/*
- * Copyright 2007-2020 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2007-2021 The OpenSSL Project Authors. All Rights Reserved.
* Copyright Nokia 2007-2019
* Copyright Siemens AG 2015-2019
*
#include <openssl/err.h>
#include <openssl/x509.h>
-DEFINE_STACK_OF(OSSL_CMP_CERTSTATUS)
-DEFINE_STACK_OF(OSSL_CMP_ITAV)
-DEFINE_STACK_OF(GENERAL_NAME)
-DEFINE_STACK_OF(X509)
-DEFINE_STACK_OF(X509_EXTENSION)
-DEFINE_STACK_OF(OSSL_CMP_PKISI)
-DEFINE_STACK_OF(OSSL_CRMF_MSG)
-DEFINE_STACK_OF(OSSL_CMP_CERTRESPONSE)
-DEFINE_STACK_OF(OSSL_CRMF_CERTID)
-DEFINE_STACK_OF(ASN1_UTF8STRING)
+OSSL_CMP_MSG *OSSL_CMP_MSG_new(OSSL_LIB_CTX *libctx, const char *propq)
+{
+ OSSL_CMP_MSG *msg = NULL;
+
+ msg = (OSSL_CMP_MSG *)ASN1_item_new_ex(ASN1_ITEM_rptr(OSSL_CMP_MSG),
+ libctx, propq);
+ if (!ossl_cmp_msg_set0_libctx(msg, libctx, propq)) {
+ OSSL_CMP_MSG_free(msg);
+ msg = NULL;
+ }
+ return msg;
+}
+
+void OSSL_CMP_MSG_free(OSSL_CMP_MSG *msg)
+{
+ ASN1_item_free((ASN1_VALUE *)msg, ASN1_ITEM_rptr(OSSL_CMP_MSG));
+}
+
+/*
+ * This should only be used if the X509 object was embedded inside another
+ * asn1 object and it needs a libctx to operate.
+ * Use OSSL_CMP_MSG_new() instead if possible.
+ */
+int ossl_cmp_msg_set0_libctx(OSSL_CMP_MSG *msg, OSSL_LIB_CTX *libctx,
+ const char *propq)
+{
+ if (msg != NULL) {
+ msg->libctx = libctx;
+ OPENSSL_free(msg->propq);
+ msg->propq = NULL;
+ if (propq != NULL) {
+ msg->propq = OPENSSL_strdup(propq);
+ if (msg->propq == NULL)
+ return 0;
+ }
+ }
+ return 1;
+}
+
OSSL_CMP_PKIHEADER *OSSL_CMP_MSG_get0_header(const OSSL_CMP_MSG *msg)
{
if (msg == NULL) {
- CMPerr(0, CMP_R_NULL_ARGUMENT);
+ ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
return NULL;
}
return msg->header;
return 1;
}
-int ossl_cmp_msg_get_bodytype(const OSSL_CMP_MSG *msg)
+int OSSL_CMP_MSG_get_bodytype(const OSSL_CMP_MSG *msg)
{
if (!ossl_assert(msg != NULL && msg->body != NULL))
return -1;
return res;
}
+/* Add extension list to the referenced extension stack, which may be NULL */
+static int add_extensions(STACK_OF(X509_EXTENSION) **target,
+ const STACK_OF(X509_EXTENSION) *exts)
+{
+ int i;
+
+ if (target == NULL)
+ return 0;
+
+ for (i = 0; i < sk_X509_EXTENSION_num(exts); i++) {
+ X509_EXTENSION *ext = sk_X509_EXTENSION_value(exts, i);
+ ASN1_OBJECT *obj = X509_EXTENSION_get_object(ext);
+ int idx = X509v3_get_ext_by_OBJ(*target, obj, -1);
+
+ /* Does extension exist in target? */
+ if (idx != -1) {
+ /* Delete all extensions of same type */
+ do {
+ X509_EXTENSION_free(sk_X509_EXTENSION_delete(*target, idx));
+ idx = X509v3_get_ext_by_OBJ(*target, obj, -1);
+ } while (idx != -1);
+ }
+ if (!X509v3_add_ext(target, ext, -1))
+ return 0;
+ }
+ return 1;
+}
+
/* Add a CRL revocation reason code to extension stack, which may be NULL */
static int add_crl_reason_extension(X509_EXTENSIONS **pexts, int reason_code)
{
if (!ossl_assert(ctx != NULL))
return NULL;
- if ((msg = OSSL_CMP_MSG_new()) == NULL)
+ if ((msg = OSSL_CMP_MSG_new(ctx->libctx, ctx->propq)) == NULL)
return NULL;
if (!ossl_cmp_hdr_init(ctx, msg->header)
|| !ossl_cmp_msg_set_bodytype(msg, bodytype))
case OSSL_CMP_PKIBODY_P10CR:
if (ctx->p10CSR == NULL) {
- CMPerr(0, CMP_R_ERROR_CREATING_P10CR);
+ ERR_raise(ERR_LIB_CMP, CMP_R_MISSING_P10CSR);
goto err;
}
if ((msg->body->value.p10cr = X509_REQ_dup(ctx->p10CSR)) == NULL)
return msg;
default:
- CMPerr(0, CMP_R_UNEXPECTED_PKIBODY);
+ ERR_raise(ERR_LIB_CMP, CMP_R_UNEXPECTED_PKIBODY);
goto err;
}
(sk_GENERAL_NAME_num((ctx)->subjectAltNames) > 0 \
|| OSSL_CMP_CTX_reqExtensions_have_SAN(ctx) == 1)
-static const X509_NAME *determine_subj(OSSL_CMP_CTX *ctx, X509 *refcert,
- int bodytype)
+static const X509_NAME *determine_subj(OSSL_CMP_CTX *ctx,
+ const X509_NAME *ref_subj,
+ int for_KUR)
{
if (ctx->subjectName != NULL)
- return ctx->subjectName;
+ return IS_NULL_DN(ctx->subjectName) ? NULL : ctx->subjectName;
- if (refcert != NULL
- && (bodytype == OSSL_CMP_PKIBODY_KUR || !HAS_SAN(ctx)))
+ if (ref_subj != NULL && (for_KUR || !HAS_SAN(ctx)))
/*
- * For KUR, copy subjectName from reference certificate.
+ * For KUR, copy subject from the reference.
* For IR or CR, do the same only if there is no subjectAltName.
*/
- return X509_get_subject_name(refcert);
+ return ref_subj;
return NULL;
}
-/*
- * Create CRMF certificate request message for IR/CR/KUR
- * returns a pointer to the OSSL_CRMF_MSG on success, NULL on error
- */
-static OSSL_CRMF_MSG *crm_new(OSSL_CMP_CTX *ctx, int bodytype, int rid)
+OSSL_CRMF_MSG *OSSL_CMP_CTX_setup_CRM(OSSL_CMP_CTX *ctx, int for_KUR, int rid)
{
OSSL_CRMF_MSG *crm = NULL;
X509 *refcert = ctx->oldCert != NULL ? ctx->oldCert : ctx->cert;
/* refcert defaults to current client cert */
EVP_PKEY *rkey = OSSL_CMP_CTX_get0_newPkey(ctx, 0);
STACK_OF(GENERAL_NAME) *default_sans = NULL;
- const X509_NAME *subject = determine_subj(ctx, refcert, bodytype);
+ const X509_NAME *ref_subj =
+ ctx->p10CSR != NULL ? X509_REQ_get_subject_name(ctx->p10CSR) :
+ refcert != NULL ? X509_get_subject_name(refcert) : NULL;
+ const X509_NAME *subject = determine_subj(ctx, ref_subj, for_KUR);
+ const X509_NAME *issuer = ctx->issuer != NULL || refcert == NULL
+ ? (IS_NULL_DN(ctx->issuer) ? NULL : ctx->issuer)
+ : X509_get_issuer_name(refcert);
int crit = ctx->setSubjectAltNameCritical || subject == NULL;
/* RFC5280: subjectAltName MUST be critical if subject is null */
X509_EXTENSIONS *exts = NULL;
+ if (rkey == NULL && ctx->p10CSR != NULL)
+ rkey = X509_REQ_get0_pubkey(ctx->p10CSR);
if (rkey == NULL)
rkey = ctx->pkey; /* default is independent of ctx->oldCert */
if (rkey == NULL) {
#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
- CMPerr(0, CMP_R_NULL_ARGUMENT);
+ ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
return NULL;
#endif
}
- if (bodytype == OSSL_CMP_PKIBODY_KUR && refcert == NULL) {
- CMPerr(0, CMP_R_MISSING_REFERENCE_CERT);
+ if (for_KUR && refcert == NULL && ctx->p10CSR == NULL) {
+ ERR_raise(ERR_LIB_CMP, CMP_R_MISSING_REFERENCE_CERT);
return NULL;
}
if ((crm = OSSL_CRMF_MSG_new()) == NULL)
* it could be NULL if centralized key creation was supported
*/
|| !OSSL_CRMF_CERTTEMPLATE_fill(OSSL_CRMF_MSG_get0_tmpl(crm), rkey,
- subject, ctx->issuer,
- NULL /* serial */))
+ subject, issuer, NULL /* serial */))
goto err;
if (ctx->days != 0) {
- time_t notBefore, notAfter;
-
- notBefore = time(NULL);
- notAfter = notBefore + 60 * 60 * 24 * ctx->days;
- if (!OSSL_CRMF_MSG_set_validity(crm, notBefore, notAfter))
+ time_t now = time(NULL);
+ ASN1_TIME *notBefore = ASN1_TIME_adj(NULL, now, 0, 0);
+ ASN1_TIME *notAfter = ASN1_TIME_adj(NULL, now, ctx->days, 0);
+
+ if (notBefore == NULL
+ || notAfter == NULL
+ || !OSSL_CRMF_MSG_set0_validity(crm, notBefore, notAfter)) {
+ ASN1_TIME_free(notBefore);
+ ASN1_TIME_free(notAfter);
goto err;
+ }
}
/* extensions */
if (refcert != NULL && !ctx->SubjectAltName_nodefault)
default_sans = X509V3_get_d2i(X509_get0_extensions(refcert),
NID_subject_alt_name, NULL, NULL);
- /* exts are copied from ctx to allow reuse */
- if (ctx->reqExtensions != NULL) {
- exts = sk_X509_EXTENSION_deep_copy(ctx->reqExtensions,
- X509_EXTENSION_dup,
- X509_EXTENSION_free);
- if (exts == NULL)
- goto err;
- }
+ if (ctx->p10CSR != NULL
+ && (exts = X509_REQ_get_extensions(ctx->p10CSR)) == NULL)
+ goto err;
+ if (ctx->reqExtensions != NULL /* augment/override existing ones */
+ && !add_extensions(&exts, ctx->reqExtensions))
+ goto err;
if (sk_GENERAL_NAME_num(ctx->subjectAltNames) > 0
&& !add1_extension(&exts, NID_subject_alt_name,
crit, ctx->subjectAltNames))
/* end fill certTemplate, now set any controls */
/* for KUR, set OldCertId according to D.6 */
- if (bodytype == OSSL_CMP_PKIBODY_KUR) {
+ if (for_KUR && refcert != NULL) {
OSSL_CRMF_CERTID *cid =
OSSL_CRMF_CERTID_gen(X509_get_issuer_name(refcert),
- X509_get_serialNumber(refcert));
+ X509_get0_serialNumber(refcert));
int ret;
if (cid == NULL)
return crm;
}
-OSSL_CMP_MSG *ossl_cmp_certReq_new(OSSL_CMP_CTX *ctx, int type, int err_code)
+OSSL_CMP_MSG *ossl_cmp_certreq_new(OSSL_CMP_CTX *ctx, int type,
+ const OSSL_CRMF_MSG *crm)
{
OSSL_CMP_MSG *msg;
- OSSL_CRMF_MSG *crm = NULL;
+ OSSL_CRMF_MSG *local_crm = NULL;
if (!ossl_assert(ctx != NULL))
return NULL;
if (type != OSSL_CMP_PKIBODY_IR && type != OSSL_CMP_PKIBODY_CR
&& type != OSSL_CMP_PKIBODY_KUR && type != OSSL_CMP_PKIBODY_P10CR) {
- CMPerr(0, CMP_R_INVALID_ARGS);
+ ERR_raise(ERR_LIB_CMP, CMP_R_INVALID_ARGS);
+ return NULL;
+ }
+ if (type == OSSL_CMP_PKIBODY_P10CR && crm != NULL) {
+ ERR_raise(ERR_LIB_CMP, CMP_R_INVALID_ARGS);
return NULL;
}
if (type != OSSL_CMP_PKIBODY_P10CR) {
EVP_PKEY *privkey = OSSL_CMP_CTX_get0_newPkey(ctx, 1);
- if (privkey == NULL)
+ /*
+ * privkey is NULL in case ctx->newPkey does not include a private key.
+ * We then may try to use ctx->pkey as fallback/default, but only
+ * if ctx-> newPkey does not include a (non-matching) public key:
+ */
+ if (privkey == NULL && OSSL_CMP_CTX_get0_newPkey(ctx, 0) == NULL)
privkey = ctx->pkey; /* default is independent of ctx->oldCert */
if (ctx->popoMethod == OSSL_CRMF_POPO_SIGNATURE && privkey == NULL) {
- CMPerr(0, CMP_R_MISSING_PRIVATE_KEY);
+ ERR_raise(ERR_LIB_CMP, CMP_R_MISSING_PRIVATE_KEY);
goto err;
}
- if ((crm = crm_new(ctx, type, OSSL_CMP_CERTREQID)) == NULL
- || !OSSL_CRMF_MSG_create_popo(crm, privkey, ctx->digest,
- ctx->popoMethod)
- /* value.ir is same for cr and kur */
- || !sk_OSSL_CRMF_MSG_push(msg->body->value.ir, crm))
+ if (crm == NULL) {
+ local_crm = OSSL_CMP_CTX_setup_CRM(ctx,
+ type == OSSL_CMP_PKIBODY_KUR,
+ OSSL_CMP_CERTREQID);
+ if (local_crm == NULL
+ || !OSSL_CRMF_MSG_create_popo(ctx->popoMethod, local_crm,
+ privkey, ctx->digest,
+ ctx->libctx, ctx->propq))
+ goto err;
+ } else {
+ if ((local_crm = OSSL_CRMF_MSG_dup(crm)) == NULL)
+ goto err;
+ }
+
+ /* value.ir is same for cr and kur */
+ if (!sk_OSSL_CRMF_MSG_push(msg->body->value.ir, local_crm))
goto err;
- crm = NULL;
- /* TODO: here optional 2nd certreqmsg could be pushed to the stack */
+ local_crm = NULL;
}
if (!ossl_cmp_msg_protect(ctx, msg))
return msg;
err:
- if (err_code != 0)
- CMPerr(0, err_code);
- OSSL_CRMF_MSG_free(crm);
+ ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_CERTREQ);
+ OSSL_CRMF_MSG_free(local_crm);
OSSL_CMP_MSG_free(msg);
return NULL;
}
-OSSL_CMP_MSG *ossl_cmp_certRep_new(OSSL_CMP_CTX *ctx, int bodytype,
- int certReqId, OSSL_CMP_PKISI *si,
- X509 *cert, STACK_OF(X509) *chain,
- STACK_OF(X509) *caPubs, int encrypted,
+OSSL_CMP_MSG *ossl_cmp_certrep_new(OSSL_CMP_CTX *ctx, int bodytype,
+ int certReqId, const OSSL_CMP_PKISI *si,
+ X509 *cert, const X509 *encryption_recip,
+ STACK_OF(X509) *chain, STACK_OF(X509) *caPubs,
int unprotectedErrors)
{
OSSL_CMP_MSG *msg = NULL;
status = ossl_cmp_pkisi_get_status(resp->status);
if (status != OSSL_CMP_PKISTATUS_rejection
&& status != OSSL_CMP_PKISTATUS_waiting && cert != NULL) {
- if (encrypted) {
- CMPerr(0, CMP_R_INVALID_ARGS);
+ if (encryption_recip != NULL) {
+ ERR_raise(ERR_LIB_CMP, ERR_R_UNSUPPORTED);
goto err;
}
if (!sk_OSSL_CMP_CERTRESPONSE_push(repMsg->response, resp))
goto err;
resp = NULL;
- /* TODO: here optional 2nd certrep could be pushed to the stack */
if (bodytype == OSSL_CMP_PKIBODY_IP && caPubs != NULL
&& (repMsg->caPubs = X509_chain_up_ref(caPubs)) == NULL)
goto err;
- if (sk_X509_num(chain) > 0) {
- msg->extraCerts = sk_X509_new_reserve(NULL, sk_X509_num(chain));
- if (msg->extraCerts == NULL
- || !ossl_cmp_sk_X509_add1_certs(msg->extraCerts, chain, 0, 1, 0))
+ if (sk_X509_num(chain) > 0
+ && !ossl_x509_add_certs_new(&msg->extraCerts, chain,
+ X509_ADD_FLAG_UP_REF | X509_ADD_FLAG_NO_DUP))
goto err;
- }
if (!unprotectedErrors
|| ossl_cmp_pkisi_get_status(si) != OSSL_CMP_PKISTATUS_rejection)
return msg;
err:
- CMPerr(0, CMP_R_ERROR_CREATING_CERTREP);
+ ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_CERTREP);
OSSL_CMP_CERTRESPONSE_free(resp);
OSSL_CMP_MSG_free(msg);
return NULL;
{
OSSL_CMP_MSG *msg = NULL;
OSSL_CMP_REVDETAILS *rd;
+ int ret;
- if (!ossl_assert(ctx != NULL && ctx->oldCert != NULL))
+ if (!ossl_assert(ctx != NULL && (ctx->oldCert != NULL
+ || ctx->p10CSR != NULL)))
return NULL;
if ((rd = OSSL_CMP_REVDETAILS_new()) == NULL)
goto err;
/* Fill the template from the contents of the certificate to be revoked */
- if (!OSSL_CRMF_CERTTEMPLATE_fill(rd->certDetails,
- NULL /* pubkey would be redundant */,
- NULL /* subject would be redundant */,
- X509_get_issuer_name(ctx->oldCert),
- X509_get_serialNumber(ctx->oldCert)))
+ ret = ctx->oldCert != NULL
+ ? OSSL_CRMF_CERTTEMPLATE_fill(rd->certDetails,
+ NULL /* pubkey would be redundant */,
+ NULL /* subject would be redundant */,
+ X509_get_issuer_name(ctx->oldCert),
+ X509_get0_serialNumber(ctx->oldCert))
+ : OSSL_CRMF_CERTTEMPLATE_fill(rd->certDetails,
+ X509_REQ_get0_pubkey(ctx->p10CSR),
+ X509_REQ_get_subject_name(ctx->p10CSR),
+ NULL, NULL);
+ if (!ret)
goto err;
/* revocation reason code is optional */
goto err;
rd = NULL;
- /*
- * TODO: the Revocation Passphrase according to section 5.3.19.9 could be
- * set here if set in ctx
- */
-
if (!ossl_cmp_msg_protect(ctx, msg))
goto err;
return msg;
err:
- CMPerr(0, CMP_R_ERROR_CREATING_RR);
+ ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_RR);
OSSL_CMP_MSG_free(msg);
OSSL_CMP_REVDETAILS_free(rd);
return NULL;
}
-OSSL_CMP_MSG *ossl_cmp_rp_new(OSSL_CMP_CTX *ctx, OSSL_CMP_PKISI *si,
- OSSL_CRMF_CERTID *cid, int unprot_err)
+OSSL_CMP_MSG *ossl_cmp_rp_new(OSSL_CMP_CTX *ctx, const OSSL_CMP_PKISI *si,
+ const OSSL_CRMF_CERTID *cid, int unprotectedErrors)
{
OSSL_CMP_REVREPCONTENT *rep = NULL;
OSSL_CMP_PKISI *si1 = NULL;
OSSL_CRMF_CERTID *cid_copy = NULL;
OSSL_CMP_MSG *msg = NULL;
- if (!ossl_assert(ctx != NULL && si != NULL && cid != NULL))
+ if (!ossl_assert(ctx != NULL && si != NULL))
return NULL;
if ((msg = ossl_cmp_msg_create(ctx, OSSL_CMP_PKIBODY_RP)) == NULL)
if ((rep->revCerts = sk_OSSL_CRMF_CERTID_new_null()) == NULL)
goto err;
- if ((cid_copy = OSSL_CRMF_CERTID_dup(cid)) == NULL)
- goto err;
- if (!sk_OSSL_CRMF_CERTID_push(rep->revCerts, cid_copy)) {
- OSSL_CRMF_CERTID_free(cid_copy);
- goto err;
+ if (cid != NULL) {
+ if ((cid_copy = OSSL_CRMF_CERTID_dup(cid)) == NULL)
+ goto err;
+ if (!sk_OSSL_CRMF_CERTID_push(rep->revCerts, cid_copy)) {
+ OSSL_CRMF_CERTID_free(cid_copy);
+ goto err;
+ }
}
- if (!unprot_err
+ if (!unprotectedErrors
|| ossl_cmp_pkisi_get_status(si) != OSSL_CMP_PKISTATUS_rejection)
if (!ossl_cmp_msg_protect(ctx, msg))
goto err;
return msg;
err:
- CMPerr(0, CMP_R_ERROR_CREATING_RP);
+ ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_RP);
OSSL_CMP_MSG_free(msg);
return NULL;
}
return msg;
err:
- CMPerr(0, CMP_R_ERROR_CREATING_PKICONF);
+ ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_PKICONF);
OSSL_CMP_MSG_free(msg);
return NULL;
}
if (!ossl_assert(msg != NULL && itav != NULL))
return 0;
- bodytype = ossl_cmp_msg_get_bodytype(msg);
+ bodytype = OSSL_CMP_MSG_get_bodytype(msg);
if (bodytype != OSSL_CMP_PKIBODY_GENM
&& bodytype != OSSL_CMP_PKIBODY_GENP) {
- CMPerr(0, CMP_R_INVALID_ARGS);
+ ERR_raise(ERR_LIB_CMP, CMP_R_INVALID_ARGS);
return 0;
}
return msg;
err:
- CMPerr(0, err_code);
+ ERR_raise(ERR_LIB_CMP, err_code);
OSSL_CMP_MSG_free(msg);
return NULL;
}
OSSL_CMP_PKIBODY_GENP, CMP_R_ERROR_CREATING_GENP);
}
-OSSL_CMP_MSG *ossl_cmp_error_new(OSSL_CMP_CTX *ctx, OSSL_CMP_PKISI *si,
- int errorCode,
- const char *details, int unprotected)
+OSSL_CMP_MSG *ossl_cmp_error_new(OSSL_CMP_CTX *ctx, const OSSL_CMP_PKISI *si,
+ int64_t errorCode, const char *details,
+ int unprotected)
{
OSSL_CMP_MSG *msg = NULL;
+ const char *lib = NULL, *reason = NULL;
OSSL_CMP_PKIFREETEXT *ft;
if (!ossl_assert(ctx != NULL && si != NULL))
if ((msg->body->value.error->pKIStatusInfo = OSSL_CMP_PKISI_dup(si))
== NULL)
goto err;
- if (errorCode >= 0) {
- if ((msg->body->value.error->errorCode = ASN1_INTEGER_new()) == NULL)
- goto err;
- if (!ASN1_INTEGER_set(msg->body->value.error->errorCode, errorCode))
- goto err;
+ if ((msg->body->value.error->errorCode = ASN1_INTEGER_new()) == NULL)
+ goto err;
+ if (!ASN1_INTEGER_set_int64(msg->body->value.error->errorCode, errorCode))
+ goto err;
+ if (errorCode > 0
+ && (uint64_t)errorCode < ((uint64_t)ERR_SYSTEM_FLAG << 1)) {
+ lib = ERR_lib_error_string((unsigned long)errorCode);
+ reason = ERR_reason_error_string((unsigned long)errorCode);
}
- if (details != NULL) {
+ if (lib != NULL || reason != NULL || details != NULL) {
if ((ft = sk_ASN1_UTF8STRING_new_null()) == NULL)
goto err;
msg->body->value.error->errorDetails = ft;
- if (!ossl_cmp_sk_ASN1_UTF8STRING_push_str(ft, details))
+ if (lib != NULL && *lib != '\0'
+ && !ossl_cmp_sk_ASN1_UTF8STRING_push_str(ft, lib))
+ goto err;
+ if (reason != NULL && *reason != '\0'
+ && !ossl_cmp_sk_ASN1_UTF8STRING_push_str(ft, reason))
+ goto err;
+ if (details != NULL
+ && !ossl_cmp_sk_ASN1_UTF8STRING_push_str(ft, details))
goto err;
}
return msg;
err:
- CMPerr(0, CMP_R_ERROR_CREATING_ERROR);
+ ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_ERROR);
OSSL_CMP_MSG_free(msg);
return NULL;
}
return 1;
}
-/*
- * TODO: handle potential 2nd certificate when signing and encrypting
- * certificates have been requested/received
- */
OSSL_CMP_MSG *ossl_cmp_certConf_new(OSSL_CMP_CTX *ctx, int fail_info,
const char *text)
{
return NULL;
if ((unsigned)fail_info > OSSL_CMP_PKIFAILUREINFO_MAX_BIT_PATTERN) {
- CMPerr(0, CMP_R_FAIL_INFO_OUT_OF_RANGE);
+ ERR_raise(ERR_LIB_CMP, CMP_R_FAIL_INFO_OUT_OF_RANGE);
return NULL;
}
if (!ASN1_INTEGER_set(certStatus->certReqId, OSSL_CMP_CERTREQID))
goto err;
/*
- * the hash of the certificate, using the same hash algorithm
- * as is used to create and verify the certificate signature
+ * The hash of the certificate, using the same hash algorithm
+ * as is used to create and verify the certificate signature.
+ * If not available, a default hash algorithm is used.
*/
- if ((certHash = X509_digest_sig(ctx->newCert)) == NULL)
+ if ((certHash = X509_digest_sig(ctx->newCert, NULL, NULL)) == NULL)
goto err;
if (!ossl_cmp_certstatus_set0_certHash(certStatus, certHash))
return msg;
err:
- CMPerr(0, CMP_R_ERROR_CREATING_CERTCONF);
+ ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_CERTCONF);
OSSL_CMP_MSG_free(msg);
ASN1_OCTET_STRING_free(certHash);
return NULL;
if ((msg = ossl_cmp_msg_create(ctx, OSSL_CMP_PKIBODY_POLLREQ)) == NULL)
goto err;
- /* TODO: support multiple cert request IDs to poll */
if ((preq = OSSL_CMP_POLLREQ_new()) == NULL
|| !ASN1_INTEGER_set(preq->certReqId, crid)
|| !sk_OSSL_CMP_POLLREQ_push(msg->body->value.pollReq, preq))
return msg;
err:
- CMPerr(0, CMP_R_ERROR_CREATING_POLLREQ);
+ ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_POLLREQ);
OSSL_CMP_POLLREQ_free(preq);
OSSL_CMP_MSG_free(msg);
return NULL;
return msg;
err:
- CMPerr(0, CMP_R_ERROR_CREATING_POLLREP);
+ ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_POLLREP);
OSSL_CMP_MSG_free(msg);
return NULL;
}
if ((status = sk_OSSL_CMP_PKISI_value(rrep->status, rsid)) != NULL)
return status;
- CMPerr(0, CMP_R_PKISTATUSINFO_NOT_FOUND);
+ ERR_raise(ERR_LIB_CMP, CMP_R_PKISTATUSINFO_NOT_FOUND);
return NULL;
}
if ((cid = sk_OSSL_CRMF_CERTID_value(rrep->revCerts, rsid)) != NULL)
return cid;
- CMPerr(0, CMP_R_CERTID_NOT_FOUND);
+ ERR_raise(ERR_LIB_CMP, CMP_R_CERTID_NOT_FOUND);
return NULL;
}
trid = ossl_cmp_asn1_get_int(certReqId);
if (trid == -1) {
- CMPerr(0, CMP_R_BAD_REQUEST_ID);
+ ERR_raise(ERR_LIB_CMP, CMP_R_BAD_REQUEST_ID);
return 0;
}
return rid == trid;
}
-static void add_expected_rid(int rid)
-{
- char str[DECIMAL_SIZE(rid) + 1];
-
- BIO_snprintf(str, sizeof(str), "%d", rid);
- ERR_add_error_data(2, "expected certReqId = ", str);
-}
-
/*
* returns a pointer to the PollResponse with the given CertReqId
* (or the first one in case -1) inside a PollRepContent
return pollRep;
}
- CMPerr(0, CMP_R_CERTRESPONSE_NOT_FOUND);
- add_expected_rid(rid);
+ ERR_raise_data(ERR_LIB_CMP, CMP_R_CERTRESPONSE_NOT_FOUND,
+ "expected certReqId = %d", rid);
return NULL;
}
return crep;
}
- CMPerr(0, CMP_R_CERTRESPONSE_NOT_FOUND);
- add_expected_rid(rid);
+ ERR_raise_data(ERR_LIB_CMP, CMP_R_CERTRESPONSE_NOT_FOUND,
+ "expected certReqId = %d", rid);
return NULL;
}
-/*
- * CMP_CERTRESPONSE_get1_certificate() attempts to retrieve the returned
- * certificate from the given certResponse B<crep>.
- * Uses the privkey in case of indirect POP from B<ctx>.
+/*-
+ * Retrieve the newly enrolled certificate from the given certResponse crep.
+ * In case of indirect POPO uses the libctx and propq from ctx and private key.
* Returns a pointer to a copy of the found certificate, or NULL if not found.
*/
-X509 *ossl_cmp_certresponse_get1_certificate(EVP_PKEY *privkey,
- const OSSL_CMP_CERTRESPONSE *crep)
+X509 *ossl_cmp_certresponse_get1_cert(const OSSL_CMP_CERTRESPONSE *crep,
+ const OSSL_CMP_CTX *ctx, EVP_PKEY *pkey)
{
OSSL_CMP_CERTORENCCERT *coec;
X509 *crt = NULL;
- if (!ossl_assert(crep != NULL))
+ if (!ossl_assert(crep != NULL && ctx != NULL))
return NULL;
if (crep->certifiedKeyPair
break;
case OSSL_CMP_CERTORENCCERT_ENCRYPTEDCERT:
/* cert encrypted for indirect PoP; RFC 4210, 5.2.8.2 */
- if (privkey == NULL) {
- CMPerr(0, CMP_R_MISSING_PRIVATE_KEY);
+ if (pkey == NULL) {
+ ERR_raise(ERR_LIB_CMP, CMP_R_MISSING_PRIVATE_KEY);
return NULL;
}
crt =
OSSL_CRMF_ENCRYPTEDVALUE_get1_encCert(coec->value.encryptedCert,
- privkey);
+ ctx->libctx, ctx->propq,
+ pkey);
break;
default:
- CMPerr(0, CMP_R_UNKNOWN_CERT_TYPE);
+ ERR_raise(ERR_LIB_CMP, CMP_R_UNKNOWN_CERT_TYPE);
return NULL;
}
}
if (crt == NULL)
- CMPerr(0, CMP_R_CERTIFICATE_NOT_FOUND);
+ ERR_raise(ERR_LIB_CMP, CMP_R_CERTIFICATE_NOT_FOUND);
+ else
+ (void)ossl_x509_set0_libctx(crt, ctx->libctx, ctx->propq);
return crt;
}
int OSSL_CMP_MSG_update_transactionID(OSSL_CMP_CTX *ctx, OSSL_CMP_MSG *msg)
{
if (ctx == NULL || msg == NULL) {
- CMPerr(0, CMP_R_NULL_ARGUMENT);
+ ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
return 0;
}
if (!ossl_cmp_hdr_set_transactionID(ctx, msg->header))
|| ossl_cmp_msg_protect(ctx, msg);
}
-OSSL_CMP_MSG *ossl_cmp_msg_load(const char *file)
+OSSL_CMP_MSG *OSSL_CMP_MSG_read(const char *file, OSSL_LIB_CTX *libctx,
+ const char *propq)
{
- OSSL_CMP_MSG *msg = NULL;
+ OSSL_CMP_MSG *msg;
BIO *bio = NULL;
- if (!ossl_assert(file != NULL))
+ if (file == NULL) {
+ ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
return NULL;
+ }
+
+ msg = OSSL_CMP_MSG_new(libctx, propq);
+ if (msg == NULL){
+ ERR_raise(ERR_LIB_CMP, ERR_R_MALLOC_FAILURE);
+ return NULL;
+ }
if ((bio = BIO_new_file(file, "rb")) == NULL)
return NULL;
- msg = d2i_OSSL_CMP_MSG_bio(bio, NULL);
+ if (d2i_OSSL_CMP_MSG_bio(bio, &msg) == NULL) {
+ OSSL_CMP_MSG_free(msg);
+ msg = NULL;
+ }
BIO_free(bio);
return msg;
}
+int OSSL_CMP_MSG_write(const char *file, const OSSL_CMP_MSG *msg)
+{
+ BIO *bio;
+ int res;
+
+ if (file == NULL || msg == NULL) {
+ ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
+ return -1;
+ }
+
+ bio = BIO_new_file(file, "wb");
+ if (bio == NULL)
+ return -2;
+ res = i2d_OSSL_CMP_MSG_bio(bio, msg);
+ BIO_free(bio);
+ return res;
+}
+
+OSSL_CMP_MSG *d2i_OSSL_CMP_MSG(OSSL_CMP_MSG **msg, const unsigned char **in,
+ long len)
+{
+ OSSL_LIB_CTX *libctx = NULL;
+ const char *propq = NULL;
+
+ if (msg != NULL && *msg != NULL) {
+ libctx = (*msg)->libctx;
+ propq = (*msg)->propq;
+ }
+
+ return (OSSL_CMP_MSG *)ASN1_item_d2i_ex((ASN1_VALUE **)msg, in, len,
+ ASN1_ITEM_rptr(OSSL_CMP_MSG),
+ libctx, propq);
+}
+
+int i2d_OSSL_CMP_MSG(const OSSL_CMP_MSG *msg, unsigned char **out)
+{
+ return ASN1_item_i2d((const ASN1_VALUE *)msg, out,
+ ASN1_ITEM_rptr(OSSL_CMP_MSG));
+}
+
OSSL_CMP_MSG *d2i_OSSL_CMP_MSG_bio(BIO *bio, OSSL_CMP_MSG **msg)
{
- return ASN1_d2i_bio_of(OSSL_CMP_MSG, OSSL_CMP_MSG_new,
- d2i_OSSL_CMP_MSG, bio, msg);
+ OSSL_LIB_CTX *libctx = NULL;
+ const char *propq = NULL;
+
+ if (msg != NULL && *msg != NULL) {
+ libctx = (*msg)->libctx;
+ propq = (*msg)->propq;
+ }
+
+ return ASN1_item_d2i_bio_ex(ASN1_ITEM_rptr(OSSL_CMP_MSG), bio, msg, libctx,
+ propq);
}
int i2d_OSSL_CMP_MSG_bio(BIO *bio, const OSSL_CMP_MSG *msg)
projects / thirdparty / openssl.git / blobdiff