@@ -638,13 +638,13 @@ static int asn1_get_x509(fmap_t *map, const void **asn1data, unsigned int *size,

 			    }

 			    if(ext.size != 8)

 				continue;

-			    if(!fmap_need_ptr_once(map, value.content, 8)) {

+			    if(!fmap_need_ptr_once(map, ext.content, 8)) {

 				exts.size = 1;

 				break;

 			    }

-			    if(!memcmp("\x2b\x06\x01\x05\x05\x07\x03\x03", value.content, 8)) /* id_kp_codeSigning */

+			    if(!memcmp("\x2b\x06\x01\x05\x05\x07\x03\x03", ext.content, 8)) /* id_kp_codeSigning */

 				x509.codeSign = 1;

-			    else if(!memcmp("\x2b\x06\x01\x05\x05\x07\x03\x08", value.content, 8)) /* id_kp_timeStamping */

+			    else if(!memcmp("\x2b\x06\x01\x05\x05\x07\x03\x08", ext.content, 8)) /* id_kp_timeStamping */

 				x509.timeSign = 1;

 			}

 			continue;

@@ -1004,7 +1004,7 @@ static int asn1_parse_mscat(fmap_t *map, const void *start, unsigned int size, c

 	    cli_dbgmsg("asn1_parse_mscat: failed to read encryptedDigest\n");

 	    break;

 	}

-	if(crtmgr_verify_pkcs7(cmgr, issuer, asn1.content, asn1.size, CLI_SHA1RSA, sha1)) {

+	if(crtmgr_verify_pkcs7(cmgr, issuer, asn1.content, asn1.size, CLI_SHA1RSA, sha1, VRFY_CODE)) {

 	    cli_dbgmsg("asn1_parse_mscat: pkcs7 signature verification failed\n");

 	    break;

 	}

@@ -1245,7 +1245,7 @@ static int asn1_parse_mscat(fmap_t *map, const void *start, unsigned int size, c

 	    cli_dbgmsg("asn1_parse_mscat: failed to read countersignature encryptedDigest\n");

 	    break;

 	}

-	if(crtmgr_verify_pkcs7(cmgr, issuer, asn1.content, asn1.size, hashtype, sha1)) {

+	if(crtmgr_verify_pkcs7(cmgr, issuer, asn1.content, asn1.size, hashtype, sha1, VRFY_TIME)) {

 	    cli_dbgmsg("asn1_parse_mscat: pkcs7 countersignature verification failed\n");

 	    break;

 	}

@@ -33,7 +33,7 @@ int cli_crt_init(cli_crt *x509) {

     }

     x509->not_before = x509->not_after = 0;

     x509->prev = x509->next = NULL;

-    x509->certSign = x509->codeSign = x509->timeSign = -1;

+    x509->certSign = x509->codeSign = x509->timeSign = 0;

     return 0;

 }

@@ -127,7 +127,7 @@ int crtmgr_add(crtmgr *m, cli_crt *x509) {

 	    sprintf(&issuer[j*2], "%02x", i->issuer[j]);

 	    sprintf(&subject[j*2], "%02x", i->subject[j]);

 	}

-	cli_dbgmsg("crtmgr_add: added cert s:%s i:%s n:%s e:%s %lu->%lu\n", subject, issuer, mod, exp, (unsigned long)i->not_before, (unsigned long)i->not_after);

+	cli_dbgmsg("crtmgr_add: added cert s:%s i:%s n:%s e:%s %lu->%lu %s%s%s\n", subject, issuer, mod, exp, (unsigned long)i->not_before, (unsigned long)i->not_after, i->certSign ? "cert ":"", i->codeSign ? "code ":"", i->timeSign ? "time":"");

     }

     m->items++;

     return 0;

@@ -267,13 +267,11 @@ int crtmgr_verify_crt(crtmgr *m, cli_crt *x509) {

     return 1;

 }

-int crtmgr_verify_pkcs7(crtmgr *m, const uint8_t *issuer, const void *signature, unsigned int signature_len, cli_crt_hashtype hashtype, const uint8_t *refhash) {

+int crtmgr_verify_pkcs7(crtmgr *m, const uint8_t *issuer, const void *signature, unsigned int signature_len, cli_crt_hashtype hashtype, const uint8_t *refhash, cli_vrfy_type vrfytype) {

     cli_crt *i;

     mp_int sig;

     int ret;

-    /* FIXME: add check on serial ? */

-

     if(signature_len < 1024/8 || signature_len > 4096/8+1) {

 	cli_dbgmsg("crtmgr_verify_pkcs7: unsupported sig len: %u\n", signature_len);

        return 1;

@@ -290,6 +288,10 @@ int crtmgr_verify_pkcs7(crtmgr *m, const uint8_t *issuer, const void *signature,

     ret = 1;

     for(i = m->crts; i; i = i->next) {

+	if(vrfytype == VRFY_CODE && !i->codeSign)

+	    continue;

+	if(vrfytype == VRFY_TIME && !i->timeSign)

+	    continue;

 	if(!memcmp(i->issuer, issuer, sizeof(i->issuer)) &&

 	   !crtmgr_rsa_verify(i, &sig, hashtype, refhash)) {

 	    ret = 0;

@@ -27,7 +27,7 @@

 #include "sha1.h"

 typedef enum { CLI_SHA1RSA, CLI_MD5RSA } cli_crt_hashtype;

-

+typedef enum {VRFY_CODE, VRFY_TIME} cli_vrfy_type;

 typedef struct cli_crt_t {

     uint8_t subject[SHA1_HASH_SIZE];

@@ -60,7 +60,7 @@ int crtmgr_add(crtmgr *m, cli_crt *x509);

 cli_crt *crtmgr_lookup(crtmgr *m, cli_crt *x509);

 void crtmgr_del(crtmgr *m, cli_crt *x509);

 int crtmgr_verify_crt(crtmgr *m, cli_crt *x509);

-int crtmgr_verify_pkcs7(crtmgr *m, const uint8_t *issuer, const void *signature, unsigned int signature_len, cli_crt_hashtype hashtype, const uint8_t *refhash);

+int crtmgr_verify_pkcs7(crtmgr *m, const uint8_t *issuer, const void *signature, unsigned int signature_len, cli_crt_hashtype hashtype, const uint8_t *refhash, cli_vrfy_type vrfytype);

 int crtmgr_add_roots(crtmgr *m);