1 | /* |
2 | * Copyright 2007-2019 The OpenSSL Project Authors. All Rights Reserved. |
3 | * Copyright Nokia 2007-2019 |
4 | * Copyright Siemens AG 2015-2019 |
5 | * |
6 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
7 | * this file except in compliance with the License. You can obtain a copy |
8 | * in the file LICENSE in the source distribution or at |
9 | * https://www.openssl.org/source/license.html |
10 | */ |
11 | |
12 | #include <openssl/trace.h> |
13 | #include <openssl/bio.h> |
14 | #include <openssl/ocsp.h> /* for OCSP_REVOKED_STATUS_* */ |
15 | |
16 | #include "cmp_local.h" |
17 | |
18 | /* explicit #includes not strictly needed since implied by the above: */ |
19 | #include <openssl/cmp.h> |
20 | #include <openssl/crmf.h> |
21 | #include <openssl/err.h> |
22 | |
23 | /* |
24 | * Get current certificate store containing trusted root CA certs |
25 | */ |
26 | X509_STORE *OSSL_CMP_CTX_get0_trustedStore(const OSSL_CMP_CTX *ctx) |
27 | { |
28 | if (ctx == NULL) { |
29 | CMPerr(0, CMP_R_NULL_ARGUMENT); |
30 | return NULL; |
31 | } |
32 | return ctx->trusted; |
33 | } |
34 | |
35 | /* |
36 | * Set certificate store containing trusted (root) CA certs and possibly CRLs |
37 | * and a cert verification callback function used for CMP server authentication. |
38 | * Any already existing store entry is freed. Given NULL, the entry is reset. |
39 | * returns 1 on success, 0 on error |
40 | */ |
41 | int OSSL_CMP_CTX_set0_trustedStore(OSSL_CMP_CTX *ctx, X509_STORE *store) |
42 | { |
43 | if (ctx == NULL) { |
44 | CMPerr(0, CMP_R_NULL_ARGUMENT); |
45 | return 0; |
46 | } |
47 | X509_STORE_free(ctx->trusted); |
48 | ctx->trusted = store; |
49 | return 1; |
50 | } |
51 | |
52 | /* |
53 | * Get current list of non-trusted intermediate certs |
54 | */ |
55 | STACK_OF(X509) *OSSL_CMP_CTX_get0_untrusted_certs(const OSSL_CMP_CTX *ctx) |
56 | { |
57 | if (ctx == NULL) { |
58 | CMPerr(0, CMP_R_NULL_ARGUMENT); |
59 | return NULL; |
60 | } |
61 | return ctx->untrusted_certs; |
62 | } |
63 | |
64 | /* |
65 | * Set untrusted certificates for path construction in authentication of |
66 | * the CMP server and potentially others (TLS server, newly enrolled cert). |
67 | * returns 1 on success, 0 on error |
68 | */ |
69 | int OSSL_CMP_CTX_set1_untrusted_certs(OSSL_CMP_CTX *ctx, STACK_OF(X509) *certs) |
70 | { |
71 | STACK_OF(X509) *untrusted_certs; |
72 | if (ctx == NULL) { |
73 | CMPerr(0, CMP_R_NULL_ARGUMENT); |
74 | return 0; |
75 | } |
76 | if ((untrusted_certs = sk_X509_new_null()) == NULL) |
77 | return 0; |
78 | if (ossl_cmp_sk_X509_add1_certs(untrusted_certs, certs, 0, 1, 0) != 1) |
79 | goto err; |
80 | sk_X509_pop_free(ctx->untrusted_certs, X509_free); |
81 | ctx->untrusted_certs = untrusted_certs; |
82 | return 1; |
83 | err: |
84 | sk_X509_pop_free(untrusted_certs, X509_free); |
85 | return 0; |
86 | } |
87 | |
88 | /* |
89 | * Allocates and initializes OSSL_CMP_CTX context structure with default values. |
90 | * Returns new context on success, NULL on error |
91 | */ |
92 | OSSL_CMP_CTX *OSSL_CMP_CTX_new(void) |
93 | { |
94 | OSSL_CMP_CTX *ctx = OPENSSL_zalloc(sizeof(*ctx)); |
95 | |
96 | if (ctx == NULL) |
97 | return NULL; |
98 | |
99 | ctx->log_verbosity = OSSL_CMP_LOG_INFO; |
100 | |
101 | ctx->status = -1; |
102 | ctx->failInfoCode = -1; |
103 | |
104 | ctx->serverPort = OSSL_CMP_DEFAULT_PORT; |
105 | ctx->proxyPort = OSSL_CMP_DEFAULT_PORT; |
106 | ctx->msgtimeout = 2 * 60; |
107 | |
108 | if ((ctx->untrusted_certs = sk_X509_new_null()) == NULL) |
109 | goto err; |
110 | |
111 | ctx->pbm_slen = 16; |
112 | ctx->pbm_owf = NID_sha256; |
113 | ctx->pbm_itercnt = 500; |
114 | ctx->pbm_mac = NID_hmac_sha1; |
115 | |
116 | ctx->digest = NID_sha256; |
117 | ctx->popoMethod = OSSL_CRMF_POPO_SIGNATURE; |
118 | ctx->revocationReason = CRL_REASON_NONE; |
119 | |
120 | /* all other elements are initialized to 0 or NULL, respectively */ |
121 | return ctx; |
122 | |
123 | err: |
124 | OSSL_CMP_CTX_free(ctx); |
125 | return NULL; |
126 | } |
127 | |
128 | /* |
129 | * Prepare the OSSL_CMP_CTX for next use, partly re-initializing OSSL_CMP_CTX |
130 | */ |
131 | int OSSL_CMP_CTX_reinit(OSSL_CMP_CTX *ctx) |
132 | { |
133 | if (ctx == NULL) { |
134 | CMPerr(0, CMP_R_NULL_ARGUMENT); |
135 | return 0; |
136 | } |
137 | |
138 | ctx->status = -1; |
139 | ctx->failInfoCode = -1; |
140 | |
141 | return ossl_cmp_ctx_set0_statusString(ctx, NULL) |
142 | && ossl_cmp_ctx_set0_newCert(ctx, NULL) |
143 | && ossl_cmp_ctx_set1_caPubs(ctx, NULL) |
144 | && ossl_cmp_ctx_set1_extraCertsIn(ctx, NULL) |
145 | && ossl_cmp_ctx_set0_validatedSrvCert(ctx, NULL) |
146 | && OSSL_CMP_CTX_set1_transactionID(ctx, NULL) |
147 | && OSSL_CMP_CTX_set1_senderNonce(ctx, NULL) |
148 | && ossl_cmp_ctx_set1_recipNonce(ctx, NULL); |
149 | } |
150 | |
151 | /* |
152 | * Frees OSSL_CMP_CTX variables allocated in OSSL_CMP_CTX_new() |
153 | */ |
154 | void OSSL_CMP_CTX_free(OSSL_CMP_CTX *ctx) |
155 | { |
156 | if (ctx == NULL) |
157 | return; |
158 | |
159 | OPENSSL_free(ctx->serverPath); |
160 | OPENSSL_free(ctx->serverName); |
161 | OPENSSL_free(ctx->proxyName); |
162 | |
163 | X509_free(ctx->srvCert); |
164 | X509_free(ctx->validatedSrvCert); |
165 | X509_NAME_free(ctx->expected_sender); |
166 | X509_STORE_free(ctx->trusted); |
167 | sk_X509_pop_free(ctx->untrusted_certs, X509_free); |
168 | |
169 | X509_free(ctx->clCert); |
170 | EVP_PKEY_free(ctx->pkey); |
171 | ASN1_OCTET_STRING_free(ctx->referenceValue); |
172 | if (ctx->secretValue != NULL) |
173 | OPENSSL_cleanse(ctx->secretValue->data, ctx->secretValue->length); |
174 | ASN1_OCTET_STRING_free(ctx->secretValue); |
175 | |
176 | X509_NAME_free(ctx->recipient); |
177 | ASN1_OCTET_STRING_free(ctx->transactionID); |
178 | ASN1_OCTET_STRING_free(ctx->senderNonce); |
179 | ASN1_OCTET_STRING_free(ctx->recipNonce); |
180 | sk_OSSL_CMP_ITAV_pop_free(ctx->geninfo_ITAVs, OSSL_CMP_ITAV_free); |
181 | sk_X509_pop_free(ctx->extraCertsOut, X509_free); |
182 | |
183 | EVP_PKEY_free(ctx->newPkey); |
184 | X509_NAME_free(ctx->issuer); |
185 | X509_NAME_free(ctx->subjectName); |
186 | sk_GENERAL_NAME_pop_free(ctx->subjectAltNames, GENERAL_NAME_free); |
187 | sk_X509_EXTENSION_pop_free(ctx->reqExtensions, X509_EXTENSION_free); |
188 | sk_POLICYINFO_pop_free(ctx->policies, POLICYINFO_free); |
189 | X509_free(ctx->oldCert); |
190 | X509_REQ_free(ctx->p10CSR); |
191 | |
192 | sk_OSSL_CMP_ITAV_pop_free(ctx->genm_ITAVs, OSSL_CMP_ITAV_free); |
193 | |
194 | sk_ASN1_UTF8STRING_pop_free(ctx->statusString, ASN1_UTF8STRING_free); |
195 | X509_free(ctx->newCert); |
196 | sk_X509_pop_free(ctx->caPubs, X509_free); |
197 | sk_X509_pop_free(ctx->extraCertsIn, X509_free); |
198 | |
199 | OPENSSL_free(ctx); |
200 | } |
201 | |
202 | int ossl_cmp_ctx_set_status(OSSL_CMP_CTX *ctx, int status) |
203 | { |
204 | if (!ossl_assert(ctx != NULL)) |
205 | return 0; |
206 | ctx->status = status; |
207 | return 1; |
208 | } |
209 | |
210 | /* |
211 | * Returns the PKIStatus from the last CertRepMessage |
212 | * or Revocation Response or error message, -1 on error |
213 | */ |
214 | int OSSL_CMP_CTX_get_status(const OSSL_CMP_CTX *ctx) |
215 | { |
216 | if (ctx == NULL) { |
217 | CMPerr(0, CMP_R_NULL_ARGUMENT); |
218 | return -1; |
219 | } |
220 | return ctx->status; |
221 | } |
222 | |
223 | /* |
224 | * Returns the statusString from the last CertRepMessage |
225 | * or Revocation Response or error message, NULL on error |
226 | */ |
227 | OSSL_CMP_PKIFREETEXT *OSSL_CMP_CTX_get0_statusString(const OSSL_CMP_CTX *ctx) |
228 | { |
229 | if (ctx == NULL) { |
230 | CMPerr(0, CMP_R_NULL_ARGUMENT); |
231 | return NULL; |
232 | } |
233 | return ctx->statusString; |
234 | } |
235 | |
236 | int ossl_cmp_ctx_set0_statusString(OSSL_CMP_CTX *ctx, |
237 | OSSL_CMP_PKIFREETEXT *text) |
238 | { |
239 | if (!ossl_assert(ctx != NULL)) |
240 | return 0; |
241 | sk_ASN1_UTF8STRING_pop_free(ctx->statusString, ASN1_UTF8STRING_free); |
242 | ctx->statusString = text; |
243 | return 1; |
244 | } |
245 | |
246 | int ossl_cmp_ctx_set0_validatedSrvCert(OSSL_CMP_CTX *ctx, X509 *cert) |
247 | { |
248 | if (!ossl_assert(ctx != NULL)) |
249 | return 0; |
250 | X509_free(ctx->validatedSrvCert); |
251 | ctx->validatedSrvCert = cert; |
252 | return 1; |
253 | } |
254 | |
255 | /* |
256 | * Set callback function for checking if the cert is ok or should |
257 | * it be rejected. |
258 | * Returns 1 on success, 0 on error |
259 | */ |
260 | int OSSL_CMP_CTX_set_certConf_cb(OSSL_CMP_CTX *ctx, OSSL_cmp_certConf_cb_t cb) |
261 | { |
262 | if (ctx == NULL) { |
263 | CMPerr(0, CMP_R_NULL_ARGUMENT); |
264 | return 0; |
265 | } |
266 | ctx->certConf_cb = cb; |
267 | return 1; |
268 | } |
269 | |
270 | /* |
271 | * Set argument, respectively a pointer to a structure containing arguments, |
272 | * optionally to be used by the certConf callback. |
273 | * Returns 1 on success, 0 on error |
274 | */ |
275 | int OSSL_CMP_CTX_set_certConf_cb_arg(OSSL_CMP_CTX *ctx, void *arg) |
276 | { |
277 | if (ctx == NULL) { |
278 | CMPerr(0, CMP_R_NULL_ARGUMENT); |
279 | return 0; |
280 | } |
281 | ctx->certConf_cb_arg = arg; |
282 | return 1; |
283 | } |
284 | |
285 | /* |
286 | * Get argument, respectively the pointer to a structure containing arguments, |
287 | * optionally to be used by certConf callback. |
288 | * Returns callback argument set previously (NULL if not set or on error) |
289 | */ |
290 | void *OSSL_CMP_CTX_get_certConf_cb_arg(const OSSL_CMP_CTX *ctx) |
291 | { |
292 | if (ctx == NULL) { |
293 | CMPerr(0, CMP_R_NULL_ARGUMENT); |
294 | return NULL; |
295 | } |
296 | return ctx->certConf_cb_arg; |
297 | } |
298 | |
299 | #ifndef OPENSSL_NO_TRACE |
300 | static size_t ossl_cmp_log_trace_cb(const char *buf, size_t cnt, |
301 | int category, int cmd, void *vdata) |
302 | { |
303 | OSSL_CMP_CTX *ctx = vdata; |
304 | const char *prefix_msg; |
305 | OSSL_CMP_severity level = -1; |
306 | char *func = NULL; |
307 | char *file = NULL; |
308 | int line = 0; |
309 | |
310 | if (buf == NULL || cnt == 0 || cmd != OSSL_TRACE_CTRL_WRITE || ctx == NULL) |
311 | return 0; |
312 | if (ctx->log_cb == NULL) |
313 | return 1; /* silently drop message */ |
314 | |
315 | prefix_msg = ossl_cmp_log_parse_metadata(buf, &level, &func, &file, &line); |
316 | |
317 | if (level > ctx->log_verbosity) /* excludes the case level is unknown */ |
318 | goto end; /* suppress output since severity is not sufficient */ |
319 | |
320 | if (!ctx->log_cb(func != NULL ? func : "(no func)" , |
321 | file != NULL ? file : "(no file)" , |
322 | line, level, prefix_msg)) |
323 | cnt = 0; |
324 | |
325 | end: |
326 | OPENSSL_free(func); |
327 | OPENSSL_free(file); |
328 | return cnt; |
329 | } |
330 | #endif |
331 | |
332 | /* |
333 | * Set a callback function for error reporting and logging messages. |
334 | * Returns 1 on success, 0 on error |
335 | */ |
336 | int OSSL_CMP_CTX_set_log_cb(OSSL_CMP_CTX *ctx, OSSL_cmp_log_cb_t cb) |
337 | { |
338 | if (ctx == NULL) { |
339 | CMPerr(0, CMP_R_NULL_ARGUMENT); |
340 | return 0; |
341 | } |
342 | ctx->log_cb = cb; |
343 | |
344 | #ifndef OPENSSL_NO_TRACE |
345 | /* do also in case cb == NULL, to switch off logging output: */ |
346 | if (!OSSL_trace_set_callback(OSSL_TRACE_CATEGORY_CMP, |
347 | ossl_cmp_log_trace_cb, ctx)) |
348 | return 0; |
349 | #endif |
350 | |
351 | return 1; |
352 | } |
353 | |
354 | /* Print OpenSSL and CMP errors via the log cb of the ctx or ERR_print_errors */ |
355 | void OSSL_CMP_CTX_print_errors(OSSL_CMP_CTX *ctx) |
356 | { |
357 | OSSL_CMP_print_errors_cb(ctx == NULL ? NULL : ctx->log_cb); |
358 | } |
359 | |
360 | /* |
361 | * Set or clear the reference value to be used for identification |
362 | * (i.e., the user name) when using PBMAC. |
363 | * Returns 1 on success, 0 on error |
364 | */ |
365 | int OSSL_CMP_CTX_set1_referenceValue(OSSL_CMP_CTX *ctx, |
366 | const unsigned char *ref, int len) |
367 | { |
368 | if (ctx == NULL) { |
369 | CMPerr(0, CMP_R_NULL_ARGUMENT); |
370 | return 0; |
371 | } |
372 | return ossl_cmp_asn1_octet_string_set1_bytes(&ctx->referenceValue, ref, |
373 | len); |
374 | } |
375 | |
376 | /* |
377 | * Set or clear the password to be used for protecting messages with PBMAC. |
378 | * Returns 1 on success, 0 on error |
379 | */ |
380 | int OSSL_CMP_CTX_set1_secretValue(OSSL_CMP_CTX *ctx, const unsigned char *sec, |
381 | const int len) |
382 | { |
383 | ASN1_OCTET_STRING *secretValue = NULL; |
384 | if (ctx == NULL) { |
385 | CMPerr(0, CMP_R_NULL_ARGUMENT); |
386 | return 0; |
387 | } |
388 | if (ossl_cmp_asn1_octet_string_set1_bytes(&secretValue, sec, len) != 1) |
389 | return 0; |
390 | if (ctx->secretValue != NULL) { |
391 | OPENSSL_cleanse(ctx->secretValue->data, ctx->secretValue->length); |
392 | ASN1_OCTET_STRING_free(ctx->secretValue); |
393 | } |
394 | ctx->secretValue = secretValue; |
395 | return 1; |
396 | } |
397 | |
398 | /* |
399 | * Returns the stack of certificates received in a response message. |
400 | * The stack is duplicated so the caller must handle freeing it! |
401 | * Returns pointer to created stack on success, NULL on error |
402 | */ |
403 | STACK_OF(X509) *(const OSSL_CMP_CTX *ctx) |
404 | { |
405 | if (ctx == NULL) { |
406 | CMPerr(0, CMP_R_NULL_ARGUMENT); |
407 | return NULL; |
408 | } |
409 | if (ctx->extraCertsIn == NULL) |
410 | return sk_X509_new_null(); |
411 | return X509_chain_up_ref(ctx->extraCertsIn); |
412 | } |
413 | |
414 | /* |
415 | * Copies any given stack of inbound X509 certificates to extraCertsIn |
416 | * of the OSSL_CMP_CTX structure so that they may be retrieved later. |
417 | * Returns 1 on success, 0 on error. |
418 | */ |
419 | int (OSSL_CMP_CTX *ctx, |
420 | STACK_OF(X509) *) |
421 | { |
422 | if (!ossl_assert(ctx != NULL)) |
423 | return 0; |
424 | |
425 | sk_X509_pop_free(ctx->extraCertsIn, X509_free); |
426 | ctx->extraCertsIn = NULL; |
427 | if (extraCertsIn == NULL) |
428 | return 1; |
429 | return (ctx->extraCertsIn = X509_chain_up_ref(extraCertsIn)) != NULL; |
430 | } |
431 | |
432 | /* |
433 | * Duplicate and set the given stack as the new stack of X509 |
434 | * certificates to send out in the extraCerts field. |
435 | * Returns 1 on success, 0 on error |
436 | */ |
437 | int (OSSL_CMP_CTX *ctx, |
438 | STACK_OF(X509) *) |
439 | { |
440 | if (ctx == NULL) { |
441 | CMPerr(0, CMP_R_NULL_ARGUMENT); |
442 | return 0; |
443 | } |
444 | |
445 | sk_X509_pop_free(ctx->extraCertsOut, X509_free); |
446 | ctx->extraCertsOut = NULL; |
447 | if (extraCertsOut == NULL) |
448 | return 1; |
449 | return (ctx->extraCertsOut = X509_chain_up_ref(extraCertsOut)) != NULL; |
450 | } |
451 | |
452 | /* |
453 | * Add the given policy info object |
454 | * to the X509_EXTENSIONS of the requested certificate template. |
455 | * Returns 1 on success, 0 on error. |
456 | */ |
457 | int OSSL_CMP_CTX_push0_policy(OSSL_CMP_CTX *ctx, POLICYINFO *pinfo) |
458 | { |
459 | if (ctx == NULL || pinfo == NULL) { |
460 | CMPerr(0, CMP_R_NULL_ARGUMENT); |
461 | return 0; |
462 | } |
463 | |
464 | if (ctx->policies == NULL |
465 | && (ctx->policies = CERTIFICATEPOLICIES_new()) == NULL) |
466 | return 0; |
467 | |
468 | return sk_POLICYINFO_push(ctx->policies, pinfo); |
469 | } |
470 | |
471 | /* |
472 | * Add an ITAV for geninfo of the PKI message header |
473 | */ |
474 | int OSSL_CMP_CTX_push0_geninfo_ITAV(OSSL_CMP_CTX *ctx, OSSL_CMP_ITAV *itav) |
475 | { |
476 | if (ctx == NULL) { |
477 | CMPerr(0, CMP_R_NULL_ARGUMENT); |
478 | return 0; |
479 | } |
480 | return OSSL_CMP_ITAV_push0_stack_item(&ctx->geninfo_ITAVs, itav); |
481 | } |
482 | |
483 | /* |
484 | * Add an itav for the body of outgoing general messages |
485 | */ |
486 | int OSSL_CMP_CTX_push0_genm_ITAV(OSSL_CMP_CTX *ctx, OSSL_CMP_ITAV *itav) |
487 | { |
488 | if (ctx == NULL) { |
489 | CMPerr(0, CMP_R_NULL_ARGUMENT); |
490 | return 0; |
491 | } |
492 | return OSSL_CMP_ITAV_push0_stack_item(&ctx->genm_ITAVs, itav); |
493 | } |
494 | |
495 | /* |
496 | * Returns a duplicate of the stack of X509 certificates that |
497 | * were received in the caPubs field of the last CertRepMessage. |
498 | * Returns NULL on error |
499 | */ |
500 | STACK_OF(X509) *OSSL_CMP_CTX_get1_caPubs(const OSSL_CMP_CTX *ctx) |
501 | { |
502 | if (ctx == NULL) { |
503 | CMPerr(0, CMP_R_NULL_ARGUMENT); |
504 | return NULL; |
505 | } |
506 | if (ctx->caPubs == NULL) |
507 | return sk_X509_new_null(); |
508 | return X509_chain_up_ref(ctx->caPubs); |
509 | } |
510 | |
511 | /* |
512 | * Duplicate and copy the given stack of certificates to the given |
513 | * OSSL_CMP_CTX structure so that they may be retrieved later. |
514 | * Returns 1 on success, 0 on error |
515 | */ |
516 | int ossl_cmp_ctx_set1_caPubs(OSSL_CMP_CTX *ctx, STACK_OF(X509) *caPubs) |
517 | { |
518 | if (!ossl_assert(ctx != NULL)) |
519 | return 0; |
520 | |
521 | sk_X509_pop_free(ctx->caPubs, X509_free); |
522 | ctx->caPubs = NULL; |
523 | if (caPubs == NULL) |
524 | return 1; |
525 | return (ctx->caPubs = X509_chain_up_ref(caPubs)) != NULL; |
526 | } |
527 | |
528 | #define char_dup OPENSSL_strdup |
529 | #define char_free OPENSSL_free |
530 | #define DEFINE_OSSL_CMP_CTX_set1(FIELD, TYPE) /* this uses _dup */ \ |
531 | int OSSL_CMP_CTX_set1_##FIELD(OSSL_CMP_CTX *ctx, const TYPE *val) \ |
532 | { \ |
533 | TYPE *val_dup = NULL; \ |
534 | \ |
535 | if (ctx == NULL) { \ |
536 | CMPerr(0, CMP_R_NULL_ARGUMENT); \ |
537 | return 0; \ |
538 | } \ |
539 | \ |
540 | if (val != NULL && (val_dup = TYPE##_dup(val)) == NULL) \ |
541 | return 0; \ |
542 | TYPE##_free(ctx->FIELD); \ |
543 | ctx->FIELD = val_dup; \ |
544 | return 1; \ |
545 | } |
546 | |
547 | #define DEFINE_OSSL_CMP_CTX_set1_up_ref(FIELD, TYPE) \ |
548 | int OSSL_CMP_CTX_set1_##FIELD(OSSL_CMP_CTX *ctx, TYPE *val) \ |
549 | { \ |
550 | if (ctx == NULL) { \ |
551 | CMPerr(0, CMP_R_NULL_ARGUMENT); \ |
552 | return 0; \ |
553 | } \ |
554 | \ |
555 | if (val != NULL && !TYPE##_up_ref(val)) \ |
556 | return 0; \ |
557 | TYPE##_free(ctx->FIELD); \ |
558 | ctx->FIELD = val; \ |
559 | return 1; \ |
560 | } |
561 | |
562 | /* |
563 | * Pins the server certificate to be directly trusted (even if it is expired) |
564 | * for verifying response messages. |
565 | * Cert pointer is not consumed. It may be NULL to clear the entry. |
566 | * Returns 1 on success, 0 on error |
567 | */ |
568 | DEFINE_OSSL_CMP_CTX_set1_up_ref(srvCert, X509) |
569 | |
570 | /* |
571 | * Set the X509 name of the recipient. Set in the PKIHeader. |
572 | * returns 1 on success, 0 on error |
573 | */ |
574 | DEFINE_OSSL_CMP_CTX_set1(recipient, X509_NAME) |
575 | |
576 | /* |
577 | * Store the X509 name of the expected sender in the PKIHeader of responses. |
578 | * Returns 1 on success, 0 on error |
579 | */ |
580 | DEFINE_OSSL_CMP_CTX_set1(expected_sender, X509_NAME) |
581 | |
582 | /* |
583 | * Set the X509 name of the issuer. Set in the PKIHeader. |
584 | * Returns 1 on success, 0 on error |
585 | */ |
586 | DEFINE_OSSL_CMP_CTX_set1(issuer, X509_NAME) |
587 | |
588 | /* |
589 | * Set the subject name that will be placed in the certificate |
590 | * request. This will be the subject name on the received certificate. |
591 | * Returns 1 on success, 0 on error |
592 | */ |
593 | DEFINE_OSSL_CMP_CTX_set1(subjectName, X509_NAME) |
594 | |
595 | /* |
596 | * Set the X.509v3 certificate request extensions to be used in IR/CR/KUR. |
597 | * Returns 1 on success, 0 on error |
598 | */ |
599 | int OSSL_CMP_CTX_set0_reqExtensions(OSSL_CMP_CTX *ctx, X509_EXTENSIONS *exts) |
600 | { |
601 | if (ctx == NULL) { |
602 | CMPerr(0, CMP_R_NULL_ARGUMENT); |
603 | return 0; |
604 | } |
605 | |
606 | if (sk_GENERAL_NAME_num(ctx->subjectAltNames) > 0 && exts != NULL |
607 | && X509v3_get_ext_by_NID(exts, NID_subject_alt_name, -1) >= 0) { |
608 | CMPerr(0, CMP_R_MULTIPLE_SAN_SOURCES); |
609 | return 0; |
610 | } |
611 | sk_X509_EXTENSION_pop_free(ctx->reqExtensions, X509_EXTENSION_free); |
612 | ctx->reqExtensions = exts; |
613 | return 1; |
614 | } |
615 | |
616 | /* returns 1 if ctx contains a Subject Alternative Name extension, else 0 */ |
617 | int OSSL_CMP_CTX_reqExtensions_have_SAN(OSSL_CMP_CTX *ctx) |
618 | { |
619 | if (ctx == NULL) { |
620 | CMPerr(0, CMP_R_NULL_ARGUMENT); |
621 | return -1; |
622 | } |
623 | /* if one of the following conditions 'fail' this is not an error */ |
624 | return ctx->reqExtensions != NULL |
625 | && X509v3_get_ext_by_NID(ctx->reqExtensions, |
626 | NID_subject_alt_name, -1) >= 0; |
627 | } |
628 | |
629 | /* |
630 | * Add a GENERAL_NAME structure that will be added to the CRMF |
631 | * request's extensions field to request subject alternative names. |
632 | * Returns 1 on success, 0 on error |
633 | */ |
634 | int OSSL_CMP_CTX_push1_subjectAltName(OSSL_CMP_CTX *ctx, |
635 | const GENERAL_NAME *name) |
636 | { |
637 | GENERAL_NAME *name_dup; |
638 | |
639 | if (ctx == NULL || name == NULL) { |
640 | CMPerr(0, CMP_R_NULL_ARGUMENT); |
641 | return 0; |
642 | } |
643 | |
644 | if (OSSL_CMP_CTX_reqExtensions_have_SAN(ctx) == 1) { |
645 | CMPerr(0, CMP_R_MULTIPLE_SAN_SOURCES); |
646 | return 0; |
647 | } |
648 | |
649 | if (ctx->subjectAltNames == NULL |
650 | && (ctx->subjectAltNames = sk_GENERAL_NAME_new_null()) == NULL) |
651 | return 0; |
652 | if ((name_dup = GENERAL_NAME_dup(name)) == NULL) |
653 | return 0; |
654 | if (!sk_GENERAL_NAME_push(ctx->subjectAltNames, name_dup)) { |
655 | GENERAL_NAME_free(name_dup); |
656 | return 0; |
657 | } |
658 | return 1; |
659 | } |
660 | |
661 | /* |
662 | * Set our own client certificate, used for example in KUR and when |
663 | * doing the IR with existing certificate. |
664 | * Returns 1 on success, 0 on error |
665 | */ |
666 | DEFINE_OSSL_CMP_CTX_set1_up_ref(clCert, X509) |
667 | |
668 | /* |
669 | * Set the old certificate that we are updating in KUR |
670 | * or the certificate to be revoked in RR, respectively. |
671 | * Also used as reference cert (defaulting to clCert) for deriving subject DN |
672 | * and SANs. Its issuer is used as default recipient in the CMP message header. |
673 | * Returns 1 on success, 0 on error |
674 | */ |
675 | DEFINE_OSSL_CMP_CTX_set1_up_ref(oldCert, X509) |
676 | |
677 | /* |
678 | * Set the PKCS#10 CSR to be sent in P10CR. |
679 | * Returns 1 on success, 0 on error |
680 | */ |
681 | DEFINE_OSSL_CMP_CTX_set1(p10CSR, X509_REQ) |
682 | |
683 | /* |
684 | * Sets the (newly received in IP/KUP/CP) certificate in the context. |
685 | * Returns 1 on success, 0 on error |
686 | * TODO: this only permits for one cert to be enrolled at a time. |
687 | */ |
688 | int ossl_cmp_ctx_set0_newCert(OSSL_CMP_CTX *ctx, X509 *cert) |
689 | { |
690 | if (!ossl_assert(ctx != NULL)) |
691 | return 0; |
692 | |
693 | X509_free(ctx->newCert); |
694 | ctx->newCert = cert; |
695 | return 1; |
696 | } |
697 | |
698 | /* |
699 | * Get the (newly received in IP/KUP/CP) client certificate from the context |
700 | * TODO: this only permits for one client cert to be received... |
701 | */ |
702 | X509 *OSSL_CMP_CTX_get0_newCert(const OSSL_CMP_CTX *ctx) |
703 | { |
704 | if (ctx == NULL) { |
705 | CMPerr(0, CMP_R_NULL_ARGUMENT); |
706 | return NULL; |
707 | } |
708 | return ctx->newCert; |
709 | } |
710 | |
711 | /* |
712 | * Set the client's current private key. |
713 | * Returns 1 on success, 0 on error |
714 | */ |
715 | DEFINE_OSSL_CMP_CTX_set1_up_ref(pkey, EVP_PKEY) |
716 | |
717 | /* |
718 | * Set new key pair. Used e.g. when doing Key Update. |
719 | * Returns 1 on success, 0 on error |
720 | */ |
721 | int OSSL_CMP_CTX_set0_newPkey(OSSL_CMP_CTX *ctx, int priv, EVP_PKEY *pkey) |
722 | { |
723 | if (ctx == NULL) { |
724 | CMPerr(0, CMP_R_NULL_ARGUMENT); |
725 | return 0; |
726 | } |
727 | |
728 | EVP_PKEY_free(ctx->newPkey); |
729 | ctx->newPkey = pkey; |
730 | ctx->newPkey_priv = priv; |
731 | return 1; |
732 | } |
733 | |
734 | /* |
735 | * gets the private/public key to use for certificate enrollment, NULL on error |
736 | */ |
737 | EVP_PKEY *OSSL_CMP_CTX_get0_newPkey(const OSSL_CMP_CTX *ctx, int priv) |
738 | { |
739 | if (ctx == NULL) { |
740 | CMPerr(0, CMP_R_NULL_ARGUMENT); |
741 | return NULL; |
742 | } |
743 | |
744 | if (ctx->newPkey != NULL) |
745 | return priv && !ctx->newPkey_priv ? NULL : ctx->newPkey; |
746 | if (ctx->p10CSR != NULL) |
747 | return priv ? NULL : X509_REQ_get0_pubkey(ctx->p10CSR); |
748 | return ctx->pkey; /* may be NULL */ |
749 | } |
750 | |
751 | /* |
752 | * Sets the given transactionID to the context. |
753 | * Returns 1 on success, 0 on error |
754 | */ |
755 | int OSSL_CMP_CTX_set1_transactionID(OSSL_CMP_CTX *ctx, |
756 | const ASN1_OCTET_STRING *id) |
757 | { |
758 | if (ctx == NULL) { |
759 | CMPerr(0, CMP_R_NULL_ARGUMENT); |
760 | return 0; |
761 | } |
762 | return ossl_cmp_asn1_octet_string_set1(&ctx->transactionID, id); |
763 | } |
764 | |
765 | /* |
766 | * sets the given nonce to be used for the recipNonce in the next message to be |
767 | * created. |
768 | * returns 1 on success, 0 on error |
769 | */ |
770 | int ossl_cmp_ctx_set1_recipNonce(OSSL_CMP_CTX *ctx, |
771 | const ASN1_OCTET_STRING *nonce) |
772 | { |
773 | if (!ossl_assert(ctx != NULL)) |
774 | return 0; |
775 | return ossl_cmp_asn1_octet_string_set1(&ctx->recipNonce, nonce); |
776 | } |
777 | |
778 | /* |
779 | * Stores the given nonce as the last senderNonce sent out. |
780 | * Returns 1 on success, 0 on error |
781 | */ |
782 | int OSSL_CMP_CTX_set1_senderNonce(OSSL_CMP_CTX *ctx, |
783 | const ASN1_OCTET_STRING *nonce) |
784 | { |
785 | if (ctx == NULL) { |
786 | CMPerr(0, CMP_R_NULL_ARGUMENT); |
787 | return 0; |
788 | } |
789 | return ossl_cmp_asn1_octet_string_set1(&ctx->senderNonce, nonce); |
790 | } |
791 | |
792 | /* |
793 | * Set the host name of the (HTTP) proxy server to use for all connections |
794 | * returns 1 on success, 0 on error |
795 | */ |
796 | DEFINE_OSSL_CMP_CTX_set1(proxyName, char) |
797 | |
798 | /* |
799 | * Set the (HTTP) host name of the CA server. |
800 | * Returns 1 on success, 0 on error |
801 | */ |
802 | DEFINE_OSSL_CMP_CTX_set1(serverName, char) |
803 | |
804 | /* |
805 | * Sets the (HTTP) proxy port to be used. |
806 | * Returns 1 on success, 0 on error |
807 | */ |
808 | int OSSL_CMP_CTX_set_proxyPort(OSSL_CMP_CTX *ctx, int port) |
809 | { |
810 | if (ctx == NULL) { |
811 | CMPerr(0, CMP_R_NULL_ARGUMENT); |
812 | return 0; |
813 | } |
814 | ctx->proxyPort = port; |
815 | return 1; |
816 | } |
817 | |
818 | /* |
819 | * sets the http connect/disconnect callback function to be used for HTTP(S) |
820 | * returns 1 on success, 0 on error |
821 | */ |
822 | int OSSL_CMP_CTX_set_http_cb(OSSL_CMP_CTX *ctx, OSSL_cmp_http_cb_t cb) |
823 | { |
824 | if (ctx == NULL) { |
825 | CMPerr(0, CMP_R_NULL_ARGUMENT); |
826 | return 0; |
827 | } |
828 | ctx->http_cb = cb; |
829 | return 1; |
830 | } |
831 | |
832 | /* |
833 | * Set argument optionally to be used by the http connect/disconnect callback. |
834 | * Returns 1 on success, 0 on error |
835 | */ |
836 | int OSSL_CMP_CTX_set_http_cb_arg(OSSL_CMP_CTX *ctx, void *arg) |
837 | { |
838 | if (ctx == NULL) { |
839 | CMPerr(0, CMP_R_NULL_ARGUMENT); |
840 | return 0; |
841 | } |
842 | ctx->http_cb_arg = arg; |
843 | return 1; |
844 | } |
845 | |
846 | /* |
847 | * Get argument optionally to be used by the http connect/disconnect callback |
848 | * Returns callback argument set previously (NULL if not set or on error) |
849 | */ |
850 | void *OSSL_CMP_CTX_get_http_cb_arg(const OSSL_CMP_CTX *ctx) |
851 | { |
852 | if (ctx == NULL) { |
853 | CMPerr(0, CMP_R_NULL_ARGUMENT); |
854 | return NULL; |
855 | } |
856 | return ctx->http_cb_arg; |
857 | } |
858 | |
859 | /* |
860 | * Set callback function for sending CMP request and receiving response. |
861 | * Returns 1 on success, 0 on error |
862 | */ |
863 | int OSSL_CMP_CTX_set_transfer_cb(OSSL_CMP_CTX *ctx, OSSL_cmp_transfer_cb_t cb) |
864 | { |
865 | if (ctx == NULL) { |
866 | CMPerr(0, CMP_R_NULL_ARGUMENT); |
867 | return 0; |
868 | } |
869 | ctx->transfer_cb = cb; |
870 | return 1; |
871 | } |
872 | |
873 | /* |
874 | * Set argument optionally to be used by the transfer callback. |
875 | * Returns 1 on success, 0 on error |
876 | */ |
877 | int OSSL_CMP_CTX_set_transfer_cb_arg(OSSL_CMP_CTX *ctx, void *arg) |
878 | { |
879 | if (ctx == NULL) { |
880 | CMPerr(0, CMP_R_NULL_ARGUMENT); |
881 | return 0; |
882 | } |
883 | ctx->transfer_cb_arg = arg; |
884 | return 1; |
885 | } |
886 | |
887 | /* |
888 | * Get argument optionally to be used by the transfer callback. |
889 | * Returns callback argument set previously (NULL if not set or on error) |
890 | */ |
891 | void *OSSL_CMP_CTX_get_transfer_cb_arg(const OSSL_CMP_CTX *ctx) |
892 | { |
893 | if (ctx == NULL) { |
894 | CMPerr(0, CMP_R_NULL_ARGUMENT); |
895 | return NULL; |
896 | } |
897 | return ctx->transfer_cb_arg; |
898 | } |
899 | |
900 | /* |
901 | * Sets the (HTTP) server port to be used. |
902 | * Returns 1 on success, 0 on error |
903 | */ |
904 | int OSSL_CMP_CTX_set_serverPort(OSSL_CMP_CTX *ctx, int port) |
905 | { |
906 | if (ctx == NULL) { |
907 | CMPerr(0, CMP_R_NULL_ARGUMENT); |
908 | return 0; |
909 | } |
910 | ctx->serverPort = port; |
911 | return 1; |
912 | } |
913 | |
914 | /* |
915 | * Sets the HTTP path to be used on the server (e.g "pkix/"). |
916 | * Returns 1 on success, 0 on error |
917 | */ |
918 | DEFINE_OSSL_CMP_CTX_set1(serverPath, char) |
919 | |
920 | /* |
921 | * Set the failInfo error code as bit encoding in OSSL_CMP_CTX. |
922 | * Returns 1 on success, 0 on error |
923 | */ |
924 | int ossl_cmp_ctx_set_failInfoCode(OSSL_CMP_CTX *ctx, int fail_info) |
925 | { |
926 | if (!ossl_assert(ctx != NULL)) |
927 | return 0; |
928 | ctx->failInfoCode = fail_info; |
929 | return 1; |
930 | } |
931 | |
932 | /* |
933 | * Get the failInfo error code in OSSL_CMP_CTX as bit encoding. |
934 | * Returns bit string as integer on success, -1 on error |
935 | */ |
936 | int OSSL_CMP_CTX_get_failInfoCode(const OSSL_CMP_CTX *ctx) |
937 | { |
938 | if (ctx == NULL) { |
939 | CMPerr(0, CMP_R_NULL_ARGUMENT); |
940 | return -1; |
941 | } |
942 | return ctx->failInfoCode; |
943 | } |
944 | |
945 | /* |
946 | * Sets a Boolean or integer option of the context to the "val" arg. |
947 | * Returns 1 on success, 0 on error |
948 | */ |
949 | int OSSL_CMP_CTX_set_option(OSSL_CMP_CTX *ctx, int opt, int val) |
950 | { |
951 | int min_val; |
952 | |
953 | if (ctx == NULL) { |
954 | CMPerr(0, CMP_R_NULL_ARGUMENT); |
955 | return 0; |
956 | } |
957 | |
958 | switch (opt) { |
959 | case OSSL_CMP_OPT_REVOCATION_REASON: |
960 | min_val = OCSP_REVOKED_STATUS_NOSTATUS; |
961 | break; |
962 | case OSSL_CMP_OPT_POPOMETHOD: |
963 | min_val = OSSL_CRMF_POPO_NONE; |
964 | break; |
965 | default: |
966 | min_val = 0; |
967 | break; |
968 | } |
969 | if (val < min_val) { |
970 | CMPerr(0, CMP_R_INVALID_ARGS); |
971 | return 0; |
972 | } |
973 | |
974 | switch (opt) { |
975 | case OSSL_CMP_OPT_LOG_VERBOSITY: |
976 | if (val > OSSL_CMP_LOG_DEBUG) { |
977 | CMPerr(0, CMP_R_INVALID_ARGS); |
978 | return 0; |
979 | } |
980 | ctx->log_verbosity = val; |
981 | break; |
982 | case OSSL_CMP_OPT_IMPLICITCONFIRM: |
983 | ctx->implicitConfirm = val; |
984 | break; |
985 | case OSSL_CMP_OPT_DISABLECONFIRM: |
986 | ctx->disableConfirm = val; |
987 | break; |
988 | case OSSL_CMP_OPT_UNPROTECTED_SEND: |
989 | ctx->unprotectedSend = val; |
990 | break; |
991 | case OSSL_CMP_OPT_UNPROTECTED_ERRORS: |
992 | ctx->unprotectedErrors = val; |
993 | break; |
994 | case OSSL_CMP_OPT_VALIDITYDAYS: |
995 | ctx->days = val; |
996 | break; |
997 | case OSSL_CMP_OPT_SUBJECTALTNAME_NODEFAULT: |
998 | ctx->SubjectAltName_nodefault = val; |
999 | break; |
1000 | case OSSL_CMP_OPT_SUBJECTALTNAME_CRITICAL: |
1001 | ctx->setSubjectAltNameCritical = val; |
1002 | break; |
1003 | case OSSL_CMP_OPT_POLICIES_CRITICAL: |
1004 | ctx->setPoliciesCritical = val; |
1005 | break; |
1006 | case OSSL_CMP_OPT_IGNORE_KEYUSAGE: |
1007 | ctx->ignore_keyusage = val; |
1008 | break; |
1009 | case OSSL_CMP_OPT_POPOMETHOD: |
1010 | if (val > OSSL_CRMF_POPO_KEYAGREE) { |
1011 | CMPerr(0, CMP_R_INVALID_ARGS); |
1012 | return 0; |
1013 | } |
1014 | ctx->popoMethod = val; |
1015 | break; |
1016 | case OSSL_CMP_OPT_DIGEST_ALGNID: |
1017 | ctx->digest = val; |
1018 | break; |
1019 | case OSSL_CMP_OPT_OWF_ALGNID: |
1020 | ctx->pbm_owf = val; |
1021 | break; |
1022 | case OSSL_CMP_OPT_MAC_ALGNID: |
1023 | ctx->pbm_mac = val; |
1024 | break; |
1025 | case OSSL_CMP_OPT_MSGTIMEOUT: |
1026 | ctx->msgtimeout = val; |
1027 | break; |
1028 | case OSSL_CMP_OPT_TOTALTIMEOUT: |
1029 | ctx->totaltimeout = val; |
1030 | break; |
1031 | case OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR: |
1032 | ctx->permitTAInExtraCertsForIR = val; |
1033 | break; |
1034 | case OSSL_CMP_OPT_REVOCATION_REASON: |
1035 | if (val > OCSP_REVOKED_STATUS_AACOMPROMISE) { |
1036 | CMPerr(0, CMP_R_INVALID_ARGS); |
1037 | return 0; |
1038 | } |
1039 | ctx->revocationReason = val; |
1040 | break; |
1041 | default: |
1042 | CMPerr(0, CMP_R_INVALID_ARGS); |
1043 | return 0; |
1044 | } |
1045 | |
1046 | return 1; |
1047 | } |
1048 | |
1049 | /* |
1050 | * Reads a Boolean or integer option value from the context. |
1051 | * Returns -1 on error (which is the default OSSL_CMP_OPT_REVOCATION_REASON) |
1052 | */ |
1053 | int OSSL_CMP_CTX_get_option(const OSSL_CMP_CTX *ctx, int opt) |
1054 | { |
1055 | if (ctx == NULL) { |
1056 | CMPerr(0, CMP_R_NULL_ARGUMENT); |
1057 | return -1; |
1058 | } |
1059 | |
1060 | switch (opt) { |
1061 | case OSSL_CMP_OPT_LOG_VERBOSITY: |
1062 | return ctx->log_verbosity; |
1063 | case OSSL_CMP_OPT_IMPLICITCONFIRM: |
1064 | return ctx->implicitConfirm; |
1065 | case OSSL_CMP_OPT_DISABLECONFIRM: |
1066 | return ctx->disableConfirm; |
1067 | case OSSL_CMP_OPT_UNPROTECTED_SEND: |
1068 | return ctx->unprotectedSend; |
1069 | case OSSL_CMP_OPT_UNPROTECTED_ERRORS: |
1070 | return ctx->unprotectedErrors; |
1071 | case OSSL_CMP_OPT_VALIDITYDAYS: |
1072 | return ctx->days; |
1073 | case OSSL_CMP_OPT_SUBJECTALTNAME_NODEFAULT: |
1074 | return ctx->SubjectAltName_nodefault; |
1075 | case OSSL_CMP_OPT_SUBJECTALTNAME_CRITICAL: |
1076 | return ctx->setSubjectAltNameCritical; |
1077 | case OSSL_CMP_OPT_POLICIES_CRITICAL: |
1078 | return ctx->setPoliciesCritical; |
1079 | case OSSL_CMP_OPT_IGNORE_KEYUSAGE: |
1080 | return ctx->ignore_keyusage; |
1081 | case OSSL_CMP_OPT_POPOMETHOD: |
1082 | return ctx->popoMethod; |
1083 | case OSSL_CMP_OPT_DIGEST_ALGNID: |
1084 | return ctx->digest; |
1085 | case OSSL_CMP_OPT_OWF_ALGNID: |
1086 | return ctx->pbm_owf; |
1087 | case OSSL_CMP_OPT_MAC_ALGNID: |
1088 | return ctx->pbm_mac; |
1089 | case OSSL_CMP_OPT_MSGTIMEOUT: |
1090 | return ctx->msgtimeout; |
1091 | case OSSL_CMP_OPT_TOTALTIMEOUT: |
1092 | return ctx->totaltimeout; |
1093 | case OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR: |
1094 | return ctx->permitTAInExtraCertsForIR; |
1095 | case OSSL_CMP_OPT_REVOCATION_REASON: |
1096 | return ctx->revocationReason; |
1097 | default: |
1098 | CMPerr(0, CMP_R_INVALID_ARGS); |
1099 | return -1; |
1100 | } |
1101 | } |
1102 | |