Hide Forgot
Description of problem: When parsing PKINIT preauthentication responses from a KDC running WS2008, I'm encountering problems reading SignedData which is wrapped in an EnvelopedData. The server is wrapping the SignedData in a ContentInfo and then putting _that_ inside of the EncapsulatedContentInfo of the EnvelopedData structure. In earlier versions, the EncapsulatedContentInfo's stated type was Data, so while it looked odd, it was easy to just parse it as a new CMS message, but in the current version the stated type is SignedData, so NSS tries to parse the nested ContentInfo as a SignedData, and it just fails. I think the party generating the message is nesting the CMS structures wrong, but I'd like to parse the message successfully anyway. Version-Release number of selected component (if applicable): nss-3.12.10-6.fc16.x86_64 How reproducible: Always Steps to Reproduce: I'll attach the data that I have. Actual results: Unable to recover the encapsulated content in its original form. Expected results: Able to recover encapsulated content in unparsed form.
Created attachment 515937 [details] preauth data
Created attachment 515938 [details] server CA certificate
Created attachment 515939 [details] client CA certificate
Created attachment 515940 [details] client credentials
Created attachment 515941 [details] test program
> In earlier versions, the EncapsulatedContentInfo's stated type was Data, > so while it looked odd, it was easy to just parse it as a new CMS message, > but in the current version the stated type is SignedData, so NSS tries to > parse the nested ContentInfo as a SignedData, and it just fails. So actually I was able to get a dump of the nexted ContentInfo and it is in fact SignedData, except it's not properly wrapped in a sequence. I have a patch I'll attach to the upstream bug which detects this case and magically adds the expected sequence. The patch makes nalin's test case in the bug work correctly. Nalin, could you see if the patch works in your test environment. bob
This bug appears to have been reported against 'rawhide' during the Fedora 19 development cycle. Changing version to '19'. (As we did not run this process for some time, it could affect also pre-Fedora 19 development cycle bugs. We are very sorry. It will help us with cleanup during Fedora 19 End Of Life. Thank you.) More information and reason for this action is here: https://fedoraproject.org/wiki/BugZappers/HouseKeeping/Fedora19
Ths was fixed a long time ago upstreama nd we picked it up in a rebase.