Add the content type attribute to additional CMS signerinfo.
authorShane Lontis <shane.lontis@oracle.com>
Mon, 3 Jun 2019 05:19:48 +0000 (15:19 +1000)
committerShane Lontis <shane.lontis@oracle.com>
Mon, 3 Jun 2019 05:19:48 +0000 (15:19 +1000)
commit19e512a8244a6f527d0194339a8f9fc45468537a
tree37ebaa0bc5bb41aa357f878262e71b6982dd9805
parent915bf45ee32826ed9eb612e4f82034a138dfeb41
Add the content type attribute to additional CMS signerinfo.

Fixes #8923

Found using the openssl cms -resign option.
This uses an alternate path to do the signing which was not adding the required signed attribute
content type. The content type attribute should always exist since it is required is there are
any signed attributes.
As the signing time attribute is always added in code, the content type attribute is also required.
The CMS_si_check_attributes() method adds validity checks for signed and unsigned attributes
e.g. The message digest attribute is a signed attribute that must exist if any signed attributes
exist, it cannot be an unsigned attribute and there must only be one instance containing a single
value.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/8944)
crypto/cms/cms_att.c
crypto/cms/cms_err.c
crypto/cms/cms_lcl.h
crypto/cms/cms_sd.c
crypto/err/openssl.txt
include/openssl/cmserr.h
test/recipes/80-test_cms.t
test/recipes/80-test_cms_data/bad_signtime_attr.cms [new file with mode: 0644]
test/recipes/80-test_cms_data/ct_multiple_attr.cms [new file with mode: 0644]
test/recipes/80-test_cms_data/no_ct_attr.cms [new file with mode: 0644]
test/recipes/80-test_cms_data/no_md_attr.cms [new file with mode: 0644]