Chunk 8 of CMP contribution to OpenSSL: CMP server and cmp_mock_srv.c for testing
[openssl.git] / crypto / cmp / cmp_status.c
1 /*
2  * Copyright 2007-2019 The OpenSSL Project Authors. All Rights Reserved.
3  * Copyright Nokia 2007-2019
4  * Copyright Siemens AG 2015-2019
5  *
6  * Licensed under the Apache License 2.0 (the "License").  You may not use
7  * this file except in compliance with the License.  You can obtain a copy
8  * in the file LICENSE in the source distribution or at
9  * https://www.openssl.org/source/license.html
10  */
11
12 /* CMP functions for PKIStatusInfo handling and PKIMessage decomposition */
13
14 #include <string.h>
15
16 #include "cmp_local.h"
17
18 /* explicit #includes not strictly needed since implied by the above: */
19 #include <time.h>
20 #include <openssl/cmp.h>
21 #include <openssl/crmf.h>
22 #include <openssl/err.h> /* needed in case config no-deprecated */
23 #include <openssl/engine.h>
24 #include <openssl/evp.h>
25 #include <openssl/objects.h>
26 #include <openssl/x509.h>
27 #include <openssl/asn1err.h> /* for ASN1_R_TOO_SMALL and ASN1_R_TOO_LARGE */
28
29 /* CMP functions related to PKIStatus */
30
31 int ossl_cmp_pkisi_get_status(const OSSL_CMP_PKISI *si)
32 {
33     if (!ossl_assert(si != NULL && si->status != NULL))
34         return -1;
35     return ossl_cmp_asn1_get_int(si->status);
36 }
37
38 const char *ossl_cmp_PKIStatus_to_string(int status)
39 {
40     switch (status) {
41     case OSSL_CMP_PKISTATUS_accepted:
42         return "PKIStatus: accepted";
43     case OSSL_CMP_PKISTATUS_grantedWithMods:
44         return "PKIStatus: granted with modifications";
45     case OSSL_CMP_PKISTATUS_rejection:
46         return "PKIStatus: rejection";
47     case OSSL_CMP_PKISTATUS_waiting:
48         return "PKIStatus: waiting";
49     case OSSL_CMP_PKISTATUS_revocationWarning:
50         return "PKIStatus: revocation warning - a revocation of the cert is imminent";
51     case OSSL_CMP_PKISTATUS_revocationNotification:
52         return "PKIStatus: revocation notification - a revocation of the cert has occurred";
53     case OSSL_CMP_PKISTATUS_keyUpdateWarning:
54         return "PKIStatus: key update warning - update already done for the cert";
55     default:
56         {
57             char buf[40];
58             BIO_snprintf(buf, sizeof(buf), "PKIStatus: invalid=%d", status);
59             CMPerr(0, CMP_R_ERROR_PARSING_PKISTATUS);
60             ERR_add_error_data(1, buf);
61             return NULL;
62         }
63     }
64 }
65
66 OSSL_CMP_PKIFREETEXT *ossl_cmp_pkisi_get0_statusString(const OSSL_CMP_PKISI *si)
67 {
68     if (!ossl_assert(si != NULL))
69         return NULL;
70     return si->statusString;
71 }
72
73 int ossl_cmp_pkisi_get_pkifailureinfo(const OSSL_CMP_PKISI *si)
74 {
75     int i;
76     int res = 0;
77
78     if (!ossl_assert(si != NULL && si->failInfo != NULL))
79         return -1;
80     for (i = 0; i <= OSSL_CMP_PKIFAILUREINFO_MAX; i++)
81         if (ASN1_BIT_STRING_get_bit(si->failInfo, i))
82             res |= 1 << i;
83     return res;
84 }
85
86 /*-
87  * convert PKIFailureInfo number to human-readable string
88  * returns pointer to static string, or NULL on error
89  */
90 static const char *CMP_PKIFAILUREINFO_to_string(int number)
91 {
92     switch (number) {
93     case OSSL_CMP_PKIFAILUREINFO_badAlg:
94         return "badAlg";
95     case OSSL_CMP_PKIFAILUREINFO_badMessageCheck:
96         return "badMessageCheck";
97     case OSSL_CMP_PKIFAILUREINFO_badRequest:
98         return "badRequest";
99     case OSSL_CMP_PKIFAILUREINFO_badTime:
100         return "badTime";
101     case OSSL_CMP_PKIFAILUREINFO_badCertId:
102         return "badCertId";
103     case OSSL_CMP_PKIFAILUREINFO_badDataFormat:
104         return "badDataFormat";
105     case OSSL_CMP_PKIFAILUREINFO_wrongAuthority:
106         return "wrongAuthority";
107     case OSSL_CMP_PKIFAILUREINFO_incorrectData:
108         return "incorrectData";
109     case OSSL_CMP_PKIFAILUREINFO_missingTimeStamp:
110         return "missingTimeStamp";
111     case OSSL_CMP_PKIFAILUREINFO_badPOP:
112         return "badPOP";
113     case OSSL_CMP_PKIFAILUREINFO_certRevoked:
114         return "certRevoked";
115     case OSSL_CMP_PKIFAILUREINFO_certConfirmed:
116         return "certConfirmed";
117     case OSSL_CMP_PKIFAILUREINFO_wrongIntegrity:
118         return "wrongIntegrity";
119     case OSSL_CMP_PKIFAILUREINFO_badRecipientNonce:
120         return "badRecipientNonce";
121     case OSSL_CMP_PKIFAILUREINFO_timeNotAvailable:
122         return "timeNotAvailable";
123     case OSSL_CMP_PKIFAILUREINFO_unacceptedPolicy:
124         return "unacceptedPolicy";
125     case OSSL_CMP_PKIFAILUREINFO_unacceptedExtension:
126         return "unacceptedExtension";
127     case OSSL_CMP_PKIFAILUREINFO_addInfoNotAvailable:
128         return "addInfoNotAvailable";
129     case OSSL_CMP_PKIFAILUREINFO_badSenderNonce:
130         return "badSenderNonce";
131     case OSSL_CMP_PKIFAILUREINFO_badCertTemplate:
132         return "badCertTemplate";
133     case OSSL_CMP_PKIFAILUREINFO_signerNotTrusted:
134         return "signerNotTrusted";
135     case OSSL_CMP_PKIFAILUREINFO_transactionIdInUse:
136         return "transactionIdInUse";
137     case OSSL_CMP_PKIFAILUREINFO_unsupportedVersion:
138         return "unsupportedVersion";
139     case OSSL_CMP_PKIFAILUREINFO_notAuthorized:
140         return "notAuthorized";
141     case OSSL_CMP_PKIFAILUREINFO_systemUnavail:
142         return "systemUnavail";
143     case OSSL_CMP_PKIFAILUREINFO_systemFailure:
144         return "systemFailure";
145     case OSSL_CMP_PKIFAILUREINFO_duplicateCertReq:
146         return "duplicateCertReq";
147     default:
148         return NULL; /* illegal failure number */
149     }
150 }
151
152 int ossl_cmp_pkisi_check_pkifailureinfo(const OSSL_CMP_PKISI *si, int bit_index)
153 {
154     if (!ossl_assert(si != NULL && si->failInfo != NULL))
155         return -1;
156     if (bit_index < 0 || bit_index > OSSL_CMP_PKIFAILUREINFO_MAX) {
157         CMPerr(0, CMP_R_INVALID_ARGS);
158         return -1;
159     }
160
161     return ASN1_BIT_STRING_get_bit(si->failInfo, bit_index);
162 }
163
164 /*-
165  * place human-readable error string created from PKIStatusInfo in given buffer
166  * returns pointer to the same buffer containing the string, or NULL on error
167  */
168 static
169 char *snprint_PKIStatusInfo_parts(int status, int fail_info,
170                                   const OSSL_CMP_PKIFREETEXT *status_strings,
171                                   char *buf, size_t bufsize)
172 {
173     int failure;
174     const char *status_string, *failure_string;
175     ASN1_UTF8STRING *text;
176     int i;
177     int printed_chars;
178     int failinfo_found = 0;
179     int n_status_strings;
180     char *write_ptr = buf;
181
182     if (buf == NULL
183             || status < 0
184             || (status_string = ossl_cmp_PKIStatus_to_string(status)) == NULL)
185         return NULL;
186
187 #define ADVANCE_BUFFER                                         \
188         if (printed_chars < 0 || (size_t)printed_chars >= bufsize) \
189             return NULL; \
190         write_ptr += printed_chars; \
191         bufsize -= printed_chars;
192
193     printed_chars = BIO_snprintf(write_ptr, bufsize, "%s", status_string);
194     ADVANCE_BUFFER;
195
196     /* failInfo is optional and may be empty */
197     if (fail_info != 0) {
198         printed_chars = BIO_snprintf(write_ptr, bufsize, "; PKIFailureInfo: ");
199         ADVANCE_BUFFER;
200         for (failure = 0; failure <= OSSL_CMP_PKIFAILUREINFO_MAX; failure++) {
201             if ((fail_info & (1 << failure)) != 0) {
202                 failure_string = CMP_PKIFAILUREINFO_to_string(failure);
203                 if (failure_string != NULL) {
204                     printed_chars = BIO_snprintf(write_ptr, bufsize, "%s%s",
205                                                  failinfo_found ? ", " : "",
206                                                  failure_string);
207                     ADVANCE_BUFFER;
208                     failinfo_found = 1;
209                 }
210             }
211         }
212     }
213     if (!failinfo_found && status != OSSL_CMP_PKISTATUS_accepted
214             && status != OSSL_CMP_PKISTATUS_grantedWithMods) {
215         printed_chars = BIO_snprintf(write_ptr, bufsize, "; <no failure info>");
216         ADVANCE_BUFFER;
217     }
218
219     /* statusString sequence is optional and may be empty */
220     n_status_strings = sk_ASN1_UTF8STRING_num(status_strings);
221     if (n_status_strings > 0) {
222         printed_chars = BIO_snprintf(write_ptr, bufsize, "; StatusString%s: ",
223                                      n_status_strings > 1 ? "s" : "");
224         ADVANCE_BUFFER;
225         for (i = 0; i < n_status_strings; i++) {
226             text = sk_ASN1_UTF8STRING_value(status_strings, i);
227             printed_chars = BIO_snprintf(write_ptr, bufsize, "\"%s\"%s",
228                                          ASN1_STRING_get0_data(text),
229                                          i < n_status_strings - 1 ? ", " : "");
230             ADVANCE_BUFFER;
231         }
232     }
233 #undef ADVANCE_BUFFER
234     return buf;
235 }
236
237 char *OSSL_CMP_snprint_PKIStatusInfo(const OSSL_CMP_PKISI *statusInfo,
238                                      char *buf, size_t bufsize)
239 {
240     int failure_info;
241
242     if (statusInfo == NULL) {
243         CMPerr(0, CMP_R_NULL_ARGUMENT);
244         return NULL;
245     }
246
247     failure_info = ossl_cmp_pkisi_get_pkifailureinfo(statusInfo);
248
249     return snprint_PKIStatusInfo_parts(ASN1_INTEGER_get(statusInfo->status),
250                                        failure_info,
251                                        statusInfo->statusString, buf, bufsize);
252 }
253
254 char *OSSL_CMP_CTX_snprint_PKIStatus(const OSSL_CMP_CTX *ctx, char *buf,
255                                      size_t bufsize)
256 {
257     if (ctx == NULL) {
258         CMPerr(0, CMP_R_NULL_ARGUMENT);
259         return NULL;
260     }
261
262     return snprint_PKIStatusInfo_parts(OSSL_CMP_CTX_get_status(ctx),
263                                        OSSL_CMP_CTX_get_failInfoCode(ctx),
264                                        OSSL_CMP_CTX_get0_statusString(ctx),
265                                        buf, bufsize);
266 }
267
268 /*-
269  * Creates a new PKIStatusInfo structure and fills it in
270  * returns a pointer to the structure on success, NULL on error
271  * note: strongly overlaps with TS_RESP_CTX_set_status_info()
272  * and TS_RESP_CTX_add_failure_info() in ../ts/ts_rsp_sign.c
273  */
274 OSSL_CMP_PKISI *OSSL_CMP_STATUSINFO_new(int status, int fail_info,
275                                         const char *text)
276 {
277     OSSL_CMP_PKISI *si = OSSL_CMP_PKISI_new();
278     ASN1_UTF8STRING *utf8_text = NULL;
279     int failure;
280
281     if (si == NULL)
282         goto err;
283     if (!ASN1_INTEGER_set(si->status, status))
284         goto err;
285
286     if (text != NULL) {
287         if ((utf8_text = ASN1_UTF8STRING_new()) == NULL
288                 || !ASN1_STRING_set(utf8_text, text, -1))
289             goto err;
290         if ((si->statusString = sk_ASN1_UTF8STRING_new_null()) == NULL)
291             goto err;
292         if (!sk_ASN1_UTF8STRING_push(si->statusString, utf8_text))
293             goto err;
294         /* Ownership is lost. */
295         utf8_text = NULL;
296     }
297
298     for (failure = 0; failure <= OSSL_CMP_PKIFAILUREINFO_MAX; failure++) {
299         if ((fail_info & (1 << failure)) != 0) {
300             if (si->failInfo == NULL
301                     && (si->failInfo = ASN1_BIT_STRING_new()) == NULL)
302                 goto err;
303             if (!ASN1_BIT_STRING_set_bit(si->failInfo, failure, 1))
304                 goto err;
305         }
306     }
307     return si;
308
309  err:
310     OSSL_CMP_PKISI_free(si);
311     ASN1_UTF8STRING_free(utf8_text);
312     return NULL;
313 }