Added support for RFC5652 types of MS countersignatures (#16) #17
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
It seems that some (maybe newer) MS countersignatures are not PKCS7 per RFC2315 but rather CMS structures defined by RFC5652. Unfortunately, PKCS7_* family of OpenSSL functions is not able to handle it, but there are CMS_* functions which are. They however do not provide same set of functions to do the same things as with PKCS7 structures. This PR adds possibility to fall back to CMS if PKCS7 fails. Some functions had to be simulated and therefore might not be *that* accurate but just from testing on a few files, it seems to validate them correctly. But it might need a tuning in the future if we test it on a more extensive set of samples.
metthal
force-pushed
the
countersig-ms-cms
branch
from
3368279
to
b6b9bf3
Compare
HoundThe
force-pushed
the
countersig-ms-cms
branch
from
8785e93
to
d14a974
Compare
HoundThe
force-pushed
the
countersig-ms-cms
branch
from
b17f59a
to
2aac779
Compare
HoundThe
force-pushed
the
countersig-ms-cms
branch
3 times, most recently
from
369404b
to
8a03bda
Compare
HoundThe
force-pushed
the
countersig-ms-cms
branch
from
8a03bda
to
01b1de1
Compare
HoundThe
approved these changes
Jan 26, 2024
There was a problem hiding this comment.
Thanks a lot for the feature, I've got a bit confused and slowed down while reading the macros, but after a while it reads fine and seems kind of neat.
I've added a test case with some dev scripts to ease up writing tests. I've also updated the CI to use proper versions 1.1 and 3.0, as the machines and packages got updated and they all used 3+. The project also uses .clang-format for formatting and I've reformated the newly added code for consistency.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
It seems that some (maybe newer) MS countersignatures are not PKCS7 per RFC2315 but rather CMS structures defined by RFC5652. Unfortunately, PKCS7_* family of OpenSSL functions is not able to handle it, but there are CMS_* functions which are. They however do not provide same set of functions to do the same things as with PKCS7 structures.
This PR adds possibility to fall back to CMS if PKCS7 fails. Some functions had to be simulated and therefore might not be that accurate but just from testing on a few files, it seems to validate them correctly. But it might need a tuning in the future if we test it on a more extensive set of samples.