Skip to content

Commit 5daf5ff

Browse files
SparkiDevSparkiDev
authored
Merge pull request #7272 from JacobBarthelmeh/pkcs7-enc
IO callbacks for content and output with PKCS7 bundle sign/encrypt
2 parents 28e8228 + c24b187 commit 5daf5ff

4 files changed

Lines changed: 1021 additions & 248 deletions

File tree

‎tests/api.c‎

Lines changed: 132 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -26871,6 +26871,43 @@ static int rsaSignRawDigestCb(PKCS7* pkcs7, byte* digest, word32 digestSz,
2687126871
}
2687226872
#endif
2687326873

26874+
#if defined(HAVE_PKCS7) && defined(ASN_BER_TO_DER)
26875+
typedef struct encodeSignedDataStream {
26876+
byte out[FOURK_BUF*3];
26877+
int idx;
26878+
word32 outIdx;
26879+
} encodeSignedDataStream;
26880+
26881+
26882+
/* content is 8k of partially created bundle */
26883+
static int GetContentCB(PKCS7* pkcs7, byte** content, void* ctx)
26884+
{
26885+
int ret = 0;
26886+
encodeSignedDataStream* strm = (encodeSignedDataStream*)ctx;
26887+
26888+
if (strm->outIdx < pkcs7->contentSz) {
26889+
ret = (pkcs7->contentSz > strm->outIdx + FOURK_BUF)?
26890+
FOURK_BUF : pkcs7->contentSz - strm->outIdx;
26891+
*content = strm->out + strm->outIdx;
26892+
strm->outIdx += ret;
26893+
}
26894+
26895+
(void)pkcs7;
26896+
return ret;
26897+
}
26898+
26899+
static int StreamOutputCB(PKCS7* pkcs7, const byte* output, word32 outputSz,
26900+
void* ctx)
26901+
{
26902+
encodeSignedDataStream* strm = (encodeSignedDataStream*)ctx;
26903+
26904+
XMEMCPY(strm->out + strm->idx, output, outputSz);
26905+
strm->idx += outputSz;
26906+
(void)pkcs7;
26907+
return 0;
26908+
}
26909+
#endif
26910+
2687426911

2687526912
/*
2687626913
* Testing wc_PKCS7_EncodeSignedData()
@@ -26999,6 +27036,7 @@ static int test_wc_PKCS7_EncodeSignedData(void)
2699927036
/* reinitialize and test setting stream mode */
2700027037
{
2700127038
int signedSz;
27039+
encodeSignedDataStream strm;
2700227040

2700327041
ExpectNotNull(pkcs7 = wc_PKCS7_New(HEAP_HINT, testDevId));
2700427042
ExpectIntEQ(wc_PKCS7_Init(pkcs7, HEAP_HINT, INVALID_DEVID), 0);
@@ -27019,8 +27057,9 @@ static int test_wc_PKCS7_EncodeSignedData(void)
2701927057
pkcs7->rng = &rng;
2702027058
}
2702127059
ExpectIntEQ(wc_PKCS7_GetStreamMode(pkcs7), 0);
27022-
ExpectIntEQ(wc_PKCS7_SetStreamMode(pkcs7, 1), 0);
27023-
ExpectIntEQ(wc_PKCS7_SetStreamMode(NULL, 1), BAD_FUNC_ARG);
27060+
ExpectIntEQ(wc_PKCS7_SetStreamMode(pkcs7, 1, NULL, NULL, NULL), 0);
27061+
ExpectIntEQ(wc_PKCS7_SetStreamMode(NULL, 1, NULL, NULL, NULL),
27062+
BAD_FUNC_ARG);
2702427063
ExpectIntEQ(wc_PKCS7_GetStreamMode(pkcs7), 1);
2702527064

2702627065
ExpectIntGT(signedSz = wc_PKCS7_EncodeSignedData(pkcs7, output,
@@ -27033,6 +27072,39 @@ static int test_wc_PKCS7_EncodeSignedData(void)
2703327072

2703427073
/* use exact signed buffer size since BER encoded */
2703527074
ExpectIntEQ(wc_PKCS7_VerifySignedData(pkcs7, output, signedSz), 0);
27075+
wc_PKCS7_Free(pkcs7);
27076+
27077+
/* now try with using callbacks for IO */
27078+
ExpectNotNull(pkcs7 = wc_PKCS7_New(HEAP_HINT, testDevId));
27079+
ExpectIntEQ(wc_PKCS7_Init(pkcs7, HEAP_HINT, INVALID_DEVID), 0);
27080+
27081+
ExpectIntEQ(wc_PKCS7_InitWithCert(pkcs7, cert, certSz), 0);
27082+
27083+
if (pkcs7 != NULL) {
27084+
pkcs7->contentSz = FOURK_BUF*2;
27085+
pkcs7->privateKey = key;
27086+
pkcs7->privateKeySz = (word32)sizeof(key);
27087+
pkcs7->encryptOID = RSAk;
27088+
#ifdef NO_SHA
27089+
pkcs7->hashOID = SHA256h;
27090+
#else
27091+
pkcs7->hashOID = SHAh;
27092+
#endif
27093+
pkcs7->rng = &rng;
27094+
}
27095+
XMEMSET(&strm, 0, sizeof(strm));
27096+
ExpectIntEQ(wc_PKCS7_SetStreamMode(pkcs7, 1, GetContentCB,
27097+
StreamOutputCB, (void*)&strm), 0);
27098+
27099+
ExpectIntGT(signedSz = wc_PKCS7_EncodeSignedData(pkcs7, NULL, 0), 0);
27100+
wc_PKCS7_Free(pkcs7);
27101+
pkcs7 = NULL;
27102+
27103+
ExpectNotNull(pkcs7 = wc_PKCS7_New(HEAP_HINT, testDevId));
27104+
ExpectIntEQ(wc_PKCS7_InitWithCert(pkcs7, NULL, 0), 0);
27105+
27106+
/* use exact signed buffer size since BER encoded */
27107+
ExpectIntEQ(wc_PKCS7_VerifySignedData(pkcs7, strm.out, signedSz), 0);
2703627108
}
2703727109
#endif
2703827110
#ifndef NO_PKCS7_STREAM
@@ -28594,15 +28666,18 @@ static int test_wc_PKCS7_EncodeDecodeEnvelopedData(void)
2859428666
testSz = (int)sizeof(testVectors)/(int)sizeof(pkcs7EnvelopedVector);
2859528667
for (i = 0; i < testSz; i++) {
2859628668
#ifdef ASN_BER_TO_DER
28597-
/* test setting stream mode */
28669+
encodeSignedDataStream strm;
28670+
28671+
/* test setting stream mode, the first one using IO callbacks */
2859828672
ExpectIntEQ(wc_PKCS7_InitWithCert(pkcs7, (testVectors + i)->cert,
2859928673
(word32)(testVectors + i)->certSz), 0);
2860028674
if (pkcs7 != NULL) {
2860128675
#ifdef ECC_TIMING_RESISTANT
2860228676
pkcs7->rng = &rng;
2860328677
#endif
2860428678

28605-
pkcs7->content = (byte*)(testVectors + i)->content;
28679+
if (i != 0)
28680+
pkcs7->content = (byte*)(testVectors + i)->content;
2860628681
pkcs7->contentSz = (testVectors + i)->contentSz;
2860728682
pkcs7->contentOID = (testVectors + i)->contentOID;
2860828683
pkcs7->encryptOID = (testVectors + i)->encryptOID;
@@ -28611,16 +28686,61 @@ static int test_wc_PKCS7_EncodeDecodeEnvelopedData(void)
2861128686
pkcs7->privateKey = (testVectors + i)->privateKey;
2861228687
pkcs7->privateKeySz = (testVectors + i)->privateKeySz;
2861328688
}
28614-
ExpectIntEQ(wc_PKCS7_SetStreamMode(pkcs7, 1), 0);
2861528689

28616-
ExpectIntGE(encodedSz = wc_PKCS7_EncodeEnvelopedData(pkcs7, output,
28617-
(word32)sizeof(output)), 0);
28690+
if (i == 0) {
28691+
XMEMSET(&strm, 0, sizeof(strm));
28692+
ExpectIntEQ(wc_PKCS7_SetStreamMode(pkcs7, 1, GetContentCB,
28693+
StreamOutputCB, (void*)&strm), 0);
28694+
encodedSz = wc_PKCS7_EncodeEnvelopedData(pkcs7, NULL, 0);
28695+
}
28696+
else {
28697+
ExpectIntEQ(wc_PKCS7_SetStreamMode(pkcs7, 1, NULL, NULL, NULL), 0);
28698+
encodedSz = wc_PKCS7_EncodeEnvelopedData(pkcs7, output,
28699+
(word32)sizeof(output));
28700+
}
2861828701

28619-
decodedSz = wc_PKCS7_DecodeEnvelopedData(pkcs7, output,
28620-
(word32)encodedSz, decoded, (word32)sizeof(decoded));
28621-
ExpectIntGE(decodedSz, 0);
28622-
/* Verify the size of each buffer. */
28623-
ExpectIntEQ((word32)sizeof(input)/sizeof(char), decodedSz);
28702+
switch ((testVectors + i)->encryptOID) {
28703+
#ifndef NO_DES3
28704+
case DES3b:
28705+
case DESb:
28706+
ExpectIntEQ(encodedSz, BAD_FUNC_ARG);
28707+
break;
28708+
#endif
28709+
#ifdef HAVE_AESCCM
28710+
#ifdef WOLFSSL_AES_128
28711+
case AES128CCMb:
28712+
ExpectIntEQ(encodedSz, BAD_FUNC_ARG);
28713+
break;
28714+
#endif
28715+
#ifdef WOLFSSL_AES_192
28716+
case AES192CCMb:
28717+
ExpectIntEQ(encodedSz, BAD_FUNC_ARG);
28718+
break;
28719+
#endif
28720+
#ifdef WOLFSSL_AES_256
28721+
case AES256CCMb:
28722+
ExpectIntEQ(encodedSz, BAD_FUNC_ARG);
28723+
break;
28724+
#endif
28725+
#endif
28726+
default:
28727+
ExpectIntGE(encodedSz, 0);
28728+
}
28729+
28730+
if (encodedSz > 0) {
28731+
if (i == 0) {
28732+
decodedSz = wc_PKCS7_DecodeEnvelopedData(pkcs7,
28733+
strm.out, (word32)encodedSz, decoded,
28734+
(word32)sizeof(decoded));
28735+
}
28736+
else {
28737+
decodedSz = wc_PKCS7_DecodeEnvelopedData(pkcs7, output,
28738+
(word32)encodedSz, decoded, (word32)sizeof(decoded));
28739+
}
28740+
ExpectIntGE(decodedSz, 0);
28741+
/* Verify the size of each buffer. */
28742+
ExpectIntEQ((word32)sizeof(input)/sizeof(char), decodedSz);
28743+
}
2862428744
wc_PKCS7_Free(pkcs7);
2862528745
pkcs7 = NULL;
2862628746
ExpectNotNull(pkcs7 = wc_PKCS7_New(HEAP_HINT, testDevId));

‎wolfcrypt/src/asn.c‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3465,7 +3465,9 @@ word32 SetBitString(word32 len, byte unusedBits, byte* output)
34653465

34663466
#ifdef ASN_BER_TO_DER
34673467

3468-
#define BER_OCTET_LENGTH 4096
3468+
#ifndef BER_OCTET_LENGTH
3469+
#define BER_OCTET_LENGTH 4096
3470+
#endif
34693471

34703472
/* sets the terminating 0x00 0x00 at the end of an indefinite length
34713473
* returns the number of bytes written */

0 commit comments

Comments
 (0)