From bdb69d587e79219d7dca6f9aa21f8dd3f05adcac Mon Sep 17 00:00:00 2001
From: Michael Brown
Date: Tue, 20 Mar 2012 23:54:16 +0000
Subject: [crypto] Add support for Cryptographic Message Syntax (PKCS #7)

The Cryptographic Message Syntax (PKCS#7) provides a format for
encapsulating digital signatures of arbitrary binary blobs.  A
signature can be generated using

  openssl cms -sign -in <file to sign> -binary -noattr \
  	  -signer <signer>.crt -inkey <signer>.key -certfile <CA>.crt \
	  -outform DER -out <signature>

Signed-off-by: Michael Brown <mcb30@ipxe.org>
---
 src/include/ipxe/asn1.h    |  6 ++++++
 src/include/ipxe/cms.h     | 50 ++++++++++++++++++++++++++++++++++++++++++++++
 src/include/ipxe/errfile.h |  1 +
 3 files changed, 57 insertions(+)
 create mode 100644 src/include/ipxe/cms.h

(limited to 'src/include/ipxe')

diff --git a/src/include/ipxe/asn1.h b/src/include/ipxe/asn1.h
index 393d5dc34..d83308a2e 100644
--- a/src/include/ipxe/asn1.h
+++ b/src/include/ipxe/asn1.h
@@ -152,6 +152,12 @@ struct asn1_cursor {
 	ASN1_OID_SINGLE ( 5 ), ASN1_OID_SINGLE ( 7 ),		\
 	ASN1_OID_SINGLE ( 3 ), ASN1_OID_SINGLE ( 3 )
 
+/** ASN.1 OID for pkcs-signedData (1.2.840.113549.1.7.2) */
+#define ASN1_OID_SIGNEDDATA					\
+	ASN1_OID_INITIAL ( 1, 2 ), ASN1_OID_DOUBLE ( 840 ),	\
+	ASN1_OID_TRIPLE ( 113549 ), ASN1_OID_SINGLE ( 1 ),	\
+	ASN1_OID_SINGLE ( 7 ), ASN1_OID_SINGLE ( 2 )
+
 /** Define an ASN.1 cursor containing an OID */
 #define ASN1_OID_CURSOR( oid_value ) {				\
 		.data = oid_value,				\
diff --git a/src/include/ipxe/cms.h b/src/include/ipxe/cms.h
new file mode 100644
index 000000000..f355bf1cb
--- /dev/null
+++ b/src/include/ipxe/cms.h
@@ -0,0 +1,50 @@
+#ifndef _IPXE_CMS_H
+#define _IPXE_CMS_H
+
+/** @file
+ *
+ * Cryptographic Message Syntax (PKCS #7)
+ *
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER );
+
+#include <time.h>
+#include <ipxe/asn1.h>
+#include <ipxe/crypto.h>
+#include <ipxe/x509.h>
+#include <ipxe/uaccess.h>
+
+/** CMS signer information */
+struct cms_signer_info {
+	/** Issuer name */
+	struct asn1_cursor issuer;
+	/** Serial number */
+	struct asn1_cursor serial;
+	/** Digest algorithm */
+	struct digest_algorithm *digest;
+	/** Public-key algorithm */
+	struct pubkey_algorithm *pubkey;
+	/** Signature */
+	const void *signature;
+	/** Length of signature */
+	size_t signature_len;
+};
+
+/** A CMS signature */
+struct cms_signature {
+	/** Raw certificate list */
+	struct asn1_cursor certificates;
+	/** Signer information
+	 *
+	 * We currently use only the first signer information block.
+	 */
+	struct cms_signer_info info;
+};
+
+extern int cms_parse ( struct cms_signature *sig, const void *data,
+		       size_t len );
+extern int cms_verify ( struct cms_signature *sig, userptr_t data, size_t len,
+			const char *name, time_t time, struct x509_root *root );
+
+#endif /* _IPXE_CMS_H */
diff --git a/src/include/ipxe/errfile.h b/src/include/ipxe/errfile.h
index 4b568840d..e0473a171 100644
--- a/src/include/ipxe/errfile.h
+++ b/src/include/ipxe/errfile.h
@@ -249,6 +249,7 @@ FILE_LICENCE ( GPL2_OR_LATER );
 #define ERRFILE_rsa		      ( ERRFILE_OTHER | 0x00270000 )
 #define ERRFILE_linux_entropy	      ( ERRFILE_OTHER | 0x00280000 )
 #define ERRFILE_x509_test	      ( ERRFILE_OTHER | 0x00290000 )
+#define ERRFILE_cms		      ( ERRFILE_OTHER | 0x002a0000 )
 
 /** @} */
 
-- 
cgit v1.2.3-55-g7522