/* pk7_smime.c */
/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
- * project 1999.
+ * project.
*/
/* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project. All rights reserved.
+ * Copyright (c) 1999-2004 The OpenSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
#include <openssl/x509v3.h>
PKCS7 *PKCS7_sign(X509 *signcert, EVP_PKEY *pkey, STACK_OF(X509) *certs,
- BIO *data, int flags)
+ BIO *data, int flags)
{
PKCS7 *p7;
PKCS7_SIGNER_INFO *si;
BIO *p7bio;
- STACK *smcap;
+ STACK_OF(X509_ALGOR) *smcap;
int i;
if(!X509_check_private_key(signcert, pkey)) {
PKCS7_add_certificate(p7, sk_X509_value(certs, i));
}
- if(!(p7bio = PKCS7_dataInit(p7, NULL))) {
- PKCS7err(PKCS7_F_PKCS7_SIGN,ERR_R_MALLOC_FAILURE);
- return NULL;
- }
-
-
- SMIME_crlf_copy(data, p7bio, flags);
-
if(!(flags & PKCS7_NOATTR)) {
PKCS7_add_signed_attribute(si, NID_pkcs9_contentType,
V_ASN1_OBJECT, OBJ_nid2obj(NID_pkcs7_data));
/* Add SMIMECapabilities */
- if(!(smcap = sk_new(NULL))) {
+ if(!(flags & PKCS7_NOSMIMECAP))
+ {
+ if(!(smcap = sk_X509_ALGOR_new_null())) {
PKCS7err(PKCS7_F_PKCS7_SIGN,ERR_R_MALLOC_FAILURE);
return NULL;
}
-#ifndef NO_DES
+#ifndef OPENSSL_NO_DES
PKCS7_simple_smimecap (smcap, NID_des_ede3_cbc, -1);
- PKCS7_simple_smimecap (smcap, NID_des_cbc, -1);
#endif
-#ifndef NO_RC2
- PKCS7_simple_smimecap (smcap, NID_rc2_cbc, 40);
+#ifndef OPENSSL_NO_RC2
PKCS7_simple_smimecap (smcap, NID_rc2_cbc, 128);
PKCS7_simple_smimecap (smcap, NID_rc2_cbc, 64);
+#endif
+#ifndef OPENSSL_NO_DES
+ PKCS7_simple_smimecap (smcap, NID_des_cbc, -1);
+#endif
+#ifndef OPENSSL_NO_RC2
+ PKCS7_simple_smimecap (smcap, NID_rc2_cbc, 40);
#endif
PKCS7_add_attrib_smimecap (si, smcap);
- sk_pop_free(smcap, X509_ALGOR_free);
+ sk_X509_ALGOR_pop_free(smcap, X509_ALGOR_free);
+ }
}
+ if (flags & PKCS7_STREAM)
+ return p7;
+
+ if (!(p7bio = PKCS7_dataInit(p7, NULL))) {
+ PKCS7err(PKCS7_F_PKCS7_SIGN,ERR_R_MALLOC_FAILURE);
+ return NULL;
+ }
+
+ SMIME_crlf_copy(data, p7bio, flags);
+
if(flags & PKCS7_DETACHED)PKCS7_set_detached(p7, 1);
if (!PKCS7_dataFinal(p7,p7bio)) {
X509 *signer;
STACK_OF(PKCS7_SIGNER_INFO) *sinfos;
PKCS7_SIGNER_INFO *si;
- PKCS7_ISSUER_AND_SERIAL *ias;
X509_STORE_CTX cert_ctx;
char buf[4096];
- int i, j=0;
+ int i, j=0, k, ret = 0;
BIO *p7bio;
- BIO *tmpout;
+ BIO *tmpin, *tmpout;
- if(OBJ_obj2nid(p7->type) != NID_pkcs7_signed) {
- PKCS7err(PKCS7_F_PKCS7_VERIFY,PKCS7_R_WRONG_CONTENT_TYPE);
+ if(!p7) {
+ PKCS7err(PKCS7_F_PKCS7_VERIFY,PKCS7_R_INVALID_NULL_POINTER);
+ return 0;
+ }
+
+ if(!PKCS7_type_is_signed(p7)) {
+ PKCS7err(PKCS7_F_PKCS7_VERIFY,PKCS7_R_WRONG_CONTENT_TYPE);
return 0;
}
/* Check for no data and no content: no data to verify signature */
if(PKCS7_get_detached(p7) && !indata) {
- PKCS7err(PKCS7_F_PKCS7_VERIFY,PKCS7_R_NO_CONTENT);
+ PKCS7err(PKCS7_F_PKCS7_VERIFY,PKCS7_R_NO_CONTENT);
return 0;
}
+#if 0
+ /* NB: this test commented out because some versions of Netscape
+ * illegally include zero length content when signing data.
+ */
/* Check for data and content: two sets of data */
if(!PKCS7_get_detached(p7) && indata) {
PKCS7err(PKCS7_F_PKCS7_VERIFY,PKCS7_R_CONTENT_AND_DATA_PRESENT);
return 0;
}
+#endif
sinfos = PKCS7_get_signer_info(p7);
if(!sinfos || !sk_PKCS7_SIGNER_INFO_num(sinfos)) {
- PKCS7err(PKCS7_F_PKCS7_VERIFY,PKCS7_R_NO_SIGNATURES_ON_DATA);
- return 0;
- }
-
-
- if(!(signers = sk_X509_new(NULL))) {
- PKCS7err(PKCS7_F_PKCS7_VERIFY,ERR_R_MALLOC_FAILURE);
+ PKCS7err(PKCS7_F_PKCS7_VERIFY,PKCS7_R_NO_SIGNATURES_ON_DATA);
return 0;
}
- /* Collect all the signers together */
- for (i = 0; i < sk_PKCS7_SIGNER_INFO_num(sinfos); i++)
- {
- si = sk_PKCS7_SIGNER_INFO_value(sinfos, i);
- ias = si->issuer_and_serial;
- signer = NULL;
- /* If any certificates passed they take priority */
- if (certs) signer = X509_find_by_issuer_and_serial (certs,
- ias->issuer, ias->serial);
- if (!signer && !(flags & PKCS7_NOINTERN)
- && p7->d.sign->cert) signer =
- X509_find_by_issuer_and_serial (p7->d.sign->cert,
- ias->issuer, ias->serial);
- if (!signer) {
- PKCS7err(PKCS7_F_PKCS7_VERIFY,PKCS7_R_SIGNER_CERTIFICATE_NOT_FOUND);
- sk_X509_free(signers);
- return 0;
- }
-
- sk_X509_push(signers, signer);
- }
+ signers = PKCS7_get0_signers(p7, certs, flags);
+ if(!signers) return 0;
/* Now verify the certificates */
- if (!(flags & PKCS7_NOVERIFY)) for (i = 0; i < sk_X509_num(signers); i++) {
- signer = sk_X509_value (signers, i);
+ if (!(flags & PKCS7_NOVERIFY)) for (k = 0; k < sk_X509_num(signers); k++) {
+ signer = sk_X509_value (signers, k);
if (!(flags & PKCS7_NOCHAIN)) {
- X509_STORE_CTX_init(&cert_ctx, store, signer,
- p7->d.sign->cert);
+ if(!X509_STORE_CTX_init(&cert_ctx, store, signer,
+ p7->d.sign->cert))
+ {
+ PKCS7err(PKCS7_F_PKCS7_VERIFY,ERR_R_X509_LIB);
+ sk_X509_free(signers);
+ return 0;
+ }
X509_STORE_CTX_set_purpose(&cert_ctx,
X509_PURPOSE_SMIME_SIGN);
- } else X509_STORE_CTX_init (&cert_ctx, store, signer, NULL);
+ } else if(!X509_STORE_CTX_init (&cert_ctx, store, signer, NULL)) {
+ PKCS7err(PKCS7_F_PKCS7_VERIFY,ERR_R_X509_LIB);
+ sk_X509_free(signers);
+ return 0;
+ }
+ if (!(flags & PKCS7_NOCRL))
+ X509_STORE_CTX_set0_crls(&cert_ctx, p7->d.sign->crl);
i = X509_verify_cert(&cert_ctx);
if (i <= 0) j = X509_STORE_CTX_get_error(&cert_ctx);
X509_STORE_CTX_cleanup(&cert_ctx);
/* Check for revocation status here */
}
- p7bio=PKCS7_dataInit(p7,indata);
+ /* Performance optimization: if the content is a memory BIO then
+ * store its contents in a temporary read only memory BIO. This
+ * avoids potentially large numbers of slow copies of data which will
+ * occur when reading from a read write memory BIO when signatures
+ * are calculated.
+ */
+
+ if (indata && (BIO_method_type(indata) == BIO_TYPE_MEM))
+ {
+ char *ptr;
+ long len;
+ len = BIO_get_mem_data(indata, &ptr);
+ tmpin = BIO_new_mem_buf(ptr, len);
+ if (tmpin == NULL)
+ {
+ PKCS7err(PKCS7_F_PKCS7_VERIFY,ERR_R_MALLOC_FAILURE);
+ return 0;
+ }
+ }
+ else
+ tmpin = indata;
+
+
+ p7bio=PKCS7_dataInit(p7,tmpin);
if(flags & PKCS7_TEXT) {
if(!(tmpout = BIO_new(BIO_s_mem()))) {
}
}
- sk_X509_free(signers);
- if(indata) BIO_pop(p7bio);
- BIO_free_all(p7bio);
-
- return 1;
+ ret = 1;
err:
+
+ if (tmpin == indata)
+ {
+ if(indata) BIO_pop(p7bio);
+ BIO_free_all(p7bio);
+ }
+ else
+ BIO_free_all(tmpin);
sk_X509_free(signers);
- BIO_free(p7bio);
- return 0;
+ return ret;
+}
+
+STACK_OF(X509) *PKCS7_get0_signers(PKCS7 *p7, STACK_OF(X509) *certs, int flags)
+{
+ STACK_OF(X509) *signers;
+ STACK_OF(PKCS7_SIGNER_INFO) *sinfos;
+ PKCS7_SIGNER_INFO *si;
+ PKCS7_ISSUER_AND_SERIAL *ias;
+ X509 *signer;
+ int i;
+
+ if(!p7) {
+ PKCS7err(PKCS7_F_PKCS7_GET0_SIGNERS,PKCS7_R_INVALID_NULL_POINTER);
+ return NULL;
+ }
+
+ if(!PKCS7_type_is_signed(p7)) {
+ PKCS7err(PKCS7_F_PKCS7_GET0_SIGNERS,PKCS7_R_WRONG_CONTENT_TYPE);
+ return NULL;
+ }
+
+ /* Collect all the signers together */
+
+ sinfos = PKCS7_get_signer_info(p7);
+
+ if(sk_PKCS7_SIGNER_INFO_num(sinfos) <= 0) {
+ PKCS7err(PKCS7_F_PKCS7_GET0_SIGNERS,PKCS7_R_NO_SIGNERS);
+ return 0;
+ }
+
+ if(!(signers = sk_X509_new_null())) {
+ PKCS7err(PKCS7_F_PKCS7_GET0_SIGNERS,ERR_R_MALLOC_FAILURE);
+ return NULL;
+ }
+
+ for (i = 0; i < sk_PKCS7_SIGNER_INFO_num(sinfos); i++)
+ {
+ si = sk_PKCS7_SIGNER_INFO_value(sinfos, i);
+ ias = si->issuer_and_serial;
+ signer = NULL;
+ /* If any certificates passed they take priority */
+ if (certs) signer = X509_find_by_issuer_and_serial (certs,
+ ias->issuer, ias->serial);
+ if (!signer && !(flags & PKCS7_NOINTERN)
+ && p7->d.sign->cert) signer =
+ X509_find_by_issuer_and_serial (p7->d.sign->cert,
+ ias->issuer, ias->serial);
+ if (!signer) {
+ PKCS7err(PKCS7_F_PKCS7_GET0_SIGNERS,PKCS7_R_SIGNER_CERTIFICATE_NOT_FOUND);
+ sk_X509_free(signers);
+ return 0;
+ }
+
+ sk_X509_push(signers, signer);
+ }
+ return signers;
}
+
/* Build a complete PKCS#7 enveloped data */
-PKCS7 *PKCS7_encrypt(STACK_OF(X509) *certs, BIO *in, EVP_CIPHER *cipher,
+PKCS7 *PKCS7_encrypt(STACK_OF(X509) *certs, BIO *in, const EVP_CIPHER *cipher,
int flags)
{
PKCS7 *p7;
BIO *p7bio = NULL;
int i;
X509 *x509;
- char inbuf[4096];
- static char txthdr[] = "Content-type: text/plain\r\n\r\n";
if(!(p7 = PKCS7_new())) {
PKCS7err(PKCS7_F_PKCS7_ENCRYPT,ERR_R_MALLOC_FAILURE);
return NULL;
goto err;
}
- if(flags & PKCS7_TEXT) {
- if(BIO_write(p7bio, txthdr, sizeof(txthdr) - 1) < 0) {
- goto err;
- }
- }
+ SMIME_crlf_copy(in, p7bio, flags);
- for (;;) {
- i = BIO_read(in, inbuf, sizeof(inbuf));
- if (i <= 0) break;
- BIO_write(p7bio, inbuf, i);
- }
BIO_flush(p7bio);
if (!PKCS7_dataFinal(p7,p7bio)) {
BIO *tmpmem;
int ret, i;
char buf[4096];
+
+ if(!p7) {
+ PKCS7err(PKCS7_F_PKCS7_DECRYPT,PKCS7_R_INVALID_NULL_POINTER);
+ return 0;
+ }
+
if(!PKCS7_type_is_enveloped(p7)) {
PKCS7err(PKCS7_F_PKCS7_DECRYPT,PKCS7_R_WRONG_CONTENT_TYPE);
return 0;
}
+
if(!X509_check_private_key(cert, pkey)) {
PKCS7err(PKCS7_F_PKCS7_DECRYPT,
PKCS7_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE);
projects / openssl.git / blobdiff