Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for verifying PKCS7 signed attributes #2264

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
+243 −24
Open

Add support for verifying PKCS7 signed attributes #2264

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions crypto/pkcs7/internal.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,8 @@ DECLARE_ASN1_FUNCTIONS(PKCS7_ENVELOPE)
DECLARE_ASN1_FUNCTIONS(PKCS7_DIGEST)
DECLARE_ASN1_FUNCTIONS(PKCS7_SIGN_ENVELOPE)

DECLARE_ASN1_ITEM(PKCS7_ATTR_VERIFY)

DEFINE_STACK_OF(PKCS7)

// ASN.1 defined here https://datatracker.ietf.org/doc/html/rfc2315#section-10.1
Expand Down
96 changes: 79 additions & 17 deletions crypto/pkcs7/pkcs7.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -446,13 +446,9 @@ int PKCS7_add_signer(PKCS7 *p7, PKCS7_SIGNER_INFO *p7i) {
return 1;
}

ASN1_TYPE *PKCS7_get_signed_attribute(const PKCS7_SIGNER_INFO *si, int nid) {
if (si == NULL) {
OPENSSL_PUT_ERROR(PKCS7, ERR_R_PASSED_NULL_PARAMETER);
return NULL;
}
for (size_t i = 0; i < sk_X509_ATTRIBUTE_num(si->auth_attr); i++) {
X509_ATTRIBUTE *attr = sk_X509_ATTRIBUTE_value(si->auth_attr, i);
static ASN1_TYPE *get_attribute(STACK_OF(X509_ATTRIBUTE) *sk, int nid) {
for (size_t i = 0; i < sk_X509_ATTRIBUTE_num(sk); i++) {
X509_ATTRIBUTE *attr = sk_X509_ATTRIBUTE_value(sk, i);
ASN1_OBJECT *obj = X509_ATTRIBUTE_get0_object(attr);
if (OBJ_obj2nid(obj) == nid) {
return X509_ATTRIBUTE_get0_type(attr, 0);
Expand All @@ -461,6 +457,27 @@ ASN1_TYPE *PKCS7_get_signed_attribute(const PKCS7_SIGNER_INFO *si, int nid) {
return NULL;
}

ASN1_TYPE *PKCS7_get_signed_attribute(const PKCS7_SIGNER_INFO *si, int nid) {
if (si == NULL) {
OPENSSL_PUT_ERROR(PKCS7, ERR_R_PASSED_NULL_PARAMETER);
return NULL;
}
return get_attribute(si->auth_attr, nid);
}

static ASN1_OCTET_STRING *PKCS7_digest_from_attributes(
STACK_OF(X509_ATTRIBUTE) *sk) {
if (sk == NULL) {
OPENSSL_PUT_ERROR(PKCS7, ERR_R_PASSED_NULL_PARAMETER);
return NULL;
}
ASN1_TYPE *astype = get_attribute(sk, NID_pkcs9_messageDigest);
if (astype == NULL) {
return NULL;
}
return astype->value.octet_string;
}

STACK_OF(PKCS7_SIGNER_INFO) *PKCS7_get_signer_info(PKCS7 *p7) {
if (p7 == NULL || p7->d.ptr == NULL) {
OPENSSL_PUT_ERROR(PKCS7, ERR_R_PASSED_NULL_PARAMETER);
Expand Down Expand Up @@ -866,9 +883,7 @@ int PKCS7_set_detached(PKCS7 *p7, int detach) {
}
}

int PKCS7_get_detached(PKCS7 *p7) {
return PKCS7_is_detached(p7);
}
int PKCS7_get_detached(PKCS7 *p7) { return PKCS7_is_detached(p7); }


static BIO *pkcs7_find_digest(EVP_MD_CTX **pmd, BIO *bio, int nid) {
Expand Down Expand Up @@ -1399,7 +1414,8 @@ PKCS7_RECIP_INFO *PKCS7_add_recipient(PKCS7 *p7, X509 *x509) {
return ri;
}

int PKCS7_decrypt(PKCS7 *p7, EVP_PKEY *pkey, X509 *cert, BIO *data, int _flags) {
int PKCS7_decrypt(PKCS7 *p7, EVP_PKEY *pkey, X509 *cert, BIO *data,
int _flags) {
GUARD_PTR(p7);
GUARD_PTR(pkey);
GUARD_PTR(data);
Expand Down Expand Up @@ -1528,6 +1544,14 @@ static int pkcs7_signature_verify(BIO *in_bio, PKCS7 *p7, PKCS7_SIGNER_INFO *si,
GUARD_PTR(signer);
int ret = 0;

// Create a new |EVP_MD_CTX| to be consumed, so that the original |EVP_MD_CTX|
// is still in a usable state.
EVP_MD_CTX *mdc_tmp = EVP_MD_CTX_new();
if (mdc_tmp == NULL) {
OPENSSL_PUT_ERROR(PKCS7, ERR_R_MALLOC_FAILURE);
goto out;
}

const int md_type = OBJ_obj2nid(si->digest_alg->algorithm);
EVP_MD_CTX *mdc = NULL;
BIO *bio = in_bio;
Expand All @@ -1548,26 +1572,64 @@ static int pkcs7_signature_verify(BIO *in_bio, PKCS7 *p7, PKCS7_SIGNER_INFO *si,
bio = BIO_next(bio);
}

// We don't currently support signed attributes. See |PKCS7_NOATTR|.
if (si->auth_attr && sk_X509_ATTRIBUTE_num(si->auth_attr) != 0) {
OPENSSL_PUT_ERROR(PKCS7, PKCS7_R_INVALID_SIGNED_DATA_TYPE);
// mdc is the digest ctx that we want, unless there are attributes, in
// which case the digest is the signed attributes.
if (!EVP_MD_CTX_copy_ex(mdc_tmp, mdc)) {
goto out;
}

EVP_PKEY *pkey;
if ((pkey = X509_get0_pubkey(signer)) == NULL) {
if (si->auth_attr != NULL && sk_X509_ATTRIBUTE_num(si->auth_attr) != 0) {
unsigned char md_data[EVP_MAX_MD_SIZE], *abuf = NULL;
unsigned int md_len;

if (!EVP_DigestFinal_ex(mdc_tmp, md_data, &md_len)) {
goto out;
}
ASN1_OCTET_STRING *message_digest =
PKCS7_digest_from_attributes(si->auth_attr);
if (message_digest == NULL) {
OPENSSL_PUT_ERROR(PKCS7, PKCS7_R_UNABLE_TO_FIND_MESSAGE_DIGEST);
goto out;
}
if (message_digest->length != (int)md_len ||
OPENSSL_memcmp(message_digest->data, md_data, md_len) != 0) {
OPENSSL_PUT_ERROR(PKCS7, PKCS7_R_DIGEST_FAILURE);
goto out;
}

if (!EVP_VerifyInit_ex(mdc_tmp, EVP_get_digestbynid(md_type), NULL)) {
goto out;
}

int alen = ASN1_item_i2d((ASN1_VALUE *)si->auth_attr, &abuf,
ASN1_ITEM_rptr(PKCS7_ATTR_VERIFY));
if (alen <= 0 || abuf == NULL) {
OPENSSL_PUT_ERROR(PKCS7, ERR_R_ASN1_LIB);
ret = -1;
goto out;
}
if (!EVP_VerifyUpdate(mdc_tmp, abuf, alen)) {
OPENSSL_free(abuf);
goto out;
}
OPENSSL_free(abuf);
}

EVP_PKEY *pkey = X509_get0_pubkey(signer);
if (pkey == NULL) {
goto out;
}

ASN1_OCTET_STRING *data_body = si->enc_digest;
if (!EVP_VerifyFinal(mdc, data_body->data, data_body->length, pkey)) {
if (!EVP_VerifyFinal(mdc_tmp, data_body->data, data_body->length, pkey)) {
OPENSSL_PUT_ERROR(PKCS7, PKCS7_R_SIGNATURE_FAILURE);
goto out;
}

ret = 1;

out:
EVP_MD_CTX_free(mdc_tmp);
return ret;
}

Expand Down
5 changes: 5 additions & 0 deletions crypto/pkcs7/pkcs7_asn1.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -187,6 +187,11 @@ ASN1_SEQUENCE(PKCS7_ENVELOPE) = {

IMPLEMENT_ASN1_FUNCTIONS(PKCS7_ENVELOPE)

ASN1_ITEM_TEMPLATE(PKCS7_ATTR_VERIFY) = ASN1_EX_TEMPLATE_TYPE(
ASN1_TFLG_SEQUENCE_OF | ASN1_TFLG_IMPTAG | ASN1_TFLG_UNIVERSAL, V_ASN1_SET,
PKCS7_ATTRIBUTES, X509_ATTRIBUTE)
ASN1_ITEM_TEMPLATE_END(PKCS7_ATTR_VERIFY)

int PKCS7_print_ctx(BIO *bio, PKCS7 *pkcs7, int indent, const ASN1_PCTX *pctx) {
GUARD_PTR(bio);
GUARD_PTR(pkcs7);
Expand Down
161 changes: 157 additions & 4 deletions crypto/pkcs7/pkcs7_test.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,8 @@
#include "../test/test_util.h"
#include "internal.h"

std::string GetTestData(const char *path);

// kPKCS7NSS contains the certificate chain of mail.google.com, as saved by NSS
// using the Chrome UI.
static const uint8_t kPKCS7NSS[] = {
Expand Down Expand Up @@ -1699,7 +1701,8 @@ TEST(PKCS7Test, TestEnveloped) {
// NOTE: we make |buf| larger than |pt_len| in case padding gets added.
// without the extra room, we sometimes overflow into the next variable on the
// stack.
uint8_t buf[pt_len + EVP_MAX_BLOCK_LENGTH], decrypted[pt_len + EVP_MAX_BLOCK_LENGTH];
uint8_t buf[pt_len + EVP_MAX_BLOCK_LENGTH],
decrypted[pt_len + EVP_MAX_BLOCK_LENGTH];

OPENSSL_cleanse(buf, sizeof(buf));
OPENSSL_memset(buf, 'A', pt_len);
Expand Down Expand Up @@ -1828,9 +1831,9 @@ TEST(PKCS7Test, TestEnveloped) {
// expectation. Ideally we'd find a way to access the padded plaintext and
// account for this deterministically by checking the random "padding" and
// adusting accordingly.
const size_t max_decrypt =
pt_len + EVP_CIPHER_block_size(EVP_aes_128_cbc());
const size_t decrypted_len = (size_t)BIO_read(bio.get(), decrypted, sizeof(decrypted));
const size_t max_decrypt = pt_len + EVP_CIPHER_block_size(EVP_aes_128_cbc());
const size_t decrypted_len =
(size_t)BIO_read(bio.get(), decrypted, sizeof(decrypted));
ASSERT_LE(decrypted_len, sizeof(decrypted));
if (decrypted_len > pt_len) {
EXPECT_LT(max_decrypt - 4, decrypted_len);
Expand Down Expand Up @@ -2068,3 +2071,153 @@ TEST(PKCS7Test, SetDetached) {
EXPECT_TRUE(PKCS7_set_detached(p7.get(), 1));
EXPECT_FALSE(p7.get()->d.sign->contents->d.data);
}

TEST(PKCS7Test, PKCS7SignedAttributes) {
// This file was generated with the following command:
// openssl smime -sign -in input.txt -signer crypto/ocsp/aws/ca_cert.pem \
// -inkey crypto/ocsp/aws/ca_key.pem -out signed.p7s -outform PEM \
// -nodetach -md sha512
//
// Files with signed attributes aren't generatable with AWS-LC for now, as
// |PKCS7_NOATTR| is always assumed with |PKCS7_sign|. See |PKCS7_sign|
// for more details.
static const char kPKCS7SignedAttributes[] = R"(
-----BEGIN PKCS7-----
MIII8QYJKoZIhvcNAQcCoIII4jCCCN4CAQExDzANBglghkgBZQMEAgMFADAcBgkq
hkiG9w0BBwGgDwQNc2lnbmVkIGRhdGENCqCCBTwwggU4MIIDIKADAgECAgkAhs29
IYxE13cwDQYJKoZIhvcNAQELBQAwKDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldB
MQwwCgYDVQQKDANzMm4wIBcNMTcwOTA1MDUxNTA1WhgPMjExNzA4MTIwNTE1MDVa
MCgxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJXQTEMMAoGA1UECgwDczJuMIICIjAN
BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAvjgKgqLJvaDndXS3qPpNA+hodYcO
lP+jit7DwI00OL42sgEW0Xmk9u2kGTwIFW1iQPCPo0kB0wMTxSwXruZJpzI2asMY
bNpkVGxMBBT94p9OJcnljeaCYsEe2Wdcm930ixl2w9MjG3au7iawmAL+R6cG06Vp
kTlTH9b6+Y1MQUM99jPmyqHr2g53Ocw0eL2WcnULsfOFQONxTLQPaKFrdAcJdB+g
y6yA86J7CASdPjyPqEMqpexGisUwTX2bi8a5r7J9E5mmXSpLVSHubrZfn1UuoZcr
8Kzo99JAbXyEvOkxi9IxH+sjduN02bPBs6PsYQTizpsATfgtIujriKZW6RLqFrst
4nCHy8MPbY/ZoPisMaIA3+aFdULypGvzDJesivaFSmnjaIlXLNUdYNGSrh1TfXFs
2yP/z0USH5c5iK4ztmB4dX8h7z2evvy85+/SIIyAIWzKSkVn7y8MLbabqkauXnxV
1jn13qMe2k21BhafUHnDEHHS6A8d3S5HIG+TzOsh/0DrRCxDnoXeKYkLp1H7hHwz
y3zhabqwNABW+PJijL27h7istdPkgwUcaMjtV1qEDQGYgHMEt85vplRfadrRyQa9
W7wMKub2Uk/U1ike5DdbYfCzX6swPRREmpnL8PZu20/FWBP/kqoJKmYGO+y/a6dN
/FVtkidBAW23vSUCAwEAAaNjMGEwHQYDVR0OBBYEFBLfgXVxypLTzhssK3c7njN3
8/dvMB8GA1UdIwQYMBaAFBLfgXVxypLTzhssK3c7njN38/dvMA8GA1UdEwEB/wQF
MAMBAf8wDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUAA4ICAQCzYLV5JyGy
1nvBRo58nj/hPZvNn5o+lv2pH2tT6ejxCmpbRM4/klE5trSakPehGtLyESKGnZQ+
kcgjUlGrPK2rkYczqtb2yjDEmqGGnjovG0Coh4vWTY8HncT1Qhq/iR/gLV47faI7
TSd0r9+5bGS7/3mQgLujmlBqMKSwSR4SgrHqhSnpG3YoAasQiamgQ/iqrDcY3wau
e0LSz4V9liyuP8pMlxBAGDXyDtRjquPR1vU7FsortRK9DM9aHtzWZA8gVh9Oe+fc
oDXitS5ZJbk0X0RvqvC5zMJaHPJ2/P3jN5Yxise4PAktu0sG/p/oI8+aVp0bwGkY
oFven2XwXN+9RW0C2kEVw9njQd6Y07nSRTbtuU2am8sKzodwnT+aDP5tU0OSRfIH
U9IdtWppYUnhKn+ajiWI2BAEaAN+iQL/j6GTfQQyfzBaMgtuZ2eqJRJcTCugSLWo
1W/88n3tkE6lDHTV1x+24LEEitBICnduxuC46iIL+0CgY+xinEcd9+YcUP7ZZkOs
FgrDOXhLuPj81G3nsN0tny12YtChbIU+OY/JEksWEiotKuWZmBPb8U045hGBn5ni
5qgRlV1n1guPpH7Bbg0GLkr6x3X9H5HsSz2JAWpJgpdok2HSxu9U6h9fr9OoFqmZ
xtW7c1tGdToKxzZiB1jhZ03QbQANYLSLwDGCA2gwggNkAgEBMDUwKDELMAkGA1UE
BhMCVVMxCzAJBgNVBAgMAldBMQwwCgYDVQQKDANzMm4CCQCGzb0hjETXdzANBglg
hkgBZQMEAgMFAKCCAQQwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG
9w0BCQUxDxcNMjUwMzExMjMyOTEzWjBPBgkqhkiG9w0BCQQxQgRAl16N1XX/Z/y4
jlWkbg/ueaFtxN8mCp2+bj3k+NmIMCQLKjkqbEine7DDaGNDb4BN15Px1ymLNy5O
5RK2D+PRGTB5BgkqhkiG9w0BCQ8xbDBqMAsGCWCGSAFlAwQBKjALBglghkgBZQME
ARYwCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggq
hkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDANBgkqhkiG9w0BAQEF
AASCAgAE9Yb3N3wPKRn3hkA2Bc6pyv4ZnNEId1uFLi/zgZ+BGl7KBa6yoRBu8tBS
FqfYah4c4X//bPWbEw8MrNEQqaRBUpMaDwHWf595RSYdYo3i0GxzKi7QFpB5SflP
yvtcdspWw/M0rwY6KmNbATtsjKAMBBeTU743inBViRUuhae29FztNMlociVz1lBt
rQ9AYswKKXbrLu7tJNGp1bYZSnmDlqzoBL/DzyQ380uTGOnRJP84Xjpsgc4IdNoW
CuWDjK5lvLQaVUS0ew0Egci29ZYGBHGOXQRIPoqndVzDwvfY9VZqK2Ip/HV1cWfa
QtMz8qGghzAMvovEmRL3qRXCQSU3KZuiJbQvV6dC5FSHWrRMYCN0seseIqHvRMtt
z6QpSj86Th7VizR5AMoYsE/R8vZ2BhecrFED2thMWyL1e94819SExYmuTghplo2s
ZxoZAOeu0qvV8JysG0DvM7qM1zG2vVTBnr+X7DoqFjRN/tdkKqNBqvtQ/ha4aDrX
EHTfIzMfpQdJz/DR7PtljxI8ASPtPCWo6Ks5pa1oq0Kf/AGkYVaAu3J0jvb++XFo
iWjrtmwM/HRbFEg2THS9b/vkiTsNSRCR9goaq9KPqXuJJsjJIoMA8IBHSLVvFnLf
1IVRuFDgmKSAyCQp2MjkDmgbthvHru4rmBBhhG5APJw0uUcFwA==
-----END PKCS7-----
)";

// Timestamp for March 11, 2025.
static const int64_t kReferencePKCS7Time = 1741824000;

const bssl::UniquePtr<BIO> bio(
BIO_new_mem_buf(kPKCS7SignedAttributes, strlen(kPKCS7SignedAttributes)));
ASSERT_TRUE(bio);
bssl::UniquePtr<PKCS7> pkcs7(
PEM_read_bio_PKCS7(bio.get(), nullptr, nullptr, nullptr));
ASSERT_TRUE(pkcs7);
ASSERT_TRUE(PKCS7_type_is_signed(pkcs7.get()));

// Set up trust store for verification.
bssl::UniquePtr<X509_STORE> store(X509_STORE_new());
bssl::UniquePtr<X509> ca_cert(CertFromPEM(
GetTestData(std::string("crypto/ocsp/test/aws/ca_cert.pem").c_str())
.c_str()));
ASSERT_TRUE(X509_STORE_add_cert(store.get(), ca_cert.get()));

// Set a valid time to avoid time bomb in tests.
X509_VERIFY_PARAM *param = X509_STORE_get0_param(store.get());
X509_VERIFY_PARAM_set_time_posix(param, kReferencePKCS7Time);

bssl::UniquePtr<BIO> out(BIO_new(BIO_s_mem()));
EXPECT_TRUE(PKCS7_verify(pkcs7.get(), nullptr, store.get(), nullptr,
out.get(), /*flags*/ 0));
}

TEST(PKCS7Test, PKCS7SignedAttributesRuby) {
// The following test file was taken from ruby/openssl's pkcs7 tests.
static const char kPKCS7Ruby[] = R"(
-----BEGIN PKCS7-----
MIIHSwYJKoZIhvcNAQcCoIIHPDCCBzgCAQExCzAJBgUrDgMCGgUAMIIDiAYJKoZI
hvcNAQcBoIIDeQSCA3UwgAYJKoZIhvcNAQcDoIAwgAIBADGCARAwggEMAgEAMHUw
cDEQMA4GA1UECgwHZXhhbXBsZTEXMBUGA1UEAwwOVEFSTUFDIFJPT1QgQ0ExIjAg
BgkqhkiG9w0BCQEWE3NvbWVvbmVAZXhhbXBsZS5vcmcxCzAJBgNVBAYTAlVTMRIw
EAYDVQQHDAlUb3duIEhhbGwCAWYwDQYJKoZIhvcNAQEBBQAEgYBspXXse8ZhG1FE
E3PVAulbvrdR52FWPkpeLvSjgEkYzTiUi0CC3poUL1Ku5mOlavWAJgoJpFICDbvc
N4ZNDCwOhnzoI9fMGmm1gvPQy15BdhhZRo9lP7Ga/Hg2APKT0/0yhPsmJ+w+u1e7
OoJEVeEZ27x3+u745bGEcu8of5th6TCABgkqhkiG9w0BBwEwFAYIKoZIhvcNAwcE
CBNs2U5mMsd/oIAEggIQU6cur8QBz02/4eMpHdlU9IkyrRMiaMZ/ky9zecOAjnvY
d2jZqS7RhczpaNJaSli3GmDsKrF+XqE9J58s9ScGqUigzapusTsxIoRUPr7Ztb0a
pg8VWDipAsuw7GfEkgx868sV93uC4v6Isfjbhd+JRTFp/wR1kTi7YgSXhES+RLUW
gQbDIDgEQYxJ5U951AJtnSpjs9za2ZkTdd8RSEizJK0bQ1vqLoApwAVgZqluATqQ
AHSDCxhweVYw6+y90B9xOrqPC0eU7Wzryq2+Raq5ND2Wlf5/N11RQ3EQdKq/l5Te
ijp9PdWPlkUhWVoDlOFkysjk+BE+7AkzgYvz9UvBjmZsMsWqf+KsZ4S8/30ndLzu
iucsu6eOnFLLX8DKZxV6nYffZOPzZZL8hFBcE7PPgSdBEkazMrEBXq1j5mN7exbJ
NOA5uGWyJNBMOCe+1JbxG9UeoqvCCTHESxEeDu7xR3NnSOD47n7cXwHr81YzK2zQ
5oWpP3C8jzI7tUjLd1S0Z3Psd17oaCn+JOfUtuB0nc3wfPF/WPo0xZQodWxp2/Cl
EltR6qr1zf5C7GwmLzBZ6bHFAIT60/JzV0/56Pn8ztsRFtI4cwaBfTfvnwi8/sD9
/LYOMY+/b6UDCUSR7RTN7XfrtAqDEzSdzdJkOWm1jvM8gkLmxpZdvxG3ZvDYnEQE
5Nq+un5nAny1wf3rWierBAjE5ntiAmgs5AAAAAAAAAAAAACgggHqMIIB5jCCAU+g
AwIBAgIBATANBgkqhkiG9w0BAQUFADAvMS0wKwYDVQQDEyQwQUM5RjAyNi1EQ0VB
LTRDMTItOTEyNy1DMEZEN0QyQThCNUEwHhcNMTIxMDE5MDk0NTQ3WhcNMTMxMDE5
MDk0NTQ3WjAvMS0wKwYDVQQDEyQwQUM5RjAyNi1EQ0VBLTRDMTItOTEyNy1DMEZE
N0QyQThCNUEwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALTsTNyGIsKvyw56
WI3Gll/RmjsupkrdEtPbx7OjS9MEgyhOAf9+u6CV0LJGHpy7HUeROykF6xpbSdCm
Mr6kNObl5N0ljOb8OmV4atKjmGg1rWawDLyDQ9Dtuby+dzfHtzAzP+J/3ZoOtSqq
AHVTnCclU1pm/uHN0HZ5nL5iLJTvAgMBAAGjEjAQMA4GA1UdDwEB/wQEAwIFoDAN
BgkqhkiG9w0BAQUFAAOBgQA8K+BouEV04HRTdMZd3akjTQOm6aEGW4nIRnYIf8ZV
mvUpLirVlX/unKtJinhGisFGpuYLMpemx17cnGkBeLCQRvHQjC+ho7l8/LOGheMS
nvu0XHhvmJtRbm8MKHhogwZqHFDnXonvjyqhnhEtK5F2Fimcce3MoF2QtEe0UWv/
8DGCAaowggGmAgEBMDQwLzEtMCsGA1UEAxMkMEFDOUYwMjYtRENFQS00QzEyLTkx
MjctQzBGRDdEMkE4QjVBAgEBMAkGBSsOAwIaBQCggc0wEgYKYIZIAYb4RQEJAjEE
EwIxOTAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0x
MjEwMTkwOTQ1NDdaMCAGCmCGSAGG+EUBCQUxEgQQ2EFUJdQNwQDxclIQ8qNyYzAj
BgkqhkiG9w0BCQQxFgQUy8GFXPpAwRJUT3rdvNC9Pn+4eoswOAYKYIZIAYb4RQEJ
BzEqEygwRkU3QzJEQTVEMDc2NzFFOTcxNDlCNUE3MDRCMERDNkM4MDYwRDJBMA0G
CSqGSIb3DQEBAQUABIGAWUNdzvU2iiQOtihBwF0h48Nnw/2qX8uRjg6CVTOMcGji
BxjUMifEbT//KJwljshl4y3yBLqeVYLOd04k6aKSdjgdZnrnUPI6p5tL5PfJkTAE
L6qflZ9YCU5erE4T5U98hCQBMh4nOYxgaTjnZzhpkKQuEiKq/755cjzTzlI/eok=
-----END PKCS7-----
)";

const bssl::UniquePtr<BIO> bio(
BIO_new_mem_buf(kPKCS7Ruby, strlen(kPKCS7Ruby)));
ASSERT_TRUE(bio);
bssl::UniquePtr<PKCS7> pkcs7(
PEM_read_bio_PKCS7(bio.get(), nullptr, nullptr, nullptr));
ASSERT_TRUE(pkcs7);
ASSERT_TRUE(PKCS7_type_is_signed(pkcs7.get()));

// Verify the file how Ruby's tests do it.
bssl::UniquePtr<X509_STORE> store(X509_STORE_new());
bssl::UniquePtr<BIO> out(BIO_new(BIO_s_mem()));
EXPECT_TRUE(PKCS7_verify(pkcs7.get(), nullptr, store.get(), nullptr,
out.get(), /*flags*/ PKCS7_NOVERIFY));
}
3 changes: 0 additions & 3 deletions include/openssl/pkcs7.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -449,9 +449,6 @@ OPENSSL_EXPORT OPENSSL_DEPRECATED PKCS7 *PKCS7_sign(X509 *sign_cert,
// written to |out| and 1 is returned. On error or verification failure, 0 is
// returned.
//
// We don't currently support authenticated attributes, so if any of |p7|'s
// signer infos have authenticated attributes, PKCS7_verify will fail.
//
// Flags: If |PKCS7_NOVERIFY| is specified, trust chain validation is skipped.
// This function also enforces the behavior of OpenSSL's |PKCS7_NO_DUAL_CONTENT|
// meaning that |indata| may not be specified if |p7|'s signed data is attached.
Expand Down
Loading