pkcs7.h@ 74730

Last change on this file since 74730 was 74716, checked in by vboxsync, 6 years ago
IPRT/ldr: More Mach-O signing hacking. bugref:9232
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 25.3 KB

Line
1	/** @file
2	* IPRT - PKCS \#7, Cryptographic Message Syntax Standard (aka CMS).
3	*/
4
5	/*
6	* Copyright (C) 2006-2017 Oracle Corporation
7	*
8	* This file is part of VirtualBox Open Source Edition (OSE), as
9	* available from http://www.virtualbox.org. This file is free software;
10	* you can redistribute it and/or modify it under the terms of the GNU
11	* General Public License (GPL) as published by the Free Software
12	* Foundation, in version 2 as it comes in the "COPYING" file of the
13	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
14	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
15	*
16	* The contents of this file may alternatively be used under the terms
17	* of the Common Development and Distribution License Version 1.0
18	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
19	* VirtualBox OSE distribution, in which case the provisions of the
20	* CDDL are applicable instead of those of the GPL.
21	*
22	* You may elect to license modified versions of this file under the
23	* terms and conditions of either the GPL or the CDDL or both.
24	*/
25
26	#ifndef ___iprt_crypto_pkcs7_h
27	#define ___iprt_crypto_pkcs7_h
28
29	#include <iprt/asn1.h>
30	#include <iprt/crypto/x509.h>
31
32
33	RT_C_DECLS_BEGIN
34
35	struct RTCRPKCS7CONTENTINFO;
36
37
38	/** @defgroup grp_rt_crpkcs7 RTCrPkcs7 - PKCS \#7, Cryptographic Message Syntax Standard (aka CMS).
39	* @ingroup grp_rt_crypto
40	* @{
41	*/
42
43	/** PKCS \#7 data object ID.*/
44	#define RTCR_PKCS7_DATA_OID "1.2.840.113549.1.7.1"
45	/** PKCS \#7 signedData object ID. */
46	#define RTCR_PKCS7_SIGNED_DATA_OID "1.2.840.113549.1.7.2"
47	/** PKCS \#7 envelopedData object ID. */
48	#define RTCR_PKCS7_ENVELOPED_DATA_OID "1.2.840.113549.1.7.3"
49	/** PKCS \#7 signedAndEnvelopedData object ID. */
50	#define RTCR_PKCS7_SIGNED_AND_ENVELOPED_DATA_OID "1.2.840.113549.1.7.4"
51	/** PKCS \#7 digestedData object ID. */
52	#define RTCR_PKCS7_DIGESTED_DATA_OID "1.2.840.113549.1.7.5"
53	/** PKCS \#7 encryptedData object ID. */
54	#define RTCR_PKCS7_ENCRYPTED_DATA_OID "1.2.840.113549.1.7.6"
55
56
57	/**
58	* PKCS \#7 IssuerAndSerialNumber (IPRT representation).
59	*/
60	typedef struct RTCRPKCS7ISSUERANDSERIALNUMBER
61	{
62	/** Sequence core. */
63	RTASN1SEQUENCECORE SeqCore;
64	/** The certificate name. */
65	RTCRX509NAME Name;
66	/** The certificate serial number. */
67	RTASN1INTEGER SerialNumber;
68	} RTCRPKCS7ISSUERANDSERIALNUMBER;
69	/** Pointer to the IPRT representation of a PKCS \#7 IssuerAndSerialNumber. */
70	typedef RTCRPKCS7ISSUERANDSERIALNUMBER *PRTCRPKCS7ISSUERANDSERIALNUMBER;
71	/** Pointer to the const IPRT representation of a PKCS \#7
72	* IssuerAndSerialNumber. */
73	typedef RTCRPKCS7ISSUERANDSERIALNUMBER const *PCRTCRPKCS7ISSUERANDSERIALNUMBER;
74	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRPKCS7ISSUERANDSERIALNUMBER, RTDECL, RTCrPkcs7IssuerAndSerialNumber, SeqCore.Asn1Core);
75
76
77	/** Pointer to the IPRT representation of a PKCS \#7 SignerInfo. */
78	typedef struct RTCRPKCS7SIGNERINFO *PRTCRPKCS7SIGNERINFO;
79	/** Pointer to the const IPRT representation of a PKCS \#7 SignerInfo. */
80	typedef struct RTCRPKCS7SIGNERINFO const *PCRTCRPKCS7SIGNERINFO;
81	RTASN1_IMPL_GEN_SET_OF_TYPEDEFS_AND_PROTOS(RTCRPKCS7SIGNERINFOS, RTCRPKCS7SIGNERINFO, RTDECL, RTCrPkcs7SignerInfos);
82
83
84	/**
85	* Attribute value type (for the union).
86	*/
87	typedef enum RTCRPKCS7ATTRIBUTETYPE
88	{
89	/** Zero is invalid. */
90	RTCRPKCS7ATTRIBUTETYPE_INVALID = 0,
91	/** Not present, union is NULL. */
92	RTCRPKCS7ATTRIBUTETYPE_NOT_PRESENT,
93	/** Unknown values, pCores. */
94	RTCRPKCS7ATTRIBUTETYPE_UNKNOWN,
95	/** Object IDs, use pObjIds. */
96	RTCRPKCS7ATTRIBUTETYPE_OBJ_IDS,
97	/** Octet strings, use pOctetStrings. */
98	RTCRPKCS7ATTRIBUTETYPE_OCTET_STRINGS,
99	/** Counter signatures (PKCS \#9), use pCounterSignatures. */
100	RTCRPKCS7ATTRIBUTETYPE_COUNTER_SIGNATURES,
101	/** Signing time (PKCS \#9), use pSigningTime. */
102	RTCRPKCS7ATTRIBUTETYPE_SIGNING_TIME,
103	/** Microsoft timestamp info (RFC-3161) signed data, use pContentInfo. */
104	RTCRPKCS7ATTRIBUTETYPE_MS_TIMESTAMP,
105	/** Microsoft nested PKCS\#7 signature (signtool /as). */
106	RTCRPKCS7ATTRIBUTETYPE_MS_NESTED_SIGNATURE,
107	/** Microsoft statement type, use pObjIdSeqs. */
108	RTCRPKCS7ATTRIBUTETYPE_MS_STATEMENT_TYPE,
109	/** Apple plist with the all code directory digests, use pOctetStrings. */
110	RTCRPKCS7ATTRIBUTETYPE_APPLE_MULTI_CD_PLIST,
111	/** Blow the type up to 32-bits. */
112	RTCRPKCS7ATTRIBUTETYPE_32BIT_HACK = 0x7fffffff
113	} RTCRPKCS7ATTRIBUTETYPE;
114
115	/**
116	* PKCS \#7 Attribute (IPRT representation).
117	*/
118	typedef struct RTCRPKCS7ATTRIBUTE
119	{
120	/** Sequence core. */
121	RTASN1SEQUENCECORE SeqCore;
122	/** The attribute type (object ID). */
123	RTASN1OBJID Type;
124	/** The type of data found in the values union. */
125	RTCRPKCS7ATTRIBUTETYPE enmType;
126	/** Value allocation. */
127	RTASN1ALLOCATION Allocation;
128	/** Values. */
129	union
130	{
131	/** ASN.1 cores (RTCRPKCS7ATTRIBUTETYPE_UNKNOWN). */
132	PRTASN1SETOFCORES pCores;
133	/** ASN.1 object identifiers (RTCRPKCS7ATTRIBUTETYPE_OBJ_IDS). */
134	PRTASN1SETOFOBJIDS pObjIds;
135	/** Sequence of ASN.1 object identifiers (RTCRPKCS7ATTRIBUTETYPE_MS_STATEMENT_TYPE). */
136	PRTASN1SETOFOBJIDSEQS pObjIdSeqs;
137	/** ASN.1 octet strings (RTCRPKCS7ATTRIBUTETYPE_OCTET_STRINGS). */
138	PRTASN1SETOFOCTETSTRINGS pOctetStrings;
139	/** Counter signatures RTCRPKCS7ATTRIBUTETYPE_COUNTER_SIGNATURES(). */
140	PRTCRPKCS7SIGNERINFOS pCounterSignatures;
141	/** Signing time(s) (RTCRPKCS7ATTRIBUTETYPE_SIGNING_TIME). */
142	PRTASN1SETOFTIMES pSigningTime;
143	/** Microsoft timestamp (RFC-3161 signed data, RTCRPKCS7ATTRIBUTETYPE_MS_TIMESTAMP),
144	* Microsoft nested signature (RTCRPKCS7ATTRIBUTETYPE_MS_NESTED_SIGNATURE). */
145	struct RTCRPKCS7SETOFCONTENTINFOS *pContentInfos;
146	} uValues;
147	} RTCRPKCS7ATTRIBUTE;
148	/** Pointer to the IPRT representation of a PKCS \#7 Attribute. */
149	typedef RTCRPKCS7ATTRIBUTE *PRTCRPKCS7ATTRIBUTE;
150	/** Pointer to the const IPRT representation of a PKCS \#7 Attribute. */
151	typedef RTCRPKCS7ATTRIBUTE const *PCRTCRPKCS7ATTRIBUTE;
152	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRPKCS7ATTRIBUTE, RTDECL, RTCrPkcs7Attribute, SeqCore.Asn1Core);
153
154	RTASN1_IMPL_GEN_SET_OF_TYPEDEFS_AND_PROTOS(RTCRPKCS7ATTRIBUTES, RTCRPKCS7ATTRIBUTE, RTDECL, RTCrPkcs7Attributes);
155
156
157	/**
158	* One PKCS \#7 SignerInfo (IPRT representation).
159	*/
160	typedef struct RTCRPKCS7SIGNERINFO
161	{
162	/** Sequence core. */
163	RTASN1SEQUENCECORE SeqCore;
164	/** The structure version (RTCRPKCS7SIGNERINFO_V1). */
165	RTASN1INTEGER Version;
166	/** The issuer and serial number of the certificate used to produce the
167	* encrypted digest below. */
168	RTCRPKCS7ISSUERANDSERIALNUMBER IssuerAndSerialNumber;
169	/** The digest algorithm use to digest the signed content. */
170	RTCRX509ALGORITHMIDENTIFIER DigestAlgorithm;
171	/** Authenticated attributes, optional [0].
172	* @todo Check how other producers formats this. The microsoft one does not
173	* have explicit tags, but combines it with the SET OF. */
174	RTCRPKCS7ATTRIBUTES AuthenticatedAttributes;
175	/** The digest encryption algorithm use to encrypt the digest of the signed
176	* content. */
177	RTCRX509ALGORITHMIDENTIFIER DigestEncryptionAlgorithm;
178	/** The encrypted digest. */
179	RTASN1OCTETSTRING EncryptedDigest;
180	/** Unauthenticated attributes, optional [1].
181	* @todo Check how other producers formats this. The microsoft one does not
182	* have explicit tags, but combines it with the SET OF. */
183	RTCRPKCS7ATTRIBUTES UnauthenticatedAttributes;
184	} RTCRPKCS7SIGNERINFO;
185	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRPKCS7SIGNERINFO, RTDECL, RTCrPkcs7SignerInfo, SeqCore.Asn1Core);
186
187	/** RTCRPKCS7SIGNERINFO::Version value. */
188	#define RTCRPKCS7SIGNERINFO_V1 1
189
190	/** @name PKCS \#9 Attribute IDs
191	* @{ */
192	/** Content type (RFC-2630 11.1).
193	* Value: Object Identifier */
194	#define RTCR_PKCS9_ID_CONTENT_TYPE_OID "1.2.840.113549.1.9.3"
195	/** Message digest (RFC-2630 11.2).
196	* Value: Octet string. */
197	#define RTCR_PKCS9_ID_MESSAGE_DIGEST_OID "1.2.840.113549.1.9.4"
198	/** Signing time (RFC-2630 11.3).
199	* Value: Octet string. */
200	#define RTCR_PKCS9_ID_SIGNING_TIME_OID "1.2.840.113549.1.9.5"
201	/** Counter signature (RFC-2630 11.4).
202	* Value: SignerInfo. */
203	#define RTCR_PKCS9_ID_COUNTER_SIGNATURE_OID "1.2.840.113549.1.9.6"
204	/** Microsoft timestamp (RTF-3161) counter signature (SignedData).
205	* @remarks This isn't defined by PKCS \#9, but lumped in here for convenience. It's actually listed as SPC by MS. */
206	#define RTCR_PKCS9_ID_MS_TIMESTAMP "1.3.6.1.4.1.311.3.3.1"
207	/** Microsoft nested PKCS\#7 signature.
208	* @remarks This isn't defined by PKCS \#9, but lumped in here for convenience. */
209	#define RTCR_PKCS9_ID_MS_NESTED_SIGNATURE "1.3.6.1.4.1.311.2.4.1"
210	/** Microsoft statement type.
211	* @remarks This isn't defined by PKCS \#9, but lumped in here for convenience. It's actually listed as SPC by MS. */
212	#define RTCR_PKCS9_ID_MS_STATEMENT_TYPE "1.3.6.1.4.1.311.2.1.11"
213	/** Microsoft opus info.
214	* @remarks This isn't defined by PKCS \#9, but lumped in here for convenience. It's actually listed as SPC by MS. */
215	#define RTCR_PKCS9_ID_MS_SP_OPUS_INFO "1.3.6.1.4.1.311.2.1.12"
216	/** Apple code signing multi-code-directory plist.
217	* @remarks This isn't defined by PKCS \#9, but lumped in here for convenience. */
218	#define RTCR_PKCS9_ID_APPLE_MULTI_CD_PLIST "1.2.840.113635.100.9.1"
219	/** @} */
220
221
222	/**
223	* Get the (next) signing time attribute from the specfied SignerInfo or one of
224	* the immediate counter signatures.
225	*
226	* @returns Pointer to the signing time if found, NULL if not.
227	* @param pThis The SignerInfo to search.
228	* @param ppSignerInfo Pointer to variable keeping track of the
229	* enumeration, optional.
230	*
231	* If specified the input value is taken to the be
232	* SignerInfo of the previously returned signing
233	* time. The value pointed to is NULL, the
234	* search/enum restarts.
235	*
236	* On successful return this is set to the
237	* SignerInfo which we found the signing time in.
238	*/
239	RTDECL(PCRTASN1TIME) RTCrPkcs7SignerInfo_GetSigningTime(PCRTCRPKCS7SIGNERINFO pThis, PCRTCRPKCS7SIGNERINFO *ppSignerInfo);
240
241
242	/**
243	* Get the (first) timestamp from within a Microsoft timestamp server counter
244	* signature.
245	*
246	* @returns Pointer to the signing time if found, NULL if not.
247	* @param pThis The SignerInfo to search.
248	* @param ppContentInfoRet Where to return the pointer to the counter
249	* signature, optional.
250	*/
251	RTDECL(PCRTASN1TIME) RTCrPkcs7SignerInfo_GetMsTimestamp(PCRTCRPKCS7SIGNERINFO pThis,
252	struct RTCRPKCS7CONTENTINFO const **ppContentInfoRet);
253
254
255
256	/**
257	* PKCS \#7 ContentInfo (IPRT representation).
258	*/
259	typedef struct RTCRPKCS7CONTENTINFO
260	{
261	/** Sequence core. */
262	RTASN1SEQUENCECORE SeqCore;
263	/** Object ID identifying the content below. */
264	RTASN1OBJID ContentType;
265	/** Content, optional, explicit tag 0.
266	*
267	* Hack alert! This should've been an explict context tag 0 structure with a
268	* type selected according to ContentType. However, it's simpler to replace the
269	* explicit context with an OCTET STRING with implict tag 0. Then we can tag
270	* along on the encapsulation logic RTASN1OCTETSTRING provides for the dynamic
271	* inner type. The default decoder code will detect known structures as
272	* outlined in the union below, and decode the octet string content as an
273	* anonymous RTASN1CORE if not known.
274	*
275	* If the user want to decode the octet string content differently, it can do so
276	* by destroying and freeing the current encapsulated pointer, replacing it with
277	* it's own. (Of course following the RTASN1OCTETSTRING rules.) Just remember
278	* to also update the value in the union.
279	*
280	* @remarks What's signed and verified is Content.pEncapsulated->uData.pv.
281	*/
282	RTASN1OCTETSTRING Content;
283	/** Pointer to the CMS octet string that's inside the Content, NULL if PKCS \#7.
284	*
285	* Hack alert! When transitioning from PKCS \#7 to CMS, the designers decided to
286	* change things and add another wrapper. This time we're talking about a real
287	* octet string, not like the one above which is really an explicit content tag.
288	* When constructing or decoding CMS content, this will be the same pointer as
289	* Content.pEncapsulated, while the union below will be holding the same pointer
290	* as pCmsContent->pEncapsulated.
291	*/
292	PRTASN1OCTETSTRING pCmsContent;
293	/** Same as Content.pEncapsulated, except a choice of known types. */
294	union
295	{
296	/** ContentType is RTCRPKCS7SIGNEDDATA_OID. */
297	struct RTCRPKCS7SIGNEDDATA *pSignedData;
298	/** ContentType is RTCRSPCINDIRECTDATACONTENT_OID. */
299	struct RTCRSPCINDIRECTDATACONTENT *pIndirectDataContent;
300	/** ContentType is RTCRTSPTSTINFO_OID. */
301	struct RTCRTSPTSTINFO *pTstInfo;
302	/** Generic / Unknown / User. */
303	PRTASN1CORE pCore;
304	} u;
305	} RTCRPKCS7CONTENTINFO;
306	/** Pointer to the IPRT representation of a PKCS \#7 ContentInfo. */
307	typedef RTCRPKCS7CONTENTINFO *PRTCRPKCS7CONTENTINFO;
308	/** Pointer to the const IPRT representation of a PKCS \#7 ContentInfo. */
309	typedef RTCRPKCS7CONTENTINFO const *PCRTCRPKCS7CONTENTINFO;
310	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRPKCS7CONTENTINFO, RTDECL, RTCrPkcs7ContentInfo, SeqCore.Asn1Core);
311	RTASN1_IMPL_GEN_SET_OF_TYPEDEFS_AND_PROTOS(RTCRPKCS7SETOFCONTENTINFOS, RTCRPKCS7CONTENTINFO, RTDECL, RTCrPkcs7SetOfContentInfos);
312
313	RTDECL(bool) RTCrPkcs7ContentInfo_IsSignedData(PCRTCRPKCS7CONTENTINFO pThis);
314
315
316	/**
317	* PKCS \#7 Certificate choice.
318	*/
319	typedef enum RTCRPKCS7CERTCHOICE
320	{
321	RTCRPKCS7CERTCHOICE_INVALID = 0,
322	RTCRPKCS7CERTCHOICE_X509,
323	RTCRPKCS7CERTCHOICE_EXTENDED_PKCS6,
324	RTCRPKCS7CERTCHOICE_AC_V1,
325	RTCRPKCS7CERTCHOICE_AC_V2,
326	RTCRPKCS7CERTCHOICE_OTHER,
327	RTCRPKCS7CERTCHOICE_END,
328	RTCRPKCS7CERTCHOICE_32BIT_HACK = 0x7fffffff
329	} RTCRPKCS7CERTCHOICE;
330
331
332	/**
333	* Common representation for PKCS \#7 ExtendedCertificateOrCertificate and the
334	* CMS CertificateChoices types.
335	*/
336	typedef struct RTCRPKCS7CERT
337	{
338	/** Dummy ASN.1 record, not encoded. */
339	RTASN1DUMMY Dummy;
340	/** The value allocation. */
341	RTASN1ALLOCATION Allocation;
342	/** The choice of value. */
343	RTCRPKCS7CERTCHOICE enmChoice;
344	/** The value union. */
345	union
346	{
347	/** Standard X.509 certificate (RTCRCMSCERTIFICATECHOICE_X509). */
348	PRTCRX509CERTIFICATE pX509Cert;
349	/** Extended PKCS \#6 certificate (RTCRCMSCERTIFICATECHOICE_EXTENDED_PKCS6). */
350	PRTASN1CORE pExtendedCert;
351	/** Attribute certificate version 1 (RTCRCMSCERTIFICATECHOICE_AC_V1). */
352	PRTASN1CORE pAcV1;
353	/** Attribute certificate version 2 (RTCRCMSCERTIFICATECHOICE_AC_V2). */
354	PRTASN1CORE pAcV2;
355	/** Other certificate (RTCRCMSCERTIFICATECHOICE_OTHER). */
356	PRTASN1CORE pOtherCert;
357	} u;
358	} RTCRPKCS7CERT;
359	/** Pointer to the IPRT representation of PKCS \#7 or CMS certificate. */
360	typedef RTCRPKCS7CERT *PRTCRPKCS7CERT;
361	/** Pointer to the const IPRT representation of PKCS \#7 or CMS certificate. */
362	typedef RTCRPKCS7CERT const *PCRTCRPKCS7CERT;
363	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRPKCS7CERT, RTDECL, RTCrPkcs7Cert, Dummy.Asn1Core);
364	RTASN1_IMPL_GEN_SET_OF_TYPEDEFS_AND_PROTOS(RTCRPKCS7SETOFCERTS, RTCRPKCS7CERT, RTDECL, RTCrPkcs7SetOfCerts);
365
366	RTDECL(PCRTCRX509CERTIFICATE) RTCrPkcs7SetOfCerts_FindX509ByIssuerAndSerialNumber(PCRTCRPKCS7SETOFCERTS pCertificates,
367	PCRTCRX509NAME pIssuer,
368	PCRTASN1INTEGER pSerialNumber);
369
370
371	/**
372	* PKCS \#7 SignedData (IPRT representation).
373	*/
374	typedef struct RTCRPKCS7SIGNEDDATA
375	{
376	/** Sequence core. */
377	RTASN1SEQUENCECORE SeqCore;
378	/** The structure version value (1). */
379	RTASN1INTEGER Version;
380	/** The digest algorithms that are used to signed the content (ContentInfo). */
381	RTCRX509ALGORITHMIDENTIFIERS DigestAlgorithms;
382	/** The content that's being signed. */
383	RTCRPKCS7CONTENTINFO ContentInfo;
384	/** Certificates, optional, implicit tag 0. (Required by Authenticode.) */
385	RTCRPKCS7SETOFCERTS Certificates;
386	/** Certificate revocation lists, optional, implicit tag 1.
387	* Not used by Authenticode, so currently stubbed. */
388	RTASN1CORE Crls;
389	/** Signer infos. */
390	RTCRPKCS7SIGNERINFOS SignerInfos;
391	} RTCRPKCS7SIGNEDDATA;
392	/** Pointer to the IPRT representation of a PKCS \#7 SignedData. */
393	typedef RTCRPKCS7SIGNEDDATA *PRTCRPKCS7SIGNEDDATA;
394	/** Pointer to the const IPRT representation of a PKCS \#7 SignedData. */
395	typedef RTCRPKCS7SIGNEDDATA const *PCRTCRPKCS7SIGNEDDATA;
396	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRPKCS7SIGNEDDATA, RTDECL, RTCrPkcs7SignedData, SeqCore.Asn1Core);
397	RTASN1_IMPL_GEN_SET_OF_TYPEDEFS_AND_PROTOS(RTCRPKCS7SETOFSIGNEDDATA, RTCRPKCS7SIGNEDDATA, RTDECL, RTCrPkcs7SetOfSignedData);
398
399	/** PKCS \#7 SignedData object ID. */
400	#define RTCRPKCS7SIGNEDDATA_OID RTCR_PKCS7_SIGNED_DATA_OID
401
402	/** PKCS \#7 SignedData version number 1. */
403	#define RTCRPKCS7SIGNEDDATA_V1 1
404	/* No version 2 seems to exist. */
405	/** CMS SignedData version number 3.
406	* This should only be used if there are version 1 attribute certificates
407	* present, or if there are version 3 SignerInfo items present, or if
408	* enmcCountInfo is not id-data (RFC-5652, section 5.1). */
409	#define RTCRPKCS7SIGNEDDATA_V3 3
410	/** CMS SignedData version number 4.
411	* This should only be used if there are version 2 attribute certificates
412	* present (RFC-5652, section 5.1). */
413	#define RTCRPKCS7SIGNEDDATA_V4 4
414	/** CMS SignedData version number 5.
415	* This should only be used if there are certificates or/and CRLs of the
416	* OTHER type present (RFC-5652, section 5.1). */
417	#define RTCRPKCS7SIGNEDDATA_V5 5
418
419
420	/** @name RTCRPKCS7SIGNEDDATA_SANITY_F_XXX - Flags for RTPkcs7SignedDataCheckSantiy.
421	* @{ */
422	/** Check for authenticode restrictions. */
423	#define RTCRPKCS7SIGNEDDATA_SANITY_F_AUTHENTICODE RT_BIT_32(0)
424	/** Check that all the hash algorithms are known to IPRT. */
425	#define RTCRPKCS7SIGNEDDATA_SANITY_F_ONLY_KNOWN_HASH RT_BIT_32(1)
426	/** Require signing certificate to be present. */
427	#define RTCRPKCS7SIGNEDDATA_SANITY_F_SIGNING_CERT_PRESENT RT_BIT_32(2)
428	/** @} */
429
430
431	/**
432	* PKCS \#7 DigestInfo (IPRT representation).
433	*/
434	typedef struct RTCRPKCS7DIGESTINFO
435	{
436	/** Sequence core. */
437	RTASN1SEQUENCECORE SeqCore;
438	/** The digest algorithm use to digest the signed content. */
439	RTCRX509ALGORITHMIDENTIFIER DigestAlgorithm;
440	/** The digest. */
441	RTASN1OCTETSTRING Digest;
442	} RTCRPKCS7DIGESTINFO;
443	/** Pointer to the IPRT representation of a PKCS \#7 DigestInfo object. */
444	typedef RTCRPKCS7DIGESTINFO *PRTCRPKCS7DIGESTINFO;
445	/** Pointer to the const IPRT representation of a PKCS \#7 DigestInfo object. */
446	typedef RTCRPKCS7DIGESTINFO const *PCRTCRPKCS7DIGESTINFO;
447	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRPKCS7DIGESTINFO, RTDECL, RTCrPkcs7DigestInfo, SeqCore.Asn1Core);
448
449
450	/**
451	* Callback function for use with RTCrPkcs7VerifySignedData.
452	*
453	* @returns IPRT status code.
454	* @param pCert The certificate to verify.
455	* @param hCertPaths Unless the certificate is trusted directly, this
456	* is a reference to the certificate path builder
457	* and verifier instance that we used to establish
458	* at least valid trusted path to @a pCert. The
459	* callback can use this to enforce additional
460	* certificate lineage requirements, effective
461	* policy checks and whatnot.
462	* This is NIL_RTCRX509CERTPATHS if the certificate
463	* is directly trusted.
464	* @param fFlags Mix of the RTCRPKCS7VCC_F_XXX flags.
465	* @param pvUser The user argument.
466	* @param pErrInfo Optional error info buffer.
467	*/
468	typedef DECLCALLBACK(int) FNRTCRPKCS7VERIFYCERTCALLBACK(PCRTCRX509CERTIFICATE pCert, RTCRX509CERTPATHS hCertPaths,
469	uint32_t fFlags, void *pvUser, PRTERRINFO pErrInfo);
470	/** Pointer to a FNRTCRPKCS7VERIFYCERTCALLBACK callback. */
471	typedef FNRTCRPKCS7VERIFYCERTCALLBACK *PFNRTCRPKCS7VERIFYCERTCALLBACK;
472
473	/** @name RTCRPKCS7VCC_F_XXX - Flags for FNRTCRPKCS7VERIFYCERTCALLBACK.
474	* @{ */
475	/** Normal callback for a direct signatory of the signed data. */
476	#define RTCRPKCS7VCC_F_SIGNED_DATA RT_BIT_32(0)
477	/** Check that the signatory can be trusted for timestamps. */
478	#define RTCRPKCS7VCC_F_TIMESTAMP RT_BIT_32(1)
479	/** @} */
480
481	/**
482	* @callback_method_impl{FNRTCRPKCS7VERIFYCERTCALLBACK,
483	* Default implementation that checks for the DigitalSignature KeyUsage bit.}
484	*/
485	RTDECL(int) RTCrPkcs7VerifyCertCallbackDefault(PCRTCRX509CERTIFICATE pCert, RTCRX509CERTPATHS hCertPaths, uint32_t fFlags,
486	void *pvUser, PRTERRINFO pErrInfo);
487
488	/**
489	* @callback_method_impl{FNRTCRPKCS7VERIFYCERTCALLBACK,
490	* Standard code signing. Use this for Microsoft SPC.}
491	*/
492	RTDECL(int) RTCrPkcs7VerifyCertCallbackCodeSigning(PCRTCRX509CERTIFICATE pCert, RTCRX509CERTPATHS hCertPaths, uint32_t fFlags,
493	void *pvUser, PRTERRINFO pErrInfo);
494
495	/**
496	* Verifies PKCS \#7 SignedData.
497	*
498	* For compatability with alternative crypto providers, the user must work on
499	* the top level PKCS \#7 structure instead directly on the SignedData.
500	*
501	* @returns IPRT status code.
502	* @param pContentInfo PKCS \#7 content info structure.
503	* @param fFlags RTCRPKCS7VERIFY_SD_F_XXX.
504	* @param hAdditionalCerts Store containing additional certificates to
505	* supplement those mentioned in the signed data.
506	* @param hTrustedCerts Store containing trusted certificates.
507	* @param pValidationTime The time we're supposed to validate the
508	* certificates chains at. Ignored for signatures
509	* with valid signing time attributes.
510	* @param pfnVerifyCert Callback for checking that a certificate used
511	* for signing the data is suitable.
512	* @param pvUser User argument for the callback.
513	* @param pErrInfo Optional error info buffer.
514	*/
515	RTDECL(int) RTCrPkcs7VerifySignedData(PCRTCRPKCS7CONTENTINFO pContentInfo, uint32_t fFlags,
516	RTCRSTORE hAdditionalCerts, RTCRSTORE hTrustedCerts,
517	PCRTTIMESPEC pValidationTime, PFNRTCRPKCS7VERIFYCERTCALLBACK pfnVerifyCert, void *pvUser,
518	PRTERRINFO pErrInfo);
519
520	/** @name RTCRPKCS7VERIFY_SD_F_XXX - Flags for RTCrPkcs7VerifySignedData
521	* @{ */
522	/** Always use the signing time attribute if present, requiring it to be
523	* verified as valid. The default behavior is to ignore unverifiable
524	* signing time attributes and use the @a pValidationTime instead. */
525	#define RTCRPKCS7VERIFY_SD_F_ALWAYS_USE_SIGNING_TIME_IF_PRESENT RT_BIT_32(0)
526	/** Same as RTCRPKCS7VERIFY_SD_F_ALWAYS_USE_SIGNING_TIME_IF_PRESENT for the MS
527	* timestamp counter sigantures. */
528	#define RTCRPKCS7VERIFY_SD_F_ALWAYS_USE_MS_TIMESTAMP_IF_PRESENT RT_BIT_32(1)
529	/** Only use signging time attributes from counter signatures. */
530	#define RTCRPKCS7VERIFY_SD_F_COUNTER_SIGNATURE_SIGNING_TIME_ONLY RT_BIT_32(2)
531	/** Don't validate the counter signature containing the signing time, just use
532	* it unverified. This is useful if we don't necessarily have the root
533	* certificates for the timestamp server handy, but use with great care.
534	* @sa RTCRPKCS7VERIFY_SD_F_USE_MS_TIMESTAMP_UNVERIFIED */
535	#define RTCRPKCS7VERIFY_SD_F_USE_SIGNING_TIME_UNVERIFIED RT_BIT_32(3)
536	/** Don't validate the MS counter signature containing the signing timestamp.
537	* @sa RTCRPKCS7VERIFY_SD_F_USE_SIGNING_TIME_UNVERIFIED */
538	#define RTCRPKCS7VERIFY_SD_F_USE_MS_TIMESTAMP_UNVERIFIED RT_BIT_32(4)
539	/** Do not consider timestamps in microsoft counter signatures. */
540	#define RTCRPKCS7VERIFY_SD_F_IGNORE_MS_TIMESTAMP RT_BIT_32(5)
541	/** The signed data requires certificates to have the timestamp extended
542	* usage bit present. This is used for recursivly verifying MS timestamp
543	* signatures. */
544	#define RTCRPKCS7VERIFY_SD_F_USAGE_TIMESTAMPING RT_BIT_32(6)
545
546	/** Indicates internally that we're validating a counter signature and should
547	* use different rules when checking out the authenticated attributes.
548	* @internal */
549	#define RTCRPKCS7VERIFY_SD_F_COUNTER_SIGNATURE RT_BIT_32(31)
550	/** @} */
551
552	/** @} */
553
554	RT_C_DECLS_END
555
556	#endif
557

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/include/iprt/crypto/pkcs7.h@ 74730

Download in other formats: