stdlib/ext/openssl/ossl_pkcs7.c

   1 /*
   2  * $Id: ossl_pkcs7.c 11708 2007-02-12 23:01:19Z shyouhei $
   3  * 'OpenSSL for Ruby' project
   4  * Copyright (C) 2001-2002  Michal Rokos <m.rokos@sh.cvut.cz>
   5  * All rights reserved.
   6  */
   7 /*
   8  * This program is licenced under the same licence as Ruby.
   9  * (See the file 'LICENCE'.)
  10  */
  11 #include "ossl.h"
  12
  13 #define WrapPKCS7(klass, obj, pkcs7) do { \
  14     if (!pkcs7) { \
  15         ossl_raise(rb_eRuntimeError, "PKCS7 wasn't initialized."); \
  16     } \
  17     obj = Data_Wrap_Struct(klass, 0, PKCS7_free, pkcs7); \
  18 } while (0)
  19 #define GetPKCS7(obj, pkcs7) do { \
  20     Data_Get_Struct(obj, PKCS7, pkcs7); \
  21     if (!pkcs7) { \
  22         ossl_raise(rb_eRuntimeError, "PKCS7 wasn't initialized."); \
  23     } \
  24 } while (0)
  25 #define SafeGetPKCS7(obj, pkcs7) do { \
  26     OSSL_Check_Kind(obj, cPKCS7); \
  27     GetPKCS7(obj, pkcs7); \
  28 } while (0)
  29
  30 #define WrapPKCS7si(klass, obj, p7si) do { \
  31     if (!p7si) { \
  32         ossl_raise(rb_eRuntimeError, "PKCS7si wasn't initialized."); \
  33     } \
  34     obj = Data_Wrap_Struct(klass, 0, PKCS7_SIGNER_INFO_free, p7si); \
  35 } while (0)
  36 #define GetPKCS7si(obj, p7si) do { \
  37     Data_Get_Struct(obj, PKCS7_SIGNER_INFO, p7si); \
  38     if (!p7si) { \
  39         ossl_raise(rb_eRuntimeError, "PKCS7si wasn't initialized."); \
  40     } \
  41 } while (0)
  42 #define SafeGetPKCS7si(obj, p7si) do { \
  43     OSSL_Check_Kind(obj, cPKCS7Signer); \
  44     GetPKCS7si(obj, p7si); \
  45 } while (0)
  46
  47 #define WrapPKCS7ri(klass, obj, p7ri) do { \
  48     if (!p7ri) { \
  49         ossl_raise(rb_eRuntimeError, "PKCS7ri wasn't initialized."); \
  50     } \
  51     obj = Data_Wrap_Struct(klass, 0, PKCS7_RECIP_INFO_free, p7ri); \
  52 } while (0)
  53 #define GetPKCS7ri(obj, p7ri) do { \
  54     Data_Get_Struct(obj, PKCS7_RECIP_INFO, p7ri); \
  55     if (!p7ri) { \
  56         ossl_raise(rb_eRuntimeError, "PKCS7ri wasn't initialized."); \
  57     } \
  58 } while (0)
  59 #define SafeGetPKCS7ri(obj, p7ri) do { \
  60     OSSL_Check_Kind(obj, cPKCS7Recipient); \
  61     GetPKCS7ri(obj, p7ri); \
  62 } while (0)
  63
  64 #define numberof(ary) (sizeof(ary)/sizeof(ary[0]))
  65
  66 #define ossl_pkcs7_set_data(o,v)       rb_iv_set((o), "@data", (v))
  67 #define ossl_pkcs7_get_data(o)         rb_iv_get((o), "@data")
  68 #define ossl_pkcs7_set_err_string(o,v) rb_iv_set((o), "@error_string", (v))
  69 #define ossl_pkcs7_get_err_string(o)   rb_iv_get((o), "@error_string")
  70
  71 /*
  72  * Classes
  73  */
  74 VALUE mPKCS7;
  75 VALUE cPKCS7;
  76 VALUE cPKCS7Signer;
  77 VALUE cPKCS7Recipient;
  78 VALUE ePKCS7Error;
  79
  80 /*
  81  * Public
  82  * (MADE PRIVATE UNTIL SOMEBODY WILL NEED THEM)
  83  */
  84 static VALUE
  85 ossl_pkcs7si_new(PKCS7_SIGNER_INFO *p7si)
  86 {
  87     PKCS7_SIGNER_INFO *pkcs7;
  88     VALUE obj;
  89
  90     pkcs7 = p7si ? PKCS7_SIGNER_INFO_dup(p7si) : PKCS7_SIGNER_INFO_new();
  91     if (!pkcs7) ossl_raise(ePKCS7Error, NULL);
  92     WrapPKCS7si(cPKCS7Signer, obj, pkcs7);
  93
  94     return obj;
  95 }
  96
  97 static PKCS7_SIGNER_INFO *
  98 DupPKCS7SignerPtr(VALUE obj)
  99 {
 100     PKCS7_SIGNER_INFO *p7si, *pkcs7;
 101
 102     SafeGetPKCS7si(obj, p7si);
 103     if (!(pkcs7 = PKCS7_SIGNER_INFO_dup(p7si))) {
 104         ossl_raise(ePKCS7Error, NULL);
 105     }
 106
 107     return pkcs7;
 108 }
 109
 110 static VALUE
 111 ossl_pkcs7ri_new(PKCS7_RECIP_INFO *p7ri)
 112 {
 113     PKCS7_RECIP_INFO *pkcs7;
 114     VALUE obj;
 115
 116     pkcs7 = p7ri ? PKCS7_RECIP_INFO_dup(p7ri) : PKCS7_RECIP_INFO_new();
 117     if (!pkcs7) ossl_raise(ePKCS7Error, NULL);
 118     WrapPKCS7ri(cPKCS7Recipient, obj, pkcs7);
 119
 120     return obj;
 121 }
 122
 123 static PKCS7_RECIP_INFO *
 124 DupPKCS7RecipientPtr(VALUE obj)
 125 {
 126     PKCS7_RECIP_INFO *p7ri, *pkcs7;
 127
 128     SafeGetPKCS7ri(obj, p7ri);
 129     if (!(pkcs7 = PKCS7_RECIP_INFO_dup(p7ri))) {
 130         ossl_raise(ePKCS7Error, NULL);
 131     }
 132
 133     return pkcs7;
 134 }
 135
 136 /*
 137  * Private
 138  */
 139 static VALUE
 140 ossl_pkcs7_s_read_smime(VALUE klass, VALUE arg)
 141 {
 142     BIO *in, *out;
 143     PKCS7 *pkcs7;
 144     VALUE ret, data;
 145
 146     in = ossl_obj2bio(arg);
 147     out = NULL;
 148     pkcs7 = SMIME_read_PKCS7(in, &out);
 149     BIO_free(in);
 150     if(!pkcs7) ossl_raise(ePKCS7Error, NULL);
 151     data = out ? ossl_membio2str(out) : Qnil;
 152     WrapPKCS7(cPKCS7, ret, pkcs7);
 153     ossl_pkcs7_set_data(ret, data);
 154     ossl_pkcs7_set_err_string(ret, Qnil);
 155
 156     return ret;
 157 }
 158
 159 static VALUE
 160 ossl_pkcs7_s_write_smime(int argc, VALUE *argv, VALUE klass)
 161 {
 162     VALUE pkcs7, data, flags;
 163     BIO *out, *in;
 164     PKCS7 *p7;
 165     VALUE str;
 166     int flg;
 167
 168     rb_scan_args(argc, argv, "12", &pkcs7, &data, &flags);
 169     flg = NIL_P(flags) ? 0 : NUM2INT(flags);
 170     if(NIL_P(data)) data = ossl_pkcs7_get_data(pkcs7);
 171     SafeGetPKCS7(pkcs7, p7);
 172     if(!NIL_P(data) && PKCS7_is_detached(p7))
 173         flg |= PKCS7_DETACHED;
 174     in = NIL_P(data) ? NULL : ossl_obj2bio(data);
 175     if(!(out = BIO_new(BIO_s_mem()))){
 176         BIO_free(in);
 177         ossl_raise(ePKCS7Error, NULL);
 178     }
 179     if(!SMIME_write_PKCS7(out, p7, in, flg)){
 180         BIO_free(out);
 181         BIO_free(in);
 182         ossl_raise(ePKCS7Error, NULL);
 183     }
 184     BIO_free(in);
 185     str = ossl_membio2str(out);
 186
 187     return str;
 188 }
 189
 190 static VALUE
 191 ossl_pkcs7_s_sign(int argc, VALUE *argv, VALUE klass)
 192 {
 193     VALUE cert, key, data, certs, flags;
 194     X509 *x509;
 195     EVP_PKEY *pkey;
 196     BIO *in;
 197     STACK_OF(X509) *x509s;
 198     int flg, status = 0;
 199     PKCS7 *pkcs7;
 200     VALUE ret;
 201
 202     rb_scan_args(argc, argv, "32", &cert, &key, &data, &certs, &flags);
 203     x509 = GetX509CertPtr(cert); /* NO NEED TO DUP */
 204     pkey = GetPrivPKeyPtr(key); /* NO NEED TO DUP */
 205     flg = NIL_P(flags) ? 0 : NUM2INT(flags);
 206     in = ossl_obj2bio(data);
 207     if(NIL_P(certs)) x509s = NULL;
 208     else{
 209         x509s = ossl_protect_x509_ary2sk(certs, &status);
 210         if(status){
 211             BIO_free(in);
 212             rb_jump_tag(status);
 213         }
 214     }
 215     if(!(pkcs7 = PKCS7_sign(x509, pkey, x509s, in, flg))){
 216         BIO_free(in);
 217         sk_X509_pop_free(x509s, X509_free);
 218         ossl_raise(ePKCS7Error, NULL);
 219     }
 220     WrapPKCS7(cPKCS7, ret, pkcs7);
 221     ossl_pkcs7_set_data(ret, data);
 222     ossl_pkcs7_set_err_string(ret, Qnil);
 223     BIO_free(in);
 224     sk_X509_pop_free(x509s, X509_free);
 225
 226     return ret;
 227 }
 228
 229 static VALUE
 230 ossl_pkcs7_s_encrypt(int argc, VALUE *argv, VALUE klass)
 231 {
 232     VALUE certs, data, cipher, flags;
 233     STACK_OF(X509) *x509s;
 234     BIO *in;
 235     const EVP_CIPHER *ciph;
 236     int flg, status = 0;
 237     VALUE ret;
 238     PKCS7 *p7;
 239
 240     rb_scan_args(argc, argv, "22", &certs, &data, &cipher, &flags);
 241     if(NIL_P(cipher)){
 242 #if !defined(OPENSSL_NO_RC2)
 243         ciph = EVP_rc2_40_cbc();
 244 #elif !defined(OPENSSL_NO_DES)
 245         ciph = EVP_des_ede3_cbc();
 246 #elif !defined(OPENSSL_NO_RC2)
 247         ciph = EVP_rc2_40_cbc();
 248 #elif !defined(OPENSSL_NO_AES)
 249         ciph = EVP_EVP_aes_128_cbc();
 250 #else
 251         ossl_raise(ePKCS7Error, "Must specify cipher");
 252 #endif
 253
 254     }
 255     else ciph = GetCipherPtr(cipher); /* NO NEED TO DUP */
 256     flg = NIL_P(flags) ? 0 : NUM2INT(flags);
 257     in = ossl_obj2bio(data);
 258     x509s = ossl_protect_x509_ary2sk(certs, &status);
 259     if(status){
 260         BIO_free(in);
 261         rb_jump_tag(status);
 262     }
 263     if(!(p7 = PKCS7_encrypt(x509s, in, (EVP_CIPHER*)ciph, flg))){
 264         BIO_free(in);
 265         sk_X509_pop_free(x509s, X509_free);
 266         ossl_raise(ePKCS7Error, NULL);
 267     }
 268     BIO_free(in);
 269     WrapPKCS7(cPKCS7, ret, p7);
 270     ossl_pkcs7_set_data(ret, data);
 271     sk_X509_pop_free(x509s, X509_free);
 272
 273     return ret;
 274 }
 275
 276 static VALUE
 277 ossl_pkcs7_alloc(VALUE klass)
 278 {
 279     PKCS7 *pkcs7;
 280     VALUE obj;
 281
 282     if (!(pkcs7 = PKCS7_new())) {
 283         ossl_raise(ePKCS7Error, NULL);
 284     }
 285     WrapPKCS7(klass, obj, pkcs7);
 286
 287     return obj;
 288 }
 289
 290 static VALUE
 291 ossl_pkcs7_initialize(int argc, VALUE *argv, VALUE self)
 292 {
 293     PKCS7 *p7;
 294     BIO *in;
 295     VALUE arg;
 296
 297     if(rb_scan_args(argc, argv, "01", &arg) == 0)
 298         return self;
 299     arg = ossl_to_der_if_possible(arg);
 300     in = ossl_obj2bio(arg);
 301     p7 = PEM_read_bio_PKCS7(in, (PKCS7 **)&DATA_PTR(self), NULL, NULL);
 302     if (!p7) {
 303         BIO_reset(in);
 304         p7 = d2i_PKCS7_bio(in, (PKCS7 **)&DATA_PTR(self));
 305     }
 306     BIO_free(in);
 307     ossl_pkcs7_set_data(self, Qnil);
 308     ossl_pkcs7_set_err_string(self, Qnil);
 309
 310     return self;
 311 }
 312
 313 static VALUE
 314 ossl_pkcs7_copy(VALUE self, VALUE other)
 315 {
 316     PKCS7 *a, *b, *pkcs7;
 317
 318     rb_check_frozen(self);
 319     if (self == other) return self;
 320
 321     GetPKCS7(self, a);
 322     SafeGetPKCS7(other, b);
 323
 324     pkcs7 = PKCS7_dup(b);
 325     if (!pkcs7) {
 326         ossl_raise(ePKCS7Error, NULL);
 327     }
 328     DATA_PTR(self) = pkcs7;
 329     PKCS7_free(a);
 330
 331     return self;
 332 }
 333
 334 static int
 335 ossl_pkcs7_sym2typeid(VALUE sym)
 336 {
 337     int i, ret = Qnil;
 338     char *s;
 339
 340     static struct {
 341         const char *name;
 342         int nid;
 343     } p7_type_tab[] = {
 344         { "signed",             NID_pkcs7_signed },
 345         { "data",               NID_pkcs7_data },
 346         { "signedAndEnveloped", NID_pkcs7_signedAndEnveloped },
 347         { "enveloped",          NID_pkcs7_enveloped },
 348         { "encrypted",          NID_pkcs7_encrypted },
 349         { "digest",             NID_pkcs7_digest },
 350         { NULL,                 0 },
 351     };
 352
 353     if(TYPE(sym) == T_SYMBOL) s = rb_id2name(SYM2ID(sym));
 354     else s = StringValuePtr(sym);
 355     for(i = 0; i < numberof(p7_type_tab); i++){
 356         if(p7_type_tab[i].name == NULL)
 357             ossl_raise(ePKCS7Error, "unknown type \"%s\"", s);
 358         if(strcmp(p7_type_tab[i].name, s) == 0){
 359             ret = p7_type_tab[i].nid;
 360             break;
 361         }
 362     }
 363
 364     return ret;
 365 }
 366
 367 static VALUE
 368 ossl_pkcs7_set_type(VALUE self, VALUE type)
 369 {
 370     PKCS7 *p7;
 371
 372     GetPKCS7(self, p7);
 373     if(!PKCS7_set_type(p7, ossl_pkcs7_sym2typeid(type)))
 374         ossl_raise(ePKCS7Error, NULL);
 375
 376     return type;
 377 }
 378
 379 static VALUE
 380 ossl_pkcs7_get_type(VALUE self)
 381 {
 382     PKCS7 *p7;
 383
 384     GetPKCS7(self, p7);
 385     if(PKCS7_type_is_signed(p7))
 386         return ID2SYM(rb_intern("signed"));
 387     if(PKCS7_type_is_encrypted(p7))
 388         return ID2SYM(rb_intern("encrypted"));
 389     if(PKCS7_type_is_enveloped(p7))
 390         return ID2SYM(rb_intern("enveloped"));
 391     if(PKCS7_type_is_signedAndEnveloped(p7))
 392         return ID2SYM(rb_intern("signedAndEnveloped"));
 393     if(PKCS7_type_is_data(p7))
 394         return ID2SYM(rb_intern("data"));
 395     return Qnil;
 396 }
 397
 398 static VALUE
 399 ossl_pkcs7_set_detached(VALUE self, VALUE flag)
 400 {
 401     PKCS7 *p7;
 402
 403     GetPKCS7(self, p7);
 404     if(flag != Qtrue && flag != Qfalse)
 405         ossl_raise(ePKCS7Error, "must specify a boolean");
 406     if(!PKCS7_set_detached(p7, flag == Qtrue ? 1 : 0))
 407         ossl_raise(ePKCS7Error, NULL);
 408
 409     return flag;
 410 }
 411
 412 static VALUE
 413 ossl_pkcs7_get_detached(VALUE self)
 414 {
 415     PKCS7 *p7;
 416     GetPKCS7(self, p7);
 417     return PKCS7_get_detached(p7) ? Qtrue : Qfalse;
 418 }
 419
 420 static VALUE
 421 ossl_pkcs7_detached_p(VALUE self)
 422 {
 423     PKCS7 *p7;
 424     GetPKCS7(self, p7);
 425     return PKCS7_is_detached(p7) ? Qtrue : Qfalse;
 426 }
 427
 428 static VALUE
 429 ossl_pkcs7_set_cipher(VALUE self, VALUE cipher)
 430 {
 431     PKCS7 *pkcs7;
 432
 433     GetPKCS7(self, pkcs7);
 434     if (!PKCS7_set_cipher(pkcs7, GetCipherPtr(cipher))) {
 435         ossl_raise(ePKCS7Error, NULL);
 436     }
 437
 438     return cipher;
 439 }
 440
 441 static VALUE
 442 ossl_pkcs7_add_signer(VALUE self, VALUE signer)
 443 {
 444     PKCS7 *pkcs7;
 445     PKCS7_SIGNER_INFO *p7si;
 446
 447     p7si = DupPKCS7SignerPtr(signer); /* NEED TO DUP */
 448     GetPKCS7(self, pkcs7);
 449     if (!PKCS7_add_signer(pkcs7, p7si)) {
 450         PKCS7_SIGNER_INFO_free(p7si);
 451         ossl_raise(ePKCS7Error, "Could not add signer.");
 452     }
 453     if (PKCS7_type_is_signed(pkcs7)){
 454         PKCS7_add_signed_attribute(p7si, NID_pkcs9_contentType,
 455                                    V_ASN1_OBJECT, OBJ_nid2obj(NID_pkcs7_data));
 456     }
 457
 458     return self;
 459 }
 460
 461 static VALUE
 462 ossl_pkcs7_get_signer(VALUE self)
 463 {
 464     PKCS7 *pkcs7;
 465     STACK_OF(PKCS7_SIGNER_INFO) *sk;
 466     PKCS7_SIGNER_INFO *si;
 467     int num, i;
 468     VALUE ary;
 469
 470     GetPKCS7(self, pkcs7);
 471     if (!(sk = PKCS7_get_signer_info(pkcs7))) {
 472         OSSL_Debug("OpenSSL::PKCS7#get_signer_info == NULL!");
 473         return rb_ary_new();
 474     }
 475     if ((num = sk_PKCS7_SIGNER_INFO_num(sk)) < 0) {
 476         ossl_raise(ePKCS7Error, "Negative number of signers!");
 477     }
 478     ary = rb_ary_new2(num);
 479     for (i=0; i<num; i++) {
 480         si = sk_PKCS7_SIGNER_INFO_value(sk, i);
 481         rb_ary_push(ary, ossl_pkcs7si_new(si));
 482     }
 483
 484     return ary;
 485 }
 486
 487 static VALUE
 488 ossl_pkcs7_add_recipient(VALUE self, VALUE recip)
 489 {
 490     PKCS7 *pkcs7;
 491     PKCS7_RECIP_INFO *ri;
 492
 493     ri = DupPKCS7RecipientPtr(recip); /* NEED TO DUP */
 494     GetPKCS7(self, pkcs7);
 495     if (!PKCS7_add_recipient_info(pkcs7, ri)) {
 496         PKCS7_RECIP_INFO_free(ri);
 497         ossl_raise(ePKCS7Error, "Could not add recipient.");
 498     }
 499
 500     return self;
 501 }
 502
 503 static VALUE
 504 ossl_pkcs7_get_recipient(VALUE self)
 505 {
 506     PKCS7 *pkcs7;
 507     STACK_OF(PKCS7_RECIP_INFO) *sk;
 508     PKCS7_RECIP_INFO *si;
 509     int num, i;
 510     VALUE ary;
 511
 512     GetPKCS7(self, pkcs7);
 513     if (PKCS7_type_is_enveloped(pkcs7))
 514         sk = pkcs7->d.enveloped->recipientinfo;
 515     else if (PKCS7_type_is_signedAndEnveloped(pkcs7))
 516         sk = pkcs7->d.signed_and_enveloped->recipientinfo;
 517     else sk = NULL;
 518     if (!sk) return rb_ary_new();
 519     if ((num = sk_PKCS7_RECIP_INFO_num(sk)) < 0) {
 520         ossl_raise(ePKCS7Error, "Negative number of recipient!");
 521     }
 522     ary = rb_ary_new2(num);
 523     for (i=0; i<num; i++) {
 524         si = sk_PKCS7_RECIP_INFO_value(sk, i);
 525         rb_ary_push(ary, ossl_pkcs7ri_new(si));
 526     }
 527
 528     return ary;
 529 }
 530
 531 static VALUE
 532 ossl_pkcs7_add_certificate(VALUE self, VALUE cert)
 533 {
 534     PKCS7 *pkcs7;
 535     X509 *x509;
 536
 537     GetPKCS7(self, pkcs7);
 538     x509 = GetX509CertPtr(cert);  /* NO NEED TO DUP */
 539     if (!PKCS7_add_certificate(pkcs7, x509)){
 540         ossl_raise(ePKCS7Error, NULL);
 541     }
 542
 543     return self;
 544 }
 545
 546 static STACK *
 547 pkcs7_get_certs_or_crls(VALUE self, int want_certs)
 548 {
 549     PKCS7 *pkcs7;
 550     STACK_OF(X509) *certs;
 551     STACK_OF(X509_CRL) *crls;
 552     int i;
 553
 554     GetPKCS7(self, pkcs7);
 555     i = OBJ_obj2nid(pkcs7->type);
 556     switch(i){
 557     case NID_pkcs7_signed:
 558         certs = pkcs7->d.sign->cert;
 559         crls = pkcs7->d.sign->crl;
 560         break;
 561     case NID_pkcs7_signedAndEnveloped:
 562         certs = pkcs7->d.signed_and_enveloped->cert;
 563         crls = pkcs7->d.signed_and_enveloped->crl;
 564         break;
 565     default:
 566         certs = crls = NULL;
 567     }
 568
 569     return want_certs ? certs : crls;
 570 }
 571
 572 static VALUE
 573 ossl_pkcs7_set_certs_i(VALUE i, VALUE arg)
 574 {
 575     return ossl_pkcs7_add_certificate(arg, i);
 576 }
 577
 578 static VALUE
 579 ossl_pkcs7_set_certificates(VALUE self, VALUE ary)
 580 {
 581     STACK_OF(X509) *certs;
 582     X509 *cert;
 583
 584     certs = pkcs7_get_certs_or_crls(self, 1);
 585     while((cert = sk_X509_pop(certs))) X509_free(cert);
 586     rb_iterate(rb_each, ary, ossl_pkcs7_set_certs_i, self);
 587
 588     return ary;
 589 }
 590
 591 static VALUE
 592 ossl_pkcs7_get_certificates(VALUE self)
 593 {
 594     return ossl_x509_sk2ary(pkcs7_get_certs_or_crls(self, 1));
 595 }
 596
 597 static VALUE
 598 ossl_pkcs7_add_crl(VALUE self, VALUE crl)
 599 {
 600     PKCS7 *pkcs7;
 601     X509_CRL *x509crl;
 602
 603     GetPKCS7(self, pkcs7); /* NO DUP needed! */
 604     x509crl = GetX509CRLPtr(crl);
 605     if (!PKCS7_add_crl(pkcs7, x509crl)) {
 606         ossl_raise(ePKCS7Error, NULL);
 607     }
 608
 609     return self;
 610 }
 611
 612 static VALUE
 613 ossl_pkcs7_set_crls_i(VALUE i, VALUE arg)
 614 {
 615     return ossl_pkcs7_add_crl(arg, i);
 616 }
 617
 618 static VALUE
 619 ossl_pkcs7_set_crls(VALUE self, VALUE ary)
 620 {
 621     STACK_OF(X509_CRL) *crls;
 622     X509_CRL *crl;
 623
 624     crls = pkcs7_get_certs_or_crls(self, 0);
 625     while((crl = sk_X509_CRL_pop(crls))) X509_CRL_free(crl);
 626     rb_iterate(rb_each, ary, ossl_pkcs7_set_crls_i, self);
 627
 628     return ary;
 629 }
 630
 631 static VALUE
 632 ossl_pkcs7_get_crls(VALUE self)
 633 {
 634     return ossl_x509crl_sk2ary(pkcs7_get_certs_or_crls(self, 0));
 635 }
 636
 637 static VALUE
 638 ossl_pkcs7_verify(int argc, VALUE *argv, VALUE self)
 639 {
 640     VALUE certs, store, indata, flags;
 641     STACK_OF(X509) *x509s;
 642     X509_STORE *x509st;
 643     int flg, ok, status = 0;
 644     BIO *in, *out;
 645     PKCS7 *p7;
 646     VALUE data;
 647     const char *msg;
 648
 649     rb_scan_args(argc, argv, "22", &certs, &store, &indata, &flags);
 650     flg = NIL_P(flags) ? 0 : NUM2INT(flags);
 651     if(NIL_P(indata)) indata = ossl_pkcs7_get_data(self);
 652     in = NIL_P(indata) ? NULL : ossl_obj2bio(indata);
 653     if(NIL_P(certs)) x509s = NULL;
 654     else{
 655         x509s = ossl_protect_x509_ary2sk(certs, &status);
 656         if(status){
 657             BIO_free(in);
 658             rb_jump_tag(status);
 659         }
 660     }
 661     x509st = GetX509StorePtr(store);
 662     GetPKCS7(self, p7);
 663     if(!(out = BIO_new(BIO_s_mem()))){
 664         BIO_free(in);
 665         sk_X509_pop_free(x509s, X509_free);
 666         ossl_raise(ePKCS7Error, NULL);
 667     }
 668     ok = PKCS7_verify(p7, x509s, x509st, in, out, flg);
 669     BIO_free(in);
 670     if (ok < 0) ossl_raise(ePKCS7Error, NULL);
 671     msg = ERR_reason_error_string(ERR_get_error());
 672     ossl_pkcs7_set_err_string(self, msg ? rb_str_new2(msg) : Qnil);
 673     ERR_clear_error();
 674     data = ossl_membio2str(out);
 675     ossl_pkcs7_set_data(self, data);
 676     sk_X509_pop_free(x509s, X509_free);
 677
 678     return (ok == 1) ? Qtrue : Qfalse;
 679 }
 680
 681 static VALUE
 682 ossl_pkcs7_decrypt(int argc, VALUE *argv, VALUE self)
 683 {
 684     VALUE pkey, cert, flags;
 685     EVP_PKEY *key;
 686     X509 *x509;
 687     int flg;
 688     PKCS7 *p7;
 689     BIO *out;
 690     VALUE str;
 691
 692     rb_scan_args(argc, argv, "21", &pkey, &cert, &flags);
 693     key = GetPrivPKeyPtr(pkey); /* NO NEED TO DUP */
 694     x509 = GetX509CertPtr(cert); /* NO NEED TO DUP */
 695     flg = NIL_P(flags) ? 0 : NUM2INT(flags);
 696     GetPKCS7(self, p7);
 697     if(!(out = BIO_new(BIO_s_mem())))
 698         ossl_raise(ePKCS7Error, NULL);
 699     if(!PKCS7_decrypt(p7, key, x509, out, flg)){
 700         BIO_free(out);
 701         ossl_raise(ePKCS7Error, NULL);
 702     }
 703     str = ossl_membio2str(out); /* out will be free */
 704
 705     return str;
 706 }
 707
 708 static VALUE
 709 ossl_pkcs7_add_data(VALUE self, VALUE data)
 710 {
 711     PKCS7 *pkcs7;
 712     BIO *out, *in;
 713     char buf[4096];
 714     int len;
 715
 716     in = ossl_obj2bio(data);
 717     GetPKCS7(self, pkcs7);
 718     if(PKCS7_type_is_signed(pkcs7)){
 719         if(!PKCS7_content_new(pkcs7, NID_pkcs7_data))
 720             ossl_raise(ePKCS7Error, NULL);
 721     }
 722     if(!(out = PKCS7_dataInit(pkcs7, NULL))) goto err;
 723     for(;;){
 724         if((len = BIO_read(in, buf, sizeof(buf))) <= 0)
 725             break;
 726         if(BIO_write(out, buf, len) != len)
 727             goto err;
 728     }
 729     if(!PKCS7_dataFinal(pkcs7, out)) goto err;
 730     ossl_pkcs7_set_data(self, Qnil);
 731
 732  err:
 733     BIO_free(out);
 734     BIO_free(in);
 735     if(ERR_peek_error()){
 736         ossl_raise(ePKCS7Error, NULL);
 737     }
 738
 739     return data;
 740 }
 741
 742 static VALUE
 743 ossl_pkcs7_to_der(VALUE self)
 744 {
 745     PKCS7 *pkcs7;
 746     VALUE str;
 747     long len;
 748     unsigned char *p;
 749
 750     GetPKCS7(self, pkcs7);
 751     if((len = i2d_PKCS7(pkcs7, NULL)) <= 0)
 752         ossl_raise(ePKCS7Error, NULL);
 753     str = rb_str_new(0, len);
 754     p = RSTRING(str)->ptr;
 755     if(i2d_PKCS7(pkcs7, &p) <= 0)
 756         ossl_raise(ePKCS7Error, NULL);
 757     ossl_str_adjust(str, p);
 758
 759     return str;
 760 }
 761
 762 static VALUE
 763 ossl_pkcs7_to_pem(VALUE self)
 764 {
 765     PKCS7 *pkcs7;
 766     BIO *out;
 767     VALUE str;
 768
 769     GetPKCS7(self, pkcs7);
 770     if (!(out = BIO_new(BIO_s_mem()))) {
 771         ossl_raise(ePKCS7Error, NULL);
 772     }
 773     if (!PEM_write_bio_PKCS7(out, pkcs7)) {
 774         BIO_free(out);
 775         ossl_raise(ePKCS7Error, NULL);
 776     }
 777     str = ossl_membio2str(out);
 778
 779     return str;
 780 }
 781
 782 /*
 783  * SIGNER INFO
 784  */
 785 static VALUE
 786 ossl_pkcs7si_alloc(VALUE klass)
 787 {
 788     PKCS7_SIGNER_INFO *p7si;
 789     VALUE obj;
 790
 791     if (!(p7si = PKCS7_SIGNER_INFO_new())) {
 792         ossl_raise(ePKCS7Error, NULL);
 793     }
 794     WrapPKCS7si(klass, obj, p7si);
 795
 796     return obj;
 797 }
 798
 799 static VALUE
 800 ossl_pkcs7si_initialize(VALUE self, VALUE cert, VALUE key, VALUE digest)
 801 {
 802     PKCS7_SIGNER_INFO *p7si;
 803     EVP_PKEY *pkey;
 804     X509 *x509;
 805     const EVP_MD *md;
 806
 807     pkey = GetPrivPKeyPtr(key); /* NO NEED TO DUP */
 808     x509 = GetX509CertPtr(cert); /* NO NEED TO DUP */
 809     md = GetDigestPtr(digest);
 810     GetPKCS7si(self, p7si);
 811     if (!(PKCS7_SIGNER_INFO_set(p7si, x509, pkey, (EVP_MD*)md))) {
 812         ossl_raise(ePKCS7Error, NULL);
 813     }
 814
 815     return self;
 816 }
 817
 818 static VALUE
 819 ossl_pkcs7si_get_issuer(VALUE self)
 820 {
 821     PKCS7_SIGNER_INFO *p7si;
 822
 823     GetPKCS7si(self, p7si);
 824
 825     return ossl_x509name_new(p7si->issuer_and_serial->issuer);
 826 }
 827
 828 static VALUE
 829 ossl_pkcs7si_get_serial(VALUE self)
 830 {
 831     PKCS7_SIGNER_INFO *p7si;
 832
 833     GetPKCS7si(self, p7si);
 834
 835     return asn1integer_to_num(p7si->issuer_and_serial->serial);
 836 }
 837
 838 static VALUE
 839 ossl_pkcs7si_get_signed_time(VALUE self)
 840 {
 841     PKCS7_SIGNER_INFO *p7si;
 842     ASN1_TYPE *asn1obj;
 843
 844     GetPKCS7si(self, p7si);
 845
 846     if (!(asn1obj = PKCS7_get_signed_attribute(p7si, NID_pkcs9_signingTime))) {
 847         ossl_raise(ePKCS7Error, NULL);
 848     }
 849     if (asn1obj->type == V_ASN1_UTCTIME) {
 850         return asn1time_to_time(asn1obj->value.utctime);
 851     }
 852     /*
 853      * OR
 854      * ossl_raise(ePKCS7Error, "...");
 855      * ?
 856      */
 857
 858     return Qnil;
 859 }
 860
 861 /*
 862  * RECIPIENT INFO
 863  */
 864 static VALUE
 865 ossl_pkcs7ri_alloc(VALUE klass)
 866 {
 867     PKCS7_RECIP_INFO *p7ri;
 868     VALUE obj;
 869
 870     if (!(p7ri = PKCS7_RECIP_INFO_new())) {
 871         ossl_raise(ePKCS7Error, NULL);
 872     }
 873     WrapPKCS7ri(klass, obj, p7ri);
 874
 875     return obj;
 876 }
 877
 878 static VALUE
 879 ossl_pkcs7ri_initialize(VALUE self, VALUE cert)
 880 {
 881     PKCS7_RECIP_INFO *p7ri;
 882     X509 *x509;
 883
 884     x509 = GetX509CertPtr(cert); /* NO NEED TO DUP */
 885     GetPKCS7ri(self, p7ri);
 886     if (!PKCS7_RECIP_INFO_set(p7ri, x509)) {
 887         ossl_raise(ePKCS7Error, NULL);
 888     }
 889
 890     return self;
 891 }
 892
 893 static VALUE
 894 ossl_pkcs7ri_get_issuer(VALUE self)
 895 {
 896     PKCS7_RECIP_INFO *p7ri;
 897
 898     GetPKCS7ri(self, p7ri);
 899
 900     return ossl_x509name_new(p7ri->issuer_and_serial->issuer);
 901 }
 902
 903 static VALUE
 904 ossl_pkcs7ri_get_serial(VALUE self)
 905 {
 906     PKCS7_RECIP_INFO *p7ri;
 907
 908     GetPKCS7ri(self, p7ri);
 909
 910     return asn1integer_to_num(p7ri->issuer_and_serial->serial);
 911 }
 912
 913 static VALUE
 914 ossl_pkcs7ri_get_enc_key(VALUE self)
 915 {
 916     PKCS7_RECIP_INFO *p7ri;
 917
 918     GetPKCS7ri(self, p7ri);
 919
 920     return asn1str_to_str(p7ri->enc_key);
 921 }
 922
 923 /*
 924  * INIT
 925  */
 926 void
 927 Init_ossl_pkcs7()
 928 {
 929     mPKCS7 = rb_define_module_under(mOSSL, "PKCS7");
 930
 931     ePKCS7Error = rb_define_class_under(mPKCS7, "PKCS7Error", eOSSLError);
 932
 933     cPKCS7 = rb_define_class_under(mPKCS7, "PKCS7", rb_cObject);
 934     rb_define_singleton_method(mPKCS7, "read_smime", ossl_pkcs7_s_read_smime, 1);
 935     rb_define_singleton_method(mPKCS7, "write_smime", ossl_pkcs7_s_write_smime, -1);
 936     rb_define_singleton_method(mPKCS7, "sign",  ossl_pkcs7_s_sign, -1);
 937     rb_define_singleton_method(mPKCS7, "encrypt", ossl_pkcs7_s_encrypt, -1);
 938     rb_attr(cPKCS7, rb_intern("data"), 1, 0, Qfalse);
 939     rb_attr(cPKCS7, rb_intern("error_string"), 1, 1, Qfalse);
 940     rb_define_alloc_func(cPKCS7, ossl_pkcs7_alloc);
 941     rb_define_copy_func(cPKCS7, ossl_pkcs7_copy);
 942     rb_define_method(cPKCS7, "initialize", ossl_pkcs7_initialize, -1);
 943     rb_define_method(cPKCS7, "type=", ossl_pkcs7_set_type, 1);
 944     rb_define_method(cPKCS7, "type", ossl_pkcs7_get_type, 0);
 945     rb_define_method(cPKCS7, "detached=", ossl_pkcs7_set_detached, 1);
 946     rb_define_method(cPKCS7, "detached", ossl_pkcs7_get_detached, 0);
 947     rb_define_method(cPKCS7, "detached?", ossl_pkcs7_detached_p, 0);
 948     rb_define_method(cPKCS7, "cipher=", ossl_pkcs7_set_cipher, 1);
 949     rb_define_method(cPKCS7, "add_signer", ossl_pkcs7_add_signer, 1);
 950     rb_define_method(cPKCS7, "signers", ossl_pkcs7_get_signer, 0);
 951     rb_define_method(cPKCS7, "add_recipient", ossl_pkcs7_add_recipient, 1);
 952     rb_define_method(cPKCS7, "recipients", ossl_pkcs7_get_recipient, 0);
 953     rb_define_method(cPKCS7, "add_certificate", ossl_pkcs7_add_certificate, 1);
 954     rb_define_method(cPKCS7, "certificates=", ossl_pkcs7_set_certificates, 1);
 955     rb_define_method(cPKCS7, "certificates", ossl_pkcs7_get_certificates, 0);
 956     rb_define_method(cPKCS7, "add_crl", ossl_pkcs7_add_crl, 1);
 957     rb_define_method(cPKCS7, "crls=", ossl_pkcs7_set_crls, 1);
 958     rb_define_method(cPKCS7, "crls", ossl_pkcs7_get_crls, 0);
 959     rb_define_method(cPKCS7, "add_data", ossl_pkcs7_add_data, 1);
 960     rb_define_alias(cPKCS7,  "data=", "add_data");
 961     rb_define_method(cPKCS7, "verify", ossl_pkcs7_verify, -1);
 962     rb_define_method(cPKCS7, "decrypt", ossl_pkcs7_decrypt, -1);
 963     rb_define_method(cPKCS7, "to_pem", ossl_pkcs7_to_pem, 0);
 964     rb_define_alias(cPKCS7,  "to_s", "to_pem");
 965     rb_define_method(cPKCS7, "to_der", ossl_pkcs7_to_der, 0);
 966
 967     cPKCS7Signer = rb_define_class_under(mPKCS7, "SignerInfo", rb_cObject);
 968     rb_define_const(mPKCS7, "Signer", cPKCS7Signer);
 969     rb_define_alloc_func(cPKCS7Signer, ossl_pkcs7si_alloc);
 970     rb_define_method(cPKCS7Signer, "initialize", ossl_pkcs7si_initialize,3);
 971     rb_define_method(cPKCS7Signer, "issuer", ossl_pkcs7si_get_issuer, 0);
 972     rb_define_alias(cPKCS7Signer, "name", "issuer");
 973     rb_define_method(cPKCS7Signer, "serial", ossl_pkcs7si_get_serial,0);
 974     rb_define_method(cPKCS7Signer,"signed_time",ossl_pkcs7si_get_signed_time,0);
 975
 976     cPKCS7Recipient = rb_define_class_under(mPKCS7,"RecipientInfo",rb_cObject);
 977     rb_define_alloc_func(cPKCS7Recipient, ossl_pkcs7ri_alloc);
 978     rb_define_method(cPKCS7Recipient, "initialize", ossl_pkcs7ri_initialize,1);
 979     rb_define_method(cPKCS7Recipient, "issuer", ossl_pkcs7ri_get_issuer,0);
 980     rb_define_method(cPKCS7Recipient, "serial", ossl_pkcs7ri_get_serial,0);
 981     rb_define_method(cPKCS7Recipient, "enc_key", ossl_pkcs7ri_get_enc_key,0);
 982
 983 #define DefPKCS7Const(x) rb_define_const(mPKCS7, #x, INT2NUM(PKCS7_##x))
 984
 985     DefPKCS7Const(TEXT);
 986     DefPKCS7Const(NOCERTS);
 987     DefPKCS7Const(NOSIGS);
 988     DefPKCS7Const(NOCHAIN);
 989     DefPKCS7Const(NOINTERN);
 990     DefPKCS7Const(NOVERIFY);
 991     DefPKCS7Const(DETACHED);
 992     DefPKCS7Const(BINARY);
 993     DefPKCS7Const(NOATTR);
 994     DefPKCS7Const(NOSMIMECAP);
 995 }