From 8c89c80a5580419bcc3e35abf18dd187c73881e4 Mon Sep 17 00:00:00 2001 From: FdaSilvaYY Date: Tue, 29 Jan 2019 23:54:30 +0100 Subject: [PATCH] CAdES: Fix SignerInfo attribute construction order. Reviewed-by: Matt Caswell Reviewed-by: Shane Lontis (Merged from https://github.com/openssl/openssl/pull/8117) --- apps/cms.c | 8 ++++++++ crypto/cms/cms_sd.c | 17 ++++++++--------- 2 files changed, 16 insertions(+), 9 deletions(-) diff --git a/apps/cms.c b/apps/cms.c index 2863a92eee..9c9f01d3ee 100644 --- a/apps/cms.c +++ b/apps/cms.c @@ -603,6 +603,14 @@ int cms_main(int argc, char **argv) goto opthelp; } + if (flags & CMS_CADES) { + if (flags & CMS_NOATTR) { + BIO_puts(bio_err, "Incompatible options: " + "CAdES required signed attributes\n"); + goto opthelp; + } + } + if (operation & SMIME_SIGNERS) { if (keyfile != NULL && signerfile == NULL) { BIO_puts(bio_err, "Illegal -inkey without -signer\n"); diff --git a/crypto/cms/cms_sd.c b/crypto/cms/cms_sd.c index 71b3041116..65261cf470 100644 --- a/crypto/cms/cms_sd.c +++ b/crypto/cms/cms_sd.c @@ -325,13 +325,6 @@ CMS_SignerInfo *CMS_add1_signer(CMS_ContentInfo *cms, if (!i) goto merr; } - if (flags & CMS_REUSE_DIGEST) { - if (!cms_copy_messageDigest(cms, si)) - goto err; - if (!(flags & (CMS_PARTIAL | CMS_KEY_PARAM)) && - !CMS_SignerInfo_sign(si)) - goto err; - } if (flags & CMS_CADES) { ESS_SIGNING_CERT *sc = NULL; ESS_SIGNING_CERT_V2 *sc2 = NULL; @@ -353,6 +346,13 @@ CMS_SignerInfo *CMS_add1_signer(CMS_ContentInfo *cms, if (!add_sc) goto err; } + if (flags & CMS_REUSE_DIGEST) { + if (!cms_copy_messageDigest(cms, si)) + goto err; + if (!(flags & (CMS_PARTIAL | CMS_KEY_PARAM)) && + !CMS_SignerInfo_sign(si)) + goto err; + } } if (!(flags & CMS_NOCERTS)) { @@ -370,8 +370,7 @@ CMS_SignerInfo *CMS_add1_signer(CMS_ContentInfo *cms, goto err; if (EVP_PKEY_CTX_set_signature_md(si->pctx, md) <= 0) goto err; - } else if (EVP_DigestSignInit(si->mctx, &si->pctx, md, NULL, pk) <= - 0) + } else if (EVP_DigestSignInit(si->mctx, &si->pctx, md, NULL, pk) <= 0) goto err; }