Upgrade chrome's OpenSSL to same version Android ships with.

openssl/apps/cms.c

 /* apps/cms.c */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
  */
 /* ====================================================================
  * Copyright (c) 2008 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ skipping 53 matching lines @@
 #include <openssl/err.h>
 #include <openssl/x509_vfy.h>
 #include <openssl/x509v3.h>
 #include <openssl/cms.h>
 
 #undef PROG
 #define PROG cms_main
 static int save_certs(char *signerfile, STACK_OF(X509) *signers);
 static int cms_cb(int ok, X509_STORE_CTX *ctx);
 static void receipt_request_print(BIO *out, CMS_ContentInfo *cms);
-static CMS_ReceiptRequest *make_receipt_request(STACK *rr_to, int rr_allorfirst,
-                                                                STACK *rr_from);
+static CMS_ReceiptRequest *make_receipt_request(STACK_OF(OPENSSL_STRING) *rr_to,
+                                                int rr_allorfirst,
+                                        STACK_OF(OPENSSL_STRING) *rr_from);
 
 #define SMIME_OP        0x10
 #define SMIME_IP        0x20
 #define SMIME_SIGNERS   0x40
 #define SMIME_ENCRYPT           (1 | SMIME_OP)
 #define SMIME_DECRYPT           (2 | SMIME_IP)
 #define SMIME_SIGN              (3 | SMIME_OP | SMIME_SIGNERS)
 #define SMIME_VERIFY            (4 | SMIME_IP)
 #define SMIME_CMSOUT            (5 | SMIME_IP | SMIME_OP)
 #define SMIME_RESIGN            (6 | SMIME_IP | SMIME_OP | SMIME_SIGNERS)
 #define SMIME_DATAOUT           (7 | SMIME_IP)
 #define SMIME_DATA_CREATE       (8 | SMIME_OP)
 #define SMIME_DIGEST_VERIFY     (9 | SMIME_IP)
 #define SMIME_DIGEST_CREATE     (10 | SMIME_OP)
 #define SMIME_UNCOMPRESS        (11 | SMIME_IP)
 #define SMIME_COMPRESS          (12 | SMIME_OP)
 #define SMIME_ENCRYPTED_DECRYPT (13 | SMIME_IP)
 #define SMIME_ENCRYPTED_ENCRYPT (14 | SMIME_OP)
 #define SMIME_SIGN_RECEIPT      (15 | SMIME_IP | SMIME_OP)
 #define SMIME_VERIFY_RECEIPT    (16 | SMIME_IP)
 
+int verify_err = 0;
+
 int MAIN(int, char **);
 
 int MAIN(int argc, char **argv)
         {
         ENGINE *e = NULL;
         int operation = 0;
         int ret = 0;
         char **args;
         const char *inmode = "r", *outmode = "w";
         char *infile = NULL, *outfile = NULL, *rctfile = NULL;
         char *signerfile = NULL, *recipfile = NULL;
-        STACK *sksigners = NULL, *skkeys = NULL;
+        STACK_OF(OPENSSL_STRING) *sksigners = NULL, *skkeys = NULL;
         char *certfile = NULL, *keyfile = NULL, *contfile=NULL;
         char *certsoutfile = NULL;
         const EVP_CIPHER *cipher = NULL;
         CMS_ContentInfo *cms = NULL, *rcms = NULL;
         X509_STORE *store = NULL;
         X509 *cert = NULL, *recip = NULL, *signer = NULL;
         EVP_PKEY *key = NULL;
         STACK_OF(X509) *encerts = NULL, *other = NULL;
         BIO *in = NULL, *out = NULL, *indata = NULL, *rctin = NULL;
         int badarg = 0;
-        int flags = CMS_DETACHED;
+        int flags = CMS_DETACHED, noout = 0, print = 0;
+        int verify_retcode = 0;
         int rr_print = 0, rr_allorfirst = -1;
-        STACK *rr_to = NULL, *rr_from = NULL;
+        STACK_OF(OPENSSL_STRING) *rr_to = NULL, *rr_from = NULL;
         CMS_ReceiptRequest *rr = NULL;
         char *to = NULL, *from = NULL, *subject = NULL;
         char *CAfile = NULL, *CApath = NULL;
         char *passargin = NULL, *passin = NULL;
         char *inrand = NULL;
         int need_rand = 0;
         const EVP_MD *sign_md = NULL;
         int informat = FORMAT_SMIME, outformat = FORMAT_SMIME;
         int rctformat = FORMAT_SMIME, keyform = FORMAT_PEM;
 #ifndef OPENSSL_NO_ENGINE
@@ skipping 27 matching lines @@
                 else if (!strcmp (*args, "-decrypt"))
                         operation = SMIME_DECRYPT;
                 else if (!strcmp (*args, "-sign"))
                         operation = SMIME_SIGN;
                 else if (!strcmp (*args, "-sign_receipt"))
                         operation = SMIME_SIGN_RECEIPT;
                 else if (!strcmp (*args, "-resign"))
                         operation = SMIME_RESIGN;
                 else if (!strcmp (*args, "-verify"))
                         operation = SMIME_VERIFY;
+                else if (!strcmp (*args, "-verify_retcode"))
+                        verify_retcode = 1;
                 else if (!strcmp(*args,"-verify_receipt"))
                         {
                         operation = SMIME_VERIFY_RECEIPT;
                         if (!args[1])
                                 goto argerr;
                         args++;
                         rctfile = *args;
                         }
                 else if (!strcmp (*args, "-cmsout"))
                         operation = SMIME_CMSOUT;
@@ skipping 66 matching lines @@
                                 flags |= CMS_BINARY;
                 else if (!strcmp (*args, "-keyid"))
                                 flags |= CMS_USE_KEYID;
                 else if (!strcmp (*args, "-nosigs"))
                                 flags |= CMS_NOSIGS;
                 else if (!strcmp (*args, "-no_content_verify"))
                                 flags |= CMS_NO_CONTENT_VERIFY;
                 else if (!strcmp (*args, "-no_attr_verify"))
                                 flags |= CMS_NO_ATTR_VERIFY;
                 else if (!strcmp (*args, "-stream"))
-                                {
-                                args++;
-                                continue;
-                                }
+                                flags |= CMS_STREAM;
                 else if (!strcmp (*args, "-indef"))
-                                {
-                                args++;
-                                continue;
-                                }
+                                flags |= CMS_STREAM;
                 else if (!strcmp (*args, "-noindef"))
                                 flags &= ~CMS_STREAM;
                 else if (!strcmp (*args, "-nooldmime"))
                                 flags |= CMS_NOOLDMIMETYPE;
                 else if (!strcmp (*args, "-crlfeol"))
                                 flags |= CMS_CRLFEOL;
+                else if (!strcmp (*args, "-noout"))
+                                noout = 1;
                 else if (!strcmp (*args, "-receipt_request_print"))
                                 rr_print = 1;
                 else if (!strcmp (*args, "-receipt_request_all"))
                                 rr_allorfirst = 0;
                 else if (!strcmp (*args, "-receipt_request_first"))
                                 rr_allorfirst = 1;
                 else if (!strcmp(*args,"-receipt_request_from"))
                         {
                         if (!args[1])
                                 goto argerr;
                         args++;
                         if (!rr_from)
-                                rr_from = sk_new_null();
-                        sk_push(rr_from, *args);
+                                rr_from = sk_OPENSSL_STRING_new_null();
+                        sk_OPENSSL_STRING_push(rr_from, *args);
                         }
                 else if (!strcmp(*args,"-receipt_request_to"))
                         {
                         if (!args[1])
                                 goto argerr;
                         args++;
                         if (!rr_to)
-                                rr_to = sk_new_null();
-                        sk_push(rr_to, *args);
+                                rr_to = sk_OPENSSL_STRING_new_null();
+                        sk_OPENSSL_STRING_push(rr_to, *args);
                         }
+                else if (!strcmp (*args, "-print"))
+                                {
+                                noout = 1;
+                                print = 1;
+                                }
                 else if (!strcmp(*args,"-secretkey"))
                         {
                         long ltmp;
                         if (!args[1])
                                 goto argerr;
                         args++;
                         secret_key = string_to_hex(*args, &ltmp);
                         if (!secret_key)
                                 {
                                 BIO_printf(bio_err, "Invalid key %s\n", *args);
@@ skipping 69 matching lines @@
                         }
                 else if (!strcmp (*args, "-signer"))
                         {
                         if (!args[1])
                                 goto argerr;
                         /* If previous -signer argument add signer to list */
 
                         if (signerfile)
                                 {
                                 if (!sksigners)
-                                        sksigners = sk_new_null();
-                                sk_push(sksigners, signerfile);
+                                        sksigners = sk_OPENSSL_STRING_new_null();
+                                sk_OPENSSL_STRING_push(sksigners, signerfile);
                                 if (!keyfile)
                                         keyfile = signerfile;
                                 if (!skkeys)
-                                        skkeys = sk_new_null();
-                                sk_push(skkeys, keyfile);
+                                        skkeys = sk_OPENSSL_STRING_new_null();
+                                sk_OPENSSL_STRING_push(skkeys, keyfile);
                                 keyfile = NULL;
                                 }
                         signerfile = *++args;
                         }
                 else if (!strcmp (*args, "-recip"))
                         {
                         if (!args[1])
                                 goto argerr;
                         recipfile = *++args;
                         }
@@ skipping 21 matching lines @@
                                 goto argerr;
                         /* If previous -inkey arument add signer to list */
                         if (keyfile)
                                 {
                                 if (!signerfile)
                                         {
                                         BIO_puts(bio_err, "Illegal -inkey without -signer\n");
                                         goto argerr;
                                         }
                                 if (!sksigners)
-                                        sksigners = sk_new_null();
-                                sk_push(sksigners, signerfile);
+                                        sksigners = sk_OPENSSL_STRING_new_null();
+                                sk_OPENSSL_STRING_push(sksigners, signerfile);
                                 signerfile = NULL;
                                 if (!skkeys)
-                                        skkeys = sk_new_null();
-                                sk_push(skkeys, keyfile);
+                                        skkeys = sk_OPENSSL_STRING_new_null();
+                                sk_OPENSSL_STRING_push(skkeys, keyfile);
                                 }
                         keyfile = *++args;
                         }
                 else if (!strcmp (*args, "-keyform"))
                         {
                         if (!args[1])
                                 goto argerr;
                         keyform = str2fmt(*++args);
                         }
                 else if (!strcmp (*args, "-rctform"))
@@ skipping 78 matching lines @@
                 {
                 if (keyfile && !signerfile)
                         {
                         BIO_puts(bio_err, "Illegal -inkey without -signer\n");
                         goto argerr;
                         }
                 /* Check to see if any final signer needs to be appended */
                 if (signerfile)
                         {
                         if (!sksigners)
-                                sksigners = sk_new_null();
-                        sk_push(sksigners, signerfile);
+                                sksigners = sk_OPENSSL_STRING_new_null();
+                        sk_OPENSSL_STRING_push(sksigners, signerfile);
                         if (!skkeys)
-                                skkeys = sk_new_null();
+                                skkeys = sk_OPENSSL_STRING_new_null();
                         if (!keyfile)
                                 keyfile = signerfile;
-                        sk_push(skkeys, keyfile);
+                        sk_OPENSSL_STRING_push(skkeys, keyfile);
                         }
                 if (!sksigners)
                         {
                         BIO_printf(bio_err, "No signer certificate specified\n");
                         badarg = 1;
                         }
                 signerfile = NULL;
                 keyfile = NULL;
                 need_rand = 1;
                 }
@@ skipping 52 matching lines @@
                 BIO_printf (bio_err, "-nosigs        don't verify message signature\n");
                 BIO_printf (bio_err, "-noverify      don't verify signers certificate\n");
                 BIO_printf (bio_err, "-nocerts       don't include signers certificate when signing\n");
                 BIO_printf (bio_err, "-nodetach      use opaque signing\n");
                 BIO_printf (bio_err, "-noattr        don't include any signed attributes\n");
                 BIO_printf (bio_err, "-binary        don't translate message to text\n");
                 BIO_printf (bio_err, "-certfile file other certificates file\n");
                 BIO_printf (bio_err, "-certsout file certificate output file\n");
                 BIO_printf (bio_err, "-signer file   signer certificate file\n");
                 BIO_printf (bio_err, "-recip  file   recipient certificate file for decryption\n");
-                BIO_printf (bio_err, "-skeyid        use subject key identifier\n");
+                BIO_printf (bio_err, "-keyid        use subject key identifier\n");
                 BIO_printf (bio_err, "-in file       input file\n");
                 BIO_printf (bio_err, "-inform arg    input format SMIME (default), PEM or DER\n");
                 BIO_printf (bio_err, "-inkey file    input private key (if not signer or recipient)\n");
                 BIO_printf (bio_err, "-keyform arg   input private key format (PEM or ENGINE)\n");
                 BIO_printf (bio_err, "-out file      output file\n");
                 BIO_printf (bio_err, "-outform arg   output format SMIME (default), PEM or DER\n");
                 BIO_printf (bio_err, "-content file  supply or override content for detached signature\n");
                 BIO_printf (bio_err, "-to addr       to address\n");
                 BIO_printf (bio_err, "-from ad       from address\n");
                 BIO_printf (bio_err, "-subject s     subject\n");
@@ skipping 65 matching lines @@
 #ifndef OPENSSL_NO_DES                  
                         cipher = EVP_des_ede3_cbc();
 #else
                         BIO_printf(bio_err, "No cipher selected\n");
                         goto end;
 #endif
                         }
 
                 if (secret_key && !secret_keyid)
                         {
-                        BIO_printf(bio_err, "No sectre key id\n");
+                        BIO_printf(bio_err, "No secret key id\n");
                         goto end;
                         }
 
                 if (*args)
                         encerts = sk_X509_new_null();
                 while (*args)
                         {
                         if (!(cert = load_cert(bio_err,*args,FORMAT_PEM,
                                 NULL, e, "recipient certificate file")))
                                 goto end;
@@ skipping 155 matching lines @@
                     BIO *tmpbio = BIO_new(BIO_f_linebuffer());
                     out = BIO_push(tmpbio, out);
                 }
 #endif
                 }
 
         if ((operation == SMIME_VERIFY) || (operation == SMIME_VERIFY_RECEIPT))
                 {
                 if (!(store = setup_verify(bio_err, CAfile, CApath)))
                         goto end;
-                X509_STORE_set_verify_cb_func(store, cms_cb);
+                X509_STORE_set_verify_cb(store, cms_cb);
                 if (vpm)
                         X509_STORE_set1_param(store, vpm);
                 }
 
 
         ret = 3;
 
         if (operation == SMIME_DATA_CREATE)
                 {
                 cms = CMS_data_create(in, flags);
@@ skipping 79 matching lines @@
                                 if (!rr)
                                         {
                                         BIO_puts(bio_err,
                                 "Signed Receipt Request Creation Error\n");
                                         goto end;
                                         }
                                 }
                         }
                 else
                         flags |= CMS_REUSE_DIGEST;
-                for (i = 0; i < sk_num(sksigners); i++)
+                for (i = 0; i < sk_OPENSSL_STRING_num(sksigners); i++)
                         {
                         CMS_SignerInfo *si;
-                        signerfile = sk_value(sksigners, i);
-                        keyfile = sk_value(skkeys, i);
+                        signerfile = sk_OPENSSL_STRING_value(sksigners, i);
+                        keyfile = sk_OPENSSL_STRING_value(skkeys, i);
                         signer = load_cert(bio_err, signerfile,FORMAT_PEM, NULL,
                                         e, "signer certificate");
                         if (!signer)
                                 goto end;
                         key = load_key(bio_err, keyfile, keyform, 0, passin, e,
                                "signing key file");
                         if (!key)
                                 goto end;
                         si = CMS_add1_signer(cms, signer, key, sign_md, flags);
                         if (!si)
@@ skipping 77 matching lines @@
                                                 indata, out, flags))
                         goto end;
                 }
         else if (operation == SMIME_VERIFY)
                 {
                 if (CMS_verify(cms, other, store, indata, out, flags) > 0)
                         BIO_printf(bio_err, "Verification successful\n");
                 else
                         {
                         BIO_printf(bio_err, "Verification failure\n");
+                        if (verify_retcode)
+                                ret = verify_err + 32;
                         goto end;
                         }
                 if (signerfile)
                         {
                         STACK_OF(X509) *signers;
                         signers = CMS_get0_signers(cms);
                         if (!save_certs(signerfile, signers))
                                 {
                                 BIO_printf(bio_err,
                                                 "Error writing signers to %s\n",
@@ skipping 12 matching lines @@
                 if (CMS_verify_receipt(rcms, cms, other, store, flags) > 0)
                         BIO_printf(bio_err, "Verification successful\n");
                 else
                         {
                         BIO_printf(bio_err, "Verification failure\n");
                         goto end;
                         }
                 }
         else
                 {
-                if (outformat == FORMAT_SMIME)
+                if (noout)
+                        {
+                        if (print)
+                                CMS_ContentInfo_print_ctx(out, cms, 0, NULL);
+                        }
+                else if (outformat == FORMAT_SMIME)
                         {
                         if (to)
                                 BIO_printf(out, "To: %s\n", to);
                         if (from)
                                 BIO_printf(out, "From: %s\n", from);
                         if (subject)
                                 BIO_printf(out, "Subject: %s\n", subject);
                         if (operation == SMIME_RESIGN)
                                 ret = SMIME_write_CMS(out, cms, indata, flags);
                         else
                                 ret = SMIME_write_CMS(out, cms, in, flags);
                         }
                 else if (outformat == FORMAT_PEM) 
-                        ret = PEM_write_bio_CMS(out, cms);
+                        ret = PEM_write_bio_CMS_stream(out, cms, in, flags);
                 else if (outformat == FORMAT_ASN1) 
-                        ret = i2d_CMS_bio(out,cms);
+                        ret = i2d_CMS_bio_stream(out,cms, in, flags);
                 else
                         {
                         BIO_printf(bio_err, "Bad output format for CMS file\n");
                         goto end;
                         }
                 if (ret <= 0)
                         {
                         ret = 6;
                         goto end;
                         }
                 }
         ret = 0;
 end:
         if (ret)
                 ERR_print_errors(bio_err);
         if (need_rand)
                 app_RAND_write_file(NULL, bio_err);
         sk_X509_pop_free(encerts, X509_free);
         sk_X509_pop_free(other, X509_free);
         if (vpm)
                 X509_VERIFY_PARAM_free(vpm);
         if (sksigners)
-                sk_free(sksigners);
+                sk_OPENSSL_STRING_free(sksigners);
         if (skkeys)
-                sk_free(skkeys);
+                sk_OPENSSL_STRING_free(skkeys);
         if (secret_key)
                 OPENSSL_free(secret_key);
         if (secret_keyid)
                 OPENSSL_free(secret_keyid);
         if (econtent_type)
                 ASN1_OBJECT_free(econtent_type);
         if (rr)
                 CMS_ReceiptRequest_free(rr);
         if (rr_to)
-                sk_free(rr_to);
+                sk_OPENSSL_STRING_free(rr_to);
         if (rr_from)
-                sk_free(rr_from);
+                sk_OPENSSL_STRING_free(rr_from);
         X509_STORE_free(store);
         X509_free(cert);
         X509_free(recip);
         X509_free(signer);
         EVP_PKEY_free(key);
         CMS_ContentInfo_free(cms);
         CMS_ContentInfo_free(rcms);
         BIO_free(rctin);
         BIO_free(in);
         BIO_free(indata);
@@ skipping 18 matching lines @@
         
 
 /* Minimal callback just to output policy info (if any) */
 
 static int cms_cb(int ok, X509_STORE_CTX *ctx)
         {
         int error;
 
         error = X509_STORE_CTX_get_error(ctx);
 
+        verify_err = error;
+
         if ((error != X509_V_ERR_NO_EXPLICIT_POLICY)
                 && ((error != X509_V_OK) || (ok != 2)))
                 return ok;
 
         policies_print(NULL, ctx);
 
         return ok;
 
         }
 
@@ skipping 61 matching lines @@
                         else
                                 BIO_printf(out, " Unknown (%d)\n", allorfirst);
                         BIO_puts(out, "  Receipts To:\n");
                         gnames_stack_print(out, rto);
                         }
                 if (rr)
                         CMS_ReceiptRequest_free(rr);
                 }
         }
 
-static STACK_OF(GENERAL_NAMES) *make_names_stack(STACK *ns)
+static STACK_OF(GENERAL_NAMES) *make_names_stack(STACK_OF(OPENSSL_STRING) *ns)
         {
         int i;
         STACK_OF(GENERAL_NAMES) *ret;
         GENERAL_NAMES *gens = NULL;
         GENERAL_NAME *gen = NULL;
         ret = sk_GENERAL_NAMES_new_null();
         if (!ret)
                 goto err;
-        for (i = 0; i < sk_num(ns); i++)
+        for (i = 0; i < sk_OPENSSL_STRING_num(ns); i++)
                 {
-                CONF_VALUE cnf;
-                cnf.name = "email";
-                cnf.value = sk_value(ns, i);
-                gen = v2i_GENERAL_NAME(NULL, NULL, &cnf);
+                char *str = sk_OPENSSL_STRING_value(ns, i);
+                gen = a2i_GENERAL_NAME(NULL, NULL, NULL, GEN_EMAIL, str, 0);
                 if (!gen)
                         goto err;
                 gens = GENERAL_NAMES_new();
                 if (!gens)
                         goto err;
                 if (!sk_GENERAL_NAME_push(gens, gen))
                         goto err;
                 gen = NULL;
                 if (!sk_GENERAL_NAMES_push(ret, gens))
                         goto err;
                 gens = NULL;
                 }
 
         return ret;
 
         err:
         if (ret)
                 sk_GENERAL_NAMES_pop_free(ret, GENERAL_NAMES_free);
         if (gens)
                 GENERAL_NAMES_free(gens);
         if (gen)
                 GENERAL_NAME_free(gen);
         return NULL;
         }
 
 
-static CMS_ReceiptRequest *make_receipt_request(STACK *rr_to, int rr_allorfirst,
-                                                                STACK *rr_from)
+static CMS_ReceiptRequest *make_receipt_request(STACK_OF(OPENSSL_STRING) *rr_to,
+                                                int rr_allorfirst,
+                                                STACK_OF(OPENSSL_STRING) *rr_from)
         {
         STACK_OF(GENERAL_NAMES) *rct_to, *rct_from;
         CMS_ReceiptRequest *rr;
         rct_to = make_names_stack(rr_to);
         if (!rct_to)
                 goto err;
         if (rr_from)
                 {
                 rct_from = make_names_stack(rr_from);
                 if (!rct_from)
                         goto err;
                 }
         else
                 rct_from = NULL;
         rr = CMS_ReceiptRequest_create0(NULL, -1, rr_allorfirst, rct_from,
                                                 rct_to);
         return rr;
         err:
         return NULL;
         }
 
 #endif