xref: /src/crypto/openssl/apps/smime.c (revision f25b8c9fb4f58cf61adb47d7570abe7caa6d385d)
1 /*
2  * Copyright 1999-2025 The OpenSSL Project Authors. All Rights Reserved.
3  *
4  * Licensed under the Apache License 2.0 (the "License").  You may not use
5  * this file except in compliance with the License.  You can obtain a copy
6  * in the file LICENSE in the source distribution or at
7  * https://www.openssl.org/source/license.html
8  */
9 
10 /* S/MIME utility function */
11 
12 #include <stdio.h>
13 #include <string.h>
14 #include "apps.h"
15 #include "progs.h"
16 #include <openssl/crypto.h>
17 #include <openssl/pem.h>
18 #include <openssl/err.h>
19 #include <openssl/x509_vfy.h>
20 #include <openssl/x509v3.h>
21 
22 static int save_certs(char *signerfile, STACK_OF(X509) *signers);
23 static int smime_cb(int ok, X509_STORE_CTX *ctx);
24 
25 #define SMIME_OP 0x10
26 #define SMIME_IP 0x20
27 #define SMIME_SIGNERS 0x40
28 #define SMIME_ENCRYPT (1 | SMIME_OP)
29 #define SMIME_DECRYPT (2 | SMIME_IP)
30 #define SMIME_SIGN (3 | SMIME_OP | SMIME_SIGNERS)
31 #define SMIME_RESIGN (6 | SMIME_IP | SMIME_OP | SMIME_SIGNERS)
32 #define SMIME_VERIFY (4 | SMIME_IP)
33 #define SMIME_PK7OUT (5 | SMIME_IP | SMIME_OP)
34 
35 typedef enum OPTION_choice {
36     OPT_COMMON,
37     OPT_ENCRYPT,
38     OPT_DECRYPT,
39     OPT_SIGN,
40     OPT_RESIGN,
41     OPT_VERIFY,
42     OPT_PK7OUT,
43     OPT_TEXT,
44     OPT_NOINTERN,
45     OPT_NOVERIFY,
46     OPT_NOCHAIN,
47     OPT_NOCERTS,
48     OPT_NOATTR,
49     OPT_NODETACH,
50     OPT_NOSMIMECAP,
51     OPT_BINARY,
52     OPT_NOSIGS,
53     OPT_STREAM,
54     OPT_INDEF,
55     OPT_NOINDEF,
56     OPT_CRLFEOL,
57     OPT_ENGINE,
58     OPT_PASSIN,
59     OPT_TO,
60     OPT_FROM,
61     OPT_SUBJECT,
62     OPT_SIGNER,
63     OPT_RECIP,
64     OPT_MD,
65     OPT_CIPHER,
66     OPT_INKEY,
67     OPT_KEYFORM,
68     OPT_CERTFILE,
69     OPT_CAFILE,
70     OPT_CAPATH,
71     OPT_CASTORE,
72     OPT_NOCAFILE,
73     OPT_NOCAPATH,
74     OPT_NOCASTORE,
75     OPT_R_ENUM,
76     OPT_PROV_ENUM,
77     OPT_CONFIG,
78     OPT_V_ENUM,
79     OPT_IN,
80     OPT_INFORM,
81     OPT_OUT,
82     OPT_OUTFORM,
83     OPT_CONTENT
84 } OPTION_CHOICE;
85 
86 const OPTIONS smime_options[] = {
87     { OPT_HELP_STR, 1, '-', "Usage: %s [options] [cert...]\n" },
88 
89     OPT_SECTION("General"),
90     { "help", OPT_HELP, '-', "Display this summary" },
91     { "in", OPT_IN, '<', "Input file" },
92     { "inform", OPT_INFORM, 'c', "Input format SMIME (default), PEM or DER" },
93     { "out", OPT_OUT, '>', "Output file" },
94     { "outform", OPT_OUTFORM, 'c',
95         "Output format SMIME (default), PEM or DER" },
96     { "inkey", OPT_INKEY, 's',
97         "Input private key (if not signer or recipient)" },
98     { "keyform", OPT_KEYFORM, 'f', "Input private key format (ENGINE, other values ignored)" },
99 #ifndef OPENSSL_NO_ENGINE
100     { "engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device" },
101 #endif
102     { "stream", OPT_STREAM, '-', "Enable CMS streaming" },
103     { "indef", OPT_INDEF, '-', "Same as -stream" },
104     { "noindef", OPT_NOINDEF, '-', "Disable CMS streaming" },
105     OPT_CONFIG_OPTION,
106 
107     OPT_SECTION("Action"),
108     { "encrypt", OPT_ENCRYPT, '-', "Encrypt message" },
109     { "decrypt", OPT_DECRYPT, '-', "Decrypt encrypted message" },
110     { "sign", OPT_SIGN, '-', "Sign message" },
111     { "resign", OPT_RESIGN, '-', "Resign a signed message" },
112     { "verify", OPT_VERIFY, '-', "Verify signed message" },
113     { "pk7out", OPT_PK7OUT, '-', "Output PKCS#7 structure" },
114 
115     OPT_SECTION("Signing/Encryption"),
116     { "passin", OPT_PASSIN, 's', "Input file pass phrase source" },
117     { "md", OPT_MD, 's', "Digest algorithm to use when signing or resigning" },
118     { "", OPT_CIPHER, '-', "Any supported cipher" },
119     { "nointern", OPT_NOINTERN, '-',
120         "Don't search certificates in message for signer" },
121     { "nodetach", OPT_NODETACH, '-', "Use opaque signing" },
122     { "noattr", OPT_NOATTR, '-', "Don't include any signed attributes" },
123     { "binary", OPT_BINARY, '-', "Don't translate message to text" },
124     { "signer", OPT_SIGNER, 's', "Signer certificate file" },
125     { "content", OPT_CONTENT, '<',
126         "Supply or override content for detached signature" },
127     { "nocerts", OPT_NOCERTS, '-',
128         "Don't include signers certificate when signing" },
129 
130     OPT_SECTION("Verification/Decryption"),
131     { "nosigs", OPT_NOSIGS, '-', "Don't verify message signature" },
132     { "noverify", OPT_NOVERIFY, '-', "Don't verify signers certificate" },
133 
134     { "certfile", OPT_CERTFILE, '<',
135         "Extra signer and intermediate CA certificates to include when signing" },
136     { OPT_MORE_STR, 0, 0,
137         "or to use as preferred signer certs and for chain building when verifying" },
138     { "recip", OPT_RECIP, '<', "Recipient certificate file for decryption" },
139 
140     OPT_SECTION("Email"),
141     { "to", OPT_TO, 's', "To address" },
142     { "from", OPT_FROM, 's', "From address" },
143     { "subject", OPT_SUBJECT, 's', "Subject" },
144     { "text", OPT_TEXT, '-', "Include or delete text MIME headers" },
145     { "nosmimecap", OPT_NOSMIMECAP, '-', "Omit the SMIMECapabilities attribute" },
146 
147     OPT_SECTION("Certificate chain"),
148     { "CApath", OPT_CAPATH, '/', "Trusted certificates directory" },
149     { "CAfile", OPT_CAFILE, '<', "Trusted certificates file" },
150     { "CAstore", OPT_CASTORE, ':', "Trusted certificates store URI" },
151     { "no-CAfile", OPT_NOCAFILE, '-',
152         "Do not load the default certificates file" },
153     { "no-CApath", OPT_NOCAPATH, '-',
154         "Do not load certificates from the default certificates directory" },
155     { "no-CAstore", OPT_NOCASTORE, '-',
156         "Do not load certificates from the default certificates store" },
157     { "nochain", OPT_NOCHAIN, '-',
158         "set PKCS7_NOCHAIN so certificates contained in the message are not used as untrusted CAs" },
159     { "crlfeol", OPT_CRLFEOL, '-', "Use CRLF as EOL termination instead of LF only" },
160 
161     OPT_R_OPTIONS,
162     OPT_V_OPTIONS,
163     OPT_PROV_OPTIONS,
164 
165     OPT_PARAMETERS(),
166     { "cert", 0, 0, "Recipient certs, used when encrypting" },
167     { NULL }
168 };
169 
operation_name(int operation)170 static const char *operation_name(int operation)
171 {
172     switch (operation) {
173     case SMIME_ENCRYPT:
174         return "encrypt";
175     case SMIME_DECRYPT:
176         return "decrypt";
177     case SMIME_SIGN:
178         return "sign";
179     case SMIME_RESIGN:
180         return "resign";
181     case SMIME_VERIFY:
182         return "verify";
183     case SMIME_PK7OUT:
184         return "pk7out";
185     default:
186         return "(invalid operation)";
187     }
188 }
189 
190 #define SET_OPERATION(op)                                                                                                            \
191     ((operation != 0 && (operation != (op)))                                                                                         \
192             ? 0 * BIO_printf(bio_err, "%s: Cannot use -%s together with -%s\n", prog, operation_name(op), operation_name(operation)) \
193             : (operation = (op)))
194 
smime_main(int argc,char ** argv)195 int smime_main(int argc, char **argv)
196 {
197     CONF *conf = NULL;
198     BIO *in = NULL, *out = NULL, *indata = NULL;
199     EVP_PKEY *key = NULL;
200     PKCS7 *p7 = NULL;
201     STACK_OF(OPENSSL_STRING) *sksigners = NULL, *skkeys = NULL;
202     STACK_OF(X509) *encerts = NULL, *other = NULL;
203     X509 *cert = NULL, *recip = NULL, *signer = NULL;
204     X509_STORE *store = NULL;
205     X509_VERIFY_PARAM *vpm = NULL;
206     EVP_CIPHER *cipher = NULL;
207     EVP_MD *sign_md = NULL;
208     const char *CAfile = NULL, *CApath = NULL, *CAstore = NULL, *prog = NULL;
209     char *certfile = NULL, *keyfile = NULL, *contfile = NULL;
210     char *infile = NULL, *outfile = NULL, *signerfile = NULL, *recipfile = NULL;
211     char *passinarg = NULL, *passin = NULL, *to = NULL, *from = NULL;
212     char *subject = NULL, *digestname = NULL, *ciphername = NULL;
213     OPTION_CHOICE o;
214     int noCApath = 0, noCAfile = 0, noCAstore = 0;
215     int flags = PKCS7_DETACHED, operation = 0, ret = 0, indef = 0;
216     int informat = FORMAT_SMIME, outformat = FORMAT_SMIME, keyform = FORMAT_UNDEF;
217     int vpmtouched = 0, rv = 0;
218     ENGINE *e = NULL;
219     const char *mime_eol = "\n";
220     OSSL_LIB_CTX *libctx = app_get0_libctx();
221 
222     if ((vpm = X509_VERIFY_PARAM_new()) == NULL)
223         return 1;
224 
225     opt_set_unknown_name("cipher");
226     prog = opt_init(argc, argv, smime_options);
227     while ((o = opt_next()) != OPT_EOF) {
228         switch (o) {
229         case OPT_EOF:
230         case OPT_ERR:
231         opthelp:
232             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
233             goto end;
234         case OPT_HELP:
235             opt_help(smime_options);
236             ret = 0;
237             goto end;
238         case OPT_INFORM:
239             if (!opt_format(opt_arg(), OPT_FMT_PDS, &informat))
240                 goto opthelp;
241             break;
242         case OPT_IN:
243             infile = opt_arg();
244             break;
245         case OPT_OUTFORM:
246             if (!opt_format(opt_arg(), OPT_FMT_PDS, &outformat))
247                 goto opthelp;
248             break;
249         case OPT_OUT:
250             outfile = opt_arg();
251             break;
252         case OPT_ENCRYPT:
253             if (!SET_OPERATION(SMIME_ENCRYPT))
254                 goto end;
255             break;
256         case OPT_DECRYPT:
257             if (!SET_OPERATION(SMIME_DECRYPT))
258                 goto end;
259             break;
260         case OPT_SIGN:
261             if (!SET_OPERATION(SMIME_SIGN))
262                 goto end;
263             break;
264         case OPT_RESIGN:
265             if (!SET_OPERATION(SMIME_RESIGN))
266                 goto end;
267             break;
268         case OPT_VERIFY:
269             if (!SET_OPERATION(SMIME_VERIFY))
270                 goto end;
271             break;
272         case OPT_PK7OUT:
273             if (!SET_OPERATION(SMIME_PK7OUT))
274                 goto end;
275             break;
276         case OPT_TEXT:
277             flags |= PKCS7_TEXT;
278             break;
279         case OPT_NOINTERN:
280             flags |= PKCS7_NOINTERN;
281             break;
282         case OPT_NOVERIFY:
283             flags |= PKCS7_NOVERIFY;
284             break;
285         case OPT_NOCHAIN:
286             flags |= PKCS7_NOCHAIN;
287             break;
288         case OPT_NOCERTS:
289             flags |= PKCS7_NOCERTS;
290             break;
291         case OPT_NOATTR:
292             flags |= PKCS7_NOATTR;
293             break;
294         case OPT_NODETACH:
295             flags &= ~PKCS7_DETACHED;
296             break;
297         case OPT_NOSMIMECAP:
298             flags |= PKCS7_NOSMIMECAP;
299             break;
300         case OPT_BINARY:
301             flags |= PKCS7_BINARY;
302             break;
303         case OPT_NOSIGS:
304             flags |= PKCS7_NOSIGS;
305             break;
306         case OPT_STREAM:
307         case OPT_INDEF:
308             indef = 1;
309             break;
310         case OPT_NOINDEF:
311             indef = 0;
312             break;
313         case OPT_CRLFEOL:
314             flags |= PKCS7_CRLFEOL;
315             mime_eol = "\r\n";
316             break;
317         case OPT_R_CASES:
318             if (!opt_rand(o))
319                 goto end;
320             break;
321         case OPT_PROV_CASES:
322             if (!opt_provider(o))
323                 goto end;
324             break;
325         case OPT_CONFIG:
326             conf = app_load_config_modules(opt_arg());
327             if (conf == NULL)
328                 goto end;
329             break;
330         case OPT_ENGINE:
331             e = setup_engine(opt_arg(), 0);
332             break;
333         case OPT_PASSIN:
334             passinarg = opt_arg();
335             break;
336         case OPT_TO:
337             to = opt_arg();
338             break;
339         case OPT_FROM:
340             from = opt_arg();
341             break;
342         case OPT_SUBJECT:
343             subject = opt_arg();
344             break;
345         case OPT_SIGNER:
346             /* If previous -signer argument add signer to list */
347             if (signerfile != NULL) {
348                 if (sksigners == NULL
349                     && (sksigners = sk_OPENSSL_STRING_new_null()) == NULL)
350                     goto end;
351                 if (sk_OPENSSL_STRING_push(sksigners, signerfile) <= 0)
352                     goto end;
353                 if (keyfile == NULL)
354                     keyfile = signerfile;
355                 if (skkeys == NULL
356                     && (skkeys = sk_OPENSSL_STRING_new_null()) == NULL)
357                     goto end;
358                 if (sk_OPENSSL_STRING_push(skkeys, keyfile) <= 0)
359                     goto end;
360                 keyfile = NULL;
361             }
362             signerfile = opt_arg();
363             break;
364         case OPT_RECIP:
365             recipfile = opt_arg();
366             break;
367         case OPT_MD:
368             digestname = opt_arg();
369             break;
370         case OPT_CIPHER:
371             ciphername = opt_unknown();
372             break;
373         case OPT_INKEY:
374             /* If previous -inkey argument add signer to list */
375             if (keyfile != NULL) {
376                 if (signerfile == NULL) {
377                     BIO_printf(bio_err,
378                         "%s: Must have -signer before -inkey\n", prog);
379                     goto opthelp;
380                 }
381                 if (sksigners == NULL
382                     && (sksigners = sk_OPENSSL_STRING_new_null()) == NULL)
383                     goto end;
384                 if (sk_OPENSSL_STRING_push(sksigners, signerfile) <= 0)
385                     goto end;
386                 signerfile = NULL;
387                 if (skkeys == NULL
388                     && (skkeys = sk_OPENSSL_STRING_new_null()) == NULL)
389                     goto end;
390                 if (sk_OPENSSL_STRING_push(skkeys, keyfile) <= 0)
391                     goto end;
392             }
393             keyfile = opt_arg();
394             break;
395         case OPT_KEYFORM:
396             if (!opt_format(opt_arg(), OPT_FMT_ANY, &keyform))
397                 goto opthelp;
398             break;
399         case OPT_CERTFILE:
400             certfile = opt_arg();
401             break;
402         case OPT_CAFILE:
403             CAfile = opt_arg();
404             break;
405         case OPT_CAPATH:
406             CApath = opt_arg();
407             break;
408         case OPT_CASTORE:
409             CAstore = opt_arg();
410             break;
411         case OPT_NOCAFILE:
412             noCAfile = 1;
413             break;
414         case OPT_NOCAPATH:
415             noCApath = 1;
416             break;
417         case OPT_NOCASTORE:
418             noCAstore = 1;
419             break;
420         case OPT_CONTENT:
421             contfile = opt_arg();
422             break;
423         case OPT_V_CASES:
424             if (!opt_verify(o, vpm))
425                 goto opthelp;
426             vpmtouched++;
427             break;
428         }
429     }
430 
431     /* Extra arguments are files with recipient keys. */
432     argc = opt_num_rest();
433     argv = opt_rest();
434 
435     if (!app_RAND_load())
436         goto end;
437 
438     if (digestname != NULL) {
439         if (!opt_md(digestname, &sign_md))
440             goto opthelp;
441     }
442     if (!opt_cipher_any(ciphername, &cipher))
443         goto opthelp;
444     if (!(operation & SMIME_SIGNERS) && (skkeys != NULL || sksigners != NULL)) {
445         BIO_puts(bio_err, "Multiple signers or keys not allowed\n");
446         goto opthelp;
447     }
448     if (!operation) {
449         BIO_puts(bio_err,
450             "No operation (-encrypt|-sign|...) specified\n");
451         goto opthelp;
452     }
453 
454     if (operation & SMIME_SIGNERS) {
455         /* Check to see if any final signer needs to be appended */
456         if (keyfile && !signerfile) {
457             BIO_puts(bio_err, "Illegal -inkey without -signer\n");
458             goto opthelp;
459         }
460         if (signerfile != NULL) {
461             if (sksigners == NULL
462                 && (sksigners = sk_OPENSSL_STRING_new_null()) == NULL)
463                 goto end;
464             if (sk_OPENSSL_STRING_push(sksigners, signerfile) <= 0)
465                 goto end;
466             if (!skkeys && (skkeys = sk_OPENSSL_STRING_new_null()) == NULL)
467                 goto end;
468             if (!keyfile)
469                 keyfile = signerfile;
470             if (sk_OPENSSL_STRING_push(skkeys, keyfile) <= 0)
471                 goto end;
472         }
473         if (sksigners == NULL) {
474             BIO_printf(bio_err, "No signer certificate specified\n");
475             goto opthelp;
476         }
477         signerfile = NULL;
478         keyfile = NULL;
479     } else if (operation == SMIME_DECRYPT) {
480         if (recipfile == NULL && keyfile == NULL) {
481             BIO_printf(bio_err,
482                 "No recipient certificate or key specified\n");
483             goto opthelp;
484         }
485     } else if (operation == SMIME_ENCRYPT) {
486         if (argc == 0) {
487             BIO_printf(bio_err, "No recipient(s) certificate(s) specified\n");
488             goto opthelp;
489         }
490     }
491 
492     if (!app_passwd(passinarg, NULL, &passin, NULL)) {
493         BIO_printf(bio_err, "Error getting password\n");
494         goto end;
495     }
496 
497     ret = 2;
498 
499     if (!(operation & SMIME_SIGNERS))
500         flags &= ~PKCS7_DETACHED;
501 
502     if (!(operation & SMIME_OP)) {
503         if (flags & PKCS7_BINARY)
504             outformat = FORMAT_BINARY;
505     }
506 
507     if (!(operation & SMIME_IP)) {
508         if (flags & PKCS7_BINARY)
509             informat = FORMAT_BINARY;
510     }
511 
512     if (operation == SMIME_ENCRYPT) {
513         if (cipher == NULL)
514             cipher = (EVP_CIPHER *)EVP_aes_256_cbc();
515         encerts = sk_X509_new_null();
516         if (encerts == NULL)
517             goto end;
518         while (*argv != NULL) {
519             cert = load_cert(*argv, FORMAT_UNDEF,
520                 "recipient certificate file");
521             if (cert == NULL)
522                 goto end;
523             if (!sk_X509_push(encerts, cert))
524                 goto end;
525             cert = NULL;
526             argv++;
527         }
528     }
529 
530     if (certfile != NULL) {
531         if (!load_certs(certfile, 0, &other, NULL, "certificates")) {
532             ERR_print_errors(bio_err);
533             goto end;
534         }
535     }
536 
537     if (recipfile != NULL && (operation == SMIME_DECRYPT)) {
538         if ((recip = load_cert(recipfile, FORMAT_UNDEF,
539                  "recipient certificate file"))
540             == NULL) {
541             ERR_print_errors(bio_err);
542             goto end;
543         }
544     }
545 
546     if (operation == SMIME_DECRYPT) {
547         if (keyfile == NULL)
548             keyfile = recipfile;
549     } else if (operation == SMIME_SIGN) {
550         if (keyfile == NULL)
551             keyfile = signerfile;
552     } else {
553         keyfile = NULL;
554     }
555 
556     if (keyfile != NULL) {
557         key = load_key(keyfile, keyform, 0, passin, e, "signing key");
558         if (key == NULL)
559             goto end;
560     }
561 
562     in = bio_open_default(infile, 'r', informat);
563     if (in == NULL)
564         goto end;
565 
566     if (operation & SMIME_IP) {
567         PKCS7 *p7_in = NULL;
568 
569         p7 = PKCS7_new_ex(libctx, app_get0_propq());
570         if (p7 == NULL) {
571             BIO_printf(bio_err, "Error allocating PKCS7 object\n");
572             goto end;
573         }
574         if (informat == FORMAT_SMIME) {
575             p7_in = SMIME_read_PKCS7_ex(in, &indata, &p7);
576         } else if (informat == FORMAT_PEM) {
577             p7_in = PEM_read_bio_PKCS7(in, &p7, NULL, NULL);
578         } else if (informat == FORMAT_ASN1) {
579             p7_in = d2i_PKCS7_bio(in, &p7);
580         } else {
581             BIO_printf(bio_err, "Bad input format for PKCS#7 file\n");
582             goto end;
583         }
584 
585         if (p7_in == NULL) {
586             BIO_printf(bio_err, "Error reading S/MIME message\n");
587             goto end;
588         }
589         if (contfile != NULL) {
590             BIO_free(indata);
591             if ((indata = BIO_new_file(contfile, "rb")) == NULL) {
592                 BIO_printf(bio_err, "Can't read content file %s\n", contfile);
593                 goto end;
594             }
595         }
596     }
597 
598     out = bio_open_default(outfile, 'w', outformat);
599     if (out == NULL)
600         goto end;
601 
602     if (operation == SMIME_VERIFY) {
603         if ((store = setup_verify(CAfile, noCAfile, CApath, noCApath,
604                  CAstore, noCAstore))
605             == NULL)
606             goto end;
607         X509_STORE_set_verify_cb(store, smime_cb);
608         if (vpmtouched)
609             X509_STORE_set1_param(store, vpm);
610     }
611 
612     ret = 3;
613 
614     if (operation == SMIME_ENCRYPT) {
615         if (indef)
616             flags |= PKCS7_STREAM;
617         p7 = PKCS7_encrypt_ex(encerts, in, cipher, flags, libctx, app_get0_propq());
618     } else if (operation & SMIME_SIGNERS) {
619         int i;
620         /*
621          * If detached data content we only enable streaming if S/MIME output
622          * format.
623          */
624         if (operation == SMIME_SIGN) {
625             if (flags & PKCS7_DETACHED) {
626                 if (outformat == FORMAT_SMIME)
627                     flags |= PKCS7_STREAM;
628             } else if (indef) {
629                 flags |= PKCS7_STREAM;
630             }
631             flags |= PKCS7_PARTIAL;
632             p7 = PKCS7_sign_ex(NULL, NULL, other, in, flags, libctx, app_get0_propq());
633             if (p7 == NULL)
634                 goto end;
635             if (flags & PKCS7_NOCERTS) {
636                 for (i = 0; i < sk_X509_num(other); i++) {
637                     X509 *x = sk_X509_value(other, i);
638                     PKCS7_add_certificate(p7, x);
639                 }
640             }
641         } else {
642             flags |= PKCS7_REUSE_DIGEST;
643         }
644         for (i = 0; i < sk_OPENSSL_STRING_num(sksigners); i++) {
645             signerfile = sk_OPENSSL_STRING_value(sksigners, i);
646             keyfile = sk_OPENSSL_STRING_value(skkeys, i);
647             signer = load_cert(signerfile, FORMAT_UNDEF, "signer certificate");
648             if (signer == NULL)
649                 goto end;
650             key = load_key(keyfile, keyform, 0, passin, e, "signing key");
651             if (key == NULL)
652                 goto end;
653 
654             if (!PKCS7_sign_add_signer(p7, signer, key, sign_md, flags))
655                 goto end;
656             X509_free(signer);
657             signer = NULL;
658             EVP_PKEY_free(key);
659             key = NULL;
660         }
661         /* If not streaming or resigning finalize structure */
662         if ((operation == SMIME_SIGN) && !(flags & PKCS7_STREAM)) {
663             if (!PKCS7_final(p7, in, flags))
664                 goto end;
665         }
666     }
667 
668     if (p7 == NULL) {
669         BIO_printf(bio_err, "Error creating PKCS#7 structure\n");
670         goto end;
671     }
672 
673     ret = 4;
674     if (operation == SMIME_DECRYPT) {
675         if (!PKCS7_decrypt(p7, key, recip, out, flags)) {
676             BIO_printf(bio_err, "Error decrypting PKCS#7 structure\n");
677             goto end;
678         }
679     } else if (operation == SMIME_VERIFY) {
680         STACK_OF(X509) *signers;
681         if (PKCS7_verify(p7, other, store, indata, out, flags))
682             BIO_printf(bio_err, "Verification successful\n");
683         else {
684             BIO_printf(bio_err, "Verification failure\n");
685             goto end;
686         }
687         signers = PKCS7_get0_signers(p7, other, flags);
688         if (!save_certs(signerfile, signers)) {
689             BIO_printf(bio_err, "Error writing signers to %s\n", signerfile);
690             ret = 5;
691             goto end;
692         }
693         sk_X509_free(signers);
694     } else if (operation == SMIME_PK7OUT) {
695         PEM_write_bio_PKCS7(out, p7);
696     } else {
697         if (to)
698             BIO_printf(out, "To: %s%s", to, mime_eol);
699         if (from)
700             BIO_printf(out, "From: %s%s", from, mime_eol);
701         if (subject)
702             BIO_printf(out, "Subject: %s%s", subject, mime_eol);
703         if (outformat == FORMAT_SMIME) {
704             if (operation == SMIME_RESIGN)
705                 rv = SMIME_write_PKCS7(out, p7, indata, flags);
706             else
707                 rv = SMIME_write_PKCS7(out, p7, in, flags);
708         } else if (outformat == FORMAT_PEM) {
709             rv = PEM_write_bio_PKCS7_stream(out, p7, in, flags);
710         } else if (outformat == FORMAT_ASN1) {
711             rv = i2d_PKCS7_bio_stream(out, p7, in, flags);
712         } else {
713             BIO_printf(bio_err, "Bad output format for PKCS#7 file\n");
714             goto end;
715         }
716         if (rv == 0) {
717             BIO_printf(bio_err, "Error writing output\n");
718             ret = 3;
719             goto end;
720         }
721     }
722     ret = 0;
723 end:
724     if (ret)
725         ERR_print_errors(bio_err);
726     OSSL_STACK_OF_X509_free(encerts);
727     OSSL_STACK_OF_X509_free(other);
728     X509_VERIFY_PARAM_free(vpm);
729     sk_OPENSSL_STRING_free(sksigners);
730     sk_OPENSSL_STRING_free(skkeys);
731     X509_STORE_free(store);
732     X509_free(cert);
733     X509_free(recip);
734     X509_free(signer);
735     EVP_PKEY_free(key);
736     EVP_MD_free(sign_md);
737     EVP_CIPHER_free(cipher);
738     PKCS7_free(p7);
739     release_engine(e);
740     BIO_free(in);
741     BIO_free(indata);
742     BIO_free_all(out);
743     OPENSSL_free(passin);
744     NCONF_free(conf);
745     return ret;
746 }
747 
save_certs(char * signerfile,STACK_OF (X509)* signers)748 static int save_certs(char *signerfile, STACK_OF(X509) *signers)
749 {
750     int i;
751     BIO *tmp;
752 
753     if (signerfile == NULL)
754         return 1;
755     tmp = BIO_new_file(signerfile, "w");
756     if (tmp == NULL)
757         return 0;
758     for (i = 0; i < sk_X509_num(signers); i++)
759         PEM_write_bio_X509(tmp, sk_X509_value(signers, i));
760     BIO_free(tmp);
761     return 1;
762 }
763 
764 /* Minimal callback just to output policy info (if any) */
765 
smime_cb(int ok,X509_STORE_CTX * ctx)766 static int smime_cb(int ok, X509_STORE_CTX *ctx)
767 {
768     int error;
769 
770     error = X509_STORE_CTX_get_error(ctx);
771 
772     if ((error != X509_V_ERR_NO_EXPLICIT_POLICY)
773         && ((error != X509_V_OK) || (ok != 2)))
774         return ok;
775 
776     policies_print(ctx);
777 
778     return ok;
779 }
780