1 /* 2 * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the Apache License 2.0 (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 #include <stdio.h> 11 #include "internal/cryptlib.h" 12 #include <openssl/objects.h> 13 #include <openssl/x509.h> 14 #include <openssl/pkcs7.h> 15 #include "crypto/asn1.h" 16 #include "crypto/evp.h" 17 #include "crypto/x509.h" /* for sk_X509_add1_cert() */ 18 #include "pk7_local.h" 19 20 long PKCS7_ctrl(PKCS7 *p7, int cmd, long larg, char *parg) 21 { 22 int nid; 23 long ret; 24 25 nid = OBJ_obj2nid(p7->type); 26 27 switch (cmd) { 28 /* NOTE(emilia): does not support detached digested data. */ 29 case PKCS7_OP_SET_DETACHED_SIGNATURE: 30 if (nid == NID_pkcs7_signed) { 31 ret = p7->detached = (int)larg; 32 if (ret && PKCS7_type_is_data(p7->d.sign->contents)) { 33 ASN1_OCTET_STRING *os; 34 os = p7->d.sign->contents->d.data; 35 ASN1_OCTET_STRING_free(os); 36 p7->d.sign->contents->d.data = NULL; 37 } 38 } else { 39 ERR_raise(ERR_LIB_PKCS7, 40 PKCS7_R_OPERATION_NOT_SUPPORTED_ON_THIS_TYPE); 41 ret = 0; 42 } 43 break; 44 case PKCS7_OP_GET_DETACHED_SIGNATURE: 45 if (nid == NID_pkcs7_signed) { 46 if (p7->d.sign == NULL || p7->d.sign->contents->d.ptr == NULL) 47 ret = 1; 48 else 49 ret = 0; 50 51 p7->detached = ret; 52 } else { 53 ERR_raise(ERR_LIB_PKCS7, 54 PKCS7_R_OPERATION_NOT_SUPPORTED_ON_THIS_TYPE); 55 ret = 0; 56 } 57 58 break; 59 default: 60 ERR_raise(ERR_LIB_PKCS7, PKCS7_R_UNKNOWN_OPERATION); 61 ret = 0; 62 } 63 return ret; 64 } 65 66 int PKCS7_content_new(PKCS7 *p7, int type) 67 { 68 PKCS7 *ret = NULL; 69 70 if ((ret = PKCS7_new()) == NULL) 71 goto err; 72 if (!PKCS7_set_type(ret, type)) 73 goto err; 74 if (!PKCS7_set_content(p7, ret)) 75 goto err; 76 77 return 1; 78 err: 79 PKCS7_free(ret); 80 return 0; 81 } 82 83 int PKCS7_set_content(PKCS7 *p7, PKCS7 *p7_data) 84 { 85 int i; 86 87 i = OBJ_obj2nid(p7->type); 88 switch (i) { 89 case NID_pkcs7_signed: 90 PKCS7_free(p7->d.sign->contents); 91 p7->d.sign->contents = p7_data; 92 break; 93 case NID_pkcs7_digest: 94 PKCS7_free(p7->d.digest->contents); 95 p7->d.digest->contents = p7_data; 96 break; 97 case NID_pkcs7_data: 98 case NID_pkcs7_enveloped: 99 case NID_pkcs7_signedAndEnveloped: 100 case NID_pkcs7_encrypted: 101 default: 102 ERR_raise(ERR_LIB_PKCS7, PKCS7_R_UNSUPPORTED_CONTENT_TYPE); 103 goto err; 104 } 105 return 1; 106 err: 107 return 0; 108 } 109 110 int PKCS7_set_type(PKCS7 *p7, int type) 111 { 112 ASN1_OBJECT *obj; 113 114 /* 115 * PKCS7_content_free(p7); 116 */ 117 obj = OBJ_nid2obj(type); /* will not fail */ 118 119 switch (type) { 120 case NID_pkcs7_signed: 121 p7->type = obj; 122 if ((p7->d.sign = PKCS7_SIGNED_new()) == NULL) 123 goto err; 124 if (!ASN1_INTEGER_set(p7->d.sign->version, 1)) { 125 PKCS7_SIGNED_free(p7->d.sign); 126 p7->d.sign = NULL; 127 goto err; 128 } 129 break; 130 case NID_pkcs7_data: 131 p7->type = obj; 132 if ((p7->d.data = ASN1_OCTET_STRING_new()) == NULL) 133 goto err; 134 break; 135 case NID_pkcs7_signedAndEnveloped: 136 p7->type = obj; 137 if ((p7->d.signed_and_enveloped = PKCS7_SIGN_ENVELOPE_new()) 138 == NULL) 139 goto err; 140 if (!ASN1_INTEGER_set(p7->d.signed_and_enveloped->version, 1)) 141 goto err; 142 p7->d.signed_and_enveloped->enc_data->content_type 143 = OBJ_nid2obj(NID_pkcs7_data); 144 break; 145 case NID_pkcs7_enveloped: 146 p7->type = obj; 147 if ((p7->d.enveloped = PKCS7_ENVELOPE_new()) 148 == NULL) 149 goto err; 150 if (!ASN1_INTEGER_set(p7->d.enveloped->version, 0)) 151 goto err; 152 p7->d.enveloped->enc_data->content_type = OBJ_nid2obj(NID_pkcs7_data); 153 break; 154 case NID_pkcs7_encrypted: 155 p7->type = obj; 156 if ((p7->d.encrypted = PKCS7_ENCRYPT_new()) 157 == NULL) 158 goto err; 159 if (!ASN1_INTEGER_set(p7->d.encrypted->version, 0)) 160 goto err; 161 p7->d.encrypted->enc_data->content_type = OBJ_nid2obj(NID_pkcs7_data); 162 break; 163 164 case NID_pkcs7_digest: 165 p7->type = obj; 166 if ((p7->d.digest = PKCS7_DIGEST_new()) 167 == NULL) 168 goto err; 169 if (!ASN1_INTEGER_set(p7->d.digest->version, 0)) 170 goto err; 171 break; 172 default: 173 ERR_raise(ERR_LIB_PKCS7, PKCS7_R_UNSUPPORTED_CONTENT_TYPE); 174 goto err; 175 } 176 return 1; 177 err: 178 return 0; 179 } 180 181 int PKCS7_set0_type_other(PKCS7 *p7, int type, ASN1_TYPE *other) 182 { 183 p7->type = OBJ_nid2obj(type); 184 p7->d.other = other; 185 return 1; 186 } 187 188 int PKCS7_add_signer(PKCS7 *p7, PKCS7_SIGNER_INFO *psi) 189 { 190 int i, j; 191 ASN1_OBJECT *obj; 192 X509_ALGOR *alg; 193 STACK_OF(PKCS7_SIGNER_INFO) *signer_sk; 194 STACK_OF(X509_ALGOR) *md_sk; 195 196 i = OBJ_obj2nid(p7->type); 197 switch (i) { 198 case NID_pkcs7_signed: 199 signer_sk = p7->d.sign->signer_info; 200 md_sk = p7->d.sign->md_algs; 201 break; 202 case NID_pkcs7_signedAndEnveloped: 203 signer_sk = p7->d.signed_and_enveloped->signer_info; 204 md_sk = p7->d.signed_and_enveloped->md_algs; 205 break; 206 default: 207 ERR_raise(ERR_LIB_PKCS7, PKCS7_R_WRONG_CONTENT_TYPE); 208 return 0; 209 } 210 211 obj = psi->digest_alg->algorithm; 212 /* If the digest is not currently listed, add it */ 213 j = 0; 214 for (i = 0; i < sk_X509_ALGOR_num(md_sk); i++) { 215 alg = sk_X509_ALGOR_value(md_sk, i); 216 if (OBJ_cmp(obj, alg->algorithm) == 0) { 217 j = 1; 218 break; 219 } 220 } 221 if (!j) { /* we need to add another algorithm */ 222 int nid; 223 224 if ((alg = X509_ALGOR_new()) == NULL 225 || (alg->parameter = ASN1_TYPE_new()) == NULL) { 226 X509_ALGOR_free(alg); 227 ERR_raise(ERR_LIB_PKCS7, ERR_R_MALLOC_FAILURE); 228 return 0; 229 } 230 /* 231 * If there is a constant copy of the ASN1 OBJECT in libcrypto, then 232 * use that. Otherwise, use a dynamically duplicated copy 233 */ 234 if ((nid = OBJ_obj2nid(obj)) != NID_undef) 235 alg->algorithm = OBJ_nid2obj(nid); 236 else 237 alg->algorithm = OBJ_dup(obj); 238 alg->parameter->type = V_ASN1_NULL; 239 if (alg->algorithm == NULL || !sk_X509_ALGOR_push(md_sk, alg)) { 240 X509_ALGOR_free(alg); 241 return 0; 242 } 243 } 244 245 psi->ctx = ossl_pkcs7_get0_ctx(p7); 246 if (!sk_PKCS7_SIGNER_INFO_push(signer_sk, psi)) 247 return 0; 248 return 1; 249 } 250 251 int PKCS7_add_certificate(PKCS7 *p7, X509 *x509) 252 { 253 int i; 254 STACK_OF(X509) **sk; 255 256 i = OBJ_obj2nid(p7->type); 257 switch (i) { 258 case NID_pkcs7_signed: 259 sk = &(p7->d.sign->cert); 260 break; 261 case NID_pkcs7_signedAndEnveloped: 262 sk = &(p7->d.signed_and_enveloped->cert); 263 break; 264 default: 265 ERR_raise(ERR_LIB_PKCS7, PKCS7_R_WRONG_CONTENT_TYPE); 266 return 0; 267 } 268 269 return ossl_x509_add_cert_new(sk, x509, X509_ADD_FLAG_UP_REF); 270 } 271 272 int PKCS7_add_crl(PKCS7 *p7, X509_CRL *crl) 273 { 274 int i; 275 STACK_OF(X509_CRL) **sk; 276 277 i = OBJ_obj2nid(p7->type); 278 switch (i) { 279 case NID_pkcs7_signed: 280 sk = &(p7->d.sign->crl); 281 break; 282 case NID_pkcs7_signedAndEnveloped: 283 sk = &(p7->d.signed_and_enveloped->crl); 284 break; 285 default: 286 ERR_raise(ERR_LIB_PKCS7, PKCS7_R_WRONG_CONTENT_TYPE); 287 return 0; 288 } 289 290 if (*sk == NULL) 291 *sk = sk_X509_CRL_new_null(); 292 if (*sk == NULL) { 293 ERR_raise(ERR_LIB_PKCS7, ERR_R_MALLOC_FAILURE); 294 return 0; 295 } 296 297 X509_CRL_up_ref(crl); 298 if (!sk_X509_CRL_push(*sk, crl)) { 299 X509_CRL_free(crl); 300 return 0; 301 } 302 return 1; 303 } 304 305 static int pkcs7_ecdsa_or_dsa_sign_verify_setup(PKCS7_SIGNER_INFO *si, 306 int verify) 307 { 308 if (verify == 0) { 309 int snid, hnid; 310 X509_ALGOR *alg1, *alg2; 311 EVP_PKEY *pkey = si->pkey; 312 313 PKCS7_SIGNER_INFO_get0_algs(si, NULL, &alg1, &alg2); 314 if (alg1 == NULL || alg1->algorithm == NULL) 315 return -1; 316 hnid = OBJ_obj2nid(alg1->algorithm); 317 if (hnid == NID_undef) 318 return -1; 319 if (!OBJ_find_sigid_by_algs(&snid, hnid, EVP_PKEY_get_id(pkey))) 320 return -1; 321 X509_ALGOR_set0(alg2, OBJ_nid2obj(snid), V_ASN1_UNDEF, 0); 322 } 323 return 1; 324 } 325 326 static int pkcs7_rsa_sign_verify_setup(PKCS7_SIGNER_INFO *si, int verify) 327 { 328 if (verify == 0) { 329 X509_ALGOR *alg = NULL; 330 331 PKCS7_SIGNER_INFO_get0_algs(si, NULL, NULL, &alg); 332 if (alg != NULL) 333 X509_ALGOR_set0(alg, OBJ_nid2obj(NID_rsaEncryption), V_ASN1_NULL, 0); 334 } 335 return 1; 336 } 337 338 int PKCS7_SIGNER_INFO_set(PKCS7_SIGNER_INFO *p7i, X509 *x509, EVP_PKEY *pkey, 339 const EVP_MD *dgst) 340 { 341 int ret; 342 343 /* We now need to add another PKCS7_SIGNER_INFO entry */ 344 if (!ASN1_INTEGER_set(p7i->version, 1)) 345 goto err; 346 if (!X509_NAME_set(&p7i->issuer_and_serial->issuer, 347 X509_get_issuer_name(x509))) 348 goto err; 349 350 /* 351 * because ASN1_INTEGER_set is used to set a 'long' we will do things the 352 * ugly way. 353 */ 354 ASN1_INTEGER_free(p7i->issuer_and_serial->serial); 355 if (!(p7i->issuer_and_serial->serial = 356 ASN1_INTEGER_dup(X509_get0_serialNumber(x509)))) 357 goto err; 358 359 /* lets keep the pkey around for a while */ 360 EVP_PKEY_up_ref(pkey); 361 p7i->pkey = pkey; 362 363 /* Set the algorithms */ 364 365 X509_ALGOR_set0(p7i->digest_alg, OBJ_nid2obj(EVP_MD_get_type(dgst)), 366 V_ASN1_NULL, NULL); 367 368 if (EVP_PKEY_is_a(pkey, "EC") || EVP_PKEY_is_a(pkey, "DSA")) 369 return pkcs7_ecdsa_or_dsa_sign_verify_setup(p7i, 0); 370 if (EVP_PKEY_is_a(pkey, "RSA")) 371 return pkcs7_rsa_sign_verify_setup(p7i, 0); 372 373 if (pkey->ameth != NULL && pkey->ameth->pkey_ctrl != NULL) { 374 ret = pkey->ameth->pkey_ctrl(pkey, ASN1_PKEY_CTRL_PKCS7_SIGN, 0, p7i); 375 if (ret > 0) 376 return 1; 377 if (ret != -2) { 378 ERR_raise(ERR_LIB_PKCS7, PKCS7_R_SIGNING_CTRL_FAILURE); 379 return 0; 380 } 381 } 382 ERR_raise(ERR_LIB_PKCS7, PKCS7_R_SIGNING_NOT_SUPPORTED_FOR_THIS_KEY_TYPE); 383 err: 384 return 0; 385 } 386 387 PKCS7_SIGNER_INFO *PKCS7_add_signature(PKCS7 *p7, X509 *x509, EVP_PKEY *pkey, 388 const EVP_MD *dgst) 389 { 390 PKCS7_SIGNER_INFO *si = NULL; 391 392 if (dgst == NULL) { 393 int def_nid; 394 if (EVP_PKEY_get_default_digest_nid(pkey, &def_nid) <= 0) 395 goto err; 396 dgst = EVP_get_digestbynid(def_nid); 397 if (dgst == NULL) { 398 ERR_raise(ERR_LIB_PKCS7, PKCS7_R_NO_DEFAULT_DIGEST); 399 goto err; 400 } 401 } 402 403 if ((si = PKCS7_SIGNER_INFO_new()) == NULL) 404 goto err; 405 if (PKCS7_SIGNER_INFO_set(si, x509, pkey, dgst) <= 0) 406 goto err; 407 if (!PKCS7_add_signer(p7, si)) 408 goto err; 409 return si; 410 err: 411 PKCS7_SIGNER_INFO_free(si); 412 return NULL; 413 } 414 415 static STACK_OF(X509) *pkcs7_get_signer_certs(const PKCS7 *p7) 416 { 417 if (p7->d.ptr == NULL) 418 return NULL; 419 if (PKCS7_type_is_signed(p7)) 420 return p7->d.sign->cert; 421 if (PKCS7_type_is_signedAndEnveloped(p7)) 422 return p7->d.signed_and_enveloped->cert; 423 return NULL; 424 } 425 426 static STACK_OF(PKCS7_RECIP_INFO) *pkcs7_get_recipient_info(const PKCS7 *p7) 427 { 428 if (p7->d.ptr == NULL) 429 return NULL; 430 if (PKCS7_type_is_signedAndEnveloped(p7)) 431 return p7->d.signed_and_enveloped->recipientinfo; 432 if (PKCS7_type_is_enveloped(p7)) 433 return p7->d.enveloped->recipientinfo; 434 return NULL; 435 } 436 437 /* 438 * Set up the library context into any loaded structure that needs it. 439 * i.e loaded X509 objects. 440 */ 441 void ossl_pkcs7_resolve_libctx(PKCS7 *p7) 442 { 443 int i; 444 const PKCS7_CTX *ctx = ossl_pkcs7_get0_ctx(p7); 445 OSSL_LIB_CTX *libctx = ossl_pkcs7_ctx_get0_libctx(ctx); 446 const char *propq = ossl_pkcs7_ctx_get0_propq(ctx); 447 STACK_OF(PKCS7_RECIP_INFO) *rinfos; 448 STACK_OF(PKCS7_SIGNER_INFO) *sinfos; 449 STACK_OF(X509) *certs; 450 451 if (ctx == NULL || p7->d.ptr == NULL) 452 return; 453 454 rinfos = pkcs7_get_recipient_info(p7); 455 sinfos = PKCS7_get_signer_info(p7); 456 certs = pkcs7_get_signer_certs(p7); 457 458 for (i = 0; i < sk_X509_num(certs); i++) 459 ossl_x509_set0_libctx(sk_X509_value(certs, i), libctx, propq); 460 461 for (i = 0; i < sk_PKCS7_RECIP_INFO_num(rinfos); i++) { 462 PKCS7_RECIP_INFO *ri = sk_PKCS7_RECIP_INFO_value(rinfos, i); 463 464 ossl_x509_set0_libctx(ri->cert, libctx, propq); 465 } 466 467 for (i = 0; i < sk_PKCS7_SIGNER_INFO_num(sinfos); i++) { 468 PKCS7_SIGNER_INFO *si = sk_PKCS7_SIGNER_INFO_value(sinfos, i); 469 470 if (si != NULL) 471 si->ctx = ctx; 472 } 473 } 474 475 const PKCS7_CTX *ossl_pkcs7_get0_ctx(const PKCS7 *p7) 476 { 477 return p7 != NULL ? &p7->ctx : NULL; 478 } 479 480 void ossl_pkcs7_set0_libctx(PKCS7 *p7, OSSL_LIB_CTX *ctx) 481 { 482 p7->ctx.libctx = ctx; 483 } 484 485 int ossl_pkcs7_set1_propq(PKCS7 *p7, const char *propq) 486 { 487 if (p7->ctx.propq != NULL) { 488 OPENSSL_free(p7->ctx.propq); 489 p7->ctx.propq = NULL; 490 } 491 if (propq != NULL) { 492 p7->ctx.propq = OPENSSL_strdup(propq); 493 if (p7->ctx.propq == NULL) { 494 ERR_raise(ERR_LIB_PROV, ERR_R_MALLOC_FAILURE); 495 return 0; 496 } 497 } 498 return 1; 499 } 500 501 int ossl_pkcs7_ctx_propagate(const PKCS7 *from, PKCS7 *to) 502 { 503 ossl_pkcs7_set0_libctx(to, from->ctx.libctx); 504 if (!ossl_pkcs7_set1_propq(to, from->ctx.propq)) 505 return 0; 506 507 ossl_pkcs7_resolve_libctx(to); 508 return 1; 509 } 510 511 OSSL_LIB_CTX *ossl_pkcs7_ctx_get0_libctx(const PKCS7_CTX *ctx) 512 { 513 return ctx != NULL ? ctx->libctx : NULL; 514 } 515 const char *ossl_pkcs7_ctx_get0_propq(const PKCS7_CTX *ctx) 516 { 517 return ctx != NULL ? ctx->propq : NULL; 518 } 519 520 int PKCS7_set_digest(PKCS7 *p7, const EVP_MD *md) 521 { 522 if (PKCS7_type_is_digest(p7)) { 523 if ((p7->d.digest->md->parameter = ASN1_TYPE_new()) == NULL) { 524 ERR_raise(ERR_LIB_PKCS7, ERR_R_MALLOC_FAILURE); 525 return 0; 526 } 527 p7->d.digest->md->parameter->type = V_ASN1_NULL; 528 p7->d.digest->md->algorithm = OBJ_nid2obj(EVP_MD_nid(md)); 529 return 1; 530 } 531 532 ERR_raise(ERR_LIB_PKCS7, PKCS7_R_WRONG_CONTENT_TYPE); 533 return 1; 534 } 535 536 STACK_OF(PKCS7_SIGNER_INFO) *PKCS7_get_signer_info(PKCS7 *p7) 537 { 538 if (p7 == NULL || p7->d.ptr == NULL) 539 return NULL; 540 if (PKCS7_type_is_signed(p7)) { 541 return p7->d.sign->signer_info; 542 } else if (PKCS7_type_is_signedAndEnveloped(p7)) { 543 return p7->d.signed_and_enveloped->signer_info; 544 } else 545 return NULL; 546 } 547 548 void PKCS7_SIGNER_INFO_get0_algs(PKCS7_SIGNER_INFO *si, EVP_PKEY **pk, 549 X509_ALGOR **pdig, X509_ALGOR **psig) 550 { 551 if (pk) 552 *pk = si->pkey; 553 if (pdig) 554 *pdig = si->digest_alg; 555 if (psig) 556 *psig = si->digest_enc_alg; 557 } 558 559 void PKCS7_RECIP_INFO_get0_alg(PKCS7_RECIP_INFO *ri, X509_ALGOR **penc) 560 { 561 if (penc) 562 *penc = ri->key_enc_algor; 563 } 564 565 PKCS7_RECIP_INFO *PKCS7_add_recipient(PKCS7 *p7, X509 *x509) 566 { 567 PKCS7_RECIP_INFO *ri; 568 569 if ((ri = PKCS7_RECIP_INFO_new()) == NULL) 570 goto err; 571 if (PKCS7_RECIP_INFO_set(ri, x509) <= 0) 572 goto err; 573 if (!PKCS7_add_recipient_info(p7, ri)) 574 goto err; 575 ri->ctx = ossl_pkcs7_get0_ctx(p7); 576 return ri; 577 err: 578 PKCS7_RECIP_INFO_free(ri); 579 return NULL; 580 } 581 582 int PKCS7_add_recipient_info(PKCS7 *p7, PKCS7_RECIP_INFO *ri) 583 { 584 int i; 585 STACK_OF(PKCS7_RECIP_INFO) *sk; 586 587 i = OBJ_obj2nid(p7->type); 588 switch (i) { 589 case NID_pkcs7_signedAndEnveloped: 590 sk = p7->d.signed_and_enveloped->recipientinfo; 591 break; 592 case NID_pkcs7_enveloped: 593 sk = p7->d.enveloped->recipientinfo; 594 break; 595 default: 596 ERR_raise(ERR_LIB_PKCS7, PKCS7_R_WRONG_CONTENT_TYPE); 597 return 0; 598 } 599 600 if (!sk_PKCS7_RECIP_INFO_push(sk, ri)) 601 return 0; 602 return 1; 603 } 604 605 static int pkcs7_rsa_encrypt_decrypt_setup(PKCS7_RECIP_INFO *ri, int decrypt) 606 { 607 X509_ALGOR *alg = NULL; 608 609 if (decrypt == 0) { 610 PKCS7_RECIP_INFO_get0_alg(ri, &alg); 611 if (alg != NULL) 612 X509_ALGOR_set0(alg, OBJ_nid2obj(NID_rsaEncryption), V_ASN1_NULL, 0); 613 } 614 return 1; 615 } 616 617 int PKCS7_RECIP_INFO_set(PKCS7_RECIP_INFO *p7i, X509 *x509) 618 { 619 int ret; 620 EVP_PKEY *pkey = NULL; 621 if (!ASN1_INTEGER_set(p7i->version, 0)) 622 return 0; 623 if (!X509_NAME_set(&p7i->issuer_and_serial->issuer, 624 X509_get_issuer_name(x509))) 625 return 0; 626 627 ASN1_INTEGER_free(p7i->issuer_and_serial->serial); 628 if (!(p7i->issuer_and_serial->serial = 629 ASN1_INTEGER_dup(X509_get0_serialNumber(x509)))) 630 return 0; 631 632 pkey = X509_get0_pubkey(x509); 633 if (pkey == NULL) 634 return 0; 635 636 if (EVP_PKEY_is_a(pkey, "RSA-PSS")) 637 return -2; 638 if (EVP_PKEY_is_a(pkey, "RSA")) { 639 if (pkcs7_rsa_encrypt_decrypt_setup(p7i, 0) <= 0) 640 goto err; 641 goto finished; 642 } 643 644 if (pkey->ameth == NULL || pkey->ameth->pkey_ctrl == NULL) { 645 ERR_raise(ERR_LIB_PKCS7, 646 PKCS7_R_ENCRYPTION_NOT_SUPPORTED_FOR_THIS_KEY_TYPE); 647 goto err; 648 } 649 650 ret = pkey->ameth->pkey_ctrl(pkey, ASN1_PKEY_CTRL_PKCS7_ENCRYPT, 0, p7i); 651 if (ret == -2) { 652 ERR_raise(ERR_LIB_PKCS7, 653 PKCS7_R_ENCRYPTION_NOT_SUPPORTED_FOR_THIS_KEY_TYPE); 654 goto err; 655 } 656 if (ret <= 0) { 657 ERR_raise(ERR_LIB_PKCS7, PKCS7_R_ENCRYPTION_CTRL_FAILURE); 658 goto err; 659 } 660 finished: 661 X509_up_ref(x509); 662 p7i->cert = x509; 663 664 return 1; 665 666 err: 667 return 0; 668 } 669 670 X509 *PKCS7_cert_from_signer_info(PKCS7 *p7, PKCS7_SIGNER_INFO *si) 671 { 672 if (PKCS7_type_is_signed(p7)) 673 return (X509_find_by_issuer_and_serial(p7->d.sign->cert, 674 si->issuer_and_serial->issuer, 675 si-> 676 issuer_and_serial->serial)); 677 else 678 return NULL; 679 } 680 681 int PKCS7_set_cipher(PKCS7 *p7, const EVP_CIPHER *cipher) 682 { 683 int i; 684 PKCS7_ENC_CONTENT *ec; 685 686 i = OBJ_obj2nid(p7->type); 687 switch (i) { 688 case NID_pkcs7_signedAndEnveloped: 689 ec = p7->d.signed_and_enveloped->enc_data; 690 break; 691 case NID_pkcs7_enveloped: 692 ec = p7->d.enveloped->enc_data; 693 break; 694 default: 695 ERR_raise(ERR_LIB_PKCS7, PKCS7_R_WRONG_CONTENT_TYPE); 696 return 0; 697 } 698 699 /* Check cipher OID exists and has data in it */ 700 i = EVP_CIPHER_get_type(cipher); 701 if (i == NID_undef) { 702 ERR_raise(ERR_LIB_PKCS7, PKCS7_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER); 703 return 0; 704 } 705 706 ec->cipher = cipher; 707 ec->ctx = ossl_pkcs7_get0_ctx(p7); 708 return 1; 709 } 710 711 /* unfortunately cannot constify BIO_new_NDEF() due to this and CMS_stream() */ 712 int PKCS7_stream(unsigned char ***boundary, PKCS7 *p7) 713 { 714 ASN1_OCTET_STRING *os = NULL; 715 716 switch (OBJ_obj2nid(p7->type)) { 717 case NID_pkcs7_data: 718 os = p7->d.data; 719 break; 720 721 case NID_pkcs7_signedAndEnveloped: 722 os = p7->d.signed_and_enveloped->enc_data->enc_data; 723 if (os == NULL) { 724 os = ASN1_OCTET_STRING_new(); 725 p7->d.signed_and_enveloped->enc_data->enc_data = os; 726 } 727 break; 728 729 case NID_pkcs7_enveloped: 730 os = p7->d.enveloped->enc_data->enc_data; 731 if (os == NULL) { 732 os = ASN1_OCTET_STRING_new(); 733 p7->d.enveloped->enc_data->enc_data = os; 734 } 735 break; 736 737 case NID_pkcs7_signed: 738 os = p7->d.sign->contents->d.data; 739 break; 740 741 default: 742 os = NULL; 743 break; 744 } 745 746 if (os == NULL) 747 return 0; 748 749 os->flags |= ASN1_STRING_FLAG_NDEF; 750 *boundary = &os->data; 751 752 return 1; 753 } 754