summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/pkcs7/pk7_smime.c
diff options
context:
space:
mode:
Diffstat (limited to 'src/lib/libcrypto/pkcs7/pk7_smime.c')
-rw-r--r--src/lib/libcrypto/pkcs7/pk7_smime.c600
1 files changed, 0 insertions, 600 deletions
diff --git a/src/lib/libcrypto/pkcs7/pk7_smime.c b/src/lib/libcrypto/pkcs7/pk7_smime.c
deleted file mode 100644
index 1c00e5914a..0000000000
--- a/src/lib/libcrypto/pkcs7/pk7_smime.c
+++ /dev/null
@@ -1,600 +0,0 @@
1/* $OpenBSD: pk7_smime.c,v 1.20 2015/02/07 14:21:41 doug Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project.
4 */
5/* ====================================================================
6 * Copyright (c) 1999-2004 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59/* Simple PKCS#7 processing functions */
60
61#include <stdio.h>
62
63#include <openssl/err.h>
64#include <openssl/x509.h>
65#include <openssl/x509v3.h>
66
67static int pkcs7_copy_existing_digest(PKCS7 *p7, PKCS7_SIGNER_INFO *si);
68
69PKCS7 *
70PKCS7_sign(X509 *signcert, EVP_PKEY *pkey, STACK_OF(X509) *certs, BIO *data,
71 int flags)
72{
73 PKCS7 *p7;
74 int i;
75
76 if (!(p7 = PKCS7_new())) {
77 PKCS7err(PKCS7_F_PKCS7_SIGN, ERR_R_MALLOC_FAILURE);
78 return NULL;
79 }
80
81 if (!PKCS7_set_type(p7, NID_pkcs7_signed))
82 goto err;
83
84 if (!PKCS7_content_new(p7, NID_pkcs7_data))
85 goto err;
86
87 if (pkey && !PKCS7_sign_add_signer(p7, signcert, pkey, NULL, flags)) {
88 PKCS7err(PKCS7_F_PKCS7_SIGN, PKCS7_R_PKCS7_ADD_SIGNER_ERROR);
89 goto err;
90 }
91
92 if (!(flags & PKCS7_NOCERTS)) {
93 for (i = 0; i < sk_X509_num(certs); i++) {
94 if (!PKCS7_add_certificate(p7, sk_X509_value(certs, i)))
95 goto err;
96 }
97 }
98
99 if (flags & PKCS7_DETACHED)
100 PKCS7_set_detached(p7, 1);
101
102 if (flags & (PKCS7_STREAM|PKCS7_PARTIAL))
103 return p7;
104
105 if (PKCS7_final(p7, data, flags))
106 return p7;
107
108err:
109 PKCS7_free(p7);
110 return NULL;
111}
112
113int
114PKCS7_final(PKCS7 *p7, BIO *data, int flags)
115{
116 BIO *p7bio;
117 int ret = 0;
118
119 if (!(p7bio = PKCS7_dataInit(p7, NULL))) {
120 PKCS7err(PKCS7_F_PKCS7_FINAL, ERR_R_MALLOC_FAILURE);
121 return 0;
122 }
123
124 SMIME_crlf_copy(data, p7bio, flags);
125
126 (void)BIO_flush(p7bio);
127
128 if (!PKCS7_dataFinal(p7, p7bio)) {
129 PKCS7err(PKCS7_F_PKCS7_FINAL, PKCS7_R_PKCS7_DATASIGN);
130 goto err;
131 }
132
133 ret = 1;
134
135err:
136 BIO_free_all(p7bio);
137
138 return ret;
139}
140
141/* Check to see if a cipher exists and if so add S/MIME capabilities */
142
143static int
144add_cipher_smcap(STACK_OF(X509_ALGOR) *sk, int nid, int arg)
145{
146 if (EVP_get_cipherbynid(nid))
147 return PKCS7_simple_smimecap(sk, nid, arg);
148 return 1;
149}
150
151static int
152add_digest_smcap(STACK_OF(X509_ALGOR) *sk, int nid, int arg)
153{
154 if (EVP_get_digestbynid(nid))
155 return PKCS7_simple_smimecap(sk, nid, arg);
156 return 1;
157}
158
159PKCS7_SIGNER_INFO *
160PKCS7_sign_add_signer(PKCS7 *p7, X509 *signcert, EVP_PKEY *pkey,
161 const EVP_MD *md, int flags)
162{
163 PKCS7_SIGNER_INFO *si = NULL;
164 STACK_OF(X509_ALGOR) *smcap = NULL;
165
166 if (!X509_check_private_key(signcert, pkey)) {
167 PKCS7err(PKCS7_F_PKCS7_SIGN_ADD_SIGNER,
168 PKCS7_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE);
169 return NULL;
170 }
171
172 if (!(si = PKCS7_add_signature(p7, signcert, pkey, md))) {
173 PKCS7err(PKCS7_F_PKCS7_SIGN_ADD_SIGNER,
174 PKCS7_R_PKCS7_ADD_SIGNATURE_ERROR);
175 return NULL;
176 }
177
178 if (!(flags & PKCS7_NOCERTS)) {
179 if (!PKCS7_add_certificate(p7, signcert))
180 goto err;
181 }
182
183 if (!(flags & PKCS7_NOATTR)) {
184 if (!PKCS7_add_attrib_content_type(si, NULL))
185 goto err;
186 /* Add SMIMECapabilities */
187 if (!(flags & PKCS7_NOSMIMECAP)) {
188 if (!(smcap = sk_X509_ALGOR_new_null())) {
189 PKCS7err(PKCS7_F_PKCS7_SIGN_ADD_SIGNER,
190 ERR_R_MALLOC_FAILURE);
191 goto err;
192 }
193 if (!add_cipher_smcap(smcap, NID_aes_256_cbc, -1) ||
194 !add_digest_smcap(smcap, NID_id_GostR3411_94, -1) ||
195 !add_digest_smcap(smcap, NID_id_tc26_gost3411_2012_256, -1) ||
196 !add_digest_smcap(smcap, NID_id_tc26_gost3411_2012_512, -1) ||
197 !add_cipher_smcap(smcap, NID_id_Gost28147_89, -1) ||
198 !add_cipher_smcap(smcap, NID_aes_192_cbc, -1) ||
199 !add_cipher_smcap(smcap, NID_aes_128_cbc, -1) ||
200 !add_cipher_smcap(smcap, NID_des_ede3_cbc, -1) ||
201 !add_cipher_smcap(smcap, NID_rc2_cbc, 128) ||
202 !add_cipher_smcap(smcap, NID_rc2_cbc, 64) ||
203 !add_cipher_smcap(smcap, NID_des_cbc, -1) ||
204 !add_cipher_smcap(smcap, NID_rc2_cbc, 40) ||
205 !PKCS7_add_attrib_smimecap(si, smcap))
206 goto err;
207 sk_X509_ALGOR_pop_free(smcap, X509_ALGOR_free);
208 smcap = NULL;
209 }
210 if (flags & PKCS7_REUSE_DIGEST) {
211 if (!pkcs7_copy_existing_digest(p7, si))
212 goto err;
213 if (!(flags & PKCS7_PARTIAL) &&
214 !PKCS7_SIGNER_INFO_sign(si))
215 goto err;
216 }
217 }
218 return si;
219
220err:
221 if (smcap)
222 sk_X509_ALGOR_pop_free(smcap, X509_ALGOR_free);
223 return NULL;
224}
225
226/* Search for a digest matching SignerInfo digest type and if found
227 * copy across.
228 */
229
230static int
231pkcs7_copy_existing_digest(PKCS7 *p7, PKCS7_SIGNER_INFO *si)
232{
233 int i;
234 STACK_OF(PKCS7_SIGNER_INFO) *sinfos;
235 PKCS7_SIGNER_INFO *sitmp;
236 ASN1_OCTET_STRING *osdig = NULL;
237
238 sinfos = PKCS7_get_signer_info(p7);
239 for (i = 0; i < sk_PKCS7_SIGNER_INFO_num(sinfos); i++) {
240 sitmp = sk_PKCS7_SIGNER_INFO_value(sinfos, i);
241 if (si == sitmp)
242 break;
243 if (sk_X509_ATTRIBUTE_num(sitmp->auth_attr) <= 0)
244 continue;
245 if (!OBJ_cmp(si->digest_alg->algorithm,
246 sitmp->digest_alg->algorithm)) {
247 osdig = PKCS7_digest_from_attributes(sitmp->auth_attr);
248 break;
249 }
250
251 }
252
253 if (osdig)
254 return PKCS7_add1_attrib_digest(si, osdig->data, osdig->length);
255
256 PKCS7err(PKCS7_F_PKCS7_COPY_EXISTING_DIGEST,
257 PKCS7_R_NO_MATCHING_DIGEST_TYPE_FOUND);
258 return 0;
259}
260
261int
262PKCS7_verify(PKCS7 *p7, STACK_OF(X509) *certs, X509_STORE *store, BIO *indata,
263 BIO *out, int flags)
264{
265 STACK_OF(X509) *signers;
266 X509 *signer;
267 STACK_OF(PKCS7_SIGNER_INFO) *sinfos;
268 PKCS7_SIGNER_INFO *si;
269 X509_STORE_CTX cert_ctx;
270 char buf[4096];
271 int i, j = 0, k, ret = 0;
272 BIO *p7bio;
273 BIO *tmpin, *tmpout;
274
275 if (!p7) {
276 PKCS7err(PKCS7_F_PKCS7_VERIFY, PKCS7_R_INVALID_NULL_POINTER);
277 return 0;
278 }
279
280 if (!PKCS7_type_is_signed(p7)) {
281 PKCS7err(PKCS7_F_PKCS7_VERIFY, PKCS7_R_WRONG_CONTENT_TYPE);
282 return 0;
283 }
284
285 /* Check for no data and no content: no data to verify signature */
286 if (PKCS7_get_detached(p7) && !indata) {
287 PKCS7err(PKCS7_F_PKCS7_VERIFY, PKCS7_R_NO_CONTENT);
288 return 0;
289 }
290
291 /*
292 * Very old Netscape illegally included empty content with
293 * a detached signature. Very old users should upgrade.
294 */
295 /* Check for data and content: two sets of data */
296 if (!PKCS7_get_detached(p7) && indata) {
297 PKCS7err(PKCS7_F_PKCS7_VERIFY, PKCS7_R_CONTENT_AND_DATA_PRESENT);
298 return 0;
299 }
300
301 sinfos = PKCS7_get_signer_info(p7);
302
303 if (!sinfos || !sk_PKCS7_SIGNER_INFO_num(sinfos)) {
304 PKCS7err(PKCS7_F_PKCS7_VERIFY, PKCS7_R_NO_SIGNATURES_ON_DATA);
305 return 0;
306 }
307
308
309 signers = PKCS7_get0_signers(p7, certs, flags);
310
311 if (!signers)
312 return 0;
313
314 /* Now verify the certificates */
315
316 if (!(flags & PKCS7_NOVERIFY))
317 for (k = 0; k < sk_X509_num(signers); k++) {
318 signer = sk_X509_value (signers, k);
319 if (!(flags & PKCS7_NOCHAIN)) {
320 if (!X509_STORE_CTX_init(&cert_ctx, store,
321 signer, p7->d.sign->cert)) {
322 PKCS7err(PKCS7_F_PKCS7_VERIFY,
323 ERR_R_X509_LIB);
324 sk_X509_free(signers);
325 return 0;
326 }
327 X509_STORE_CTX_set_default(&cert_ctx,
328 "smime_sign");
329 } else if (!X509_STORE_CTX_init(&cert_ctx, store,
330 signer, NULL)) {
331 PKCS7err(PKCS7_F_PKCS7_VERIFY, ERR_R_X509_LIB);
332 sk_X509_free(signers);
333 return 0;
334 }
335 if (!(flags & PKCS7_NOCRL))
336 X509_STORE_CTX_set0_crls(&cert_ctx, p7->d.sign->crl);
337 i = X509_verify_cert(&cert_ctx);
338 if (i <= 0)
339 j = X509_STORE_CTX_get_error(&cert_ctx);
340 X509_STORE_CTX_cleanup(&cert_ctx);
341 if (i <= 0) {
342 PKCS7err(PKCS7_F_PKCS7_VERIFY,
343 PKCS7_R_CERTIFICATE_VERIFY_ERROR);
344 ERR_asprintf_error_data("Verify error:%s",
345 X509_verify_cert_error_string(j));
346 sk_X509_free(signers);
347 return 0;
348 }
349 /* Check for revocation status here */
350 }
351
352 /*
353 * Performance optimization: if the content is a memory BIO then
354 * store its contents in a temporary read only memory BIO. This
355 * avoids potentially large numbers of slow copies of data which will
356 * occur when reading from a read write memory BIO when signatures
357 * are calculated.
358 */
359 if (indata && (BIO_method_type(indata) == BIO_TYPE_MEM)) {
360 char *ptr;
361 long len;
362
363 len = BIO_get_mem_data(indata, &ptr);
364 tmpin = BIO_new_mem_buf(ptr, len);
365 if (tmpin == NULL) {
366 PKCS7err(PKCS7_F_PKCS7_VERIFY, ERR_R_MALLOC_FAILURE);
367 return 0;
368 }
369 } else
370 tmpin = indata;
371
372
373 if (!(p7bio = PKCS7_dataInit(p7, tmpin)))
374 goto err;
375
376 if (flags & PKCS7_TEXT) {
377 if (!(tmpout = BIO_new(BIO_s_mem()))) {
378 PKCS7err(PKCS7_F_PKCS7_VERIFY, ERR_R_MALLOC_FAILURE);
379 goto err;
380 }
381 BIO_set_mem_eof_return(tmpout, 0);
382 } else
383 tmpout = out;
384
385 /* We now have to 'read' from p7bio to calculate digests etc. */
386 for (;;) {
387 i = BIO_read(p7bio, buf, sizeof(buf));
388 if (i <= 0)
389 break;
390 if (tmpout)
391 BIO_write(tmpout, buf, i);
392 }
393
394 if (flags & PKCS7_TEXT) {
395 if (!SMIME_text(tmpout, out)) {
396 PKCS7err(PKCS7_F_PKCS7_VERIFY,
397 PKCS7_R_SMIME_TEXT_ERROR);
398 BIO_free(tmpout);
399 goto err;
400 }
401 BIO_free(tmpout);
402 }
403
404 /* Now Verify All Signatures */
405 if (!(flags & PKCS7_NOSIGS))
406 for (i = 0; i < sk_PKCS7_SIGNER_INFO_num(sinfos); i++) {
407 si = sk_PKCS7_SIGNER_INFO_value(sinfos, i);
408 signer = sk_X509_value (signers, i);
409 j = PKCS7_signatureVerify(p7bio, p7, si, signer);
410 if (j <= 0) {
411 PKCS7err(PKCS7_F_PKCS7_VERIFY,
412 PKCS7_R_SIGNATURE_FAILURE);
413 goto err;
414 }
415 }
416
417 ret = 1;
418
419err:
420 if (tmpin == indata) {
421 if (indata)
422 BIO_pop(p7bio);
423 }
424 BIO_free_all(p7bio);
425 sk_X509_free(signers);
426
427 return ret;
428}
429
430STACK_OF(X509) *
431PKCS7_get0_signers(PKCS7 *p7, STACK_OF(X509) *certs, int flags)
432{
433 STACK_OF(X509) *signers;
434 STACK_OF(PKCS7_SIGNER_INFO) *sinfos;
435 PKCS7_SIGNER_INFO *si;
436 PKCS7_ISSUER_AND_SERIAL *ias;
437 X509 *signer;
438 int i;
439
440 if (!p7) {
441 PKCS7err(PKCS7_F_PKCS7_GET0_SIGNERS,
442 PKCS7_R_INVALID_NULL_POINTER);
443 return NULL;
444 }
445
446 if (!PKCS7_type_is_signed(p7)) {
447 PKCS7err(PKCS7_F_PKCS7_GET0_SIGNERS,
448 PKCS7_R_WRONG_CONTENT_TYPE);
449 return NULL;
450 }
451
452 /* Collect all the signers together */
453 sinfos = PKCS7_get_signer_info(p7);
454 if (sk_PKCS7_SIGNER_INFO_num(sinfos) <= 0) {
455 PKCS7err(PKCS7_F_PKCS7_GET0_SIGNERS, PKCS7_R_NO_SIGNERS);
456 return 0;
457 }
458
459 if (!(signers = sk_X509_new_null())) {
460 PKCS7err(PKCS7_F_PKCS7_GET0_SIGNERS, ERR_R_MALLOC_FAILURE);
461 return NULL;
462 }
463
464 for (i = 0; i < sk_PKCS7_SIGNER_INFO_num(sinfos); i++) {
465 si = sk_PKCS7_SIGNER_INFO_value(sinfos, i);
466 ias = si->issuer_and_serial;
467 signer = NULL;
468 /* If any certificates passed they take priority */
469 if (certs)
470 signer = X509_find_by_issuer_and_serial (certs,
471 ias->issuer, ias->serial);
472 if (!signer && !(flags & PKCS7_NOINTERN) && p7->d.sign->cert)
473 signer =
474 X509_find_by_issuer_and_serial(p7->d.sign->cert,
475 ias->issuer, ias->serial);
476 if (!signer) {
477 PKCS7err(PKCS7_F_PKCS7_GET0_SIGNERS,
478 PKCS7_R_SIGNER_CERTIFICATE_NOT_FOUND);
479 sk_X509_free(signers);
480 return 0;
481 }
482
483 if (!sk_X509_push(signers, signer)) {
484 sk_X509_free(signers);
485 return NULL;
486 }
487 }
488 return signers;
489}
490
491/* Build a complete PKCS#7 enveloped data */
492
493PKCS7 *
494PKCS7_encrypt(STACK_OF(X509) *certs, BIO *in, const EVP_CIPHER *cipher,
495 int flags)
496{
497 PKCS7 *p7;
498 BIO *p7bio = NULL;
499 int i;
500 X509 *x509;
501
502 if (!(p7 = PKCS7_new())) {
503 PKCS7err(PKCS7_F_PKCS7_ENCRYPT, ERR_R_MALLOC_FAILURE);
504 return NULL;
505 }
506
507 if (!PKCS7_set_type(p7, NID_pkcs7_enveloped))
508 goto err;
509 if (!PKCS7_set_cipher(p7, cipher)) {
510 PKCS7err(PKCS7_F_PKCS7_ENCRYPT, PKCS7_R_ERROR_SETTING_CIPHER);
511 goto err;
512 }
513
514 for (i = 0; i < sk_X509_num(certs); i++) {
515 x509 = sk_X509_value(certs, i);
516 if (!PKCS7_add_recipient(p7, x509)) {
517 PKCS7err(PKCS7_F_PKCS7_ENCRYPT,
518 PKCS7_R_ERROR_ADDING_RECIPIENT);
519 goto err;
520 }
521 }
522
523 if (flags & PKCS7_STREAM)
524 return p7;
525
526 if (PKCS7_final(p7, in, flags))
527 return p7;
528
529err:
530 BIO_free_all(p7bio);
531 PKCS7_free(p7);
532 return NULL;
533}
534
535int
536PKCS7_decrypt(PKCS7 *p7, EVP_PKEY *pkey, X509 *cert, BIO *data, int flags)
537{
538 BIO *tmpmem;
539 int ret, i;
540 char buf[4096];
541
542 if (!p7) {
543 PKCS7err(PKCS7_F_PKCS7_DECRYPT, PKCS7_R_INVALID_NULL_POINTER);
544 return 0;
545 }
546
547 if (!PKCS7_type_is_enveloped(p7)) {
548 PKCS7err(PKCS7_F_PKCS7_DECRYPT, PKCS7_R_WRONG_CONTENT_TYPE);
549 return 0;
550 }
551
552 if (cert && !X509_check_private_key(cert, pkey)) {
553 PKCS7err(PKCS7_F_PKCS7_DECRYPT,
554 PKCS7_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE);
555 return 0;
556 }
557
558 if (!(tmpmem = PKCS7_dataDecode(p7, pkey, NULL, cert))) {
559 PKCS7err(PKCS7_F_PKCS7_DECRYPT, PKCS7_R_DECRYPT_ERROR);
560 return 0;
561 }
562
563 if (flags & PKCS7_TEXT) {
564 BIO *tmpbuf;
565
566 /* Encrypt BIOs can't do BIO_gets() so add a buffer BIO */
567 if (!(tmpbuf = BIO_new(BIO_f_buffer()))) {
568 PKCS7err(PKCS7_F_PKCS7_DECRYPT, ERR_R_MALLOC_FAILURE);
569 BIO_free_all(tmpmem);
570 return 0;
571 }
572 BIO_push(tmpbuf, tmpmem);
573 ret = SMIME_text(tmpbuf, data);
574 if (ret > 0 && BIO_method_type(tmpmem) == BIO_TYPE_CIPHER) {
575 if (!BIO_get_cipher_status(tmpmem))
576 ret = 0;
577 }
578 BIO_free_all(tmpbuf);
579 return ret;
580 } else {
581 for (;;) {
582 i = BIO_read(tmpmem, buf, sizeof(buf));
583 if (i <= 0) {
584 ret = 1;
585 if (BIO_method_type(tmpmem) ==
586 BIO_TYPE_CIPHER) {
587 if (!BIO_get_cipher_status(tmpmem))
588 ret = 0;
589 }
590 break;
591 }
592 if (BIO_write(data, buf, i) != i) {
593 ret = 0;
594 break;
595 }
596 }
597 BIO_free_all(tmpmem);
598 return ret;
599 }
600}
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-08-16 20:46:55 +0000