/src/nss/lib/smime/cmsmessage.c

Source (jump to first uncovered line)
/* This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

/*
 * CMS message methods.
 */

#include "cmslocal.h"

#include "cert.h"
#include "secasn1.h"
#include "secitem.h"
#include "secoid.h"
#include "pk11func.h"
#include "secerr.h"

/*
 * NSS_CMSMessage_Create - create a CMS message object
 *
 * "poolp" - arena to allocate memory from, or NULL if new arena should be created
 */
NSSCMSMessage *
NSS_CMSMessage_Create(PLArenaPool *poolp)
{
    void *mark = NULL;
    NSSCMSMessage *cmsg;
    PRBool poolp_is_ours = PR_FALSE;

    if (poolp == NULL) {
        poolp = PORT_NewArena(1024); /* XXX what is right value? */
        if (poolp == NULL) {
            return NULL;
        }
        poolp_is_ours = PR_TRUE;
    }

    if (!poolp_is_ours)
        mark = PORT_ArenaMark(poolp);

    cmsg = (NSSCMSMessage *)PORT_ArenaZAlloc(poolp, sizeof(NSSCMSMessage));
    if (cmsg == NULL ||
        NSS_CMSContentInfo_Private_Init(&(cmsg->contentInfo)) != SECSuccess) {
        if (!poolp_is_ours) {
            if (mark) {
                PORT_ArenaRelease(poolp, mark);
            }
        } else {
            PORT_FreeArena(poolp, PR_FALSE);
        }
        return NULL;
    }

    cmsg->poolp = poolp;
    cmsg->poolp_is_ours = poolp_is_ours;
    cmsg->refCount = 1;

    if (mark) {
        PORT_ArenaUnmark(poolp, mark);
    }

    return cmsg;
}

/*
 * NSS_CMSMessage_SetEncodingParams - set up a CMS message object for encoding or decoding
 *
 * "cmsg" - message object
 * "pwfn", pwfn_arg" - callback function for getting token password
 * "decrypt_key_cb", "decrypt_key_cb_arg" - callback function for getting bulk key for encryptedData
 * "detached_digestalgs", "detached_digests" - digests from detached content
 */
void
NSS_CMSMessage_SetEncodingParams(NSSCMSMessage *cmsg,
                                 PK11PasswordFunc pwfn, void *pwfn_arg,
                                 NSSCMSGetDecryptKeyCallback decrypt_key_cb, void *decrypt_key_cb_arg,
                                 SECAlgorithmID **detached_digestalgs, SECItem **detached_digests)
{
    if (cmsg == NULL) {
        return;
    }
    if (pwfn) {
        PK11_SetPasswordFunc(pwfn);
    }

    cmsg->pwfn_arg = pwfn_arg;
    cmsg->decrypt_key_cb = decrypt_key_cb;
    cmsg->decrypt_key_cb_arg = decrypt_key_cb_arg;
    cmsg->detached_digestalgs = detached_digestalgs;
    cmsg->detached_digests = detached_digests;
}

/*
 * NSS_CMSMessage_Destroy - destroy a CMS message and all of its sub-pieces.
 */
void
NSS_CMSMessage_Destroy(NSSCMSMessage *cmsg)
{
    if (cmsg == NULL)
        return;

    PORT_Assert(cmsg->refCount > 0);
    if (cmsg->refCount <= 0) { /* oops */
        return;
    }

    cmsg->refCount--; /* thread safety? */
    if (cmsg->refCount > 0) {
        return;
    }

    NSS_CMSContentInfo_Destroy(&(cmsg->contentInfo));

    /* if poolp is not NULL, cmsg is the owner of its arena */
    if (cmsg->poolp_is_ours) {
        PORT_FreeArena(cmsg->poolp, PR_FALSE); /* XXX clear it? */
    }
}

/*
 * NSS_CMSMessage_Copy - return a copy of the given message.
 *
 * The copy may be virtual or may be real -- either way, the result needs
 * to be passed to NSS_CMSMessage_Destroy later (as does the original).
 */
NSSCMSMessage *
NSS_CMSMessage_Copy(NSSCMSMessage *cmsg)
{
    if (cmsg == NULL) {
        return NULL;
    }

    PORT_Assert(cmsg->refCount > 0);

    cmsg->refCount++; /* XXX chrisk thread safety? */
    return cmsg;
}

/*
 * NSS_CMSMessage_GetArena - return a pointer to the message's arena pool
 */
PLArenaPool *
NSS_CMSMessage_GetArena(NSSCMSMessage *cmsg)
{
    if (cmsg == NULL) {
        return NULL;
    }

    return cmsg->poolp;
}

/*
 * NSS_CMSMessage_GetContentInfo - return a pointer to the top level contentInfo
 */
NSSCMSContentInfo *
NSS_CMSMessage_GetContentInfo(NSSCMSMessage *cmsg)
{
    if (cmsg == NULL) {
        return NULL;
    }

    return &(cmsg->contentInfo);
}

/*
 * Return a pointer to the actual content.
 * In the case of those types which are encrypted, this returns the *plain* content.
 * In case of nested contentInfos, this descends and retrieves the innermost content.
 */
SECItem *
NSS_CMSMessage_GetContent(NSSCMSMessage *cmsg)
{
    if (cmsg == NULL) {
        return NULL;
    }

    /* this is a shortcut */
    NSSCMSContentInfo *cinfo = NSS_CMSMessage_GetContentInfo(cmsg);
    SECItem *pItem = NSS_CMSContentInfo_GetInnerContent(cinfo);
    return pItem;
}

/*
 * NSS_CMSMessage_ContentLevelCount - count number of levels of CMS content objects in this message
 *
 * CMS data content objects do not count.
 */
int
NSS_CMSMessage_ContentLevelCount(NSSCMSMessage *cmsg)
{
    int count = 0;
    NSSCMSContentInfo *cinfo;

    if (cmsg == NULL) {
        return 0;
    }

    /* walk down the chain of contentinfos */
    for (cinfo = &(cmsg->contentInfo); cinfo != NULL;) {
        count++;
        cinfo = NSS_CMSContentInfo_GetChildContentInfo(cinfo);
    }
    return count;
}

/*
 * NSS_CMSMessage_ContentLevel - find content level #n
 *
 * CMS data content objects do not count.
 */
NSSCMSContentInfo *
NSS_CMSMessage_ContentLevel(NSSCMSMessage *cmsg, int n)
{
    int count = 0;
    NSSCMSContentInfo *cinfo;

    if (cmsg == NULL) {
        return NULL;
    }

    /* walk down the chain of contentinfos */
    for (cinfo = &(cmsg->contentInfo); cinfo != NULL && count < n;
         cinfo = NSS_CMSContentInfo_GetChildContentInfo(cinfo)) {
        count++;
    }

    return cinfo;
}

/*
 * NSS_CMSMessage_ContainsCertsOrCrls - see if message contains certs along the way
 */
PRBool
NSS_CMSMessage_ContainsCertsOrCrls(NSSCMSMessage *cmsg)
{
    NSSCMSContentInfo *cinfo;

    if (cmsg == NULL) {
        return PR_FALSE;
    }

    /* descend into CMS message */
    for (cinfo = &(cmsg->contentInfo); cinfo != NULL;
         cinfo = NSS_CMSContentInfo_GetChildContentInfo(cinfo)) {
        SECOidTag tag = NSS_CMSContentInfo_GetContentTypeTag(cinfo);
        if (tag != SEC_OID_PKCS7_SIGNED_DATA)
            continue; /* next level */

        if (NSS_CMSSignedData_ContainsCertsOrCrls(NSS_CMSContentInfo_GetContent(cinfo)))
            return PR_TRUE;
        /* callback here for generic wrappers? */
    }
    return PR_FALSE;
}

/*
 * NSS_CMSMessage_IsEncrypted - see if message contains a encrypted submessage
 */
PRBool
NSS_CMSMessage_IsEncrypted(NSSCMSMessage *cmsg)
{
    NSSCMSContentInfo *cinfo;

    if (cmsg == NULL) {
        return PR_FALSE;
    }

    /* walk down the chain of contentinfos */
    for (cinfo = &(cmsg->contentInfo); cinfo != NULL;
         cinfo = NSS_CMSContentInfo_GetChildContentInfo(cinfo)) {
        switch (NSS_CMSContentInfo_GetContentTypeTag(cinfo)) {
            case SEC_OID_PKCS7_ENVELOPED_DATA:
            case SEC_OID_PKCS7_ENCRYPTED_DATA:
                return PR_TRUE;
            default:
                /* callback here for generic wrappers? */
                break;
        }
    }
    return PR_FALSE;
}

/*
 * NSS_CMSMessage_IsSigned - see if message contains a signed submessage
 *
 * If the CMS message has a SignedData with a signature (not just a SignedData)
 * return true; false otherwise.  This can/should be called before calling
 * VerifySignature, which will always indicate failure if no signature is
 * present, but that does not mean there even was a signature!
 * Note that the content itself can be empty (detached content was sent
 * another way); it is the presence of the signature that matters.
 */
PRBool
NSS_CMSMessage_IsSigned(NSSCMSMessage *cmsg)
{
    NSSCMSContentInfo *cinfo;

    if (cmsg == NULL) {
        return PR_FALSE;
    }

    /* walk down the chain of contentinfos */
    for (cinfo = &(cmsg->contentInfo); cinfo != NULL;
         cinfo = NSS_CMSContentInfo_GetChildContentInfo(cinfo)) {
        switch (NSS_CMSContentInfo_GetContentTypeTag(cinfo)) {
            case SEC_OID_PKCS7_SIGNED_DATA:
                if (cinfo->content.signedData == NULL) {
                    return PR_FALSE;
                }
                if (!NSS_CMSArray_IsEmpty((void **)cinfo->content.signedData->signerInfos)) {
                    return PR_TRUE;
                }
                break;
            default:
                /* callback here for generic wrappers? */
                break;
        }
    }
    return PR_FALSE;
}

/*
 * NSS_CMSMessage_IsContentEmpty - see if content is empty
 *
 * returns PR_TRUE is innermost content length is < minLen
 * XXX need the encrypted content length (why?)
 */
PRBool
NSS_CMSMessage_IsContentEmpty(NSSCMSMessage *cmsg, unsigned int minLen)
{
    SECItem *item = NULL;

    if (cmsg == NULL) {
        return PR_TRUE;
    }

    item = NSS_CMSContentInfo_GetContent(NSS_CMSMessage_GetContentInfo(cmsg));

    if (!item) {
        return PR_TRUE;
    } else if (item->len <= minLen) {
        return PR_TRUE;
    }

    return PR_FALSE;
}

Coverage Report

Created: 2025-08-28 06:13

Line	Count	Source (jump to first uncovered line)
1		/* This Source Code Form is subject to the terms of the Mozilla Public
2		* License, v. 2.0. If a copy of the MPL was not distributed with this
3		* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
4
5		/*
6		* CMS message methods.
7		*/
8
9		#include "cmslocal.h"
10
11		#include "cert.h"
12		#include "secasn1.h"
13		#include "secitem.h"
14		#include "secoid.h"
15		#include "pk11func.h"
16		#include "secerr.h"
17
18		/*
19		* NSS_CMSMessage_Create - create a CMS message object
20		*
21		* "poolp" - arena to allocate memory from, or NULL if new arena should be created
22		*/
23		NSSCMSMessage *
24		NSS_CMSMessage_Create(PLArenaPool *poolp)
25	4.25k	{
26	4.25k	void *mark = NULL;
27	4.25k	NSSCMSMessage *cmsg;
28	4.25k	PRBool poolp_is_ours = PR_FALSE;
29
30	4.25k	if (poolp == NULL) {
31	4.25k	poolp = PORT_NewArena(1024); /* XXX what is right value? */
32	4.25k	if (poolp == NULL) {
33	0	return NULL;
34	0	}
35	4.25k	poolp_is_ours = PR_TRUE;
36	4.25k	}
37
38	4.25k	if (!poolp_is_ours)
39	0	mark = PORT_ArenaMark(poolp);
40
41	4.25k	cmsg = (NSSCMSMessage *)PORT_ArenaZAlloc(poolp, sizeof(NSSCMSMessage));
42	4.25k	if (cmsg == NULL \|\|
43	4.25k	NSS_CMSContentInfo_Private_Init(&(cmsg->contentInfo)) != SECSuccess) {
44	0	if (!poolp_is_ours) {
45	0	if (mark) {
46	0	PORT_ArenaRelease(poolp, mark);
47	0	}
48	0	} else {
49	0	PORT_FreeArena(poolp, PR_FALSE);
50	0	}
51	0	return NULL;
52	0	}
53
54	4.25k	cmsg->poolp = poolp;
55	4.25k	cmsg->poolp_is_ours = poolp_is_ours;
56	4.25k	cmsg->refCount = 1;
57
58	4.25k	if (mark) {
59	0	PORT_ArenaUnmark(poolp, mark);
60	0	}
61
62	4.25k	return cmsg;
63	4.25k	}
64
65		/*
66		* NSS_CMSMessage_SetEncodingParams - set up a CMS message object for encoding or decoding
67		*
68		* "cmsg" - message object
69		* "pwfn", pwfn_arg" - callback function for getting token password
70		* "decrypt_key_cb", "decrypt_key_cb_arg" - callback function for getting bulk key for encryptedData
71		* "detached_digestalgs", "detached_digests" - digests from detached content
72		*/
73		void
74		NSS_CMSMessage_SetEncodingParams(NSSCMSMessage *cmsg,
75		PK11PasswordFunc pwfn, void *pwfn_arg,
76		NSSCMSGetDecryptKeyCallback decrypt_key_cb, void *decrypt_key_cb_arg,
77		SECAlgorithmID detached_digestalgs, SECItem detached_digests)
78	4.25k	{
79	4.25k	if (cmsg == NULL) {
80	0	return;
81	0	}
82	4.25k	if (pwfn) {
83	0	PK11_SetPasswordFunc(pwfn);
84	0	}
85
86	4.25k	cmsg->pwfn_arg = pwfn_arg;
87	4.25k	cmsg->decrypt_key_cb = decrypt_key_cb;
88	4.25k	cmsg->decrypt_key_cb_arg = decrypt_key_cb_arg;
89	4.25k	cmsg->detached_digestalgs = detached_digestalgs;
90	4.25k	cmsg->detached_digests = detached_digests;
91	4.25k	}
92
93		/*
94		* NSS_CMSMessage_Destroy - destroy a CMS message and all of its sub-pieces.
95		*/
96		void
97		NSS_CMSMessage_Destroy(NSSCMSMessage *cmsg)
98	4.25k	{
99	4.25k	if (cmsg == NULL)
100	0	return;
101
102	4.25k	PORT_Assert(cmsg->refCount > 0);
103	4.25k	if (cmsg->refCount <= 0) { /* oops */
104	0	return;
105	0	}
106
107	4.25k	cmsg->refCount--; /* thread safety? */
108	4.25k	if (cmsg->refCount > 0) {
109	0	return;
110	0	}
111
112	4.25k	NSS_CMSContentInfo_Destroy(&(cmsg->contentInfo));
113
114		/* if poolp is not NULL, cmsg is the owner of its arena */
115	4.25k	if (cmsg->poolp_is_ours) {
116	4.25k	PORT_FreeArena(cmsg->poolp, PR_FALSE); /* XXX clear it? */
117	4.25k	}
118	4.25k	}
119
120		/*
121		* NSS_CMSMessage_Copy - return a copy of the given message.
122		*
123		* The copy may be virtual or may be real -- either way, the result needs
124		* to be passed to NSS_CMSMessage_Destroy later (as does the original).
125		*/
126		NSSCMSMessage *
127		NSS_CMSMessage_Copy(NSSCMSMessage *cmsg)
128	0	{
129	0	if (cmsg == NULL) {
130	0	return NULL;
131	0	}
132
133	0	PORT_Assert(cmsg->refCount > 0);
134
135	0	cmsg->refCount++; /* XXX chrisk thread safety? */
136	0	return cmsg;
137	0	}
138
139		/*
140		* NSS_CMSMessage_GetArena - return a pointer to the message's arena pool
141		*/
142		PLArenaPool *
143		NSS_CMSMessage_GetArena(NSSCMSMessage *cmsg)
144	0	{
145	0	if (cmsg == NULL) {
146	0	return NULL;
147	0	}
148
149	0	return cmsg->poolp;
150	0	}
151
152		/*
153		* NSS_CMSMessage_GetContentInfo - return a pointer to the top level contentInfo
154		*/
155		NSSCMSContentInfo *
156		NSS_CMSMessage_GetContentInfo(NSSCMSMessage *cmsg)
157	0	{
158	0	if (cmsg == NULL) {
159	0	return NULL;
160	0	}
161
162	0	return &(cmsg->contentInfo);
163	0	}
164
165		/*
166		* Return a pointer to the actual content.
167		* In the case of those types which are encrypted, this returns the plain content.
168		* In case of nested contentInfos, this descends and retrieves the innermost content.
169		*/
170		SECItem *
171		NSS_CMSMessage_GetContent(NSSCMSMessage *cmsg)
172	0	{
173	0	if (cmsg == NULL) {
174	0	return NULL;
175	0	}
176
177		/* this is a shortcut */
178	0	NSSCMSContentInfo *cinfo = NSS_CMSMessage_GetContentInfo(cmsg);
179	0	SECItem *pItem = NSS_CMSContentInfo_GetInnerContent(cinfo);
180	0	return pItem;
181	0	}
182
183		/*
184		* NSS_CMSMessage_ContentLevelCount - count number of levels of CMS content objects in this message
185		*
186		* CMS data content objects do not count.
187		*/
188		int
189		NSS_CMSMessage_ContentLevelCount(NSSCMSMessage *cmsg)
190	0	{
191	0	int count = 0;
192	0	NSSCMSContentInfo *cinfo;
193
194	0	if (cmsg == NULL) {
195	0	return 0;
196	0	}
197
198		/* walk down the chain of contentinfos */
199	0	for (cinfo = &(cmsg->contentInfo); cinfo != NULL;) {
200	0	count++;
201	0	cinfo = NSS_CMSContentInfo_GetChildContentInfo(cinfo);
202	0	}
203	0	return count;
204	0	}
205
206		/*
207		* NSS_CMSMessage_ContentLevel - find content level #n
208		*
209		* CMS data content objects do not count.
210		*/
211		NSSCMSContentInfo *
212		NSS_CMSMessage_ContentLevel(NSSCMSMessage *cmsg, int n)
213	0	{
214	0	int count = 0;
215	0	NSSCMSContentInfo *cinfo;
216
217	0	if (cmsg == NULL) {
218	0	return NULL;
219	0	}
220
221		/* walk down the chain of contentinfos */
222	0	for (cinfo = &(cmsg->contentInfo); cinfo != NULL && count < n;
223	0	cinfo = NSS_CMSContentInfo_GetChildContentInfo(cinfo)) {
224	0	count++;
225	0	}
226
227	0	return cinfo;
228	0	}
229
230		/*
231		* NSS_CMSMessage_ContainsCertsOrCrls - see if message contains certs along the way
232		*/
233		PRBool
234		NSS_CMSMessage_ContainsCertsOrCrls(NSSCMSMessage *cmsg)
235	0	{
236	0	NSSCMSContentInfo *cinfo;
237
238	0	if (cmsg == NULL) {
239	0	return PR_FALSE;
240	0	}
241
242		/* descend into CMS message */
243	0	for (cinfo = &(cmsg->contentInfo); cinfo != NULL;
244	0	cinfo = NSS_CMSContentInfo_GetChildContentInfo(cinfo)) {
245	0	SECOidTag tag = NSS_CMSContentInfo_GetContentTypeTag(cinfo);
246	0	if (tag != SEC_OID_PKCS7_SIGNED_DATA)
247	0	continue; /* next level */
248
249	0	if (NSS_CMSSignedData_ContainsCertsOrCrls(NSS_CMSContentInfo_GetContent(cinfo)))
250	0	return PR_TRUE;
251		/* callback here for generic wrappers? */
252	0	}
253	0	return PR_FALSE;
254	0	}
255
256		/*
257		* NSS_CMSMessage_IsEncrypted - see if message contains a encrypted submessage
258		*/
259		PRBool
260		NSS_CMSMessage_IsEncrypted(NSSCMSMessage *cmsg)
261	0	{
262	0	NSSCMSContentInfo *cinfo;
263
264	0	if (cmsg == NULL) {
265	0	return PR_FALSE;
266	0	}
267
268		/* walk down the chain of contentinfos */
269	0	for (cinfo = &(cmsg->contentInfo); cinfo != NULL;
270	0	cinfo = NSS_CMSContentInfo_GetChildContentInfo(cinfo)) {
271	0	switch (NSS_CMSContentInfo_GetContentTypeTag(cinfo)) {
272	0	case SEC_OID_PKCS7_ENVELOPED_DATA:
273	0	case SEC_OID_PKCS7_ENCRYPTED_DATA:
274	0	return PR_TRUE;
275	0	default:
276		/* callback here for generic wrappers? */
277	0	break;
278	0	}
279	0	}
280	0	return PR_FALSE;
281	0	}
282
283		/*
284		* NSS_CMSMessage_IsSigned - see if message contains a signed submessage
285		*
286		* If the CMS message has a SignedData with a signature (not just a SignedData)
287		* return true; false otherwise. This can/should be called before calling
288		* VerifySignature, which will always indicate failure if no signature is
289		* present, but that does not mean there even was a signature!
290		* Note that the content itself can be empty (detached content was sent
291		* another way); it is the presence of the signature that matters.
292		*/
293		PRBool
294		NSS_CMSMessage_IsSigned(NSSCMSMessage *cmsg)
295	4.25k	{
296	4.25k	NSSCMSContentInfo *cinfo;
297
298	4.25k	if (cmsg == NULL) {
299	4.21k	return PR_FALSE;
300	4.21k	}
301
302		/* walk down the chain of contentinfos */
303	140	for (cinfo = &(cmsg->contentInfo); cinfo != NULL;
304	109	cinfo = NSS_CMSContentInfo_GetChildContentInfo(cinfo)) {
305	109	switch (NSS_CMSContentInfo_GetContentTypeTag(cinfo)) {
306	72	case SEC_OID_PKCS7_SIGNED_DATA:
307	72	if (cinfo->content.signedData == NULL) {
308	1	return PR_FALSE;
309	1	}
310	71	if (!NSS_CMSArray_IsEmpty((void **)cinfo->content.signedData->signerInfos)) {
311	10	return PR_TRUE;
312	10	}
313	61	break;
314	61	default:
315		/* callback here for generic wrappers? */
316	37	break;
317	109	}
318	109	}
319	31	return PR_FALSE;
320	42	}
321
322		/*
323		* NSS_CMSMessage_IsContentEmpty - see if content is empty
324		*
325		* returns PR_TRUE is innermost content length is < minLen
326		* XXX need the encrypted content length (why?)
327		*/
328		PRBool
329		NSS_CMSMessage_IsContentEmpty(NSSCMSMessage *cmsg, unsigned int minLen)
330	0	{
331	0	SECItem *item = NULL;
332
333	0	if (cmsg == NULL) {
334	0	return PR_TRUE;
335	0	}
336
337	0	item = NSS_CMSContentInfo_GetContent(NSS_CMSMessage_GetContentInfo(cmsg));
338
339	0	if (!item) {
340	0	return PR_TRUE;
341	0	} else if (item->len <= minLen) {
342	0	return PR_TRUE;
343	0	}
344
345	0	return PR_FALSE;
346	0	}