2 * Copyright 2007-2020 The OpenSSL Project Authors. All Rights Reserved.
3 * Copyright Nokia 2007-2019
4 * Copyright Siemens AG 2015-2019
6 * Licensed under the Apache License 2.0 (the "License"). You may not use
7 * this file except in compliance with the License. You can obtain a copy
8 * in the file LICENSE in the source distribution or at
9 * https://www.openssl.org/source/license.html
12 /* CMP functions for PKIMessage construction */
14 #include "cmp_local.h"
16 /* explicit #includes not strictly needed since implied by the above: */
17 #include <openssl/asn1t.h>
18 #include <openssl/cmp.h>
19 #include <openssl/crmf.h>
20 #include <openssl/err.h>
21 #include <openssl/x509.h>
23 DEFINE_STACK_OF(OSSL_CMP_CERTSTATUS)
24 DEFINE_STACK_OF(OSSL_CMP_ITAV)
25 DEFINE_STACK_OF(GENERAL_NAME)
27 DEFINE_STACK_OF(X509_EXTENSION)
28 DEFINE_STACK_OF(OSSL_CMP_PKISI)
29 DEFINE_STACK_OF(OSSL_CRMF_MSG)
30 DEFINE_STACK_OF(OSSL_CMP_CERTRESPONSE)
31 DEFINE_STACK_OF(OSSL_CRMF_CERTID)
32 DEFINE_STACK_OF(ASN1_UTF8STRING)
34 OSSL_CMP_PKIHEADER *OSSL_CMP_MSG_get0_header(const OSSL_CMP_MSG *msg)
37 CMPerr(0, CMP_R_NULL_ARGUMENT);
43 const char *ossl_cmp_bodytype_to_string(int type)
45 static const char *type_names[] = {
46 "IR", "IP", "CR", "CP", "P10CR",
47 "POPDECC", "POPDECR", "KUR", "KUP",
48 "KRR", "KRP", "RR", "RP", "CCR", "CCP",
49 "CKUANN", "CANN", "RANN", "CRLANN", "PKICONF", "NESTED",
50 "GENM", "GENP", "ERROR", "CERTCONF", "POLLREQ", "POLLREP",
53 if (type < 0 || type > OSSL_CMP_PKIBODY_TYPE_MAX)
54 return "illegal body type";
55 return type_names[type];
58 int ossl_cmp_msg_set_bodytype(OSSL_CMP_MSG *msg, int type)
60 if (!ossl_assert(msg != NULL && msg->body != NULL))
63 msg->body->type = type;
67 int ossl_cmp_msg_get_bodytype(const OSSL_CMP_MSG *msg)
69 if (!ossl_assert(msg != NULL && msg->body != NULL))
72 return msg->body->type;
75 /* Add an extension to the referenced extension stack, which may be NULL */
76 static int add1_extension(X509_EXTENSIONS **pexts, int nid, int crit, void *ex)
81 if (!ossl_assert(pexts != NULL)) /* pointer to var must not be NULL */
84 if ((ext = X509V3_EXT_i2d(nid, crit, ex)) == NULL)
87 res = X509v3_add_ext(pexts, ext, 0) != NULL;
88 X509_EXTENSION_free(ext);
92 /* Add a CRL revocation reason code to extension stack, which may be NULL */
93 static int add_crl_reason_extension(X509_EXTENSIONS **pexts, int reason_code)
95 ASN1_ENUMERATED *val = ASN1_ENUMERATED_new();
98 if (val != NULL && ASN1_ENUMERATED_set(val, reason_code))
99 res = add1_extension(pexts, NID_crl_reason, 0 /* non-critical */, val);
100 ASN1_ENUMERATED_free(val);
104 OSSL_CMP_MSG *ossl_cmp_msg_create(OSSL_CMP_CTX *ctx, int bodytype)
106 OSSL_CMP_MSG *msg = NULL;
108 if (!ossl_assert(ctx != NULL))
111 if ((msg = OSSL_CMP_MSG_new()) == NULL)
113 if (!ossl_cmp_hdr_init(ctx, msg->header)
114 || !ossl_cmp_msg_set_bodytype(msg, bodytype))
116 if (ctx->geninfo_ITAVs != NULL
117 && !ossl_cmp_hdr_generalInfo_push1_items(msg->header,
122 case OSSL_CMP_PKIBODY_IR:
123 case OSSL_CMP_PKIBODY_CR:
124 case OSSL_CMP_PKIBODY_KUR:
125 if ((msg->body->value.ir = OSSL_CRMF_MSGS_new()) == NULL)
129 case OSSL_CMP_PKIBODY_P10CR:
130 if (ctx->p10CSR == NULL) {
131 CMPerr(0, CMP_R_MISSING_P10CSR);
134 if ((msg->body->value.p10cr = X509_REQ_dup(ctx->p10CSR)) == NULL)
138 case OSSL_CMP_PKIBODY_IP:
139 case OSSL_CMP_PKIBODY_CP:
140 case OSSL_CMP_PKIBODY_KUP:
141 if ((msg->body->value.ip = OSSL_CMP_CERTREPMESSAGE_new()) == NULL)
145 case OSSL_CMP_PKIBODY_RR:
146 if ((msg->body->value.rr = sk_OSSL_CMP_REVDETAILS_new_null()) == NULL)
149 case OSSL_CMP_PKIBODY_RP:
150 if ((msg->body->value.rp = OSSL_CMP_REVREPCONTENT_new()) == NULL)
154 case OSSL_CMP_PKIBODY_CERTCONF:
155 if ((msg->body->value.certConf =
156 sk_OSSL_CMP_CERTSTATUS_new_null()) == NULL)
159 case OSSL_CMP_PKIBODY_PKICONF:
160 if ((msg->body->value.pkiconf = ASN1_TYPE_new()) == NULL)
162 ASN1_TYPE_set(msg->body->value.pkiconf, V_ASN1_NULL, NULL);
165 case OSSL_CMP_PKIBODY_POLLREQ:
166 if ((msg->body->value.pollReq = sk_OSSL_CMP_POLLREQ_new_null()) == NULL)
169 case OSSL_CMP_PKIBODY_POLLREP:
170 if ((msg->body->value.pollRep = sk_OSSL_CMP_POLLREP_new_null()) == NULL)
174 case OSSL_CMP_PKIBODY_GENM:
175 case OSSL_CMP_PKIBODY_GENP:
176 if ((msg->body->value.genm = sk_OSSL_CMP_ITAV_new_null()) == NULL)
180 case OSSL_CMP_PKIBODY_ERROR:
181 if ((msg->body->value.error = OSSL_CMP_ERRORMSGCONTENT_new()) == NULL)
186 CMPerr(0, CMP_R_UNEXPECTED_PKIBODY);
191 OSSL_CMP_MSG_free(msg);
195 #define HAS_SAN(ctx) \
196 (sk_GENERAL_NAME_num((ctx)->subjectAltNames) > 0 \
197 || OSSL_CMP_CTX_reqExtensions_have_SAN(ctx) == 1)
199 static const X509_NAME *determine_subj(OSSL_CMP_CTX *ctx, X509 *refcert,
202 if (ctx->subjectName != NULL)
203 return ctx->subjectName;
205 if (refcert != NULL && (for_KUR || !HAS_SAN(ctx)))
207 * For KUR, copy subjectName from reference certificate.
208 * For IR or CR, do the same only if there is no subjectAltName.
210 return X509_get_subject_name(refcert);
214 OSSL_CRMF_MSG *OSSL_CMP_CTX_setup_CRM(OSSL_CMP_CTX *ctx, int for_KUR, int rid)
216 OSSL_CRMF_MSG *crm = NULL;
217 X509 *refcert = ctx->oldCert != NULL ? ctx->oldCert : ctx->cert;
218 /* refcert defaults to current client cert */
219 EVP_PKEY *rkey = OSSL_CMP_CTX_get0_newPkey(ctx, 0);
220 STACK_OF(GENERAL_NAME) *default_sans = NULL;
221 const X509_NAME *subject = determine_subj(ctx, refcert, for_KUR);
222 int crit = ctx->setSubjectAltNameCritical || subject == NULL;
223 /* RFC5280: subjectAltName MUST be critical if subject is null */
224 X509_EXTENSIONS *exts = NULL;
227 rkey = ctx->pkey; /* default is independent of ctx->oldCert */
229 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
230 CMPerr(0, CMP_R_NULL_ARGUMENT);
234 if (for_KUR && refcert == NULL) {
235 CMPerr(0, CMP_R_MISSING_REFERENCE_CERT);
238 if ((crm = OSSL_CRMF_MSG_new()) == NULL)
240 if (!OSSL_CRMF_MSG_set_certReqId(crm, rid)
242 * fill certTemplate, corresponding to CertificationRequestInfo
243 * of PKCS#10. The rkey param cannot be NULL so far -
244 * it could be NULL if centralized key creation was supported
246 || !OSSL_CRMF_CERTTEMPLATE_fill(OSSL_CRMF_MSG_get0_tmpl(crm), rkey,
247 subject, ctx->issuer,
250 if (ctx->days != 0) {
251 time_t now = time(NULL);
252 ASN1_TIME *notBefore = ASN1_TIME_adj(NULL, now, 0, 0);
253 ASN1_TIME *notAfter = ASN1_TIME_adj(NULL, now, ctx->days, 0);
255 if (notBefore == NULL
257 || !OSSL_CRMF_MSG_set0_validity(crm, notBefore, notAfter)) {
258 ASN1_TIME_free(notBefore);
259 ASN1_TIME_free(notAfter);
265 if (refcert != NULL && !ctx->SubjectAltName_nodefault)
266 default_sans = X509V3_get_d2i(X509_get0_extensions(refcert),
267 NID_subject_alt_name, NULL, NULL);
268 /* exts are copied from ctx to allow reuse */
269 if (ctx->reqExtensions != NULL) {
270 exts = sk_X509_EXTENSION_deep_copy(ctx->reqExtensions,
272 X509_EXTENSION_free);
276 if (sk_GENERAL_NAME_num(ctx->subjectAltNames) > 0
277 && !add1_extension(&exts, NID_subject_alt_name,
278 crit, ctx->subjectAltNames))
280 if (!HAS_SAN(ctx) && default_sans != NULL
281 && !add1_extension(&exts, NID_subject_alt_name, crit, default_sans))
283 if (ctx->policies != NULL
284 && !add1_extension(&exts, NID_certificate_policies,
285 ctx->setPoliciesCritical, ctx->policies))
287 if (!OSSL_CRMF_MSG_set0_extensions(crm, exts))
290 /* end fill certTemplate, now set any controls */
292 /* for KUR, set OldCertId according to D.6 */
294 OSSL_CRMF_CERTID *cid =
295 OSSL_CRMF_CERTID_gen(X509_get_issuer_name(refcert),
296 X509_get0_serialNumber(refcert));
301 ret = OSSL_CRMF_MSG_set1_regCtrl_oldCertID(crm, cid);
302 OSSL_CRMF_CERTID_free(cid);
310 OSSL_CRMF_MSG_free(crm);
314 sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
315 sk_GENERAL_NAME_pop_free(default_sans, GENERAL_NAME_free);
319 OSSL_CMP_MSG *ossl_cmp_certreq_new(OSSL_CMP_CTX *ctx, int type,
320 const OSSL_CRMF_MSG *crm)
323 OSSL_CRMF_MSG *local_crm = NULL;
325 if (!ossl_assert(ctx != NULL))
328 if (type != OSSL_CMP_PKIBODY_IR && type != OSSL_CMP_PKIBODY_CR
329 && type != OSSL_CMP_PKIBODY_KUR && type != OSSL_CMP_PKIBODY_P10CR) {
330 CMPerr(0, CMP_R_INVALID_ARGS);
334 if ((msg = ossl_cmp_msg_create(ctx, type)) == NULL)
338 if (ctx->implicitConfirm && !ossl_cmp_hdr_set_implicitConfirm(msg->header))
342 /* For P10CR the content has already been set in OSSL_CMP_MSG_create */
343 if (type != OSSL_CMP_PKIBODY_P10CR) {
344 EVP_PKEY *privkey = OSSL_CMP_CTX_get0_newPkey(ctx, 1);
347 privkey = ctx->pkey; /* default is independent of ctx->oldCert */
348 if (ctx->popoMethod == OSSL_CRMF_POPO_SIGNATURE && privkey == NULL) {
349 CMPerr(0, CMP_R_MISSING_PRIVATE_KEY);
353 local_crm = OSSL_CMP_CTX_setup_CRM(ctx,
354 type == OSSL_CMP_PKIBODY_KUR,
356 if (local_crm == NULL
357 || !OSSL_CRMF_MSG_create_popo(local_crm, privkey, ctx->digest,
361 if ((local_crm = OSSL_CRMF_MSG_dup(crm)) == NULL)
365 /* value.ir is same for cr and kur */
366 if (!sk_OSSL_CRMF_MSG_push(msg->body->value.ir, local_crm))
369 /* TODO: here optional 2nd certreqmsg could be pushed to the stack */
372 if (!ossl_cmp_msg_protect(ctx, msg))
378 CMPerr(0, CMP_R_ERROR_CREATING_CERTREQ);
379 OSSL_CRMF_MSG_free(local_crm);
380 OSSL_CMP_MSG_free(msg);
384 OSSL_CMP_MSG *ossl_cmp_certrep_new(OSSL_CMP_CTX *ctx, int bodytype,
385 int certReqId, OSSL_CMP_PKISI *si,
386 X509 *cert, STACK_OF(X509) *chain,
387 STACK_OF(X509) *caPubs, int encrypted,
388 int unprotectedErrors)
390 OSSL_CMP_MSG *msg = NULL;
391 OSSL_CMP_CERTREPMESSAGE *repMsg = NULL;
392 OSSL_CMP_CERTRESPONSE *resp = NULL;
395 if (!ossl_assert(ctx != NULL && si != NULL))
398 if ((msg = ossl_cmp_msg_create(ctx, bodytype)) == NULL)
400 repMsg = msg->body->value.ip; /* value.ip is same for cp and kup */
403 if (ctx->implicitConfirm && !ossl_cmp_hdr_set_implicitConfirm(msg->header))
407 if ((resp = OSSL_CMP_CERTRESPONSE_new()) == NULL)
409 OSSL_CMP_PKISI_free(resp->status);
410 if ((resp->status = OSSL_CMP_PKISI_dup(si)) == NULL
411 || !ASN1_INTEGER_set(resp->certReqId, certReqId))
414 status = ossl_cmp_pkisi_get_status(resp->status);
415 if (status != OSSL_CMP_PKISTATUS_rejection
416 && status != OSSL_CMP_PKISTATUS_waiting && cert != NULL) {
418 CMPerr(0, CMP_R_INVALID_ARGS);
422 if ((resp->certifiedKeyPair = OSSL_CMP_CERTIFIEDKEYPAIR_new())
425 resp->certifiedKeyPair->certOrEncCert->type =
426 OSSL_CMP_CERTORENCCERT_CERTIFICATE;
427 if (!X509_up_ref(cert))
429 resp->certifiedKeyPair->certOrEncCert->value.certificate = cert;
432 if (!sk_OSSL_CMP_CERTRESPONSE_push(repMsg->response, resp))
435 /* TODO: here optional 2nd certrep could be pushed to the stack */
437 if (bodytype == OSSL_CMP_PKIBODY_IP && caPubs != NULL
438 && (repMsg->caPubs = X509_chain_up_ref(caPubs)) == NULL)
440 if (sk_X509_num(chain) > 0) {
441 msg->extraCerts = sk_X509_new_reserve(NULL, sk_X509_num(chain));
442 if (msg->extraCerts == NULL
443 || !X509_add_certs(msg->extraCerts, chain,
444 X509_ADD_FLAG_UP_REF | X509_ADD_FLAG_NO_DUP))
448 if (!unprotectedErrors
449 || ossl_cmp_pkisi_get_status(si) != OSSL_CMP_PKISTATUS_rejection)
450 if (!ossl_cmp_msg_protect(ctx, msg))
456 CMPerr(0, CMP_R_ERROR_CREATING_CERTREP);
457 OSSL_CMP_CERTRESPONSE_free(resp);
458 OSSL_CMP_MSG_free(msg);
462 OSSL_CMP_MSG *ossl_cmp_rr_new(OSSL_CMP_CTX *ctx)
464 OSSL_CMP_MSG *msg = NULL;
465 OSSL_CMP_REVDETAILS *rd;
467 if (!ossl_assert(ctx != NULL && ctx->oldCert != NULL))
470 if ((rd = OSSL_CMP_REVDETAILS_new()) == NULL)
473 /* Fill the template from the contents of the certificate to be revoked */
474 if (!OSSL_CRMF_CERTTEMPLATE_fill(rd->certDetails,
475 NULL /* pubkey would be redundant */,
476 NULL /* subject would be redundant */,
477 X509_get_issuer_name(ctx->oldCert),
478 X509_get0_serialNumber(ctx->oldCert)))
481 /* revocation reason code is optional */
482 if (ctx->revocationReason != CRL_REASON_NONE
483 && !add_crl_reason_extension(&rd->crlEntryDetails,
484 ctx->revocationReason))
487 if ((msg = ossl_cmp_msg_create(ctx, OSSL_CMP_PKIBODY_RR)) == NULL)
490 if (!sk_OSSL_CMP_REVDETAILS_push(msg->body->value.rr, rd))
495 * TODO: the Revocation Passphrase according to section 5.3.19.9 could be
496 * set here if set in ctx
499 if (!ossl_cmp_msg_protect(ctx, msg))
505 CMPerr(0, CMP_R_ERROR_CREATING_RR);
506 OSSL_CMP_MSG_free(msg);
507 OSSL_CMP_REVDETAILS_free(rd);
511 OSSL_CMP_MSG *ossl_cmp_rp_new(OSSL_CMP_CTX *ctx, OSSL_CMP_PKISI *si,
512 OSSL_CRMF_CERTID *cid, int unprot_err)
514 OSSL_CMP_REVREPCONTENT *rep = NULL;
515 OSSL_CMP_PKISI *si1 = NULL;
516 OSSL_CRMF_CERTID *cid_copy = NULL;
517 OSSL_CMP_MSG *msg = NULL;
519 if (!ossl_assert(ctx != NULL && si != NULL && cid != NULL))
522 if ((msg = ossl_cmp_msg_create(ctx, OSSL_CMP_PKIBODY_RP)) == NULL)
524 rep = msg->body->value.rp;
526 if ((si1 = OSSL_CMP_PKISI_dup(si)) == NULL)
529 if (!sk_OSSL_CMP_PKISI_push(rep->status, si1)) {
530 OSSL_CMP_PKISI_free(si1);
534 if ((rep->revCerts = sk_OSSL_CRMF_CERTID_new_null()) == NULL)
536 if ((cid_copy = OSSL_CRMF_CERTID_dup(cid)) == NULL)
538 if (!sk_OSSL_CRMF_CERTID_push(rep->revCerts, cid_copy)) {
539 OSSL_CRMF_CERTID_free(cid_copy);
544 || ossl_cmp_pkisi_get_status(si) != OSSL_CMP_PKISTATUS_rejection)
545 if (!ossl_cmp_msg_protect(ctx, msg))
551 CMPerr(0, CMP_R_ERROR_CREATING_RP);
552 OSSL_CMP_MSG_free(msg);
556 OSSL_CMP_MSG *ossl_cmp_pkiconf_new(OSSL_CMP_CTX *ctx)
560 if (!ossl_assert(ctx != NULL))
563 if ((msg = ossl_cmp_msg_create(ctx, OSSL_CMP_PKIBODY_PKICONF)) == NULL)
565 if (ossl_cmp_msg_protect(ctx, msg))
569 CMPerr(0, CMP_R_ERROR_CREATING_PKICONF);
570 OSSL_CMP_MSG_free(msg);
574 int ossl_cmp_msg_gen_push0_ITAV(OSSL_CMP_MSG *msg, OSSL_CMP_ITAV *itav)
578 if (!ossl_assert(msg != NULL && itav != NULL))
581 bodytype = ossl_cmp_msg_get_bodytype(msg);
582 if (bodytype != OSSL_CMP_PKIBODY_GENM
583 && bodytype != OSSL_CMP_PKIBODY_GENP) {
584 CMPerr(0, CMP_R_INVALID_ARGS);
588 /* value.genp has the same structure, so this works for genp as well */
589 return OSSL_CMP_ITAV_push0_stack_item(&msg->body->value.genm, itav);
592 int ossl_cmp_msg_gen_push1_ITAVs(OSSL_CMP_MSG *msg,
593 const STACK_OF(OSSL_CMP_ITAV) *itavs)
596 OSSL_CMP_ITAV *itav = NULL;
598 if (!ossl_assert(msg != NULL))
601 for (i = 0; i < sk_OSSL_CMP_ITAV_num(itavs); i++) {
602 itav = OSSL_CMP_ITAV_dup(sk_OSSL_CMP_ITAV_value(itavs, i));
604 || !ossl_cmp_msg_gen_push0_ITAV(msg, itav)) {
605 OSSL_CMP_ITAV_free(itav);
613 * Creates a new General Message/Response with an empty itav stack
614 * returns a pointer to the PKIMessage on success, NULL on error
616 static OSSL_CMP_MSG *gen_new(OSSL_CMP_CTX *ctx,
617 const STACK_OF(OSSL_CMP_ITAV) *itavs,
618 int body_type, int err_code)
620 OSSL_CMP_MSG *msg = NULL;
622 if (!ossl_assert(ctx != NULL))
625 if ((msg = ossl_cmp_msg_create(ctx, body_type)) == NULL)
628 if (ctx->genm_ITAVs != NULL
629 && !ossl_cmp_msg_gen_push1_ITAVs(msg, itavs))
632 if (!ossl_cmp_msg_protect(ctx, msg))
639 OSSL_CMP_MSG_free(msg);
643 OSSL_CMP_MSG *ossl_cmp_genm_new(OSSL_CMP_CTX *ctx)
645 return gen_new(ctx, ctx->genm_ITAVs,
646 OSSL_CMP_PKIBODY_GENM, CMP_R_ERROR_CREATING_GENM);
649 OSSL_CMP_MSG *ossl_cmp_genp_new(OSSL_CMP_CTX *ctx,
650 const STACK_OF(OSSL_CMP_ITAV) *itavs)
652 return gen_new(ctx, itavs,
653 OSSL_CMP_PKIBODY_GENP, CMP_R_ERROR_CREATING_GENP);
656 OSSL_CMP_MSG *ossl_cmp_error_new(OSSL_CMP_CTX *ctx, OSSL_CMP_PKISI *si,
658 const char *details, int unprotected)
660 OSSL_CMP_MSG *msg = NULL;
661 OSSL_CMP_PKIFREETEXT *ft;
663 if (!ossl_assert(ctx != NULL && si != NULL))
666 if ((msg = ossl_cmp_msg_create(ctx, OSSL_CMP_PKIBODY_ERROR)) == NULL)
669 OSSL_CMP_PKISI_free(msg->body->value.error->pKIStatusInfo);
670 if ((msg->body->value.error->pKIStatusInfo = OSSL_CMP_PKISI_dup(si))
673 if (errorCode >= 0) {
674 if ((msg->body->value.error->errorCode = ASN1_INTEGER_new()) == NULL)
676 if (!ASN1_INTEGER_set(msg->body->value.error->errorCode, errorCode))
679 if (details != NULL) {
680 if ((ft = sk_ASN1_UTF8STRING_new_null()) == NULL)
682 msg->body->value.error->errorDetails = ft;
683 if (!ossl_cmp_sk_ASN1_UTF8STRING_push_str(ft, details))
687 if (!unprotected && !ossl_cmp_msg_protect(ctx, msg))
692 CMPerr(0, CMP_R_ERROR_CREATING_ERROR);
693 OSSL_CMP_MSG_free(msg);
698 * Set the certHash field of a OSSL_CMP_CERTSTATUS structure.
699 * This is used in the certConf message, for example,
700 * to confirm that the certificate was received successfully.
702 int ossl_cmp_certstatus_set0_certHash(OSSL_CMP_CERTSTATUS *certStatus,
703 ASN1_OCTET_STRING *hash)
705 if (!ossl_assert(certStatus != NULL))
707 ASN1_OCTET_STRING_free(certStatus->certHash);
708 certStatus->certHash = hash;
713 * TODO: handle potential 2nd certificate when signing and encrypting
714 * certificates have been requested/received
716 OSSL_CMP_MSG *ossl_cmp_certConf_new(OSSL_CMP_CTX *ctx, int fail_info,
719 OSSL_CMP_MSG *msg = NULL;
720 OSSL_CMP_CERTSTATUS *certStatus = NULL;
721 ASN1_OCTET_STRING *certHash = NULL;
722 OSSL_CMP_PKISI *sinfo;
724 if (!ossl_assert(ctx != NULL && ctx->newCert != NULL))
727 if ((unsigned)fail_info > OSSL_CMP_PKIFAILUREINFO_MAX_BIT_PATTERN) {
728 CMPerr(0, CMP_R_FAIL_INFO_OUT_OF_RANGE);
732 if ((msg = ossl_cmp_msg_create(ctx, OSSL_CMP_PKIBODY_CERTCONF)) == NULL)
735 if ((certStatus = OSSL_CMP_CERTSTATUS_new()) == NULL)
737 /* consume certStatus into msg right away so it gets deallocated with msg */
738 if (!sk_OSSL_CMP_CERTSTATUS_push(msg->body->value.certConf, certStatus))
740 /* set the ID of the certReq */
741 if (!ASN1_INTEGER_set(certStatus->certReqId, OSSL_CMP_CERTREQID))
744 * the hash of the certificate, using the same hash algorithm
745 * as is used to create and verify the certificate signature
747 if ((certHash = X509_digest_sig(ctx->newCert)) == NULL)
750 if (!ossl_cmp_certstatus_set0_certHash(certStatus, certHash))
754 * For any particular CertStatus, omission of the statusInfo field
755 * indicates ACCEPTANCE of the specified certificate. Alternatively,
756 * explicit status details (with respect to acceptance or rejection) MAY
757 * be provided in the statusInfo field, perhaps for auditing purposes at
760 sinfo = fail_info != 0 ?
761 OSSL_CMP_STATUSINFO_new(OSSL_CMP_PKISTATUS_rejection, fail_info, text) :
762 OSSL_CMP_STATUSINFO_new(OSSL_CMP_PKISTATUS_accepted, 0, text);
765 certStatus->statusInfo = sinfo;
767 if (!ossl_cmp_msg_protect(ctx, msg))
773 CMPerr(0, CMP_R_ERROR_CREATING_CERTCONF);
774 OSSL_CMP_MSG_free(msg);
775 ASN1_OCTET_STRING_free(certHash);
779 OSSL_CMP_MSG *ossl_cmp_pollReq_new(OSSL_CMP_CTX *ctx, int crid)
781 OSSL_CMP_MSG *msg = NULL;
782 OSSL_CMP_POLLREQ *preq = NULL;
784 if (!ossl_assert(ctx != NULL))
787 if ((msg = ossl_cmp_msg_create(ctx, OSSL_CMP_PKIBODY_POLLREQ)) == NULL)
790 /* TODO: support multiple cert request IDs to poll */
791 if ((preq = OSSL_CMP_POLLREQ_new()) == NULL
792 || !ASN1_INTEGER_set(preq->certReqId, crid)
793 || !sk_OSSL_CMP_POLLREQ_push(msg->body->value.pollReq, preq))
797 if (!ossl_cmp_msg_protect(ctx, msg))
803 CMPerr(0, CMP_R_ERROR_CREATING_POLLREQ);
804 OSSL_CMP_POLLREQ_free(preq);
805 OSSL_CMP_MSG_free(msg);
809 OSSL_CMP_MSG *ossl_cmp_pollRep_new(OSSL_CMP_CTX *ctx, int crid,
813 OSSL_CMP_POLLREP *prep;
815 if (!ossl_assert(ctx != NULL))
818 if ((msg = ossl_cmp_msg_create(ctx, OSSL_CMP_PKIBODY_POLLREP)) == NULL)
820 if ((prep = OSSL_CMP_POLLREP_new()) == NULL)
822 if (!sk_OSSL_CMP_POLLREP_push(msg->body->value.pollRep, prep))
824 if (!ASN1_INTEGER_set(prep->certReqId, crid))
826 if (!ASN1_INTEGER_set_int64(prep->checkAfter, poll_after))
829 if (!ossl_cmp_msg_protect(ctx, msg))
834 CMPerr(0, CMP_R_ERROR_CREATING_POLLREP);
835 OSSL_CMP_MSG_free(msg);
840 * returns the status field of the RevRepContent with the given
841 * request/sequence id inside a revocation response.
842 * RevRepContent has the revocation statuses in same order as they were sent in
844 * returns NULL on error
847 ossl_cmp_revrepcontent_get_pkisi(OSSL_CMP_REVREPCONTENT *rrep, int rsid)
849 OSSL_CMP_PKISI *status;
851 if (!ossl_assert(rrep != NULL))
854 if ((status = sk_OSSL_CMP_PKISI_value(rrep->status, rsid)) != NULL)
857 CMPerr(0, CMP_R_PKISTATUSINFO_NOT_FOUND);
862 * returns the CertId field in the revCerts part of the RevRepContent
863 * with the given request/sequence id inside a revocation response.
864 * RevRepContent has the CertIds in same order as they were sent in
866 * returns NULL on error
869 ossl_cmp_revrepcontent_get_CertId(OSSL_CMP_REVREPCONTENT *rrep, int rsid)
871 OSSL_CRMF_CERTID *cid = NULL;
873 if (!ossl_assert(rrep != NULL))
876 if ((cid = sk_OSSL_CRMF_CERTID_value(rrep->revCerts, rsid)) != NULL)
879 CMPerr(0, CMP_R_CERTID_NOT_FOUND);
883 static int suitable_rid(const ASN1_INTEGER *certReqId, int rid)
890 trid = ossl_cmp_asn1_get_int(certReqId);
893 CMPerr(0, CMP_R_BAD_REQUEST_ID);
899 static void add_expected_rid(int rid)
901 char str[DECIMAL_SIZE(rid) + 1];
903 BIO_snprintf(str, sizeof(str), "%d", rid);
904 ERR_add_error_data(2, "expected certReqId = ", str);
908 * returns a pointer to the PollResponse with the given CertReqId
909 * (or the first one in case -1) inside a PollRepContent
910 * returns NULL on error or if no suitable PollResponse available
913 ossl_cmp_pollrepcontent_get0_pollrep(const OSSL_CMP_POLLREPCONTENT *prc,
916 OSSL_CMP_POLLREP *pollRep = NULL;
919 if (!ossl_assert(prc != NULL))
922 for (i = 0; i < sk_OSSL_CMP_POLLREP_num(prc); i++) {
923 pollRep = sk_OSSL_CMP_POLLREP_value(prc, i);
924 if (suitable_rid(pollRep->certReqId, rid))
928 CMPerr(0, CMP_R_CERTRESPONSE_NOT_FOUND);
929 add_expected_rid(rid);
934 * returns a pointer to the CertResponse with the given CertReqId
935 * (or the first one in case -1) inside a CertRepMessage
936 * returns NULL on error or if no suitable CertResponse available
938 OSSL_CMP_CERTRESPONSE *
939 ossl_cmp_certrepmessage_get0_certresponse(const OSSL_CMP_CERTREPMESSAGE *crm,
942 OSSL_CMP_CERTRESPONSE *crep = NULL;
945 if (!ossl_assert(crm != NULL && crm->response != NULL))
948 for (i = 0; i < sk_OSSL_CMP_CERTRESPONSE_num(crm->response); i++) {
949 crep = sk_OSSL_CMP_CERTRESPONSE_value(crm->response, i);
950 if (suitable_rid(crep->certReqId, rid))
954 CMPerr(0, CMP_R_CERTRESPONSE_NOT_FOUND);
955 add_expected_rid(rid);
960 * CMP_CERTRESPONSE_get1_certificate() attempts to retrieve the returned
961 * certificate from the given certResponse B<crep>.
962 * Uses the privkey in case of indirect POP from B<ctx>.
963 * Returns a pointer to a copy of the found certificate, or NULL if not found.
965 X509 *ossl_cmp_certresponse_get1_certificate(EVP_PKEY *privkey,
966 const OSSL_CMP_CERTRESPONSE *crep)
968 OSSL_CMP_CERTORENCCERT *coec;
971 if (!ossl_assert(crep != NULL))
974 if (crep->certifiedKeyPair
975 && (coec = crep->certifiedKeyPair->certOrEncCert) != NULL) {
976 switch (coec->type) {
977 case OSSL_CMP_CERTORENCCERT_CERTIFICATE:
978 crt = X509_dup(coec->value.certificate);
980 case OSSL_CMP_CERTORENCCERT_ENCRYPTEDCERT:
981 /* cert encrypted for indirect PoP; RFC 4210, 5.2.8.2 */
982 if (privkey == NULL) {
983 CMPerr(0, CMP_R_MISSING_PRIVATE_KEY);
987 OSSL_CRMF_ENCRYPTEDVALUE_get1_encCert(coec->value.encryptedCert,
991 CMPerr(0, CMP_R_UNKNOWN_CERT_TYPE);
996 CMPerr(0, CMP_R_CERTIFICATE_NOT_FOUND);
1000 int OSSL_CMP_MSG_update_transactionID(OSSL_CMP_CTX *ctx, OSSL_CMP_MSG *msg)
1002 if (ctx == NULL || msg == NULL) {
1003 CMPerr(0, CMP_R_NULL_ARGUMENT);
1006 if (!ossl_cmp_hdr_set_transactionID(ctx, msg->header))
1008 return msg->header->protectionAlg == NULL
1009 || ossl_cmp_msg_protect(ctx, msg);
1012 OSSL_CMP_MSG *OSSL_CMP_MSG_read(const char *file)
1014 OSSL_CMP_MSG *msg = NULL;
1018 CMPerr(0, CMP_R_NULL_ARGUMENT);
1022 if ((bio = BIO_new_file(file, "rb")) == NULL)
1024 msg = d2i_OSSL_CMP_MSG_bio(bio, NULL);
1029 int OSSL_CMP_MSG_write(const char *file, const OSSL_CMP_MSG *msg)
1034 if (file == NULL || msg == NULL) {
1035 CMPerr(0, CMP_R_NULL_ARGUMENT);
1039 bio = BIO_new_file(file, "wb");
1042 res = i2d_OSSL_CMP_MSG_bio(bio, msg);
1047 OSSL_CMP_MSG *d2i_OSSL_CMP_MSG_bio(BIO *bio, OSSL_CMP_MSG **msg)
1049 return ASN1_d2i_bio_of(OSSL_CMP_MSG, OSSL_CMP_MSG_new,
1050 d2i_OSSL_CMP_MSG, bio, msg);
1053 int i2d_OSSL_CMP_MSG_bio(BIO *bio, const OSSL_CMP_MSG *msg)
1055 return ASN1_i2d_bio_of(OSSL_CMP_MSG, i2d_OSSL_CMP_MSG, bio, msg);