679380 - Errors parsing nested CMS messages make the encapsulated content irretrievable

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P1)

Description

[Elio Maldonado]

Reported by Nalin Dahyabhai:

Description of problem:

When parsing PKINIT preauthentication responses from a KDC running WS2008, I'm
encountering problems reading SignedData which is wrapped in an EnvelopedData.

The server is wrapping the SignedData in a ContentInfo and then putting _that_
inside of the EncapsulatedContentInfo of the EnvelopedData structure.  In
earlier versions, the EncapsulatedContentInfo's stated type was Data, so while
it looked odd, it was easy to just parse it as a new CMS message, but in the
current version the stated type is SignedData, so NSS tries to parse the nested
ContentInfo as a SignedData, and it just fails.

I think the party generating the message is nesting the CMS structures wrong,
but I'd like to parse the message successfully anyway.

Version-Release number of selected component (if applicable):
nss-3.12.10-6.fc16.x86_64

How reproducible:
Always

Steps to Reproduce:
I'll attach the data that I have.

Actual results:
Unable to recover the encapsulated content in its original form.

Expected results:
Able to recover encapsulated content in unparsed form.

Comment 1

[Robert Relyea]

Attachment: If we detect that the sequence wrapper is missing, add it back.

> In earlier versions, the EncapsulatedContentInfo's stated type was Data,
> so while it looked odd, it was easy to just parse it as a new CMS message,
> but in the current version the stated type is SignedData, so NSS tries to
> parse the nested ContentInfo as a SignedData, and it just fails.

So actually I was able to get a dump of the nested ContentInfo and it is in fact SignedData, except it's not properly wrapped in a sequence. This patch detects this case and magically adds the expected sequence back.

bob

Comment 2

[Nalin Dahyabhai]

FWIW, I can confirm that the patch works for me here.

Comment 3

[Robert Relyea]

Checking in pk11obj.c;
/cvsroot/mozilla/security/nss/lib/pk11wrap/pk11obj.c,v  <--  pk11obj.c
new revision: 1.23; previous revision: 1.22
done

Comment 4

[Robert Relyea]

Whoops, closed the wrong bug...

Comment 5

[Robert Relyea]

Checking in cmsdecode.c;
/cvsroot/mozilla/security/nss/lib/smime/cmsdecode.c,v  <--  cmsdecode.c
new revision: 1.14; previous revision: 1.13
done

Comment 6

[Robert Relyea]

Comment on attachment 556192 [details] [diff] [review]
If we detect that the sequence wrapper is missing, add it back.

clearing review request.