crypto/cmp/cmp_asn.c

   1 /*
   2  * Copyright 2007-2020 The OpenSSL Project Authors. All Rights Reserved.
   3  * Copyright Nokia 2007-2019
   4  * Copyright Siemens AG 2015-2019
   5  *
   6  * Licensed under the Apache License 2.0 (the "License").  You may not use
   7  * this file except in compliance with the License.  You can obtain a copy
   8  * in the file LICENSE in the source distribution or at
   9  * https://www.openssl.org/source/license.html
  10  */
  11
  12 #include <openssl/asn1t.h>
  13
  14 #include "cmp_local.h"
  15
  16 /* explicit #includes not strictly needed since implied by the above: */
  17 #include <openssl/cmp.h>
  18 #include <openssl/crmf.h>
  19
  20 DEFINE_STACK_OF(OSSL_CMP_ITAV)
  21
  22 /* ASN.1 declarations from RFC4210 */
  23 ASN1_SEQUENCE(OSSL_CMP_REVANNCONTENT) = {
  24     /* OSSL_CMP_PKISTATUS is effectively ASN1_INTEGER so it is used directly */
  25     ASN1_SIMPLE(OSSL_CMP_REVANNCONTENT, status, ASN1_INTEGER),
  26     ASN1_SIMPLE(OSSL_CMP_REVANNCONTENT, certId, OSSL_CRMF_CERTID),
  27     ASN1_SIMPLE(OSSL_CMP_REVANNCONTENT, willBeRevokedAt, ASN1_GENERALIZEDTIME),
  28     ASN1_SIMPLE(OSSL_CMP_REVANNCONTENT, badSinceDate, ASN1_GENERALIZEDTIME),
  29     ASN1_OPT(OSSL_CMP_REVANNCONTENT, crlDetails, X509_EXTENSIONS)
  30 } ASN1_SEQUENCE_END(OSSL_CMP_REVANNCONTENT)
  31 IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_REVANNCONTENT)
  32
  33
  34 ASN1_SEQUENCE(OSSL_CMP_CHALLENGE) = {
  35     ASN1_OPT(OSSL_CMP_CHALLENGE, owf, X509_ALGOR),
  36     ASN1_SIMPLE(OSSL_CMP_CHALLENGE, witness, ASN1_OCTET_STRING),
  37     ASN1_SIMPLE(OSSL_CMP_CHALLENGE, challenge, ASN1_OCTET_STRING)
  38 } ASN1_SEQUENCE_END(OSSL_CMP_CHALLENGE)
  39 IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_CHALLENGE)
  40
  41
  42 ASN1_ITEM_TEMPLATE(OSSL_CMP_POPODECKEYCHALLCONTENT) =
  43     ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0,
  44                           OSSL_CMP_POPODECKEYCHALLCONTENT, OSSL_CMP_CHALLENGE)
  45 ASN1_ITEM_TEMPLATE_END(OSSL_CMP_POPODECKEYCHALLCONTENT)
  46
  47
  48 ASN1_ITEM_TEMPLATE(OSSL_CMP_POPODECKEYRESPCONTENT) =
  49     ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0,
  50                           OSSL_CMP_POPODECKEYRESPCONTENT, ASN1_INTEGER)
  51 ASN1_ITEM_TEMPLATE_END(OSSL_CMP_POPODECKEYRESPCONTENT)
  52
  53
  54 ASN1_SEQUENCE(OSSL_CMP_CAKEYUPDANNCONTENT) = {
  55     /* OSSL_CMP_CMPCERTIFICATE is effectively X509 so it is used directly */
  56     ASN1_SIMPLE(OSSL_CMP_CAKEYUPDANNCONTENT, oldWithNew, X509),
  57     /* OSSL_CMP_CMPCERTIFICATE is effectively X509 so it is used directly */
  58     ASN1_SIMPLE(OSSL_CMP_CAKEYUPDANNCONTENT, newWithOld, X509),
  59     /* OSSL_CMP_CMPCERTIFICATE is effectively X509 so it is used directly */
  60     ASN1_SIMPLE(OSSL_CMP_CAKEYUPDANNCONTENT, newWithNew, X509)
  61 } ASN1_SEQUENCE_END(OSSL_CMP_CAKEYUPDANNCONTENT)
  62 IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_CAKEYUPDANNCONTENT)
  63
  64
  65 ASN1_SEQUENCE(OSSL_CMP_ERRORMSGCONTENT) = {
  66     ASN1_SIMPLE(OSSL_CMP_ERRORMSGCONTENT, pKIStatusInfo, OSSL_CMP_PKISI),
  67     ASN1_OPT(OSSL_CMP_ERRORMSGCONTENT, errorCode, ASN1_INTEGER),
  68     /*
  69      * OSSL_CMP_PKIFREETEXT is effectively a sequence of ASN1_UTF8STRING
  70      * so it is used directly
  71      *
  72      */
  73     ASN1_SEQUENCE_OF_OPT(OSSL_CMP_ERRORMSGCONTENT, errorDetails,
  74                          ASN1_UTF8STRING)
  75 } ASN1_SEQUENCE_END(OSSL_CMP_ERRORMSGCONTENT)
  76 IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_ERRORMSGCONTENT)
  77
  78 ASN1_ADB_TEMPLATE(infotypeandvalue_default) = ASN1_OPT(OSSL_CMP_ITAV,
  79                                                        infoValue.other,
  80                                                        ASN1_ANY);
  81 /* ITAV means InfoTypeAndValue */
  82 ASN1_ADB(OSSL_CMP_ITAV) = {
  83     /* OSSL_CMP_CMPCERTIFICATE is effectively X509 so it is used directly */
  84     ADB_ENTRY(NID_id_it_caProtEncCert, ASN1_OPT(OSSL_CMP_ITAV,
  85                                                 infoValue.caProtEncCert, X509)),
  86     ADB_ENTRY(NID_id_it_signKeyPairTypes,
  87               ASN1_SEQUENCE_OF_OPT(OSSL_CMP_ITAV,
  88                                    infoValue.signKeyPairTypes, X509_ALGOR)),
  89     ADB_ENTRY(NID_id_it_encKeyPairTypes,
  90               ASN1_SEQUENCE_OF_OPT(OSSL_CMP_ITAV,
  91                                    infoValue.encKeyPairTypes, X509_ALGOR)),
  92     ADB_ENTRY(NID_id_it_preferredSymmAlg,
  93               ASN1_OPT(OSSL_CMP_ITAV, infoValue.preferredSymmAlg,
  94                        X509_ALGOR)),
  95     ADB_ENTRY(NID_id_it_caKeyUpdateInfo,
  96               ASN1_OPT(OSSL_CMP_ITAV, infoValue.caKeyUpdateInfo,
  97                        OSSL_CMP_CAKEYUPDANNCONTENT)),
  98     ADB_ENTRY(NID_id_it_currentCRL,
  99               ASN1_OPT(OSSL_CMP_ITAV, infoValue.currentCRL, X509_CRL)),
 100     ADB_ENTRY(NID_id_it_unsupportedOIDs,
 101               ASN1_SEQUENCE_OF_OPT(OSSL_CMP_ITAV,
 102                                    infoValue.unsupportedOIDs, ASN1_OBJECT)),
 103     ADB_ENTRY(NID_id_it_keyPairParamReq,
 104               ASN1_OPT(OSSL_CMP_ITAV, infoValue.keyPairParamReq,
 105                        ASN1_OBJECT)),
 106     ADB_ENTRY(NID_id_it_keyPairParamRep,
 107               ASN1_OPT(OSSL_CMP_ITAV, infoValue.keyPairParamRep,
 108                        X509_ALGOR)),
 109     ADB_ENTRY(NID_id_it_revPassphrase,
 110               ASN1_OPT(OSSL_CMP_ITAV, infoValue.revPassphrase,
 111                        OSSL_CRMF_ENCRYPTEDVALUE)),
 112     ADB_ENTRY(NID_id_it_implicitConfirm,
 113               ASN1_OPT(OSSL_CMP_ITAV, infoValue.implicitConfirm,
 114                        ASN1_NULL)),
 115     ADB_ENTRY(NID_id_it_confirmWaitTime,
 116               ASN1_OPT(OSSL_CMP_ITAV, infoValue.confirmWaitTime,
 117                        ASN1_GENERALIZEDTIME)),
 118     ADB_ENTRY(NID_id_it_origPKIMessage,
 119               ASN1_OPT(OSSL_CMP_ITAV, infoValue.origPKIMessage,
 120                        OSSL_CMP_MSGS)),
 121     ADB_ENTRY(NID_id_it_suppLangTags,
 122               ASN1_SEQUENCE_OF_OPT(OSSL_CMP_ITAV, infoValue.suppLangTagsValue,
 123                                    ASN1_UTF8STRING)),
 124 } ASN1_ADB_END(OSSL_CMP_ITAV, 0, infoType, 0,
 125                &infotypeandvalue_default_tt, NULL);
 126
 127
 128 ASN1_SEQUENCE(OSSL_CMP_ITAV) = {
 129     ASN1_SIMPLE(OSSL_CMP_ITAV, infoType, ASN1_OBJECT),
 130     ASN1_ADB_OBJECT(OSSL_CMP_ITAV)
 131 } ASN1_SEQUENCE_END(OSSL_CMP_ITAV)
 132 IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_ITAV)
 133 IMPLEMENT_ASN1_DUP_FUNCTION(OSSL_CMP_ITAV)
 134
 135 OSSL_CMP_ITAV *OSSL_CMP_ITAV_create(ASN1_OBJECT *type, ASN1_TYPE *value)
 136 {
 137     OSSL_CMP_ITAV *itav;
 138
 139     if (type == NULL || (itav = OSSL_CMP_ITAV_new()) == NULL)
 140         return NULL;
 141     OSSL_CMP_ITAV_set0(itav, type, value);
 142     return itav;
 143 }
 144
 145 void OSSL_CMP_ITAV_set0(OSSL_CMP_ITAV *itav, ASN1_OBJECT *type,
 146                         ASN1_TYPE *value)
 147 {
 148     itav->infoType = type;
 149     itav->infoValue.other = value;
 150 }
 151
 152 ASN1_OBJECT *OSSL_CMP_ITAV_get0_type(const OSSL_CMP_ITAV *itav)
 153 {
 154     if (itav == NULL)
 155         return NULL;
 156     return itav->infoType;
 157 }
 158
 159 ASN1_TYPE *OSSL_CMP_ITAV_get0_value(const OSSL_CMP_ITAV *itav)
 160 {
 161     if (itav == NULL)
 162         return NULL;
 163     return itav->infoValue.other;
 164 }
 165
 166 int OSSL_CMP_ITAV_push0_stack_item(STACK_OF(OSSL_CMP_ITAV) **itav_sk_p,
 167                                    OSSL_CMP_ITAV *itav)
 168 {
 169     int created = 0;
 170
 171     if (itav_sk_p == NULL || itav == NULL) {
 172         CMPerr(0, CMP_R_NULL_ARGUMENT);
 173         goto err;
 174     }
 175
 176     if (*itav_sk_p == NULL) {
 177         if ((*itav_sk_p = sk_OSSL_CMP_ITAV_new_null()) == NULL)
 178             goto err;
 179         created = 1;
 180     }
 181     if (!sk_OSSL_CMP_ITAV_push(*itav_sk_p, itav))
 182         goto err;
 183     return 1;
 184
 185  err:
 186     if (created != 0) {
 187         sk_OSSL_CMP_ITAV_free(*itav_sk_p);
 188         *itav_sk_p = NULL;
 189     }
 190     return 0;
 191 }
 192
 193 /* get ASN.1 encoded integer, return -1 on error */
 194 int ossl_cmp_asn1_get_int(const ASN1_INTEGER *a)
 195 {
 196     int64_t res;
 197
 198     if (!ASN1_INTEGER_get_int64(&res, a)) {
 199         CMPerr(0, ASN1_R_INVALID_NUMBER);
 200         return -1;
 201     }
 202     if (res < INT_MIN) {
 203         CMPerr(0, ASN1_R_TOO_SMALL);
 204         return -1;
 205     }
 206     if (res > INT_MAX) {
 207         CMPerr(0, ASN1_R_TOO_LARGE);
 208         return -1;
 209     }
 210     return (int)res;
 211 }
 212
 213 ASN1_CHOICE(OSSL_CMP_CERTORENCCERT) = {
 214     /* OSSL_CMP_CMPCERTIFICATE is effectively X509 so it is used directly */
 215     ASN1_EXP(OSSL_CMP_CERTORENCCERT, value.certificate, X509, 0),
 216     ASN1_EXP(OSSL_CMP_CERTORENCCERT, value.encryptedCert,
 217              OSSL_CRMF_ENCRYPTEDVALUE, 1),
 218 } ASN1_CHOICE_END(OSSL_CMP_CERTORENCCERT)
 219 IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_CERTORENCCERT)
 220
 221
 222 ASN1_SEQUENCE(OSSL_CMP_CERTIFIEDKEYPAIR) = {
 223     ASN1_SIMPLE(OSSL_CMP_CERTIFIEDKEYPAIR, certOrEncCert,
 224                 OSSL_CMP_CERTORENCCERT),
 225     ASN1_EXP_OPT(OSSL_CMP_CERTIFIEDKEYPAIR, privateKey,
 226                  OSSL_CRMF_ENCRYPTEDVALUE, 0),
 227     ASN1_EXP_OPT(OSSL_CMP_CERTIFIEDKEYPAIR, publicationInfo,
 228                  OSSL_CRMF_PKIPUBLICATIONINFO, 1)
 229 } ASN1_SEQUENCE_END(OSSL_CMP_CERTIFIEDKEYPAIR)
 230 IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_CERTIFIEDKEYPAIR)
 231
 232
 233 ASN1_SEQUENCE(OSSL_CMP_REVDETAILS) = {
 234     ASN1_SIMPLE(OSSL_CMP_REVDETAILS, certDetails, OSSL_CRMF_CERTTEMPLATE),
 235     ASN1_OPT(OSSL_CMP_REVDETAILS, crlEntryDetails, X509_EXTENSIONS)
 236 } ASN1_SEQUENCE_END(OSSL_CMP_REVDETAILS)
 237 IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_REVDETAILS)
 238
 239
 240 ASN1_ITEM_TEMPLATE(OSSL_CMP_REVREQCONTENT) =
 241     ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, OSSL_CMP_REVREQCONTENT,
 242                           OSSL_CMP_REVDETAILS)
 243 ASN1_ITEM_TEMPLATE_END(OSSL_CMP_REVREQCONTENT)
 244
 245
 246 ASN1_SEQUENCE(OSSL_CMP_REVREPCONTENT) = {
 247     ASN1_SEQUENCE_OF(OSSL_CMP_REVREPCONTENT, status, OSSL_CMP_PKISI),
 248     ASN1_EXP_SEQUENCE_OF_OPT(OSSL_CMP_REVREPCONTENT, revCerts, OSSL_CRMF_CERTID,
 249                              0),
 250     ASN1_EXP_SEQUENCE_OF_OPT(OSSL_CMP_REVREPCONTENT, crls, X509_CRL, 1)
 251 } ASN1_SEQUENCE_END(OSSL_CMP_REVREPCONTENT)
 252 IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_REVREPCONTENT)
 253
 254
 255 ASN1_SEQUENCE(OSSL_CMP_KEYRECREPCONTENT) = {
 256     ASN1_SIMPLE(OSSL_CMP_KEYRECREPCONTENT, status, OSSL_CMP_PKISI),
 257     ASN1_EXP_OPT(OSSL_CMP_KEYRECREPCONTENT, newSigCert, X509, 0),
 258     ASN1_EXP_SEQUENCE_OF_OPT(OSSL_CMP_KEYRECREPCONTENT, caCerts, X509, 1),
 259     ASN1_EXP_SEQUENCE_OF_OPT(OSSL_CMP_KEYRECREPCONTENT, keyPairHist,
 260                              OSSL_CMP_CERTIFIEDKEYPAIR, 2)
 261 } ASN1_SEQUENCE_END(OSSL_CMP_KEYRECREPCONTENT)
 262 IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_KEYRECREPCONTENT)
 263
 264
 265 ASN1_ITEM_TEMPLATE(OSSL_CMP_PKISTATUS) =
 266     ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_UNIVERSAL, 0, status, ASN1_INTEGER)
 267 ASN1_ITEM_TEMPLATE_END(OSSL_CMP_PKISTATUS)
 268
 269 ASN1_SEQUENCE(OSSL_CMP_PKISI) = {
 270     ASN1_SIMPLE(OSSL_CMP_PKISI, status, OSSL_CMP_PKISTATUS),
 271     /*
 272      * CMP_PKIFREETEXT is effectively a sequence of ASN1_UTF8STRING
 273      * so it is used directly
 274      */
 275     ASN1_SEQUENCE_OF_OPT(OSSL_CMP_PKISI, statusString, ASN1_UTF8STRING),
 276     /*
 277      * OSSL_CMP_PKIFAILUREINFO is effectively ASN1_BIT_STRING so used directly
 278      */
 279     ASN1_OPT(OSSL_CMP_PKISI, failInfo, ASN1_BIT_STRING)
 280 } ASN1_SEQUENCE_END(OSSL_CMP_PKISI)
 281 IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_PKISI)
 282 IMPLEMENT_ASN1_DUP_FUNCTION(OSSL_CMP_PKISI)
 283
 284 ASN1_SEQUENCE(OSSL_CMP_CERTSTATUS) = {
 285     ASN1_SIMPLE(OSSL_CMP_CERTSTATUS, certHash, ASN1_OCTET_STRING),
 286     ASN1_SIMPLE(OSSL_CMP_CERTSTATUS, certReqId, ASN1_INTEGER),
 287     ASN1_OPT(OSSL_CMP_CERTSTATUS, statusInfo, OSSL_CMP_PKISI)
 288 } ASN1_SEQUENCE_END(OSSL_CMP_CERTSTATUS)
 289 IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_CERTSTATUS)
 290
 291 ASN1_ITEM_TEMPLATE(OSSL_CMP_CERTCONFIRMCONTENT) =
 292     ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, OSSL_CMP_CERTCONFIRMCONTENT,
 293                           OSSL_CMP_CERTSTATUS)
 294 ASN1_ITEM_TEMPLATE_END(OSSL_CMP_CERTCONFIRMCONTENT)
 295
 296 ASN1_SEQUENCE(OSSL_CMP_CERTRESPONSE) = {
 297     ASN1_SIMPLE(OSSL_CMP_CERTRESPONSE, certReqId, ASN1_INTEGER),
 298     ASN1_SIMPLE(OSSL_CMP_CERTRESPONSE, status, OSSL_CMP_PKISI),
 299     ASN1_OPT(OSSL_CMP_CERTRESPONSE, certifiedKeyPair,
 300              OSSL_CMP_CERTIFIEDKEYPAIR),
 301     ASN1_OPT(OSSL_CMP_CERTRESPONSE, rspInfo, ASN1_OCTET_STRING)
 302 } ASN1_SEQUENCE_END(OSSL_CMP_CERTRESPONSE)
 303 IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_CERTRESPONSE)
 304
 305 ASN1_SEQUENCE(OSSL_CMP_POLLREQ) = {
 306     ASN1_SIMPLE(OSSL_CMP_POLLREQ, certReqId, ASN1_INTEGER)
 307 } ASN1_SEQUENCE_END(OSSL_CMP_POLLREQ)
 308 IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_POLLREQ)
 309
 310 ASN1_ITEM_TEMPLATE(OSSL_CMP_POLLREQCONTENT) =
 311     ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, OSSL_CMP_POLLREQCONTENT,
 312                           OSSL_CMP_POLLREQ)
 313 ASN1_ITEM_TEMPLATE_END(OSSL_CMP_POLLREQCONTENT)
 314
 315 ASN1_SEQUENCE(OSSL_CMP_POLLREP) = {
 316     ASN1_SIMPLE(OSSL_CMP_POLLREP, certReqId, ASN1_INTEGER),
 317     ASN1_SIMPLE(OSSL_CMP_POLLREP, checkAfter, ASN1_INTEGER),
 318     ASN1_SEQUENCE_OF_OPT(OSSL_CMP_POLLREP, reason, ASN1_UTF8STRING),
 319 } ASN1_SEQUENCE_END(OSSL_CMP_POLLREP)
 320 IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_POLLREP)
 321
 322 ASN1_ITEM_TEMPLATE(OSSL_CMP_POLLREPCONTENT) =
 323     ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0,
 324                           OSSL_CMP_POLLREPCONTENT,
 325                           OSSL_CMP_POLLREP)
 326 ASN1_ITEM_TEMPLATE_END(OSSL_CMP_POLLREPCONTENT)
 327
 328 ASN1_SEQUENCE(OSSL_CMP_CERTREPMESSAGE) = {
 329     /* OSSL_CMP_CMPCERTIFICATE is effectively X509 so it is used directly */
 330     ASN1_EXP_SEQUENCE_OF_OPT(OSSL_CMP_CERTREPMESSAGE, caPubs, X509, 1),
 331     ASN1_SEQUENCE_OF(OSSL_CMP_CERTREPMESSAGE, response, OSSL_CMP_CERTRESPONSE)
 332 } ASN1_SEQUENCE_END(OSSL_CMP_CERTREPMESSAGE)
 333 IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_CERTREPMESSAGE)
 334
 335 ASN1_ITEM_TEMPLATE(OSSL_CMP_GENMSGCONTENT) =
 336     ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, OSSL_CMP_GENMSGCONTENT,
 337                           OSSL_CMP_ITAV)
 338 ASN1_ITEM_TEMPLATE_END(OSSL_CMP_GENMSGCONTENT)
 339
 340 ASN1_ITEM_TEMPLATE(OSSL_CMP_GENREPCONTENT) =
 341     ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, OSSL_CMP_GENREPCONTENT,
 342                           OSSL_CMP_ITAV)
 343 ASN1_ITEM_TEMPLATE_END(OSSL_CMP_GENREPCONTENT)
 344
 345 ASN1_ITEM_TEMPLATE(OSSL_CMP_CRLANNCONTENT) =
 346     ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0,
 347                           OSSL_CMP_CRLANNCONTENT, X509_CRL)
 348 ASN1_ITEM_TEMPLATE_END(OSSL_CMP_CRLANNCONTENT)
 349
 350 ASN1_CHOICE(OSSL_CMP_PKIBODY) = {
 351     ASN1_EXP(OSSL_CMP_PKIBODY, value.ir, OSSL_CRMF_MSGS, 0),
 352     ASN1_EXP(OSSL_CMP_PKIBODY, value.ip, OSSL_CMP_CERTREPMESSAGE, 1),
 353     ASN1_EXP(OSSL_CMP_PKIBODY, value.cr, OSSL_CRMF_MSGS, 2),
 354     ASN1_EXP(OSSL_CMP_PKIBODY, value.cp, OSSL_CMP_CERTREPMESSAGE, 3),
 355     ASN1_EXP(OSSL_CMP_PKIBODY, value.p10cr, X509_REQ, 4),
 356     ASN1_EXP(OSSL_CMP_PKIBODY, value.popdecc,
 357              OSSL_CMP_POPODECKEYCHALLCONTENT, 5),
 358     ASN1_EXP(OSSL_CMP_PKIBODY, value.popdecr,
 359              OSSL_CMP_POPODECKEYRESPCONTENT, 6),
 360     ASN1_EXP(OSSL_CMP_PKIBODY, value.kur, OSSL_CRMF_MSGS, 7),
 361     ASN1_EXP(OSSL_CMP_PKIBODY, value.kup, OSSL_CMP_CERTREPMESSAGE, 8),
 362     ASN1_EXP(OSSL_CMP_PKIBODY, value.krr, OSSL_CRMF_MSGS, 9),
 363     ASN1_EXP(OSSL_CMP_PKIBODY, value.krp, OSSL_CMP_KEYRECREPCONTENT, 10),
 364     ASN1_EXP(OSSL_CMP_PKIBODY, value.rr, OSSL_CMP_REVREQCONTENT, 11),
 365     ASN1_EXP(OSSL_CMP_PKIBODY, value.rp, OSSL_CMP_REVREPCONTENT, 12),
 366     ASN1_EXP(OSSL_CMP_PKIBODY, value.ccr, OSSL_CRMF_MSGS, 13),
 367     ASN1_EXP(OSSL_CMP_PKIBODY, value.ccp, OSSL_CMP_CERTREPMESSAGE, 14),
 368     ASN1_EXP(OSSL_CMP_PKIBODY, value.ckuann, OSSL_CMP_CAKEYUPDANNCONTENT, 15),
 369     ASN1_EXP(OSSL_CMP_PKIBODY, value.cann, X509, 16),
 370     ASN1_EXP(OSSL_CMP_PKIBODY, value.rann, OSSL_CMP_REVANNCONTENT, 17),
 371     ASN1_EXP(OSSL_CMP_PKIBODY, value.crlann, OSSL_CMP_CRLANNCONTENT, 18),
 372     ASN1_EXP(OSSL_CMP_PKIBODY, value.pkiconf, ASN1_ANY, 19),
 373     ASN1_EXP(OSSL_CMP_PKIBODY, value.nested, OSSL_CMP_MSGS, 20),
 374     ASN1_EXP(OSSL_CMP_PKIBODY, value.genm, OSSL_CMP_GENMSGCONTENT, 21),
 375     ASN1_EXP(OSSL_CMP_PKIBODY, value.genp, OSSL_CMP_GENREPCONTENT, 22),
 376     ASN1_EXP(OSSL_CMP_PKIBODY, value.error, OSSL_CMP_ERRORMSGCONTENT, 23),
 377     ASN1_EXP(OSSL_CMP_PKIBODY, value.certConf, OSSL_CMP_CERTCONFIRMCONTENT, 24),
 378     ASN1_EXP(OSSL_CMP_PKIBODY, value.pollReq, OSSL_CMP_POLLREQCONTENT, 25),
 379     ASN1_EXP(OSSL_CMP_PKIBODY, value.pollRep, OSSL_CMP_POLLREPCONTENT, 26),
 380 } ASN1_CHOICE_END(OSSL_CMP_PKIBODY)
 381 IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_PKIBODY)
 382
 383 ASN1_SEQUENCE(OSSL_CMP_PKIHEADER) = {
 384     ASN1_SIMPLE(OSSL_CMP_PKIHEADER, pvno, ASN1_INTEGER),
 385     ASN1_SIMPLE(OSSL_CMP_PKIHEADER, sender, GENERAL_NAME),
 386     ASN1_SIMPLE(OSSL_CMP_PKIHEADER, recipient, GENERAL_NAME),
 387     ASN1_EXP_OPT(OSSL_CMP_PKIHEADER, messageTime, ASN1_GENERALIZEDTIME, 0),
 388     ASN1_EXP_OPT(OSSL_CMP_PKIHEADER, protectionAlg, X509_ALGOR, 1),
 389     ASN1_EXP_OPT(OSSL_CMP_PKIHEADER, senderKID, ASN1_OCTET_STRING, 2),
 390     ASN1_EXP_OPT(OSSL_CMP_PKIHEADER, recipKID, ASN1_OCTET_STRING, 3),
 391     ASN1_EXP_OPT(OSSL_CMP_PKIHEADER, transactionID, ASN1_OCTET_STRING, 4),
 392     ASN1_EXP_OPT(OSSL_CMP_PKIHEADER, senderNonce, ASN1_OCTET_STRING, 5),
 393     ASN1_EXP_OPT(OSSL_CMP_PKIHEADER, recipNonce, ASN1_OCTET_STRING, 6),
 394     /*
 395      * OSSL_CMP_PKIFREETEXT is effectively a sequence of ASN1_UTF8STRING
 396      * so it is used directly
 397      */
 398     ASN1_EXP_SEQUENCE_OF_OPT(OSSL_CMP_PKIHEADER, freeText, ASN1_UTF8STRING, 7),
 399     ASN1_EXP_SEQUENCE_OF_OPT(OSSL_CMP_PKIHEADER, generalInfo,
 400                              OSSL_CMP_ITAV, 8)
 401 } ASN1_SEQUENCE_END(OSSL_CMP_PKIHEADER)
 402 IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_PKIHEADER)
 403
 404 ASN1_SEQUENCE(OSSL_CMP_PROTECTEDPART) = {
 405     ASN1_SIMPLE(OSSL_CMP_MSG, header, OSSL_CMP_PKIHEADER),
 406     ASN1_SIMPLE(OSSL_CMP_MSG, body, OSSL_CMP_PKIBODY)
 407 } ASN1_SEQUENCE_END(OSSL_CMP_PROTECTEDPART)
 408 IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_PROTECTEDPART)
 409
 410 ASN1_SEQUENCE(OSSL_CMP_MSG) = {
 411     ASN1_SIMPLE(OSSL_CMP_MSG, header, OSSL_CMP_PKIHEADER),
 412     ASN1_SIMPLE(OSSL_CMP_MSG, body, OSSL_CMP_PKIBODY),
 413     ASN1_EXP_OPT(OSSL_CMP_MSG, protection, ASN1_BIT_STRING, 0),
 414     /* OSSL_CMP_CMPCERTIFICATE is effectively X509 so it is used directly */
 415     ASN1_EXP_SEQUENCE_OF_OPT(OSSL_CMP_MSG, extraCerts, X509, 1)
 416 } ASN1_SEQUENCE_END(OSSL_CMP_MSG)
 417 IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_MSG)
 418 IMPLEMENT_ASN1_DUP_FUNCTION(OSSL_CMP_MSG)
 419
 420 ASN1_ITEM_TEMPLATE(OSSL_CMP_MSGS) =
 421     ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, OSSL_CMP_MSGS,
 422                           OSSL_CMP_MSG)
 423 ASN1_ITEM_TEMPLATE_END(OSSL_CMP_MSGS)