cms_smime.c@ 96159

最後變更在這個檔案從96159是 94082,由 vboxsync 提交於 3 年前
libs/openssl-3.0.1: started applying and adjusting our OpenSSL changes to 3.0.1. bugref:10128
檔案大小: 26.8 KB

行
1	/*
2	* Copyright 2008-2021 The OpenSSL Project Authors. All Rights Reserved.
3	*
4	* Licensed under the Apache License 2.0 (the "License"). You may not use
5	* this file except in compliance with the License. You can obtain a copy
6	* in the file LICENSE in the source distribution or at
7	* https://www.openssl.org/source/license.html
8	*/
9
10	#include "internal/cryptlib.h"
11	#include <openssl/asn1t.h>
12	#include <openssl/x509.h>
13	#include <openssl/x509v3.h>
14	#include <openssl/err.h>
15	#include <openssl/cms.h>
16	#include "cms_local.h"
17	#include "crypto/asn1.h"
18
19	static BIO cms_get_text_bio(BIO out, unsigned int flags)
20	{
21	BIO *rbio;
22
23	if (out == NULL)
24	rbio = BIO_new(BIO_s_null());
25	else if (flags & CMS_TEXT) {
26	rbio = BIO_new(BIO_s_mem());
27	BIO_set_mem_eof_return(rbio, 0);
28	} else
29	rbio = out;
30	return rbio;
31	}
32
33	static int cms_copy_content(BIO out, BIO in, unsigned int flags)
34	{
35	unsigned char buf[4096];
36	int r = 0, i;
37	BIO *tmpout;
38
39	tmpout = cms_get_text_bio(out, flags);
40
41	if (tmpout == NULL) {
42	ERR_raise(ERR_LIB_CMS, ERR_R_MALLOC_FAILURE);
43	goto err;
44	}
45
46	/* Read all content through chain to process digest, decrypt etc */
47	for (;;) {
48	i = BIO_read(in, buf, sizeof(buf));
49	if (i <= 0) {
50	if (BIO_method_type(in) == BIO_TYPE_CIPHER) {
51	if (!BIO_get_cipher_status(in))
52	goto err;
53	}
54	if (i < 0)
55	goto err;
56	break;
57	}
58
59	if (tmpout != NULL && (BIO_write(tmpout, buf, i) != i))
60	goto err;
61	}
62
63	if (flags & CMS_TEXT) {
64	if (!SMIME_text(tmpout, out)) {
65	ERR_raise(ERR_LIB_CMS, CMS_R_SMIME_TEXT_ERROR);
66	goto err;
67	}
68	}
69
70	r = 1;
71	err:
72	if (tmpout != out)
73	BIO_free(tmpout);
74	return r;
75
76	}
77
78	static int check_content(CMS_ContentInfo *cms)
79	{
80	ASN1_OCTET_STRING **pos = CMS_get0_content(cms);
81
82	if (pos == NULL \|\| *pos == NULL) {
83	ERR_raise(ERR_LIB_CMS, CMS_R_NO_CONTENT);
84	return 0;
85	}
86	return 1;
87	}
88
89	static void do_free_upto(BIO f, BIO upto)
90	{
91	if (upto != NULL) {
92	BIO *tbio;
93
94	do {
95	tbio = BIO_pop(f);
96	BIO_free(f);
97	f = tbio;
98	} while (f != NULL && f != upto);
99	} else {
100	BIO_free_all(f);
101	}
102	}
103
104	int CMS_data(CMS_ContentInfo cms, BIO out, unsigned int flags)
105	{
106	BIO *cont;
107	int r;
108
109	if (OBJ_obj2nid(CMS_get0_type(cms)) != NID_pkcs7_data) {
110	ERR_raise(ERR_LIB_CMS, CMS_R_TYPE_NOT_DATA);
111	return 0;
112	}
113	cont = CMS_dataInit(cms, NULL);
114	if (cont == NULL)
115	return 0;
116	r = cms_copy_content(out, cont, flags);
117	BIO_free_all(cont);
118	return r;
119	}
120
121	CMS_ContentInfo CMS_data_create_ex(BIO in, unsigned int flags,
122	OSSL_LIB_CTX libctx, const char propq)
123	{
124	CMS_ContentInfo *cms = ossl_cms_Data_create(libctx, propq);
125
126	if (cms == NULL)
127	return NULL;
128
129	if ((flags & CMS_STREAM) \|\| CMS_final(cms, in, NULL, flags))
130	return cms;
131
132	CMS_ContentInfo_free(cms);
133	return NULL;
134	}
135
136	CMS_ContentInfo CMS_data_create(BIO in, unsigned int flags)
137	{
138	return CMS_data_create_ex(in, flags, NULL, NULL);
139	}
140
141	int CMS_digest_verify(CMS_ContentInfo cms, BIO dcont, BIO *out,
142	unsigned int flags)
143	{
144	BIO *cont;
145	int r;
146
147	if (OBJ_obj2nid(CMS_get0_type(cms)) != NID_pkcs7_digest) {
148	ERR_raise(ERR_LIB_CMS, CMS_R_TYPE_NOT_DIGESTED_DATA);
149	return 0;
150	}
151
152	if (dcont == NULL && !check_content(cms))
153	return 0;
154
155	cont = CMS_dataInit(cms, dcont);
156	if (cont == NULL)
157	return 0;
158
159	r = cms_copy_content(out, cont, flags);
160	if (r)
161	r = ossl_cms_DigestedData_do_final(cms, cont, 1);
162	do_free_upto(cont, dcont);
163	return r;
164	}
165
166	CMS_ContentInfo CMS_digest_create_ex(BIO in, const EVP_MD *md,
167	unsigned int flags, OSSL_LIB_CTX *ctx,
168	const char *propq)
169	{
170	CMS_ContentInfo *cms;
171
172	/*
173	* Because the EVP_MD is cached and can be a legacy algorithm, we
174	* cannot fetch the algorithm if it isn't supplied.
175	*/
176	if (md == NULL)
177	md = EVP_sha1();
178	cms = ossl_cms_DigestedData_create(md, ctx, propq);
179	if (cms == NULL)
180	return NULL;
181
182	if (!(flags & CMS_DETACHED))
183	CMS_set_detached(cms, 0);
184
185	if ((flags & CMS_STREAM) \|\| CMS_final(cms, in, NULL, flags))
186	return cms;
187
188	CMS_ContentInfo_free(cms);
189	return NULL;
190	}
191
192	CMS_ContentInfo CMS_digest_create(BIO in, const EVP_MD *md,
193	unsigned int flags)
194	{
195	return CMS_digest_create_ex(in, md, flags, NULL, NULL);
196	}
197
198	int CMS_EncryptedData_decrypt(CMS_ContentInfo *cms,
199	const unsigned char *key, size_t keylen,
200	BIO dcont, BIO out, unsigned int flags)
201	{
202	BIO *cont;
203	int r;
204
205	if (OBJ_obj2nid(CMS_get0_type(cms)) != NID_pkcs7_encrypted) {
206	ERR_raise(ERR_LIB_CMS, CMS_R_TYPE_NOT_ENCRYPTED_DATA);
207	return 0;
208	}
209
210	if (dcont == NULL && !check_content(cms))
211	return 0;
212
213	if (CMS_EncryptedData_set1_key(cms, NULL, key, keylen) <= 0)
214	return 0;
215	cont = CMS_dataInit(cms, dcont);
216	if (cont == NULL)
217	return 0;
218	r = cms_copy_content(out, cont, flags);
219	do_free_upto(cont, dcont);
220	return r;
221	}
222
223	CMS_ContentInfo CMS_EncryptedData_encrypt_ex(BIO in, const EVP_CIPHER *cipher,
224	const unsigned char *key,
225	size_t keylen, unsigned int flags,
226	OSSL_LIB_CTX *libctx,
227	const char *propq)
228	{
229	CMS_ContentInfo *cms;
230
231	if (cipher == NULL) {
232	ERR_raise(ERR_LIB_CMS, CMS_R_NO_CIPHER);
233	return NULL;
234	}
235	cms = CMS_ContentInfo_new_ex(libctx, propq);
236	if (cms == NULL)
237	return NULL;
238	if (!CMS_EncryptedData_set1_key(cms, cipher, key, keylen))
239	return NULL;
240
241	if (!(flags & CMS_DETACHED))
242	CMS_set_detached(cms, 0);
243
244	if ((flags & (CMS_STREAM \| CMS_PARTIAL))
245	\|\| CMS_final(cms, in, NULL, flags))
246	return cms;
247
248	CMS_ContentInfo_free(cms);
249	return NULL;
250	}
251
252	CMS_ContentInfo CMS_EncryptedData_encrypt(BIO in, const EVP_CIPHER *cipher,
253	const unsigned char *key,
254	size_t keylen, unsigned int flags)
255	{
256	return CMS_EncryptedData_encrypt_ex(in, cipher, key, keylen, flags, NULL,
257	NULL);
258	}
259
260	static int cms_signerinfo_verify_cert(CMS_SignerInfo *si,
261	X509_STORE *store,
262	STACK_OF(X509) *certs,
263	STACK_OF(X509_CRL) *crls,
264	STACK_OF(X509) **chain,
265	const CMS_CTX *cms_ctx)
266	{
267	X509_STORE_CTX *ctx;
268	X509 *signer;
269	int i, j, r = 0;
270
271	ctx = X509_STORE_CTX_new_ex(ossl_cms_ctx_get0_libctx(cms_ctx),
272	ossl_cms_ctx_get0_propq(cms_ctx));
273	if (ctx == NULL) {
274	ERR_raise(ERR_LIB_CMS, ERR_R_MALLOC_FAILURE);
275	goto err;
276	}
277	CMS_SignerInfo_get0_algs(si, NULL, &signer, NULL, NULL);
278	if (!X509_STORE_CTX_init(ctx, store, signer, certs)) {
279	ERR_raise(ERR_LIB_CMS, CMS_R_STORE_INIT_ERROR);
280	goto err;
281	}
282	X509_STORE_CTX_set_default(ctx, "smime_sign");
283	if (crls != NULL)
284	X509_STORE_CTX_set0_crls(ctx, crls);
285
286	i = X509_verify_cert(ctx);
287	if (i <= 0) {
288	j = X509_STORE_CTX_get_error(ctx);
289	ERR_raise_data(ERR_LIB_CMS, CMS_R_CERTIFICATE_VERIFY_ERROR,
290	"Verify error: %s", X509_verify_cert_error_string(j));
291	goto err;
292	}
293	r = 1;
294
295	/* also send back the trust chain when required */
296	if (chain != NULL)
297	*chain = X509_STORE_CTX_get1_chain(ctx);
298	err:
299	X509_STORE_CTX_free(ctx);
300	return r;
301
302	}
303
304	int CMS_verify(CMS_ContentInfo cms, STACK_OF(X509) certs,
305	X509_STORE store, BIO dcont, BIO *out, unsigned int flags)
306	{
307	CMS_SignerInfo *si;
308	STACK_OF(CMS_SignerInfo) *sinfos;
309	STACK_OF(X509) *cms_certs = NULL;
310	STACK_OF(X509_CRL) *crls = NULL;
311	STACK_OF(X509) **si_chains = NULL;
312	X509 *signer;
313	int i, scount = 0, ret = 0;
314	BIO cmsbio = NULL, tmpin = NULL, *tmpout = NULL;
315	int cadesVerify = (flags & CMS_CADES) != 0;
316	const CMS_CTX *ctx = ossl_cms_get0_cmsctx(cms);
317
318	if (dcont == NULL && !check_content(cms))
319	return 0;
320	if (dcont != NULL && !(flags & CMS_BINARY)) {
321	const ASN1_OBJECT *coid = CMS_get0_eContentType(cms);
322
323	if (OBJ_obj2nid(coid) == NID_id_ct_asciiTextWithCRLF)
324	flags \|= CMS_ASCIICRLF;
325	}
326
327	/* Attempt to find all signer certificates */
328
329	sinfos = CMS_get0_SignerInfos(cms);
330
331	if (sk_CMS_SignerInfo_num(sinfos) <= 0) {
332	ERR_raise(ERR_LIB_CMS, CMS_R_NO_SIGNERS);
333	goto err;
334	}
335
336	for (i = 0; i < sk_CMS_SignerInfo_num(sinfos); i++) {
337	si = sk_CMS_SignerInfo_value(sinfos, i);
338	CMS_SignerInfo_get0_algs(si, NULL, &signer, NULL, NULL);
339	if (signer)
340	scount++;
341	}
342
343	if (scount != sk_CMS_SignerInfo_num(sinfos))
344	scount += CMS_set1_signers_certs(cms, certs, flags);
345
346	if (scount != sk_CMS_SignerInfo_num(sinfos)) {
347	ERR_raise(ERR_LIB_CMS, CMS_R_SIGNER_CERTIFICATE_NOT_FOUND);
348	goto err;
349	}
350
351	/* Attempt to verify all signers certs */
352	/* at this point scount == sk_CMS_SignerInfo_num(sinfos) */
353
354	if ((flags & CMS_NO_SIGNER_CERT_VERIFY) == 0 \|\| cadesVerify) {
355	if (cadesVerify) {
356	/* Certificate trust chain is required to check CAdES signature */
357	si_chains = OPENSSL_zalloc(scount * sizeof(si_chains[0]));
358	if (si_chains == NULL) {
359	ERR_raise(ERR_LIB_CMS, ERR_R_MALLOC_FAILURE);
360	goto err;
361	}
362	}
363	cms_certs = CMS_get1_certs(cms);
364	if (!(flags & CMS_NOCRL))
365	crls = CMS_get1_crls(cms);
366	for (i = 0; i < scount; i++) {
367	si = sk_CMS_SignerInfo_value(sinfos, i);
368
369	if (!cms_signerinfo_verify_cert(si, store, cms_certs, crls,
370	si_chains ? &si_chains[i] : NULL,
371	ctx))
372	goto err;
373	}
374	}
375
376	/* Attempt to verify all SignerInfo signed attribute signatures */
377
378	if ((flags & CMS_NO_ATTR_VERIFY) == 0 \|\| cadesVerify) {
379	for (i = 0; i < scount; i++) {
380	si = sk_CMS_SignerInfo_value(sinfos, i);
381	if (CMS_signed_get_attr_count(si) < 0)
382	continue;
383	if (CMS_SignerInfo_verify(si) <= 0)
384	goto err;
385	if (cadesVerify) {
386	STACK_OF(X509) *si_chain = si_chains ? si_chains[i] : NULL;
387
388	if (ossl_cms_check_signing_certs(si, si_chain) <= 0)
389	goto err;
390	}
391	}
392	}
393
394	/*
395	* Performance optimization: if the content is a memory BIO then store
396	* its contents in a temporary read only memory BIO. This avoids
397	* potentially large numbers of slow copies of data which will occur when
398	* reading from a read write memory BIO when signatures are calculated.
399	*/
400
401	if (dcont != NULL && (BIO_method_type(dcont) == BIO_TYPE_MEM)) {
402	char *ptr;
403	long len;
404
405	len = BIO_get_mem_data(dcont, &ptr);
406	tmpin = (len == 0) ? dcont : BIO_new_mem_buf(ptr, len);
407	if (tmpin == NULL) {
408	ERR_raise(ERR_LIB_CMS, ERR_R_MALLOC_FAILURE);
409	goto err2;
410	}
411	} else {
412	tmpin = dcont;
413	}
414	/*
415	* If not binary mode and detached generate digests by writing through
416	* the BIO. That makes it possible to canonicalise the input.
417	*/
418	if (!(flags & SMIME_BINARY) && dcont) {
419	/*
420	* Create output BIO so we can either handle text or to ensure
421	* included content doesn't override detached content.
422	*/
423	tmpout = cms_get_text_bio(out, flags);
424	if (tmpout == NULL) {
425	ERR_raise(ERR_LIB_CMS, ERR_R_MALLOC_FAILURE);
426	goto err;
427	}
428	cmsbio = CMS_dataInit(cms, tmpout);
429	if (cmsbio == NULL)
430	goto err;
431	/*
432	* Don't use SMIME_TEXT for verify: it adds headers and we want to
433	* remove them.
434	*/
435	SMIME_crlf_copy(dcont, cmsbio, flags & ~SMIME_TEXT);
436
437	if (flags & CMS_TEXT) {
438	if (!SMIME_text(tmpout, out)) {
439	ERR_raise(ERR_LIB_CMS, CMS_R_SMIME_TEXT_ERROR);
440	goto err;
441	}
442	}
443	} else {
444	cmsbio = CMS_dataInit(cms, tmpin);
445	if (cmsbio == NULL)
446	goto err;
447
448	if (!cms_copy_content(out, cmsbio, flags))
449	goto err;
450
451	}
452	if (!(flags & CMS_NO_CONTENT_VERIFY)) {
453	for (i = 0; i < sk_CMS_SignerInfo_num(sinfos); i++) {
454	si = sk_CMS_SignerInfo_value(sinfos, i);
455	if (CMS_SignerInfo_verify_content(si, cmsbio) <= 0) {
456	ERR_raise(ERR_LIB_CMS, CMS_R_CONTENT_VERIFY_ERROR);
457	goto err;
458	}
459	}
460	}
461
462	ret = 1;
463	err:
464	if (!(flags & SMIME_BINARY) && dcont) {
465	do_free_upto(cmsbio, tmpout);
466	if (tmpin != dcont)
467	BIO_free(tmpin);
468	} else {
469	if (dcont && (tmpin == dcont))
470	do_free_upto(cmsbio, dcont);
471	else
472	BIO_free_all(cmsbio);
473	}
474
475	if (out != tmpout)
476	BIO_free_all(tmpout);
477
478	err2:
479	if (si_chains != NULL) {
480	for (i = 0; i < scount; ++i)
481	sk_X509_pop_free(si_chains[i], X509_free);
482	OPENSSL_free(si_chains);
483	}
484	sk_X509_pop_free(cms_certs, X509_free);
485	sk_X509_CRL_pop_free(crls, X509_CRL_free);
486
487	return ret;
488	}
489
490	int CMS_verify_receipt(CMS_ContentInfo rcms, CMS_ContentInfo ocms,
491	STACK_OF(X509) *certs,
492	X509_STORE *store, unsigned int flags)
493	{
494	int r;
495
496	flags &= ~(CMS_DETACHED \| CMS_TEXT);
497	r = CMS_verify(rcms, certs, store, NULL, NULL, flags);
498	if (r <= 0)
499	return r;
500	return ossl_cms_Receipt_verify(rcms, ocms);
501	}
502
503	CMS_ContentInfo CMS_sign_ex(X509 signcert, EVP_PKEY *pkey,
504	STACK_OF(X509) certs, BIO data,
505	unsigned int flags, OSSL_LIB_CTX *libctx,
506	const char *propq)
507	{
508	CMS_ContentInfo *cms;
509	int i;
510
511	cms = CMS_ContentInfo_new_ex(libctx, propq);
512	if (cms == NULL \|\| !CMS_SignedData_init(cms))
513	goto merr;
514	if (flags & CMS_ASCIICRLF
515	&& !CMS_set1_eContentType(cms,
516	OBJ_nid2obj(NID_id_ct_asciiTextWithCRLF)))
517	goto err;
518
519	if (pkey != NULL && !CMS_add1_signer(cms, signcert, pkey, NULL, flags)) {
520	ERR_raise(ERR_LIB_CMS, CMS_R_ADD_SIGNER_ERROR);
521	goto err;
522	}
523
524	for (i = 0; i < sk_X509_num(certs); i++) {
525	X509 *x = sk_X509_value(certs, i);
526
527	if (!CMS_add1_cert(cms, x))
528	goto merr;
529	}
530
531	if (!(flags & CMS_DETACHED))
532	CMS_set_detached(cms, 0);
533
534	if ((flags & (CMS_STREAM \| CMS_PARTIAL))
535	\|\| CMS_final(cms, data, NULL, flags))
536	return cms;
537	else
538	goto err;
539
540	merr:
541	ERR_raise(ERR_LIB_CMS, ERR_R_MALLOC_FAILURE);
542
543	err:
544	CMS_ContentInfo_free(cms);
545	return NULL;
546	}
547
548	CMS_ContentInfo CMS_sign(X509 signcert, EVP_PKEY pkey, STACK_OF(X509) certs,
549	BIO *data, unsigned int flags)
550	{
551	return CMS_sign_ex(signcert, pkey, certs, data, flags, NULL, NULL);
552	}
553
554	CMS_ContentInfo CMS_sign_receipt(CMS_SignerInfo si,
555	X509 signcert, EVP_PKEY pkey,
556	STACK_OF(X509) *certs, unsigned int flags)
557	{
558	CMS_SignerInfo *rct_si;
559	CMS_ContentInfo *cms = NULL;
560	ASN1_OCTET_STRING *pos, os;
561	BIO *rct_cont = NULL;
562	int r = 0;
563	const CMS_CTX *ctx = si->cms_ctx;
564
565	flags &= ~(CMS_STREAM \| CMS_TEXT);
566	/* Not really detached but avoids content being allocated */
567	flags \|= CMS_PARTIAL \| CMS_BINARY \| CMS_DETACHED;
568	if (pkey == NULL \|\| signcert == NULL) {
569	ERR_raise(ERR_LIB_CMS, CMS_R_NO_KEY_OR_CERT);
570	return NULL;
571	}
572
573	/* Initialize signed data */
574
575	cms = CMS_sign_ex(NULL, NULL, certs, NULL, flags,
576	ossl_cms_ctx_get0_libctx(ctx),
577	ossl_cms_ctx_get0_propq(ctx));
578	if (cms == NULL)
579	goto err;
580
581	/* Set inner content type to signed receipt */
582	if (!CMS_set1_eContentType(cms, OBJ_nid2obj(NID_id_smime_ct_receipt)))
583	goto err;
584
585	rct_si = CMS_add1_signer(cms, signcert, pkey, NULL, flags);
586	if (!rct_si) {
587	ERR_raise(ERR_LIB_CMS, CMS_R_ADD_SIGNER_ERROR);
588	goto err;
589	}
590
591	os = ossl_cms_encode_Receipt(si);
592	if (os == NULL)
593	goto err;
594
595	/* Set content to digest */
596	rct_cont = BIO_new_mem_buf(os->data, os->length);
597	if (rct_cont == NULL)
598	goto err;
599
600	/* Add msgSigDigest attribute */
601
602	if (!ossl_cms_msgSigDigest_add1(rct_si, si))
603	goto err;
604
605	/* Finalize structure */
606	if (!CMS_final(cms, rct_cont, NULL, flags))
607	goto err;
608
609	/* Set embedded content */
610	pos = CMS_get0_content(cms);
611	if (pos == NULL)
612	goto err;
613	*pos = os;
614
615	r = 1;
616
617	err:
618	BIO_free(rct_cont);
619	if (r)
620	return cms;
621	CMS_ContentInfo_free(cms);
622	return NULL;
623
624	}
625
626	CMS_ContentInfo CMS_encrypt_ex(STACK_OF(X509) certs, BIO *data,
627	const EVP_CIPHER *cipher, unsigned int flags,
628	OSSL_LIB_CTX libctx, const char propq)
629	{
630	CMS_ContentInfo *cms;
631	int i;
632	X509 *recip;
633
634
635	cms = (EVP_CIPHER_get_flags(cipher) & EVP_CIPH_FLAG_AEAD_CIPHER)
636	? CMS_AuthEnvelopedData_create_ex(cipher, libctx, propq)
637	: CMS_EnvelopedData_create_ex(cipher, libctx, propq);
638	if (cms == NULL)
639	goto merr;
640	for (i = 0; i < sk_X509_num(certs); i++) {
641	recip = sk_X509_value(certs, i);
642	if (!CMS_add1_recipient_cert(cms, recip, flags)) {
643	ERR_raise(ERR_LIB_CMS, CMS_R_RECIPIENT_ERROR);
644	goto err;
645	}
646	}
647
648	if (!(flags & CMS_DETACHED))
649	CMS_set_detached(cms, 0);
650
651	if ((flags & (CMS_STREAM \| CMS_PARTIAL))
652	\|\| CMS_final(cms, data, NULL, flags))
653	return cms;
654	else
655	goto err;
656
657	merr:
658	ERR_raise(ERR_LIB_CMS, ERR_R_MALLOC_FAILURE);
659	err:
660	CMS_ContentInfo_free(cms);
661	return NULL;
662	}
663
664	CMS_ContentInfo CMS_encrypt(STACK_OF(X509) certs, BIO *data,
665	const EVP_CIPHER *cipher, unsigned int flags)
666	{
667	return CMS_encrypt_ex(certs, data, cipher, flags, NULL, NULL);
668	}
669
670	static int cms_kari_set1_pkey_and_peer(CMS_ContentInfo *cms,
671	CMS_RecipientInfo *ri,
672	EVP_PKEY pk, X509 cert, X509 *peer)
673	{
674	int i;
675	STACK_OF(CMS_RecipientEncryptedKey) *reks;
676	CMS_RecipientEncryptedKey *rek;
677
678	reks = CMS_RecipientInfo_kari_get0_reks(ri);
679	for (i = 0; i < sk_CMS_RecipientEncryptedKey_num(reks); i++) {
680	int rv;
681
682	rek = sk_CMS_RecipientEncryptedKey_value(reks, i);
683	if (cert != NULL && CMS_RecipientEncryptedKey_cert_cmp(rek, cert))
684	continue;
685	CMS_RecipientInfo_kari_set0_pkey_and_peer(ri, pk, peer);
686	rv = CMS_RecipientInfo_kari_decrypt(cms, ri, rek);
687	CMS_RecipientInfo_kari_set0_pkey(ri, NULL);
688	if (rv > 0)
689	return 1;
690	return cert == NULL ? 0 : -1;
691	}
692	return 0;
693	}
694
695	int CMS_decrypt_set1_pkey(CMS_ContentInfo cms, EVP_PKEY pk, X509 *cert)
696	{
697	return CMS_decrypt_set1_pkey_and_peer(cms, pk, cert, NULL);
698	}
699
700	int CMS_decrypt_set1_pkey_and_peer(CMS_ContentInfo cms, EVP_PKEY pk,
701	X509 cert, X509 peer)
702	{
703	STACK_OF(CMS_RecipientInfo) *ris;
704	CMS_RecipientInfo *ri;
705	int i, r, cms_pkey_ri_type;
706	int debug = 0, match_ri = 0;
707
708	ris = CMS_get0_RecipientInfos(cms);
709	if (ris != NULL)
710	debug = ossl_cms_get0_env_enc_content(cms)->debug;
711
712	cms_pkey_ri_type = ossl_cms_pkey_get_ri_type(pk);
713	if (cms_pkey_ri_type == CMS_RECIPINFO_NONE) {
714	ERR_raise(ERR_LIB_CMS, CMS_R_NOT_SUPPORTED_FOR_THIS_KEY_TYPE);
715	return 0;
716	}
717
718	for (i = 0; i < sk_CMS_RecipientInfo_num(ris); i++) {
719	int ri_type;
720
721	ri = sk_CMS_RecipientInfo_value(ris, i);
722	ri_type = CMS_RecipientInfo_type(ri);
723	if (!ossl_cms_pkey_is_ri_type_supported(pk, ri_type))
724	continue;
725	match_ri = 1;
726	if (ri_type == CMS_RECIPINFO_AGREE) {
727	r = cms_kari_set1_pkey_and_peer(cms, ri, pk, cert, peer);
728	if (r > 0)
729	return 1;
730	if (r < 0)
731	return 0;
732	}
733	/*
734	* If we have a cert try matching RecipientInfo otherwise try them
735	* all.
736	*/
737	else if (cert == NULL\|\| !CMS_RecipientInfo_ktri_cert_cmp(ri, cert)) {
738	EVP_PKEY_up_ref(pk);
739	CMS_RecipientInfo_set0_pkey(ri, pk);
740	r = CMS_RecipientInfo_decrypt(cms, ri);
741	CMS_RecipientInfo_set0_pkey(ri, NULL);
742	if (cert != NULL) {
743	/*
744	* If not debugging clear any error and return success to
745	* avoid leaking of information useful to MMA
746	*/
747	if (!debug) {
748	ERR_clear_error();
749	return 1;
750	}
751	if (r > 0)
752	return 1;
753	ERR_raise(ERR_LIB_CMS, CMS_R_DECRYPT_ERROR);
754	return 0;
755	}
756	/*
757	* If no cert and not debugging don't leave loop after first
758	* successful decrypt. Always attempt to decrypt all recipients
759	* to avoid leaking timing of a successful decrypt.
760	*/
761	else if (r > 0 && (debug \|\| cms_pkey_ri_type != CMS_RECIPINFO_TRANS))
762	return 1;
763	}
764	}
765	/* If no cert, key transport and not debugging always return success */
766	if (cert == NULL
767	&& cms_pkey_ri_type == CMS_RECIPINFO_TRANS
768	&& match_ri
769	&& !debug) {
770	ERR_clear_error();
771	return 1;
772	}
773
774	ERR_raise(ERR_LIB_CMS, CMS_R_NO_MATCHING_RECIPIENT);
775	return 0;
776
777	}
778
779	int CMS_decrypt_set1_key(CMS_ContentInfo *cms,
780	unsigned char *key, size_t keylen,
781	const unsigned char *id, size_t idlen)
782	{
783	STACK_OF(CMS_RecipientInfo) *ris;
784	CMS_RecipientInfo *ri;
785	int i, r;
786
787	ris = CMS_get0_RecipientInfos(cms);
788	for (i = 0; i < sk_CMS_RecipientInfo_num(ris); i++) {
789	ri = sk_CMS_RecipientInfo_value(ris, i);
790	if (CMS_RecipientInfo_type(ri) != CMS_RECIPINFO_KEK)
791	continue;
792
793	/*
794	* If we have an id try matching RecipientInfo otherwise try them
795	* all.
796	*/
797	if (id == NULL \|\| (CMS_RecipientInfo_kekri_id_cmp(ri, id, idlen) == 0)) {
798	CMS_RecipientInfo_set0_key(ri, key, keylen);
799	r = CMS_RecipientInfo_decrypt(cms, ri);
800	CMS_RecipientInfo_set0_key(ri, NULL, 0);
801	if (r > 0)
802	return 1;
803	if (id != NULL) {
804	ERR_raise(ERR_LIB_CMS, CMS_R_DECRYPT_ERROR);
805	return 0;
806	}
807	ERR_clear_error();
808	}
809	}
810
811	ERR_raise(ERR_LIB_CMS, CMS_R_NO_MATCHING_RECIPIENT);
812	return 0;
813
814	}
815
816	int CMS_decrypt_set1_password(CMS_ContentInfo *cms,
817	unsigned char *pass, ossl_ssize_t passlen)
818	{
819	STACK_OF(CMS_RecipientInfo) *ris;
820	CMS_RecipientInfo *ri;
821	int i, r;
822
823	ris = CMS_get0_RecipientInfos(cms);
824	for (i = 0; i < sk_CMS_RecipientInfo_num(ris); i++) {
825	ri = sk_CMS_RecipientInfo_value(ris, i);
826	if (CMS_RecipientInfo_type(ri) != CMS_RECIPINFO_PASS)
827	continue;
828	CMS_RecipientInfo_set0_password(ri, pass, passlen);
829	r = CMS_RecipientInfo_decrypt(cms, ri);
830	CMS_RecipientInfo_set0_password(ri, NULL, 0);
831	if (r > 0)
832	return 1;
833	}
834
835	ERR_raise(ERR_LIB_CMS, CMS_R_NO_MATCHING_RECIPIENT);
836	return 0;
837
838	}
839
840	int CMS_decrypt(CMS_ContentInfo cms, EVP_PKEY pk, X509 *cert,
841	BIO dcont, BIO out, unsigned int flags)
842	{
843	int r;
844	BIO *cont;
845
846	int nid = OBJ_obj2nid(CMS_get0_type(cms));
847
848	if (nid != NID_pkcs7_enveloped
849	&& nid != NID_id_smime_ct_authEnvelopedData) {
850	ERR_raise(ERR_LIB_CMS, CMS_R_TYPE_NOT_ENVELOPED_DATA);
851	return 0;
852	}
853	if (dcont == NULL && !check_content(cms))
854	return 0;
855	if (flags & CMS_DEBUG_DECRYPT)
856	ossl_cms_get0_env_enc_content(cms)->debug = 1;
857	else
858	ossl_cms_get0_env_enc_content(cms)->debug = 0;
859	if (cert == NULL)
860	ossl_cms_get0_env_enc_content(cms)->havenocert = 1;
861	else
862	ossl_cms_get0_env_enc_content(cms)->havenocert = 0;
863	if (pk == NULL && cert == NULL && dcont == NULL && out == NULL)
864	return 1;
865	if (pk != NULL && !CMS_decrypt_set1_pkey(cms, pk, cert))
866	return 0;
867	cont = CMS_dataInit(cms, dcont);
868	if (cont == NULL)
869	return 0;
870	r = cms_copy_content(out, cont, flags);
871	do_free_upto(cont, dcont);
872	return r;
873	}
874
875	int CMS_final(CMS_ContentInfo cms, BIO data, BIO *dcont, unsigned int flags)
876	{
877	BIO *cmsbio;
878	int ret = 0;
879
880	if ((cmsbio = CMS_dataInit(cms, dcont)) == NULL) {
881	ERR_raise(ERR_LIB_CMS, CMS_R_CMS_LIB);
882	return 0;
883	}
884
885	ret = SMIME_crlf_copy(data, cmsbio, flags);
886
887	(void)BIO_flush(cmsbio);
888
889	if (!CMS_dataFinal(cms, cmsbio)) {
890	ERR_raise(ERR_LIB_CMS, CMS_R_CMS_DATAFINAL_ERROR);
891	goto err;
892	}
893	err:
894	do_free_upto(cmsbio, dcont);
895
896	return ret;
897
898	}
899
900	#ifdef ZLIB
901
902	int CMS_uncompress(CMS_ContentInfo cms, BIO dcont, BIO *out,
903	unsigned int flags)
904	{
905	BIO *cont;
906	int r;
907
908	if (OBJ_obj2nid(CMS_get0_type(cms)) != NID_id_smime_ct_compressedData) {
909	ERR_raise(ERR_LIB_CMS, CMS_R_TYPE_NOT_COMPRESSED_DATA);
910	return 0;
911	}
912
913	if (dcont == NULL && !check_content(cms))
914	return 0;
915
916	cont = CMS_dataInit(cms, dcont);
917	if (cont == NULL)
918	return 0;
919	r = cms_copy_content(out, cont, flags);
920	do_free_upto(cont, dcont);
921	return r;
922	}
923
924	CMS_ContentInfo CMS_compress(BIO in, int comp_nid, unsigned int flags)
925	{
926	CMS_ContentInfo *cms;
927
928	if (comp_nid <= 0)
929	comp_nid = NID_zlib_compression;
930	cms = ossl_cms_CompressedData_create(comp_nid, NULL, NULL);
931	if (cms == NULL)
932	return NULL;
933
934	if (!(flags & CMS_DETACHED))
935	CMS_set_detached(cms, 0);
936
937	if ((flags & CMS_STREAM) \|\| CMS_final(cms, in, NULL, flags))
938	return cms;
939
940	CMS_ContentInfo_free(cms);
941	return NULL;
942	}
943
944	#else
945
946	int CMS_uncompress(CMS_ContentInfo cms, BIO dcont, BIO *out,
947	unsigned int flags)
948	{
949	ERR_raise(ERR_LIB_CMS, CMS_R_UNSUPPORTED_COMPRESSION_ALGORITHM);
950	return 0;
951	}
952
953	CMS_ContentInfo CMS_compress(BIO in, int comp_nid, unsigned int flags)
954	{
955	ERR_raise(ERR_LIB_CMS, CMS_R_UNSUPPORTED_COMPRESSION_ALGORITHM);
956	return NULL;
957	}
958
959	#endif

注意: 瀏覽 TracBrowser 來幫助您使用儲存庫瀏覽器

source: vbox/trunk/src/libs/openssl-3.0.3/crypto/cms/cms_smime.c@ 96159

以其他格式下載: