Add support for digested data PKCS#7 type.

[openssl.git] / crypto / pkcs7 / pk7_lib.c

diff --git a/crypto/pkcs7/pk7_lib.c b/crypto/pkcs7/pk7_lib.c
index 3e0a889288bb5d1339f5e4ab8ed4b6ae74de0bc1..70ee44be8f05be1dfaaf40b190c0f620d6b95108 100644 (file)
--- a/crypto/pkcs7/pk7_lib.c
+++ b/crypto/pkcs7/pk7_lib.c
@@ -74,6 +74,13 @@ long PKCS7_ctrl(PKCS7 *p7, int cmd, long larg, char *parg)
                if (nid == NID_pkcs7_signed)
                        {
                        ret=p7->detached=(int)larg;
+                       if (ret && PKCS7_type_is_data(p7->d.sign->contents))
+                                       {
+                                       ASN1_OCTET_STRING *os;
+                                       os=p7->d.sign->contents->d.data;
+                                       ASN1_OCTET_STRING_free(os);
+                                       p7->d.sign->contents->d.data = NULL;
+                                       }
                        }
                else
                        {
@@ -131,6 +138,10 @@ int PKCS7_set_content(PKCS7 *p7, PKCS7 *p7_data)
                p7->d.sign->contents=p7_data;
                break;
        case NID_pkcs7_digest:
+               if (p7->d.digest->contents != NULL)
+                       PKCS7_free(p7->d.digest->contents);
+               p7->d.digest->contents=p7_data;
+               break;
        case NID_pkcs7_data:
        case NID_pkcs7_enveloped:
        case NID_pkcs7_signedAndEnveloped:
@@ -190,6 +201,11 @@ int PKCS7_set_type(PKCS7 *p7, int type)
                break;
 
        case NID_pkcs7_digest:
+               p7->type=obj;
+               if ((p7->d.digest=PKCS7_DIGEST_new())
+                       == NULL) goto err;
+               ASN1_INTEGER_set(p7->d.digest->version,0);
+               break;
        default:
                PKCS7err(PKCS7_F_PKCS7_SET_TYPE,PKCS7_R_UNSUPPORTED_CONTENT_TYPE);
                goto err;
@@ -199,6 +215,13 @@ err:
        return(0);
        }
 
+int PKCS7_set0_type_other(PKCS7 *p7, int type, ASN1_TYPE *other)
+       {
+       p7->type = OBJ_nid2obj(type);
+       p7->d.other = other;
+       return 1;
+       }
+
 int PKCS7_add_signer(PKCS7 *p7, PKCS7_SIGNER_INFO *psi)
        {
        int i,j,nid;
@@ -307,9 +330,13 @@ int PKCS7_add_crl(PKCS7 *p7, X509_CRL *crl)
 int PKCS7_SIGNER_INFO_set(PKCS7_SIGNER_INFO *p7i, X509 *x509, EVP_PKEY *pkey,
             const EVP_MD *dgst)
        {
+       int nid;
        char is_dsa;
-       if (pkey->type == EVP_PKEY_DSA || pkey->type == EVP_PKEY_ECDSA) is_dsa = 1;
-       else is_dsa = 0;
+
+       if (pkey->type == EVP_PKEY_DSA || pkey->type == EVP_PKEY_EC)
+               is_dsa = 1;
+       else
+               is_dsa = 0;
        /* We now need to add another PKCS7_SIGNER_INFO entry */
        ASN1_INTEGER_set(p7i->version,1);
        X509_NAME_set(&p7i->issuer_and_serial->issuer,
@@ -336,16 +363,38 @@ int PKCS7_SIGNER_INFO_set(PKCS7_SIGNER_INFO *p7i, X509 *x509, EVP_PKEY *pkey,
                goto err;
        p7i->digest_alg->parameter->type=V_ASN1_NULL;
 
-       p7i->digest_enc_alg->algorithm=OBJ_nid2obj(EVP_PKEY_type(pkey->type));
-
        if (p7i->digest_enc_alg->parameter != NULL)
                ASN1_TYPE_free(p7i->digest_enc_alg->parameter);
-       if(is_dsa) p7i->digest_enc_alg->parameter = NULL;
-       else {
+       nid = EVP_PKEY_type(pkey->type);
+       if (nid == EVP_PKEY_RSA)
+               {
+               p7i->digest_enc_alg->algorithm=OBJ_nid2obj(NID_rsaEncryption);
                if (!(p7i->digest_enc_alg->parameter=ASN1_TYPE_new()))
                        goto err;
                p7i->digest_enc_alg->parameter->type=V_ASN1_NULL;
-       }
+               }
+       else if (nid == EVP_PKEY_DSA)
+               {
+#if 1
+               /* use 'dsaEncryption' OID for compatibility with other software
+                * (PKCS #7 v1.5 does specify how to handle DSA) ... */
+               p7i->digest_enc_alg->algorithm=OBJ_nid2obj(NID_dsa);
+#else
+               /* ... although the 'dsaWithSHA1' OID (as required by RFC 2630 for CMS)
+                * would make more sense. */
+               p7i->digest_enc_alg->algorithm=OBJ_nid2obj(NID_dsaWithSHA1);
+#endif
+               p7i->digest_enc_alg->parameter = NULL; /* special case for DSA: omit 'parameter'! */
+               }
+       else if (nid == EVP_PKEY_EC)
+               {
+               p7i->digest_enc_alg->algorithm=OBJ_nid2obj(NID_ecdsa_with_SHA1);
+               if (!(p7i->digest_enc_alg->parameter=ASN1_TYPE_new()))
+                       goto err;
+               p7i->digest_enc_alg->parameter->type=V_ASN1_NULL;
+               }
+       else
+               return(0);
 
        return(1);
 err:
@@ -365,6 +414,24 @@ err:
        return(NULL);
        }
 
+int PKCS7_set_digest(PKCS7 *p7, const EVP_MD *md)
+       {
+       if (PKCS7_type_is_digest(p7))
+               {
+               if(!(p7->d.digest->md->parameter = ASN1_TYPE_new()))
+                       {
+                       PKCS7err(PKCS7_F_PKCS7_SET_DIGEST,ERR_R_MALLOC_FAILURE);
+                       return 0;
+                       }
+               p7->d.digest->md->parameter->type = V_ASN1_NULL;
+               p7->d.digest->md->algorithm = OBJ_nid2obj(EVP_MD_nid(md));
+               return 1;
+               }
+               
+       PKCS7err(PKCS7_F_PKCS7_SET_DIGEST,PKCS7_R_WRONG_CONTENT_TYPE);
+       return 1;
+       }
+
 STACK_OF(PKCS7_SIGNER_INFO) *PKCS7_get_signer_info(PKCS7 *p7)
        {
        if (PKCS7_type_is_signed(p7))