Add -show_chain option to print out verified chain.

[openssl.git] / crypto / pkcs7 / pk7_smime.c

diff --git a/crypto/pkcs7/pk7_smime.c b/crypto/pkcs7/pk7_smime.c
index d3b55e427387ffacc022ad4dbe5ef1e999567353..a5104f8d05af7d826c5dd4c01e52ae3b9294499e 100644 (file)
--- a/crypto/pkcs7/pk7_smime.c
+++ b/crypto/pkcs7/pk7_smime.c
@@ -1,5 +1,5 @@
 /* pk7_smime.c */
-/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
  */
 /* ====================================================================
@@ -98,6 +98,9 @@ PKCS7 *PKCS7_sign(X509 *signcert, EVP_PKEY *pkey, STACK_OF(X509) *certs,
                        }
                }
 
+       if(flags & PKCS7_DETACHED)
+               PKCS7_set_detached(p7, 1);
+
        if (flags & (PKCS7_STREAM|PKCS7_PARTIAL))
                return p7;
 
@@ -121,8 +124,8 @@ int PKCS7_final(PKCS7 *p7, BIO *data, int flags)
 
        SMIME_crlf_copy(data, p7bio, flags);
 
-       if(PKCS7_type_is_signed(p7) && (flags & PKCS7_DETACHED))
-               PKCS7_set_detached(p7, 1);
+       (void)BIO_flush(p7bio);
+
 
         if (!PKCS7_dataFinal(p7,p7bio))
                {
@@ -148,12 +151,18 @@ static int add_cipher_smcap(STACK_OF(X509_ALGOR) *sk, int nid, int arg)
        return 1;
        }
 
+static int add_digest_smcap(STACK_OF(X509_ALGOR) *sk, int nid, int arg)
+       {
+       if (EVP_get_digestbynid(nid))
+               return PKCS7_simple_smimecap(sk, nid, arg);
+       return 1;
+       }
+
 PKCS7_SIGNER_INFO *PKCS7_sign_add_signer(PKCS7 *p7, X509 *signcert,
                                        EVP_PKEY *pkey, const EVP_MD *md,
                                        int flags)
        {
        PKCS7_SIGNER_INFO *si = NULL;
-       int si_free = 1;
        STACK_OF(X509_ALGOR) *smcap = NULL;
        if(!X509_check_private_key(signcert, pkey))
                {
@@ -169,10 +178,6 @@ PKCS7_SIGNER_INFO *PKCS7_sign_add_signer(PKCS7 *p7, X509 *signcert,
                return NULL;
                }
 
-       /* si is now part of p7 so don't free it on error */
-
-       si_free = 0;
-
        if(!(flags & PKCS7_NOCERTS))
                {
                if (!PKCS7_add_certificate(p7, signcert))
@@ -192,7 +197,12 @@ PKCS7_SIGNER_INFO *PKCS7_sign_add_signer(PKCS7 *p7, X509 *signcert,
                                        ERR_R_MALLOC_FAILURE);
                                goto err;
                                }
-                       if (!add_cipher_smcap(smcap, NID_des_ede3_cbc, -1)
+                       if (!add_cipher_smcap(smcap, NID_aes_256_cbc, -1)
+                       || !add_digest_smcap(smcap, NID_id_GostR3411_94, -1)
+                       || !add_cipher_smcap(smcap, NID_id_Gost28147_89, -1)
+                               || !add_cipher_smcap(smcap, NID_aes_192_cbc, -1)
+                               || !add_cipher_smcap(smcap, NID_aes_128_cbc, -1)
+                       || !add_cipher_smcap(smcap, NID_des_ede3_cbc, -1)
                                || !add_cipher_smcap(smcap, NID_rc2_cbc, 128)
                                || !add_cipher_smcap(smcap, NID_rc2_cbc, 64)
                                || !add_cipher_smcap(smcap, NID_des_cbc, -1)
@@ -206,7 +216,8 @@ PKCS7_SIGNER_INFO *PKCS7_sign_add_signer(PKCS7 *p7, X509 *signcert,
                        {
                        if (!pkcs7_copy_existing_digest(p7, si))
                                goto err;
-                       if (!PKCS7_SIGNER_INFO_sign(si))
+                       if (!(flags & PKCS7_PARTIAL) &&
+                                       !PKCS7_SIGNER_INFO_sign(si))
                                goto err;
                        }
                }
@@ -214,8 +225,6 @@ PKCS7_SIGNER_INFO *PKCS7_sign_add_signer(PKCS7 *p7, X509 *signcert,
        err:
        if (smcap)
                sk_X509_ALGOR_pop_free(smcap, X509_ALGOR_free);
-       if (si && si_free)
-               PKCS7_SIGNER_INFO_free(si);
        return NULL;
        }
 
@@ -318,8 +327,7 @@ int PKCS7_verify(PKCS7 *p7, STACK_OF(X509) *certs, X509_STORE *store,
                                sk_X509_free(signers);
                                return 0;
                                }
-                       X509_STORE_CTX_set_purpose(&cert_ctx,
-                                               X509_PURPOSE_SMIME_SIGN);
+                       X509_STORE_CTX_set_default(&cert_ctx, "smime_sign");
                } else if(!X509_STORE_CTX_init (&cert_ctx, store, signer, NULL)) {
                        PKCS7err(PKCS7_F_PKCS7_VERIFY,ERR_R_X509_LIB);
                        sk_X509_free(signers);
@@ -363,13 +371,15 @@ int PKCS7_verify(PKCS7 *p7, STACK_OF(X509) *certs, X509_STORE *store,
                tmpin = indata;
                
 
-       p7bio=PKCS7_dataInit(p7,tmpin);
+       if (!(p7bio=PKCS7_dataInit(p7,tmpin)))
+               goto err;
 
        if(flags & PKCS7_TEXT) {
                if(!(tmpout = BIO_new(BIO_s_mem()))) {
                        PKCS7err(PKCS7_F_PKCS7_VERIFY,ERR_R_MALLOC_FAILURE);
                        goto err;
                }
+               BIO_set_mem_eof_return(tmpout, 0);
        } else tmpout = out;
 
        /* We now have to 'read' from p7bio to calculate digests etc. */
@@ -468,7 +478,10 @@ STACK_OF(X509) *PKCS7_get0_signers(PKCS7 *p7, STACK_OF(X509) *certs, int flags)
                        return 0;
            }
 
-           sk_X509_push(signers, signer);
+           if (!sk_X509_push(signers, signer)) {
+               sk_X509_free(signers);
+               return NULL;
+           }
        }
        return signers;
 }
@@ -488,8 +501,9 @@ PKCS7 *PKCS7_encrypt(STACK_OF(X509) *certs, BIO *in, const EVP_CIPHER *cipher,
                return NULL;
        }
 
-       PKCS7_set_type(p7, NID_pkcs7_enveloped);
-       if(!PKCS7_set_cipher(p7, cipher)) {
+       if (!PKCS7_set_type(p7, NID_pkcs7_enveloped))
+               goto err;
+       if (!PKCS7_set_cipher(p7, cipher)) {
                PKCS7err(PKCS7_F_PKCS7_ENCRYPT,PKCS7_R_ERROR_SETTING_CIPHER);
                goto err;
        }
@@ -503,12 +517,15 @@ PKCS7 *PKCS7_encrypt(STACK_OF(X509) *certs, BIO *in, const EVP_CIPHER *cipher,
                }
        }
 
+       if (flags & PKCS7_STREAM)
+               return p7;
+
        if (PKCS7_final(p7, in, flags))
                return p7;
 
        err:
 
-       BIO_free(p7bio);
+       BIO_free_all(p7bio);
        PKCS7_free(p7);
        return NULL;
 
@@ -546,22 +563,44 @@ int PKCS7_decrypt(PKCS7 *p7, EVP_PKEY *pkey, X509 *cert, BIO *data, int flags)
                /* Encrypt BIOs can't do BIO_gets() so add a buffer BIO */
                if(!(tmpbuf = BIO_new(BIO_f_buffer()))) {
                        PKCS7err(PKCS7_F_PKCS7_DECRYPT, ERR_R_MALLOC_FAILURE);
+                       BIO_free_all(tmpmem);
                        return 0;
                }
                if(!(bread = BIO_push(tmpbuf, tmpmem))) {
                        PKCS7err(PKCS7_F_PKCS7_DECRYPT, ERR_R_MALLOC_FAILURE);
+                       BIO_free_all(tmpbuf);
+                       BIO_free_all(tmpmem);
                        return 0;
                }
                ret = SMIME_text(bread, data);
+               if (ret > 0 && BIO_method_type(tmpmem) == BIO_TYPE_CIPHER)
+                       {
+                       if (!BIO_get_cipher_status(tmpmem))
+                               ret = 0;
+                       }
                BIO_free_all(bread);
                return ret;
        } else {
                for(;;) {
                        i = BIO_read(tmpmem, buf, sizeof(buf));
-                       if(i <= 0) break;
-                       BIO_write(data, buf, i);
+                       if(i <= 0)
+                               {
+                               ret = 1;
+                               if (BIO_method_type(tmpmem) == BIO_TYPE_CIPHER)
+                                       {
+                                       if (!BIO_get_cipher_status(tmpmem))
+                                               ret = 0;
+                                       }
+                                       
+                               break;
+                               }
+                       if (BIO_write(data, buf, i) != i)
+                               {
+                               ret = 0;
+                               break;
+                               }
                }
                BIO_free_all(tmpmem);
-               return 1;
+               return ret;
        }
 }