Robert Sloan | 9254e68 | 2017-04-24 09:42:06 -0700 | [diff] [blame] | 1 | /* Copyright (c) 2014, Google Inc. |
| 2 | * |
| 3 | * Permission to use, copy, modify, and/or distribute this software for any |
| 4 | * purpose with or without fee is hereby granted, provided that the above |
| 5 | * copyright notice and this permission notice appear in all copies. |
| 6 | * |
| 7 | * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES |
| 8 | * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF |
| 9 | * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY |
| 10 | * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES |
| 11 | * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION |
| 12 | * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN |
| 13 | * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ |
| 14 | |
| 15 | #include <openssl/pkcs7.h> |
| 16 | |
| 17 | #include <openssl/bytestring.h> |
| 18 | #include <openssl/err.h> |
| 19 | #include <openssl/mem.h> |
| 20 | #include <openssl/pool.h> |
| 21 | #include <openssl/stack.h> |
| 22 | |
| 23 | #include "internal.h" |
| 24 | #include "../bytestring/internal.h" |
| 25 | |
| 26 | |
Robert Sloan | 8f860b1 | 2017-08-28 07:37:06 -0700 | [diff] [blame] | 27 | // 1.2.840.113549.1.7.1 |
Robert Sloan | 9254e68 | 2017-04-24 09:42:06 -0700 | [diff] [blame] | 28 | static const uint8_t kPKCS7Data[] = {0x2a, 0x86, 0x48, 0x86, 0xf7, |
| 29 | 0x0d, 0x01, 0x07, 0x01}; |
| 30 | |
Robert Sloan | 8f860b1 | 2017-08-28 07:37:06 -0700 | [diff] [blame] | 31 | // 1.2.840.113549.1.7.2 |
Robert Sloan | 9254e68 | 2017-04-24 09:42:06 -0700 | [diff] [blame] | 32 | static const uint8_t kPKCS7SignedData[] = {0x2a, 0x86, 0x48, 0x86, 0xf7, |
| 33 | 0x0d, 0x01, 0x07, 0x02}; |
| 34 | |
Robert Sloan | 8f860b1 | 2017-08-28 07:37:06 -0700 | [diff] [blame] | 35 | // pkcs7_parse_header reads the non-certificate/non-CRL prefix of a PKCS#7 |
| 36 | // SignedData blob from |cbs| and sets |*out| to point to the rest of the |
| 37 | // input. If the input is in BER format, then |*der_bytes| will be set to a |
| 38 | // pointer that needs to be freed by the caller once they have finished |
| 39 | // processing |*out| (which will be pointing into |*der_bytes|). |
| 40 | // |
| 41 | // It returns one on success or zero on error. On error, |*der_bytes| is |
| 42 | // NULL. |
Robert Sloan | 9254e68 | 2017-04-24 09:42:06 -0700 | [diff] [blame] | 43 | int pkcs7_parse_header(uint8_t **der_bytes, CBS *out, CBS *cbs) { |
Robert Sloan | 9254e68 | 2017-04-24 09:42:06 -0700 | [diff] [blame] | 44 | CBS in, content_info, content_type, wrapped_signed_data, signed_data; |
| 45 | uint64_t version; |
| 46 | |
Robert Sloan | 8f860b1 | 2017-08-28 07:37:06 -0700 | [diff] [blame] | 47 | // The input may be in BER format. |
Robert Sloan | 9254e68 | 2017-04-24 09:42:06 -0700 | [diff] [blame] | 48 | *der_bytes = NULL; |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 49 | if (!CBS_asn1_ber_to_der(cbs, &in, der_bytes) || |
| 50 | // See https://tools.ietf.org/html/rfc2315#section-7 |
| 51 | !CBS_get_asn1(&in, &content_info, CBS_ASN1_SEQUENCE) || |
Robert Sloan | 9254e68 | 2017-04-24 09:42:06 -0700 | [diff] [blame] | 52 | !CBS_get_asn1(&content_info, &content_type, CBS_ASN1_OBJECT)) { |
| 53 | goto err; |
| 54 | } |
| 55 | |
| 56 | if (!CBS_mem_equal(&content_type, kPKCS7SignedData, |
| 57 | sizeof(kPKCS7SignedData))) { |
| 58 | OPENSSL_PUT_ERROR(PKCS7, PKCS7_R_NOT_PKCS7_SIGNED_DATA); |
| 59 | goto err; |
| 60 | } |
| 61 | |
Robert Sloan | 8f860b1 | 2017-08-28 07:37:06 -0700 | [diff] [blame] | 62 | // See https://tools.ietf.org/html/rfc2315#section-9.1 |
Robert Sloan | 9254e68 | 2017-04-24 09:42:06 -0700 | [diff] [blame] | 63 | if (!CBS_get_asn1(&content_info, &wrapped_signed_data, |
| 64 | CBS_ASN1_CONTEXT_SPECIFIC | CBS_ASN1_CONSTRUCTED | 0) || |
| 65 | !CBS_get_asn1(&wrapped_signed_data, &signed_data, CBS_ASN1_SEQUENCE) || |
| 66 | !CBS_get_asn1_uint64(&signed_data, &version) || |
| 67 | !CBS_get_asn1(&signed_data, NULL /* digests */, CBS_ASN1_SET) || |
| 68 | !CBS_get_asn1(&signed_data, NULL /* content */, CBS_ASN1_SEQUENCE)) { |
| 69 | goto err; |
| 70 | } |
| 71 | |
| 72 | if (version < 1) { |
| 73 | OPENSSL_PUT_ERROR(PKCS7, PKCS7_R_BAD_PKCS7_VERSION); |
| 74 | goto err; |
| 75 | } |
| 76 | |
| 77 | CBS_init(out, CBS_data(&signed_data), CBS_len(&signed_data)); |
| 78 | return 1; |
| 79 | |
| 80 | err: |
| 81 | OPENSSL_free(*der_bytes); |
| 82 | *der_bytes = NULL; |
| 83 | return 0; |
| 84 | } |
| 85 | |
| 86 | int PKCS7_get_raw_certificates(STACK_OF(CRYPTO_BUFFER) *out_certs, CBS *cbs, |
| 87 | CRYPTO_BUFFER_POOL *pool) { |
| 88 | CBS signed_data, certificates; |
| 89 | uint8_t *der_bytes = NULL; |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 90 | int ret = 0, has_certificates; |
Robert Sloan | 9254e68 | 2017-04-24 09:42:06 -0700 | [diff] [blame] | 91 | const size_t initial_certs_len = sk_CRYPTO_BUFFER_num(out_certs); |
| 92 | |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 93 | // See https://tools.ietf.org/html/rfc2315#section-9.1 |
| 94 | if (!pkcs7_parse_header(&der_bytes, &signed_data, cbs) || |
| 95 | !CBS_get_optional_asn1( |
| 96 | &signed_data, &certificates, &has_certificates, |
| 97 | CBS_ASN1_CONTEXT_SPECIFIC | CBS_ASN1_CONSTRUCTED | 0)) { |
| 98 | goto err; |
Robert Sloan | 9254e68 | 2017-04-24 09:42:06 -0700 | [diff] [blame] | 99 | } |
| 100 | |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 101 | if (!has_certificates) { |
| 102 | CBS_init(&certificates, NULL, 0); |
Robert Sloan | 9254e68 | 2017-04-24 09:42:06 -0700 | [diff] [blame] | 103 | } |
| 104 | |
| 105 | while (CBS_len(&certificates) > 0) { |
| 106 | CBS cert; |
| 107 | if (!CBS_get_asn1_element(&certificates, &cert, CBS_ASN1_SEQUENCE)) { |
| 108 | goto err; |
| 109 | } |
| 110 | |
| 111 | CRYPTO_BUFFER *buf = CRYPTO_BUFFER_new_from_CBS(&cert, pool); |
| 112 | if (buf == NULL || |
| 113 | !sk_CRYPTO_BUFFER_push(out_certs, buf)) { |
| 114 | CRYPTO_BUFFER_free(buf); |
| 115 | goto err; |
| 116 | } |
| 117 | } |
| 118 | |
| 119 | ret = 1; |
| 120 | |
| 121 | err: |
| 122 | OPENSSL_free(der_bytes); |
| 123 | |
| 124 | if (!ret) { |
| 125 | while (sk_CRYPTO_BUFFER_num(out_certs) != initial_certs_len) { |
| 126 | CRYPTO_BUFFER *buf = sk_CRYPTO_BUFFER_pop(out_certs); |
| 127 | CRYPTO_BUFFER_free(buf); |
| 128 | } |
| 129 | } |
| 130 | |
| 131 | return ret; |
| 132 | } |
| 133 | |
| 134 | int pkcs7_bundle(CBB *out, int (*cb)(CBB *out, const void *arg), |
| 135 | const void *arg) { |
| 136 | CBB outer_seq, oid, wrapped_seq, seq, version_bytes, digest_algos_set, |
Srinivas Paladugu | dd42a61 | 2019-08-09 19:30:39 +0000 | [diff] [blame^] | 137 | content_info; |
Robert Sloan | 9254e68 | 2017-04-24 09:42:06 -0700 | [diff] [blame] | 138 | |
Robert Sloan | 8f860b1 | 2017-08-28 07:37:06 -0700 | [diff] [blame] | 139 | // See https://tools.ietf.org/html/rfc2315#section-7 |
Robert Sloan | 9254e68 | 2017-04-24 09:42:06 -0700 | [diff] [blame] | 140 | if (!CBB_add_asn1(out, &outer_seq, CBS_ASN1_SEQUENCE) || |
| 141 | !CBB_add_asn1(&outer_seq, &oid, CBS_ASN1_OBJECT) || |
| 142 | !CBB_add_bytes(&oid, kPKCS7SignedData, sizeof(kPKCS7SignedData)) || |
| 143 | !CBB_add_asn1(&outer_seq, &wrapped_seq, |
| 144 | CBS_ASN1_CONTEXT_SPECIFIC | CBS_ASN1_CONSTRUCTED | 0) || |
Robert Sloan | 8f860b1 | 2017-08-28 07:37:06 -0700 | [diff] [blame] | 145 | // See https://tools.ietf.org/html/rfc2315#section-9.1 |
Robert Sloan | 9254e68 | 2017-04-24 09:42:06 -0700 | [diff] [blame] | 146 | !CBB_add_asn1(&wrapped_seq, &seq, CBS_ASN1_SEQUENCE) || |
| 147 | !CBB_add_asn1(&seq, &version_bytes, CBS_ASN1_INTEGER) || |
| 148 | !CBB_add_u8(&version_bytes, 1) || |
| 149 | !CBB_add_asn1(&seq, &digest_algos_set, CBS_ASN1_SET) || |
| 150 | !CBB_add_asn1(&seq, &content_info, CBS_ASN1_SEQUENCE) || |
| 151 | !CBB_add_asn1(&content_info, &oid, CBS_ASN1_OBJECT) || |
| 152 | !CBB_add_bytes(&oid, kPKCS7Data, sizeof(kPKCS7Data)) || |
Srinivas Paladugu | dd42a61 | 2019-08-09 19:30:39 +0000 | [diff] [blame^] | 153 | !cb(&seq, arg)) { |
Robert Sloan | 9254e68 | 2017-04-24 09:42:06 -0700 | [diff] [blame] | 154 | return 0; |
| 155 | } |
| 156 | |
| 157 | return CBB_flush(out); |
| 158 | } |