155 lines
7.1 KiB
HTML
Executable File
155 lines
7.1 KiB
HTML
Executable File
<?xml version="1.0" ?>
|
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
|
<html xmlns="http://www.w3.org/1999/xhtml">
|
|
<head>
|
|
<title>PKCS7_verify</title>
|
|
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
|
<link rev="made" href="mailto:root@localhost" />
|
|
</head>
|
|
|
|
<body style="background-color: white">
|
|
|
|
|
|
<!-- INDEX BEGIN -->
|
|
<div name="index">
|
|
<p><a name="__index__"></a></p>
|
|
|
|
<ul>
|
|
|
|
<li><a href="#name">NAME</a></li>
|
|
<li><a href="#synopsis">SYNOPSIS</a></li>
|
|
<li><a href="#description">DESCRIPTION</a></li>
|
|
<li><a href="#verify_process">VERIFY PROCESS</a></li>
|
|
<li><a href="#notes">NOTES</a></li>
|
|
<li><a href="#return_values">RETURN VALUES</a></li>
|
|
<li><a href="#bugs">BUGS</a></li>
|
|
<li><a href="#see_also">SEE ALSO</a></li>
|
|
<li><a href="#copyright">COPYRIGHT</a></li>
|
|
</ul>
|
|
|
|
<hr name="index" />
|
|
</div>
|
|
<!-- INDEX END -->
|
|
|
|
<p>
|
|
</p>
|
|
<hr />
|
|
<h1><a name="name">NAME</a></h1>
|
|
<p>PKCS7_verify, PKCS7_get0_signers - verify a PKCS#7 signedData structure</p>
|
|
<p>
|
|
</p>
|
|
<hr />
|
|
<h1><a name="synopsis">SYNOPSIS</a></h1>
|
|
<pre>
|
|
#include <openssl/pkcs7.h></pre>
|
|
<pre>
|
|
int PKCS7_verify(PKCS7 *p7, STACK_OF(X509) *certs, X509_STORE *store,
|
|
BIO *indata, BIO *out, int flags);</pre>
|
|
<pre>
|
|
STACK_OF(X509) *PKCS7_get0_signers(PKCS7 *p7, STACK_OF(X509) *certs, int flags);</pre>
|
|
<p>
|
|
</p>
|
|
<hr />
|
|
<h1><a name="description">DESCRIPTION</a></h1>
|
|
<p>PKCS7_verify() verifies a PKCS#7 signedData structure. <strong>p7</strong> is the PKCS7
|
|
structure to verify. <strong>certs</strong> is a set of certificates in which to search for
|
|
the signer's certificate. <strong>store</strong> is a trusted certificate store (used for
|
|
chain verification). <strong>indata</strong> is the signed data if the content is not
|
|
present in <strong>p7</strong> (that is it is detached). The content is written to <strong>out</strong>
|
|
if it is not NULL.</p>
|
|
<p><strong>flags</strong> is an optional set of flags, which can be used to modify the verify
|
|
operation.</p>
|
|
<p>PKCS7_get0_signers() retrieves the signer's certificates from <strong>p7</strong>, it does
|
|
<strong>not</strong> check their validity or whether any signatures are valid. The <strong>certs</strong>
|
|
and <strong>flags</strong> parameters have the same meanings as in PKCS7_verify().</p>
|
|
<p>
|
|
</p>
|
|
<hr />
|
|
<h1><a name="verify_process">VERIFY PROCESS</a></h1>
|
|
<p>Normally the verify process proceeds as follows.</p>
|
|
<p>Initially some sanity checks are performed on <strong>p7</strong>. The type of <strong>p7</strong> must
|
|
be signedData. There must be at least one signature on the data and if
|
|
the content is detached <strong>indata</strong> cannot be <strong>NULL</strong>. If the content is
|
|
not detached and <strong>indata</strong> is not <strong>NULL</strong>, then the structure has both
|
|
embedded and external content. To treat this as an error, use the flag
|
|
<strong>PKCS7_NO_DUAL_CONTENT</strong>.
|
|
The default behavior allows this, for compatibility with older
|
|
versions of OpenSSL.</p>
|
|
<p>An attempt is made to locate all the signer's certificates, first looking in
|
|
the <strong>certs</strong> parameter (if it is not <strong>NULL</strong>) and then looking in any certificates
|
|
contained in the <strong>p7</strong> structure itself. If any signer's certificates cannot be
|
|
located the operation fails.</p>
|
|
<p>Each signer's certificate is chain verified using the <strong>smimesign</strong> purpose and
|
|
the supplied trusted certificate store. Any internal certificates in the message
|
|
are used as untrusted CAs. If any chain verify fails an error code is returned.</p>
|
|
<p>Finally the signed content is read (and written to <strong>out</strong> is it is not NULL) and
|
|
the signature's checked.</p>
|
|
<p>If all signature's verify correctly then the function is successful.</p>
|
|
<p>Any of the following flags (ored together) can be passed in the <strong>flags</strong> parameter
|
|
to change the default verify behaviour. Only the flag <strong>PKCS7_NOINTERN</strong> is
|
|
meaningful to PKCS7_get0_signers().</p>
|
|
<p>If <strong>PKCS7_NOINTERN</strong> is set the certificates in the message itself are not
|
|
searched when locating the signer's certificate. This means that all the signers
|
|
certificates must be in the <strong>certs</strong> parameter.</p>
|
|
<p>If the <strong>PKCS7_TEXT</strong> flag is set MIME headers for type <strong>text/plain</strong> are deleted
|
|
from the content. If the content is not of type <strong>text/plain</strong> then an error is
|
|
returned.</p>
|
|
<p>If <strong>PKCS7_NOVERIFY</strong> is set the signer's certificates are not chain verified.</p>
|
|
<p>If <strong>PKCS7_NOCHAIN</strong> is set then the certificates contained in the message are
|
|
not used as untrusted CAs. This means that the whole verify chain (apart from
|
|
the signer's certificate) must be contained in the trusted store.</p>
|
|
<p>If <strong>PKCS7_NOSIGS</strong> is set then the signatures on the data are not checked.</p>
|
|
<p>
|
|
</p>
|
|
<hr />
|
|
<h1><a name="notes">NOTES</a></h1>
|
|
<p>One application of <strong>PKCS7_NOINTERN</strong> is to only accept messages signed by
|
|
a small number of certificates. The acceptable certificates would be passed
|
|
in the <strong>certs</strong> parameter. In this case if the signer is not one of the
|
|
certificates supplied in <strong>certs</strong> then the verify will fail because the
|
|
signer cannot be found.</p>
|
|
<p>Care should be taken when modifying the default verify behaviour, for example
|
|
setting <code>PKCS7_NOVERIFY|PKCS7_NOSIGS</code> will totally disable all verification
|
|
and any signed message will be considered valid. This combination is however
|
|
useful if one merely wishes to write the content to <strong>out</strong> and its validity
|
|
is not considered important.</p>
|
|
<p>Chain verification should arguably be performed using the signing time rather
|
|
than the current time. However since the signing time is supplied by the
|
|
signer it cannot be trusted without additional evidence (such as a trusted
|
|
timestamp).</p>
|
|
<p>
|
|
</p>
|
|
<hr />
|
|
<h1><a name="return_values">RETURN VALUES</a></h1>
|
|
<p>PKCS7_verify() returns one for a successful verification and zero
|
|
if an error occurs.</p>
|
|
<p>PKCS7_get0_signers() returns all signers or <strong>NULL</strong> if an error occurred.</p>
|
|
<p>The error can be obtained from <em>ERR_get_error(3)</em></p>
|
|
<p>
|
|
</p>
|
|
<hr />
|
|
<h1><a name="bugs">BUGS</a></h1>
|
|
<p>The trusted certificate store is not searched for the signers certificate,
|
|
this is primarily due to the inadequacies of the current <strong>X509_STORE</strong>
|
|
functionality.</p>
|
|
<p>The lack of single pass processing and need to hold all data in memory as
|
|
mentioned in PKCS7_sign() also applies to PKCS7_verify().</p>
|
|
<p>
|
|
</p>
|
|
<hr />
|
|
<h1><a name="see_also">SEE ALSO</a></h1>
|
|
<p><em>ERR_get_error(3)</em>, <em>PKCS7_sign(3)</em></p>
|
|
<p>
|
|
</p>
|
|
<hr />
|
|
<h1><a name="copyright">COPYRIGHT</a></h1>
|
|
<p>Copyright 2002-2016 The OpenSSL Project Authors. All Rights Reserved.</p>
|
|
<p>Licensed under the Apache License 2.0 (the "License"). You may not use
|
|
this file except in compliance with the License. You can obtain a copy
|
|
in the file LICENSE in the source distribution or at
|
|
<a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
|
|
|
</body>
|
|
|
|
</html>
|