summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/cms/cms_sd.c
diff options
context:
space:
mode:
Diffstat (limited to 'src/lib/libcrypto/cms/cms_sd.c')
-rw-r--r--src/lib/libcrypto/cms/cms_sd.c710
1 files changed, 330 insertions, 380 deletions
diff --git a/src/lib/libcrypto/cms/cms_sd.c b/src/lib/libcrypto/cms/cms_sd.c
index 976881743b..7fbc0490ba 100644
--- a/src/lib/libcrypto/cms/cms_sd.c
+++ b/src/lib/libcrypto/cms/cms_sd.c
@@ -10,7 +10,7 @@
10 * are met: 10 * are met:
11 * 11 *
12 * 1. Redistributions of source code must retain the above copyright 12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer. 13 * notice, this list of conditions and the following disclaimer.
14 * 14 *
15 * 2. Redistributions in binary form must reproduce the above copyright 15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in 16 * notice, this list of conditions and the following disclaimer in
@@ -64,119 +64,111 @@
64 64
65DECLARE_ASN1_ITEM(CMS_SignedData) 65DECLARE_ASN1_ITEM(CMS_SignedData)
66 66
67static CMS_SignedData *cms_get0_signed(CMS_ContentInfo *cms) 67static CMS_SignedData *
68 { 68cms_get0_signed(CMS_ContentInfo *cms)
69 if (OBJ_obj2nid(cms->contentType) != NID_pkcs7_signed) 69{
70 { 70 if (OBJ_obj2nid(cms->contentType) != NID_pkcs7_signed) {
71 CMSerr(CMS_F_CMS_GET0_SIGNED, CMS_R_CONTENT_TYPE_NOT_SIGNED_DATA); 71 CMSerr(CMS_F_CMS_GET0_SIGNED,
72 CMS_R_CONTENT_TYPE_NOT_SIGNED_DATA);
72 return NULL; 73 return NULL;
73 }
74 return cms->d.signedData;
75 } 74 }
75 return cms->d.signedData;
76}
76 77
77static CMS_SignedData *cms_signed_data_init(CMS_ContentInfo *cms) 78static CMS_SignedData *
78 { 79cms_signed_data_init(CMS_ContentInfo *cms)
79 if (cms->d.other == NULL) 80{
80 { 81 if (cms->d.other == NULL) {
81 cms->d.signedData = M_ASN1_new_of(CMS_SignedData); 82 cms->d.signedData = M_ASN1_new_of(CMS_SignedData);
82 if (!cms->d.signedData) 83 if (!cms->d.signedData) {
83 { 84 CMSerr(CMS_F_CMS_SIGNED_DATA_INIT,
84 CMSerr(CMS_F_CMS_SIGNED_DATA_INIT, ERR_R_MALLOC_FAILURE); 85 ERR_R_MALLOC_FAILURE);
85 return NULL; 86 return NULL;
86 } 87 }
87 cms->d.signedData->version = 1; 88 cms->d.signedData->version = 1;
88 cms->d.signedData->encapContentInfo->eContentType = 89 cms->d.signedData->encapContentInfo->eContentType =
89 OBJ_nid2obj(NID_pkcs7_data); 90 OBJ_nid2obj(NID_pkcs7_data);
90 cms->d.signedData->encapContentInfo->partial = 1; 91 cms->d.signedData->encapContentInfo->partial = 1;
91 ASN1_OBJECT_free(cms->contentType); 92 ASN1_OBJECT_free(cms->contentType);
92 cms->contentType = OBJ_nid2obj(NID_pkcs7_signed); 93 cms->contentType = OBJ_nid2obj(NID_pkcs7_signed);
93 return cms->d.signedData; 94 return cms->d.signedData;
94 }
95 return cms_get0_signed(cms);
96 } 95 }
96 return cms_get0_signed(cms);
97}
97 98
98/* Just initialize SignedData e.g. for certs only structure */ 99/* Just initialize SignedData e.g. for certs only structure */
99 100
100int CMS_SignedData_init(CMS_ContentInfo *cms) 101int
101 { 102CMS_SignedData_init(CMS_ContentInfo *cms)
103{
102 if (cms_signed_data_init(cms)) 104 if (cms_signed_data_init(cms))
103 return 1; 105 return 1;
104 else 106 else
105 return 0; 107 return 0;
106 } 108}
107 109
108/* Check structures and fixup version numbers (if necessary) */ 110/* Check structures and fixup version numbers (if necessary) */
109 111
110static void cms_sd_set_version(CMS_SignedData *sd) 112static void
111 { 113cms_sd_set_version(CMS_SignedData *sd)
114{
112 int i; 115 int i;
113 CMS_CertificateChoices *cch; 116 CMS_CertificateChoices *cch;
114 CMS_RevocationInfoChoice *rch; 117 CMS_RevocationInfoChoice *rch;
115 CMS_SignerInfo *si; 118 CMS_SignerInfo *si;
116 119
117 for (i = 0; i < sk_CMS_CertificateChoices_num(sd->certificates); i++) 120 for (i = 0; i < sk_CMS_CertificateChoices_num(sd->certificates); i++) {
118 {
119 cch = sk_CMS_CertificateChoices_value(sd->certificates, i); 121 cch = sk_CMS_CertificateChoices_value(sd->certificates, i);
120 if (cch->type == CMS_CERTCHOICE_OTHER) 122 if (cch->type == CMS_CERTCHOICE_OTHER) {
121 {
122 if (sd->version < 5) 123 if (sd->version < 5)
123 sd->version = 5; 124 sd->version = 5;
124 } 125 } else if (cch->type == CMS_CERTCHOICE_V2ACERT) {
125 else if (cch->type == CMS_CERTCHOICE_V2ACERT)
126 {
127 if (sd->version < 4) 126 if (sd->version < 4)
128 sd->version = 4; 127 sd->version = 4;
129 } 128 } else if (cch->type == CMS_CERTCHOICE_V1ACERT) {
130 else if (cch->type == CMS_CERTCHOICE_V1ACERT)
131 {
132 if (sd->version < 3) 129 if (sd->version < 3)
133 sd->version = 3; 130 sd->version = 3;
134 }
135 } 131 }
132 }
136 133
137 for (i = 0; i < sk_CMS_RevocationInfoChoice_num(sd->crls); i++) 134 for (i = 0; i < sk_CMS_RevocationInfoChoice_num(sd->crls); i++) {
138 {
139 rch = sk_CMS_RevocationInfoChoice_value(sd->crls, i); 135 rch = sk_CMS_RevocationInfoChoice_value(sd->crls, i);
140 if (rch->type == CMS_REVCHOICE_OTHER) 136 if (rch->type == CMS_REVCHOICE_OTHER) {
141 {
142 if (sd->version < 5) 137 if (sd->version < 5)
143 sd->version = 5; 138 sd->version = 5;
144 }
145 } 139 }
140 }
146 141
147 if ((OBJ_obj2nid(sd->encapContentInfo->eContentType) != NID_pkcs7_data) 142 if ((OBJ_obj2nid(sd->encapContentInfo->eContentType) !=
148 && (sd->version < 3)) 143 NID_pkcs7_data) && (sd->version < 3))
149 sd->version = 3; 144 sd->version = 3;
150 145
151 for (i = 0; i < sk_CMS_SignerInfo_num(sd->signerInfos); i++) 146 for (i = 0; i < sk_CMS_SignerInfo_num(sd->signerInfos); i++) {
152 {
153 si = sk_CMS_SignerInfo_value(sd->signerInfos, i); 147 si = sk_CMS_SignerInfo_value(sd->signerInfos, i);
154 if (si->sid->type == CMS_SIGNERINFO_KEYIDENTIFIER) 148 if (si->sid->type == CMS_SIGNERINFO_KEYIDENTIFIER) {
155 {
156 if (si->version < 3) 149 if (si->version < 3)
157 si->version = 3; 150 si->version = 3;
158 if (sd->version < 3) 151 if (sd->version < 3)
159 sd->version = 3; 152 sd->version = 3;
160 } 153 } else
161 else
162 sd->version = 1; 154 sd->version = 1;
163 } 155 }
164 156
165 if (sd->version < 1) 157 if (sd->version < 1)
166 sd->version = 1; 158 sd->version = 1;
159}
167 160
168 }
169
170/* Copy an existing messageDigest value */ 161/* Copy an existing messageDigest value */
171 162
172static int cms_copy_messageDigest(CMS_ContentInfo *cms, CMS_SignerInfo *si) 163static int
173 { 164cms_copy_messageDigest(CMS_ContentInfo *cms, CMS_SignerInfo *si)
165{
174 STACK_OF(CMS_SignerInfo) *sinfos; 166 STACK_OF(CMS_SignerInfo) *sinfos;
175 CMS_SignerInfo *sitmp; 167 CMS_SignerInfo *sitmp;
176 int i; 168 int i;
169
177 sinfos = CMS_get0_SignerInfos(cms); 170 sinfos = CMS_get0_SignerInfos(cms);
178 for (i = 0; i < sk_CMS_SignerInfo_num(sinfos); i++) 171 for (i = 0; i < sk_CMS_SignerInfo_num(sinfos); i++) {
179 {
180 ASN1_OCTET_STRING *messageDigest; 172 ASN1_OCTET_STRING *messageDigest;
181 sitmp = sk_CMS_SignerInfo_value(sinfos, i); 173 sitmp = sk_CMS_SignerInfo_value(sinfos, i);
182 if (sitmp == si) 174 if (sitmp == si)
@@ -184,133 +176,124 @@ static int cms_copy_messageDigest(CMS_ContentInfo *cms, CMS_SignerInfo *si)
184 if (CMS_signed_get_attr_count(sitmp) < 0) 176 if (CMS_signed_get_attr_count(sitmp) < 0)
185 continue; 177 continue;
186 if (OBJ_cmp(si->digestAlgorithm->algorithm, 178 if (OBJ_cmp(si->digestAlgorithm->algorithm,
187 sitmp->digestAlgorithm->algorithm)) 179 sitmp->digestAlgorithm->algorithm))
188 continue; 180 continue;
189 messageDigest = CMS_signed_get0_data_by_OBJ(sitmp, 181 messageDigest = CMS_signed_get0_data_by_OBJ(sitmp,
190 OBJ_nid2obj(NID_pkcs9_messageDigest), 182 OBJ_nid2obj(NID_pkcs9_messageDigest),
191 -3, V_ASN1_OCTET_STRING); 183 -3, V_ASN1_OCTET_STRING);
192 if (!messageDigest) 184 if (!messageDigest) {
193 {
194 CMSerr(CMS_F_CMS_COPY_MESSAGEDIGEST, 185 CMSerr(CMS_F_CMS_COPY_MESSAGEDIGEST,
195 CMS_R_ERROR_READING_MESSAGEDIGEST_ATTRIBUTE); 186 CMS_R_ERROR_READING_MESSAGEDIGEST_ATTRIBUTE);
196 return 0; 187 return 0;
197 } 188 }
198 189
199 if (CMS_signed_add1_attr_by_NID(si, NID_pkcs9_messageDigest, 190 if (CMS_signed_add1_attr_by_NID(si, NID_pkcs9_messageDigest,
200 V_ASN1_OCTET_STRING, 191 V_ASN1_OCTET_STRING,
201 messageDigest, -1)) 192 messageDigest, -1))
202 return 1; 193 return 1;
203 else 194 else
204 return 0; 195 return 0;
205 }
206 CMSerr(CMS_F_CMS_COPY_MESSAGEDIGEST, CMS_R_NO_MATCHING_DIGEST);
207 return 0;
208 } 196 }
197 CMSerr(CMS_F_CMS_COPY_MESSAGEDIGEST, CMS_R_NO_MATCHING_DIGEST);
198 return 0;
199}
209 200
210int cms_set1_SignerIdentifier(CMS_SignerIdentifier *sid, X509 *cert, int type) 201int
211 { 202cms_set1_SignerIdentifier(CMS_SignerIdentifier *sid, X509 *cert, int type)
212 switch(type) 203{
213 { 204 switch (type) {
214 case CMS_SIGNERINFO_ISSUER_SERIAL: 205 case CMS_SIGNERINFO_ISSUER_SERIAL:
215 sid->d.issuerAndSerialNumber = 206 sid->d.issuerAndSerialNumber =
216 M_ASN1_new_of(CMS_IssuerAndSerialNumber); 207 M_ASN1_new_of(CMS_IssuerAndSerialNumber);
217 if (!sid->d.issuerAndSerialNumber) 208 if (!sid->d.issuerAndSerialNumber)
218 goto merr; 209 goto merr;
219 if (!X509_NAME_set(&sid->d.issuerAndSerialNumber->issuer, 210 if (!X509_NAME_set(&sid->d.issuerAndSerialNumber->issuer,
220 X509_get_issuer_name(cert))) 211 X509_get_issuer_name(cert)))
221 goto merr; 212 goto merr;
222 if (!ASN1_STRING_copy( 213 if (!ASN1_STRING_copy(
223 sid->d.issuerAndSerialNumber->serialNumber, 214 sid->d.issuerAndSerialNumber->serialNumber,
224 X509_get_serialNumber(cert))) 215 X509_get_serialNumber(cert)))
225 goto merr; 216 goto merr;
226 break; 217 break;
227 218
228 case CMS_SIGNERINFO_KEYIDENTIFIER: 219 case CMS_SIGNERINFO_KEYIDENTIFIER:
229 if (!cert->skid) 220 if (!cert->skid) {
230 {
231 CMSerr(CMS_F_CMS_SET1_SIGNERIDENTIFIER, 221 CMSerr(CMS_F_CMS_SET1_SIGNERIDENTIFIER,
232 CMS_R_CERTIFICATE_HAS_NO_KEYID); 222 CMS_R_CERTIFICATE_HAS_NO_KEYID);
233 return 0; 223 return 0;
234 } 224 }
235 sid->d.subjectKeyIdentifier = ASN1_STRING_dup(cert->skid); 225 sid->d.subjectKeyIdentifier = ASN1_STRING_dup(cert->skid);
236 if (!sid->d.subjectKeyIdentifier) 226 if (!sid->d.subjectKeyIdentifier)
237 goto merr; 227 goto merr;
238 break; 228 break;
239 229
240 default: 230 default:
241 CMSerr(CMS_F_CMS_SET1_SIGNERIDENTIFIER, CMS_R_UNKNOWN_ID); 231 CMSerr(CMS_F_CMS_SET1_SIGNERIDENTIFIER, CMS_R_UNKNOWN_ID);
242 return 0; 232 return 0;
243 } 233 }
244 234
245 sid->type = type; 235 sid->type = type;
246 236
247 return 1; 237 return 1;
248 238
249 merr: 239merr:
250 CMSerr(CMS_F_CMS_SET1_SIGNERIDENTIFIER, ERR_R_MALLOC_FAILURE); 240 CMSerr(CMS_F_CMS_SET1_SIGNERIDENTIFIER, ERR_R_MALLOC_FAILURE);
251 return 0; 241 return 0;
242}
252 243
253 } 244int
254 245cms_SignerIdentifier_get0_signer_id(CMS_SignerIdentifier *sid,
255int cms_SignerIdentifier_get0_signer_id(CMS_SignerIdentifier *sid, 246 ASN1_OCTET_STRING **keyid, X509_NAME **issuer, ASN1_INTEGER **sno)
256 ASN1_OCTET_STRING **keyid, 247{
257 X509_NAME **issuer, ASN1_INTEGER **sno) 248 if (sid->type == CMS_SIGNERINFO_ISSUER_SERIAL) {
258 {
259 if (sid->type == CMS_SIGNERINFO_ISSUER_SERIAL)
260 {
261 if (issuer) 249 if (issuer)
262 *issuer = sid->d.issuerAndSerialNumber->issuer; 250 *issuer = sid->d.issuerAndSerialNumber->issuer;
263 if (sno) 251 if (sno)
264 *sno = sid->d.issuerAndSerialNumber->serialNumber; 252 *sno = sid->d.issuerAndSerialNumber->serialNumber;
265 } 253 } else if (sid->type == CMS_SIGNERINFO_KEYIDENTIFIER) {
266 else if (sid->type == CMS_SIGNERINFO_KEYIDENTIFIER)
267 {
268 if (keyid) 254 if (keyid)
269 *keyid = sid->d.subjectKeyIdentifier; 255 *keyid = sid->d.subjectKeyIdentifier;
270 } 256 } else
271 else
272 return 0; 257 return 0;
273 return 1; 258 return 1;
274 } 259}
275 260
276int cms_SignerIdentifier_cert_cmp(CMS_SignerIdentifier *sid, X509 *cert) 261int
277 { 262cms_SignerIdentifier_cert_cmp(CMS_SignerIdentifier *sid, X509 *cert)
263{
278 int ret; 264 int ret;
279 if (sid->type == CMS_SIGNERINFO_ISSUER_SERIAL) 265
280 { 266 if (sid->type == CMS_SIGNERINFO_ISSUER_SERIAL) {
281 ret = X509_NAME_cmp(sid->d.issuerAndSerialNumber->issuer, 267 ret = X509_NAME_cmp(sid->d.issuerAndSerialNumber->issuer,
282 X509_get_issuer_name(cert)); 268 X509_get_issuer_name(cert));
283 if (ret) 269 if (ret)
284 return ret; 270 return ret;
285 return ASN1_INTEGER_cmp(sid->d.issuerAndSerialNumber->serialNumber, 271 return ASN1_INTEGER_cmp(sid->d.issuerAndSerialNumber->serialNumber,
286 X509_get_serialNumber(cert)); 272 X509_get_serialNumber(cert));
287 } 273 } else if (sid->type == CMS_SIGNERINFO_KEYIDENTIFIER) {
288 else if (sid->type == CMS_SIGNERINFO_KEYIDENTIFIER)
289 {
290 X509_check_purpose(cert, -1, -1); 274 X509_check_purpose(cert, -1, -1);
291 if (!cert->skid) 275 if (!cert->skid)
292 return -1; 276 return -1;
293 return ASN1_OCTET_STRING_cmp(sid->d.subjectKeyIdentifier, 277 return ASN1_OCTET_STRING_cmp(sid->d.subjectKeyIdentifier,
294 cert->skid); 278 cert->skid);
295 } 279 } else
296 else
297 return -1; 280 return -1;
298 } 281}
299 282
300CMS_SignerInfo *CMS_add1_signer(CMS_ContentInfo *cms, 283CMS_SignerInfo *
301 X509 *signer, EVP_PKEY *pk, const EVP_MD *md, 284CMS_add1_signer(CMS_ContentInfo *cms, X509 *signer, EVP_PKEY *pk,
302 unsigned int flags) 285 const EVP_MD *md, unsigned int flags)
303 { 286{
304 CMS_SignedData *sd; 287 CMS_SignedData *sd;
305 CMS_SignerInfo *si = NULL; 288 CMS_SignerInfo *si = NULL;
306 X509_ALGOR *alg; 289 X509_ALGOR *alg;
307 int i, type; 290 int i, type;
308 if(!X509_check_private_key(signer, pk)) 291
309 { 292 if (!X509_check_private_key(signer, pk)) {
310 CMSerr(CMS_F_CMS_ADD1_SIGNER, 293 CMSerr(CMS_F_CMS_ADD1_SIGNER,
311 CMS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE); 294 CMS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE);
312 return NULL; 295 return NULL;
313 } 296 }
314 sd = cms_signed_data_init(cms); 297 sd = cms_signed_data_init(cms);
315 if (!sd) 298 if (!sd)
316 goto err; 299 goto err;
@@ -325,98 +308,83 @@ CMS_SignerInfo *CMS_add1_signer(CMS_ContentInfo *cms,
325 si->pkey = pk; 308 si->pkey = pk;
326 si->signer = signer; 309 si->signer = signer;
327 310
328 if (flags & CMS_USE_KEYID) 311 if (flags & CMS_USE_KEYID) {
329 {
330 si->version = 3; 312 si->version = 3;
331 if (sd->version < 3) 313 if (sd->version < 3)
332 sd->version = 3; 314 sd->version = 3;
333 type = CMS_SIGNERINFO_KEYIDENTIFIER; 315 type = CMS_SIGNERINFO_KEYIDENTIFIER;
334 } 316 } else {
335 else
336 {
337 type = CMS_SIGNERINFO_ISSUER_SERIAL; 317 type = CMS_SIGNERINFO_ISSUER_SERIAL;
338 si->version = 1; 318 si->version = 1;
339 } 319 }
340 320
341 if (!cms_set1_SignerIdentifier(si->sid, signer, type)) 321 if (!cms_set1_SignerIdentifier(si->sid, signer, type))
342 goto err; 322 goto err;
343 323
344 if (md == NULL) 324 if (md == NULL) {
345 {
346 int def_nid; 325 int def_nid;
347 if (EVP_PKEY_get_default_digest_nid(pk, &def_nid) <= 0) 326 if (EVP_PKEY_get_default_digest_nid(pk, &def_nid) <= 0)
348 goto err; 327 goto err;
349 md = EVP_get_digestbynid(def_nid); 328 md = EVP_get_digestbynid(def_nid);
350 if (md == NULL) 329 if (md == NULL) {
351 {
352 CMSerr(CMS_F_CMS_ADD1_SIGNER, CMS_R_NO_DEFAULT_DIGEST); 330 CMSerr(CMS_F_CMS_ADD1_SIGNER, CMS_R_NO_DEFAULT_DIGEST);
353 goto err; 331 goto err;
354 }
355 } 332 }
333 }
356 334
357 if (!md) 335 if (!md) {
358 {
359 CMSerr(CMS_F_CMS_ADD1_SIGNER, CMS_R_NO_DIGEST_SET); 336 CMSerr(CMS_F_CMS_ADD1_SIGNER, CMS_R_NO_DIGEST_SET);
360 goto err; 337 goto err;
361 } 338 }
362 339
363 cms_DigestAlgorithm_set(si->digestAlgorithm, md); 340 cms_DigestAlgorithm_set(si->digestAlgorithm, md);
364 341
365 /* See if digest is present in digestAlgorithms */ 342 /* See if digest is present in digestAlgorithms */
366 for (i = 0; i < sk_X509_ALGOR_num(sd->digestAlgorithms); i++) 343 for (i = 0; i < sk_X509_ALGOR_num(sd->digestAlgorithms); i++) {
367 {
368 ASN1_OBJECT *aoid; 344 ASN1_OBJECT *aoid;
369 alg = sk_X509_ALGOR_value(sd->digestAlgorithms, i); 345 alg = sk_X509_ALGOR_value(sd->digestAlgorithms, i);
370 X509_ALGOR_get0(&aoid, NULL, NULL, alg); 346 X509_ALGOR_get0(&aoid, NULL, NULL, alg);
371 if (OBJ_obj2nid(aoid) == EVP_MD_type(md)) 347 if (OBJ_obj2nid(aoid) == EVP_MD_type(md))
372 break; 348 break;
373 } 349 }
374 350
375 if (i == sk_X509_ALGOR_num(sd->digestAlgorithms)) 351 if (i == sk_X509_ALGOR_num(sd->digestAlgorithms)) {
376 {
377 alg = X509_ALGOR_new(); 352 alg = X509_ALGOR_new();
378 if (!alg) 353 if (!alg)
379 goto merr; 354 goto merr;
380 cms_DigestAlgorithm_set(alg, md); 355 cms_DigestAlgorithm_set(alg, md);
381 if (!sk_X509_ALGOR_push(sd->digestAlgorithms, alg)) 356 if (!sk_X509_ALGOR_push(sd->digestAlgorithms, alg)) {
382 {
383 X509_ALGOR_free(alg); 357 X509_ALGOR_free(alg);
384 goto merr; 358 goto merr;
385 }
386 } 359 }
360 }
387 361
388 if (pk->ameth && pk->ameth->pkey_ctrl) 362 if (pk->ameth && pk->ameth->pkey_ctrl) {
389 {
390 i = pk->ameth->pkey_ctrl(pk, ASN1_PKEY_CTRL_CMS_SIGN, 363 i = pk->ameth->pkey_ctrl(pk, ASN1_PKEY_CTRL_CMS_SIGN,
391 0, si); 364 0, si);
392 if (i == -2) 365 if (i == -2) {
393 {
394 CMSerr(CMS_F_CMS_ADD1_SIGNER, 366 CMSerr(CMS_F_CMS_ADD1_SIGNER,
395 CMS_R_NOT_SUPPORTED_FOR_THIS_KEY_TYPE); 367 CMS_R_NOT_SUPPORTED_FOR_THIS_KEY_TYPE);
396 goto err; 368 goto err;
397 } 369 }
398 if (i <= 0) 370 if (i <= 0) {
399 {
400 CMSerr(CMS_F_CMS_ADD1_SIGNER, CMS_R_CTRL_FAILURE); 371 CMSerr(CMS_F_CMS_ADD1_SIGNER, CMS_R_CTRL_FAILURE);
401 goto err; 372 goto err;
402 }
403 } 373 }
374 }
404 375
405 if (!(flags & CMS_NOATTR)) 376 if (!(flags & CMS_NOATTR)) {
406 {
407 /* Initialialize signed attributes strutucture so other 377 /* Initialialize signed attributes strutucture so other
408 * attributes such as signing time etc are added later 378 * attributes such as signing time etc are added later
409 * even if we add none here. 379 * even if we add none here.
410 */ 380 */
411 if (!si->signedAttrs) 381 if (!si->signedAttrs) {
412 {
413 si->signedAttrs = sk_X509_ATTRIBUTE_new_null(); 382 si->signedAttrs = sk_X509_ATTRIBUTE_new_null();
414 if (!si->signedAttrs) 383 if (!si->signedAttrs)
415 goto merr; 384 goto merr;
416 } 385 }
417 386
418 if (!(flags & CMS_NOSMIMECAP)) 387 if (!(flags & CMS_NOSMIMECAP)) {
419 {
420 STACK_OF(X509_ALGOR) *smcap = NULL; 388 STACK_OF(X509_ALGOR) *smcap = NULL;
421 i = CMS_add_standard_smimecap(&smcap); 389 i = CMS_add_standard_smimecap(&smcap);
422 if (i) 390 if (i)
@@ -424,45 +392,44 @@ CMS_SignerInfo *CMS_add1_signer(CMS_ContentInfo *cms,
424 sk_X509_ALGOR_pop_free(smcap, X509_ALGOR_free); 392 sk_X509_ALGOR_pop_free(smcap, X509_ALGOR_free);
425 if (!i) 393 if (!i)
426 goto merr; 394 goto merr;
427 } 395 }
428 if (flags & CMS_REUSE_DIGEST) 396 if (flags & CMS_REUSE_DIGEST) {
429 {
430 if (!cms_copy_messageDigest(cms, si)) 397 if (!cms_copy_messageDigest(cms, si))
431 goto err; 398 goto err;
432 if (!(flags & CMS_PARTIAL) && 399 if (!(flags & CMS_PARTIAL) &&
433 !CMS_SignerInfo_sign(si)) 400 !CMS_SignerInfo_sign(si))
434 goto err; 401 goto err;
435 }
436 } 402 }
403 }
437 404
438 if (!(flags & CMS_NOCERTS)) 405 if (!(flags & CMS_NOCERTS)) {
439 {
440 /* NB ignore -1 return for duplicate cert */ 406 /* NB ignore -1 return for duplicate cert */
441 if (!CMS_add1_cert(cms, signer)) 407 if (!CMS_add1_cert(cms, signer))
442 goto merr; 408 goto merr;
443 } 409 }
444 410
445 if (!sd->signerInfos) 411 if (!sd->signerInfos)
446 sd->signerInfos = sk_CMS_SignerInfo_new_null(); 412 sd->signerInfos = sk_CMS_SignerInfo_new_null();
447 if (!sd->signerInfos || 413 if (!sd->signerInfos ||
448 !sk_CMS_SignerInfo_push(sd->signerInfos, si)) 414 !sk_CMS_SignerInfo_push(sd->signerInfos, si))
449 goto merr; 415 goto merr;
450 416
451 return si; 417 return si;
452 418
453 merr: 419merr:
454 CMSerr(CMS_F_CMS_ADD1_SIGNER, ERR_R_MALLOC_FAILURE); 420 CMSerr(CMS_F_CMS_ADD1_SIGNER, ERR_R_MALLOC_FAILURE);
455 err: 421err:
456 if (si) 422 if (si)
457 M_ASN1_free_of(si, CMS_SignerInfo); 423 M_ASN1_free_of(si, CMS_SignerInfo);
458 return NULL; 424 return NULL;
425}
459 426
460 } 427static int
461 428cms_add1_signingTime(CMS_SignerInfo *si, ASN1_TIME *t)
462static int cms_add1_signingTime(CMS_SignerInfo *si, ASN1_TIME *t) 429{
463 {
464 ASN1_TIME *tt; 430 ASN1_TIME *tt;
465 int r = 0; 431 int r = 0;
432
466 if (t) 433 if (t)
467 tt = t; 434 tt = t;
468 else 435 else
@@ -472,89 +439,88 @@ static int cms_add1_signingTime(CMS_SignerInfo *si, ASN1_TIME *t)
472 goto merr; 439 goto merr;
473 440
474 if (CMS_signed_add1_attr_by_NID(si, NID_pkcs9_signingTime, 441 if (CMS_signed_add1_attr_by_NID(si, NID_pkcs9_signingTime,
475 tt->type, tt, -1) <= 0) 442 tt->type, tt, -1) <= 0)
476 goto merr; 443 goto merr;
477 444
478 r = 1; 445 r = 1;
479 446
480 merr: 447merr:
481
482 if (!t) 448 if (!t)
483 ASN1_TIME_free(tt); 449 ASN1_TIME_free(tt);
484
485 if (!r) 450 if (!r)
486 CMSerr(CMS_F_CMS_ADD1_SIGNINGTIME, ERR_R_MALLOC_FAILURE); 451 CMSerr(CMS_F_CMS_ADD1_SIGNINGTIME, ERR_R_MALLOC_FAILURE);
487 452
488 return r; 453 return r;
454}
489 455
490 } 456STACK_OF(CMS_SignerInfo) *
491 457CMS_get0_SignerInfos(CMS_ContentInfo *cms)
492STACK_OF(CMS_SignerInfo) *CMS_get0_SignerInfos(CMS_ContentInfo *cms) 458{
493 {
494 CMS_SignedData *sd; 459 CMS_SignedData *sd;
460
495 sd = cms_get0_signed(cms); 461 sd = cms_get0_signed(cms);
496 if (!sd) 462 if (!sd)
497 return NULL; 463 return NULL;
498 return sd->signerInfos; 464 return sd->signerInfos;
499 } 465}
500 466
501STACK_OF(X509) *CMS_get0_signers(CMS_ContentInfo *cms) 467STACK_OF(X509) *
502 { 468CMS_get0_signers(CMS_ContentInfo *cms)
469{
503 STACK_OF(X509) *signers = NULL; 470 STACK_OF(X509) *signers = NULL;
504 STACK_OF(CMS_SignerInfo) *sinfos; 471 STACK_OF(CMS_SignerInfo) *sinfos;
505 CMS_SignerInfo *si; 472 CMS_SignerInfo *si;
506 int i; 473 int i;
474
507 sinfos = CMS_get0_SignerInfos(cms); 475 sinfos = CMS_get0_SignerInfos(cms);
508 for (i = 0; i < sk_CMS_SignerInfo_num(sinfos); i++) 476 for (i = 0; i < sk_CMS_SignerInfo_num(sinfos); i++) {
509 {
510 si = sk_CMS_SignerInfo_value(sinfos, i); 477 si = sk_CMS_SignerInfo_value(sinfos, i);
511 if (si->signer) 478 if (si->signer) {
512 { 479 if (!signers) {
513 if (!signers)
514 {
515 signers = sk_X509_new_null(); 480 signers = sk_X509_new_null();
516 if (!signers) 481 if (!signers)
517 return NULL; 482 return NULL;
518 } 483 }
519 if (!sk_X509_push(signers, si->signer)) 484 if (!sk_X509_push(signers, si->signer)) {
520 {
521 sk_X509_free(signers); 485 sk_X509_free(signers);
522 return NULL; 486 return NULL;
523 }
524 } 487 }
525 } 488 }
526 return signers;
527 } 489 }
490 return signers;
491}
528 492
529void CMS_SignerInfo_set1_signer_cert(CMS_SignerInfo *si, X509 *signer) 493void
530 { 494CMS_SignerInfo_set1_signer_cert(CMS_SignerInfo *si, X509 *signer)
531 if (signer) 495{
532 { 496 if (signer) {
533 CRYPTO_add(&signer->references, 1, CRYPTO_LOCK_X509); 497 CRYPTO_add(&signer->references, 1, CRYPTO_LOCK_X509);
534 if (si->pkey) 498 if (si->pkey)
535 EVP_PKEY_free(si->pkey); 499 EVP_PKEY_free(si->pkey);
536 si->pkey = X509_get_pubkey(signer); 500 si->pkey = X509_get_pubkey(signer);
537 } 501 }
538 if (si->signer) 502 if (si->signer)
539 X509_free(si->signer); 503 X509_free(si->signer);
540 si->signer = signer; 504 si->signer = signer;
541 } 505}
542 506
543int CMS_SignerInfo_get0_signer_id(CMS_SignerInfo *si, 507int
544 ASN1_OCTET_STRING **keyid, 508CMS_SignerInfo_get0_signer_id(CMS_SignerInfo *si, ASN1_OCTET_STRING **keyid,
545 X509_NAME **issuer, ASN1_INTEGER **sno) 509 X509_NAME **issuer, ASN1_INTEGER **sno)
546 { 510{
547 return cms_SignerIdentifier_get0_signer_id(si->sid, keyid, issuer, sno); 511 return cms_SignerIdentifier_get0_signer_id(si->sid, keyid, issuer, sno);
548 } 512}
549 513
550int CMS_SignerInfo_cert_cmp(CMS_SignerInfo *si, X509 *cert) 514int
551 { 515CMS_SignerInfo_cert_cmp(CMS_SignerInfo *si, X509 *cert)
516{
552 return cms_SignerIdentifier_cert_cmp(si->sid, cert); 517 return cms_SignerIdentifier_cert_cmp(si->sid, cert);
553 } 518}
554 519
555int CMS_set1_signers_certs(CMS_ContentInfo *cms, STACK_OF(X509) *scerts, 520int
556 unsigned int flags) 521CMS_set1_signers_certs(CMS_ContentInfo *cms, STACK_OF(X509) *scerts,
557 { 522 unsigned int flags)
523{
558 CMS_SignedData *sd; 524 CMS_SignedData *sd;
559 CMS_SignerInfo *si; 525 CMS_SignerInfo *si;
560 CMS_CertificateChoices *cch; 526 CMS_CertificateChoices *cch;
@@ -562,50 +528,47 @@ int CMS_set1_signers_certs(CMS_ContentInfo *cms, STACK_OF(X509) *scerts,
562 X509 *x; 528 X509 *x;
563 int i, j; 529 int i, j;
564 int ret = 0; 530 int ret = 0;
531
565 sd = cms_get0_signed(cms); 532 sd = cms_get0_signed(cms);
566 if (!sd) 533 if (!sd)
567 return -1; 534 return -1;
568 certs = sd->certificates; 535 certs = sd->certificates;
569 for (i = 0; i < sk_CMS_SignerInfo_num(sd->signerInfos); i++) 536 for (i = 0; i < sk_CMS_SignerInfo_num(sd->signerInfos); i++) {
570 {
571 si = sk_CMS_SignerInfo_value(sd->signerInfos, i); 537 si = sk_CMS_SignerInfo_value(sd->signerInfos, i);
572 if (si->signer) 538 if (si->signer)
573 continue; 539 continue;
574 540
575 for (j = 0; j < sk_X509_num(scerts); j++) 541 for (j = 0; j < sk_X509_num(scerts); j++) {
576 {
577 x = sk_X509_value(scerts, j); 542 x = sk_X509_value(scerts, j);
578 if (CMS_SignerInfo_cert_cmp(si, x) == 0) 543 if (CMS_SignerInfo_cert_cmp(si, x) == 0) {
579 {
580 CMS_SignerInfo_set1_signer_cert(si, x); 544 CMS_SignerInfo_set1_signer_cert(si, x);
581 ret++; 545 ret++;
582 break; 546 break;
583 }
584 } 547 }
548 }
585 549
586 if (si->signer || (flags & CMS_NOINTERN)) 550 if (si->signer || (flags & CMS_NOINTERN))
587 continue; 551 continue;
588 552
589 for (j = 0; j < sk_CMS_CertificateChoices_num(certs); j++) 553 for (j = 0; j < sk_CMS_CertificateChoices_num(certs); j++) {
590 {
591 cch = sk_CMS_CertificateChoices_value(certs, j); 554 cch = sk_CMS_CertificateChoices_value(certs, j);
592 if (cch->type != 0) 555 if (cch->type != 0)
593 continue; 556 continue;
594 x = cch->d.certificate; 557 x = cch->d.certificate;
595 if (CMS_SignerInfo_cert_cmp(si, x) == 0) 558 if (CMS_SignerInfo_cert_cmp(si, x) == 0) {
596 {
597 CMS_SignerInfo_set1_signer_cert(si, x); 559 CMS_SignerInfo_set1_signer_cert(si, x);
598 ret++; 560 ret++;
599 break; 561 break;
600 }
601 } 562 }
602 } 563 }
603 return ret;
604 } 564 }
565 return ret;
566}
605 567
606void CMS_SignerInfo_get0_algs(CMS_SignerInfo *si, EVP_PKEY **pk, X509 **signer, 568void
607 X509_ALGOR **pdig, X509_ALGOR **psig) 569CMS_SignerInfo_get0_algs(CMS_SignerInfo *si, EVP_PKEY **pk, X509 **signer,
608 { 570 X509_ALGOR **pdig, X509_ALGOR **psig)
571{
609 if (pk) 572 if (pk)
610 *pk = si->pkey; 573 *pk = si->pkey;
611 if (signer) 574 if (signer)
@@ -614,93 +577,88 @@ void CMS_SignerInfo_get0_algs(CMS_SignerInfo *si, EVP_PKEY **pk, X509 **signer,
614 *pdig = si->digestAlgorithm; 577 *pdig = si->digestAlgorithm;
615 if (psig) 578 if (psig)
616 *psig = si->signatureAlgorithm; 579 *psig = si->signatureAlgorithm;
617 } 580}
618 581
619static int cms_SignerInfo_content_sign(CMS_ContentInfo *cms, 582static int
620 CMS_SignerInfo *si, BIO *chain) 583cms_SignerInfo_content_sign(CMS_ContentInfo *cms, CMS_SignerInfo *si,
621 { 584 BIO *chain)
585{
622 EVP_MD_CTX mctx; 586 EVP_MD_CTX mctx;
623 int r = 0; 587 int r = 0;
624 EVP_MD_CTX_init(&mctx); 588 EVP_MD_CTX_init(&mctx);
625 589
626 590 if (!si->pkey) {
627 if (!si->pkey)
628 {
629 CMSerr(CMS_F_CMS_SIGNERINFO_CONTENT_SIGN, CMS_R_NO_PRIVATE_KEY); 591 CMSerr(CMS_F_CMS_SIGNERINFO_CONTENT_SIGN, CMS_R_NO_PRIVATE_KEY);
630 return 0; 592 return 0;
631 } 593 }
632 594
633 if (!cms_DigestAlgorithm_find_ctx(&mctx, chain, si->digestAlgorithm)) 595 if (!cms_DigestAlgorithm_find_ctx(&mctx, chain, si->digestAlgorithm))
634 goto err; 596 goto err;
635 597
636 /* If any signed attributes calculate and add messageDigest attribute */ 598 /* If any signed attributes calculate and add messageDigest attribute */
637 599
638 if (CMS_signed_get_attr_count(si) >= 0) 600 if (CMS_signed_get_attr_count(si) >= 0) {
639 {
640 ASN1_OBJECT *ctype = 601 ASN1_OBJECT *ctype =
641 cms->d.signedData->encapContentInfo->eContentType; 602 cms->d.signedData->encapContentInfo->eContentType;
642 unsigned char md[EVP_MAX_MD_SIZE]; 603 unsigned char md[EVP_MAX_MD_SIZE];
643 unsigned int mdlen; 604 unsigned int mdlen;
644 if (!EVP_DigestFinal_ex(&mctx, md, &mdlen)) 605 if (!EVP_DigestFinal_ex(&mctx, md, &mdlen))
645 goto err; 606 goto err;
646 if (!CMS_signed_add1_attr_by_NID(si, NID_pkcs9_messageDigest, 607 if (!CMS_signed_add1_attr_by_NID(si, NID_pkcs9_messageDigest,
647 V_ASN1_OCTET_STRING, 608 V_ASN1_OCTET_STRING,
648 md, mdlen)) 609 md, mdlen))
649 goto err; 610 goto err;
650 /* Copy content type across */ 611 /* Copy content type across */
651 if (CMS_signed_add1_attr_by_NID(si, NID_pkcs9_contentType, 612 if (CMS_signed_add1_attr_by_NID(si, NID_pkcs9_contentType,
652 V_ASN1_OBJECT, ctype, -1) <= 0) 613 V_ASN1_OBJECT, ctype, -1) <= 0)
653 goto err; 614 goto err;
654 if (!CMS_SignerInfo_sign(si)) 615 if (!CMS_SignerInfo_sign(si))
655 goto err; 616 goto err;
656 } 617 } else {
657 else
658 {
659 unsigned char *sig; 618 unsigned char *sig;
660 unsigned int siglen; 619 unsigned int siglen;
661 sig = malloc(EVP_PKEY_size(si->pkey)); 620 sig = malloc(EVP_PKEY_size(si->pkey));
662 if (!sig) 621 if (!sig) {
663 {
664 CMSerr(CMS_F_CMS_SIGNERINFO_CONTENT_SIGN, 622 CMSerr(CMS_F_CMS_SIGNERINFO_CONTENT_SIGN,
665 ERR_R_MALLOC_FAILURE); 623 ERR_R_MALLOC_FAILURE);
666 goto err; 624 goto err;
667 } 625 }
668 if (!EVP_SignFinal(&mctx, sig, &siglen, si->pkey)) 626 if (!EVP_SignFinal(&mctx, sig, &siglen, si->pkey)) {
669 {
670 CMSerr(CMS_F_CMS_SIGNERINFO_CONTENT_SIGN, 627 CMSerr(CMS_F_CMS_SIGNERINFO_CONTENT_SIGN,
671 CMS_R_SIGNFINAL_ERROR); 628 CMS_R_SIGNFINAL_ERROR);
672 free(sig); 629 free(sig);
673 goto err; 630 goto err;
674 }
675 ASN1_STRING_set0(si->signature, sig, siglen);
676 } 631 }
632 ASN1_STRING_set0(si->signature, sig, siglen);
633 }
677 634
678 r = 1; 635 r = 1;
679 636
680 err: 637err:
681 EVP_MD_CTX_cleanup(&mctx); 638 EVP_MD_CTX_cleanup(&mctx);
682 return r; 639 return r;
640}
683 641
684 } 642int
685 643cms_SignedData_final(CMS_ContentInfo *cms, BIO *chain)
686int cms_SignedData_final(CMS_ContentInfo *cms, BIO *chain) 644{
687 {
688 STACK_OF(CMS_SignerInfo) *sinfos; 645 STACK_OF(CMS_SignerInfo) *sinfos;
689 CMS_SignerInfo *si; 646 CMS_SignerInfo *si;
690 int i; 647 int i;
648
691 sinfos = CMS_get0_SignerInfos(cms); 649 sinfos = CMS_get0_SignerInfos(cms);
692 for (i = 0; i < sk_CMS_SignerInfo_num(sinfos); i++) 650 for (i = 0; i < sk_CMS_SignerInfo_num(sinfos); i++) {
693 {
694 si = sk_CMS_SignerInfo_value(sinfos, i); 651 si = sk_CMS_SignerInfo_value(sinfos, i);
695 if (!cms_SignerInfo_content_sign(cms, si, chain)) 652 if (!cms_SignerInfo_content_sign(cms, si, chain))
696 return 0; 653 return 0;
697 } 654 }
698 cms->d.signedData->encapContentInfo->partial = 0; 655 cms->d.signedData->encapContentInfo->partial = 0;
699 return 1; 656 return 1;
700 } 657}
701 658
702int CMS_SignerInfo_sign(CMS_SignerInfo *si) 659int
703 { 660CMS_SignerInfo_sign(CMS_SignerInfo *si)
661{
704 EVP_MD_CTX mctx; 662 EVP_MD_CTX mctx;
705 EVP_PKEY_CTX *pctx; 663 EVP_PKEY_CTX *pctx;
706 unsigned char *abuf = NULL; 664 unsigned char *abuf = NULL;
@@ -714,25 +672,23 @@ int CMS_SignerInfo_sign(CMS_SignerInfo *si)
714 672
715 EVP_MD_CTX_init(&mctx); 673 EVP_MD_CTX_init(&mctx);
716 674
717 if (CMS_signed_get_attr_by_NID(si, NID_pkcs9_signingTime, -1) < 0) 675 if (CMS_signed_get_attr_by_NID(si, NID_pkcs9_signingTime, -1) < 0) {
718 {
719 if (!cms_add1_signingTime(si, NULL)) 676 if (!cms_add1_signingTime(si, NULL))
720 goto err; 677 goto err;
721 } 678 }
722 679
723 if (EVP_DigestSignInit(&mctx, &pctx, md, NULL, si->pkey) <= 0) 680 if (EVP_DigestSignInit(&mctx, &pctx, md, NULL, si->pkey) <= 0)
724 goto err; 681 goto err;
725 682
726 if (EVP_PKEY_CTX_ctrl(pctx, -1, EVP_PKEY_OP_SIGN, 683 if (EVP_PKEY_CTX_ctrl(pctx, -1, EVP_PKEY_OP_SIGN,
727 EVP_PKEY_CTRL_CMS_SIGN, 0, si) <= 0) 684 EVP_PKEY_CTRL_CMS_SIGN, 0, si) <= 0) {
728 {
729 CMSerr(CMS_F_CMS_SIGNERINFO_SIGN, CMS_R_CTRL_ERROR); 685 CMSerr(CMS_F_CMS_SIGNERINFO_SIGN, CMS_R_CTRL_ERROR);
730 goto err; 686 goto err;
731 } 687 }
732 688
733 alen = ASN1_item_i2d((ASN1_VALUE *)si->signedAttrs,&abuf, 689 alen = ASN1_item_i2d((ASN1_VALUE *)si->signedAttrs, &abuf,
734 ASN1_ITEM_rptr(CMS_Attributes_Sign)); 690 ASN1_ITEM_rptr(CMS_Attributes_Sign));
735 if(!abuf) 691 if (!abuf)
736 goto err; 692 goto err;
737 if (EVP_DigestSignUpdate(&mctx, abuf, alen) <= 0) 693 if (EVP_DigestSignUpdate(&mctx, abuf, alen) <= 0)
738 goto err; 694 goto err;
@@ -740,17 +696,16 @@ int CMS_SignerInfo_sign(CMS_SignerInfo *si)
740 goto err; 696 goto err;
741 free(abuf); 697 free(abuf);
742 abuf = malloc(siglen); 698 abuf = malloc(siglen);
743 if(!abuf) 699 if (!abuf)
744 goto err; 700 goto err;
745 if (EVP_DigestSignFinal(&mctx, abuf, &siglen) <= 0) 701 if (EVP_DigestSignFinal(&mctx, abuf, &siglen) <= 0)
746 goto err; 702 goto err;
747 703
748 if (EVP_PKEY_CTX_ctrl(pctx, -1, EVP_PKEY_OP_SIGN, 704 if (EVP_PKEY_CTX_ctrl(pctx, -1, EVP_PKEY_OP_SIGN,
749 EVP_PKEY_CTRL_CMS_SIGN, 1, si) <= 0) 705 EVP_PKEY_CTRL_CMS_SIGN, 1, si) <= 0) {
750 {
751 CMSerr(CMS_F_CMS_SIGNERINFO_SIGN, CMS_R_CTRL_ERROR); 706 CMSerr(CMS_F_CMS_SIGNERINFO_SIGN, CMS_R_CTRL_ERROR);
752 goto err; 707 goto err;
753 } 708 }
754 709
755 EVP_MD_CTX_cleanup(&mctx); 710 EVP_MD_CTX_cleanup(&mctx);
756 711
@@ -758,26 +713,25 @@ int CMS_SignerInfo_sign(CMS_SignerInfo *si)
758 713
759 return 1; 714 return 1;
760 715
761 err: 716err:
762 free(abuf); 717 free(abuf);
763 EVP_MD_CTX_cleanup(&mctx); 718 EVP_MD_CTX_cleanup(&mctx);
764 return 0; 719 return 0;
720}
765 721
766 } 722int
767 723CMS_SignerInfo_verify(CMS_SignerInfo *si)
768int CMS_SignerInfo_verify(CMS_SignerInfo *si) 724{
769 {
770 EVP_MD_CTX mctx; 725 EVP_MD_CTX mctx;
771 EVP_PKEY_CTX *pctx; 726 EVP_PKEY_CTX *pctx;
772 unsigned char *abuf = NULL; 727 unsigned char *abuf = NULL;
773 int alen, r = -1; 728 int alen, r = -1;
774 const EVP_MD *md = NULL; 729 const EVP_MD *md = NULL;
775 730
776 if (!si->pkey) 731 if (!si->pkey) {
777 {
778 CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY, CMS_R_NO_PUBLIC_KEY); 732 CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY, CMS_R_NO_PUBLIC_KEY);
779 return -1; 733 return -1;
780 } 734 }
781 735
782 md = EVP_get_digestbyobj(si->digestAlgorithm->algorithm); 736 md = EVP_get_digestbyobj(si->digestAlgorithm->algorithm);
783 if (md == NULL) 737 if (md == NULL)
@@ -786,199 +740,195 @@ int CMS_SignerInfo_verify(CMS_SignerInfo *si)
786 if (EVP_DigestVerifyInit(&mctx, &pctx, md, NULL, si->pkey) <= 0) 740 if (EVP_DigestVerifyInit(&mctx, &pctx, md, NULL, si->pkey) <= 0)
787 goto err; 741 goto err;
788 742
789 alen = ASN1_item_i2d((ASN1_VALUE *)si->signedAttrs,&abuf, 743 alen = ASN1_item_i2d((ASN1_VALUE *)si->signedAttrs, &abuf,
790 ASN1_ITEM_rptr(CMS_Attributes_Verify)); 744 ASN1_ITEM_rptr(CMS_Attributes_Verify));
791 if(!abuf) 745 if (!abuf)
792 goto err; 746 goto err;
793 r = EVP_DigestVerifyUpdate(&mctx, abuf, alen); 747 r = EVP_DigestVerifyUpdate(&mctx, abuf, alen);
794 free(abuf); 748 free(abuf);
795 if (r <= 0) 749 if (r <= 0) {
796 {
797 r = -1; 750 r = -1;
798 goto err; 751 goto err;
799 } 752 }
800 r = EVP_DigestVerifyFinal(&mctx, 753 r = EVP_DigestVerifyFinal(&mctx,
801 si->signature->data, si->signature->length); 754 si->signature->data, si->signature->length);
802 if (r <= 0) 755 if (r <= 0)
803 CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY, CMS_R_VERIFICATION_FAILURE); 756 CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY, CMS_R_VERIFICATION_FAILURE);
804 err: 757
758err:
805 EVP_MD_CTX_cleanup(&mctx); 759 EVP_MD_CTX_cleanup(&mctx);
806 return r; 760 return r;
807 } 761}
808 762
809/* Create a chain of digest BIOs from a CMS ContentInfo */ 763/* Create a chain of digest BIOs from a CMS ContentInfo */
810 764
811BIO *cms_SignedData_init_bio(CMS_ContentInfo *cms) 765BIO *
812 { 766cms_SignedData_init_bio(CMS_ContentInfo *cms)
767{
813 int i; 768 int i;
814 CMS_SignedData *sd; 769 CMS_SignedData *sd;
815 BIO *chain = NULL; 770 BIO *chain = NULL;
771
816 sd = cms_get0_signed(cms); 772 sd = cms_get0_signed(cms);
817 if (!sd) 773 if (!sd)
818 return NULL; 774 return NULL;
819 if (cms->d.signedData->encapContentInfo->partial) 775 if (cms->d.signedData->encapContentInfo->partial)
820 cms_sd_set_version(sd); 776 cms_sd_set_version(sd);
821 for (i = 0; i < sk_X509_ALGOR_num(sd->digestAlgorithms); i++) 777 for (i = 0; i < sk_X509_ALGOR_num(sd->digestAlgorithms); i++) {
822 {
823 X509_ALGOR *digestAlgorithm; 778 X509_ALGOR *digestAlgorithm;
824 BIO *mdbio; 779 BIO *mdbio;
825 digestAlgorithm = sk_X509_ALGOR_value(sd->digestAlgorithms, i); 780 digestAlgorithm = sk_X509_ALGOR_value(sd->digestAlgorithms, i);
826 mdbio = cms_DigestAlgorithm_init_bio(digestAlgorithm); 781 mdbio = cms_DigestAlgorithm_init_bio(digestAlgorithm);
827 if (!mdbio) 782 if (!mdbio)
828 goto err; 783 goto err;
829 if (chain) 784 if (chain)
830 BIO_push(chain, mdbio); 785 BIO_push(chain, mdbio);
831 else 786 else
832 chain = mdbio; 787 chain = mdbio;
833 } 788 }
834 return chain; 789 return chain;
835 err: 790
791err:
836 if (chain) 792 if (chain)
837 BIO_free_all(chain); 793 BIO_free_all(chain);
838 return NULL; 794 return NULL;
839 } 795}
840 796
841int CMS_SignerInfo_verify_content(CMS_SignerInfo *si, BIO *chain) 797int
842 { 798CMS_SignerInfo_verify_content(CMS_SignerInfo *si, BIO *chain)
799{
843 ASN1_OCTET_STRING *os = NULL; 800 ASN1_OCTET_STRING *os = NULL;
844 EVP_MD_CTX mctx; 801 EVP_MD_CTX mctx;
845 int r = -1; 802 int r = -1;
803
846 EVP_MD_CTX_init(&mctx); 804 EVP_MD_CTX_init(&mctx);
847 /* If we have any signed attributes look for messageDigest value */ 805 /* If we have any signed attributes look for messageDigest value */
848 if (CMS_signed_get_attr_count(si) >= 0) 806 if (CMS_signed_get_attr_count(si) >= 0) {
849 {
850 os = CMS_signed_get0_data_by_OBJ(si, 807 os = CMS_signed_get0_data_by_OBJ(si,
851 OBJ_nid2obj(NID_pkcs9_messageDigest), 808 OBJ_nid2obj(NID_pkcs9_messageDigest),
852 -3, V_ASN1_OCTET_STRING); 809 -3, V_ASN1_OCTET_STRING);
853 if (!os) 810 if (!os) {
854 {
855 CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY_CONTENT, 811 CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY_CONTENT,
856 CMS_R_ERROR_READING_MESSAGEDIGEST_ATTRIBUTE); 812 CMS_R_ERROR_READING_MESSAGEDIGEST_ATTRIBUTE);
857 goto err; 813 goto err;
858 }
859 } 814 }
815 }
860 816
861 if (!cms_DigestAlgorithm_find_ctx(&mctx, chain, si->digestAlgorithm)) 817 if (!cms_DigestAlgorithm_find_ctx(&mctx, chain, si->digestAlgorithm))
862 goto err; 818 goto err;
863 819
864 /* If messageDigest found compare it */ 820 /* If messageDigest found compare it */
865 821
866 if (os) 822 if (os) {
867 {
868 unsigned char mval[EVP_MAX_MD_SIZE]; 823 unsigned char mval[EVP_MAX_MD_SIZE];
869 unsigned int mlen; 824 unsigned int mlen;
870 if (EVP_DigestFinal_ex(&mctx, mval, &mlen) <= 0) 825 if (EVP_DigestFinal_ex(&mctx, mval, &mlen) <= 0) {
871 {
872 CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY_CONTENT, 826 CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY_CONTENT,
873 CMS_R_UNABLE_TO_FINALIZE_CONTEXT); 827 CMS_R_UNABLE_TO_FINALIZE_CONTEXT);
874 goto err; 828 goto err;
875 } 829 }
876 if (mlen != (unsigned int)os->length) 830 if (mlen != (unsigned int)os->length) {
877 {
878 CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY_CONTENT, 831 CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY_CONTENT,
879 CMS_R_MESSAGEDIGEST_ATTRIBUTE_WRONG_LENGTH); 832 CMS_R_MESSAGEDIGEST_ATTRIBUTE_WRONG_LENGTH);
880 goto err; 833 goto err;
881 } 834 }
882 835
883 if (memcmp(mval, os->data, mlen)) 836 if (memcmp(mval, os->data, mlen)) {
884 {
885 CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY_CONTENT, 837 CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY_CONTENT,
886 CMS_R_VERIFICATION_FAILURE); 838 CMS_R_VERIFICATION_FAILURE);
887 r = 0; 839 r = 0;
888 } 840 } else
889 else
890 r = 1; 841 r = 1;
891 } 842 } else {
892 else
893 {
894 r = EVP_VerifyFinal(&mctx, si->signature->data, 843 r = EVP_VerifyFinal(&mctx, si->signature->data,
895 si->signature->length, si->pkey); 844 si->signature->length, si->pkey);
896 if (r <= 0) 845 if (r <= 0) {
897 {
898 CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY_CONTENT, 846 CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY_CONTENT,
899 CMS_R_VERIFICATION_FAILURE); 847 CMS_R_VERIFICATION_FAILURE);
900 r = 0; 848 r = 0;
901 }
902 } 849 }
850 }
903 851
904 err: 852err:
905 EVP_MD_CTX_cleanup(&mctx); 853 EVP_MD_CTX_cleanup(&mctx);
906 return r; 854 return r;
855}
907 856
908 } 857int
909 858CMS_add_smimecap(CMS_SignerInfo *si, STACK_OF(X509_ALGOR) *algs)
910int CMS_add_smimecap(CMS_SignerInfo *si, STACK_OF(X509_ALGOR) *algs) 859{
911 {
912 unsigned char *smder = NULL; 860 unsigned char *smder = NULL;
913 int smderlen, r; 861 int smderlen, r;
862
914 smderlen = i2d_X509_ALGORS(algs, &smder); 863 smderlen = i2d_X509_ALGORS(algs, &smder);
915 if (smderlen <= 0) 864 if (smderlen <= 0)
916 return 0; 865 return 0;
917 r = CMS_signed_add1_attr_by_NID(si, NID_SMIMECapabilities, 866 r = CMS_signed_add1_attr_by_NID(si, NID_SMIMECapabilities,
918 V_ASN1_SEQUENCE, smder, smderlen); 867 V_ASN1_SEQUENCE, smder, smderlen);
919 free(smder); 868 free(smder);
920 return r; 869 return r;
921 } 870}
922 871
923int CMS_add_simple_smimecap(STACK_OF(X509_ALGOR) **algs, 872int
924 int algnid, int keysize) 873CMS_add_simple_smimecap(STACK_OF(X509_ALGOR) **algs, int algnid, int keysize)
925 { 874{
926 X509_ALGOR *alg; 875 X509_ALGOR *alg;
927 ASN1_INTEGER *key = NULL; 876 ASN1_INTEGER *key = NULL;
928 if (keysize > 0) 877
929 { 878 if (keysize > 0) {
930 key = ASN1_INTEGER_new(); 879 key = ASN1_INTEGER_new();
931 if (!key || !ASN1_INTEGER_set(key, keysize)) 880 if (!key || !ASN1_INTEGER_set(key, keysize))
932 return 0; 881 return 0;
933 } 882 }
934 alg = X509_ALGOR_new(); 883 alg = X509_ALGOR_new();
935 if (!alg) 884 if (!alg) {
936 {
937 if (key) 885 if (key)
938 ASN1_INTEGER_free(key); 886 ASN1_INTEGER_free(key);
939 return 0; 887 return 0;
940 } 888 }
941 889
942 X509_ALGOR_set0(alg, OBJ_nid2obj(algnid), 890 X509_ALGOR_set0(alg, OBJ_nid2obj(algnid),
943 key ? V_ASN1_INTEGER : V_ASN1_UNDEF, key); 891 key ? V_ASN1_INTEGER : V_ASN1_UNDEF, key);
944 if (!*algs) 892 if (!*algs)
945 *algs = sk_X509_ALGOR_new_null(); 893 *algs = sk_X509_ALGOR_new_null();
946 if (!*algs || !sk_X509_ALGOR_push(*algs, alg)) 894 if (!*algs || !sk_X509_ALGOR_push(*algs, alg)) {
947 {
948 X509_ALGOR_free(alg); 895 X509_ALGOR_free(alg);
949 return 0; 896 return 0;
950 }
951 return 1;
952 } 897 }
898 return 1;
899}
953 900
954/* Check to see if a cipher exists and if so add S/MIME capabilities */ 901/* Check to see if a cipher exists and if so add S/MIME capabilities */
955 902
956static int cms_add_cipher_smcap(STACK_OF(X509_ALGOR) **sk, int nid, int arg) 903static int
957 { 904cms_add_cipher_smcap(STACK_OF(X509_ALGOR) **sk, int nid, int arg)
905{
958 if (EVP_get_cipherbynid(nid)) 906 if (EVP_get_cipherbynid(nid))
959 return CMS_add_simple_smimecap(sk, nid, arg); 907 return CMS_add_simple_smimecap(sk, nid, arg);
960 return 1; 908 return 1;
961 } 909}
962 910
963static int cms_add_digest_smcap(STACK_OF(X509_ALGOR) **sk, int nid, int arg) 911static int
964 { 912cms_add_digest_smcap(STACK_OF(X509_ALGOR) **sk, int nid, int arg)
913{
965 if (EVP_get_digestbynid(nid)) 914 if (EVP_get_digestbynid(nid))
966 return CMS_add_simple_smimecap(sk, nid, arg); 915 return CMS_add_simple_smimecap(sk, nid, arg);
967 return 1; 916 return 1;
968 } 917}
969 918
970int CMS_add_standard_smimecap(STACK_OF(X509_ALGOR) **smcap) 919int
971 { 920CMS_add_standard_smimecap(STACK_OF(X509_ALGOR) **smcap)
972 if (!cms_add_cipher_smcap(smcap, NID_aes_256_cbc, -1) 921{
973 || !cms_add_digest_smcap(smcap, NID_id_GostR3411_94, -1) 922 if (!cms_add_cipher_smcap(smcap, NID_aes_256_cbc, -1) ||
974 || !cms_add_cipher_smcap(smcap, NID_id_Gost28147_89, -1) 923 !cms_add_digest_smcap(smcap, NID_id_GostR3411_94, -1) ||
975 || !cms_add_cipher_smcap(smcap, NID_aes_192_cbc, -1) 924 !cms_add_cipher_smcap(smcap, NID_id_Gost28147_89, -1) ||
976 || !cms_add_cipher_smcap(smcap, NID_aes_128_cbc, -1) 925 !cms_add_cipher_smcap(smcap, NID_aes_192_cbc, -1) ||
977 || !cms_add_cipher_smcap(smcap, NID_des_ede3_cbc, -1) 926 !cms_add_cipher_smcap(smcap, NID_aes_128_cbc, -1) ||
978 || !cms_add_cipher_smcap(smcap, NID_rc2_cbc, 128) 927 !cms_add_cipher_smcap(smcap, NID_des_ede3_cbc, -1) ||
979 || !cms_add_cipher_smcap(smcap, NID_rc2_cbc, 64) 928 !cms_add_cipher_smcap(smcap, NID_rc2_cbc, 128) ||
980 || !cms_add_cipher_smcap(smcap, NID_des_cbc, -1) 929 !cms_add_cipher_smcap(smcap, NID_rc2_cbc, 64) ||
981 || !cms_add_cipher_smcap(smcap, NID_rc2_cbc, 40)) 930 !cms_add_cipher_smcap(smcap, NID_des_cbc, -1) ||
931 !cms_add_cipher_smcap(smcap, NID_rc2_cbc, 40))
982 return 0; 932 return 0;
983 return 1; 933 return 1;
984 } 934}
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-08-20 20:34:43 +0000