VirtualBox

Changeset 52600 in vbox for trunk/include/iprt


Ignore:
Timestamp:
Sep 4, 2014 10:59:00 PM (10 years ago)
Author:
vboxsync
Message:

IPRT: Added support for microsoft timestamp counter signatures. This required making the PKCS #7 code accept some of the CMS (RFC-5652) stuff.

Location:
trunk/include/iprt
Files:
7 edited

Legend:

Unmodified
Added
Removed

  • trunk/include/iprt/asn1-generator-asn1-decoder.h

    r51770 r52600  
    2424 */
    2525
     26#include <iprt/string.h>
     27
    2628#define RTASN1TMPL_PASS RTASN1TMPL_PASS_DECODE
    2729#include <iprt/asn1-generator-pass.h>

  • trunk/include/iprt/asn1-generator-init.h

    r51770 r52600  
    2424 */
    2525
     26#include <iprt/string.h>
    2627
    2728#define RTASN1TMPL_PASS                 RTASN1TMPL_PASS_INIT

  • trunk/include/iprt/asn1-generator-pass.h

    r51919 r52600  
    10391039    { a_MoreConstraints }
    10401040
     1041# define RTASN1TMPL_MEMBER_CONSTR_U64_MIN_MAX(a_Name, uMin, uMax, a_MoreConstraints) \
     1042    if (RT_SUCCESS(rc)) \
     1043    { \
     1044        if (RT_UNLIKELY(   RTAsn1Integer_UnsignedCompareWithU64(&pThis->a_Name, uMin) < 0 \
     1045                        || RTAsn1Integer_UnsignedCompareWithU64(&pThis->a_Name, uMax) > 0) ) \
     1046            rc = RTErrInfoSetF(pErrInfo, VERR_GENERAL_FAILURE, \
     1047                               "%s::" #a_Name ": Out of range: %#x not in {%#llx..%#llx}", \
     1048                               pszErrorTag, pThis->a_Name.Asn1Core.cb > 8 ? UINT64_MAX : pThis->a_Name.uValue.u, \
     1049                               (uint64_t)(uMin), (uint64_t)(uMax)); \
     1050    } \
     1051    { a_MoreConstraints }
     1052
    10411053# define RTASN1TMPL_MEMBER_CONSTR_PRESENT(a_Name, a_Api, a_MoreConstraints) \
    10421054    if (RT_SUCCESS(rc) && RT_UNLIKELY(!RT_CONCAT(a_Api,_IsPresent)(&pThis->a_Name))) \
    … …  
    12591271    RTASN1TMPL_PCHOICE_ITAG_EX(a_uTag, a_enmChoice, a_PtrName, a_Name, a_Type, a_Api, RTASN1TMPL_ITAG_F_UP, RT_NOTHING)
    12601272#endif
     1273#ifndef RTASN1TMPL_PCHOICE_ITAG_UC
     1274# define RTASN1TMPL_PCHOICE_ITAG_UC(a_uTag, a_enmChoice, a_PtrName, a_Name, a_Type, a_Api) \
     1275    RTASN1TMPL_PCHOICE_ITAG_EX(a_uTag, a_enmChoice, a_PtrName, a_Name, a_Type, a_Api, RTASN1TMPL_ITAG_F_UC, RT_NOTHING)
     1276#endif
    12611277#ifndef RTASN1TMPL_PCHOICE_ITAG_CP
    12621278# define RTASN1TMPL_PCHOICE_ITAG_CP(a_uTag, a_enmChoice, a_PtrName, a_Name, a_Type, a_Api) \
    … …  
    12831299#ifndef RTASN1TMPL_MEMBER_CONSTR_BITSTRING_MIN_MAX
    12841300# define RTASN1TMPL_MEMBER_CONSTR_BITSTRING_MIN_MAX(a_Name, cMinBits, cMaxBits, a_MoreConstraints)
     1301#endif
     1302#ifndef RTASN1TMPL_MEMBER_CONSTR_U64_MIN_MAX
     1303# define RTASN1TMPL_MEMBER_CONSTR_U64_MIN_MAX(a_Name, uMin, uMax, a_MoreConstraints)
    12851304#endif
    12861305#ifndef RTASN1TMPL_MEMBER_CONSTR_PRESENT
    … …  
    13721391#undef RTASN1TMPL_MEMBER_CONSTR_MIN_MAX
    13731392#undef RTASN1TMPL_MEMBER_CONSTR_BITSTRING_MIN_MAX
     1393#undef RTASN1TMPL_MEMBER_CONSTR_U64_MIN_MAX
    13741394#undef RTASN1TMPL_MEMBER_CONSTR_PRESENT
    13751395

  • trunk/include/iprt/asn1.h

    r52537 r52600  
    397397
    398398
    399 /** Aliases two ASN.1 types. */
     399/** Aliases two ASN.1 types, no method aliases. */
     400#define RTASN1TYPE_ALIAS_TYPE_ONLY(a_TypeNm, a_AliasType) \
     401    typedef a_AliasType a_TypeNm; \
     402    typedef a_TypeNm *RT_CONCAT(P,a_TypeNm); \
     403    typedef a_TypeNm const *RT_CONCAT(PC,a_TypeNm)
     404
     405/** Aliases two ASN.1 types and methods. */
    400406#define RTASN1TYPE_ALIAS(a_TypeNm, a_AliasType, a_ImplExtNm, a_AliasExtNm) \
    401407    typedef a_AliasType a_TypeNm; \

  • trunk/include/iprt/crypto/pkcs7.h

    r52537 r52600  
    8585    /** Signing time (PKCS \#9), use pSigningTime. */
    8686    RTCRPKCS7ATTRIBUTETYPE_SIGNING_TIME,
     87    /** Microsoft timestamp info (RFC-3161) signed data, use pContentInfo. */
     88    RTCRPKCS7ATTRIBUTETYPE_MS_TIMESTAMP,
    8789    /** Blow the type up to 32-bits. */
    8890    RTCRPKCS7ATTRIBUTETYPE_32BIT_HACK = 0x7fffffff
    … …  
    115117        /** Signing time(s) (RTCRPKCS7ATTRIBUTETYPE_SIGNING_TIME). */
    116118        PRTASN1SETOFTIMES               pSigningTime;
     119        /** Microsoft timestamp (RFC-3161 signed data). */
     120        struct RTCRPKCS7SETOFCONTENTINFOS *pContentInfos;
    117121    } uValues;
    118122} RTCRPKCS7ATTRIBUTE;
    … …  
    173177 * Value: SignerInfo. */
    174178#define RTCR_PKCS9_ID_COUNTER_SIGNATURE_OID "1.2.840.113549.1.9.6"
     179/** Microsoft timestamp (RTF-3161) counter signature (SignedData).
     180 * @remarks This isn't defined by PKCS \#9, but lumped in here for
     181 *          convenience.  It's actually listed as SPC by MS. */
     182#define RTCR_PKCS9_ID_MS_TIMESTAMP          "1.3.6.1.4.1.311.3.3.1"
    175183/** @} */
     184
    176185
    177186/**
    … …  
    193202 */
    194203RTDECL(PCRTASN1TIME) RTCrPkcs7SignerInfo_GetSigningTime(PCRTCRPKCS7SIGNERINFO pThis, PCRTCRPKCS7SIGNERINFO *ppSignerInfo);
     204
     205
     206/**
     207 * Get the (first) timestamp from within a Microsoft timestamp server counter
     208 * signature.
     209 *
     210 * @returns Pointer to the signing time if found, NULL if not.
     211 * @param   pThis               The SignerInfo to search.
     212 * @param   ppContentInfo       Where to return the pointer to the counter
     213 *                              signature, optional.
     214 */
     215RTDECL(PCRTASN1TIME) RTCrPkcs7SignerInfo_GetMsTimestamp(PCRTCRPKCS7SIGNERINFO pThis,
     216                                                        struct RTCRPKCS7CONTENTINFO const **ppContentInfo);
    195217
    196218
    … …  
    223245     */
    224246    RTASN1OCTETSTRING                   Content;
     247    /** Pointer to the CMS octet string that's inside the Content, NULL if PKCS \#7.
     248     *
     249     * Hack alert! When transitioning from PKCS \#7 to CMS, the designers decided to
     250     * change things and add another wrapper.  This time we're talking about a real
     251     * octet string, not like the one above which is really an explicit content tag.
     252     * When constructing or decoding CMS content, this will be the same pointer as
     253     * Content.pEncapsulated, while the union below will be holding the same pointer
     254     * as pCmsContent->pEncapsulated.
     255     */
     256    PRTASN1OCTETSTRING                  pCmsContent;
    225257    /** Same as Content.pEncapsulated, except a choice of known types. */
    226258    union
    … …  
    230262        /** ContentType is RTCRSPCINDIRECTDATACONTENT_OID. */
    231263        struct RTCRSPCINDIRECTDATACONTENT  *pIndirectDataContent;
     264        /** ContentType is RTCRTSPTSTINFO_OID. */
     265        struct RTCRTSPTSTINFO              *pTstInfo;
    232266        /** Generic / Unknown / User. */
    233267        PRTASN1CORE                         pCore;
    … …  
    238272/** Pointer to the const IPRT representation of a PKCS \#7 ContentInfo. */
    239273typedef RTCRPKCS7CONTENTINFO const *PCRTCRPKCS7CONTENTINFO;
    240 
    241274RTASN1TYPE_STANDARD_PROTOTYPES(RTCRPKCS7CONTENTINFO, RTDECL, RTCrPkcs7ContentInfo, SeqCore.Asn1Core);
     275RTASN1_IMPL_GEN_SET_OF_TYPEDEFS_AND_PROTOS(RTCRPKCS7SETOFCONTENTINFOS, RTCRPKCS7CONTENTINFO, RTDECL, RTCrPkcs7SetOfContentInfos);
    242276
    243277RTDECL(bool) RTCrPkcs7ContentInfo_IsSignedData(PCRTCRPKCS7CONTENTINFO pThis);
     278
     279
     280/**
     281 * PKCS \#7 Certificate choice.
     282 */
     283typedef enum RTCRPKCS7CERTCHOICE
     284{
     285    RTCRPKCS7CERTCHOICE_INVALID = 0,
     286    RTCRPKCS7CERTCHOICE_X509,
     287    RTCRPKCS7CERTCHOICE_EXTENDED_PKCS6,
     288    RTCRPKCS7CERTCHOICE_AC_V1,
     289    RTCRPKCS7CERTCHOICE_AC_V2,
     290    RTCRPKCS7CERTCHOICE_OTHER,
     291    RTCRPKCS7CERTCHOICE_END,
     292    RTCRPKCS7CERTCHOICE_32BIT_HACK = 0x7fffffff
     293} RTCRPKCS7CERTCHOICE;
     294
     295
     296/**
     297 * Common representation for PKCS \#7 ExtendedCertificateOrCertificate and the
     298 * CMS CertificateChoices types.
     299 */
     300typedef struct RTCRPKCS7CERT
     301{
     302    /** Dummy ASN.1 record, not encoded. */
     303    RTASN1DUMMY                         Dummy;
     304    /** The value allocation. */
     305    RTASN1ALLOCATION                    Allocation;
     306    /** The choice of value.   */
     307    RTCRPKCS7CERTCHOICE                 enmChoice;
     308    /** The value union. */
     309    union
     310    {
     311        /** Standard X.509 certificate (RTCRCMSCERTIFICATECHOICE_X509). */
     312        PRTCRX509CERTIFICATE            pX509Cert;
     313        /** Extended PKCS \#6 certificate (RTCRCMSCERTIFICATECHOICE_EXTENDED_PKCS6). */
     314        PRTASN1CORE                     pExtendedCert;
     315        /** Attribute certificate version 1 (RTCRCMSCERTIFICATECHOICE_AC_V1). */
     316        PRTASN1CORE                     pAcV1;
     317        /** Attribute certificate version 2 (RTCRCMSCERTIFICATECHOICE_AC_V2). */
     318        PRTASN1CORE                     pAcV2;
     319        /** Other certificate (RTCRCMSCERTIFICATECHOICE_OTHER). */
     320        PRTASN1CORE                     pOtherCert;
     321    } u;
     322} RTCRPKCS7CERT;
     323/** Pointer to the IPRT representation of PKCS \#7 or CMS certificate. */
     324typedef RTCRPKCS7CERT *PRTCRPKCS7CERT;
     325/** Pointer to the const IPRT representation of PKCS \#7 or CMS certificate. */
     326typedef RTCRPKCS7CERT const *PCRTCRPKCS7CERT;
     327RTASN1TYPE_STANDARD_PROTOTYPES(RTCRPKCS7CERT, RTDECL, RTCrPkcs7Cert, Dummy.Asn1Core);
     328RTASN1_IMPL_GEN_SET_OF_TYPEDEFS_AND_PROTOS(RTCRPKCS7SETOFCERTS, RTCRPKCS7CERT, RTDECL, RTCrPkcs7SetOfCerts);
     329
     330RTDECL(PCRTCRX509CERTIFICATE) RTCrPkcs7SetOfCerts_FindX509ByIssuerAndSerialNumber(PCRTCRPKCS7SETOFCERTS pCertificates,
     331                                                                                  PCRTCRX509NAME pIssuer,
     332                                                                                  PCRTASN1INTEGER pSerialNumber);
    244333
    245334
    … …  
    258347    RTCRPKCS7CONTENTINFO                ContentInfo;
    259348    /** Certificates, optional, implicit tag 0. (Required by Authenticode.) */
    260     RTCRX509CERTIFICATES                Certificates;
     349    RTCRPKCS7SETOFCERTS                 Certificates;
    261350    /** Certificate revocation lists, optional, implicit tag 1.
    262351     * Not used by Authenticode, so currently stubbed. */
    … …  
    270359typedef RTCRPKCS7SIGNEDDATA const *PCRTCRPKCS7SIGNEDDATA;
    271360RTASN1TYPE_STANDARD_PROTOTYPES(RTCRPKCS7SIGNEDDATA, RTDECL, RTCrPkcs7SignedData, SeqCore.Asn1Core);
     361RTASN1_IMPL_GEN_SET_OF_TYPEDEFS_AND_PROTOS(RTCRPKCS7SETOFSIGNEDDATA, RTCRPKCS7SIGNEDDATA, RTDECL, RTCrPkcs7SetOfSignedData);
    272362
    273363/** PKCS \#7 SignedData object ID.  */
    … …  
    276366/** PKCS \#7 SignedData version number 1.  */
    277367#define RTCRPKCS7SIGNEDDATA_V1    1
     368/* No version 2 seems to exist. */
     369/** CMS SignedData version number 3.
     370 * This should only be used if there are version 1 attribute certificates
     371 * present, or if there are version 3 SignerInfo items present, or if
     372 * enmcCountInfo is not id-data (RFC-5652, section 5.1). */
     373#define RTCRPKCS7SIGNEDDATA_V3    3
     374/** CMS SignedData version number 4.
     375 * This should only be used if there are version 2 attribute certificates
     376 * present (RFC-5652, section 5.1). */
     377#define RTCRPKCS7SIGNEDDATA_V4    4
     378/** CMS SignedData version number 5.
     379 * This should only be used if there are certificates or/and CRLs of the
     380 * OTHER type present (RFC-5652, section 5.1). */
     381#define RTCRPKCS7SIGNEDDATA_V5    5
    278382
    279383
    … …  
    384488 * signing time attributes and use the @a pValidationTime instead. */
    385489#define RTCRPKCS7VERIFY_SD_F_ALWAYS_USE_SIGNING_TIME_IF_PRESENT     RT_BIT_32(0)
     490/** Same as RTCRPKCS7VERIFY_SD_F_ALWAYS_USE_SIGNING_TIME_IF_PRESENT for the MS
     491 *  timestamp counter sigantures. */
     492#define RTCRPKCS7VERIFY_SD_F_ALWAYS_USE_MS_TIMESTAMP_IF_PRESENT     RT_BIT_32(1)
    386493/** Only use signging time attributes from counter signatures. */
    387 #define RTCRPKCS7VERIFY_SD_F_COUNTER_SIGNATURE_SIGNING_TIME_ONLY    RT_BIT_32(1)
     494#define RTCRPKCS7VERIFY_SD_F_COUNTER_SIGNATURE_SIGNING_TIME_ONLY    RT_BIT_32(2)
    388495/** Don't validate the counter signature containing the signing time, just use
    389496 * it unverified.  This is useful if we don't necessarily have the root
    390  * certificates for the timestamp server handy, but use with great care. */
    391 #define RTCRPKCS7VERIFY_SD_F_USE_SIGNING_TIME_UNVERIFIED            RT_BIT_32(2)
     497 * certificates for the timestamp server handy, but use with great care.
     498 * @sa RTCRPKCS7VERIFY_SD_F_USE_MS_TIMESTAMP_UNVERIFIED */
     499#define RTCRPKCS7VERIFY_SD_F_USE_SIGNING_TIME_UNVERIFIED            RT_BIT_32(3)
     500/** Don't validate the MS counter signature containing the signing timestamp.
     501 * @sa RTCRPKCS7VERIFY_SD_F_USE_SIGNING_TIME_UNVERIFIED */
     502#define RTCRPKCS7VERIFY_SD_F_USE_MS_TIMESTAMP_UNVERIFIED            RT_BIT_32(4)
     503/** Do not consider timestamps in microsoft counter signatures. */
     504#define RTCRPKCS7VERIFY_SD_F_IGNORE_MS_TIMESTAMP                    RT_BIT_32(5)
     505/** The signed data requires certificates to have the timestamp extended
     506 * usage bit present.  This is used for recursivly verifying MS timestamp
     507 * signatures. */
     508#define RTCRPKCS7VERIFY_SD_F_USAGE_TIMESTAMPING                     RT_BIT_32(6)
     509
    392510/** Indicates internally that we're validating a counter signature and should
    393511 * use different rules when checking out the authenticated attributes.

  • trunk/include/iprt/crypto/x509.h

    r52537 r52600  
    10231023RTDECL(int) RTCrX509CertPathsSetUntrustedStore(RTCRX509CERTPATHS hCertPaths, RTCRSTORE hUntrustedStore);
    10241024RTDECL(int) RTCrX509CertPathsSetUntrustedArray(RTCRX509CERTPATHS hCertPaths, PCRTCRX509CERTIFICATE paCerts, uint32_t cCerts);
     1025RTDECL(int) RTCrX509CertPathsSetUntrustedSet(RTCRX509CERTPATHS hCertPaths, struct RTCRPKCS7SETOFCERTS const *pSetOfCerts);
    10251026RTDECL(int) RTCrX509CertPathsSetValidTime(RTCRX509CERTPATHS hCertPaths, PCRTTIME pTime);
    10261027RTDECL(int) RTCrX509CertPathsSetValidTimeSpec(RTCRX509CERTPATHS hCertPaths, PCRTTIMESPEC pTimeSpec);

  • trunk/include/iprt/mangling.h

    r52539 r52600  
    23972397# define RTCrPkcs7SignerInfo_Enum                       RT_MANGLER(RTCrPkcs7SignerInfo_Enum)
    23982398# define RTCrPkcs7SignerInfo_GetSigningTime             RT_MANGLER(RTCrPkcs7SignerInfo_GetSigningTime)
     2399# define RTCrPkcs7SignerInfo_GetMsTimestamp             RT_MANGLER(RTCrPkcs7SignerInfo_GetMsTimestamp)
    23992400# define RTCrPkcs7SignerInfos_Compare                   RT_MANGLER(RTCrPkcs7SignerInfos_Compare)
    24002401# define RTCrPkcs7SignerInfos_Delete                    RT_MANGLER(RTCrPkcs7SignerInfos_Delete)
    … …  
    27602761# define RTCrTafTrustAnchorInfo_CheckSanity             RT_MANGLER(RTCrTafTrustAnchorInfo_CheckSanity)
    27612762# define RTCrTafTrustAnchorList_CheckSanity             RT_MANGLER(RTCrTafTrustAnchorList_CheckSanity)
     2763# define RTCrTspAccuracy_CheckSanity                    RT_MANGLER(RTCrTspAccuracy_CheckSanity)
     2764# define RTCrTspAccuracy_Clone                          RT_MANGLER(RTCrTspAccuracy_Clone)
     2765# define RTCrTspAccuracy_Compare                        RT_MANGLER(RTCrTspAccuracy_Compare)
     2766# define RTCrTspAccuracy_DecodeAsn1                     RT_MANGLER(RTCrTspAccuracy_DecodeAsn1)
     2767# define RTCrTspAccuracy_Delete                         RT_MANGLER(RTCrTspAccuracy_Delete)
     2768# define RTCrTspAccuracy_Enum                           RT_MANGLER(RTCrTspAccuracy_Enum)
     2769# define RTCrTspAccuracy_Init                           RT_MANGLER(RTCrTspAccuracy_Init)
     2770# define RTCrTspMessageImprint_CheckSanity              RT_MANGLER(RTCrTspMessageImprint_CheckSanity)
     2771# define RTCrTspMessageImprint_Clone                    RT_MANGLER(RTCrTspMessageImprint_Clone)
     2772# define RTCrTspMessageImprint_Compare                  RT_MANGLER(RTCrTspMessageImprint_Compare)
     2773# define RTCrTspMessageImprint_DecodeAsn1               RT_MANGLER(RTCrTspMessageImprint_DecodeAsn1)
     2774# define RTCrTspMessageImprint_Delete                   RT_MANGLER(RTCrTspMessageImprint_Delete)
     2775# define RTCrTspMessageImprint_Enum                     RT_MANGLER(RTCrTspMessageImprint_Enum)
     2776# define RTCrTspMessageImprint_Init                     RT_MANGLER(RTCrTspMessageImprint_Init)
     2777# define RTCrTspTstInfo_CheckSanity                     RT_MANGLER(RTCrTspTstInfo_CheckSanity)
     2778# define RTCrTspTstInfo_Clone                           RT_MANGLER(RTCrTspTstInfo_Clone)
     2779# define RTCrTspTstInfo_Compare                         RT_MANGLER(RTCrTspTstInfo_Compare)
     2780# define RTCrTspTstInfo_DecodeAsn1                      RT_MANGLER(RTCrTspTstInfo_DecodeAsn1)
     2781# define RTCrTspTstInfo_Delete                          RT_MANGLER(RTCrTspTstInfo_Delete)
     2782# define RTCrTspTstInfo_Enum                            RT_MANGLER(RTCrTspTstInfo_Enum)
     2783# define RTCrTspTstInfo_Init                            RT_MANGLER(RTCrTspTstInfo_Init)
    27622784# define RTCrCertCtxRelease                             RT_MANGLER(RTCrCertCtxRelease)
    27632785# define RTCrCertCtxRetain                              RT_MANGLER(RTCrCertCtxRetain)
Note: See TracChangeset for help on using the changeset viewer.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette