pkcs7.h@ 67180

Last change on this file since 67180 was 64883, checked in by vboxsync, 8 years ago
IPRT/ASN.1: Refactored array handling (SET OF, SEQUENCE OF) to use a pointer array instead of an object instance array. The old approach would move objects around in memory after they'd be initialized/decoded, making certain core optimziations involving pointers to object members impossible, as well as causing potentially causing trouble when modifying structures that takes down pointers after decoding. Fixed validation bug in rtCrX509Name_CheckSanityExtra where it didn't check that the RDNs had subitems but instead checked the parent twice (slight risk).
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 24.2 KB

Line
1	/** @file
2	* IPRT - PKCS \#7, Cryptographic Message Syntax Standard (aka CMS).
3	*/
4
5	/*
6	* Copyright (C) 2006-2016 Oracle Corporation
7	*
8	* This file is part of VirtualBox Open Source Edition (OSE), as
9	* available from http://www.virtualbox.org. This file is free software;
10	* you can redistribute it and/or modify it under the terms of the GNU
11	* General Public License (GPL) as published by the Free Software
12	* Foundation, in version 2 as it comes in the "COPYING" file of the
13	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
14	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
15	*
16	* The contents of this file may alternatively be used under the terms
17	* of the Common Development and Distribution License Version 1.0
18	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
19	* VirtualBox OSE distribution, in which case the provisions of the
20	* CDDL are applicable instead of those of the GPL.
21	*
22	* You may elect to license modified versions of this file under the
23	* terms and conditions of either the GPL or the CDDL or both.
24	*/
25
26	#ifndef ___iprt_crypto_pkcs7_h
27	#define ___iprt_crypto_pkcs7_h
28
29	#include <iprt/asn1.h>
30	#include <iprt/crypto/x509.h>
31
32
33	RT_C_DECLS_BEGIN
34
35	/** @defgroup grp_rt_crpkcs7 RTCrPkcs7 - PKCS \#7, Cryptographic Message Syntax Standard (aka CMS).
36	* @ingroup grp_rt_crypto
37	* @{
38	*/
39
40
41	/**
42	* PKCS \#7 IssuerAndSerialNumber (IPRT representation).
43	*/
44	typedef struct RTCRPKCS7ISSUERANDSERIALNUMBER
45	{
46	/** Sequence core. */
47	RTASN1SEQUENCECORE SeqCore;
48	/** The certificate name. */
49	RTCRX509NAME Name;
50	/** The certificate serial number. */
51	RTASN1INTEGER SerialNumber;
52	} RTCRPKCS7ISSUERANDSERIALNUMBER;
53	/** Pointer to the IPRT representation of a PKCS \#7 IssuerAndSerialNumber. */
54	typedef RTCRPKCS7ISSUERANDSERIALNUMBER *PRTCRPKCS7ISSUERANDSERIALNUMBER;
55	/** Pointer to the const IPRT representation of a PKCS \#7
56	* IssuerAndSerialNumber. */
57	typedef RTCRPKCS7ISSUERANDSERIALNUMBER const *PCRTCRPKCS7ISSUERANDSERIALNUMBER;
58	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRPKCS7ISSUERANDSERIALNUMBER, RTDECL, RTCrPkcs7IssuerAndSerialNumber, SeqCore.Asn1Core);
59
60
61	/** Pointer to the IPRT representation of a PKCS \#7 SignerInfo. */
62	typedef struct RTCRPKCS7SIGNERINFO *PRTCRPKCS7SIGNERINFO;
63	/** Pointer to the const IPRT representation of a PKCS \#7 SignerInfo. */
64	typedef struct RTCRPKCS7SIGNERINFO const *PCRTCRPKCS7SIGNERINFO;
65	RTASN1_IMPL_GEN_SET_OF_TYPEDEFS_AND_PROTOS(RTCRPKCS7SIGNERINFOS, RTCRPKCS7SIGNERINFO, RTDECL, RTCrPkcs7SignerInfos);
66
67
68	/**
69	* Attribute value type (for the union).
70	*/
71	typedef enum RTCRPKCS7ATTRIBUTETYPE
72	{
73	/** Zero is invalid. */
74	RTCRPKCS7ATTRIBUTETYPE_INVALID = 0,
75	/** Not present, union is NULL. */
76	RTCRPKCS7ATTRIBUTETYPE_NOT_PRESENT,
77	/** Unknown values, pCores. */
78	RTCRPKCS7ATTRIBUTETYPE_UNKNOWN,
79	/** Object IDs, use pObjIds. */
80	RTCRPKCS7ATTRIBUTETYPE_OBJ_IDS,
81	/** Octet strings, use pOctetStrings. */
82	RTCRPKCS7ATTRIBUTETYPE_OCTET_STRINGS,
83	/** Counter signatures (PKCS \#9), use pCounterSignatures. */
84	RTCRPKCS7ATTRIBUTETYPE_COUNTER_SIGNATURES,
85	/** Signing time (PKCS \#9), use pSigningTime. */
86	RTCRPKCS7ATTRIBUTETYPE_SIGNING_TIME,
87	/** Microsoft timestamp info (RFC-3161) signed data, use pContentInfo. */
88	RTCRPKCS7ATTRIBUTETYPE_MS_TIMESTAMP,
89	/** Microsoft nested PKCS\#7 signature (signtool /as). */
90	RTCRPKCS7ATTRIBUTETYPE_MS_NESTED_SIGNATURE,
91	/** Microsoft statement type, use pObjIdSeqs. */
92	RTCRPKCS7ATTRIBUTETYPE_MS_STATEMENT_TYPE,
93	/** Blow the type up to 32-bits. */
94	RTCRPKCS7ATTRIBUTETYPE_32BIT_HACK = 0x7fffffff
95	} RTCRPKCS7ATTRIBUTETYPE;
96
97	/**
98	* PKCS \#7 Attribute (IPRT representation).
99	*/
100	typedef struct RTCRPKCS7ATTRIBUTE
101	{
102	/** Sequence core. */
103	RTASN1SEQUENCECORE SeqCore;
104	/** The attribute type (object ID). */
105	RTASN1OBJID Type;
106	/** The type of data found in the values union. */
107	RTCRPKCS7ATTRIBUTETYPE enmType;
108	/** Value allocation. */
109	RTASN1ALLOCATION Allocation;
110	/** Values. */
111	union
112	{
113	/** ASN.1 cores (RTCRPKCS7ATTRIBUTETYPE_UNKNOWN). */
114	PRTASN1SETOFCORES pCores;
115	/** ASN.1 object identifiers (RTCRPKCS7ATTRIBUTETYPE_OBJ_IDS). */
116	PRTASN1SETOFOBJIDS pObjIds;
117	/** Sequence of ASN.1 object identifiers (RTCRPKCS7ATTRIBUTETYPE_MS_STATEMENT_TYPE). */
118	PRTASN1SETOFOBJIDSEQS pObjIdSeqs;
119	/** ASN.1 octet strings (RTCRPKCS7ATTRIBUTETYPE_OCTET_STRINGS). */
120	PRTASN1SETOFOCTETSTRINGS pOctetStrings;
121	/** Counter signatures RTCRPKCS7ATTRIBUTETYPE_COUNTER_SIGNATURES(). */
122	PRTCRPKCS7SIGNERINFOS pCounterSignatures;
123	/** Signing time(s) (RTCRPKCS7ATTRIBUTETYPE_SIGNING_TIME). */
124	PRTASN1SETOFTIMES pSigningTime;
125	/** Microsoft timestamp (RFC-3161 signed data, RTCRPKCS7ATTRIBUTETYPE_MS_TIMESTAMP),
126	* Microsoft nested signature (RTCRPKCS7ATTRIBUTETYPE_MS_NESTED_SIGNATURE). */
127	struct RTCRPKCS7SETOFCONTENTINFOS *pContentInfos;
128	} uValues;
129	} RTCRPKCS7ATTRIBUTE;
130	/** Pointer to the IPRT representation of a PKCS \#7 Attribute. */
131	typedef RTCRPKCS7ATTRIBUTE *PRTCRPKCS7ATTRIBUTE;
132	/** Pointer to the const IPRT representation of a PKCS \#7 Attribute. */
133	typedef RTCRPKCS7ATTRIBUTE const *PCRTCRPKCS7ATTRIBUTE;
134	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRPKCS7ATTRIBUTE, RTDECL, RTCrPkcs7Attribute, SeqCore.Asn1Core);
135
136	RTASN1_IMPL_GEN_SET_OF_TYPEDEFS_AND_PROTOS(RTCRPKCS7ATTRIBUTES, RTCRPKCS7ATTRIBUTE, RTDECL, RTCrPkcs7Attributes);
137
138
139	/**
140	* One PKCS \#7 SignerInfo (IPRT representation).
141	*/
142	typedef struct RTCRPKCS7SIGNERINFO
143	{
144	/** Sequence core. */
145	RTASN1SEQUENCECORE SeqCore;
146	/** The structure version (RTCRPKCS7SIGNERINFO_V1). */
147	RTASN1INTEGER Version;
148	/** The issuer and serial number of the certificate used to produce the
149	* encrypted digest below. */
150	RTCRPKCS7ISSUERANDSERIALNUMBER IssuerAndSerialNumber;
151	/** The digest algorithm use to digest the signed content. */
152	RTCRX509ALGORITHMIDENTIFIER DigestAlgorithm;
153	/** Authenticated attributes, optional [0].
154	* @todo Check how other producers formats this. The microsoft one does not
155	* have explicit tags, but combines it with the SET OF. */
156	RTCRPKCS7ATTRIBUTES AuthenticatedAttributes;
157	/** The digest encryption algorithm use to encrypt the digest of the signed
158	* content. */
159	RTCRX509ALGORITHMIDENTIFIER DigestEncryptionAlgorithm;
160	/** The encrypted digest. */
161	RTASN1OCTETSTRING EncryptedDigest;
162	/** Unauthenticated attributes, optional [1].
163	* @todo Check how other producers formats this. The microsoft one does not
164	* have explicit tags, but combines it with the SET OF. */
165	RTCRPKCS7ATTRIBUTES UnauthenticatedAttributes;
166	} RTCRPKCS7SIGNERINFO;
167	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRPKCS7SIGNERINFO, RTDECL, RTCrPkcs7SignerInfo, SeqCore.Asn1Core);
168
169	/** RTCRPKCS7SIGNERINFO::Version value. */
170	#define RTCRPKCS7SIGNERINFO_V1 1
171
172	/** @name PKCS \#9 Attribute IDs
173	* @{ */
174	/** Content type (RFC-2630 11.1).
175	* Value: Object Identifier */
176	#define RTCR_PKCS9_ID_CONTENT_TYPE_OID "1.2.840.113549.1.9.3"
177	/** Message digest (RFC-2630 11.2).
178	* Value: Octet string. */
179	#define RTCR_PKCS9_ID_MESSAGE_DIGEST_OID "1.2.840.113549.1.9.4"
180	/** Signing time (RFC-2630 11.3).
181	* Value: Octet string. */
182	#define RTCR_PKCS9_ID_SIGNING_TIME_OID "1.2.840.113549.1.9.5"
183	/** Counter signature (RFC-2630 11.4).
184	* Value: SignerInfo. */
185	#define RTCR_PKCS9_ID_COUNTER_SIGNATURE_OID "1.2.840.113549.1.9.6"
186	/** Microsoft timestamp (RTF-3161) counter signature (SignedData).
187	* @remarks This isn't defined by PKCS \#9, but lumped in here for convenience. It's actually listed as SPC by MS. */
188	#define RTCR_PKCS9_ID_MS_TIMESTAMP "1.3.6.1.4.1.311.3.3.1"
189	/** Microsoft nested PKCS\#7 signature.
190	* @remarks This isn't defined by PKCS \#9, but lumped in here for convenience. */
191	#define RTCR_PKCS9_ID_MS_NESTED_SIGNATURE "1.3.6.1.4.1.311.2.4.1"
192	/** Microsoft statement type.
193	* @remarks This isn't defined by PKCS \#9, but lumped in here for convenience. It's actually listed as SPC by MS. */
194	#define RTCR_PKCS9_ID_MS_STATEMENT_TYPE "1.3.6.1.4.1.311.2.1.11"
195	/** Microsoft opus info.
196	* @remarks This isn't defined by PKCS \#9, but lumped in here for convenience. It's actually listed as SPC by MS. */
197	#define RTCR_PKCS9_ID_MS_SP_OPUS_INFO "1.3.6.1.4.1.311.2.1.12"
198	/** @} */
199
200
201	/**
202	* Get the (next) signing time attribute from the specfied SignerInfo or one of
203	* the immediate counter signatures.
204	*
205	* @returns Pointer to the signing time if found, NULL if not.
206	* @param pThis The SignerInfo to search.
207	* @param ppSignerInfo Pointer to variable keeping track of the
208	* enumeration, optional.
209	*
210	* If specified the input value is taken to the be
211	* SignerInfo of the previously returned signing
212	* time. The value pointed to is NULL, the
213	* search/enum restarts.
214	*
215	* On successful return this is set to the
216	* SignerInfo which we found the signing time in.
217	*/
218	RTDECL(PCRTASN1TIME) RTCrPkcs7SignerInfo_GetSigningTime(PCRTCRPKCS7SIGNERINFO pThis, PCRTCRPKCS7SIGNERINFO *ppSignerInfo);
219
220
221	/**
222	* Get the (first) timestamp from within a Microsoft timestamp server counter
223	* signature.
224	*
225	* @returns Pointer to the signing time if found, NULL if not.
226	* @param pThis The SignerInfo to search.
227	* @param ppContentInfoRet Where to return the pointer to the counter
228	* signature, optional.
229	*/
230	RTDECL(PCRTASN1TIME) RTCrPkcs7SignerInfo_GetMsTimestamp(PCRTCRPKCS7SIGNERINFO pThis,
231	struct RTCRPKCS7CONTENTINFO const **ppContentInfoRet);
232
233
234
235	/**
236	* PKCS \#7 ContentInfo (IPRT representation).
237	*/
238	typedef struct RTCRPKCS7CONTENTINFO
239	{
240	/** Sequence core. */
241	RTASN1SEQUENCECORE SeqCore;
242	/** Object ID identifying the content below. */
243	RTASN1OBJID ContentType;
244	/** Content, optional, explicit tag 0.
245	*
246	* Hack alert! This should've been an explict context tag 0 structure with a
247	* type selected according to ContentType. However, it's simpler to replace the
248	* explicit context with an OCTET STRING with implict tag 0. Then we can tag
249	* along on the encapsulation logic RTASN1OCTETSTRING provides for the dynamic
250	* inner type. The default decoder code will detect known structures as
251	* outlined in the union below, and decode the octet string content as an
252	* anonymous RTASN1CORE if not known.
253	*
254	* If the user want to decode the octet string content differently, it can do so
255	* by destroying and freeing the current encapsulated pointer, replacing it with
256	* it's own. (Of course following the RTASN1OCTETSTRING rules.) Just remember
257	* to also update the value in the union.
258	*
259	* @remarks What's signed and verified is Content.pEncapsulated->uData.pv.
260	*/
261	RTASN1OCTETSTRING Content;
262	/** Pointer to the CMS octet string that's inside the Content, NULL if PKCS \#7.
263	*
264	* Hack alert! When transitioning from PKCS \#7 to CMS, the designers decided to
265	* change things and add another wrapper. This time we're talking about a real
266	* octet string, not like the one above which is really an explicit content tag.
267	* When constructing or decoding CMS content, this will be the same pointer as
268	* Content.pEncapsulated, while the union below will be holding the same pointer
269	* as pCmsContent->pEncapsulated.
270	*/
271	PRTASN1OCTETSTRING pCmsContent;
272	/** Same as Content.pEncapsulated, except a choice of known types. */
273	union
274	{
275	/** ContentType is RTCRPKCS7SIGNEDDATA_OID. */
276	struct RTCRPKCS7SIGNEDDATA *pSignedData;
277	/** ContentType is RTCRSPCINDIRECTDATACONTENT_OID. */
278	struct RTCRSPCINDIRECTDATACONTENT *pIndirectDataContent;
279	/** ContentType is RTCRTSPTSTINFO_OID. */
280	struct RTCRTSPTSTINFO *pTstInfo;
281	/** Generic / Unknown / User. */
282	PRTASN1CORE pCore;
283	} u;
284	} RTCRPKCS7CONTENTINFO;
285	/** Pointer to the IPRT representation of a PKCS \#7 ContentInfo. */
286	typedef RTCRPKCS7CONTENTINFO *PRTCRPKCS7CONTENTINFO;
287	/** Pointer to the const IPRT representation of a PKCS \#7 ContentInfo. */
288	typedef RTCRPKCS7CONTENTINFO const *PCRTCRPKCS7CONTENTINFO;
289	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRPKCS7CONTENTINFO, RTDECL, RTCrPkcs7ContentInfo, SeqCore.Asn1Core);
290	RTASN1_IMPL_GEN_SET_OF_TYPEDEFS_AND_PROTOS(RTCRPKCS7SETOFCONTENTINFOS, RTCRPKCS7CONTENTINFO, RTDECL, RTCrPkcs7SetOfContentInfos);
291
292	RTDECL(bool) RTCrPkcs7ContentInfo_IsSignedData(PCRTCRPKCS7CONTENTINFO pThis);
293
294
295	/**
296	* PKCS \#7 Certificate choice.
297	*/
298	typedef enum RTCRPKCS7CERTCHOICE
299	{
300	RTCRPKCS7CERTCHOICE_INVALID = 0,
301	RTCRPKCS7CERTCHOICE_X509,
302	RTCRPKCS7CERTCHOICE_EXTENDED_PKCS6,
303	RTCRPKCS7CERTCHOICE_AC_V1,
304	RTCRPKCS7CERTCHOICE_AC_V2,
305	RTCRPKCS7CERTCHOICE_OTHER,
306	RTCRPKCS7CERTCHOICE_END,
307	RTCRPKCS7CERTCHOICE_32BIT_HACK = 0x7fffffff
308	} RTCRPKCS7CERTCHOICE;
309
310
311	/**
312	* Common representation for PKCS \#7 ExtendedCertificateOrCertificate and the
313	* CMS CertificateChoices types.
314	*/
315	typedef struct RTCRPKCS7CERT
316	{
317	/** Dummy ASN.1 record, not encoded. */
318	RTASN1DUMMY Dummy;
319	/** The value allocation. */
320	RTASN1ALLOCATION Allocation;
321	/** The choice of value. */
322	RTCRPKCS7CERTCHOICE enmChoice;
323	/** The value union. */
324	union
325	{
326	/** Standard X.509 certificate (RTCRCMSCERTIFICATECHOICE_X509). */
327	PRTCRX509CERTIFICATE pX509Cert;
328	/** Extended PKCS \#6 certificate (RTCRCMSCERTIFICATECHOICE_EXTENDED_PKCS6). */
329	PRTASN1CORE pExtendedCert;
330	/** Attribute certificate version 1 (RTCRCMSCERTIFICATECHOICE_AC_V1). */
331	PRTASN1CORE pAcV1;
332	/** Attribute certificate version 2 (RTCRCMSCERTIFICATECHOICE_AC_V2). */
333	PRTASN1CORE pAcV2;
334	/** Other certificate (RTCRCMSCERTIFICATECHOICE_OTHER). */
335	PRTASN1CORE pOtherCert;
336	} u;
337	} RTCRPKCS7CERT;
338	/** Pointer to the IPRT representation of PKCS \#7 or CMS certificate. */
339	typedef RTCRPKCS7CERT *PRTCRPKCS7CERT;
340	/** Pointer to the const IPRT representation of PKCS \#7 or CMS certificate. */
341	typedef RTCRPKCS7CERT const *PCRTCRPKCS7CERT;
342	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRPKCS7CERT, RTDECL, RTCrPkcs7Cert, Dummy.Asn1Core);
343	RTASN1_IMPL_GEN_SET_OF_TYPEDEFS_AND_PROTOS(RTCRPKCS7SETOFCERTS, RTCRPKCS7CERT, RTDECL, RTCrPkcs7SetOfCerts);
344
345	RTDECL(PCRTCRX509CERTIFICATE) RTCrPkcs7SetOfCerts_FindX509ByIssuerAndSerialNumber(PCRTCRPKCS7SETOFCERTS pCertificates,
346	PCRTCRX509NAME pIssuer,
347	PCRTASN1INTEGER pSerialNumber);
348
349
350	/**
351	* PKCS \#7 SignedData (IPRT representation).
352	*/
353	typedef struct RTCRPKCS7SIGNEDDATA
354	{
355	/** Sequence core. */
356	RTASN1SEQUENCECORE SeqCore;
357	/** The structure version value (1). */
358	RTASN1INTEGER Version;
359	/** The digest algorithms that are used to signed the content (ContentInfo). */
360	RTCRX509ALGORITHMIDENTIFIERS DigestAlgorithms;
361	/** The content that's being signed. */
362	RTCRPKCS7CONTENTINFO ContentInfo;
363	/** Certificates, optional, implicit tag 0. (Required by Authenticode.) */
364	RTCRPKCS7SETOFCERTS Certificates;
365	/** Certificate revocation lists, optional, implicit tag 1.
366	* Not used by Authenticode, so currently stubbed. */
367	RTASN1CORE Crls;
368	/** Signer infos. */
369	RTCRPKCS7SIGNERINFOS SignerInfos;
370	} RTCRPKCS7SIGNEDDATA;
371	/** Pointer to the IPRT representation of a PKCS \#7 SignedData. */
372	typedef RTCRPKCS7SIGNEDDATA *PRTCRPKCS7SIGNEDDATA;
373	/** Pointer to the const IPRT representation of a PKCS \#7 SignedData. */
374	typedef RTCRPKCS7SIGNEDDATA const *PCRTCRPKCS7SIGNEDDATA;
375	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRPKCS7SIGNEDDATA, RTDECL, RTCrPkcs7SignedData, SeqCore.Asn1Core);
376	RTASN1_IMPL_GEN_SET_OF_TYPEDEFS_AND_PROTOS(RTCRPKCS7SETOFSIGNEDDATA, RTCRPKCS7SIGNEDDATA, RTDECL, RTCrPkcs7SetOfSignedData);
377
378	/** PKCS \#7 SignedData object ID. */
379	#define RTCRPKCS7SIGNEDDATA_OID "1.2.840.113549.1.7.2"
380
381	/** PKCS \#7 SignedData version number 1. */
382	#define RTCRPKCS7SIGNEDDATA_V1 1
383	/* No version 2 seems to exist. */
384	/** CMS SignedData version number 3.
385	* This should only be used if there are version 1 attribute certificates
386	* present, or if there are version 3 SignerInfo items present, or if
387	* enmcCountInfo is not id-data (RFC-5652, section 5.1). */
388	#define RTCRPKCS7SIGNEDDATA_V3 3
389	/** CMS SignedData version number 4.
390	* This should only be used if there are version 2 attribute certificates
391	* present (RFC-5652, section 5.1). */
392	#define RTCRPKCS7SIGNEDDATA_V4 4
393	/** CMS SignedData version number 5.
394	* This should only be used if there are certificates or/and CRLs of the
395	* OTHER type present (RFC-5652, section 5.1). */
396	#define RTCRPKCS7SIGNEDDATA_V5 5
397
398
399	/** @name RTCRPKCS7SIGNEDDATA_SANITY_F_XXX - Flags for RTPkcs7SignedDataCheckSantiy.
400	* @{ */
401	/** Check for authenticode restrictions. */
402	#define RTCRPKCS7SIGNEDDATA_SANITY_F_AUTHENTICODE RT_BIT_32(0)
403	/** Check that all the hash algorithms are known to IPRT. */
404	#define RTCRPKCS7SIGNEDDATA_SANITY_F_ONLY_KNOWN_HASH RT_BIT_32(1)
405	/** Require signing certificate to be present. */
406	#define RTCRPKCS7SIGNEDDATA_SANITY_F_SIGNING_CERT_PRESENT RT_BIT_32(2)
407	/** @} */
408
409
410	/**
411	* PKCS \#7 DigestInfo (IPRT representation).
412	*/
413	typedef struct RTCRPKCS7DIGESTINFO
414	{
415	/** Sequence core. */
416	RTASN1SEQUENCECORE SeqCore;
417	/** The digest algorithm use to digest the signed content. */
418	RTCRX509ALGORITHMIDENTIFIER DigestAlgorithm;
419	/** The digest. */
420	RTASN1OCTETSTRING Digest;
421	} RTCRPKCS7DIGESTINFO;
422	/** Pointer to the IPRT representation of a PKCS \#7 DigestInfo object. */
423	typedef RTCRPKCS7DIGESTINFO *PRTCRPKCS7DIGESTINFO;
424	/** Pointer to the const IPRT representation of a PKCS \#7 DigestInfo object. */
425	typedef RTCRPKCS7DIGESTINFO const *PCRTCRPKCS7DIGESTINFO;
426	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRPKCS7DIGESTINFO, RTDECL, RTCrPkcs7DigestInfo, SeqCore.Asn1Core);
427
428
429	/**
430	* Callback function for use with RTCrPkcs7VerifySignedData.
431	*
432	* @returns IPRT status code.
433	* @param pCert The certificate to verify.
434	* @param hCertPaths Unless the certificate is trusted directly, this
435	* is a reference to the certificate path builder
436	* and verifier instance that we used to establish
437	* at least valid trusted path to @a pCert. The
438	* callback can use this to enforce additional
439	* certificate lineage requirements, effective
440	* policy checks and whatnot.
441	* This is NIL_RTCRX509CERTPATHS if the certificate
442	* is directly trusted.
443	* @param fFlags Mix of the RTCRPKCS7VCC_F_XXX flags.
444	* @param pvUser The user argument.
445	* @param pErrInfo Optional error info buffer.
446	*/
447	typedef DECLCALLBACK(int) FNRTCRPKCS7VERIFYCERTCALLBACK(PCRTCRX509CERTIFICATE pCert, RTCRX509CERTPATHS hCertPaths,
448	uint32_t fFlags, void *pvUser, PRTERRINFO pErrInfo);
449	/** Pointer to a FNRTCRPKCS7VERIFYCERTCALLBACK callback. */
450	typedef FNRTCRPKCS7VERIFYCERTCALLBACK *PFNRTCRPKCS7VERIFYCERTCALLBACK;
451
452	/** @name RTCRPKCS7VCC_F_XXX - Flags for FNRTCRPKCS7VERIFYCERTCALLBACK.
453	* @{ */
454	/** Normal callback for a direct signatory of the signed data. */
455	#define RTCRPKCS7VCC_F_SIGNED_DATA RT_BIT_32(0)
456	/** Check that the signatory can be trusted for timestamps. */
457	#define RTCRPKCS7VCC_F_TIMESTAMP RT_BIT_32(1)
458	/** @} */
459
460	/**
461	* @callback_method_impl{FNRTCRPKCS7VERIFYCERTCALLBACK,
462	* Default implementation that checks for the DigitalSignature KeyUsage bit.}
463	*/
464	RTDECL(int) RTCrPkcs7VerifyCertCallbackDefault(PCRTCRX509CERTIFICATE pCert, RTCRX509CERTPATHS hCertPaths, uint32_t fFlags,
465	void *pvUser, PRTERRINFO pErrInfo);
466
467	/**
468	* @callback_method_impl{FNRTCRPKCS7VERIFYCERTCALLBACK,
469	* Standard code signing. Use this for Microsoft SPC.}
470	*/
471	RTDECL(int) RTCrPkcs7VerifyCertCallbackCodeSigning(PCRTCRX509CERTIFICATE pCert, RTCRX509CERTPATHS hCertPaths, uint32_t fFlags,
472	void *pvUser, PRTERRINFO pErrInfo);
473
474	/**
475	* Verifies PKCS \#7 SignedData.
476	*
477	* For compatability with alternative crypto providers, the user must work on
478	* the top level PKCS \#7 structure instead directly on the SignedData.
479	*
480	* @returns IPRT status code.
481	* @param pContentInfo PKCS \#7 content info structure.
482	* @param fFlags RTCRPKCS7VERIFY_SD_F_XXX.
483	* @param hAdditionalCerts Store containing additional certificates to
484	* supplement those mentioned in the signed data.
485	* @param hTrustedCerts Store containing trusted certificates.
486	* @param pValidationTime The time we're supposed to validate the
487	* certificates chains at. Ignored for signatures
488	* with valid signing time attributes.
489	* @param pfnVerifyCert Callback for checking that a certificate used
490	* for signing the data is suitable.
491	* @param pvUser User argument for the callback.
492	* @param pErrInfo Optional error info buffer.
493	*/
494	RTDECL(int) RTCrPkcs7VerifySignedData(PCRTCRPKCS7CONTENTINFO pContentInfo, uint32_t fFlags,
495	RTCRSTORE hAdditionalCerts, RTCRSTORE hTrustedCerts,
496	PCRTTIMESPEC pValidationTime, PFNRTCRPKCS7VERIFYCERTCALLBACK pfnVerifyCert, void *pvUser,
497	PRTERRINFO pErrInfo);
498
499	/** @name RTCRPKCS7VERIFY_SD_F_XXX - Flags for RTCrPkcs7VerifySignedData
500	* @{ */
501	/** Always use the signing time attribute if present, requiring it to be
502	* verified as valid. The default behavior is to ignore unverifiable
503	* signing time attributes and use the @a pValidationTime instead. */
504	#define RTCRPKCS7VERIFY_SD_F_ALWAYS_USE_SIGNING_TIME_IF_PRESENT RT_BIT_32(0)
505	/** Same as RTCRPKCS7VERIFY_SD_F_ALWAYS_USE_SIGNING_TIME_IF_PRESENT for the MS
506	* timestamp counter sigantures. */
507	#define RTCRPKCS7VERIFY_SD_F_ALWAYS_USE_MS_TIMESTAMP_IF_PRESENT RT_BIT_32(1)
508	/** Only use signging time attributes from counter signatures. */
509	#define RTCRPKCS7VERIFY_SD_F_COUNTER_SIGNATURE_SIGNING_TIME_ONLY RT_BIT_32(2)
510	/** Don't validate the counter signature containing the signing time, just use
511	* it unverified. This is useful if we don't necessarily have the root
512	* certificates for the timestamp server handy, but use with great care.
513	* @sa RTCRPKCS7VERIFY_SD_F_USE_MS_TIMESTAMP_UNVERIFIED */
514	#define RTCRPKCS7VERIFY_SD_F_USE_SIGNING_TIME_UNVERIFIED RT_BIT_32(3)
515	/** Don't validate the MS counter signature containing the signing timestamp.
516	* @sa RTCRPKCS7VERIFY_SD_F_USE_SIGNING_TIME_UNVERIFIED */
517	#define RTCRPKCS7VERIFY_SD_F_USE_MS_TIMESTAMP_UNVERIFIED RT_BIT_32(4)
518	/** Do not consider timestamps in microsoft counter signatures. */
519	#define RTCRPKCS7VERIFY_SD_F_IGNORE_MS_TIMESTAMP RT_BIT_32(5)
520	/** The signed data requires certificates to have the timestamp extended
521	* usage bit present. This is used for recursivly verifying MS timestamp
522	* signatures. */
523	#define RTCRPKCS7VERIFY_SD_F_USAGE_TIMESTAMPING RT_BIT_32(6)
524
525	/** Indicates internally that we're validating a counter signature and should
526	* use different rules when checking out the authenticated attributes.
527	* @internal */
528	#define RTCRPKCS7VERIFY_SD_F_COUNTER_SIGNATURE RT_BIT_32(31)
529	/** @} */
530
531	/** @} */
532
533	RT_C_DECLS_END
534
535	#endif
536

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/include/iprt/crypto/pkcs7.h@ 67180

Download in other formats: