pkcs7-sanity.cpp@ 73603

Last change on this file since 73603 was 69111, checked in by vboxsync, 7 years ago
(C) year
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 11.4 KB

Line
1	/* $Id: pkcs7-sanity.cpp 69111 2017-10-17 14:26:02Z vboxsync $ */
2	/** @file
3	* IPRT - Crypto - PKCS \#7, Sanity Checkers.
4	*/
5
6	/*
7	* Copyright (C) 2006-2017 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* The contents of this file may alternatively be used under the terms
18	* of the Common Development and Distribution License Version 1.0
19	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20	* VirtualBox OSE distribution, in which case the provisions of the
21	* CDDL are applicable instead of those of the GPL.
22	*
23	* You may elect to license modified versions of this file under the
24	* terms and conditions of either the GPL or the CDDL or both.
25	*/
26
27
28	/*********************************************************************************************************************************
29	* Header Files *
30	*********************************************************************************************************************************/
31	#include "internal/iprt.h"
32	#include <iprt/crypto/pkcs7.h>
33
34	#include <iprt/err.h>
35	#include <iprt/string.h>
36
37	//#include <iprt/stream.h>
38
39	#include "pkcs7-internal.h"
40
41
42	static int rtCrPkcs7SignedData_CheckSanityExtra(PCRTCRPKCS7SIGNEDDATA pSignedData, uint32_t fFlags,
43	PRTERRINFO pErrInfo, const char *pszErrorTag)
44	{
45	bool const fAuthenticode = RT_BOOL(fFlags & RTCRPKCS7SIGNEDDATA_SANITY_F_AUTHENTICODE);
46	RT_NOREF_PV(fFlags);
47
48	//RTAsn1Dump(&pSignedData->SeqCore.Asn1Core, 0, 0, RTAsn1DumpStrmPrintfV, g_pStdOut);
49
50	if ( RTAsn1Integer_UnsignedCompareWithU32(&pSignedData->Version, RTCRPKCS7SIGNEDDATA_V1) != 0
51	&& RTAsn1Integer_UnsignedCompareWithU32(&pSignedData->Version, RTCRPKCS7SIGNEDDATA_V3) != 0
52	&& RTAsn1Integer_UnsignedCompareWithU32(&pSignedData->Version, RTCRPKCS7SIGNEDDATA_V4) != 0
53	&& RTAsn1Integer_UnsignedCompareWithU32(&pSignedData->Version, RTCRPKCS7SIGNEDDATA_V5) != 0)
54	return RTErrInfoSetF(pErrInfo, VERR_CR_PKCS7_SIGNED_DATA_VERSION, "SignedData version is %llu, expected %u",
55	pSignedData->Version.uValue.u, RTCRPKCS7SIGNEDDATA_V1);
56
57	/*
58	* DigestAlgorithms.
59	*/
60	if (pSignedData->DigestAlgorithms.cItems == 0) /** @todo this might be too strict */
61	return RTErrInfoSet(pErrInfo, VERR_CR_PKCS7_SIGNED_DATA_NO_DIGEST_ALGOS, "SignedData.DigestAlgorithms is empty");
62	if (pSignedData->DigestAlgorithms.cItems != 1 && fAuthenticode)
63	return RTErrInfoSetF(pErrInfo, VERR_CR_SPC_NOT_EXACTLY_ONE_DIGEST_ALGO,
64	"%s: SignedData.DigestAlgorithms has more than one algorithm (%u)",
65	pszErrorTag, pSignedData->DigestAlgorithms.cItems);
66
67	if (fFlags & RTCRPKCS7SIGNEDDATA_SANITY_F_ONLY_KNOWN_HASH)
68	for (uint32_t i = 0; i < pSignedData->DigestAlgorithms.cItems; i++)
69	{
70	if (RTCrX509AlgorithmIdentifier_QueryDigestType(pSignedData->DigestAlgorithms.papItems[i]) == RTDIGESTTYPE_INVALID)
71	return RTErrInfoSetF(pErrInfo, VERR_CR_PKCS7_UNKNOWN_DIGEST_ALGORITHM,
72	"%s: SignedData.DigestAlgorithms[%i] is not known: %s",
73	pszErrorTag, i, pSignedData->DigestAlgorithms.papItems[i]->Algorithm.szObjId);
74	if (pSignedData->DigestAlgorithms.papItems[i]->Parameters.enmType != RTASN1TYPE_NULL)
75	return RTErrInfoSetF(pErrInfo, VERR_CR_PKCS7_DIGEST_PARAMS_NOT_IMPL,
76	"%s: SignedData.DigestAlgorithms[%i] has parameters: tag=%u",
77	pszErrorTag, i, pSignedData->DigestAlgorithms.papItems[i]->Parameters.u.Core.uTag);
78	}
79
80	/*
81	* Certificates.
82	*/
83	if ( (fFlags & RTCRPKCS7SIGNEDDATA_SANITY_F_SIGNING_CERT_PRESENT)
84	&& pSignedData->Certificates.cItems == 0)
85	return RTErrInfoSetF(pErrInfo, VERR_CR_PKCS7_NO_CERTIFICATES,
86	"%s: SignedData.Certifcates is empty, expected at least one certificate", pszErrorTag);
87
88	/*
89	* Crls.
90	*/
91	if (fAuthenticode && RTAsn1Core_IsPresent(&pSignedData->Crls))
92	return RTErrInfoSetF(pErrInfo, VERR_CR_PKCS7_EXPECTED_NO_CRLS,
93	"%s: SignedData.Crls is not empty as expected for authenticode.", pszErrorTag);
94	/** @todo check Crls when they become important. */
95
96	/*
97	* SignerInfos.
98	*/
99	if (pSignedData->SignerInfos.cItems == 0)
100	return RTErrInfoSetF(pErrInfo, VERR_CR_PKCS7_NO_SIGNER_INFOS, "%s: SignedData.SignerInfos is empty?", pszErrorTag);
101	if (fAuthenticode && pSignedData->SignerInfos.cItems != 1)
102	return RTErrInfoSetF(pErrInfo, VERR_CR_PKCS7_EXPECTED_ONE_SIGNER_INFO,
103	"%s: SignedData.SignerInfos should have one entry for authenticode: %u",
104	pszErrorTag, pSignedData->SignerInfos.cItems);
105
106	for (uint32_t i = 0; i < pSignedData->SignerInfos.cItems; i++)
107	{
108	PCRTCRPKCS7SIGNERINFO pSignerInfo = pSignedData->SignerInfos.papItems[i];
109
110	if (RTAsn1Integer_UnsignedCompareWithU32(&pSignerInfo->Version, RTCRPKCS7SIGNERINFO_V1) != 0)
111	return RTErrInfoSetF(pErrInfo, VERR_CR_PKCS7_SIGNER_INFO_VERSION,
112	"%s: SignedData.SignerInfos[%u] version is %llu, expected %u",
113	pszErrorTag, i, pSignerInfo->Version.uValue.u, RTCRPKCS7SIGNERINFO_V1);
114
115	/* IssuerAndSerialNumber. */
116	int rc = RTCrX509Name_CheckSanity(&pSignerInfo->IssuerAndSerialNumber.Name, 0, pErrInfo,
117	"SignedData.SignerInfos[#].IssuerAndSerialNumber.Name");
118	if (RT_FAILURE(rc))
119	return rc;
120
121	if (pSignerInfo->IssuerAndSerialNumber.SerialNumber.Asn1Core.cb == 0)
122	return RTErrInfoSetF(pErrInfo, VERR_CR_PKCS7_SIGNER_INFO_NO_ISSUER_SERIAL_NO,
123	"%s: SignedData.SignerInfos[%u].IssuerAndSerialNumber.SerialNumber is missing (zero length)",
124	pszErrorTag, i);
125
126	PCRTCRX509CERTIFICATE pCert;
127	pCert = RTCrPkcs7SetOfCerts_FindX509ByIssuerAndSerialNumber(&pSignedData->Certificates,
128	&pSignerInfo->IssuerAndSerialNumber.Name,
129	&pSignerInfo->IssuerAndSerialNumber.SerialNumber);
130	if (!pCert && (fFlags & RTCRPKCS7SIGNEDDATA_SANITY_F_SIGNING_CERT_PRESENT))
131	return RTErrInfoSetF(pErrInfo, VERR_CR_PKCS7_SIGNER_CERT_NOT_SHIPPED,
132	"%s: SignedData.SignerInfos[%u].IssuerAndSerialNumber not found in T0.Certificates",
133	pszErrorTag, i);
134
135	/* DigestAlgorithm */
136	uint32_t j = 0;
137	while ( j < pSignedData->DigestAlgorithms.cItems
138	&& RTCrX509AlgorithmIdentifier_Compare(pSignedData->DigestAlgorithms.papItems[j],
139	&pSignerInfo->DigestAlgorithm) != 0)
140	j++;
141	if (j >= pSignedData->DigestAlgorithms.cItems)
142	return RTErrInfoSetF(pErrInfo, VERR_CR_PKCS7_DIGEST_ALGO_NOT_FOUND_IN_LIST,
143	"%s: SignedData.SignerInfos[%u].DigestAlgorithm (%s) not found in SignedData.DigestAlgorithms",
144	pszErrorTag, i, pSignerInfo->DigestAlgorithm.Algorithm.szObjId);
145
146	/* Digest encryption algorithm. */
147	#if 0 /** @todo Unimportant: Seen timestamp signatures specifying pkcs1-Sha256WithRsaEncryption in SignerInfo and just RSA in the certificate. Figure out how to compare the two. */
148	if ( pCert
149	&& RTCrX509AlgorithmIdentifier_Compare(&pSignerInfo->DigestEncryptionAlgorithm,
150	&pCert->TbsCertificate.SubjectPublicKeyInfo.Algorithm) != 0)
151	return RTErrInfoSetF(pErrInfo, VERR_CR_PKCS7_SIGNER_INFO_DIGEST_ENCRYPT_MISMATCH,
152	"SignedData.SignerInfos[%u].DigestEncryptionAlgorithm (%s) mismatch with certificate (%s)",
153	i, pSignerInfo->DigestEncryptionAlgorithm.Algorithm.szObjId,
154	pCert->TbsCertificate.SubjectPublicKeyInfo.Algorithm.Algorithm.szObjId);
155	#endif
156
157	/* Authenticated attributes we know. */
158	if (RTCrPkcs7Attributes_IsPresent(&pSignerInfo->AuthenticatedAttributes))
159	{
160	bool fFoundContentInfo = false;
161	bool fFoundMessageDigest = false;
162	for (j = 0; j < pSignerInfo->AuthenticatedAttributes.cItems; j++)
163	{
164	PCRTCRPKCS7ATTRIBUTE pAttrib = pSignerInfo->AuthenticatedAttributes.papItems[j];
165	if (RTAsn1ObjId_CompareWithString(&pAttrib->Type, RTCR_PKCS9_ID_CONTENT_TYPE_OID) == 0)
166	{
167	if (fFoundContentInfo)
168	return RTErrInfoSetF(pErrInfo, VERR_CR_PKCS7_MISSING_CONTENT_TYPE_ATTRIB,
169	"%s: Multiple authenticated content-type attributes.", pszErrorTag);
170	fFoundContentInfo = true;
171	AssertReturn(pAttrib->enmType == RTCRPKCS7ATTRIBUTETYPE_OBJ_IDS, VERR_INTERNAL_ERROR_3);
172	if (pAttrib->uValues.pObjIds->cItems != 1)
173	return RTErrInfoSetF(pErrInfo, VERR_CR_PKCS7_BAD_CONTENT_TYPE_ATTRIB,
174	"%s: Expected exactly one value for content-type attrib, found: %u",
175	pszErrorTag, pAttrib->uValues.pObjIds->cItems);
176	}
177	else if (RTAsn1ObjId_CompareWithString(&pAttrib->Type, RTCR_PKCS9_ID_MESSAGE_DIGEST_OID) == 0)
178	{
179	if (fFoundMessageDigest)
180	return RTErrInfoSetF(pErrInfo, VERR_CR_PKCS7_MISSING_MESSAGE_DIGEST_ATTRIB,
181	"%s: Multiple authenticated message-digest attributes.", pszErrorTag);
182	fFoundMessageDigest = true;
183	AssertReturn(pAttrib->enmType == RTCRPKCS7ATTRIBUTETYPE_OCTET_STRINGS, VERR_INTERNAL_ERROR_3);
184	if (pAttrib->uValues.pOctetStrings->cItems != 1)
185	return RTErrInfoSetF(pErrInfo, VERR_CR_PKCS7_BAD_CONTENT_TYPE_ATTRIB,
186	"%s: Expected exactly one value for message-digest attrib, found: %u",
187	pszErrorTag, pAttrib->uValues.pOctetStrings->cItems);
188	}
189	}
190
191	if (!fFoundContentInfo)
192	return RTErrInfoSetF(pErrInfo, VERR_CR_PKCS7_MISSING_CONTENT_TYPE_ATTRIB,
193	"%s: Missing authenticated content-type attribute.", pszErrorTag);
194	if (!fFoundMessageDigest)
195	return RTErrInfoSetF(pErrInfo, VERR_CR_PKCS7_MISSING_MESSAGE_DIGEST_ATTRIB,
196	"%s: Missing authenticated message-digest attribute.", pszErrorTag);
197	}
198	}
199
200	return VINF_SUCCESS;
201	}
202
203
204	/*
205	* Generate the code.
206	*/
207	#include <iprt/asn1-generator-sanity.h>
208

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Runtime/common/crypto/pkcs7-sanity.cpp@ 73603

Download in other formats: