VirtualBox

Changeset 52600 in vbox


Ignore:
Timestamp:
Sep 4, 2014 10:59:00 PM (10 years ago)
Author:
vboxsync
Message:

IPRT: Added support for microsoft timestamp counter signatures. This required making the PKCS #7 code accept some of the CMS (RFC-5652) stuff.

Location:
trunk
Files:
6 added
20 edited

Legend:

Unmodified
Added
Removed

  • trunk/include/iprt/asn1-generator-asn1-decoder.h

    r51770 r52600  
    2424 */
    2525
     26#include <iprt/string.h>
     27
    2628#define RTASN1TMPL_PASS RTASN1TMPL_PASS_DECODE
    2729#include <iprt/asn1-generator-pass.h>

  • trunk/include/iprt/asn1-generator-init.h

    r51770 r52600  
    2424 */
    2525
     26#include <iprt/string.h>
    2627
    2728#define RTASN1TMPL_PASS                 RTASN1TMPL_PASS_INIT

  • trunk/include/iprt/asn1-generator-pass.h

    r51919 r52600  
    10391039    { a_MoreConstraints }
    10401040
     1041# define RTASN1TMPL_MEMBER_CONSTR_U64_MIN_MAX(a_Name, uMin, uMax, a_MoreConstraints) \
     1042    if (RT_SUCCESS(rc)) \
     1043    { \
     1044        if (RT_UNLIKELY(   RTAsn1Integer_UnsignedCompareWithU64(&pThis->a_Name, uMin) < 0 \
     1045                        || RTAsn1Integer_UnsignedCompareWithU64(&pThis->a_Name, uMax) > 0) ) \
     1046            rc = RTErrInfoSetF(pErrInfo, VERR_GENERAL_FAILURE, \
     1047                               "%s::" #a_Name ": Out of range: %#x not in {%#llx..%#llx}", \
     1048                               pszErrorTag, pThis->a_Name.Asn1Core.cb > 8 ? UINT64_MAX : pThis->a_Name.uValue.u, \
     1049                               (uint64_t)(uMin), (uint64_t)(uMax)); \
     1050    } \
     1051    { a_MoreConstraints }
     1052
    10411053# define RTASN1TMPL_MEMBER_CONSTR_PRESENT(a_Name, a_Api, a_MoreConstraints) \
    10421054    if (RT_SUCCESS(rc) && RT_UNLIKELY(!RT_CONCAT(a_Api,_IsPresent)(&pThis->a_Name))) \
    … …  
    12591271    RTASN1TMPL_PCHOICE_ITAG_EX(a_uTag, a_enmChoice, a_PtrName, a_Name, a_Type, a_Api, RTASN1TMPL_ITAG_F_UP, RT_NOTHING)
    12601272#endif
     1273#ifndef RTASN1TMPL_PCHOICE_ITAG_UC
     1274# define RTASN1TMPL_PCHOICE_ITAG_UC(a_uTag, a_enmChoice, a_PtrName, a_Name, a_Type, a_Api) \
     1275    RTASN1TMPL_PCHOICE_ITAG_EX(a_uTag, a_enmChoice, a_PtrName, a_Name, a_Type, a_Api, RTASN1TMPL_ITAG_F_UC, RT_NOTHING)
     1276#endif
    12611277#ifndef RTASN1TMPL_PCHOICE_ITAG_CP
    12621278# define RTASN1TMPL_PCHOICE_ITAG_CP(a_uTag, a_enmChoice, a_PtrName, a_Name, a_Type, a_Api) \
    … …  
    12831299#ifndef RTASN1TMPL_MEMBER_CONSTR_BITSTRING_MIN_MAX
    12841300# define RTASN1TMPL_MEMBER_CONSTR_BITSTRING_MIN_MAX(a_Name, cMinBits, cMaxBits, a_MoreConstraints)
     1301#endif
     1302#ifndef RTASN1TMPL_MEMBER_CONSTR_U64_MIN_MAX
     1303# define RTASN1TMPL_MEMBER_CONSTR_U64_MIN_MAX(a_Name, uMin, uMax, a_MoreConstraints)
    12851304#endif
    12861305#ifndef RTASN1TMPL_MEMBER_CONSTR_PRESENT
    … …  
    13721391#undef RTASN1TMPL_MEMBER_CONSTR_MIN_MAX
    13731392#undef RTASN1TMPL_MEMBER_CONSTR_BITSTRING_MIN_MAX
     1393#undef RTASN1TMPL_MEMBER_CONSTR_U64_MIN_MAX
    13741394#undef RTASN1TMPL_MEMBER_CONSTR_PRESENT
    13751395

  • trunk/include/iprt/asn1.h

    r52537 r52600  
    397397
    398398
    399 /** Aliases two ASN.1 types. */
     399/** Aliases two ASN.1 types, no method aliases. */
     400#define RTASN1TYPE_ALIAS_TYPE_ONLY(a_TypeNm, a_AliasType) \
     401    typedef a_AliasType a_TypeNm; \
     402    typedef a_TypeNm *RT_CONCAT(P,a_TypeNm); \
     403    typedef a_TypeNm const *RT_CONCAT(PC,a_TypeNm)
     404
     405/** Aliases two ASN.1 types and methods. */
    400406#define RTASN1TYPE_ALIAS(a_TypeNm, a_AliasType, a_ImplExtNm, a_AliasExtNm) \
    401407    typedef a_AliasType a_TypeNm; \

  • trunk/include/iprt/crypto/pkcs7.h

    r52537 r52600  
    8585    /** Signing time (PKCS \#9), use pSigningTime. */
    8686    RTCRPKCS7ATTRIBUTETYPE_SIGNING_TIME,
     87    /** Microsoft timestamp info (RFC-3161) signed data, use pContentInfo. */
     88    RTCRPKCS7ATTRIBUTETYPE_MS_TIMESTAMP,
    8789    /** Blow the type up to 32-bits. */
    8890    RTCRPKCS7ATTRIBUTETYPE_32BIT_HACK = 0x7fffffff
    … …  
    115117        /** Signing time(s) (RTCRPKCS7ATTRIBUTETYPE_SIGNING_TIME). */
    116118        PRTASN1SETOFTIMES               pSigningTime;
     119        /** Microsoft timestamp (RFC-3161 signed data). */
     120        struct RTCRPKCS7SETOFCONTENTINFOS *pContentInfos;
    117121    } uValues;
    118122} RTCRPKCS7ATTRIBUTE;
    … …  
    173177 * Value: SignerInfo. */
    174178#define RTCR_PKCS9_ID_COUNTER_SIGNATURE_OID "1.2.840.113549.1.9.6"
     179/** Microsoft timestamp (RTF-3161) counter signature (SignedData).
     180 * @remarks This isn't defined by PKCS \#9, but lumped in here for
     181 *          convenience.  It's actually listed as SPC by MS. */
     182#define RTCR_PKCS9_ID_MS_TIMESTAMP          "1.3.6.1.4.1.311.3.3.1"
    175183/** @} */
     184
    176185
    177186/**
    … …  
    193202 */
    194203RTDECL(PCRTASN1TIME) RTCrPkcs7SignerInfo_GetSigningTime(PCRTCRPKCS7SIGNERINFO pThis, PCRTCRPKCS7SIGNERINFO *ppSignerInfo);
     204
     205
     206/**
     207 * Get the (first) timestamp from within a Microsoft timestamp server counter
     208 * signature.
     209 *
     210 * @returns Pointer to the signing time if found, NULL if not.
     211 * @param   pThis               The SignerInfo to search.
     212 * @param   ppContentInfo       Where to return the pointer to the counter
     213 *                              signature, optional.
     214 */
     215RTDECL(PCRTASN1TIME) RTCrPkcs7SignerInfo_GetMsTimestamp(PCRTCRPKCS7SIGNERINFO pThis,
     216                                                        struct RTCRPKCS7CONTENTINFO const **ppContentInfo);
    195217
    196218
    … …  
    223245     */
    224246    RTASN1OCTETSTRING                   Content;
     247    /** Pointer to the CMS octet string that's inside the Content, NULL if PKCS \#7.
     248     *
     249     * Hack alert! When transitioning from PKCS \#7 to CMS, the designers decided to
     250     * change things and add another wrapper.  This time we're talking about a real
     251     * octet string, not like the one above which is really an explicit content tag.
     252     * When constructing or decoding CMS content, this will be the same pointer as
     253     * Content.pEncapsulated, while the union below will be holding the same pointer
     254     * as pCmsContent->pEncapsulated.
     255     */
     256    PRTASN1OCTETSTRING                  pCmsContent;
    225257    /** Same as Content.pEncapsulated, except a choice of known types. */
    226258    union
    … …  
    230262        /** ContentType is RTCRSPCINDIRECTDATACONTENT_OID. */
    231263        struct RTCRSPCINDIRECTDATACONTENT  *pIndirectDataContent;
     264        /** ContentType is RTCRTSPTSTINFO_OID. */
     265        struct RTCRTSPTSTINFO              *pTstInfo;
    232266        /** Generic / Unknown / User. */
    233267        PRTASN1CORE                         pCore;
    … …  
    238272/** Pointer to the const IPRT representation of a PKCS \#7 ContentInfo. */
    239273typedef RTCRPKCS7CONTENTINFO const *PCRTCRPKCS7CONTENTINFO;
    240 
    241274RTASN1TYPE_STANDARD_PROTOTYPES(RTCRPKCS7CONTENTINFO, RTDECL, RTCrPkcs7ContentInfo, SeqCore.Asn1Core);
     275RTASN1_IMPL_GEN_SET_OF_TYPEDEFS_AND_PROTOS(RTCRPKCS7SETOFCONTENTINFOS, RTCRPKCS7CONTENTINFO, RTDECL, RTCrPkcs7SetOfContentInfos);
    242276
    243277RTDECL(bool) RTCrPkcs7ContentInfo_IsSignedData(PCRTCRPKCS7CONTENTINFO pThis);
     278
     279
     280/**
     281 * PKCS \#7 Certificate choice.
     282 */
     283typedef enum RTCRPKCS7CERTCHOICE
     284{
     285    RTCRPKCS7CERTCHOICE_INVALID = 0,
     286    RTCRPKCS7CERTCHOICE_X509,
     287    RTCRPKCS7CERTCHOICE_EXTENDED_PKCS6,
     288    RTCRPKCS7CERTCHOICE_AC_V1,
     289    RTCRPKCS7CERTCHOICE_AC_V2,
     290    RTCRPKCS7CERTCHOICE_OTHER,
     291    RTCRPKCS7CERTCHOICE_END,
     292    RTCRPKCS7CERTCHOICE_32BIT_HACK = 0x7fffffff
     293} RTCRPKCS7CERTCHOICE;
     294
     295
     296/**
     297 * Common representation for PKCS \#7 ExtendedCertificateOrCertificate and the
     298 * CMS CertificateChoices types.
     299 */
     300typedef struct RTCRPKCS7CERT
     301{
     302    /** Dummy ASN.1 record, not encoded. */
     303    RTASN1DUMMY                         Dummy;
     304    /** The value allocation. */
     305    RTASN1ALLOCATION                    Allocation;
     306    /** The choice of value.   */
     307    RTCRPKCS7CERTCHOICE                 enmChoice;
     308    /** The value union. */
     309    union
     310    {
     311        /** Standard X.509 certificate (RTCRCMSCERTIFICATECHOICE_X509). */
     312        PRTCRX509CERTIFICATE            pX509Cert;
     313        /** Extended PKCS \#6 certificate (RTCRCMSCERTIFICATECHOICE_EXTENDED_PKCS6). */
     314        PRTASN1CORE                     pExtendedCert;
     315        /** Attribute certificate version 1 (RTCRCMSCERTIFICATECHOICE_AC_V1). */
     316        PRTASN1CORE                     pAcV1;
     317        /** Attribute certificate version 2 (RTCRCMSCERTIFICATECHOICE_AC_V2). */
     318        PRTASN1CORE                     pAcV2;
     319        /** Other certificate (RTCRCMSCERTIFICATECHOICE_OTHER). */
     320        PRTASN1CORE                     pOtherCert;
     321    } u;
     322} RTCRPKCS7CERT;
     323/** Pointer to the IPRT representation of PKCS \#7 or CMS certificate. */
     324typedef RTCRPKCS7CERT *PRTCRPKCS7CERT;
     325/** Pointer to the const IPRT representation of PKCS \#7 or CMS certificate. */
     326typedef RTCRPKCS7CERT const *PCRTCRPKCS7CERT;
     327RTASN1TYPE_STANDARD_PROTOTYPES(RTCRPKCS7CERT, RTDECL, RTCrPkcs7Cert, Dummy.Asn1Core);
     328RTASN1_IMPL_GEN_SET_OF_TYPEDEFS_AND_PROTOS(RTCRPKCS7SETOFCERTS, RTCRPKCS7CERT, RTDECL, RTCrPkcs7SetOfCerts);
     329
     330RTDECL(PCRTCRX509CERTIFICATE) RTCrPkcs7SetOfCerts_FindX509ByIssuerAndSerialNumber(PCRTCRPKCS7SETOFCERTS pCertificates,
     331                                                                                  PCRTCRX509NAME pIssuer,
     332                                                                                  PCRTASN1INTEGER pSerialNumber);
    244333
    245334
    … …  
    258347    RTCRPKCS7CONTENTINFO                ContentInfo;
    259348    /** Certificates, optional, implicit tag 0. (Required by Authenticode.) */
    260     RTCRX509CERTIFICATES                Certificates;
     349    RTCRPKCS7SETOFCERTS                 Certificates;
    261350    /** Certificate revocation lists, optional, implicit tag 1.
    262351     * Not used by Authenticode, so currently stubbed. */
    … …  
    270359typedef RTCRPKCS7SIGNEDDATA const *PCRTCRPKCS7SIGNEDDATA;
    271360RTASN1TYPE_STANDARD_PROTOTYPES(RTCRPKCS7SIGNEDDATA, RTDECL, RTCrPkcs7SignedData, SeqCore.Asn1Core);
     361RTASN1_IMPL_GEN_SET_OF_TYPEDEFS_AND_PROTOS(RTCRPKCS7SETOFSIGNEDDATA, RTCRPKCS7SIGNEDDATA, RTDECL, RTCrPkcs7SetOfSignedData);
    272362
    273363/** PKCS \#7 SignedData object ID.  */
    … …  
    276366/** PKCS \#7 SignedData version number 1.  */
    277367#define RTCRPKCS7SIGNEDDATA_V1    1
     368/* No version 2 seems to exist. */
     369/** CMS SignedData version number 3.
     370 * This should only be used if there are version 1 attribute certificates
     371 * present, or if there are version 3 SignerInfo items present, or if
     372 * enmcCountInfo is not id-data (RFC-5652, section 5.1). */
     373#define RTCRPKCS7SIGNEDDATA_V3    3
     374/** CMS SignedData version number 4.
     375 * This should only be used if there are version 2 attribute certificates
     376 * present (RFC-5652, section 5.1). */
     377#define RTCRPKCS7SIGNEDDATA_V4    4
     378/** CMS SignedData version number 5.
     379 * This should only be used if there are certificates or/and CRLs of the
     380 * OTHER type present (RFC-5652, section 5.1). */
     381#define RTCRPKCS7SIGNEDDATA_V5    5
    278382
    279383
    … …  
    384488 * signing time attributes and use the @a pValidationTime instead. */
    385489#define RTCRPKCS7VERIFY_SD_F_ALWAYS_USE_SIGNING_TIME_IF_PRESENT     RT_BIT_32(0)
     490/** Same as RTCRPKCS7VERIFY_SD_F_ALWAYS_USE_SIGNING_TIME_IF_PRESENT for the MS
     491 *  timestamp counter sigantures. */
     492#define RTCRPKCS7VERIFY_SD_F_ALWAYS_USE_MS_TIMESTAMP_IF_PRESENT     RT_BIT_32(1)
    386493/** Only use signging time attributes from counter signatures. */
    387 #define RTCRPKCS7VERIFY_SD_F_COUNTER_SIGNATURE_SIGNING_TIME_ONLY    RT_BIT_32(1)
     494#define RTCRPKCS7VERIFY_SD_F_COUNTER_SIGNATURE_SIGNING_TIME_ONLY    RT_BIT_32(2)
    388495/** Don't validate the counter signature containing the signing time, just use
    389496 * it unverified.  This is useful if we don't necessarily have the root
    390  * certificates for the timestamp server handy, but use with great care. */
    391 #define RTCRPKCS7VERIFY_SD_F_USE_SIGNING_TIME_UNVERIFIED            RT_BIT_32(2)
     497 * certificates for the timestamp server handy, but use with great care.
     498 * @sa RTCRPKCS7VERIFY_SD_F_USE_MS_TIMESTAMP_UNVERIFIED */
     499#define RTCRPKCS7VERIFY_SD_F_USE_SIGNING_TIME_UNVERIFIED            RT_BIT_32(3)
     500/** Don't validate the MS counter signature containing the signing timestamp.
     501 * @sa RTCRPKCS7VERIFY_SD_F_USE_SIGNING_TIME_UNVERIFIED */
     502#define RTCRPKCS7VERIFY_SD_F_USE_MS_TIMESTAMP_UNVERIFIED            RT_BIT_32(4)
     503/** Do not consider timestamps in microsoft counter signatures. */
     504#define RTCRPKCS7VERIFY_SD_F_IGNORE_MS_TIMESTAMP                    RT_BIT_32(5)
     505/** The signed data requires certificates to have the timestamp extended
     506 * usage bit present.  This is used for recursivly verifying MS timestamp
     507 * signatures. */
     508#define RTCRPKCS7VERIFY_SD_F_USAGE_TIMESTAMPING                     RT_BIT_32(6)
     509
    392510/** Indicates internally that we're validating a counter signature and should
    393511 * use different rules when checking out the authenticated attributes.

  • trunk/include/iprt/crypto/x509.h

    r52537 r52600  
    10231023RTDECL(int) RTCrX509CertPathsSetUntrustedStore(RTCRX509CERTPATHS hCertPaths, RTCRSTORE hUntrustedStore);
    10241024RTDECL(int) RTCrX509CertPathsSetUntrustedArray(RTCRX509CERTPATHS hCertPaths, PCRTCRX509CERTIFICATE paCerts, uint32_t cCerts);
     1025RTDECL(int) RTCrX509CertPathsSetUntrustedSet(RTCRX509CERTPATHS hCertPaths, struct RTCRPKCS7SETOFCERTS const *pSetOfCerts);
    10251026RTDECL(int) RTCrX509CertPathsSetValidTime(RTCRX509CERTPATHS hCertPaths, PCRTTIME pTime);
    10261027RTDECL(int) RTCrX509CertPathsSetValidTimeSpec(RTCRX509CERTPATHS hCertPaths, PCRTTIMESPEC pTimeSpec);

  • trunk/include/iprt/mangling.h

    r52539 r52600  
    23972397# define RTCrPkcs7SignerInfo_Enum                       RT_MANGLER(RTCrPkcs7SignerInfo_Enum)
    23982398# define RTCrPkcs7SignerInfo_GetSigningTime             RT_MANGLER(RTCrPkcs7SignerInfo_GetSigningTime)
     2399# define RTCrPkcs7SignerInfo_GetMsTimestamp             RT_MANGLER(RTCrPkcs7SignerInfo_GetMsTimestamp)
    23992400# define RTCrPkcs7SignerInfos_Compare                   RT_MANGLER(RTCrPkcs7SignerInfos_Compare)
    24002401# define RTCrPkcs7SignerInfos_Delete                    RT_MANGLER(RTCrPkcs7SignerInfos_Delete)
    … …  
    27602761# define RTCrTafTrustAnchorInfo_CheckSanity             RT_MANGLER(RTCrTafTrustAnchorInfo_CheckSanity)
    27612762# define RTCrTafTrustAnchorList_CheckSanity             RT_MANGLER(RTCrTafTrustAnchorList_CheckSanity)
     2763# define RTCrTspAccuracy_CheckSanity                    RT_MANGLER(RTCrTspAccuracy_CheckSanity)
     2764# define RTCrTspAccuracy_Clone                          RT_MANGLER(RTCrTspAccuracy_Clone)
     2765# define RTCrTspAccuracy_Compare                        RT_MANGLER(RTCrTspAccuracy_Compare)
     2766# define RTCrTspAccuracy_DecodeAsn1                     RT_MANGLER(RTCrTspAccuracy_DecodeAsn1)
     2767# define RTCrTspAccuracy_Delete                         RT_MANGLER(RTCrTspAccuracy_Delete)
     2768# define RTCrTspAccuracy_Enum                           RT_MANGLER(RTCrTspAccuracy_Enum)
     2769# define RTCrTspAccuracy_Init                           RT_MANGLER(RTCrTspAccuracy_Init)
     2770# define RTCrTspMessageImprint_CheckSanity              RT_MANGLER(RTCrTspMessageImprint_CheckSanity)
     2771# define RTCrTspMessageImprint_Clone                    RT_MANGLER(RTCrTspMessageImprint_Clone)
     2772# define RTCrTspMessageImprint_Compare                  RT_MANGLER(RTCrTspMessageImprint_Compare)
     2773# define RTCrTspMessageImprint_DecodeAsn1               RT_MANGLER(RTCrTspMessageImprint_DecodeAsn1)
     2774# define RTCrTspMessageImprint_Delete                   RT_MANGLER(RTCrTspMessageImprint_Delete)
     2775# define RTCrTspMessageImprint_Enum                     RT_MANGLER(RTCrTspMessageImprint_Enum)
     2776# define RTCrTspMessageImprint_Init                     RT_MANGLER(RTCrTspMessageImprint_Init)
     2777# define RTCrTspTstInfo_CheckSanity                     RT_MANGLER(RTCrTspTstInfo_CheckSanity)
     2778# define RTCrTspTstInfo_Clone                           RT_MANGLER(RTCrTspTstInfo_Clone)
     2779# define RTCrTspTstInfo_Compare                         RT_MANGLER(RTCrTspTstInfo_Compare)
     2780# define RTCrTspTstInfo_DecodeAsn1                      RT_MANGLER(RTCrTspTstInfo_DecodeAsn1)
     2781# define RTCrTspTstInfo_Delete                          RT_MANGLER(RTCrTspTstInfo_Delete)
     2782# define RTCrTspTstInfo_Enum                            RT_MANGLER(RTCrTspTstInfo_Enum)
     2783# define RTCrTspTstInfo_Init                            RT_MANGLER(RTCrTspTstInfo_Init)
    27622784# define RTCrCertCtxRelease                             RT_MANGLER(RTCrCertCtxRelease)
    27632785# define RTCrCertCtxRetain                              RT_MANGLER(RTCrCertCtxRetain)

  • trunk/src/VBox/HostDrivers/Support/Makefile.kmk

    r52406 r52600  
    281281        $(VBOX_PATH_RUNTIME_SRC)/common/crypto/taf-init.cpp \
    282282        $(VBOX_PATH_RUNTIME_SRC)/common/crypto/taf-sanity.cpp \
     283        $(VBOX_PATH_RUNTIME_SRC)/common/crypto/tsp-asn1-decoder.cpp \
     284        $(VBOX_PATH_RUNTIME_SRC)/common/crypto/tsp-core.cpp \
     285        $(VBOX_PATH_RUNTIME_SRC)/common/crypto/tsp-init.cpp \
     286        $(VBOX_PATH_RUNTIME_SRC)/common/crypto/tsp-sanity.cpp \
    283287        $(VBOX_PATH_RUNTIME_SRC)/common/checksum/alt-md2.cpp \
    284288        $(VBOX_PATH_RUNTIME_SRC)/common/checksum/alt-md5.cpp \

  • trunk/src/VBox/HostDrivers/Support/win/SUPHardenedVerifyImage-win.cpp

    r52541 r52600  
    10041004
    10051005    uint32_t fFlags = RTCRPKCS7VERIFY_SD_F_ALWAYS_USE_SIGNING_TIME_IF_PRESENT
     1006                    | RTCRPKCS7VERIFY_SD_F_ALWAYS_USE_MS_TIMESTAMP_IF_PRESENT
    10061007                    | RTCRPKCS7VERIFY_SD_F_COUNTER_SIGNATURE_SIGNING_TIME_ONLY;
    10071008#ifndef IN_RING0
    10081009    if (!g_fHaveOtherRoots)
    10091010#endif
    1010         fFlags |= RTCRPKCS7VERIFY_SD_F_USE_SIGNING_TIME_UNVERIFIED;
     1011        fFlags |= RTCRPKCS7VERIFY_SD_F_USE_SIGNING_TIME_UNVERIFIED | RTCRPKCS7VERIFY_SD_F_USE_MS_TIMESTAMP_UNVERIFIED;
    10111012    return RTCrPkcs7VerifySignedData(pContentInfo, fFlags, g_hSpcAndNtKernelSuppStore, g_hSpcAndNtKernelRootStore,
    10121013                                     &ValidationTime, supHardNtViCertVerifyCallback, pNtViRdr, pErrInfo);

  • trunk/src/VBox/Runtime/Makefile.kmk

    r52443 r52600  
    359359        common/crypto/taf-init.cpp \
    360360        common/crypto/taf-sanity.cpp \
     361        common/crypto/tsp-asn1-decoder.cpp \
     362        common/crypto/tsp-core.cpp \
     363        common/crypto/tsp-init.cpp \
     364        common/crypto/tsp-sanity.cpp \
    361365        common/crypto/store.cpp \
    362366        common/crypto/store-inmem.cpp \
    … …  
    19201924        common/crypto/taf-init.cpp \
    19211925        common/crypto/taf-sanity.cpp \
     1926        common/crypto/tsp-asn1-decoder.cpp \
     1927        common/crypto/tsp-core.cpp \
     1928        common/crypto/tsp-init.cpp \
     1929        common/crypto/tsp-sanity.cpp \
    19221930        common/checksum/alt-md2.cpp \
    19231931        common/checksum/alt-sha1.cpp \
    … …  
    27342742spc-template.o spc-template.obj: spc-core.o spc-asn1-decoder.o spc-sanity.o spc-init.o
    27352743taf-template.o taf-template.obj: taf-core.o taf-asn1-decoder.o taf-sanity.o taf-init.o
     2744tsp-template.o tsp-template.obj: tsp-core.o tsp-asn1-decoder.o tsp-sanity.o tsp-init.o
    27362745x509-template.o x509-template.obj: x509-core.o x509-asn1-decoder.o x509-sanity.o x509-init.o
    27372746pkcs7-template.o pkcs7-template.obj: pkcs7-core.o pkcs7-asn1-decoder.o pkcs7-sanity.o pkcs7-init.o

  • trunk/src/VBox/Runtime/common/asn1/asn1-cursor.cpp

    r52533 r52600  
    2828*   Header Files                                                               *
    2929*******************************************************************************/
     30#define RT_STRICT
    3031#include "internal/iprt.h"
    3132#include <iprt/asn1.h>
    … …  
    4748 *
    4849 * For reference, 'RTSignTool verify-exe RTSignTool.exe', requires a value of 15
    49  * to work without hitting the limit.
     50 * to work without hitting the limit for signatures with simple timestamps, and
     51 * 23 (amd64/rel = ~3KB) for the new microsoft timestamp counter signatures.
    5052 */
    5153#ifdef IN_RING3

  • trunk/src/VBox/Runtime/common/asn1/asn1-dump.cpp

    r51858 r52600  
    8484static void rtAsn1DumpPrintIdent(PRTASN1DUMPDATA pData, uint32_t uDepth)
    8585{
    86     uint32_t i = 0;
    87     uDepth *= 2;
    88     while (i < uDepth)
     86    uint32_t cchLeft = uDepth * 2;
     87    while (cchLeft > 0)
    8988    {
    9089        static char const s_szSpaces[] = "                                        ";
    91         uint32_t cch = RT_MIN(uDepth, sizeof(s_szSpaces) - 1);
     90        uint32_t cch = RT_MIN(cchLeft, sizeof(s_szSpaces) - 1);
    9291        rtAsn1DumpPrintf(pData, &s_szSpaces[sizeof(s_szSpaces) - 1 - cch]);
    93         i += cch;
     92        cchLeft -= cch;
    9493    }
    9594}

  • trunk/src/VBox/Runtime/common/asn1/asn1-ut-time-decode.cpp

    r51770 r52600  
    178178     * Check the dot.
    179179     */
    180     if (*pchFraction == '.')
     180    if (*pchFraction != '.')
    181181        return RTAsn1CursorSetInfo(pCursor, VERR_ASN1_INVALID_GENERALIZED_TIME_ENCODING,
    182182                                   "%s: Expected GeneralizedTime fraction dot, found: '%c' ('%.*s')",

  • trunk/src/VBox/Runtime/common/crypto/pkcs7-asn1-decoder.cpp

    r52533 r52600  
    3535#include <iprt/string.h>
    3636#include <iprt/crypto/spc.h>
     37#include <iprt/crypto/tsp.h>
    3738
    3839#include "pkcs7-internal.h"
    … …  
    4243 * PKCS #7 ContentInfo
    4344 */
     45typedef enum RTCRPKCS7CONTENTINFOCHOICE
     46{
     47    RTCRPKCS7CONTENTINFOCHOICE_INVALID = 0,
     48    RTCRPKCS7CONTENTINFOCHOICE_UNKNOWN,
     49    RTCRPKCS7CONTENTINFOCHOICE_SIGNED_DATA,
     50    RTCRPKCS7CONTENTINFOCHOICE_SPC_INDIRECT_DATA_CONTENT,
     51    RTCRPKCS7CONTENTINFOCHOICE_TSP_TST_INFO,
     52    RTCRPKCS7CONTENTINFOCHOICE_END,
     53    RTCRPKCS7CONTENTINFOCHOICE_32BIT_HACK = 0x7fffffff
     54} RTCRPKCS7CONTENTINFOCHOICE;
    4455
    4556static int rtCrPkcs7ContentInfo_DecodeExtra(PRTASN1CURSOR pCursor, uint32_t fFlags, PRTCRPKCS7CONTENTINFO pThis,
    … …  
    4859    pThis->u.pCore = NULL;
    4960
    50     int             rc;
    51     RTASN1CURSOR    ContentCursor;
     61    /*
     62     * Figure the type.
     63     */
     64    RTCRPKCS7CONTENTINFOCHOICE  enmChoice;
     65    size_t                      cbContent = 0;
    5266    if (RTAsn1ObjId_CompareWithString(&pThis->ContentType, RTCRPKCS7SIGNEDDATA_OID) == 0)
    5367    {
    54         rc = RTAsn1MemAllocZ(&pThis->Content.EncapsulatedAllocation, (void **)&pThis->Content.pEncapsulated,
    55                              sizeof(*pThis->u.pSignedData));
    56         if (RT_SUCCESS(rc))
    57         {
    58             pThis->u.pCore = pThis->Content.pEncapsulated;
    59             rc = RTAsn1CursorInitSubFromCore(pCursor, &pThis->Content.Asn1Core, &ContentCursor, "Content");
    60             if (RT_SUCCESS(rc))
    61                 rc = RTCrPkcs7SignedData_DecodeAsn1(&ContentCursor, 0, pThis->u.pSignedData, "SignedData");
    62         }
     68        enmChoice = RTCRPKCS7CONTENTINFOCHOICE_SIGNED_DATA;
     69        cbContent = sizeof(*pThis->u.pSignedData);
    6370    }
    6471    else if (RTAsn1ObjId_CompareWithString(&pThis->ContentType, RTCRSPCINDIRECTDATACONTENT_OID) == 0)
    6572    {
    66         rc = RTAsn1MemAllocZ(&pThis->Content.EncapsulatedAllocation, (void **)&pThis->Content.pEncapsulated,
    67                              sizeof(*pThis->u.pIndirectDataContent));
     73        enmChoice = RTCRPKCS7CONTENTINFOCHOICE_SPC_INDIRECT_DATA_CONTENT;
     74        cbContent = sizeof(*pThis->u.pIndirectDataContent);
     75    }
     76    else if (RTAsn1ObjId_CompareWithString(&pThis->ContentType, RTCRTSPTSTINFO_OID) == 0)
     77    {
     78        enmChoice = RTCRPKCS7CONTENTINFOCHOICE_TSP_TST_INFO;
     79        cbContent = sizeof(*pThis->u.pTstInfo);
     80    }
     81    else
     82    {
     83        enmChoice = RTCRPKCS7CONTENTINFOCHOICE_UNKNOWN;
     84        cbContent = 0;
     85    }
     86
     87    int rc = VINF_SUCCESS;
     88    if (enmChoice != RTCRPKCS7CONTENTINFOCHOICE_UNKNOWN)
     89    {
     90        /*
     91         * Detect CMS octet string and open the content cursor.
     92         * Current we don't have work with any contet which is octet string,
     93         * they're all sequences, which make detection so much simpler.
     94         */
     95        PRTASN1OCTETSTRING  pOctetString = &pThis->Content;
     96        RTASN1CURSOR        ContentCursor;
     97        rc = RTAsn1CursorInitSubFromCore(pCursor, &pThis->Content.Asn1Core, &ContentCursor, "Content");
     98        if (   RT_SUCCESS(rc)
     99            && RTAsn1CursorIsNextEx(&ContentCursor, ASN1_TAG_OCTET_STRING, ASN1_TAGFLAG_PRIMITIVE | ASN1_TAGCLASS_UNIVERSAL))
     100        {
     101            rc = RTAsn1MemAllocZ(&pThis->Content.EncapsulatedAllocation, (void **)&pThis->Content.pEncapsulated,
     102                                 sizeof(*pOctetString));
     103            if (RT_SUCCESS(rc))
     104            {
     105                pThis->pCmsContent = pOctetString = (PRTASN1OCTETSTRING)pThis->Content.pEncapsulated;
     106                rc = RTAsn1OctetString_DecodeAsn1(&ContentCursor, 0, pOctetString, "CmsContent");
     107                if (RT_SUCCESS(rc))
     108                    rc = RTAsn1CursorCheckEnd(&ContentCursor);
     109                if (RT_SUCCESS(rc))
     110                    rc = RTAsn1CursorInitSubFromCore(pCursor, &pOctetString->Asn1Core, &ContentCursor, "CmsContent");
     111            }
     112        }
    68113        if (RT_SUCCESS(rc))
    69114        {
    70             pThis->u.pCore = pThis->Content.pEncapsulated;
    71             rc = RTAsn1CursorInitSubFromCore(pCursor, &pThis->Content.Asn1Core, &ContentCursor, "Content");
     115            /*
     116             * Allocate memory for the decoded content.
     117             */
     118            rc = RTAsn1MemAllocZ(&pOctetString->EncapsulatedAllocation, (void **)&pOctetString->pEncapsulated, cbContent);
    72119            if (RT_SUCCESS(rc))
    73                 rc = RTCrSpcIndirectDataContent_DecodeAsn1(&ContentCursor, 0, pThis->u.pIndirectDataContent, "IndirectDataContent");
     120            {
     121                pThis->u.pCore = pOctetString->pEncapsulated;
     122
     123                /*
     124                 * Decode it.
     125                 */
     126                switch (enmChoice)
     127                {
     128                    case RTCRPKCS7CONTENTINFOCHOICE_SIGNED_DATA:
     129                        rc = RTCrPkcs7SignedData_DecodeAsn1(&ContentCursor, 0, pThis->u.pSignedData, "SignedData");
     130                        break;
     131                    case RTCRPKCS7CONTENTINFOCHOICE_SPC_INDIRECT_DATA_CONTENT:
     132                        rc = RTCrSpcIndirectDataContent_DecodeAsn1(&ContentCursor, 0, pThis->u.pIndirectDataContent,
     133                                                                   "IndirectDataContent");
     134                        break;
     135                    case RTCRPKCS7CONTENTINFOCHOICE_TSP_TST_INFO:
     136                        rc = RTCrTspTstInfo_DecodeAsn1(&ContentCursor, 0, pThis->u.pTstInfo, "TstInfo");
     137                        break;
     138                    default:
     139                        AssertFailed();
     140                        rc = VERR_IPE_NOT_REACHED_DEFAULT_CASE;
     141                        break;
     142                }
     143                if (RT_SUCCESS(rc))
     144                    rc = RTAsn1CursorCheckEnd(&ContentCursor);
     145                if (RT_SUCCESS(rc))
     146                    return VINF_SUCCESS;
     147
     148                RTAsn1MemFree(&pOctetString->EncapsulatedAllocation, pOctetString->pEncapsulated);
     149                pOctetString->pEncapsulated = NULL;
     150                pThis->u.pCore = NULL;
     151            }
    74152        }
    75153    }
    76     else
    77         return VINF_SUCCESS;
    78 
    79     if (RT_SUCCESS(rc))
    80         rc = RTAsn1CursorCheckEnd(&ContentCursor);
    81     if (RT_SUCCESS(rc))
    82         return VINF_SUCCESS;
    83154    return rc;
    84155}

  • trunk/src/VBox/Runtime/common/crypto/pkcs7-core.cpp

    r52537 r52600  
    3434#include <iprt/err.h>
    3535#include <iprt/string.h>
     36#include <iprt/crypto/tsp.h>
    3637
    3738#include "pkcs7-internal.h"
    … …  
    127128
    128129
     130RTDECL(PCRTASN1TIME) RTCrPkcs7SignerInfo_GetMsTimestamp(PCRTCRPKCS7SIGNERINFO pThis, PCRTCRPKCS7CONTENTINFO *ppContentInfo)
     131{
     132    /*
     133     * Assume there is only one, so no need to enumerate anything here.
     134     */
     135    uint32_t             cAttrsLeft = pThis->UnauthenticatedAttributes.cItems;
     136    PCRTCRPKCS7ATTRIBUTE pAttr      = pThis->UnauthenticatedAttributes.paItems;
     137    while (cAttrsLeft-- > 0)
     138    {
     139        if (pAttr->enmType == RTCRPKCS7ATTRIBUTETYPE_MS_TIMESTAMP)
     140        {
     141            uint32_t                cLeft        = pAttr->uValues.pContentInfos->cItems;
     142            PCRTCRPKCS7CONTENTINFO  pContentInfo = &pAttr->uValues.pContentInfos->paItems[0];
     143            while (cLeft-- > 0)
     144            {
     145                if (RTAsn1ObjId_CompareWithString(&pContentInfo->ContentType, RTCRPKCS7SIGNEDDATA_OID) == 0)
     146                {
     147                    if (RTAsn1ObjId_CompareWithString(&pContentInfo->u.pSignedData->ContentInfo.ContentType,
     148                                                      RTCRTSPTSTINFO_OID) == 0)
     149                    {
     150                        if (ppContentInfo)
     151                            *ppContentInfo = pContentInfo;
     152                        return &pContentInfo->u.pSignedData->ContentInfo.u.pTstInfo->GenTime;
     153                    }
     154                }
     155
     156                pContentInfo++;
     157            }
     158        }
     159        pAttr++;
     160    }
     161
     162    /*
     163     * No signature was found.
     164     */
     165    if (ppContentInfo)
     166        *ppContentInfo = NULL;
     167
     168    return NULL;
     169}
     170
     171
    129172/*
    130173 * PCKS #7 ContentInfo.
    … …  
    138181
    139182/*
     183 * Set of some kind of certificate supported by PKCS #7 or CMS.
     184 */
     185
     186RTDECL(PCRTCRX509CERTIFICATE)
     187RTCrPkcs7SetOfCerts_FindX509ByIssuerAndSerialNumber(PCRTCRPKCS7SETOFCERTS pCertificates,
     188                                                    PCRTCRX509NAME pIssuer, PCRTASN1INTEGER pSerialNumber)
     189{
     190    for (uint32_t i = 0; i < pCertificates->cItems; i++)
     191        if (   pCertificates->paItems[i].enmChoice == RTCRPKCS7CERTCHOICE_X509
     192            && RTCrX509Certificate_MatchIssuerAndSerialNumber(pCertificates->paItems[i].u.pX509Cert, pIssuer, pSerialNumber))
     193            return pCertificates->paItems[i].u.pX509Cert;
     194    return NULL;
     195}
     196
     197
     198/*
    140199 * Generate the standard core code.
    141200 */

  • trunk/src/VBox/Runtime/common/crypto/pkcs7-sanity.cpp

    r51770 r52600  
    4747    //RTAsn1Dump(&pSignedData->SeqCore.Asn1Core, 0, 0, RTAsn1DumpStrmPrintfV, g_pStdOut);
    4848
    49     if (RTAsn1Integer_UnsignedCompareWithU32(&pSignedData->Version, RTCRPKCS7SIGNEDDATA_V1) != 0)
     49    if (   RTAsn1Integer_UnsignedCompareWithU32(&pSignedData->Version, RTCRPKCS7SIGNEDDATA_V1) != 0
     50        && RTAsn1Integer_UnsignedCompareWithU32(&pSignedData->Version, RTCRPKCS7SIGNEDDATA_V3) != 0
     51        && RTAsn1Integer_UnsignedCompareWithU32(&pSignedData->Version, RTCRPKCS7SIGNEDDATA_V4) != 0
     52        && RTAsn1Integer_UnsignedCompareWithU32(&pSignedData->Version, RTCRPKCS7SIGNEDDATA_V5) != 0)
    5053        return RTErrInfoSetF(pErrInfo, VERR_CR_PKCS7_SIGNED_DATA_VERSION, "SignedData version is %llu, expected %u",
    5154                             pSignedData->Version.uValue.u, RTCRPKCS7SIGNEDDATA_V1);
    … …  
    8285                            "SignedData.Certifcates is empty, expected at least one certificate");
    8386
    84     if (pSignedData->Certificates.cItems > 0)
    85     {
    86         int rc = RTCrX509Certificates_CheckSanity(&pSignedData->Certificates, 0, pErrInfo, "SignedData.T0.Certificates");
    87         if (RT_FAILURE(rc))
    88             return rc;
    89     }
    90 
    9187    /*
    9288     * Crls.
    … …  
    127123
    128124        PCRTCRX509CERTIFICATE pCert;
    129         pCert = RTCrX509Certificates_FindByIssuerAndSerialNumber(&pSignedData->Certificates,
    130                                                                  &pSignerInfo->IssuerAndSerialNumber.Name,
    131                                                                  &pSignerInfo->IssuerAndSerialNumber.SerialNumber);
     125        pCert = RTCrPkcs7SetOfCerts_FindX509ByIssuerAndSerialNumber(&pSignedData->Certificates,
     126                                                                    &pSignerInfo->IssuerAndSerialNumber.Name,
     127                                                                    &pSignerInfo->IssuerAndSerialNumber.SerialNumber);
    132128        if (!pCert && (fFlags & RTCRPKCS7SIGNEDDATA_SANITY_F_SIGNING_CERT_PRESENT))
    133129            return RTErrInfoSetF(pErrInfo, VERR_CR_PKCS7_SIGNER_CERT_NOT_SHIPPED,
    … …  
    146142
    147143        /* Digest encryption algorithm. */
     144#if 0  /** @todo Unimportant: Seen timestamp signatures specifying pkcs1-Sha256WithRsaEncryption in SignerInfo and just RSA in the certificate.  Figure out how to compare the two. */
    148145        if (   pCert
    149146            && RTCrX509AlgorithmIdentifier_Compare(&pSignerInfo->DigestEncryptionAlgorithm,
    … …  
    153150                                 i, pSignerInfo->DigestEncryptionAlgorithm.Algorithm.szObjId,
    154151                                 pCert->TbsCertificate.SubjectPublicKeyInfo.Algorithm.Algorithm.szObjId);
     152#endif
    155153
    156154        /* Authenticated attributes we know. */

  • trunk/src/VBox/Runtime/common/crypto/pkcs7-template.h

    r52503 r52600  
    5959RTASN1TMPL_MEMBER_DYN(          uValues,    pSigningTime,   RTASN1SETOFTIMES,           RTAsn1SetOfTimes,           Allocation,
    6060    enmType, RTCRPKCS7ATTRIBUTETYPE_SIGNING_TIME,   RTAsn1ObjId_CompareWithString(&pThis->Type, RTCR_PKCS9_ID_SIGNING_TIME_OID) == 0);
     61RTASN1TMPL_MEMBER_DYN(          uValues,    pContentInfos,  RTCRPKCS7SETOFCONTENTINFOS, RTCrPkcs7SetOfContentInfos, Allocation,
     62    enmType, RTCRPKCS7ATTRIBUTETYPE_MS_TIMESTAMP,   RTAsn1ObjId_CompareWithString(&pThis->Type, RTCR_PKCS9_ID_MS_TIMESTAMP) == 0);
    6163RTASN1TMPL_MEMBER_DYN_DEFAULT(  uValues,    pCores,         RTASN1SETOFCORES,           RTAsn1SetOfCores,           Allocation,
    6264    enmType, RTCRPKCS7ATTRIBUTETYPE_UNKNOWN);
    … …  
    122124RTASN1TMPL_MEMBER(              DigestAlgorithms,           RTCRX509ALGORITHMIDENTIFIERS,   RTCrX509AlgorithmIdentifiers);
    123125RTASN1TMPL_MEMBER(              ContentInfo,                RTCRPKCS7CONTENTINFO,           RTCrPkcs7ContentInfo);
    124 RTASN1TMPL_MEMBER_OPT_ITAG(     Certificates,               RTCRX509CERTIFICATES,           RTCrX509Certificates,   0);
     126RTASN1TMPL_MEMBER_OPT_ITAG(     Certificates,               RTCRPKCS7SETOFCERTS,            RTCrPkcs7SetOfCerts,    0);
    125127RTASN1TMPL_MEMBER_OPT_ITAG(     Crls,                       RTASN1CORE,                     RTAsn1Core,             1);
    126128RTASN1TMPL_MEMBER(              SignerInfos,                RTCRPKCS7SIGNERINFOS,           RTCrPkcs7SignerInfos);
    127129RTASN1TMPL_EXEC_CHECK_SANITY(   rc = rtCrPkcs7SignedData_CheckSanityExtra(pThis, fFlags, pErrInfo, pszErrorTag) ) /* no ; */
    128130RTASN1TMPL_END_SEQCORE();
     131#undef RTASN1TMPL_TYPE
     132#undef RTASN1TMPL_EXT_NAME
     133#undef RTASN1TMPL_INT_NAME
     134
     135
     136/*
     137 * Set of PCKS #7 SignedData.
     138 */
     139#define RTASN1TMPL_TYPE         RTCRPKCS7SETOFSIGNEDDATA
     140#define RTASN1TMPL_EXT_NAME     RTCrPkcs7SetOfSignedData
     141#define RTASN1TMPL_INT_NAME     rtCrPkcs7SetOfSignedData
     142RTASN1TMPL_SET_OF(RTCRPKCS7SIGNEDDATA, RTCrPkcs7SignedData);
    129143#undef RTASN1TMPL_TYPE
    130144#undef RTASN1TMPL_EXT_NAME
    … …  
    163177#undef RTASN1TMPL_INT_NAME
    164178
     179
     180/*
     181 * Set of PCKS #7 ContentInfo.
     182 */
     183#define RTASN1TMPL_TYPE         RTCRPKCS7SETOFCONTENTINFOS
     184#define RTASN1TMPL_EXT_NAME     RTCrPkcs7SetOfContentInfos
     185#define RTASN1TMPL_INT_NAME     rtCrPkcs7SetOfContentInfos
     186RTASN1TMPL_SET_OF(RTCRPKCS7CONTENTINFO, RTCrPkcs7ContentInfo);
     187#undef RTASN1TMPL_TYPE
     188#undef RTASN1TMPL_EXT_NAME
     189#undef RTASN1TMPL_INT_NAME
     190
     191
     192/*
     193 * One PKCS #7 ExtendedCertificateOrCertificate or a CMS CertificateChoices (sic).
     194 */
     195#define RTASN1TMPL_TYPE         RTCRPKCS7CERT
     196#define RTASN1TMPL_EXT_NAME     RTCrPkcs7Cert
     197#define RTASN1TMPL_INT_NAME     rtCrPkcs7Cert
     198RTASN1TMPL_BEGIN_PCHOICE();
     199RTASN1TMPL_PCHOICE_ITAG_UC(     ASN1_TAG_SEQUENCE, RTCRPKCS7CERTCHOICE_X509, u.pX509Cert, X509Cert,     RTCRX509CERTIFICATE, RTCrX509Certificate);
     200RTASN1TMPL_PCHOICE_ITAG(        0, RTCRPKCS7CERTCHOICE_EXTENDED_PKCS6, u.pExtendedCert,   ExtendedCert, RTASN1CORE, RTAsn1Core);
     201RTASN1TMPL_PCHOICE_ITAG(        1, RTCRPKCS7CERTCHOICE_AC_V1,          u.pAcV1,           AcV1,         RTASN1CORE, RTAsn1Core);
     202RTASN1TMPL_PCHOICE_ITAG(        2, RTCRPKCS7CERTCHOICE_AC_V2,          u.pAcV2,           AcV2,         RTASN1CORE, RTAsn1Core);
     203RTASN1TMPL_PCHOICE_ITAG(        3, RTCRPKCS7CERTCHOICE_OTHER,          u.pOtherCert,      OtherCert,    RTASN1CORE, RTAsn1Core);
     204RTASN1TMPL_END_PCHOICE();
     205#undef RTASN1TMPL_TYPE
     206#undef RTASN1TMPL_EXT_NAME
     207#undef RTASN1TMPL_INT_NAME
     208
     209
     210/*
     211 * Set of PKCS #7 ExtendedCertificateOrCertificate or a CMS CertificateChoices.
     212 */
     213#define RTASN1TMPL_TYPE         RTCRPKCS7SETOFCERTS
     214#define RTASN1TMPL_EXT_NAME     RTCrPkcs7SetOfCerts
     215#define RTASN1TMPL_INT_NAME     rtCrPkcs7SetOfCerts
     216RTASN1TMPL_SET_OF(RTCRPKCS7CERT, RTCrPkcs7Cert);
     217#undef RTASN1TMPL_TYPE
     218#undef RTASN1TMPL_EXT_NAME
     219#undef RTASN1TMPL_INT_NAME
     220

  • trunk/src/VBox/Runtime/common/crypto/pkcs7-verify.cpp

    r52545 r52600  
    7171        if (RT_SUCCESS(rcOssl))
    7272        {
    73             for (uint32_t i = 0; i < pContentInfo->u.pSignedData->Certificates.cItems; i++)
    74                 rtCrOpenSslAddX509CertToStack(pAddCerts, &pContentInfo->u.pSignedData->Certificates.paItems[i]);
     73            PCRTCRPKCS7SETOFCERTS pCerts = &pContentInfo->u.pSignedData->Certificates;
     74            for (uint32_t i = 0; i < pCerts->cItems; i++)
     75                if (pCerts->paItems[i].enmChoice == RTCRPKCS7CERTCHOICE_X509)
     76                    rtCrOpenSslAddX509CertToStack(pAddCerts, pCerts->paItems[i].u.pX509Cert);
    7577
    7678
    … …  
    398400    {
    399401        hSignerCertSrc = NULL;
    400         pSignerCert = RTCrX509Certificates_FindByIssuerAndSerialNumber(&pSignedData->Certificates,
    401                                                                        &pSignerInfo->IssuerAndSerialNumber.Name,
    402                                                                        &pSignerInfo->IssuerAndSerialNumber.SerialNumber);
     402        pSignerCert = RTCrPkcs7SetOfCerts_FindX509ByIssuerAndSerialNumber(&pSignedData->Certificates,
     403                                                                          &pSignerInfo->IssuerAndSerialNumber.Name,
     404                                                                          &pSignerInfo->IssuerAndSerialNumber.SerialNumber);
    403405        if (!pSignerCert)
    404406            return RTErrInfoSetF(pErrInfo, VERR_CR_PKCS7_SIGNED_DATA_CERT_NOT_FOUND,
    … …  
    426428                rc = RTCrX509CertPathsSetUntrustedStore(hCertPaths, hAdditionalCerts);
    427429            if (pSignedData->Certificates.cItems > 0 && RT_SUCCESS(rc))
    428                 rc = RTCrX509CertPathsSetUntrustedArray(hCertPaths,
    429                                                         pSignedData->Certificates.paItems,
    430                                                         pSignedData->Certificates.cItems);
     430                rc = RTCrX509CertPathsSetUntrustedSet(hCertPaths, &pSignedData->Certificates);
    431431            if (RT_SUCCESS(rc))
    432432            {
    … …  
    586586        return rc;
    587587
    588     AssertReturn(!(fFlags & RTCRPKCS7VERIFY_SD_F_COUNTER_SIGNATURE), VERR_INVALID_FLAGS);
    589 
    590588    /*
    591589     * Hash the content info.
    … …  
    640638             * Validate the signed infos.
    641639             */
     640            uint32_t fPrimaryVccFlags = !(fFlags & RTCRPKCS7VERIFY_SD_F_USAGE_TIMESTAMPING)
     641                                      ? RTCRPKCS7VCC_F_SIGNED_DATA : RTCRPKCS7VCC_F_TIMESTAMP;
    642642            rc = VERR_CR_PKCS7_NO_SIGNER_INFOS;
    643643            for (i = 0; i < pSignedData->SignerInfos.cItems; i++)
    … …  
    651651                /*
    652652                 * See if we can find a trusted signing time.
     653                 * (Note that while it would make sense splitting up this function,
     654                 * we need to carry a lot of arguments around, so better not.)
    653655                 */
    654656                bool                    fDone              = false;
    … …  
    667669                            rc = rtCrPkcs7VerifySignerInfo(pSignerInfo, pSignedData, hThisDigest, fFlags,
    668670                                                           hAdditionalCerts, hTrustedCerts, &ThisValidationTime,
    669                                                            pfnVerifyCert, RTCRPKCS7VCC_F_SIGNED_DATA | RTCRPKCS7VCC_F_TIMESTAMP,
     671                                                           pfnVerifyCert, fPrimaryVccFlags | RTCRPKCS7VCC_F_TIMESTAMP,
    670672                                                           pvUser, pErrInfo);
    671673                        }
    … …  
    680682                                rc = rtCrPkcs7VerifySignerInfo(pSignerInfo, pSignedData, hThisDigest, fFlags, hAdditionalCerts,
    681683                                                               hTrustedCerts, &ThisValidationTime,
    682                                                                pfnVerifyCert, RTCRPKCS7VCC_F_SIGNED_DATA, pvUser, pErrInfo);
     684                                                               pfnVerifyCert, fPrimaryVccFlags, pvUser, pErrInfo);
    683685                        }
    684686                        fDone = RT_SUCCESS(rc)
    … …  
    693695
    694696                /*
     697                 * If not luck, check for microsoft timestamp counter signatures.
     698                 */
     699                if (!fDone && !(fFlags & RTCRPKCS7VERIFY_SD_F_IGNORE_MS_TIMESTAMP))
     700                {
     701                    PCRTCRPKCS7CONTENTINFO pSignedTimestamp = NULL;
     702                    pSignedTime = RTCrPkcs7SignerInfo_GetMsTimestamp(pSignerInfo, &pSignedTimestamp);
     703                    if (pSignedTime)
     704                    {
     705                        RTTIMESPEC ThisValidationTime;
     706                        if (RT_LIKELY(RTTimeImplode(&ThisValidationTime, &pSignedTime->Time)))
     707                        {
     708                            rc = VINF_SUCCESS;
     709                            if (!(fFlags & RTCRPKCS7VERIFY_SD_F_USE_MS_TIMESTAMP_UNVERIFIED))
     710                                rc = RTCrPkcs7VerifySignedData(pSignedTimestamp,
     711                                                               fFlags | RTCRPKCS7VERIFY_SD_F_IGNORE_MS_TIMESTAMP
     712                                                               | RTCRPKCS7VERIFY_SD_F_USAGE_TIMESTAMPING,
     713                                                               hAdditionalCerts, hTrustedCerts, &ThisValidationTime,
     714                                                               pfnVerifyCert, pvUser, pErrInfo);
     715
     716                            if (RT_SUCCESS(rc))
     717                                rc = rtCrPkcs7VerifySignerInfo(pSignerInfo, pSignedData, hThisDigest, fFlags, hAdditionalCerts,
     718                                                               hTrustedCerts, &ThisValidationTime,
     719                                                               pfnVerifyCert, fPrimaryVccFlags, pvUser, pErrInfo);
     720                            fDone = RT_SUCCESS(rc)
     721                                 || (fFlags & RTCRPKCS7VERIFY_SD_F_ALWAYS_USE_MS_TIMESTAMP_IF_PRESENT);
     722                        }
     723                        else
     724                        {
     725                            rc = RTErrInfoSet(pErrInfo, VERR_INTERNAL_ERROR_3, "RTTimeImplode failed");
     726                            fDone = true;
     727                        }
     728
     729                    }
     730                }
     731
     732                /*
    695733                 * No valid signing time found, use the one specified instead.
    696734                 */
    697735                if (!fDone)
    698736                    rc = rtCrPkcs7VerifySignerInfo(pSignerInfo, pSignedData, hThisDigest, fFlags, hAdditionalCerts, hTrustedCerts,
    699                                                    pValidationTime, pfnVerifyCert, RTCRPKCS7VCC_F_SIGNED_DATA, pvUser, pErrInfo);
     737                                                   pValidationTime, pfnVerifyCert, fPrimaryVccFlags, pvUser, pErrInfo);
    700738                RTCrDigestRelease(hThisDigest);
    701739                if (RT_FAILURE(rc))
    … …  
    721759     * Verify using OpenSSL and combine the results (should be identical).
    722760     */
     761    /** @todo figure out how to verify MS timstamp signatures using OpenSSL. */
     762    if (fFlags & RTCRPKCS7VERIFY_SD_F_USAGE_TIMESTAMPING)
     763        return rc;
    723764    int rcOssl = rtCrPkcs7VerifySignedDataUsingOpenSsl(pContentInfo, fFlags, hAdditionalCerts, hTrustedCerts,
    724765                                                       pvContent, cbContent, RT_SUCCESS(rc) ? pErrInfo : NULL);

  • trunk/src/VBox/Runtime/common/crypto/x509-certpaths.cpp

    r51823 r52600  
    3939#include <iprt/list.h>
    4040#include <iprt/time.h>
     41#include <iprt/crypto/pkcs7.h> /* PCRTCRPKCS7SETOFCERTS */
    4142#include <iprt/crypto/store.h>
    4243
    … …  
    9293#define RTCRX509CERTPATHNODE_SRC_NONE               0
    9394#define RTCRX509CERTPATHNODE_SRC_TARGET             1
    94 #define RTCRX509CERTPATHNODE_SRC_UNTRUSTED_ARRAY    2
    95 #define RTCRX509CERTPATHNODE_SRC_UNTRUSTED_STORE    3
    96 #define RTCRX509CERTPATHNODE_SRC_TRUSTED_STORE      4
    97 #define RTCRX509CERTPATHNODE_SRC_TRUSTED_CERT       5
     95#define RTCRX509CERTPATHNODE_SRC_UNTRUSTED_SET      2
     96#define RTCRX509CERTPATHNODE_SRC_UNTRUSTED_ARRAY    3
     97#define RTCRX509CERTPATHNODE_SRC_UNTRUSTED_STORE    4
     98#define RTCRX509CERTPATHNODE_SRC_TRUSTED_STORE      5
     99#define RTCRX509CERTPATHNODE_SRC_TRUSTED_CERT       6
    98100#define RTCRX509CERTPATHNODE_SRC_IS_TRUSTED(uSrc)   ((uSrc) >= RTCRX509CERTPATHNODE_SRC_TRUSTED_STORE)
    99101/** @} */
    … …  
    164166    /** Store of untrusted certificates. */
    165167    RTCRSTORE                       hUntrustedStore;
    166     /** Array of untrusted certificates, typically from the protocol (like the
    167      *  certificates member of PKCS \#7 SignedData). */
     168    /** Array of untrusted certificates, typically from the protocol. */
    168169    PCRTCRX509CERTIFICATE           paUntrustedCerts;
    169170    /** Number of entries in paUntrusted. */
    170171    uint32_t                        cUntrustedCerts;
     172    /** Set of untrusted PKCS \#7 / CMS certificatess. */
     173    PCRTCRPKCS7SETOFCERTS           pUntrustedCertsSet;
    171174
    172175    /** UTC time we're going to validate the path at, requires
    … …  
    364367            pThis->hUntrustedStore              = NIL_RTCRSTORE;
    365368            pThis->paUntrustedCerts             = NULL; /* Referencing user memory. */
     369            pThis->pUntrustedCertsSet           = NULL; /* Referencing user memory. */
    366370            pThis->papInitialUserPolicySet      = NULL; /* Referencing user memory. */
    367371            pThis->pInitialPermittedSubtrees    = NULL; /* Referencing user memory. */
    … …  
    438442    pThis->paUntrustedCerts = paCerts;
    439443    pThis->cUntrustedCerts  = cCerts;
     444    return VINF_SUCCESS;
     445}
     446
     447
     448RTDECL(int) RTCrX509CertPathsSetUntrustedSet(RTCRX509CERTPATHS hCertPaths, PCRTCRPKCS7SETOFCERTS pSetOfCerts)
     449{
     450    PRTCRX509CERTPATHSINT pThis = hCertPaths;
     451    AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
     452    AssertReturn(pThis->u32Magic == RTCRX509CERTPATHSINT_MAGIC, VERR_INVALID_HANDLE);
     453
     454    pThis->pUntrustedCertsSet = pSetOfCerts;
    440455    return VINF_SUCCESS;
    441456}
    … …  
    694709            if (RTCrX509Certificate_MatchSubjectOrAltSubjectByRfc5280(&pThis->paUntrustedCerts[i], pIssuer))
    695710                rtCrX509CertPathsAddIssuer(pThis, pNode, &pThis->paUntrustedCerts[i], NULL,
    696                                                  RTCRX509CERTPATHNODE_SRC_UNTRUSTED_ARRAY);
     711                                           RTCRX509CERTPATHNODE_SRC_UNTRUSTED_ARRAY);
     712
     713    /** @todo Rainy day: Should abstract the untrusted array and set so we don't get
     714     *        unnecessary PKCS7/CMS header dependencies. */
     715
     716    /*
     717     * Untrusted set.
     718     */
     719    if (pThis->pUntrustedCertsSet)
     720    {
     721        uint32_t const  cCerts  = pThis->pUntrustedCertsSet->cItems;
     722        PCRTCRPKCS7CERT paCerts = pThis->pUntrustedCertsSet->paItems;
     723        for (uint32_t i = 0; i < cCerts; i++)
     724            if (   paCerts[i].enmChoice == RTCRPKCS7CERTCHOICE_X509
     725                && RTCrX509Certificate_MatchSubjectOrAltSubjectByRfc5280(paCerts[i].u.pX509Cert, pIssuer))
     726                rtCrX509CertPathsAddIssuer(pThis, pNode, paCerts[i].u.pX509Cert, NULL, RTCRX509CERTPATHNODE_SRC_UNTRUSTED_SET);
     727    }
    697728}
    698729
    … …  
    10841115    {
    10851116        case RTCRX509CERTPATHNODE_SRC_TARGET:           return "target";
     1117        case RTCRX509CERTPATHNODE_SRC_UNTRUSTED_SET:    return "untrusted_set";
    10861118        case RTCRX509CERTPATHNODE_SRC_UNTRUSTED_ARRAY:  return "untrusted_array";
    10871119        case RTCRX509CERTPATHNODE_SRC_UNTRUSTED_STORE:  return "untrusted_store";

  • trunk/src/VBox/Runtime/tools/RTSignTool.cpp

    r52538 r52600  
    183183                    PCRTCRPKCS7ISSUERANDSERIALNUMBER pISN = &pSd->SignerInfos.paItems[0].IssuerAndSerialNumber;
    184184                    PCRTCRX509CERTIFICATE pCert;
    185                     pCert = RTCrX509Certificates_FindByIssuerAndSerialNumber(&pSd->Certificates,
    186                                                                             &pISN->Name, &pISN->SerialNumber);
     185                    pCert = RTCrPkcs7SetOfCerts_FindX509ByIssuerAndSerialNumber(&pSd->Certificates,
     186                                                                                &pISN->Name, &pISN->SerialNumber);
    187187                    if (pCert)
    188188                    {
    … …  
    404404            return RTCrPkcs7VerifySignedData(pContentInfo,
    405405                                             RTCRPKCS7VERIFY_SD_F_COUNTER_SIGNATURE_SIGNING_TIME_ONLY
    406                                              | RTCRPKCS7VERIFY_SD_F_ALWAYS_USE_SIGNING_TIME_IF_PRESENT,
     406                                             | RTCRPKCS7VERIFY_SD_F_ALWAYS_USE_SIGNING_TIME_IF_PRESENT
     407                                             | RTCRPKCS7VERIFY_SD_F_ALWAYS_USE_MS_TIMESTAMP_IF_PRESENT,
    407408                                             pState->hAdditionalStore, pState->hRootStore, &ValidationTime,
    408409                                             VerifyExecCertVerifyCallback, pState, pErrInfo);
Note: See TracChangeset for help on using the changeset viewer.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette