Add -reqin_new_tid option to apps/cmp.c and OSSL_CMP_MSG_update_transactionID()
[openssl.git] / crypto / cmp / cmp_asn.c
1 /*
2  * Copyright 2007-2020 The OpenSSL Project Authors. All Rights Reserved.
3  * Copyright Nokia 2007-2019
4  * Copyright Siemens AG 2015-2019
5  *
6  * Licensed under the Apache License 2.0 (the "License").  You may not use
7  * this file except in compliance with the License.  You can obtain a copy
8  * in the file LICENSE in the source distribution or at
9  * https://www.openssl.org/source/license.html
10  */
11
12 #include <openssl/asn1t.h>
13
14 #include "cmp_local.h"
15
16 /* explicit #includes not strictly needed since implied by the above: */
17 #include <openssl/cmp.h>
18 #include <openssl/crmf.h>
19
20 DEFINE_STACK_OF(OSSL_CMP_ITAV)
21
22 /* ASN.1 declarations from RFC4210 */
23 ASN1_SEQUENCE(OSSL_CMP_REVANNCONTENT) = {
24     /* OSSL_CMP_PKISTATUS is effectively ASN1_INTEGER so it is used directly */
25     ASN1_SIMPLE(OSSL_CMP_REVANNCONTENT, status, ASN1_INTEGER),
26     ASN1_SIMPLE(OSSL_CMP_REVANNCONTENT, certId, OSSL_CRMF_CERTID),
27     ASN1_SIMPLE(OSSL_CMP_REVANNCONTENT, willBeRevokedAt, ASN1_GENERALIZEDTIME),
28     ASN1_SIMPLE(OSSL_CMP_REVANNCONTENT, badSinceDate, ASN1_GENERALIZEDTIME),
29     ASN1_OPT(OSSL_CMP_REVANNCONTENT, crlDetails, X509_EXTENSIONS)
30 } ASN1_SEQUENCE_END(OSSL_CMP_REVANNCONTENT)
31 IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_REVANNCONTENT)
32
33
34 ASN1_SEQUENCE(OSSL_CMP_CHALLENGE) = {
35     ASN1_OPT(OSSL_CMP_CHALLENGE, owf, X509_ALGOR),
36     ASN1_SIMPLE(OSSL_CMP_CHALLENGE, witness, ASN1_OCTET_STRING),
37     ASN1_SIMPLE(OSSL_CMP_CHALLENGE, challenge, ASN1_OCTET_STRING)
38 } ASN1_SEQUENCE_END(OSSL_CMP_CHALLENGE)
39 IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_CHALLENGE)
40
41
42 ASN1_ITEM_TEMPLATE(OSSL_CMP_POPODECKEYCHALLCONTENT) =
43     ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0,
44                           OSSL_CMP_POPODECKEYCHALLCONTENT, OSSL_CMP_CHALLENGE)
45 ASN1_ITEM_TEMPLATE_END(OSSL_CMP_POPODECKEYCHALLCONTENT)
46
47
48 ASN1_ITEM_TEMPLATE(OSSL_CMP_POPODECKEYRESPCONTENT) =
49     ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0,
50                           OSSL_CMP_POPODECKEYRESPCONTENT, ASN1_INTEGER)
51 ASN1_ITEM_TEMPLATE_END(OSSL_CMP_POPODECKEYRESPCONTENT)
52
53
54 ASN1_SEQUENCE(OSSL_CMP_CAKEYUPDANNCONTENT) = {
55     /* OSSL_CMP_CMPCERTIFICATE is effectively X509 so it is used directly */
56     ASN1_SIMPLE(OSSL_CMP_CAKEYUPDANNCONTENT, oldWithNew, X509),
57     /* OSSL_CMP_CMPCERTIFICATE is effectively X509 so it is used directly */
58     ASN1_SIMPLE(OSSL_CMP_CAKEYUPDANNCONTENT, newWithOld, X509),
59     /* OSSL_CMP_CMPCERTIFICATE is effectively X509 so it is used directly */
60     ASN1_SIMPLE(OSSL_CMP_CAKEYUPDANNCONTENT, newWithNew, X509)
61 } ASN1_SEQUENCE_END(OSSL_CMP_CAKEYUPDANNCONTENT)
62 IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_CAKEYUPDANNCONTENT)
63
64
65 ASN1_SEQUENCE(OSSL_CMP_ERRORMSGCONTENT) = {
66     ASN1_SIMPLE(OSSL_CMP_ERRORMSGCONTENT, pKIStatusInfo, OSSL_CMP_PKISI),
67     ASN1_OPT(OSSL_CMP_ERRORMSGCONTENT, errorCode, ASN1_INTEGER),
68     /*
69      * OSSL_CMP_PKIFREETEXT is effectively a sequence of ASN1_UTF8STRING
70      * so it is used directly
71      *
72      */
73     ASN1_SEQUENCE_OF_OPT(OSSL_CMP_ERRORMSGCONTENT, errorDetails,
74                          ASN1_UTF8STRING)
75 } ASN1_SEQUENCE_END(OSSL_CMP_ERRORMSGCONTENT)
76 IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_ERRORMSGCONTENT)
77
78 ASN1_ADB_TEMPLATE(infotypeandvalue_default) = ASN1_OPT(OSSL_CMP_ITAV,
79                                                        infoValue.other,
80                                                        ASN1_ANY);
81 /* ITAV means InfoTypeAndValue */
82 ASN1_ADB(OSSL_CMP_ITAV) = {
83     /* OSSL_CMP_CMPCERTIFICATE is effectively X509 so it is used directly */
84     ADB_ENTRY(NID_id_it_caProtEncCert, ASN1_OPT(OSSL_CMP_ITAV,
85                                                 infoValue.caProtEncCert, X509)),
86     ADB_ENTRY(NID_id_it_signKeyPairTypes,
87               ASN1_SEQUENCE_OF_OPT(OSSL_CMP_ITAV,
88                                    infoValue.signKeyPairTypes, X509_ALGOR)),
89     ADB_ENTRY(NID_id_it_encKeyPairTypes,
90               ASN1_SEQUENCE_OF_OPT(OSSL_CMP_ITAV,
91                                    infoValue.encKeyPairTypes, X509_ALGOR)),
92     ADB_ENTRY(NID_id_it_preferredSymmAlg,
93               ASN1_OPT(OSSL_CMP_ITAV, infoValue.preferredSymmAlg,
94                        X509_ALGOR)),
95     ADB_ENTRY(NID_id_it_caKeyUpdateInfo,
96               ASN1_OPT(OSSL_CMP_ITAV, infoValue.caKeyUpdateInfo,
97                        OSSL_CMP_CAKEYUPDANNCONTENT)),
98     ADB_ENTRY(NID_id_it_currentCRL,
99               ASN1_OPT(OSSL_CMP_ITAV, infoValue.currentCRL, X509_CRL)),
100     ADB_ENTRY(NID_id_it_unsupportedOIDs,
101               ASN1_SEQUENCE_OF_OPT(OSSL_CMP_ITAV,
102                                    infoValue.unsupportedOIDs, ASN1_OBJECT)),
103     ADB_ENTRY(NID_id_it_keyPairParamReq,
104               ASN1_OPT(OSSL_CMP_ITAV, infoValue.keyPairParamReq,
105                        ASN1_OBJECT)),
106     ADB_ENTRY(NID_id_it_keyPairParamRep,
107               ASN1_OPT(OSSL_CMP_ITAV, infoValue.keyPairParamRep,
108                        X509_ALGOR)),
109     ADB_ENTRY(NID_id_it_revPassphrase,
110               ASN1_OPT(OSSL_CMP_ITAV, infoValue.revPassphrase,
111                        OSSL_CRMF_ENCRYPTEDVALUE)),
112     ADB_ENTRY(NID_id_it_implicitConfirm,
113               ASN1_OPT(OSSL_CMP_ITAV, infoValue.implicitConfirm,
114                        ASN1_NULL)),
115     ADB_ENTRY(NID_id_it_confirmWaitTime,
116               ASN1_OPT(OSSL_CMP_ITAV, infoValue.confirmWaitTime,
117                        ASN1_GENERALIZEDTIME)),
118     ADB_ENTRY(NID_id_it_origPKIMessage,
119               ASN1_OPT(OSSL_CMP_ITAV, infoValue.origPKIMessage,
120                        OSSL_CMP_MSGS)),
121     ADB_ENTRY(NID_id_it_suppLangTags,
122               ASN1_SEQUENCE_OF_OPT(OSSL_CMP_ITAV, infoValue.suppLangTagsValue,
123                                    ASN1_UTF8STRING)),
124 } ASN1_ADB_END(OSSL_CMP_ITAV, 0, infoType, 0,
125                &infotypeandvalue_default_tt, NULL);
126
127
128 ASN1_SEQUENCE(OSSL_CMP_ITAV) = {
129     ASN1_SIMPLE(OSSL_CMP_ITAV, infoType, ASN1_OBJECT),
130     ASN1_ADB_OBJECT(OSSL_CMP_ITAV)
131 } ASN1_SEQUENCE_END(OSSL_CMP_ITAV)
132 IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_ITAV)
133 IMPLEMENT_ASN1_DUP_FUNCTION(OSSL_CMP_ITAV)
134
135 OSSL_CMP_ITAV *OSSL_CMP_ITAV_create(ASN1_OBJECT *type, ASN1_TYPE *value)
136 {
137     OSSL_CMP_ITAV *itav;
138
139     if (type == NULL || (itav = OSSL_CMP_ITAV_new()) == NULL)
140         return NULL;
141     OSSL_CMP_ITAV_set0(itav, type, value);
142     return itav;
143 }
144
145 void OSSL_CMP_ITAV_set0(OSSL_CMP_ITAV *itav, ASN1_OBJECT *type,
146                         ASN1_TYPE *value)
147 {
148     itav->infoType = type;
149     itav->infoValue.other = value;
150 }
151
152 ASN1_OBJECT *OSSL_CMP_ITAV_get0_type(const OSSL_CMP_ITAV *itav)
153 {
154     if (itav == NULL)
155         return NULL;
156     return itav->infoType;
157 }
158
159 ASN1_TYPE *OSSL_CMP_ITAV_get0_value(const OSSL_CMP_ITAV *itav)
160 {
161     if (itav == NULL)
162         return NULL;
163     return itav->infoValue.other;
164 }
165
166 int OSSL_CMP_ITAV_push0_stack_item(STACK_OF(OSSL_CMP_ITAV) **itav_sk_p,
167                                    OSSL_CMP_ITAV *itav)
168 {
169     int created = 0;
170
171     if (itav_sk_p == NULL || itav == NULL) {
172         CMPerr(0, CMP_R_NULL_ARGUMENT);
173         goto err;
174     }
175
176     if (*itav_sk_p == NULL) {
177         if ((*itav_sk_p = sk_OSSL_CMP_ITAV_new_null()) == NULL)
178             goto err;
179         created = 1;
180     }
181     if (!sk_OSSL_CMP_ITAV_push(*itav_sk_p, itav))
182         goto err;
183     return 1;
184
185  err:
186     if (created != 0) {
187         sk_OSSL_CMP_ITAV_free(*itav_sk_p);
188         *itav_sk_p = NULL;
189     }
190     return 0;
191 }
192
193 /* get ASN.1 encoded integer, return -1 on error */
194 int ossl_cmp_asn1_get_int(const ASN1_INTEGER *a)
195 {
196     int64_t res;
197
198     if (!ASN1_INTEGER_get_int64(&res, a)) {
199         CMPerr(0, ASN1_R_INVALID_NUMBER);
200         return -1;
201     }
202     if (res < INT_MIN) {
203         CMPerr(0, ASN1_R_TOO_SMALL);
204         return -1;
205     }
206     if (res > INT_MAX) {
207         CMPerr(0, ASN1_R_TOO_LARGE);
208         return -1;
209     }
210     return (int)res;
211 }
212
213 ASN1_CHOICE(OSSL_CMP_CERTORENCCERT) = {
214     /* OSSL_CMP_CMPCERTIFICATE is effectively X509 so it is used directly */
215     ASN1_EXP(OSSL_CMP_CERTORENCCERT, value.certificate, X509, 0),
216     ASN1_EXP(OSSL_CMP_CERTORENCCERT, value.encryptedCert,
217              OSSL_CRMF_ENCRYPTEDVALUE, 1),
218 } ASN1_CHOICE_END(OSSL_CMP_CERTORENCCERT)
219 IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_CERTORENCCERT)
220
221
222 ASN1_SEQUENCE(OSSL_CMP_CERTIFIEDKEYPAIR) = {
223     ASN1_SIMPLE(OSSL_CMP_CERTIFIEDKEYPAIR, certOrEncCert,
224                 OSSL_CMP_CERTORENCCERT),
225     ASN1_EXP_OPT(OSSL_CMP_CERTIFIEDKEYPAIR, privateKey,
226                  OSSL_CRMF_ENCRYPTEDVALUE, 0),
227     ASN1_EXP_OPT(OSSL_CMP_CERTIFIEDKEYPAIR, publicationInfo,
228                  OSSL_CRMF_PKIPUBLICATIONINFO, 1)
229 } ASN1_SEQUENCE_END(OSSL_CMP_CERTIFIEDKEYPAIR)
230 IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_CERTIFIEDKEYPAIR)
231
232
233 ASN1_SEQUENCE(OSSL_CMP_REVDETAILS) = {
234     ASN1_SIMPLE(OSSL_CMP_REVDETAILS, certDetails, OSSL_CRMF_CERTTEMPLATE),
235     ASN1_OPT(OSSL_CMP_REVDETAILS, crlEntryDetails, X509_EXTENSIONS)
236 } ASN1_SEQUENCE_END(OSSL_CMP_REVDETAILS)
237 IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_REVDETAILS)
238
239
240 ASN1_ITEM_TEMPLATE(OSSL_CMP_REVREQCONTENT) =
241     ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, OSSL_CMP_REVREQCONTENT,
242                           OSSL_CMP_REVDETAILS)
243 ASN1_ITEM_TEMPLATE_END(OSSL_CMP_REVREQCONTENT)
244
245
246 ASN1_SEQUENCE(OSSL_CMP_REVREPCONTENT) = {
247     ASN1_SEQUENCE_OF(OSSL_CMP_REVREPCONTENT, status, OSSL_CMP_PKISI),
248     ASN1_EXP_SEQUENCE_OF_OPT(OSSL_CMP_REVREPCONTENT, revCerts, OSSL_CRMF_CERTID,
249                              0),
250     ASN1_EXP_SEQUENCE_OF_OPT(OSSL_CMP_REVREPCONTENT, crls, X509_CRL, 1)
251 } ASN1_SEQUENCE_END(OSSL_CMP_REVREPCONTENT)
252 IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_REVREPCONTENT)
253
254
255 ASN1_SEQUENCE(OSSL_CMP_KEYRECREPCONTENT) = {
256     ASN1_SIMPLE(OSSL_CMP_KEYRECREPCONTENT, status, OSSL_CMP_PKISI),
257     ASN1_EXP_OPT(OSSL_CMP_KEYRECREPCONTENT, newSigCert, X509, 0),
258     ASN1_EXP_SEQUENCE_OF_OPT(OSSL_CMP_KEYRECREPCONTENT, caCerts, X509, 1),
259     ASN1_EXP_SEQUENCE_OF_OPT(OSSL_CMP_KEYRECREPCONTENT, keyPairHist,
260                              OSSL_CMP_CERTIFIEDKEYPAIR, 2)
261 } ASN1_SEQUENCE_END(OSSL_CMP_KEYRECREPCONTENT)
262 IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_KEYRECREPCONTENT)
263
264
265 ASN1_ITEM_TEMPLATE(OSSL_CMP_PKISTATUS) =
266     ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_UNIVERSAL, 0, status, ASN1_INTEGER)
267 ASN1_ITEM_TEMPLATE_END(OSSL_CMP_PKISTATUS)
268
269 ASN1_SEQUENCE(OSSL_CMP_PKISI) = {
270     ASN1_SIMPLE(OSSL_CMP_PKISI, status, OSSL_CMP_PKISTATUS),
271     /*
272      * CMP_PKIFREETEXT is effectively a sequence of ASN1_UTF8STRING
273      * so it is used directly
274      */
275     ASN1_SEQUENCE_OF_OPT(OSSL_CMP_PKISI, statusString, ASN1_UTF8STRING),
276     /*
277      * OSSL_CMP_PKIFAILUREINFO is effectively ASN1_BIT_STRING so used directly
278      */
279     ASN1_OPT(OSSL_CMP_PKISI, failInfo, ASN1_BIT_STRING)
280 } ASN1_SEQUENCE_END(OSSL_CMP_PKISI)
281 IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_PKISI)
282 IMPLEMENT_ASN1_DUP_FUNCTION(OSSL_CMP_PKISI)
283
284 ASN1_SEQUENCE(OSSL_CMP_CERTSTATUS) = {
285     ASN1_SIMPLE(OSSL_CMP_CERTSTATUS, certHash, ASN1_OCTET_STRING),
286     ASN1_SIMPLE(OSSL_CMP_CERTSTATUS, certReqId, ASN1_INTEGER),
287     ASN1_OPT(OSSL_CMP_CERTSTATUS, statusInfo, OSSL_CMP_PKISI)
288 } ASN1_SEQUENCE_END(OSSL_CMP_CERTSTATUS)
289 IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_CERTSTATUS)
290
291 ASN1_ITEM_TEMPLATE(OSSL_CMP_CERTCONFIRMCONTENT) =
292     ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, OSSL_CMP_CERTCONFIRMCONTENT,
293                           OSSL_CMP_CERTSTATUS)
294 ASN1_ITEM_TEMPLATE_END(OSSL_CMP_CERTCONFIRMCONTENT)
295
296 ASN1_SEQUENCE(OSSL_CMP_CERTRESPONSE) = {
297     ASN1_SIMPLE(OSSL_CMP_CERTRESPONSE, certReqId, ASN1_INTEGER),
298     ASN1_SIMPLE(OSSL_CMP_CERTRESPONSE, status, OSSL_CMP_PKISI),
299     ASN1_OPT(OSSL_CMP_CERTRESPONSE, certifiedKeyPair,
300              OSSL_CMP_CERTIFIEDKEYPAIR),
301     ASN1_OPT(OSSL_CMP_CERTRESPONSE, rspInfo, ASN1_OCTET_STRING)
302 } ASN1_SEQUENCE_END(OSSL_CMP_CERTRESPONSE)
303 IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_CERTRESPONSE)
304
305 ASN1_SEQUENCE(OSSL_CMP_POLLREQ) = {
306     ASN1_SIMPLE(OSSL_CMP_POLLREQ, certReqId, ASN1_INTEGER)
307 } ASN1_SEQUENCE_END(OSSL_CMP_POLLREQ)
308 IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_POLLREQ)
309
310 ASN1_ITEM_TEMPLATE(OSSL_CMP_POLLREQCONTENT) =
311     ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, OSSL_CMP_POLLREQCONTENT,
312                           OSSL_CMP_POLLREQ)
313 ASN1_ITEM_TEMPLATE_END(OSSL_CMP_POLLREQCONTENT)
314
315 ASN1_SEQUENCE(OSSL_CMP_POLLREP) = {
316     ASN1_SIMPLE(OSSL_CMP_POLLREP, certReqId, ASN1_INTEGER),
317     ASN1_SIMPLE(OSSL_CMP_POLLREP, checkAfter, ASN1_INTEGER),
318     ASN1_SEQUENCE_OF_OPT(OSSL_CMP_POLLREP, reason, ASN1_UTF8STRING),
319 } ASN1_SEQUENCE_END(OSSL_CMP_POLLREP)
320 IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_POLLREP)
321
322 ASN1_ITEM_TEMPLATE(OSSL_CMP_POLLREPCONTENT) =
323     ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0,
324                           OSSL_CMP_POLLREPCONTENT,
325                           OSSL_CMP_POLLREP)
326 ASN1_ITEM_TEMPLATE_END(OSSL_CMP_POLLREPCONTENT)
327
328 ASN1_SEQUENCE(OSSL_CMP_CERTREPMESSAGE) = {
329     /* OSSL_CMP_CMPCERTIFICATE is effectively X509 so it is used directly */
330     ASN1_EXP_SEQUENCE_OF_OPT(OSSL_CMP_CERTREPMESSAGE, caPubs, X509, 1),
331     ASN1_SEQUENCE_OF(OSSL_CMP_CERTREPMESSAGE, response, OSSL_CMP_CERTRESPONSE)
332 } ASN1_SEQUENCE_END(OSSL_CMP_CERTREPMESSAGE)
333 IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_CERTREPMESSAGE)
334
335 ASN1_ITEM_TEMPLATE(OSSL_CMP_GENMSGCONTENT) =
336     ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, OSSL_CMP_GENMSGCONTENT,
337                           OSSL_CMP_ITAV)
338 ASN1_ITEM_TEMPLATE_END(OSSL_CMP_GENMSGCONTENT)
339
340 ASN1_ITEM_TEMPLATE(OSSL_CMP_GENREPCONTENT) =
341     ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, OSSL_CMP_GENREPCONTENT,
342                           OSSL_CMP_ITAV)
343 ASN1_ITEM_TEMPLATE_END(OSSL_CMP_GENREPCONTENT)
344
345 ASN1_ITEM_TEMPLATE(OSSL_CMP_CRLANNCONTENT) =
346     ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0,
347                           OSSL_CMP_CRLANNCONTENT, X509_CRL)
348 ASN1_ITEM_TEMPLATE_END(OSSL_CMP_CRLANNCONTENT)
349
350 ASN1_CHOICE(OSSL_CMP_PKIBODY) = {
351     ASN1_EXP(OSSL_CMP_PKIBODY, value.ir, OSSL_CRMF_MSGS, 0),
352     ASN1_EXP(OSSL_CMP_PKIBODY, value.ip, OSSL_CMP_CERTREPMESSAGE, 1),
353     ASN1_EXP(OSSL_CMP_PKIBODY, value.cr, OSSL_CRMF_MSGS, 2),
354     ASN1_EXP(OSSL_CMP_PKIBODY, value.cp, OSSL_CMP_CERTREPMESSAGE, 3),
355     ASN1_EXP(OSSL_CMP_PKIBODY, value.p10cr, X509_REQ, 4),
356     ASN1_EXP(OSSL_CMP_PKIBODY, value.popdecc,
357              OSSL_CMP_POPODECKEYCHALLCONTENT, 5),
358     ASN1_EXP(OSSL_CMP_PKIBODY, value.popdecr,
359              OSSL_CMP_POPODECKEYRESPCONTENT, 6),
360     ASN1_EXP(OSSL_CMP_PKIBODY, value.kur, OSSL_CRMF_MSGS, 7),
361     ASN1_EXP(OSSL_CMP_PKIBODY, value.kup, OSSL_CMP_CERTREPMESSAGE, 8),
362     ASN1_EXP(OSSL_CMP_PKIBODY, value.krr, OSSL_CRMF_MSGS, 9),
363     ASN1_EXP(OSSL_CMP_PKIBODY, value.krp, OSSL_CMP_KEYRECREPCONTENT, 10),
364     ASN1_EXP(OSSL_CMP_PKIBODY, value.rr, OSSL_CMP_REVREQCONTENT, 11),
365     ASN1_EXP(OSSL_CMP_PKIBODY, value.rp, OSSL_CMP_REVREPCONTENT, 12),
366     ASN1_EXP(OSSL_CMP_PKIBODY, value.ccr, OSSL_CRMF_MSGS, 13),
367     ASN1_EXP(OSSL_CMP_PKIBODY, value.ccp, OSSL_CMP_CERTREPMESSAGE, 14),
368     ASN1_EXP(OSSL_CMP_PKIBODY, value.ckuann, OSSL_CMP_CAKEYUPDANNCONTENT, 15),
369     ASN1_EXP(OSSL_CMP_PKIBODY, value.cann, X509, 16),
370     ASN1_EXP(OSSL_CMP_PKIBODY, value.rann, OSSL_CMP_REVANNCONTENT, 17),
371     ASN1_EXP(OSSL_CMP_PKIBODY, value.crlann, OSSL_CMP_CRLANNCONTENT, 18),
372     ASN1_EXP(OSSL_CMP_PKIBODY, value.pkiconf, ASN1_ANY, 19),
373     ASN1_EXP(OSSL_CMP_PKIBODY, value.nested, OSSL_CMP_MSGS, 20),
374     ASN1_EXP(OSSL_CMP_PKIBODY, value.genm, OSSL_CMP_GENMSGCONTENT, 21),
375     ASN1_EXP(OSSL_CMP_PKIBODY, value.genp, OSSL_CMP_GENREPCONTENT, 22),
376     ASN1_EXP(OSSL_CMP_PKIBODY, value.error, OSSL_CMP_ERRORMSGCONTENT, 23),
377     ASN1_EXP(OSSL_CMP_PKIBODY, value.certConf, OSSL_CMP_CERTCONFIRMCONTENT, 24),
378     ASN1_EXP(OSSL_CMP_PKIBODY, value.pollReq, OSSL_CMP_POLLREQCONTENT, 25),
379     ASN1_EXP(OSSL_CMP_PKIBODY, value.pollRep, OSSL_CMP_POLLREPCONTENT, 26),
380 } ASN1_CHOICE_END(OSSL_CMP_PKIBODY)
381 IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_PKIBODY)
382
383 ASN1_SEQUENCE(OSSL_CMP_PKIHEADER) = {
384     ASN1_SIMPLE(OSSL_CMP_PKIHEADER, pvno, ASN1_INTEGER),
385     ASN1_SIMPLE(OSSL_CMP_PKIHEADER, sender, GENERAL_NAME),
386     ASN1_SIMPLE(OSSL_CMP_PKIHEADER, recipient, GENERAL_NAME),
387     ASN1_EXP_OPT(OSSL_CMP_PKIHEADER, messageTime, ASN1_GENERALIZEDTIME, 0),
388     ASN1_EXP_OPT(OSSL_CMP_PKIHEADER, protectionAlg, X509_ALGOR, 1),
389     ASN1_EXP_OPT(OSSL_CMP_PKIHEADER, senderKID, ASN1_OCTET_STRING, 2),
390     ASN1_EXP_OPT(OSSL_CMP_PKIHEADER, recipKID, ASN1_OCTET_STRING, 3),
391     ASN1_EXP_OPT(OSSL_CMP_PKIHEADER, transactionID, ASN1_OCTET_STRING, 4),
392     ASN1_EXP_OPT(OSSL_CMP_PKIHEADER, senderNonce, ASN1_OCTET_STRING, 5),
393     ASN1_EXP_OPT(OSSL_CMP_PKIHEADER, recipNonce, ASN1_OCTET_STRING, 6),
394     /*
395      * OSSL_CMP_PKIFREETEXT is effectively a sequence of ASN1_UTF8STRING
396      * so it is used directly
397      */
398     ASN1_EXP_SEQUENCE_OF_OPT(OSSL_CMP_PKIHEADER, freeText, ASN1_UTF8STRING, 7),
399     ASN1_EXP_SEQUENCE_OF_OPT(OSSL_CMP_PKIHEADER, generalInfo,
400                              OSSL_CMP_ITAV, 8)
401 } ASN1_SEQUENCE_END(OSSL_CMP_PKIHEADER)
402 IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_PKIHEADER)
403
404 ASN1_SEQUENCE(OSSL_CMP_PROTECTEDPART) = {
405     ASN1_SIMPLE(OSSL_CMP_MSG, header, OSSL_CMP_PKIHEADER),
406     ASN1_SIMPLE(OSSL_CMP_MSG, body, OSSL_CMP_PKIBODY)
407 } ASN1_SEQUENCE_END(OSSL_CMP_PROTECTEDPART)
408 IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_PROTECTEDPART)
409
410 ASN1_SEQUENCE(OSSL_CMP_MSG) = {
411     ASN1_SIMPLE(OSSL_CMP_MSG, header, OSSL_CMP_PKIHEADER),
412     ASN1_SIMPLE(OSSL_CMP_MSG, body, OSSL_CMP_PKIBODY),
413     ASN1_EXP_OPT(OSSL_CMP_MSG, protection, ASN1_BIT_STRING, 0),
414     /* OSSL_CMP_CMPCERTIFICATE is effectively X509 so it is used directly */
415     ASN1_EXP_SEQUENCE_OF_OPT(OSSL_CMP_MSG, extraCerts, X509, 1)
416 } ASN1_SEQUENCE_END(OSSL_CMP_MSG)
417 IMPLEMENT_ASN1_FUNCTIONS(OSSL_CMP_MSG)
418 IMPLEMENT_ASN1_DUP_FUNCTION(OSSL_CMP_MSG)
419
420 ASN1_ITEM_TEMPLATE(OSSL_CMP_MSGS) =
421     ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, OSSL_CMP_MSGS,
422                           OSSL_CMP_MSG)
423 ASN1_ITEM_TEMPLATE_END(OSSL_CMP_MSGS)