VirtualBox

Changeset 84310 in vbox


Ignore:
Timestamp:
May 14, 2020 5:40:35 PM (5 years ago)
Author:
vboxsync
Message:

IPRT/crypto: Adding RTAsn1EncodeQueryRawBits to deal with getting encoded bytes cheaply if possible and always safely. Fixed another place using RTASN1CORE_GET_RAW_ASN1_PTR and assuming input was decoded and had valid data pointers. Added RTCrStoreCertAddPkcs7 and RTCrStoreCertAddX509 for more conveniently adding decoded certs to stores. Added RTCRPKCS7VERIFY_SD_F_TRUST_ALL_CERTS to the PKCS7 verification code. Added RTCrPkcs7_ReadFromBuffer. bugref:9699

Location:
trunk
Files:
1 added
10 edited

Legend:

Unmodified
Added
Removed

  • trunk/include/iprt/asn1.h

    r82968 r84310  
    16311631RTDECL(int) RTAsn1EncodeToBuffer(PCRTASN1CORE pRoot, uint32_t fFlags, void *pvBuf, size_t cbBuf, PRTERRINFO pErrInfo);
    16321632
     1633/**
     1634 * Helper for when DER encoded ASN.1 is needed for something.
     1635 *
     1636 * Handy when interfacing with OpenSSL and the many d2i_Xxxxx OpenSSL functions,
     1637 * but also handy when structures needs to be digested or similar during signing
     1638 * or verification.
     1639 *
     1640 * We sometimes can use the data we've decoded directly, but often we have
     1641 * encode it into a temporary heap buffer.
     1642 *
     1643 * @returns IPRT status code, details in @a pErrInfo if present.
     1644 * @param   pRoot       The ASN.1 root of the structure to be passed to OpenSSL.
     1645 * @param   ppbRaw      Where to return the pointer to raw encoded data.
     1646 * @param   pcbRaw      Where to return the size of the raw encoded data.
     1647 * @param   ppvFree     Where to return what to pass to RTMemTmpFree, i.e. NULL
     1648 *                      if we use the previously decoded data directly and
     1649 *                      non-NULL if we had to allocate heap and encode it.
     1650 * @param   pErrInfo    Where to return details about encoding issues. Optional.
     1651 */
     1652RTDECL(int) RTAsn1EncodeQueryRawBits(PRTASN1CORE pRoot, const uint8_t **ppbRaw, uint32_t *pcbRaw,
     1653                                     void **ppvFree, PRTERRINFO pErrInfo);
     1654
    16331655/** @} */
    16341656

  • trunk/include/iprt/crypto/pkcs7.h

    r84248 r84310  
    431431/** @} */
    432432
     433/** PKCS\#7/CMS (content info) markers. */
     434extern RTDATADECL(RTCRPEMMARKER const) g_aRTCrPkcs7Markers[];
     435/** Number of entries in g_aRTCrPkcs7Markers. */
     436extern RTDATADECL(uint32_t const)      g_cRTCrPkcs7Markers;
     437
     438/** @name Flags for RTCrPkcs7ContentInfo_ReadFromBuffer
     439 * @{ */
     440/** Only allow PEM certificates, not binary ones.
     441 * @sa RTCRPEMREADFILE_F_ONLY_PEM  */
     442#define RTCRPKCS7_READ_F_PEM_ONLY        RT_BIT(1)
     443/** @} */
     444
     445RTDECL(int) RTCrPkcs7_ReadFromBuffer(PRTCRPKCS7CONTENTINFO pContentInfo, const void *pvBuf, size_t cbBuf,
     446                                     uint32_t fFlags, PCRTASN1ALLOCATORVTABLE pAllocator,
     447                                     bool *pfCmsLabeled, PRTERRINFO pErrInfo, const char *pszErrorTag);
     448
    433449
    434450/**
    … …  
    552568                                                      void const *pvData, size_t cbData, PRTERRINFO pErrInfo);
    553569
    554 /** @name RTCRPKCS7VERIFY_SD_F_XXX - Flags for RTCrPkcs7VerifySignedData
     570/** @name RTCRPKCS7VERIFY_SD_F_XXX - Flags for RTCrPkcs7VerifySignedData and
     571 *                                   RTCrPkcs7VerifySignedDataWithExternalData
    555572 * @{ */
    556573/** Always use the signing time attribute if present, requiring it to be
    … …  
    559576#define RTCRPKCS7VERIFY_SD_F_ALWAYS_USE_SIGNING_TIME_IF_PRESENT     RT_BIT_32(0)
    560577/** Same as RTCRPKCS7VERIFY_SD_F_ALWAYS_USE_SIGNING_TIME_IF_PRESENT for the MS
    561  *  timestamp counter sigantures. */
     578 *  timestamp counter signatures. */
    562579#define RTCRPKCS7VERIFY_SD_F_ALWAYS_USE_MS_TIMESTAMP_IF_PRESENT     RT_BIT_32(1)
    563580/** Only use signing time attributes from counter signatures. */
    … …  
    577594 * signatures. */
    578595#define RTCRPKCS7VERIFY_SD_F_USAGE_TIMESTAMPING                     RT_BIT_32(6)
     596/** Skip the verification of the certificate trust paths, taking all
     597 * certificates to be trustworthy. */
     598#define RTCRPKCS7VERIFY_SD_F_TRUST_ALL_CERTS                        RT_BIT_32(7)
    579599
    580600/** Indicates internally that we're validating a counter signature and should
    … …  
    584604/** @} */
    585605
     606
     607RTDECL(int) RTCrPkcs7SimpleSignSignedData(uint32_t fFlags, PCRTCRX509CERTIFICATE pSigner, RTCRKEY hPrivateKey,
     608                                          void const *pvData, size_t cbData, RTDIGESTTYPE enmDigestType,
     609                                          RTCRSTORE hAdditionalCerts, void *pvResult, size_t *pcbResult, PRTERRINFO pErrInfo);
    586610
    587611/** @name RTCRPKCS7SIGN_SD_F_XXX - Flags for RTCrPkcs7SimpleSign.
    … …  
    595619/** @} */
    596620
    597 RTDECL(int) RTCrPkcs7SimpleSignSignedData(uint32_t fFlags, PCRTCRX509CERTIFICATE pSigner, RTCRKEY hPrivateKey,
    598                                           void const *pvData, size_t cbData, RTDIGESTTYPE enmDigestType,
    599                                           RTCRSTORE hAdditionalCerts, void *pvResult, size_t *pcbResult, PRTERRINFO pErrInfo);
    600 
    601621/** @} */
    602622

  • trunk/include/iprt/crypto/store.h

    r84230 r84310  
    182182
    183183/**
     184 * Add an X.509 packaged certificate to the store.
     185 *
     186 * @returns IPRT status code.
     187 * @retval  VWRN_ALREADY_EXISTS if the certificate is already present and
     188 *          RTCRCERTCTX_F_ADD_IF_NOT_FOUND was specified.
     189 * @retval  VERR_WRITE_PROTECT if the store doesn't support adding.
     190 * @param   hStore              The store to add the certificate to.
     191 * @param   fFlags              RTCRCERTCTX_F_XXX. Encoding must is optional,
     192 *                              but must be RTCRCERTCTX_F_ENC_X509_DER if given.
     193 *                              RTCRCERTCTX_F_ADD_IF_NOT_FOUND is supported.
     194 * @param   pCertificate        The certificate to add.  We may have to encode
     195 *                              it, thus not const.
     196 * @param   pErrInfo            Where to return additional error/warning info.
     197 *                              Optional.
     198 */
     199RTDECL(int) RTCrStoreCertAddX509(RTCRSTORE hStore, uint32_t fFlags, PRTCRX509CERTIFICATE pCertificate, PRTERRINFO pErrInfo);
     200
     201/**
    184202 * Adds certificates from files in the specified directory.
    185203 *

  • trunk/include/iprt/mangling.h

    r84296 r84310  
    29392939# define RTAsn1EncodeRecalcHdrSize                      RT_MANGLER(RTAsn1EncodeRecalcHdrSize)
    29402940# define RTAsn1EncodeToBuffer                           RT_MANGLER(RTAsn1EncodeToBuffer)
     2941# define RTAsn1EncodeQueryRawBits                       RT_MANGLER(RTAsn1EncodeQueryRawBits)
    29412942# define RTAsn1EncodeWrite                              RT_MANGLER(RTAsn1EncodeWrite)
    29422943# define RTAsn1EncodeWriteHeader                        RT_MANGLER(RTAsn1EncodeWriteHeader)
    … …  
    33643365# define RTCrPemWriteAsn1ToVfsFile                      RT_MANGLER(RTCrPemWriteAsn1ToVfsFile)
    33653366# define RTCrPkcs5Pbkdf2Hmac                            RT_MANGLER(RTCrPkcs5Pbkdf2Hmac)
     3367# define RTCrPkcs7_ReadFromBuffer                       RT_MANGLER(RTCrPkcs7_ReadFromBuffer)
    33663368# define RTCrPkcs7Attribute_DecodeAsn1                  RT_MANGLER(RTCrPkcs7Attribute_DecodeAsn1)
    33673369# define RTCrPkcs7Attributes_DecodeAsn1                 RT_MANGLER(RTCrPkcs7Attributes_DecodeAsn1)
    … …  
    38573859# define RTCrCertCtxRetain                              RT_MANGLER(RTCrCertCtxRetain)
    38583860# define RTCrStoreCertAddEncoded                        RT_MANGLER(RTCrStoreCertAddEncoded)
     3861# define RTCrStoreCertAddX509                           RT_MANGLER(RTCrStoreCertAddX509)
    38593862# define RTCrStoreCertByIssuerAndSerialNo               RT_MANGLER(RTCrStoreCertByIssuerAndSerialNo)
    38603863# define RTCrStoreCertCount                             RT_MANGLER(RTCrStoreCertCount)
    … …  
    40464049# define g_RTAsn1EFenceAllocator                        RT_MANGLER(g_RTAsn1EFenceAllocator)
    40474050# define g_RTAsn1SaferAllocator                         RT_MANGLER(g_RTAsn1SaferAllocator)
     4051# define g_aRTCrPkcs7Markers                            RT_MANGLER(g_aRTCrPkcs7Markers)
     4052# define g_cRTCrPkcs7Markers                            RT_MANGLER(g_cRTCrPkcs7Markers)
    40484053# define g_aRTCrX509CertificateMarkers                  RT_MANGLER(g_aRTCrX509CertificateMarkers)
    40494054# define g_cRTCrX509CertificateMarkers                  RT_MANGLER(g_cRTCrX509CertificateMarkers)

  • trunk/src/VBox/Runtime/Makefile.kmk

    r84293 r84310  
    397397        common/crypto/pkcs7-asn1-decoder.cpp \
    398398        common/crypto/pkcs7-core.cpp \
     399        common/crypto/pkcs7-file.cpp \
    399400        common/crypto/pkcs7-init.cpp \
    400401        common/crypto/pkcs7-sanity.cpp \

  • trunk/src/VBox/Runtime/common/asn1/asn1-encode.cpp

    r82968 r84310  
    3636#include <iprt/ctype.h>
    3737#include <iprt/err.h>
     38#include <iprt/mem.h>
    3839#include <iprt/string.h>
    3940
    … …  
    475476}
    476477
     478
     479RTDECL(int) RTAsn1EncodeQueryRawBits(PRTASN1CORE pRoot, const uint8_t **ppbRaw, uint32_t *pcbRaw,
     480                                     void **ppvFree, PRTERRINFO pErrInfo)
     481{
     482    /*
     483     * ASSUME that if we've got pointers here, they are valid...
     484     */
     485    if (   pRoot->uData.pv
     486        && !(pRoot->fFlags & RTASN1CORE_F_INDEFINITE_LENGTH) /* BER, not DER. */
     487        && (pRoot->fFlags & RTASN1CORE_F_DECODED_CONTENT) )
     488    {
     489        /** @todo Check that it's DER encoding. */
     490        *ppbRaw  = RTASN1CORE_GET_RAW_ASN1_PTR(pRoot);
     491        *pcbRaw  = RTASN1CORE_GET_RAW_ASN1_SIZE(pRoot);
     492        *ppvFree = NULL;
     493        return VINF_SUCCESS;
     494    }
     495
     496    /*
     497     * Encode it into a temporary heap buffer.
     498     */
     499    uint32_t cbEncoded = 0;
     500    int rc = RTAsn1EncodePrepare(pRoot, RTASN1ENCODE_F_DER, &cbEncoded, pErrInfo);
     501    if (RT_SUCCESS(rc))
     502    {
     503        void *pvEncoded = RTMemTmpAllocZ(cbEncoded);
     504        if (pvEncoded)
     505        {
     506            rc = RTAsn1EncodeToBuffer(pRoot, RTASN1ENCODE_F_DER, pvEncoded, cbEncoded, pErrInfo);
     507            if (RT_SUCCESS(rc))
     508            {
     509                *ppvFree = pvEncoded;
     510                *ppbRaw  = (unsigned char *)pvEncoded;
     511                *pcbRaw  = cbEncoded;
     512                return VINF_SUCCESS;
     513            }
     514            RTMemTmpFree(pvEncoded);
     515        }
     516        else
     517            rc = RTErrInfoSetF(pErrInfo, VERR_NO_TMP_MEMORY, "RTMemTmpAllocZ(%u)", cbEncoded);
     518    }
     519
     520    *ppvFree = NULL;
     521    *ppbRaw  = NULL;
     522    *pcbRaw  = 0;
     523    return rc;
     524}
     525

  • trunk/src/VBox/Runtime/common/crypto/iprt-openssl.cpp

    r84248 r84310  
    7070{
    7171    const unsigned char *pabEncoded;
    72 
    73     /*
    74      * ASSUME that if the certificate has data pointers, it's been parsed out
    75      * of a binary blob and we can safely access that here.
    76      */
    77     if (pCert->SeqCore.Asn1Core.uData.pv)
     72    uint32_t             cbEncoded;
     73    void                *pvFree;
     74    int rc = RTAsn1EncodeQueryRawBits(RTCrX509Certificate_GetAsn1Core(pCert),
     75                                      (const uint8_t **)&pabEncoded, &cbEncoded, &pvFree, pErrInfo);
     76    if (RT_SUCCESS(rc))
    7877    {
    79         pabEncoded = (const unsigned char *)RTASN1CORE_GET_RAW_ASN1_PTR(&pCert->SeqCore.Asn1Core);
    80         uint32_t cbEncoded  = RTASN1CORE_GET_RAW_ASN1_SIZE(&pCert->SeqCore.Asn1Core);
    81         X509    *pOsslCert  = NULL;
    82         if (d2i_X509(&pOsslCert, &pabEncoded, cbEncoded) == pOsslCert)
     78        X509 *pOsslCert = NULL;
     79        X509 *pOsslCertRet = d2i_X509(&pOsslCert, &pabEncoded, cbEncoded);
     80        RTMemTmpFree(pvFree);
     81        if (pOsslCertRet == pOsslCert)
    8382        {
    8483            *ppvOsslCert = pOsslCert;
    8584            return VINF_SUCCESS;
    8685        }
     86        rc = RTErrInfoSet(pErrInfo, VERR_CR_X509_OSSL_D2I_FAILED, "d2i_X509");
     87
    8788    }
    88     /*
    89      * Otherwise, we'll have to encode it into a temporary buffer that openssl
    90      * can decode into its structures.
    91      */
    92     else
    93     {
    94         PRTASN1CORE pNonConstCore = (PRTASN1CORE)&pCert->SeqCore.Asn1Core;
    95         uint32_t    cbEncoded     = 0;
    96         int rc = RTAsn1EncodePrepare(pNonConstCore, RTASN1ENCODE_F_DER, &cbEncoded, pErrInfo);
    97         AssertRCReturn(rc, rc);
    98 
    99         void * const pvEncoded = RTMemTmpAllocZ(cbEncoded);
    100         AssertReturn(pvEncoded, VERR_NO_TMP_MEMORY);
    101 
    102         rc = RTAsn1EncodeToBuffer(pNonConstCore, RTASN1ENCODE_F_DER, pvEncoded, cbEncoded, pErrInfo);
    103         if (RT_SUCCESS(rc))
    104         {
    105             pabEncoded = (const unsigned char *)pvEncoded;
    106             X509 *pOsslCert = NULL;
    107             if (d2i_X509(&pOsslCert, &pabEncoded, cbEncoded) == pOsslCert)
    108             {
    109                 *ppvOsslCert = pOsslCert;
    110                 RTMemTmpFree(pvEncoded);
    111                 return VINF_SUCCESS;
    112             }
    113         }
    114         else
    115         {
    116             RTMemTmpFree(pvEncoded);
    117             return rc;
    118         }
    119     }
    120 
    12189    *ppvOsslCert = NULL;
    122     return RTErrInfoSet(pErrInfo, VERR_CR_X509_OSSL_D2I_FAILED, "d2i_X509");
     90    return rc;
    12391}
    12492

  • trunk/src/VBox/Runtime/common/crypto/pkcs7-verify.cpp

    r84230 r84310  
    3333
    3434#include <iprt/err.h>
     35#include <iprt/mem.h>
    3536#include <iprt/string.h>
    3637#include <iprt/crypto/digest.h>
    … …  
    5960     * Verify using OpenSSL.          ERR_PUT_error
    6061     */
    61     int rcOssl;
    62     unsigned char const *pbRawContent = RTASN1CORE_GET_RAW_ASN1_PTR(&pContentInfo->SeqCore.Asn1Core);
    63     uint32_t             cbRawContent = RTASN1CORE_GET_RAW_ASN1_SIZE(&pContentInfo->SeqCore.Asn1Core)
    64                                       + (pContentInfo->SeqCore.Asn1Core.fFlags & RTASN1CORE_F_INDEFINITE_LENGTH ? 2 : 0);
    65     PKCS7 *pOsslPkcs7 = NULL;
    66     if (d2i_PKCS7(&pOsslPkcs7, &pbRawContent, cbRawContent) != NULL)
     62    unsigned char const *pbRawContent;
     63    uint32_t             cbRawContent;
     64    void                *pvFree;
     65    int rcOssl = RTAsn1EncodeQueryRawBits(RTCrPkcs7ContentInfo_GetAsn1Core(pContentInfo),
     66                                          (const uint8_t **)&pbRawContent, &cbRawContent, &pvFree, pErrInfo);
     67    AssertRCReturn(rcOssl, rcOssl);
     68
     69    PKCS7 *pOsslPkcs7   = NULL;
     70    PKCS7 *pOsslPkcs7Ret = d2i_PKCS7(&pOsslPkcs7, &pbRawContent, cbRawContent);
     71
     72    RTMemTmpFree(pvFree);
     73
     74    if (pOsslPkcs7Ret != NULL)
    6775    {
    6876        STACK_OF(X509) *pAddCerts = NULL;
    … …  
    317325
    318326        /* ASSUMES that the attributes are encoded according to DER. */
    319         uint8_t const  *pbData = (uint8_t const *)RTASN1CORE_GET_RAW_ASN1_PTR(&pSignerInfo->AuthenticatedAttributes.SetCore.Asn1Core);
    320         uint32_t        cbData = RTASN1CORE_GET_RAW_ASN1_SIZE(&pSignerInfo->AuthenticatedAttributes.SetCore.Asn1Core);
    321         uint8_t         bSetOfTag = ASN1_TAG_SET | ASN1_TAGCLASS_UNIVERSAL | ASN1_TAGFLAG_CONSTRUCTED;
    322         rc = RTCrDigestUpdate(hDigest, &bSetOfTag, sizeof(bSetOfTag)); /* Replace the implict tag with a SET-OF tag. */
     327        uint8_t const  *pbData;
     328        uint32_t        cbData;
     329        void           *pvFree = NULL;
     330        rc = RTAsn1EncodeQueryRawBits(RTCrPkcs7Attributes_GetAsn1Core(&pSignerInfo->AuthenticatedAttributes),
     331                                      &pbData, &cbData, &pvFree, pErrInfo);
    323332        if (RT_SUCCESS(rc))
    324             rc = RTCrDigestUpdate(hDigest, pbData + sizeof(bSetOfTag), cbData - sizeof(bSetOfTag)); /* Skip the implicit tag. */
    325         if (RT_SUCCESS(rc))
    326             rc = RTCrDigestFinal(hDigest, NULL, 0);
     333        {
     334            uint8_t bSetOfTag = ASN1_TAG_SET | ASN1_TAGCLASS_UNIVERSAL | ASN1_TAGFLAG_CONSTRUCTED;
     335            rc = RTCrDigestUpdate(hDigest, &bSetOfTag, sizeof(bSetOfTag)); /* Replace the implict tag with a SET-OF tag. */
     336            if (RT_SUCCESS(rc))
     337                rc = RTCrDigestUpdate(hDigest, pbData + sizeof(bSetOfTag), cbData - sizeof(bSetOfTag)); /* Skip the implicit tag. */
     338            if (RT_SUCCESS(rc))
     339                rc = RTCrDigestFinal(hDigest, NULL, 0);
     340            RTMemTmpFree(pvFree);
     341        }
    327342    }
    328343    return rc;
    … …  
    425440     */
    426441    int rc = VINF_SUCCESS;
    427     if (   hSignerCertSrc == NIL_RTCRSTORE
    428         || hSignerCertSrc != hTrustedCerts)
     442    if (   (   hSignerCertSrc == NIL_RTCRSTORE
     443            || hSignerCertSrc != hTrustedCerts)
     444        && !(fFlags & RTCRPKCS7VERIFY_SD_F_TRUST_ALL_CERTS) )
    429445    {
    430446        RTCRX509CERTPATHS hCertPaths;

  • trunk/src/VBox/Runtime/common/crypto/store.cpp

    r84253 r84310  
    3737#include <iprt/string.h>
    3838
     39#include <iprt/crypto/pkcs7.h>
    3940#include <iprt/crypto/x509.h>
    4041
    … …  
    188189}
    189190
     191
     192RTDECL(int) RTCrStoreCertAddX509(RTCRSTORE hStore, uint32_t fFlags, PRTCRX509CERTIFICATE pCertificate, PRTERRINFO pErrInfo)
     193{
     194    /*
     195     * Validate.
     196     */
     197    PRTCRSTOREINT pThis = (PRTCRSTOREINT)hStore;
     198    AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
     199    AssertReturn(pThis->u32Magic == RTCRSTOREINT_MAGIC, VERR_INVALID_HANDLE);
     200
     201    AssertPtrReturn(pCertificate, VERR_INVALID_POINTER);
     202    AssertReturn(RTCrX509Certificate_IsPresent(pCertificate), VERR_INVALID_PARAMETER);
     203    int rc = RTCrX509Certificate_CheckSanity(pCertificate, 0, pErrInfo, "Cert");
     204    AssertRCReturn(rc, rc);
     205
     206    AssertReturn(!(fFlags & ~(RTCRCERTCTX_F_ADD_IF_NOT_FOUND | RTCRCERTCTX_F_ENC_MASK)), VERR_INVALID_FLAGS);
     207    AssertCompile(RTCRCERTCTX_F_ENC_X509_DER == 0);
     208    AssertMsgReturn((fFlags & RTCRCERTCTX_F_ENC_MASK) == RTCRCERTCTX_F_ENC_X509_DER,
     209                    ("Invalid encoding: %#x\n", fFlags), VERR_INVALID_FLAGS);
     210
     211    /*
     212     * Encode and add it using pfnCertAddEncoded.
     213     */
     214    if (pThis->pProvider->pfnCertAddEncoded)
     215    {
     216        PRTASN1CORE pCore     = RTCrX509Certificate_GetAsn1Core(pCertificate);
     217        uint32_t    cbEncoded = 0;
     218        rc = RTAsn1EncodePrepare(pCore, RTASN1ENCODE_F_DER, &cbEncoded, pErrInfo);
     219        if (RT_SUCCESS(rc))
     220        {
     221            uint8_t * const pbEncoded = (uint8_t *)RTMemTmpAllocZ(cbEncoded);
     222            if (pbEncoded)
     223            {
     224                rc = RTAsn1EncodeToBuffer(pCore, RTASN1ENCODE_F_DER, pbEncoded, cbEncoded, pErrInfo);
     225                if (RT_SUCCESS(rc))
     226                    rc = pThis->pProvider->pfnCertAddEncoded(pThis->pvProvider, fFlags, pbEncoded, cbEncoded, pErrInfo);
     227                RTMemTmpFree(pbEncoded);
     228            }
     229            else
     230                rc = VERR_NO_TMP_MEMORY;
     231        }
     232    }
     233    else
     234        rc = VERR_WRITE_PROTECT;
     235
     236    return rc;
     237}
     238
     239
     240RTDECL(int) RTCrStoreCertAddPkcs7(RTCRSTORE hStore, uint32_t fFlags, PRTCRPKCS7CERT pCertificate, PRTERRINFO pErrInfo)
     241{
     242    AssertPtrReturn(pCertificate, VERR_INVALID_POINTER);
     243    AssertReturn(RTCrPkcs7Cert_IsPresent(pCertificate), VERR_INVALID_PARAMETER);
     244    switch (pCertificate->enmChoice)
     245    {
     246        case RTCRPKCS7CERTCHOICE_X509:
     247            return RTCrStoreCertAddX509(hStore, fFlags, pCertificate->u.pX509Cert, pErrInfo);
     248
     249        case RTCRPKCS7CERTCHOICE_EXTENDED_PKCS6:
     250            return RTErrInfoSetF(pErrInfo, VERR_NOT_IMPLEMENTED, "RTCrStoreCertAddPkcs7 does not implement EXTENDED_PKCS6");
     251        case RTCRPKCS7CERTCHOICE_AC_V1:
     252            return RTErrInfoSetF(pErrInfo, VERR_NOT_IMPLEMENTED, "RTCrStoreCertAddPkcs7 does not implement AC_V1");
     253        case RTCRPKCS7CERTCHOICE_AC_V2:
     254            return RTErrInfoSetF(pErrInfo, VERR_NOT_IMPLEMENTED, "RTCrStoreCertAddPkcs7 does not implement AC_V2");
     255        case RTCRPKCS7CERTCHOICE_OTHER:
     256            return RTErrInfoSetF(pErrInfo, VERR_NOT_IMPLEMENTED, "RTCrStoreCertAddPkcs7 does not implement OTHER");
     257        case RTCRPKCS7CERTCHOICE_END:
     258        case RTCRPKCS7CERTCHOICE_INVALID:
     259        case RTCRPKCS7CERTCHOICE_32BIT_HACK:
     260            break;
     261        /* no default */
     262    }
     263    return RTErrInfoSetF(pErrInfo, VERR_INVALID_PARAMETER, "Invalid RTCRPKCS7CERT enmChoice value: %d", pCertificate->enmChoice);
     264}
    190265
    191266

  • trunk/src/VBox/Runtime/common/crypto/x509-verify.cpp

    r82968 r84310  
    8989     * encoded bits are missing.
    9090     */
    91     if (   pThis->TbsCertificate.SeqCore.Asn1Core.uData.pu8
    92         && pThis->TbsCertificate.SeqCore.Asn1Core.cb > 0)
     91    const uint8_t  *pbRaw;
     92    uint32_t        cbRaw;
     93    void           *pvFree = NULL;
     94    rc = RTAsn1EncodeQueryRawBits(RTCrX509TbsCertificate_GetAsn1Core(&pThis->TbsCertificate), &pbRaw, &cbRaw, &pvFree, pErrInfo);
     95    if (RT_SUCCESS(rc))
     96    {
    9397        rc = RTCrPkixPubKeyVerifySignature(&pThis->SignatureAlgorithm.Algorithm, hPubKey, pParameters, &pThis->SignatureValue,
    94                                            RTASN1CORE_GET_RAW_ASN1_PTR(&pThis->TbsCertificate.SeqCore.Asn1Core),
    95                                            RTASN1CORE_GET_RAW_ASN1_SIZE(&pThis->TbsCertificate.SeqCore.Asn1Core),
    96                                            pErrInfo);
    97     else
    98     {
    99         uint32_t cbEncoded;
    100         rc = RTAsn1EncodePrepare((PRTASN1CORE)&pThis->TbsCertificate.SeqCore.Asn1Core, RTASN1ENCODE_F_DER, &cbEncoded, pErrInfo);
    101         if (RT_SUCCESS(rc))
    102         {
    103             void *pvTbsBits = RTMemTmpAlloc(cbEncoded);
    104             if (pvTbsBits)
    105             {
    106                 rc = RTAsn1EncodeToBuffer(&pThis->TbsCertificate.SeqCore.Asn1Core, RTASN1ENCODE_F_DER,
    107                                           pvTbsBits, cbEncoded, pErrInfo);
    108                 if (RT_SUCCESS(rc))
    109                     rc = RTCrPkixPubKeyVerifySignature(&pThis->SignatureAlgorithm.Algorithm, hPubKey, pParameters,
    110                                                        &pThis->SignatureValue, pvTbsBits, cbEncoded, pErrInfo);
    111                 else
    112                     AssertRC(rc);
    113                 RTMemTmpFree(pvTbsBits);
    114             }
    115             else
    116                 rc = VERR_NO_TMP_MEMORY;
    117         }
     98                                           pbRaw, cbRaw, pErrInfo);
     99        RTMemTmpFree(pvFree);
    118100    }
    119101
Note: See TracChangeset for help on using the changeset viewer.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette