1 /*
2 * Copyright 2007-2023 The OpenSSL Project Authors. All Rights Reserved.
3 * Copyright Nokia 2007-2019
4 * Copyright Siemens AG 2015-2019
5 *
6 * Licensed under the Apache License 2.0 (the "License"). You may not use
7 * this file except in compliance with the License. You can obtain a copy
8 * in the file LICENSE in the source distribution or at
9 * https://www.openssl.org/source/license.html
10 */
11
12 /* CMP functions for PKIMessage construction */
13
14 #include "cmp_local.h"
15
16 /* explicit #includes not strictly needed since implied by the above: */
17 #include <openssl/asn1t.h>
18 #include <openssl/cmp.h>
19 #include <openssl/crmf.h>
20 #include <openssl/err.h>
21 #include <openssl/x509.h>
22
OSSL_CMP_MSG_new(OSSL_LIB_CTX * libctx,const char * propq)23 OSSL_CMP_MSG *OSSL_CMP_MSG_new(OSSL_LIB_CTX *libctx, const char *propq)
24 {
25 OSSL_CMP_MSG *msg = NULL;
26
27 msg = (OSSL_CMP_MSG *)ASN1_item_new_ex(ASN1_ITEM_rptr(OSSL_CMP_MSG),
28 libctx, propq);
29 if (!ossl_cmp_msg_set0_libctx(msg, libctx, propq)) {
30 OSSL_CMP_MSG_free(msg);
31 msg = NULL;
32 }
33 return msg;
34 }
35
OSSL_CMP_MSG_free(OSSL_CMP_MSG * msg)36 void OSSL_CMP_MSG_free(OSSL_CMP_MSG *msg)
37 {
38 ASN1_item_free((ASN1_VALUE *)msg, ASN1_ITEM_rptr(OSSL_CMP_MSG));
39 }
40
41 /*
42 * This should only be used if the X509 object was embedded inside another
43 * asn1 object and it needs a libctx to operate.
44 * Use OSSL_CMP_MSG_new() instead if possible.
45 */
ossl_cmp_msg_set0_libctx(OSSL_CMP_MSG * msg,OSSL_LIB_CTX * libctx,const char * propq)46 int ossl_cmp_msg_set0_libctx(OSSL_CMP_MSG *msg, OSSL_LIB_CTX *libctx,
47 const char *propq)
48 {
49 if (msg != NULL) {
50 msg->libctx = libctx;
51 OPENSSL_free(msg->propq);
52 msg->propq = NULL;
53 if (propq != NULL) {
54 msg->propq = OPENSSL_strdup(propq);
55 if (msg->propq == NULL)
56 return 0;
57 }
58 }
59 return 1;
60 }
61
62
OSSL_CMP_MSG_get0_header(const OSSL_CMP_MSG * msg)63 OSSL_CMP_PKIHEADER *OSSL_CMP_MSG_get0_header(const OSSL_CMP_MSG *msg)
64 {
65 if (msg == NULL) {
66 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
67 return NULL;
68 }
69 return msg->header;
70 }
71
ossl_cmp_bodytype_to_string(int type)72 const char *ossl_cmp_bodytype_to_string(int type)
73 {
74 static const char *type_names[] = {
75 "IR", "IP", "CR", "CP", "P10CR",
76 "POPDECC", "POPDECR", "KUR", "KUP",
77 "KRR", "KRP", "RR", "RP", "CCR", "CCP",
78 "CKUANN", "CANN", "RANN", "CRLANN", "PKICONF", "NESTED",
79 "GENM", "GENP", "ERROR", "CERTCONF", "POLLREQ", "POLLREP",
80 };
81
82 if (type < 0 || type > OSSL_CMP_PKIBODY_TYPE_MAX)
83 return "illegal body type";
84 return type_names[type];
85 }
86
ossl_cmp_msg_set_bodytype(OSSL_CMP_MSG * msg,int type)87 int ossl_cmp_msg_set_bodytype(OSSL_CMP_MSG *msg, int type)
88 {
89 if (!ossl_assert(msg != NULL && msg->body != NULL))
90 return 0;
91
92 msg->body->type = type;
93 return 1;
94 }
95
OSSL_CMP_MSG_get_bodytype(const OSSL_CMP_MSG * msg)96 int OSSL_CMP_MSG_get_bodytype(const OSSL_CMP_MSG *msg)
97 {
98 if (!ossl_assert(msg != NULL && msg->body != NULL))
99 return -1;
100
101 return msg->body->type;
102 }
103
104 /* Add an extension to the referenced extension stack, which may be NULL */
add1_extension(X509_EXTENSIONS ** pexts,int nid,int crit,void * ex)105 static int add1_extension(X509_EXTENSIONS **pexts, int nid, int crit, void *ex)
106 {
107 X509_EXTENSION *ext;
108 int res;
109
110 if (!ossl_assert(pexts != NULL)) /* pointer to var must not be NULL */
111 return 0;
112
113 if ((ext = X509V3_EXT_i2d(nid, crit, ex)) == NULL)
114 return 0;
115
116 res = X509v3_add_ext(pexts, ext, 0) != NULL;
117 X509_EXTENSION_free(ext);
118 return res;
119 }
120
121 /* Add extension list to the referenced extension stack, which may be NULL */
add_extensions(STACK_OF (X509_EXTENSION)** target,const STACK_OF (X509_EXTENSION)* exts)122 static int add_extensions(STACK_OF(X509_EXTENSION) **target,
123 const STACK_OF(X509_EXTENSION) *exts)
124 {
125 int i;
126
127 if (target == NULL)
128 return 0;
129
130 for (i = 0; i < sk_X509_EXTENSION_num(exts); i++) {
131 X509_EXTENSION *ext = sk_X509_EXTENSION_value(exts, i);
132 ASN1_OBJECT *obj = X509_EXTENSION_get_object(ext);
133 int idx = X509v3_get_ext_by_OBJ(*target, obj, -1);
134
135 /* Does extension exist in target? */
136 if (idx != -1) {
137 /* Delete all extensions of same type */
138 do {
139 X509_EXTENSION_free(sk_X509_EXTENSION_delete(*target, idx));
140 idx = X509v3_get_ext_by_OBJ(*target, obj, -1);
141 } while (idx != -1);
142 }
143 if (!X509v3_add_ext(target, ext, -1))
144 return 0;
145 }
146 return 1;
147 }
148
149 /* Add a CRL revocation reason code to extension stack, which may be NULL */
add_crl_reason_extension(X509_EXTENSIONS ** pexts,int reason_code)150 static int add_crl_reason_extension(X509_EXTENSIONS **pexts, int reason_code)
151 {
152 ASN1_ENUMERATED *val = ASN1_ENUMERATED_new();
153 int res = 0;
154
155 if (val != NULL && ASN1_ENUMERATED_set(val, reason_code))
156 res = add1_extension(pexts, NID_crl_reason, 0 /* non-critical */, val);
157 ASN1_ENUMERATED_free(val);
158 return res;
159 }
160
ossl_cmp_msg_create(OSSL_CMP_CTX * ctx,int bodytype)161 OSSL_CMP_MSG *ossl_cmp_msg_create(OSSL_CMP_CTX *ctx, int bodytype)
162 {
163 OSSL_CMP_MSG *msg = NULL;
164
165 if (!ossl_assert(ctx != NULL))
166 return NULL;
167
168 if ((msg = OSSL_CMP_MSG_new(ctx->libctx, ctx->propq)) == NULL)
169 return NULL;
170 if (!ossl_cmp_hdr_init(ctx, msg->header)
171 || !ossl_cmp_msg_set_bodytype(msg, bodytype))
172 goto err;
173 if (ctx->geninfo_ITAVs != NULL
174 && !ossl_cmp_hdr_generalInfo_push1_items(msg->header,
175 ctx->geninfo_ITAVs))
176 goto err;
177
178 switch (bodytype) {
179 case OSSL_CMP_PKIBODY_IR:
180 case OSSL_CMP_PKIBODY_CR:
181 case OSSL_CMP_PKIBODY_KUR:
182 if ((msg->body->value.ir = OSSL_CRMF_MSGS_new()) == NULL)
183 goto err;
184 return msg;
185
186 case OSSL_CMP_PKIBODY_P10CR:
187 if (ctx->p10CSR == NULL) {
188 ERR_raise(ERR_LIB_CMP, CMP_R_MISSING_P10CSR);
189 goto err;
190 }
191 if ((msg->body->value.p10cr = X509_REQ_dup(ctx->p10CSR)) == NULL)
192 goto err;
193 return msg;
194
195 case OSSL_CMP_PKIBODY_IP:
196 case OSSL_CMP_PKIBODY_CP:
197 case OSSL_CMP_PKIBODY_KUP:
198 if ((msg->body->value.ip = OSSL_CMP_CERTREPMESSAGE_new()) == NULL)
199 goto err;
200 return msg;
201
202 case OSSL_CMP_PKIBODY_RR:
203 if ((msg->body->value.rr = sk_OSSL_CMP_REVDETAILS_new_null()) == NULL)
204 goto err;
205 return msg;
206 case OSSL_CMP_PKIBODY_RP:
207 if ((msg->body->value.rp = OSSL_CMP_REVREPCONTENT_new()) == NULL)
208 goto err;
209 return msg;
210
211 case OSSL_CMP_PKIBODY_CERTCONF:
212 if ((msg->body->value.certConf =
213 sk_OSSL_CMP_CERTSTATUS_new_null()) == NULL)
214 goto err;
215 return msg;
216 case OSSL_CMP_PKIBODY_PKICONF:
217 if ((msg->body->value.pkiconf = ASN1_TYPE_new()) == NULL)
218 goto err;
219 ASN1_TYPE_set(msg->body->value.pkiconf, V_ASN1_NULL, NULL);
220 return msg;
221
222 case OSSL_CMP_PKIBODY_POLLREQ:
223 if ((msg->body->value.pollReq = sk_OSSL_CMP_POLLREQ_new_null()) == NULL)
224 goto err;
225 return msg;
226 case OSSL_CMP_PKIBODY_POLLREP:
227 if ((msg->body->value.pollRep = sk_OSSL_CMP_POLLREP_new_null()) == NULL)
228 goto err;
229 return msg;
230
231 case OSSL_CMP_PKIBODY_GENM:
232 case OSSL_CMP_PKIBODY_GENP:
233 if ((msg->body->value.genm = sk_OSSL_CMP_ITAV_new_null()) == NULL)
234 goto err;
235 return msg;
236
237 case OSSL_CMP_PKIBODY_ERROR:
238 if ((msg->body->value.error = OSSL_CMP_ERRORMSGCONTENT_new()) == NULL)
239 goto err;
240 return msg;
241
242 default:
243 ERR_raise(ERR_LIB_CMP, CMP_R_UNEXPECTED_PKIBODY);
244 goto err;
245 }
246
247 err:
248 OSSL_CMP_MSG_free(msg);
249 return NULL;
250 }
251
252 #define HAS_SAN(ctx) \
253 (sk_GENERAL_NAME_num((ctx)->subjectAltNames) > 0 \
254 || OSSL_CMP_CTX_reqExtensions_have_SAN(ctx) == 1)
255
determine_subj(OSSL_CMP_CTX * ctx,int for_KUR,const X509_NAME * ref_subj)256 static const X509_NAME *determine_subj(OSSL_CMP_CTX *ctx, int for_KUR,
257 const X509_NAME *ref_subj)
258 {
259 if (ctx->subjectName != NULL)
260 return IS_NULL_DN(ctx->subjectName) ? NULL : ctx->subjectName;
261 if (ctx->p10CSR != NULL) /* first default is from any given CSR */
262 return X509_REQ_get_subject_name(ctx->p10CSR);
263 if (for_KUR || !HAS_SAN(ctx))
264 /*
265 * For KUR, copy subject from any reference cert as fallback.
266 * For IR or CR, do the same only if there is no subjectAltName.
267 */
268 return ref_subj;
269 return NULL;
270 }
271
OSSL_CMP_CTX_setup_CRM(OSSL_CMP_CTX * ctx,int for_KUR,int rid)272 OSSL_CRMF_MSG *OSSL_CMP_CTX_setup_CRM(OSSL_CMP_CTX *ctx, int for_KUR, int rid)
273 {
274 OSSL_CRMF_MSG *crm = NULL;
275 X509 *refcert = ctx->oldCert != NULL ? ctx->oldCert : ctx->cert;
276 /* refcert defaults to current client cert */
277 EVP_PKEY *rkey = ossl_cmp_ctx_get0_newPubkey(ctx);
278 STACK_OF(GENERAL_NAME) *default_sans = NULL;
279 const X509_NAME *ref_subj =
280 refcert != NULL ? X509_get_subject_name(refcert) : NULL;
281 const X509_NAME *subject = determine_subj(ctx, for_KUR, ref_subj);
282 const X509_NAME *issuer = ctx->issuer != NULL || refcert == NULL
283 ? (IS_NULL_DN(ctx->issuer) ? NULL : ctx->issuer)
284 : X509_get_issuer_name(refcert);
285 int crit = ctx->setSubjectAltNameCritical || subject == NULL;
286 /* RFC5280: subjectAltName MUST be critical if subject is null */
287 X509_EXTENSIONS *exts = NULL;
288
289 if (rkey == NULL) {
290 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
291 ERR_raise(ERR_LIB_CMP, CMP_R_MISSING_PUBLIC_KEY);
292 return NULL;
293 #endif
294 }
295 if (for_KUR && refcert == NULL && ctx->p10CSR == NULL) {
296 ERR_raise(ERR_LIB_CMP, CMP_R_MISSING_REFERENCE_CERT);
297 return NULL;
298 }
299 if ((crm = OSSL_CRMF_MSG_new()) == NULL)
300 return NULL;
301 if (!OSSL_CRMF_MSG_set_certReqId(crm, rid)
302 /*
303 * fill certTemplate, corresponding to CertificationRequestInfo
304 * of PKCS#10. The rkey param cannot be NULL so far -
305 * it could be NULL if centralized key creation was supported
306 */
307 || !OSSL_CRMF_CERTTEMPLATE_fill(OSSL_CRMF_MSG_get0_tmpl(crm), rkey,
308 subject, issuer, NULL /* serial */))
309 goto err;
310 if (ctx->days != 0) {
311 time_t now = time(NULL);
312 ASN1_TIME *notBefore = ASN1_TIME_adj(NULL, now, 0, 0);
313 ASN1_TIME *notAfter = ASN1_TIME_adj(NULL, now, ctx->days, 0);
314
315 if (notBefore == NULL
316 || notAfter == NULL
317 || !OSSL_CRMF_MSG_set0_validity(crm, notBefore, notAfter)) {
318 ASN1_TIME_free(notBefore);
319 ASN1_TIME_free(notAfter);
320 goto err;
321 }
322 }
323
324 /* extensions */
325 if (ctx->p10CSR != NULL
326 && (exts = X509_REQ_get_extensions(ctx->p10CSR)) == NULL)
327 goto err;
328 if (!ctx->SubjectAltName_nodefault && !HAS_SAN(ctx) && refcert != NULL
329 && (default_sans = X509V3_get_d2i(X509_get0_extensions(refcert),
330 NID_subject_alt_name, NULL, NULL))
331 != NULL
332 && !add1_extension(&exts, NID_subject_alt_name, crit, default_sans))
333 goto err;
334 if (ctx->reqExtensions != NULL /* augment/override existing ones */
335 && !add_extensions(&exts, ctx->reqExtensions))
336 goto err;
337 if (sk_GENERAL_NAME_num(ctx->subjectAltNames) > 0
338 && !add1_extension(&exts, NID_subject_alt_name,
339 crit, ctx->subjectAltNames))
340 goto err;
341 if (ctx->policies != NULL
342 && !add1_extension(&exts, NID_certificate_policies,
343 ctx->setPoliciesCritical, ctx->policies))
344 goto err;
345 if (!OSSL_CRMF_MSG_set0_extensions(crm, exts))
346 goto err;
347 exts = NULL;
348 /* end fill certTemplate, now set any controls */
349
350 /* for KUR, set OldCertId according to D.6 */
351 if (for_KUR && refcert != NULL) {
352 OSSL_CRMF_CERTID *cid =
353 OSSL_CRMF_CERTID_gen(X509_get_issuer_name(refcert),
354 X509_get0_serialNumber(refcert));
355 int ret;
356
357 if (cid == NULL)
358 goto err;
359 ret = OSSL_CRMF_MSG_set1_regCtrl_oldCertID(crm, cid);
360 OSSL_CRMF_CERTID_free(cid);
361 if (ret == 0)
362 goto err;
363 }
364
365 goto end;
366
367 err:
368 OSSL_CRMF_MSG_free(crm);
369 crm = NULL;
370
371 end:
372 sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
373 sk_GENERAL_NAME_pop_free(default_sans, GENERAL_NAME_free);
374 return crm;
375 }
376
ossl_cmp_certreq_new(OSSL_CMP_CTX * ctx,int type,const OSSL_CRMF_MSG * crm)377 OSSL_CMP_MSG *ossl_cmp_certreq_new(OSSL_CMP_CTX *ctx, int type,
378 const OSSL_CRMF_MSG *crm)
379 {
380 OSSL_CMP_MSG *msg;
381 OSSL_CRMF_MSG *local_crm = NULL;
382
383 if (!ossl_assert(ctx != NULL))
384 return NULL;
385
386 if (type != OSSL_CMP_PKIBODY_IR && type != OSSL_CMP_PKIBODY_CR
387 && type != OSSL_CMP_PKIBODY_KUR && type != OSSL_CMP_PKIBODY_P10CR) {
388 ERR_raise(ERR_LIB_CMP, CMP_R_INVALID_ARGS);
389 return NULL;
390 }
391 if (type == OSSL_CMP_PKIBODY_P10CR && crm != NULL) {
392 ERR_raise(ERR_LIB_CMP, CMP_R_INVALID_ARGS);
393 return NULL;
394 }
395
396 if ((msg = ossl_cmp_msg_create(ctx, type)) == NULL)
397 goto err;
398
399 /* header */
400 if (ctx->implicitConfirm && !ossl_cmp_hdr_set_implicitConfirm(msg->header))
401 goto err;
402
403 /* body */
404 /* For P10CR the content has already been set in OSSL_CMP_MSG_create */
405 if (type != OSSL_CMP_PKIBODY_P10CR) {
406 EVP_PKEY *privkey = OSSL_CMP_CTX_get0_newPkey(ctx, 1);
407
408 /* privkey is ctx->newPkey (if private, else NULL) or ctx->pkey */
409 if (ctx->popoMethod >= OSSL_CRMF_POPO_SIGNATURE && privkey == NULL) {
410 ERR_raise(ERR_LIB_CMP, CMP_R_MISSING_PRIVATE_KEY_FOR_POPO);
411 goto err;
412 }
413 if (crm == NULL) {
414 local_crm = OSSL_CMP_CTX_setup_CRM(ctx,
415 type == OSSL_CMP_PKIBODY_KUR,
416 OSSL_CMP_CERTREQID);
417 if (local_crm == NULL
418 || !OSSL_CRMF_MSG_create_popo(ctx->popoMethod, local_crm,
419 privkey, ctx->digest,
420 ctx->libctx, ctx->propq))
421 goto err;
422 } else {
423 if ((local_crm = OSSL_CRMF_MSG_dup(crm)) == NULL)
424 goto err;
425 }
426
427 /* value.ir is same for cr and kur */
428 if (!sk_OSSL_CRMF_MSG_push(msg->body->value.ir, local_crm))
429 goto err;
430 local_crm = NULL;
431 }
432
433 if (!ossl_cmp_msg_protect(ctx, msg))
434 goto err;
435
436 return msg;
437
438 err:
439 ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_CERTREQ);
440 OSSL_CRMF_MSG_free(local_crm);
441 OSSL_CMP_MSG_free(msg);
442 return NULL;
443 }
444
ossl_cmp_certrep_new(OSSL_CMP_CTX * ctx,int bodytype,int certReqId,const OSSL_CMP_PKISI * si,X509 * cert,const X509 * encryption_recip,STACK_OF (X509)* chain,STACK_OF (X509)* caPubs,int unprotectedErrors)445 OSSL_CMP_MSG *ossl_cmp_certrep_new(OSSL_CMP_CTX *ctx, int bodytype,
446 int certReqId, const OSSL_CMP_PKISI *si,
447 X509 *cert, const X509 *encryption_recip,
448 STACK_OF(X509) *chain, STACK_OF(X509) *caPubs,
449 int unprotectedErrors)
450 {
451 OSSL_CMP_MSG *msg = NULL;
452 OSSL_CMP_CERTREPMESSAGE *repMsg = NULL;
453 OSSL_CMP_CERTRESPONSE *resp = NULL;
454 int status = OSSL_CMP_PKISTATUS_unspecified;
455
456 if (!ossl_assert(ctx != NULL && si != NULL))
457 return NULL;
458
459 if ((msg = ossl_cmp_msg_create(ctx, bodytype)) == NULL)
460 goto err;
461 repMsg = msg->body->value.ip; /* value.ip is same for cp and kup */
462
463 /* header */
464 if (ctx->implicitConfirm && !ossl_cmp_hdr_set_implicitConfirm(msg->header))
465 goto err;
466
467 /* body */
468 if ((resp = OSSL_CMP_CERTRESPONSE_new()) == NULL)
469 goto err;
470 OSSL_CMP_PKISI_free(resp->status);
471 if ((resp->status = OSSL_CMP_PKISI_dup(si)) == NULL
472 || !ASN1_INTEGER_set(resp->certReqId, certReqId))
473 goto err;
474
475 status = ossl_cmp_pkisi_get_status(resp->status);
476 if (status != OSSL_CMP_PKISTATUS_rejection
477 && status != OSSL_CMP_PKISTATUS_waiting && cert != NULL) {
478 if (encryption_recip != NULL) {
479 ERR_raise(ERR_LIB_CMP, ERR_R_UNSUPPORTED);
480 goto err;
481 }
482
483 if ((resp->certifiedKeyPair = OSSL_CMP_CERTIFIEDKEYPAIR_new())
484 == NULL)
485 goto err;
486 resp->certifiedKeyPair->certOrEncCert->type =
487 OSSL_CMP_CERTORENCCERT_CERTIFICATE;
488 if (!X509_up_ref(cert))
489 goto err;
490 resp->certifiedKeyPair->certOrEncCert->value.certificate = cert;
491 }
492
493 if (!sk_OSSL_CMP_CERTRESPONSE_push(repMsg->response, resp))
494 goto err;
495 resp = NULL;
496
497 if (bodytype == OSSL_CMP_PKIBODY_IP && caPubs != NULL
498 && (repMsg->caPubs = X509_chain_up_ref(caPubs)) == NULL)
499 goto err;
500 if (sk_X509_num(chain) > 0
501 && !ossl_x509_add_certs_new(&msg->extraCerts, chain,
502 X509_ADD_FLAG_UP_REF | X509_ADD_FLAG_NO_DUP))
503 goto err;
504
505 if (!unprotectedErrors
506 || ossl_cmp_pkisi_get_status(si) != OSSL_CMP_PKISTATUS_rejection)
507 if (!ossl_cmp_msg_protect(ctx, msg))
508 goto err;
509
510 return msg;
511
512 err:
513 ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_CERTREP);
514 OSSL_CMP_CERTRESPONSE_free(resp);
515 OSSL_CMP_MSG_free(msg);
516 return NULL;
517 }
518
ossl_cmp_rr_new(OSSL_CMP_CTX * ctx)519 OSSL_CMP_MSG *ossl_cmp_rr_new(OSSL_CMP_CTX *ctx)
520 {
521 OSSL_CMP_MSG *msg = NULL;
522 OSSL_CMP_REVDETAILS *rd;
523 int ret;
524
525 if (!ossl_assert(ctx != NULL && (ctx->oldCert != NULL
526 || ctx->p10CSR != NULL)))
527 return NULL;
528
529 if ((rd = OSSL_CMP_REVDETAILS_new()) == NULL)
530 goto err;
531
532 /* Fill the template from the contents of the certificate to be revoked */
533 ret = ctx->oldCert != NULL
534 ? OSSL_CRMF_CERTTEMPLATE_fill(rd->certDetails,
535 NULL /* pubkey would be redundant */,
536 NULL /* subject would be redundant */,
537 X509_get_issuer_name(ctx->oldCert),
538 X509_get0_serialNumber(ctx->oldCert))
539 : OSSL_CRMF_CERTTEMPLATE_fill(rd->certDetails,
540 X509_REQ_get0_pubkey(ctx->p10CSR),
541 X509_REQ_get_subject_name(ctx->p10CSR),
542 NULL, NULL);
543 if (!ret)
544 goto err;
545
546 /* revocation reason code is optional */
547 if (ctx->revocationReason != CRL_REASON_NONE
548 && !add_crl_reason_extension(&rd->crlEntryDetails,
549 ctx->revocationReason))
550 goto err;
551
552 if ((msg = ossl_cmp_msg_create(ctx, OSSL_CMP_PKIBODY_RR)) == NULL)
553 goto err;
554
555 if (!sk_OSSL_CMP_REVDETAILS_push(msg->body->value.rr, rd))
556 goto err;
557 rd = NULL;
558 /* Revocation Passphrase according to section 5.3.19.9 could be set here */
559
560 if (!ossl_cmp_msg_protect(ctx, msg))
561 goto err;
562
563 return msg;
564
565 err:
566 ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_RR);
567 OSSL_CMP_MSG_free(msg);
568 OSSL_CMP_REVDETAILS_free(rd);
569 return NULL;
570 }
571
ossl_cmp_rp_new(OSSL_CMP_CTX * ctx,const OSSL_CMP_PKISI * si,const OSSL_CRMF_CERTID * cid,int unprotectedErrors)572 OSSL_CMP_MSG *ossl_cmp_rp_new(OSSL_CMP_CTX *ctx, const OSSL_CMP_PKISI *si,
573 const OSSL_CRMF_CERTID *cid, int unprotectedErrors)
574 {
575 OSSL_CMP_REVREPCONTENT *rep = NULL;
576 OSSL_CMP_PKISI *si1 = NULL;
577 OSSL_CRMF_CERTID *cid_copy = NULL;
578 OSSL_CMP_MSG *msg = NULL;
579
580 if (!ossl_assert(ctx != NULL && si != NULL))
581 return NULL;
582
583 if ((msg = ossl_cmp_msg_create(ctx, OSSL_CMP_PKIBODY_RP)) == NULL)
584 goto err;
585 rep = msg->body->value.rp;
586
587 if ((si1 = OSSL_CMP_PKISI_dup(si)) == NULL
588 || !sk_OSSL_CMP_PKISI_push(rep->status, si1))
589 goto err;
590
591 si1 = NULL; /* ownership transferred to rep->status */
592
593 if ((rep->revCerts = sk_OSSL_CRMF_CERTID_new_null()) == NULL)
594 goto err;
595 if (cid != NULL) {
596 if ((cid_copy = OSSL_CRMF_CERTID_dup(cid)) == NULL
597 || !sk_OSSL_CRMF_CERTID_push(rep->revCerts, cid_copy))
598 goto err;
599
600 cid_copy = NULL; /* ownership transferred to rep->revCerts */
601 }
602
603 if (!unprotectedErrors
604 || ossl_cmp_pkisi_get_status(si) != OSSL_CMP_PKISTATUS_rejection)
605 if (!ossl_cmp_msg_protect(ctx, msg))
606 goto err;
607
608 return msg;
609
610 err:
611 ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_RP);
612 OSSL_CMP_PKISI_free(si1);
613 OSSL_CRMF_CERTID_free(cid_copy);
614 OSSL_CMP_MSG_free(msg);
615 return NULL;
616 }
617
ossl_cmp_pkiconf_new(OSSL_CMP_CTX * ctx)618 OSSL_CMP_MSG *ossl_cmp_pkiconf_new(OSSL_CMP_CTX *ctx)
619 {
620 OSSL_CMP_MSG *msg;
621
622 if (!ossl_assert(ctx != NULL))
623 return NULL;
624
625 if ((msg = ossl_cmp_msg_create(ctx, OSSL_CMP_PKIBODY_PKICONF)) == NULL)
626 goto err;
627 if (ossl_cmp_msg_protect(ctx, msg))
628 return msg;
629
630 err:
631 ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_PKICONF);
632 OSSL_CMP_MSG_free(msg);
633 return NULL;
634 }
635
ossl_cmp_msg_gen_push0_ITAV(OSSL_CMP_MSG * msg,OSSL_CMP_ITAV * itav)636 int ossl_cmp_msg_gen_push0_ITAV(OSSL_CMP_MSG *msg, OSSL_CMP_ITAV *itav)
637 {
638 int bodytype;
639
640 if (!ossl_assert(msg != NULL && itav != NULL))
641 return 0;
642
643 bodytype = OSSL_CMP_MSG_get_bodytype(msg);
644 if (bodytype != OSSL_CMP_PKIBODY_GENM
645 && bodytype != OSSL_CMP_PKIBODY_GENP) {
646 ERR_raise(ERR_LIB_CMP, CMP_R_INVALID_ARGS);
647 return 0;
648 }
649
650 /* value.genp has the same structure, so this works for genp as well */
651 return OSSL_CMP_ITAV_push0_stack_item(&msg->body->value.genm, itav);
652 }
653
ossl_cmp_msg_gen_push1_ITAVs(OSSL_CMP_MSG * msg,const STACK_OF (OSSL_CMP_ITAV)* itavs)654 int ossl_cmp_msg_gen_push1_ITAVs(OSSL_CMP_MSG *msg,
655 const STACK_OF(OSSL_CMP_ITAV) *itavs)
656 {
657 int i;
658 OSSL_CMP_ITAV *itav = NULL;
659
660 if (!ossl_assert(msg != NULL))
661 return 0;
662
663 for (i = 0; i < sk_OSSL_CMP_ITAV_num(itavs); i++) {
664 itav = OSSL_CMP_ITAV_dup(sk_OSSL_CMP_ITAV_value(itavs, i));
665 if (itav == NULL
666 || !ossl_cmp_msg_gen_push0_ITAV(msg, itav)) {
667 OSSL_CMP_ITAV_free(itav);
668 return 0;
669 }
670 }
671 return 1;
672 }
673
674 /*
675 * Creates a new General Message/Response with an empty itav stack
676 * returns a pointer to the PKIMessage on success, NULL on error
677 */
gen_new(OSSL_CMP_CTX * ctx,const STACK_OF (OSSL_CMP_ITAV)* itavs,int body_type,int err_code)678 static OSSL_CMP_MSG *gen_new(OSSL_CMP_CTX *ctx,
679 const STACK_OF(OSSL_CMP_ITAV) *itavs,
680 int body_type, int err_code)
681 {
682 OSSL_CMP_MSG *msg = NULL;
683
684 if (!ossl_assert(ctx != NULL))
685 return NULL;
686
687 if ((msg = ossl_cmp_msg_create(ctx, body_type)) == NULL)
688 return NULL;
689
690 if (itavs != NULL && !ossl_cmp_msg_gen_push1_ITAVs(msg, itavs))
691 goto err;
692
693 if (!ossl_cmp_msg_protect(ctx, msg))
694 goto err;
695
696 return msg;
697
698 err:
699 ERR_raise(ERR_LIB_CMP, err_code);
700 OSSL_CMP_MSG_free(msg);
701 return NULL;
702 }
703
ossl_cmp_genm_new(OSSL_CMP_CTX * ctx)704 OSSL_CMP_MSG *ossl_cmp_genm_new(OSSL_CMP_CTX *ctx)
705 {
706 return gen_new(ctx, ctx->genm_ITAVs,
707 OSSL_CMP_PKIBODY_GENM, CMP_R_ERROR_CREATING_GENM);
708 }
709
ossl_cmp_genp_new(OSSL_CMP_CTX * ctx,const STACK_OF (OSSL_CMP_ITAV)* itavs)710 OSSL_CMP_MSG *ossl_cmp_genp_new(OSSL_CMP_CTX *ctx,
711 const STACK_OF(OSSL_CMP_ITAV) *itavs)
712 {
713 return gen_new(ctx, itavs,
714 OSSL_CMP_PKIBODY_GENP, CMP_R_ERROR_CREATING_GENP);
715 }
716
ossl_cmp_error_new(OSSL_CMP_CTX * ctx,const OSSL_CMP_PKISI * si,int64_t errorCode,const char * details,int unprotected)717 OSSL_CMP_MSG *ossl_cmp_error_new(OSSL_CMP_CTX *ctx, const OSSL_CMP_PKISI *si,
718 int64_t errorCode, const char *details,
719 int unprotected)
720 {
721 OSSL_CMP_MSG *msg = NULL;
722 const char *lib = NULL, *reason = NULL;
723 OSSL_CMP_PKIFREETEXT *ft;
724
725 if (!ossl_assert(ctx != NULL && si != NULL))
726 return NULL;
727
728 if ((msg = ossl_cmp_msg_create(ctx, OSSL_CMP_PKIBODY_ERROR)) == NULL)
729 goto err;
730
731 OSSL_CMP_PKISI_free(msg->body->value.error->pKIStatusInfo);
732 if ((msg->body->value.error->pKIStatusInfo = OSSL_CMP_PKISI_dup(si))
733 == NULL)
734 goto err;
735 if ((msg->body->value.error->errorCode = ASN1_INTEGER_new()) == NULL)
736 goto err;
737 if (!ASN1_INTEGER_set_int64(msg->body->value.error->errorCode, errorCode))
738 goto err;
739 if (errorCode > 0
740 && (uint64_t)errorCode < ((uint64_t)ERR_SYSTEM_FLAG << 1)) {
741 lib = ERR_lib_error_string((unsigned long)errorCode);
742 reason = ERR_reason_error_string((unsigned long)errorCode);
743 }
744 if (lib != NULL || reason != NULL || details != NULL) {
745 if ((ft = sk_ASN1_UTF8STRING_new_null()) == NULL)
746 goto err;
747 msg->body->value.error->errorDetails = ft;
748 if (lib != NULL && *lib != '\0'
749 && !ossl_cmp_sk_ASN1_UTF8STRING_push_str(ft, lib, -1))
750 goto err;
751 if (reason != NULL && *reason != '\0'
752 && !ossl_cmp_sk_ASN1_UTF8STRING_push_str(ft, reason, -1))
753 goto err;
754 if (details != NULL
755 && !ossl_cmp_sk_ASN1_UTF8STRING_push_str(ft, details, -1))
756 goto err;
757 }
758
759 if (!unprotected && !ossl_cmp_msg_protect(ctx, msg))
760 goto err;
761 return msg;
762
763 err:
764 ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_ERROR);
765 OSSL_CMP_MSG_free(msg);
766 return NULL;
767 }
768
769 /*
770 * Set the certHash field of a OSSL_CMP_CERTSTATUS structure.
771 * This is used in the certConf message, for example,
772 * to confirm that the certificate was received successfully.
773 */
ossl_cmp_certstatus_set0_certHash(OSSL_CMP_CERTSTATUS * certStatus,ASN1_OCTET_STRING * hash)774 int ossl_cmp_certstatus_set0_certHash(OSSL_CMP_CERTSTATUS *certStatus,
775 ASN1_OCTET_STRING *hash)
776 {
777 if (!ossl_assert(certStatus != NULL))
778 return 0;
779 ASN1_OCTET_STRING_free(certStatus->certHash);
780 certStatus->certHash = hash;
781 return 1;
782 }
783
ossl_cmp_certConf_new(OSSL_CMP_CTX * ctx,int certReqId,int fail_info,const char * text)784 OSSL_CMP_MSG *ossl_cmp_certConf_new(OSSL_CMP_CTX *ctx, int certReqId,
785 int fail_info, const char *text)
786 {
787 OSSL_CMP_MSG *msg = NULL;
788 OSSL_CMP_CERTSTATUS *certStatus = NULL;
789 ASN1_OCTET_STRING *certHash = NULL;
790 OSSL_CMP_PKISI *sinfo;
791
792 if (!ossl_assert(ctx != NULL && ctx->newCert != NULL
793 && (certReqId == OSSL_CMP_CERTREQID
794 || certReqId == OSSL_CMP_CERTREQID_NONE)))
795 return NULL;
796
797 if ((unsigned)fail_info > OSSL_CMP_PKIFAILUREINFO_MAX_BIT_PATTERN) {
798 ERR_raise(ERR_LIB_CMP, CMP_R_FAIL_INFO_OUT_OF_RANGE);
799 return NULL;
800 }
801
802 if ((msg = ossl_cmp_msg_create(ctx, OSSL_CMP_PKIBODY_CERTCONF)) == NULL)
803 goto err;
804
805 if ((certStatus = OSSL_CMP_CERTSTATUS_new()) == NULL)
806 goto err;
807 /* consume certStatus into msg right away so it gets deallocated with msg */
808 if (sk_OSSL_CMP_CERTSTATUS_push(msg->body->value.certConf, certStatus) < 1) {
809 OSSL_CMP_CERTSTATUS_free(certStatus);
810 goto err;
811 }
812
813 /* set the ID of the certReq */
814 if (!ASN1_INTEGER_set(certStatus->certReqId, certReqId))
815 goto err;
816 /*
817 * The hash of the certificate, using the same hash algorithm
818 * as is used to create and verify the certificate signature.
819 * If not available, a default hash algorithm is used.
820 */
821 if ((certHash = X509_digest_sig(ctx->newCert, NULL, NULL)) == NULL)
822 goto err;
823
824 if (!ossl_cmp_certstatus_set0_certHash(certStatus, certHash))
825 goto err;
826 certHash = NULL;
827 /*
828 * For any particular CertStatus, omission of the statusInfo field
829 * indicates ACCEPTANCE of the specified certificate. Alternatively,
830 * explicit status details (with respect to acceptance or rejection) MAY
831 * be provided in the statusInfo field, perhaps for auditing purposes at
832 * the CA/RA.
833 */
834 sinfo = fail_info != 0 ?
835 OSSL_CMP_STATUSINFO_new(OSSL_CMP_PKISTATUS_rejection, fail_info, text) :
836 OSSL_CMP_STATUSINFO_new(OSSL_CMP_PKISTATUS_accepted, 0, text);
837 if (sinfo == NULL)
838 goto err;
839 certStatus->statusInfo = sinfo;
840
841 if (!ossl_cmp_msg_protect(ctx, msg))
842 goto err;
843
844 return msg;
845
846 err:
847 ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_CERTCONF);
848 OSSL_CMP_MSG_free(msg);
849 ASN1_OCTET_STRING_free(certHash);
850 return NULL;
851 }
852
ossl_cmp_pollReq_new(OSSL_CMP_CTX * ctx,int crid)853 OSSL_CMP_MSG *ossl_cmp_pollReq_new(OSSL_CMP_CTX *ctx, int crid)
854 {
855 OSSL_CMP_MSG *msg = NULL;
856 OSSL_CMP_POLLREQ *preq = NULL;
857
858 if (!ossl_assert(ctx != NULL))
859 return NULL;
860
861 if ((msg = ossl_cmp_msg_create(ctx, OSSL_CMP_PKIBODY_POLLREQ)) == NULL)
862 goto err;
863
864 if ((preq = OSSL_CMP_POLLREQ_new()) == NULL
865 || !ASN1_INTEGER_set(preq->certReqId, crid)
866 || !sk_OSSL_CMP_POLLREQ_push(msg->body->value.pollReq, preq))
867 goto err;
868
869 preq = NULL;
870 if (!ossl_cmp_msg_protect(ctx, msg))
871 goto err;
872
873 return msg;
874
875 err:
876 ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_POLLREQ);
877 OSSL_CMP_POLLREQ_free(preq);
878 OSSL_CMP_MSG_free(msg);
879 return NULL;
880 }
881
ossl_cmp_pollRep_new(OSSL_CMP_CTX * ctx,int crid,int64_t poll_after)882 OSSL_CMP_MSG *ossl_cmp_pollRep_new(OSSL_CMP_CTX *ctx, int crid,
883 int64_t poll_after)
884 {
885 OSSL_CMP_MSG *msg;
886 OSSL_CMP_POLLREP *prep;
887
888 if (!ossl_assert(ctx != NULL))
889 return NULL;
890
891 if ((msg = ossl_cmp_msg_create(ctx, OSSL_CMP_PKIBODY_POLLREP)) == NULL)
892 goto err;
893 if ((prep = OSSL_CMP_POLLREP_new()) == NULL)
894 goto err;
895 if (!sk_OSSL_CMP_POLLREP_push(msg->body->value.pollRep, prep))
896 goto err;
897 if (!ASN1_INTEGER_set(prep->certReqId, crid))
898 goto err;
899 if (!ASN1_INTEGER_set_int64(prep->checkAfter, poll_after))
900 goto err;
901
902 if (!ossl_cmp_msg_protect(ctx, msg))
903 goto err;
904 return msg;
905
906 err:
907 ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_POLLREP);
908 OSSL_CMP_MSG_free(msg);
909 return NULL;
910 }
911
912 /*-
913 * returns the status field of the RevRepContent with the given
914 * request/sequence id inside a revocation response.
915 * RevRepContent has the revocation statuses in same order as they were sent in
916 * RevReqContent.
917 * returns NULL on error
918 */
919 OSSL_CMP_PKISI *
ossl_cmp_revrepcontent_get_pkisi(OSSL_CMP_REVREPCONTENT * rrep,int rsid)920 ossl_cmp_revrepcontent_get_pkisi(OSSL_CMP_REVREPCONTENT *rrep, int rsid)
921 {
922 OSSL_CMP_PKISI *status;
923
924 if (!ossl_assert(rrep != NULL))
925 return NULL;
926
927 if ((status = sk_OSSL_CMP_PKISI_value(rrep->status, rsid)) != NULL)
928 return status;
929
930 ERR_raise(ERR_LIB_CMP, CMP_R_PKISTATUSINFO_NOT_FOUND);
931 return NULL;
932 }
933
934 /*
935 * returns the CertId field in the revCerts part of the RevRepContent
936 * with the given request/sequence id inside a revocation response.
937 * RevRepContent has the CertIds in same order as they were sent in
938 * RevReqContent.
939 * returns NULL on error
940 */
941 OSSL_CRMF_CERTID *
ossl_cmp_revrepcontent_get_CertId(OSSL_CMP_REVREPCONTENT * rrep,int rsid)942 ossl_cmp_revrepcontent_get_CertId(OSSL_CMP_REVREPCONTENT *rrep, int rsid)
943 {
944 OSSL_CRMF_CERTID *cid = NULL;
945
946 if (!ossl_assert(rrep != NULL))
947 return NULL;
948
949 if ((cid = sk_OSSL_CRMF_CERTID_value(rrep->revCerts, rsid)) != NULL)
950 return cid;
951
952 ERR_raise(ERR_LIB_CMP, CMP_R_CERTID_NOT_FOUND);
953 return NULL;
954 }
955
suitable_rid(const ASN1_INTEGER * certReqId,int rid)956 static int suitable_rid(const ASN1_INTEGER *certReqId, int rid)
957 {
958 int trid;
959
960 if (rid == OSSL_CMP_CERTREQID_NONE)
961 return 1;
962
963 trid = ossl_cmp_asn1_get_int(certReqId);
964
965 if (trid == OSSL_CMP_CERTREQID_NONE) {
966 ERR_raise(ERR_LIB_CMP, CMP_R_BAD_REQUEST_ID);
967 return 0;
968 }
969 return rid == trid;
970 }
971
972 /*
973 * returns a pointer to the PollResponse with the given CertReqId
974 * (or the first one in case -1) inside a PollRepContent
975 * returns NULL on error or if no suitable PollResponse available
976 */
977 OSSL_CMP_POLLREP *
ossl_cmp_pollrepcontent_get0_pollrep(const OSSL_CMP_POLLREPCONTENT * prc,int rid)978 ossl_cmp_pollrepcontent_get0_pollrep(const OSSL_CMP_POLLREPCONTENT *prc,
979 int rid)
980 {
981 OSSL_CMP_POLLREP *pollRep = NULL;
982 int i;
983
984 if (!ossl_assert(prc != NULL))
985 return NULL;
986
987 for (i = 0; i < sk_OSSL_CMP_POLLREP_num(prc); i++) {
988 pollRep = sk_OSSL_CMP_POLLREP_value(prc, i);
989 if (suitable_rid(pollRep->certReqId, rid))
990 return pollRep;
991 }
992
993 ERR_raise_data(ERR_LIB_CMP, CMP_R_CERTRESPONSE_NOT_FOUND,
994 "expected certReqId = %d", rid);
995 return NULL;
996 }
997
998 /*
999 * returns a pointer to the CertResponse with the given CertReqId
1000 * (or the first one in case -1) inside a CertRepMessage
1001 * returns NULL on error or if no suitable CertResponse available
1002 */
1003 OSSL_CMP_CERTRESPONSE *
ossl_cmp_certrepmessage_get0_certresponse(const OSSL_CMP_CERTREPMESSAGE * crm,int rid)1004 ossl_cmp_certrepmessage_get0_certresponse(const OSSL_CMP_CERTREPMESSAGE *crm,
1005 int rid)
1006 {
1007 OSSL_CMP_CERTRESPONSE *crep = NULL;
1008 int i;
1009
1010 if (!ossl_assert(crm != NULL && crm->response != NULL))
1011 return NULL;
1012
1013 for (i = 0; i < sk_OSSL_CMP_CERTRESPONSE_num(crm->response); i++) {
1014 crep = sk_OSSL_CMP_CERTRESPONSE_value(crm->response, i);
1015 if (suitable_rid(crep->certReqId, rid))
1016 return crep;
1017 }
1018
1019 ERR_raise_data(ERR_LIB_CMP, CMP_R_CERTRESPONSE_NOT_FOUND,
1020 "expected certReqId = %d", rid);
1021 return NULL;
1022 }
1023
1024 /*-
1025 * Retrieve the newly enrolled certificate from the given certResponse crep.
1026 * Uses libctx and propq from ctx, in case of indirect POPO also private key.
1027 * Returns a pointer to a copy of the found certificate, or NULL if not found.
1028 */
ossl_cmp_certresponse_get1_cert(const OSSL_CMP_CTX * ctx,const OSSL_CMP_CERTRESPONSE * crep)1029 X509 *ossl_cmp_certresponse_get1_cert(const OSSL_CMP_CTX *ctx,
1030 const OSSL_CMP_CERTRESPONSE *crep)
1031 {
1032 OSSL_CMP_CERTORENCCERT *coec;
1033 X509 *crt = NULL;
1034 EVP_PKEY *pkey;
1035
1036 if (!ossl_assert(crep != NULL && ctx != NULL))
1037 return NULL;
1038
1039 if (crep->certifiedKeyPair
1040 && (coec = crep->certifiedKeyPair->certOrEncCert) != NULL) {
1041 switch (coec->type) {
1042 case OSSL_CMP_CERTORENCCERT_CERTIFICATE:
1043 crt = X509_dup(coec->value.certificate);
1044 break;
1045 case OSSL_CMP_CERTORENCCERT_ENCRYPTEDCERT:
1046 /* cert encrypted for indirect PoP; RFC 4210, 5.2.8.2 */
1047 pkey = OSSL_CMP_CTX_get0_newPkey(ctx, 1);
1048 /* pkey is ctx->newPkey (if private, else NULL) or ctx->pkey */
1049 if (pkey == NULL) {
1050 ERR_raise(ERR_LIB_CMP, CMP_R_MISSING_PRIVATE_KEY);
1051 return NULL;
1052 }
1053 crt =
1054 OSSL_CRMF_ENCRYPTEDVALUE_get1_encCert(coec->value.encryptedCert,
1055 ctx->libctx, ctx->propq,
1056 pkey);
1057 break;
1058 default:
1059 ERR_raise(ERR_LIB_CMP, CMP_R_UNKNOWN_CERT_TYPE);
1060 return NULL;
1061 }
1062 }
1063 if (crt == NULL)
1064 ERR_raise(ERR_LIB_CMP, CMP_R_CERTIFICATE_NOT_FOUND);
1065 else
1066 (void)ossl_x509_set0_libctx(crt, ctx->libctx, ctx->propq);
1067 return crt;
1068 }
1069
OSSL_CMP_MSG_update_transactionID(OSSL_CMP_CTX * ctx,OSSL_CMP_MSG * msg)1070 int OSSL_CMP_MSG_update_transactionID(OSSL_CMP_CTX *ctx, OSSL_CMP_MSG *msg)
1071 {
1072 if (ctx == NULL || msg == NULL) {
1073 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
1074 return 0;
1075 }
1076 if (!ossl_cmp_hdr_set_transactionID(ctx, msg->header))
1077 return 0;
1078 return msg->header->protectionAlg == NULL
1079 || ossl_cmp_msg_protect(ctx, msg);
1080 }
1081
OSSL_CMP_MSG_update_recipNonce(OSSL_CMP_CTX * ctx,OSSL_CMP_MSG * msg)1082 int OSSL_CMP_MSG_update_recipNonce(OSSL_CMP_CTX *ctx, OSSL_CMP_MSG *msg)
1083 {
1084 if (ctx == NULL || msg == NULL || msg->header == NULL) {
1085 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
1086 return 0;
1087 }
1088 if (ctx->recipNonce == NULL) /* nothing to do for 1st msg in transaction */
1089 return 1;
1090 if (!ossl_cmp_asn1_octet_string_set1(&msg->header->recipNonce,
1091 ctx->recipNonce))
1092 return 0;
1093 return msg->header->protectionAlg == NULL || ossl_cmp_msg_protect(ctx, msg);
1094 }
1095
OSSL_CMP_MSG_read(const char * file,OSSL_LIB_CTX * libctx,const char * propq)1096 OSSL_CMP_MSG *OSSL_CMP_MSG_read(const char *file, OSSL_LIB_CTX *libctx,
1097 const char *propq)
1098 {
1099 OSSL_CMP_MSG *msg;
1100 BIO *bio = NULL;
1101
1102 if (file == NULL) {
1103 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
1104 return NULL;
1105 }
1106
1107 msg = OSSL_CMP_MSG_new(libctx, propq);
1108 if (msg == NULL){
1109 ERR_raise(ERR_LIB_CMP, ERR_R_MALLOC_FAILURE);
1110 return NULL;
1111 }
1112
1113 if ((bio = BIO_new_file(file, "rb")) == NULL
1114 || d2i_OSSL_CMP_MSG_bio(bio, &msg) == NULL) {
1115 OSSL_CMP_MSG_free(msg);
1116 msg = NULL;
1117 }
1118 BIO_free(bio);
1119 return msg;
1120 }
1121
OSSL_CMP_MSG_write(const char * file,const OSSL_CMP_MSG * msg)1122 int OSSL_CMP_MSG_write(const char *file, const OSSL_CMP_MSG *msg)
1123 {
1124 BIO *bio;
1125 int res;
1126
1127 if (file == NULL || msg == NULL) {
1128 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
1129 return -1;
1130 }
1131
1132 bio = BIO_new_file(file, "wb");
1133 if (bio == NULL)
1134 return -2;
1135 res = i2d_OSSL_CMP_MSG_bio(bio, msg);
1136 BIO_free(bio);
1137 return res;
1138 }
1139
d2i_OSSL_CMP_MSG(OSSL_CMP_MSG ** msg,const unsigned char ** in,long len)1140 OSSL_CMP_MSG *d2i_OSSL_CMP_MSG(OSSL_CMP_MSG **msg, const unsigned char **in,
1141 long len)
1142 {
1143 OSSL_LIB_CTX *libctx = NULL;
1144 const char *propq = NULL;
1145
1146 if (msg != NULL && *msg != NULL) {
1147 libctx = (*msg)->libctx;
1148 propq = (*msg)->propq;
1149 }
1150
1151 return (OSSL_CMP_MSG *)ASN1_item_d2i_ex((ASN1_VALUE **)msg, in, len,
1152 ASN1_ITEM_rptr(OSSL_CMP_MSG),
1153 libctx, propq);
1154 }
1155
i2d_OSSL_CMP_MSG(const OSSL_CMP_MSG * msg,unsigned char ** out)1156 int i2d_OSSL_CMP_MSG(const OSSL_CMP_MSG *msg, unsigned char **out)
1157 {
1158 return ASN1_item_i2d((const ASN1_VALUE *)msg, out,
1159 ASN1_ITEM_rptr(OSSL_CMP_MSG));
1160 }
1161
d2i_OSSL_CMP_MSG_bio(BIO * bio,OSSL_CMP_MSG ** msg)1162 OSSL_CMP_MSG *d2i_OSSL_CMP_MSG_bio(BIO *bio, OSSL_CMP_MSG **msg)
1163 {
1164 OSSL_LIB_CTX *libctx = NULL;
1165 const char *propq = NULL;
1166
1167 if (msg != NULL && *msg != NULL) {
1168 libctx = (*msg)->libctx;
1169 propq = (*msg)->propq;
1170 }
1171
1172 return ASN1_item_d2i_bio_ex(ASN1_ITEM_rptr(OSSL_CMP_MSG), bio, msg, libctx,
1173 propq);
1174 }
1175
i2d_OSSL_CMP_MSG_bio(BIO * bio,const OSSL_CMP_MSG * msg)1176 int i2d_OSSL_CMP_MSG_bio(BIO *bio, const OSSL_CMP_MSG *msg)
1177 {
1178 return ASN1_i2d_bio_of(OSSL_CMP_MSG, i2d_OSSL_CMP_MSG, bio, msg);
1179 }
1180