This patch adds cades support for openssl

apps/cms.c

@@ -22,6 +22,8 @@
 # include <openssl/x509_vfy.h>
 # include <openssl/x509v3.h>
 # include <openssl/cms.h>
+# include <openssl/ts.h>
+# include "crypto/ts/ts_lcl.h"
 
 static int save_certs(char *signerfile, STACK_OF(X509) *signers);
 static int cms_cb(int ok, X509_STORE_CTX *ctx);
@@ -51,6 +53,7 @@ static int cms_set_pkey_param(EVP_PKEY_CTX *pctx,
 # define SMIME_ENCRYPTED_ENCRYPT (14 | SMIME_OP)
 # define SMIME_SIGN_RECEIPT      (15 | SMIME_IP | SMIME_OP)
 # define SMIME_VERIFY_RECEIPT    (16 | SMIME_IP)
+# define CMS_CADES                   0x100000
 
 static int verify_err = 0;
 
@@ -65,7 +68,7 @@ struct cms_key_param_st {
 typedef enum OPTION_choice {
     OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
     OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_ENCRYPT,
-    OPT_DECRYPT, OPT_SIGN, OPT_SIGN_RECEIPT, OPT_RESIGN,
+    OPT_DECRYPT, OPT_SIGN, OPT_CADES, OPT_SIGN_RECEIPT, OPT_RESIGN,
     OPT_VERIFY, OPT_VERIFY_RETCODE, OPT_VERIFY_RECEIPT,
     OPT_CMSOUT, OPT_DATA_OUT, OPT_DATA_CREATE, OPT_DIGEST_VERIFY,
     OPT_DIGEST_CREATE, OPT_COMPRESS, OPT_UNCOMPRESS,
@@ -102,6 +105,7 @@ const OPTIONS cms_options[] = {
     {"sign", OPT_SIGN, '-', "Sign message"},
     {"sign_receipt", OPT_SIGN_RECEIPT, '-', "Generate a signed receipt for the message"},
     {"resign", OPT_RESIGN, '-', "Resign a signed message"},
+    {"cades", OPT_CADES, '-', "Include signer certificate digest"},
     {"verify", OPT_VERIFY, '-', "Verify signed message"},
     {"verify_retcode", OPT_VERIFY_RETCODE, '-'},
     {"verify_receipt", OPT_VERIFY_RECEIPT, '<'},
@@ -326,6 +330,9 @@ int cms_main(int argc, char **argv)
         case OPT_BINARY:
             flags |= CMS_BINARY;
             break;
+        case OPT_CADES:
+            flags |= CMS_CADES;
+            break;
         case OPT_KEYID:
             flags |= CMS_USE_KEYID;
             break;
@@ -940,6 +947,50 @@ int cms_main(int argc, char **argv)
             si = CMS_add1_signer(cms, signer, key, sign_md, tflags);
             if (si == NULL)
                 goto end;
+            if (flags & CMS_CADES) {
+                ASN1_STRING *seq = NULL;
+                unsigned char *p, *pp = NULL;
+                ESS_SIGNING_CERT_V2 *sc = NULL;
+                ESS_CERT_ID_V2 * cid;
+                unsigned char hash[EVP_MAX_MD_SIZE];
+                unsigned int hash_len = sizeof (hash);
+                X509_ALGOR *alg = NULL;
+		int len;
+
+                memset(hash, 0, sizeof (hash));
+                /* Create the SigningCertificateV2 attribute. */
+                if (!(sc = ESS_SIGNING_CERT_V2_new()))
+                    goto end;
+                /* Adding the signing certificate id. */
+                if (!(cid = ESS_CERT_ID_V2_new()))
+                    goto end;
+                alg = X509_ALGOR_new();
+                if (alg == NULL)
+                    goto end;
+                X509_ALGOR_set_md(alg, sign_md);
+                if (alg->algorithm == NULL)
+                    goto end;
+                cid->hash_alg = alg;
+                alg = NULL;
+                if (!X509_digest(signer, sign_md, hash, &hash_len))
+                    goto end;
+                if (!ASN1_OCTET_STRING_set(cid->hash, hash, hash_len))
+                    goto end;
+                if (!sk_ESS_CERT_ID_V2_push(sc->cert_ids, cid))
+                    goto end;
+                /* Add SigningCertificateV2 signed attribute to the signer info. */
+                len = i2d_ESS_SIGNING_CERT_V2(sc, NULL);
+                if ((pp = OPENSSL_malloc(len)) == NULL) 
+                    goto end;
+                p = pp;
+                i2d_ESS_SIGNING_CERT_V2(sc, &p);
+                if (!(seq = ASN1_STRING_new()) || !ASN1_STRING_set(seq, pp, len)) 
+		    goto end;
+                OPENSSL_free(pp);
+                pp = NULL;
+                if (!CMS_signed_add1_attr_by_NID(si, NID_id_smime_aa_signingCertificateV2,
+                        V_ASN1_SEQUENCE, seq, -1)) goto end;
+            }
             if (kparam != NULL) {
                 EVP_PKEY_CTX *pctx;
                 pctx = CMS_SignerInfo_get0_pkey_ctx(si);