EMAIL, str, 0);
2234212c 1380 if (gen == NULL)
0f113f3e
MC		 1381 goto err;
1382 gens = GENERAL_NAMES_new();
96487cdd 1383 if (gens == NULL)
0f113f3e
MC		 1384 goto err;
1385 if (!sk_GENERAL_NAME_push(gens, gen))
1386 goto err;
1387 gen = NULL;
1388 if (!sk_GENERAL_NAMES_push(ret, gens))
1389 goto err;
1390 gens = NULL;
1391 }
1392
1393 return ret;
1394
1395 err:
25aaa98a
RS		 1396 sk_GENERAL_NAMES_pop_free(ret, GENERAL_NAMES_free);
1397 GENERAL_NAMES_free(gens);
1398 GENERAL_NAME_free(gen);
0f113f3e
MC		 1399 return NULL;
1400}
1401
c1669f41
SL		 1402static CMS_ReceiptRequest *make_receipt_request(
1403 STACK_OF(OPENSSL_STRING) *rr_to, int rr_allorfirst,
1404 STACK_OF(OPENSSL_STRING) *rr_from,
1405 OPENSSL_CTX *libctx, const char *propq)
0f113f3e 1406{
6e4ab54b 1407 STACK_OF(GENERAL_NAMES) *rct_to = NULL, *rct_from = NULL;
0f113f3e
MC		 1408 CMS_ReceiptRequest *rr;
1409 rct_to = make_names_stack(rr_to);
2234212c 1410 if (rct_to == NULL)
0f113f3e 1411 goto err;
2234212c 1412 if (rr_from != NULL) {
0f113f3e 1413 rct_from = make_names_stack(rr_from);
2234212c 1414 if (rct_from == NULL)
0f113f3e 1415 goto err;
2234212c 1416 } else {
0f113f3e 1417 rct_from = NULL;
2234212c 1418 }
c1669f41
SL		 1419 rr = CMS_ReceiptRequest_create0_with_libctx(NULL, -1, rr_allorfirst,
1420 rct_from, rct_to, libctx, propq);
0f113f3e
MC		 1421 return rr;
1422 err:
6e4ab54b 1423 sk_GENERAL_NAMES_pop_free(rct_to, GENERAL_NAMES_free);
0f113f3e
MC		 1424 return NULL;
1425}
f5e2354c 1426
02498cc8 1427static int cms_set_pkey_param(EVP_PKEY_CTX *pctx,
0f113f3e
MC		 1428 STACK_OF(OPENSSL_STRING) *param)
1429{
1430 char *keyopt;
1431 int i;
1432 if (sk_OPENSSL_STRING_num(param) <= 0)
1433 return 1;
1434 for (i = 0; i < sk_OPENSSL_STRING_num(param); i++) {
1435 keyopt = sk_OPENSSL_STRING_value(param, i);
1436 if (pkey_ctrl_string(pctx, keyopt) <= 0) {
1437 BIO_printf(bio_err, "parameter error \"%s\"\n", keyopt);
1438 ERR_print_errors(bio_err);
1439 return 0;
1440 }
1441 }
1442 return 1;
1443}
02498cc8 1444
8931b30d 1445#endif
A mirror of the official openssl repository