Check for bad DN qualifiers on signer certificates (#2716).

diff --git a/src/lib/config.cc b/src/lib/config.cc
index 45fc6192387020c1273de3ac28a3f3a65ee85a47..1bb2f3c6a53e45fcd74b81f80b45883bb15f8eef 100644 (file)
--- a/src/lib/config.cc
+++ b/src/lib/config.cc
@@ -501,6 +501,7 @@ try
                        case BAD_SIGNER_UTF8_STRINGS:
                        case BAD_SIGNER_INCONSISTENT:
                        case BAD_SIGNER_VALIDITY_TOO_LONG:
+                       case BAD_SIGNER_DN_QUALIFIER:
                                _signer_chain = create_certificate_chain ();
                                break;
                        case BAD_DECRYPTION_INCONSISTENT:
@@ -1590,6 +1591,9 @@ Config::check_certificates () const
                if ((i.not_after().year() - i.not_before().year()) > 15) {
                        bad = BAD_SIGNER_VALIDITY_TOO_LONG;
                }
+               if (dcp::escape_digest(i.subject_dn_qualifier()) != dcp::public_key_digest(i.public_key())) {
+                       bad = BAD_SIGNER_DN_QUALIFIER;
+               }
        }
 
        if (!_signer_chain->chain_valid() || !_signer_chain->private_key_valid()) {

diff --git a/src/lib/config.h b/src/lib/config.h
index 0a332bcbb74abdc287153077a86601fe4d1cf00e..dce4aafefdaf8aa849f85e63a562c335a6d006df 100644 (file)
--- a/src/lib/config.h
+++ b/src/lib/config.h
@@ -430,6 +430,7 @@ public:
                NAG_32_ON_64,
                NAG_TOO_MANY_DROPPED_FRAMES,
                NAG_BAD_SIGNER_CHAIN_VALIDITY,
+               NAG_BAD_SIGNER_DN_QUALIFIER,
                NAG_COUNT
        };
 
@@ -1224,6 +1225,7 @@ public:
                BAD_SIGNER_INCONSISTENT,      ///< signer chain is somehow inconsistent
                BAD_DECRYPTION_INCONSISTENT,  ///< KDM decryption chain is somehow inconsistent
                BAD_SIGNER_VALIDITY_TOO_LONG, ///< signer certificate validity periods are >10 years
+               BAD_SIGNER_DN_QUALIFIER,      ///< some signer certificate has a bad dnQualifier (DoM #2716).
        };
 
        static boost::signals2::signal<bool (BadReason)> Bad;

diff --git a/src/tools/dcpomatic.cc b/src/tools/dcpomatic.cc
index 5bd8b8def425a677e50c45bce2d5a333e8dcc8ef..8faaf5bcdc6e2ab3f071b05e92b3ab820ad743aa 100644 (file)
--- a/src/tools/dcpomatic.cc
+++ b/src/tools/dcpomatic.cc
@@ -1919,6 +1919,19 @@ private:
                        }
                        return true;
                }
+               case Config::BAD_SIGNER_DN_QUALIFIER:
+               {
+                       RecreateChainDialog dialog(
+                               _frame, _("Recreate signing certificates"),
+                               _("The certificate chain that DCP-o-matic uses for signing DCPs and KDMs contains a small error\n"
+                                 "which will prevent DCPs from being validated correctly on some systems.  This error was caused\n"
+                                 "by a bug in DCP-o-matic which has now been fixed. Do you want to re-create the certificate chain\n"
+                                 "for signing DCPs and KDMs?"),
+                               _("Do nothing"),
+                               Config::NAG_BAD_SIGNER_DN_QUALIFIER
+                               );
+                       return dialog.ShowModal() == wxID_OK;
+               }
                default:
                        DCPOMATIC_ASSERT (false);
                }

diff --git a/test/data b/test/data
index ae6d44f2c605b2035fa0346798c3b536ed1a0160..a4ad4c1a4880d02aabf2790e11c4e5c2c28034dc 160000 (submodule)
--- a/test/data
+++ b/test/data
@@ -1 +1 @@
-Subproject commit ae6d44f2c605b2035fa0346798c3b536ed1a0160
+Subproject commit a4ad4c1a4880d02aabf2790e11c4e5c2c28034dc