Fix for CMS/PKCS7 MMA. If RSA decryption fails use a random key and

[oweals/openssl.git] / crypto / cms / cms_smime.c

diff --git a/crypto/cms/cms_smime.c b/crypto/cms/cms_smime.c
index 48885ce67594300e665d8ff859f1472dbd95afba..8c56e3a8520d73802c7ea00f81e81c1d574bc49b 100644 (file)
--- a/crypto/cms/cms_smime.c
+++ b/crypto/cms/cms_smime.c
@@ -68,7 +68,10 @@ static int cms_copy_content(BIO *out, BIO *in, unsigned int flags)
        if (out == NULL)
                tmpout = BIO_new(BIO_s_null());
        else if (flags & CMS_TEXT)
+               {
                tmpout = BIO_new(BIO_s_mem());
+               BIO_set_mem_eof_return(tmpout, 0);
+               }
        else
                tmpout = out;
 
@@ -89,11 +92,13 @@ static int cms_copy_content(BIO *out, BIO *in, unsigned int flags)
                                if (!BIO_get_cipher_status(in))
                                        goto err;
                                }
+                       if (i < 0)
+                               goto err;
                        break;
                        }
                                
-               if (tmpout)
-                       BIO_write(tmpout, buf, i);
+               if (tmpout && (BIO_write(tmpout, buf, i) != i))
+                       goto err;
        }
 
        if(flags & CMS_TEXT)
@@ -125,6 +130,23 @@ static int check_content(CMS_ContentInfo *cms)
        return 1;
        }
 
+static void do_free_upto(BIO *f, BIO *upto)
+       {
+       if (upto)
+               {
+               BIO *tbio;
+               do 
+                       {
+                       tbio = BIO_pop(f);
+                       BIO_free(f);
+                       f = tbio;
+                       }
+               while (f != upto);
+               }
+       else
+               BIO_free_all(f);
+       }
+
 int CMS_data(CMS_ContentInfo *cms, BIO *out, unsigned int flags)
        {
        BIO *cont;
@@ -149,7 +171,7 @@ CMS_ContentInfo *CMS_data_create(BIO *in, unsigned int flags)
        if (!cms)
                return NULL;
 
-       if ((flags & CMS_STREAM) || CMS_final(cms, in, flags))
+       if ((flags & CMS_STREAM) || CMS_final(cms, in, NULL, flags))
                return cms;
 
        CMS_ContentInfo_free(cms);
@@ -177,7 +199,7 @@ int CMS_digest_verify(CMS_ContentInfo *cms, BIO *dcont, BIO *out,
        r = cms_copy_content(out, cont, flags);
        if (r)
                r = cms_DigestedData_do_final(cms, cont, 1);
-       BIO_free_all(cont);
+       do_free_upto(cont, dcont);
        return r;
        }
 
@@ -194,7 +216,7 @@ CMS_ContentInfo *CMS_digest_create(BIO *in, const EVP_MD *md,
        if(!(flags & CMS_DETACHED))
                CMS_set_detached(cms, 0);
 
-       if ((flags & CMS_STREAM) || CMS_final(cms, in, flags))
+       if ((flags & CMS_STREAM) || CMS_final(cms, in, NULL, flags))
                return cms;
 
        CMS_ContentInfo_free(cms);
@@ -223,7 +245,7 @@ int CMS_EncryptedData_decrypt(CMS_ContentInfo *cms,
        if (!cont)
                return 0;
        r = cms_copy_content(out, cont, flags);
-       BIO_free_all(cont);
+       do_free_upto(cont, dcont);
        return r;
        }
 
@@ -246,7 +268,8 @@ CMS_ContentInfo *CMS_EncryptedData_encrypt(BIO *in, const EVP_CIPHER *cipher,
        if(!(flags & CMS_DETACHED))
                CMS_set_detached(cms, 0);
 
-       if ((flags & (CMS_STREAM|CMS_PARTIAL)) || CMS_final(cms, in, flags))
+       if ((flags & (CMS_STREAM|CMS_PARTIAL))
+               || CMS_final(cms, in, NULL, flags))
                return cms;
 
        CMS_ContentInfo_free(cms);
@@ -269,7 +292,7 @@ static int cms_signerinfo_verify_cert(CMS_SignerInfo *si,
                                                CMS_R_STORE_INIT_ERROR);
                goto err;
                }
-       X509_STORE_CTX_set_purpose(&ctx, X509_PURPOSE_SMIME_SIGN);
+       X509_STORE_CTX_set_default(&ctx, "smime_sign");
        if (crls)
                X509_STORE_CTX_set0_crls(&ctx, crls);
 
@@ -336,7 +359,8 @@ int CMS_verify(CMS_ContentInfo *cms, STACK_OF(X509) *certs,
        if (!(flags & CMS_NO_SIGNER_CERT_VERIFY))
                {
                cms_certs = CMS_get1_certs(cms);
-               crls = CMS_get1_crls(cms);
+               if (!(flags & CMS_NOCRL))
+                       crls = CMS_get1_crls(cms);
                for (i = 0; i < sk_CMS_SignerInfo_num(sinfos); i++)
                        {
                        si = sk_CMS_SignerInfo_value(sinfos, i);
@@ -395,7 +419,7 @@ int CMS_verify(CMS_ContentInfo *cms, STACK_OF(X509) *certs,
                for (i = 0; i < sk_CMS_SignerInfo_num(sinfos); i++)
                        {
                        si = sk_CMS_SignerInfo_value(sinfos, i);
-                       if (!CMS_SignerInfo_verify_content(si, cmsbio))
+                       if (CMS_SignerInfo_verify_content(si, cmsbio) <= 0)
                                {
                                CMSerr(CMS_F_CMS_VERIFY,
                                        CMS_R_CONTENT_VERIFY_ERROR);
@@ -409,8 +433,9 @@ int CMS_verify(CMS_ContentInfo *cms, STACK_OF(X509) *certs,
        err:
        
        if (dcont && (tmpin == dcont))
-               BIO_pop(cmsbio);
-       BIO_free_all(cmsbio);
+               do_free_upto(cmsbio, dcont);
+       else
+               BIO_free_all(cmsbio);
 
        if (cms_certs)
                sk_X509_pop_free(cms_certs, X509_free);
@@ -425,6 +450,7 @@ int CMS_verify_receipt(CMS_ContentInfo *rcms, CMS_ContentInfo *ocms,
                        X509_STORE *store, unsigned int flags)
        {
        int r;
+       flags &= ~(CMS_DETACHED|CMS_TEXT);
        r = CMS_verify(rcms, certs, store, NULL, NULL, flags);
        if (r <= 0)
                return r;
@@ -436,28 +462,29 @@ CMS_ContentInfo *CMS_sign(X509 *signcert, EVP_PKEY *pkey, STACK_OF(X509) *certs,
        {
        CMS_ContentInfo *cms;
        int i;
+
        cms = CMS_ContentInfo_new();
-       if (!cms)
+       if (!cms || !CMS_SignedData_init(cms))
                goto merr;
+
        if (pkey && !CMS_add1_signer(cms, signcert, pkey, NULL, flags))
                {
                CMSerr(CMS_F_CMS_SIGN, CMS_R_ADD_SIGNER_ERROR);
                goto err;
                }
+
        for (i = 0; i < sk_X509_num(certs); i++)
                {
                X509 *x = sk_X509_value(certs, i);
                if (!CMS_add1_cert(cms, x))
                        goto merr;
                }
-       /* If no signer or certs initialize signedData */
-       if (!pkey && !i && !CMS_SignedData_init(cms))
-               goto merr;
 
        if(!(flags & CMS_DETACHED))
                CMS_set_detached(cms, 0);
 
-       if ((flags & (CMS_STREAM|CMS_PARTIAL)) || CMS_final(cms, data, flags))
+       if ((flags & (CMS_STREAM|CMS_PARTIAL))
+               || CMS_final(cms, data, NULL, flags))
                return cms;
        else
                goto err;
@@ -482,7 +509,7 @@ CMS_ContentInfo *CMS_sign_receipt(CMS_SignerInfo *si,
        BIO *rct_cont = NULL;
        int r = 0;
 
-       flags &= ~CMS_STREAM;
+       flags &= ~(CMS_STREAM|CMS_TEXT);
        /* Not really detached but avoids content being allocated */
        flags |= CMS_PARTIAL|CMS_BINARY|CMS_DETACHED;
        if (!pkey || !signcert)
@@ -524,7 +551,7 @@ CMS_ContentInfo *CMS_sign_receipt(CMS_SignerInfo *si,
                goto err;
 
        /* Finalize structure */
-       if (!CMS_final(cms, rct_cont, flags))
+       if (!CMS_final(cms, rct_cont, NULL, flags))
                goto err;
 
        /* Set embedded content */
@@ -565,7 +592,8 @@ CMS_ContentInfo *CMS_encrypt(STACK_OF(X509) *certs, BIO *data,
        if(!(flags & CMS_DETACHED))
                CMS_set_detached(cms, 0);
 
-       if ((flags & (CMS_STREAM|CMS_PARTIAL)) || CMS_final(cms, data, flags))
+       if ((flags & (CMS_STREAM|CMS_PARTIAL))
+               || CMS_final(cms, data, NULL, flags))
                return cms;
        else
                goto err;
@@ -583,7 +611,10 @@ int CMS_decrypt_set1_pkey(CMS_ContentInfo *cms, EVP_PKEY *pk, X509 *cert)
        STACK_OF(CMS_RecipientInfo) *ris;
        CMS_RecipientInfo *ri;
        int i, r;
+       int debug = 0;
        ris = CMS_get0_RecipientInfos(cms);
+       if (ris)
+               debug = cms->d.envelopedData->encryptedContentInfo->debug;
        for (i = 0; i < sk_CMS_RecipientInfo_num(ris); i++)
                {
                ri = sk_CMS_RecipientInfo_value(ris, i);
@@ -597,17 +628,38 @@ int CMS_decrypt_set1_pkey(CMS_ContentInfo *cms, EVP_PKEY *pk, X509 *cert)
                        CMS_RecipientInfo_set0_pkey(ri, pk);
                        r = CMS_RecipientInfo_decrypt(cms, ri);
                        CMS_RecipientInfo_set0_pkey(ri, NULL);
-                       if (r > 0)
-                               return 1;
                        if (cert)
                                {
+                               /* If not debugging clear any error and
+                                * return success to avoid leaking of
+                                * information useful to MMA
+                                */
+                               if (!debug)
+                                       {
+                                       ERR_clear_error();
+                                       return 1;
+                                       }
+                               if (r > 0)
+                                       return 1;
                                CMSerr(CMS_F_CMS_DECRYPT_SET1_PKEY,
                                                CMS_R_DECRYPT_ERROR);
                                return 0;
                                }
-                       ERR_clear_error();
+                       /* If no cert and not debugging don't leave loop
+                        * after first successful decrypt. Always attempt
+                        * to decrypt all recipients to avoid leaking timing
+                        * of a successful decrypt.
+                        */
+                       else if (r > 0 && debug)
+                               return 1;
                        }
                }
+       /* If no cert and not debugging always return success */
+       if (!cert && !debug)
+               {
+               ERR_clear_error();
+               return 1;
+               }
 
        CMSerr(CMS_F_CMS_DECRYPT_SET1_PKEY, CMS_R_NO_MATCHING_RECIPIENT);
        return 0;
@@ -652,6 +704,30 @@ int CMS_decrypt_set1_key(CMS_ContentInfo *cms,
        return 0;
 
        }
+
+int CMS_decrypt_set1_password(CMS_ContentInfo *cms, 
+                               unsigned char *pass, ossl_ssize_t passlen)
+       {
+       STACK_OF(CMS_RecipientInfo) *ris;
+       CMS_RecipientInfo *ri;
+       int i, r;
+       ris = CMS_get0_RecipientInfos(cms);
+       for (i = 0; i < sk_CMS_RecipientInfo_num(ris); i++)
+               {
+               ri = sk_CMS_RecipientInfo_value(ris, i);
+               if (CMS_RecipientInfo_type(ri) != CMS_RECIPINFO_PASS)
+                               continue;
+               CMS_RecipientInfo_set0_password(ri, pass, passlen);
+               r = CMS_RecipientInfo_decrypt(cms, ri);
+               CMS_RecipientInfo_set0_password(ri, NULL, 0);
+               if (r > 0)
+                       return 1;
+               }
+
+       CMSerr(CMS_F_CMS_DECRYPT_SET1_PASSWORD, CMS_R_NO_MATCHING_RECIPIENT);
+       return 0;
+
+       }
        
 int CMS_decrypt(CMS_ContentInfo *cms, EVP_PKEY *pk, X509 *cert,
                                BIO *dcont, BIO *out,
@@ -666,22 +742,27 @@ int CMS_decrypt(CMS_ContentInfo *cms, EVP_PKEY *pk, X509 *cert,
                }
        if (!dcont && !check_content(cms))
                return 0;
+       if (flags & CMS_DEBUG_DECRYPT)
+               cms->d.envelopedData->encryptedContentInfo->debug = 1;
+       else
+               cms->d.envelopedData->encryptedContentInfo->debug = 0;
+       if (!pk && !cert && !dcont && !out)
+               return 1;
        if (pk && !CMS_decrypt_set1_pkey(cms, pk, cert))
                return 0;
-
        cont = CMS_dataInit(cms, dcont);
        if (!cont)
                return 0;
        r = cms_copy_content(out, cont, flags);
-       BIO_free_all(cont);
+       do_free_upto(cont, dcont);
        return r;
        }
 
-int CMS_final(CMS_ContentInfo *cms, BIO *data, int flags)
+int CMS_final(CMS_ContentInfo *cms, BIO *data, BIO *dcont, unsigned int flags)
        {
        BIO *cmsbio;
        int ret = 0;
-       if (!(cmsbio = CMS_dataInit(cms, NULL)))
+       if (!(cmsbio = CMS_dataInit(cms, dcont)))
                {
                CMSerr(CMS_F_CMS_FINAL,ERR_R_MALLOC_FAILURE);
                return 0;
@@ -701,7 +782,7 @@ int CMS_final(CMS_ContentInfo *cms, BIO *data, int flags)
        ret = 1;
 
        err:
-       BIO_free_all(cmsbio);
+       do_free_upto(cmsbio, dcont);
 
        return ret;
 
@@ -728,7 +809,7 @@ int CMS_uncompress(CMS_ContentInfo *cms, BIO *dcont, BIO *out,
        if (!cont)
                return 0;
        r = cms_copy_content(out, cont, flags);
-       BIO_free_all(cont);
+       do_free_upto(cont, dcont);
        return r;
        }
 
@@ -744,7 +825,7 @@ CMS_ContentInfo *CMS_compress(BIO *in, int comp_nid, unsigned int flags)
        if(!(flags & CMS_DETACHED))
                CMS_set_detached(cms, 0);
 
-       if ((flags & CMS_STREAM) || CMS_final(cms, in, flags))
+       if ((flags & CMS_STREAM) || CMS_final(cms, in, NULL, flags))
                return cms;
 
        CMS_ContentInfo_free(cms);