libsecurity_smime/lib/cmssigdata.c

   1 /*
   2  * The contents of this file are subject to the Mozilla Public
   3  * License Version 1.1 (the "License"); you may not use this file
   4  * except in compliance with the License. You may obtain a copy of
   5  * the License at http://www.mozilla.org/MPL/
   6  *
   7  * Software distributed under the License is distributed on an "AS
   8  * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
   9  * implied. See the License for the specific language governing
  10  * rights and limitations under the License.
  11  *
  12  * The Original Code is the Netscape security libraries.
  13  *
  14  * The Initial Developer of the Original Code is Netscape
  15  * Communications Corporation.  Portions created by Netscape are
  16  * Copyright (C) 1994-2000 Netscape Communications Corporation.  All
  17  * Rights Reserved.
  18  *
  19  * Contributor(s):
  20  *
  21  * Alternatively, the contents of this file may be used under the
  22  * terms of the GNU General Public License Version 2 or later (the
  23  * "GPL"), in which case the provisions of the GPL are applicable
  24  * instead of those above.  If you wish to allow use of your
  25  * version of this file only under the terms of the GPL and not to
  26  * allow others to use your version of this file under the MPL,
  27  * indicate your decision by deleting the provisions above and
  28  * replace them with the notice and other provisions required by
  29  * the GPL.  If you do not delete the provisions above, a recipient
  30  * may use your version of this file under either the MPL or the
  31  * GPL.
  32  */
  33
  34 /*
  35  * CMS signedData methods.
  36  */
  37
  38 #include <Security/SecCmsSignedData.h>
  39
  40 #include <Security/SecCmsContentInfo.h>
  41 #include <Security/SecCmsDigestContext.h>
  42 #include <Security/SecCmsSignerInfo.h>
  43
  44 #include "cmslocal.h"
  45
  46 #include "cert.h"
  47 #include "SecAsn1Item.h"
  48 #include "secoid.h"
  49
  50 #include <security_asn1/secasn1.h>
  51 #include <security_asn1/secerr.h>
  52 #include <security_asn1/secport.h>
  53
  54 #if !USE_CDSA_CRYPTO
  55 #include <Security/SecCertificatePriv.h>
  56 #endif
  57
  58 SecCmsSignedDataRef
  59 SecCmsSignedDataCreate(SecCmsMessageRef cmsg)
  60 {
  61     void *mark;
  62     SecCmsSignedDataRef sigd;
  63     PLArenaPool *poolp;
  64
  65     poolp = cmsg->poolp;
  66
  67     mark = PORT_ArenaMark(poolp);
  68
  69     sigd = (SecCmsSignedDataRef)PORT_ArenaZAlloc (poolp, sizeof(SecCmsSignedData));
  70     if (sigd == NULL)
  71         goto loser;
  72
  73     sigd->contentInfo.cmsg = cmsg;
  74
  75     /* signerInfos, certs, certlists, crls are all empty */
  76     /* version is set in SecCmsSignedDataFinalize() */
  77
  78     PORT_ArenaUnmark(poolp, mark);
  79     return sigd;
  80
  81 loser:
  82     PORT_ArenaRelease(poolp, mark);
  83     return NULL;
  84 }
  85
  86 void
  87 SecCmsSignedDataDestroy(SecCmsSignedDataRef sigd)
  88 {
  89     SecCmsSignerInfoRef *signerinfos, si;
  90
  91     if (sigd == NULL)
  92         return;
  93
  94     if (sigd->certs != NULL)
  95         CFRelease(sigd->certs);
  96
  97     signerinfos = sigd->signerInfos;
  98     if (signerinfos != NULL) {
  99         while ((si = *signerinfos++) != NULL)
 100             SecCmsSignerInfoDestroy(si);
 101     }
 102
 103     /* everything's in a pool, so don't worry about the storage */
 104    SecCmsContentInfoDestroy(&(sigd->contentInfo));
 105 }
 106
 107 /*
 108  * SecCmsSignedDataEncodeBeforeStart - do all the necessary things to a SignedData
 109  *     before start of encoding.
 110  *
 111  * In detail:
 112  *  - find out about the right value to put into sigd->version
 113  *  - come up with a list of digestAlgorithms (which should be the union of the algorithms
 114  *         in the signerinfos).
 115  *         If we happen to have a pre-set list of algorithms (and digest values!), we
 116  *         check if we have all the signerinfos' algorithms. If not, this is an error.
 117  */
 118 OSStatus
 119 SecCmsSignedDataEncodeBeforeStart(SecCmsSignedDataRef sigd)
 120 {
 121     SecCmsSignerInfoRef signerinfo;
 122     SECOidTag digestalgtag;
 123     SecAsn1Item * dummy;
 124     int version;
 125     OSStatus rv;
 126     Boolean haveDigests = PR_FALSE;
 127     int n, i;
 128     PLArenaPool *poolp;
 129
 130     poolp = sigd->contentInfo.cmsg->poolp;
 131
 132     /* we assume that we have precomputed digests if there is a list of algorithms, and */
 133     /* a chunk of data for each of those algorithms */
 134     if (sigd->digestAlgorithms != NULL && sigd->digests != NULL) {
 135         for (i=0; sigd->digestAlgorithms[i] != NULL; i++) {
 136             if (sigd->digests[i] == NULL)
 137                 break;
 138         }
 139         if (sigd->digestAlgorithms[i] == NULL)  /* reached the end of the array? */
 140             haveDigests = PR_TRUE;              /* yes: we must have all the digests */
 141     }
 142
 143     version = SEC_CMS_SIGNED_DATA_VERSION_BASIC;
 144
 145     /* RFC2630 5.1 "version is the syntax version number..." */
 146     if (SecCmsContentInfoGetContentTypeTag(&(sigd->contentInfo)) != SEC_OID_PKCS7_DATA)
 147         version = SEC_CMS_SIGNED_DATA_VERSION_EXT;
 148
 149     /* prepare all the SignerInfos (there may be none) */
 150     for (i=0; i < SecCmsSignedDataSignerInfoCount(sigd); i++) {
 151         signerinfo = SecCmsSignedDataGetSignerInfo(sigd, i);
 152
 153         /* RFC2630 5.1 "version is the syntax version number..." */
 154         if (SecCmsSignerInfoGetVersion(signerinfo) != SEC_CMS_SIGNER_INFO_VERSION_ISSUERSN)
 155             version = SEC_CMS_SIGNED_DATA_VERSION_EXT;
 156
 157         /* collect digestAlgorithms from SignerInfos */
 158         /* (we need to know which algorithms we have when the content comes in) */
 159         /* do not overwrite any existing digestAlgorithms (and digest) */
 160         digestalgtag = SecCmsSignerInfoGetDigestAlgTag(signerinfo);
 161         n = SecCmsAlgArrayGetIndexByAlgTag(sigd->digestAlgorithms, digestalgtag);
 162         if (n < 0 && haveDigests) {
 163             /* oops, there is a digestalg we do not have a digest for */
 164             /* but we were supposed to have all the digests already... */
 165             goto loser;
 166         } else if (n < 0) {
 167             /* add the digestAlgorithm & a NULL digest */
 168             rv = SecCmsSignedDataAddDigest(poolp, sigd, digestalgtag, NULL);
 169             if (rv != SECSuccess)
 170                 goto loser;
 171         } else {
 172             /* found it, nothing to do */
 173         }
 174     }
 175
 176     dummy = SEC_ASN1EncodeInteger(poolp, &(sigd->version), (long)version);
 177     if (dummy == NULL)
 178         return SECFailure;
 179
 180     /* this is a SET OF, so we need to sort them guys */
 181     rv = SecCmsArraySortByDER((void **)sigd->digestAlgorithms,
 182                                 SEC_ASN1_GET(SECOID_AlgorithmIDTemplate),
 183                                 (void **)sigd->digests);
 184     if (rv != SECSuccess)
 185         return SECFailure;
 186
 187     return SECSuccess;
 188
 189 loser:
 190     return SECFailure;
 191 }
 192
 193 OSStatus
 194 SecCmsSignedDataEncodeBeforeData(SecCmsSignedDataRef sigd)
 195 {
 196     /* set up the digests */
 197     if (sigd->digestAlgorithms != NULL) {
 198         sigd->contentInfo.digcx = SecCmsDigestContextStartMultiple(sigd->digestAlgorithms);
 199         if (sigd->contentInfo.digcx == NULL)
 200             return SECFailure;
 201     }
 202     return SECSuccess;
 203 }
 204
 205 /*
 206  * SecCmsSignedDataEncodeAfterData - do all the necessary things to a SignedData
 207  *     after all the encapsulated data was passed through the encoder.
 208  *
 209  * In detail:
 210  *  - create the signatures in all the SignerInfos
 211  *
 212  * Please note that nothing is done to the Certificates and CRLs in the message - this
 213  * is entirely the responsibility of our callers.
 214  */
 215 OSStatus
 216 SecCmsSignedDataEncodeAfterData(SecCmsSignedDataRef sigd)
 217 {
 218     SecCmsSignerInfoRef *signerinfos, signerinfo;
 219     SecCmsContentInfoRef cinfo;
 220     SECOidTag digestalgtag;
 221     OSStatus ret = SECFailure;
 222     OSStatus rv;
 223     SecAsn1Item * contentType;
 224     CFIndex certcount;
 225     int i, ci, n, rci, si;
 226     PLArenaPool *poolp;
 227     CFArrayRef certlist;
 228     extern const SecAsn1Template SecCmsSignerInfoTemplate[];
 229
 230     cinfo = &(sigd->contentInfo);
 231     poolp = cinfo->cmsg->poolp;
 232
 233     /* did we have digest calculation going on? */
 234     if (cinfo->digcx) {
 235         SecAsn1Item **digests = NULL;
 236         SECAlgorithmID **digestalgs = NULL;
 237         rv = SecCmsDigestContextFinishMultiple(cinfo->digcx, &digestalgs, &digests);
 238         if (rv != SECSuccess)
 239             goto loser;         /* error has been set by SecCmsDigestContextFinishMultiple */
 240         if (digestalgs && digests) {
 241             rv = SecCmsSignedDataSetDigests(sigd, digestalgs, digests);
 242             if (rv != SECSuccess)
 243                 goto loser;             /* error has been set by SecCmsSignedDataSetDigests */
 244         }
 245         SecCmsDigestContextDestroy(cinfo->digcx);
 246         cinfo->digcx = NULL;
 247     }
 248
 249     signerinfos = sigd->signerInfos;
 250     certcount = 0;
 251
 252     /* prepare all the SignerInfos (there may be none) */
 253     for (i=0; i < SecCmsSignedDataSignerInfoCount(sigd); i++) {
 254         signerinfo = SecCmsSignedDataGetSignerInfo(sigd, i);
 255
 256         /* find correct digest for this signerinfo */
 257         digestalgtag = SecCmsSignerInfoGetDigestAlgTag(signerinfo);
 258         n = SecCmsAlgArrayGetIndexByAlgTag(sigd->digestAlgorithms, digestalgtag);
 259         if (n < 0 || sigd->digests == NULL || sigd->digests[n] == NULL) {
 260             /* oops - digest not found */
 261             PORT_SetError(SEC_ERROR_DIGEST_NOT_FOUND);
 262             goto loser;
 263         }
 264
 265         /* XXX if our content is anything else but data, we need to force the
 266          * presence of signed attributes (RFC2630 5.3 "signedAttributes is a
 267          * collection...") */
 268
 269         /* pass contentType here as we want a contentType attribute */
 270         if ((contentType = SecCmsContentInfoGetContentTypeOID(cinfo)) == NULL)
 271             goto loser;
 272
 273         /* sign the thing */
 274         rv = SecCmsSignerInfoSign(signerinfo, sigd->digests[n], contentType);
 275         if (rv != SECSuccess)
 276             goto loser;
 277
 278         /* while we're at it, count number of certs in certLists */
 279         certlist = SecCmsSignerInfoGetCertList(signerinfo);
 280         if (certlist)
 281             certcount += CFArrayGetCount(certlist);
 282     }
 283
 284     /* this is a SET OF, so we need to sort them guys */
 285     rv = SecCmsArraySortByDER((void **)signerinfos, SecCmsSignerInfoTemplate, NULL);
 286     if (rv != SECSuccess)
 287         goto loser;
 288
 289     /*
 290      * now prepare certs & crls
 291      */
 292
 293     /* count the rest of the certs */
 294     if (sigd->certs != NULL)
 295         certcount += CFArrayGetCount(sigd->certs);
 296
 297     if (certcount == 0) {
 298         sigd->rawCerts = NULL;
 299     } else {
 300         /*
 301          * Combine all of the certs and cert chains into rawcerts.
 302          * Note: certcount is an upper bound; we may not need that many slots
 303          * but we will allocate anyway to avoid having to do another pass.
 304          * (The temporary space saving is not worth it.)
 305          *
 306          * XXX ARGH - this NEEDS to be fixed. need to come up with a decent
 307          *  SetOfDERcertficates implementation
 308          */
 309         sigd->rawCerts = (SecAsn1Item * *)PORT_ArenaAlloc(poolp, (certcount + 1) * sizeof(SecAsn1Item *));
 310         if (sigd->rawCerts == NULL)
 311             return SECFailure;
 312
 313         /*
 314          * XXX Want to check for duplicates and not add *any* cert that is
 315          * already in the set.  This will be more important when we start
 316          * dealing with larger sets of certs, dual-key certs (signing and
 317          * encryption), etc.  For the time being we can slide by...
 318          *
 319          * XXX ARGH - this NEEDS to be fixed. need to come up with a decent
 320          *  SetOfDERcertficates implementation
 321          */
 322         rci = 0;
 323         if (signerinfos != NULL) {
 324             for (si = 0; signerinfos[si] != NULL; si++) {
 325                 signerinfo = signerinfos[si];
 326                 for (ci = 0; ci < CFArrayGetCount(signerinfo->certList); ci++) {
 327                     sigd->rawCerts[rci] = PORT_ArenaZAlloc(poolp, sizeof(SecAsn1Item));
 328                     SecCertificateRef cert = (SecCertificateRef)CFArrayGetValueAtIndex(signerinfo->certList, ci);
 329 #if USE_CDSA_CRYPTO
 330                     SecCertificateGetData(cert, sigd->rawCerts[rci++]);
 331 #else
 332                     SecAsn1Item cert_data = { SecCertificateGetLength(cert),
 333                         (uint8_t *)SecCertificateGetBytePtr(cert) };
 334                     *(sigd->rawCerts[rci++]) = cert_data;
 335 #endif
 336                 }
 337             }
 338         }
 339
 340         if (sigd->certs != NULL) {
 341             for (ci = 0; ci < CFArrayGetCount(sigd->certs); ci++) {
 342                 sigd->rawCerts[rci] = PORT_ArenaZAlloc(poolp, sizeof(SecAsn1Item));
 343                 SecCertificateRef cert = (SecCertificateRef)CFArrayGetValueAtIndex(sigd->certs, ci);
 344 #if USE_CDSA_CRYPTO
 345                 SecCertificateGetData(cert, sigd->rawCerts[rci++]);
 346 #else
 347                     SecAsn1Item cert_data = { SecCertificateGetLength(cert),
 348                         (uint8_t *)SecCertificateGetBytePtr(cert) };
 349                     *(sigd->rawCerts[rci++]) = cert_data;
 350 #endif
 351             }
 352         }
 353
 354         sigd->rawCerts[rci] = NULL;
 355
 356         /* this is a SET OF, so we need to sort them guys - we have the DER already, though */
 357         SecCmsArraySort((void **)sigd->rawCerts, SecCmsUtilDERCompare, NULL, NULL);
 358     }
 359
 360     ret = SECSuccess;
 361
 362 loser:
 363     return ret;
 364 }
 365
 366 OSStatus
 367 SecCmsSignedDataDecodeBeforeData(SecCmsSignedDataRef sigd)
 368 {
 369     /* set up the digests, if we have digest algorithms, no digests yet, and content is attached */
 370     if (sigd->digestAlgorithms != NULL && sigd->digests == NULL /* && sigd->contentInfo.content.pointer != NULL*/) {
 371         /* if digests are already there, do nothing */
 372         sigd->contentInfo.digcx = SecCmsDigestContextStartMultiple(sigd->digestAlgorithms);
 373         if (sigd->contentInfo.digcx == NULL)
 374             return SECFailure;
 375     }
 376     return SECSuccess;
 377 }
 378
 379 /*
 380  * SecCmsSignedDataDecodeAfterData - do all the necessary things to a SignedData
 381  *     after all the encapsulated data was passed through the decoder.
 382  */
 383 OSStatus
 384 SecCmsSignedDataDecodeAfterData(SecCmsSignedDataRef sigd)
 385 {
 386     OSStatus rv = SECSuccess;
 387
 388     /* did we have digest calculation going on? */
 389     if (sigd->contentInfo.digcx) {
 390         /* @@@ we should see if data was absent vs. zero length */
 391         if (sigd->contentInfo.content.data && sigd->contentInfo.content.data->Length) {
 392             SecAsn1Item * *digests = NULL;
 393             SECAlgorithmID **digestalgs = NULL;
 394             rv = SecCmsDigestContextFinishMultiple(sigd->contentInfo.digcx, &digestalgs, &digests);
 395             if (rv != SECSuccess)
 396                 goto loser;             /* error has been set by SecCmsDigestContextFinishMultiple */
 397             rv = SecCmsSignedDataSetDigests(sigd, digestalgs, digests);
 398             if (rv != SECSuccess)
 399                 goto loser;             /* error has been set by SecCmsSignedDataSetDigests */
 400         }
 401         SecCmsDigestContextDestroy(sigd->contentInfo.digcx);
 402         sigd->contentInfo.digcx = NULL;
 403     }
 404
 405 loser:
 406     return rv;
 407 }
 408
 409 /*
 410  * SecCmsSignedDataDecodeAfterEnd - do all the necessary things to a SignedData
 411  *     after all decoding is finished.
 412  */
 413 OSStatus
 414 SecCmsSignedDataDecodeAfterEnd(SecCmsSignedDataRef sigd)
 415 {
 416     SecCmsSignerInfoRef *signerinfos;
 417     int i;
 418
 419     if (!sigd) {
 420         return SECFailure;
 421     }
 422
 423     /* set cmsg for all the signerinfos */
 424     signerinfos = sigd->signerInfos;
 425
 426     /* set signedData for all the signerinfos */
 427     if (signerinfos) {
 428         for (i = 0; signerinfos[i] != NULL; i++)
 429             signerinfos[i]->signedData = sigd;
 430     }
 431
 432     return SECSuccess;
 433 }
 434
 435 /*
 436  * SecCmsSignedDataGetSignerInfos - retrieve the SignedData's signer list
 437  */
 438 SecCmsSignerInfoRef *
 439 SecCmsSignedDataGetSignerInfos(SecCmsSignedDataRef sigd)
 440 {
 441     return sigd->signerInfos;
 442 }
 443
 444 int
 445 SecCmsSignedDataSignerInfoCount(SecCmsSignedDataRef sigd)
 446 {
 447     return SecCmsArrayCount((void **)sigd->signerInfos);
 448 }
 449
 450 SecCmsSignerInfoRef
 451 SecCmsSignedDataGetSignerInfo(SecCmsSignedDataRef sigd, int i)
 452 {
 453     return sigd->signerInfos[i];
 454 }
 455
 456 /*
 457  * SecCmsSignedDataGetDigestAlgs - retrieve the SignedData's digest algorithm list
 458  */
 459 SECAlgorithmID **
 460 SecCmsSignedDataGetDigestAlgs(SecCmsSignedDataRef sigd)
 461 {
 462     return sigd->digestAlgorithms;
 463 }
 464
 465 /*
 466  * SecCmsSignedDataGetContentInfo - return pointer to this signedData's contentinfo
 467  */
 468 SecCmsContentInfoRef
 469 SecCmsSignedDataGetContentInfo(SecCmsSignedDataRef sigd)
 470 {
 471     return &(sigd->contentInfo);
 472 }
 473
 474 /*
 475  * SecCmsSignedDataGetCertificateList - retrieve the SignedData's certificate list
 476  */
 477 SecAsn1Item * *
 478 SecCmsSignedDataGetCertificateList(SecCmsSignedDataRef sigd)
 479 {
 480     return sigd->rawCerts;
 481 }
 482
 483 OSStatus
 484 SecCmsSignedDataImportCerts(SecCmsSignedDataRef sigd, SecKeychainRef keychain,
 485                                 SECCertUsage certusage, Boolean keepcerts)
 486 {
 487     OSStatus rv = -1;
 488
 489 #if USE_CDSA_CRYPTO
 490     int ix, certcount = SecCmsArrayCount((void **)sigd->rawCerts);
 491     rv = CERT_ImportCerts(keychain, certusage, certcount, sigd->rawCerts, NULL,
 492                           keepcerts, PR_FALSE, NULL);
 493     /* XXX CRL handling */
 494
 495     if (sigd->signerInfos != NULL) {
 496         /* fill in all signerinfo's certs */
 497         for (ix = 0; sigd->signerInfos[ix] != NULL; i++)
 498             (void)SecCmsSignerInfoGetSigningCertificate(sigd->signerInfos[ix], keychain);
 499     }
 500 #else
 501     // XXX we should only ever import certs for a cert only data blob
 502 #endif
 503
 504     return rv;
 505 }
 506
 507 /*
 508  * XXX the digests need to be passed in BETWEEN the decoding and the verification in case
 509  *     of external signatures!
 510  */
 511
 512
 513 /*
 514  * SecCmsSignedDataVerifySignerInfo - check the signatures.
 515  *
 516  * The digests were either calculated during decoding (and are stored in the
 517  * signedData itself) or set after decoding using SecCmsSignedDataSetDigests.
 518  *
 519  * The verification checks if the signing cert is valid and has a trusted chain
 520  * for the purpose specified by "policies".
 521  *
 522  * If trustRef is NULL the cert chain is verified and the VerificationStatus is set accordingly.
 523  * Otherwise a SecTrust object is returned for the caller to evaluate using SecTrustEvaluate().
 524  */
 525 OSStatus
 526 SecCmsSignedDataVerifySignerInfo(SecCmsSignedDataRef sigd, int i,
 527                             SecKeychainRef keychainOrArray, CFTypeRef policies, SecTrustRef *trustRef)
 528 {
 529     SecCmsSignerInfoRef signerinfo;
 530     SecCmsContentInfoRef cinfo;
 531     SECOidData *algiddata;
 532     SecAsn1Item *contentType, *digest;
 533     OSStatus status;
 534
 535     cinfo = &(sigd->contentInfo);
 536
 537     signerinfo = sigd->signerInfos[i];
 538
 539     /* Signature or digest level verificationStatus errors should supercede
 540        certificate level errors, so check the digest and signature first.  */
 541
 542     /* Find digest and contentType for signerinfo */
 543     algiddata = SecCmsSignerInfoGetDigestAlg(signerinfo);
 544
 545     if (!sigd->digests) {
 546         SECAlgorithmID **digestalgs = SecCmsSignedDataGetDigestAlgs(sigd);
 547         SecCmsDigestContextRef digcx = SecCmsDigestContextStartMultiple(digestalgs);
 548         SecCmsSignedDataSetDigestContext(sigd, digcx);
 549         SecCmsDigestContextDestroy(digcx);
 550     }
 551
 552     digest = SecCmsSignedDataGetDigestByAlgTag(sigd, algiddata->offset);
 553
 554     contentType = SecCmsContentInfoGetContentTypeOID(cinfo);
 555
 556     /* verify signature */
 557     status = SecCmsSignerInfoVerify(signerinfo, digest, contentType);
 558 #if SECTRUST_VERBOSE_DEBUG
 559         syslog(LOG_ERR, "SecCmsSignedDataVerifySignerInfo: SecCmsSignerInfoVerify returned %d, will %sverify cert",
 560                 (int)status, (status) ? "NOT " : "");
 561 #endif
 562     if (status) {
 563         return status;
 564     }
 565
 566     /* Now verify the certificate.  We do this even if the signature failed to verify so we can
 567        return a trustRef to the caller for display purposes.  */
 568     status = SecCmsSignerInfoVerifyCertificate(signerinfo, keychainOrArray, policies, trustRef);
 569 #if SECTRUST_VERBOSE_DEBUG
 570         syslog(LOG_ERR, "SecCmsSignedDataVerifySignerInfo: SecCmsSignerInfoVerifyCertificate returned %d", (int)status);
 571 #endif
 572
 573     return status;
 574 }
 575
 576 #if USE_CDSA_CRYPTO
 577
 578 /*
 579  * SecCmsSignedDataVerifyCertsOnly - verify the certs in a certs-only message
 580  */
 581 OSStatus
 582 SecCmsSignedDataVerifyCertsOnly(SecCmsSignedDataRef sigd,
 583                                   SecKeychainRef keychainOrArray,
 584                                   CFTypeRef policies)
 585 {
 586     SecCertificateRef cert;
 587     OSStatus rv = SECSuccess;
 588     int i;
 589     int count;
 590
 591     if (!sigd || !keychainOrArray || !sigd->rawCerts) {
 592         PORT_SetError(SEC_ERROR_INVALID_ARGS);
 593         return SECFailure;
 594     }
 595
 596     count = SecCmsArrayCount((void**)sigd->rawCerts);
 597     for (i=0; i < count; i++) {
 598         if (sigd->certs && CFArrayGetCount(sigd->certs) > i) {
 599             cert = (SecCertificateRef)CFArrayGetValueAtIndex(sigd->certs, i);
 600             CFRetain(cert);
 601         } else {
 602             cert = CERT_FindCertByDERCert(keychainOrArray, sigd->rawCerts[i]);
 603             if (!cert) {
 604                 rv = SECFailure;
 605                 break;
 606             }
 607         }
 608         rv |= CERT_VerifyCert(keychainOrArray, cert, policies, CFAbsoluteTimeGetCurrent(), NULL);
 609         CFRelease(cert);
 610     }
 611
 612     return rv;
 613 }
 614 #else
 615 OSStatus
 616 SecCmsSignedDataVerifyCertsOnly(SecCmsSignedDataRef sigd,
 617                                   SecKeychainRef keychainOrArray,
 618                                   CFTypeRef policies)
 619 {
 620     OSStatus rv = SECSuccess;
 621
 622     if (!sigd || !keychainOrArray || !sigd->rawCerts) {
 623         PORT_SetError(SEC_ERROR_INVALID_ARGS);
 624         return SECFailure;
 625     }
 626
 627     SecAsn1Item **cert_datas = sigd->rawCerts;
 628     SecAsn1Item *cert_data;
 629     while ((cert_data = *cert_datas++) != NULL) {
 630         SecCertificateRef cert = SecCertificateCreateWithBytes(NULL, cert_data->Data, cert_data->Length);
 631         if (cert) {
 632             CFArrayRef certs = CFArrayCreate(kCFAllocatorDefault, (const void **)&cert, 1, NULL);
 633             rv |= CERT_VerifyCert(keychainOrArray, certs, policies, CFAbsoluteTimeGetCurrent(), NULL);
 634             CFRelease(certs);
 635             CFRelease(cert);
 636         }
 637         else
 638             rv |= SECFailure;
 639     }
 640
 641     return rv;
 642 }
 643 #endif
 644
 645 /*
 646  * SecCmsSignedDataHasDigests - see if we have digests in place
 647  */
 648 Boolean
 649 SecCmsSignedDataHasDigests(SecCmsSignedDataRef sigd)
 650 {
 651     return (sigd->digests != NULL);
 652 }
 653
 654 OSStatus
 655 SecCmsSignedDataAddCertList(SecCmsSignedDataRef sigd, CFArrayRef certlist)
 656 {
 657     PORT_Assert(certlist != NULL);
 658
 659     if (certlist == NULL)
 660         return SECFailure;
 661
 662     if (!sigd->certs)
 663         sigd->certs = CFArrayCreateMutableCopy(NULL, 0, certlist);
 664     else
 665     {
 666         CFRange certlistRange = { 0, CFArrayGetCount(certlist) };
 667         CFArrayAppendArray(sigd->certs, certlist, certlistRange);
 668     }
 669
 670     return SECSuccess;
 671 }
 672
 673 /*
 674  * SecCmsSignedDataAddCertChain - add cert and its entire chain to the set of certs
 675  */
 676 OSStatus
 677 SecCmsSignedDataAddCertChain(SecCmsSignedDataRef sigd, SecCertificateRef cert)
 678 {
 679     CFArrayRef certlist;
 680     SECCertUsage usage;
 681     OSStatus rv;
 682
 683     usage = certUsageEmailSigner;
 684
 685     /* do not include root */
 686     certlist = CERT_CertChainFromCert(cert, usage, PR_FALSE);
 687     if (certlist == NULL)
 688         return SECFailure;
 689
 690     rv = SecCmsSignedDataAddCertList(sigd, certlist);
 691     CFRelease(certlist);
 692
 693     return rv;
 694 }
 695
 696 OSStatus
 697 SecCmsSignedDataAddCertificate(SecCmsSignedDataRef sigd, SecCertificateRef cert)
 698 {
 699     PORT_Assert(cert != NULL);
 700
 701     if (cert == NULL)
 702         return SECFailure;
 703
 704     if (!sigd->certs)
 705         sigd->certs = CFArrayCreateMutable(NULL, 0, &kCFTypeArrayCallBacks);
 706
 707     CFArrayAppendValue(sigd->certs, cert);
 708
 709     return SECSuccess;
 710 }
 711
 712 Boolean
 713 SecCmsSignedDataContainsCertsOrCrls(SecCmsSignedDataRef sigd)
 714 {
 715     if (sigd->rawCerts != NULL && sigd->rawCerts[0] != NULL)
 716         return PR_TRUE;
 717     else if (sigd->rawCrls != NULL && sigd->rawCrls[0] != NULL)
 718         return PR_TRUE;
 719     else
 720         return PR_FALSE;
 721 }
 722
 723 OSStatus
 724 SecCmsSignedDataAddSignerInfo(SecCmsSignedDataRef sigd,
 725                               SecCmsSignerInfoRef signerinfo)
 726 {
 727     void *mark;
 728     OSStatus rv;
 729     SECOidTag digestalgtag;
 730     PLArenaPool *poolp;
 731
 732     poolp = sigd->contentInfo.cmsg->poolp;
 733
 734     mark = PORT_ArenaMark(poolp);
 735
 736     /* add signerinfo */
 737     rv = SecCmsArrayAdd(poolp, (void ***)&(sigd->signerInfos), (void *)signerinfo);
 738     if (rv != SECSuccess)
 739         goto loser;
 740
 741     /*
 742      * add empty digest
 743      * Empty because we don't have it yet. Either it gets created during encoding
 744      * (if the data is present) or has to be set externally.
 745      * XXX maybe pass it in optionally?
 746      */
 747     digestalgtag = SecCmsSignerInfoGetDigestAlgTag(signerinfo);
 748     rv = SecCmsSignedDataSetDigestValue(sigd, digestalgtag, NULL);
 749     if (rv != SECSuccess)
 750         goto loser;
 751
 752     /*
 753      * The last thing to get consistency would be adding the digest.
 754      */
 755
 756     PORT_ArenaUnmark(poolp, mark);
 757     return SECSuccess;
 758
 759 loser:
 760     PORT_ArenaRelease (poolp, mark);
 761     return SECFailure;
 762 }
 763
 764 SecAsn1Item *
 765 SecCmsSignedDataGetDigestByAlgTag(SecCmsSignedDataRef sigd, SECOidTag algtag)
 766 {
 767     int idx;
 768
 769     idx = SecCmsAlgArrayGetIndexByAlgTag(sigd->digestAlgorithms, algtag);
 770     return (idx >= 0)?(sigd->digests)[idx]:NULL;
 771 }
 772
 773 OSStatus
 774 SecCmsSignedDataSetDigestContext(SecCmsSignedDataRef sigd,
 775                                  SecCmsDigestContextRef digestContext)
 776 {
 777     SECAlgorithmID **digestalgs;
 778     SecAsn1Item * *digests;
 779
 780     if (SecCmsDigestContextFinishMultiple(digestContext, &digestalgs, &digests) != SECSuccess)
 781         goto loser;
 782     if (SecCmsSignedDataSetDigests(sigd, digestalgs, digests) != SECSuccess)
 783         goto loser;
 784
 785     return 0;
 786 loser:
 787     return PORT_GetError();
 788 }
 789
 790 /*
 791  * SecCmsSignedDataSetDigests - set a signedData's digests member
 792  *
 793  * "digestalgs" - array of digest algorithm IDs
 794  * "digests"    - array of digests corresponding to the digest algorithms
 795  */
 796 OSStatus
 797 SecCmsSignedDataSetDigests(SecCmsSignedDataRef sigd,
 798                                 SECAlgorithmID **digestalgs,
 799                                 SecAsn1Item * *digests)
 800 {
 801     int cnt, i, idx;
 802
 803     if (sigd->digestAlgorithms == NULL) {
 804         PORT_SetError(SEC_ERROR_INVALID_ARGS);
 805         return SECFailure;
 806     }
 807
 808     /* Since we'll generate a empty digest for content-less messages
 809        whether or not they're detached, we have to avoid overwriting
 810        externally set digest for detached content => return early */
 811     if (sigd->digests && sigd->digests[0])
 812         return 0;
 813
 814     /* we assume that the digests array is just not there yet */
 815 /*
 816     PORT_Assert(sigd->digests == NULL);
 817     if (sigd->digests != NULL) {
 818         PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
 819         return SECFailure;
 820     }
 821 */
 822     /* now allocate one (same size as digestAlgorithms) */
 823     if (sigd->digests == NULL) {
 824         cnt = SecCmsArrayCount((void **)sigd->digestAlgorithms);
 825         sigd->digests = PORT_ArenaZAlloc(sigd->contentInfo.cmsg->poolp, (cnt + 1) * sizeof(SecAsn1Item *));
 826         if (sigd->digests == NULL) {
 827             PORT_SetError(SEC_ERROR_NO_MEMORY);
 828             return SECFailure;
 829         }
 830     }
 831
 832     for (i = 0; sigd->digestAlgorithms[i] != NULL; i++) {
 833         /* try to find the sigd's i'th digest algorithm in the array we passed in */
 834         idx = SecCmsAlgArrayGetIndexByAlgID(digestalgs, sigd->digestAlgorithms[i]);
 835         if (idx < 0) {
 836             PORT_SetError(SEC_ERROR_DIGEST_NOT_FOUND);
 837             return SECFailure;
 838         }
 839
 840         /* found it - now set it */
 841         if ((sigd->digests[i] = SECITEM_AllocItem(sigd->contentInfo.cmsg->poolp, NULL, 0)) == NULL ||
 842             SECITEM_CopyItem(sigd->contentInfo.cmsg->poolp, sigd->digests[i], digests[idx]) != SECSuccess)
 843         {
 844             PORT_SetError(SEC_ERROR_NO_MEMORY);
 845             return SECFailure;
 846         }
 847     }
 848     return SECSuccess;
 849 }
 850
 851 OSStatus
 852 SecCmsSignedDataSetDigestValue(SecCmsSignedDataRef sigd,
 853                                 SECOidTag digestalgtag,
 854                                 SecAsn1Item * digestdata)
 855 {
 856     SecAsn1Item * digest = NULL;
 857     PLArenaPool *poolp;
 858     void *mark;
 859     int n, cnt;
 860
 861     poolp = sigd->contentInfo.cmsg->poolp;
 862
 863     mark = PORT_ArenaMark(poolp);
 864
 865
 866     if (digestdata) {
 867         digest = (SecAsn1Item *) PORT_ArenaZAlloc(poolp,sizeof(SecAsn1Item));
 868
 869         /* copy digestdata item to arena (in case we have it and are not only making room) */
 870         if (SECITEM_CopyItem(poolp, digest, digestdata) != SECSuccess)
 871             goto loser;
 872     }
 873
 874     /* now allocate one (same size as digestAlgorithms) */
 875     if (sigd->digests == NULL) {
 876         cnt = SecCmsArrayCount((void **)sigd->digestAlgorithms);
 877         sigd->digests = PORT_ArenaZAlloc(sigd->contentInfo.cmsg->poolp, (cnt + 1) * sizeof(SecAsn1Item *));
 878         if (sigd->digests == NULL) {
 879                 PORT_SetError(SEC_ERROR_NO_MEMORY);
 880                 return SECFailure;
 881         }
 882     }
 883
 884     n = -1;
 885     if (sigd->digestAlgorithms != NULL)
 886         n = SecCmsAlgArrayGetIndexByAlgTag(sigd->digestAlgorithms, digestalgtag);
 887
 888     /* if not found, add a digest */
 889     if (n < 0) {
 890         if (SecCmsSignedDataAddDigest(poolp, sigd, digestalgtag, digest) != SECSuccess)
 891             goto loser;
 892     } else {
 893         /* replace NULL pointer with digest item (and leak previous value) */
 894         sigd->digests[n] = digest;
 895     }
 896
 897     PORT_ArenaUnmark(poolp, mark);
 898     return SECSuccess;
 899
 900 loser:
 901     PORT_ArenaRelease(poolp, mark);
 902     return SECFailure;
 903 }
 904
 905 OSStatus
 906 SecCmsSignedDataAddDigest(PRArenaPool *poolp,
 907                                 SecCmsSignedDataRef sigd,
 908                                 SECOidTag digestalgtag,
 909                                 SecAsn1Item * digest)
 910 {
 911     SECAlgorithmID *digestalg;
 912     void *mark;
 913
 914     mark = PORT_ArenaMark(poolp);
 915
 916     digestalg = PORT_ArenaZAlloc(poolp, sizeof(SECAlgorithmID));
 917     if (digestalg == NULL)
 918         goto loser;
 919
 920     if (SECOID_SetAlgorithmID (poolp, digestalg, digestalgtag, NULL) != SECSuccess) /* no params */
 921         goto loser;
 922
 923     if (SecCmsArrayAdd(poolp, (void ***)&(sigd->digestAlgorithms), (void *)digestalg) != SECSuccess ||
 924         /* even if digest is NULL, add dummy to have same-size array */
 925         SecCmsArrayAdd(poolp, (void ***)&(sigd->digests), (void *)digest) != SECSuccess)
 926     {
 927         goto loser;
 928     }
 929
 930     PORT_ArenaUnmark(poolp, mark);
 931     return SECSuccess;
 932
 933 loser:
 934     PORT_ArenaRelease(poolp, mark);
 935     return SECFailure;
 936 }
 937
 938 SecAsn1Item *
 939 SecCmsSignedDataGetDigestValue(SecCmsSignedDataRef sigd, SECOidTag digestalgtag)
 940 {
 941     int n;
 942
 943     if (sigd->digestAlgorithms == NULL)
 944         return NULL;
 945
 946     n = SecCmsAlgArrayGetIndexByAlgTag(sigd->digestAlgorithms, digestalgtag);
 947
 948     return (n < 0) ? NULL : sigd->digests[n];
 949 }
 950
 951 /* =============================================================================
 952  * Misc. utility functions
 953  */
 954
 955 /*
 956  * SecCmsSignedDataCreateCertsOnly - create a certs-only SignedData.
 957  *
 958  * cert          - base certificates that will be included
 959  * include_chain - if true, include the complete cert chain for cert
 960  *
 961  * More certs and chains can be added via AddCertificate and AddCertChain.
 962  *
 963  * An error results in a return value of NULL and an error set.
 964  *
 965  * XXXX CRLs
 966  */
 967 SecCmsSignedDataRef
 968 SecCmsSignedDataCreateCertsOnly(SecCmsMessageRef cmsg, SecCertificateRef cert, Boolean include_chain)
 969 {
 970     SecCmsSignedDataRef sigd;
 971     void *mark;
 972     PLArenaPool *poolp;
 973     OSStatus rv;
 974
 975     poolp = cmsg->poolp;
 976     mark = PORT_ArenaMark(poolp);
 977
 978     sigd = SecCmsSignedDataCreate(cmsg);
 979     if (sigd == NULL)
 980         goto loser;
 981
 982     /* no signerinfos, thus no digestAlgorithms */
 983
 984     /* but certs */
 985     if (include_chain) {
 986         rv = SecCmsSignedDataAddCertChain(sigd, cert);
 987     } else {
 988         rv = SecCmsSignedDataAddCertificate(sigd, cert);
 989     }
 990     if (rv != SECSuccess)
 991         goto loser;
 992
 993     /* RFC2630 5.2 sez:
 994      * In the degenerate case where there are no signers, the
 995      * EncapsulatedContentInfo value being "signed" is irrelevant.  In this
 996      * case, the content type within the EncapsulatedContentInfo value being
 997      * "signed" should be id-data (as defined in section 4), and the content
 998      * field of the EncapsulatedContentInfo value should be omitted.
 999      */
1000     rv = SecCmsContentInfoSetContentData(&(sigd->contentInfo), NULL, PR_TRUE);
1001     if (rv != SECSuccess)
1002         goto loser;
1003
1004     PORT_ArenaUnmark(poolp, mark);
1005     return sigd;
1006
1007 loser:
1008     if (sigd)
1009         SecCmsSignedDataDestroy(sigd);
1010     PORT_ArenaRelease(poolp, mark);
1011     return NULL;
1012 }
1013
1014 /* TODO:
1015  * SecCmsSignerInfoGetReceiptRequest()
1016  * SecCmsSignedDataHasReceiptRequest()
1017  * easy way to iterate over signers
1018  */
1019