- {
- int ret=0;
- int i,j;
- BIO *btmp;
- BUF_MEM *buf_mem=NULL;
- BUF_MEM *buf=NULL;
- PKCS7_SIGNER_INFO *si;
- EVP_MD_CTX *mdc,ctx_tmp;
- STACK_OF(X509_ATTRIBUTE) *sk;
- STACK_OF(PKCS7_SIGNER_INFO) *si_sk=NULL;
- unsigned char *p,*pp=NULL;
- int x;
- ASN1_OCTET_STRING *os=NULL;
-
- i=OBJ_obj2nid(p7->type);
- p7->state=PKCS7_S_HEADER;
-
- switch (i)
- {
- case NID_pkcs7_signedAndEnveloped:
- /* XXXXXXXXXXXXXXXX */
- si_sk=p7->d.signed_and_enveloped->signer_info;
- os=M_ASN1_OCTET_STRING_new();
- p7->d.signed_and_enveloped->enc_data->enc_data=os;
- break;
- case NID_pkcs7_enveloped:
- /* XXXXXXXXXXXXXXXX */
- os=M_ASN1_OCTET_STRING_new();
- p7->d.enveloped->enc_data->enc_data=os;
- break;
- case NID_pkcs7_signed:
- si_sk=p7->d.sign->signer_info;
- os=p7->d.sign->contents->d.data;
- /* If detached data then the content is excluded */
- if(p7->detached) {
- M_ASN1_OCTET_STRING_free(os);
- p7->d.sign->contents->d.data = NULL;
- }
- break;
- }
-
- if (si_sk != NULL)
- {
- if ((buf=BUF_MEM_new()) == NULL)
- {
- PKCS7err(PKCS7_F_PKCS7_DATASIGN,ERR_R_BIO_LIB);
- goto err;
- }
- for (i=0; i<sk_PKCS7_SIGNER_INFO_num(si_sk); i++)
- {
- si=sk_PKCS7_SIGNER_INFO_value(si_sk,i);
- if (si->pkey == NULL) continue;
-
- j=OBJ_obj2nid(si->digest_alg->algorithm);
-
- btmp=bio;
- for (;;)
- {
- if ((btmp=BIO_find_type(btmp,BIO_TYPE_MD))
- == NULL)
- {
- PKCS7err(PKCS7_F_PKCS7_DATASIGN,PKCS7_R_UNABLE_TO_FIND_MESSAGE_DIGEST);
- goto err;
- }
- BIO_get_md_ctx(btmp,&mdc);
- if (mdc == NULL)
- {
- PKCS7err(PKCS7_F_PKCS7_DATASIGN,PKCS7_R_INTERNAL_ERROR);
- goto err;
- }
- if (EVP_MD_CTX_type(mdc) == j)
- break;
- else
- btmp=BIO_next(btmp);
- }
-
- /* We now have the EVP_MD_CTX, lets do the
- * signing. */
- memcpy(&ctx_tmp,mdc,sizeof(ctx_tmp));
- if (!BUF_MEM_grow(buf,EVP_PKEY_size(si->pkey)))
- {
- PKCS7err(PKCS7_F_PKCS7_DATASIGN,ERR_R_BIO_LIB);
- goto err;
- }
-
- sk=si->auth_attr;
-
- /* If there are attributes, we add the digest
- * attribute and only sign the attributes */
- if ((sk != NULL) && (sk_X509_ATTRIBUTE_num(sk) != 0))
- {
- unsigned char md_data[EVP_MAX_MD_SIZE];
- unsigned int md_len;
- ASN1_OCTET_STRING *digest;
- ASN1_UTCTIME *sign_time;
- const EVP_MD *md_tmp;
-
- /* Add signing time */
- sign_time=X509_gmtime_adj(NULL,0);
- PKCS7_add_signed_attribute(si,
- NID_pkcs9_signingTime,
- V_ASN1_UTCTIME,sign_time);
-
- /* Add digest */
- md_tmp=EVP_MD_CTX_md(&ctx_tmp);
- EVP_DigestFinal(&ctx_tmp,md_data,&md_len);
- digest=M_ASN1_OCTET_STRING_new();
- M_ASN1_OCTET_STRING_set(digest,md_data,md_len);
- PKCS7_add_signed_attribute(si,
- NID_pkcs9_messageDigest,
- V_ASN1_OCTET_STRING,digest);
-
- /* Now sign the mess */
- EVP_SignInit(&ctx_tmp,md_tmp);
- x=i2d_ASN1_SET_OF_X509_ATTRIBUTE(sk,NULL,
- i2d_X509_ATTRIBUTE,
- V_ASN1_SET,V_ASN1_UNIVERSAL,IS_SET);
- pp=(unsigned char *)OPENSSL_malloc(x);
- p=pp;
- i2d_ASN1_SET_OF_X509_ATTRIBUTE(sk,&p,
- i2d_X509_ATTRIBUTE,
- V_ASN1_SET,V_ASN1_UNIVERSAL,IS_SET);
- EVP_SignUpdate(&ctx_tmp,pp,x);
- OPENSSL_free(pp);
- pp=NULL;
- }
-
- if (si->pkey->type == EVP_PKEY_DSA)
- ctx_tmp.digest=EVP_dss1();
-
- if (!EVP_SignFinal(&ctx_tmp,(unsigned char *)buf->data,
- (unsigned int *)&buf->length,si->pkey))
- {
- PKCS7err(PKCS7_F_PKCS7_DATASIGN,ERR_R_EVP_LIB);
- goto err;
- }
- if (!ASN1_STRING_set(si->enc_digest,
- (unsigned char *)buf->data,buf->length))
- {
- PKCS7err(PKCS7_F_PKCS7_DATASIGN,ERR_R_ASN1_LIB);
- goto err;
- }
- }
- }
-
- if (!PKCS7_is_detached(p7))
- {
- btmp=BIO_find_type(bio,BIO_TYPE_MEM);
- if (btmp == NULL)
- {
- PKCS7err(PKCS7_F_PKCS7_DATASIGN,PKCS7_R_UNABLE_TO_FIND_MEM_BIO);
- goto err;
- }
- BIO_get_mem_ptr(btmp,&buf_mem);
- /* Mark the BIO read only then we can use its copy of the data
- * instead of making an extra copy.
- */
- BIO_set_flags(btmp, BIO_FLAGS_MEM_RDONLY);
- BIO_set_mem_eof_return(btmp, 0);
- os->data = (unsigned char *)buf_mem->data;
- os->length = buf_mem->length;
-#if 0
- M_ASN1_OCTET_STRING_set(os,
- (unsigned char *)buf_mem->data,buf_mem->length);
-#endif
- }
- if (pp != NULL) OPENSSL_free(pp);
- pp=NULL;
+{
+ int ret = 0;
+ int i, j;
+ BIO *btmp;
+ PKCS7_SIGNER_INFO *si;
+ EVP_MD_CTX *mdc, ctx_tmp;
+ STACK_OF(X509_ATTRIBUTE) *sk;
+ STACK_OF(PKCS7_SIGNER_INFO) *si_sk = NULL;
+ ASN1_OCTET_STRING *os = NULL;
+
+ if (p7 == NULL) {
+ PKCS7err(PKCS7_F_PKCS7_DATAFINAL, PKCS7_R_INVALID_NULL_POINTER);
+ return 0;
+ }
+
+ if (p7->d.ptr == NULL) {
+ PKCS7err(PKCS7_F_PKCS7_DATAFINAL, PKCS7_R_NO_CONTENT);
+ return 0;
+ }
+
+ EVP_MD_CTX_init(&ctx_tmp);
+ i = OBJ_obj2nid(p7->type);
+ p7->state = PKCS7_S_HEADER;
+
+ switch (i) {
+ case NID_pkcs7_data:
+ os = p7->d.data;
+ break;
+ case NID_pkcs7_signedAndEnveloped:
+ /* XXXXXXXXXXXXXXXX */
+ si_sk = p7->d.signed_and_enveloped->signer_info;
+ os = p7->d.signed_and_enveloped->enc_data->enc_data;
+ if (!os) {
+ os = M_ASN1_OCTET_STRING_new();
+ if (!os) {
+ PKCS7err(PKCS7_F_PKCS7_DATAFINAL, ERR_R_MALLOC_FAILURE);
+ goto err;
+ }
+ p7->d.signed_and_enveloped->enc_data->enc_data = os;
+ }
+ break;
+ case NID_pkcs7_enveloped:
+ /* XXXXXXXXXXXXXXXX */
+ os = p7->d.enveloped->enc_data->enc_data;
+ if (!os) {
+ os = M_ASN1_OCTET_STRING_new();
+ if (!os) {
+ PKCS7err(PKCS7_F_PKCS7_DATAFINAL, ERR_R_MALLOC_FAILURE);
+ goto err;
+ }
+ p7->d.enveloped->enc_data->enc_data = os;
+ }
+ break;
+ case NID_pkcs7_signed:
+ si_sk = p7->d.sign->signer_info;
+ os = PKCS7_get_octet_string(p7->d.sign->contents);
+ /* If detached data then the content is excluded */
+ if (PKCS7_type_is_data(p7->d.sign->contents) && p7->detached) {
+ M_ASN1_OCTET_STRING_free(os);
+ os = NULL;
+ p7->d.sign->contents->d.data = NULL;
+ }
+ break;
+
+ case NID_pkcs7_digest:
+ os = PKCS7_get_octet_string(p7->d.digest->contents);
+ /* If detached data then the content is excluded */
+ if (PKCS7_type_is_data(p7->d.digest->contents) && p7->detached) {
+ M_ASN1_OCTET_STRING_free(os);
+ os = NULL;
+ p7->d.digest->contents->d.data = NULL;
+ }
+ break;
+
+ default:
+ PKCS7err(PKCS7_F_PKCS7_DATAFINAL, PKCS7_R_UNSUPPORTED_CONTENT_TYPE);
+ goto err;
+ }
+
+ if (si_sk != NULL) {
+ for (i = 0; i < sk_PKCS7_SIGNER_INFO_num(si_sk); i++) {
+ si = sk_PKCS7_SIGNER_INFO_value(si_sk, i);
+ if (si->pkey == NULL)
+ continue;
+
+ j = OBJ_obj2nid(si->digest_alg->algorithm);
+
+ btmp = bio;
+
+ btmp = PKCS7_find_digest(&mdc, btmp, j);
+
+ if (btmp == NULL)
+ goto err;
+
+ /*
+ * We now have the EVP_MD_CTX, lets do the signing.
+ */
+ if (!EVP_MD_CTX_copy_ex(&ctx_tmp, mdc))
+ goto err;
+
+ sk = si->auth_attr;
+
+ /*
+ * If there are attributes, we add the digest attribute and only
+ * sign the attributes
+ */
+ if (sk_X509_ATTRIBUTE_num(sk) > 0) {
+ if (!do_pkcs7_signed_attrib(si, &ctx_tmp))
+ goto err;
+ } else {
+ unsigned char *abuf = NULL;
+ unsigned int abuflen;
+ abuflen = EVP_PKEY_size(si->pkey);
+ abuf = OPENSSL_malloc(abuflen);
+ if (!abuf)
+ goto err;
+
+ if (!EVP_SignFinal(&ctx_tmp, abuf, &abuflen, si->pkey)) {
+ PKCS7err(PKCS7_F_PKCS7_DATAFINAL, ERR_R_EVP_LIB);
+ goto err;
+ }
+ ASN1_STRING_set0(si->enc_digest, abuf, abuflen);
+ }
+ }
+ } else if (i == NID_pkcs7_digest) {
+ unsigned char md_data[EVP_MAX_MD_SIZE];
+ unsigned int md_len;
+ if (!PKCS7_find_digest(&mdc, bio,
+ OBJ_obj2nid(p7->d.digest->md->algorithm)))
+ goto err;
+ if (!EVP_DigestFinal_ex(mdc, md_data, &md_len))
+ goto err;
+ M_ASN1_OCTET_STRING_set(p7->d.digest->digest, md_data, md_len);
+ }
+
+ if (!PKCS7_is_detached(p7)) {
+ /*
+ * NOTE(emilia): I think we only reach os == NULL here because detached
+ * digested data support is broken.
+ */
+ if (os == NULL)
+ goto err;
+ if (!(os->flags & ASN1_STRING_FLAG_NDEF)) {
+ char *cont;
+ long contlen;
+ btmp = BIO_find_type(bio, BIO_TYPE_MEM);
+ if (btmp == NULL) {
+ PKCS7err(PKCS7_F_PKCS7_DATAFINAL, PKCS7_R_UNABLE_TO_FIND_MEM_BIO);
+ goto err;
+ }
+ contlen = BIO_get_mem_data(btmp, &cont);
+ /*
+ * Mark the BIO read only then we can use its copy of the data
+ * instead of making an extra copy.
+ */
+ BIO_set_flags(btmp, BIO_FLAGS_MEM_RDONLY);
+ BIO_set_mem_eof_return(btmp, 0);
+ ASN1_STRING_set0(os, (unsigned char *)cont, contlen);
+ }
+ }
+ ret = 1;
+ err:
+ EVP_MD_CTX_cleanup(&ctx_tmp);
+ return (ret);
+}