Changeset 84330 in vbox for trunk/include/iprt/crypto/pkcs7.h

Timestamp:

May 18, 2020 1:37:00 PM (5 years ago)

Author:

vboxsync

Message:

IPRT: Adding some new flags to the PKCS#7/CMS verification routines. bugref:9699

File:

• trunk/include/iprt/crypto/pkcs7.h (modified) (3 diffs)

trunk/include/iprt/crypto/pkcs7.h

@@ -527 +527 @@
  *                              certificates chains at.  Ignored for signatures
  *                              with valid signing time attributes.
+ *                              When RTCRPKCS7VERIFY_SD_F_UPDATE_VALIDATION_TIME
+ *                              is set, this is updated to the actual validation
+ *                              time used.
  * @param   pfnVerifyCert       Callback for checking that a certificate used
  *                              for signing the data is suitable.
@@ -554 +557 @@
  *                              certificates chains at.  Ignored for signatures
  *                              with valid signing time attributes.
+ *                              When RTCRPKCS7VERIFY_SD_F_UPDATE_VALIDATION_TIME
+ *                              is set, this is updated to the actual validation
+ *                              time used.
  * @param   pfnVerifyCert       Callback for checking that a certificate used
  *                              for signing the data is suitable.
@@ -597 +603 @@
  * certificates to be trustworthy. */
 #define RTCRPKCS7VERIFY_SD_F_TRUST_ALL_CERTS                        RT_BIT_32(7)
+/** Update @a pValidationTime with the actual validation time used.
+ * This requires RTCRPKCS7VERIFY_SD_F_HAS_SIGNER_INDEX to get a consistent
+ * result.  And yeah, it unconst the parameter, which is patently ugly. */
+#define RTCRPKCS7VERIFY_SD_F_UPDATE_VALIDATION_TIME                 RT_BIT_32(8)
+
+/** This can be used to only verify one given signer info.
+ * Max index value is 15.  */
+#define RTCRPKCS7VERIFY_SD_F_SIGNER_INDEX(a_idxSignerInfo) \
+    (  RTCRPKCS7VERIFY_SD_F_HAS_SIGNER_INDEX \
+     | (((a_idxSignerInfo) & RTCRPKCS7VERIFY_SD_F_SIGNER_INDEX_MAX) << RTCRPKCS7VERIFY_SD_F_SIGNER_INDEX_SHIFT) )
+/** Has a valid value in RTCRPKCS7VERIFY_SD_F_SIGNER_INDEX_MASK. */
+#define RTCRPKCS7VERIFY_SD_F_HAS_SIGNER_INDEX                       RT_BIT_32(23)
+/** Signer index shift value. */
+#define RTCRPKCS7VERIFY_SD_F_SIGNER_INDEX_SHIFT                     24
+/** Signer index mask. */
+#define RTCRPKCS7VERIFY_SD_F_SIGNER_INDEX_MASK                      UINT32_C(0x0f000000)
+/** Max signer index value (inclusive). */
+#define RTCRPKCS7VERIFY_SD_F_SIGNER_INDEX_MAX \
+    (RTCRPKCS7VERIFY_SD_F_SIGNER_INDEX_MASK >> RTCRPKCS7VERIFY_SD_F_SIGNER_INDEX_SHIFT)
 
 /** Indicates internally that we're validating a counter signature and should