2 * Copyright 2007-2021 The OpenSSL Project Authors. All Rights Reserved.
3 * Copyright Nokia 2007-2019
4 * Copyright Siemens AG 2015-2019
6 * Licensed under the Apache License 2.0 (the "License"). You may not use
7 * this file except in compliance with the License. You can obtain a copy
8 * in the file LICENSE in the source distribution or at
9 * https://www.openssl.org/source/license.html
12 #include "cmp_local.h"
14 /* explicit #includes not strictly needed since implied by the above: */
15 #include <openssl/asn1t.h>
16 #include <openssl/cmp.h>
17 #include <openssl/crmf.h>
18 #include <openssl/err.h>
19 #include <openssl/x509.h>
22 * This function is also used by the internal verify_PBMAC() in cmp_vfy.c.
24 * Calculate protection for given PKImessage according to
25 * the algorithm and parameters in the message header's protectionAlg
26 * using the credentials, library context, and property criteria in the ctx.
28 * returns ASN1_BIT_STRING representing the protection on success, else NULL
30 ASN1_BIT_STRING
*ossl_cmp_calc_protection(const OSSL_CMP_CTX
*ctx
,
31 const OSSL_CMP_MSG
*msg
)
33 ASN1_BIT_STRING
*prot
= NULL
;
34 OSSL_CMP_PROTECTEDPART prot_part
;
35 const ASN1_OBJECT
*algorOID
= NULL
;
36 const void *ppval
= NULL
;
39 if (!ossl_assert(ctx
!= NULL
&& msg
!= NULL
))
42 /* construct data to be signed */
43 prot_part
.header
= msg
->header
;
44 prot_part
.body
= msg
->body
;
46 if (msg
->header
->protectionAlg
== NULL
) {
47 ERR_raise(ERR_LIB_CMP
, CMP_R_UNKNOWN_ALGORITHM_ID
);
50 X509_ALGOR_get0(&algorOID
, &pptype
, &ppval
, msg
->header
->protectionAlg
);
52 if (OBJ_obj2nid(algorOID
) == NID_id_PasswordBasedMAC
) {
54 size_t prot_part_der_len
;
55 unsigned char *prot_part_der
= NULL
;
57 unsigned char *protection
= NULL
;
58 OSSL_CRMF_PBMPARAMETER
*pbm
= NULL
;
59 ASN1_STRING
*pbm_str
= NULL
;
60 const unsigned char *pbm_str_uc
= NULL
;
62 if (ctx
->secretValue
== NULL
) {
63 ERR_raise(ERR_LIB_CMP
, CMP_R_MISSING_PBM_SECRET
);
67 ERR_raise(ERR_LIB_CMP
, CMP_R_ERROR_CALCULATING_PROTECTION
);
71 len
= i2d_OSSL_CMP_PROTECTEDPART(&prot_part
, &prot_part_der
);
72 if (len
< 0 || prot_part_der
== NULL
) {
73 ERR_raise(ERR_LIB_CMP
, CMP_R_ERROR_CALCULATING_PROTECTION
);
76 prot_part_der_len
= (size_t)len
;
78 pbm_str
= (ASN1_STRING
*)ppval
;
79 pbm_str_uc
= pbm_str
->data
;
80 pbm
= d2i_OSSL_CRMF_PBMPARAMETER(NULL
, &pbm_str_uc
, pbm_str
->length
);
82 ERR_raise(ERR_LIB_CMP
, CMP_R_WRONG_ALGORITHM_OID
);
86 if (!OSSL_CRMF_pbm_new(ctx
->libctx
, ctx
->propq
,
87 pbm
, prot_part_der
, prot_part_der_len
,
88 ctx
->secretValue
->data
, ctx
->secretValue
->length
,
89 &protection
, &sig_len
))
92 if ((prot
= ASN1_BIT_STRING_new()) == NULL
)
94 /* OpenSSL defaults all bit strings to be encoded as ASN.1 NamedBitList */
95 prot
->flags
&= ~(ASN1_STRING_FLAG_BITS_LEFT
| 0x07);
96 prot
->flags
|= ASN1_STRING_FLAG_BITS_LEFT
;
97 if (!ASN1_BIT_STRING_set(prot
, protection
, sig_len
)) {
98 ASN1_BIT_STRING_free(prot
);
102 OSSL_CRMF_PBMPARAMETER_free(pbm
);
103 OPENSSL_free(protection
);
104 OPENSSL_free(prot_part_der
);
108 const EVP_MD
*md
= NULL
;
110 if (ctx
->pkey
== NULL
) {
111 ERR_raise(ERR_LIB_CMP
,
112 CMP_R_MISSING_KEY_INPUT_FOR_CREATING_PROTECTION
);
115 if (!OBJ_find_sigid_algs(OBJ_obj2nid(algorOID
), &md_nid
, NULL
)
116 || (md
= EVP_get_digestbynid(md_nid
)) == NULL
) {
117 ERR_raise(ERR_LIB_CMP
, CMP_R_UNKNOWN_ALGORITHM_ID
);
121 if ((prot
= ASN1_BIT_STRING_new()) == NULL
)
123 if (ASN1_item_sign_ex(ASN1_ITEM_rptr(OSSL_CMP_PROTECTEDPART
), NULL
,
124 NULL
, prot
, &prot_part
, NULL
, ctx
->pkey
, md
,
125 ctx
->libctx
, ctx
->propq
))
127 ASN1_BIT_STRING_free(prot
);
132 int ossl_cmp_msg_add_extraCerts(OSSL_CMP_CTX
*ctx
, OSSL_CMP_MSG
*msg
)
134 if (!ossl_assert(ctx
!= NULL
&& msg
!= NULL
))
137 /* Add first ctx->cert and its chain if using signature-based protection */
138 if (!ctx
->unprotectedSend
&& ctx
->secretValue
== NULL
139 && ctx
->cert
!= NULL
&& ctx
->pkey
!= NULL
) {
140 int prepend
= X509_ADD_FLAG_UP_REF
| X509_ADD_FLAG_NO_DUP
141 | X509_ADD_FLAG_PREPEND
| X509_ADD_FLAG_NO_SS
;
143 /* if not yet done try to build chain using available untrusted certs */
144 if (ctx
->chain
== NULL
) {
146 "trying to build chain for own CMP signer cert");
148 ossl_cmp_build_cert_chain(ctx
->libctx
, ctx
->propq
, NULL
,
149 ctx
->untrusted
, ctx
->cert
);
150 if (ctx
->chain
!= NULL
) {
152 "success building chain for own CMP signer cert");
154 /* dump errors to avoid confusion when printing further ones */
155 OSSL_CMP_CTX_print_errors(ctx
);
157 "could not build chain for own CMP signer cert");
160 if (ctx
->chain
!= NULL
) {
161 if (!ossl_x509_add_certs_new(&msg
->extraCerts
, ctx
->chain
, prepend
))
164 /* make sure that at least our own signer cert is included first */
165 if (!ossl_x509_add_cert_new(&msg
->extraCerts
, ctx
->cert
, prepend
))
167 ossl_cmp_debug(ctx
, "fallback: adding just own CMP signer cert");
171 /* add any additional certificates from ctx->extraCertsOut */
172 if (!ossl_x509_add_certs_new(&msg
->extraCerts
, ctx
->extraCertsOut
,
173 X509_ADD_FLAG_UP_REF
| X509_ADD_FLAG_NO_DUP
))
176 /* in case extraCerts are empty list avoid empty ASN.1 sequence */
177 if (sk_X509_num(msg
->extraCerts
) == 0) {
178 sk_X509_free(msg
->extraCerts
);
179 msg
->extraCerts
= NULL
;
185 * Create an X509_ALGOR structure for PasswordBasedMAC protection based on
186 * the pbm settings in the context
188 static int set_pbmac_algor(const OSSL_CMP_CTX
*ctx
, X509_ALGOR
**alg
)
190 OSSL_CRMF_PBMPARAMETER
*pbm
= NULL
;
191 unsigned char *pbm_der
= NULL
;
193 ASN1_STRING
*pbm_str
= NULL
;
195 if (!ossl_assert(ctx
!= NULL
))
198 pbm
= OSSL_CRMF_pbmp_new(ctx
->libctx
, ctx
->pbm_slen
,
199 EVP_MD_type(ctx
->pbm_owf
), ctx
->pbm_itercnt
,
201 pbm_str
= ASN1_STRING_new();
202 if (pbm
== NULL
|| pbm_str
== NULL
)
205 if ((pbm_der_len
= i2d_OSSL_CRMF_PBMPARAMETER(pbm
, &pbm_der
)) < 0)
208 if (!ASN1_STRING_set(pbm_str
, pbm_der
, pbm_der_len
))
210 if (*alg
== NULL
&& (*alg
= X509_ALGOR_new()) == NULL
)
212 OPENSSL_free(pbm_der
);
214 X509_ALGOR_set0(*alg
, OBJ_nid2obj(NID_id_PasswordBasedMAC
),
215 V_ASN1_SEQUENCE
, pbm_str
);
216 OSSL_CRMF_PBMPARAMETER_free(pbm
);
220 ASN1_STRING_free(pbm_str
);
221 OPENSSL_free(pbm_der
);
222 OSSL_CRMF_PBMPARAMETER_free(pbm
);
226 static int set_sig_algor(const OSSL_CMP_CTX
*ctx
, X509_ALGOR
**alg
)
229 ASN1_OBJECT
*algo
= NULL
;
231 if (!OBJ_find_sigid_by_algs(&nid
, EVP_MD_type(ctx
->digest
),
232 EVP_PKEY_id(ctx
->pkey
))) {
233 ERR_raise(ERR_LIB_CMP
, CMP_R_UNSUPPORTED_KEY_TYPE
);
236 if ((algo
= OBJ_nid2obj(nid
)) == NULL
)
238 if (*alg
== NULL
&& (*alg
= X509_ALGOR_new()) == NULL
)
241 if (X509_ALGOR_set0(*alg
, algo
, V_ASN1_UNDEF
, NULL
))
243 ASN1_OBJECT_free(algo
);
247 static int set_senderKID(const OSSL_CMP_CTX
*ctx
, OSSL_CMP_MSG
*msg
,
248 const ASN1_OCTET_STRING
*id
)
251 id
= ctx
->referenceValue
; /* standard for PBM, fallback for sig-based */
252 return id
== NULL
|| ossl_cmp_hdr_set1_senderKID(msg
->header
, id
);
255 int ossl_cmp_msg_protect(OSSL_CMP_CTX
*ctx
, OSSL_CMP_MSG
*msg
)
257 if (!ossl_assert(ctx
!= NULL
&& msg
!= NULL
))
261 * For the case of re-protection remove pre-existing protection.
262 * TODO: Consider also removing any pre-existing extraCerts.
264 X509_ALGOR_free(msg
->header
->protectionAlg
);
265 msg
->header
->protectionAlg
= NULL
;
266 ASN1_BIT_STRING_free(msg
->protection
);
267 msg
->protection
= NULL
;
269 if (ctx
->unprotectedSend
) {
270 if (!set_senderKID(ctx
, msg
, NULL
))
272 } else if (ctx
->secretValue
!= NULL
) {
273 /* use PasswordBasedMac according to 5.1.3.1 if secretValue is given */
274 if (!set_pbmac_algor(ctx
, &msg
->header
->protectionAlg
))
276 if (!set_senderKID(ctx
, msg
, NULL
))
280 * will add any additional certificates from ctx->extraCertsOut
281 * while not needed to validate the protection certificate,
282 * the option to do this might be handy for certain use cases
284 } else if (ctx
->cert
!= NULL
&& ctx
->pkey
!= NULL
) {
285 /* use MSG_SIG_ALG according to 5.1.3.3 if client cert and key given */
287 /* make sure that key and certificate match */
288 if (!X509_check_private_key(ctx
->cert
, ctx
->pkey
)) {
289 ERR_raise(ERR_LIB_CMP
, CMP_R_CERT_AND_KEY_DO_NOT_MATCH
);
293 if (!set_sig_algor(ctx
, &msg
->header
->protectionAlg
))
295 /* set senderKID to keyIdentifier of the cert according to 5.1.1 */
296 if (!set_senderKID(ctx
, msg
, X509_get0_subject_key_id(ctx
->cert
)))
300 * will add ctx->cert followed, if possible, by its chain built
301 * from ctx->untrusted, and then ctx->extraCertsOut
304 ERR_raise(ERR_LIB_CMP
,
305 CMP_R_MISSING_KEY_INPUT_FOR_CREATING_PROTECTION
);
308 if (!ctx
->unprotectedSend
309 && ((msg
->protection
= ossl_cmp_calc_protection(ctx
, msg
)) == NULL
))
313 * For signature-based protection add ctx->cert followed by its chain.
314 * Finally add any additional certificates from ctx->extraCertsOut;
315 * even if not needed to validate the protection
316 * the option to do this might be handy for certain use cases.
318 if (!ossl_cmp_msg_add_extraCerts(ctx
, msg
))
322 * As required by RFC 4210 section 5.1.1., if the sender name is not known
323 * to the client it set to NULL-DN. In this case for identification at least
324 * the senderKID must be set, where we took the referenceValue as fallback.
326 if (!(ossl_cmp_general_name_is_NULL_DN(msg
->header
->sender
)
327 && msg
->header
->senderKID
== NULL
))
329 ERR_raise(ERR_LIB_CMP
, CMP_R_MISSING_SENDER_IDENTIFICATION
);
332 ERR_raise(ERR_LIB_CMP
, CMP_R_ERROR_PROTECTING_MESSAGE
);