]> git.ipfire.org Git - thirdparty/krb5.git/commitdiff
Update error checking for OpenSSL CMS_verify 1264/head
authorJulien Rische <jrische@redhat.com>
Thu, 28 Jul 2022 13:20:12 +0000 (15:20 +0200)
committerGreg Hudson <ghudson@mit.edu>
Thu, 18 Aug 2022 21:17:37 +0000 (17:17 -0400)
The code for CMS data verification was initially written for OpenSSL's
PKCS7_verify() function.  It now uses CMS_verify(), but error handling
is still done using PKCS7_verify() error identifiers.  Update the
recognized error codes so that the KDC generates
KDC_ERR_DIGEST_IN_SIGNED_DATA_NOT_ACCEPTED errors when appropriate.
Use ERR_peek_last_error() to observe the error generated closest to
the API surface.

[ghudson@mit.edu: edited commit message]

ticket: 9069 (new)
tags: pullup
target_version: 1.20-next

src/plugins/preauth/pkinit/pkinit_crypto_openssl.c

index 5c7461170730ce46d26eab38e6e35b2633b7b448..461135940d9df599dac2e5068b9f80e1ca80981b 100644 (file)
@@ -2061,12 +2061,15 @@ cms_signeddata_verify(krb5_context context,
             goto cleanup;
         out = BIO_new(BIO_s_mem());
         if (CMS_verify(cms, NULL, store, NULL, out, flags) == 0) {
-            unsigned long err = ERR_peek_error();
+            unsigned long err = ERR_peek_last_error();
             switch(ERR_GET_REASON(err)) {
-            case PKCS7_R_DIGEST_FAILURE:
+            case RSA_R_DIGEST_NOT_ALLOWED:
+            case CMS_R_UNKNOWN_DIGEST_ALGORITHM:
+            case CMS_R_NO_MATCHING_DIGEST:
+            case CMS_R_NO_MATCHING_SIGNATURE:
                 retval = KRB5KDC_ERR_DIGEST_IN_SIGNED_DATA_NOT_ACCEPTED;
                 break;
-            case PKCS7_R_SIGNATURE_FAILURE:
+            case CMS_R_VERIFICATION_FAILURE:
             default:
                 retval = KRB5KDC_ERR_INVALID_SIG;
             }