summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/cms/cms_sd.c
diff options
context:
space:
mode:
Diffstat (limited to 'src/lib/libcrypto/cms/cms_sd.c')
-rw-r--r--src/lib/libcrypto/cms/cms_sd.c276
1 files changed, 163 insertions, 113 deletions
diff --git a/src/lib/libcrypto/cms/cms_sd.c b/src/lib/libcrypto/cms/cms_sd.c
index 57a92b59e3..6c65844c93 100644
--- a/src/lib/libcrypto/cms/cms_sd.c
+++ b/src/lib/libcrypto/cms/cms_sd.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: cms_sd.c,v 1.16 2019/08/10 16:42:20 jsing Exp $ */ 1/* $OpenBSD: cms_sd.c,v 1.17 2019/08/10 18:15:52 jsing Exp $ */
2/* 2/*
3 * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL 3 * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
4 * project. 4 * project.
@@ -65,7 +65,8 @@
65 65
66/* CMS SignedData Utilities */ 66/* CMS SignedData Utilities */
67 67
68static CMS_SignedData *cms_get0_signed(CMS_ContentInfo *cms) 68static CMS_SignedData *
69cms_get0_signed(CMS_ContentInfo *cms)
69{ 70{
70 if (OBJ_obj2nid(cms->contentType) != NID_pkcs7_signed) { 71 if (OBJ_obj2nid(cms->contentType) != NID_pkcs7_signed) {
71 CMSerr(CMS_F_CMS_GET0_SIGNED, CMS_R_CONTENT_TYPE_NOT_SIGNED_DATA); 72 CMSerr(CMS_F_CMS_GET0_SIGNED, CMS_R_CONTENT_TYPE_NOT_SIGNED_DATA);
@@ -74,7 +75,8 @@ static CMS_SignedData *cms_get0_signed(CMS_ContentInfo *cms)
74 return cms->d.signedData; 75 return cms->d.signedData;
75} 76}
76 77
77static CMS_SignedData *cms_signed_data_init(CMS_ContentInfo *cms) 78static CMS_SignedData *
79cms_signed_data_init(CMS_ContentInfo *cms)
78{ 80{
79 if (cms->d.other == NULL) { 81 if (cms->d.other == NULL) {
80 cms->d.signedData = M_ASN1_new_of(CMS_SignedData); 82 cms->d.signedData = M_ASN1_new_of(CMS_SignedData);
@@ -84,7 +86,7 @@ static CMS_SignedData *cms_signed_data_init(CMS_ContentInfo *cms)
84 } 86 }
85 cms->d.signedData->version = 1; 87 cms->d.signedData->version = 1;
86 cms->d.signedData->encapContentInfo->eContentType = 88 cms->d.signedData->encapContentInfo->eContentType =
87 OBJ_nid2obj(NID_pkcs7_data); 89 OBJ_nid2obj(NID_pkcs7_data);
88 cms->d.signedData->encapContentInfo->partial = 1; 90 cms->d.signedData->encapContentInfo->partial = 1;
89 ASN1_OBJECT_free(cms->contentType); 91 ASN1_OBJECT_free(cms->contentType);
90 cms->contentType = OBJ_nid2obj(NID_pkcs7_signed); 92 cms->contentType = OBJ_nid2obj(NID_pkcs7_signed);
@@ -95,7 +97,8 @@ static CMS_SignedData *cms_signed_data_init(CMS_ContentInfo *cms)
95 97
96/* Just initialise SignedData e.g. for certs only structure */ 98/* Just initialise SignedData e.g. for certs only structure */
97 99
98int CMS_SignedData_init(CMS_ContentInfo *cms) 100int
101CMS_SignedData_init(CMS_ContentInfo *cms)
99{ 102{
100 if (cms_signed_data_init(cms)) 103 if (cms_signed_data_init(cms))
101 return 1; 104 return 1;
@@ -105,7 +108,8 @@ int CMS_SignedData_init(CMS_ContentInfo *cms)
105 108
106/* Check structures and fixup version numbers (if necessary) */ 109/* Check structures and fixup version numbers (if necessary) */
107 110
108static void cms_sd_set_version(CMS_SignedData *sd) 111static void
112cms_sd_set_version(CMS_SignedData *sd)
109{ 113{
110 int i; 114 int i;
111 CMS_CertificateChoices *cch; 115 CMS_CertificateChoices *cch;
@@ -151,16 +155,17 @@ static void cms_sd_set_version(CMS_SignedData *sd)
151 155
152 if (sd->version < 1) 156 if (sd->version < 1)
153 sd->version = 1; 157 sd->version = 1;
154
155} 158}
156 159
157/* Copy an existing messageDigest value */ 160/* Copy an existing messageDigest value */
158 161
159static int cms_copy_messageDigest(CMS_ContentInfo *cms, CMS_SignerInfo *si) 162static int
163cms_copy_messageDigest(CMS_ContentInfo *cms, CMS_SignerInfo *si)
160{ 164{
161 STACK_OF(CMS_SignerInfo) *sinfos; 165 STACK_OF(CMS_SignerInfo) *sinfos;
162 CMS_SignerInfo *sitmp; 166 CMS_SignerInfo *sitmp;
163 int i; 167 int i;
168
164 sinfos = CMS_get0_SignerInfos(cms); 169 sinfos = CMS_get0_SignerInfos(cms);
165 for (i = 0; i < sk_CMS_SignerInfo_num(sinfos); i++) { 170 for (i = 0; i < sk_CMS_SignerInfo_num(sinfos); i++) {
166 ASN1_OCTET_STRING *messageDigest; 171 ASN1_OCTET_STRING *messageDigest;
@@ -170,30 +175,30 @@ static int cms_copy_messageDigest(CMS_ContentInfo *cms, CMS_SignerInfo *si)
170 if (CMS_signed_get_attr_count(sitmp) < 0) 175 if (CMS_signed_get_attr_count(sitmp) < 0)
171 continue; 176 continue;
172 if (OBJ_cmp(si->digestAlgorithm->algorithm, 177 if (OBJ_cmp(si->digestAlgorithm->algorithm,
173 sitmp->digestAlgorithm->algorithm)) 178 sitmp->digestAlgorithm->algorithm))
174 continue; 179 continue;
175 messageDigest = CMS_signed_get0_data_by_OBJ(sitmp, 180 messageDigest = CMS_signed_get0_data_by_OBJ(sitmp,
176 OBJ_nid2obj 181 OBJ_nid2obj(NID_pkcs9_messageDigest), -3, V_ASN1_OCTET_STRING);
177 (NID_pkcs9_messageDigest),
178 -3, V_ASN1_OCTET_STRING);
179 if (!messageDigest) { 182 if (!messageDigest) {
180 CMSerr(CMS_F_CMS_COPY_MESSAGEDIGEST, 183 CMSerr(CMS_F_CMS_COPY_MESSAGEDIGEST,
181 CMS_R_ERROR_READING_MESSAGEDIGEST_ATTRIBUTE); 184 CMS_R_ERROR_READING_MESSAGEDIGEST_ATTRIBUTE);
182 return 0; 185 return 0;
183 } 186 }
184 187
185 if (CMS_signed_add1_attr_by_NID(si, NID_pkcs9_messageDigest, 188 if (CMS_signed_add1_attr_by_NID(si, NID_pkcs9_messageDigest,
186 V_ASN1_OCTET_STRING, 189 V_ASN1_OCTET_STRING, messageDigest, -1))
187 messageDigest, -1))
188 return 1; 190 return 1;
189 else 191 else
190 return 0; 192 return 0;
191 } 193 }
194
192 CMSerr(CMS_F_CMS_COPY_MESSAGEDIGEST, CMS_R_NO_MATCHING_DIGEST); 195 CMSerr(CMS_F_CMS_COPY_MESSAGEDIGEST, CMS_R_NO_MATCHING_DIGEST);
196
193 return 0; 197 return 0;
194} 198}
195 199
196int cms_set1_SignerIdentifier(CMS_SignerIdentifier *sid, X509 *cert, int type) 200int
201cms_set1_SignerIdentifier(CMS_SignerIdentifier *sid, X509 *cert, int type)
197{ 202{
198 switch (type) { 203 switch (type) {
199 case CMS_SIGNERINFO_ISSUER_SERIAL: 204 case CMS_SIGNERINFO_ISSUER_SERIAL:
@@ -216,10 +221,9 @@ int cms_set1_SignerIdentifier(CMS_SignerIdentifier *sid, X509 *cert, int type)
216 return 1; 221 return 1;
217} 222}
218 223
219int cms_SignerIdentifier_get0_signer_id(CMS_SignerIdentifier *sid, 224int
220 ASN1_OCTET_STRING **keyid, 225cms_SignerIdentifier_get0_signer_id(CMS_SignerIdentifier *sid,
221 X509_NAME **issuer, 226 ASN1_OCTET_STRING **keyid, X509_NAME **issuer, ASN1_INTEGER **sno)
222 ASN1_INTEGER **sno)
223{ 227{
224 if (sid->type == CMS_SIGNERINFO_ISSUER_SERIAL) { 228 if (sid->type == CMS_SIGNERINFO_ISSUER_SERIAL) {
225 if (issuer) 229 if (issuer)
@@ -231,10 +235,12 @@ int cms_SignerIdentifier_get0_signer_id(CMS_SignerIdentifier *sid,
231 *keyid = sid->d.subjectKeyIdentifier; 235 *keyid = sid->d.subjectKeyIdentifier;
232 } else 236 } else
233 return 0; 237 return 0;
238
234 return 1; 239 return 1;
235} 240}
236 241
237int cms_SignerIdentifier_cert_cmp(CMS_SignerIdentifier *sid, X509 *cert) 242int
243cms_SignerIdentifier_cert_cmp(CMS_SignerIdentifier *sid, X509 *cert)
238{ 244{
239 if (sid->type == CMS_SIGNERINFO_ISSUER_SERIAL) 245 if (sid->type == CMS_SIGNERINFO_ISSUER_SERIAL)
240 return cms_ias_cert_cmp(sid->d.issuerAndSerialNumber, cert); 246 return cms_ias_cert_cmp(sid->d.issuerAndSerialNumber, cert);
@@ -244,10 +250,12 @@ int cms_SignerIdentifier_cert_cmp(CMS_SignerIdentifier *sid, X509 *cert)
244 return -1; 250 return -1;
245} 251}
246 252
247static int cms_sd_asn1_ctrl(CMS_SignerInfo *si, int cmd) 253static int
254cms_sd_asn1_ctrl(CMS_SignerInfo *si, int cmd)
248{ 255{
249 EVP_PKEY *pkey = si->pkey; 256 EVP_PKEY *pkey = si->pkey;
250 int i; 257 int i;
258
251 if (!pkey->ameth || !pkey->ameth->pkey_ctrl) 259 if (!pkey->ameth || !pkey->ameth->pkey_ctrl)
252 return 1; 260 return 1;
253 i = pkey->ameth->pkey_ctrl(pkey, ASN1_PKEY_CTRL_CMS_SIGN, cmd, si); 261 i = pkey->ameth->pkey_ctrl(pkey, ASN1_PKEY_CTRL_CMS_SIGN, cmd, si);
@@ -259,20 +267,22 @@ static int cms_sd_asn1_ctrl(CMS_SignerInfo *si, int cmd)
259 CMSerr(CMS_F_CMS_SD_ASN1_CTRL, CMS_R_CTRL_FAILURE); 267 CMSerr(CMS_F_CMS_SD_ASN1_CTRL, CMS_R_CTRL_FAILURE);
260 return 0; 268 return 0;
261 } 269 }
270
262 return 1; 271 return 1;
263} 272}
264 273
265CMS_SignerInfo *CMS_add1_signer(CMS_ContentInfo *cms, 274CMS_SignerInfo *
266 X509 *signer, EVP_PKEY *pk, const EVP_MD *md, 275CMS_add1_signer(CMS_ContentInfo *cms, X509 *signer, EVP_PKEY *pk,
267 unsigned int flags) 276 const EVP_MD *md, unsigned int flags)
268{ 277{
269 CMS_SignedData *sd; 278 CMS_SignedData *sd;
270 CMS_SignerInfo *si = NULL; 279 CMS_SignerInfo *si = NULL;
271 X509_ALGOR *alg; 280 X509_ALGOR *alg;
272 int i, type; 281 int i, type;
282
273 if (!X509_check_private_key(signer, pk)) { 283 if (!X509_check_private_key(signer, pk)) {
274 CMSerr(CMS_F_CMS_ADD1_SIGNER, 284 CMSerr(CMS_F_CMS_ADD1_SIGNER,
275 CMS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE); 285 CMS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE);
276 return NULL; 286 return NULL;
277 } 287 }
278 sd = cms_signed_data_init(cms); 288 sd = cms_signed_data_init(cms);
@@ -358,24 +368,25 @@ CMS_SignerInfo *CMS_add1_signer(CMS_ContentInfo *cms,
358 if (!si->signedAttrs) { 368 if (!si->signedAttrs) {
359 si->signedAttrs = sk_X509_ATTRIBUTE_new_null(); 369 si->signedAttrs = sk_X509_ATTRIBUTE_new_null();
360 if (!si->signedAttrs) 370 if (!si->signedAttrs)
361 goto merr; 371 goto merr;
362 } 372 }
363 373
364 if (!(flags & CMS_NOSMIMECAP)) { 374 if (!(flags & CMS_NOSMIMECAP)) {
365 STACK_OF(X509_ALGOR) *smcap = NULL; 375 STACK_OF(X509_ALGOR) *smcap = NULL;
376
366 i = CMS_add_standard_smimecap(&smcap); 377 i = CMS_add_standard_smimecap(&smcap);
367 if (i) 378 if (i)
368 i = CMS_add_smimecap(si, smcap); 379 i = CMS_add_smimecap(si, smcap);
369 sk_X509_ALGOR_pop_free(smcap, X509_ALGOR_free); 380 sk_X509_ALGOR_pop_free(smcap, X509_ALGOR_free);
370 if (!i) 381 if (!i)
371 goto merr; 382 goto merr;
372 } 383 }
373 if (flags & CMS_REUSE_DIGEST) { 384 if (flags & CMS_REUSE_DIGEST) {
374 if (!cms_copy_messageDigest(cms, si)) 385 if (!cms_copy_messageDigest(cms, si))
375 goto err; 386 goto err;
376 if (!(flags & (CMS_PARTIAL | CMS_KEY_PARAM)) && 387 if (!(flags & (CMS_PARTIAL | CMS_KEY_PARAM)) &&
377 !CMS_SignerInfo_sign(si)) 388 !CMS_SignerInfo_sign(si))
378 goto err; 389 goto err;
379 } 390 }
380 } 391 }
381 392
@@ -389,13 +400,13 @@ CMS_SignerInfo *CMS_add1_signer(CMS_ContentInfo *cms,
389 if (flags & CMS_NOATTR) { 400 if (flags & CMS_NOATTR) {
390 si->pctx = EVP_PKEY_CTX_new(si->pkey, NULL); 401 si->pctx = EVP_PKEY_CTX_new(si->pkey, NULL);
391 if (si->pctx == NULL) 402 if (si->pctx == NULL)
392 goto err; 403 goto err;
393 if (EVP_PKEY_sign_init(si->pctx) <= 0) 404 if (EVP_PKEY_sign_init(si->pctx) <= 0)
394 goto err; 405 goto err;
395 if (EVP_PKEY_CTX_set_signature_md(si->pctx, md) <= 0) 406 if (EVP_PKEY_CTX_set_signature_md(si->pctx, md) <= 0)
396 goto err; 407 goto err;
397 } else if (EVP_DigestSignInit(si->mctx, &si->pctx, md, NULL, pk) <= 408 } else if (EVP_DigestSignInit(si->mctx, &si->pctx, md,
398 0) 409 NULL, pk) <= 0)
399 goto err; 410 goto err;
400 } 411 }
401 412
@@ -410,14 +421,16 @@ CMS_SignerInfo *CMS_add1_signer(CMS_ContentInfo *cms,
410 CMSerr(CMS_F_CMS_ADD1_SIGNER, ERR_R_MALLOC_FAILURE); 421 CMSerr(CMS_F_CMS_ADD1_SIGNER, ERR_R_MALLOC_FAILURE);
411 err: 422 err:
412 M_ASN1_free_of(si, CMS_SignerInfo); 423 M_ASN1_free_of(si, CMS_SignerInfo);
413 return NULL;
414 424
425 return NULL;
415} 426}
416 427
417static int cms_add1_signingTime(CMS_SignerInfo *si, ASN1_TIME *t) 428static int
429cms_add1_signingTime(CMS_SignerInfo *si, ASN1_TIME *t)
418{ 430{
419 ASN1_TIME *tt; 431 ASN1_TIME *tt;
420 int r = 0; 432 int r = 0;
433
421 if (t) 434 if (t)
422 tt = t; 435 tt = t;
423 else 436 else
@@ -433,61 +446,67 @@ static int cms_add1_signingTime(CMS_SignerInfo *si, ASN1_TIME *t)
433 r = 1; 446 r = 1;
434 447
435 merr: 448 merr:
436
437 if (!t) 449 if (!t)
438 ASN1_TIME_free(tt); 450 ASN1_TIME_free(tt);
439
440 if (!r) 451 if (!r)
441 CMSerr(CMS_F_CMS_ADD1_SIGNINGTIME, ERR_R_MALLOC_FAILURE); 452 CMSerr(CMS_F_CMS_ADD1_SIGNINGTIME, ERR_R_MALLOC_FAILURE);
442 453
443 return r; 454 return r;
444
445} 455}
446 456
447EVP_PKEY_CTX *CMS_SignerInfo_get0_pkey_ctx(CMS_SignerInfo *si) 457EVP_PKEY_CTX *
458CMS_SignerInfo_get0_pkey_ctx(CMS_SignerInfo *si)
448{ 459{
449 return si->pctx; 460 return si->pctx;
450} 461}
451 462
452EVP_MD_CTX *CMS_SignerInfo_get0_md_ctx(CMS_SignerInfo *si) 463EVP_MD_CTX *
464CMS_SignerInfo_get0_md_ctx(CMS_SignerInfo *si)
453{ 465{
454 return si->mctx; 466 return si->mctx;
455} 467}
456 468
457STACK_OF(CMS_SignerInfo) *CMS_get0_SignerInfos(CMS_ContentInfo *cms) 469STACK_OF(CMS_SignerInfo) *
470CMS_get0_SignerInfos(CMS_ContentInfo *cms)
458{ 471{
459 CMS_SignedData *sd; 472 CMS_SignedData *sd;
473
460 sd = cms_get0_signed(cms); 474 sd = cms_get0_signed(cms);
461 if (!sd) 475 if (!sd)
462 return NULL; 476 return NULL;
477
463 return sd->signerInfos; 478 return sd->signerInfos;
464} 479}
465 480
466STACK_OF(X509) *CMS_get0_signers(CMS_ContentInfo *cms) 481STACK_OF(X509) *
482CMS_get0_signers(CMS_ContentInfo *cms)
467{ 483{
468 STACK_OF(X509) *signers = NULL; 484 STACK_OF(X509) *signers = NULL;
469 STACK_OF(CMS_SignerInfo) *sinfos; 485 STACK_OF(CMS_SignerInfo) *sinfos;
470 CMS_SignerInfo *si; 486 CMS_SignerInfo *si;
471 int i; 487 int i;
488
472 sinfos = CMS_get0_SignerInfos(cms); 489 sinfos = CMS_get0_SignerInfos(cms);
473 for (i = 0; i < sk_CMS_SignerInfo_num(sinfos); i++) { 490 for (i = 0; i < sk_CMS_SignerInfo_num(sinfos); i++) {
474 si = sk_CMS_SignerInfo_value(sinfos, i); 491 si = sk_CMS_SignerInfo_value(sinfos, i);
475 if (si->signer) { 492 if (si->signer) {
476 if (!signers) { 493 if (!signers) {
477 signers = sk_X509_new_null(); 494 signers = sk_X509_new_null();
478 if (!signers) 495 if (!signers)
479 return NULL; 496 return NULL;
480 } 497 }
481 if (!sk_X509_push(signers, si->signer)) { 498 if (!sk_X509_push(signers, si->signer)) {
482 sk_X509_free(signers); 499 sk_X509_free(signers);
483 return NULL; 500 return NULL;
484 } 501 }
485 } 502 }
486 } 503 }
504
487 return signers; 505 return signers;
488} 506}
489 507
490void CMS_SignerInfo_set1_signer_cert(CMS_SignerInfo *si, X509 *signer) 508void
509CMS_SignerInfo_set1_signer_cert(CMS_SignerInfo *si, X509 *signer)
491{ 510{
492 if (signer) { 511 if (signer) {
493 X509_up_ref(signer); 512 X509_up_ref(signer);
@@ -498,20 +517,22 @@ void CMS_SignerInfo_set1_signer_cert(CMS_SignerInfo *si, X509 *signer)
498 si->signer = signer; 517 si->signer = signer;
499} 518}
500 519
501int CMS_SignerInfo_get0_signer_id(CMS_SignerInfo *si, 520int
502 ASN1_OCTET_STRING **keyid, 521CMS_SignerInfo_get0_signer_id(CMS_SignerInfo *si, ASN1_OCTET_STRING **keyid,
503 X509_NAME **issuer, ASN1_INTEGER **sno) 522 X509_NAME **issuer, ASN1_INTEGER **sno)
504{ 523{
505 return cms_SignerIdentifier_get0_signer_id(si->sid, keyid, issuer, sno); 524 return cms_SignerIdentifier_get0_signer_id(si->sid, keyid, issuer, sno);
506} 525}
507 526
508int CMS_SignerInfo_cert_cmp(CMS_SignerInfo *si, X509 *cert) 527int
528CMS_SignerInfo_cert_cmp(CMS_SignerInfo *si, X509 *cert)
509{ 529{
510 return cms_SignerIdentifier_cert_cmp(si->sid, cert); 530 return cms_SignerIdentifier_cert_cmp(si->sid, cert);
511} 531}
512 532
513int CMS_set1_signers_certs(CMS_ContentInfo *cms, STACK_OF(X509) *scerts, 533int
514 unsigned int flags) 534CMS_set1_signers_certs(CMS_ContentInfo *cms, STACK_OF(X509) *scerts,
535 unsigned int flags)
515{ 536{
516 CMS_SignedData *sd; 537 CMS_SignedData *sd;
517 CMS_SignerInfo *si; 538 CMS_SignerInfo *si;
@@ -520,6 +541,7 @@ int CMS_set1_signers_certs(CMS_ContentInfo *cms, STACK_OF(X509) *scerts,
520 X509 *x; 541 X509 *x;
521 int i, j; 542 int i, j;
522 int ret = 0; 543 int ret = 0;
544
523 sd = cms_get0_signed(cms); 545 sd = cms_get0_signed(cms);
524 if (!sd) 546 if (!sd)
525 return -1; 547 return -1;
@@ -532,9 +554,9 @@ int CMS_set1_signers_certs(CMS_ContentInfo *cms, STACK_OF(X509) *scerts,
532 for (j = 0; j < sk_X509_num(scerts); j++) { 554 for (j = 0; j < sk_X509_num(scerts); j++) {
533 x = sk_X509_value(scerts, j); 555 x = sk_X509_value(scerts, j);
534 if (CMS_SignerInfo_cert_cmp(si, x) == 0) { 556 if (CMS_SignerInfo_cert_cmp(si, x) == 0) {
535 CMS_SignerInfo_set1_signer_cert(si, x); 557 CMS_SignerInfo_set1_signer_cert(si, x);
536 ret++; 558 ret++;
537 break; 559 break;
538 } 560 }
539 } 561 }
540 562
@@ -544,21 +566,21 @@ int CMS_set1_signers_certs(CMS_ContentInfo *cms, STACK_OF(X509) *scerts,
544 for (j = 0; j < sk_CMS_CertificateChoices_num(certs); j++) { 566 for (j = 0; j < sk_CMS_CertificateChoices_num(certs); j++) {
545 cch = sk_CMS_CertificateChoices_value(certs, j); 567 cch = sk_CMS_CertificateChoices_value(certs, j);
546 if (cch->type != 0) 568 if (cch->type != 0)
547 continue; 569 continue;
548 x = cch->d.certificate; 570 x = cch->d.certificate;
549 if (CMS_SignerInfo_cert_cmp(si, x) == 0) { 571 if (CMS_SignerInfo_cert_cmp(si, x) == 0) {
550 CMS_SignerInfo_set1_signer_cert(si, x); 572 CMS_SignerInfo_set1_signer_cert(si, x);
551 ret++; 573 ret++;
552 break; 574 break;
553 } 575 }
554 } 576 }
555 } 577 }
556 return ret; 578 return ret;
557} 579}
558 580
559void CMS_SignerInfo_get0_algs(CMS_SignerInfo *si, EVP_PKEY **pk, 581void
560 X509 **signer, X509_ALGOR **pdig, 582CMS_SignerInfo_get0_algs(CMS_SignerInfo *si, EVP_PKEY **pk, X509 **signer,
561 X509_ALGOR **psig) 583X509_ALGOR **pdig, X509_ALGOR **psig)
562{ 584{
563 if (pk) 585 if (pk)
564 *pk = si->pkey; 586 *pk = si->pkey;
@@ -570,13 +592,14 @@ void CMS_SignerInfo_get0_algs(CMS_SignerInfo *si, EVP_PKEY **pk,
570 *psig = si->signatureAlgorithm; 592 *psig = si->signatureAlgorithm;
571} 593}
572 594
573ASN1_OCTET_STRING *CMS_SignerInfo_get0_signature(CMS_SignerInfo *si) 595ASN1_OCTET_STRING *
596CMS_SignerInfo_get0_signature(CMS_SignerInfo *si)
574{ 597{
575 return si->signature; 598 return si->signature;
576} 599}
577 600
578static int cms_SignerInfo_content_sign(CMS_ContentInfo *cms, 601static int
579 CMS_SignerInfo *si, BIO *chain) 602cms_SignerInfo_content_sign(CMS_ContentInfo *cms, CMS_SignerInfo *si, BIO *chain)
580{ 603{
581 EVP_MD_CTX *mctx = EVP_MD_CTX_new(); 604 EVP_MD_CTX *mctx = EVP_MD_CTX_new();
582 int r = 0; 605 int r = 0;
@@ -604,17 +627,18 @@ static int cms_SignerInfo_content_sign(CMS_ContentInfo *cms,
604 627
605 if (CMS_signed_get_attr_count(si) >= 0) { 628 if (CMS_signed_get_attr_count(si) >= 0) {
606 ASN1_OBJECT *ctype = 629 ASN1_OBJECT *ctype =
607 cms->d.signedData->encapContentInfo->eContentType; 630 cms->d.signedData->encapContentInfo->eContentType;
608 unsigned char md[EVP_MAX_MD_SIZE]; 631 unsigned char md[EVP_MAX_MD_SIZE];
609 unsigned int mdlen; 632 unsigned int mdlen;
633
610 if (!EVP_DigestFinal_ex(mctx, md, &mdlen)) 634 if (!EVP_DigestFinal_ex(mctx, md, &mdlen))
611 goto err; 635 goto err;
612 if (!CMS_signed_add1_attr_by_NID(si, NID_pkcs9_messageDigest, 636 if (!CMS_signed_add1_attr_by_NID(si, NID_pkcs9_messageDigest,
613 V_ASN1_OCTET_STRING, md, mdlen)) 637 V_ASN1_OCTET_STRING, md, mdlen))
614 goto err; 638 goto err;
615 /* Copy content type across */ 639 /* Copy content type across */
616 if (CMS_signed_add1_attr_by_NID(si, NID_pkcs9_contentType, 640 if (CMS_signed_add1_attr_by_NID(si, NID_pkcs9_contentType,
617 V_ASN1_OBJECT, ctype, -1) <= 0) 641 V_ASN1_OBJECT, ctype, -1) <= 0)
618 goto err; 642 goto err;
619 if (!CMS_SignerInfo_sign(si)) 643 if (!CMS_SignerInfo_sign(si))
620 goto err; 644 goto err;
@@ -623,6 +647,7 @@ static int cms_SignerInfo_content_sign(CMS_ContentInfo *cms,
623 size_t siglen; 647 size_t siglen;
624 unsigned char md[EVP_MAX_MD_SIZE]; 648 unsigned char md[EVP_MAX_MD_SIZE];
625 unsigned int mdlen; 649 unsigned int mdlen;
650
626 pctx = si->pctx; 651 pctx = si->pctx;
627 if (!EVP_DigestFinal_ex(mctx, md, &mdlen)) 652 if (!EVP_DigestFinal_ex(mctx, md, &mdlen))
628 goto err; 653 goto err;
@@ -640,6 +665,7 @@ static int cms_SignerInfo_content_sign(CMS_ContentInfo *cms,
640 } else { 665 } else {
641 unsigned char *sig; 666 unsigned char *sig;
642 unsigned int siglen; 667 unsigned int siglen;
668
643 sig = OPENSSL_malloc(EVP_PKEY_size(si->pkey)); 669 sig = OPENSSL_malloc(EVP_PKEY_size(si->pkey));
644 if (sig == NULL) { 670 if (sig == NULL) {
645 CMSerr(CMS_F_CMS_SIGNERINFO_CONTENT_SIGN, ERR_R_MALLOC_FAILURE); 671 CMSerr(CMS_F_CMS_SIGNERINFO_CONTENT_SIGN, ERR_R_MALLOC_FAILURE);
@@ -658,15 +684,17 @@ static int cms_SignerInfo_content_sign(CMS_ContentInfo *cms,
658 err: 684 err:
659 EVP_MD_CTX_free(mctx); 685 EVP_MD_CTX_free(mctx);
660 EVP_PKEY_CTX_free(pctx); 686 EVP_PKEY_CTX_free(pctx);
661 return r;
662 687
688 return r;
663} 689}
664 690
665int cms_SignedData_final(CMS_ContentInfo *cms, BIO *chain) 691int
692cms_SignedData_final(CMS_ContentInfo *cms, BIO *chain)
666{ 693{
667 STACK_OF(CMS_SignerInfo) *sinfos; 694 STACK_OF(CMS_SignerInfo) *sinfos;
668 CMS_SignerInfo *si; 695 CMS_SignerInfo *si;
669 int i; 696 int i;
697
670 sinfos = CMS_get0_SignerInfos(cms); 698 sinfos = CMS_get0_SignerInfos(cms);
671 for (i = 0; i < sk_CMS_SignerInfo_num(sinfos); i++) { 699 for (i = 0; i < sk_CMS_SignerInfo_num(sinfos); i++) {
672 si = sk_CMS_SignerInfo_value(sinfos, i); 700 si = sk_CMS_SignerInfo_value(sinfos, i);
@@ -674,10 +702,12 @@ int cms_SignedData_final(CMS_ContentInfo *cms, BIO *chain)
674 return 0; 702 return 0;
675 } 703 }
676 cms->d.signedData->encapContentInfo->partial = 0; 704 cms->d.signedData->encapContentInfo->partial = 0;
705
677 return 1; 706 return 1;
678} 707}
679 708
680int CMS_SignerInfo_sign(CMS_SignerInfo *si) 709int
710CMS_SignerInfo_sign(CMS_SignerInfo *si)
681{ 711{
682 EVP_MD_CTX *mctx = si->mctx; 712 EVP_MD_CTX *mctx = si->mctx;
683 EVP_PKEY_CTX *pctx = NULL; 713 EVP_PKEY_CTX *pctx = NULL;
@@ -705,13 +735,13 @@ int CMS_SignerInfo_sign(CMS_SignerInfo *si)
705 } 735 }
706 736
707 if (EVP_PKEY_CTX_ctrl(pctx, -1, EVP_PKEY_OP_SIGN, 737 if (EVP_PKEY_CTX_ctrl(pctx, -1, EVP_PKEY_OP_SIGN,
708 EVP_PKEY_CTRL_CMS_SIGN, 0, si) <= 0) { 738 EVP_PKEY_CTRL_CMS_SIGN, 0, si) <= 0) {
709 CMSerr(CMS_F_CMS_SIGNERINFO_SIGN, CMS_R_CTRL_ERROR); 739 CMSerr(CMS_F_CMS_SIGNERINFO_SIGN, CMS_R_CTRL_ERROR);
710 goto err; 740 goto err;
711 } 741 }
712 742
713 alen = ASN1_item_i2d((ASN1_VALUE *)si->signedAttrs, &abuf, 743 alen = ASN1_item_i2d((ASN1_VALUE *)si->signedAttrs, &abuf,
714 ASN1_ITEM_rptr(CMS_Attributes_Sign)); 744 ASN1_ITEM_rptr(CMS_Attributes_Sign));
715 if (!abuf) 745 if (!abuf)
716 goto err; 746 goto err;
717 if (EVP_DigestSignUpdate(mctx, abuf, alen) <= 0) 747 if (EVP_DigestSignUpdate(mctx, abuf, alen) <= 0)
@@ -726,7 +756,7 @@ int CMS_SignerInfo_sign(CMS_SignerInfo *si)
726 goto err; 756 goto err;
727 757
728 if (EVP_PKEY_CTX_ctrl(pctx, -1, EVP_PKEY_OP_SIGN, 758 if (EVP_PKEY_CTX_ctrl(pctx, -1, EVP_PKEY_OP_SIGN,
729 EVP_PKEY_CTRL_CMS_SIGN, 1, si) <= 0) { 759 EVP_PKEY_CTRL_CMS_SIGN, 1, si) <= 0) {
730 CMSerr(CMS_F_CMS_SIGNERINFO_SIGN, CMS_R_CTRL_ERROR); 760 CMSerr(CMS_F_CMS_SIGNERINFO_SIGN, CMS_R_CTRL_ERROR);
731 goto err; 761 goto err;
732 } 762 }
@@ -740,11 +770,12 @@ int CMS_SignerInfo_sign(CMS_SignerInfo *si)
740 err: 770 err:
741 OPENSSL_free(abuf); 771 OPENSSL_free(abuf);
742 EVP_MD_CTX_reset(mctx); 772 EVP_MD_CTX_reset(mctx);
743 return 0;
744 773
774 return 0;
745} 775}
746 776
747int CMS_SignerInfo_verify(CMS_SignerInfo *si) 777int
778CMS_SignerInfo_verify(CMS_SignerInfo *si)
748{ 779{
749 EVP_MD_CTX *mctx = NULL; 780 EVP_MD_CTX *mctx = NULL;
750 unsigned char *abuf = NULL; 781 unsigned char *abuf = NULL;
@@ -771,7 +802,7 @@ int CMS_SignerInfo_verify(CMS_SignerInfo *si)
771 goto err; 802 goto err;
772 803
773 alen = ASN1_item_i2d((ASN1_VALUE *)si->signedAttrs, &abuf, 804 alen = ASN1_item_i2d((ASN1_VALUE *)si->signedAttrs, &abuf,
774 ASN1_ITEM_rptr(CMS_Attributes_Verify)); 805 ASN1_ITEM_rptr(CMS_Attributes_Verify));
775 if (!abuf) 806 if (!abuf)
776 goto err; 807 goto err;
777 r = EVP_DigestVerifyUpdate(mctx, abuf, alen); 808 r = EVP_DigestVerifyUpdate(mctx, abuf, alen);
@@ -780,22 +811,27 @@ int CMS_SignerInfo_verify(CMS_SignerInfo *si)
780 r = -1; 811 r = -1;
781 goto err; 812 goto err;
782 } 813 }
783 r = EVP_DigestVerifyFinal(mctx, 814
784 si->signature->data, si->signature->length); 815 r = EVP_DigestVerifyFinal(mctx, si->signature->data,
816 si->signature->length);
785 if (r <= 0) 817 if (r <= 0)
786 CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY, CMS_R_VERIFICATION_FAILURE); 818 CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY, CMS_R_VERIFICATION_FAILURE);
819
787 err: 820 err:
788 EVP_MD_CTX_reset(mctx); 821 EVP_MD_CTX_reset(mctx);
822
789 return r; 823 return r;
790} 824}
791 825
792/* Create a chain of digest BIOs from a CMS ContentInfo */ 826/* Create a chain of digest BIOs from a CMS ContentInfo */
793 827
794BIO *cms_SignedData_init_bio(CMS_ContentInfo *cms) 828BIO *
829cms_SignedData_init_bio(CMS_ContentInfo *cms)
795{ 830{
796 int i; 831 int i;
797 CMS_SignedData *sd; 832 CMS_SignedData *sd;
798 BIO *chain = NULL; 833 BIO *chain = NULL;
834
799 sd = cms_get0_signed(cms); 835 sd = cms_get0_signed(cms);
800 if (!sd) 836 if (!sd)
801 return NULL; 837 return NULL;
@@ -813,13 +849,17 @@ BIO *cms_SignedData_init_bio(CMS_ContentInfo *cms)
813 else 849 else
814 chain = mdbio; 850 chain = mdbio;
815 } 851 }
852
816 return chain; 853 return chain;
854
817 err: 855 err:
818 BIO_free_all(chain); 856 BIO_free_all(chain);
857
819 return NULL; 858 return NULL;
820} 859}
821 860
822int CMS_SignerInfo_verify_content(CMS_SignerInfo *si, BIO *chain) 861int
862CMS_SignerInfo_verify_content(CMS_SignerInfo *si, BIO *chain)
823{ 863{
824 ASN1_OCTET_STRING *os = NULL; 864 ASN1_OCTET_STRING *os = NULL;
825 EVP_MD_CTX *mctx = EVP_MD_CTX_new(); 865 EVP_MD_CTX *mctx = EVP_MD_CTX_new();
@@ -835,11 +875,11 @@ int CMS_SignerInfo_verify_content(CMS_SignerInfo *si, BIO *chain)
835 /* If we have any signed attributes look for messageDigest value */ 875 /* If we have any signed attributes look for messageDigest value */
836 if (CMS_signed_get_attr_count(si) >= 0) { 876 if (CMS_signed_get_attr_count(si) >= 0) {
837 os = CMS_signed_get0_data_by_OBJ(si, 877 os = CMS_signed_get0_data_by_OBJ(si,
838 OBJ_nid2obj(NID_pkcs9_messageDigest), 878 OBJ_nid2obj(NID_pkcs9_messageDigest), -3,
839 -3, V_ASN1_OCTET_STRING); 879 V_ASN1_OCTET_STRING);
840 if (!os) { 880 if (!os) {
841 CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY_CONTENT, 881 CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY_CONTENT,
842 CMS_R_ERROR_READING_MESSAGEDIGEST_ATTRIBUTE); 882 CMS_R_ERROR_READING_MESSAGEDIGEST_ATTRIBUTE);
843 goto err; 883 goto err;
844 } 884 }
845 } 885 }
@@ -849,7 +889,7 @@ int CMS_SignerInfo_verify_content(CMS_SignerInfo *si, BIO *chain)
849 889
850 if (EVP_DigestFinal_ex(mctx, mval, &mlen) <= 0) { 890 if (EVP_DigestFinal_ex(mctx, mval, &mlen) <= 0) {
851 CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY_CONTENT, 891 CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY_CONTENT,
852 CMS_R_UNABLE_TO_FINALIZE_CONTEXT); 892 CMS_R_UNABLE_TO_FINALIZE_CONTEXT);
853 goto err; 893 goto err;
854 } 894 }
855 895
@@ -858,18 +898,19 @@ int CMS_SignerInfo_verify_content(CMS_SignerInfo *si, BIO *chain)
858 if (os) { 898 if (os) {
859 if (mlen != (unsigned int)os->length) { 899 if (mlen != (unsigned int)os->length) {
860 CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY_CONTENT, 900 CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY_CONTENT,
861 CMS_R_MESSAGEDIGEST_ATTRIBUTE_WRONG_LENGTH); 901 CMS_R_MESSAGEDIGEST_ATTRIBUTE_WRONG_LENGTH);
862 goto err; 902 goto err;
863 } 903 }
864 904
865 if (memcmp(mval, os->data, mlen)) { 905 if (memcmp(mval, os->data, mlen)) {
866 CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY_CONTENT, 906 CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY_CONTENT,
867 CMS_R_VERIFICATION_FAILURE); 907 CMS_R_VERIFICATION_FAILURE);
868 r = 0; 908 r = 0;
869 } else 909 } else
870 r = 1; 910 r = 1;
871 } else { 911 } else {
872 const EVP_MD *md = EVP_MD_CTX_md(mctx); 912 const EVP_MD *md = EVP_MD_CTX_md(mctx);
913
873 pkctx = EVP_PKEY_CTX_new(si->pkey, NULL); 914 pkctx = EVP_PKEY_CTX_new(si->pkey, NULL);
874 if (pkctx == NULL) 915 if (pkctx == NULL)
875 goto err; 916 goto err;
@@ -892,28 +933,32 @@ int CMS_SignerInfo_verify_content(CMS_SignerInfo *si, BIO *chain)
892 err: 933 err:
893 EVP_PKEY_CTX_free(pkctx); 934 EVP_PKEY_CTX_free(pkctx);
894 EVP_MD_CTX_free(mctx); 935 EVP_MD_CTX_free(mctx);
895 return r;
896 936
937 return r;
897} 938}
898 939
899int CMS_add_smimecap(CMS_SignerInfo *si, STACK_OF(X509_ALGOR) *algs) 940int
941CMS_add_smimecap(CMS_SignerInfo *si, STACK_OF(X509_ALGOR) *algs)
900{ 942{
901 unsigned char *smder = NULL; 943 unsigned char *smder = NULL;
902 int smderlen, r; 944 int smderlen, r;
945
903 smderlen = i2d_X509_ALGORS(algs, &smder); 946 smderlen = i2d_X509_ALGORS(algs, &smder);
904 if (smderlen <= 0) 947 if (smderlen <= 0)
905 return 0; 948 return 0;
906 r = CMS_signed_add1_attr_by_NID(si, NID_SMIMECapabilities, 949 r = CMS_signed_add1_attr_by_NID(si, NID_SMIMECapabilities,
907 V_ASN1_SEQUENCE, smder, smderlen); 950 V_ASN1_SEQUENCE, smder, smderlen);
908 OPENSSL_free(smder); 951 OPENSSL_free(smder);
952
909 return r; 953 return r;
910} 954}
911 955
912int CMS_add_simple_smimecap(STACK_OF(X509_ALGOR) **algs, 956int
913 int algnid, int keysize) 957CMS_add_simple_smimecap(STACK_OF(X509_ALGOR) **algs, int algnid, int keysize)
914{ 958{
915 X509_ALGOR *alg; 959 X509_ALGOR *alg;
916 ASN1_INTEGER *key = NULL; 960 ASN1_INTEGER *key = NULL;
961
917 if (keysize > 0) { 962 if (keysize > 0) {
918 key = ASN1_INTEGER_new(); 963 key = ASN1_INTEGER_new();
919 if (key == NULL || !ASN1_INTEGER_set(key, keysize)) 964 if (key == NULL || !ASN1_INTEGER_set(key, keysize))
@@ -926,46 +971,51 @@ int CMS_add_simple_smimecap(STACK_OF(X509_ALGOR) **algs,
926 } 971 }
927 972
928 X509_ALGOR_set0(alg, OBJ_nid2obj(algnid), 973 X509_ALGOR_set0(alg, OBJ_nid2obj(algnid),
929 key ? V_ASN1_INTEGER : V_ASN1_UNDEF, key); 974 key ? V_ASN1_INTEGER : V_ASN1_UNDEF, key);
930 if (*algs == NULL) 975 if (*algs == NULL)
931 *algs = sk_X509_ALGOR_new_null(); 976 *algs = sk_X509_ALGOR_new_null();
932 if (*algs == NULL || !sk_X509_ALGOR_push(*algs, alg)) { 977 if (*algs == NULL || !sk_X509_ALGOR_push(*algs, alg)) {
933 X509_ALGOR_free(alg); 978 X509_ALGOR_free(alg);
934 return 0; 979 return 0;
935 } 980 }
981
936 return 1; 982 return 1;
937} 983}
938 984
939/* Check to see if a cipher exists and if so add S/MIME capabilities */ 985/* Check to see if a cipher exists and if so add S/MIME capabilities */
940 986
941static int cms_add_cipher_smcap(STACK_OF(X509_ALGOR) **sk, int nid, int arg) 987static int
988cms_add_cipher_smcap(STACK_OF(X509_ALGOR) **sk, int nid, int arg)
942{ 989{
943 if (EVP_get_cipherbynid(nid)) 990 if (EVP_get_cipherbynid(nid))
944 return CMS_add_simple_smimecap(sk, nid, arg); 991 return CMS_add_simple_smimecap(sk, nid, arg);
945 return 1; 992 return 1;
946} 993}
947 994
948static int cms_add_digest_smcap(STACK_OF(X509_ALGOR) **sk, int nid, int arg) 995static int
996cms_add_digest_smcap(STACK_OF(X509_ALGOR) **sk, int nid, int arg)
949{ 997{
950 if (EVP_get_digestbynid(nid)) 998 if (EVP_get_digestbynid(nid))
951 return CMS_add_simple_smimecap(sk, nid, arg); 999 return CMS_add_simple_smimecap(sk, nid, arg);
952 return 1; 1000 return 1;
953} 1001}
954 1002
955int CMS_add_standard_smimecap(STACK_OF(X509_ALGOR) **smcap) 1003int
956{ 1004CMS_add_standard_smimecap(STACK_OF(X509_ALGOR) **smcap)
957 if (!cms_add_cipher_smcap(smcap, NID_aes_256_cbc, -1) 1005{
958 || !cms_add_digest_smcap(smcap, NID_id_GostR3411_2012_256, -1) 1006 if (!cms_add_cipher_smcap(smcap, NID_aes_256_cbc, -1) ||
959 || !cms_add_digest_smcap(smcap, NID_id_GostR3411_2012_512, -1) 1007 !cms_add_digest_smcap(smcap, NID_id_GostR3411_2012_256, -1) ||
960 || !cms_add_digest_smcap(smcap, NID_id_GostR3411_94, -1) 1008 !cms_add_digest_smcap(smcap, NID_id_GostR3411_2012_512, -1) ||
961 || !cms_add_cipher_smcap(smcap, NID_id_Gost28147_89, -1) 1009 !cms_add_digest_smcap(smcap, NID_id_GostR3411_94, -1) ||
962 || !cms_add_cipher_smcap(smcap, NID_aes_192_cbc, -1) 1010 !cms_add_cipher_smcap(smcap, NID_id_Gost28147_89, -1) ||
963 || !cms_add_cipher_smcap(smcap, NID_aes_128_cbc, -1) 1011 !cms_add_cipher_smcap(smcap, NID_aes_192_cbc, -1) ||
964 || !cms_add_cipher_smcap(smcap, NID_des_ede3_cbc, -1) 1012 !cms_add_cipher_smcap(smcap, NID_aes_128_cbc, -1) ||
965 || !cms_add_cipher_smcap(smcap, NID_rc2_cbc, 128) 1013 !cms_add_cipher_smcap(smcap, NID_des_ede3_cbc, -1) ||
966 || !cms_add_cipher_smcap(smcap, NID_rc2_cbc, 64) 1014 !cms_add_cipher_smcap(smcap, NID_rc2_cbc, 128) ||
967 || !cms_add_cipher_smcap(smcap, NID_des_cbc, -1) 1015 !cms_add_cipher_smcap(smcap, NID_rc2_cbc, 64) ||
968 || !cms_add_cipher_smcap(smcap, NID_rc2_cbc, 40)) 1016 !cms_add_cipher_smcap(smcap, NID_des_cbc, -1) ||
1017 !cms_add_cipher_smcap(smcap, NID_rc2_cbc, 40))
969 return 0; 1018 return 0;
1019
970 return 1; 1020 return 1;
971} 1021}
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-12-09 20:28:00 +0000