Ignore non-X509 certificates in SignedCms#64348

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bartonjs merged 2 commits into from
Jan 28, 2022
Merged

Ignore non-X509 certificates in SignedCms #64348

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
cb04bde
Improve support for reading timestamps on Windows Authenticode
bartonjs Jan 26, 2022
4cca93a
Add a test that the CMS can decode
vcsjones Jan 26, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions src/libraries/System.Security.Cryptography.Pkcs/src/System.Security.Cryptography.Pkcs.csproj
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -490,6 +490,10 @@ System.Security.Cryptography.Pkcs.EnvelopedCms</PackageDescription>
<Compile Include="System\Security\Cryptography\Pkcs\Asn1\MessageImprint.xml.cs">
<DependentUpon>System\Security\Cryptography\Pkcs\Asn1\MessageImprint.xml</DependentUpon>
</Compile>
<AsnXml Include="System\Security\Cryptography\Pkcs\Asn1\OtherCertificateFormat.xml" />
<Compile Include="System\Security\Cryptography\Pkcs\Asn1\OtherCertificateFormat.xml.cs">
<DependentUpon>System\Security\Cryptography\Pkcs\Asn1\OtherCertificateFormat.xml</DependentUpon>
</Compile>
<Compile Include="System\Security\Cryptography\Pkcs\Asn1\PkiFailureInfo.cs" />
<Compile Include="System\Security\Cryptography\Pkcs\Asn1\PkiStatus.cs" />
<AsnXml Include="System\Security\Cryptography\Pkcs\Asn1\PkiStatusInfo.xml" />
Expand Down
10 changes: 4 additions & 6 deletions ...ity.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/Asn1/CertificateChoiceAsn.xml
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -15,12 +15,10 @@
other[3] IMPLICIT OtherCertificateFormat
}

OtherCertificateFormat ::= SEQUENCE {
otherCertFormat OBJECT IDENTIFIER,
otherCert ANY DEFINED BY otherCertFormat
}

Except we only support public key certificates, so just trim the choice here.
-->
<asn:AnyValue name="Certificate" universalTagNumber="16" />
<asn:AnyValue name="ExtendedCertificate" implicitTag="0" />
<asn:AnyValue name="AttributeCertificateV1" implicitTag="1" />
<asn:AnyValue name="AttributeCertificateV2" implicitTag="2" />
<asn:AsnType name="OtherCertificateFormat" typeName="System.Security.Cryptography.Pkcs.Asn1.OtherCertificateFormat" implicitTag="3" />
</asn:Choice>
114 changes: 114 additions & 0 deletions ....Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/Asn1/CertificateChoiceAsn.xml.cs
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -12,6 +12,10 @@ namespace System.Security.Cryptography.Pkcs.Asn1
internal partial struct CertificateChoiceAsn
{
internal ReadOnlyMemory<byte>? Certificate;
internal ReadOnlyMemory<byte>? ExtendedCertificate;
internal ReadOnlyMemory<byte>? AttributeCertificateV1;
internal ReadOnlyMemory<byte>? AttributeCertificateV2;
internal System.Security.Cryptography.Pkcs.Asn1.OtherCertificateFormat? OtherCertificateFormat;

#if DEBUG
static CertificateChoiceAsn()
Expand All@@ -28,6 +32,10 @@ static CertificateChoiceAsn()
};

ensureUniqueTag(new Asn1Tag((UniversalTagNumber)16), "Certificate");
ensureUniqueTag(new Asn1Tag(TagClass.ContextSpecific, 0), "ExtendedCertificate");
ensureUniqueTag(new Asn1Tag(TagClass.ContextSpecific, 1), "AttributeCertificateV1");
ensureUniqueTag(new Asn1Tag(TagClass.ContextSpecific, 2), "AttributeCertificateV2");
ensureUniqueTag(new Asn1Tag(TagClass.ContextSpecific, 3), "OtherCertificateFormat");
}
#endif

Expand DownExpand Up@@ -60,6 +68,90 @@ internal void Encode(AsnWriter writer)
wroteValue = true;
}

if (ExtendedCertificate.HasValue)
{
if (wroteValue)
throw new CryptographicException();

// Validator for tag constraint for ExtendedCertificate
{
if (!Asn1Tag.TryDecode(ExtendedCertificate.Value.Span, out Asn1Tag validateTag, out _) ||
!validateTag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 0)))
{
throw new CryptographicException();
}
}

try
{
writer.WriteEncodedValue(ExtendedCertificate.Value.Span);
}
catch (ArgumentException e)
{
throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
}
wroteValue = true;
}

if (AttributeCertificateV1.HasValue)
{
if (wroteValue)
throw new CryptographicException();

// Validator for tag constraint for AttributeCertificateV1
{
if (!Asn1Tag.TryDecode(AttributeCertificateV1.Value.Span, out Asn1Tag validateTag, out _) ||
!validateTag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 1)))
{
throw new CryptographicException();
}
}

try
{
writer.WriteEncodedValue(AttributeCertificateV1.Value.Span);
}
catch (ArgumentException e)
{
throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
}
wroteValue = true;
}

if (AttributeCertificateV2.HasValue)
{
if (wroteValue)
throw new CryptographicException();

// Validator for tag constraint for AttributeCertificateV2
{
if (!Asn1Tag.TryDecode(AttributeCertificateV2.Value.Span, out Asn1Tag validateTag, out _) ||
!validateTag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 2)))
{
throw new CryptographicException();
}
}

try
{
writer.WriteEncodedValue(AttributeCertificateV2.Value.Span);
}
catch (ArgumentException e)
{
throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
}
wroteValue = true;
}

if (OtherCertificateFormat.HasValue)
{
if (wroteValue)
throw new CryptographicException();

OtherCertificateFormat.Value.Encode(writer, new Asn1Tag(TagClass.ContextSpecific, 3));
wroteValue = true;
}

if (!wroteValue)
{
throw new CryptographicException();
Expand DownExpand Up@@ -107,6 +199,28 @@ private static void DecodeCore(ref AsnValueReader reader, ReadOnlyMemory<byte> r
tmpSpan = reader.ReadEncodedValue();
decoded.Certificate = rebindSpan.Overlaps(tmpSpan, out offset) ? rebind.Slice(offset, tmpSpan.Length) : tmpSpan.ToArray();
}
else if (tag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 0)))
{
tmpSpan = reader.ReadEncodedValue();
decoded.ExtendedCertificate = rebindSpan.Overlaps(tmpSpan, out offset) ? rebind.Slice(offset, tmpSpan.Length) : tmpSpan.ToArray();
}
else if (tag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 1)))
{
tmpSpan = reader.ReadEncodedValue();
decoded.AttributeCertificateV1 = rebindSpan.Overlaps(tmpSpan, out offset) ? rebind.Slice(offset, tmpSpan.Length) : tmpSpan.ToArray();
}
else if (tag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 2)))
{
tmpSpan = reader.ReadEncodedValue();
decoded.AttributeCertificateV2 = rebindSpan.Overlaps(tmpSpan, out offset) ? rebind.Slice(offset, tmpSpan.Length) : tmpSpan.ToArray();
}
else if (tag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 3)))
{
System.Security.Cryptography.Pkcs.Asn1.OtherCertificateFormat tmpOtherCertificateFormat;
System.Security.Cryptography.Pkcs.Asn1.OtherCertificateFormat.Decode(ref reader, new Asn1Tag(TagClass.ContextSpecific, 3), rebind, out tmpOtherCertificateFormat);
decoded.OtherCertificateFormat = tmpOtherCertificateFormat;

}
else
{
throw new CryptographicException();
Expand Down
17 changes: 17 additions & 0 deletions ...y.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/Asn1/OtherCertificateFormat.xml
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
<?xml version="1.0" encoding="utf-8" ?>
<asn:Sequence
xmlns:asn="http://schemas.dot.net/asnxml/201808/"
name="OtherCertificateFormat"
namespace="System.Security.Cryptography.Pkcs.Asn1">

<!--
https://tools.ietf.org/html/rfc5652#section-10.2.2

OtherCertificateFormat ::= SEQUENCE {
otherCertFormat OBJECT IDENTIFIER,
otherCert ANY DEFINED BY otherCertFormat
}
-->
<asn:ObjectIdentifier name="OtherCertFormat" backingType="string" />
<asn:AnyValue name="OtherCert" />
</asn:Sequence>
98 changes: 98 additions & 0 deletions ...ryptography.Pkcs/src/System/Security/Cryptography/Pkcs/Asn1/OtherCertificateFormat.xml.cs
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
// Licensed to the .NET Foundation under one or more agreements.
// The .NET Foundation licenses this file to you under the MIT license.

#pragma warning disable SA1028 // ignore whitespace warnings for generated code
using System;
using System.Formats.Asn1;
using System.Runtime.InteropServices;

namespace System.Security.Cryptography.Pkcs.Asn1
{
[StructLayout(LayoutKind.Sequential)]
internal partial struct OtherCertificateFormat
{
internal string OtherCertFormat;
internal ReadOnlyMemory<byte> OtherCert;

internal void Encode(AsnWriter writer)
{
Encode(writer, Asn1Tag.Sequence);
}

internal void Encode(AsnWriter writer, Asn1Tag tag)
{
writer.PushSequence(tag);

try
{
writer.WriteObjectIdentifier(OtherCertFormat);
}
catch (ArgumentException e)
{
throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
}
try
{
writer.WriteEncodedValue(OtherCert.Span);
}
catch (ArgumentException e)
{
throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
}
writer.PopSequence(tag);
}

internal static OtherCertificateFormat Decode(ReadOnlyMemory<byte> encoded, AsnEncodingRules ruleSet)
{
return Decode(Asn1Tag.Sequence, encoded, ruleSet);
}

internal static OtherCertificateFormat Decode(Asn1Tag expectedTag, ReadOnlyMemory<byte> encoded, AsnEncodingRules ruleSet)
{
try
{
AsnValueReader reader = new AsnValueReader(encoded.Span, ruleSet);

DecodeCore(ref reader, expectedTag, encoded, out OtherCertificateFormat decoded);
reader.ThrowIfNotEmpty();
return decoded;
}
catch (AsnContentException e)
{
throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
}
}

internal static void Decode(ref AsnValueReader reader, ReadOnlyMemory<byte> rebind, out OtherCertificateFormat decoded)
{
Decode(ref reader, Asn1Tag.Sequence, rebind, out decoded);
}

internal static void Decode(ref AsnValueReader reader, Asn1Tag expectedTag, ReadOnlyMemory<byte> rebind, out OtherCertificateFormat decoded)
{
try
{
DecodeCore(ref reader, expectedTag, rebind, out decoded);
}
catch (AsnContentException e)
{
throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
}
}

private static void DecodeCore(ref AsnValueReader reader, Asn1Tag expectedTag, ReadOnlyMemory<byte> rebind, out OtherCertificateFormat decoded)
{
decoded = default;
AsnValueReader sequenceReader = reader.ReadSequence(expectedTag);
ReadOnlySpan<byte> rebindSpan = rebind.Span;
int offset;
ReadOnlySpan<byte> tmpSpan;

decoded.OtherCertFormat = sequenceReader.ReadObjectIdentifier();
tmpSpan = sequenceReader.ReadEncodedValue();
decoded.OtherCert = rebindSpan.Overlaps(tmpSpan, out offset) ? rebind.Slice(offset, tmpSpan.Length) : tmpSpan.ToArray();

sequenceReader.ThrowIfNotEmpty();
}
}
}
12 changes: 10 additions & 2 deletions ...ries/System.Security.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/SignedCms.cs
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -89,8 +89,16 @@ public X509Certificate2Collection Certificates

foreach (CertificateChoiceAsn choice in certChoices)
{
Debug.Assert(choice.Certificate.HasValue);
coll.Add(new X509Certificate2(choice.Certificate.Value.ToArray()));
if (choice.Certificate.HasValue)
{
coll.Add(new X509Certificate2(choice.Certificate.Value
#if NET5_0_OR_GREATER
.Span
#else
.ToArray()
#endif
));
}
}

return coll;
Expand Down
9 changes: 9 additions & 0 deletions src/libraries/System.Security.Cryptography.Pkcs/tests/SignedCms/SignedCmsTests.cs
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -1602,6 +1602,15 @@ public static void CheckNoSignature_FromCoreFx_TamperIssuerName()
signers[0].CheckHash();
}

[Fact]
public static void Decode_CanDecodeWithAttributeCertificate()
{
SignedCms cms = new SignedCms();
cms.Decode(SignedDocuments.TstWithAttributeCertificate);
Assert.Equal(2, cms.Certificates.Count);
cms.CheckSignature(verifySignatureOnly: true);
}

private static void CheckNoSignature(byte[] encoded, bool badOid=false)
{
SignedCms cms = new SignedCms();
Expand Down
Loading
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
Ignore non-X509 certificates in SignedCms#64348

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

bartonjs
merged 2 commits into

from

Jan 28, 2022
 Merged


Ignore non-X509 certificates in SignedCms
#64348
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
cb04bde

Improve support for reading timestamps on Windows Authenticode


bartonjs Jan 26, 2022
4cca93a

Add a test that the CMS can decode


vcsjones Jan 26, 2022

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


4 changes: 4 additions & 0 deletions
src/libraries/System.Security.Cryptography.Pkcs/src/System.Security.Cryptography.Pkcs.csproj

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -490,6 +490,10 @@ System.Security.Cryptography.Pkcs.EnvelopedCms</PackageDescription>
 <Compile Include="System\Security\Cryptography\Pkcs\Asn1\MessageImprint.xml.cs">
 <DependentUpon>System\Security\Cryptography\Pkcs\Asn1\MessageImprint.xml</DependentUpon>
 </Compile>
 <AsnXml Include="System\Security\Cryptography\Pkcs\Asn1\OtherCertificateFormat.xml" />
 <Compile Include="System\Security\Cryptography\Pkcs\Asn1\OtherCertificateFormat.xml.cs">
 <DependentUpon>System\Security\Cryptography\Pkcs\Asn1\OtherCertificateFormat.xml</DependentUpon>
 </Compile>
 <Compile Include="System\Security\Cryptography\Pkcs\Asn1\PkiFailureInfo.cs" />
 <Compile Include="System\Security\Cryptography\Pkcs\Asn1\PkiStatus.cs" />
 <AsnXml Include="System\Security\Cryptography\Pkcs\Asn1\PkiStatusInfo.xml" />
Expand Down

10 changes: 4 additions & 6 deletions
...ity.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/Asn1/CertificateChoiceAsn.xml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -15,12 +15,10 @@
 other[3] IMPLICIT OtherCertificateFormat
 }

 OtherCertificateFormat ::= SEQUENCE {
 otherCertFormat OBJECT IDENTIFIER,
 otherCert ANY DEFINED BY otherCertFormat
 }

 Except we only support public key certificates, so just trim the choice here.
 -->
 <asn:AnyValue name="Certificate" universalTagNumber="16" />
 <asn:AnyValue name="ExtendedCertificate" implicitTag="0" />
 <asn:AnyValue name="AttributeCertificateV1" implicitTag="1" />
 <asn:AnyValue name="AttributeCertificateV2" implicitTag="2" />
 <asn:AsnType name="OtherCertificateFormat" typeName="System.Security.Cryptography.Pkcs.Asn1.OtherCertificateFormat" implicitTag="3" />
</asn:Choice>

114 changes: 114 additions & 0 deletions
....Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/Asn1/CertificateChoiceAsn.xml.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -12,6 +12,10 @@ namespace System.Security.Cryptography.Pkcs.Asn1
 internal partial struct CertificateChoiceAsn
 {
 internal ReadOnlyMemory<byte>? Certificate;
 internal ReadOnlyMemory<byte>? ExtendedCertificate;
 internal ReadOnlyMemory<byte>? AttributeCertificateV1;
 internal ReadOnlyMemory<byte>? AttributeCertificateV2;
 internal System.Security.Cryptography.Pkcs.Asn1.OtherCertificateFormat? OtherCertificateFormat;

#if DEBUG
 static CertificateChoiceAsn()
Expand All@@ -28,6 +32,10 @@ static CertificateChoiceAsn()
 };

 ensureUniqueTag(new Asn1Tag((UniversalTagNumber)16), "Certificate");
 ensureUniqueTag(new Asn1Tag(TagClass.ContextSpecific, 0), "ExtendedCertificate");
 ensureUniqueTag(new Asn1Tag(TagClass.ContextSpecific, 1), "AttributeCertificateV1");
 ensureUniqueTag(new Asn1Tag(TagClass.ContextSpecific, 2), "AttributeCertificateV2");
 ensureUniqueTag(new Asn1Tag(TagClass.ContextSpecific, 3), "OtherCertificateFormat");
 }
#endif

Expand DownExpand Up@@ -60,6 +68,90 @@ internal void Encode(AsnWriter writer)
 wroteValue = true;
 }

 if (ExtendedCertificate.HasValue)
 {
 if (wroteValue)
 throw new CryptographicException();

 // Validator for tag constraint for ExtendedCertificate
 {
 if (!Asn1Tag.TryDecode(ExtendedCertificate.Value.Span, out Asn1Tag validateTag, out _) ||
 !validateTag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 0)))
 {
 throw new CryptographicException();
 }
 }

 try
 {
 writer.WriteEncodedValue(ExtendedCertificate.Value.Span);
 }
 catch (ArgumentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 wroteValue = true;
 }

 if (AttributeCertificateV1.HasValue)
 {
 if (wroteValue)
 throw new CryptographicException();

 // Validator for tag constraint for AttributeCertificateV1
 {
 if (!Asn1Tag.TryDecode(AttributeCertificateV1.Value.Span, out Asn1Tag validateTag, out _) ||
 !validateTag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 1)))
 {
 throw new CryptographicException();
 }
 }

 try
 {
 writer.WriteEncodedValue(AttributeCertificateV1.Value.Span);
 }
 catch (ArgumentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 wroteValue = true;
 }

 if (AttributeCertificateV2.HasValue)
 {
 if (wroteValue)
 throw new CryptographicException();

 // Validator for tag constraint for AttributeCertificateV2
 {
 if (!Asn1Tag.TryDecode(AttributeCertificateV2.Value.Span, out Asn1Tag validateTag, out _) ||
 !validateTag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 2)))
 {
 throw new CryptographicException();
 }
 }

 try
 {
 writer.WriteEncodedValue(AttributeCertificateV2.Value.Span);
 }
 catch (ArgumentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 wroteValue = true;
 }

 if (OtherCertificateFormat.HasValue)
 {
 if (wroteValue)
 throw new CryptographicException();

 OtherCertificateFormat.Value.Encode(writer, new Asn1Tag(TagClass.ContextSpecific, 3));
 wroteValue = true;
 }

 if (!wroteValue)
 {
 throw new CryptographicException();
Expand DownExpand Up@@ -107,6 +199,28 @@ private static void DecodeCore(ref AsnValueReader reader, ReadOnlyMemory<byte> r
 tmpSpan = reader.ReadEncodedValue();
 decoded.Certificate = rebindSpan.Overlaps(tmpSpan, out offset) ? rebind.Slice(offset, tmpSpan.Length) : tmpSpan.ToArray();
 }
 else if (tag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 0)))
 {
 tmpSpan = reader.ReadEncodedValue();
 decoded.ExtendedCertificate = rebindSpan.Overlaps(tmpSpan, out offset) ? rebind.Slice(offset, tmpSpan.Length) : tmpSpan.ToArray();
 }
 else if (tag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 1)))
 {
 tmpSpan = reader.ReadEncodedValue();
 decoded.AttributeCertificateV1 = rebindSpan.Overlaps(tmpSpan, out offset) ? rebind.Slice(offset, tmpSpan.Length) : tmpSpan.ToArray();
 }
 else if (tag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 2)))
 {
 tmpSpan = reader.ReadEncodedValue();
 decoded.AttributeCertificateV2 = rebindSpan.Overlaps(tmpSpan, out offset) ? rebind.Slice(offset, tmpSpan.Length) : tmpSpan.ToArray();
 }
 else if (tag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 3)))
 {
 System.Security.Cryptography.Pkcs.Asn1.OtherCertificateFormat tmpOtherCertificateFormat;
 System.Security.Cryptography.Pkcs.Asn1.OtherCertificateFormat.Decode(ref reader, new Asn1Tag(TagClass.ContextSpecific, 3), rebind, out tmpOtherCertificateFormat);
 decoded.OtherCertificateFormat = tmpOtherCertificateFormat;

 }
 else
 {
 throw new CryptographicException();
Expand Down

17 changes: 17 additions & 0 deletions
...y.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/Asn1/OtherCertificateFormat.xml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
<?xml version="1.0" encoding="utf-8" ?>
<asn:Sequence
 xmlns:asn="http://schemas.dot.net/asnxml/201808/"
 name="OtherCertificateFormat"
 namespace="System.Security.Cryptography.Pkcs.Asn1">

 <!--
 https://tools.ietf.org/html/rfc5652#section-10.2.2

 OtherCertificateFormat ::= SEQUENCE {
 otherCertFormat OBJECT IDENTIFIER,
 otherCert ANY DEFINED BY otherCertFormat
 }
 -->
 <asn:ObjectIdentifier name="OtherCertFormat" backingType="string" />
 <asn:AnyValue name="OtherCert" />
</asn:Sequence>

98 changes: 98 additions & 0 deletions
...ryptography.Pkcs/src/System/Security/Cryptography/Pkcs/Asn1/OtherCertificateFormat.xml.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
// Licensed to the .NET Foundation under one or more agreements.
// The .NET Foundation licenses this file to you under the MIT license.

#pragma warning disable SA1028 // ignore whitespace warnings for generated code
using System;
using System.Formats.Asn1;
using System.Runtime.InteropServices;

namespace System.Security.Cryptography.Pkcs.Asn1
{
 [StructLayout(LayoutKind.Sequential)]
 internal partial struct OtherCertificateFormat
 {
 internal string OtherCertFormat;
 internal ReadOnlyMemory<byte> OtherCert;

 internal void Encode(AsnWriter writer)
 {
 Encode(writer, Asn1Tag.Sequence);
 }

 internal void Encode(AsnWriter writer, Asn1Tag tag)
 {
 writer.PushSequence(tag);

 try
 {
 writer.WriteObjectIdentifier(OtherCertFormat);
 }
 catch (ArgumentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 try
 {
 writer.WriteEncodedValue(OtherCert.Span);
 }
 catch (ArgumentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 writer.PopSequence(tag);
 }

 internal static OtherCertificateFormat Decode(ReadOnlyMemory<byte> encoded, AsnEncodingRules ruleSet)
 {
 return Decode(Asn1Tag.Sequence, encoded, ruleSet);
 }

 internal static OtherCertificateFormat Decode(Asn1Tag expectedTag, ReadOnlyMemory<byte> encoded, AsnEncodingRules ruleSet)
 {
 try
 {
 AsnValueReader reader = new AsnValueReader(encoded.Span, ruleSet);

 DecodeCore(ref reader, expectedTag, encoded, out OtherCertificateFormat decoded);
 reader.ThrowIfNotEmpty();
 return decoded;
 }
 catch (AsnContentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 }

 internal static void Decode(ref AsnValueReader reader, ReadOnlyMemory<byte> rebind, out OtherCertificateFormat decoded)
 {
 Decode(ref reader, Asn1Tag.Sequence, rebind, out decoded);
 }

 internal static void Decode(ref AsnValueReader reader, Asn1Tag expectedTag, ReadOnlyMemory<byte> rebind, out OtherCertificateFormat decoded)
 {
 try
 {
 DecodeCore(ref reader, expectedTag, rebind, out decoded);
 }
 catch (AsnContentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 }

 private static void DecodeCore(ref AsnValueReader reader, Asn1Tag expectedTag, ReadOnlyMemory<byte> rebind, out OtherCertificateFormat decoded)
 {
 decoded = default;
 AsnValueReader sequenceReader = reader.ReadSequence(expectedTag);
 ReadOnlySpan<byte> rebindSpan = rebind.Span;
 int offset;
 ReadOnlySpan<byte> tmpSpan;

 decoded.OtherCertFormat = sequenceReader.ReadObjectIdentifier();
 tmpSpan = sequenceReader.ReadEncodedValue();
 decoded.OtherCert = rebindSpan.Overlaps(tmpSpan, out offset) ? rebind.Slice(offset, tmpSpan.Length) : tmpSpan.ToArray();

 sequenceReader.ThrowIfNotEmpty();
 }
 }
}

12 changes: 10 additions & 2 deletions
...ries/System.Security.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/SignedCms.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -89,8 +89,16 @@ public X509Certificate2Collection Certificates

 foreach (CertificateChoiceAsn choice in certChoices)
 {
 Debug.Assert(choice.Certificate.HasValue);
 coll.Add(new X509Certificate2(choice.Certificate.Value.ToArray()));
 if (choice.Certificate.HasValue)
 {
 coll.Add(new X509Certificate2(choice.Certificate.Value
#if NET5_0_OR_GREATER
 .Span
#else
 .ToArray()
#endif
 ));
 }
 }

 return coll;
Expand Down

9 changes: 9 additions & 0 deletions
src/libraries/System.Security.Cryptography.Pkcs/tests/SignedCms/SignedCmsTests.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -1602,6 +1602,15 @@ public static void CheckNoSignature_FromCoreFx_TamperIssuerName()
 signers[0].CheckHash();
 }

 [Fact]
 public static void Decode_CanDecodeWithAttributeCertificate()
 {
 SignedCms cms = new SignedCms();
 cms.Decode(SignedDocuments.TstWithAttributeCertificate);
 Assert.Equal(2, cms.Certificates.Count);
 cms.CheckSignature(verifySignatureOnly: true);
 }

 private static void CheckNoSignature(byte[] encoded, bool badOid=false)
 {
 SignedCms cms = new SignedCms();
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Ignore non-X509 certificates in SignedCms#64348

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

bartonjs
merged 2 commits into

from

Jan 28, 2022
 Merged


Ignore non-X509 certificates in SignedCms
#64348
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
cb04bde

Improve support for reading timestamps on Windows Authenticode


bartonjs Jan 26, 2022
4cca93a

Add a test that the CMS can decode


vcsjones Jan 26, 2022

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


4 changes: 4 additions & 0 deletions
src/libraries/System.Security.Cryptography.Pkcs/src/System.Security.Cryptography.Pkcs.csproj

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -490,6 +490,10 @@ System.Security.Cryptography.Pkcs.EnvelopedCms</PackageDescription>
 <Compile Include="System\Security\Cryptography\Pkcs\Asn1\MessageImprint.xml.cs">
 <DependentUpon>System\Security\Cryptography\Pkcs\Asn1\MessageImprint.xml</DependentUpon>
 </Compile>
 <AsnXml Include="System\Security\Cryptography\Pkcs\Asn1\OtherCertificateFormat.xml" />
 <Compile Include="System\Security\Cryptography\Pkcs\Asn1\OtherCertificateFormat.xml.cs">
 <DependentUpon>System\Security\Cryptography\Pkcs\Asn1\OtherCertificateFormat.xml</DependentUpon>
 </Compile>
 <Compile Include="System\Security\Cryptography\Pkcs\Asn1\PkiFailureInfo.cs" />
 <Compile Include="System\Security\Cryptography\Pkcs\Asn1\PkiStatus.cs" />
 <AsnXml Include="System\Security\Cryptography\Pkcs\Asn1\PkiStatusInfo.xml" />
Expand Down

10 changes: 4 additions & 6 deletions
...ity.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/Asn1/CertificateChoiceAsn.xml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -15,12 +15,10 @@
 other[3] IMPLICIT OtherCertificateFormat
 }

 OtherCertificateFormat ::= SEQUENCE {
 otherCertFormat OBJECT IDENTIFIER,
 otherCert ANY DEFINED BY otherCertFormat
 }

 Except we only support public key certificates, so just trim the choice here.
 -->
 <asn:AnyValue name="Certificate" universalTagNumber="16" />
 <asn:AnyValue name="ExtendedCertificate" implicitTag="0" />
 <asn:AnyValue name="AttributeCertificateV1" implicitTag="1" />
 <asn:AnyValue name="AttributeCertificateV2" implicitTag="2" />
 <asn:AsnType name="OtherCertificateFormat" typeName="System.Security.Cryptography.Pkcs.Asn1.OtherCertificateFormat" implicitTag="3" />
</asn:Choice>

114 changes: 114 additions & 0 deletions
....Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/Asn1/CertificateChoiceAsn.xml.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -12,6 +12,10 @@ namespace System.Security.Cryptography.Pkcs.Asn1
 internal partial struct CertificateChoiceAsn
 {
 internal ReadOnlyMemory<byte>? Certificate;
 internal ReadOnlyMemory<byte>? ExtendedCertificate;
 internal ReadOnlyMemory<byte>? AttributeCertificateV1;
 internal ReadOnlyMemory<byte>? AttributeCertificateV2;
 internal System.Security.Cryptography.Pkcs.Asn1.OtherCertificateFormat? OtherCertificateFormat;

#if DEBUG
 static CertificateChoiceAsn()
Expand All@@ -28,6 +32,10 @@ static CertificateChoiceAsn()
 };

 ensureUniqueTag(new Asn1Tag((UniversalTagNumber)16), "Certificate");
 ensureUniqueTag(new Asn1Tag(TagClass.ContextSpecific, 0), "ExtendedCertificate");
 ensureUniqueTag(new Asn1Tag(TagClass.ContextSpecific, 1), "AttributeCertificateV1");
 ensureUniqueTag(new Asn1Tag(TagClass.ContextSpecific, 2), "AttributeCertificateV2");
 ensureUniqueTag(new Asn1Tag(TagClass.ContextSpecific, 3), "OtherCertificateFormat");
 }
#endif

Expand DownExpand Up@@ -60,6 +68,90 @@ internal void Encode(AsnWriter writer)
 wroteValue = true;
 }

 if (ExtendedCertificate.HasValue)
 {
 if (wroteValue)
 throw new CryptographicException();

 // Validator for tag constraint for ExtendedCertificate
 {
 if (!Asn1Tag.TryDecode(ExtendedCertificate.Value.Span, out Asn1Tag validateTag, out _) ||
 !validateTag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 0)))
 {
 throw new CryptographicException();
 }
 }

 try
 {
 writer.WriteEncodedValue(ExtendedCertificate.Value.Span);
 }
 catch (ArgumentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 wroteValue = true;
 }

 if (AttributeCertificateV1.HasValue)
 {
 if (wroteValue)
 throw new CryptographicException();

 // Validator for tag constraint for AttributeCertificateV1
 {
 if (!Asn1Tag.TryDecode(AttributeCertificateV1.Value.Span, out Asn1Tag validateTag, out _) ||
 !validateTag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 1)))
 {
 throw new CryptographicException();
 }
 }

 try
 {
 writer.WriteEncodedValue(AttributeCertificateV1.Value.Span);
 }
 catch (ArgumentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 wroteValue = true;
 }

 if (AttributeCertificateV2.HasValue)
 {
 if (wroteValue)
 throw new CryptographicException();

 // Validator for tag constraint for AttributeCertificateV2
 {
 if (!Asn1Tag.TryDecode(AttributeCertificateV2.Value.Span, out Asn1Tag validateTag, out _) ||
 !validateTag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 2)))
 {
 throw new CryptographicException();
 }
 }

 try
 {
 writer.WriteEncodedValue(AttributeCertificateV2.Value.Span);
 }
 catch (ArgumentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 wroteValue = true;
 }

 if (OtherCertificateFormat.HasValue)
 {
 if (wroteValue)
 throw new CryptographicException();

 OtherCertificateFormat.Value.Encode(writer, new Asn1Tag(TagClass.ContextSpecific, 3));
 wroteValue = true;
 }

 if (!wroteValue)
 {
 throw new CryptographicException();
Expand DownExpand Up@@ -107,6 +199,28 @@ private static void DecodeCore(ref AsnValueReader reader, ReadOnlyMemory<byte> r
 tmpSpan = reader.ReadEncodedValue();
 decoded.Certificate = rebindSpan.Overlaps(tmpSpan, out offset) ? rebind.Slice(offset, tmpSpan.Length) : tmpSpan.ToArray();
 }
 else if (tag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 0)))
 {
 tmpSpan = reader.ReadEncodedValue();
 decoded.ExtendedCertificate = rebindSpan.Overlaps(tmpSpan, out offset) ? rebind.Slice(offset, tmpSpan.Length) : tmpSpan.ToArray();
 }
 else if (tag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 1)))
 {
 tmpSpan = reader.ReadEncodedValue();
 decoded.AttributeCertificateV1 = rebindSpan.Overlaps(tmpSpan, out offset) ? rebind.Slice(offset, tmpSpan.Length) : tmpSpan.ToArray();
 }
 else if (tag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 2)))
 {
 tmpSpan = reader.ReadEncodedValue();
 decoded.AttributeCertificateV2 = rebindSpan.Overlaps(tmpSpan, out offset) ? rebind.Slice(offset, tmpSpan.Length) : tmpSpan.ToArray();
 }
 else if (tag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 3)))
 {
 System.Security.Cryptography.Pkcs.Asn1.OtherCertificateFormat tmpOtherCertificateFormat;
 System.Security.Cryptography.Pkcs.Asn1.OtherCertificateFormat.Decode(ref reader, new Asn1Tag(TagClass.ContextSpecific, 3), rebind, out tmpOtherCertificateFormat);
 decoded.OtherCertificateFormat = tmpOtherCertificateFormat;

 }
 else
 {
 throw new CryptographicException();
Expand Down

17 changes: 17 additions & 0 deletions
...y.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/Asn1/OtherCertificateFormat.xml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
<?xml version="1.0" encoding="utf-8" ?>
<asn:Sequence
 xmlns:asn="http://schemas.dot.net/asnxml/201808/"
 name="OtherCertificateFormat"
 namespace="System.Security.Cryptography.Pkcs.Asn1">

 <!--
 https://tools.ietf.org/html/rfc5652#section-10.2.2

 OtherCertificateFormat ::= SEQUENCE {
 otherCertFormat OBJECT IDENTIFIER,
 otherCert ANY DEFINED BY otherCertFormat
 }
 -->
 <asn:ObjectIdentifier name="OtherCertFormat" backingType="string" />
 <asn:AnyValue name="OtherCert" />
</asn:Sequence>

98 changes: 98 additions & 0 deletions
...ryptography.Pkcs/src/System/Security/Cryptography/Pkcs/Asn1/OtherCertificateFormat.xml.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
// Licensed to the .NET Foundation under one or more agreements.
// The .NET Foundation licenses this file to you under the MIT license.

#pragma warning disable SA1028 // ignore whitespace warnings for generated code
using System;
using System.Formats.Asn1;
using System.Runtime.InteropServices;

namespace System.Security.Cryptography.Pkcs.Asn1
{
 [StructLayout(LayoutKind.Sequential)]
 internal partial struct OtherCertificateFormat
 {
 internal string OtherCertFormat;
 internal ReadOnlyMemory<byte> OtherCert;

 internal void Encode(AsnWriter writer)
 {
 Encode(writer, Asn1Tag.Sequence);
 }

 internal void Encode(AsnWriter writer, Asn1Tag tag)
 {
 writer.PushSequence(tag);

 try
 {
 writer.WriteObjectIdentifier(OtherCertFormat);
 }
 catch (ArgumentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 try
 {
 writer.WriteEncodedValue(OtherCert.Span);
 }
 catch (ArgumentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 writer.PopSequence(tag);
 }

 internal static OtherCertificateFormat Decode(ReadOnlyMemory<byte> encoded, AsnEncodingRules ruleSet)
 {
 return Decode(Asn1Tag.Sequence, encoded, ruleSet);
 }

 internal static OtherCertificateFormat Decode(Asn1Tag expectedTag, ReadOnlyMemory<byte> encoded, AsnEncodingRules ruleSet)
 {
 try
 {
 AsnValueReader reader = new AsnValueReader(encoded.Span, ruleSet);

 DecodeCore(ref reader, expectedTag, encoded, out OtherCertificateFormat decoded);
 reader.ThrowIfNotEmpty();
 return decoded;
 }
 catch (AsnContentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 }

 internal static void Decode(ref AsnValueReader reader, ReadOnlyMemory<byte> rebind, out OtherCertificateFormat decoded)
 {
 Decode(ref reader, Asn1Tag.Sequence, rebind, out decoded);
 }

 internal static void Decode(ref AsnValueReader reader, Asn1Tag expectedTag, ReadOnlyMemory<byte> rebind, out OtherCertificateFormat decoded)
 {
 try
 {
 DecodeCore(ref reader, expectedTag, rebind, out decoded);
 }
 catch (AsnContentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 }

 private static void DecodeCore(ref AsnValueReader reader, Asn1Tag expectedTag, ReadOnlyMemory<byte> rebind, out OtherCertificateFormat decoded)
 {
 decoded = default;
 AsnValueReader sequenceReader = reader.ReadSequence(expectedTag);
 ReadOnlySpan<byte> rebindSpan = rebind.Span;
 int offset;
 ReadOnlySpan<byte> tmpSpan;

 decoded.OtherCertFormat = sequenceReader.ReadObjectIdentifier();
 tmpSpan = sequenceReader.ReadEncodedValue();
 decoded.OtherCert = rebindSpan.Overlaps(tmpSpan, out offset) ? rebind.Slice(offset, tmpSpan.Length) : tmpSpan.ToArray();

 sequenceReader.ThrowIfNotEmpty();
 }
 }
}

12 changes: 10 additions & 2 deletions
...ries/System.Security.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/SignedCms.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -89,8 +89,16 @@ public X509Certificate2Collection Certificates

 foreach (CertificateChoiceAsn choice in certChoices)
 {
 Debug.Assert(choice.Certificate.HasValue);
 coll.Add(new X509Certificate2(choice.Certificate.Value.ToArray()));
 if (choice.Certificate.HasValue)
 {
 coll.Add(new X509Certificate2(choice.Certificate.Value
#if NET5_0_OR_GREATER
 .Span
#else
 .ToArray()
#endif
 ));
 }
 }

 return coll;
Expand Down

9 changes: 9 additions & 0 deletions
src/libraries/System.Security.Cryptography.Pkcs/tests/SignedCms/SignedCmsTests.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -1602,6 +1602,15 @@ public static void CheckNoSignature_FromCoreFx_TamperIssuerName()
 signers[0].CheckHash();
 }

 [Fact]
 public static void Decode_CanDecodeWithAttributeCertificate()
 {
 SignedCms cms = new SignedCms();
 cms.Decode(SignedDocuments.TstWithAttributeCertificate);
 Assert.Equal(2, cms.Certificates.Count);
 cms.CheckSignature(verifySignatureOnly: true);
 }

 private static void CheckNoSignature(byte[] encoded, bool badOid=false)
 {
 SignedCms cms = new SignedCms();
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Ignore non-X509 certificates in SignedCms#64348

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

bartonjs
merged 2 commits into

from

Jan 28, 2022
 Merged


Ignore non-X509 certificates in SignedCms
#64348
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
cb04bde

Improve support for reading timestamps on Windows Authenticode


bartonjs Jan 26, 2022
4cca93a

Add a test that the CMS can decode


vcsjones Jan 26, 2022

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


4 changes: 4 additions & 0 deletions
src/libraries/System.Security.Cryptography.Pkcs/src/System.Security.Cryptography.Pkcs.csproj

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -490,6 +490,10 @@ System.Security.Cryptography.Pkcs.EnvelopedCms</PackageDescription>
 <Compile Include="System\Security\Cryptography\Pkcs\Asn1\MessageImprint.xml.cs">
 <DependentUpon>System\Security\Cryptography\Pkcs\Asn1\MessageImprint.xml</DependentUpon>
 </Compile>
 <AsnXml Include="System\Security\Cryptography\Pkcs\Asn1\OtherCertificateFormat.xml" />
 <Compile Include="System\Security\Cryptography\Pkcs\Asn1\OtherCertificateFormat.xml.cs">
 <DependentUpon>System\Security\Cryptography\Pkcs\Asn1\OtherCertificateFormat.xml</DependentUpon>
 </Compile>
 <Compile Include="System\Security\Cryptography\Pkcs\Asn1\PkiFailureInfo.cs" />
 <Compile Include="System\Security\Cryptography\Pkcs\Asn1\PkiStatus.cs" />
 <AsnXml Include="System\Security\Cryptography\Pkcs\Asn1\PkiStatusInfo.xml" />
Expand Down

10 changes: 4 additions & 6 deletions
...ity.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/Asn1/CertificateChoiceAsn.xml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -15,12 +15,10 @@
 other[3] IMPLICIT OtherCertificateFormat
 }

 OtherCertificateFormat ::= SEQUENCE {
 otherCertFormat OBJECT IDENTIFIER,
 otherCert ANY DEFINED BY otherCertFormat
 }

 Except we only support public key certificates, so just trim the choice here.
 -->
 <asn:AnyValue name="Certificate" universalTagNumber="16" />
 <asn:AnyValue name="ExtendedCertificate" implicitTag="0" />
 <asn:AnyValue name="AttributeCertificateV1" implicitTag="1" />
 <asn:AnyValue name="AttributeCertificateV2" implicitTag="2" />
 <asn:AsnType name="OtherCertificateFormat" typeName="System.Security.Cryptography.Pkcs.Asn1.OtherCertificateFormat" implicitTag="3" />
</asn:Choice>

114 changes: 114 additions & 0 deletions
....Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/Asn1/CertificateChoiceAsn.xml.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -12,6 +12,10 @@ namespace System.Security.Cryptography.Pkcs.Asn1
 internal partial struct CertificateChoiceAsn
 {
 internal ReadOnlyMemory<byte>? Certificate;
 internal ReadOnlyMemory<byte>? ExtendedCertificate;
 internal ReadOnlyMemory<byte>? AttributeCertificateV1;
 internal ReadOnlyMemory<byte>? AttributeCertificateV2;
 internal System.Security.Cryptography.Pkcs.Asn1.OtherCertificateFormat? OtherCertificateFormat;

#if DEBUG
 static CertificateChoiceAsn()
Expand All@@ -28,6 +32,10 @@ static CertificateChoiceAsn()
 };

 ensureUniqueTag(new Asn1Tag((UniversalTagNumber)16), "Certificate");
 ensureUniqueTag(new Asn1Tag(TagClass.ContextSpecific, 0), "ExtendedCertificate");
 ensureUniqueTag(new Asn1Tag(TagClass.ContextSpecific, 1), "AttributeCertificateV1");
 ensureUniqueTag(new Asn1Tag(TagClass.ContextSpecific, 2), "AttributeCertificateV2");
 ensureUniqueTag(new Asn1Tag(TagClass.ContextSpecific, 3), "OtherCertificateFormat");
 }
#endif

Expand DownExpand Up@@ -60,6 +68,90 @@ internal void Encode(AsnWriter writer)
 wroteValue = true;
 }

 if (ExtendedCertificate.HasValue)
 {
 if (wroteValue)
 throw new CryptographicException();

 // Validator for tag constraint for ExtendedCertificate
 {
 if (!Asn1Tag.TryDecode(ExtendedCertificate.Value.Span, out Asn1Tag validateTag, out _) ||
 !validateTag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 0)))
 {
 throw new CryptographicException();
 }
 }

 try
 {
 writer.WriteEncodedValue(ExtendedCertificate.Value.Span);
 }
 catch (ArgumentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 wroteValue = true;
 }

 if (AttributeCertificateV1.HasValue)
 {
 if (wroteValue)
 throw new CryptographicException();

 // Validator for tag constraint for AttributeCertificateV1
 {
 if (!Asn1Tag.TryDecode(AttributeCertificateV1.Value.Span, out Asn1Tag validateTag, out _) ||
 !validateTag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 1)))
 {
 throw new CryptographicException();
 }
 }

 try
 {
 writer.WriteEncodedValue(AttributeCertificateV1.Value.Span);
 }
 catch (ArgumentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 wroteValue = true;
 }

 if (AttributeCertificateV2.HasValue)
 {
 if (wroteValue)
 throw new CryptographicException();

 // Validator for tag constraint for AttributeCertificateV2
 {
 if (!Asn1Tag.TryDecode(AttributeCertificateV2.Value.Span, out Asn1Tag validateTag, out _) ||
 !validateTag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 2)))
 {
 throw new CryptographicException();
 }
 }

 try
 {
 writer.WriteEncodedValue(AttributeCertificateV2.Value.Span);
 }
 catch (ArgumentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 wroteValue = true;
 }

 if (OtherCertificateFormat.HasValue)
 {
 if (wroteValue)
 throw new CryptographicException();

 OtherCertificateFormat.Value.Encode(writer, new Asn1Tag(TagClass.ContextSpecific, 3));
 wroteValue = true;
 }

 if (!wroteValue)
 {
 throw new CryptographicException();
Expand DownExpand Up@@ -107,6 +199,28 @@ private static void DecodeCore(ref AsnValueReader reader, ReadOnlyMemory<byte> r
 tmpSpan = reader.ReadEncodedValue();
 decoded.Certificate = rebindSpan.Overlaps(tmpSpan, out offset) ? rebind.Slice(offset, tmpSpan.Length) : tmpSpan.ToArray();
 }
 else if (tag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 0)))
 {
 tmpSpan = reader.ReadEncodedValue();
 decoded.ExtendedCertificate = rebindSpan.Overlaps(tmpSpan, out offset) ? rebind.Slice(offset, tmpSpan.Length) : tmpSpan.ToArray();
 }
 else if (tag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 1)))
 {
 tmpSpan = reader.ReadEncodedValue();
 decoded.AttributeCertificateV1 = rebindSpan.Overlaps(tmpSpan, out offset) ? rebind.Slice(offset, tmpSpan.Length) : tmpSpan.ToArray();
 }
 else if (tag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 2)))
 {
 tmpSpan = reader.ReadEncodedValue();
 decoded.AttributeCertificateV2 = rebindSpan.Overlaps(tmpSpan, out offset) ? rebind.Slice(offset, tmpSpan.Length) : tmpSpan.ToArray();
 }
 else if (tag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 3)))
 {
 System.Security.Cryptography.Pkcs.Asn1.OtherCertificateFormat tmpOtherCertificateFormat;
 System.Security.Cryptography.Pkcs.Asn1.OtherCertificateFormat.Decode(ref reader, new Asn1Tag(TagClass.ContextSpecific, 3), rebind, out tmpOtherCertificateFormat);
 decoded.OtherCertificateFormat = tmpOtherCertificateFormat;

 }
 else
 {
 throw new CryptographicException();
Expand Down

17 changes: 17 additions & 0 deletions
...y.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/Asn1/OtherCertificateFormat.xml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
<?xml version="1.0" encoding="utf-8" ?>
<asn:Sequence
 xmlns:asn="http://schemas.dot.net/asnxml/201808/"
 name="OtherCertificateFormat"
 namespace="System.Security.Cryptography.Pkcs.Asn1">

 <!--
 https://tools.ietf.org/html/rfc5652#section-10.2.2

 OtherCertificateFormat ::= SEQUENCE {
 otherCertFormat OBJECT IDENTIFIER,
 otherCert ANY DEFINED BY otherCertFormat
 }
 -->
 <asn:ObjectIdentifier name="OtherCertFormat" backingType="string" />
 <asn:AnyValue name="OtherCert" />
</asn:Sequence>

98 changes: 98 additions & 0 deletions
...ryptography.Pkcs/src/System/Security/Cryptography/Pkcs/Asn1/OtherCertificateFormat.xml.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
// Licensed to the .NET Foundation under one or more agreements.
// The .NET Foundation licenses this file to you under the MIT license.

#pragma warning disable SA1028 // ignore whitespace warnings for generated code
using System;
using System.Formats.Asn1;
using System.Runtime.InteropServices;

namespace System.Security.Cryptography.Pkcs.Asn1
{
 [StructLayout(LayoutKind.Sequential)]
 internal partial struct OtherCertificateFormat
 {
 internal string OtherCertFormat;
 internal ReadOnlyMemory<byte> OtherCert;

 internal void Encode(AsnWriter writer)
 {
 Encode(writer, Asn1Tag.Sequence);
 }

 internal void Encode(AsnWriter writer, Asn1Tag tag)
 {
 writer.PushSequence(tag);

 try
 {
 writer.WriteObjectIdentifier(OtherCertFormat);
 }
 catch (ArgumentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 try
 {
 writer.WriteEncodedValue(OtherCert.Span);
 }
 catch (ArgumentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 writer.PopSequence(tag);
 }

 internal static OtherCertificateFormat Decode(ReadOnlyMemory<byte> encoded, AsnEncodingRules ruleSet)
 {
 return Decode(Asn1Tag.Sequence, encoded, ruleSet);
 }

 internal static OtherCertificateFormat Decode(Asn1Tag expectedTag, ReadOnlyMemory<byte> encoded, AsnEncodingRules ruleSet)
 {
 try
 {
 AsnValueReader reader = new AsnValueReader(encoded.Span, ruleSet);

 DecodeCore(ref reader, expectedTag, encoded, out OtherCertificateFormat decoded);
 reader.ThrowIfNotEmpty();
 return decoded;
 }
 catch (AsnContentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 }

 internal static void Decode(ref AsnValueReader reader, ReadOnlyMemory<byte> rebind, out OtherCertificateFormat decoded)
 {
 Decode(ref reader, Asn1Tag.Sequence, rebind, out decoded);
 }

 internal static void Decode(ref AsnValueReader reader, Asn1Tag expectedTag, ReadOnlyMemory<byte> rebind, out OtherCertificateFormat decoded)
 {
 try
 {
 DecodeCore(ref reader, expectedTag, rebind, out decoded);
 }
 catch (AsnContentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 }

 private static void DecodeCore(ref AsnValueReader reader, Asn1Tag expectedTag, ReadOnlyMemory<byte> rebind, out OtherCertificateFormat decoded)
 {
 decoded = default;
 AsnValueReader sequenceReader = reader.ReadSequence(expectedTag);
 ReadOnlySpan<byte> rebindSpan = rebind.Span;
 int offset;
 ReadOnlySpan<byte> tmpSpan;

 decoded.OtherCertFormat = sequenceReader.ReadObjectIdentifier();
 tmpSpan = sequenceReader.ReadEncodedValue();
 decoded.OtherCert = rebindSpan.Overlaps(tmpSpan, out offset) ? rebind.Slice(offset, tmpSpan.Length) : tmpSpan.ToArray();

 sequenceReader.ThrowIfNotEmpty();
 }
 }
}

12 changes: 10 additions & 2 deletions
...ries/System.Security.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/SignedCms.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -89,8 +89,16 @@ public X509Certificate2Collection Certificates

 foreach (CertificateChoiceAsn choice in certChoices)
 {
 Debug.Assert(choice.Certificate.HasValue);
 coll.Add(new X509Certificate2(choice.Certificate.Value.ToArray()));
 if (choice.Certificate.HasValue)
 {
 coll.Add(new X509Certificate2(choice.Certificate.Value
#if NET5_0_OR_GREATER
 .Span
#else
 .ToArray()
#endif
 ));
 }
 }

 return coll;
Expand Down

9 changes: 9 additions & 0 deletions
src/libraries/System.Security.Cryptography.Pkcs/tests/SignedCms/SignedCmsTests.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -1602,6 +1602,15 @@ public static void CheckNoSignature_FromCoreFx_TamperIssuerName()
 signers[0].CheckHash();
 }

 [Fact]
 public static void Decode_CanDecodeWithAttributeCertificate()
 {
 SignedCms cms = new SignedCms();
 cms.Decode(SignedDocuments.TstWithAttributeCertificate);
 Assert.Equal(2, cms.Certificates.Count);
 cms.CheckSignature(verifySignatureOnly: true);
 }

 private static void CheckNoSignature(byte[] encoded, bool badOid=false)
 {
 SignedCms cms = new SignedCms();
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
Ignore non-X509 certificates in SignedCms#64348

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

bartonjs
merged 2 commits into

from

Jan 28, 2022
 Merged


Ignore non-X509 certificates in SignedCms
#64348
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
cb04bde

Improve support for reading timestamps on Windows Authenticode


bartonjs Jan 26, 2022
4cca93a

Add a test that the CMS can decode


vcsjones Jan 26, 2022

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


4 changes: 4 additions & 0 deletions
src/libraries/System.Security.Cryptography.Pkcs/src/System.Security.Cryptography.Pkcs.csproj

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -490,6 +490,10 @@ System.Security.Cryptography.Pkcs.EnvelopedCms</PackageDescription>
 <Compile Include="System\Security\Cryptography\Pkcs\Asn1\MessageImprint.xml.cs">
 <DependentUpon>System\Security\Cryptography\Pkcs\Asn1\MessageImprint.xml</DependentUpon>
 </Compile>
 <AsnXml Include="System\Security\Cryptography\Pkcs\Asn1\OtherCertificateFormat.xml" />
 <Compile Include="System\Security\Cryptography\Pkcs\Asn1\OtherCertificateFormat.xml.cs">
 <DependentUpon>System\Security\Cryptography\Pkcs\Asn1\OtherCertificateFormat.xml</DependentUpon>
 </Compile>
 <Compile Include="System\Security\Cryptography\Pkcs\Asn1\PkiFailureInfo.cs" />
 <Compile Include="System\Security\Cryptography\Pkcs\Asn1\PkiStatus.cs" />
 <AsnXml Include="System\Security\Cryptography\Pkcs\Asn1\PkiStatusInfo.xml" />
Expand Down

10 changes: 4 additions & 6 deletions
...ity.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/Asn1/CertificateChoiceAsn.xml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -15,12 +15,10 @@
 other[3] IMPLICIT OtherCertificateFormat
 }

 OtherCertificateFormat ::= SEQUENCE {
 otherCertFormat OBJECT IDENTIFIER,
 otherCert ANY DEFINED BY otherCertFormat
 }

 Except we only support public key certificates, so just trim the choice here.
 -->
 <asn:AnyValue name="Certificate" universalTagNumber="16" />
 <asn:AnyValue name="ExtendedCertificate" implicitTag="0" />
 <asn:AnyValue name="AttributeCertificateV1" implicitTag="1" />
 <asn:AnyValue name="AttributeCertificateV2" implicitTag="2" />
 <asn:AsnType name="OtherCertificateFormat" typeName="System.Security.Cryptography.Pkcs.Asn1.OtherCertificateFormat" implicitTag="3" />
</asn:Choice>

114 changes: 114 additions & 0 deletions
....Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/Asn1/CertificateChoiceAsn.xml.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -12,6 +12,10 @@ namespace System.Security.Cryptography.Pkcs.Asn1
 internal partial struct CertificateChoiceAsn
 {
 internal ReadOnlyMemory<byte>? Certificate;
 internal ReadOnlyMemory<byte>? ExtendedCertificate;
 internal ReadOnlyMemory<byte>? AttributeCertificateV1;
 internal ReadOnlyMemory<byte>? AttributeCertificateV2;
 internal System.Security.Cryptography.Pkcs.Asn1.OtherCertificateFormat? OtherCertificateFormat;

#if DEBUG
 static CertificateChoiceAsn()
Expand All@@ -28,6 +32,10 @@ static CertificateChoiceAsn()
 };

 ensureUniqueTag(new Asn1Tag((UniversalTagNumber)16), "Certificate");
 ensureUniqueTag(new Asn1Tag(TagClass.ContextSpecific, 0), "ExtendedCertificate");
 ensureUniqueTag(new Asn1Tag(TagClass.ContextSpecific, 1), "AttributeCertificateV1");
 ensureUniqueTag(new Asn1Tag(TagClass.ContextSpecific, 2), "AttributeCertificateV2");
 ensureUniqueTag(new Asn1Tag(TagClass.ContextSpecific, 3), "OtherCertificateFormat");
 }
#endif

Expand DownExpand Up@@ -60,6 +68,90 @@ internal void Encode(AsnWriter writer)
 wroteValue = true;
 }

 if (ExtendedCertificate.HasValue)
 {
 if (wroteValue)
 throw new CryptographicException();

 // Validator for tag constraint for ExtendedCertificate
 {
 if (!Asn1Tag.TryDecode(ExtendedCertificate.Value.Span, out Asn1Tag validateTag, out _) ||
 !validateTag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 0)))
 {
 throw new CryptographicException();
 }
 }

 try
 {
 writer.WriteEncodedValue(ExtendedCertificate.Value.Span);
 }
 catch (ArgumentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 wroteValue = true;
 }

 if (AttributeCertificateV1.HasValue)
 {
 if (wroteValue)
 throw new CryptographicException();

 // Validator for tag constraint for AttributeCertificateV1
 {
 if (!Asn1Tag.TryDecode(AttributeCertificateV1.Value.Span, out Asn1Tag validateTag, out _) ||
 !validateTag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 1)))
 {
 throw new CryptographicException();
 }
 }

 try
 {
 writer.WriteEncodedValue(AttributeCertificateV1.Value.Span);
 }
 catch (ArgumentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 wroteValue = true;
 }

 if (AttributeCertificateV2.HasValue)
 {
 if (wroteValue)
 throw new CryptographicException();

 // Validator for tag constraint for AttributeCertificateV2
 {
 if (!Asn1Tag.TryDecode(AttributeCertificateV2.Value.Span, out Asn1Tag validateTag, out _) ||
 !validateTag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 2)))
 {
 throw new CryptographicException();
 }
 }

 try
 {
 writer.WriteEncodedValue(AttributeCertificateV2.Value.Span);
 }
 catch (ArgumentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 wroteValue = true;
 }

 if (OtherCertificateFormat.HasValue)
 {
 if (wroteValue)
 throw new CryptographicException();

 OtherCertificateFormat.Value.Encode(writer, new Asn1Tag(TagClass.ContextSpecific, 3));
 wroteValue = true;
 }

 if (!wroteValue)
 {
 throw new CryptographicException();
Expand DownExpand Up@@ -107,6 +199,28 @@ private static void DecodeCore(ref AsnValueReader reader, ReadOnlyMemory<byte> r
 tmpSpan = reader.ReadEncodedValue();
 decoded.Certificate = rebindSpan.Overlaps(tmpSpan, out offset) ? rebind.Slice(offset, tmpSpan.Length) : tmpSpan.ToArray();
 }
 else if (tag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 0)))
 {
 tmpSpan = reader.ReadEncodedValue();
 decoded.ExtendedCertificate = rebindSpan.Overlaps(tmpSpan, out offset) ? rebind.Slice(offset, tmpSpan.Length) : tmpSpan.ToArray();
 }
 else if (tag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 1)))
 {
 tmpSpan = reader.ReadEncodedValue();
 decoded.AttributeCertificateV1 = rebindSpan.Overlaps(tmpSpan, out offset) ? rebind.Slice(offset, tmpSpan.Length) : tmpSpan.ToArray();
 }
 else if (tag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 2)))
 {
 tmpSpan = reader.ReadEncodedValue();
 decoded.AttributeCertificateV2 = rebindSpan.Overlaps(tmpSpan, out offset) ? rebind.Slice(offset, tmpSpan.Length) : tmpSpan.ToArray();
 }
 else if (tag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 3)))
 {
 System.Security.Cryptography.Pkcs.Asn1.OtherCertificateFormat tmpOtherCertificateFormat;
 System.Security.Cryptography.Pkcs.Asn1.OtherCertificateFormat.Decode(ref reader, new Asn1Tag(TagClass.ContextSpecific, 3), rebind, out tmpOtherCertificateFormat);
 decoded.OtherCertificateFormat = tmpOtherCertificateFormat;

 }
 else
 {
 throw new CryptographicException();
Expand Down

17 changes: 17 additions & 0 deletions
...y.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/Asn1/OtherCertificateFormat.xml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
<?xml version="1.0" encoding="utf-8" ?>
<asn:Sequence
 xmlns:asn="http://schemas.dot.net/asnxml/201808/"
 name="OtherCertificateFormat"
 namespace="System.Security.Cryptography.Pkcs.Asn1">

 <!--
 https://tools.ietf.org/html/rfc5652#section-10.2.2

 OtherCertificateFormat ::= SEQUENCE {
 otherCertFormat OBJECT IDENTIFIER,
 otherCert ANY DEFINED BY otherCertFormat
 }
 -->
 <asn:ObjectIdentifier name="OtherCertFormat" backingType="string" />
 <asn:AnyValue name="OtherCert" />
</asn:Sequence>

98 changes: 98 additions & 0 deletions
...ryptography.Pkcs/src/System/Security/Cryptography/Pkcs/Asn1/OtherCertificateFormat.xml.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
// Licensed to the .NET Foundation under one or more agreements.
// The .NET Foundation licenses this file to you under the MIT license.

#pragma warning disable SA1028 // ignore whitespace warnings for generated code
using System;
using System.Formats.Asn1;
using System.Runtime.InteropServices;

namespace System.Security.Cryptography.Pkcs.Asn1
{
 [StructLayout(LayoutKind.Sequential)]
 internal partial struct OtherCertificateFormat
 {
 internal string OtherCertFormat;
 internal ReadOnlyMemory<byte> OtherCert;

 internal void Encode(AsnWriter writer)
 {
 Encode(writer, Asn1Tag.Sequence);
 }

 internal void Encode(AsnWriter writer, Asn1Tag tag)
 {
 writer.PushSequence(tag);

 try
 {
 writer.WriteObjectIdentifier(OtherCertFormat);
 }
 catch (ArgumentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 try
 {
 writer.WriteEncodedValue(OtherCert.Span);
 }
 catch (ArgumentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 writer.PopSequence(tag);
 }

 internal static OtherCertificateFormat Decode(ReadOnlyMemory<byte> encoded, AsnEncodingRules ruleSet)
 {
 return Decode(Asn1Tag.Sequence, encoded, ruleSet);
 }

 internal static OtherCertificateFormat Decode(Asn1Tag expectedTag, ReadOnlyMemory<byte> encoded, AsnEncodingRules ruleSet)
 {
 try
 {
 AsnValueReader reader = new AsnValueReader(encoded.Span, ruleSet);

 DecodeCore(ref reader, expectedTag, encoded, out OtherCertificateFormat decoded);
 reader.ThrowIfNotEmpty();
 return decoded;
 }
 catch (AsnContentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 }

 internal static void Decode(ref AsnValueReader reader, ReadOnlyMemory<byte> rebind, out OtherCertificateFormat decoded)
 {
 Decode(ref reader, Asn1Tag.Sequence, rebind, out decoded);
 }

 internal static void Decode(ref AsnValueReader reader, Asn1Tag expectedTag, ReadOnlyMemory<byte> rebind, out OtherCertificateFormat decoded)
 {
 try
 {
 DecodeCore(ref reader, expectedTag, rebind, out decoded);
 }
 catch (AsnContentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 }

 private static void DecodeCore(ref AsnValueReader reader, Asn1Tag expectedTag, ReadOnlyMemory<byte> rebind, out OtherCertificateFormat decoded)
 {
 decoded = default;
 AsnValueReader sequenceReader = reader.ReadSequence(expectedTag);
 ReadOnlySpan<byte> rebindSpan = rebind.Span;
 int offset;
 ReadOnlySpan<byte> tmpSpan;

 decoded.OtherCertFormat = sequenceReader.ReadObjectIdentifier();
 tmpSpan = sequenceReader.ReadEncodedValue();
 decoded.OtherCert = rebindSpan.Overlaps(tmpSpan, out offset) ? rebind.Slice(offset, tmpSpan.Length) : tmpSpan.ToArray();

 sequenceReader.ThrowIfNotEmpty();
 }
 }
}

12 changes: 10 additions & 2 deletions
...ries/System.Security.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/SignedCms.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -89,8 +89,16 @@ public X509Certificate2Collection Certificates

 foreach (CertificateChoiceAsn choice in certChoices)
 {
 Debug.Assert(choice.Certificate.HasValue);
 coll.Add(new X509Certificate2(choice.Certificate.Value.ToArray()));
 if (choice.Certificate.HasValue)
 {
 coll.Add(new X509Certificate2(choice.Certificate.Value
#if NET5_0_OR_GREATER
 .Span
#else
 .ToArray()
#endif
 ));
 }
 }

 return coll;
Expand Down

9 changes: 9 additions & 0 deletions
src/libraries/System.Security.Cryptography.Pkcs/tests/SignedCms/SignedCmsTests.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -1602,6 +1602,15 @@ public static void CheckNoSignature_FromCoreFx_TamperIssuerName()
 signers[0].CheckHash();
 }

 [Fact]
 public static void Decode_CanDecodeWithAttributeCertificate()
 {
 SignedCms cms = new SignedCms();
 cms.Decode(SignedDocuments.TstWithAttributeCertificate);
 Assert.Equal(2, cms.Certificates.Count);
 cms.CheckSignature(verifySignatureOnly: true);
 }

 private static void CheckNoSignature(byte[] encoded, bool badOid=false)
 {
 SignedCms cms = new SignedCms();
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Ignore non-X509 certificates in SignedCms#64348

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

bartonjs
merged 2 commits into

from

Jan 28, 2022
 Merged


Ignore non-X509 certificates in SignedCms
#64348
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
cb04bde

Improve support for reading timestamps on Windows Authenticode


bartonjs Jan 26, 2022
4cca93a

Add a test that the CMS can decode


vcsjones Jan 26, 2022

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


4 changes: 4 additions & 0 deletions
src/libraries/System.Security.Cryptography.Pkcs/src/System.Security.Cryptography.Pkcs.csproj

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -490,6 +490,10 @@ System.Security.Cryptography.Pkcs.EnvelopedCms</PackageDescription>
 <Compile Include="System\Security\Cryptography\Pkcs\Asn1\MessageImprint.xml.cs">
 <DependentUpon>System\Security\Cryptography\Pkcs\Asn1\MessageImprint.xml</DependentUpon>
 </Compile>
 <AsnXml Include="System\Security\Cryptography\Pkcs\Asn1\OtherCertificateFormat.xml" />
 <Compile Include="System\Security\Cryptography\Pkcs\Asn1\OtherCertificateFormat.xml.cs">
 <DependentUpon>System\Security\Cryptography\Pkcs\Asn1\OtherCertificateFormat.xml</DependentUpon>
 </Compile>
 <Compile Include="System\Security\Cryptography\Pkcs\Asn1\PkiFailureInfo.cs" />
 <Compile Include="System\Security\Cryptography\Pkcs\Asn1\PkiStatus.cs" />
 <AsnXml Include="System\Security\Cryptography\Pkcs\Asn1\PkiStatusInfo.xml" />
Expand Down

10 changes: 4 additions & 6 deletions
...ity.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/Asn1/CertificateChoiceAsn.xml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -15,12 +15,10 @@
 other[3] IMPLICIT OtherCertificateFormat
 }

 OtherCertificateFormat ::= SEQUENCE {
 otherCertFormat OBJECT IDENTIFIER,
 otherCert ANY DEFINED BY otherCertFormat
 }

 Except we only support public key certificates, so just trim the choice here.
 -->
 <asn:AnyValue name="Certificate" universalTagNumber="16" />
 <asn:AnyValue name="ExtendedCertificate" implicitTag="0" />
 <asn:AnyValue name="AttributeCertificateV1" implicitTag="1" />
 <asn:AnyValue name="AttributeCertificateV2" implicitTag="2" />
 <asn:AsnType name="OtherCertificateFormat" typeName="System.Security.Cryptography.Pkcs.Asn1.OtherCertificateFormat" implicitTag="3" />
</asn:Choice>

114 changes: 114 additions & 0 deletions
....Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/Asn1/CertificateChoiceAsn.xml.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -12,6 +12,10 @@ namespace System.Security.Cryptography.Pkcs.Asn1
 internal partial struct CertificateChoiceAsn
 {
 internal ReadOnlyMemory<byte>? Certificate;
 internal ReadOnlyMemory<byte>? ExtendedCertificate;
 internal ReadOnlyMemory<byte>? AttributeCertificateV1;
 internal ReadOnlyMemory<byte>? AttributeCertificateV2;
 internal System.Security.Cryptography.Pkcs.Asn1.OtherCertificateFormat? OtherCertificateFormat;

#if DEBUG
 static CertificateChoiceAsn()
Expand All@@ -28,6 +32,10 @@ static CertificateChoiceAsn()
 };

 ensureUniqueTag(new Asn1Tag((UniversalTagNumber)16), "Certificate");
 ensureUniqueTag(new Asn1Tag(TagClass.ContextSpecific, 0), "ExtendedCertificate");
 ensureUniqueTag(new Asn1Tag(TagClass.ContextSpecific, 1), "AttributeCertificateV1");
 ensureUniqueTag(new Asn1Tag(TagClass.ContextSpecific, 2), "AttributeCertificateV2");
 ensureUniqueTag(new Asn1Tag(TagClass.ContextSpecific, 3), "OtherCertificateFormat");
 }
#endif

Expand DownExpand Up@@ -60,6 +68,90 @@ internal void Encode(AsnWriter writer)
 wroteValue = true;
 }

 if (ExtendedCertificate.HasValue)
 {
 if (wroteValue)
 throw new CryptographicException();

 // Validator for tag constraint for ExtendedCertificate
 {
 if (!Asn1Tag.TryDecode(ExtendedCertificate.Value.Span, out Asn1Tag validateTag, out _) ||
 !validateTag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 0)))
 {
 throw new CryptographicException();
 }
 }

 try
 {
 writer.WriteEncodedValue(ExtendedCertificate.Value.Span);
 }
 catch (ArgumentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 wroteValue = true;
 }

 if (AttributeCertificateV1.HasValue)
 {
 if (wroteValue)
 throw new CryptographicException();

 // Validator for tag constraint for AttributeCertificateV1
 {
 if (!Asn1Tag.TryDecode(AttributeCertificateV1.Value.Span, out Asn1Tag validateTag, out _) ||
 !validateTag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 1)))
 {
 throw new CryptographicException();
 }
 }

 try
 {
 writer.WriteEncodedValue(AttributeCertificateV1.Value.Span);
 }
 catch (ArgumentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 wroteValue = true;
 }

 if (AttributeCertificateV2.HasValue)
 {
 if (wroteValue)
 throw new CryptographicException();

 // Validator for tag constraint for AttributeCertificateV2
 {
 if (!Asn1Tag.TryDecode(AttributeCertificateV2.Value.Span, out Asn1Tag validateTag, out _) ||
 !validateTag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 2)))
 {
 throw new CryptographicException();
 }
 }

 try
 {
 writer.WriteEncodedValue(AttributeCertificateV2.Value.Span);
 }
 catch (ArgumentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 wroteValue = true;
 }

 if (OtherCertificateFormat.HasValue)
 {
 if (wroteValue)
 throw new CryptographicException();

 OtherCertificateFormat.Value.Encode(writer, new Asn1Tag(TagClass.ContextSpecific, 3));
 wroteValue = true;
 }

 if (!wroteValue)
 {
 throw new CryptographicException();
Expand DownExpand Up@@ -107,6 +199,28 @@ private static void DecodeCore(ref AsnValueReader reader, ReadOnlyMemory<byte> r
 tmpSpan = reader.ReadEncodedValue();
 decoded.Certificate = rebindSpan.Overlaps(tmpSpan, out offset) ? rebind.Slice(offset, tmpSpan.Length) : tmpSpan.ToArray();
 }
 else if (tag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 0)))
 {
 tmpSpan = reader.ReadEncodedValue();
 decoded.ExtendedCertificate = rebindSpan.Overlaps(tmpSpan, out offset) ? rebind.Slice(offset, tmpSpan.Length) : tmpSpan.ToArray();
 }
 else if (tag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 1)))
 {
 tmpSpan = reader.ReadEncodedValue();
 decoded.AttributeCertificateV1 = rebindSpan.Overlaps(tmpSpan, out offset) ? rebind.Slice(offset, tmpSpan.Length) : tmpSpan.ToArray();
 }
 else if (tag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 2)))
 {
 tmpSpan = reader.ReadEncodedValue();
 decoded.AttributeCertificateV2 = rebindSpan.Overlaps(tmpSpan, out offset) ? rebind.Slice(offset, tmpSpan.Length) : tmpSpan.ToArray();
 }
 else if (tag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 3)))
 {
 System.Security.Cryptography.Pkcs.Asn1.OtherCertificateFormat tmpOtherCertificateFormat;
 System.Security.Cryptography.Pkcs.Asn1.OtherCertificateFormat.Decode(ref reader, new Asn1Tag(TagClass.ContextSpecific, 3), rebind, out tmpOtherCertificateFormat);
 decoded.OtherCertificateFormat = tmpOtherCertificateFormat;

 }
 else
 {
 throw new CryptographicException();
Expand Down

17 changes: 17 additions & 0 deletions
...y.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/Asn1/OtherCertificateFormat.xml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
<?xml version="1.0" encoding="utf-8" ?>
<asn:Sequence
 xmlns:asn="http://schemas.dot.net/asnxml/201808/"
 name="OtherCertificateFormat"
 namespace="System.Security.Cryptography.Pkcs.Asn1">

 <!--
 https://tools.ietf.org/html/rfc5652#section-10.2.2

 OtherCertificateFormat ::= SEQUENCE {
 otherCertFormat OBJECT IDENTIFIER,
 otherCert ANY DEFINED BY otherCertFormat
 }
 -->
 <asn:ObjectIdentifier name="OtherCertFormat" backingType="string" />
 <asn:AnyValue name="OtherCert" />
</asn:Sequence>

98 changes: 98 additions & 0 deletions
...ryptography.Pkcs/src/System/Security/Cryptography/Pkcs/Asn1/OtherCertificateFormat.xml.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
// Licensed to the .NET Foundation under one or more agreements.
// The .NET Foundation licenses this file to you under the MIT license.

#pragma warning disable SA1028 // ignore whitespace warnings for generated code
using System;
using System.Formats.Asn1;
using System.Runtime.InteropServices;

namespace System.Security.Cryptography.Pkcs.Asn1
{
 [StructLayout(LayoutKind.Sequential)]
 internal partial struct OtherCertificateFormat
 {
 internal string OtherCertFormat;
 internal ReadOnlyMemory<byte> OtherCert;

 internal void Encode(AsnWriter writer)
 {
 Encode(writer, Asn1Tag.Sequence);
 }

 internal void Encode(AsnWriter writer, Asn1Tag tag)
 {
 writer.PushSequence(tag);

 try
 {
 writer.WriteObjectIdentifier(OtherCertFormat);
 }
 catch (ArgumentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 try
 {
 writer.WriteEncodedValue(OtherCert.Span);
 }
 catch (ArgumentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 writer.PopSequence(tag);
 }

 internal static OtherCertificateFormat Decode(ReadOnlyMemory<byte> encoded, AsnEncodingRules ruleSet)
 {
 return Decode(Asn1Tag.Sequence, encoded, ruleSet);
 }

 internal static OtherCertificateFormat Decode(Asn1Tag expectedTag, ReadOnlyMemory<byte> encoded, AsnEncodingRules ruleSet)
 {
 try
 {
 AsnValueReader reader = new AsnValueReader(encoded.Span, ruleSet);

 DecodeCore(ref reader, expectedTag, encoded, out OtherCertificateFormat decoded);
 reader.ThrowIfNotEmpty();
 return decoded;
 }
 catch (AsnContentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 }

 internal static void Decode(ref AsnValueReader reader, ReadOnlyMemory<byte> rebind, out OtherCertificateFormat decoded)
 {
 Decode(ref reader, Asn1Tag.Sequence, rebind, out decoded);
 }

 internal static void Decode(ref AsnValueReader reader, Asn1Tag expectedTag, ReadOnlyMemory<byte> rebind, out OtherCertificateFormat decoded)
 {
 try
 {
 DecodeCore(ref reader, expectedTag, rebind, out decoded);
 }
 catch (AsnContentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 }

 private static void DecodeCore(ref AsnValueReader reader, Asn1Tag expectedTag, ReadOnlyMemory<byte> rebind, out OtherCertificateFormat decoded)
 {
 decoded = default;
 AsnValueReader sequenceReader = reader.ReadSequence(expectedTag);
 ReadOnlySpan<byte> rebindSpan = rebind.Span;
 int offset;
 ReadOnlySpan<byte> tmpSpan;

 decoded.OtherCertFormat = sequenceReader.ReadObjectIdentifier();
 tmpSpan = sequenceReader.ReadEncodedValue();
 decoded.OtherCert = rebindSpan.Overlaps(tmpSpan, out offset) ? rebind.Slice(offset, tmpSpan.Length) : tmpSpan.ToArray();

 sequenceReader.ThrowIfNotEmpty();
 }
 }
}

12 changes: 10 additions & 2 deletions
...ries/System.Security.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/SignedCms.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -89,8 +89,16 @@ public X509Certificate2Collection Certificates

 foreach (CertificateChoiceAsn choice in certChoices)
 {
 Debug.Assert(choice.Certificate.HasValue);
 coll.Add(new X509Certificate2(choice.Certificate.Value.ToArray()));
 if (choice.Certificate.HasValue)
 {
 coll.Add(new X509Certificate2(choice.Certificate.Value
#if NET5_0_OR_GREATER
 .Span
#else
 .ToArray()
#endif
 ));
 }
 }

 return coll;
Expand Down

9 changes: 9 additions & 0 deletions
src/libraries/System.Security.Cryptography.Pkcs/tests/SignedCms/SignedCmsTests.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -1602,6 +1602,15 @@ public static void CheckNoSignature_FromCoreFx_TamperIssuerName()
 signers[0].CheckHash();
 }

 [Fact]
 public static void Decode_CanDecodeWithAttributeCertificate()
 {
 SignedCms cms = new SignedCms();
 cms.Decode(SignedDocuments.TstWithAttributeCertificate);
 Assert.Equal(2, cms.Certificates.Count);
 cms.CheckSignature(verifySignatureOnly: true);
 }

 private static void CheckNoSignature(byte[] encoded, bool badOid=false)
 {
 SignedCms cms = new SignedCms();
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Ignore non-X509 certificates in SignedCms#64348

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

bartonjs
merged 2 commits into

from

Jan 28, 2022
 Merged


Ignore non-X509 certificates in SignedCms
#64348
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
cb04bde

Improve support for reading timestamps on Windows Authenticode


bartonjs Jan 26, 2022
4cca93a

Add a test that the CMS can decode


vcsjones Jan 26, 2022

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


4 changes: 4 additions & 0 deletions
src/libraries/System.Security.Cryptography.Pkcs/src/System.Security.Cryptography.Pkcs.csproj

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -490,6 +490,10 @@ System.Security.Cryptography.Pkcs.EnvelopedCms</PackageDescription>
 <Compile Include="System\Security\Cryptography\Pkcs\Asn1\MessageImprint.xml.cs">
 <DependentUpon>System\Security\Cryptography\Pkcs\Asn1\MessageImprint.xml</DependentUpon>
 </Compile>
 <AsnXml Include="System\Security\Cryptography\Pkcs\Asn1\OtherCertificateFormat.xml" />
 <Compile Include="System\Security\Cryptography\Pkcs\Asn1\OtherCertificateFormat.xml.cs">
 <DependentUpon>System\Security\Cryptography\Pkcs\Asn1\OtherCertificateFormat.xml</DependentUpon>
 </Compile>
 <Compile Include="System\Security\Cryptography\Pkcs\Asn1\PkiFailureInfo.cs" />
 <Compile Include="System\Security\Cryptography\Pkcs\Asn1\PkiStatus.cs" />
 <AsnXml Include="System\Security\Cryptography\Pkcs\Asn1\PkiStatusInfo.xml" />
Expand Down

10 changes: 4 additions & 6 deletions
...ity.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/Asn1/CertificateChoiceAsn.xml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -15,12 +15,10 @@
 other[3] IMPLICIT OtherCertificateFormat
 }

 OtherCertificateFormat ::= SEQUENCE {
 otherCertFormat OBJECT IDENTIFIER,
 otherCert ANY DEFINED BY otherCertFormat
 }

 Except we only support public key certificates, so just trim the choice here.
 -->
 <asn:AnyValue name="Certificate" universalTagNumber="16" />
 <asn:AnyValue name="ExtendedCertificate" implicitTag="0" />
 <asn:AnyValue name="AttributeCertificateV1" implicitTag="1" />
 <asn:AnyValue name="AttributeCertificateV2" implicitTag="2" />
 <asn:AsnType name="OtherCertificateFormat" typeName="System.Security.Cryptography.Pkcs.Asn1.OtherCertificateFormat" implicitTag="3" />
</asn:Choice>

114 changes: 114 additions & 0 deletions
....Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/Asn1/CertificateChoiceAsn.xml.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -12,6 +12,10 @@ namespace System.Security.Cryptography.Pkcs.Asn1
 internal partial struct CertificateChoiceAsn
 {
 internal ReadOnlyMemory<byte>? Certificate;
 internal ReadOnlyMemory<byte>? ExtendedCertificate;
 internal ReadOnlyMemory<byte>? AttributeCertificateV1;
 internal ReadOnlyMemory<byte>? AttributeCertificateV2;
 internal System.Security.Cryptography.Pkcs.Asn1.OtherCertificateFormat? OtherCertificateFormat;

#if DEBUG
 static CertificateChoiceAsn()
Expand All@@ -28,6 +32,10 @@ static CertificateChoiceAsn()
 };

 ensureUniqueTag(new Asn1Tag((UniversalTagNumber)16), "Certificate");
 ensureUniqueTag(new Asn1Tag(TagClass.ContextSpecific, 0), "ExtendedCertificate");
 ensureUniqueTag(new Asn1Tag(TagClass.ContextSpecific, 1), "AttributeCertificateV1");
 ensureUniqueTag(new Asn1Tag(TagClass.ContextSpecific, 2), "AttributeCertificateV2");
 ensureUniqueTag(new Asn1Tag(TagClass.ContextSpecific, 3), "OtherCertificateFormat");
 }
#endif

Expand DownExpand Up@@ -60,6 +68,90 @@ internal void Encode(AsnWriter writer)
 wroteValue = true;
 }

 if (ExtendedCertificate.HasValue)
 {
 if (wroteValue)
 throw new CryptographicException();

 // Validator for tag constraint for ExtendedCertificate
 {
 if (!Asn1Tag.TryDecode(ExtendedCertificate.Value.Span, out Asn1Tag validateTag, out _) ||
 !validateTag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 0)))
 {
 throw new CryptographicException();
 }
 }

 try
 {
 writer.WriteEncodedValue(ExtendedCertificate.Value.Span);
 }
 catch (ArgumentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 wroteValue = true;
 }

 if (AttributeCertificateV1.HasValue)
 {
 if (wroteValue)
 throw new CryptographicException();

 // Validator for tag constraint for AttributeCertificateV1
 {
 if (!Asn1Tag.TryDecode(AttributeCertificateV1.Value.Span, out Asn1Tag validateTag, out _) ||
 !validateTag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 1)))
 {
 throw new CryptographicException();
 }
 }

 try
 {
 writer.WriteEncodedValue(AttributeCertificateV1.Value.Span);
 }
 catch (ArgumentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 wroteValue = true;
 }

 if (AttributeCertificateV2.HasValue)
 {
 if (wroteValue)
 throw new CryptographicException();

 // Validator for tag constraint for AttributeCertificateV2
 {
 if (!Asn1Tag.TryDecode(AttributeCertificateV2.Value.Span, out Asn1Tag validateTag, out _) ||
 !validateTag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 2)))
 {
 throw new CryptographicException();
 }
 }

 try
 {
 writer.WriteEncodedValue(AttributeCertificateV2.Value.Span);
 }
 catch (ArgumentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 wroteValue = true;
 }

 if (OtherCertificateFormat.HasValue)
 {
 if (wroteValue)
 throw new CryptographicException();

 OtherCertificateFormat.Value.Encode(writer, new Asn1Tag(TagClass.ContextSpecific, 3));
 wroteValue = true;
 }

 if (!wroteValue)
 {
 throw new CryptographicException();
Expand DownExpand Up@@ -107,6 +199,28 @@ private static void DecodeCore(ref AsnValueReader reader, ReadOnlyMemory<byte> r
 tmpSpan = reader.ReadEncodedValue();
 decoded.Certificate = rebindSpan.Overlaps(tmpSpan, out offset) ? rebind.Slice(offset, tmpSpan.Length) : tmpSpan.ToArray();
 }
 else if (tag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 0)))
 {
 tmpSpan = reader.ReadEncodedValue();
 decoded.ExtendedCertificate = rebindSpan.Overlaps(tmpSpan, out offset) ? rebind.Slice(offset, tmpSpan.Length) : tmpSpan.ToArray();
 }
 else if (tag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 1)))
 {
 tmpSpan = reader.ReadEncodedValue();
 decoded.AttributeCertificateV1 = rebindSpan.Overlaps(tmpSpan, out offset) ? rebind.Slice(offset, tmpSpan.Length) : tmpSpan.ToArray();
 }
 else if (tag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 2)))
 {
 tmpSpan = reader.ReadEncodedValue();
 decoded.AttributeCertificateV2 = rebindSpan.Overlaps(tmpSpan, out offset) ? rebind.Slice(offset, tmpSpan.Length) : tmpSpan.ToArray();
 }
 else if (tag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 3)))
 {
 System.Security.Cryptography.Pkcs.Asn1.OtherCertificateFormat tmpOtherCertificateFormat;
 System.Security.Cryptography.Pkcs.Asn1.OtherCertificateFormat.Decode(ref reader, new Asn1Tag(TagClass.ContextSpecific, 3), rebind, out tmpOtherCertificateFormat);
 decoded.OtherCertificateFormat = tmpOtherCertificateFormat;

 }
 else
 {
 throw new CryptographicException();
Expand Down

17 changes: 17 additions & 0 deletions
...y.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/Asn1/OtherCertificateFormat.xml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
<?xml version="1.0" encoding="utf-8" ?>
<asn:Sequence
 xmlns:asn="http://schemas.dot.net/asnxml/201808/"
 name="OtherCertificateFormat"
 namespace="System.Security.Cryptography.Pkcs.Asn1">

 <!--
 https://tools.ietf.org/html/rfc5652#section-10.2.2

 OtherCertificateFormat ::= SEQUENCE {
 otherCertFormat OBJECT IDENTIFIER,
 otherCert ANY DEFINED BY otherCertFormat
 }
 -->
 <asn:ObjectIdentifier name="OtherCertFormat" backingType="string" />
 <asn:AnyValue name="OtherCert" />
</asn:Sequence>

98 changes: 98 additions & 0 deletions
...ryptography.Pkcs/src/System/Security/Cryptography/Pkcs/Asn1/OtherCertificateFormat.xml.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
// Licensed to the .NET Foundation under one or more agreements.
// The .NET Foundation licenses this file to you under the MIT license.

#pragma warning disable SA1028 // ignore whitespace warnings for generated code
using System;
using System.Formats.Asn1;
using System.Runtime.InteropServices;

namespace System.Security.Cryptography.Pkcs.Asn1
{
 [StructLayout(LayoutKind.Sequential)]
 internal partial struct OtherCertificateFormat
 {
 internal string OtherCertFormat;
 internal ReadOnlyMemory<byte> OtherCert;

 internal void Encode(AsnWriter writer)
 {
 Encode(writer, Asn1Tag.Sequence);
 }

 internal void Encode(AsnWriter writer, Asn1Tag tag)
 {
 writer.PushSequence(tag);

 try
 {
 writer.WriteObjectIdentifier(OtherCertFormat);
 }
 catch (ArgumentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 try
 {
 writer.WriteEncodedValue(OtherCert.Span);
 }
 catch (ArgumentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 writer.PopSequence(tag);
 }

 internal static OtherCertificateFormat Decode(ReadOnlyMemory<byte> encoded, AsnEncodingRules ruleSet)
 {
 return Decode(Asn1Tag.Sequence, encoded, ruleSet);
 }

 internal static OtherCertificateFormat Decode(Asn1Tag expectedTag, ReadOnlyMemory<byte> encoded, AsnEncodingRules ruleSet)
 {
 try
 {
 AsnValueReader reader = new AsnValueReader(encoded.Span, ruleSet);

 DecodeCore(ref reader, expectedTag, encoded, out OtherCertificateFormat decoded);
 reader.ThrowIfNotEmpty();
 return decoded;
 }
 catch (AsnContentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 }

 internal static void Decode(ref AsnValueReader reader, ReadOnlyMemory<byte> rebind, out OtherCertificateFormat decoded)
 {
 Decode(ref reader, Asn1Tag.Sequence, rebind, out decoded);
 }

 internal static void Decode(ref AsnValueReader reader, Asn1Tag expectedTag, ReadOnlyMemory<byte> rebind, out OtherCertificateFormat decoded)
 {
 try
 {
 DecodeCore(ref reader, expectedTag, rebind, out decoded);
 }
 catch (AsnContentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 }

 private static void DecodeCore(ref AsnValueReader reader, Asn1Tag expectedTag, ReadOnlyMemory<byte> rebind, out OtherCertificateFormat decoded)
 {
 decoded = default;
 AsnValueReader sequenceReader = reader.ReadSequence(expectedTag);
 ReadOnlySpan<byte> rebindSpan = rebind.Span;
 int offset;
 ReadOnlySpan<byte> tmpSpan;

 decoded.OtherCertFormat = sequenceReader.ReadObjectIdentifier();
 tmpSpan = sequenceReader.ReadEncodedValue();
 decoded.OtherCert = rebindSpan.Overlaps(tmpSpan, out offset) ? rebind.Slice(offset, tmpSpan.Length) : tmpSpan.ToArray();

 sequenceReader.ThrowIfNotEmpty();
 }
 }
}

12 changes: 10 additions & 2 deletions
...ries/System.Security.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/SignedCms.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -89,8 +89,16 @@ public X509Certificate2Collection Certificates

 foreach (CertificateChoiceAsn choice in certChoices)
 {
 Debug.Assert(choice.Certificate.HasValue);
 coll.Add(new X509Certificate2(choice.Certificate.Value.ToArray()));
 if (choice.Certificate.HasValue)
 {
 coll.Add(new X509Certificate2(choice.Certificate.Value
#if NET5_0_OR_GREATER
 .Span
#else
 .ToArray()
#endif
 ));
 }
 }

 return coll;
Expand Down

9 changes: 9 additions & 0 deletions
src/libraries/System.Security.Cryptography.Pkcs/tests/SignedCms/SignedCmsTests.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -1602,6 +1602,15 @@ public static void CheckNoSignature_FromCoreFx_TamperIssuerName()
 signers[0].CheckHash();
 }

 [Fact]
 public static void Decode_CanDecodeWithAttributeCertificate()
 {
 SignedCms cms = new SignedCms();
 cms.Decode(SignedDocuments.TstWithAttributeCertificate);
 Assert.Equal(2, cms.Certificates.Count);
 cms.CheckSignature(verifySignatureOnly: true);
 }

 private static void CheckNoSignature(byte[] encoded, bool badOid=false)
 {
 SignedCms cms = new SignedCms();
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
Ignore non-X509 certificates in SignedCms#64348

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

bartonjs
merged 2 commits into

from

Jan 28, 2022
 Merged


Ignore non-X509 certificates in SignedCms
#64348
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
cb04bde

Improve support for reading timestamps on Windows Authenticode


bartonjs Jan 26, 2022
4cca93a

Add a test that the CMS can decode


vcsjones Jan 26, 2022

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


4 changes: 4 additions & 0 deletions
src/libraries/System.Security.Cryptography.Pkcs/src/System.Security.Cryptography.Pkcs.csproj

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -490,6 +490,10 @@ System.Security.Cryptography.Pkcs.EnvelopedCms</PackageDescription>
 <Compile Include="System\Security\Cryptography\Pkcs\Asn1\MessageImprint.xml.cs">
 <DependentUpon>System\Security\Cryptography\Pkcs\Asn1\MessageImprint.xml</DependentUpon>
 </Compile>
 <AsnXml Include="System\Security\Cryptography\Pkcs\Asn1\OtherCertificateFormat.xml" />
 <Compile Include="System\Security\Cryptography\Pkcs\Asn1\OtherCertificateFormat.xml.cs">
 <DependentUpon>System\Security\Cryptography\Pkcs\Asn1\OtherCertificateFormat.xml</DependentUpon>
 </Compile>
 <Compile Include="System\Security\Cryptography\Pkcs\Asn1\PkiFailureInfo.cs" />
 <Compile Include="System\Security\Cryptography\Pkcs\Asn1\PkiStatus.cs" />
 <AsnXml Include="System\Security\Cryptography\Pkcs\Asn1\PkiStatusInfo.xml" />
Expand Down

10 changes: 4 additions & 6 deletions
...ity.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/Asn1/CertificateChoiceAsn.xml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -15,12 +15,10 @@
 other[3] IMPLICIT OtherCertificateFormat
 }

 OtherCertificateFormat ::= SEQUENCE {
 otherCertFormat OBJECT IDENTIFIER,
 otherCert ANY DEFINED BY otherCertFormat
 }

 Except we only support public key certificates, so just trim the choice here.
 -->
 <asn:AnyValue name="Certificate" universalTagNumber="16" />
 <asn:AnyValue name="ExtendedCertificate" implicitTag="0" />
 <asn:AnyValue name="AttributeCertificateV1" implicitTag="1" />
 <asn:AnyValue name="AttributeCertificateV2" implicitTag="2" />
 <asn:AsnType name="OtherCertificateFormat" typeName="System.Security.Cryptography.Pkcs.Asn1.OtherCertificateFormat" implicitTag="3" />
</asn:Choice>

114 changes: 114 additions & 0 deletions
....Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/Asn1/CertificateChoiceAsn.xml.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -12,6 +12,10 @@ namespace System.Security.Cryptography.Pkcs.Asn1
 internal partial struct CertificateChoiceAsn
 {
 internal ReadOnlyMemory<byte>? Certificate;
 internal ReadOnlyMemory<byte>? ExtendedCertificate;
 internal ReadOnlyMemory<byte>? AttributeCertificateV1;
 internal ReadOnlyMemory<byte>? AttributeCertificateV2;
 internal System.Security.Cryptography.Pkcs.Asn1.OtherCertificateFormat? OtherCertificateFormat;

#if DEBUG
 static CertificateChoiceAsn()
Expand All@@ -28,6 +32,10 @@ static CertificateChoiceAsn()
 };

 ensureUniqueTag(new Asn1Tag((UniversalTagNumber)16), "Certificate");
 ensureUniqueTag(new Asn1Tag(TagClass.ContextSpecific, 0), "ExtendedCertificate");
 ensureUniqueTag(new Asn1Tag(TagClass.ContextSpecific, 1), "AttributeCertificateV1");
 ensureUniqueTag(new Asn1Tag(TagClass.ContextSpecific, 2), "AttributeCertificateV2");
 ensureUniqueTag(new Asn1Tag(TagClass.ContextSpecific, 3), "OtherCertificateFormat");
 }
#endif

Expand DownExpand Up@@ -60,6 +68,90 @@ internal void Encode(AsnWriter writer)
 wroteValue = true;
 }

 if (ExtendedCertificate.HasValue)
 {
 if (wroteValue)
 throw new CryptographicException();

 // Validator for tag constraint for ExtendedCertificate
 {
 if (!Asn1Tag.TryDecode(ExtendedCertificate.Value.Span, out Asn1Tag validateTag, out _) ||
 !validateTag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 0)))
 {
 throw new CryptographicException();
 }
 }

 try
 {
 writer.WriteEncodedValue(ExtendedCertificate.Value.Span);
 }
 catch (ArgumentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 wroteValue = true;
 }

 if (AttributeCertificateV1.HasValue)
 {
 if (wroteValue)
 throw new CryptographicException();

 // Validator for tag constraint for AttributeCertificateV1
 {
 if (!Asn1Tag.TryDecode(AttributeCertificateV1.Value.Span, out Asn1Tag validateTag, out _) ||
 !validateTag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 1)))
 {
 throw new CryptographicException();
 }
 }

 try
 {
 writer.WriteEncodedValue(AttributeCertificateV1.Value.Span);
 }
 catch (ArgumentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 wroteValue = true;
 }

 if (AttributeCertificateV2.HasValue)
 {
 if (wroteValue)
 throw new CryptographicException();

 // Validator for tag constraint for AttributeCertificateV2
 {
 if (!Asn1Tag.TryDecode(AttributeCertificateV2.Value.Span, out Asn1Tag validateTag, out _) ||
 !validateTag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 2)))
 {
 throw new CryptographicException();
 }
 }

 try
 {
 writer.WriteEncodedValue(AttributeCertificateV2.Value.Span);
 }
 catch (ArgumentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 wroteValue = true;
 }

 if (OtherCertificateFormat.HasValue)
 {
 if (wroteValue)
 throw new CryptographicException();

 OtherCertificateFormat.Value.Encode(writer, new Asn1Tag(TagClass.ContextSpecific, 3));
 wroteValue = true;
 }

 if (!wroteValue)
 {
 throw new CryptographicException();
Expand DownExpand Up@@ -107,6 +199,28 @@ private static void DecodeCore(ref AsnValueReader reader, ReadOnlyMemory<byte> r
 tmpSpan = reader.ReadEncodedValue();
 decoded.Certificate = rebindSpan.Overlaps(tmpSpan, out offset) ? rebind.Slice(offset, tmpSpan.Length) : tmpSpan.ToArray();
 }
 else if (tag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 0)))
 {
 tmpSpan = reader.ReadEncodedValue();
 decoded.ExtendedCertificate = rebindSpan.Overlaps(tmpSpan, out offset) ? rebind.Slice(offset, tmpSpan.Length) : tmpSpan.ToArray();
 }
 else if (tag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 1)))
 {
 tmpSpan = reader.ReadEncodedValue();
 decoded.AttributeCertificateV1 = rebindSpan.Overlaps(tmpSpan, out offset) ? rebind.Slice(offset, tmpSpan.Length) : tmpSpan.ToArray();
 }
 else if (tag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 2)))
 {
 tmpSpan = reader.ReadEncodedValue();
 decoded.AttributeCertificateV2 = rebindSpan.Overlaps(tmpSpan, out offset) ? rebind.Slice(offset, tmpSpan.Length) : tmpSpan.ToArray();
 }
 else if (tag.HasSameClassAndValue(new Asn1Tag(TagClass.ContextSpecific, 3)))
 {
 System.Security.Cryptography.Pkcs.Asn1.OtherCertificateFormat tmpOtherCertificateFormat;
 System.Security.Cryptography.Pkcs.Asn1.OtherCertificateFormat.Decode(ref reader, new Asn1Tag(TagClass.ContextSpecific, 3), rebind, out tmpOtherCertificateFormat);
 decoded.OtherCertificateFormat = tmpOtherCertificateFormat;

 }
 else
 {
 throw new CryptographicException();
Expand Down

17 changes: 17 additions & 0 deletions
...y.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/Asn1/OtherCertificateFormat.xml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
<?xml version="1.0" encoding="utf-8" ?>
<asn:Sequence
 xmlns:asn="http://schemas.dot.net/asnxml/201808/"
 name="OtherCertificateFormat"
 namespace="System.Security.Cryptography.Pkcs.Asn1">

 <!--
 https://tools.ietf.org/html/rfc5652#section-10.2.2

 OtherCertificateFormat ::= SEQUENCE {
 otherCertFormat OBJECT IDENTIFIER,
 otherCert ANY DEFINED BY otherCertFormat
 }
 -->
 <asn:ObjectIdentifier name="OtherCertFormat" backingType="string" />
 <asn:AnyValue name="OtherCert" />
</asn:Sequence>

98 changes: 98 additions & 0 deletions
...ryptography.Pkcs/src/System/Security/Cryptography/Pkcs/Asn1/OtherCertificateFormat.xml.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
// Licensed to the .NET Foundation under one or more agreements.
// The .NET Foundation licenses this file to you under the MIT license.

#pragma warning disable SA1028 // ignore whitespace warnings for generated code
using System;
using System.Formats.Asn1;
using System.Runtime.InteropServices;

namespace System.Security.Cryptography.Pkcs.Asn1
{
 [StructLayout(LayoutKind.Sequential)]
 internal partial struct OtherCertificateFormat
 {
 internal string OtherCertFormat;
 internal ReadOnlyMemory<byte> OtherCert;

 internal void Encode(AsnWriter writer)
 {
 Encode(writer, Asn1Tag.Sequence);
 }

 internal void Encode(AsnWriter writer, Asn1Tag tag)
 {
 writer.PushSequence(tag);

 try
 {
 writer.WriteObjectIdentifier(OtherCertFormat);
 }
 catch (ArgumentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 try
 {
 writer.WriteEncodedValue(OtherCert.Span);
 }
 catch (ArgumentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 writer.PopSequence(tag);
 }

 internal static OtherCertificateFormat Decode(ReadOnlyMemory<byte> encoded, AsnEncodingRules ruleSet)
 {
 return Decode(Asn1Tag.Sequence, encoded, ruleSet);
 }

 internal static OtherCertificateFormat Decode(Asn1Tag expectedTag, ReadOnlyMemory<byte> encoded, AsnEncodingRules ruleSet)
 {
 try
 {
 AsnValueReader reader = new AsnValueReader(encoded.Span, ruleSet);

 DecodeCore(ref reader, expectedTag, encoded, out OtherCertificateFormat decoded);
 reader.ThrowIfNotEmpty();
 return decoded;
 }
 catch (AsnContentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 }

 internal static void Decode(ref AsnValueReader reader, ReadOnlyMemory<byte> rebind, out OtherCertificateFormat decoded)
 {
 Decode(ref reader, Asn1Tag.Sequence, rebind, out decoded);
 }

 internal static void Decode(ref AsnValueReader reader, Asn1Tag expectedTag, ReadOnlyMemory<byte> rebind, out OtherCertificateFormat decoded)
 {
 try
 {
 DecodeCore(ref reader, expectedTag, rebind, out decoded);
 }
 catch (AsnContentException e)
 {
 throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding, e);
 }
 }

 private static void DecodeCore(ref AsnValueReader reader, Asn1Tag expectedTag, ReadOnlyMemory<byte> rebind, out OtherCertificateFormat decoded)
 {
 decoded = default;
 AsnValueReader sequenceReader = reader.ReadSequence(expectedTag);
 ReadOnlySpan<byte> rebindSpan = rebind.Span;
 int offset;
 ReadOnlySpan<byte> tmpSpan;

 decoded.OtherCertFormat = sequenceReader.ReadObjectIdentifier();
 tmpSpan = sequenceReader.ReadEncodedValue();
 decoded.OtherCert = rebindSpan.Overlaps(tmpSpan, out offset) ? rebind.Slice(offset, tmpSpan.Length) : tmpSpan.ToArray();

 sequenceReader.ThrowIfNotEmpty();
 }
 }
}

12 changes: 10 additions & 2 deletions
...ries/System.Security.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/SignedCms.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -89,8 +89,16 @@ public X509Certificate2Collection Certificates

 foreach (CertificateChoiceAsn choice in certChoices)
 {
 Debug.Assert(choice.Certificate.HasValue);
 coll.Add(new X509Certificate2(choice.Certificate.Value.ToArray()));
 if (choice.Certificate.HasValue)
 {
 coll.Add(new X509Certificate2(choice.Certificate.Value
#if NET5_0_OR_GREATER
 .Span
#else
 .ToArray()
#endif
 ));
 }
 }

 return coll;
Expand Down

9 changes: 9 additions & 0 deletions
src/libraries/System.Security.Cryptography.Pkcs/tests/SignedCms/SignedCmsTests.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -1602,6 +1602,15 @@ public static void CheckNoSignature_FromCoreFx_TamperIssuerName()
 signers[0].CheckHash();
 }

 [Fact]
 public static void Decode_CanDecodeWithAttributeCertificate()
 {
 SignedCms cms = new SignedCms();
 cms.Decode(SignedDocuments.TstWithAttributeCertificate);
 Assert.Equal(2, cms.Certificates.Count);
 cms.CheckSignature(verifySignatureOnly: true);
 }

 private static void CheckNoSignature(byte[] encoded, bool badOid=false)
 {
 SignedCms cms = new SignedCms();
Expand Down
Loading