michael@0: /* This Source Code Form is subject to the terms of the Mozilla Public
michael@0:  * License, v. 2.0. If a copy of the MPL was not distributed with this
michael@0:  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
michael@0: 
michael@0: /*
michael@0:  * Support routines for PKCS7 implementation, none of which are exported.
michael@0:  * This file should only contain things that are needed by both the
michael@0:  * encoding/creation side *and* the decoding/decryption side.  Anything
michael@0:  * else should be static routines in the appropriate file.
michael@0:  */
michael@0: 
michael@0: #include "p7local.h"
michael@0: 
michael@0: #include "cryptohi.h" 
michael@0: #include "secasn1.h"
michael@0: #include "secoid.h"
michael@0: #include "secitem.h"
michael@0: #include "pk11func.h"
michael@0: #include "secpkcs5.h"
michael@0: #include "secerr.h"
michael@0: 
michael@0: /*
michael@0:  * -------------------------------------------------------------------
michael@0:  * Cipher stuff.
michael@0:  */
michael@0: 
michael@0: typedef SECStatus (*sec_pkcs7_cipher_function) (void *,
michael@0: 						unsigned char *,
michael@0: 						unsigned *,
michael@0: 						unsigned int,
michael@0: 						const unsigned char *,
michael@0: 						unsigned int);
michael@0: typedef SECStatus (*sec_pkcs7_cipher_destroy) (void *, PRBool);
michael@0: 
michael@0: #define BLOCK_SIZE 4096
michael@0: 
michael@0: struct sec_pkcs7_cipher_object {
michael@0:     void *cx;
michael@0:     sec_pkcs7_cipher_function doit;
michael@0:     sec_pkcs7_cipher_destroy destroy;
michael@0:     PRBool encrypt;
michael@0:     int block_size;
michael@0:     int pad_size;
michael@0:     int pending_count;
michael@0:     unsigned char pending_buf[BLOCK_SIZE];
michael@0: };
michael@0: 
michael@0: SEC_ASN1_MKSUB(CERT_IssuerAndSNTemplate)
michael@0: SEC_ASN1_MKSUB(CERT_SetOfSignedCrlTemplate)
michael@0: SEC_ASN1_MKSUB(SECOID_AlgorithmIDTemplate)
michael@0: SEC_ASN1_MKSUB(SEC_OctetStringTemplate)
michael@0: SEC_ASN1_MKSUB(SEC_SetOfAnyTemplate)
michael@0: 
michael@0: /*
michael@0:  * Create a cipher object to do decryption,  based on the given bulk
michael@0:  * encryption key and algorithm identifier (which may include an iv).
michael@0:  *
michael@0:  * XXX This interface, or one similar, would be really nice available
michael@0:  * in general...  I tried to keep the pkcs7-specific stuff (mostly
michael@0:  * having to do with padding) out of here.
michael@0:  *
michael@0:  * XXX Once both are working, it might be nice to combine this and the
michael@0:  * function below (for starting up encryption) into one routine, and just
michael@0:  * have two simple cover functions which call it. 
michael@0:  */
michael@0: sec_PKCS7CipherObject *
michael@0: sec_PKCS7CreateDecryptObject (PK11SymKey *key, SECAlgorithmID *algid)
michael@0: {
michael@0:     sec_PKCS7CipherObject *result;
michael@0:     SECOidTag algtag;
michael@0:     void *ciphercx;
michael@0:     CK_MECHANISM_TYPE cryptoMechType;
michael@0:     PK11SlotInfo *slot;
michael@0:     SECItem *param = NULL;
michael@0: 
michael@0:     result = (struct sec_pkcs7_cipher_object*)
michael@0:       PORT_ZAlloc (sizeof(struct sec_pkcs7_cipher_object));
michael@0:     if (result == NULL)
michael@0: 	return NULL;
michael@0: 
michael@0:     ciphercx = NULL;
michael@0:     algtag = SECOID_GetAlgorithmTag (algid);
michael@0: 
michael@0:     if (SEC_PKCS5IsAlgorithmPBEAlg(algid)) {
michael@0: 	SECItem *pwitem;
michael@0: 
michael@0: 	pwitem = (SECItem *)PK11_GetSymKeyUserData(key);
michael@0: 	if (!pwitem) {
michael@0: 	    PORT_Free(result);
michael@0: 	    return NULL;
michael@0: 	}
michael@0: 
michael@0: 	cryptoMechType = PK11_GetPBECryptoMechanism(algid, &param, pwitem);
michael@0: 	if (cryptoMechType == CKM_INVALID_MECHANISM) {
michael@0: 	    PORT_Free(result);
michael@0: 	    SECITEM_FreeItem(param,PR_TRUE);
michael@0: 	    return NULL;
michael@0: 	}
michael@0:     } else {
michael@0: 	cryptoMechType = PK11_AlgtagToMechanism(algtag);
michael@0: 	param = PK11_ParamFromAlgid(algid);
michael@0: 	if (param == NULL) {
michael@0: 	    PORT_Free(result);
michael@0: 	    return NULL;
michael@0: 	}
michael@0:     }
michael@0: 
michael@0:     result->pad_size = PK11_GetBlockSize(cryptoMechType, param);
michael@0:     slot = PK11_GetSlotFromKey(key);
michael@0:     result->block_size = PK11_IsHW(slot) ? BLOCK_SIZE : result->pad_size;
michael@0:     PK11_FreeSlot(slot);
michael@0:     ciphercx = PK11_CreateContextBySymKey(cryptoMechType, CKA_DECRYPT, 
michael@0: 					  key, param);
michael@0:     SECITEM_FreeItem(param,PR_TRUE);
michael@0:     if (ciphercx == NULL) {
michael@0: 	PORT_Free (result);
michael@0: 	return NULL;
michael@0:     }
michael@0: 
michael@0:     result->cx = ciphercx;
michael@0:     result->doit =  (sec_pkcs7_cipher_function) PK11_CipherOp;
michael@0:     result->destroy = (sec_pkcs7_cipher_destroy) PK11_DestroyContext;
michael@0:     result->encrypt = PR_FALSE;
michael@0:     result->pending_count = 0;
michael@0: 
michael@0:     return result;
michael@0: }
michael@0: 
michael@0: /*
michael@0:  * Create a cipher object to do encryption, based on the given bulk
michael@0:  * encryption key and algorithm tag.  Fill in the algorithm identifier
michael@0:  * (which may include an iv) appropriately.
michael@0:  *
michael@0:  * XXX This interface, or one similar, would be really nice available
michael@0:  * in general...  I tried to keep the pkcs7-specific stuff (mostly
michael@0:  * having to do with padding) out of here.
michael@0:  *
michael@0:  * XXX Once both are working, it might be nice to combine this and the
michael@0:  * function above (for starting up decryption) into one routine, and just
michael@0:  * have two simple cover functions which call it. 
michael@0:  */
michael@0: sec_PKCS7CipherObject *
michael@0: sec_PKCS7CreateEncryptObject (PLArenaPool *poolp, PK11SymKey *key,
michael@0: 			      SECOidTag algtag, SECAlgorithmID *algid)
michael@0: {
michael@0:     sec_PKCS7CipherObject *result;
michael@0:     void *ciphercx;
michael@0:     SECStatus rv;
michael@0:     CK_MECHANISM_TYPE cryptoMechType;
michael@0:     PK11SlotInfo *slot;
michael@0:     SECItem *param = NULL;
michael@0:     PRBool needToEncodeAlgid = PR_FALSE;
michael@0: 
michael@0:     result = (struct sec_pkcs7_cipher_object*)
michael@0: 	      PORT_ZAlloc (sizeof(struct sec_pkcs7_cipher_object));
michael@0:     if (result == NULL)
michael@0: 	return NULL;
michael@0: 
michael@0:     ciphercx = NULL;
michael@0:     if (SEC_PKCS5IsAlgorithmPBEAlg(algid)) {
michael@0: 	SECItem *pwitem;
michael@0: 
michael@0: 	pwitem = (SECItem *)PK11_GetSymKeyUserData(key);
michael@0: 	if (!pwitem) {
michael@0: 	    PORT_Free(result);
michael@0: 	    return NULL;
michael@0: 	}
michael@0: 
michael@0: 	cryptoMechType = PK11_GetPBECryptoMechanism(algid, &param, pwitem);
michael@0: 	if (cryptoMechType == CKM_INVALID_MECHANISM) {
michael@0: 	    PORT_Free(result);
michael@0: 	    SECITEM_FreeItem(param,PR_TRUE);
michael@0: 	    return NULL;
michael@0: 	}
michael@0:     } else {
michael@0: 	cryptoMechType = PK11_AlgtagToMechanism(algtag);
michael@0: 	param = PK11_GenerateNewParam(cryptoMechType, key);
michael@0: 	if (param == NULL) {
michael@0: 	    PORT_Free(result);
michael@0: 	    return NULL;
michael@0: 	}
michael@0: 	needToEncodeAlgid = PR_TRUE;
michael@0:     }
michael@0: 
michael@0:     result->pad_size = PK11_GetBlockSize(cryptoMechType,param);
michael@0:     slot = PK11_GetSlotFromKey(key);
michael@0:     result->block_size = PK11_IsHW(slot) ? BLOCK_SIZE : result->pad_size;
michael@0:     PK11_FreeSlot(slot);
michael@0:     ciphercx = PK11_CreateContextBySymKey(cryptoMechType, CKA_ENCRYPT, 
michael@0:     					  key, param);
michael@0:     if (ciphercx == NULL) {
michael@0: 	PORT_Free (result);
michael@0:         SECITEM_FreeItem(param,PR_TRUE);
michael@0: 	return NULL;
michael@0:     }
michael@0: 
michael@0:     /*
michael@0:      * These are placed after the CreateContextBySymKey() because some
michael@0:      * mechanisms have to generate their IVs from their card (i.e. FORTEZZA).
michael@0:      * Don't move it from here.
michael@0:      */
michael@0:     if (needToEncodeAlgid) {
michael@0: 	rv = PK11_ParamToAlgid(algtag,param,poolp,algid);
michael@0: 	if(rv != SECSuccess) {
michael@0: 	    PORT_Free (result);
michael@0:             SECITEM_FreeItem(param,PR_TRUE);
michael@0: 	    return NULL;
michael@0: 	}
michael@0:     }
michael@0:     SECITEM_FreeItem(param,PR_TRUE);
michael@0: 
michael@0:     result->cx = ciphercx;
michael@0:     result->doit = (sec_pkcs7_cipher_function) PK11_CipherOp;
michael@0:     result->destroy = (sec_pkcs7_cipher_destroy) PK11_DestroyContext;
michael@0:     result->encrypt = PR_TRUE;
michael@0:     result->pending_count = 0;
michael@0: 
michael@0:     return result;
michael@0: }
michael@0: 
michael@0: 
michael@0: /*
michael@0:  * Destroy the cipher object.
michael@0:  */
michael@0: static void
michael@0: sec_pkcs7_destroy_cipher (sec_PKCS7CipherObject *obj)
michael@0: {
michael@0:     (* obj->destroy) (obj->cx, PR_TRUE);
michael@0:     PORT_Free (obj);
michael@0: }
michael@0: 
michael@0: void
michael@0: sec_PKCS7DestroyDecryptObject (sec_PKCS7CipherObject *obj)
michael@0: {
michael@0:     PORT_Assert (obj != NULL);
michael@0:     if (obj == NULL)
michael@0: 	return;
michael@0:     PORT_Assert (! obj->encrypt);
michael@0:     sec_pkcs7_destroy_cipher (obj);
michael@0: }
michael@0: 
michael@0: void
michael@0: sec_PKCS7DestroyEncryptObject (sec_PKCS7CipherObject *obj)
michael@0: {
michael@0:     PORT_Assert (obj != NULL);
michael@0:     if (obj == NULL)
michael@0: 	return;
michael@0:     PORT_Assert (obj->encrypt);
michael@0:     sec_pkcs7_destroy_cipher (obj);
michael@0: }
michael@0: 
michael@0: 
michael@0: /*
michael@0:  * XXX I think all of the following lengths should be longs instead
michael@0:  * of ints, but our current crypto interface uses ints, so I did too.
michael@0:  */
michael@0: 
michael@0: 
michael@0: /*
michael@0:  * What will be the output length of the next call to decrypt?
michael@0:  * Result can be used to perform memory allocations.  Note that the amount
michael@0:  * is exactly accurate only when not doing a block cipher or when final
michael@0:  * is false, otherwise it is an upper bound on the amount because until
michael@0:  * we see the data we do not know how many padding bytes there are
michael@0:  * (always between 1 and bsize).
michael@0:  *
michael@0:  * Note that this can return zero, which does not mean that the decrypt
michael@0:  * operation can be skipped!  (It simply means that there are not enough
michael@0:  * bytes to make up an entire block; the bytes will be reserved until
michael@0:  * there are enough to encrypt/decrypt at least one block.)  However,
michael@0:  * if zero is returned it *does* mean that no output buffer need be
michael@0:  * passed in to the subsequent decrypt operation, as no output bytes
michael@0:  * will be stored.
michael@0:  */
michael@0: unsigned int
michael@0: sec_PKCS7DecryptLength (sec_PKCS7CipherObject *obj, unsigned int input_len,
michael@0: 			PRBool final)
michael@0: {
michael@0:     int blocks, block_size;
michael@0: 
michael@0:     PORT_Assert (! obj->encrypt);
michael@0: 
michael@0:     block_size = obj->block_size;
michael@0: 
michael@0:     /*
michael@0:      * If this is not a block cipher, then we always have the same
michael@0:      * number of output bytes as we had input bytes.
michael@0:      */
michael@0:     if (block_size == 0)
michael@0: 	return input_len;
michael@0: 
michael@0:     /*
michael@0:      * On the final call, we will always use up all of the pending
michael@0:      * bytes plus all of the input bytes, *but*, there will be padding
michael@0:      * at the end and we cannot predict how many bytes of padding we
michael@0:      * will end up removing.  The amount given here is actually known
michael@0:      * to be at least 1 byte too long (because we know we will have
michael@0:      * at least 1 byte of padding), but seemed clearer/better to me.
michael@0:      */
michael@0:     if (final)
michael@0: 	return obj->pending_count + input_len;
michael@0: 
michael@0:     /*
michael@0:      * Okay, this amount is exactly what we will output on the
michael@0:      * next cipher operation.  We will always hang onto the last
michael@0:      * 1 - block_size bytes for non-final operations.  That is,
michael@0:      * we will do as many complete blocks as we can *except* the
michael@0:      * last block (complete or partial).  (This is because until
michael@0:      * we know we are at the end, we cannot know when to interpret
michael@0:      * and removing the padding byte(s), which are guaranteed to
michael@0:      * be there.)
michael@0:      */
michael@0:     blocks = (obj->pending_count + input_len - 1) / block_size;
michael@0:     return blocks * block_size;
michael@0: }
michael@0: 
michael@0: /*
michael@0:  * What will be the output length of the next call to encrypt?
michael@0:  * Result can be used to perform memory allocations.
michael@0:  *
michael@0:  * Note that this can return zero, which does not mean that the encrypt
michael@0:  * operation can be skipped!  (It simply means that there are not enough
michael@0:  * bytes to make up an entire block; the bytes will be reserved until
michael@0:  * there are enough to encrypt/decrypt at least one block.)  However,
michael@0:  * if zero is returned it *does* mean that no output buffer need be
michael@0:  * passed in to the subsequent encrypt operation, as no output bytes
michael@0:  * will be stored.
michael@0:  */
michael@0: unsigned int
michael@0: sec_PKCS7EncryptLength (sec_PKCS7CipherObject *obj, unsigned int input_len,
michael@0: 			PRBool final)
michael@0: {
michael@0:     int blocks, block_size;
michael@0:     int pad_size;
michael@0: 
michael@0:     PORT_Assert (obj->encrypt);
michael@0: 
michael@0:     block_size = obj->block_size;
michael@0:     pad_size = obj->pad_size;
michael@0: 
michael@0:     /*
michael@0:      * If this is not a block cipher, then we always have the same
michael@0:      * number of output bytes as we had input bytes.
michael@0:      */
michael@0:     if (block_size == 0)
michael@0: 	return input_len;
michael@0: 
michael@0:     /*
michael@0:      * On the final call, we only send out what we need for
michael@0:      * remaining bytes plus the padding.  (There is always padding,
michael@0:      * so even if we have an exact number of blocks as input, we
michael@0:      * will add another full block that is just padding.)
michael@0:      */
michael@0:     if (final) {
michael@0: 	if (pad_size == 0) {
michael@0:     	    return obj->pending_count + input_len;
michael@0: 	} else {
michael@0:     	    blocks = (obj->pending_count + input_len) / pad_size;
michael@0: 	    blocks++;
michael@0: 	    return blocks*pad_size;
michael@0: 	}
michael@0:     }
michael@0: 
michael@0:     /*
michael@0:      * Now, count the number of complete blocks of data we have.
michael@0:      */
michael@0:     blocks = (obj->pending_count + input_len) / block_size;
michael@0: 
michael@0: 
michael@0:     return blocks * block_size;
michael@0: }
michael@0: 
michael@0: 
michael@0: /*
michael@0:  * Decrypt a given length of input buffer (starting at "input" and
michael@0:  * containing "input_len" bytes), placing the decrypted bytes in
michael@0:  * "output" and storing the output length in "*output_len_p".
michael@0:  * "obj" is the return value from sec_PKCS7CreateDecryptObject.
michael@0:  * When "final" is true, this is the last of the data to be decrypted.
michael@0:  *
michael@0:  * This is much more complicated than it sounds when the cipher is
michael@0:  * a block-type, meaning that the decryption function will only
michael@0:  * operate on whole blocks.  But our caller is operating stream-wise,
michael@0:  * and can pass in any number of bytes.  So we need to keep track
michael@0:  * of block boundaries.  We save excess bytes between calls in "obj".
michael@0:  * We also need to determine which bytes are padding, and remove
michael@0:  * them from the output.  We can only do this step when we know we
michael@0:  * have the final block of data.  PKCS #7 specifies that the padding
michael@0:  * used for a block cipher is a string of bytes, each of whose value is
michael@0:  * the same as the length of the padding, and that all data is padded.
michael@0:  * (Even data that starts out with an exact multiple of blocks gets
michael@0:  * added to it another block, all of which is padding.)
michael@0:  */ 
michael@0: SECStatus
michael@0: sec_PKCS7Decrypt (sec_PKCS7CipherObject *obj, unsigned char *output,
michael@0: 		  unsigned int *output_len_p, unsigned int max_output_len,
michael@0: 		  const unsigned char *input, unsigned int input_len,
michael@0: 		  PRBool final)
michael@0: {
michael@0:     int blocks, bsize, pcount, padsize;
michael@0:     unsigned int max_needed, ifraglen, ofraglen, output_len;
michael@0:     unsigned char *pbuf;
michael@0:     SECStatus rv;
michael@0: 
michael@0:     PORT_Assert (! obj->encrypt);
michael@0: 
michael@0:     /*
michael@0:      * Check that we have enough room for the output.  Our caller should
michael@0:      * already handle this; failure is really an internal error (i.e. bug).
michael@0:      */
michael@0:     max_needed = sec_PKCS7DecryptLength (obj, input_len, final);
michael@0:     PORT_Assert (max_output_len >= max_needed);
michael@0:     if (max_output_len < max_needed) {
michael@0: 	/* PORT_SetError (XXX); */
michael@0: 	return SECFailure;
michael@0:     }
michael@0: 
michael@0:     /*
michael@0:      * hardware encryption does not like small decryption sizes here, so we
michael@0:      * allow both blocking and padding.
michael@0:      */
michael@0:     bsize = obj->block_size;
michael@0:     padsize = obj->pad_size;
michael@0: 
michael@0:     /*
michael@0:      * When no blocking or padding work to do, we can simply call the
michael@0:      * cipher function and we are done.
michael@0:      */
michael@0:     if (bsize == 0) {
michael@0: 	return (* obj->doit) (obj->cx, output, output_len_p, max_output_len,
michael@0: 			      input, input_len);
michael@0:     }
michael@0: 
michael@0:     pcount = obj->pending_count;
michael@0:     pbuf = obj->pending_buf;
michael@0: 
michael@0:     output_len = 0;
michael@0: 
michael@0:     if (pcount) {
michael@0: 	/*
michael@0: 	 * Try to fill in an entire block, starting with the bytes
michael@0: 	 * we already have saved away.
michael@0: 	 */
michael@0: 	while (input_len && pcount < bsize) {
michael@0: 	    pbuf[pcount++] = *input++;
michael@0: 	    input_len--;
michael@0: 	}
michael@0: 	/*
michael@0: 	 * If we have at most a whole block and this is not our last call,
michael@0: 	 * then we are done for now.  (We do not try to decrypt a lone
michael@0: 	 * single block because we cannot interpret the padding bytes
michael@0: 	 * until we know we are handling the very last block of all input.)
michael@0: 	 */
michael@0: 	if (input_len == 0 && !final) {
michael@0: 	    obj->pending_count = pcount;
michael@0: 	    if (output_len_p)
michael@0: 		*output_len_p = 0;
michael@0: 	    return SECSuccess;
michael@0: 	}
michael@0: 	/*
michael@0: 	 * Given the logic above, we expect to have a full block by now.
michael@0: 	 * If we do not, there is something wrong, either with our own
michael@0: 	 * logic or with (length of) the data given to us.
michael@0: 	 */
michael@0: 	PORT_Assert ((padsize == 0) || (pcount % padsize) == 0);
michael@0: 	if ((padsize != 0) && (pcount % padsize) != 0) {
michael@0: 	    PORT_Assert (final);	
michael@0: 	    PORT_SetError (SEC_ERROR_BAD_DATA);
michael@0: 	    return SECFailure;
michael@0: 	}
michael@0: 	/*
michael@0: 	 * Decrypt the block.
michael@0: 	 */
michael@0: 	rv = (* obj->doit) (obj->cx, output, &ofraglen, max_output_len,
michael@0: 			    pbuf, pcount);
michael@0: 	if (rv != SECSuccess)
michael@0: 	    return rv;
michael@0: 
michael@0: 	/*
michael@0: 	 * For now anyway, all of our ciphers have the same number of
michael@0: 	 * bytes of output as they do input.  If this ever becomes untrue,
michael@0: 	 * then sec_PKCS7DecryptLength needs to be made smarter!
michael@0: 	 */
michael@0: 	PORT_Assert (ofraglen == pcount);
michael@0: 
michael@0: 	/*
michael@0: 	 * Account for the bytes now in output.
michael@0: 	 */
michael@0: 	max_output_len -= ofraglen;
michael@0: 	output_len += ofraglen;
michael@0: 	output += ofraglen;
michael@0:     }
michael@0: 
michael@0:     /*
michael@0:      * If this is our last call, we expect to have an exact number of
michael@0:      * blocks left to be decrypted; we will decrypt them all.
michael@0:      * 
michael@0:      * If not our last call, we always save between 1 and bsize bytes
michael@0:      * until next time.  (We must do this because we cannot be sure
michael@0:      * that none of the decrypted bytes are padding bytes until we
michael@0:      * have at least another whole block of data.  You cannot tell by
michael@0:      * looking -- the data could be anything -- you can only tell by
michael@0:      * context, knowing you are looking at the last block.)  We could
michael@0:      * decrypt a whole block now but it is easier if we just treat it
michael@0:      * the same way we treat partial block bytes.
michael@0:      */
michael@0:     if (final) {
michael@0: 	if (padsize) {
michael@0: 	    blocks = input_len / padsize;
michael@0: 	    ifraglen = blocks * padsize;
michael@0: 	} else ifraglen = input_len;
michael@0: 	PORT_Assert (ifraglen == input_len);
michael@0: 
michael@0: 	if (ifraglen != input_len) {
michael@0: 	    PORT_SetError (SEC_ERROR_BAD_DATA);
michael@0: 	    return SECFailure;
michael@0: 	}
michael@0:     } else {
michael@0: 	blocks = (input_len - 1) / bsize;
michael@0: 	ifraglen = blocks * bsize;
michael@0: 	PORT_Assert (ifraglen < input_len);
michael@0: 
michael@0: 	pcount = input_len - ifraglen;
michael@0: 	PORT_Memcpy (pbuf, input + ifraglen, pcount);
michael@0: 	obj->pending_count = pcount;
michael@0:     }
michael@0: 
michael@0:     if (ifraglen) {
michael@0: 	rv = (* obj->doit) (obj->cx, output, &ofraglen, max_output_len,
michael@0: 			    input, ifraglen);
michael@0: 	if (rv != SECSuccess)
michael@0: 	    return rv;
michael@0: 
michael@0: 	/*
michael@0: 	 * For now anyway, all of our ciphers have the same number of
michael@0: 	 * bytes of output as they do input.  If this ever becomes untrue,
michael@0: 	 * then sec_PKCS7DecryptLength needs to be made smarter!
michael@0: 	 */
michael@0: 	PORT_Assert (ifraglen == ofraglen);
michael@0: 	if (ifraglen != ofraglen) {
michael@0: 	    PORT_SetError (SEC_ERROR_BAD_DATA);
michael@0: 	    return SECFailure;
michael@0: 	}
michael@0: 
michael@0: 	output_len += ofraglen;
michael@0:     } else {
michael@0: 	ofraglen = 0;
michael@0:     }
michael@0: 
michael@0:     /*
michael@0:      * If we just did our very last block, "remove" the padding by
michael@0:      * adjusting the output length.
michael@0:      */
michael@0:     if (final && (padsize != 0)) {
michael@0: 	unsigned int padlen = *(output + ofraglen - 1);
michael@0: 	if (padlen == 0 || padlen > padsize) {
michael@0: 	    PORT_SetError (SEC_ERROR_BAD_DATA);
michael@0: 	    return SECFailure;
michael@0: 	}
michael@0: 	output_len -= padlen;
michael@0:     }
michael@0: 
michael@0:     PORT_Assert (output_len_p != NULL || output_len == 0);
michael@0:     if (output_len_p != NULL)
michael@0: 	*output_len_p = output_len;
michael@0: 
michael@0:     return SECSuccess;
michael@0: }
michael@0: 
michael@0: /*
michael@0:  * Encrypt a given length of input buffer (starting at "input" and
michael@0:  * containing "input_len" bytes), placing the encrypted bytes in
michael@0:  * "output" and storing the output length in "*output_len_p".
michael@0:  * "obj" is the return value from sec_PKCS7CreateEncryptObject.
michael@0:  * When "final" is true, this is the last of the data to be encrypted.
michael@0:  *
michael@0:  * This is much more complicated than it sounds when the cipher is
michael@0:  * a block-type, meaning that the encryption function will only
michael@0:  * operate on whole blocks.  But our caller is operating stream-wise,
michael@0:  * and can pass in any number of bytes.  So we need to keep track
michael@0:  * of block boundaries.  We save excess bytes between calls in "obj".
michael@0:  * We also need to add padding bytes at the end.  PKCS #7 specifies
michael@0:  * that the padding used for a block cipher is a string of bytes,
michael@0:  * each of whose value is the same as the length of the padding,
michael@0:  * and that all data is padded.  (Even data that starts out with
michael@0:  * an exact multiple of blocks gets added to it another block,
michael@0:  * all of which is padding.)
michael@0:  *
michael@0:  * XXX I would kind of like to combine this with the function above
michael@0:  * which does decryption, since they have a lot in common.  But the
michael@0:  * tricky parts about padding and filling blocks would be much
michael@0:  * harder to read that way, so I left them separate.  At least for
michael@0:  * now until it is clear that they are right.
michael@0:  */ 
michael@0: SECStatus
michael@0: sec_PKCS7Encrypt (sec_PKCS7CipherObject *obj, unsigned char *output,
michael@0: 		  unsigned int *output_len_p, unsigned int max_output_len,
michael@0: 		  const unsigned char *input, unsigned int input_len,
michael@0: 		  PRBool final)
michael@0: {
michael@0:     int blocks, bsize, padlen, pcount, padsize;
michael@0:     unsigned int max_needed, ifraglen, ofraglen, output_len;
michael@0:     unsigned char *pbuf;
michael@0:     SECStatus rv;
michael@0: 
michael@0:     PORT_Assert (obj->encrypt);
michael@0: 
michael@0:     /*
michael@0:      * Check that we have enough room for the output.  Our caller should
michael@0:      * already handle this; failure is really an internal error (i.e. bug).
michael@0:      */
michael@0:     max_needed = sec_PKCS7EncryptLength (obj, input_len, final);
michael@0:     PORT_Assert (max_output_len >= max_needed);
michael@0:     if (max_output_len < max_needed) {
michael@0: 	/* PORT_SetError (XXX); */
michael@0: 	return SECFailure;
michael@0:     }
michael@0: 
michael@0:     bsize = obj->block_size;
michael@0:     padsize = obj->pad_size;
michael@0: 
michael@0:     /*
michael@0:      * When no blocking and padding work to do, we can simply call the
michael@0:      * cipher function and we are done.
michael@0:      */
michael@0:     if (bsize == 0) {
michael@0: 	return (* obj->doit) (obj->cx, output, output_len_p, max_output_len,
michael@0: 			      input, input_len);
michael@0:     }
michael@0: 
michael@0:     pcount = obj->pending_count;
michael@0:     pbuf = obj->pending_buf;
michael@0: 
michael@0:     output_len = 0;
michael@0: 
michael@0:     if (pcount) {
michael@0: 	/*
michael@0: 	 * Try to fill in an entire block, starting with the bytes
michael@0: 	 * we already have saved away.
michael@0: 	 */
michael@0: 	while (input_len && pcount < bsize) {
michael@0: 	    pbuf[pcount++] = *input++;
michael@0: 	    input_len--;
michael@0: 	}
michael@0: 	/*
michael@0: 	 * If we do not have a full block and we know we will be
michael@0: 	 * called again, then we are done for now.
michael@0: 	 */
michael@0: 	if (pcount < bsize && !final) {
michael@0: 	    obj->pending_count = pcount;
michael@0: 	    if (output_len_p != NULL)
michael@0: 		*output_len_p = 0;
michael@0: 	    return SECSuccess;
michael@0: 	}
michael@0: 	/*
michael@0: 	 * If we have a whole block available, encrypt it.
michael@0: 	 */
michael@0: 	if ((padsize == 0) || (pcount % padsize) == 0) {
michael@0: 	    rv = (* obj->doit) (obj->cx, output, &ofraglen, max_output_len,
michael@0: 				pbuf, pcount);
michael@0: 	    if (rv != SECSuccess)
michael@0: 		return rv;
michael@0: 
michael@0: 	    /*
michael@0: 	     * For now anyway, all of our ciphers have the same number of
michael@0: 	     * bytes of output as they do input.  If this ever becomes untrue,
michael@0: 	     * then sec_PKCS7EncryptLength needs to be made smarter!
michael@0: 	     */
michael@0: 	    PORT_Assert (ofraglen == pcount);
michael@0: 
michael@0: 	    /*
michael@0: 	     * Account for the bytes now in output.
michael@0: 	     */
michael@0: 	    max_output_len -= ofraglen;
michael@0: 	    output_len += ofraglen;
michael@0: 	    output += ofraglen;
michael@0: 
michael@0: 	    pcount = 0;
michael@0: 	}
michael@0:     }
michael@0: 
michael@0:     if (input_len) {
michael@0: 	PORT_Assert (pcount == 0);
michael@0: 
michael@0: 	blocks = input_len / bsize;
michael@0: 	ifraglen = blocks * bsize;
michael@0: 
michael@0: 	if (ifraglen) {
michael@0: 	    rv = (* obj->doit) (obj->cx, output, &ofraglen, max_output_len,
michael@0: 				input, ifraglen);
michael@0: 	    if (rv != SECSuccess)
michael@0: 		return rv;
michael@0: 
michael@0: 	    /*
michael@0: 	     * For now anyway, all of our ciphers have the same number of
michael@0: 	     * bytes of output as they do input.  If this ever becomes untrue,
michael@0: 	     * then sec_PKCS7EncryptLength needs to be made smarter!
michael@0: 	     */
michael@0: 	    PORT_Assert (ifraglen == ofraglen);
michael@0: 
michael@0: 	    max_output_len -= ofraglen;
michael@0: 	    output_len += ofraglen;
michael@0: 	    output += ofraglen;
michael@0: 	}
michael@0: 
michael@0: 	pcount = input_len - ifraglen;
michael@0: 	PORT_Assert (pcount < bsize);
michael@0: 	if (pcount)
michael@0: 	    PORT_Memcpy (pbuf, input + ifraglen, pcount);
michael@0:     }
michael@0: 
michael@0:     if (final) {
michael@0: 	padlen = padsize - (pcount % padsize);
michael@0: 	PORT_Memset (pbuf + pcount, padlen, padlen);
michael@0: 	rv = (* obj->doit) (obj->cx, output, &ofraglen, max_output_len,
michael@0: 			    pbuf, pcount+padlen);
michael@0: 	if (rv != SECSuccess)
michael@0: 	    return rv;
michael@0: 
michael@0: 	/*
michael@0: 	 * For now anyway, all of our ciphers have the same number of
michael@0: 	 * bytes of output as they do input.  If this ever becomes untrue,
michael@0: 	 * then sec_PKCS7EncryptLength needs to be made smarter!
michael@0: 	 */
michael@0: 	PORT_Assert (ofraglen == (pcount+padlen));
michael@0: 	output_len += ofraglen;
michael@0:     } else {
michael@0: 	obj->pending_count = pcount;
michael@0:     }
michael@0: 
michael@0:     PORT_Assert (output_len_p != NULL || output_len == 0);
michael@0:     if (output_len_p != NULL)
michael@0: 	*output_len_p = output_len;
michael@0: 
michael@0:     return SECSuccess;
michael@0: }
michael@0: 
michael@0: /*
michael@0:  * End of cipher stuff.
michael@0:  * -------------------------------------------------------------------
michael@0:  */
michael@0: 
michael@0: 
michael@0: /*
michael@0:  * -------------------------------------------------------------------
michael@0:  * XXX The following Attribute stuff really belongs elsewhere.
michael@0:  * The Attribute type is *not* part of pkcs7 but rather X.501.
michael@0:  * But for now, since PKCS7 is the only customer of attributes,
michael@0:  * we define them here.  Once there is a use outside of PKCS7,
michael@0:  * then change the attribute types and functions from internal
michael@0:  * to external naming convention, and move them elsewhere!
michael@0:  */
michael@0: 
michael@0: /*
michael@0:  * Look through a set of attributes and find one that matches the
michael@0:  * specified object ID.  If "only" is true, then make sure that
michael@0:  * there is not more than one attribute of the same type.  Otherwise,
michael@0:  * just return the first one found. (XXX Does anybody really want
michael@0:  * that first-found behavior?  It was like that when I found it...)
michael@0:  */
michael@0: SEC_PKCS7Attribute *
michael@0: sec_PKCS7FindAttribute (SEC_PKCS7Attribute **attrs, SECOidTag oidtag,
michael@0: 			PRBool only)
michael@0: {
michael@0:     SECOidData *oid;
michael@0:     SEC_PKCS7Attribute *attr1, *attr2;
michael@0: 
michael@0:     if (attrs == NULL)
michael@0: 	return NULL;
michael@0: 
michael@0:     oid = SECOID_FindOIDByTag(oidtag);
michael@0:     if (oid == NULL)
michael@0: 	return NULL;
michael@0: 
michael@0:     while ((attr1 = *attrs++) != NULL) {
michael@0: 	if (attr1->type.len == oid->oid.len && PORT_Memcmp (attr1->type.data,
michael@0: 							    oid->oid.data,
michael@0: 							    oid->oid.len) == 0)
michael@0: 	    break;
michael@0:     }
michael@0: 
michael@0:     if (attr1 == NULL)
michael@0: 	return NULL;
michael@0: 
michael@0:     if (!only)
michael@0: 	return attr1;
michael@0: 
michael@0:     while ((attr2 = *attrs++) != NULL) {
michael@0: 	if (attr2->type.len == oid->oid.len && PORT_Memcmp (attr2->type.data,
michael@0: 							    oid->oid.data,
michael@0: 							    oid->oid.len) == 0)
michael@0: 	    break;
michael@0:     }
michael@0: 
michael@0:     if (attr2 != NULL)
michael@0: 	return NULL;
michael@0: 
michael@0:     return attr1;
michael@0: }
michael@0: 
michael@0: 
michael@0: /*
michael@0:  * Return the single attribute value, doing some sanity checking first:
michael@0:  * - Multiple values are *not* expected.
michael@0:  * - Empty values are *not* expected.
michael@0:  */
michael@0: SECItem *
michael@0: sec_PKCS7AttributeValue(SEC_PKCS7Attribute *attr)
michael@0: {
michael@0:     SECItem *value;
michael@0: 
michael@0:     if (attr == NULL)
michael@0: 	return NULL;
michael@0: 
michael@0:     value = attr->values[0];
michael@0: 
michael@0:     if (value == NULL || value->data == NULL || value->len == 0)
michael@0: 	return NULL;
michael@0: 
michael@0:     if (attr->values[1] != NULL)
michael@0: 	return NULL;
michael@0: 
michael@0:     return value;
michael@0: }
michael@0: 
michael@0: static const SEC_ASN1Template *
michael@0: sec_attr_choose_attr_value_template(void *src_or_dest, PRBool encoding)
michael@0: {
michael@0:     const SEC_ASN1Template *theTemplate;
michael@0: 
michael@0:     SEC_PKCS7Attribute *attribute;
michael@0:     SECOidData *oiddata;
michael@0:     PRBool encoded;
michael@0: 
michael@0:     PORT_Assert (src_or_dest != NULL);
michael@0:     if (src_or_dest == NULL)
michael@0: 	return NULL;
michael@0: 
michael@0:     attribute = (SEC_PKCS7Attribute*)src_or_dest;
michael@0: 
michael@0:     if (encoding && attribute->encoded)
michael@0: 	return SEC_ASN1_GET(SEC_AnyTemplate);
michael@0: 
michael@0:     oiddata = attribute->typeTag;
michael@0:     if (oiddata == NULL) {
michael@0: 	oiddata = SECOID_FindOID(&attribute->type);
michael@0: 	attribute->typeTag = oiddata;
michael@0:     }
michael@0: 
michael@0:     if (oiddata == NULL) {
michael@0: 	encoded = PR_TRUE;
michael@0: 	theTemplate = SEC_ASN1_GET(SEC_AnyTemplate);
michael@0:     } else {
michael@0: 	switch (oiddata->offset) {
michael@0: 	  default:
michael@0: 	    encoded = PR_TRUE;
michael@0: 	    theTemplate = SEC_ASN1_GET(SEC_AnyTemplate);
michael@0: 	    break;
michael@0: 	  case SEC_OID_PKCS9_EMAIL_ADDRESS:
michael@0: 	  case SEC_OID_RFC1274_MAIL:
michael@0: 	  case SEC_OID_PKCS9_UNSTRUCTURED_NAME:
michael@0: 	    encoded = PR_FALSE;
michael@0: 	    theTemplate = SEC_ASN1_GET(SEC_IA5StringTemplate);
michael@0: 	    break;
michael@0: 	  case SEC_OID_PKCS9_CONTENT_TYPE:
michael@0: 	    encoded = PR_FALSE;
michael@0: 	    theTemplate = SEC_ASN1_GET(SEC_ObjectIDTemplate);
michael@0: 	    break;
michael@0: 	  case SEC_OID_PKCS9_MESSAGE_DIGEST:
michael@0: 	    encoded = PR_FALSE;
michael@0: 	    theTemplate = SEC_ASN1_GET(SEC_OctetStringTemplate);
michael@0: 	    break;
michael@0: 	  case SEC_OID_PKCS9_SIGNING_TIME:
michael@0: 	    encoded = PR_FALSE;
michael@0:             theTemplate = SEC_ASN1_GET(CERT_TimeChoiceTemplate);
michael@0: 	    break;
michael@0: 	  /* XXX Want other types here, too */
michael@0: 	}
michael@0:     }
michael@0: 
michael@0:     if (encoding) {
michael@0: 	/*
michael@0: 	 * If we are encoding and we think we have an already-encoded value,
michael@0: 	 * then the code which initialized this attribute should have set
michael@0: 	 * the "encoded" property to true (and we would have returned early,
michael@0: 	 * up above).  No devastating error, but that code should be fixed.
michael@0: 	 * (It could indicate that the resulting encoded bytes are wrong.)
michael@0: 	 */
michael@0: 	PORT_Assert (!encoded);
michael@0:     } else {
michael@0: 	/*
michael@0: 	 * We are decoding; record whether the resulting value is
michael@0: 	 * still encoded or not.
michael@0: 	 */
michael@0: 	attribute->encoded = encoded;
michael@0:     }
michael@0:     return theTemplate;
michael@0: }
michael@0: 
michael@0: static const SEC_ASN1TemplateChooserPtr sec_attr_chooser
michael@0: 	= sec_attr_choose_attr_value_template;
michael@0: 
michael@0: static const SEC_ASN1Template sec_pkcs7_attribute_template[] = {
michael@0:     { SEC_ASN1_SEQUENCE,
michael@0: 	  0, NULL, sizeof(SEC_PKCS7Attribute) },
michael@0:     { SEC_ASN1_OBJECT_ID,
michael@0: 	  offsetof(SEC_PKCS7Attribute,type) },
michael@0:     { SEC_ASN1_DYNAMIC | SEC_ASN1_SET_OF,
michael@0: 	  offsetof(SEC_PKCS7Attribute,values),
michael@0: 	  &sec_attr_chooser },
michael@0:     { 0 }
michael@0: };
michael@0: 
michael@0: static const SEC_ASN1Template sec_pkcs7_set_of_attribute_template[] = {
michael@0:     { SEC_ASN1_SET_OF, 0, sec_pkcs7_attribute_template },
michael@0: };
michael@0: 
michael@0: /*
michael@0:  * If you are wondering why this routine does not reorder the attributes
michael@0:  * first, and might be tempted to make it do so, see the comment by the
michael@0:  * call to ReorderAttributes in p7encode.c.  (Or, see who else calls this
michael@0:  * and think long and hard about the implications of making it always
michael@0:  * do the reordering.)
michael@0:  */
michael@0: SECItem *
michael@0: sec_PKCS7EncodeAttributes (PLArenaPool *poolp, SECItem *dest, void *src)
michael@0: {
michael@0:     return SEC_ASN1EncodeItem (poolp, dest, src,
michael@0: 			       sec_pkcs7_set_of_attribute_template);
michael@0: }
michael@0: 
michael@0: /*
michael@0:  * Make sure that the order of the attributes guarantees valid DER
michael@0:  * (which must be in lexigraphically ascending order for a SET OF);
michael@0:  * if reordering is necessary it will be done in place (in attrs).
michael@0:  */
michael@0: SECStatus
michael@0: sec_PKCS7ReorderAttributes (SEC_PKCS7Attribute **attrs)
michael@0: {
michael@0:     PLArenaPool *poolp;
michael@0:     int num_attrs, i, pass, besti;
michael@0:     unsigned int j;
michael@0:     SECItem **enc_attrs;
michael@0:     SEC_PKCS7Attribute **new_attrs;
michael@0: 
michael@0:     /*
michael@0:      * I think we should not be called with NULL.  But if we are,
michael@0:      * call it a success anyway, because the order *is* okay.
michael@0:      */
michael@0:     PORT_Assert (attrs != NULL);
michael@0:     if (attrs == NULL)
michael@0: 	return SECSuccess;
michael@0: 
michael@0:     /*
michael@0:      * Count how many attributes we are dealing with here.
michael@0:      */
michael@0:     num_attrs = 0;
michael@0:     while (attrs[num_attrs] != NULL)
michael@0: 	num_attrs++;
michael@0: 
michael@0:     /*
michael@0:      * Again, I think we should have some attributes here.
michael@0:      * But if we do not, or if there is only one, then call it
michael@0:      * a success because it also already has a fine order.
michael@0:      */
michael@0:     PORT_Assert (num_attrs);
michael@0:     if (num_attrs == 0 || num_attrs == 1)
michael@0: 	return SECSuccess;
michael@0: 
michael@0:     /*
michael@0:      * Allocate an arena for us to work with, so it is easy to
michael@0:      * clean up all of the memory (fairly small pieces, really).
michael@0:      */
michael@0:     poolp = PORT_NewArena (1024);	/* XXX what is right value? */
michael@0:     if (poolp == NULL)
michael@0: 	return SECFailure;		/* no memory; nothing we can do... */
michael@0: 
michael@0:     /*
michael@0:      * Allocate arrays to hold the individual encodings which we will use
michael@0:      * for comparisons and the reordered attributes as they are sorted.
michael@0:      */
michael@0:     enc_attrs=(SECItem**)PORT_ArenaZAlloc(poolp, num_attrs*sizeof(SECItem *));
michael@0:     new_attrs = (SEC_PKCS7Attribute**)PORT_ArenaZAlloc (poolp,
michael@0: 				  num_attrs * sizeof(SEC_PKCS7Attribute *));
michael@0:     if (enc_attrs == NULL || new_attrs == NULL) {
michael@0: 	PORT_FreeArena (poolp, PR_FALSE);
michael@0: 	return SECFailure;
michael@0:     }
michael@0: 
michael@0:     /*
michael@0:      * DER encode each individual attribute.
michael@0:      */
michael@0:     for (i = 0; i < num_attrs; i++) {
michael@0: 	enc_attrs[i] = SEC_ASN1EncodeItem (poolp, NULL, attrs[i],
michael@0: 					   sec_pkcs7_attribute_template);
michael@0: 	if (enc_attrs[i] == NULL) {
michael@0: 	    PORT_FreeArena (poolp, PR_FALSE);
michael@0: 	    return SECFailure;
michael@0: 	}
michael@0:     }
michael@0: 
michael@0:     /*
michael@0:      * Now compare and sort them; this is not the most efficient sorting
michael@0:      * method, but it is just fine for the problem at hand, because the
michael@0:      * number of attributes is (always) going to be small.
michael@0:      */
michael@0:     for (pass = 0; pass < num_attrs; pass++) {
michael@0: 	/*
michael@0: 	 * Find the first not-yet-accepted attribute.  (Once one is
michael@0: 	 * sorted into the other array, it is cleared from enc_attrs.)
michael@0: 	 */
michael@0: 	for (i = 0; i < num_attrs; i++) {
michael@0: 	    if (enc_attrs[i] != NULL)
michael@0: 		break;
michael@0: 	}
michael@0: 	PORT_Assert (i < num_attrs);
michael@0: 	besti = i;
michael@0: 
michael@0: 	/*
michael@0: 	 * Find the lowest (lexigraphically) encoding.  One that is
michael@0: 	 * shorter than all the rest is known to be "less" because each
michael@0: 	 * attribute is of the same type (a SEQUENCE) and so thus the
michael@0: 	 * first octet of each is the same, and the second octet is
michael@0: 	 * the length (or the length of the length with the high bit
michael@0: 	 * set, followed by the length, which also works out to always
michael@0: 	 * order the shorter first).  Two (or more) that have the
michael@0: 	 * same length need to be compared byte by byte until a mismatch
michael@0: 	 * is found.
michael@0: 	 */
michael@0: 	for (i = besti + 1; i < num_attrs; i++) {
michael@0: 	    if (enc_attrs[i] == NULL)	/* slot already handled */
michael@0: 		continue;
michael@0: 
michael@0: 	    if (enc_attrs[i]->len != enc_attrs[besti]->len) {
michael@0: 		if (enc_attrs[i]->len < enc_attrs[besti]->len)
michael@0: 		    besti = i;
michael@0: 		continue;
michael@0: 	    }
michael@0: 
michael@0: 	    for (j = 0; j < enc_attrs[i]->len; j++) {
michael@0: 		if (enc_attrs[i]->data[j] < enc_attrs[besti]->data[j]) {
michael@0: 		    besti = i;
michael@0: 		    break;
michael@0: 		}
michael@0: 	    }
michael@0: 
michael@0: 	    /*
michael@0: 	     * For this not to be true, we would have to have encountered	
michael@0: 	     * two *identical* attributes, which I think we should not see.
michael@0: 	     * So assert if it happens, but even if it does, let it go
michael@0: 	     * through; the ordering of the two does not matter.
michael@0: 	     */
michael@0: 	    PORT_Assert (j < enc_attrs[i]->len);
michael@0: 	}
michael@0: 
michael@0: 	/*
michael@0: 	 * Now we have found the next-lowest one; copy it over and
michael@0: 	 * remove it from enc_attrs.
michael@0: 	 */
michael@0: 	new_attrs[pass] = attrs[besti];
michael@0: 	enc_attrs[besti] = NULL;
michael@0:     }
michael@0: 
michael@0:     /*
michael@0:      * Now new_attrs has the attributes in the order we want;
michael@0:      * copy them back into the attrs array we started with.
michael@0:      */
michael@0:     for (i = 0; i < num_attrs; i++)
michael@0: 	attrs[i] = new_attrs[i];
michael@0: 
michael@0:     PORT_FreeArena (poolp, PR_FALSE);
michael@0:     return SECSuccess;
michael@0: }
michael@0: 
michael@0: /*
michael@0:  * End of attribute stuff.
michael@0:  * -------------------------------------------------------------------
michael@0:  */
michael@0: 
michael@0: 
michael@0: /*
michael@0:  * Templates and stuff.  Keep these at the end of the file.
michael@0:  */
michael@0: 
michael@0: /* forward declaration */
michael@0: static const SEC_ASN1Template *
michael@0: sec_pkcs7_choose_content_template(void *src_or_dest, PRBool encoding);
michael@0: 
michael@0: static const SEC_ASN1TemplateChooserPtr sec_pkcs7_chooser
michael@0: 	= sec_pkcs7_choose_content_template;
michael@0: 
michael@0: const SEC_ASN1Template sec_PKCS7ContentInfoTemplate[] = {
michael@0:     { SEC_ASN1_SEQUENCE | SEC_ASN1_MAY_STREAM,
michael@0: 	  0, NULL, sizeof(SEC_PKCS7ContentInfo) },
michael@0:     { SEC_ASN1_OBJECT_ID,
michael@0: 	  offsetof(SEC_PKCS7ContentInfo,contentType) },
michael@0:     { SEC_ASN1_OPTIONAL | SEC_ASN1_DYNAMIC | SEC_ASN1_MAY_STREAM
michael@0:      | SEC_ASN1_EXPLICIT | SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC | 0,
michael@0: 	  offsetof(SEC_PKCS7ContentInfo,content),
michael@0: 	  &sec_pkcs7_chooser },
michael@0:     { 0 }
michael@0: };
michael@0: 
michael@0: /* XXX These names should change from external to internal convention. */
michael@0: 
michael@0: static const SEC_ASN1Template SEC_PKCS7SignerInfoTemplate[] = {
michael@0:     { SEC_ASN1_SEQUENCE,
michael@0: 	  0, NULL, sizeof(SEC_PKCS7SignerInfo) },
michael@0:     { SEC_ASN1_INTEGER,
michael@0: 	  offsetof(SEC_PKCS7SignerInfo,version) },
michael@0:     { SEC_ASN1_POINTER | SEC_ASN1_XTRN,
michael@0: 	  offsetof(SEC_PKCS7SignerInfo,issuerAndSN),
michael@0: 	  SEC_ASN1_SUB(CERT_IssuerAndSNTemplate) },
michael@0:     { SEC_ASN1_INLINE | SEC_ASN1_XTRN,
michael@0: 	  offsetof(SEC_PKCS7SignerInfo,digestAlg),
michael@0: 	  SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
michael@0:     { SEC_ASN1_OPTIONAL | SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC | 0,
michael@0: 	  offsetof(SEC_PKCS7SignerInfo,authAttr),
michael@0: 	  sec_pkcs7_set_of_attribute_template },
michael@0:     { SEC_ASN1_INLINE | SEC_ASN1_XTRN,
michael@0: 	  offsetof(SEC_PKCS7SignerInfo,digestEncAlg),
michael@0: 	  SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
michael@0:     { SEC_ASN1_OCTET_STRING,
michael@0: 	  offsetof(SEC_PKCS7SignerInfo,encDigest) },
michael@0:     { SEC_ASN1_OPTIONAL | SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC | 1,
michael@0: 	  offsetof(SEC_PKCS7SignerInfo,unAuthAttr),
michael@0: 	  sec_pkcs7_set_of_attribute_template },
michael@0:     { 0 }
michael@0: };
michael@0: 
michael@0: static const SEC_ASN1Template SEC_PKCS7SignedDataTemplate[] = {
michael@0:     { SEC_ASN1_SEQUENCE | SEC_ASN1_MAY_STREAM,
michael@0: 	  0, NULL, sizeof(SEC_PKCS7SignedData) },
michael@0:     { SEC_ASN1_INTEGER,
michael@0: 	  offsetof(SEC_PKCS7SignedData,version) },
michael@0:     { SEC_ASN1_SET_OF | SEC_ASN1_XTRN,
michael@0: 	  offsetof(SEC_PKCS7SignedData,digestAlgorithms),
michael@0: 	  SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
michael@0:     { SEC_ASN1_INLINE,
michael@0: 	  offsetof(SEC_PKCS7SignedData,contentInfo),
michael@0: 	  sec_PKCS7ContentInfoTemplate },
michael@0:     { SEC_ASN1_OPTIONAL | SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC  |
michael@0:       SEC_ASN1_XTRN | 0,
michael@0: 	  offsetof(SEC_PKCS7SignedData,rawCerts),
michael@0: 	  SEC_ASN1_SUB(SEC_SetOfAnyTemplate) },
michael@0:     { SEC_ASN1_OPTIONAL | SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC  |
michael@0:       SEC_ASN1_XTRN | 1,
michael@0: 	  offsetof(SEC_PKCS7SignedData,crls),
michael@0: 	  SEC_ASN1_SUB(CERT_SetOfSignedCrlTemplate) },
michael@0:     { SEC_ASN1_SET_OF,
michael@0: 	  offsetof(SEC_PKCS7SignedData,signerInfos),
michael@0: 	  SEC_PKCS7SignerInfoTemplate },
michael@0:     { 0 }
michael@0: };
michael@0: 
michael@0: static const SEC_ASN1Template SEC_PointerToPKCS7SignedDataTemplate[] = {
michael@0:     { SEC_ASN1_POINTER, 0, SEC_PKCS7SignedDataTemplate }
michael@0: };
michael@0: 
michael@0: static const SEC_ASN1Template SEC_PKCS7RecipientInfoTemplate[] = {
michael@0:     { SEC_ASN1_SEQUENCE,
michael@0: 	  0, NULL, sizeof(SEC_PKCS7RecipientInfo) },
michael@0:     { SEC_ASN1_INTEGER,
michael@0: 	  offsetof(SEC_PKCS7RecipientInfo,version) },
michael@0:     { SEC_ASN1_POINTER | SEC_ASN1_XTRN,
michael@0: 	  offsetof(SEC_PKCS7RecipientInfo,issuerAndSN),
michael@0: 	  SEC_ASN1_SUB(CERT_IssuerAndSNTemplate) },
michael@0:     { SEC_ASN1_INLINE | SEC_ASN1_XTRN,
michael@0: 	  offsetof(SEC_PKCS7RecipientInfo,keyEncAlg),
michael@0: 	  SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
michael@0:     { SEC_ASN1_OCTET_STRING,
michael@0: 	  offsetof(SEC_PKCS7RecipientInfo,encKey) },
michael@0:     { 0 }
michael@0: };
michael@0: 
michael@0: static const SEC_ASN1Template SEC_PKCS7EncryptedContentInfoTemplate[] = {
michael@0:     { SEC_ASN1_SEQUENCE | SEC_ASN1_MAY_STREAM,
michael@0: 	  0, NULL, sizeof(SEC_PKCS7EncryptedContentInfo) },
michael@0:     { SEC_ASN1_OBJECT_ID,
michael@0: 	  offsetof(SEC_PKCS7EncryptedContentInfo,contentType) },
michael@0:     { SEC_ASN1_INLINE | SEC_ASN1_XTRN,
michael@0: 	  offsetof(SEC_PKCS7EncryptedContentInfo,contentEncAlg),
michael@0: 	  SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
michael@0:     { SEC_ASN1_OPTIONAL | SEC_ASN1_MAY_STREAM | SEC_ASN1_CONTEXT_SPECIFIC |
michael@0:       SEC_ASN1_XTRN | 0,
michael@0: 	  offsetof(SEC_PKCS7EncryptedContentInfo,encContent),
michael@0: 	  SEC_ASN1_SUB(SEC_OctetStringTemplate) },
michael@0:     { 0 }
michael@0: };
michael@0: 
michael@0: static const SEC_ASN1Template SEC_PKCS7EnvelopedDataTemplate[] = {
michael@0:     { SEC_ASN1_SEQUENCE | SEC_ASN1_MAY_STREAM,
michael@0: 	  0, NULL, sizeof(SEC_PKCS7EnvelopedData) },
michael@0:     { SEC_ASN1_INTEGER,
michael@0: 	  offsetof(SEC_PKCS7EnvelopedData,version) },
michael@0:     { SEC_ASN1_SET_OF,
michael@0: 	  offsetof(SEC_PKCS7EnvelopedData,recipientInfos),
michael@0: 	  SEC_PKCS7RecipientInfoTemplate },
michael@0:     { SEC_ASN1_INLINE,
michael@0: 	  offsetof(SEC_PKCS7EnvelopedData,encContentInfo),
michael@0: 	  SEC_PKCS7EncryptedContentInfoTemplate },
michael@0:     { 0 }
michael@0: };
michael@0: 
michael@0: static const SEC_ASN1Template SEC_PointerToPKCS7EnvelopedDataTemplate[] = {
michael@0:     { SEC_ASN1_POINTER, 0, SEC_PKCS7EnvelopedDataTemplate }
michael@0: };
michael@0: 
michael@0: static const SEC_ASN1Template SEC_PKCS7SignedAndEnvelopedDataTemplate[] = {
michael@0:     { SEC_ASN1_SEQUENCE | SEC_ASN1_MAY_STREAM,
michael@0: 	  0, NULL, sizeof(SEC_PKCS7SignedAndEnvelopedData) },
michael@0:     { SEC_ASN1_INTEGER,
michael@0: 	  offsetof(SEC_PKCS7SignedAndEnvelopedData,version) },
michael@0:     { SEC_ASN1_SET_OF,
michael@0: 	  offsetof(SEC_PKCS7SignedAndEnvelopedData,recipientInfos),
michael@0: 	  SEC_PKCS7RecipientInfoTemplate },
michael@0:     { SEC_ASN1_SET_OF | SEC_ASN1_XTRN,
michael@0: 	  offsetof(SEC_PKCS7SignedAndEnvelopedData,digestAlgorithms),
michael@0: 	  SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
michael@0:     { SEC_ASN1_INLINE,
michael@0: 	  offsetof(SEC_PKCS7SignedAndEnvelopedData,encContentInfo),
michael@0: 	  SEC_PKCS7EncryptedContentInfoTemplate },
michael@0:     { SEC_ASN1_OPTIONAL | SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC |
michael@0:       SEC_ASN1_XTRN | 0,
michael@0: 	  offsetof(SEC_PKCS7SignedAndEnvelopedData,rawCerts),
michael@0: 	  SEC_ASN1_SUB(SEC_SetOfAnyTemplate) },
michael@0:     { SEC_ASN1_OPTIONAL | SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC |
michael@0:       SEC_ASN1_XTRN | 1,
michael@0: 	  offsetof(SEC_PKCS7SignedAndEnvelopedData,crls),
michael@0: 	  SEC_ASN1_SUB(CERT_SetOfSignedCrlTemplate) },
michael@0:     { SEC_ASN1_SET_OF,
michael@0: 	  offsetof(SEC_PKCS7SignedAndEnvelopedData,signerInfos),
michael@0: 	  SEC_PKCS7SignerInfoTemplate },
michael@0:     { 0 }
michael@0: };
michael@0: 
michael@0: static const SEC_ASN1Template
michael@0: SEC_PointerToPKCS7SignedAndEnvelopedDataTemplate[] = {
michael@0:     { SEC_ASN1_POINTER, 0, SEC_PKCS7SignedAndEnvelopedDataTemplate }
michael@0: };
michael@0: 
michael@0: static const SEC_ASN1Template SEC_PKCS7DigestedDataTemplate[] = {
michael@0:     { SEC_ASN1_SEQUENCE | SEC_ASN1_MAY_STREAM,
michael@0: 	  0, NULL, sizeof(SEC_PKCS7DigestedData) },
michael@0:     { SEC_ASN1_INTEGER,
michael@0: 	  offsetof(SEC_PKCS7DigestedData,version) },
michael@0:     { SEC_ASN1_INLINE | SEC_ASN1_XTRN,
michael@0: 	  offsetof(SEC_PKCS7DigestedData,digestAlg),
michael@0: 	  SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
michael@0:     { SEC_ASN1_INLINE,
michael@0: 	  offsetof(SEC_PKCS7DigestedData,contentInfo),
michael@0: 	  sec_PKCS7ContentInfoTemplate },
michael@0:     { SEC_ASN1_OCTET_STRING,
michael@0: 	  offsetof(SEC_PKCS7DigestedData,digest) },
michael@0:     { 0 }
michael@0: };
michael@0: 
michael@0: static const SEC_ASN1Template SEC_PointerToPKCS7DigestedDataTemplate[] = {
michael@0:     { SEC_ASN1_POINTER, 0, SEC_PKCS7DigestedDataTemplate }
michael@0: };
michael@0: 
michael@0: static const SEC_ASN1Template SEC_PKCS7EncryptedDataTemplate[] = {
michael@0:     { SEC_ASN1_SEQUENCE | SEC_ASN1_MAY_STREAM,
michael@0: 	  0, NULL, sizeof(SEC_PKCS7EncryptedData) },
michael@0:     { SEC_ASN1_INTEGER,
michael@0: 	  offsetof(SEC_PKCS7EncryptedData,version) },
michael@0:     { SEC_ASN1_INLINE,
michael@0: 	  offsetof(SEC_PKCS7EncryptedData,encContentInfo),
michael@0: 	  SEC_PKCS7EncryptedContentInfoTemplate },
michael@0:     { 0 }
michael@0: };
michael@0: 
michael@0: static const SEC_ASN1Template SEC_PointerToPKCS7EncryptedDataTemplate[] = {
michael@0:     { SEC_ASN1_POINTER, 0, SEC_PKCS7EncryptedDataTemplate }
michael@0: };
michael@0: 
michael@0: static const SEC_ASN1Template *
michael@0: sec_pkcs7_choose_content_template(void *src_or_dest, PRBool encoding)
michael@0: {
michael@0:     const SEC_ASN1Template *theTemplate;
michael@0:     SEC_PKCS7ContentInfo *cinfo;
michael@0:     SECOidTag kind;
michael@0: 
michael@0:     PORT_Assert (src_or_dest != NULL);
michael@0:     if (src_or_dest == NULL)
michael@0: 	return NULL;
michael@0: 
michael@0:     cinfo = (SEC_PKCS7ContentInfo*)src_or_dest;
michael@0:     kind = SEC_PKCS7ContentType (cinfo);
michael@0:     switch (kind) {
michael@0:       default:
michael@0: 	theTemplate = SEC_ASN1_GET(SEC_PointerToAnyTemplate);
michael@0: 	break;
michael@0:       case SEC_OID_PKCS7_DATA:
michael@0: 	theTemplate = SEC_ASN1_GET(SEC_PointerToOctetStringTemplate);
michael@0: 	break;
michael@0:       case SEC_OID_PKCS7_SIGNED_DATA:
michael@0: 	theTemplate = SEC_PointerToPKCS7SignedDataTemplate;
michael@0: 	break;
michael@0:       case SEC_OID_PKCS7_ENVELOPED_DATA:
michael@0: 	theTemplate = SEC_PointerToPKCS7EnvelopedDataTemplate;
michael@0: 	break;
michael@0:       case SEC_OID_PKCS7_SIGNED_ENVELOPED_DATA:
michael@0: 	theTemplate = SEC_PointerToPKCS7SignedAndEnvelopedDataTemplate;
michael@0: 	break;
michael@0:       case SEC_OID_PKCS7_DIGESTED_DATA:
michael@0: 	theTemplate = SEC_PointerToPKCS7DigestedDataTemplate;
michael@0: 	break;
michael@0:       case SEC_OID_PKCS7_ENCRYPTED_DATA:
michael@0: 	theTemplate = SEC_PointerToPKCS7EncryptedDataTemplate;
michael@0: 	break;
michael@0:     }
michael@0:     return theTemplate;
michael@0: }
michael@0: 
michael@0: /*
michael@0:  * End of templates.  Do not add stuff after this; put new code
michael@0:  * up above the start of the template definitions.
michael@0:  */