13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync/* $Id$ */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync/** @file
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * IPRT - Crypto - PKCS \#7, Sanity Checkers.
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync/*
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * Copyright (C) 2006-2014 Oracle Corporation
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync *
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * This file is part of VirtualBox Open Source Edition (OSE), as
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * available from http://www.virtualbox.org. This file is free software;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * you can redistribute it and/or modify it under the terms of the GNU
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * General Public License (GPL) as published by the Free Software
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * Foundation, in version 2 as it comes in the "COPYING" file of the
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync *
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * The contents of this file may alternatively be used under the terms
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * of the Common Development and Distribution License Version 1.0
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * (CDDL) only, as it comes in the "COPYING.CDDL" file of the
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * VirtualBox OSE distribution, in which case the provisions of the
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * CDDL are applicable instead of those of the GPL.
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync *
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * You may elect to license modified versions of this file under the
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * terms and conditions of either the GPL or the CDDL or both.
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync/*******************************************************************************
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync* Header Files *
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync*******************************************************************************/
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync#include "internal/iprt.h"
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync#include <iprt/crypto/pkcs7.h>
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync#include <iprt/err.h>
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync#include <iprt/string.h>
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync//#include <iprt/stream.h>
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync#include "pkcs7-internal.h"
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsyncstatic int rtCrPkcs7SignedData_CheckSanityExtra(PCRTCRPKCS7SIGNEDDATA pSignedData, uint32_t fFlags,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync PRTERRINFO pErrInfo, const char *pszErrorTag)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync{
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync bool const fAuthenticode = RT_BOOL(fFlags & RTCRPKCS7SIGNEDDATA_SANITY_F_AUTHENTICODE);
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync //RTAsn1Dump(&pSignedData->SeqCore.Asn1Core, 0, 0, RTAsn1DumpStrmPrintfV, g_pStdOut);
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
4ee2f4fc8e99dc69ba5d63fd7dd3f52a38d0501evboxsync if ( RTAsn1Integer_UnsignedCompareWithU32(&pSignedData->Version, RTCRPKCS7SIGNEDDATA_V1) != 0
4ee2f4fc8e99dc69ba5d63fd7dd3f52a38d0501evboxsync && RTAsn1Integer_UnsignedCompareWithU32(&pSignedData->Version, RTCRPKCS7SIGNEDDATA_V3) != 0
4ee2f4fc8e99dc69ba5d63fd7dd3f52a38d0501evboxsync && RTAsn1Integer_UnsignedCompareWithU32(&pSignedData->Version, RTCRPKCS7SIGNEDDATA_V4) != 0
4ee2f4fc8e99dc69ba5d63fd7dd3f52a38d0501evboxsync && RTAsn1Integer_UnsignedCompareWithU32(&pSignedData->Version, RTCRPKCS7SIGNEDDATA_V5) != 0)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync return RTErrInfoSetF(pErrInfo, VERR_CR_PKCS7_SIGNED_DATA_VERSION, "SignedData version is %llu, expected %u",
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync pSignedData->Version.uValue.u, RTCRPKCS7SIGNEDDATA_V1);
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /*
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * DigestAlgorithms.
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync if (pSignedData->DigestAlgorithms.cItems == 0) /** @todo this might be too strict */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync return RTErrInfoSet(pErrInfo, VERR_CR_PKCS7_SIGNED_DATA_NO_DIGEST_ALGOS, "SignedData.DigestAlgorithms is empty");
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync if (pSignedData->DigestAlgorithms.cItems != 1 && fAuthenticode)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync return RTErrInfoSetF(pErrInfo, VERR_CR_SPC_NOT_EXACTLY_ONE_DIGEST_ALGO,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync "SignedData.DigestAlgorithms has more than one algorithm (%u)",
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync pSignedData->DigestAlgorithms.cItems);
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync if (fFlags & RTCRPKCS7SIGNEDDATA_SANITY_F_ONLY_KNOWN_HASH)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync for (uint32_t i = 0; i < pSignedData->DigestAlgorithms.cItems; i++)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync {
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync if (RTCrX509AlgorithmIdentifier_QueryDigestType(&pSignedData->DigestAlgorithms.paItems[i]) == RTDIGESTTYPE_INVALID)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync return RTErrInfoSetF(pErrInfo, VERR_CR_PKCS7_UNKNOWN_DIGEST_ALGORITHM,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync "SignedData.DigestAlgorithms[%i] is not known: %s",
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync i, pSignedData->DigestAlgorithms.paItems[i].Algorithm.szObjId);
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync if (pSignedData->DigestAlgorithms.paItems[i].Parameters.enmType != RTASN1TYPE_NULL)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync return RTErrInfoSetF(pErrInfo, VERR_CR_PKCS7_DIGEST_PARAMS_NOT_IMPL,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync "SignedData.DigestAlgorithms[%i] has parameters: tag=%u",
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync i, pSignedData->DigestAlgorithms.paItems[i].Parameters.u.Core.uTag);
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync }
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /*
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * Certificates.
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync if ( (fFlags & RTCRPKCS7SIGNEDDATA_SANITY_F_SIGNING_CERT_PRESENT)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync && pSignedData->Certificates.cItems == 0)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync return RTErrInfoSet(pErrInfo, VERR_CR_PKCS7_NO_CERTIFICATES,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync "SignedData.Certifcates is empty, expected at least one certificate");
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /*
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * Crls.
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync if (fAuthenticode && RTAsn1Core_IsPresent(&pSignedData->Crls))
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync return RTErrInfoSet(pErrInfo, VERR_CR_PKCS7_EXPECTED_NO_CRLS,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync "SignedData.Crls is not empty as expected for authenticode.");
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /** @todo check Crls when they become important. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /*
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * SignerInfos.
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync if (pSignedData->SignerInfos.cItems == 0)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync return RTErrInfoSet(pErrInfo, VERR_CR_PKCS7_NO_SIGNER_INFOS, "SignedData.SignerInfos is empty?");
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync if (fAuthenticode && pSignedData->SignerInfos.cItems != 1)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync return RTErrInfoSetF(pErrInfo, VERR_CR_PKCS7_EXPECTED_ONE_SIGNER_INFO,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync "SignedData.SignerInfos should have one entry for authenticode: %u",
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync pSignedData->SignerInfos.cItems);
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync for (uint32_t i = 0; i < pSignedData->SignerInfos.cItems; i++)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync {
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync PCRTCRPKCS7SIGNERINFO pSignerInfo = &pSignedData->SignerInfos.paItems[i];
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync if (RTAsn1Integer_UnsignedCompareWithU32(&pSignerInfo->Version, RTCRPKCS7SIGNERINFO_V1) != 0)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync return RTErrInfoSetF(pErrInfo, VERR_CR_PKCS7_SIGNER_INFO_VERSION,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync "SignedData.SignerInfos[%u] version is %llu, expected %u",
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync pSignerInfo->Version.uValue.u, RTCRPKCS7SIGNERINFO_V1);
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /* IssuerAndSerialNumber. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync int rc = RTCrX509Name_CheckSanity(&pSignerInfo->IssuerAndSerialNumber.Name, 0, pErrInfo,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync "SignedData.SignerInfos[#].IssuerAndSerialNumber.Name");
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync if (RT_FAILURE(rc))
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync return rc;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync if (pSignerInfo->IssuerAndSerialNumber.SerialNumber.Asn1Core.cb == 0)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync return RTErrInfoSetF(pErrInfo, VERR_CR_PKCS7_SIGNER_INFO_NO_ISSUER_SERIAL_NO,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync "SignedData.SignerInfos[%u].IssuerAndSerialNumber.SerialNumber is missing (zero length)", i);
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync PCRTCRX509CERTIFICATE pCert;
4ee2f4fc8e99dc69ba5d63fd7dd3f52a38d0501evboxsync pCert = RTCrPkcs7SetOfCerts_FindX509ByIssuerAndSerialNumber(&pSignedData->Certificates,
4ee2f4fc8e99dc69ba5d63fd7dd3f52a38d0501evboxsync &pSignerInfo->IssuerAndSerialNumber.Name,
4ee2f4fc8e99dc69ba5d63fd7dd3f52a38d0501evboxsync &pSignerInfo->IssuerAndSerialNumber.SerialNumber);
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync if (!pCert && (fFlags & RTCRPKCS7SIGNEDDATA_SANITY_F_SIGNING_CERT_PRESENT))
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync return RTErrInfoSetF(pErrInfo, VERR_CR_PKCS7_SIGNER_CERT_NOT_SHIPPED,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync "SignedData.SignerInfos[%u].IssuerAndSerialNumber not found in T0.Certificates", i);
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /* DigestAlgorithm */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync uint32_t j = 0;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync while ( j < pSignedData->DigestAlgorithms.cItems
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync && RTCrX509AlgorithmIdentifier_Compare(&pSignedData->DigestAlgorithms.paItems[j],
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync &pSignerInfo->DigestAlgorithm) != 0)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync j++;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync if (j >= pSignedData->DigestAlgorithms.cItems)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync return RTErrInfoSetF(pErrInfo, VERR_CR_PKCS7_DIGEST_ALGO_NOT_FOUND_IN_LIST,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync "SignedData.SignerInfos[%u].DigestAlgorithm (%s) not found in SignedData.DigestAlgorithms",
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync i, pSignerInfo->DigestAlgorithm.Algorithm.szObjId);
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /* Digest encryption algorithm. */
4ee2f4fc8e99dc69ba5d63fd7dd3f52a38d0501evboxsync#if 0 /** @todo Unimportant: Seen timestamp signatures specifying pkcs1-Sha256WithRsaEncryption in SignerInfo and just RSA in the certificate. Figure out how to compare the two. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync if ( pCert
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync && RTCrX509AlgorithmIdentifier_Compare(&pSignerInfo->DigestEncryptionAlgorithm,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync &pCert->TbsCertificate.SubjectPublicKeyInfo.Algorithm) != 0)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync return RTErrInfoSetF(pErrInfo, VERR_CR_PKCS7_SIGNER_INFO_DIGEST_ENCRYPT_MISMATCH,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync "SignedData.SignerInfos[%u].DigestEncryptionAlgorithm (%s) mismatch with certificate (%s)",
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync i, pSignerInfo->DigestEncryptionAlgorithm.Algorithm.szObjId,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync pCert->TbsCertificate.SubjectPublicKeyInfo.Algorithm.Algorithm.szObjId);
4ee2f4fc8e99dc69ba5d63fd7dd3f52a38d0501evboxsync#endif
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /* Authenticated attributes we know. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync if (RTCrPkcs7Attributes_IsPresent(&pSignerInfo->AuthenticatedAttributes))
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync {
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync bool fFoundContentInfo = false;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync bool fFoundMessageDigest = false;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync for (j = 0; j < pSignerInfo->AuthenticatedAttributes.cItems; j++)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync {
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync PCRTCRPKCS7ATTRIBUTE pAttrib = &pSignerInfo->AuthenticatedAttributes.paItems[j];
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync if (RTAsn1ObjId_CompareWithString(&pAttrib->Type, RTCR_PKCS9_ID_CONTENT_TYPE_OID) == 0)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync {
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync if (fFoundContentInfo)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync return RTErrInfoSet(pErrInfo, VERR_CR_PKCS7_MISSING_CONTENT_TYPE_ATTRIB,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync "Multiple authenticated content-type attributes.");
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync fFoundContentInfo = true;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync AssertReturn(pAttrib->enmType == RTCRPKCS7ATTRIBUTETYPE_OBJ_IDS, VERR_INTERNAL_ERROR_3);
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync if (pAttrib->uValues.pObjIds->cItems != 1)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync return RTErrInfoSetF(pErrInfo, VERR_CR_PKCS7_BAD_CONTENT_TYPE_ATTRIB,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync "Expected exactly one value for content-type attrib, found: %u",
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync pAttrib->uValues.pObjIds->cItems);
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync }
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync else if (RTAsn1ObjId_CompareWithString(&pAttrib->Type, RTCR_PKCS9_ID_MESSAGE_DIGEST_OID) == 0)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync {
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync if (fFoundMessageDigest)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync return RTErrInfoSet(pErrInfo, VERR_CR_PKCS7_MISSING_MESSAGE_DIGEST_ATTRIB,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync "Multiple authenticated message-digest attributes.");
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync fFoundMessageDigest = true;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync AssertReturn(pAttrib->enmType == RTCRPKCS7ATTRIBUTETYPE_OCTET_STRINGS, VERR_INTERNAL_ERROR_3);
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync if (pAttrib->uValues.pOctetStrings->cItems != 1)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync return RTErrInfoSetF(pErrInfo, VERR_CR_PKCS7_BAD_CONTENT_TYPE_ATTRIB,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync "Expected exactly one value for message-digest attrib, found: %u",
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync pAttrib->uValues.pOctetStrings->cItems);
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync }
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync else
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync AssertReturn(pAttrib->enmType == RTCRPKCS7ATTRIBUTETYPE_UNKNOWN, VERR_INTERNAL_ERROR_3);
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync }
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync if (!fFoundContentInfo)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync return RTErrInfoSet(pErrInfo, VERR_CR_PKCS7_MISSING_CONTENT_TYPE_ATTRIB,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync "Missing authenticated content-type attribute.");
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync if (!fFoundMessageDigest)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync return RTErrInfoSet(pErrInfo, VERR_CR_PKCS7_MISSING_MESSAGE_DIGEST_ATTRIB,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync "Missing authenticated message-digest attribute.");
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync }
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync }
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync return VINF_SUCCESS;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync}
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync/*
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * Generate the code.
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync#include <iprt/asn1-generator-sanity.h>
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync