Changeset 84330 in vbox

Timestamp:

May 18, 2020 1:37:00 PM (5 years ago)

Author:

vboxsync

Message:

IPRT: Adding some new flags to the PKCS#7/CMS verification routines. bugref:9699

Location:

trunk

Files:

• include/iprt/crypto/pkcs7.h (modified) (3 diffs)
• src/VBox/Runtime/common/crypto/pkcs7-verify.cpp (modified) (7 diffs)

trunk/include/iprt/crypto/pkcs7.h

@@ -527 +527 @@
  *                              certificates chains at.  Ignored for signatures
  *                              with valid signing time attributes.
+ *                              When RTCRPKCS7VERIFY_SD_F_UPDATE_VALIDATION_TIME
+ *                              is set, this is updated to the actual validation
+ *                              time used.
  * @param   pfnVerifyCert       Callback for checking that a certificate used
  *                              for signing the data is suitable.
@@ -554 +557 @@
  *                              certificates chains at.  Ignored for signatures
  *                              with valid signing time attributes.
+ *                              When RTCRPKCS7VERIFY_SD_F_UPDATE_VALIDATION_TIME
+ *                              is set, this is updated to the actual validation
+ *                              time used.
  * @param   pfnVerifyCert       Callback for checking that a certificate used
  *                              for signing the data is suitable.
@@ -597 +603 @@
  * certificates to be trustworthy. */
 #define RTCRPKCS7VERIFY_SD_F_TRUST_ALL_CERTS                        RT_BIT_32(7)
+/** Update @a pValidationTime with the actual validation time used.
+ * This requires RTCRPKCS7VERIFY_SD_F_HAS_SIGNER_INDEX to get a consistent
+ * result.  And yeah, it unconst the parameter, which is patently ugly. */
+#define RTCRPKCS7VERIFY_SD_F_UPDATE_VALIDATION_TIME                 RT_BIT_32(8)
+
+/** This can be used to only verify one given signer info.
+ * Max index value is 15.  */
+#define RTCRPKCS7VERIFY_SD_F_SIGNER_INDEX(a_idxSignerInfo) \
+    (  RTCRPKCS7VERIFY_SD_F_HAS_SIGNER_INDEX \
+     | (((a_idxSignerInfo) & RTCRPKCS7VERIFY_SD_F_SIGNER_INDEX_MAX) << RTCRPKCS7VERIFY_SD_F_SIGNER_INDEX_SHIFT) )
+/** Has a valid value in RTCRPKCS7VERIFY_SD_F_SIGNER_INDEX_MASK. */
+#define RTCRPKCS7VERIFY_SD_F_HAS_SIGNER_INDEX                       RT_BIT_32(23)
+/** Signer index shift value. */
+#define RTCRPKCS7VERIFY_SD_F_SIGNER_INDEX_SHIFT                     24
+/** Signer index mask. */
+#define RTCRPKCS7VERIFY_SD_F_SIGNER_INDEX_MASK                      UINT32_C(0x0f000000)
+/** Max signer index value (inclusive). */
+#define RTCRPKCS7VERIFY_SD_F_SIGNER_INDEX_MAX \
+    (RTCRPKCS7VERIFY_SD_F_SIGNER_INDEX_MASK >> RTCRPKCS7VERIFY_SD_F_SIGNER_INDEX_SHIFT)
 
 /** Indicates internally that we're validating a counter signature and should

trunk/src/VBox/Runtime/common/crypto/pkcs7-verify.cpp

@@ -441 +441 @@
     int rc = VINF_SUCCESS;
     if (   (   hSignerCertSrc == NIL_RTCRSTORE
-            || hSignerCertSrc != hTrustedCerts)
+            || hSignerCertSrc != hTrustedCerts ) /** @todo 'hSignerCertSrc != hTrustedCerts' ain't making sense wrt pValidationTime */
         && !(fFlags & RTCRPKCS7VERIFY_SD_F_TRUST_ALL_CERTS) )
     {
@@ -659 +659 @@
         {
             /*
-             * Validate the signed infos.
+             * Validate the signed infos.  The flags may select one particular entry.
              */
+            RTTIMESPEC const GivenValidationTime = *pValidationTime;
             uint32_t fPrimaryVccFlags = !(fFlags & RTCRPKCS7VERIFY_SD_F_USAGE_TIMESTAMPING)
                                       ? RTCRPKCS7VCC_F_SIGNED_DATA : RTCRPKCS7VCC_F_TIMESTAMP;
+            uint32_t cItems           = pSignedData->SignerInfos.cItems;
+            i                         = 0;
+            if (fFlags & RTCRPKCS7VERIFY_SD_F_HAS_SIGNER_INDEX)
+            {
+                i      = (fFlags & RTCRPKCS7VERIFY_SD_F_SIGNER_INDEX_MASK) >> RTCRPKCS7VERIFY_SD_F_SIGNER_INDEX_SHIFT;
+                cItems = RT_MIN(cItems, i + 1);
+            }
             rc = VERR_CR_PKCS7_NO_SIGNER_INFOS;
-            for (i = 0; i < pSignedData->SignerInfos.cItems; i++)
+            for (; i < cItems; i++)
             {
                 PCRTCRPKCS7SIGNERINFO   pSignerInfo = pSignedData->SignerInfos.papItems[i];
@@ -699 +707 @@
                             rc = VINF_SUCCESS;
                             if (!(fFlags & RTCRPKCS7VERIFY_SD_F_USE_SIGNING_TIME_UNVERIFIED))
-                                rc = rtCrPkcs7VerifyCounterSignerInfo(pSigningTimeSigner, pSignerInfo, pSignedData, fFlags,
+                                rc = rtCrPkcs7VerifyCounterSignerInfo(pSigningTimeSigner, pSignerInfo, pSignedData,
+                                                                      fFlags & ~RTCRPKCS7VERIFY_SD_F_UPDATE_VALIDATION_TIME,
                                                                       hAdditionalCerts, hTrustedCerts, &ThisValidationTime,
                                                                       pfnVerifyCert, RTCRPKCS7VCC_F_TIMESTAMP, pvUser, pErrInfo);
@@ -709 +718 @@
                         fDone = RT_SUCCESS(rc)
                              || (fFlags & RTCRPKCS7VERIFY_SD_F_ALWAYS_USE_SIGNING_TIME_IF_PRESENT);
+                        if ((fFlags & RTCRPKCS7VERIFY_SD_F_UPDATE_VALIDATION_TIME) && fDone)
+                            *(PRTTIMESPEC)pValidationTime = ThisValidationTime;
                     }
                     else
@@ -743 +754 @@
                             fDone = RT_SUCCESS(rc)
                                  || (fFlags & RTCRPKCS7VERIFY_SD_F_ALWAYS_USE_MS_TIMESTAMP_IF_PRESENT);
+                            if ((fFlags & RTCRPKCS7VERIFY_SD_F_UPDATE_VALIDATION_TIME) && fDone)
+                                *(PRTTIMESPEC)pValidationTime = ThisValidationTime;
                         }
                         else
@@ -758 +771 @@
                 if (!fDone)
                     rc = rtCrPkcs7VerifySignerInfo(pSignerInfo, pSignedData, hThisDigest, fFlags, hAdditionalCerts, hTrustedCerts,
-                                                   pValidationTime, pfnVerifyCert, fPrimaryVccFlags, pvUser, pErrInfo);
+                                                   &GivenValidationTime, pfnVerifyCert, fPrimaryVccFlags, pvUser, pErrInfo);
                 RTCrDigestRelease(hThisDigest);
                 if (RT_FAILURE(rc))
@@ -785 +798 @@
     if (fFlags & RTCRPKCS7VERIFY_SD_F_USAGE_TIMESTAMPING)
         return rc;
+    /** @todo figure out if we can verify just one signer info item using OpenSSL. */
+    if (!(fFlags & RTCRPKCS7VERIFY_SD_F_HAS_SIGNER_INDEX) && pSignedData->SignerInfos.cItems > 1)
+        return rc;
+
     int rcOssl = rtCrPkcs7VerifySignedDataUsingOpenSsl(pContentInfo, fFlags, hAdditionalCerts, hTrustedCerts,
                                                        pvContent, cbContent, RT_SUCCESS(rc) ? pErrInfo : NULL);