Changeset 84670 in vbox for trunk/src/VBox/Runtime/common/crypto

Timestamp:

Jun 3, 2020 7:53:34 PM (5 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

138429

Message:

IPRT/RTCrX509CertPaths: Hack the code to accept trusted targets some more. Previous hack only worked for self-signed certificates. duh. bugref:9699

File:

• trunk/src/VBox/Runtime/common/crypto/x509-certpaths.cpp (modified) (4 diffs)

trunk/src/VBox/Runtime/common/crypto/x509-certpaths.cpp

@@ -571 +571 @@
 }
 
+/**
+ * Helper for checking whether a certificate is in the trusted store or not.
+ */
+static bool rtCrX509CertPathsIsCertInStore(PRTCRX509CERTPATHNODE pNode, RTCRSTORE hStore)
+{
+    bool fRc = false;
+    PCRTCRCERTCTX pCertCtx = RTCrStoreCertByIssuerAndSerialNo(hStore, &pNode->pCert->TbsCertificate.Issuer,
+                                                              &pNode->pCert->TbsCertificate.SerialNumber);
+    if (pCertCtx)
+    {
+        if (pCertCtx->pCert)
+            fRc = RTCrX509Certificate_Compare(pCertCtx->pCert, pNode->pCert) == 0;
+        RTCrCertCtxRelease(pCertCtx);
+    }
+    return fRc;
+}
+
 /** @}  */
 
@@ -579 +596 @@
  */
 
-/**
- *
- * @returns
- * @param   pThis               .
- */
 static PRTCRX509CERTPATHNODE rtCrX509CertPathsNewNode(PRTCRX509CERTPATHSINT pThis)
 {
@@ -919 +931 @@
         pCur->uDepth = 0;
         pCur->uSrc   = RTCRX509CERTPATHNODE_SRC_TARGET;
+
+        /* Check if the target is trusted and do the upgrade (this is outside the RFC,
+           but this simplifies the path validator usage a lot (less work for the caller)). */
+        if (   pThis->pTrustedCert
+            && RTCrX509Certificate_Compare(pThis->pTrustedCert, pCur->pCert) == 0)
+            pCur->uSrc = RTCRX509CERTPATHNODE_SRC_TRUSTED_CERT;
+        else if (   pThis->hTrustedStore != NIL_RTCRSTORE
+                 && rtCrX509CertPathsIsCertInStore(pCur, pThis->hTrustedStore))
+            pCur->uSrc = RTCRX509CERTPATHNODE_SRC_TRUSTED_STORE;
 
         pThis->pErrInfo = pErrInfo;
@@ -1195 +1216 @@
             else if (uVerbosity >= 3)
                 RTAsn1Dump(&pCurLeaf->pCert->TbsCertificate.T3.Extensions.SeqCore.Asn1Core, 0, iIndent, pfnPrintfV, pvUser);
+
+            rtDumpIndent(pfnPrintfV, pvUser, iIndent, "Valid  : %s thru %s\n",
+                         RTTimeToString(&pCurLeaf->pCert->TbsCertificate.Validity.NotBefore.Time,
+                                        pThis->szTmp, sizeof(pThis->szTmp) / 2),
+                         RTTimeToString(&pCurLeaf->pCert->TbsCertificate.Validity.NotAfter.Time,
+                                        &pThis->szTmp[sizeof(pThis->szTmp) / 2], sizeof(pThis->szTmp) / 2) );
         }
         else