1*0Sstevel@tonic-gate /* crypto/pkcs7/pk7_lib.c */ 2*0Sstevel@tonic-gate /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 3*0Sstevel@tonic-gate * All rights reserved. 4*0Sstevel@tonic-gate * 5*0Sstevel@tonic-gate * This package is an SSL implementation written 6*0Sstevel@tonic-gate * by Eric Young (eay@cryptsoft.com). 7*0Sstevel@tonic-gate * The implementation was written so as to conform with Netscapes SSL. 8*0Sstevel@tonic-gate * 9*0Sstevel@tonic-gate * This library is free for commercial and non-commercial use as long as 10*0Sstevel@tonic-gate * the following conditions are aheared to. The following conditions 11*0Sstevel@tonic-gate * apply to all code found in this distribution, be it the RC4, RSA, 12*0Sstevel@tonic-gate * lhash, DES, etc., code; not just the SSL code. The SSL documentation 13*0Sstevel@tonic-gate * included with this distribution is covered by the same copyright terms 14*0Sstevel@tonic-gate * except that the holder is Tim Hudson (tjh@cryptsoft.com). 15*0Sstevel@tonic-gate * 16*0Sstevel@tonic-gate * Copyright remains Eric Young's, and as such any Copyright notices in 17*0Sstevel@tonic-gate * the code are not to be removed. 18*0Sstevel@tonic-gate * If this package is used in a product, Eric Young should be given attribution 19*0Sstevel@tonic-gate * as the author of the parts of the library used. 20*0Sstevel@tonic-gate * This can be in the form of a textual message at program startup or 21*0Sstevel@tonic-gate * in documentation (online or textual) provided with the package. 22*0Sstevel@tonic-gate * 23*0Sstevel@tonic-gate * Redistribution and use in source and binary forms, with or without 24*0Sstevel@tonic-gate * modification, are permitted provided that the following conditions 25*0Sstevel@tonic-gate * are met: 26*0Sstevel@tonic-gate * 1. Redistributions of source code must retain the copyright 27*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer. 28*0Sstevel@tonic-gate * 2. Redistributions in binary form must reproduce the above copyright 29*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer in the 30*0Sstevel@tonic-gate * documentation and/or other materials provided with the distribution. 31*0Sstevel@tonic-gate * 3. All advertising materials mentioning features or use of this software 32*0Sstevel@tonic-gate * must display the following acknowledgement: 33*0Sstevel@tonic-gate * "This product includes cryptographic software written by 34*0Sstevel@tonic-gate * Eric Young (eay@cryptsoft.com)" 35*0Sstevel@tonic-gate * The word 'cryptographic' can be left out if the rouines from the library 36*0Sstevel@tonic-gate * being used are not cryptographic related :-). 37*0Sstevel@tonic-gate * 4. If you include any Windows specific code (or a derivative thereof) from 38*0Sstevel@tonic-gate * the apps directory (application code) you must include an acknowledgement: 39*0Sstevel@tonic-gate * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" 40*0Sstevel@tonic-gate * 41*0Sstevel@tonic-gate * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND 42*0Sstevel@tonic-gate * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 43*0Sstevel@tonic-gate * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 44*0Sstevel@tonic-gate * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 45*0Sstevel@tonic-gate * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 46*0Sstevel@tonic-gate * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 47*0Sstevel@tonic-gate * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 48*0Sstevel@tonic-gate * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 49*0Sstevel@tonic-gate * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 50*0Sstevel@tonic-gate * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 51*0Sstevel@tonic-gate * SUCH DAMAGE. 52*0Sstevel@tonic-gate * 53*0Sstevel@tonic-gate * The licence and distribution terms for any publically available version or 54*0Sstevel@tonic-gate * derivative of this code cannot be changed. i.e. this code cannot simply be 55*0Sstevel@tonic-gate * copied and put under another distribution licence 56*0Sstevel@tonic-gate * [including the GNU Public Licence.] 57*0Sstevel@tonic-gate */ 58*0Sstevel@tonic-gate 59*0Sstevel@tonic-gate #include <stdio.h> 60*0Sstevel@tonic-gate #include "cryptlib.h" 61*0Sstevel@tonic-gate #include <openssl/objects.h> 62*0Sstevel@tonic-gate #include <openssl/x509.h> 63*0Sstevel@tonic-gate 64*0Sstevel@tonic-gate long PKCS7_ctrl(PKCS7 *p7, int cmd, long larg, char *parg) 65*0Sstevel@tonic-gate { 66*0Sstevel@tonic-gate int nid; 67*0Sstevel@tonic-gate long ret; 68*0Sstevel@tonic-gate 69*0Sstevel@tonic-gate nid=OBJ_obj2nid(p7->type); 70*0Sstevel@tonic-gate 71*0Sstevel@tonic-gate switch (cmd) 72*0Sstevel@tonic-gate { 73*0Sstevel@tonic-gate case PKCS7_OP_SET_DETACHED_SIGNATURE: 74*0Sstevel@tonic-gate if (nid == NID_pkcs7_signed) 75*0Sstevel@tonic-gate { 76*0Sstevel@tonic-gate ret=p7->detached=(int)larg; 77*0Sstevel@tonic-gate if (ret && PKCS7_type_is_data(p7->d.sign->contents)) 78*0Sstevel@tonic-gate { 79*0Sstevel@tonic-gate ASN1_OCTET_STRING *os; 80*0Sstevel@tonic-gate os=p7->d.sign->contents->d.data; 81*0Sstevel@tonic-gate ASN1_OCTET_STRING_free(os); 82*0Sstevel@tonic-gate p7->d.sign->contents->d.data = NULL; 83*0Sstevel@tonic-gate } 84*0Sstevel@tonic-gate } 85*0Sstevel@tonic-gate else 86*0Sstevel@tonic-gate { 87*0Sstevel@tonic-gate PKCS7err(PKCS7_F_PKCS7_CTRL,PKCS7_R_OPERATION_NOT_SUPPORTED_ON_THIS_TYPE); 88*0Sstevel@tonic-gate ret=0; 89*0Sstevel@tonic-gate } 90*0Sstevel@tonic-gate break; 91*0Sstevel@tonic-gate case PKCS7_OP_GET_DETACHED_SIGNATURE: 92*0Sstevel@tonic-gate if (nid == NID_pkcs7_signed) 93*0Sstevel@tonic-gate { 94*0Sstevel@tonic-gate if(!p7->d.sign || !p7->d.sign->contents->d.ptr) 95*0Sstevel@tonic-gate ret = 1; 96*0Sstevel@tonic-gate else ret = 0; 97*0Sstevel@tonic-gate 98*0Sstevel@tonic-gate p7->detached = ret; 99*0Sstevel@tonic-gate } 100*0Sstevel@tonic-gate else 101*0Sstevel@tonic-gate { 102*0Sstevel@tonic-gate PKCS7err(PKCS7_F_PKCS7_CTRL,PKCS7_R_OPERATION_NOT_SUPPORTED_ON_THIS_TYPE); 103*0Sstevel@tonic-gate ret=0; 104*0Sstevel@tonic-gate } 105*0Sstevel@tonic-gate 106*0Sstevel@tonic-gate break; 107*0Sstevel@tonic-gate default: 108*0Sstevel@tonic-gate PKCS7err(PKCS7_F_PKCS7_CTRL,PKCS7_R_UNKNOWN_OPERATION); 109*0Sstevel@tonic-gate ret=0; 110*0Sstevel@tonic-gate } 111*0Sstevel@tonic-gate return(ret); 112*0Sstevel@tonic-gate } 113*0Sstevel@tonic-gate 114*0Sstevel@tonic-gate int PKCS7_content_new(PKCS7 *p7, int type) 115*0Sstevel@tonic-gate { 116*0Sstevel@tonic-gate PKCS7 *ret=NULL; 117*0Sstevel@tonic-gate 118*0Sstevel@tonic-gate if ((ret=PKCS7_new()) == NULL) goto err; 119*0Sstevel@tonic-gate if (!PKCS7_set_type(ret,type)) goto err; 120*0Sstevel@tonic-gate if (!PKCS7_set_content(p7,ret)) goto err; 121*0Sstevel@tonic-gate 122*0Sstevel@tonic-gate return(1); 123*0Sstevel@tonic-gate err: 124*0Sstevel@tonic-gate if (ret != NULL) PKCS7_free(ret); 125*0Sstevel@tonic-gate return(0); 126*0Sstevel@tonic-gate } 127*0Sstevel@tonic-gate 128*0Sstevel@tonic-gate int PKCS7_set_content(PKCS7 *p7, PKCS7 *p7_data) 129*0Sstevel@tonic-gate { 130*0Sstevel@tonic-gate int i; 131*0Sstevel@tonic-gate 132*0Sstevel@tonic-gate i=OBJ_obj2nid(p7->type); 133*0Sstevel@tonic-gate switch (i) 134*0Sstevel@tonic-gate { 135*0Sstevel@tonic-gate case NID_pkcs7_signed: 136*0Sstevel@tonic-gate if (p7->d.sign->contents != NULL) 137*0Sstevel@tonic-gate PKCS7_free(p7->d.sign->contents); 138*0Sstevel@tonic-gate p7->d.sign->contents=p7_data; 139*0Sstevel@tonic-gate break; 140*0Sstevel@tonic-gate case NID_pkcs7_digest: 141*0Sstevel@tonic-gate case NID_pkcs7_data: 142*0Sstevel@tonic-gate case NID_pkcs7_enveloped: 143*0Sstevel@tonic-gate case NID_pkcs7_signedAndEnveloped: 144*0Sstevel@tonic-gate case NID_pkcs7_encrypted: 145*0Sstevel@tonic-gate default: 146*0Sstevel@tonic-gate PKCS7err(PKCS7_F_PKCS7_SET_CONTENT,PKCS7_R_UNSUPPORTED_CONTENT_TYPE); 147*0Sstevel@tonic-gate goto err; 148*0Sstevel@tonic-gate } 149*0Sstevel@tonic-gate return(1); 150*0Sstevel@tonic-gate err: 151*0Sstevel@tonic-gate return(0); 152*0Sstevel@tonic-gate } 153*0Sstevel@tonic-gate 154*0Sstevel@tonic-gate int PKCS7_set_type(PKCS7 *p7, int type) 155*0Sstevel@tonic-gate { 156*0Sstevel@tonic-gate ASN1_OBJECT *obj; 157*0Sstevel@tonic-gate 158*0Sstevel@tonic-gate /*PKCS7_content_free(p7);*/ 159*0Sstevel@tonic-gate obj=OBJ_nid2obj(type); /* will not fail */ 160*0Sstevel@tonic-gate 161*0Sstevel@tonic-gate switch (type) 162*0Sstevel@tonic-gate { 163*0Sstevel@tonic-gate case NID_pkcs7_signed: 164*0Sstevel@tonic-gate p7->type=obj; 165*0Sstevel@tonic-gate if ((p7->d.sign=PKCS7_SIGNED_new()) == NULL) 166*0Sstevel@tonic-gate goto err; 167*0Sstevel@tonic-gate ASN1_INTEGER_set(p7->d.sign->version,1); 168*0Sstevel@tonic-gate break; 169*0Sstevel@tonic-gate case NID_pkcs7_data: 170*0Sstevel@tonic-gate p7->type=obj; 171*0Sstevel@tonic-gate if ((p7->d.data=M_ASN1_OCTET_STRING_new()) == NULL) 172*0Sstevel@tonic-gate goto err; 173*0Sstevel@tonic-gate break; 174*0Sstevel@tonic-gate case NID_pkcs7_signedAndEnveloped: 175*0Sstevel@tonic-gate p7->type=obj; 176*0Sstevel@tonic-gate if ((p7->d.signed_and_enveloped=PKCS7_SIGN_ENVELOPE_new()) 177*0Sstevel@tonic-gate == NULL) goto err; 178*0Sstevel@tonic-gate ASN1_INTEGER_set(p7->d.signed_and_enveloped->version,1); 179*0Sstevel@tonic-gate p7->d.signed_and_enveloped->enc_data->content_type 180*0Sstevel@tonic-gate = OBJ_nid2obj(NID_pkcs7_data); 181*0Sstevel@tonic-gate break; 182*0Sstevel@tonic-gate case NID_pkcs7_enveloped: 183*0Sstevel@tonic-gate p7->type=obj; 184*0Sstevel@tonic-gate if ((p7->d.enveloped=PKCS7_ENVELOPE_new()) 185*0Sstevel@tonic-gate == NULL) goto err; 186*0Sstevel@tonic-gate ASN1_INTEGER_set(p7->d.enveloped->version,0); 187*0Sstevel@tonic-gate p7->d.enveloped->enc_data->content_type 188*0Sstevel@tonic-gate = OBJ_nid2obj(NID_pkcs7_data); 189*0Sstevel@tonic-gate break; 190*0Sstevel@tonic-gate case NID_pkcs7_encrypted: 191*0Sstevel@tonic-gate p7->type=obj; 192*0Sstevel@tonic-gate if ((p7->d.encrypted=PKCS7_ENCRYPT_new()) 193*0Sstevel@tonic-gate == NULL) goto err; 194*0Sstevel@tonic-gate ASN1_INTEGER_set(p7->d.encrypted->version,0); 195*0Sstevel@tonic-gate p7->d.encrypted->enc_data->content_type 196*0Sstevel@tonic-gate = OBJ_nid2obj(NID_pkcs7_data); 197*0Sstevel@tonic-gate break; 198*0Sstevel@tonic-gate 199*0Sstevel@tonic-gate case NID_pkcs7_digest: 200*0Sstevel@tonic-gate default: 201*0Sstevel@tonic-gate PKCS7err(PKCS7_F_PKCS7_SET_TYPE,PKCS7_R_UNSUPPORTED_CONTENT_TYPE); 202*0Sstevel@tonic-gate goto err; 203*0Sstevel@tonic-gate } 204*0Sstevel@tonic-gate return(1); 205*0Sstevel@tonic-gate err: 206*0Sstevel@tonic-gate return(0); 207*0Sstevel@tonic-gate } 208*0Sstevel@tonic-gate 209*0Sstevel@tonic-gate int PKCS7_add_signer(PKCS7 *p7, PKCS7_SIGNER_INFO *psi) 210*0Sstevel@tonic-gate { 211*0Sstevel@tonic-gate int i,j,nid; 212*0Sstevel@tonic-gate X509_ALGOR *alg; 213*0Sstevel@tonic-gate STACK_OF(PKCS7_SIGNER_INFO) *signer_sk; 214*0Sstevel@tonic-gate STACK_OF(X509_ALGOR) *md_sk; 215*0Sstevel@tonic-gate 216*0Sstevel@tonic-gate i=OBJ_obj2nid(p7->type); 217*0Sstevel@tonic-gate switch (i) 218*0Sstevel@tonic-gate { 219*0Sstevel@tonic-gate case NID_pkcs7_signed: 220*0Sstevel@tonic-gate signer_sk= p7->d.sign->signer_info; 221*0Sstevel@tonic-gate md_sk= p7->d.sign->md_algs; 222*0Sstevel@tonic-gate break; 223*0Sstevel@tonic-gate case NID_pkcs7_signedAndEnveloped: 224*0Sstevel@tonic-gate signer_sk= p7->d.signed_and_enveloped->signer_info; 225*0Sstevel@tonic-gate md_sk= p7->d.signed_and_enveloped->md_algs; 226*0Sstevel@tonic-gate break; 227*0Sstevel@tonic-gate default: 228*0Sstevel@tonic-gate PKCS7err(PKCS7_F_PKCS7_ADD_SIGNER,PKCS7_R_WRONG_CONTENT_TYPE); 229*0Sstevel@tonic-gate return(0); 230*0Sstevel@tonic-gate } 231*0Sstevel@tonic-gate 232*0Sstevel@tonic-gate nid=OBJ_obj2nid(psi->digest_alg->algorithm); 233*0Sstevel@tonic-gate 234*0Sstevel@tonic-gate /* If the digest is not currently listed, add it */ 235*0Sstevel@tonic-gate j=0; 236*0Sstevel@tonic-gate for (i=0; i<sk_X509_ALGOR_num(md_sk); i++) 237*0Sstevel@tonic-gate { 238*0Sstevel@tonic-gate alg=sk_X509_ALGOR_value(md_sk,i); 239*0Sstevel@tonic-gate if (OBJ_obj2nid(alg->algorithm) == nid) 240*0Sstevel@tonic-gate { 241*0Sstevel@tonic-gate j=1; 242*0Sstevel@tonic-gate break; 243*0Sstevel@tonic-gate } 244*0Sstevel@tonic-gate } 245*0Sstevel@tonic-gate if (!j) /* we need to add another algorithm */ 246*0Sstevel@tonic-gate { 247*0Sstevel@tonic-gate if(!(alg=X509_ALGOR_new()) 248*0Sstevel@tonic-gate || !(alg->parameter = ASN1_TYPE_new())) { 249*0Sstevel@tonic-gate PKCS7err(PKCS7_F_PKCS7_ADD_SIGNER,ERR_R_MALLOC_FAILURE); 250*0Sstevel@tonic-gate return(0); 251*0Sstevel@tonic-gate } 252*0Sstevel@tonic-gate alg->algorithm=OBJ_nid2obj(nid); 253*0Sstevel@tonic-gate alg->parameter->type = V_ASN1_NULL; 254*0Sstevel@tonic-gate sk_X509_ALGOR_push(md_sk,alg); 255*0Sstevel@tonic-gate } 256*0Sstevel@tonic-gate 257*0Sstevel@tonic-gate sk_PKCS7_SIGNER_INFO_push(signer_sk,psi); 258*0Sstevel@tonic-gate return(1); 259*0Sstevel@tonic-gate } 260*0Sstevel@tonic-gate 261*0Sstevel@tonic-gate int PKCS7_add_certificate(PKCS7 *p7, X509 *x509) 262*0Sstevel@tonic-gate { 263*0Sstevel@tonic-gate int i; 264*0Sstevel@tonic-gate STACK_OF(X509) **sk; 265*0Sstevel@tonic-gate 266*0Sstevel@tonic-gate i=OBJ_obj2nid(p7->type); 267*0Sstevel@tonic-gate switch (i) 268*0Sstevel@tonic-gate { 269*0Sstevel@tonic-gate case NID_pkcs7_signed: 270*0Sstevel@tonic-gate sk= &(p7->d.sign->cert); 271*0Sstevel@tonic-gate break; 272*0Sstevel@tonic-gate case NID_pkcs7_signedAndEnveloped: 273*0Sstevel@tonic-gate sk= &(p7->d.signed_and_enveloped->cert); 274*0Sstevel@tonic-gate break; 275*0Sstevel@tonic-gate default: 276*0Sstevel@tonic-gate PKCS7err(PKCS7_F_PKCS7_ADD_CERTIFICATE,PKCS7_R_WRONG_CONTENT_TYPE); 277*0Sstevel@tonic-gate return(0); 278*0Sstevel@tonic-gate } 279*0Sstevel@tonic-gate 280*0Sstevel@tonic-gate if (*sk == NULL) 281*0Sstevel@tonic-gate *sk=sk_X509_new_null(); 282*0Sstevel@tonic-gate CRYPTO_add(&x509->references,1,CRYPTO_LOCK_X509); 283*0Sstevel@tonic-gate sk_X509_push(*sk,x509); 284*0Sstevel@tonic-gate return(1); 285*0Sstevel@tonic-gate } 286*0Sstevel@tonic-gate 287*0Sstevel@tonic-gate int PKCS7_add_crl(PKCS7 *p7, X509_CRL *crl) 288*0Sstevel@tonic-gate { 289*0Sstevel@tonic-gate int i; 290*0Sstevel@tonic-gate STACK_OF(X509_CRL) **sk; 291*0Sstevel@tonic-gate 292*0Sstevel@tonic-gate i=OBJ_obj2nid(p7->type); 293*0Sstevel@tonic-gate switch (i) 294*0Sstevel@tonic-gate { 295*0Sstevel@tonic-gate case NID_pkcs7_signed: 296*0Sstevel@tonic-gate sk= &(p7->d.sign->crl); 297*0Sstevel@tonic-gate break; 298*0Sstevel@tonic-gate case NID_pkcs7_signedAndEnveloped: 299*0Sstevel@tonic-gate sk= &(p7->d.signed_and_enveloped->crl); 300*0Sstevel@tonic-gate break; 301*0Sstevel@tonic-gate default: 302*0Sstevel@tonic-gate PKCS7err(PKCS7_F_PKCS7_ADD_CRL,PKCS7_R_WRONG_CONTENT_TYPE); 303*0Sstevel@tonic-gate return(0); 304*0Sstevel@tonic-gate } 305*0Sstevel@tonic-gate 306*0Sstevel@tonic-gate if (*sk == NULL) 307*0Sstevel@tonic-gate *sk=sk_X509_CRL_new_null(); 308*0Sstevel@tonic-gate 309*0Sstevel@tonic-gate CRYPTO_add(&crl->references,1,CRYPTO_LOCK_X509_CRL); 310*0Sstevel@tonic-gate sk_X509_CRL_push(*sk,crl); 311*0Sstevel@tonic-gate return(1); 312*0Sstevel@tonic-gate } 313*0Sstevel@tonic-gate 314*0Sstevel@tonic-gate int PKCS7_SIGNER_INFO_set(PKCS7_SIGNER_INFO *p7i, X509 *x509, EVP_PKEY *pkey, 315*0Sstevel@tonic-gate const EVP_MD *dgst) 316*0Sstevel@tonic-gate { 317*0Sstevel@tonic-gate char is_dsa; 318*0Sstevel@tonic-gate if (pkey->type == EVP_PKEY_DSA) is_dsa = 1; 319*0Sstevel@tonic-gate else is_dsa = 0; 320*0Sstevel@tonic-gate /* We now need to add another PKCS7_SIGNER_INFO entry */ 321*0Sstevel@tonic-gate ASN1_INTEGER_set(p7i->version,1); 322*0Sstevel@tonic-gate X509_NAME_set(&p7i->issuer_and_serial->issuer, 323*0Sstevel@tonic-gate X509_get_issuer_name(x509)); 324*0Sstevel@tonic-gate 325*0Sstevel@tonic-gate /* because ASN1_INTEGER_set is used to set a 'long' we will do 326*0Sstevel@tonic-gate * things the ugly way. */ 327*0Sstevel@tonic-gate M_ASN1_INTEGER_free(p7i->issuer_and_serial->serial); 328*0Sstevel@tonic-gate p7i->issuer_and_serial->serial= 329*0Sstevel@tonic-gate M_ASN1_INTEGER_dup(X509_get_serialNumber(x509)); 330*0Sstevel@tonic-gate 331*0Sstevel@tonic-gate /* lets keep the pkey around for a while */ 332*0Sstevel@tonic-gate CRYPTO_add(&pkey->references,1,CRYPTO_LOCK_EVP_PKEY); 333*0Sstevel@tonic-gate p7i->pkey=pkey; 334*0Sstevel@tonic-gate 335*0Sstevel@tonic-gate /* Set the algorithms */ 336*0Sstevel@tonic-gate if (is_dsa) p7i->digest_alg->algorithm=OBJ_nid2obj(NID_sha1); 337*0Sstevel@tonic-gate else 338*0Sstevel@tonic-gate p7i->digest_alg->algorithm=OBJ_nid2obj(EVP_MD_type(dgst)); 339*0Sstevel@tonic-gate 340*0Sstevel@tonic-gate if (p7i->digest_alg->parameter != NULL) 341*0Sstevel@tonic-gate ASN1_TYPE_free(p7i->digest_alg->parameter); 342*0Sstevel@tonic-gate if ((p7i->digest_alg->parameter=ASN1_TYPE_new()) == NULL) 343*0Sstevel@tonic-gate goto err; 344*0Sstevel@tonic-gate p7i->digest_alg->parameter->type=V_ASN1_NULL; 345*0Sstevel@tonic-gate 346*0Sstevel@tonic-gate p7i->digest_enc_alg->algorithm=OBJ_nid2obj(EVP_PKEY_type(pkey->type)); 347*0Sstevel@tonic-gate 348*0Sstevel@tonic-gate if (p7i->digest_enc_alg->parameter != NULL) 349*0Sstevel@tonic-gate ASN1_TYPE_free(p7i->digest_enc_alg->parameter); 350*0Sstevel@tonic-gate if(is_dsa) p7i->digest_enc_alg->parameter = NULL; 351*0Sstevel@tonic-gate else { 352*0Sstevel@tonic-gate if (!(p7i->digest_enc_alg->parameter=ASN1_TYPE_new())) 353*0Sstevel@tonic-gate goto err; 354*0Sstevel@tonic-gate p7i->digest_enc_alg->parameter->type=V_ASN1_NULL; 355*0Sstevel@tonic-gate } 356*0Sstevel@tonic-gate 357*0Sstevel@tonic-gate return(1); 358*0Sstevel@tonic-gate err: 359*0Sstevel@tonic-gate return(0); 360*0Sstevel@tonic-gate } 361*0Sstevel@tonic-gate 362*0Sstevel@tonic-gate PKCS7_SIGNER_INFO *PKCS7_add_signature(PKCS7 *p7, X509 *x509, EVP_PKEY *pkey, 363*0Sstevel@tonic-gate const EVP_MD *dgst) 364*0Sstevel@tonic-gate { 365*0Sstevel@tonic-gate PKCS7_SIGNER_INFO *si; 366*0Sstevel@tonic-gate 367*0Sstevel@tonic-gate if ((si=PKCS7_SIGNER_INFO_new()) == NULL) goto err; 368*0Sstevel@tonic-gate if (!PKCS7_SIGNER_INFO_set(si,x509,pkey,dgst)) goto err; 369*0Sstevel@tonic-gate if (!PKCS7_add_signer(p7,si)) goto err; 370*0Sstevel@tonic-gate return(si); 371*0Sstevel@tonic-gate err: 372*0Sstevel@tonic-gate return(NULL); 373*0Sstevel@tonic-gate } 374*0Sstevel@tonic-gate 375*0Sstevel@tonic-gate STACK_OF(PKCS7_SIGNER_INFO) *PKCS7_get_signer_info(PKCS7 *p7) 376*0Sstevel@tonic-gate { 377*0Sstevel@tonic-gate if (PKCS7_type_is_signed(p7)) 378*0Sstevel@tonic-gate { 379*0Sstevel@tonic-gate return(p7->d.sign->signer_info); 380*0Sstevel@tonic-gate } 381*0Sstevel@tonic-gate else if (PKCS7_type_is_signedAndEnveloped(p7)) 382*0Sstevel@tonic-gate { 383*0Sstevel@tonic-gate return(p7->d.signed_and_enveloped->signer_info); 384*0Sstevel@tonic-gate } 385*0Sstevel@tonic-gate else 386*0Sstevel@tonic-gate return(NULL); 387*0Sstevel@tonic-gate } 388*0Sstevel@tonic-gate 389*0Sstevel@tonic-gate PKCS7_RECIP_INFO *PKCS7_add_recipient(PKCS7 *p7, X509 *x509) 390*0Sstevel@tonic-gate { 391*0Sstevel@tonic-gate PKCS7_RECIP_INFO *ri; 392*0Sstevel@tonic-gate 393*0Sstevel@tonic-gate if ((ri=PKCS7_RECIP_INFO_new()) == NULL) goto err; 394*0Sstevel@tonic-gate if (!PKCS7_RECIP_INFO_set(ri,x509)) goto err; 395*0Sstevel@tonic-gate if (!PKCS7_add_recipient_info(p7,ri)) goto err; 396*0Sstevel@tonic-gate return(ri); 397*0Sstevel@tonic-gate err: 398*0Sstevel@tonic-gate return(NULL); 399*0Sstevel@tonic-gate } 400*0Sstevel@tonic-gate 401*0Sstevel@tonic-gate int PKCS7_add_recipient_info(PKCS7 *p7, PKCS7_RECIP_INFO *ri) 402*0Sstevel@tonic-gate { 403*0Sstevel@tonic-gate int i; 404*0Sstevel@tonic-gate STACK_OF(PKCS7_RECIP_INFO) *sk; 405*0Sstevel@tonic-gate 406*0Sstevel@tonic-gate i=OBJ_obj2nid(p7->type); 407*0Sstevel@tonic-gate switch (i) 408*0Sstevel@tonic-gate { 409*0Sstevel@tonic-gate case NID_pkcs7_signedAndEnveloped: 410*0Sstevel@tonic-gate sk= p7->d.signed_and_enveloped->recipientinfo; 411*0Sstevel@tonic-gate break; 412*0Sstevel@tonic-gate case NID_pkcs7_enveloped: 413*0Sstevel@tonic-gate sk= p7->d.enveloped->recipientinfo; 414*0Sstevel@tonic-gate break; 415*0Sstevel@tonic-gate default: 416*0Sstevel@tonic-gate PKCS7err(PKCS7_F_PKCS7_ADD_RECIPIENT_INFO,PKCS7_R_WRONG_CONTENT_TYPE); 417*0Sstevel@tonic-gate return(0); 418*0Sstevel@tonic-gate } 419*0Sstevel@tonic-gate 420*0Sstevel@tonic-gate sk_PKCS7_RECIP_INFO_push(sk,ri); 421*0Sstevel@tonic-gate return(1); 422*0Sstevel@tonic-gate } 423*0Sstevel@tonic-gate 424*0Sstevel@tonic-gate int PKCS7_RECIP_INFO_set(PKCS7_RECIP_INFO *p7i, X509 *x509) 425*0Sstevel@tonic-gate { 426*0Sstevel@tonic-gate ASN1_INTEGER_set(p7i->version,0); 427*0Sstevel@tonic-gate X509_NAME_set(&p7i->issuer_and_serial->issuer, 428*0Sstevel@tonic-gate X509_get_issuer_name(x509)); 429*0Sstevel@tonic-gate 430*0Sstevel@tonic-gate M_ASN1_INTEGER_free(p7i->issuer_and_serial->serial); 431*0Sstevel@tonic-gate p7i->issuer_and_serial->serial= 432*0Sstevel@tonic-gate M_ASN1_INTEGER_dup(X509_get_serialNumber(x509)); 433*0Sstevel@tonic-gate 434*0Sstevel@tonic-gate X509_ALGOR_free(p7i->key_enc_algor); 435*0Sstevel@tonic-gate p7i->key_enc_algor= X509_ALGOR_dup(x509->cert_info->key->algor); 436*0Sstevel@tonic-gate 437*0Sstevel@tonic-gate CRYPTO_add(&x509->references,1,CRYPTO_LOCK_X509); 438*0Sstevel@tonic-gate p7i->cert=x509; 439*0Sstevel@tonic-gate 440*0Sstevel@tonic-gate return(1); 441*0Sstevel@tonic-gate } 442*0Sstevel@tonic-gate 443*0Sstevel@tonic-gate X509 *PKCS7_cert_from_signer_info(PKCS7 *p7, PKCS7_SIGNER_INFO *si) 444*0Sstevel@tonic-gate { 445*0Sstevel@tonic-gate if (PKCS7_type_is_signed(p7)) 446*0Sstevel@tonic-gate return(X509_find_by_issuer_and_serial(p7->d.sign->cert, 447*0Sstevel@tonic-gate si->issuer_and_serial->issuer, 448*0Sstevel@tonic-gate si->issuer_and_serial->serial)); 449*0Sstevel@tonic-gate else 450*0Sstevel@tonic-gate return(NULL); 451*0Sstevel@tonic-gate } 452*0Sstevel@tonic-gate 453*0Sstevel@tonic-gate int PKCS7_set_cipher(PKCS7 *p7, const EVP_CIPHER *cipher) 454*0Sstevel@tonic-gate { 455*0Sstevel@tonic-gate int i; 456*0Sstevel@tonic-gate ASN1_OBJECT *objtmp; 457*0Sstevel@tonic-gate PKCS7_ENC_CONTENT *ec; 458*0Sstevel@tonic-gate 459*0Sstevel@tonic-gate i=OBJ_obj2nid(p7->type); 460*0Sstevel@tonic-gate switch (i) 461*0Sstevel@tonic-gate { 462*0Sstevel@tonic-gate case NID_pkcs7_signedAndEnveloped: 463*0Sstevel@tonic-gate ec=p7->d.signed_and_enveloped->enc_data; 464*0Sstevel@tonic-gate break; 465*0Sstevel@tonic-gate case NID_pkcs7_enveloped: 466*0Sstevel@tonic-gate ec=p7->d.enveloped->enc_data; 467*0Sstevel@tonic-gate break; 468*0Sstevel@tonic-gate default: 469*0Sstevel@tonic-gate PKCS7err(PKCS7_F_PKCS7_SET_CIPHER,PKCS7_R_WRONG_CONTENT_TYPE); 470*0Sstevel@tonic-gate return(0); 471*0Sstevel@tonic-gate } 472*0Sstevel@tonic-gate 473*0Sstevel@tonic-gate /* Check cipher OID exists and has data in it*/ 474*0Sstevel@tonic-gate i = EVP_CIPHER_type(cipher); 475*0Sstevel@tonic-gate if(i == NID_undef) { 476*0Sstevel@tonic-gate PKCS7err(PKCS7_F_PKCS7_SET_CIPHER,PKCS7_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER); 477*0Sstevel@tonic-gate return(0); 478*0Sstevel@tonic-gate } 479*0Sstevel@tonic-gate objtmp = OBJ_nid2obj(i); 480*0Sstevel@tonic-gate 481*0Sstevel@tonic-gate ec->cipher = cipher; 482*0Sstevel@tonic-gate return 1; 483*0Sstevel@tonic-gate } 484*0Sstevel@tonic-gate 485