1 /*
2 * Copyright 2007-2025 The OpenSSL Project Authors. All Rights Reserved.
3 * Copyright Nokia 2007-2019
4 * Copyright Siemens AG 2015-2019
5 *
6 * Licensed under the Apache License 2.0 (the "License"). You may not use
7 * this file except in compliance with the License. You can obtain a copy
8 * in the file LICENSE in the source distribution or at
9 * https://www.openssl.org/source/license.html
10 */
11
12 #include "cmp_local.h"
13 #include "crypto/asn1.h"
14
15 /* explicit #includes not strictly needed since implied by the above: */
16 #include <openssl/asn1t.h>
17 #include <openssl/cmp.h>
18 #include <openssl/crmf.h>
19 #include <openssl/err.h>
20 #include <openssl/x509.h>
21
22 /*
23 * This function is also used by the internal verify_PBMAC() in cmp_vfy.c.
24 *
25 * Calculate protection for |msg| according to |msg->header->protectionAlg|
26 * using the credentials, library context, and property criteria in the ctx.
27 * Unless |msg->header->protectionAlg| is PasswordBasedMAC,
28 * its value is completed according to |ctx->pkey| and |ctx->digest|,
29 * where the latter irrelevant in the case of Edwards curves.
30 *
31 * returns ASN1_BIT_STRING representing the protection on success, else NULL
32 */
ossl_cmp_calc_protection(const OSSL_CMP_CTX * ctx,const OSSL_CMP_MSG * msg)33 ASN1_BIT_STRING *ossl_cmp_calc_protection(const OSSL_CMP_CTX *ctx,
34 const OSSL_CMP_MSG *msg)
35 {
36 ASN1_BIT_STRING *prot = NULL;
37 OSSL_CMP_PROTECTEDPART prot_part;
38 const ASN1_OBJECT *algorOID = NULL;
39 const void *ppval = NULL;
40 int pptype = 0;
41
42 if (!ossl_assert(ctx != NULL && msg != NULL))
43 return NULL;
44
45 /* construct data to be signed */
46 prot_part.header = msg->header;
47 prot_part.body = msg->body;
48
49 if (msg->header->protectionAlg == NULL) {
50 ERR_raise(ERR_LIB_CMP, CMP_R_UNKNOWN_ALGORITHM_ID);
51 return NULL;
52 }
53 X509_ALGOR_get0(&algorOID, &pptype, &ppval, msg->header->protectionAlg);
54
55 if (OBJ_obj2nid(algorOID) == NID_id_PasswordBasedMAC) {
56 int len;
57 size_t prot_part_der_len;
58 unsigned char *prot_part_der = NULL;
59 size_t sig_len;
60 unsigned char *protection = NULL;
61 OSSL_CRMF_PBMPARAMETER *pbm = NULL;
62 ASN1_STRING *pbm_str = NULL;
63 const unsigned char *pbm_str_uc = NULL;
64
65 if (ctx->secretValue == NULL) {
66 ERR_raise(ERR_LIB_CMP, CMP_R_MISSING_PBM_SECRET);
67 return NULL;
68 }
69 if (ppval == NULL) {
70 ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CALCULATING_PROTECTION);
71 return NULL;
72 }
73
74 len = i2d_OSSL_CMP_PROTECTEDPART(&prot_part, &prot_part_der);
75 if (len < 0 || prot_part_der == NULL) {
76 ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CALCULATING_PROTECTION);
77 goto end;
78 }
79 prot_part_der_len = (size_t)len;
80
81 pbm_str = (ASN1_STRING *)ppval;
82 pbm_str_uc = pbm_str->data;
83 pbm = d2i_OSSL_CRMF_PBMPARAMETER(NULL, &pbm_str_uc, pbm_str->length);
84 if (pbm == NULL) {
85 ERR_raise(ERR_LIB_CMP, CMP_R_WRONG_ALGORITHM_OID);
86 goto end;
87 }
88
89 if (!OSSL_CRMF_pbm_new(ctx->libctx, ctx->propq,
90 pbm, prot_part_der, prot_part_der_len,
91 ctx->secretValue->data, ctx->secretValue->length,
92 &protection, &sig_len))
93 goto end;
94
95 if ((prot = ASN1_BIT_STRING_new()) == NULL)
96 goto end;
97 /* OpenSSL by default encodes all bit strings as ASN.1 NamedBitList */
98 ossl_asn1_string_set_bits_left(prot, 0);
99 if (!ASN1_BIT_STRING_set(prot, protection, sig_len)) {
100 ASN1_BIT_STRING_free(prot);
101 prot = NULL;
102 }
103 end:
104 OSSL_CRMF_PBMPARAMETER_free(pbm);
105 OPENSSL_free(protection);
106 OPENSSL_free(prot_part_der);
107 return prot;
108 } else {
109 const EVP_MD *md = ctx->digest;
110 char name[80] = "";
111
112 if (ctx->pkey == NULL) {
113 ERR_raise(ERR_LIB_CMP,
114 CMP_R_MISSING_KEY_INPUT_FOR_CREATING_PROTECTION);
115 return NULL;
116 }
117 if (EVP_PKEY_get_default_digest_name(ctx->pkey, name, sizeof(name)) > 0
118 && strcmp(name, "UNDEF") == 0) /* at least for Ed25519, Ed448 */
119 md = NULL;
120
121 if ((prot = ASN1_BIT_STRING_new()) == NULL)
122 return NULL;
123 if (ASN1_item_sign_ex(ASN1_ITEM_rptr(OSSL_CMP_PROTECTEDPART),
124 msg->header->protectionAlg, /* sets X509_ALGOR */
125 NULL, prot, &prot_part, NULL, ctx->pkey, md,
126 ctx->libctx, ctx->propq))
127 return prot;
128 ASN1_BIT_STRING_free(prot);
129 return NULL;
130 }
131 }
132
ossl_cmp_set_own_chain(OSSL_CMP_CTX * ctx)133 void ossl_cmp_set_own_chain(OSSL_CMP_CTX *ctx)
134 {
135 if (!ossl_assert(ctx != NULL))
136 return;
137 /* if not yet done try to build chain using available untrusted certs */
138 if (ctx->chain == NULL) {
139 ossl_cmp_debug(ctx, "trying to build chain for own CMP signer cert");
140 ctx->chain = X509_build_chain(ctx->cert, ctx->untrusted, NULL, 0,
141 ctx->libctx, ctx->propq);
142 if (ctx->chain != NULL) {
143 ossl_cmp_debug(ctx, "success building chain for own CMP signer cert");
144 } else {
145 /* dump errors to avoid confusion when printing further ones */
146 OSSL_CMP_CTX_print_errors(ctx);
147 ossl_cmp_warn(ctx, "could not build chain for own CMP signer cert");
148 }
149 }
150 }
151
152 /* ctx is not const just because ctx->chain may get adapted */
ossl_cmp_msg_add_extraCerts(OSSL_CMP_CTX * ctx,OSSL_CMP_MSG * msg)153 int ossl_cmp_msg_add_extraCerts(OSSL_CMP_CTX *ctx, OSSL_CMP_MSG *msg)
154 {
155 if (!ossl_assert(ctx != NULL && msg != NULL))
156 return 0;
157
158 /* Add first ctx->cert and its chain if using signature-based protection */
159 if (!ctx->unprotectedSend && ctx->secretValue == NULL
160 && ctx->cert != NULL && ctx->pkey != NULL) {
161 int prepend = X509_ADD_FLAG_UP_REF | X509_ADD_FLAG_NO_DUP
162 | X509_ADD_FLAG_PREPEND | X509_ADD_FLAG_NO_SS;
163
164 ossl_cmp_set_own_chain(ctx);
165 if (ctx->chain != NULL) {
166 if (!ossl_x509_add_certs_new(&msg->extraCerts, ctx->chain, prepend))
167 return 0;
168 } else {
169 /* make sure that at least our own signer cert is included first */
170 if (!ossl_x509_add_cert_new(&msg->extraCerts, ctx->cert, prepend))
171 return 0;
172 ossl_cmp_debug(ctx, "fallback: adding just own CMP signer cert");
173 }
174 }
175
176 /* add any additional certificates from ctx->extraCertsOut */
177 if (!ossl_x509_add_certs_new(&msg->extraCerts, ctx->extraCertsOut,
178 X509_ADD_FLAG_UP_REF | X509_ADD_FLAG_NO_DUP))
179 return 0;
180
181 /* in case extraCerts are empty list avoid empty ASN.1 sequence */
182 if (sk_X509_num(msg->extraCerts) == 0) {
183 sk_X509_free(msg->extraCerts);
184 msg->extraCerts = NULL;
185 }
186 return 1;
187 }
188
189 /*
190 * Create an X509_ALGOR structure for PasswordBasedMAC protection based on
191 * the pbm settings in the context
192 */
pbmac_algor(const OSSL_CMP_CTX * ctx)193 static X509_ALGOR *pbmac_algor(const OSSL_CMP_CTX *ctx)
194 {
195 OSSL_CRMF_PBMPARAMETER *pbm = NULL;
196 unsigned char *pbm_der = NULL;
197 int pbm_der_len;
198 ASN1_STRING *pbm_str = NULL;
199 X509_ALGOR *alg = NULL;
200
201 if (!ossl_assert(ctx != NULL))
202 return NULL;
203
204 pbm = OSSL_CRMF_pbmp_new(ctx->libctx, ctx->pbm_slen,
205 EVP_MD_get_type(ctx->pbm_owf), ctx->pbm_itercnt,
206 ctx->pbm_mac);
207 pbm_str = ASN1_STRING_new();
208 if (pbm == NULL || pbm_str == NULL)
209 goto err;
210 if ((pbm_der_len = i2d_OSSL_CRMF_PBMPARAMETER(pbm, &pbm_der)) < 0)
211 goto err;
212 if (!ASN1_STRING_set(pbm_str, pbm_der, pbm_der_len))
213 goto err;
214 alg = ossl_X509_ALGOR_from_nid(NID_id_PasswordBasedMAC,
215 V_ASN1_SEQUENCE, pbm_str);
216 err:
217 if (alg == NULL)
218 ASN1_STRING_free(pbm_str);
219 OPENSSL_free(pbm_der);
220 OSSL_CRMF_PBMPARAMETER_free(pbm);
221 return alg;
222 }
223
set_senderKID(const OSSL_CMP_CTX * ctx,OSSL_CMP_MSG * msg,const ASN1_OCTET_STRING * id)224 static int set_senderKID(const OSSL_CMP_CTX *ctx, OSSL_CMP_MSG *msg,
225 const ASN1_OCTET_STRING *id)
226 {
227 if (id == NULL)
228 id = ctx->referenceValue; /* standard for PBM, fallback for sig-based */
229 return id == NULL || ossl_cmp_hdr_set1_senderKID(msg->header, id);
230 }
231
232 /* ctx is not const just because ctx->chain may get adapted */
ossl_cmp_msg_protect(OSSL_CMP_CTX * ctx,OSSL_CMP_MSG * msg)233 int ossl_cmp_msg_protect(OSSL_CMP_CTX *ctx, OSSL_CMP_MSG *msg)
234 {
235 if (!ossl_assert(ctx != NULL && msg != NULL))
236 return 0;
237
238 /*
239 * For the case of re-protection remove pre-existing protection.
240 * Does not remove any pre-existing extraCerts.
241 */
242 X509_ALGOR_free(msg->header->protectionAlg);
243 msg->header->protectionAlg = NULL;
244 ASN1_BIT_STRING_free(msg->protection);
245 msg->protection = NULL;
246
247 if (ctx->unprotectedSend) {
248 if (!set_senderKID(ctx, msg, NULL))
249 goto err;
250 } else if (ctx->secretValue != NULL) {
251 /* use PasswordBasedMac according to 5.1.3.1 if secretValue is given */
252 if ((msg->header->protectionAlg = pbmac_algor(ctx)) == NULL)
253 goto err;
254 if (!set_senderKID(ctx, msg, NULL))
255 goto err;
256
257 /*
258 * will add any additional certificates from ctx->extraCertsOut
259 * while not needed to validate the protection certificate,
260 * the option to do this might be handy for certain use cases
261 */
262 } else if (ctx->cert != NULL && ctx->pkey != NULL) {
263 /* use MSG_SIG_ALG according to 5.1.3.3 if client cert and key given */
264
265 /* make sure that key and certificate match */
266 if (!X509_check_private_key(ctx->cert, ctx->pkey)) {
267 ERR_raise(ERR_LIB_CMP, CMP_R_CERT_AND_KEY_DO_NOT_MATCH);
268 goto err;
269 }
270
271 if ((msg->header->protectionAlg = X509_ALGOR_new()) == NULL)
272 goto err;
273 /* set senderKID to keyIdentifier of the cert according to 5.1.1 */
274 if (!set_senderKID(ctx, msg, X509_get0_subject_key_id(ctx->cert)))
275 goto err;
276
277 /*
278 * will add ctx->cert followed, if possible, by its chain built
279 * from ctx->untrusted, and then ctx->extraCertsOut
280 */
281 } else {
282 ERR_raise(ERR_LIB_CMP,
283 CMP_R_MISSING_KEY_INPUT_FOR_CREATING_PROTECTION);
284 goto err;
285 }
286 if (!ctx->unprotectedSend
287 /* protect according to msg->header->protectionAlg partly set above */
288 && ((msg->protection = ossl_cmp_calc_protection(ctx, msg)) == NULL))
289 goto err;
290
291 /*
292 * For signature-based protection add ctx->cert followed by its chain.
293 * Finally add any additional certificates from ctx->extraCertsOut;
294 * even if not needed to validate the protection
295 * the option to do this might be handy for certain use cases.
296 */
297 if (!ossl_cmp_msg_add_extraCerts(ctx, msg))
298 goto err;
299
300 /*
301 * As required by RFC 4210 section 5.1.1., if the sender name is not known
302 * to the client it set to NULL-DN. In this case for identification at least
303 * the senderKID must be set, where we took the referenceValue as fallback.
304 */
305 if (!(ossl_cmp_general_name_is_NULL_DN(msg->header->sender)
306 && msg->header->senderKID == NULL))
307 return 1;
308 ERR_raise(ERR_LIB_CMP, CMP_R_MISSING_SENDER_IDENTIFICATION);
309
310 err:
311 ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_PROTECTING_MESSAGE);
312 return 0;
313 }
314