VirtualBox

Changeset 84230 in vbox


Ignore:
Timestamp:
May 10, 2020 12:52:05 AM (5 years ago)
Author:
vboxsync
Message:

IPRT,openssl: Adding RTCrPkcs7SimpleSignSignedData as a feeble start at PKCS#7/CMS signing. bugref:9699

Location:
trunk
Files:
1 added
14 edited

Legend:

Unmodified
Added
Removed

  • trunk/include/iprt/crypto/pem.h

    r84172 r84230  
    224224                                const void *pvContent, size_t cbContent, const char *pszMarker);
    225225
     226RTDECL(ssize_t) RTCrPemWriteBlobToVfsIoStrm(RTVFSIOSTREAM hVfsIos, const void *pvContent, size_t cbContent, const char *pszMarker);
     227RTDECL(ssize_t) RTCrPemWriteBlobToVfsFile(RTVFSFILE hVfsFile, const void *pvContent, size_t cbContent, const char *pszMarker);
     228
    226229/**
    227230 * PEM formatter for a generic ASN.1 structure.

  • trunk/include/iprt/crypto/pkcs7.h

    r82968 r84230  
    561561 *  timestamp counter sigantures. */
    562562#define RTCRPKCS7VERIFY_SD_F_ALWAYS_USE_MS_TIMESTAMP_IF_PRESENT     RT_BIT_32(1)
    563 /** Only use signging time attributes from counter signatures. */
     563/** Only use signing time attributes from counter signatures. */
    564564#define RTCRPKCS7VERIFY_SD_F_COUNTER_SIGNATURE_SIGNING_TIME_ONLY    RT_BIT_32(2)
    565565/** Don't validate the counter signature containing the signing time, just use
    … …  
    584584/** @} */
    585585
     586
     587/** @name RTCRPKCS7SIGN_SD_F_XXX - Flags for RTCrPkcs7SimpleSign.
     588 * @{ */
     589/** Detached data. */
     590#define RTCRPKCS7SIGN_SD_F_DEATCHED      RT_BIT_32(0)
     591/** No SMIME capabilities attribute. */
     592#define RTCRPKCS7SIGN_SD_F_NO_SMIME_CAP  RT_BIT_32(1)
     593/** Valid flag mask.   */
     594#define RTCRPKCS7SIGN_SD_F_VALID_MASK    UINT32_C(0x00000003)
    586595/** @} */
    587596
     597RTDECL(int) RTCrPkcs7SimpleSignSignedData(uint32_t fFlags, PCRTCRX509CERTIFICATE pSigner, RTCRKEY hPrivateKey,
     598                                          void const *pvData, size_t cbData, RTCRSTORE hAdditionalCerts,
     599                                          void *pvResult, size_t *pcbResult, PRTERRINFO pErrInfo);
     600
     601/** @} */
     602
    588603RT_C_DECLS_END
    589604

  • trunk/include/iprt/crypto/store.h

    r82968 r84230  
    310310RTDECL(int) RTCrStoreCertSearchDestroy(RTCRSTORE hStore, PRTCRSTORECERTSEARCH pSearch);
    311311
    312 RTDECL(int) RTCrStoreConvertToOpenSslCertStore(RTCRSTORE hStore, uint32_t fFlags, void **ppvOpenSslStore);
    313 RTDECL(int) RTCrStoreConvertToOpenSslCertStack(RTCRSTORE hStore, uint32_t fFlags, void **ppvOpenSslStack);
     312RTDECL(int) RTCrStoreConvertToOpenSslCertStore(RTCRSTORE hStore, uint32_t fFlags, void **ppvOpenSslStore, PRTERRINFO pErrInfo);
     313RTDECL(int) RTCrStoreConvertToOpenSslCertStack(RTCRSTORE hStore, uint32_t fFlags, void **ppvOpenSslStack, PRTERRINFO pErrInfo);
    314314
    315315

  • trunk/include/iprt/mangling.h

    r84205 r84230  
    33483348# define RTCrPemReadFile                                RT_MANGLER(RTCrPemReadFile)
    33493349# define RTCrPemWriteBlob                               RT_MANGLER(RTCrPemWriteBlob)
     3350# define RTCrPemWriteBlobToVfsIoStrm                    RT_MANGLER(RTCrPemWriteBlobToVfsIoStrm)
     3351# define RTCrPemWriteBlobToVfsFile                      RT_MANGLER(RTCrPemWriteBlobToVfsFile)
    33503352# define RTCrPemWriteAsn1                               RT_MANGLER(RTCrPemWriteAsn1)
    33513353# define RTCrPemWriteAsn1ToVfsIoStrm                    RT_MANGLER(RTCrPemWriteAsn1ToVfsIoStrm)
    … …  
    34113413# define RTCrPkcs7SignerInfo_CheckSanity                RT_MANGLER(RTCrPkcs7SignerInfo_CheckSanity)
    34123414# define RTCrPkcs7SignerInfos_CheckSanity               RT_MANGLER(RTCrPkcs7SignerInfos_CheckSanity)
     3415# define RTCrPkcs7SimpleSignSignedData                  RT_MANGLER(RTCrPkcs7SimpleSignSignedData)
    34133416# define RTCrPkcs7VerifyCertCallbackCodeSigning         RT_MANGLER(RTCrPkcs7VerifyCertCallbackCodeSigning)
    34143417# define RTCrPkcs7VerifyCertCallbackDefault             RT_MANGLER(RTCrPkcs7VerifyCertCallbackDefault)

  • trunk/src/VBox/Runtime/Makefile.kmk

    r84163 r84230  
    399399        common/crypto/pkcs7-init.cpp \
    400400        common/crypto/pkcs7-sanity.cpp \
     401        common/crypto/pkcs7-sign.cpp \
    401402        common/crypto/pkcs7-verify.cpp \
    402403        common/crypto/pkix-sign.cpp \
    … …  
    16841685        common/crypto/digest-core.cpp \
    16851686        common/crypto/pemfile-read.cpp \
    1686         common/crypto/pemfile-write.cpp \
    16871687        common/crypto/pkcs7-asn1-decoder.cpp \
    16881688        common/crypto/pkcs7-core.cpp \

  • trunk/src/VBox/Runtime/common/crypto/iprt-openssl.cpp

    r82968 r84230  
    3434# include <iprt/err.h>
    3535# include <iprt/string.h>
     36# include <iprt/mem.h>
     37# include <iprt/asn1.h>
    3638
    3739# include "internal/iprt-openssl.h"
    … …  
    6466
    6567
    66 DECLHIDDEN(int) rtCrOpenSslAddX509CertToStack(void *pvOsslStack, PCRTCRX509CERTIFICATE pCert)
     68DECLHIDDEN(int) rtCrOpenSslConvertX509Cert(void **ppvOsslCert, PCRTCRX509CERTIFICATE pCert, PRTERRINFO pErrInfo)
    6769{
    68     int                  rc;
    69     const unsigned char *pabEncoded = (const unsigned char *)RTASN1CORE_GET_RAW_ASN1_PTR(&pCert->SeqCore.Asn1Core);
    70     uint32_t             cbEncoded  = RTASN1CORE_GET_RAW_ASN1_SIZE(&pCert->SeqCore.Asn1Core);
    71     X509                *pOsslCert  = NULL;
    72     if (d2i_X509(&pOsslCert, &pabEncoded, cbEncoded) == pOsslCert)
     70    const unsigned char *pabEncoded;
     71
     72    /*
     73     * ASSUME that if the certificate has data pointers, it's been parsed out
     74     * of a binary blob and we can safely access that here.
     75     */
     76    if (pCert->SeqCore.Asn1Core.uData.pv)
     77    {
     78        pabEncoded = (const unsigned char *)RTASN1CORE_GET_RAW_ASN1_PTR(&pCert->SeqCore.Asn1Core);
     79        uint32_t cbEncoded  = RTASN1CORE_GET_RAW_ASN1_SIZE(&pCert->SeqCore.Asn1Core);
     80        X509    *pOsslCert  = NULL;
     81        if (d2i_X509(&pOsslCert, &pabEncoded, cbEncoded) == pOsslCert)
     82        {
     83            *ppvOsslCert = pOsslCert;
     84            return VINF_SUCCESS;
     85        }
     86    }
     87    /*
     88     * Otherwise, we'll have to encode it into a temporary buffer that openssl
     89     * can decode into its structures.
     90     */
     91    else
     92    {
     93        PRTASN1CORE pNonConstCore = (PRTASN1CORE)&pCert->SeqCore.Asn1Core;
     94        uint32_t    cbEncoded     = 0;
     95        int rc = RTAsn1EncodePrepare(pNonConstCore, RTASN1ENCODE_F_DER, &cbEncoded, pErrInfo);
     96        AssertRCReturn(rc, rc);
     97
     98        void * const pvEncoded = RTMemTmpAllocZ(cbEncoded);
     99        AssertReturn(pvEncoded, VERR_NO_TMP_MEMORY);
     100
     101        rc = RTAsn1EncodeToBuffer(pNonConstCore, RTASN1ENCODE_F_DER, pvEncoded, cbEncoded, pErrInfo);
     102        if (RT_SUCCESS(rc))
     103        {
     104            pabEncoded = (const unsigned char *)pvEncoded;
     105            X509 *pOsslCert = NULL;
     106            if (d2i_X509(&pOsslCert, &pabEncoded, cbEncoded) == pOsslCert)
     107            {
     108                *ppvOsslCert = pOsslCert;
     109                RTMemTmpFree(pvEncoded);
     110                return VINF_SUCCESS;
     111            }
     112        }
     113        else
     114        {
     115            RTMemTmpFree(pvEncoded);
     116            return rc;
     117        }
     118    }
     119
     120    *ppvOsslCert = NULL;
     121    return RTErrInfoSet(pErrInfo, VERR_CR_X509_OSSL_D2I_FAILED, "d2i_X509");
     122}
     123
     124
     125DECLHIDDEN(void) rtCrOpenSslFreeConvertedX509Cert(void *pvOsslCert)
     126{
     127    X509_free((X509 *)pvOsslCert);
     128}
     129
     130
     131DECLHIDDEN(int) rtCrOpenSslAddX509CertToStack(void *pvOsslStack, PCRTCRX509CERTIFICATE pCert, PRTERRINFO pErrInfo)
     132{
     133    X509 *pOsslCert = NULL;
     134    int rc = rtCrOpenSslConvertX509Cert((void **)&pOsslCert, pCert, pErrInfo);
     135    if (RT_SUCCESS(rc))
    73136    {
    74137        if (sk_X509_push((STACK_OF(X509) *)pvOsslStack, pOsslCert))
    … …  
    76139        else
    77140        {
    78             rc = VERR_NO_MEMORY;
    79             X509_free(pOsslCert);
     141            rtCrOpenSslFreeConvertedX509Cert(pOsslCert);
     142            rc = RTErrInfoSet(pErrInfo, VERR_NO_MEMORY, "sk_X509_push");
    80143        }
    81144    }
    82     else
    83         rc = VERR_CR_X509_OSSL_D2I_FAILED;
    84145    return rc;
    85146}

  • trunk/src/VBox/Runtime/common/crypto/key-openssl.cpp

    r82968 r84230  
    6060 * @param   pErrInfo        Where to optionally return more error details.
    6161 */
    62 DECLHIDDEN(int) rtCrKeyToOpenSslKey(RTCRKEY hKey, bool fNeedPublic, const char *pszAlgoObjId,
    63                                     void /*EVP_PKEY*/ **ppEvpKey, const void /*EVP_MD*/ **ppEvpMdType, PRTERRINFO pErrInfo)
     62DECLHIDDEN(int) rtCrKeyToOpenSslKey(RTCRKEY hKey, bool fNeedPublic, void /*EVP_PKEY*/ **ppEvpKey, PRTERRINFO pErrInfo)
     63{
     64    *ppEvpKey = NULL;
     65    AssertReturn(hKey->u32Magic == RTCRKEYINT_MAGIC, VERR_INVALID_HANDLE);
     66    AssertReturn(fNeedPublic == !(hKey->fFlags & RTCRKEYINT_F_PRIVATE), VERR_WRONG_TYPE);
     67
     68    rtCrOpenSslInit();
     69
     70    /*
     71     * Translate the key type from IPRT to EVP speak.
     72     */
     73    int         idKeyType;
     74    switch (hKey->enmType)
     75    {
     76        case RTCRKEYTYPE_RSA_PRIVATE:
     77        case RTCRKEYTYPE_RSA_PUBLIC:
     78            idKeyType = EVP_PKEY_RSA;
     79            break;
     80        default:
     81            return RTErrInfoSetF(pErrInfo, VERR_NOT_SUPPORTED, "Unsupported key type: %d", hKey->enmType);
     82    }
     83
     84    /*
     85     * Allocate a new key structure and set its type.
     86     */
     87    EVP_PKEY *pEvpNewKey = EVP_PKEY_new();
     88    if (!pEvpNewKey)
     89        return RTErrInfoSetF(pErrInfo, VERR_NO_MEMORY, "EVP_PKEY_new/%d failed", idKeyType);
     90
     91    /*
     92     * Load the key into the structure.
     93     */
     94    const unsigned char *puchPublicKey = hKey->pbEncoded;
     95    EVP_PKEY *pRet;
     96    if (fNeedPublic)
     97        *ppEvpKey = pRet = d2i_PublicKey(idKeyType, &pEvpNewKey, &puchPublicKey, hKey->cbEncoded);
     98    else
     99        *ppEvpKey = pRet = d2i_PrivateKey(idKeyType, &pEvpNewKey, &puchPublicKey, hKey->cbEncoded);
     100    if (pRet)
     101        return VINF_SUCCESS;
     102
     103    /* Bail out: */
     104    EVP_PKEY_free(pEvpNewKey);
     105    return RTErrInfoSet(pErrInfo, VERR_CR_PKIX_OSSL_D2I_PUBLIC_KEY_FAILED,
     106                        fNeedPublic ? "d2i_PublicKey failed" : "d2i_PrivateKey failed");
     107}
     108
     109
     110/**
     111 * Creates an OpenSSL key for the given IPRT one, returning the message digest
     112 * algorithm if desired.
     113 *
     114 * @returns IRPT status code.
     115 * @param   hKey            The key to convert to an OpenSSL key.
     116 * @param   fNeedPublic     Set if we need the public side of the key.
     117 * @param   pszAlgoObjId    Alogrithm stuff we currently need.
     118 * @param   ppEvpKey        Where to return the pointer to the key structure.
     119 * @param   ppEvpMdType     Where to optionally return the message digest type.
     120 * @param   pErrInfo        Where to optionally return more error details.
     121 */
     122DECLHIDDEN(int) rtCrKeyToOpenSslKeyEx(RTCRKEY hKey, bool fNeedPublic, const char *pszAlgoObjId,
     123                                      void /*EVP_PKEY*/ **ppEvpKey, const void /*EVP_MD*/ **ppEvpMdType, PRTERRINFO pErrInfo)
    64124{
    65125    *ppEvpKey = NULL;

  • trunk/src/VBox/Runtime/common/crypto/pemfile-write.cpp

    r84211 r84230  
    110110    cchRet += pfnOutput(pvUser, NULL, 0);
    111111
     112    return cchRet;
     113}
     114
     115
     116RTDECL(ssize_t) RTCrPemWriteBlobToVfsIoStrm(RTVFSIOSTREAM hVfsIos, const void *pvContent, size_t cbContent, const char *pszMarker)
     117{
     118    VFSIOSTRMOUTBUF Buf;
     119    VFSIOSTRMOUTBUF_INIT(&Buf, hVfsIos);
     120    size_t cchRet = RTCrPemWriteBlob(RTVfsIoStrmStrOutputCallback, &Buf, pvContent, cbContent, pszMarker);
     121    Assert(Buf.offBuf == 0);
     122    return RT_SUCCESS(Buf.rc) ? (ssize_t)cchRet : Buf.rc;
     123}
     124
     125
     126RTDECL(ssize_t) RTCrPemWriteBlobToVfsFile(RTVFSFILE hVfsFile, const void *pvContent, size_t cbContent, const char *pszMarker)
     127{
     128    RTVFSIOSTREAM hVfsIos = RTVfsFileToIoStream(hVfsFile);
     129    AssertReturn(hVfsIos != NIL_RTVFSIOSTREAM, VERR_INVALID_HANDLE);
     130    ssize_t cchRet = RTCrPemWriteBlobToVfsIoStrm(hVfsIos, pvContent, cbContent, pszMarker);
     131    RTVfsIoStrmRelease(hVfsIos);
    112132    return cchRet;
    113133}
    … …  
    236256}
    237257
     258

  • trunk/src/VBox/Runtime/common/crypto/pkcs7-verify.cpp

    r82968 r84230  
    6868        STACK_OF(X509) *pAddCerts = NULL;
    6969        if (hAdditionalCerts != NIL_RTCRSTORE)
    70             rcOssl = RTCrStoreConvertToOpenSslCertStack(hAdditionalCerts, 0, (void **)&pAddCerts);
     70            rcOssl = RTCrStoreConvertToOpenSslCertStack(hAdditionalCerts, 0, (void **)&pAddCerts, pErrInfo);
    7171        else
    7272        {
    … …  
    7979            for (uint32_t i = 0; i < pCerts->cItems; i++)
    8080                if (pCerts->papItems[i]->enmChoice == RTCRPKCS7CERTCHOICE_X509)
    81                     rtCrOpenSslAddX509CertToStack(pAddCerts, pCerts->papItems[i]->u.pX509Cert);
     81                    rtCrOpenSslAddX509CertToStack(pAddCerts, pCerts->papItems[i]->u.pX509Cert, NULL);
    8282
    8383            X509_STORE *pTrustedCerts = NULL;
    8484            if (hTrustedCerts != NIL_RTCRSTORE)
    85                 rcOssl = RTCrStoreConvertToOpenSslCertStore(hTrustedCerts, 0, (void **)&pTrustedCerts);
     85                rcOssl = RTCrStoreConvertToOpenSslCertStore(hTrustedCerts, 0, (void **)&pTrustedCerts, pErrInfo);
    8686            if (RT_SUCCESS(rcOssl))
    8787            {

  • trunk/src/VBox/Runtime/common/crypto/pkix-sign.cpp

    r82968 r84230  
    155155    EVP_PKEY     *pEvpPrivateKey = NULL;
    156156    const EVP_MD *pEvpMdType = NULL;
    157     int rcOssl = rtCrKeyToOpenSslKey(hPrivateKey, false /*fNeedPublic*/, pszAlgObjId,
    158                                      (void **)&pEvpPrivateKey, (const void **)&pEvpMdType, pErrInfo);
     157    int rcOssl = rtCrKeyToOpenSslKeyEx(hPrivateKey, false /*fNeedPublic*/, pszAlgObjId,
     158                                       (void **)&pEvpPrivateKey, (const void **)&pEvpMdType, pErrInfo);
    159159    if (RT_SUCCESS(rcOssl))
    160160    {

  • trunk/src/VBox/Runtime/common/crypto/pkix-verify.cpp

    r82968 r84230  
    116116    EVP_PKEY     *pEvpPublicKey = NULL;
    117117    const EVP_MD *pEvpMdType = NULL;
    118     int rcOssl = rtCrKeyToOpenSslKey(hPublicKey, true /*fNeedPublic*/, pAlgorithm->szObjId,
    119                                      (void **)&pEvpPublicKey, (const void **)&pEvpMdType, pErrInfo);
     118    int rcOssl = rtCrKeyToOpenSslKeyEx(hPublicKey, true /*fNeedPublic*/, pAlgorithm->szObjId,
     119                                       (void **)&pEvpPublicKey, (const void **)&pEvpMdType, pErrInfo);
    120120    if (RT_SUCCESS(rcOssl))
    121121    {
    … …  
    230230    EVP_PKEY     *pEvpPublicKey = NULL;
    231231    const EVP_MD *pEvpMdType = NULL;
    232     int rcOssl = rtCrKeyToOpenSslKey(hPublicKey, true /*fNeedPublic*/, pszAlgObjId,
    233                                      (void **)&pEvpPublicKey, (const void **)&pEvpMdType, pErrInfo);
     232    int rcOssl = rtCrKeyToOpenSslKeyEx(hPublicKey, true /*fNeedPublic*/, pszAlgObjId,
     233                                       (void **)&pEvpPublicKey, (const void **)&pEvpMdType, pErrInfo);
    234234    if (RT_SUCCESS(rcOssl))
    235235    {

  • trunk/src/VBox/Runtime/common/crypto/store.cpp

    r82968 r84230  
    318318 */
    319319
    320 RTDECL(int) RTCrStoreConvertToOpenSslCertStore(RTCRSTORE hStore, uint32_t fFlags, void **ppvOpenSslStore)
    321 {
     320RTDECL(int) RTCrStoreConvertToOpenSslCertStore(RTCRSTORE hStore, uint32_t fFlags, void **ppvOpenSslStore, PRTERRINFO pErrInfo)
     321{
     322    RT_NOREF(pErrInfo);
    322323    PRTCRSTOREINT pThis = (PRTCRSTOREINT)hStore;
    323324    AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
    … …  
    372373
    373374
    374 RTDECL(int) RTCrStoreConvertToOpenSslCertStack(RTCRSTORE hStore, uint32_t fFlags, void **ppvOpenSslStack)
    375 {
     375RTDECL(int) RTCrStoreConvertToOpenSslCertStack(RTCRSTORE hStore, uint32_t fFlags, void **ppvOpenSslStack, PRTERRINFO pErrInfo)
     376{
     377    RT_NOREF(pErrInfo);
    376378    PRTCRSTOREINT pThis = (PRTCRSTOREINT)hStore;
    377379    AssertPtrReturn(pThis, VERR_INVALID_HANDLE);

  • trunk/src/VBox/Runtime/include/internal/iprt-openssl.h

    r82968 r84230  
    3939DECLHIDDEN(void) rtCrOpenSslInit(void);
    4040DECLHIDDEN(int)  rtCrOpenSslErrInfoCallback(const char *pach, size_t cch, void *pvUser);
    41 DECLHIDDEN(int)  rtCrOpenSslAddX509CertToStack(void *pvOsslStack, PCRTCRX509CERTIFICATE pCert);
     41DECLHIDDEN(int)  rtCrOpenSslConvertX509Cert(void **ppvOsslCert, PCRTCRX509CERTIFICATE pCert, PRTERRINFO pErrInfo);
     42DECLHIDDEN(void) rtCrOpenSslFreeConvertedX509Cert(void *pvOsslCert);
     43DECLHIDDEN(int)  rtCrOpenSslAddX509CertToStack(void *pvOsslStack, PCRTCRX509CERTIFICATE pCert, PRTERRINFO pErrInfo);
    4244
    43 DECLHIDDEN(int)  rtCrKeyToOpenSslKey(RTCRKEY hKey, bool fNeedPublic, const char *pszAlgoObjId,
    44                                      void /*EVP_PKEY*/ **ppEvpKey, const void /*EVP_MD*/ **ppEvpMdType, PRTERRINFO pErrInfo);
     45DECLHIDDEN(int)  rtCrKeyToOpenSslKey(RTCRKEY hKey, bool fNeedPublic, void /*EVP_PKEY*/ **ppEvpKey, PRTERRINFO pErrInfo);
     46DECLHIDDEN(int)  rtCrKeyToOpenSslKeyEx(RTCRKEY hKey, bool fNeedPublic, const char *pszAlgoObjId,
     47                                       void /*EVP_PKEY*/ **ppEvpKey, const void /*EVP_MD*/ **ppEvpMdType, PRTERRINFO pErrInfo);
    4548
    4649RT_C_DECLS_END

  • trunk/src/libs/openssl-1.1.1g/Config.kmk

    r84229 r84230  
    7878        include/openssl/cmac.h=>cmac.h \
    7979        include/openssl/cms.h=>cms.h \
     80        include/openssl/cmserr.h=>cmserr.h \
    8081        include/openssl/comp.h=>comp.h \
    8182        include/openssl/comperr.h=>comperr.h \
Note: See TracChangeset for help on using the changeset viewer.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette