/src/openssl34/crypto/cms/cms_lib.c

Source
/*
 * Copyright 2008-2024 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

#include <openssl/asn1t.h>
#include <openssl/x509v3.h>
#include <openssl/err.h>
#include <openssl/pem.h>
#include <openssl/bio.h>
#include <openssl/asn1.h>
#include <openssl/cms.h>
#include "internal/sizes.h"
#include "internal/cryptlib.h"
#include "crypto/x509.h"
#include "cms_local.h"

static STACK_OF(CMS_CertificateChoices)
    **
    cms_get0_certificate_choices(CMS_ContentInfo *cms);

IMPLEMENT_ASN1_ALLOC_FUNCTIONS(CMS_ContentInfo)
IMPLEMENT_ASN1_PRINT_FUNCTION(CMS_ContentInfo)

CMS_ContentInfo *d2i_CMS_ContentInfo(CMS_ContentInfo **a,
    const unsigned char **in, long len)
{
    CMS_ContentInfo *ci;
    const CMS_CTX *ctx = ossl_cms_get0_cmsctx(a == NULL ? NULL : *a);

    ci = (CMS_ContentInfo *)ASN1_item_d2i_ex((ASN1_VALUE **)a, in, len,
        (CMS_ContentInfo_it()),
        ossl_cms_ctx_get0_libctx(ctx),
        ossl_cms_ctx_get0_propq(ctx));
    if (ci != NULL) {
        ERR_set_mark();
        ossl_cms_resolve_libctx(ci);
        ERR_pop_to_mark();
    }
    return ci;
}

int i2d_CMS_ContentInfo(const CMS_ContentInfo *a, unsigned char **out)
{
    return ASN1_item_i2d((const ASN1_VALUE *)a, out, (CMS_ContentInfo_it()));
}

CMS_ContentInfo *CMS_ContentInfo_new_ex(OSSL_LIB_CTX *libctx, const char *propq)
{
    CMS_ContentInfo *ci;

    ci = (CMS_ContentInfo *)ASN1_item_new_ex(ASN1_ITEM_rptr(CMS_ContentInfo),
        libctx, propq);
    if (ci != NULL) {
        ci->ctx.libctx = libctx;
        ci->ctx.propq = NULL;
        if (propq != NULL) {
            ci->ctx.propq = OPENSSL_strdup(propq);
            if (ci->ctx.propq == NULL) {
                CMS_ContentInfo_free(ci);
                ci = NULL;
            }
        }
    }
    return ci;
}

const CMS_CTX *ossl_cms_get0_cmsctx(const CMS_ContentInfo *cms)
{
    return cms != NULL ? &cms->ctx : NULL;
}

OSSL_LIB_CTX *ossl_cms_ctx_get0_libctx(const CMS_CTX *ctx)
{
    return ctx != NULL ? ctx->libctx : NULL;
}

const char *ossl_cms_ctx_get0_propq(const CMS_CTX *ctx)
{
    return ctx != NULL ? ctx->propq : NULL;
}

void ossl_cms_resolve_libctx(CMS_ContentInfo *ci)
{
    int i;
    CMS_CertificateChoices *cch;
    STACK_OF(CMS_CertificateChoices) **pcerts;
    const CMS_CTX *ctx = ossl_cms_get0_cmsctx(ci);
    OSSL_LIB_CTX *libctx = ossl_cms_ctx_get0_libctx(ctx);
    const char *propq = ossl_cms_ctx_get0_propq(ctx);

    ossl_cms_SignerInfos_set_cmsctx(ci);
    ossl_cms_RecipientInfos_set_cmsctx(ci);

    pcerts = cms_get0_certificate_choices(ci);
    if (pcerts != NULL) {
        for (i = 0; i < sk_CMS_CertificateChoices_num(*pcerts); i++) {
            cch = sk_CMS_CertificateChoices_value(*pcerts, i);
            if (cch->type == CMS_CERTCHOICE_CERT)
                ossl_x509_set0_libctx(cch->d.certificate, libctx, propq);
        }
    }
}

const ASN1_OBJECT *CMS_get0_type(const CMS_ContentInfo *cms)
{
    return cms->contentType;
}

CMS_ContentInfo *ossl_cms_Data_create(OSSL_LIB_CTX *libctx, const char *propq)
{
    CMS_ContentInfo *cms = CMS_ContentInfo_new_ex(libctx, propq);

    if (cms != NULL) {
        cms->contentType = OBJ_nid2obj(NID_pkcs7_data);
        /* Never detached */
        CMS_set_detached(cms, 0);
    }
    return cms;
}

BIO *ossl_cms_content_bio(CMS_ContentInfo *cms)
{
    ASN1_OCTET_STRING **pos = CMS_get0_content(cms);

    if (pos == NULL)
        return NULL;
    /* If content detached data goes nowhere: create NULL BIO */
    if (*pos == NULL)
        return BIO_new(BIO_s_null());
    /*
     * If content not detached and created return memory BIO
     */
    if (*pos == NULL || ((*pos)->flags == ASN1_STRING_FLAG_CONT))
        return BIO_new(BIO_s_mem());
    /* Else content was read in: return read only BIO for it */
    return BIO_new_mem_buf((*pos)->data, (*pos)->length);
}

BIO *CMS_dataInit(CMS_ContentInfo *cms, BIO *icont)
{
    BIO *cmsbio, *cont;
    if (icont)
        cont = icont;
    else
        cont = ossl_cms_content_bio(cms);
    if (!cont) {
        ERR_raise(ERR_LIB_CMS, CMS_R_NO_CONTENT);
        return NULL;
    }
    switch (OBJ_obj2nid(cms->contentType)) {

    case NID_pkcs7_data:
        return cont;

    case NID_pkcs7_signed:
        cmsbio = ossl_cms_SignedData_init_bio(cms);
        break;

    case NID_pkcs7_digest:
        cmsbio = ossl_cms_DigestedData_init_bio(cms);
        break;
#ifndef OPENSSL_NO_ZLIB
    case NID_id_smime_ct_compressedData:
        cmsbio = ossl_cms_CompressedData_init_bio(cms);
        break;
#endif

    case NID_pkcs7_encrypted:
        cmsbio = ossl_cms_EncryptedData_init_bio(cms);
        break;

    case NID_pkcs7_enveloped:
        cmsbio = ossl_cms_EnvelopedData_init_bio(cms);
        break;

    case NID_id_smime_ct_authEnvelopedData:
        cmsbio = ossl_cms_AuthEnvelopedData_init_bio(cms);
        break;

    default:
        ERR_raise(ERR_LIB_CMS, CMS_R_UNSUPPORTED_TYPE);
        goto err;
    }

    if (cmsbio)
        return BIO_push(cmsbio, cont);
err:
    if (!icont)
        BIO_free(cont);
    return NULL;
}

/* unfortunately cannot constify SMIME_write_ASN1() due to this function */
int CMS_dataFinal(CMS_ContentInfo *cms, BIO *cmsbio)
{
    return ossl_cms_DataFinal(cms, cmsbio, NULL, 0);
}

int ossl_cms_DataFinal(CMS_ContentInfo *cms, BIO *cmsbio,
    const unsigned char *precomp_md,
    unsigned int precomp_mdlen)
{
    ASN1_OCTET_STRING **pos = CMS_get0_content(cms);

    if (pos == NULL)
        return 0;
    /* If embedded content find memory BIO and set content */
    if (*pos && ((*pos)->flags & ASN1_STRING_FLAG_CONT)) {
        BIO *mbio;
        unsigned char *cont;
        long contlen;
        mbio = BIO_find_type(cmsbio, BIO_TYPE_MEM);
        if (!mbio) {
            ERR_raise(ERR_LIB_CMS, CMS_R_CONTENT_NOT_FOUND);
            return 0;
        }
        contlen = BIO_get_mem_data(mbio, &cont);
        /* Set bio as read only so its content can't be clobbered */
        BIO_set_flags(mbio, BIO_FLAGS_MEM_RDONLY);
        BIO_set_mem_eof_return(mbio, 0);
        ASN1_STRING_set0(*pos, cont, contlen);
        (*pos)->flags &= ~ASN1_STRING_FLAG_CONT;
    }

    switch (OBJ_obj2nid(cms->contentType)) {

    case NID_pkcs7_data:
    case NID_pkcs7_encrypted:
    case NID_id_smime_ct_compressedData:
        /* Nothing to do */
        return 1;

    case NID_pkcs7_enveloped:
        return ossl_cms_EnvelopedData_final(cms, cmsbio);

    case NID_id_smime_ct_authEnvelopedData:
        return ossl_cms_AuthEnvelopedData_final(cms, cmsbio);

    case NID_pkcs7_signed:
        return ossl_cms_SignedData_final(cms, cmsbio, precomp_md, precomp_mdlen);

    case NID_pkcs7_digest:
        return ossl_cms_DigestedData_do_final(cms, cmsbio, 0);

    default:
        ERR_raise(ERR_LIB_CMS, CMS_R_UNSUPPORTED_TYPE);
        return 0;
    }
}

/*
 * Return an OCTET STRING pointer to content. This allows it to be accessed
 * or set later.
 */

ASN1_OCTET_STRING **CMS_get0_content(CMS_ContentInfo *cms)
{
    switch (OBJ_obj2nid(cms->contentType)) {

    case NID_pkcs7_data:
        return &cms->d.data;

    case NID_pkcs7_signed:
        return &cms->d.signedData->encapContentInfo->eContent;

    case NID_pkcs7_enveloped:
        return &cms->d.envelopedData->encryptedContentInfo->encryptedContent;

    case NID_pkcs7_digest:
        return &cms->d.digestedData->encapContentInfo->eContent;

    case NID_pkcs7_encrypted:
        return &cms->d.encryptedData->encryptedContentInfo->encryptedContent;

    case NID_id_smime_ct_authEnvelopedData:
        return &cms->d.authEnvelopedData->authEncryptedContentInfo
                    ->encryptedContent;

    case NID_id_smime_ct_authData:
        return &cms->d.authenticatedData->encapContentInfo->eContent;

    case NID_id_smime_ct_compressedData:
        return &cms->d.compressedData->encapContentInfo->eContent;

    default:
        if (cms->d.other->type == V_ASN1_OCTET_STRING)
            return &cms->d.other->value.octet_string;
        ERR_raise(ERR_LIB_CMS, CMS_R_UNSUPPORTED_CONTENT_TYPE);
        return NULL;
    }
}

/*
 * Return an ASN1_OBJECT pointer to content type. This allows it to be
 * accessed or set later.
 */

static ASN1_OBJECT **cms_get0_econtent_type(CMS_ContentInfo *cms)
{
    switch (OBJ_obj2nid(cms->contentType)) {

    case NID_pkcs7_signed:
        return &cms->d.signedData->encapContentInfo->eContentType;

    case NID_pkcs7_enveloped:
        return &cms->d.envelopedData->encryptedContentInfo->contentType;

    case NID_pkcs7_digest:
        return &cms->d.digestedData->encapContentInfo->eContentType;

    case NID_pkcs7_encrypted:
        return &cms->d.encryptedData->encryptedContentInfo->contentType;

    case NID_id_smime_ct_authEnvelopedData:
        return &cms->d.authEnvelopedData->authEncryptedContentInfo
                    ->contentType;
    case NID_id_smime_ct_authData:
        return &cms->d.authenticatedData->encapContentInfo->eContentType;

    case NID_id_smime_ct_compressedData:
        return &cms->d.compressedData->encapContentInfo->eContentType;

    default:
        ERR_raise(ERR_LIB_CMS, CMS_R_UNSUPPORTED_CONTENT_TYPE);
        return NULL;
    }
}

const ASN1_OBJECT *CMS_get0_eContentType(CMS_ContentInfo *cms)
{
    ASN1_OBJECT **petype;
    petype = cms_get0_econtent_type(cms);
    if (petype)
        return *petype;
    return NULL;
}

int CMS_set1_eContentType(CMS_ContentInfo *cms, const ASN1_OBJECT *oid)
{
    ASN1_OBJECT **petype, *etype;

    petype = cms_get0_econtent_type(cms);
    if (petype == NULL)
        return 0;
    if (oid == NULL)
        return 1;
    etype = OBJ_dup(oid);
    if (etype == NULL)
        return 0;
    ASN1_OBJECT_free(*petype);
    *petype = etype;
    return 1;
}

int CMS_is_detached(CMS_ContentInfo *cms)
{
    ASN1_OCTET_STRING **pos;

    pos = CMS_get0_content(cms);
    if (pos == NULL)
        return -1;
    if (*pos != NULL)
        return 0;
    return 1;
}

int CMS_set_detached(CMS_ContentInfo *cms, int detached)
{
    ASN1_OCTET_STRING **pos;

    pos = CMS_get0_content(cms);
    if (pos == NULL)
        return 0;
    if (detached) {
        ASN1_OCTET_STRING_free(*pos);
        *pos = NULL;
        return 1;
    }
    if (*pos == NULL)
        *pos = ASN1_OCTET_STRING_new();
    if (*pos != NULL) {
        /*
         * NB: special flag to show content is created and not read in.
         */
        (*pos)->flags |= ASN1_STRING_FLAG_CONT;
        return 1;
    }
    ERR_raise(ERR_LIB_CMS, ERR_R_ASN1_LIB);
    return 0;
}

/* Create a digest BIO from an X509_ALGOR structure */

BIO *ossl_cms_DigestAlgorithm_init_bio(X509_ALGOR *digestAlgorithm,
    const CMS_CTX *ctx)
{
    BIO *mdbio = NULL;
    const ASN1_OBJECT *digestoid;
    const EVP_MD *digest = NULL;
    EVP_MD *fetched_digest = NULL;
    char alg[OSSL_MAX_NAME_SIZE];

    X509_ALGOR_get0(&digestoid, NULL, NULL, digestAlgorithm);
    OBJ_obj2txt(alg, sizeof(alg), digestoid, 0);

    (void)ERR_set_mark();
    fetched_digest = EVP_MD_fetch(ossl_cms_ctx_get0_libctx(ctx), alg,
        ossl_cms_ctx_get0_propq(ctx));

    if (fetched_digest != NULL)
        digest = fetched_digest;
    else
        digest = EVP_get_digestbyobj(digestoid);
    if (digest == NULL) {
        (void)ERR_clear_last_mark();
        ERR_raise(ERR_LIB_CMS, CMS_R_UNKNOWN_DIGEST_ALGORITHM);
        goto err;
    }
    (void)ERR_pop_to_mark();

    mdbio = BIO_new(BIO_f_md());
    if (mdbio == NULL || BIO_set_md(mdbio, digest) <= 0) {
        ERR_raise(ERR_LIB_CMS, CMS_R_MD_BIO_INIT_ERROR);
        goto err;
    }
    EVP_MD_free(fetched_digest);
    return mdbio;
err:
    EVP_MD_free(fetched_digest);
    BIO_free(mdbio);
    return NULL;
}

/* Locate a message digest content from a BIO chain based on SignerInfo */

int ossl_cms_DigestAlgorithm_find_ctx(EVP_MD_CTX *mctx, BIO *chain,
    X509_ALGOR *mdalg)
{
    int nid;
    const ASN1_OBJECT *mdoid;
    X509_ALGOR_get0(&mdoid, NULL, NULL, mdalg);
    nid = OBJ_obj2nid(mdoid);
    /* Look for digest type to match signature */
    for (;;) {
        EVP_MD_CTX *mtmp;
        chain = BIO_find_type(chain, BIO_TYPE_MD);
        if (chain == NULL) {
            ERR_raise(ERR_LIB_CMS, CMS_R_NO_MATCHING_DIGEST);
            return 0;
        }
        BIO_get_md_ctx(chain, &mtmp);
        if (EVP_MD_CTX_get_type(mtmp) == nid
            /*
             * Workaround for broken implementations that use signature
             * algorithm OID instead of digest.
             */
            || EVP_MD_get_pkey_type(EVP_MD_CTX_get0_md(mtmp)) == nid)
            return EVP_MD_CTX_copy_ex(mctx, mtmp);
        chain = BIO_next(chain);
    }
}

static STACK_OF(CMS_CertificateChoices)
    **
    cms_get0_certificate_choices(CMS_ContentInfo *cms)
{
    switch (OBJ_obj2nid(cms->contentType)) {

    case NID_pkcs7_signed:
        return &cms->d.signedData->certificates;

    case NID_pkcs7_enveloped:
        if (cms->d.envelopedData->originatorInfo == NULL)
            return NULL;
        return &cms->d.envelopedData->originatorInfo->certificates;

    case NID_id_smime_ct_authEnvelopedData:
        if (cms->d.authEnvelopedData->originatorInfo == NULL)
            return NULL;
        return &cms->d.authEnvelopedData->originatorInfo->certificates;

    default:
        ERR_raise(ERR_LIB_CMS, CMS_R_UNSUPPORTED_CONTENT_TYPE);
        return NULL;
    }
}

CMS_CertificateChoices *CMS_add0_CertificateChoices(CMS_ContentInfo *cms)
{
    STACK_OF(CMS_CertificateChoices) **pcerts;
    CMS_CertificateChoices *cch;

    pcerts = cms_get0_certificate_choices(cms);
    if (pcerts == NULL)
        return NULL;
    if (*pcerts == NULL)
        *pcerts = sk_CMS_CertificateChoices_new_null();
    if (*pcerts == NULL)
        return NULL;
    cch = M_ASN1_new_of(CMS_CertificateChoices);
    if (!cch)
        return NULL;
    if (!sk_CMS_CertificateChoices_push(*pcerts, cch)) {
        M_ASN1_free_of(cch, CMS_CertificateChoices);
        return NULL;
    }
    return cch;
}

int CMS_add0_cert(CMS_ContentInfo *cms, X509 *cert)
{
    CMS_CertificateChoices *cch;
    STACK_OF(CMS_CertificateChoices) **pcerts;
    int i;

    pcerts = cms_get0_certificate_choices(cms);
    if (pcerts == NULL)
        return 0;
    for (i = 0; i < sk_CMS_CertificateChoices_num(*pcerts); i++) {
        cch = sk_CMS_CertificateChoices_value(*pcerts, i);
        if (cch->type == CMS_CERTCHOICE_CERT) {
            if (X509_cmp(cch->d.certificate, cert) == 0) {
                X509_free(cert);
                return 1; /* cert already present */
            }
        }
    }
    cch = CMS_add0_CertificateChoices(cms);
    if (!cch)
        return 0;
    cch->type = CMS_CERTCHOICE_CERT;
    cch->d.certificate = cert;
    return 1;
}

int CMS_add1_cert(CMS_ContentInfo *cms, X509 *cert)
{
    if (!X509_up_ref(cert))
        return 0;
    if (CMS_add0_cert(cms, cert))
        return 1;
    X509_free(cert);
    return 0;
}

static STACK_OF(CMS_RevocationInfoChoice)
    **
    cms_get0_revocation_choices(CMS_ContentInfo *cms)
{
    switch (OBJ_obj2nid(cms->contentType)) {

    case NID_pkcs7_signed:
        return &cms->d.signedData->crls;

    case NID_pkcs7_enveloped:
        if (cms->d.envelopedData->originatorInfo == NULL)
            return NULL;
        return &cms->d.envelopedData->originatorInfo->crls;

    case NID_id_smime_ct_authEnvelopedData:
        if (cms->d.authEnvelopedData->originatorInfo == NULL)
            return NULL;
        return &cms->d.authEnvelopedData->originatorInfo->crls;

    default:
        ERR_raise(ERR_LIB_CMS, CMS_R_UNSUPPORTED_CONTENT_TYPE);
        return NULL;
    }
}

CMS_RevocationInfoChoice *CMS_add0_RevocationInfoChoice(CMS_ContentInfo *cms)
{
    STACK_OF(CMS_RevocationInfoChoice) **pcrls;
    CMS_RevocationInfoChoice *rch;

    pcrls = cms_get0_revocation_choices(cms);
    if (pcrls == NULL)
        return NULL;
    if (*pcrls == NULL)
        *pcrls = sk_CMS_RevocationInfoChoice_new_null();
    if (*pcrls == NULL)
        return NULL;
    rch = M_ASN1_new_of(CMS_RevocationInfoChoice);
    if (rch == NULL)
        return NULL;
    if (!sk_CMS_RevocationInfoChoice_push(*pcrls, rch)) {
        M_ASN1_free_of(rch, CMS_RevocationInfoChoice);
        return NULL;
    }
    return rch;
}

int CMS_add0_crl(CMS_ContentInfo *cms, X509_CRL *crl)
{
    CMS_RevocationInfoChoice *rch = CMS_add0_RevocationInfoChoice(cms);

    if (rch == NULL)
        return 0;
    rch->type = CMS_REVCHOICE_CRL;
    rch->d.crl = crl;
    return 1;
}

int CMS_add1_crl(CMS_ContentInfo *cms, X509_CRL *crl)
{
    if (!X509_CRL_up_ref(crl))
        return 0;
    if (CMS_add0_crl(cms, crl))
        return 1;
    X509_CRL_free(crl);
    return 0;
}

STACK_OF(X509) *CMS_get1_certs(CMS_ContentInfo *cms)
{
    STACK_OF(X509) *certs = NULL;

    if (!ossl_cms_get1_certs_ex(cms, &certs))
        return NULL;
    if (sk_X509_num(certs) == 0) {
        sk_X509_free(certs);
        return NULL;
    }
    return certs;
}

int ossl_cms_get1_certs_ex(CMS_ContentInfo *cms, STACK_OF(X509) **certs)
{
    CMS_CertificateChoices *cch;
    STACK_OF(CMS_CertificateChoices) **pcerts;
    int i, n;

    if (certs == NULL)
        return 0;
    *certs = NULL;
    pcerts = cms_get0_certificate_choices(cms);
    if (pcerts == NULL)
        return 0;

    /* make sure to return NULL *certs only on error */
    n = sk_CMS_CertificateChoices_num(*pcerts);
    if ((*certs = sk_X509_new_reserve(NULL, n)) == NULL)
        return 0;

    for (i = 0; i < n; i++) {
        cch = sk_CMS_CertificateChoices_value(*pcerts, i);
        if (cch->type == 0) {
            if (!X509_add_cert(*certs, cch->d.certificate,
                    X509_ADD_FLAG_UP_REF)) {
                OSSL_STACK_OF_X509_free(*certs);
                *certs = NULL;
                return 0;
            }
        }
    }
    return 1;
}

STACK_OF(X509_CRL) *CMS_get1_crls(CMS_ContentInfo *cms)
{
    STACK_OF(X509_CRL) *crls = NULL;

    if (!ossl_cms_get1_crls_ex(cms, &crls))
        return NULL;
    if (sk_X509_CRL_num(crls) == 0) {
        sk_X509_CRL_free(crls);
        return NULL;
    }
    return crls;
}

int ossl_cms_get1_crls_ex(CMS_ContentInfo *cms, STACK_OF(X509_CRL) **crls)
{
    STACK_OF(CMS_RevocationInfoChoice) **pcrls;
    CMS_RevocationInfoChoice *rch;
    int i, n;

    if (crls == NULL)
        return 0;
    *crls = NULL;
    pcrls = cms_get0_revocation_choices(cms);
    if (pcrls == NULL)
        return 0;

    /* make sure to return NULL *crls only on error */
    n = sk_CMS_RevocationInfoChoice_num(*pcrls);
    if ((*crls = sk_X509_CRL_new_reserve(NULL, n)) == NULL)
        return 0;

    for (i = 0; i < n; i++) {
        rch = sk_CMS_RevocationInfoChoice_value(*pcrls, i);
        if (rch->type == 0) {
            if (!X509_CRL_up_ref(rch->d.crl)
                || !ossl_assert(sk_X509_CRL_push(*crls, rch->d.crl))) {
                /* push cannot fail on reserved stack */
                sk_X509_CRL_pop_free(*crls, X509_CRL_free);
                *crls = NULL;
                return 0;
            }
        }
    }
    return 1;
}

int ossl_cms_ias_cert_cmp(CMS_IssuerAndSerialNumber *ias, X509 *cert)
{
    int ret;
    ret = X509_NAME_cmp(ias->issuer, X509_get_issuer_name(cert));
    if (ret)
        return ret;
    return ASN1_INTEGER_cmp(ias->serialNumber, X509_get0_serialNumber(cert));
}

int ossl_cms_keyid_cert_cmp(ASN1_OCTET_STRING *keyid, X509 *cert)
{
    const ASN1_OCTET_STRING *cert_keyid = X509_get0_subject_key_id(cert);

    if (cert_keyid == NULL)
        return -1;
    return ASN1_OCTET_STRING_cmp(keyid, cert_keyid);
}

int ossl_cms_set1_ias(CMS_IssuerAndSerialNumber **pias, X509 *cert)
{
    CMS_IssuerAndSerialNumber *ias;
    ias = M_ASN1_new_of(CMS_IssuerAndSerialNumber);
    if (!ias) {
        ERR_raise(ERR_LIB_CMS, ERR_R_ASN1_LIB);
        goto err;
    }
    if (!X509_NAME_set(&ias->issuer, X509_get_issuer_name(cert))) {
        ERR_raise(ERR_LIB_CMS, ERR_R_X509_LIB);
        goto err;
    }
    if (!ASN1_STRING_copy(ias->serialNumber, X509_get0_serialNumber(cert))) {
        ERR_raise(ERR_LIB_CMS, ERR_R_ASN1_LIB);
        goto err;
    }
    M_ASN1_free_of(*pias, CMS_IssuerAndSerialNumber);
    *pias = ias;
    return 1;
err:
    M_ASN1_free_of(ias, CMS_IssuerAndSerialNumber);
    return 0;
}

int ossl_cms_set1_keyid(ASN1_OCTET_STRING **pkeyid, X509 *cert)
{
    ASN1_OCTET_STRING *keyid = NULL;
    const ASN1_OCTET_STRING *cert_keyid;
    cert_keyid = X509_get0_subject_key_id(cert);
    if (cert_keyid == NULL) {
        ERR_raise(ERR_LIB_CMS, CMS_R_CERTIFICATE_HAS_NO_KEYID);
        return 0;
    }
    keyid = ASN1_STRING_dup(cert_keyid);
    if (!keyid) {
        ERR_raise(ERR_LIB_CMS, ERR_R_ASN1_LIB);
        return 0;
    }
    ASN1_OCTET_STRING_free(*pkeyid);
    *pkeyid = keyid;
    return 1;
}

Coverage Report

Created: 2026-02-14 07:20

Line	Count	Source
1		/*
2		* Copyright 2008-2024 The OpenSSL Project Authors. All Rights Reserved.
3		*
4		* Licensed under the Apache License 2.0 (the "License"). You may not use
5		* this file except in compliance with the License. You can obtain a copy
6		* in the file LICENSE in the source distribution or at
7		* https://www.openssl.org/source/license.html
8		*/
9
10		#include <openssl/asn1t.h>
11		#include <openssl/x509v3.h>
12		#include <openssl/err.h>
13		#include <openssl/pem.h>
14		#include <openssl/bio.h>
15		#include <openssl/asn1.h>
16		#include <openssl/cms.h>
17		#include "internal/sizes.h"
18		#include "internal/cryptlib.h"
19		#include "crypto/x509.h"
20		#include "cms_local.h"
21
22		static STACK_OF(CMS_CertificateChoices)
23		**
24		cms_get0_certificate_choices(CMS_ContentInfo *cms);
25
26		IMPLEMENT_ASN1_ALLOC_FUNCTIONS(CMS_ContentInfo)
27		IMPLEMENT_ASN1_PRINT_FUNCTION(CMS_ContentInfo)
28
29		CMS_ContentInfo d2i_CMS_ContentInfo(CMS_ContentInfo *a,
30		const unsigned char **in, long len)
31	0	{
32	0	CMS_ContentInfo *ci;
33	0	const CMS_CTX ctx = ossl_cms_get0_cmsctx(a == NULL ? NULL : a);
34
35	0	ci = (CMS_ContentInfo )ASN1_item_d2i_ex((ASN1_VALUE *)a, in, len,
36	0	(CMS_ContentInfo_it()),
37	0	ossl_cms_ctx_get0_libctx(ctx),
38	0	ossl_cms_ctx_get0_propq(ctx));
39	0	if (ci != NULL) {
40	0	ERR_set_mark();
41	0	ossl_cms_resolve_libctx(ci);
42	0	ERR_pop_to_mark();
43	0	}
44	0	return ci;
45	0	}
46
47		int i2d_CMS_ContentInfo(const CMS_ContentInfo a, unsigned char *out)
48	0	{
49	0	return ASN1_item_i2d((const ASN1_VALUE *)a, out, (CMS_ContentInfo_it()));
50	0	}
51
52		CMS_ContentInfo CMS_ContentInfo_new_ex(OSSL_LIB_CTX libctx, const char *propq)
53	0	{
54	0	CMS_ContentInfo *ci;
55
56	0	ci = (CMS_ContentInfo *)ASN1_item_new_ex(ASN1_ITEM_rptr(CMS_ContentInfo),
57	0	libctx, propq);
58	0	if (ci != NULL) {
59	0	ci->ctx.libctx = libctx;
60	0	ci->ctx.propq = NULL;
61	0	if (propq != NULL) {
62	0	ci->ctx.propq = OPENSSL_strdup(propq);
63	0	if (ci->ctx.propq == NULL) {
64	0	CMS_ContentInfo_free(ci);
65	0	ci = NULL;
66	0	}
67	0	}
68	0	}
69	0	return ci;
70	0	}
71
72		const CMS_CTX ossl_cms_get0_cmsctx(const CMS_ContentInfo cms)
73	69.1k	{
74	69.1k	return cms != NULL ? &cms->ctx : NULL;
75	69.1k	}
76
77		OSSL_LIB_CTX ossl_cms_ctx_get0_libctx(const CMS_CTX ctx)
78	58.5k	{
79	58.5k	return ctx != NULL ? ctx->libctx : NULL;
80	58.5k	}
81
82		const char ossl_cms_ctx_get0_propq(const CMS_CTX ctx)
83	58.5k	{
84	58.5k	return ctx != NULL ? ctx->propq : NULL;
85	58.5k	}
86
87		void ossl_cms_resolve_libctx(CMS_ContentInfo *ci)
88	6.73k	{
89	6.73k	int i;
90	6.73k	CMS_CertificateChoices *cch;
91	6.73k	STACK_OF(CMS_CertificateChoices) **pcerts;
92	6.73k	const CMS_CTX *ctx = ossl_cms_get0_cmsctx(ci);
93	6.73k	OSSL_LIB_CTX *libctx = ossl_cms_ctx_get0_libctx(ctx);
94	6.73k	const char *propq = ossl_cms_ctx_get0_propq(ctx);
95
96	6.73k	ossl_cms_SignerInfos_set_cmsctx(ci);
97	6.73k	ossl_cms_RecipientInfos_set_cmsctx(ci);
98
99	6.73k	pcerts = cms_get0_certificate_choices(ci);
100	6.73k	if (pcerts != NULL) {
101	524k	for (i = 0; i < sk_CMS_CertificateChoices_num(*pcerts); i++) {
102	523k	cch = sk_CMS_CertificateChoices_value(*pcerts, i);
103	523k	if (cch->type == CMS_CERTCHOICE_CERT)
104	1.00k	ossl_x509_set0_libctx(cch->d.certificate, libctx, propq);
105	523k	}
106	1.58k	}
107	6.73k	}
108
109		const ASN1_OBJECT CMS_get0_type(const CMS_ContentInfo cms)
110	0	{
111	0	return cms->contentType;
112	0	}
113
114		CMS_ContentInfo ossl_cms_Data_create(OSSL_LIB_CTX libctx, const char *propq)
115	0	{
116	0	CMS_ContentInfo *cms = CMS_ContentInfo_new_ex(libctx, propq);
117
118	0	if (cms != NULL) {
119	0	cms->contentType = OBJ_nid2obj(NID_pkcs7_data);
120		/* Never detached */
121	0	CMS_set_detached(cms, 0);
122	0	}
123	0	return cms;
124	0	}
125
126		BIO ossl_cms_content_bio(CMS_ContentInfo cms)
127	0	{
128	0	ASN1_OCTET_STRING **pos = CMS_get0_content(cms);
129
130	0	if (pos == NULL)
131	0	return NULL;
132		/* If content detached data goes nowhere: create NULL BIO */
133	0	if (*pos == NULL)
134	0	return BIO_new(BIO_s_null());
135		/*
136		* If content not detached and created return memory BIO
137		*/
138	0	if (pos == NULL \|\| ((pos)->flags == ASN1_STRING_FLAG_CONT))
139	0	return BIO_new(BIO_s_mem());
140		/* Else content was read in: return read only BIO for it */
141	0	return BIO_new_mem_buf((pos)->data, (pos)->length);
142	0	}
143
144		BIO CMS_dataInit(CMS_ContentInfo cms, BIO *icont)
145	0	{
146	0	BIO cmsbio, cont;
147	0	if (icont)
148	0	cont = icont;
149	0	else
150	0	cont = ossl_cms_content_bio(cms);
151	0	if (!cont) {
152	0	ERR_raise(ERR_LIB_CMS, CMS_R_NO_CONTENT);
153	0	return NULL;
154	0	}
155	0	switch (OBJ_obj2nid(cms->contentType)) {
156
157	0	case NID_pkcs7_data:
158	0	return cont;
159
160	0	case NID_pkcs7_signed:
161	0	cmsbio = ossl_cms_SignedData_init_bio(cms);
162	0	break;
163
164	0	case NID_pkcs7_digest:
165	0	cmsbio = ossl_cms_DigestedData_init_bio(cms);
166	0	break;
167		#ifndef OPENSSL_NO_ZLIB
168		case NID_id_smime_ct_compressedData:
169		cmsbio = ossl_cms_CompressedData_init_bio(cms);
170		break;
171		#endif
172
173	0	case NID_pkcs7_encrypted:
174	0	cmsbio = ossl_cms_EncryptedData_init_bio(cms);
175	0	break;
176
177	0	case NID_pkcs7_enveloped:
178	0	cmsbio = ossl_cms_EnvelopedData_init_bio(cms);
179	0	break;
180
181	0	case NID_id_smime_ct_authEnvelopedData:
182	0	cmsbio = ossl_cms_AuthEnvelopedData_init_bio(cms);
183	0	break;
184
185	0	default:
186	0	ERR_raise(ERR_LIB_CMS, CMS_R_UNSUPPORTED_TYPE);
187	0	goto err;
188	0	}
189
190	0	if (cmsbio)
191	0	return BIO_push(cmsbio, cont);
192	0	err:
193	0	if (!icont)
194	0	BIO_free(cont);
195	0	return NULL;
196	0	}
197
198		/* unfortunately cannot constify SMIME_write_ASN1() due to this function */
199		int CMS_dataFinal(CMS_ContentInfo cms, BIO cmsbio)
200	0	{
201	0	return ossl_cms_DataFinal(cms, cmsbio, NULL, 0);
202	0	}
203
204		int ossl_cms_DataFinal(CMS_ContentInfo cms, BIO cmsbio,
205		const unsigned char *precomp_md,
206		unsigned int precomp_mdlen)
207	0	{
208	0	ASN1_OCTET_STRING **pos = CMS_get0_content(cms);
209
210	0	if (pos == NULL)
211	0	return 0;
212		/* If embedded content find memory BIO and set content */
213	0	if (pos && ((pos)->flags & ASN1_STRING_FLAG_CONT)) {
214	0	BIO *mbio;
215	0	unsigned char *cont;
216	0	long contlen;
217	0	mbio = BIO_find_type(cmsbio, BIO_TYPE_MEM);
218	0	if (!mbio) {
219	0	ERR_raise(ERR_LIB_CMS, CMS_R_CONTENT_NOT_FOUND);
220	0	return 0;
221	0	}
222	0	contlen = BIO_get_mem_data(mbio, &cont);
223		/* Set bio as read only so its content can't be clobbered */
224	0	BIO_set_flags(mbio, BIO_FLAGS_MEM_RDONLY);
225	0	BIO_set_mem_eof_return(mbio, 0);
226	0	ASN1_STRING_set0(*pos, cont, contlen);
227	0	(*pos)->flags &= ~ASN1_STRING_FLAG_CONT;
228	0	}
229
230	0	switch (OBJ_obj2nid(cms->contentType)) {
231
232	0	case NID_pkcs7_data:
233	0	case NID_pkcs7_encrypted:
234	0	case NID_id_smime_ct_compressedData:
235		/* Nothing to do */
236	0	return 1;
237
238	0	case NID_pkcs7_enveloped:
239	0	return ossl_cms_EnvelopedData_final(cms, cmsbio);
240
241	0	case NID_id_smime_ct_authEnvelopedData:
242	0	return ossl_cms_AuthEnvelopedData_final(cms, cmsbio);
243
244	0	case NID_pkcs7_signed:
245	0	return ossl_cms_SignedData_final(cms, cmsbio, precomp_md, precomp_mdlen);
246
247	0	case NID_pkcs7_digest:
248	0	return ossl_cms_DigestedData_do_final(cms, cmsbio, 0);
249
250	0	default:
251	0	ERR_raise(ERR_LIB_CMS, CMS_R_UNSUPPORTED_TYPE);
252	0	return 0;
253	0	}
254	0	}
255
256		/*
257		* Return an OCTET STRING pointer to content. This allows it to be accessed
258		* or set later.
259		*/
260
261		ASN1_OCTET_STRING *CMS_get0_content(CMS_ContentInfo cms)
262	0	{
263	0	switch (OBJ_obj2nid(cms->contentType)) {
264
265	0	case NID_pkcs7_data:
266	0	return &cms->d.data;
267
268	0	case NID_pkcs7_signed:
269	0	return &cms->d.signedData->encapContentInfo->eContent;
270
271	0	case NID_pkcs7_enveloped:
272	0	return &cms->d.envelopedData->encryptedContentInfo->encryptedContent;
273
274	0	case NID_pkcs7_digest:
275	0	return &cms->d.digestedData->encapContentInfo->eContent;
276
277	0	case NID_pkcs7_encrypted:
278	0	return &cms->d.encryptedData->encryptedContentInfo->encryptedContent;
279
280	0	case NID_id_smime_ct_authEnvelopedData:
281	0	return &cms->d.authEnvelopedData->authEncryptedContentInfo
282	0	->encryptedContent;
283
284	0	case NID_id_smime_ct_authData:
285	0	return &cms->d.authenticatedData->encapContentInfo->eContent;
286
287	0	case NID_id_smime_ct_compressedData:
288	0	return &cms->d.compressedData->encapContentInfo->eContent;
289
290	0	default:
291	0	if (cms->d.other->type == V_ASN1_OCTET_STRING)
292	0	return &cms->d.other->value.octet_string;
293	0	ERR_raise(ERR_LIB_CMS, CMS_R_UNSUPPORTED_CONTENT_TYPE);
294	0	return NULL;
295	0	}
296	0	}
297
298		/*
299		* Return an ASN1_OBJECT pointer to content type. This allows it to be
300		* accessed or set later.
301		*/
302
303		static ASN1_OBJECT *cms_get0_econtent_type(CMS_ContentInfo cms)
304	0	{
305	0	switch (OBJ_obj2nid(cms->contentType)) {
306
307	0	case NID_pkcs7_signed:
308	0	return &cms->d.signedData->encapContentInfo->eContentType;
309
310	0	case NID_pkcs7_enveloped:
311	0	return &cms->d.envelopedData->encryptedContentInfo->contentType;
312
313	0	case NID_pkcs7_digest:
314	0	return &cms->d.digestedData->encapContentInfo->eContentType;
315
316	0	case NID_pkcs7_encrypted:
317	0	return &cms->d.encryptedData->encryptedContentInfo->contentType;
318
319	0	case NID_id_smime_ct_authEnvelopedData:
320	0	return &cms->d.authEnvelopedData->authEncryptedContentInfo
321	0	->contentType;
322	0	case NID_id_smime_ct_authData:
323	0	return &cms->d.authenticatedData->encapContentInfo->eContentType;
324
325	0	case NID_id_smime_ct_compressedData:
326	0	return &cms->d.compressedData->encapContentInfo->eContentType;
327
328	0	default:
329	0	ERR_raise(ERR_LIB_CMS, CMS_R_UNSUPPORTED_CONTENT_TYPE);
330	0	return NULL;
331	0	}
332	0	}
333
334		const ASN1_OBJECT CMS_get0_eContentType(CMS_ContentInfo cms)
335	0	{
336	0	ASN1_OBJECT **petype;
337	0	petype = cms_get0_econtent_type(cms);
338	0	if (petype)
339	0	return *petype;
340	0	return NULL;
341	0	}
342
343		int CMS_set1_eContentType(CMS_ContentInfo cms, const ASN1_OBJECT oid)
344	0	{
345	0	ASN1_OBJECT *petype, etype;
346
347	0	petype = cms_get0_econtent_type(cms);
348	0	if (petype == NULL)
349	0	return 0;
350	0	if (oid == NULL)
351	0	return 1;
352	0	etype = OBJ_dup(oid);
353	0	if (etype == NULL)
354	0	return 0;
355	0	ASN1_OBJECT_free(*petype);
356	0	*petype = etype;
357	0	return 1;
358	0	}
359
360		int CMS_is_detached(CMS_ContentInfo *cms)
361	0	{
362	0	ASN1_OCTET_STRING **pos;
363
364	0	pos = CMS_get0_content(cms);
365	0	if (pos == NULL)
366	0	return -1;
367	0	if (*pos != NULL)
368	0	return 0;
369	0	return 1;
370	0	}
371
372		int CMS_set_detached(CMS_ContentInfo *cms, int detached)
373	0	{
374	0	ASN1_OCTET_STRING **pos;
375
376	0	pos = CMS_get0_content(cms);
377	0	if (pos == NULL)
378	0	return 0;
379	0	if (detached) {
380	0	ASN1_OCTET_STRING_free(*pos);
381	0	*pos = NULL;
382	0	return 1;
383	0	}
384	0	if (*pos == NULL)
385	0	*pos = ASN1_OCTET_STRING_new();
386	0	if (*pos != NULL) {
387		/*
388		* NB: special flag to show content is created and not read in.
389		*/
390	0	(*pos)->flags \|= ASN1_STRING_FLAG_CONT;
391	0	return 1;
392	0	}
393	0	ERR_raise(ERR_LIB_CMS, ERR_R_ASN1_LIB);
394	0	return 0;
395	0	}
396
397		/* Create a digest BIO from an X509_ALGOR structure */
398
399		BIO ossl_cms_DigestAlgorithm_init_bio(X509_ALGOR digestAlgorithm,
400		const CMS_CTX *ctx)
401	0	{
402	0	BIO *mdbio = NULL;
403	0	const ASN1_OBJECT *digestoid;
404	0	const EVP_MD *digest = NULL;
405	0	EVP_MD *fetched_digest = NULL;
406	0	char alg[OSSL_MAX_NAME_SIZE];
407
408	0	X509_ALGOR_get0(&digestoid, NULL, NULL, digestAlgorithm);
409	0	OBJ_obj2txt(alg, sizeof(alg), digestoid, 0);
410
411	0	(void)ERR_set_mark();
412	0	fetched_digest = EVP_MD_fetch(ossl_cms_ctx_get0_libctx(ctx), alg,
413	0	ossl_cms_ctx_get0_propq(ctx));
414
415	0	if (fetched_digest != NULL)
416	0	digest = fetched_digest;
417	0	else
418	0	digest = EVP_get_digestbyobj(digestoid);
419	0	if (digest == NULL) {
420	0	(void)ERR_clear_last_mark();
421	0	ERR_raise(ERR_LIB_CMS, CMS_R_UNKNOWN_DIGEST_ALGORITHM);
422	0	goto err;
423	0	}
424	0	(void)ERR_pop_to_mark();
425
426	0	mdbio = BIO_new(BIO_f_md());
427	0	if (mdbio == NULL \|\| BIO_set_md(mdbio, digest) <= 0) {
428	0	ERR_raise(ERR_LIB_CMS, CMS_R_MD_BIO_INIT_ERROR);
429	0	goto err;
430	0	}
431	0	EVP_MD_free(fetched_digest);
432	0	return mdbio;
433	0	err:
434	0	EVP_MD_free(fetched_digest);
435	0	BIO_free(mdbio);
436	0	return NULL;
437	0	}
438
439		/* Locate a message digest content from a BIO chain based on SignerInfo */
440
441		int ossl_cms_DigestAlgorithm_find_ctx(EVP_MD_CTX mctx, BIO chain,
442		X509_ALGOR *mdalg)
443	0	{
444	0	int nid;
445	0	const ASN1_OBJECT *mdoid;
446	0	X509_ALGOR_get0(&mdoid, NULL, NULL, mdalg);
447	0	nid = OBJ_obj2nid(mdoid);
448		/* Look for digest type to match signature */
449	0	for (;;) {
450	0	EVP_MD_CTX *mtmp;
451	0	chain = BIO_find_type(chain, BIO_TYPE_MD);
452	0	if (chain == NULL) {
453	0	ERR_raise(ERR_LIB_CMS, CMS_R_NO_MATCHING_DIGEST);
454	0	return 0;
455	0	}
456	0	BIO_get_md_ctx(chain, &mtmp);
457	0	if (EVP_MD_CTX_get_type(mtmp) == nid
458		/*
459		* Workaround for broken implementations that use signature
460		* algorithm OID instead of digest.
461		*/
462	0	\|\| EVP_MD_get_pkey_type(EVP_MD_CTX_get0_md(mtmp)) == nid)
463	0	return EVP_MD_CTX_copy_ex(mctx, mtmp);
464	0	chain = BIO_next(chain);
465	0	}
466	0	}
467
468		static STACK_OF(CMS_CertificateChoices)
469		**
470		cms_get0_certificate_choices(CMS_ContentInfo *cms)
471	6.73k	{
472	6.73k	switch (OBJ_obj2nid(cms->contentType)) {
473
474	1.58k	case NID_pkcs7_signed:
475	1.58k	return &cms->d.signedData->certificates;
476
477	2.48k	case NID_pkcs7_enveloped:
478	2.48k	if (cms->d.envelopedData->originatorInfo == NULL)
479	2.47k	return NULL;
480	6	return &cms->d.envelopedData->originatorInfo->certificates;
481
482	0	case NID_id_smime_ct_authEnvelopedData:
483	0	if (cms->d.authEnvelopedData->originatorInfo == NULL)
484	0	return NULL;
485	0	return &cms->d.authEnvelopedData->originatorInfo->certificates;
486
487	2.67k	default:
488	2.67k	ERR_raise(ERR_LIB_CMS, CMS_R_UNSUPPORTED_CONTENT_TYPE);
489	2.67k	return NULL;
490	6.73k	}
491	6.73k	}
492
493		CMS_CertificateChoices CMS_add0_CertificateChoices(CMS_ContentInfo cms)
494	0	{
495	0	STACK_OF(CMS_CertificateChoices) **pcerts;
496	0	CMS_CertificateChoices *cch;
497
498	0	pcerts = cms_get0_certificate_choices(cms);
499	0	if (pcerts == NULL)
500	0	return NULL;
501	0	if (*pcerts == NULL)
502	0	*pcerts = sk_CMS_CertificateChoices_new_null();
503	0	if (*pcerts == NULL)
504	0	return NULL;
505	0	cch = M_ASN1_new_of(CMS_CertificateChoices);
506	0	if (!cch)
507	0	return NULL;
508	0	if (!sk_CMS_CertificateChoices_push(*pcerts, cch)) {
509	0	M_ASN1_free_of(cch, CMS_CertificateChoices);
510	0	return NULL;
511	0	}
512	0	return cch;
513	0	}
514
515		int CMS_add0_cert(CMS_ContentInfo cms, X509 cert)
516	0	{
517	0	CMS_CertificateChoices *cch;
518	0	STACK_OF(CMS_CertificateChoices) **pcerts;
519	0	int i;
520
521	0	pcerts = cms_get0_certificate_choices(cms);
522	0	if (pcerts == NULL)
523	0	return 0;
524	0	for (i = 0; i < sk_CMS_CertificateChoices_num(*pcerts); i++) {
525	0	cch = sk_CMS_CertificateChoices_value(*pcerts, i);
526	0	if (cch->type == CMS_CERTCHOICE_CERT) {
527	0	if (X509_cmp(cch->d.certificate, cert) == 0) {
528	0	X509_free(cert);
529	0	return 1; /* cert already present */
530	0	}
531	0	}
532	0	}
533	0	cch = CMS_add0_CertificateChoices(cms);
534	0	if (!cch)
535	0	return 0;
536	0	cch->type = CMS_CERTCHOICE_CERT;
537	0	cch->d.certificate = cert;
538	0	return 1;
539	0	}
540
541		int CMS_add1_cert(CMS_ContentInfo cms, X509 cert)
542	0	{
543	0	if (!X509_up_ref(cert))
544	0	return 0;
545	0	if (CMS_add0_cert(cms, cert))
546	0	return 1;
547	0	X509_free(cert);
548	0	return 0;
549	0	}
550
551		static STACK_OF(CMS_RevocationInfoChoice)
552		**
553		cms_get0_revocation_choices(CMS_ContentInfo *cms)
554	0	{
555	0	switch (OBJ_obj2nid(cms->contentType)) {
556
557	0	case NID_pkcs7_signed:
558	0	return &cms->d.signedData->crls;
559
560	0	case NID_pkcs7_enveloped:
561	0	if (cms->d.envelopedData->originatorInfo == NULL)
562	0	return NULL;
563	0	return &cms->d.envelopedData->originatorInfo->crls;
564
565	0	case NID_id_smime_ct_authEnvelopedData:
566	0	if (cms->d.authEnvelopedData->originatorInfo == NULL)
567	0	return NULL;
568	0	return &cms->d.authEnvelopedData->originatorInfo->crls;
569
570	0	default:
571	0	ERR_raise(ERR_LIB_CMS, CMS_R_UNSUPPORTED_CONTENT_TYPE);
572	0	return NULL;
573	0	}
574	0	}
575
576		CMS_RevocationInfoChoice CMS_add0_RevocationInfoChoice(CMS_ContentInfo cms)
577	0	{
578	0	STACK_OF(CMS_RevocationInfoChoice) **pcrls;
579	0	CMS_RevocationInfoChoice *rch;
580
581	0	pcrls = cms_get0_revocation_choices(cms);
582	0	if (pcrls == NULL)
583	0	return NULL;
584	0	if (*pcrls == NULL)
585	0	*pcrls = sk_CMS_RevocationInfoChoice_new_null();
586	0	if (*pcrls == NULL)
587	0	return NULL;
588	0	rch = M_ASN1_new_of(CMS_RevocationInfoChoice);
589	0	if (rch == NULL)
590	0	return NULL;
591	0	if (!sk_CMS_RevocationInfoChoice_push(*pcrls, rch)) {
592	0	M_ASN1_free_of(rch, CMS_RevocationInfoChoice);
593	0	return NULL;
594	0	}
595	0	return rch;
596	0	}
597
598		int CMS_add0_crl(CMS_ContentInfo cms, X509_CRL crl)
599	0	{
600	0	CMS_RevocationInfoChoice *rch = CMS_add0_RevocationInfoChoice(cms);
601
602	0	if (rch == NULL)
603	0	return 0;
604	0	rch->type = CMS_REVCHOICE_CRL;
605	0	rch->d.crl = crl;
606	0	return 1;
607	0	}
608
609		int CMS_add1_crl(CMS_ContentInfo cms, X509_CRL crl)
610	0	{
611	0	if (!X509_CRL_up_ref(crl))
612	0	return 0;
613	0	if (CMS_add0_crl(cms, crl))
614	0	return 1;
615	0	X509_CRL_free(crl);
616	0	return 0;
617	0	}
618
619		STACK_OF(X509) CMS_get1_certs(CMS_ContentInfo cms)
620	0	{
621	0	STACK_OF(X509) *certs = NULL;
622
623	0	if (!ossl_cms_get1_certs_ex(cms, &certs))
624	0	return NULL;
625	0	if (sk_X509_num(certs) == 0) {
626	0	sk_X509_free(certs);
627	0	return NULL;
628	0	}
629	0	return certs;
630	0	}
631
632		int ossl_cms_get1_certs_ex(CMS_ContentInfo cms, STACK_OF(X509) *certs)
633	0	{
634	0	CMS_CertificateChoices *cch;
635	0	STACK_OF(CMS_CertificateChoices) **pcerts;
636	0	int i, n;
637
638	0	if (certs == NULL)
639	0	return 0;
640	0	*certs = NULL;
641	0	pcerts = cms_get0_certificate_choices(cms);
642	0	if (pcerts == NULL)
643	0	return 0;
644
645		/* make sure to return NULL certs only on error /
646	0	n = sk_CMS_CertificateChoices_num(*pcerts);
647	0	if ((*certs = sk_X509_new_reserve(NULL, n)) == NULL)
648	0	return 0;
649
650	0	for (i = 0; i < n; i++) {
651	0	cch = sk_CMS_CertificateChoices_value(*pcerts, i);
652	0	if (cch->type == 0) {
653	0	if (!X509_add_cert(*certs, cch->d.certificate,
654	0	X509_ADD_FLAG_UP_REF)) {
655	0	OSSL_STACK_OF_X509_free(*certs);
656	0	*certs = NULL;
657	0	return 0;
658	0	}
659	0	}
660	0	}
661	0	return 1;
662	0	}
663
664		STACK_OF(X509_CRL) CMS_get1_crls(CMS_ContentInfo cms)
665	0	{
666	0	STACK_OF(X509_CRL) *crls = NULL;
667
668	0	if (!ossl_cms_get1_crls_ex(cms, &crls))
669	0	return NULL;
670	0	if (sk_X509_CRL_num(crls) == 0) {
671	0	sk_X509_CRL_free(crls);
672	0	return NULL;
673	0	}
674	0	return crls;
675	0	}
676
677		int ossl_cms_get1_crls_ex(CMS_ContentInfo cms, STACK_OF(X509_CRL) *crls)
678	0	{
679	0	STACK_OF(CMS_RevocationInfoChoice) **pcrls;
680	0	CMS_RevocationInfoChoice *rch;
681	0	int i, n;
682
683	0	if (crls == NULL)
684	0	return 0;
685	0	*crls = NULL;
686	0	pcrls = cms_get0_revocation_choices(cms);
687	0	if (pcrls == NULL)
688	0	return 0;
689
690		/* make sure to return NULL crls only on error /
691	0	n = sk_CMS_RevocationInfoChoice_num(*pcrls);
692	0	if ((*crls = sk_X509_CRL_new_reserve(NULL, n)) == NULL)
693	0	return 0;
694
695	0	for (i = 0; i < n; i++) {
696	0	rch = sk_CMS_RevocationInfoChoice_value(*pcrls, i);
697	0	if (rch->type == 0) {
698	0	if (!X509_CRL_up_ref(rch->d.crl)
699	0	\|\| !ossl_assert(sk_X509_CRL_push(*crls, rch->d.crl))) {
700		/* push cannot fail on reserved stack */
701	0	sk_X509_CRL_pop_free(*crls, X509_CRL_free);
702	0	*crls = NULL;
703	0	return 0;
704	0	}
705	0	}
706	0	}
707	0	return 1;
708	0	}
709
710		int ossl_cms_ias_cert_cmp(CMS_IssuerAndSerialNumber ias, X509 cert)
711	0	{
712	0	int ret;
713	0	ret = X509_NAME_cmp(ias->issuer, X509_get_issuer_name(cert));
714	0	if (ret)
715	0	return ret;
716	0	return ASN1_INTEGER_cmp(ias->serialNumber, X509_get0_serialNumber(cert));
717	0	}
718
719		int ossl_cms_keyid_cert_cmp(ASN1_OCTET_STRING keyid, X509 cert)
720	0	{
721	0	const ASN1_OCTET_STRING *cert_keyid = X509_get0_subject_key_id(cert);
722
723	0	if (cert_keyid == NULL)
724	0	return -1;
725	0	return ASN1_OCTET_STRING_cmp(keyid, cert_keyid);
726	0	}
727
728		int ossl_cms_set1_ias(CMS_IssuerAndSerialNumber *pias, X509 cert)
729	0	{
730	0	CMS_IssuerAndSerialNumber *ias;
731	0	ias = M_ASN1_new_of(CMS_IssuerAndSerialNumber);
732	0	if (!ias) {
733	0	ERR_raise(ERR_LIB_CMS, ERR_R_ASN1_LIB);
734	0	goto err;
735	0	}
736	0	if (!X509_NAME_set(&ias->issuer, X509_get_issuer_name(cert))) {
737	0	ERR_raise(ERR_LIB_CMS, ERR_R_X509_LIB);
738	0	goto err;
739	0	}
740	0	if (!ASN1_STRING_copy(ias->serialNumber, X509_get0_serialNumber(cert))) {
741	0	ERR_raise(ERR_LIB_CMS, ERR_R_ASN1_LIB);
742	0	goto err;
743	0	}
744	0	M_ASN1_free_of(*pias, CMS_IssuerAndSerialNumber);
745	0	*pias = ias;
746	0	return 1;
747	0	err:
748	0	M_ASN1_free_of(ias, CMS_IssuerAndSerialNumber);
749	0	return 0;
750	0	}
751
752		int ossl_cms_set1_keyid(ASN1_OCTET_STRING *pkeyid, X509 cert)
753	0	{
754	0	ASN1_OCTET_STRING *keyid = NULL;
755	0	const ASN1_OCTET_STRING *cert_keyid;
756	0	cert_keyid = X509_get0_subject_key_id(cert);
757	0	if (cert_keyid == NULL) {
758	0	ERR_raise(ERR_LIB_CMS, CMS_R_CERTIFICATE_HAS_NO_KEYID);
759	0	return 0;
760	0	}
761	0	keyid = ASN1_STRING_dup(cert_keyid);
762	0	if (!keyid) {
763	0	ERR_raise(ERR_LIB_CMS, ERR_R_ASN1_LIB);
764	0	return 0;
765	0	}
766	0	ASN1_OCTET_STRING_free(*pkeyid);
767	0	*pkeyid = keyid;
768	0	return 1;
769	0	}