pkcs7.h@ 64865

Last change on this file since 64865 was 64865, checked in by vboxsync, 8 years ago
IPRT/PKCS#7: Decode MS statement type attributes.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 24.2 KB

Line
1	/** @file
2	* IPRT - PKCS \#7, Cryptographic Message Syntax Standard (aka CMS).
3	*/
4
5	/*
6	* Copyright (C) 2006-2016 Oracle Corporation
7	*
8	* This file is part of VirtualBox Open Source Edition (OSE), as
9	* available from http://www.virtualbox.org. This file is free software;
10	* you can redistribute it and/or modify it under the terms of the GNU
11	* General Public License (GPL) as published by the Free Software
12	* Foundation, in version 2 as it comes in the "COPYING" file of the
13	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
14	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
15	*
16	* The contents of this file may alternatively be used under the terms
17	* of the Common Development and Distribution License Version 1.0
18	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
19	* VirtualBox OSE distribution, in which case the provisions of the
20	* CDDL are applicable instead of those of the GPL.
21	*
22	* You may elect to license modified versions of this file under the
23	* terms and conditions of either the GPL or the CDDL or both.
24	*/
25
26	#ifndef ___iprt_crypto_pkcs7_h
27	#define ___iprt_crypto_pkcs7_h
28
29	#include <iprt/asn1.h>
30	#include <iprt/crypto/x509.h>
31
32
33	RT_C_DECLS_BEGIN
34
35	/** @defgroup grp_rt_crpkcs7 RTCrPkcs7 - PKCS \#7, Cryptographic Message Syntax Standard (aka CMS).
36	* @ingroup grp_rt_crypto
37	* @{
38	*/
39
40
41	/**
42	* PKCS \#7 IssuerAndSerialNumber (IPRT representation).
43	*/
44	typedef struct RTCRPKCS7ISSUERANDSERIALNUMBER
45	{
46	/** Sequence core. */
47	RTASN1SEQUENCECORE SeqCore;
48	/** The certificate name. */
49	RTCRX509NAME Name;
50	/** The certificate serial number. */
51	RTASN1INTEGER SerialNumber;
52	} RTCRPKCS7ISSUERANDSERIALNUMBER;
53	/** Pointer to the IPRT representation of a PKCS \#7 IssuerAndSerialNumber. */
54	typedef RTCRPKCS7ISSUERANDSERIALNUMBER *PRTCRPKCS7ISSUERANDSERIALNUMBER;
55	/** Pointer to the const IPRT representation of a PKCS \#7
56	* IssuerAndSerialNumber. */
57	typedef RTCRPKCS7ISSUERANDSERIALNUMBER const *PCRTCRPKCS7ISSUERANDSERIALNUMBER;
58	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRPKCS7ISSUERANDSERIALNUMBER, RTDECL, RTCrPkcs7IssuerAndSerialNumber, SeqCore.Asn1Core);
59
60
61	/** Pointer to the IPRT representation of a PKCS \#7 SignerInfo. */
62	typedef struct RTCRPKCS7SIGNERINFO *PRTCRPKCS7SIGNERINFO;
63	/** Pointer to the const IPRT representation of a PKCS \#7 SignerInfo. */
64	typedef struct RTCRPKCS7SIGNERINFO const *PCRTCRPKCS7SIGNERINFO;
65	RTASN1_IMPL_GEN_SET_OF_TYPEDEFS_AND_PROTOS(RTCRPKCS7SIGNERINFOS, RTCRPKCS7SIGNERINFO, RTDECL, RTCrPkcs7SignerInfos);
66
67
68	/**
69	* Attribute value type (for the union).
70	*/
71	typedef enum RTCRPKCS7ATTRIBUTETYPE
72	{
73	/** Zero is invalid. */
74	RTCRPKCS7ATTRIBUTETYPE_INVALID = 0,
75	/** Not present, union is NULL. */
76	RTCRPKCS7ATTRIBUTETYPE_NOT_PRESENT,
77	/** Unknown values, pCores. */
78	RTCRPKCS7ATTRIBUTETYPE_UNKNOWN,
79	/** Object IDs, use pObjIds. */
80	RTCRPKCS7ATTRIBUTETYPE_OBJ_IDS,
81	/** Octet strings, use pOctetStrings. */
82	RTCRPKCS7ATTRIBUTETYPE_OCTET_STRINGS,
83	/** Counter signatures (PKCS \#9), use pCounterSignatures. */
84	RTCRPKCS7ATTRIBUTETYPE_COUNTER_SIGNATURES,
85	/** Signing time (PKCS \#9), use pSigningTime. */
86	RTCRPKCS7ATTRIBUTETYPE_SIGNING_TIME,
87	/** Microsoft timestamp info (RFC-3161) signed data, use pContentInfo. */
88	RTCRPKCS7ATTRIBUTETYPE_MS_TIMESTAMP,
89	/** Microsoft nested PKCS\#7 signature (signtool /as). */
90	RTCRPKCS7ATTRIBUTETYPE_MS_NESTED_SIGNATURE,
91	/** Microsoft statement type, use pObjIdSeqs. */
92	RTCRPKCS7ATTRIBUTETYPE_MS_STATEMENT_TYPE,
93	/** Blow the type up to 32-bits. */
94	RTCRPKCS7ATTRIBUTETYPE_32BIT_HACK = 0x7fffffff
95	} RTCRPKCS7ATTRIBUTETYPE;
96
97	/**
98	* PKCS \#7 Attribute (IPRT representation).
99	*/
100	typedef struct RTCRPKCS7ATTRIBUTE
101	{
102	/** Sequence core. */
103	RTASN1SEQUENCECORE SeqCore;
104	/** The attribute type (object ID). */
105	RTASN1OBJID Type;
106	/** The type of data found in the values union. */
107	RTCRPKCS7ATTRIBUTETYPE enmType;
108	/** Value allocation. */
109	RTASN1ALLOCATION Allocation;
110	/** Values. */
111	union
112	{
113	/** ASN.1 cores (RTCRPKCS7ATTRIBUTETYPE_UNKNOWN). */
114	PRTASN1SETOFCORES pCores;
115	/** ASN.1 object identifiers (RTCRPKCS7ATTRIBUTETYPE_OBJ_IDS). */
116	PRTASN1SETOFOBJIDS pObjIds;
117	/** Sequence of ASN.1 object identifiers (RTCRPKCS7ATTRIBUTETYPE_MS_STATEMENT_TYPE). */
118	PRTASN1SETOFOBJIDSEQS pObjIdSeqs;
119	/** ASN.1 octet strings (RTCRPKCS7ATTRIBUTETYPE_OCTET_STRINGS). */
120	PRTASN1SETOFOCTETSTRINGS pOctetStrings;
121	/** Counter signatures RTCRPKCS7ATTRIBUTETYPE_COUNTER_SIGNATURES(). */
122	PRTCRPKCS7SIGNERINFOS pCounterSignatures;
123	/** Signing time(s) (RTCRPKCS7ATTRIBUTETYPE_SIGNING_TIME). */
124	PRTASN1SETOFTIMES pSigningTime;
125	/** Microsoft timestamp (RFC-3161 signed data, RTCRPKCS7ATTRIBUTETYPE_MS_TIMESTAMP),
126	* Microsoft nested signature (RTCRPKCS7ATTRIBUTETYPE_MS_NESTED_SIGNATURE). */
127	struct RTCRPKCS7SETOFCONTENTINFOS *pContentInfos;
128	} uValues;
129	} RTCRPKCS7ATTRIBUTE;
130	/** Pointer to the IPRT representation of a PKCS \#7 Attribute. */
131	typedef RTCRPKCS7ATTRIBUTE *PRTCRPKCS7ATTRIBUTE;
132	/** Pointer to the const IPRT representation of a PKCS \#7 Attribute. */
133	typedef RTCRPKCS7ATTRIBUTE const *PCRTCRPKCS7ATTRIBUTE;
134	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRPKCS7ATTRIBUTE, RTDECL, RTCrPkcs7Attribute, SeqCore.Asn1Core);
135
136	RTASN1_IMPL_GEN_SET_OF_TYPEDEFS_AND_PROTOS(RTCRPKCS7ATTRIBUTES, RTCRPKCS7ATTRIBUTE, RTDECL, RTCrPkcs7Attributes);
137
138
139	/**
140	* One PKCS \#7 SignerInfo (IPRT representation).
141	*/
142	typedef struct RTCRPKCS7SIGNERINFO
143	{
144	/** Sequence core. */
145	RTASN1SEQUENCECORE SeqCore;
146	/** The structure version (RTCRPKCS7SIGNERINFO_V1). */
147	RTASN1INTEGER Version;
148	/** The issuer and serial number of the certificate used to produce the
149	* encrypted digest below. */
150	RTCRPKCS7ISSUERANDSERIALNUMBER IssuerAndSerialNumber;
151	/** The digest algorithm use to digest the signed content. */
152	RTCRX509ALGORITHMIDENTIFIER DigestAlgorithm;
153	/** Authenticated attributes, optional [0].
154	* @todo Check how other producers formats this. The microsoft one does not
155	* have explicit tags, but combines it with the SET OF. */
156	RTCRPKCS7ATTRIBUTES AuthenticatedAttributes;
157	/** The digest encryption algorithm use to encrypt the digest of the signed
158	* content. */
159	RTCRX509ALGORITHMIDENTIFIER DigestEncryptionAlgorithm;
160	/** The encrypted digest. */
161	RTASN1OCTETSTRING EncryptedDigest;
162	/** Unauthenticated attributes, optional [1].
163	* @todo Check how other producers formats this. The microsoft one does not
164	* have explicit tags, but combines it with the SET OF. */
165	RTCRPKCS7ATTRIBUTES UnauthenticatedAttributes;
166	} RTCRPKCS7SIGNERINFO;
167	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRPKCS7SIGNERINFO, RTDECL, RTCrPkcs7SignerInfo, SeqCore.Asn1Core);
168
169	/** RTCRPKCS7SIGNERINFO::Version value. */
170	#define RTCRPKCS7SIGNERINFO_V1 1
171
172	/** @name PKCS \#9 Attribute IDs
173	* @{ */
174	/** Content type (RFC-2630 11.1).
175	* Value: Object Identifier */
176	#define RTCR_PKCS9_ID_CONTENT_TYPE_OID "1.2.840.113549.1.9.3"
177	/** Message digest (RFC-2630 11.2).
178	* Value: Octet string. */
179	#define RTCR_PKCS9_ID_MESSAGE_DIGEST_OID "1.2.840.113549.1.9.4"
180	/** Signing time (RFC-2630 11.3).
181	* Value: Octet string. */
182	#define RTCR_PKCS9_ID_SIGNING_TIME_OID "1.2.840.113549.1.9.5"
183	/** Counter signature (RFC-2630 11.4).
184	* Value: SignerInfo. */
185	#define RTCR_PKCS9_ID_COUNTER_SIGNATURE_OID "1.2.840.113549.1.9.6"
186	/** Microsoft timestamp (RTF-3161) counter signature (SignedData).
187	* @remarks This isn't defined by PKCS \#9, but lumped in here for convenience. It's actually listed as SPC by MS. */
188	#define RTCR_PKCS9_ID_MS_TIMESTAMP "1.3.6.1.4.1.311.3.3.1"
189	/** Microsoft nested PKCS\#7 signature.
190	* @remarks This isn't defined by PKCS \#9, but lumped in here for convenience. */
191	#define RTCR_PKCS9_ID_MS_NESTED_SIGNATURE "1.3.6.1.4.1.311.2.4.1"
192	/** Microsoft statement type.
193	* @remarks This isn't defined by PKCS \#9, but lumped in here for convenience. It's actually listed as SPC by MS. */
194	#define RTCR_PKCS9_ID_MS_STATEMENT_TYPE "1.3.6.1.4.1.311.2.1.11"
195	/** Microsoft opus info.
196	* @remarks This isn't defined by PKCS \#9, but lumped in here for convenience. It's actually listed as SPC by MS. */
197	#define RTCR_PKCS9_ID_MS_SP_OPUS_INFO "1.3.6.1.4.1.311.2.1.12"
198	/** @} */
199
200
201	/**
202	* Get the (next) signing time attribute from the specfied SignerInfo or one of
203	* the immediate counter signatures.
204	*
205	* @returns Pointer to the signing time if found, NULL if not.
206	* @param pThis The SignerInfo to search.
207	* @param ppSignerInfo Pointer to variable keeping track of the
208	* enumeration, optional.
209	*
210	* If specified the input value is taken to the be
211	* SignerInfo of the previously returned signing
212	* time. The value pointed to is NULL, the
213	* search/enum restarts.
214	*
215	* On successful return this is set to the
216	* SignerInfo which we found the signing time in.
217	*/
218	RTDECL(PCRTASN1TIME) RTCrPkcs7SignerInfo_GetSigningTime(PCRTCRPKCS7SIGNERINFO pThis, PCRTCRPKCS7SIGNERINFO *ppSignerInfo);
219
220
221	/**
222	* Get the (first) timestamp from within a Microsoft timestamp server counter
223	* signature.
224	*
225	* @returns Pointer to the signing time if found, NULL if not.
226	* @param pThis The SignerInfo to search.
227	* @param ppContentInfo Where to return the pointer to the counter
228	* signature, optional.
229	*/
230	RTDECL(PCRTASN1TIME) RTCrPkcs7SignerInfo_GetMsTimestamp(PCRTCRPKCS7SIGNERINFO pThis,
231	struct RTCRPKCS7CONTENTINFO const **ppContentInfo);
232
233
234
235	/**
236	* PKCS \#7 ContentInfo (IPRT representation).
237	*/
238	typedef struct RTCRPKCS7CONTENTINFO
239	{
240	/** Sequence core. */
241	RTASN1SEQUENCECORE SeqCore;
242	/** Object ID identifying the content below. */
243	RTASN1OBJID ContentType;
244	/** Content, optional, explicit tag 0.
245	*
246	* Hack alert! This should've been an explict context tag 0 structure with a
247	* type selected according to ContentType. However, it's simpler to replace the
248	* explicit context with an OCTET STRING with implict tag 0. Then we can tag
249	* along on the encapsulation logic RTASN1OCTETSTRING provides for the dynamic
250	* inner type. The default decoder code will detect known structures as
251	* outlined in the union below, and decode the octet string content as an
252	* anonymous RTASN1CORE if not known.
253	*
254	* If the user want to decode the octet string content differently, it can do so
255	* by destroying and freeing the current encapsulated pointer, replacing it with
256	* it's own. (Of course following the RTASN1OCTETSTRING rules.) Just remember
257	* to also update the value in the union.
258	*
259	* @remarks What's signed and verified is Content.pEncapsulated->uData.pv.
260	*/
261	RTASN1OCTETSTRING Content;
262	/** Pointer to the CMS octet string that's inside the Content, NULL if PKCS \#7.
263	*
264	* Hack alert! When transitioning from PKCS \#7 to CMS, the designers decided to
265	* change things and add another wrapper. This time we're talking about a real
266	* octet string, not like the one above which is really an explicit content tag.
267	* When constructing or decoding CMS content, this will be the same pointer as
268	* Content.pEncapsulated, while the union below will be holding the same pointer
269	* as pCmsContent->pEncapsulated.
270	*/
271	PRTASN1OCTETSTRING pCmsContent;
272	/** Same as Content.pEncapsulated, except a choice of known types. */
273	union
274	{
275	/** ContentType is RTCRPKCS7SIGNEDDATA_OID. */
276	struct RTCRPKCS7SIGNEDDATA *pSignedData;
277	/** ContentType is RTCRSPCINDIRECTDATACONTENT_OID. */
278	struct RTCRSPCINDIRECTDATACONTENT *pIndirectDataContent;
279	/** ContentType is RTCRTSPTSTINFO_OID. */
280	struct RTCRTSPTSTINFO *pTstInfo;
281	/** Generic / Unknown / User. */
282	PRTASN1CORE pCore;
283	} u;
284	} RTCRPKCS7CONTENTINFO;
285	/** Pointer to the IPRT representation of a PKCS \#7 ContentInfo. */
286	typedef RTCRPKCS7CONTENTINFO *PRTCRPKCS7CONTENTINFO;
287	/** Pointer to the const IPRT representation of a PKCS \#7 ContentInfo. */
288	typedef RTCRPKCS7CONTENTINFO const *PCRTCRPKCS7CONTENTINFO;
289	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRPKCS7CONTENTINFO, RTDECL, RTCrPkcs7ContentInfo, SeqCore.Asn1Core);
290	RTASN1_IMPL_GEN_SET_OF_TYPEDEFS_AND_PROTOS(RTCRPKCS7SETOFCONTENTINFOS, RTCRPKCS7CONTENTINFO, RTDECL, RTCrPkcs7SetOfContentInfos);
291
292	RTDECL(bool) RTCrPkcs7ContentInfo_IsSignedData(PCRTCRPKCS7CONTENTINFO pThis);
293
294
295	/**
296	* PKCS \#7 Certificate choice.
297	*/
298	typedef enum RTCRPKCS7CERTCHOICE
299	{
300	RTCRPKCS7CERTCHOICE_INVALID = 0,
301	RTCRPKCS7CERTCHOICE_X509,
302	RTCRPKCS7CERTCHOICE_EXTENDED_PKCS6,
303	RTCRPKCS7CERTCHOICE_AC_V1,
304	RTCRPKCS7CERTCHOICE_AC_V2,
305	RTCRPKCS7CERTCHOICE_OTHER,
306	RTCRPKCS7CERTCHOICE_END,
307	RTCRPKCS7CERTCHOICE_32BIT_HACK = 0x7fffffff
308	} RTCRPKCS7CERTCHOICE;
309
310
311	/**
312	* Common representation for PKCS \#7 ExtendedCertificateOrCertificate and the
313	* CMS CertificateChoices types.
314	*/
315	typedef struct RTCRPKCS7CERT
316	{
317	/** Dummy ASN.1 record, not encoded. */
318	RTASN1DUMMY Dummy;
319	/** The value allocation. */
320	RTASN1ALLOCATION Allocation;
321	/** The choice of value. */
322	RTCRPKCS7CERTCHOICE enmChoice;
323	/** The value union. */
324	union
325	{
326	/** Standard X.509 certificate (RTCRCMSCERTIFICATECHOICE_X509). */
327	PRTCRX509CERTIFICATE pX509Cert;
328	/** Extended PKCS \#6 certificate (RTCRCMSCERTIFICATECHOICE_EXTENDED_PKCS6). */
329	PRTASN1CORE pExtendedCert;
330	/** Attribute certificate version 1 (RTCRCMSCERTIFICATECHOICE_AC_V1). */
331	PRTASN1CORE pAcV1;
332	/** Attribute certificate version 2 (RTCRCMSCERTIFICATECHOICE_AC_V2). */
333	PRTASN1CORE pAcV2;
334	/** Other certificate (RTCRCMSCERTIFICATECHOICE_OTHER). */
335	PRTASN1CORE pOtherCert;
336	} u;
337	} RTCRPKCS7CERT;
338	/** Pointer to the IPRT representation of PKCS \#7 or CMS certificate. */
339	typedef RTCRPKCS7CERT *PRTCRPKCS7CERT;
340	/** Pointer to the const IPRT representation of PKCS \#7 or CMS certificate. */
341	typedef RTCRPKCS7CERT const *PCRTCRPKCS7CERT;
342	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRPKCS7CERT, RTDECL, RTCrPkcs7Cert, Dummy.Asn1Core);
343	RTASN1_IMPL_GEN_SET_OF_TYPEDEFS_AND_PROTOS(RTCRPKCS7SETOFCERTS, RTCRPKCS7CERT, RTDECL, RTCrPkcs7SetOfCerts);
344
345	RTDECL(PCRTCRX509CERTIFICATE) RTCrPkcs7SetOfCerts_FindX509ByIssuerAndSerialNumber(PCRTCRPKCS7SETOFCERTS pCertificates,
346	PCRTCRX509NAME pIssuer,
347	PCRTASN1INTEGER pSerialNumber);
348
349
350	/**
351	* PKCS \#7 SignedData (IPRT representation).
352	*/
353	typedef struct RTCRPKCS7SIGNEDDATA
354	{
355	/** Sequence core. */
356	RTASN1SEQUENCECORE SeqCore;
357	/** The structure version value (1). */
358	RTASN1INTEGER Version;
359	/** The digest algorithms that are used to signed the content (ContentInfo). */
360	RTCRX509ALGORITHMIDENTIFIERS DigestAlgorithms;
361	/** The content that's being signed. */
362	RTCRPKCS7CONTENTINFO ContentInfo;
363	/** Certificates, optional, implicit tag 0. (Required by Authenticode.) */
364	RTCRPKCS7SETOFCERTS Certificates;
365	/** Certificate revocation lists, optional, implicit tag 1.
366	* Not used by Authenticode, so currently stubbed. */
367	RTASN1CORE Crls;
368	/** Signer infos. */
369	RTCRPKCS7SIGNERINFOS SignerInfos;
370	} RTCRPKCS7SIGNEDDATA;
371	/** Pointer to the IPRT representation of a PKCS \#7 SignedData. */
372	typedef RTCRPKCS7SIGNEDDATA *PRTCRPKCS7SIGNEDDATA;
373	/** Pointer to the const IPRT representation of a PKCS \#7 SignedData. */
374	typedef RTCRPKCS7SIGNEDDATA const *PCRTCRPKCS7SIGNEDDATA;
375	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRPKCS7SIGNEDDATA, RTDECL, RTCrPkcs7SignedData, SeqCore.Asn1Core);
376	RTASN1_IMPL_GEN_SET_OF_TYPEDEFS_AND_PROTOS(RTCRPKCS7SETOFSIGNEDDATA, RTCRPKCS7SIGNEDDATA, RTDECL, RTCrPkcs7SetOfSignedData);
377
378	/** PKCS \#7 SignedData object ID. */
379	#define RTCRPKCS7SIGNEDDATA_OID "1.2.840.113549.1.7.2"
380
381	/** PKCS \#7 SignedData version number 1. */
382	#define RTCRPKCS7SIGNEDDATA_V1 1
383	/* No version 2 seems to exist. */
384	/** CMS SignedData version number 3.
385	* This should only be used if there are version 1 attribute certificates
386	* present, or if there are version 3 SignerInfo items present, or if
387	* enmcCountInfo is not id-data (RFC-5652, section 5.1). */
388	#define RTCRPKCS7SIGNEDDATA_V3 3
389	/** CMS SignedData version number 4.
390	* This should only be used if there are version 2 attribute certificates
391	* present (RFC-5652, section 5.1). */
392	#define RTCRPKCS7SIGNEDDATA_V4 4
393	/** CMS SignedData version number 5.
394	* This should only be used if there are certificates or/and CRLs of the
395	* OTHER type present (RFC-5652, section 5.1). */
396	#define RTCRPKCS7SIGNEDDATA_V5 5
397
398
399	/** @name RTCRPKCS7SIGNEDDATA_SANITY_F_XXX - Flags for RTPkcs7SignedDataCheckSantiy.
400	* @{ */
401	/** Check for authenticode restrictions. */
402	#define RTCRPKCS7SIGNEDDATA_SANITY_F_AUTHENTICODE RT_BIT_32(0)
403	/** Check that all the hash algorithms are known to IPRT. */
404	#define RTCRPKCS7SIGNEDDATA_SANITY_F_ONLY_KNOWN_HASH RT_BIT_32(1)
405	/** Require signing certificate to be present. */
406	#define RTCRPKCS7SIGNEDDATA_SANITY_F_SIGNING_CERT_PRESENT RT_BIT_32(2)
407	/** @} */
408
409
410	/**
411	* PKCS \#7 DigestInfo (IPRT representation).
412	*/
413	typedef struct RTCRPKCS7DIGESTINFO
414	{
415	/** Sequence core. */
416	RTASN1SEQUENCECORE SeqCore;
417	/** The digest algorithm use to digest the signed content. */
418	RTCRX509ALGORITHMIDENTIFIER DigestAlgorithm;
419	/** The digest. */
420	RTASN1OCTETSTRING Digest;
421	} RTCRPKCS7DIGESTINFO;
422	/** Pointer to the IPRT representation of a PKCS \#7 DigestInfo object. */
423	typedef RTCRPKCS7DIGESTINFO *PRTCRPKCS7DIGESTINFO;
424	/** Pointer to the const IPRT representation of a PKCS \#7 DigestInfo object. */
425	typedef RTCRPKCS7DIGESTINFO const *PCRTCRPKCS7DIGESTINFO;
426	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRPKCS7DIGESTINFO, RTDECL, RTCrPkcs7DigestInfo, SeqCore.Asn1Core);
427
428
429	/**
430	* Callback function for use with RTCrPkcs7VerifySignedData.
431	*
432	* @returns IPRT status code.
433	* @param pCert The certificate to verify.
434	* @param hCertPaths Unless the certificate is trusted directly, this
435	* is a reference to the certificate path builder
436	* and verifier instance that we used to establish
437	* at least valid trusted path to @a pCert. The
438	* callback can use this to enforce additional
439	* certificate lineage requirements, effective
440	* policy checks and whatnot.
441	* This is NIL_RTCRX509CERTPATHS if the certificate
442	* is directly trusted.
443	* @param fFlags Mix of the RTCRPKCS7VCC_F_XXX flags.
444	* @param pvUser The user argument.
445	* @param pErrInfo Optional error info buffer.
446	*/
447	typedef DECLCALLBACK(int) FNRTCRPKCS7VERIFYCERTCALLBACK(PCRTCRX509CERTIFICATE pCert, RTCRX509CERTPATHS hCertPaths,
448	uint32_t fFlags, void *pvUser, PRTERRINFO pErrInfo);
449	/** Pointer to a FNRTCRPKCS7VERIFYCERTCALLBACK callback. */
450	typedef FNRTCRPKCS7VERIFYCERTCALLBACK *PFNRTCRPKCS7VERIFYCERTCALLBACK;
451
452	/** @name RTCRPKCS7VCC_F_XXX - Flags for FNRTCRPKCS7VERIFYCERTCALLBACK.
453	* @{ */
454	/** Normal callback for a direct signatory of the signed data. */
455	#define RTCRPKCS7VCC_F_SIGNED_DATA RT_BIT_32(0)
456	/** Check that the signatory can be trusted for timestamps. */
457	#define RTCRPKCS7VCC_F_TIMESTAMP RT_BIT_32(1)
458	/** @} */
459
460	/**
461	* @callback_method_impl{FNRTCRPKCS7VERIFYCERTCALLBACK,
462	* Default implementation that checks for the DigitalSignature KeyUsage bit.}
463	*/
464	RTDECL(int) RTCrPkcs7VerifyCertCallbackDefault(PCRTCRX509CERTIFICATE pCert, RTCRX509CERTPATHS hCertPaths, uint32_t fFlags,
465	void *pvUser, PRTERRINFO pErrInfo);
466
467	/**
468	* @callback_method_impl{FNRTCRPKCS7VERIFYCERTCALLBACK,
469	* Standard code signing. Use this for Microsoft SPC.}
470	*/
471	RTDECL(int) RTCrPkcs7VerifyCertCallbackCodeSigning(PCRTCRX509CERTIFICATE pCert, RTCRX509CERTPATHS hCertPaths, uint32_t fFlags,
472	void *pvUser, PRTERRINFO pErrInfo);
473
474	/**
475	* Verifies PKCS \#7 SignedData.
476	*
477	* For compatability with alternative crypto providers, the user must work on
478	* the top level PKCS \#7 structure instead directly on the SignedData.
479	*
480	* @returns IPRT status code.
481	* @param pContentInfo PKCS \#7 content info structure.
482	* @param fFlags RTCRPKCS7VERIFY_SD_F_XXX.
483	* @param hAdditionalCerts Store containing additional certificates to
484	* supplement those mentioned in the signed data.
485	* @param hTrustedCerts Store containing trusted certificates.
486	* @param pValidationTime The time we're supposed to validate the
487	* certificates chains at. Ignored for signatures
488	* with valid signing time attributes.
489	* @param pfnVerifyCert Callback for checking that a certificate used
490	* for signing the data is suitable.
491	* @param pvUser User argument for the callback.
492	* @param pErrInfo Optional error info buffer.
493	*/
494	RTDECL(int) RTCrPkcs7VerifySignedData(PCRTCRPKCS7CONTENTINFO pContentInfo, uint32_t fFlags,
495	RTCRSTORE hAdditionalCerts, RTCRSTORE hTrustedCerts,
496	PCRTTIMESPEC pValidationTime, PFNRTCRPKCS7VERIFYCERTCALLBACK pfnVerifyCert, void *pvUser,
497	PRTERRINFO pErrInfo);
498
499	/** @name RTCRPKCS7VERIFY_SD_F_XXX - Flags for RTCrPkcs7VerifySignedData
500	* @{ */
501	/** Always use the signing time attribute if present, requiring it to be
502	* verified as valid. The default behavior is to ignore unverifiable
503	* signing time attributes and use the @a pValidationTime instead. */
504	#define RTCRPKCS7VERIFY_SD_F_ALWAYS_USE_SIGNING_TIME_IF_PRESENT RT_BIT_32(0)
505	/** Same as RTCRPKCS7VERIFY_SD_F_ALWAYS_USE_SIGNING_TIME_IF_PRESENT for the MS
506	* timestamp counter sigantures. */
507	#define RTCRPKCS7VERIFY_SD_F_ALWAYS_USE_MS_TIMESTAMP_IF_PRESENT RT_BIT_32(1)
508	/** Only use signging time attributes from counter signatures. */
509	#define RTCRPKCS7VERIFY_SD_F_COUNTER_SIGNATURE_SIGNING_TIME_ONLY RT_BIT_32(2)
510	/** Don't validate the counter signature containing the signing time, just use
511	* it unverified. This is useful if we don't necessarily have the root
512	* certificates for the timestamp server handy, but use with great care.
513	* @sa RTCRPKCS7VERIFY_SD_F_USE_MS_TIMESTAMP_UNVERIFIED */
514	#define RTCRPKCS7VERIFY_SD_F_USE_SIGNING_TIME_UNVERIFIED RT_BIT_32(3)
515	/** Don't validate the MS counter signature containing the signing timestamp.
516	* @sa RTCRPKCS7VERIFY_SD_F_USE_SIGNING_TIME_UNVERIFIED */
517	#define RTCRPKCS7VERIFY_SD_F_USE_MS_TIMESTAMP_UNVERIFIED RT_BIT_32(4)
518	/** Do not consider timestamps in microsoft counter signatures. */
519	#define RTCRPKCS7VERIFY_SD_F_IGNORE_MS_TIMESTAMP RT_BIT_32(5)
520	/** The signed data requires certificates to have the timestamp extended
521	* usage bit present. This is used for recursivly verifying MS timestamp
522	* signatures. */
523	#define RTCRPKCS7VERIFY_SD_F_USAGE_TIMESTAMPING RT_BIT_32(6)
524
525	/** Indicates internally that we're validating a counter signature and should
526	* use different rules when checking out the authenticated attributes.
527	* @internal */
528	#define RTCRPKCS7VERIFY_SD_F_COUNTER_SIGNATURE RT_BIT_32(31)
529	/** @} */
530
531	/** @} */
532
533	RT_C_DECLS_END
534
535	#endif
536

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/include/iprt/crypto/pkcs7.h@ 64865

Download in other formats: