xref: /openbsd/lib/libcrypto/pkcs7/pk7_smime.c (revision a0c63bf7)
1 /* $OpenBSD: pk7_smime.c,v 1.27 2024/04/20 10:11:55 tb Exp $ */
2 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3  * project.
4  */
5 /* ====================================================================
6  * Copyright (c) 1999-2004 The OpenSSL Project.  All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  *
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in
17  *    the documentation and/or other materials provided with the
18  *    distribution.
19  *
20  * 3. All advertising materials mentioning features or use of this
21  *    software must display the following acknowledgment:
22  *    "This product includes software developed by the OpenSSL Project
23  *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24  *
25  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26  *    endorse or promote products derived from this software without
27  *    prior written permission. For written permission, please contact
28  *    licensing@OpenSSL.org.
29  *
30  * 5. Products derived from this software may not be called "OpenSSL"
31  *    nor may "OpenSSL" appear in their names without prior written
32  *    permission of the OpenSSL Project.
33  *
34  * 6. Redistributions of any form whatsoever must retain the following
35  *    acknowledgment:
36  *    "This product includes software developed by the OpenSSL Project
37  *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38  *
39  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
43  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50  * OF THE POSSIBILITY OF SUCH DAMAGE.
51  * ====================================================================
52  *
53  * This product includes cryptographic software written by Eric Young
54  * (eay@cryptsoft.com).  This product includes software written by Tim
55  * Hudson (tjh@cryptsoft.com).
56  *
57  */
58 
59 /* Simple PKCS#7 processing functions */
60 
61 #include <stdio.h>
62 
63 #include <openssl/err.h>
64 #include <openssl/x509.h>
65 #include <openssl/x509v3.h>
66 
67 #include "x509_local.h"
68 
69 static int pkcs7_copy_existing_digest(PKCS7 *p7, PKCS7_SIGNER_INFO *si);
70 
71 PKCS7 *
PKCS7_sign(X509 * signcert,EVP_PKEY * pkey,STACK_OF (X509)* certs,BIO * data,int flags)72 PKCS7_sign(X509 *signcert, EVP_PKEY *pkey, STACK_OF(X509) *certs, BIO *data,
73     int flags)
74 {
75 	PKCS7 *p7;
76 	int i;
77 
78 	if (!(p7 = PKCS7_new())) {
79 		PKCS7error(ERR_R_MALLOC_FAILURE);
80 		return NULL;
81 	}
82 
83 	if (!PKCS7_set_type(p7, NID_pkcs7_signed))
84 		goto err;
85 
86 	if (!PKCS7_content_new(p7, NID_pkcs7_data))
87 		goto err;
88 
89 	if (pkey && !PKCS7_sign_add_signer(p7, signcert, pkey, NULL, flags)) {
90 		PKCS7error(PKCS7_R_PKCS7_ADD_SIGNER_ERROR);
91 		goto err;
92 	}
93 
94 	if (!(flags & PKCS7_NOCERTS)) {
95 		for (i = 0; i < sk_X509_num(certs); i++) {
96 			if (!PKCS7_add_certificate(p7, sk_X509_value(certs, i)))
97 				goto err;
98 		}
99 	}
100 
101 	if (flags & PKCS7_DETACHED)
102 		PKCS7_set_detached(p7, 1);
103 
104 	if (flags & (PKCS7_STREAM|PKCS7_PARTIAL))
105 		return p7;
106 
107 	if (PKCS7_final(p7, data, flags))
108 		return p7;
109 
110 err:
111 	PKCS7_free(p7);
112 	return NULL;
113 }
114 LCRYPTO_ALIAS(PKCS7_sign);
115 
116 int
PKCS7_final(PKCS7 * p7,BIO * data,int flags)117 PKCS7_final(PKCS7 *p7, BIO *data, int flags)
118 {
119 	BIO *p7bio;
120 	int ret = 0;
121 
122 	if (!(p7bio = PKCS7_dataInit(p7, NULL))) {
123 		PKCS7error(ERR_R_MALLOC_FAILURE);
124 		return 0;
125 	}
126 
127 	SMIME_crlf_copy(data, p7bio, flags);
128 
129 	(void)BIO_flush(p7bio);
130 
131 	if (!PKCS7_dataFinal(p7, p7bio)) {
132 		PKCS7error(PKCS7_R_PKCS7_DATASIGN);
133 		goto err;
134 	}
135 
136 	ret = 1;
137 
138 err:
139 	BIO_free_all(p7bio);
140 
141 	return ret;
142 }
143 LCRYPTO_ALIAS(PKCS7_final);
144 
145 /* Check to see if a cipher exists and if so add S/MIME capabilities */
146 
147 static int
add_cipher_smcap(STACK_OF (X509_ALGOR)* sk,int nid,int arg)148 add_cipher_smcap(STACK_OF(X509_ALGOR) *sk, int nid, int arg)
149 {
150 	if (EVP_get_cipherbynid(nid))
151 		return PKCS7_simple_smimecap(sk, nid, arg);
152 	return 1;
153 }
154 
155 PKCS7_SIGNER_INFO *
PKCS7_sign_add_signer(PKCS7 * p7,X509 * signcert,EVP_PKEY * pkey,const EVP_MD * md,int flags)156 PKCS7_sign_add_signer(PKCS7 *p7, X509 *signcert, EVP_PKEY *pkey,
157     const EVP_MD *md, int flags)
158 {
159 	PKCS7_SIGNER_INFO *si = NULL;
160 	STACK_OF(X509_ALGOR) *smcap = NULL;
161 
162 	if (!X509_check_private_key(signcert, pkey)) {
163 		PKCS7error(PKCS7_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE);
164 		return NULL;
165 	}
166 
167 	if (!(si = PKCS7_add_signature(p7, signcert, pkey, md))) {
168 		PKCS7error(PKCS7_R_PKCS7_ADD_SIGNATURE_ERROR);
169 		return NULL;
170 	}
171 
172 	if (!(flags & PKCS7_NOCERTS)) {
173 		if (!PKCS7_add_certificate(p7, signcert))
174 			goto err;
175 	}
176 
177 	if (!(flags & PKCS7_NOATTR)) {
178 		if (!PKCS7_add_attrib_content_type(si, NULL))
179 			goto err;
180 		/* Add SMIMECapabilities */
181 		if (!(flags & PKCS7_NOSMIMECAP)) {
182 			if (!(smcap = sk_X509_ALGOR_new_null())) {
183 				PKCS7error(ERR_R_MALLOC_FAILURE);
184 				goto err;
185 			}
186 			if (!add_cipher_smcap(smcap, NID_aes_256_cbc, -1) ||
187 			    !add_cipher_smcap(smcap, NID_aes_192_cbc, -1) ||
188 			    !add_cipher_smcap(smcap, NID_aes_128_cbc, -1) ||
189 			    !add_cipher_smcap(smcap, NID_des_ede3_cbc, -1) ||
190 			    !add_cipher_smcap(smcap, NID_rc2_cbc, 128) ||
191 			    !add_cipher_smcap(smcap, NID_rc2_cbc, 64) ||
192 			    !add_cipher_smcap(smcap, NID_des_cbc, -1) ||
193 			    !add_cipher_smcap(smcap, NID_rc2_cbc, 40) ||
194 			    !PKCS7_add_attrib_smimecap(si, smcap))
195 				goto err;
196 			sk_X509_ALGOR_pop_free(smcap, X509_ALGOR_free);
197 			smcap = NULL;
198 		}
199 		if (flags & PKCS7_REUSE_DIGEST) {
200 			if (!pkcs7_copy_existing_digest(p7, si))
201 				goto err;
202 			if (!(flags & PKCS7_PARTIAL) &&
203 			    !PKCS7_SIGNER_INFO_sign(si))
204 				goto err;
205 		}
206 	}
207 	return si;
208 
209 err:
210 	if (smcap)
211 		sk_X509_ALGOR_pop_free(smcap, X509_ALGOR_free);
212 	return NULL;
213 }
214 LCRYPTO_ALIAS(PKCS7_sign_add_signer);
215 
216 /* Search for a digest matching SignerInfo digest type and if found
217  * copy across.
218  */
219 
220 static int
pkcs7_copy_existing_digest(PKCS7 * p7,PKCS7_SIGNER_INFO * si)221 pkcs7_copy_existing_digest(PKCS7 *p7, PKCS7_SIGNER_INFO *si)
222 {
223 	int i;
224 	STACK_OF(PKCS7_SIGNER_INFO) *sinfos;
225 	PKCS7_SIGNER_INFO *sitmp;
226 	ASN1_OCTET_STRING *osdig = NULL;
227 
228 	sinfos = PKCS7_get_signer_info(p7);
229 	for (i = 0; i < sk_PKCS7_SIGNER_INFO_num(sinfos); i++) {
230 		sitmp = sk_PKCS7_SIGNER_INFO_value(sinfos, i);
231 		if (si == sitmp)
232 			break;
233 		if (sk_X509_ATTRIBUTE_num(sitmp->auth_attr) <= 0)
234 			continue;
235 		if (!OBJ_cmp(si->digest_alg->algorithm,
236 		    sitmp->digest_alg->algorithm)) {
237 			osdig = PKCS7_digest_from_attributes(sitmp->auth_attr);
238 			break;
239 		}
240 
241 	}
242 
243 	if (osdig)
244 		return PKCS7_add1_attrib_digest(si, osdig->data, osdig->length);
245 
246 	PKCS7error(PKCS7_R_NO_MATCHING_DIGEST_TYPE_FOUND);
247 	return 0;
248 }
249 
250 int
PKCS7_verify(PKCS7 * p7,STACK_OF (X509)* certs,X509_STORE * store,BIO * indata,BIO * out,int flags)251 PKCS7_verify(PKCS7 *p7, STACK_OF(X509) *certs, X509_STORE *store, BIO *indata,
252     BIO *out, int flags)
253 {
254 	STACK_OF(X509) *signers;
255 	X509 *signer;
256 	STACK_OF(PKCS7_SIGNER_INFO) *sinfos;
257 	PKCS7_SIGNER_INFO *si;
258 	X509_STORE_CTX cert_ctx;
259 	char buf[4096];
260 	int i, j = 0, k, ret = 0;
261 	BIO *p7bio;
262 	BIO *tmpin, *tmpout;
263 
264 	if (!p7) {
265 		PKCS7error(PKCS7_R_INVALID_NULL_POINTER);
266 		return 0;
267 	}
268 
269 	if (!PKCS7_type_is_signed(p7)) {
270 		PKCS7error(PKCS7_R_WRONG_CONTENT_TYPE);
271 		return 0;
272 	}
273 
274 	/* Check for no data and no content: no data to verify signature */
275 	if (PKCS7_get_detached(p7) && !indata) {
276 		PKCS7error(PKCS7_R_NO_CONTENT);
277 		return 0;
278 	}
279 
280 	/*
281 	 * Very old Netscape illegally included empty content with
282 	 * a detached signature.  Very old users should upgrade.
283 	 */
284 	/* Check for data and content: two sets of data */
285 	if (!PKCS7_get_detached(p7) && indata) {
286 		PKCS7error(PKCS7_R_CONTENT_AND_DATA_PRESENT);
287 		return 0;
288 	}
289 
290 	sinfos = PKCS7_get_signer_info(p7);
291 
292 	if (!sinfos || !sk_PKCS7_SIGNER_INFO_num(sinfos)) {
293 		PKCS7error(PKCS7_R_NO_SIGNATURES_ON_DATA);
294 		return 0;
295 	}
296 
297 
298 	signers = PKCS7_get0_signers(p7, certs, flags);
299 
300 	if (!signers)
301 		return 0;
302 
303 	/* Now verify the certificates */
304 
305 	if (!(flags & PKCS7_NOVERIFY))
306 		for (k = 0; k < sk_X509_num(signers); k++) {
307 			signer = sk_X509_value (signers, k);
308 			if  (!(flags & PKCS7_NOCHAIN)) {
309 				if (!X509_STORE_CTX_init(&cert_ctx, store,
310 				    signer, p7->d.sign->cert)) {
311 					PKCS7error(ERR_R_X509_LIB);
312 					sk_X509_free(signers);
313 					return 0;
314 				}
315 				if (X509_STORE_CTX_set_default(&cert_ctx,
316 				    "smime_sign") == 0) {
317 					sk_X509_free(signers);
318 					return 0;
319 				}
320 			} else if (!X509_STORE_CTX_init(&cert_ctx, store,
321 			    signer, NULL)) {
322 				PKCS7error(ERR_R_X509_LIB);
323 				sk_X509_free(signers);
324 				return 0;
325 			}
326 			if (!(flags & PKCS7_NOCRL))
327 				X509_STORE_CTX_set0_crls(&cert_ctx, p7->d.sign->crl);
328 			i = X509_verify_cert(&cert_ctx);
329 			if (i <= 0)
330 				j = X509_STORE_CTX_get_error(&cert_ctx);
331 			X509_STORE_CTX_cleanup(&cert_ctx);
332 			if (i <= 0) {
333 				PKCS7error(PKCS7_R_CERTIFICATE_VERIFY_ERROR);
334 				ERR_asprintf_error_data("Verify error:%s",
335 				    X509_verify_cert_error_string(j));
336 				sk_X509_free(signers);
337 				return 0;
338 			}
339 			/* Check for revocation status here */
340 		}
341 
342 	/*
343 	 * Performance optimization: if the content is a memory BIO then
344 	 * store its contents in a temporary read only memory BIO. This
345 	 * avoids potentially large numbers of slow copies of data which will
346 	 * occur when reading from a read write memory BIO when signatures
347 	 * are calculated.
348 	 */
349 	if (indata && (BIO_method_type(indata) == BIO_TYPE_MEM)) {
350 		char *ptr;
351 		long len;
352 
353 		len = BIO_get_mem_data(indata, &ptr);
354 		tmpin = BIO_new_mem_buf(ptr, len);
355 		if (tmpin == NULL) {
356 			PKCS7error(ERR_R_MALLOC_FAILURE);
357 			return 0;
358 		}
359 	} else
360 		tmpin = indata;
361 
362 
363 	if (!(p7bio = PKCS7_dataInit(p7, tmpin)))
364 		goto err;
365 
366 	if (flags & PKCS7_TEXT) {
367 		if (!(tmpout = BIO_new(BIO_s_mem()))) {
368 			PKCS7error(ERR_R_MALLOC_FAILURE);
369 			goto err;
370 		}
371 		BIO_set_mem_eof_return(tmpout, 0);
372 	} else
373 		tmpout = out;
374 
375 	/* We now have to 'read' from p7bio to calculate digests etc. */
376 	for (;;) {
377 		i = BIO_read(p7bio, buf, sizeof(buf));
378 		if (i <= 0)
379 			break;
380 		if (tmpout)
381 			BIO_write(tmpout, buf, i);
382 	}
383 
384 	if (flags & PKCS7_TEXT) {
385 		if (!SMIME_text(tmpout, out)) {
386 			PKCS7error(PKCS7_R_SMIME_TEXT_ERROR);
387 			BIO_free(tmpout);
388 			goto err;
389 		}
390 		BIO_free(tmpout);
391 	}
392 
393 	/* Now Verify All Signatures */
394 	if (!(flags & PKCS7_NOSIGS))
395 		for (i = 0; i < sk_PKCS7_SIGNER_INFO_num(sinfos); i++) {
396 			si = sk_PKCS7_SIGNER_INFO_value(sinfos, i);
397 			signer = sk_X509_value (signers, i);
398 			j = PKCS7_signatureVerify(p7bio, p7, si, signer);
399 			if (j <= 0) {
400 				PKCS7error(PKCS7_R_SIGNATURE_FAILURE);
401 				goto err;
402 			}
403 		}
404 
405 	ret = 1;
406 
407 err:
408 	if (tmpin == indata) {
409 		if (indata)
410 			BIO_pop(p7bio);
411 	}
412 	BIO_free_all(p7bio);
413 	sk_X509_free(signers);
414 
415 	return ret;
416 }
417 LCRYPTO_ALIAS(PKCS7_verify);
418 
STACK_OF(X509)419 STACK_OF(X509) *
420 PKCS7_get0_signers(PKCS7 *p7, STACK_OF(X509) *certs, int flags)
421 {
422 	STACK_OF(X509) *signers;
423 	STACK_OF(PKCS7_SIGNER_INFO) *sinfos;
424 	PKCS7_SIGNER_INFO *si;
425 	PKCS7_ISSUER_AND_SERIAL *ias;
426 	X509 *signer;
427 	int i;
428 
429 	if (!p7) {
430 		PKCS7error(PKCS7_R_INVALID_NULL_POINTER);
431 		return NULL;
432 	}
433 
434 	if (!PKCS7_type_is_signed(p7)) {
435 		PKCS7error(PKCS7_R_WRONG_CONTENT_TYPE);
436 		return NULL;
437 	}
438 
439 	/* Collect all the signers together */
440 	sinfos = PKCS7_get_signer_info(p7);
441 	if (sk_PKCS7_SIGNER_INFO_num(sinfos) <= 0) {
442 		PKCS7error(PKCS7_R_NO_SIGNERS);
443 		return 0;
444 	}
445 
446 	if (!(signers = sk_X509_new_null())) {
447 		PKCS7error(ERR_R_MALLOC_FAILURE);
448 		return NULL;
449 	}
450 
451 	for (i = 0; i < sk_PKCS7_SIGNER_INFO_num(sinfos); i++) {
452 		si = sk_PKCS7_SIGNER_INFO_value(sinfos, i);
453 		ias = si->issuer_and_serial;
454 		signer = NULL;
455 		/* If any certificates passed they take priority */
456 		if (certs)
457 			signer = X509_find_by_issuer_and_serial (certs,
458 			    ias->issuer, ias->serial);
459 		if (!signer && !(flags & PKCS7_NOINTERN) && p7->d.sign->cert)
460 			signer =
461 			    X509_find_by_issuer_and_serial(p7->d.sign->cert,
462 			      ias->issuer, ias->serial);
463 		if (!signer) {
464 			PKCS7error(PKCS7_R_SIGNER_CERTIFICATE_NOT_FOUND);
465 			sk_X509_free(signers);
466 			return 0;
467 		}
468 
469 		if (!sk_X509_push(signers, signer)) {
470 			sk_X509_free(signers);
471 			return NULL;
472 		}
473 	}
474 	return signers;
475 }
476 LCRYPTO_ALIAS(PKCS7_get0_signers);
477 
478 /* Build a complete PKCS#7 enveloped data */
479 
480 PKCS7 *
PKCS7_encrypt(STACK_OF (X509)* certs,BIO * in,const EVP_CIPHER * cipher,int flags)481 PKCS7_encrypt(STACK_OF(X509) *certs, BIO *in, const EVP_CIPHER *cipher,
482     int flags)
483 {
484 	PKCS7 *p7;
485 	BIO *p7bio = NULL;
486 	int i;
487 	X509 *x509;
488 
489 	if (!(p7 = PKCS7_new())) {
490 		PKCS7error(ERR_R_MALLOC_FAILURE);
491 		return NULL;
492 	}
493 
494 	if (!PKCS7_set_type(p7, NID_pkcs7_enveloped))
495 		goto err;
496 	if (!PKCS7_set_cipher(p7, cipher)) {
497 		PKCS7error(PKCS7_R_ERROR_SETTING_CIPHER);
498 		goto err;
499 	}
500 
501 	for (i = 0; i < sk_X509_num(certs); i++) {
502 		x509 = sk_X509_value(certs, i);
503 		if (!PKCS7_add_recipient(p7, x509)) {
504 			PKCS7error(PKCS7_R_ERROR_ADDING_RECIPIENT);
505 			goto err;
506 		}
507 	}
508 
509 	if (flags & PKCS7_STREAM)
510 		return p7;
511 
512 	if (PKCS7_final(p7, in, flags))
513 		return p7;
514 
515 err:
516 	BIO_free_all(p7bio);
517 	PKCS7_free(p7);
518 	return NULL;
519 }
520 LCRYPTO_ALIAS(PKCS7_encrypt);
521 
522 int
PKCS7_decrypt(PKCS7 * p7,EVP_PKEY * pkey,X509 * cert,BIO * data,int flags)523 PKCS7_decrypt(PKCS7 *p7, EVP_PKEY *pkey, X509 *cert, BIO *data, int flags)
524 {
525 	BIO *tmpmem;
526 	int ret, i;
527 	char buf[4096];
528 
529 	if (!p7) {
530 		PKCS7error(PKCS7_R_INVALID_NULL_POINTER);
531 		return 0;
532 	}
533 
534 	if (!PKCS7_type_is_enveloped(p7)) {
535 		PKCS7error(PKCS7_R_WRONG_CONTENT_TYPE);
536 		return 0;
537 	}
538 
539 	if (cert && !X509_check_private_key(cert, pkey)) {
540 		PKCS7error(PKCS7_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE);
541 		return 0;
542 	}
543 
544 	if (!(tmpmem = PKCS7_dataDecode(p7, pkey, NULL, cert))) {
545 		PKCS7error(PKCS7_R_DECRYPT_ERROR);
546 		return 0;
547 	}
548 
549 	if (flags & PKCS7_TEXT) {
550 		BIO *tmpbuf;
551 
552 		/* Encrypt BIOs can't do BIO_gets() so add a buffer BIO */
553 		if (!(tmpbuf = BIO_new(BIO_f_buffer()))) {
554 			PKCS7error(ERR_R_MALLOC_FAILURE);
555 			BIO_free_all(tmpmem);
556 			return 0;
557 		}
558 		BIO_push(tmpbuf, tmpmem);
559 		ret = SMIME_text(tmpbuf, data);
560 		if (ret > 0 && BIO_method_type(tmpmem) == BIO_TYPE_CIPHER) {
561 			if (!BIO_get_cipher_status(tmpmem))
562 				ret = 0;
563 		}
564 		BIO_free_all(tmpbuf);
565 		return ret;
566 	} else {
567 		for (;;) {
568 			i = BIO_read(tmpmem, buf, sizeof(buf));
569 			if (i <= 0) {
570 				ret = 1;
571 				if (BIO_method_type(tmpmem) ==
572 				    BIO_TYPE_CIPHER) {
573 					if (!BIO_get_cipher_status(tmpmem))
574 						ret = 0;
575 				}
576 				break;
577 			}
578 			if (BIO_write(data, buf, i) != i) {
579 				ret = 0;
580 				break;
581 			}
582 		}
583 		BIO_free_all(tmpmem);
584 		return ret;
585 	}
586 }
587 LCRYPTO_ALIAS(PKCS7_decrypt);
588