Changeset 84381 in vbox

Timestamp:

May 19, 2020 7:47:12 PM (5 years ago)

Author:

vboxsync

Message:

Main/Appliance: Use the RTCRPKCS7VERIFY_SD_F_CHECK_TRUST_ANCHORS flag when checking the PKCS#7/CMS certificates. bugref:9699

File:

• trunk/src/VBox/Main/src-server/ApplianceImplImport.cpp (modified) (7 diffs)

trunk/src/VBox/Main/src-server/ApplianceImplImport.cpp

@@ -3319 +3319 @@
     vrc = RTCrPkcs7VerifySignedDataWithExternalData(&m->ContentInfo, RTCRPKCS7VERIFY_SD_F_USE_SIGNING_TIME_UNVERIFIED
                                                     | RTCRPKCS7VERIFY_SD_F_UPDATE_VALIDATION_TIME
-                                                    | RTCRPKCS7VERIFY_SD_F_SIGNER_INDEX(iSigner), NIL_RTCRSTORE,
+                                                    | RTCRPKCS7VERIFY_SD_F_SIGNER_INDEX(iSigner)
+                                                    | RTCRPKCS7VERIFY_SD_F_CHECK_TRUST_ANCHORS, NIL_RTCRSTORE,
                                                     hTrustedStore, &Now2, NULL, NULL,
                                                     pvData, cbData, RTErrInfoInitStatic(pErrInfo));
@@ -3329 +3330 @@
                                                         | RTCRPKCS7VERIFY_SD_F_COUNTER_SIGNATURE_SIGNING_TIME_ONLY
                                                         | RTCRPKCS7VERIFY_SD_F_UPDATE_VALIDATION_TIME
-                                                        | RTCRPKCS7VERIFY_SD_F_SIGNER_INDEX(iSigner), NIL_RTCRSTORE,
+                                                        | RTCRPKCS7VERIFY_SD_F_SIGNER_INDEX(iSigner)
+                                                        | RTCRPKCS7VERIFY_SD_F_CHECK_TRUST_ANCHORS, NIL_RTCRSTORE,
                                                         hTrustedStore, &Now3, NULL, NULL, pvData, cbData, NULL);
         if (RT_SUCCESS(vrc))
@@ -3357 +3359 @@
     vrc = RTCrPkcs7VerifySignedDataWithExternalData(&m->ContentInfo,
                                                     RTCRPKCS7VERIFY_SD_F_COUNTER_SIGNATURE_SIGNING_TIME_ONLY
-                                                    | RTCRPKCS7VERIFY_SD_F_SIGNER_INDEX(iSigner), NIL_RTCRSTORE,
+                                                    | RTCRPKCS7VERIFY_SD_F_SIGNER_INDEX(iSigner)
+                                                    | RTCRPKCS7VERIFY_SD_F_CHECK_TRUST_ANCHORS, NIL_RTCRSTORE,
                                                     *phTrustedStore2, pNow, NULL, NULL, pvData, cbData, NULL);
     if (RT_SUCCESS(vrc))
@@ -3372 +3375 @@
     vrc = RTCrPkcs7VerifySignedDataWithExternalData(&m->ContentInfo, RTCRPKCS7VERIFY_SD_F_USE_SIGNING_TIME_UNVERIFIED
                                                     | RTCRPKCS7VERIFY_SD_F_UPDATE_VALIDATION_TIME
-                                                    | RTCRPKCS7VERIFY_SD_F_SIGNER_INDEX(iSigner), NIL_RTCRSTORE,
+                                                    | RTCRPKCS7VERIFY_SD_F_SIGNER_INDEX(iSigner)
+                                                    | RTCRPKCS7VERIFY_SD_F_CHECK_TRUST_ANCHORS, NIL_RTCRSTORE,
                                                     *phTrustedStore2, pNow, NULL, NULL, pvData, cbData, NULL);
     if (RT_SUCCESS(vrc))
@@ -3381 +3385 @@
                                                         | RTCRPKCS7VERIFY_SD_F_COUNTER_SIGNATURE_SIGNING_TIME_ONLY
                                                         | RTCRPKCS7VERIFY_SD_F_UPDATE_VALIDATION_TIME
-                                                        | RTCRPKCS7VERIFY_SD_F_SIGNER_INDEX(iSigner), NIL_RTCRSTORE,
+                                                        | RTCRPKCS7VERIFY_SD_F_SIGNER_INDEX(iSigner)
+                                                        | RTCRPKCS7VERIFY_SD_F_CHECK_TRUST_ANCHORS, NIL_RTCRSTORE,
                                                         *phTrustedStore2, &Now3, NULL, NULL, pvData, cbData, NULL);
         if (RT_SUCCESS(vrc))
@@ -3411 +3416 @@
     RTTIMESPEC Now;
     int vrc = RTCrPkcs7VerifySignedDataWithExternalData(&m->ContentInfo,
-                                                        RTCRPKCS7VERIFY_SD_F_COUNTER_SIGNATURE_SIGNING_TIME_ONLY,
+                                                          RTCRPKCS7VERIFY_SD_F_COUNTER_SIGNATURE_SIGNING_TIME_ONLY
+                                                        | RTCRPKCS7VERIFY_SD_F_CHECK_TRUST_ANCHORS,
                                                         NIL_RTCRSTORE /*hAdditionalCerts*/, hTrustedStore,
                                                         RTTimeNow(&Now), NULL /*pfnVerifyCert*/, NULL /*pvUser*/,
@@ -3429 +3435 @@
             vrc = RTCrPkcs7VerifySignedDataWithExternalData(&m->ContentInfo,
                                                             RTCRPKCS7VERIFY_SD_F_COUNTER_SIGNATURE_SIGNING_TIME_ONLY
-                                                            | RTCRPKCS7VERIFY_SD_F_SIGNER_INDEX(iSigner),
+                                                            | RTCRPKCS7VERIFY_SD_F_SIGNER_INDEX(iSigner)
+                                                            | RTCRPKCS7VERIFY_SD_F_CHECK_TRUST_ANCHORS,
                                                             NIL_RTCRSTORE /*hAdditionalCerts*/, hTrustedStore,
                                                             &Now, NULL /*pfnVerifyCert*/, NULL /*pvUser*/,