Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix pkcs7 #6672

Closed
wants to merge 9 commits into from
Closed

Fix pkcs7 #6672

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
49be1e3
pkcs7: check that content lengths fill whole buffer
DemiMarie Nov 28, 2022
0a85b1f
pkcs7: Remove duplicate code
DemiMarie Nov 28, 2022
a45817a
pkcs7: do not store content type OID
DemiMarie Nov 28, 2022
742908f
Check for junk after SignedData
DemiMarie Nov 28, 2022
591840c
Simple cleanup
DemiMarie Nov 28, 2022
53adc17
pkcs7: do not store content type OIDs
DemiMarie Dec 14, 2022
a0a721e
pkcs7: reject signatures with internal data
DemiMarie Nov 28, 2022
9c08537
Reject junk in signer identifers
DemiMarie Nov 30, 2022
1c8020e
pkcs7: Check that hash algs are in digestAlgorithms
DemiMarie Nov 30, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 12 additions & 22 deletions include/mbedtls/pkcs7.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -134,24 +134,13 @@ typedef struct mbedtls_pkcs7_signer_info
}
mbedtls_pkcs7_signer_info;

/**
* Structure holding attached data as part of PKCS7 signed data format
*/
typedef struct mbedtls_pkcs7_data
{
mbedtls_pkcs7_buf MBEDTLS_PRIVATE(oid);
mbedtls_pkcs7_buf MBEDTLS_PRIVATE(data);
}
mbedtls_pkcs7_data;

/**
* Structure holding the signed data section
*/
typedef struct mbedtls_pkcs7_signed_data
{
int MBEDTLS_PRIVATE(version);
mbedtls_pkcs7_buf MBEDTLS_PRIVATE(digest_alg_identifiers);
struct mbedtls_pkcs7_data MBEDTLS_PRIVATE(content);
int MBEDTLS_PRIVATE(no_of_certs);
mbedtls_x509_crt MBEDTLS_PRIVATE(certs);
int MBEDTLS_PRIVATE(no_of_crls);
Expand All @@ -167,7 +156,6 @@ mbedtls_pkcs7_signed_data;
typedef struct mbedtls_pkcs7
{
mbedtls_pkcs7_buf MBEDTLS_PRIVATE(raw);
mbedtls_pkcs7_buf MBEDTLS_PRIVATE(content_type_oid);
mbedtls_pkcs7_signed_data MBEDTLS_PRIVATE(signed_data);
}
mbedtls_pkcs7;
Expand All @@ -180,7 +168,7 @@ mbedtls_pkcs7;
void mbedtls_pkcs7_init( mbedtls_pkcs7 *pkcs7 );

/**
* \brief Parse a single DER formatted pkcs7 content.
* \brief Parse a single DER formatted pkcs7 detached signature.
*
* \param pkcs7 The pkcs7 structure to be filled by parser for the output.
* \param buf The buffer holding the DER encoded pkcs7.
Expand All @@ -189,6 +177,7 @@ void mbedtls_pkcs7_init( mbedtls_pkcs7 *pkcs7 );
* \note This function makes an internal copy of the PKCS7 buffer
* \p buf. In particular, \p buf may be destroyed or reused
* after this call returns.
* \note Signatures with internal data are not supported.
*
* \return The \c mbedtls_pkcs7_type of \p buf, if successful.
* \return A negative error code on failure.
Expand All @@ -208,7 +197,8 @@ int mbedtls_pkcs7_parse_der( mbedtls_pkcs7 *pkcs7, const unsigned char *buf,
* matches.
*
* This function does not use the certificates held within the
* PKCS7 structure itself.
* PKCS7 structure itself, and does not check that the
* certificate is signed by a trusted certification authority.
*
* \param pkcs7 PKCS7 structure containing signature.
* \param cert Certificate containing key to verify signature.
Expand All @@ -229,23 +219,23 @@ int mbedtls_pkcs7_signed_data_verify( mbedtls_pkcs7 *pkcs7,
* \brief Verification of PKCS7 signature against a caller-supplied
* certificate.
*
* For each signer in the PKCS structure, this function computes
* a signature over the supplied hash, using the supplied
* certificate and the same digest algorithm as specified by the
* signer. It then compares this signature against the
* signer's signature; verification succeeds if any comparison
* matches.
* For each signer in the PKCS structure, this function
* validates a signature over the supplied hash, using the
* supplied certificate and the same digest algorithm as
* specified by the signer. Verification succeeds if any
* signature is good.
*
* This function does not use the certificates held within the
* PKCS7 structure itself.
* PKCS7 structure itself, and does not check that the
* certificate is signed by a trusted certification authority.
*
* \param pkcs7 PKCS7 structure containing signature.
* \param cert Certificate containing key to verify signature.
* \param hash Hash of the plain data on which signature has to be verified.
* \param hashlen Length of the hash.
*
* \note This function is different from mbedtls_pkcs7_signed_data_verify()
* in a way that it directly receives the hash of the data.
* in that it is directly passed the hash of the data.
*
* \return 0 if the signature verifies, or a negative error code on failure.
*/
Expand Down
Loading