Merge pull request #1005 from samscott89/add-pkcs7-support

Add PKCS7 support

openssl-sys/src/lib.rs

@@ -25,6 +25,7 @@ pub use object::*;
 pub use ocsp::*;
 pub use ossl_typ::*;
 pub use pem::*;
+pub use pkcs7::*;
 pub use pkcs12::*;
 pub use rand::*;
 pub use rsa::*;
@@ -61,6 +62,7 @@ mod object;
 mod ocsp;
 mod ossl_typ;
 mod pem;
+mod pkcs7;
 mod pkcs12;
 mod rand;
 mod rsa;

openssl-sys/src/ossl_typ.rs

@@ -10,6 +10,7 @@ pub enum ASN1_BIT_STRING {}
 pub enum ASN1_TIME {}
 pub enum ASN1_TYPE {}
 pub enum ASN1_OBJECT {}
+pub enum ASN1_OCTET_STRING {}
 
 pub enum bio_st {} // FIXME remove
 cfg_if! {

openssl-sys/src/pem.rs

@@ -132,6 +132,15 @@ extern "C" {
         cb: pem_password_cb,
         u: *mut c_void,
     ) -> *mut EVP_PKEY;
+
+    pub fn PEM_read_bio_PKCS7(
+        bio: *mut BIO,
+        out: *mut *mut PKCS7,
+        cb: pem_password_cb,
+        u: *mut c_void,
+    ) -> *mut PKCS7;
+
+    pub fn PEM_write_bio_PKCS7(bp: *mut BIO, x: *mut PKCS7) -> c_int;
 }
 
 pub const PEM_R_NO_START_LINE: c_int = 108;

openssl-sys/src/pkcs7.rs

@@ -0,0 +1,74 @@
+use libc::*;
+
+use *;
+
+pub enum PKCS7_SIGNED {}
+pub enum PKCS7_ENVELOPE {}
+pub enum PKCS7_SIGN_ENVELOPE {}
+pub enum PKCS7_DIGEST {}
+pub enum PKCS7_ENCRYPT {}
+pub enum PKCS7 {}
+
+pub const PKCS7_TEXT: c_int = 0x1;
+pub const PKCS7_NOCERTS: c_int = 0x2;
+pub const PKCS7_NOSIGS: c_int = 0x4;
+pub const PKCS7_NOCHAIN: c_int = 0x8;
+pub const PKCS7_NOINTERN: c_int = 0x10;
+pub const PKCS7_NOVERIFY: c_int = 0x20;
+pub const PKCS7_DETACHED: c_int = 0x40;
+pub const PKCS7_BINARY: c_int = 0x80;
+pub const PKCS7_NOATTR: c_int = 0x100;
+pub const PKCS7_NOSMIMECAP: c_int = 0x200;
+pub const PKCS7_NOOLDMIMETYPE: c_int = 0x400;
+pub const PKCS7_CRLFEOL: c_int = 0x800;
+pub const PKCS7_STREAM: c_int = 0x1000;
+pub const PKCS7_NOCRL: c_int = 0x2000;
+pub const PKCS7_PARTIAL: c_int = 0x4000;
+pub const PKCS7_REUSE_DIGEST: c_int = 0x8000;
+#[cfg(not(any(ossl101, ossl102, libressl)))]
+pub const PKCS7_NO_DUAL_CONTENT: c_int = 0x10000;
+
+extern "C" {
+    pub fn PKCS7_encrypt(
+        certs: *mut stack_st_X509,
+        b: *mut BIO,
+        cipher: *const EVP_CIPHER,
+        flags: c_int,
+    ) -> *mut PKCS7;
+
+    pub fn PKCS7_verify(
+        pkcs7: *mut PKCS7,
+        certs: *mut stack_st_X509,
+        store: *mut X509_STORE,
+        indata: *mut BIO,
+        out: *mut BIO,
+        flags: c_int,
+    ) -> c_int;
+
+    pub fn PKCS7_sign(
+        signcert: *mut X509,
+        pkey: *mut EVP_PKEY,
+        certs: *mut stack_st_X509,
+        data: *mut BIO,
+        flags: c_int,
+    ) -> *mut PKCS7;
+
+    pub fn PKCS7_decrypt(
+        pkcs7: *mut PKCS7,
+        pkey: *mut EVP_PKEY,
+        cert: *mut X509,
+        data: *mut BIO,
+        flags: c_int,
+    ) -> c_int;
+
+    pub fn PKCS7_free(pkcs7: *mut PKCS7);
+
+    pub fn SMIME_write_PKCS7(
+        out: *mut BIO,
+        pkcs7: *mut PKCS7,
+        data: *mut BIO,
+        flags: c_int,
+    ) -> c_int;
+
+    pub fn SMIME_read_PKCS7(bio: *mut BIO, bcont: *mut *mut BIO) -> *mut PKCS7;
+}

openssl/src/bio.rs

@@ -66,6 +66,10 @@ impl MemBio {
             slice::from_raw_parts(ptr as *const _ as *const _, len as usize)
         }
     }
+
+    pub unsafe fn from_ptr(bio: *mut ffi::BIO) -> MemBio {
+        MemBio(bio)
+    }
 }
 
 cfg_if! {

openssl/src/lib.rs

@@ -161,6 +161,7 @@ pub mod nid;
 pub mod ocsp;
 pub mod pkcs12;
 pub mod pkcs5;
+pub mod pkcs7;
 pub mod pkey;
 pub mod rand;
 pub mod rsa;

openssl/src/pkcs7.rs

@@ -0,0 +1,383 @@
+use bio::{MemBio, MemBioSlice};
+use error::ErrorStack;
+use ffi;
+use foreign_types::ForeignTypeRef;
+use libc::c_int;
+use pkey::{HasPrivate, PKeyRef};
+use stack::StackRef;
+use std::ptr;
+use symm::Cipher;
+use x509::store::X509StoreRef;
+use x509::{X509Ref, X509};
+use {cvt, cvt_p};
+
+foreign_type_and_impl_send_sync! {
+    type CType = ffi::PKCS7;
+    fn drop = ffi::PKCS7_free;
+
+    /// A PKCS#7 structure.
+    ///
+    /// Contains signed and/or encrypted data.
+    pub struct Pkcs7;
+
+    /// Reference to `Pkcs7`
+    pub struct Pkcs7Ref;
+}
+
+bitflags! {
+    pub struct Pkcs7Flags: c_int {
+        const TEXT = ffi::PKCS7_TEXT;
+        const NOCERTS = ffi::PKCS7_NOCERTS;
+        const NOSIGS = ffi::PKCS7_NOSIGS;
+        const NOCHAIN = ffi::PKCS7_NOCHAIN;
+        const NOINTERN = ffi::PKCS7_NOINTERN;
+        const NOVERIFY = ffi::PKCS7_NOVERIFY;
+        const DETACHED = ffi::PKCS7_DETACHED;
+        const BINARY = ffi::PKCS7_BINARY;
+        const NOATTR = ffi::PKCS7_NOATTR;
+        const NOSMIMECAP = ffi::PKCS7_NOSMIMECAP;
+        const NOOLDMIMETYPE = ffi::PKCS7_NOOLDMIMETYPE;
+        const CRLFEOL = ffi::PKCS7_CRLFEOL;
+        const STREAM = ffi::PKCS7_STREAM;
+        const NOCRL = ffi::PKCS7_NOCRL;
+        const PARTIAL = ffi::PKCS7_PARTIAL;
+        const REUSE_DIGEST = ffi::PKCS7_REUSE_DIGEST;
+        #[cfg(not(any(ossl101, ossl102, libressl)))]
+        const NO_DUAL_CONTENT = ffi::PKCS7_NO_DUAL_CONTENT;
+    }
+}
+
+impl Pkcs7 {
+    from_pem! {
+        /// Deserializes a PEM-encoded PKCS#7 signature
+        ///
+        /// The input should have a header of `-----BEGIN PKCS7-----`.
+        ///
+        /// This corresponds to [`PEM_read_bio_PKCS7`].
+        ///
+        /// [`PEM_read_bio_PKCS7`]: https://www.openssl.org/docs/man1.0.2/crypto/PEM_read_bio_PKCS7.html
+        from_pem,
+        Pkcs7,
+        ffi::PEM_read_bio_PKCS7
+    }
+
+    /// Parses a message in S/MIME format.
+    ///
+    /// Returns the loaded signature, along with the cleartext message (if
+    /// available).
+    ///
+    /// This corresponds to [`SMIME_read_PKCS7`].
+    ///
+    /// [`SMIME_read_PKCS7`]: https://www.openssl.org/docs/man1.1.0/crypto/SMIME_read_PKCS7.html
+    pub fn from_smime(input: &[u8]) -> Result<(Pkcs7, Option<Vec<u8>>), ErrorStack> {
+        ffi::init();
+
+        let input_bio = MemBioSlice::new(input)?;
+        let mut bcont_bio = ptr::null_mut();
+        unsafe {
+            let pkcs7 =
+                cvt_p(ffi::SMIME_read_PKCS7(input_bio.as_ptr(), &mut bcont_bio)).map(Pkcs7)?;
+            let out = if !bcont_bio.is_null() {
+                let bcont_bio = MemBio::from_ptr(bcont_bio);
+                Some(bcont_bio.get_buf().to_vec())
+            } else {
+                None
+            };
+            Ok((pkcs7, out))
+        }
+    }
+
+    /// Creates and returns a PKCS#7 `envelopedData` structure.
+    ///
+    /// `certs` is a list of recipient certificates. `input` is the content to be
+    /// encrypted. `cipher` is the symmetric cipher to use. `flags` is an optional
+    /// set of flags.
+    ///
+    /// This corresponds to [`PKCS7_encrypt`].
+    ///
+    /// [`PKCS7_encrypt`]: https://www.openssl.org/docs/man1.0.2/crypto/PKCS7_encrypt.html
+    pub fn encrypt(
+        certs: &StackRef<X509>,
+        input: &[u8],
+        cipher: Cipher,
+        flags: Pkcs7Flags,
+    ) -> Result<Pkcs7, ErrorStack> {
+        let input_bio = MemBioSlice::new(input)?;
+
+        unsafe {
+            cvt_p(ffi::PKCS7_encrypt(
+                certs.as_ptr(),
+                input_bio.as_ptr(),
+                cipher.as_ptr(),
+                flags.bits,
+            )).map(Pkcs7)
+        }
+    }
+
+    /// Creates and returns a PKCS#7 `signedData` structure.
+    ///
+    /// `signcert` is the certificate to sign with, `pkey` is the corresponding
+    /// private key. `certs` is an optional additional set of certificates to
+    /// include in the PKCS#7 structure (for example any intermediate CAs in the
+    /// chain).
+    ///
+    /// This corresponds to [`PKCS7_sign`].
+    ///
+    /// [`PKCS7_sign`]: https://www.openssl.org/docs/man1.0.2/crypto/PKCS7_sign.html
+    pub fn sign<PT>(
+        signcert: &X509Ref,
+        pkey: &PKeyRef<PT>,
+        certs: &StackRef<X509>,
+        input: &[u8],
+        flags: Pkcs7Flags,
+    ) -> Result<Pkcs7, ErrorStack>
+    where
+        PT: HasPrivate,
+    {
+        let input_bio = MemBioSlice::new(input)?;
+        unsafe {
+            cvt_p(ffi::PKCS7_sign(
+                signcert.as_ptr(),
+                pkey.as_ptr(),
+                certs.as_ptr(),
+                input_bio.as_ptr(),
+                flags.bits,
+            )).map(Pkcs7)
+        }
+    }
+}
+
+impl Pkcs7Ref {
+    /// Converts PKCS#7 structure to S/MIME format
+    ///
+    /// This corresponds to [`SMIME_write_PKCS7`].
+    ///
+    /// [`SMIME_write_PKCS7`]: https://www.openssl.org/docs/man1.1.0/crypto/SMIME_write_PKCS7.html
+    pub fn to_smime(&self, input: &[u8], flags: Pkcs7Flags) -> Result<Vec<u8>, ErrorStack> {
+        let input_bio = MemBioSlice::new(input)?;
+        let output = MemBio::new()?;
+        unsafe {
+            cvt(ffi::SMIME_write_PKCS7(
+                output.as_ptr(),
+                self.as_ptr(),
+                input_bio.as_ptr(),
+                flags.bits,
+            )).map(|_| output.get_buf().to_owned())
+        }
+    }
+
+    to_pem! {
+        /// Serializes the data into a PEM-encoded PKCS#7 structure.
+        ///
+        /// The output will have a header of `-----BEGIN PKCS7-----`.
+        ///
+        /// This corresponds to [`PEM_write_bio_PKCS7`].
+        ///
+        /// [`PEM_write_bio_PKCS7`]: https://www.openssl.org/docs/man1.0.2/crypto/PEM_write_bio_PKCS7.html
+        to_pem,
+        ffi::PEM_write_bio_PKCS7
+    }
+
+    /// Decrypts data using the provided private key.
+    ///
+    /// `pkey` is the recipient's private key, and `cert` is the recipient's
+    /// certificate.
+    ///
+    /// Returns the decrypted message.
+    ///
+    /// This corresponds to [`PKCS7_decrypt`].
+    ///
+    /// [`PKCS7_decrypt`]: https://www.openssl.org/docs/man1.0.2/crypto/PKCS7_decrypt.html
+    pub fn decrypt<PT>(
+        &self,
+        pkey: &PKeyRef<PT>,
+        cert: &X509Ref,
+        flags: Pkcs7Flags,
+    ) -> Result<Vec<u8>, ErrorStack>
+    where
+        PT: HasPrivate,
+    {
+        let output = MemBio::new()?;
+
+        unsafe {
+            cvt(ffi::PKCS7_decrypt(
+                self.as_ptr(),
+                pkey.as_ptr(),
+                cert.as_ptr(),
+                output.as_ptr(),
+                flags.bits,
+            )).map(|_| output.get_buf().to_owned())
+        }
+    }
+
+    /// Verifies the PKCS#7 `signedData` structure contained by `&self`.
+    ///
+    /// `certs` is a set of certificates in which to search for the signer's
+    /// certificate. `store` is a trusted certificate store (used for chain
+    /// verification). `indata` is the signed data if the content is not present
+    /// in `&self`. The content is written to `out` if it is not `None`.
+    ///
+    /// This corresponds to [`PKCS7_verify`].
+    ///
+    /// [`PKCS7_verify`]: https://www.openssl.org/docs/man1.0.2/crypto/PKCS7_verify.html
+    pub fn verify(
+        &self,
+        certs: &StackRef<X509>,
+        store: &X509StoreRef,
+        indata: Option<&[u8]>,
+        out: Option<&mut Vec<u8>>,
+        flags: Pkcs7Flags,
+    ) -> Result<(), ErrorStack> {
+        let out_bio = MemBio::new()?;
+
+        let indata_bio = match indata {
+            Some(data) => Some(MemBioSlice::new(data)?),
+            None => None,
+        };
+        let indata_bio_ptr = indata_bio.as_ref().map_or(ptr::null_mut(), |p| p.as_ptr());
+
+        unsafe {
+            cvt(ffi::PKCS7_verify(
+                self.as_ptr(),
+                certs.as_ptr(),
+                store.as_ptr(),
+                indata_bio_ptr,
+                out_bio.as_ptr(),
+                flags.bits,
+            )).map(|_| ())?
+        }
+
+        if let Some(data) = out {
+            data.clear();
+            data.extend_from_slice(out_bio.get_buf());
+        }
+
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use pkcs7::{Pkcs7, Pkcs7Flags};
+    use pkey::PKey;
+    use stack::Stack;
+    use symm::Cipher;
+    use x509::store::X509StoreBuilder;
+    use x509::X509;
+
+    #[test]
+    fn encrypt_decrypt_test() {
+        let cert = include_bytes!("../test/certs.pem");
+        let cert = X509::from_pem(cert).unwrap();
+        let mut certs = Stack::new().unwrap();
+        certs.push(cert.clone()).unwrap();
+        let message: String = String::from("foo");
+        let cypher = Cipher::des_ede3_cbc();
+        let flags = Pkcs7Flags::STREAM;
+        let pkey = include_bytes!("../test/key.pem");
+        let pkey = PKey::private_key_from_pem(pkey).unwrap();
+
+        let pkcs7 =
+            Pkcs7::encrypt(&certs, message.as_bytes(), cypher, flags).expect("should succeed");
+
+        let encrypted = pkcs7
+            .to_smime(message.as_bytes(), flags)
+            .expect("should succeed");
+
+        let (pkcs7_decoded, _) = Pkcs7::from_smime(encrypted.as_slice()).expect("should succeed");
+
+        let decoded = pkcs7_decoded
+            .decrypt(&pkey, &cert, Pkcs7Flags::empty())
+            .expect("should succeed");
+
+        assert_eq!(decoded, message.into_bytes());
+    }
+
+    #[test]
+    fn sign_verify_test_detached() {
+        let cert = include_bytes!("../test/cert.pem");
+        let cert = X509::from_pem(cert).unwrap();
+        let certs = Stack::new().unwrap();
+        let message: String = String::from("foo");
+        let flags = Pkcs7Flags::STREAM | Pkcs7Flags::DETACHED;
+        let pkey = include_bytes!("../test/key.pem");
+        let pkey = PKey::private_key_from_pem(pkey).unwrap();
+        let mut store_builder = X509StoreBuilder::new().expect("should succeed");
+
+        let root_ca = include_bytes!("../test/root-ca.pem");
+        let root_ca = X509::from_pem(root_ca).unwrap();
+        store_builder.add_cert(root_ca).expect("should succeed");
+
+        let store = store_builder.build();
+
+        let pkcs7 =
+            Pkcs7::sign(&cert, &pkey, &certs, message.as_bytes(), flags).expect("should succeed");
+
+        let signed = pkcs7
+            .to_smime(message.as_bytes(), flags)
+            .expect("should succeed");
+        println!("{:?}", String::from_utf8(signed.clone()).unwrap());
+        let (pkcs7_decoded, content) =
+            Pkcs7::from_smime(signed.as_slice()).expect("should succeed");
+
+        let mut output = Vec::new();
+        pkcs7_decoded
+            .verify(
+                &certs,
+                &store,
+                Some(message.as_bytes()),
+                Some(&mut output),
+                flags,
+            ).expect("should succeed");
+
+        assert_eq!(message.clone().into_bytes(), output);
+        assert_eq!(
+            message.clone().into_bytes(),
+            content.expect("should be non-empty")
+        );
+    }
+
+    #[test]
+    fn sign_verify_test_normal() {
+        let cert = include_bytes!("../test/cert.pem");
+        let cert = X509::from_pem(cert).unwrap();
+        let certs = Stack::new().unwrap();
+        let message: String = String::from("foo");
+        let flags = Pkcs7Flags::STREAM;
+        let pkey = include_bytes!("../test/key.pem");
+        let pkey = PKey::private_key_from_pem(pkey).unwrap();
+        let mut store_builder = X509StoreBuilder::new().expect("should succeed");
+
+        let root_ca = include_bytes!("../test/root-ca.pem");
+        let root_ca = X509::from_pem(root_ca).unwrap();
+        store_builder.add_cert(root_ca).expect("should succeed");
+
+        let store = store_builder.build();
+
+        let pkcs7 =
+            Pkcs7::sign(&cert, &pkey, &certs, message.as_bytes(), flags).expect("should succeed");
+
+        let signed = pkcs7
+            .to_smime(message.as_bytes(), flags)
+            .expect("should succeed");
+
+        let (pkcs7_decoded, content) =
+            Pkcs7::from_smime(signed.as_slice()).expect("should succeed");
+
+        let mut output = Vec::new();
+        pkcs7_decoded
+            .verify(&certs, &store, None, Some(&mut output), flags)
+            .expect("should succeed");
+
+        assert_eq!(message.clone().into_bytes(), output);
+        assert!(content.is_none());
+    }
+
+    #[test]
+    fn invalid_from_smime() {
+        let input = String::from("Invalid SMIME Message");
+        let result = Pkcs7::from_smime(input.as_bytes());
+
+        assert_eq!(result.is_err(), true)
+    }
+}