crypto/cms/cms_smime.c

   1 /* crypto/cms/cms_smime.c */
   2 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
   3  * project.
   4  */
   5 /* ====================================================================
   6  * Copyright (c) 2008 The OpenSSL Project.  All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in
  17  *    the documentation and/or other materials provided with the
  18  *    distribution.
  19  *
  20  * 3. All advertising materials mentioning features or use of this
  21  *    software must display the following acknowledgment:
  22  *    "This product includes software developed by the OpenSSL Project
  23  *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
  24  *
  25  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  26  *    endorse or promote products derived from this software without
  27  *    prior written permission. For written permission, please contact
  28  *    licensing@OpenSSL.org.
  29  *
  30  * 5. Products derived from this software may not be called "OpenSSL"
  31  *    nor may "OpenSSL" appear in their names without prior written
  32  *    permission of the OpenSSL Project.
  33  *
  34  * 6. Redistributions of any form whatsoever must retain the following
  35  *    acknowledgment:
  36  *    "This product includes software developed by the OpenSSL Project
  37  *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
  38  *
  39  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  40  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  41  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  42  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  43  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  44  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  45  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  46  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  47  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  48  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  49  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  50  * OF THE POSSIBILITY OF SUCH DAMAGE.
  51  * ====================================================================
  52  */
  53
  54 #include "cryptlib.h"
  55 #include <openssl/asn1t.h>
  56 #include <openssl/x509.h>
  57 #include <openssl/x509v3.h>
  58 #include <openssl/err.h>
  59 #include <openssl/cms.h>
  60 #include "cms_lcl.h"
  61
  62 static int cms_copy_content(BIO *out, BIO *in, unsigned int flags)
  63         {
  64         unsigned char buf[4096];
  65         int r = 0, i;
  66         BIO *tmpout = NULL;
  67
  68         if(flags & CMS_TEXT)
  69                 {
  70                 tmpout = BIO_new(BIO_s_mem());
  71                 if(!tmpout)
  72                         {
  73                         CMSerr(CMS_F_CMS_COPY_CONTENT,ERR_R_MALLOC_FAILURE);
  74                         goto err;
  75                         }
  76                 }
  77         else
  78                 tmpout = out;
  79
  80         /* Read all content through chain to process digest, decrypt etc */
  81         for (;;)
  82         {
  83                 i=BIO_read(in,buf,sizeof(buf));
  84                 if (i <= 0)
  85                         {
  86                         if (BIO_method_type(in) == BIO_TYPE_CIPHER)
  87                                 {
  88                                 if (!BIO_get_cipher_status(in))
  89                                         goto err;
  90                                 }
  91                         break;
  92                         }
  93
  94                 if (tmpout)
  95                         BIO_write(tmpout, buf, i);
  96         }
  97
  98         if(flags & CMS_TEXT)
  99                 {
 100                 if(!SMIME_text(tmpout, out))
 101                         {
 102                         CMSerr(CMS_F_CMS_COPY_CONTENT,CMS_R_SMIME_TEXT_ERROR);
 103                         goto err;
 104                         }
 105                 }
 106
 107         r = 1;
 108
 109         err:
 110         if (tmpout && (tmpout != out))
 111                 BIO_free(tmpout);
 112         return r;
 113
 114         }
 115
 116 int CMS_data(CMS_ContentInfo *cms, BIO *out, unsigned int flags)
 117         {
 118         BIO *cont;
 119         int r;
 120         if (OBJ_obj2nid(CMS_get0_type(cms)) != NID_pkcs7_data)
 121                 {
 122                 CMSerr(CMS_F_CMS_DATA, CMS_R_TYPE_NOT_DATA);
 123                 return 0;
 124                 }
 125         cont = CMS_dataInit(cms, NULL);
 126         if (!cont)
 127                 return 0;
 128         r = cms_copy_content(out, cont, flags);
 129         BIO_free_all(cont);
 130         return r;
 131         }
 132
 133 CMS_ContentInfo *CMS_data_create(BIO *in, unsigned int flags)
 134         {
 135         CMS_ContentInfo *cms;
 136         cms = cms_Data_create();
 137         if (!cms)
 138                 return NULL;
 139
 140         if ((flags & CMS_STREAM) || CMS_final(cms, in, flags))
 141                 return cms;
 142
 143         CMS_ContentInfo_free(cms);
 144
 145         return NULL;
 146         }
 147
 148 int CMS_digest_verify(CMS_ContentInfo *cms, BIO *dcont, BIO *out,
 149                                                         unsigned int flags)
 150         {
 151         BIO *cont;
 152         int r;
 153         if (OBJ_obj2nid(CMS_get0_type(cms)) != NID_pkcs7_digest)
 154                 {
 155                 CMSerr(CMS_F_CMS_DIGEST_VERIFY, CMS_R_TYPE_NOT_DIGESTED_DATA);
 156                 return 0;
 157                 }
 158
 159         if (!dcont)
 160                 {
 161                 ASN1_OCTET_STRING **pos = CMS_get0_content(cms);
 162                 if (!pos || !*pos)
 163                         {
 164                         CMSerr(CMS_F_CMS_DIGEST_VERIFY, CMS_R_NO_CONTENT);
 165                         return 0;
 166                         }
 167                 }
 168
 169         cont = CMS_dataInit(cms, dcont);
 170         if (!cont)
 171                 return 0;
 172         r = cms_copy_content(out, cont, flags);
 173         if (r)
 174                 r = cms_DigestedData_do_final(cms, cont, 1);
 175         BIO_free_all(cont);
 176         return r;
 177         }
 178
 179 CMS_ContentInfo *CMS_digest_create(BIO *in, const EVP_MD *md,
 180                                         unsigned int flags)
 181         {
 182         CMS_ContentInfo *cms;
 183         if (!md)
 184                 md = EVP_sha1();
 185         cms = cms_DigestedData_create(md);
 186         if (!cms)
 187                 return NULL;
 188
 189         if(!(flags & CMS_DETACHED))
 190                 CMS_set_detached(cms, 0);
 191
 192         if ((flags & CMS_STREAM) || CMS_final(cms, in, flags))
 193                 return cms;
 194
 195         CMS_ContentInfo_free(cms);
 196         return NULL;
 197         }
 198
 199 int CMS_EncryptedData_decrypt(CMS_ContentInfo *cms,
 200                                 const unsigned char *key, size_t keylen,
 201                                 BIO *dcont, BIO *out, unsigned int flags)
 202         {
 203         BIO *cont;
 204         int r;
 205         if (OBJ_obj2nid(CMS_get0_type(cms)) != NID_pkcs7_encrypted)
 206                 {
 207                 CMSerr(CMS_F_CMS_ENCRYPTEDDATA_DECRYPT,
 208                                         CMS_R_TYPE_NOT_ENCRYPTED_DATA);
 209                 return 0;
 210                 }
 211
 212         if (!dcont)
 213                 {
 214                 ASN1_OCTET_STRING **pos = CMS_get0_content(cms);
 215                 if (!pos || !*pos)
 216                         {
 217                         CMSerr(CMS_F_CMS_ENCRYPTEDDATA_DECRYPT,
 218                                         CMS_R_NO_CONTENT);
 219                         return 0;
 220                         }
 221                 }
 222
 223         if (CMS_EncryptedData_set1_key(cms, NULL, key, keylen) <= 0)
 224                 return 0;
 225         cont = CMS_dataInit(cms, dcont);
 226         if (!cont)
 227                 return 0;
 228         r = cms_copy_content(out, cont, flags);
 229         BIO_free_all(cont);
 230         return r;
 231         }
 232
 233 CMS_ContentInfo *CMS_EncryptedData_encrypt(BIO *in, const EVP_CIPHER *cipher,
 234                                         const unsigned char *key, size_t keylen,
 235                                         unsigned int flags)
 236         {
 237         CMS_ContentInfo *cms;
 238         if (!cipher)
 239                 {
 240                 CMSerr(CMS_F_CMS_ENCRYPTEDDATA_ENCRYPT, CMS_R_NO_CIPHER);
 241                 return NULL;
 242                 }
 243         cms = CMS_ContentInfo_new();
 244         if (!cms)
 245                 return NULL;
 246         if (!CMS_EncryptedData_set1_key(cms, cipher, key, keylen))
 247                 return NULL;
 248
 249         if(!(flags & CMS_DETACHED))
 250                 CMS_set_detached(cms, 0);
 251
 252         if ((flags & (CMS_STREAM|CMS_PARTIAL)) || CMS_final(cms, in, flags))
 253                 return cms;
 254
 255         CMS_ContentInfo_free(cms);
 256         return NULL;
 257         }
 258
 259 static int cms_signerinfo_verify_cert(CMS_SignerInfo *si,
 260                                         X509_STORE *store,
 261                                         STACK_OF(X509) *certs,
 262                                         STACK_OF(X509_CRL) *crls,
 263                                         unsigned int flags)
 264         {
 265         X509_STORE_CTX ctx;
 266         X509 *signer;
 267         int i, j, r = 0;
 268         CMS_SignerInfo_get0_algs(si, NULL, &signer, NULL, NULL);
 269         if (!X509_STORE_CTX_init(&ctx, store, signer, certs))
 270                 {
 271                 CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY_CERT,
 272                                                 CMS_R_STORE_INIT_ERROR);
 273                 goto err;
 274                 }
 275         X509_STORE_CTX_set_purpose(&ctx, X509_PURPOSE_SMIME_SIGN);
 276         if (crls)
 277                 X509_STORE_CTX_set0_crls(&ctx, crls);
 278
 279         i = X509_verify_cert(&ctx);
 280         if (i <= 0)
 281                 {
 282                 j = X509_STORE_CTX_get_error(&ctx);
 283                 CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY_CERT,
 284                                                 CMS_R_CERTIFICATE_VERIFY_ERROR);
 285                 ERR_add_error_data(2, "Verify error:",
 286                                          X509_verify_cert_error_string(j));
 287                 goto err;
 288                 }
 289         r = 1;
 290         err:
 291         X509_STORE_CTX_cleanup(&ctx);
 292         return r;
 293
 294         }
 295
 296 int CMS_verify(CMS_ContentInfo *cms, STACK_OF(X509) *certs,
 297                  X509_STORE *store, BIO *dcont, BIO *out, unsigned int flags)
 298         {
 299         CMS_SignerInfo *si;
 300         STACK_OF(CMS_SignerInfo) *sinfos;
 301         STACK_OF(X509) *cms_certs = NULL;
 302         STACK_OF(X509_CRL) *crls = NULL;
 303         X509 *signer;
 304         int i, scount = 0, ret = 0;
 305         BIO *cmsbio = NULL, *tmpin = NULL;
 306
 307         if (!dcont)
 308                 {
 309                 ASN1_OCTET_STRING **pos = CMS_get0_content(cms);
 310                 if (!pos || !*pos)
 311                         {
 312                         CMSerr(CMS_F_CMS_VERIFY, CMS_R_NO_CONTENT);
 313                         return 0;
 314                         }
 315                 }
 316
 317         /* Attempt to find all signer certificates */
 318
 319         sinfos = CMS_get0_SignerInfos(cms);
 320
 321         if (sk_CMS_SignerInfo_num(sinfos) <= 0)
 322                 {
 323                 CMSerr(CMS_F_CMS_VERIFY, CMS_R_NO_SIGNERS);
 324                 goto err;
 325                 }
 326
 327         for (i = 0; i < sk_CMS_SignerInfo_num(sinfos); i++)
 328                 {
 329                 si = sk_CMS_SignerInfo_value(sinfos, i);
 330                 CMS_SignerInfo_get0_algs(si, NULL, &signer, NULL, NULL);
 331                 if (signer)
 332                         scount++;
 333                 }
 334
 335         if (scount != sk_CMS_SignerInfo_num(sinfos))
 336                 scount += CMS_set1_signers_certs(cms, certs, flags);
 337
 338         if (scount != sk_CMS_SignerInfo_num(sinfos))
 339                 {
 340                 CMSerr(CMS_F_CMS_VERIFY, CMS_R_SIGNER_CERTIFICATE_NOT_FOUND);
 341                 goto err;
 342                 }
 343
 344         /* Attempt to verify all signers certs */
 345
 346         if (!(flags & CMS_NO_SIGNER_CERT_VERIFY))
 347                 {
 348                 cms_certs = CMS_get1_certs(cms);
 349                 crls = CMS_get1_crls(cms);
 350                 for (i = 0; i < sk_CMS_SignerInfo_num(sinfos); i++)
 351                         {
 352                         si = sk_CMS_SignerInfo_value(sinfos, i);
 353                         if (!cms_signerinfo_verify_cert(si, store,
 354                                                         cms_certs, crls, flags))
 355                                 goto err;
 356                         }
 357                 }
 358
 359         /* Attempt to verify all SignerInfo signed attribute signatures */
 360
 361         if (!(flags & CMS_NO_ATTR_VERIFY))
 362                 {
 363                 for (i = 0; i < sk_CMS_SignerInfo_num(sinfos); i++)
 364                         {
 365                         si = sk_CMS_SignerInfo_value(sinfos, i);
 366                         if (CMS_signed_get_attr_count(si) < 0)
 367                                 continue;
 368                         if (CMS_SignerInfo_verify(si) <= 0)
 369                                 goto err;
 370                         }
 371                 }
 372
 373         /* Performance optimization: if the content is a memory BIO then
 374          * store its contents in a temporary read only memory BIO. This
 375          * avoids potentially large numbers of slow copies of data which will
 376          * occur when reading from a read write memory BIO when signatures
 377          * are calculated.
 378          */
 379
 380         if (dcont && (BIO_method_type(dcont) == BIO_TYPE_MEM))
 381                 {
 382                 char *ptr;
 383                 long len;
 384                 len = BIO_get_mem_data(dcont, &ptr);
 385                 tmpin = BIO_new_mem_buf(ptr, len);
 386                 if (tmpin == NULL)
 387                         {
 388                         CMSerr(CMS_F_CMS_VERIFY,ERR_R_MALLOC_FAILURE);
 389                         return 0;
 390                         }
 391                 }
 392         else
 393                 tmpin = dcont;
 394
 395
 396         cmsbio=CMS_dataInit(cms, tmpin);
 397         if (!cmsbio)
 398                 goto err;
 399
 400         if (!cms_copy_content(out, cmsbio, flags))
 401                 goto err;
 402
 403         if (!(flags & CMS_NO_CONTENT_VERIFY))
 404                 {
 405                 for (i = 0; i < sk_CMS_SignerInfo_num(sinfos); i++)
 406                         {
 407                         si = sk_CMS_SignerInfo_value(sinfos, i);
 408                         if (!CMS_SignerInfo_verify_content(si, cmsbio))
 409                                 {
 410                                 CMSerr(CMS_F_CMS_VERIFY,
 411                                         CMS_R_CONTENT_VERIFY_ERROR);
 412                                 goto err;
 413                                 }
 414                         }
 415                 }
 416
 417         ret = 1;
 418
 419         err:
 420
 421         if (dcont && (tmpin == dcont))
 422                 BIO_pop(cmsbio);
 423         BIO_free_all(cmsbio);
 424
 425         if (cms_certs)
 426                 sk_X509_pop_free(cms_certs, X509_free);
 427         if (crls)
 428                 sk_X509_CRL_pop_free(crls, X509_CRL_free);
 429
 430         return ret;
 431         }
 432
 433 CMS_ContentInfo *CMS_sign(X509 *signcert, EVP_PKEY *pkey, STACK_OF(X509) *certs,
 434                                                 BIO *data, unsigned int flags)
 435         {
 436         CMS_ContentInfo *cms;
 437         int i;
 438         cms = CMS_ContentInfo_new();
 439         if (!cms)
 440                 goto merr;
 441         if (pkey && !CMS_add1_signer(cms, signcert, pkey, NULL, flags))
 442                 {
 443                 CMSerr(CMS_F_CMS_SIGN, CMS_R_ADD_SIGNER_ERROR);
 444                 goto err;
 445                 }
 446         for (i = 0; i < sk_X509_num(certs); i++)
 447                 {
 448                 X509 *x = sk_X509_value(certs, i);
 449                 if (!CMS_add1_cert(cms, x))
 450                         goto merr;
 451                 }
 452         /* If no signer or certs initialize signedData */
 453         if (!pkey && !i && !CMS_SignedData_init(cms))
 454                 goto merr;
 455
 456         if(!(flags & CMS_DETACHED))
 457                 CMS_set_detached(cms, 0);
 458
 459         if ((flags & (CMS_STREAM|CMS_PARTIAL)) || CMS_final(cms, data, flags))
 460                 return cms;
 461
 462         return cms;
 463
 464         merr:
 465         CMSerr(CMS_F_CMS_SIGN, ERR_R_MALLOC_FAILURE);
 466
 467         err:
 468         if (cms)
 469                 CMS_ContentInfo_free(cms);
 470         return NULL;
 471         }
 472
 473 /* Placeholders for now... */
 474
 475 CMS_ContentInfo *CMS_encrypt(STACK_OF(X509) *certs, BIO *in,
 476                                 const EVP_CIPHER *cipher, unsigned int flags)
 477         {
 478         return NULL;
 479         }
 480
 481 int CMS_decrypt(CMS_ContentInfo *cms, EVP_PKEY *pkey, X509 *cert, BIO *data,
 482                                 unsigned int flags)
 483         {
 484         return 0;
 485         }
 486
 487 int CMS_final(CMS_ContentInfo *cms, BIO *data, int flags)
 488         {
 489         BIO *cmsbio;
 490         int ret = 0;
 491         if (!(cmsbio = CMS_dataInit(cms, NULL)))
 492                 {
 493                 CMSerr(CMS_F_CMS_FINAL,ERR_R_MALLOC_FAILURE);
 494                 return 0;
 495                 }
 496
 497         SMIME_crlf_copy(data, cmsbio, flags);
 498
 499         (void)BIO_flush(cmsbio);
 500
 501
 502         if (!CMS_dataFinal(cms, cmsbio))
 503                 {
 504                 CMSerr(CMS_F_CMS_FINAL,CMS_R_CMS_DATAFINAL_ERROR);
 505                 goto err;
 506                 }
 507
 508         ret = 1;
 509
 510         err:
 511         BIO_free_all(cmsbio);
 512
 513         return ret;
 514
 515         }
 516
 517 #ifdef ZLIB
 518
 519 int CMS_uncompress(CMS_ContentInfo *cms, BIO *dcont, BIO *out,
 520                                                         unsigned int flags)
 521         {
 522         BIO *cont;
 523         int r;
 524         if (OBJ_obj2nid(CMS_get0_type(cms)) != NID_id_smime_ct_compressedData)
 525                 {
 526                 CMSerr(CMS_F_CMS_UNCOMPRESS,
 527                                         CMS_R_TYPE_NOT_COMPRESSED_DATA);
 528                 return 0;
 529                 }
 530
 531         if (!dcont)
 532                 {
 533                 ASN1_OCTET_STRING **pos = CMS_get0_content(cms);
 534                 if (!pos || !*pos)
 535                         {
 536                         CMSerr(CMS_F_CMS_UNCOMPRESS, CMS_R_NO_CONTENT);
 537                         return 0;
 538                         }
 539                 }
 540
 541         cont = CMS_dataInit(cms, dcont);
 542         if (!cont)
 543                 return 0;
 544         r = cms_copy_content(out, cont, flags);
 545         BIO_free_all(cont);
 546         return r;
 547         }
 548
 549 CMS_ContentInfo *CMS_compress(BIO *in, int comp_nid, unsigned int flags)
 550         {
 551         CMS_ContentInfo *cms;
 552         if (comp_nid <= 0)
 553                 comp_nid = NID_zlib_compression;
 554         cms = cms_CompressedData_create(comp_nid);
 555         if (!cms)
 556                 return NULL;
 557
 558         if(!(flags & CMS_DETACHED))
 559                 CMS_set_detached(cms, 0);
 560
 561         if ((flags & CMS_STREAM) || CMS_final(cms, in, flags))
 562                 return cms;
 563
 564         CMS_ContentInfo_free(cms);
 565         return NULL;
 566         }
 567
 568 #else
 569
 570 int CMS_uncompress(CMS_ContentInfo *cms, BIO *dcont, BIO *out,
 571                                                         unsigned int flags)
 572         {
 573         CMSerr(CMS_F_CMS_UNCOMPRESS, CMS_R_UNSUPPORTED_COMPRESSION_ALGORITHM);
 574         return 0;
 575         }
 576
 577 CMS_ContentInfo *CMS_compress(BIO *in, int comp_nid, unsigned int flags)
 578         {
 579         CMSerr(CMS_F_CMS_COMPRESS, CMS_R_UNSUPPORTED_COMPRESSION_ALGORITHM);
 580         return NULL;
 581         }
 582
 583 #endif