- X509 *signer, EVP_PKEY *pk, const EVP_MD *md,
- unsigned int flags)
- {
- CMS_SignedData *sd;
- CMS_SignerInfo *si = NULL;
- X509_ALGOR *alg;
- int i, type;
- if(!X509_check_private_key(signer, pk))
- {
- CMSerr(CMS_F_CMS_ADD1_SIGNER,
- CMS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE);
- return NULL;
- }
- sd = cms_signed_data_init(cms);
- if (!sd)
- goto err;
- si = M_ASN1_new_of(CMS_SignerInfo);
- if (!si)
- goto merr;
- X509_check_purpose(signer, -1, -1);
-
- CRYPTO_add(&pk->references, 1, CRYPTO_LOCK_EVP_PKEY);
- CRYPTO_add(&signer->references, 1, CRYPTO_LOCK_X509);
-
- si->pkey = pk;
- si->signer = signer;
-
- if (flags & CMS_USE_KEYID)
- {
- si->version = 3;
- if (sd->version < 3)
- sd->version = 3;
- type = CMS_SIGNERINFO_KEYIDENTIFIER;
- }
- else
- {
- type = CMS_SIGNERINFO_ISSUER_SERIAL;
- si->version = 1;
- }
-
- if (!cms_set1_SignerIdentifier(si->sid, signer, type))
- goto err;
-
- if (md == NULL)
- {
- int def_nid;
- if (EVP_PKEY_get_default_digest_nid(pk, &def_nid) <= 0)
- goto err;
- md = EVP_get_digestbynid(def_nid);
- if (md == NULL)
- {
- CMSerr(CMS_F_CMS_ADD1_SIGNER, CMS_R_NO_DEFAULT_DIGEST);
- goto err;
- }
- }
-
- if (!md)
- {
- CMSerr(CMS_F_CMS_ADD1_SIGNER, CMS_R_NO_DIGEST_SET);
- goto err;
- }
-
- cms_DigestAlgorithm_set(si->digestAlgorithm, md);
-
- /* See if digest is present in digestAlgorithms */
- for (i = 0; i < sk_X509_ALGOR_num(sd->digestAlgorithms); i++)
- {
- ASN1_OBJECT *aoid;
- alg = sk_X509_ALGOR_value(sd->digestAlgorithms, i);
- X509_ALGOR_get0(&aoid, NULL, NULL, alg);
- if (OBJ_obj2nid(aoid) == EVP_MD_type(md))
- break;
- }
-
- if (i == sk_X509_ALGOR_num(sd->digestAlgorithms))
- {
- alg = X509_ALGOR_new();
- if (!alg)
- goto merr;
- cms_DigestAlgorithm_set(alg, md);
- if (!sk_X509_ALGOR_push(sd->digestAlgorithms, alg))
- {
- X509_ALGOR_free(alg);
- goto merr;
- }
- }
-
- if (pk->ameth && pk->ameth->pkey_ctrl)
- {
- i = pk->ameth->pkey_ctrl(pk, ASN1_PKEY_CTRL_CMS_SIGN,
- 0, si);
- if (i == -2)
- {
- CMSerr(CMS_F_CMS_ADD1_SIGNER,
- CMS_R_NOT_SUPPORTED_FOR_THIS_KEY_TYPE);
- goto err;
- }
- if (i <= 0)
- {
- CMSerr(CMS_F_CMS_ADD1_SIGNER, CMS_R_CTRL_FAILURE);
- goto err;
- }
- }
-
- if (!(flags & CMS_NOATTR))
- {
- /* Copy content type across */
- ASN1_OBJECT *ctype =
- OBJ_dup(sd->encapContentInfo->eContentType);
- if (!ctype)
- goto merr;
- i = CMS_signed_add1_attr_by_NID(si, NID_pkcs9_contentType,
- V_ASN1_OBJECT, ctype, -1);
- ASN1_OBJECT_free(ctype);
- if (i <= 0)
- goto merr;
- if (!(flags & CMS_NOSMIMECAP))
- {
- STACK_OF(X509_ALGOR) *smcap = NULL;
- i = CMS_add_standard_smimecap(&smcap);
- if (i)
- i = CMS_add_smimecap(si, smcap);
- sk_X509_ALGOR_pop_free(smcap, X509_ALGOR_free);
- if (!i)
- goto merr;
- }
- if (flags & CMS_REUSE_DIGEST)
- {
- if (!cms_copy_messageDigest(cms, si))
- goto err;
- if (!(flags & CMS_PARTIAL) &&
- !CMS_SignerInfo_sign(si))
- goto err;
- }
- }
-
- if (!(flags & CMS_NOCERTS))
- {
- /* NB ignore -1 return for duplicate cert */
- if (!CMS_add1_cert(cms, signer))
- goto merr;
- }
-
- if (!sd->signerInfos)
- sd->signerInfos = sk_CMS_SignerInfo_new_null();
- if (!sd->signerInfos ||
- !sk_CMS_SignerInfo_push(sd->signerInfos, si))
- goto merr;
-
- return si;
-
- merr:
- CMSerr(CMS_F_CMS_ADD1_SIGNER, ERR_R_MALLOC_FAILURE);
- err:
- if (si)
- M_ASN1_free_of(si, CMS_SignerInfo);
- return NULL;
-
- }
+ X509 *signer, EVP_PKEY *pk, const EVP_MD *md,
+ unsigned int flags)
+{
+ CMS_SignedData *sd;
+ CMS_SignerInfo *si = NULL;
+ X509_ALGOR *alg;
+ int i, type;
+ if (!X509_check_private_key(signer, pk)) {
+ CMSerr(CMS_F_CMS_ADD1_SIGNER,
+ CMS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE);
+ return NULL;
+ }
+ sd = cms_signed_data_init(cms);
+ if (!sd)
+ goto err;
+ si = M_ASN1_new_of(CMS_SignerInfo);
+ if (!si)
+ goto merr;
+ X509_check_purpose(signer, -1, -1);
+
+ CRYPTO_add(&pk->references, 1, CRYPTO_LOCK_EVP_PKEY);
+ CRYPTO_add(&signer->references, 1, CRYPTO_LOCK_X509);
+
+ si->pkey = pk;
+ si->signer = signer;
+ EVP_MD_CTX_init(&si->mctx);
+ si->pctx = NULL;
+
+ if (flags & CMS_USE_KEYID) {
+ si->version = 3;
+ if (sd->version < 3)
+ sd->version = 3;
+ type = CMS_SIGNERINFO_KEYIDENTIFIER;
+ } else {
+ type = CMS_SIGNERINFO_ISSUER_SERIAL;
+ si->version = 1;
+ }
+
+ if (!cms_set1_SignerIdentifier(si->sid, signer, type))
+ goto err;
+
+ if (md == NULL) {
+ int def_nid;
+ if (EVP_PKEY_get_default_digest_nid(pk, &def_nid) <= 0)
+ goto err;
+ md = EVP_get_digestbynid(def_nid);
+ if (md == NULL) {
+ CMSerr(CMS_F_CMS_ADD1_SIGNER, CMS_R_NO_DEFAULT_DIGEST);
+ goto err;
+ }
+ }
+
+ if (!md) {
+ CMSerr(CMS_F_CMS_ADD1_SIGNER, CMS_R_NO_DIGEST_SET);
+ goto err;
+ }
+
+ cms_DigestAlgorithm_set(si->digestAlgorithm, md);
+
+ /* See if digest is present in digestAlgorithms */
+ for (i = 0; i < sk_X509_ALGOR_num(sd->digestAlgorithms); i++) {
+ ASN1_OBJECT *aoid;
+ alg = sk_X509_ALGOR_value(sd->digestAlgorithms, i);
+ X509_ALGOR_get0(&aoid, NULL, NULL, alg);
+ if (OBJ_obj2nid(aoid) == EVP_MD_type(md))
+ break;
+ }
+
+ if (i == sk_X509_ALGOR_num(sd->digestAlgorithms)) {
+ alg = X509_ALGOR_new();
+ if (!alg)
+ goto merr;
+ cms_DigestAlgorithm_set(alg, md);
+ if (!sk_X509_ALGOR_push(sd->digestAlgorithms, alg)) {
+ X509_ALGOR_free(alg);
+ goto merr;
+ }
+ }
+
+ if (!(flags & CMS_KEY_PARAM) && !cms_sd_asn1_ctrl(si, 0))
+ goto err;
+ if (!(flags & CMS_NOATTR)) {
+ /*
+ * Initialialize signed attributes strutucture so other attributes
+ * such as signing time etc are added later even if we add none here.
+ */
+ if (!si->signedAttrs) {
+ si->signedAttrs = sk_X509_ATTRIBUTE_new_null();
+ if (!si->signedAttrs)
+ goto merr;
+ }
+
+ if (!(flags & CMS_NOSMIMECAP)) {
+ STACK_OF(X509_ALGOR) *smcap = NULL;
+ i = CMS_add_standard_smimecap(&smcap);
+ if (i)
+ i = CMS_add_smimecap(si, smcap);
+ sk_X509_ALGOR_pop_free(smcap, X509_ALGOR_free);
+ if (!i)
+ goto merr;
+ }
+ if (flags & CMS_REUSE_DIGEST) {
+ if (!cms_copy_messageDigest(cms, si))
+ goto err;
+ if (!(flags & (CMS_PARTIAL | CMS_KEY_PARAM)) &&
+ !CMS_SignerInfo_sign(si))
+ goto err;
+ }
+ }
+
+ if (!(flags & CMS_NOCERTS)) {
+ /* NB ignore -1 return for duplicate cert */
+ if (!CMS_add1_cert(cms, signer))
+ goto merr;
+ }
+
+ if (flags & CMS_KEY_PARAM) {
+ if (flags & CMS_NOATTR) {
+ si->pctx = EVP_PKEY_CTX_new(si->pkey, NULL);
+ if (!si->pctx)
+ goto err;
+ if (EVP_PKEY_sign_init(si->pctx) <= 0)
+ goto err;
+ if (EVP_PKEY_CTX_set_signature_md(si->pctx, md) <= 0)
+ goto err;
+ } else if (EVP_DigestSignInit(&si->mctx, &si->pctx, md, NULL, pk) <=
+ 0)
+ goto err;
+ }
+
+ if (!sd->signerInfos)
+ sd->signerInfos = sk_CMS_SignerInfo_new_null();
+ if (!sd->signerInfos || !sk_CMS_SignerInfo_push(sd->signerInfos, si))
+ goto merr;
+
+ return si;
+
+ merr:
+ CMSerr(CMS_F_CMS_ADD1_SIGNER, ERR_R_MALLOC_FAILURE);
+ err:
+ if (si)
+ M_ASN1_free_of(si, CMS_SignerInfo);
+ return NULL;
+
+}