Chain of trust issues with a single CA certificate

[ruffsl]

I'll quote the same succinctly put issue filled over for OpenDDS here:

OpenDDS/OpenDDS#3992 (comment)

Problem

Assume a usage of DDS Security where the same CA is used for both permissions and identity. The certificates issued to particpants allow them to sign documents. Assume the participant generates a permissions file and then signs it. Chain verification causes verification attempts to succeed since the signing certificate, i.e., the participant's certificate, can be chained back to the permission CA's certificate (which is also the identity CA).

This problem was identified in ros2/sros2#282.

Solution

Implement the suggestion in ros2/sros2#282. Specifically, use PKCS7_NOINTERN to not accept any signatures in the signed document. This, in turn, requires the use of the certs parameter to PKCS7_verify. PKCS7_NOVERIFY is used since the permissions CA certificate will not be chain verified.

Example call site for reference:

cyclonedds/src/security/builtin_plugins/access_control/src/access_control_utils.c

Line 251 in 65981fb

if (PKCS7_verify(p7, NULL, store, inbio, *outbio, PKCS7_TEXT) != 1)