1 /* Copyright (c) 2014, Google Inc. 2 * 3 * Permission to use, copy, modify, and/or distribute this software for any 4 * purpose with or without fee is hereby granted, provided that the above 5 * copyright notice and this permission notice appear in all copies. 6 * 7 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 8 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 9 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY 10 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 11 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION 12 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN 13 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ 14 15 #ifndef OPENSSL_HEADER_PKCS7_H 16 #define OPENSSL_HEADER_PKCS7_H 17 18 #include <openssl/base.h> 19 20 #include <openssl/stack.h> 21 22 #if defined(__cplusplus) 23 extern "C" { 24 #endif 25 26 27 // PKCS#7. 28 // 29 // This library contains functions for extracting information from PKCS#7 30 // structures (RFC 2315). 31 32 DECLARE_STACK_OF(CRYPTO_BUFFER) 33 DECLARE_STACK_OF(X509) 34 DECLARE_STACK_OF(X509_CRL) 35 36 // PKCS7_get_raw_certificates parses a PKCS#7, SignedData structure from |cbs| 37 // and appends the included certificates to |out_certs|. It returns one on 38 // success and zero on error. |cbs| is advanced passed the structure. 39 // 40 // Note that a SignedData structure may contain no certificates, in which case 41 // this function succeeds but does not append any certificates. Additionally, 42 // certificates in SignedData structures are unordered. Callers should not 43 // assume a particular order in |*out_certs| and may need to search for matches 44 // or run path-building algorithms. 45 OPENSSL_EXPORT int PKCS7_get_raw_certificates( 46 STACK_OF(CRYPTO_BUFFER) *out_certs, CBS *cbs, CRYPTO_BUFFER_POOL *pool); 47 48 // PKCS7_get_certificates behaves like |PKCS7_get_raw_certificates| but parses 49 // them into |X509| objects. 50 OPENSSL_EXPORT int PKCS7_get_certificates(STACK_OF(X509) *out_certs, CBS *cbs); 51 52 // PKCS7_bundle_raw_certificates appends a PKCS#7, SignedData structure 53 // containing |certs| to |out|. It returns one on success and zero on error. 54 // Note that certificates in SignedData structures are unordered. The order in 55 // |certs| will not be preserved. 56 OPENSSL_EXPORT int PKCS7_bundle_raw_certificates( 57 CBB *out, const STACK_OF(CRYPTO_BUFFER) *certs); 58 59 // PKCS7_bundle_certificates behaves like |PKCS7_bundle_raw_certificates| but 60 // takes |X509| objects as input. 61 OPENSSL_EXPORT int PKCS7_bundle_certificates( 62 CBB *out, const STACK_OF(X509) *certs); 63 64 // PKCS7_get_CRLs parses a PKCS#7, SignedData structure from |cbs| and appends 65 // the included CRLs to |out_crls|. It returns one on success and zero on error. 66 // |cbs| is advanced passed the structure. 67 // 68 // Note that a SignedData structure may contain no CRLs, in which case this 69 // function succeeds but does not append any CRLs. Additionally, CRLs in 70 // SignedData structures are unordered. Callers should not assume an order in 71 // |*out_crls| and may need to search for matches. 72 OPENSSL_EXPORT int PKCS7_get_CRLs(STACK_OF(X509_CRL) *out_crls, CBS *cbs); 73 74 // PKCS7_bundle_CRLs appends a PKCS#7, SignedData structure containing 75 // |crls| to |out|. It returns one on success and zero on error. Note that CRLs 76 // in SignedData structures are unordered. The order in |crls| will not be 77 // preserved. 78 OPENSSL_EXPORT int PKCS7_bundle_CRLs(CBB *out, const STACK_OF(X509_CRL) *crls); 79 80 // PKCS7_get_PEM_certificates reads a PEM-encoded, PKCS#7, SignedData structure 81 // from |pem_bio| and appends the included certificates to |out_certs|. It 82 // returns one on success and zero on error. 83 // 84 // Note that a SignedData structure may contain no certificates, in which case 85 // this function succeeds but does not append any certificates. Additionally, 86 // certificates in SignedData structures are unordered. Callers should not 87 // assume a particular order in |*out_certs| and may need to search for matches 88 // or run path-building algorithms. 89 OPENSSL_EXPORT int PKCS7_get_PEM_certificates(STACK_OF(X509) *out_certs, 90 BIO *pem_bio); 91 92 // PKCS7_get_PEM_CRLs reads a PEM-encoded, PKCS#7, SignedData structure from 93 // |pem_bio| and appends the included CRLs to |out_crls|. It returns one on 94 // success and zero on error. 95 // 96 // Note that a SignedData structure may contain no CRLs, in which case this 97 // function succeeds but does not append any CRLs. Additionally, CRLs in 98 // SignedData structures are unordered. Callers should not assume an order in 99 // |*out_crls| and may need to search for matches. 100 OPENSSL_EXPORT int PKCS7_get_PEM_CRLs(STACK_OF(X509_CRL) *out_crls, 101 BIO *pem_bio); 102 103 104 // Deprecated functions. 105 // 106 // These functions are a compatibility layer over a subset of OpenSSL's PKCS#7 107 // API. It intentionally does not implement the whole thing, only the minimum 108 // needed to build cryptography.io. 109 110 typedef struct { 111 STACK_OF(X509) *cert; 112 STACK_OF(X509_CRL) *crl; 113 } PKCS7_SIGNED; 114 115 typedef struct { 116 STACK_OF(X509) *cert; 117 STACK_OF(X509_CRL) *crl; 118 } PKCS7_SIGN_ENVELOPE; 119 120 typedef void PKCS7_ENVELOPE; 121 typedef void PKCS7_DIGEST; 122 typedef void PKCS7_ENCRYPT; 123 typedef void PKCS7_SIGNER_INFO; 124 125 typedef struct { 126 uint8_t *ber_bytes; 127 size_t ber_len; 128 129 // Unlike OpenSSL, the following fields are immutable. They filled in when the 130 // object is parsed and ignored in serialization. 131 ASN1_OBJECT *type; 132 union { 133 char *ptr; 134 ASN1_OCTET_STRING *data; 135 PKCS7_SIGNED *sign; 136 PKCS7_ENVELOPE *enveloped; 137 PKCS7_SIGN_ENVELOPE *signed_and_enveloped; 138 PKCS7_DIGEST *digest; 139 PKCS7_ENCRYPT *encrypted; 140 ASN1_TYPE *other; 141 } d; 142 } PKCS7; 143 144 // d2i_PKCS7 parses a BER-encoded, PKCS#7 signed data ContentInfo structure from 145 // |len| bytes at |*inp|, as described in |d2i_SAMPLE|. 146 OPENSSL_EXPORT PKCS7 *d2i_PKCS7(PKCS7 **out, const uint8_t **inp, 147 size_t len); 148 149 // d2i_PKCS7_bio behaves like |d2i_PKCS7| but reads the input from |bio|. If 150 // the length of the object is indefinite the full contents of |bio| are read. 151 // 152 // If the function fails then some unknown amount of data may have been read 153 // from |bio|. 154 OPENSSL_EXPORT PKCS7 *d2i_PKCS7_bio(BIO *bio, PKCS7 **out); 155 156 // i2d_PKCS7 marshals |p7| as a DER-encoded PKCS#7 ContentInfo structure, as 157 // described in |i2d_SAMPLE|. 158 OPENSSL_EXPORT int i2d_PKCS7(const PKCS7 *p7, uint8_t **out); 159 160 // i2d_PKCS7_bio writes |p7| to |bio|. It returns one on success and zero on 161 // error. 162 OPENSSL_EXPORT int i2d_PKCS7_bio(BIO *bio, const PKCS7 *p7); 163 164 // PKCS7_free releases memory associated with |p7|. 165 OPENSSL_EXPORT void PKCS7_free(PKCS7 *p7); 166 167 // PKCS7_type_is_data returns zero. 168 OPENSSL_EXPORT int PKCS7_type_is_data(const PKCS7 *p7); 169 170 // PKCS7_type_is_digest returns zero. 171 OPENSSL_EXPORT int PKCS7_type_is_digest(const PKCS7 *p7); 172 173 // PKCS7_type_is_encrypted returns zero. 174 OPENSSL_EXPORT int PKCS7_type_is_encrypted(const PKCS7 *p7); 175 176 // PKCS7_type_is_enveloped returns zero. 177 OPENSSL_EXPORT int PKCS7_type_is_enveloped(const PKCS7 *p7); 178 179 // PKCS7_type_is_signed returns one. (We only supporte signed data 180 // ContentInfos.) 181 OPENSSL_EXPORT int PKCS7_type_is_signed(const PKCS7 *p7); 182 183 // PKCS7_type_is_signedAndEnveloped returns zero. 184 OPENSSL_EXPORT int PKCS7_type_is_signedAndEnveloped(const PKCS7 *p7); 185 186 // PKCS7_DETACHED indicates that the PKCS#7 file specifies its data externally. 187 #define PKCS7_DETACHED 0x40 188 189 // The following flags cause |PKCS7_sign| to fail. 190 #define PKCS7_TEXT 0x1 191 #define PKCS7_NOCERTS 0x2 192 #define PKCS7_NOSIGS 0x4 193 #define PKCS7_NOCHAIN 0x8 194 #define PKCS7_NOINTERN 0x10 195 #define PKCS7_NOVERIFY 0x20 196 #define PKCS7_BINARY 0x80 197 #define PKCS7_NOATTR 0x100 198 #define PKCS7_NOSMIMECAP 0x200 199 #define PKCS7_STREAM 0x1000 200 #define PKCS7_PARTIAL 0x4000 201 202 // PKCS7_sign can operate in two modes to provide some backwards compatibility: 203 // 204 // The first mode assembles |certs| into a PKCS#7 signed data ContentInfo with 205 // external data and no signatures. It returns a newly-allocated |PKCS7| on 206 // success or NULL on error. |sign_cert| and |pkey| must be NULL. |data| is 207 // ignored. |flags| must be equal to |PKCS7_DETACHED|. Additionally, 208 // certificates in SignedData structures are unordered. The order of |certs| 209 // will not be preserved. 210 // 211 // The second mode generates a detached RSA SHA-256 signature of |data| using 212 // |pkey| and produces a PKCS#7 SignedData structure containing it. |certs| 213 // must be NULL and |flags| must be exactly |PKCS7_NOATTR | PKCS7_BINARY | 214 // PKCS7_NOCERTS | PKCS7_DETACHED|. 215 // 216 // Note this function only implements a subset of the corresponding OpenSSL 217 // function. It is provided for backwards compatibility only. 218 OPENSSL_EXPORT PKCS7 *PKCS7_sign(X509 *sign_cert, EVP_PKEY *pkey, 219 STACK_OF(X509) *certs, BIO *data, int flags); 220 221 222 #if defined(__cplusplus) 223 } // extern C 224 225 extern "C++" { 226 BSSL_NAMESPACE_BEGIN 227 228 BORINGSSL_MAKE_DELETER(PKCS7, PKCS7_free) 229 230 BSSL_NAMESPACE_END 231 } // extern C++ 232 #endif 233 234 #define PKCS7_R_BAD_PKCS7_VERSION 100 235 #define PKCS7_R_NOT_PKCS7_SIGNED_DATA 101 236 #define PKCS7_R_NO_CERTIFICATES_INCLUDED 102 237 #define PKCS7_R_NO_CRLS_INCLUDED 103 238 239 #endif // OPENSSL_HEADER_PKCS7_H 240