2 * Copyright 2007-2020 The OpenSSL Project Authors. All Rights Reserved.
3 * Copyright Nokia 2007-2019
4 * Copyright Siemens AG 2015-2019
6 * Licensed under the Apache License 2.0 (the "License"). You may not use
7 * this file except in compliance with the License. You can obtain a copy
8 * in the file LICENSE in the source distribution or at
9 * https://www.openssl.org/source/license.html
12 #include "cmp_local.h"
14 /* explicit #includes not strictly needed since implied by the above: */
15 #include <openssl/asn1t.h>
16 #include <openssl/cmp.h>
17 #include <openssl/crmf.h>
18 #include <openssl/err.h>
19 #include <openssl/x509.h>
24 * This function is also used by the internal verify_PBMAC() in cmp_vfy.c.
26 * Calculate protection for given PKImessage according to
27 * the algorithm and parameters in the message header's protectionAlg
28 * using the credentials, library context, and property criteria in the ctx.
30 * returns ASN1_BIT_STRING representing the protection on success, else NULL
32 ASN1_BIT_STRING *ossl_cmp_calc_protection(const OSSL_CMP_CTX *ctx,
33 const OSSL_CMP_MSG *msg)
35 ASN1_BIT_STRING *prot = NULL;
36 OSSL_CMP_PROTECTEDPART prot_part;
37 const ASN1_OBJECT *algorOID = NULL;
38 const void *ppval = NULL;
41 if (!ossl_assert(ctx != NULL && msg != NULL))
44 /* construct data to be signed */
45 prot_part.header = msg->header;
46 prot_part.body = msg->body;
48 if (msg->header->protectionAlg == NULL) {
49 CMPerr(0, CMP_R_UNKNOWN_ALGORITHM_ID);
52 X509_ALGOR_get0(&algorOID, &pptype, &ppval, msg->header->protectionAlg);
54 if (OBJ_obj2nid(algorOID) == NID_id_PasswordBasedMAC) {
56 size_t prot_part_der_len;
57 unsigned char *prot_part_der = NULL;
59 unsigned char *protection = NULL;
60 OSSL_CRMF_PBMPARAMETER *pbm = NULL;
61 ASN1_STRING *pbm_str = NULL;
62 const unsigned char *pbm_str_uc = NULL;
64 if (ctx->secretValue == NULL) {
65 CMPerr(0, CMP_R_MISSING_PBM_SECRET);
69 CMPerr(0, CMP_R_ERROR_CALCULATING_PROTECTION);
73 len = i2d_OSSL_CMP_PROTECTEDPART(&prot_part, &prot_part_der);
74 if (len < 0 || prot_part_der == NULL) {
75 CMPerr(0, CMP_R_ERROR_CALCULATING_PROTECTION);
78 prot_part_der_len = (size_t)len;
80 pbm_str = (ASN1_STRING *)ppval;
81 pbm_str_uc = pbm_str->data;
82 pbm = d2i_OSSL_CRMF_PBMPARAMETER(NULL, &pbm_str_uc, pbm_str->length);
84 CMPerr(0, CMP_R_WRONG_ALGORITHM_OID);
88 if (!OSSL_CRMF_pbm_new(ctx->libctx, ctx->propq,
89 pbm, prot_part_der, prot_part_der_len,
90 ctx->secretValue->data, ctx->secretValue->length,
91 &protection, &sig_len))
94 if ((prot = ASN1_BIT_STRING_new()) == NULL)
96 /* OpenSSL defaults all bit strings to be encoded as ASN.1 NamedBitList */
97 prot->flags &= ~(ASN1_STRING_FLAG_BITS_LEFT | 0x07);
98 prot->flags |= ASN1_STRING_FLAG_BITS_LEFT;
99 if (!ASN1_BIT_STRING_set(prot, protection, sig_len)) {
100 ASN1_BIT_STRING_free(prot);
104 OSSL_CRMF_PBMPARAMETER_free(pbm);
105 OPENSSL_free(protection);
106 OPENSSL_free(prot_part_der);
110 const EVP_MD *md = NULL;
112 if (ctx->pkey == NULL) {
113 CMPerr(0, CMP_R_MISSING_KEY_INPUT_FOR_CREATING_PROTECTION);
116 if (!OBJ_find_sigid_algs(OBJ_obj2nid(algorOID), &md_nid, NULL)
117 || (md = EVP_get_digestbynid(md_nid)) == NULL) {
118 CMPerr(0, CMP_R_UNKNOWN_ALGORITHM_ID);
122 if ((prot = ASN1_BIT_STRING_new()) == NULL)
124 if (ASN1_item_sign_with_libctx(ASN1_ITEM_rptr(OSSL_CMP_PROTECTEDPART),
125 NULL, NULL, prot, &prot_part, NULL,
126 ctx->pkey, md, ctx->libctx, ctx->propq))
128 ASN1_BIT_STRING_free(prot);
133 int ossl_cmp_msg_add_extraCerts(OSSL_CMP_CTX *ctx, OSSL_CMP_MSG *msg)
135 if (!ossl_assert(ctx != NULL && msg != NULL))
138 if (msg->extraCerts == NULL
139 && (msg->extraCerts = sk_X509_new_null()) == NULL)
142 /* Add first ctx->cert and its chain if using signature-based protection */
143 if (!ctx->unprotectedSend && ctx->secretValue == NULL) {
144 int flags_prepend = X509_ADD_FLAG_UP_REF | X509_ADD_FLAG_NO_DUP
145 | X509_ADD_FLAG_PREPEND | X509_ADD_FLAG_NO_SS;
147 /* if not yet done try to build chain using available untrusted certs */
148 if (ctx->chain == NULL) {
150 "trying to build chain for own CMP signer cert");
152 ossl_cmp_build_cert_chain(ctx->libctx, ctx->propq, NULL,
153 ctx->untrusted, ctx->cert);
154 if (ctx->chain != NULL) {
156 "success building chain for own CMP signer cert");
158 /* dump errors to avoid confusion when printing further ones */
159 OSSL_CMP_CTX_print_errors(ctx);
161 "could not build chain for own CMP signer cert");
164 if (ctx->chain != NULL) {
165 if (!X509_add_certs(msg->extraCerts, ctx->chain, flags_prepend))
168 /* make sure that at least our own signer cert is included first */
169 if (!X509_add_cert(msg->extraCerts, ctx->cert, flags_prepend))
172 "fallback: adding just own CMP signer cert");
176 /* add any additional certificates from ctx->extraCertsOut */
177 if (!X509_add_certs(msg->extraCerts, ctx->extraCertsOut,
178 X509_ADD_FLAG_UP_REF | X509_ADD_FLAG_NO_DUP))
181 /* if none was found avoid empty ASN.1 sequence */
182 if (sk_X509_num(msg->extraCerts) == 0) {
183 sk_X509_free(msg->extraCerts);
184 msg->extraCerts = NULL;
190 * Create an X509_ALGOR structure for PasswordBasedMAC protection based on
191 * the pbm settings in the context
193 static int set_pbmac_algor(const OSSL_CMP_CTX *ctx, X509_ALGOR **alg)
195 OSSL_CRMF_PBMPARAMETER *pbm = NULL;
196 unsigned char *pbm_der = NULL;
198 ASN1_STRING *pbm_str = NULL;
200 if (!ossl_assert(ctx != NULL))
203 pbm = OSSL_CRMF_pbmp_new(ctx->libctx, ctx->pbm_slen,
204 EVP_MD_type(ctx->pbm_owf), ctx->pbm_itercnt,
206 pbm_str = ASN1_STRING_new();
207 if (pbm == NULL || pbm_str == NULL)
210 if ((pbm_der_len = i2d_OSSL_CRMF_PBMPARAMETER(pbm, &pbm_der)) < 0)
213 if (!ASN1_STRING_set(pbm_str, pbm_der, pbm_der_len))
215 if (*alg == NULL && (*alg = X509_ALGOR_new()) == NULL)
217 OPENSSL_free(pbm_der);
219 X509_ALGOR_set0(*alg, OBJ_nid2obj(NID_id_PasswordBasedMAC),
220 V_ASN1_SEQUENCE, pbm_str);
221 OSSL_CRMF_PBMPARAMETER_free(pbm);
225 ASN1_STRING_free(pbm_str);
226 OPENSSL_free(pbm_der);
227 OSSL_CRMF_PBMPARAMETER_free(pbm);
231 static int set_sig_algor(const OSSL_CMP_CTX *ctx, X509_ALGOR **alg)
234 ASN1_OBJECT *algo = NULL;
236 if (!OBJ_find_sigid_by_algs(&nid, EVP_MD_type(ctx->digest),
237 EVP_PKEY_id(ctx->pkey))) {
238 CMPerr(0, CMP_R_UNSUPPORTED_KEY_TYPE);
241 if ((algo = OBJ_nid2obj(nid)) == NULL)
243 if (*alg == NULL && (*alg = X509_ALGOR_new()) == NULL)
246 if (X509_ALGOR_set0(*alg, algo, V_ASN1_UNDEF, NULL))
248 ASN1_OBJECT_free(algo);
252 static int set_senderKID(const OSSL_CMP_CTX *ctx, OSSL_CMP_MSG *msg,
253 const ASN1_OCTET_STRING *id)
256 id = ctx->referenceValue; /* standard for PBM, fallback for sig-based */
257 return id == NULL || ossl_cmp_hdr_set1_senderKID(msg->header, id);
260 int ossl_cmp_msg_protect(OSSL_CMP_CTX *ctx, OSSL_CMP_MSG *msg)
262 if (!ossl_assert(ctx != NULL && msg != NULL))
266 * For the case of re-protection remove pre-existing protection.
267 * TODO: Consider also removing any pre-existing extraCerts.
269 X509_ALGOR_free(msg->header->protectionAlg);
270 msg->header->protectionAlg = NULL;
271 ASN1_BIT_STRING_free(msg->protection);
272 msg->protection = NULL;
274 if (ctx->unprotectedSend)
277 /* use PasswordBasedMac according to 5.1.3.1 if secretValue is given */
278 if (ctx->secretValue != NULL) {
279 if (!set_pbmac_algor(ctx, &msg->header->protectionAlg))
281 if (!set_senderKID(ctx, msg, NULL))
285 * will add any additional certificates from ctx->extraCertsOut
286 * while not needed to validate the protection certificate,
287 * the option to do this might be handy for certain use cases
289 } else if (ctx->cert != NULL && ctx->pkey != NULL) {
290 /* use MSG_SIG_ALG according to 5.1.3.3 if client cert and key given */
292 /* make sure that key and certificate match */
293 if (!X509_check_private_key(ctx->cert, ctx->pkey)) {
294 CMPerr(0, CMP_R_CERT_AND_KEY_DO_NOT_MATCH);
298 if (!set_sig_algor(ctx, &msg->header->protectionAlg))
300 /* set senderKID to keyIdentifier of the cert according to 5.1.1 */
301 if (!set_senderKID(ctx, msg, X509_get0_subject_key_id(ctx->cert)))
305 * will add ctx->cert followed, if possible, by its chain built
306 * from ctx->untrusted, and then ctx->extraCertsOut
309 CMPerr(0, CMP_R_MISSING_KEY_INPUT_FOR_CREATING_PROTECTION);
312 if ((msg->protection = ossl_cmp_calc_protection(ctx, msg)) == NULL)
316 * If present, add ctx->cert followed by its chain as far as possible.
317 * Finally add any additional certificates from ctx->extraCertsOut;
318 * even if not needed to validate the protection
319 * the option to do this might be handy for certain use cases.
321 if (!ossl_cmp_msg_add_extraCerts(ctx, msg))
325 * As required by RFC 4210 section 5.1.1., if the sender name is not known
326 * to the client it set to NULL-DN. In this case for identification at least
327 * the senderKID must be set, where we took the referenceValue as fallback.
329 if (ossl_cmp_general_name_is_NULL_DN(msg->header->sender)
330 && msg->header->senderKID == NULL)
331 CMPerr(0, CMP_R_MISSING_SENDER_IDENTIFICATION);
336 CMPerr(0, CMP_R_ERROR_PROTECTING_MESSAGE);