/* pk7_smime.c */
-/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
* project.
*/
/* ====================================================================
#include <openssl/x509.h>
#include <openssl/x509v3.h>
+static int pkcs7_copy_existing_digest(PKCS7 *p7, PKCS7_SIGNER_INFO *si);
+
PKCS7 *PKCS7_sign(X509 *signcert, EVP_PKEY *pkey, STACK_OF(X509) *certs,
BIO *data, int flags)
{
}
}
+ if(flags & PKCS7_DETACHED)
+ PKCS7_set_detached(p7, 1);
+
if (flags & (PKCS7_STREAM|PKCS7_PARTIAL))
return p7;
int PKCS7_final(PKCS7 *p7, BIO *data, int flags)
{
BIO *p7bio;
- int ret;
+ int ret = 0;
if (!(p7bio = PKCS7_dataInit(p7, NULL)))
{
PKCS7err(PKCS7_F_PKCS7_FINAL,ERR_R_MALLOC_FAILURE);
SMIME_crlf_copy(data, p7bio, flags);
- if(PKCS7_type_is_signed(p7) && (flags & PKCS7_DETACHED))
- PKCS7_set_detached(p7, 1);
+ (void)BIO_flush(p7bio);
+
if (!PKCS7_dataFinal(p7,p7bio))
{
return 1;
}
+static int add_digest_smcap(STACK_OF(X509_ALGOR) *sk, int nid, int arg)
+ {
+ if (EVP_get_digestbynid(nid))
+ return PKCS7_simple_smimecap(sk, nid, arg);
+ return 1;
+ }
+
PKCS7_SIGNER_INFO *PKCS7_sign_add_signer(PKCS7 *p7, X509 *signcert,
EVP_PKEY *pkey, const EVP_MD *md,
int flags)
{
PKCS7_SIGNER_INFO *si = NULL;
- int si_free = 1;
STACK_OF(X509_ALGOR) *smcap = NULL;
if(!X509_check_private_key(signcert, pkey))
{
return NULL;
}
- /* si is now part of p7 so don't free it on error */
-
- si_free = 0;
-
if(!(flags & PKCS7_NOCERTS))
{
if (!PKCS7_add_certificate(p7, signcert))
ERR_R_MALLOC_FAILURE);
goto err;
}
- if (!add_cipher_smcap(smcap, NID_des_ede3_cbc, -1)
+ if (!add_cipher_smcap(smcap, NID_aes_256_cbc, -1)
+ || !add_digest_smcap(smcap, NID_id_GostR3411_94, -1)
+ || !add_cipher_smcap(smcap, NID_id_Gost28147_89, -1)
+ || !add_cipher_smcap(smcap, NID_aes_192_cbc, -1)
+ || !add_cipher_smcap(smcap, NID_aes_128_cbc, -1)
+ || !add_cipher_smcap(smcap, NID_des_ede3_cbc, -1)
|| !add_cipher_smcap(smcap, NID_rc2_cbc, 128)
|| !add_cipher_smcap(smcap, NID_rc2_cbc, 64)
|| !add_cipher_smcap(smcap, NID_des_cbc, -1)
|| !PKCS7_add_attrib_smimecap (si, smcap))
goto err;
sk_X509_ALGOR_pop_free(smcap, X509_ALGOR_free);
+ smcap = NULL;
+ }
+ if (flags & PKCS7_REUSE_DIGEST)
+ {
+ if (!pkcs7_copy_existing_digest(p7, si))
+ goto err;
+ if (!(flags & PKCS7_PARTIAL) &&
+ !PKCS7_SIGNER_INFO_sign(si))
+ goto err;
}
}
return si;
err:
if (smcap)
sk_X509_ALGOR_pop_free(smcap, X509_ALGOR_free);
- if (si && si_free)
- PKCS7_SIGNER_INFO_free(si);
return NULL;
}
+/* Search for a digest matching SignerInfo digest type and if found
+ * copy across.
+ */
+
+static int pkcs7_copy_existing_digest(PKCS7 *p7, PKCS7_SIGNER_INFO *si)
+ {
+ int i;
+ STACK_OF(PKCS7_SIGNER_INFO) *sinfos;
+ PKCS7_SIGNER_INFO *sitmp;
+ ASN1_OCTET_STRING *osdig = NULL;
+ sinfos = PKCS7_get_signer_info(p7);
+ for (i = 0; i < sk_PKCS7_SIGNER_INFO_num(sinfos); i++)
+ {
+ sitmp = sk_PKCS7_SIGNER_INFO_value(sinfos, i);
+ if (si == sitmp)
+ break;
+ if (sk_X509_ATTRIBUTE_num(sitmp->auth_attr) <= 0)
+ continue;
+ if (!OBJ_cmp(si->digest_alg->algorithm,
+ sitmp->digest_alg->algorithm))
+ {
+ osdig = PKCS7_digest_from_attributes(sitmp->auth_attr);
+ break;
+ }
+
+ }
+
+ if (osdig)
+ return PKCS7_add1_attrib_digest(si, osdig->data, osdig->length);
+
+ PKCS7err(PKCS7_F_PKCS7_COPY_EXISTING_DIGEST,
+ PKCS7_R_NO_MATCHING_DIGEST_TYPE_FOUND);
+ return 0;
+ }
+
int PKCS7_verify(PKCS7 *p7, STACK_OF(X509) *certs, X509_STORE *store,
BIO *indata, BIO *out, int flags)
{
sk_X509_free(signers);
return 0;
}
- X509_STORE_CTX_set_purpose(&cert_ctx,
- X509_PURPOSE_SMIME_SIGN);
+ X509_STORE_CTX_set_default(&cert_ctx, "smime_sign");
} else if(!X509_STORE_CTX_init (&cert_ctx, store, signer, NULL)) {
PKCS7err(PKCS7_F_PKCS7_VERIFY,ERR_R_X509_LIB);
sk_X509_free(signers);
tmpin = indata;
- p7bio=PKCS7_dataInit(p7,tmpin);
+ if (!(p7bio=PKCS7_dataInit(p7,tmpin)))
+ goto err;
if(flags & PKCS7_TEXT) {
if(!(tmpout = BIO_new(BIO_s_mem()))) {
PKCS7err(PKCS7_F_PKCS7_VERIFY,ERR_R_MALLOC_FAILURE);
goto err;
}
+ BIO_set_mem_eof_return(tmpout, 0);
} else tmpout = out;
/* We now have to 'read' from p7bio to calculate digests etc. */
return 0;
}
- sk_X509_push(signers, signer);
+ if (!sk_X509_push(signers, signer)) {
+ sk_X509_free(signers);
+ return NULL;
+ }
}
return signers;
}
return NULL;
}
- PKCS7_set_type(p7, NID_pkcs7_enveloped);
- if(!PKCS7_set_cipher(p7, cipher)) {
+ if (!PKCS7_set_type(p7, NID_pkcs7_enveloped))
+ goto err;
+ if (!PKCS7_set_cipher(p7, cipher)) {
PKCS7err(PKCS7_F_PKCS7_ENCRYPT,PKCS7_R_ERROR_SETTING_CIPHER);
goto err;
}
}
}
+ if (flags & PKCS7_STREAM)
+ return p7;
+
if (PKCS7_final(p7, in, flags))
return p7;
err:
- BIO_free(p7bio);
+ BIO_free_all(p7bio);
PKCS7_free(p7);
return NULL;
/* Encrypt BIOs can't do BIO_gets() so add a buffer BIO */
if(!(tmpbuf = BIO_new(BIO_f_buffer()))) {
PKCS7err(PKCS7_F_PKCS7_DECRYPT, ERR_R_MALLOC_FAILURE);
+ BIO_free_all(tmpmem);
return 0;
}
if(!(bread = BIO_push(tmpbuf, tmpmem))) {
PKCS7err(PKCS7_F_PKCS7_DECRYPT, ERR_R_MALLOC_FAILURE);
+ BIO_free_all(tmpbuf);
+ BIO_free_all(tmpmem);
return 0;
}
ret = SMIME_text(bread, data);
+ if (ret > 0 && BIO_method_type(tmpmem) == BIO_TYPE_CIPHER)
+ {
+ if (!BIO_get_cipher_status(tmpmem))
+ ret = 0;
+ }
BIO_free_all(bread);
return ret;
} else {
for(;;) {
i = BIO_read(tmpmem, buf, sizeof(buf));
- if(i <= 0) break;
- BIO_write(data, buf, i);
+ if(i <= 0)
+ {
+ ret = 1;
+ if (BIO_method_type(tmpmem) == BIO_TYPE_CIPHER)
+ {
+ if (!BIO_get_cipher_status(tmpmem))
+ ret = 0;
+ }
+
+ break;
+ }
+ if (BIO_write(data, buf, i) != i)
+ {
+ ret = 0;
+ break;
+ }
}
BIO_free_all(tmpmem);
- return 1;
+ return ret;
}
}
projects / openssl.git / blobdiff