1 /*
2 * Copyright 2007-2023 The OpenSSL Project Authors. All Rights Reserved.
3 * Copyright Nokia 2007-2019
4 * Copyright Siemens AG 2015-2019
5 *
6 * Licensed under the Apache License 2.0 (the "License"). You may not use
7 * this file except in compliance with the License. You can obtain a copy
8 * in the file LICENSE in the source distribution or at
9 * https://www.openssl.org/source/license.html
10 */
11
12 /* CMP functions for PKIMessage construction */
13
14 #include "cmp_local.h"
15
16 /* explicit #includes not strictly needed since implied by the above: */
17 #include <openssl/asn1t.h>
18 #include <openssl/cmp.h>
19 #include <openssl/crmf.h>
20 #include <openssl/err.h>
21 #include <openssl/x509.h>
22
OSSL_CMP_MSG_new(OSSL_LIB_CTX * libctx,const char * propq)23 OSSL_CMP_MSG *OSSL_CMP_MSG_new(OSSL_LIB_CTX *libctx, const char *propq)
24 {
25 OSSL_CMP_MSG *msg = NULL;
26
27 msg = (OSSL_CMP_MSG *)ASN1_item_new_ex(ASN1_ITEM_rptr(OSSL_CMP_MSG),
28 libctx, propq);
29 if (!ossl_cmp_msg_set0_libctx(msg, libctx, propq)) {
30 OSSL_CMP_MSG_free(msg);
31 msg = NULL;
32 }
33 return msg;
34 }
35
OSSL_CMP_MSG_free(OSSL_CMP_MSG * msg)36 void OSSL_CMP_MSG_free(OSSL_CMP_MSG *msg)
37 {
38 ASN1_item_free((ASN1_VALUE *)msg, ASN1_ITEM_rptr(OSSL_CMP_MSG));
39 }
40
41 /*
42 * This should only be used if the X509 object was embedded inside another
43 * asn1 object and it needs a libctx to operate.
44 * Use OSSL_CMP_MSG_new() instead if possible.
45 */
ossl_cmp_msg_set0_libctx(OSSL_CMP_MSG * msg,OSSL_LIB_CTX * libctx,const char * propq)46 int ossl_cmp_msg_set0_libctx(OSSL_CMP_MSG *msg, OSSL_LIB_CTX *libctx,
47 const char *propq)
48 {
49 if (msg != NULL) {
50 msg->libctx = libctx;
51 OPENSSL_free(msg->propq);
52 msg->propq = NULL;
53 if (propq != NULL) {
54 msg->propq = OPENSSL_strdup(propq);
55 if (msg->propq == NULL)
56 return 0;
57 }
58 }
59 return 1;
60 }
61
62
OSSL_CMP_MSG_get0_header(const OSSL_CMP_MSG * msg)63 OSSL_CMP_PKIHEADER *OSSL_CMP_MSG_get0_header(const OSSL_CMP_MSG *msg)
64 {
65 if (msg == NULL) {
66 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
67 return NULL;
68 }
69 return msg->header;
70 }
71
ossl_cmp_bodytype_to_string(int type)72 const char *ossl_cmp_bodytype_to_string(int type)
73 {
74 static const char *type_names[] = {
75 "IR", "IP", "CR", "CP", "P10CR",
76 "POPDECC", "POPDECR", "KUR", "KUP",
77 "KRR", "KRP", "RR", "RP", "CCR", "CCP",
78 "CKUANN", "CANN", "RANN", "CRLANN", "PKICONF", "NESTED",
79 "GENM", "GENP", "ERROR", "CERTCONF", "POLLREQ", "POLLREP",
80 };
81
82 if (type < 0 || type > OSSL_CMP_PKIBODY_TYPE_MAX)
83 return "illegal body type";
84 return type_names[type];
85 }
86
ossl_cmp_msg_set_bodytype(OSSL_CMP_MSG * msg,int type)87 int ossl_cmp_msg_set_bodytype(OSSL_CMP_MSG *msg, int type)
88 {
89 if (!ossl_assert(msg != NULL && msg->body != NULL))
90 return 0;
91
92 msg->body->type = type;
93 return 1;
94 }
95
OSSL_CMP_MSG_get_bodytype(const OSSL_CMP_MSG * msg)96 int OSSL_CMP_MSG_get_bodytype(const OSSL_CMP_MSG *msg)
97 {
98 if (!ossl_assert(msg != NULL && msg->body != NULL))
99 return -1;
100
101 return msg->body->type;
102 }
103
104 /* Add an extension to the referenced extension stack, which may be NULL */
add1_extension(X509_EXTENSIONS ** pexts,int nid,int crit,void * ex)105 static int add1_extension(X509_EXTENSIONS **pexts, int nid, int crit, void *ex)
106 {
107 X509_EXTENSION *ext;
108 int res;
109
110 if (!ossl_assert(pexts != NULL)) /* pointer to var must not be NULL */
111 return 0;
112
113 if ((ext = X509V3_EXT_i2d(nid, crit, ex)) == NULL)
114 return 0;
115
116 res = X509v3_add_ext(pexts, ext, 0) != NULL;
117 X509_EXTENSION_free(ext);
118 return res;
119 }
120
121 /* Add extension list to the referenced extension stack, which may be NULL */
add_extensions(STACK_OF (X509_EXTENSION)** target,const STACK_OF (X509_EXTENSION)* exts)122 static int add_extensions(STACK_OF(X509_EXTENSION) **target,
123 const STACK_OF(X509_EXTENSION) *exts)
124 {
125 int i;
126
127 if (target == NULL)
128 return 0;
129
130 for (i = 0; i < sk_X509_EXTENSION_num(exts); i++) {
131 X509_EXTENSION *ext = sk_X509_EXTENSION_value(exts, i);
132 ASN1_OBJECT *obj = X509_EXTENSION_get_object(ext);
133 int idx = X509v3_get_ext_by_OBJ(*target, obj, -1);
134
135 /* Does extension exist in target? */
136 if (idx != -1) {
137 /* Delete all extensions of same type */
138 do {
139 X509_EXTENSION_free(sk_X509_EXTENSION_delete(*target, idx));
140 idx = X509v3_get_ext_by_OBJ(*target, obj, -1);
141 } while (idx != -1);
142 }
143 if (!X509v3_add_ext(target, ext, -1))
144 return 0;
145 }
146 return 1;
147 }
148
149 /* Add a CRL revocation reason code to extension stack, which may be NULL */
add_crl_reason_extension(X509_EXTENSIONS ** pexts,int reason_code)150 static int add_crl_reason_extension(X509_EXTENSIONS **pexts, int reason_code)
151 {
152 ASN1_ENUMERATED *val = ASN1_ENUMERATED_new();
153 int res = 0;
154
155 if (val != NULL && ASN1_ENUMERATED_set(val, reason_code))
156 res = add1_extension(pexts, NID_crl_reason, 0 /* non-critical */, val);
157 ASN1_ENUMERATED_free(val);
158 return res;
159 }
160
ossl_cmp_msg_create(OSSL_CMP_CTX * ctx,int bodytype)161 OSSL_CMP_MSG *ossl_cmp_msg_create(OSSL_CMP_CTX *ctx, int bodytype)
162 {
163 OSSL_CMP_MSG *msg = NULL;
164
165 if (!ossl_assert(ctx != NULL))
166 return NULL;
167
168 if ((msg = OSSL_CMP_MSG_new(ctx->libctx, ctx->propq)) == NULL)
169 return NULL;
170 if (!ossl_cmp_hdr_init(ctx, msg->header)
171 || !ossl_cmp_msg_set_bodytype(msg, bodytype))
172 goto err;
173 if (ctx->geninfo_ITAVs != NULL
174 && !ossl_cmp_hdr_generalInfo_push1_items(msg->header,
175 ctx->geninfo_ITAVs))
176 goto err;
177
178 switch (bodytype) {
179 case OSSL_CMP_PKIBODY_IR:
180 case OSSL_CMP_PKIBODY_CR:
181 case OSSL_CMP_PKIBODY_KUR:
182 if ((msg->body->value.ir = OSSL_CRMF_MSGS_new()) == NULL)
183 goto err;
184 return msg;
185
186 case OSSL_CMP_PKIBODY_P10CR:
187 if (ctx->p10CSR == NULL) {
188 ERR_raise(ERR_LIB_CMP, CMP_R_MISSING_P10CSR);
189 goto err;
190 }
191 if ((msg->body->value.p10cr = X509_REQ_dup(ctx->p10CSR)) == NULL)
192 goto err;
193 return msg;
194
195 case OSSL_CMP_PKIBODY_IP:
196 case OSSL_CMP_PKIBODY_CP:
197 case OSSL_CMP_PKIBODY_KUP:
198 if ((msg->body->value.ip = OSSL_CMP_CERTREPMESSAGE_new()) == NULL)
199 goto err;
200 return msg;
201
202 case OSSL_CMP_PKIBODY_RR:
203 if ((msg->body->value.rr = sk_OSSL_CMP_REVDETAILS_new_null()) == NULL)
204 goto err;
205 return msg;
206 case OSSL_CMP_PKIBODY_RP:
207 if ((msg->body->value.rp = OSSL_CMP_REVREPCONTENT_new()) == NULL)
208 goto err;
209 return msg;
210
211 case OSSL_CMP_PKIBODY_CERTCONF:
212 if ((msg->body->value.certConf =
213 sk_OSSL_CMP_CERTSTATUS_new_null()) == NULL)
214 goto err;
215 return msg;
216 case OSSL_CMP_PKIBODY_PKICONF:
217 if ((msg->body->value.pkiconf = ASN1_TYPE_new()) == NULL)
218 goto err;
219 ASN1_TYPE_set(msg->body->value.pkiconf, V_ASN1_NULL, NULL);
220 return msg;
221
222 case OSSL_CMP_PKIBODY_POLLREQ:
223 if ((msg->body->value.pollReq = sk_OSSL_CMP_POLLREQ_new_null()) == NULL)
224 goto err;
225 return msg;
226 case OSSL_CMP_PKIBODY_POLLREP:
227 if ((msg->body->value.pollRep = sk_OSSL_CMP_POLLREP_new_null()) == NULL)
228 goto err;
229 return msg;
230
231 case OSSL_CMP_PKIBODY_GENM:
232 case OSSL_CMP_PKIBODY_GENP:
233 if ((msg->body->value.genm = sk_OSSL_CMP_ITAV_new_null()) == NULL)
234 goto err;
235 return msg;
236
237 case OSSL_CMP_PKIBODY_ERROR:
238 if ((msg->body->value.error = OSSL_CMP_ERRORMSGCONTENT_new()) == NULL)
239 goto err;
240 return msg;
241
242 default:
243 ERR_raise(ERR_LIB_CMP, CMP_R_UNEXPECTED_PKIBODY);
244 goto err;
245 }
246
247 err:
248 OSSL_CMP_MSG_free(msg);
249 return NULL;
250 }
251
252 #define HAS_SAN(ctx) \
253 (sk_GENERAL_NAME_num((ctx)->subjectAltNames) > 0 \
254 || OSSL_CMP_CTX_reqExtensions_have_SAN(ctx) == 1)
255
determine_subj(OSSL_CMP_CTX * ctx,int for_KUR,const X509_NAME * ref_subj)256 static const X509_NAME *determine_subj(OSSL_CMP_CTX *ctx, int for_KUR,
257 const X509_NAME *ref_subj)
258 {
259 if (ctx->subjectName != NULL)
260 return IS_NULL_DN(ctx->subjectName) ? NULL : ctx->subjectName;
261 if (ctx->p10CSR != NULL) /* first default is from any given CSR */
262 return X509_REQ_get_subject_name(ctx->p10CSR);
263 if (for_KUR || !HAS_SAN(ctx))
264 /*
265 * For KUR, copy subject from any reference cert as fallback.
266 * For IR or CR, do the same only if there is no subjectAltName.
267 */
268 return ref_subj;
269 return NULL;
270 }
271
OSSL_CMP_CTX_setup_CRM(OSSL_CMP_CTX * ctx,int for_KUR,int rid)272 OSSL_CRMF_MSG *OSSL_CMP_CTX_setup_CRM(OSSL_CMP_CTX *ctx, int for_KUR, int rid)
273 {
274 OSSL_CRMF_MSG *crm = NULL;
275 X509 *refcert = ctx->oldCert != NULL ? ctx->oldCert : ctx->cert;
276 /* refcert defaults to current client cert */
277 EVP_PKEY *rkey = ossl_cmp_ctx_get0_newPubkey(ctx);
278 STACK_OF(GENERAL_NAME) *default_sans = NULL;
279 const X509_NAME *ref_subj =
280 refcert != NULL ? X509_get_subject_name(refcert) : NULL;
281 const X509_NAME *subject = determine_subj(ctx, for_KUR, ref_subj);
282 const X509_NAME *issuer = ctx->issuer != NULL || refcert == NULL
283 ? (IS_NULL_DN(ctx->issuer) ? NULL : ctx->issuer)
284 : X509_get_issuer_name(refcert);
285 int crit = ctx->setSubjectAltNameCritical || subject == NULL;
286 /* RFC5280: subjectAltName MUST be critical if subject is null */
287 X509_EXTENSIONS *exts = NULL;
288
289 if (rkey == NULL) {
290 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
291 ERR_raise(ERR_LIB_CMP, CMP_R_MISSING_PUBLIC_KEY);
292 return NULL;
293 #endif
294 }
295 if (for_KUR && refcert == NULL && ctx->p10CSR == NULL) {
296 ERR_raise(ERR_LIB_CMP, CMP_R_MISSING_REFERENCE_CERT);
297 return NULL;
298 }
299 if ((crm = OSSL_CRMF_MSG_new()) == NULL)
300 return NULL;
301 if (!OSSL_CRMF_MSG_set_certReqId(crm, rid)
302 /*
303 * fill certTemplate, corresponding to CertificationRequestInfo
304 * of PKCS#10. The rkey param cannot be NULL so far -
305 * it could be NULL if centralized key creation was supported
306 */
307 || !OSSL_CRMF_CERTTEMPLATE_fill(OSSL_CRMF_MSG_get0_tmpl(crm), rkey,
308 subject, issuer, NULL /* serial */))
309 goto err;
310 if (ctx->days != 0) {
311 time_t now = time(NULL);
312 ASN1_TIME *notBefore = ASN1_TIME_adj(NULL, now, 0, 0);
313 ASN1_TIME *notAfter = ASN1_TIME_adj(NULL, now, ctx->days, 0);
314
315 if (notBefore == NULL
316 || notAfter == NULL
317 || !OSSL_CRMF_MSG_set0_validity(crm, notBefore, notAfter)) {
318 ASN1_TIME_free(notBefore);
319 ASN1_TIME_free(notAfter);
320 goto err;
321 }
322 }
323
324 /* extensions */
325 if (ctx->p10CSR != NULL
326 && (exts = X509_REQ_get_extensions(ctx->p10CSR)) == NULL)
327 goto err;
328 if (!ctx->SubjectAltName_nodefault && !HAS_SAN(ctx) && refcert != NULL
329 && (default_sans = X509V3_get_d2i(X509_get0_extensions(refcert),
330 NID_subject_alt_name, NULL, NULL))
331 != NULL
332 && !add1_extension(&exts, NID_subject_alt_name, crit, default_sans))
333 goto err;
334 if (ctx->reqExtensions != NULL /* augment/override existing ones */
335 && !add_extensions(&exts, ctx->reqExtensions))
336 goto err;
337 if (sk_GENERAL_NAME_num(ctx->subjectAltNames) > 0
338 && !add1_extension(&exts, NID_subject_alt_name,
339 crit, ctx->subjectAltNames))
340 goto err;
341 if (ctx->policies != NULL
342 && !add1_extension(&exts, NID_certificate_policies,
343 ctx->setPoliciesCritical, ctx->policies))
344 goto err;
345 if (!OSSL_CRMF_MSG_set0_extensions(crm, exts))
346 goto err;
347 exts = NULL;
348 /* end fill certTemplate, now set any controls */
349
350 /* for KUR, set OldCertId according to D.6 */
351 if (for_KUR && refcert != NULL) {
352 OSSL_CRMF_CERTID *cid =
353 OSSL_CRMF_CERTID_gen(X509_get_issuer_name(refcert),
354 X509_get0_serialNumber(refcert));
355 int ret;
356
357 if (cid == NULL)
358 goto err;
359 ret = OSSL_CRMF_MSG_set1_regCtrl_oldCertID(crm, cid);
360 OSSL_CRMF_CERTID_free(cid);
361 if (ret == 0)
362 goto err;
363 }
364
365 goto end;
366
367 err:
368 OSSL_CRMF_MSG_free(crm);
369 crm = NULL;
370
371 end:
372 sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
373 sk_GENERAL_NAME_pop_free(default_sans, GENERAL_NAME_free);
374 return crm;
375 }
376
ossl_cmp_certreq_new(OSSL_CMP_CTX * ctx,int type,const OSSL_CRMF_MSG * crm)377 OSSL_CMP_MSG *ossl_cmp_certreq_new(OSSL_CMP_CTX *ctx, int type,
378 const OSSL_CRMF_MSG *crm)
379 {
380 OSSL_CMP_MSG *msg;
381 OSSL_CRMF_MSG *local_crm = NULL;
382
383 if (!ossl_assert(ctx != NULL))
384 return NULL;
385
386 if (type != OSSL_CMP_PKIBODY_IR && type != OSSL_CMP_PKIBODY_CR
387 && type != OSSL_CMP_PKIBODY_KUR && type != OSSL_CMP_PKIBODY_P10CR) {
388 ERR_raise(ERR_LIB_CMP, CMP_R_INVALID_ARGS);
389 return NULL;
390 }
391 if (type == OSSL_CMP_PKIBODY_P10CR && crm != NULL) {
392 ERR_raise(ERR_LIB_CMP, CMP_R_INVALID_ARGS);
393 return NULL;
394 }
395
396 if ((msg = ossl_cmp_msg_create(ctx, type)) == NULL)
397 goto err;
398
399 /* header */
400 if (ctx->implicitConfirm && !ossl_cmp_hdr_set_implicitConfirm(msg->header))
401 goto err;
402
403 /* body */
404 /* For P10CR the content has already been set in OSSL_CMP_MSG_create */
405 if (type != OSSL_CMP_PKIBODY_P10CR) {
406 EVP_PKEY *privkey = OSSL_CMP_CTX_get0_newPkey(ctx, 1);
407
408 /* privkey is ctx->newPkey (if private, else NULL) or ctx->pkey */
409 if (ctx->popoMethod >= OSSL_CRMF_POPO_SIGNATURE && privkey == NULL) {
410 ERR_raise(ERR_LIB_CMP, CMP_R_MISSING_PRIVATE_KEY_FOR_POPO);
411 goto err;
412 }
413 if (crm == NULL) {
414 local_crm = OSSL_CMP_CTX_setup_CRM(ctx,
415 type == OSSL_CMP_PKIBODY_KUR,
416 OSSL_CMP_CERTREQID);
417 if (local_crm == NULL
418 || !OSSL_CRMF_MSG_create_popo(ctx->popoMethod, local_crm,
419 privkey, ctx->digest,
420 ctx->libctx, ctx->propq))
421 goto err;
422 } else {
423 if ((local_crm = OSSL_CRMF_MSG_dup(crm)) == NULL)
424 goto err;
425 }
426
427 /* value.ir is same for cr and kur */
428 if (!sk_OSSL_CRMF_MSG_push(msg->body->value.ir, local_crm))
429 goto err;
430 local_crm = NULL;
431 }
432
433 if (!ossl_cmp_msg_protect(ctx, msg))
434 goto err;
435
436 return msg;
437
438 err:
439 ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_CERTREQ);
440 OSSL_CRMF_MSG_free(local_crm);
441 OSSL_CMP_MSG_free(msg);
442 return NULL;
443 }
444
ossl_cmp_certrep_new(OSSL_CMP_CTX * ctx,int bodytype,int certReqId,const OSSL_CMP_PKISI * si,X509 * cert,const X509 * encryption_recip,STACK_OF (X509)* chain,STACK_OF (X509)* caPubs,int unprotectedErrors)445 OSSL_CMP_MSG *ossl_cmp_certrep_new(OSSL_CMP_CTX *ctx, int bodytype,
446 int certReqId, const OSSL_CMP_PKISI *si,
447 X509 *cert, const X509 *encryption_recip,
448 STACK_OF(X509) *chain, STACK_OF(X509) *caPubs,
449 int unprotectedErrors)
450 {
451 OSSL_CMP_MSG *msg = NULL;
452 OSSL_CMP_CERTREPMESSAGE *repMsg = NULL;
453 OSSL_CMP_CERTRESPONSE *resp = NULL;
454 int status = OSSL_CMP_PKISTATUS_unspecified;
455
456 if (!ossl_assert(ctx != NULL && si != NULL))
457 return NULL;
458
459 if ((msg = ossl_cmp_msg_create(ctx, bodytype)) == NULL)
460 goto err;
461 repMsg = msg->body->value.ip; /* value.ip is same for cp and kup */
462
463 /* header */
464 if (ctx->implicitConfirm && !ossl_cmp_hdr_set_implicitConfirm(msg->header))
465 goto err;
466
467 /* body */
468 if ((resp = OSSL_CMP_CERTRESPONSE_new()) == NULL)
469 goto err;
470 OSSL_CMP_PKISI_free(resp->status);
471 if ((resp->status = OSSL_CMP_PKISI_dup(si)) == NULL
472 || !ASN1_INTEGER_set(resp->certReqId, certReqId))
473 goto err;
474
475 status = ossl_cmp_pkisi_get_status(resp->status);
476 if (status != OSSL_CMP_PKISTATUS_rejection
477 && status != OSSL_CMP_PKISTATUS_waiting && cert != NULL) {
478 if (encryption_recip != NULL) {
479 ERR_raise(ERR_LIB_CMP, ERR_R_UNSUPPORTED);
480 goto err;
481 }
482
483 if ((resp->certifiedKeyPair = OSSL_CMP_CERTIFIEDKEYPAIR_new())
484 == NULL)
485 goto err;
486 resp->certifiedKeyPair->certOrEncCert->type =
487 OSSL_CMP_CERTORENCCERT_CERTIFICATE;
488 if (!X509_up_ref(cert))
489 goto err;
490 resp->certifiedKeyPair->certOrEncCert->value.certificate = cert;
491 }
492
493 if (!sk_OSSL_CMP_CERTRESPONSE_push(repMsg->response, resp))
494 goto err;
495 resp = NULL;
496
497 if (bodytype == OSSL_CMP_PKIBODY_IP && caPubs != NULL
498 && (repMsg->caPubs = X509_chain_up_ref(caPubs)) == NULL)
499 goto err;
500 if (sk_X509_num(chain) > 0
501 && !ossl_x509_add_certs_new(&msg->extraCerts, chain,
502 X509_ADD_FLAG_UP_REF | X509_ADD_FLAG_NO_DUP))
503 goto err;
504
505 if (!unprotectedErrors
506 || ossl_cmp_pkisi_get_status(si) != OSSL_CMP_PKISTATUS_rejection)
507 if (!ossl_cmp_msg_protect(ctx, msg))
508 goto err;
509
510 return msg;
511
512 err:
513 ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_CERTREP);
514 OSSL_CMP_CERTRESPONSE_free(resp);
515 OSSL_CMP_MSG_free(msg);
516 return NULL;
517 }
518
ossl_cmp_rr_new(OSSL_CMP_CTX * ctx)519 OSSL_CMP_MSG *ossl_cmp_rr_new(OSSL_CMP_CTX *ctx)
520 {
521 OSSL_CMP_MSG *msg = NULL;
522 OSSL_CMP_REVDETAILS *rd;
523 int ret;
524
525 if (!ossl_assert(ctx != NULL && (ctx->oldCert != NULL
526 || ctx->p10CSR != NULL)))
527 return NULL;
528
529 if ((rd = OSSL_CMP_REVDETAILS_new()) == NULL)
530 goto err;
531
532 /* Fill the template from the contents of the certificate to be revoked */
533 ret = ctx->oldCert != NULL
534 ? OSSL_CRMF_CERTTEMPLATE_fill(rd->certDetails,
535 NULL /* pubkey would be redundant */,
536 NULL /* subject would be redundant */,
537 X509_get_issuer_name(ctx->oldCert),
538 X509_get0_serialNumber(ctx->oldCert))
539 : OSSL_CRMF_CERTTEMPLATE_fill(rd->certDetails,
540 X509_REQ_get0_pubkey(ctx->p10CSR),
541 X509_REQ_get_subject_name(ctx->p10CSR),
542 NULL, NULL);
543 if (!ret)
544 goto err;
545
546 /* revocation reason code is optional */
547 if (ctx->revocationReason != CRL_REASON_NONE
548 && !add_crl_reason_extension(&rd->crlEntryDetails,
549 ctx->revocationReason))
550 goto err;
551
552 if ((msg = ossl_cmp_msg_create(ctx, OSSL_CMP_PKIBODY_RR)) == NULL)
553 goto err;
554
555 if (!sk_OSSL_CMP_REVDETAILS_push(msg->body->value.rr, rd))
556 goto err;
557 rd = NULL;
558 /* Revocation Passphrase according to section 5.3.19.9 could be set here */
559
560 if (!ossl_cmp_msg_protect(ctx, msg))
561 goto err;
562
563 return msg;
564
565 err:
566 ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_RR);
567 OSSL_CMP_MSG_free(msg);
568 OSSL_CMP_REVDETAILS_free(rd);
569 return NULL;
570 }
571
ossl_cmp_rp_new(OSSL_CMP_CTX * ctx,const OSSL_CMP_PKISI * si,const OSSL_CRMF_CERTID * cid,int unprotectedErrors)572 OSSL_CMP_MSG *ossl_cmp_rp_new(OSSL_CMP_CTX *ctx, const OSSL_CMP_PKISI *si,
573 const OSSL_CRMF_CERTID *cid, int unprotectedErrors)
574 {
575 OSSL_CMP_REVREPCONTENT *rep = NULL;
576 OSSL_CMP_PKISI *si1 = NULL;
577 OSSL_CRMF_CERTID *cid_copy = NULL;
578 OSSL_CMP_MSG *msg = NULL;
579
580 if (!ossl_assert(ctx != NULL && si != NULL))
581 return NULL;
582
583 if ((msg = ossl_cmp_msg_create(ctx, OSSL_CMP_PKIBODY_RP)) == NULL)
584 goto err;
585 rep = msg->body->value.rp;
586
587 if ((si1 = OSSL_CMP_PKISI_dup(si)) == NULL)
588 goto err;
589
590 if (!sk_OSSL_CMP_PKISI_push(rep->status, si1)) {
591 OSSL_CMP_PKISI_free(si1);
592 goto err;
593 }
594
595 if ((rep->revCerts = sk_OSSL_CRMF_CERTID_new_null()) == NULL)
596 goto err;
597 if (cid != NULL) {
598 if ((cid_copy = OSSL_CRMF_CERTID_dup(cid)) == NULL)
599 goto err;
600 if (!sk_OSSL_CRMF_CERTID_push(rep->revCerts, cid_copy)) {
601 OSSL_CRMF_CERTID_free(cid_copy);
602 goto err;
603 }
604 }
605
606 if (!unprotectedErrors
607 || ossl_cmp_pkisi_get_status(si) != OSSL_CMP_PKISTATUS_rejection)
608 if (!ossl_cmp_msg_protect(ctx, msg))
609 goto err;
610
611 return msg;
612
613 err:
614 ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_RP);
615 OSSL_CMP_MSG_free(msg);
616 return NULL;
617 }
618
ossl_cmp_pkiconf_new(OSSL_CMP_CTX * ctx)619 OSSL_CMP_MSG *ossl_cmp_pkiconf_new(OSSL_CMP_CTX *ctx)
620 {
621 OSSL_CMP_MSG *msg;
622
623 if (!ossl_assert(ctx != NULL))
624 return NULL;
625
626 if ((msg = ossl_cmp_msg_create(ctx, OSSL_CMP_PKIBODY_PKICONF)) == NULL)
627 goto err;
628 if (ossl_cmp_msg_protect(ctx, msg))
629 return msg;
630
631 err:
632 ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_PKICONF);
633 OSSL_CMP_MSG_free(msg);
634 return NULL;
635 }
636
ossl_cmp_msg_gen_push0_ITAV(OSSL_CMP_MSG * msg,OSSL_CMP_ITAV * itav)637 int ossl_cmp_msg_gen_push0_ITAV(OSSL_CMP_MSG *msg, OSSL_CMP_ITAV *itav)
638 {
639 int bodytype;
640
641 if (!ossl_assert(msg != NULL && itav != NULL))
642 return 0;
643
644 bodytype = OSSL_CMP_MSG_get_bodytype(msg);
645 if (bodytype != OSSL_CMP_PKIBODY_GENM
646 && bodytype != OSSL_CMP_PKIBODY_GENP) {
647 ERR_raise(ERR_LIB_CMP, CMP_R_INVALID_ARGS);
648 return 0;
649 }
650
651 /* value.genp has the same structure, so this works for genp as well */
652 return OSSL_CMP_ITAV_push0_stack_item(&msg->body->value.genm, itav);
653 }
654
ossl_cmp_msg_gen_push1_ITAVs(OSSL_CMP_MSG * msg,const STACK_OF (OSSL_CMP_ITAV)* itavs)655 int ossl_cmp_msg_gen_push1_ITAVs(OSSL_CMP_MSG *msg,
656 const STACK_OF(OSSL_CMP_ITAV) *itavs)
657 {
658 int i;
659 OSSL_CMP_ITAV *itav = NULL;
660
661 if (!ossl_assert(msg != NULL))
662 return 0;
663
664 for (i = 0; i < sk_OSSL_CMP_ITAV_num(itavs); i++) {
665 itav = OSSL_CMP_ITAV_dup(sk_OSSL_CMP_ITAV_value(itavs, i));
666 if (itav == NULL
667 || !ossl_cmp_msg_gen_push0_ITAV(msg, itav)) {
668 OSSL_CMP_ITAV_free(itav);
669 return 0;
670 }
671 }
672 return 1;
673 }
674
675 /*
676 * Creates a new General Message/Response with an empty itav stack
677 * returns a pointer to the PKIMessage on success, NULL on error
678 */
gen_new(OSSL_CMP_CTX * ctx,const STACK_OF (OSSL_CMP_ITAV)* itavs,int body_type,int err_code)679 static OSSL_CMP_MSG *gen_new(OSSL_CMP_CTX *ctx,
680 const STACK_OF(OSSL_CMP_ITAV) *itavs,
681 int body_type, int err_code)
682 {
683 OSSL_CMP_MSG *msg = NULL;
684
685 if (!ossl_assert(ctx != NULL))
686 return NULL;
687
688 if ((msg = ossl_cmp_msg_create(ctx, body_type)) == NULL)
689 return NULL;
690
691 if (itavs != NULL && !ossl_cmp_msg_gen_push1_ITAVs(msg, itavs))
692 goto err;
693
694 if (!ossl_cmp_msg_protect(ctx, msg))
695 goto err;
696
697 return msg;
698
699 err:
700 ERR_raise(ERR_LIB_CMP, err_code);
701 OSSL_CMP_MSG_free(msg);
702 return NULL;
703 }
704
ossl_cmp_genm_new(OSSL_CMP_CTX * ctx)705 OSSL_CMP_MSG *ossl_cmp_genm_new(OSSL_CMP_CTX *ctx)
706 {
707 return gen_new(ctx, ctx->genm_ITAVs,
708 OSSL_CMP_PKIBODY_GENM, CMP_R_ERROR_CREATING_GENM);
709 }
710
ossl_cmp_genp_new(OSSL_CMP_CTX * ctx,const STACK_OF (OSSL_CMP_ITAV)* itavs)711 OSSL_CMP_MSG *ossl_cmp_genp_new(OSSL_CMP_CTX *ctx,
712 const STACK_OF(OSSL_CMP_ITAV) *itavs)
713 {
714 return gen_new(ctx, itavs,
715 OSSL_CMP_PKIBODY_GENP, CMP_R_ERROR_CREATING_GENP);
716 }
717
ossl_cmp_error_new(OSSL_CMP_CTX * ctx,const OSSL_CMP_PKISI * si,int64_t errorCode,const char * details,int unprotected)718 OSSL_CMP_MSG *ossl_cmp_error_new(OSSL_CMP_CTX *ctx, const OSSL_CMP_PKISI *si,
719 int64_t errorCode, const char *details,
720 int unprotected)
721 {
722 OSSL_CMP_MSG *msg = NULL;
723 const char *lib = NULL, *reason = NULL;
724 OSSL_CMP_PKIFREETEXT *ft;
725
726 if (!ossl_assert(ctx != NULL && si != NULL))
727 return NULL;
728
729 if ((msg = ossl_cmp_msg_create(ctx, OSSL_CMP_PKIBODY_ERROR)) == NULL)
730 goto err;
731
732 OSSL_CMP_PKISI_free(msg->body->value.error->pKIStatusInfo);
733 if ((msg->body->value.error->pKIStatusInfo = OSSL_CMP_PKISI_dup(si))
734 == NULL)
735 goto err;
736 if ((msg->body->value.error->errorCode = ASN1_INTEGER_new()) == NULL)
737 goto err;
738 if (!ASN1_INTEGER_set_int64(msg->body->value.error->errorCode, errorCode))
739 goto err;
740 if (errorCode > 0
741 && (uint64_t)errorCode < ((uint64_t)ERR_SYSTEM_FLAG << 1)) {
742 lib = ERR_lib_error_string((unsigned long)errorCode);
743 reason = ERR_reason_error_string((unsigned long)errorCode);
744 }
745 if (lib != NULL || reason != NULL || details != NULL) {
746 if ((ft = sk_ASN1_UTF8STRING_new_null()) == NULL)
747 goto err;
748 msg->body->value.error->errorDetails = ft;
749 if (lib != NULL && *lib != '\0'
750 && !ossl_cmp_sk_ASN1_UTF8STRING_push_str(ft, lib, -1))
751 goto err;
752 if (reason != NULL && *reason != '\0'
753 && !ossl_cmp_sk_ASN1_UTF8STRING_push_str(ft, reason, -1))
754 goto err;
755 if (details != NULL
756 && !ossl_cmp_sk_ASN1_UTF8STRING_push_str(ft, details, -1))
757 goto err;
758 }
759
760 if (!unprotected && !ossl_cmp_msg_protect(ctx, msg))
761 goto err;
762 return msg;
763
764 err:
765 ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_ERROR);
766 OSSL_CMP_MSG_free(msg);
767 return NULL;
768 }
769
770 /*
771 * Set the certHash field of a OSSL_CMP_CERTSTATUS structure.
772 * This is used in the certConf message, for example,
773 * to confirm that the certificate was received successfully.
774 */
ossl_cmp_certstatus_set0_certHash(OSSL_CMP_CERTSTATUS * certStatus,ASN1_OCTET_STRING * hash)775 int ossl_cmp_certstatus_set0_certHash(OSSL_CMP_CERTSTATUS *certStatus,
776 ASN1_OCTET_STRING *hash)
777 {
778 if (!ossl_assert(certStatus != NULL))
779 return 0;
780 ASN1_OCTET_STRING_free(certStatus->certHash);
781 certStatus->certHash = hash;
782 return 1;
783 }
784
ossl_cmp_certConf_new(OSSL_CMP_CTX * ctx,int certReqId,int fail_info,const char * text)785 OSSL_CMP_MSG *ossl_cmp_certConf_new(OSSL_CMP_CTX *ctx, int certReqId,
786 int fail_info, const char *text)
787 {
788 OSSL_CMP_MSG *msg = NULL;
789 OSSL_CMP_CERTSTATUS *certStatus = NULL;
790 ASN1_OCTET_STRING *certHash = NULL;
791 OSSL_CMP_PKISI *sinfo;
792
793 if (!ossl_assert(ctx != NULL && ctx->newCert != NULL
794 && (certReqId == OSSL_CMP_CERTREQID
795 || certReqId == OSSL_CMP_CERTREQID_NONE)))
796 return NULL;
797
798 if ((unsigned)fail_info > OSSL_CMP_PKIFAILUREINFO_MAX_BIT_PATTERN) {
799 ERR_raise(ERR_LIB_CMP, CMP_R_FAIL_INFO_OUT_OF_RANGE);
800 return NULL;
801 }
802
803 if ((msg = ossl_cmp_msg_create(ctx, OSSL_CMP_PKIBODY_CERTCONF)) == NULL)
804 goto err;
805
806 if ((certStatus = OSSL_CMP_CERTSTATUS_new()) == NULL)
807 goto err;
808 /* consume certStatus into msg right away so it gets deallocated with msg */
809 if (sk_OSSL_CMP_CERTSTATUS_push(msg->body->value.certConf, certStatus) < 1) {
810 OSSL_CMP_CERTSTATUS_free(certStatus);
811 goto err;
812 }
813
814 /* set the ID of the certReq */
815 if (!ASN1_INTEGER_set(certStatus->certReqId, certReqId))
816 goto err;
817 /*
818 * The hash of the certificate, using the same hash algorithm
819 * as is used to create and verify the certificate signature.
820 * If not available, a default hash algorithm is used.
821 */
822 if ((certHash = X509_digest_sig(ctx->newCert, NULL, NULL)) == NULL)
823 goto err;
824
825 if (!ossl_cmp_certstatus_set0_certHash(certStatus, certHash))
826 goto err;
827 certHash = NULL;
828 /*
829 * For any particular CertStatus, omission of the statusInfo field
830 * indicates ACCEPTANCE of the specified certificate. Alternatively,
831 * explicit status details (with respect to acceptance or rejection) MAY
832 * be provided in the statusInfo field, perhaps for auditing purposes at
833 * the CA/RA.
834 */
835 sinfo = fail_info != 0 ?
836 OSSL_CMP_STATUSINFO_new(OSSL_CMP_PKISTATUS_rejection, fail_info, text) :
837 OSSL_CMP_STATUSINFO_new(OSSL_CMP_PKISTATUS_accepted, 0, text);
838 if (sinfo == NULL)
839 goto err;
840 certStatus->statusInfo = sinfo;
841
842 if (!ossl_cmp_msg_protect(ctx, msg))
843 goto err;
844
845 return msg;
846
847 err:
848 ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_CERTCONF);
849 OSSL_CMP_MSG_free(msg);
850 ASN1_OCTET_STRING_free(certHash);
851 return NULL;
852 }
853
ossl_cmp_pollReq_new(OSSL_CMP_CTX * ctx,int crid)854 OSSL_CMP_MSG *ossl_cmp_pollReq_new(OSSL_CMP_CTX *ctx, int crid)
855 {
856 OSSL_CMP_MSG *msg = NULL;
857 OSSL_CMP_POLLREQ *preq = NULL;
858
859 if (!ossl_assert(ctx != NULL))
860 return NULL;
861
862 if ((msg = ossl_cmp_msg_create(ctx, OSSL_CMP_PKIBODY_POLLREQ)) == NULL)
863 goto err;
864
865 if ((preq = OSSL_CMP_POLLREQ_new()) == NULL
866 || !ASN1_INTEGER_set(preq->certReqId, crid)
867 || !sk_OSSL_CMP_POLLREQ_push(msg->body->value.pollReq, preq))
868 goto err;
869
870 preq = NULL;
871 if (!ossl_cmp_msg_protect(ctx, msg))
872 goto err;
873
874 return msg;
875
876 err:
877 ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_POLLREQ);
878 OSSL_CMP_POLLREQ_free(preq);
879 OSSL_CMP_MSG_free(msg);
880 return NULL;
881 }
882
ossl_cmp_pollRep_new(OSSL_CMP_CTX * ctx,int crid,int64_t poll_after)883 OSSL_CMP_MSG *ossl_cmp_pollRep_new(OSSL_CMP_CTX *ctx, int crid,
884 int64_t poll_after)
885 {
886 OSSL_CMP_MSG *msg;
887 OSSL_CMP_POLLREP *prep;
888
889 if (!ossl_assert(ctx != NULL))
890 return NULL;
891
892 if ((msg = ossl_cmp_msg_create(ctx, OSSL_CMP_PKIBODY_POLLREP)) == NULL)
893 goto err;
894 if ((prep = OSSL_CMP_POLLREP_new()) == NULL)
895 goto err;
896 if (!sk_OSSL_CMP_POLLREP_push(msg->body->value.pollRep, prep))
897 goto err;
898 if (!ASN1_INTEGER_set(prep->certReqId, crid))
899 goto err;
900 if (!ASN1_INTEGER_set_int64(prep->checkAfter, poll_after))
901 goto err;
902
903 if (!ossl_cmp_msg_protect(ctx, msg))
904 goto err;
905 return msg;
906
907 err:
908 ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_POLLREP);
909 OSSL_CMP_MSG_free(msg);
910 return NULL;
911 }
912
913 /*-
914 * returns the status field of the RevRepContent with the given
915 * request/sequence id inside a revocation response.
916 * RevRepContent has the revocation statuses in same order as they were sent in
917 * RevReqContent.
918 * returns NULL on error
919 */
920 OSSL_CMP_PKISI *
ossl_cmp_revrepcontent_get_pkisi(OSSL_CMP_REVREPCONTENT * rrep,int rsid)921 ossl_cmp_revrepcontent_get_pkisi(OSSL_CMP_REVREPCONTENT *rrep, int rsid)
922 {
923 OSSL_CMP_PKISI *status;
924
925 if (!ossl_assert(rrep != NULL))
926 return NULL;
927
928 if ((status = sk_OSSL_CMP_PKISI_value(rrep->status, rsid)) != NULL)
929 return status;
930
931 ERR_raise(ERR_LIB_CMP, CMP_R_PKISTATUSINFO_NOT_FOUND);
932 return NULL;
933 }
934
935 /*
936 * returns the CertId field in the revCerts part of the RevRepContent
937 * with the given request/sequence id inside a revocation response.
938 * RevRepContent has the CertIds in same order as they were sent in
939 * RevReqContent.
940 * returns NULL on error
941 */
942 OSSL_CRMF_CERTID *
ossl_cmp_revrepcontent_get_CertId(OSSL_CMP_REVREPCONTENT * rrep,int rsid)943 ossl_cmp_revrepcontent_get_CertId(OSSL_CMP_REVREPCONTENT *rrep, int rsid)
944 {
945 OSSL_CRMF_CERTID *cid = NULL;
946
947 if (!ossl_assert(rrep != NULL))
948 return NULL;
949
950 if ((cid = sk_OSSL_CRMF_CERTID_value(rrep->revCerts, rsid)) != NULL)
951 return cid;
952
953 ERR_raise(ERR_LIB_CMP, CMP_R_CERTID_NOT_FOUND);
954 return NULL;
955 }
956
suitable_rid(const ASN1_INTEGER * certReqId,int rid)957 static int suitable_rid(const ASN1_INTEGER *certReqId, int rid)
958 {
959 int trid;
960
961 if (rid == OSSL_CMP_CERTREQID_NONE)
962 return 1;
963
964 trid = ossl_cmp_asn1_get_int(certReqId);
965
966 if (trid == OSSL_CMP_CERTREQID_NONE) {
967 ERR_raise(ERR_LIB_CMP, CMP_R_BAD_REQUEST_ID);
968 return 0;
969 }
970 return rid == trid;
971 }
972
973 /*
974 * returns a pointer to the PollResponse with the given CertReqId
975 * (or the first one in case -1) inside a PollRepContent
976 * returns NULL on error or if no suitable PollResponse available
977 */
978 OSSL_CMP_POLLREP *
ossl_cmp_pollrepcontent_get0_pollrep(const OSSL_CMP_POLLREPCONTENT * prc,int rid)979 ossl_cmp_pollrepcontent_get0_pollrep(const OSSL_CMP_POLLREPCONTENT *prc,
980 int rid)
981 {
982 OSSL_CMP_POLLREP *pollRep = NULL;
983 int i;
984
985 if (!ossl_assert(prc != NULL))
986 return NULL;
987
988 for (i = 0; i < sk_OSSL_CMP_POLLREP_num(prc); i++) {
989 pollRep = sk_OSSL_CMP_POLLREP_value(prc, i);
990 if (suitable_rid(pollRep->certReqId, rid))
991 return pollRep;
992 }
993
994 ERR_raise_data(ERR_LIB_CMP, CMP_R_CERTRESPONSE_NOT_FOUND,
995 "expected certReqId = %d", rid);
996 return NULL;
997 }
998
999 /*
1000 * returns a pointer to the CertResponse with the given CertReqId
1001 * (or the first one in case -1) inside a CertRepMessage
1002 * returns NULL on error or if no suitable CertResponse available
1003 */
1004 OSSL_CMP_CERTRESPONSE *
ossl_cmp_certrepmessage_get0_certresponse(const OSSL_CMP_CERTREPMESSAGE * crm,int rid)1005 ossl_cmp_certrepmessage_get0_certresponse(const OSSL_CMP_CERTREPMESSAGE *crm,
1006 int rid)
1007 {
1008 OSSL_CMP_CERTRESPONSE *crep = NULL;
1009 int i;
1010
1011 if (!ossl_assert(crm != NULL && crm->response != NULL))
1012 return NULL;
1013
1014 for (i = 0; i < sk_OSSL_CMP_CERTRESPONSE_num(crm->response); i++) {
1015 crep = sk_OSSL_CMP_CERTRESPONSE_value(crm->response, i);
1016 if (suitable_rid(crep->certReqId, rid))
1017 return crep;
1018 }
1019
1020 ERR_raise_data(ERR_LIB_CMP, CMP_R_CERTRESPONSE_NOT_FOUND,
1021 "expected certReqId = %d", rid);
1022 return NULL;
1023 }
1024
1025 /*-
1026 * Retrieve the newly enrolled certificate from the given certResponse crep.
1027 * Uses libctx and propq from ctx, in case of indirect POPO also private key.
1028 * Returns a pointer to a copy of the found certificate, or NULL if not found.
1029 */
ossl_cmp_certresponse_get1_cert(const OSSL_CMP_CTX * ctx,const OSSL_CMP_CERTRESPONSE * crep)1030 X509 *ossl_cmp_certresponse_get1_cert(const OSSL_CMP_CTX *ctx,
1031 const OSSL_CMP_CERTRESPONSE *crep)
1032 {
1033 OSSL_CMP_CERTORENCCERT *coec;
1034 X509 *crt = NULL;
1035 EVP_PKEY *pkey;
1036
1037 if (!ossl_assert(crep != NULL && ctx != NULL))
1038 return NULL;
1039
1040 if (crep->certifiedKeyPair
1041 && (coec = crep->certifiedKeyPair->certOrEncCert) != NULL) {
1042 switch (coec->type) {
1043 case OSSL_CMP_CERTORENCCERT_CERTIFICATE:
1044 crt = X509_dup(coec->value.certificate);
1045 break;
1046 case OSSL_CMP_CERTORENCCERT_ENCRYPTEDCERT:
1047 /* cert encrypted for indirect PoP; RFC 4210, 5.2.8.2 */
1048 pkey = OSSL_CMP_CTX_get0_newPkey(ctx, 1);
1049 /* pkey is ctx->newPkey (if private, else NULL) or ctx->pkey */
1050 if (pkey == NULL) {
1051 ERR_raise(ERR_LIB_CMP, CMP_R_MISSING_PRIVATE_KEY);
1052 return NULL;
1053 }
1054 crt =
1055 OSSL_CRMF_ENCRYPTEDVALUE_get1_encCert(coec->value.encryptedCert,
1056 ctx->libctx, ctx->propq,
1057 pkey);
1058 break;
1059 default:
1060 ERR_raise(ERR_LIB_CMP, CMP_R_UNKNOWN_CERT_TYPE);
1061 return NULL;
1062 }
1063 }
1064 if (crt == NULL)
1065 ERR_raise(ERR_LIB_CMP, CMP_R_CERTIFICATE_NOT_FOUND);
1066 else
1067 (void)ossl_x509_set0_libctx(crt, ctx->libctx, ctx->propq);
1068 return crt;
1069 }
1070
OSSL_CMP_MSG_update_transactionID(OSSL_CMP_CTX * ctx,OSSL_CMP_MSG * msg)1071 int OSSL_CMP_MSG_update_transactionID(OSSL_CMP_CTX *ctx, OSSL_CMP_MSG *msg)
1072 {
1073 if (ctx == NULL || msg == NULL) {
1074 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
1075 return 0;
1076 }
1077 if (!ossl_cmp_hdr_set_transactionID(ctx, msg->header))
1078 return 0;
1079 return msg->header->protectionAlg == NULL
1080 || ossl_cmp_msg_protect(ctx, msg);
1081 }
1082
OSSL_CMP_MSG_update_recipNonce(OSSL_CMP_CTX * ctx,OSSL_CMP_MSG * msg)1083 int OSSL_CMP_MSG_update_recipNonce(OSSL_CMP_CTX *ctx, OSSL_CMP_MSG *msg)
1084 {
1085 if (ctx == NULL || msg == NULL || msg->header == NULL) {
1086 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
1087 return 0;
1088 }
1089 if (ctx->recipNonce == NULL) /* nothing to do for 1st msg in transaction */
1090 return 1;
1091 if (!ossl_cmp_asn1_octet_string_set1(&msg->header->recipNonce,
1092 ctx->recipNonce))
1093 return 0;
1094 return msg->header->protectionAlg == NULL || ossl_cmp_msg_protect(ctx, msg);
1095 }
1096
OSSL_CMP_MSG_read(const char * file,OSSL_LIB_CTX * libctx,const char * propq)1097 OSSL_CMP_MSG *OSSL_CMP_MSG_read(const char *file, OSSL_LIB_CTX *libctx,
1098 const char *propq)
1099 {
1100 OSSL_CMP_MSG *msg;
1101 BIO *bio = NULL;
1102
1103 if (file == NULL) {
1104 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
1105 return NULL;
1106 }
1107
1108 msg = OSSL_CMP_MSG_new(libctx, propq);
1109 if (msg == NULL){
1110 ERR_raise(ERR_LIB_CMP, ERR_R_MALLOC_FAILURE);
1111 return NULL;
1112 }
1113
1114 if ((bio = BIO_new_file(file, "rb")) == NULL
1115 || d2i_OSSL_CMP_MSG_bio(bio, &msg) == NULL) {
1116 OSSL_CMP_MSG_free(msg);
1117 msg = NULL;
1118 }
1119 BIO_free(bio);
1120 return msg;
1121 }
1122
OSSL_CMP_MSG_write(const char * file,const OSSL_CMP_MSG * msg)1123 int OSSL_CMP_MSG_write(const char *file, const OSSL_CMP_MSG *msg)
1124 {
1125 BIO *bio;
1126 int res;
1127
1128 if (file == NULL || msg == NULL) {
1129 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
1130 return -1;
1131 }
1132
1133 bio = BIO_new_file(file, "wb");
1134 if (bio == NULL)
1135 return -2;
1136 res = i2d_OSSL_CMP_MSG_bio(bio, msg);
1137 BIO_free(bio);
1138 return res;
1139 }
1140
d2i_OSSL_CMP_MSG(OSSL_CMP_MSG ** msg,const unsigned char ** in,long len)1141 OSSL_CMP_MSG *d2i_OSSL_CMP_MSG(OSSL_CMP_MSG **msg, const unsigned char **in,
1142 long len)
1143 {
1144 OSSL_LIB_CTX *libctx = NULL;
1145 const char *propq = NULL;
1146
1147 if (msg != NULL && *msg != NULL) {
1148 libctx = (*msg)->libctx;
1149 propq = (*msg)->propq;
1150 }
1151
1152 return (OSSL_CMP_MSG *)ASN1_item_d2i_ex((ASN1_VALUE **)msg, in, len,
1153 ASN1_ITEM_rptr(OSSL_CMP_MSG),
1154 libctx, propq);
1155 }
1156
i2d_OSSL_CMP_MSG(const OSSL_CMP_MSG * msg,unsigned char ** out)1157 int i2d_OSSL_CMP_MSG(const OSSL_CMP_MSG *msg, unsigned char **out)
1158 {
1159 return ASN1_item_i2d((const ASN1_VALUE *)msg, out,
1160 ASN1_ITEM_rptr(OSSL_CMP_MSG));
1161 }
1162
d2i_OSSL_CMP_MSG_bio(BIO * bio,OSSL_CMP_MSG ** msg)1163 OSSL_CMP_MSG *d2i_OSSL_CMP_MSG_bio(BIO *bio, OSSL_CMP_MSG **msg)
1164 {
1165 OSSL_LIB_CTX *libctx = NULL;
1166 const char *propq = NULL;
1167
1168 if (msg != NULL && *msg != NULL) {
1169 libctx = (*msg)->libctx;
1170 propq = (*msg)->propq;
1171 }
1172
1173 return ASN1_item_d2i_bio_ex(ASN1_ITEM_rptr(OSSL_CMP_MSG), bio, msg, libctx,
1174 propq);
1175 }
1176
i2d_OSSL_CMP_MSG_bio(BIO * bio,const OSSL_CMP_MSG * msg)1177 int i2d_OSSL_CMP_MSG_bio(BIO *bio, const OSSL_CMP_MSG *msg)
1178 {
1179 return ASN1_i2d_bio_of(OSSL_CMP_MSG, i2d_OSSL_CMP_MSG, bio, msg);
1180 }
1181