]>
Commit | Line | Data |
---|---|---|
7960dbec DDO |
1 | /* |
2 | * Copyright 2007-2019 The OpenSSL Project Authors. All Rights Reserved. | |
3 | * Copyright Nokia 2007-2019 | |
4 | * Copyright Siemens AG 2015-2019 | |
5 | * | |
6 | * Licensed under the Apache License 2.0 (the "License"). You may not use | |
7 | * this file except in compliance with the License. You can obtain a copy | |
8 | * in the file LICENSE in the source distribution or at | |
9 | * https://www.openssl.org/source/license.html | |
10 | */ | |
11 | ||
12 | #include <openssl/trace.h> | |
13 | #include <openssl/bio.h> | |
14 | #include <openssl/ocsp.h> /* for OCSP_REVOKED_STATUS_* */ | |
15 | ||
706457b7 | 16 | #include "cmp_local.h" |
7960dbec DDO |
17 | |
18 | /* explicit #includes not strictly needed since implied by the above: */ | |
19 | #include <openssl/cmp.h> | |
20 | #include <openssl/crmf.h> | |
21 | #include <openssl/err.h> | |
22 | ||
23 | /* | |
24 | * Get current certificate store containing trusted root CA certs | |
25 | */ | |
26 | X509_STORE *OSSL_CMP_CTX_get0_trustedStore(const OSSL_CMP_CTX *ctx) | |
27 | { | |
28 | if (ctx == NULL) { | |
29 | CMPerr(0, CMP_R_NULL_ARGUMENT); | |
30 | return NULL; | |
31 | } | |
32 | return ctx->trusted; | |
33 | } | |
34 | ||
35 | /* | |
36 | * Set certificate store containing trusted (root) CA certs and possibly CRLs | |
37 | * and a cert verification callback function used for CMP server authentication. | |
38 | * Any already existing store entry is freed. Given NULL, the entry is reset. | |
39 | * returns 1 on success, 0 on error | |
40 | */ | |
41 | int OSSL_CMP_CTX_set0_trustedStore(OSSL_CMP_CTX *ctx, X509_STORE *store) | |
42 | { | |
43 | if (ctx == NULL) { | |
44 | CMPerr(0, CMP_R_NULL_ARGUMENT); | |
45 | return 0; | |
46 | } | |
47 | X509_STORE_free(ctx->trusted); | |
48 | ctx->trusted = store; | |
49 | return 1; | |
50 | } | |
51 | ||
52 | /* | |
53 | * Get current list of non-trusted intermediate certs | |
54 | */ | |
55 | STACK_OF(X509) *OSSL_CMP_CTX_get0_untrusted_certs(const OSSL_CMP_CTX *ctx) | |
56 | { | |
57 | if (ctx == NULL) { | |
58 | CMPerr(0, CMP_R_NULL_ARGUMENT); | |
59 | return NULL; | |
60 | } | |
61 | return ctx->untrusted_certs; | |
62 | } | |
63 | ||
64 | /* | |
65 | * Set untrusted certificates for path construction in authentication of | |
66 | * the CMP server and potentially others (TLS server, newly enrolled cert). | |
67 | * returns 1 on success, 0 on error | |
68 | */ | |
69 | int OSSL_CMP_CTX_set1_untrusted_certs(OSSL_CMP_CTX *ctx, STACK_OF(X509) *certs) | |
70 | { | |
59ae04d7 | 71 | STACK_OF(X509) *untrusted_certs; |
7960dbec DDO |
72 | if (ctx == NULL) { |
73 | CMPerr(0, CMP_R_NULL_ARGUMENT); | |
74 | return 0; | |
75 | } | |
59ae04d7 | 76 | if ((untrusted_certs = sk_X509_new_null()) == NULL) |
7960dbec | 77 | return 0; |
59ae04d7 | 78 | if (ossl_cmp_sk_X509_add1_certs(untrusted_certs, certs, 0, 1, 0) != 1) |
79 | goto err; | |
80 | sk_X509_pop_free(ctx->untrusted_certs, X509_free); | |
81 | ctx->untrusted_certs = untrusted_certs; | |
82 | return 1; | |
83 | err: | |
84 | sk_X509_pop_free(untrusted_certs, X509_free); | |
85 | return 0; | |
7960dbec DDO |
86 | } |
87 | ||
88 | /* | |
89 | * Allocates and initializes OSSL_CMP_CTX context structure with default values. | |
90 | * Returns new context on success, NULL on error | |
91 | */ | |
92 | OSSL_CMP_CTX *OSSL_CMP_CTX_new(void) | |
93 | { | |
94 | OSSL_CMP_CTX *ctx = OPENSSL_zalloc(sizeof(*ctx)); | |
95 | ||
96 | if (ctx == NULL) | |
97 | return NULL; | |
98 | ||
99 | ctx->log_verbosity = OSSL_CMP_LOG_INFO; | |
100 | ||
101 | ctx->status = -1; | |
102 | ctx->failInfoCode = -1; | |
103 | ||
104 | ctx->serverPort = OSSL_CMP_DEFAULT_PORT; | |
105 | ctx->proxyPort = OSSL_CMP_DEFAULT_PORT; | |
106 | ctx->msgtimeout = 2 * 60; | |
107 | ||
108 | if ((ctx->untrusted_certs = sk_X509_new_null()) == NULL) | |
109 | goto err; | |
110 | ||
111 | ctx->pbm_slen = 16; | |
112 | ctx->pbm_owf = NID_sha256; | |
113 | ctx->pbm_itercnt = 500; | |
114 | ctx->pbm_mac = NID_hmac_sha1; | |
115 | ||
116 | ctx->digest = NID_sha256; | |
117 | ctx->popoMethod = OSSL_CRMF_POPO_SIGNATURE; | |
118 | ctx->revocationReason = CRL_REASON_NONE; | |
119 | ||
120 | /* all other elements are initialized to 0 or NULL, respectively */ | |
121 | return ctx; | |
122 | ||
123 | err: | |
124 | OSSL_CMP_CTX_free(ctx); | |
125 | return NULL; | |
126 | } | |
127 | ||
128 | /* | |
129 | * Prepare the OSSL_CMP_CTX for next use, partly re-initializing OSSL_CMP_CTX | |
130 | */ | |
131 | int OSSL_CMP_CTX_reinit(OSSL_CMP_CTX *ctx) | |
132 | { | |
133 | if (ctx == NULL) { | |
134 | CMPerr(0, CMP_R_NULL_ARGUMENT); | |
135 | return 0; | |
136 | } | |
137 | ||
138 | ctx->status = -1; | |
139 | ctx->failInfoCode = -1; | |
140 | ||
141 | return ossl_cmp_ctx_set0_statusString(ctx, NULL) | |
142 | && ossl_cmp_ctx_set0_newCert(ctx, NULL) | |
143 | && ossl_cmp_ctx_set1_caPubs(ctx, NULL) | |
144 | && ossl_cmp_ctx_set1_extraCertsIn(ctx, NULL) | |
145 | && ossl_cmp_ctx_set0_validatedSrvCert(ctx, NULL) | |
146 | && OSSL_CMP_CTX_set1_transactionID(ctx, NULL) | |
147 | && OSSL_CMP_CTX_set1_senderNonce(ctx, NULL) | |
148 | && ossl_cmp_ctx_set1_recipNonce(ctx, NULL); | |
149 | } | |
150 | ||
151 | /* | |
152 | * Frees OSSL_CMP_CTX variables allocated in OSSL_CMP_CTX_new() | |
153 | */ | |
154 | void OSSL_CMP_CTX_free(OSSL_CMP_CTX *ctx) | |
155 | { | |
156 | if (ctx == NULL) | |
157 | return; | |
158 | ||
159 | OPENSSL_free(ctx->serverPath); | |
160 | OPENSSL_free(ctx->serverName); | |
161 | OPENSSL_free(ctx->proxyName); | |
162 | ||
163 | X509_free(ctx->srvCert); | |
164 | X509_free(ctx->validatedSrvCert); | |
165 | X509_NAME_free(ctx->expected_sender); | |
166 | X509_STORE_free(ctx->trusted); | |
167 | sk_X509_pop_free(ctx->untrusted_certs, X509_free); | |
168 | ||
169 | X509_free(ctx->clCert); | |
170 | EVP_PKEY_free(ctx->pkey); | |
171 | ASN1_OCTET_STRING_free(ctx->referenceValue); | |
172 | if (ctx->secretValue != NULL) | |
173 | OPENSSL_cleanse(ctx->secretValue->data, ctx->secretValue->length); | |
174 | ASN1_OCTET_STRING_free(ctx->secretValue); | |
175 | ||
176 | X509_NAME_free(ctx->recipient); | |
177 | ASN1_OCTET_STRING_free(ctx->transactionID); | |
178 | ASN1_OCTET_STRING_free(ctx->senderNonce); | |
179 | ASN1_OCTET_STRING_free(ctx->recipNonce); | |
180 | sk_OSSL_CMP_ITAV_pop_free(ctx->geninfo_ITAVs, OSSL_CMP_ITAV_free); | |
181 | sk_X509_pop_free(ctx->extraCertsOut, X509_free); | |
182 | ||
183 | EVP_PKEY_free(ctx->newPkey); | |
184 | X509_NAME_free(ctx->issuer); | |
185 | X509_NAME_free(ctx->subjectName); | |
186 | sk_GENERAL_NAME_pop_free(ctx->subjectAltNames, GENERAL_NAME_free); | |
187 | sk_X509_EXTENSION_pop_free(ctx->reqExtensions, X509_EXTENSION_free); | |
188 | sk_POLICYINFO_pop_free(ctx->policies, POLICYINFO_free); | |
189 | X509_free(ctx->oldCert); | |
190 | X509_REQ_free(ctx->p10CSR); | |
191 | ||
192 | sk_OSSL_CMP_ITAV_pop_free(ctx->genm_ITAVs, OSSL_CMP_ITAV_free); | |
193 | ||
194 | sk_ASN1_UTF8STRING_pop_free(ctx->statusString, ASN1_UTF8STRING_free); | |
195 | X509_free(ctx->newCert); | |
196 | sk_X509_pop_free(ctx->caPubs, X509_free); | |
197 | sk_X509_pop_free(ctx->extraCertsIn, X509_free); | |
198 | ||
199 | OPENSSL_free(ctx); | |
200 | } | |
201 | ||
202 | int ossl_cmp_ctx_set_status(OSSL_CMP_CTX *ctx, int status) | |
203 | { | |
204 | if (!ossl_assert(ctx != NULL)) | |
4dde554c | 205 | return 0; |
7960dbec DDO |
206 | ctx->status = status; |
207 | return 1; | |
208 | } | |
209 | ||
210 | /* | |
211 | * Returns the PKIStatus from the last CertRepMessage | |
212 | * or Revocation Response or error message, -1 on error | |
213 | */ | |
214 | int OSSL_CMP_CTX_get_status(const OSSL_CMP_CTX *ctx) | |
215 | { | |
216 | if (ctx == NULL) { | |
217 | CMPerr(0, CMP_R_NULL_ARGUMENT); | |
218 | return -1; | |
219 | } | |
220 | return ctx->status; | |
221 | } | |
222 | ||
223 | /* | |
224 | * Returns the statusString from the last CertRepMessage | |
225 | * or Revocation Response or error message, NULL on error | |
226 | */ | |
227 | OSSL_CMP_PKIFREETEXT *OSSL_CMP_CTX_get0_statusString(const OSSL_CMP_CTX *ctx) | |
228 | { | |
229 | if (ctx == NULL) { | |
230 | CMPerr(0, CMP_R_NULL_ARGUMENT); | |
231 | return NULL; | |
232 | } | |
233 | return ctx->statusString; | |
234 | } | |
235 | ||
236 | int ossl_cmp_ctx_set0_statusString(OSSL_CMP_CTX *ctx, | |
237 | OSSL_CMP_PKIFREETEXT *text) | |
238 | { | |
239 | if (!ossl_assert(ctx != NULL)) | |
240 | return 0; | |
241 | sk_ASN1_UTF8STRING_pop_free(ctx->statusString, ASN1_UTF8STRING_free); | |
242 | ctx->statusString = text; | |
243 | return 1; | |
244 | } | |
245 | ||
246 | int ossl_cmp_ctx_set0_validatedSrvCert(OSSL_CMP_CTX *ctx, X509 *cert) | |
247 | { | |
248 | if (!ossl_assert(ctx != NULL)) | |
249 | return 0; | |
250 | X509_free(ctx->validatedSrvCert); | |
251 | ctx->validatedSrvCert = cert; | |
252 | return 1; | |
253 | } | |
254 | ||
255 | /* | |
256 | * Set callback function for checking if the cert is ok or should | |
257 | * it be rejected. | |
258 | * Returns 1 on success, 0 on error | |
259 | */ | |
260 | int OSSL_CMP_CTX_set_certConf_cb(OSSL_CMP_CTX *ctx, OSSL_cmp_certConf_cb_t cb) | |
261 | { | |
262 | if (ctx == NULL) { | |
263 | CMPerr(0, CMP_R_NULL_ARGUMENT); | |
264 | return 0; | |
265 | } | |
266 | ctx->certConf_cb = cb; | |
267 | return 1; | |
268 | } | |
269 | ||
270 | /* | |
271 | * Set argument, respectively a pointer to a structure containing arguments, | |
272 | * optionally to be used by the certConf callback. | |
273 | * Returns 1 on success, 0 on error | |
274 | */ | |
275 | int OSSL_CMP_CTX_set_certConf_cb_arg(OSSL_CMP_CTX *ctx, void *arg) | |
276 | { | |
277 | if (ctx == NULL) { | |
278 | CMPerr(0, CMP_R_NULL_ARGUMENT); | |
279 | return 0; | |
280 | } | |
281 | ctx->certConf_cb_arg = arg; | |
282 | return 1; | |
283 | } | |
284 | ||
285 | /* | |
286 | * Get argument, respectively the pointer to a structure containing arguments, | |
287 | * optionally to be used by certConf callback. | |
288 | * Returns callback argument set previously (NULL if not set or on error) | |
289 | */ | |
290 | void *OSSL_CMP_CTX_get_certConf_cb_arg(const OSSL_CMP_CTX *ctx) | |
291 | { | |
292 | if (ctx == NULL) { | |
293 | CMPerr(0, CMP_R_NULL_ARGUMENT); | |
294 | return NULL; | |
295 | } | |
296 | return ctx->certConf_cb_arg; | |
297 | } | |
298 | ||
299 | #ifndef OPENSSL_NO_TRACE | |
300 | static size_t ossl_cmp_log_trace_cb(const char *buf, size_t cnt, | |
301 | int category, int cmd, void *vdata) | |
302 | { | |
303 | OSSL_CMP_CTX *ctx = vdata; | |
304 | const char *prefix_msg; | |
305 | OSSL_CMP_severity level = -1; | |
306 | char *func = NULL; | |
307 | char *file = NULL; | |
308 | int line = 0; | |
309 | ||
310 | if (buf == NULL || cnt == 0 || cmd != OSSL_TRACE_CTRL_WRITE || ctx == NULL) | |
311 | return 0; | |
312 | if (ctx->log_cb == NULL) | |
313 | return 1; /* silently drop message */ | |
314 | ||
315 | prefix_msg = ossl_cmp_log_parse_metadata(buf, &level, &func, &file, &line); | |
316 | ||
317 | if (level > ctx->log_verbosity) /* excludes the case level is unknown */ | |
318 | goto end; /* suppress output since severity is not sufficient */ | |
319 | ||
320 | if (!ctx->log_cb(func != NULL ? func : "(no func)", | |
321 | file != NULL ? file : "(no file)", | |
322 | line, level, prefix_msg)) | |
323 | cnt = 0; | |
324 | ||
325 | end: | |
326 | OPENSSL_free(func); | |
327 | OPENSSL_free(file); | |
328 | return cnt; | |
329 | } | |
330 | #endif | |
331 | ||
332 | /* | |
333 | * Set a callback function for error reporting and logging messages. | |
334 | * Returns 1 on success, 0 on error | |
335 | */ | |
336 | int OSSL_CMP_CTX_set_log_cb(OSSL_CMP_CTX *ctx, OSSL_cmp_log_cb_t cb) | |
337 | { | |
338 | if (ctx == NULL) { | |
339 | CMPerr(0, CMP_R_NULL_ARGUMENT); | |
340 | return 0; | |
341 | } | |
342 | ctx->log_cb = cb; | |
343 | ||
344 | #ifndef OPENSSL_NO_TRACE | |
345 | /* do also in case cb == NULL, to switch off logging output: */ | |
346 | if (!OSSL_trace_set_callback(OSSL_TRACE_CATEGORY_CMP, | |
347 | ossl_cmp_log_trace_cb, ctx)) | |
348 | return 0; | |
349 | #endif | |
350 | ||
351 | return 1; | |
352 | } | |
353 | ||
354 | /* Print OpenSSL and CMP errors via the log cb of the ctx or ERR_print_errors */ | |
355 | void OSSL_CMP_CTX_print_errors(OSSL_CMP_CTX *ctx) | |
356 | { | |
357 | OSSL_CMP_print_errors_cb(ctx == NULL ? NULL : ctx->log_cb); | |
358 | } | |
359 | ||
360 | /* | |
361 | * Set or clear the reference value to be used for identification | |
362 | * (i.e., the user name) when using PBMAC. | |
363 | * Returns 1 on success, 0 on error | |
364 | */ | |
365 | int OSSL_CMP_CTX_set1_referenceValue(OSSL_CMP_CTX *ctx, | |
366 | const unsigned char *ref, int len) | |
367 | { | |
368 | if (ctx == NULL) { | |
369 | CMPerr(0, CMP_R_NULL_ARGUMENT); | |
370 | return 0; | |
371 | } | |
372 | return ossl_cmp_asn1_octet_string_set1_bytes(&ctx->referenceValue, ref, | |
373 | len); | |
374 | } | |
375 | ||
376 | /* | |
377 | * Set or clear the password to be used for protecting messages with PBMAC. | |
378 | * Returns 1 on success, 0 on error | |
379 | */ | |
380 | int OSSL_CMP_CTX_set1_secretValue(OSSL_CMP_CTX *ctx, const unsigned char *sec, | |
381 | const int len) | |
382 | { | |
59ae04d7 | 383 | ASN1_OCTET_STRING *secretValue = NULL; |
7960dbec DDO |
384 | if (ctx == NULL) { |
385 | CMPerr(0, CMP_R_NULL_ARGUMENT); | |
386 | return 0; | |
387 | } | |
59ae04d7 | 388 | if (ossl_cmp_asn1_octet_string_set1_bytes(&secretValue, sec, len) != 1) |
389 | return 0; | |
390 | if (ctx->secretValue != NULL) { | |
7960dbec | 391 | OPENSSL_cleanse(ctx->secretValue->data, ctx->secretValue->length); |
59ae04d7 | 392 | ASN1_OCTET_STRING_free(ctx->secretValue); |
393 | } | |
394 | ctx->secretValue = secretValue; | |
395 | return 1; | |
7960dbec DDO |
396 | } |
397 | ||
398 | /* | |
399 | * Returns the stack of certificates received in a response message. | |
400 | * The stack is duplicated so the caller must handle freeing it! | |
401 | * Returns pointer to created stack on success, NULL on error | |
402 | */ | |
403 | STACK_OF(X509) *OSSL_CMP_CTX_get1_extraCertsIn(const OSSL_CMP_CTX *ctx) | |
404 | { | |
405 | if (ctx == NULL) { | |
406 | CMPerr(0, CMP_R_NULL_ARGUMENT); | |
407 | return NULL; | |
408 | } | |
409 | if (ctx->extraCertsIn == NULL) | |
410 | return sk_X509_new_null(); | |
411 | return X509_chain_up_ref(ctx->extraCertsIn); | |
412 | } | |
413 | ||
414 | /* | |
415 | * Copies any given stack of inbound X509 certificates to extraCertsIn | |
416 | * of the OSSL_CMP_CTX structure so that they may be retrieved later. | |
417 | * Returns 1 on success, 0 on error. | |
418 | */ | |
419 | int ossl_cmp_ctx_set1_extraCertsIn(OSSL_CMP_CTX *ctx, | |
420 | STACK_OF(X509) *extraCertsIn) | |
421 | { | |
422 | if (!ossl_assert(ctx != NULL)) | |
423 | return 0; | |
424 | ||
425 | sk_X509_pop_free(ctx->extraCertsIn, X509_free); | |
426 | ctx->extraCertsIn = NULL; | |
427 | if (extraCertsIn == NULL) | |
428 | return 1; | |
429 | return (ctx->extraCertsIn = X509_chain_up_ref(extraCertsIn)) != NULL; | |
430 | } | |
431 | ||
432 | /* | |
433 | * Duplicate and set the given stack as the new stack of X509 | |
434 | * certificates to send out in the extraCerts field. | |
435 | * Returns 1 on success, 0 on error | |
436 | */ | |
437 | int OSSL_CMP_CTX_set1_extraCertsOut(OSSL_CMP_CTX *ctx, | |
438 | STACK_OF(X509) *extraCertsOut) | |
439 | { | |
440 | if (ctx == NULL) { | |
441 | CMPerr(0, CMP_R_NULL_ARGUMENT); | |
442 | return 0; | |
443 | } | |
444 | ||
445 | sk_X509_pop_free(ctx->extraCertsOut, X509_free); | |
446 | ctx->extraCertsOut = NULL; | |
447 | if (extraCertsOut == NULL) | |
448 | return 1; | |
449 | return (ctx->extraCertsOut = X509_chain_up_ref(extraCertsOut)) != NULL; | |
450 | } | |
451 | ||
452 | /* | |
453 | * Add the given policy info object | |
454 | * to the X509_EXTENSIONS of the requested certificate template. | |
455 | * Returns 1 on success, 0 on error. | |
456 | */ | |
457 | int OSSL_CMP_CTX_push0_policy(OSSL_CMP_CTX *ctx, POLICYINFO *pinfo) | |
458 | { | |
459 | if (ctx == NULL || pinfo == NULL) { | |
460 | CMPerr(0, CMP_R_NULL_ARGUMENT); | |
461 | return 0; | |
462 | } | |
463 | ||
464 | if (ctx->policies == NULL | |
465 | && (ctx->policies = CERTIFICATEPOLICIES_new()) == NULL) | |
466 | return 0; | |
467 | ||
468 | return sk_POLICYINFO_push(ctx->policies, pinfo); | |
469 | } | |
470 | ||
471 | /* | |
472 | * Add an ITAV for geninfo of the PKI message header | |
473 | */ | |
474 | int OSSL_CMP_CTX_push0_geninfo_ITAV(OSSL_CMP_CTX *ctx, OSSL_CMP_ITAV *itav) | |
475 | { | |
476 | if (ctx == NULL) { | |
477 | CMPerr(0, CMP_R_NULL_ARGUMENT); | |
478 | return 0; | |
479 | } | |
480 | return OSSL_CMP_ITAV_push0_stack_item(&ctx->geninfo_ITAVs, itav); | |
481 | } | |
482 | ||
483 | /* | |
484 | * Add an itav for the body of outgoing general messages | |
485 | */ | |
486 | int OSSL_CMP_CTX_push0_genm_ITAV(OSSL_CMP_CTX *ctx, OSSL_CMP_ITAV *itav) | |
487 | { | |
488 | if (ctx == NULL) { | |
489 | CMPerr(0, CMP_R_NULL_ARGUMENT); | |
490 | return 0; | |
491 | } | |
492 | return OSSL_CMP_ITAV_push0_stack_item(&ctx->genm_ITAVs, itav); | |
493 | } | |
494 | ||
495 | /* | |
496 | * Returns a duplicate of the stack of X509 certificates that | |
497 | * were received in the caPubs field of the last CertRepMessage. | |
498 | * Returns NULL on error | |
499 | */ | |
500 | STACK_OF(X509) *OSSL_CMP_CTX_get1_caPubs(const OSSL_CMP_CTX *ctx) | |
501 | { | |
502 | if (ctx == NULL) { | |
503 | CMPerr(0, CMP_R_NULL_ARGUMENT); | |
504 | return NULL; | |
505 | } | |
506 | if (ctx->caPubs == NULL) | |
507 | return sk_X509_new_null(); | |
508 | return X509_chain_up_ref(ctx->caPubs); | |
509 | } | |
510 | ||
511 | /* | |
512 | * Duplicate and copy the given stack of certificates to the given | |
513 | * OSSL_CMP_CTX structure so that they may be retrieved later. | |
514 | * Returns 1 on success, 0 on error | |
515 | */ | |
516 | int ossl_cmp_ctx_set1_caPubs(OSSL_CMP_CTX *ctx, STACK_OF(X509) *caPubs) | |
517 | { | |
518 | if (!ossl_assert(ctx != NULL)) | |
519 | return 0; | |
520 | ||
521 | sk_X509_pop_free(ctx->caPubs, X509_free); | |
522 | ctx->caPubs = NULL; | |
523 | if (caPubs == NULL) | |
524 | return 1; | |
525 | return (ctx->caPubs = X509_chain_up_ref(caPubs)) != NULL; | |
526 | } | |
527 | ||
528 | #define char_dup OPENSSL_strdup | |
529 | #define char_free OPENSSL_free | |
530 | #define DEFINE_OSSL_CMP_CTX_set1(FIELD, TYPE) /* this uses _dup */ \ | |
531 | int OSSL_CMP_CTX_set1_##FIELD(OSSL_CMP_CTX *ctx, const TYPE *val) \ | |
532 | { \ | |
533 | TYPE *val_dup = NULL; \ | |
534 | \ | |
535 | if (ctx == NULL) { \ | |
536 | CMPerr(0, CMP_R_NULL_ARGUMENT); \ | |
537 | return 0; \ | |
538 | } \ | |
539 | \ | |
540 | if (val != NULL && (val_dup = TYPE##_dup(val)) == NULL) \ | |
541 | return 0; \ | |
542 | TYPE##_free(ctx->FIELD); \ | |
543 | ctx->FIELD = val_dup; \ | |
544 | return 1; \ | |
545 | } | |
546 | ||
547 | #define DEFINE_OSSL_CMP_CTX_set1_up_ref(FIELD, TYPE) \ | |
548 | int OSSL_CMP_CTX_set1_##FIELD(OSSL_CMP_CTX *ctx, TYPE *val) \ | |
549 | { \ | |
550 | if (ctx == NULL) { \ | |
551 | CMPerr(0, CMP_R_NULL_ARGUMENT); \ | |
552 | return 0; \ | |
553 | } \ | |
554 | \ | |
555 | if (val != NULL && !TYPE##_up_ref(val)) \ | |
556 | return 0; \ | |
557 | TYPE##_free(ctx->FIELD); \ | |
558 | ctx->FIELD = val; \ | |
559 | return 1; \ | |
560 | } | |
561 | ||
562 | /* | |
563 | * Pins the server certificate to be directly trusted (even if it is expired) | |
564 | * for verifying response messages. | |
565 | * Cert pointer is not consumed. It may be NULL to clear the entry. | |
566 | * Returns 1 on success, 0 on error | |
567 | */ | |
568 | DEFINE_OSSL_CMP_CTX_set1_up_ref(srvCert, X509) | |
569 | ||
570 | /* | |
571 | * Set the X509 name of the recipient. Set in the PKIHeader. | |
572 | * returns 1 on success, 0 on error | |
573 | */ | |
574 | DEFINE_OSSL_CMP_CTX_set1(recipient, X509_NAME) | |
575 | ||
576 | /* | |
577 | * Store the X509 name of the expected sender in the PKIHeader of responses. | |
578 | * Returns 1 on success, 0 on error | |
579 | */ | |
580 | DEFINE_OSSL_CMP_CTX_set1(expected_sender, X509_NAME) | |
581 | ||
582 | /* | |
583 | * Set the X509 name of the issuer. Set in the PKIHeader. | |
584 | * Returns 1 on success, 0 on error | |
585 | */ | |
586 | DEFINE_OSSL_CMP_CTX_set1(issuer, X509_NAME) | |
587 | ||
588 | /* | |
589 | * Set the subject name that will be placed in the certificate | |
590 | * request. This will be the subject name on the received certificate. | |
591 | * Returns 1 on success, 0 on error | |
592 | */ | |
593 | DEFINE_OSSL_CMP_CTX_set1(subjectName, X509_NAME) | |
594 | ||
595 | /* | |
596 | * Set the X.509v3 certificate request extensions to be used in IR/CR/KUR. | |
597 | * Returns 1 on success, 0 on error | |
598 | */ | |
599 | int OSSL_CMP_CTX_set0_reqExtensions(OSSL_CMP_CTX *ctx, X509_EXTENSIONS *exts) | |
600 | { | |
601 | if (ctx == NULL) { | |
602 | CMPerr(0, CMP_R_NULL_ARGUMENT); | |
603 | return 0; | |
604 | } | |
605 | ||
606 | if (sk_GENERAL_NAME_num(ctx->subjectAltNames) > 0 && exts != NULL | |
607 | && X509v3_get_ext_by_NID(exts, NID_subject_alt_name, -1) >= 0) { | |
608 | CMPerr(0, CMP_R_MULTIPLE_SAN_SOURCES); | |
609 | return 0; | |
610 | } | |
611 | sk_X509_EXTENSION_pop_free(ctx->reqExtensions, X509_EXTENSION_free); | |
612 | ctx->reqExtensions = exts; | |
613 | return 1; | |
614 | } | |
615 | ||
616 | /* returns 1 if ctx contains a Subject Alternative Name extension, else 0 */ | |
617 | int OSSL_CMP_CTX_reqExtensions_have_SAN(OSSL_CMP_CTX *ctx) | |
618 | { | |
619 | if (ctx == NULL) { | |
620 | CMPerr(0, CMP_R_NULL_ARGUMENT); | |
621 | return -1; | |
622 | } | |
623 | /* if one of the following conditions 'fail' this is not an error */ | |
624 | return ctx->reqExtensions != NULL | |
625 | && X509v3_get_ext_by_NID(ctx->reqExtensions, | |
626 | NID_subject_alt_name, -1) >= 0; | |
627 | } | |
628 | ||
629 | /* | |
630 | * Add a GENERAL_NAME structure that will be added to the CRMF | |
631 | * request's extensions field to request subject alternative names. | |
632 | * Returns 1 on success, 0 on error | |
633 | */ | |
634 | int OSSL_CMP_CTX_push1_subjectAltName(OSSL_CMP_CTX *ctx, | |
635 | const GENERAL_NAME *name) | |
636 | { | |
637 | GENERAL_NAME *name_dup; | |
638 | ||
639 | if (ctx == NULL || name == NULL) { | |
640 | CMPerr(0, CMP_R_NULL_ARGUMENT); | |
641 | return 0; | |
642 | } | |
643 | ||
644 | if (OSSL_CMP_CTX_reqExtensions_have_SAN(ctx) == 1) { | |
645 | CMPerr(0, CMP_R_MULTIPLE_SAN_SOURCES); | |
646 | return 0; | |
647 | } | |
648 | ||
649 | if (ctx->subjectAltNames == NULL | |
650 | && (ctx->subjectAltNames = sk_GENERAL_NAME_new_null()) == NULL) | |
651 | return 0; | |
652 | if ((name_dup = GENERAL_NAME_dup(name)) == NULL) | |
653 | return 0; | |
654 | if (!sk_GENERAL_NAME_push(ctx->subjectAltNames, name_dup)) { | |
655 | GENERAL_NAME_free(name_dup); | |
656 | return 0; | |
657 | } | |
658 | return 1; | |
659 | } | |
660 | ||
661 | /* | |
662 | * Set our own client certificate, used for example in KUR and when | |
663 | * doing the IR with existing certificate. | |
664 | * Returns 1 on success, 0 on error | |
665 | */ | |
666 | DEFINE_OSSL_CMP_CTX_set1_up_ref(clCert, X509) | |
667 | ||
668 | /* | |
669 | * Set the old certificate that we are updating in KUR | |
670 | * or the certificate to be revoked in RR, respectively. | |
671 | * Also used as reference cert (defaulting to clCert) for deriving subject DN | |
672 | * and SANs. Its issuer is used as default recipient in the CMP message header. | |
673 | * Returns 1 on success, 0 on error | |
674 | */ | |
675 | DEFINE_OSSL_CMP_CTX_set1_up_ref(oldCert, X509) | |
676 | ||
677 | /* | |
678 | * Set the PKCS#10 CSR to be sent in P10CR. | |
679 | * Returns 1 on success, 0 on error | |
680 | */ | |
681 | DEFINE_OSSL_CMP_CTX_set1(p10CSR, X509_REQ) | |
682 | ||
683 | /* | |
684 | * Sets the (newly received in IP/KUP/CP) certificate in the context. | |
685 | * Returns 1 on success, 0 on error | |
686 | * TODO: this only permits for one cert to be enrolled at a time. | |
687 | */ | |
688 | int ossl_cmp_ctx_set0_newCert(OSSL_CMP_CTX *ctx, X509 *cert) | |
689 | { | |
690 | if (!ossl_assert(ctx != NULL)) | |
691 | return 0; | |
692 | ||
693 | X509_free(ctx->newCert); | |
694 | ctx->newCert = cert; | |
695 | return 1; | |
696 | } | |
697 | ||
698 | /* | |
699 | * Get the (newly received in IP/KUP/CP) client certificate from the context | |
700 | * TODO: this only permits for one client cert to be received... | |
701 | */ | |
702 | X509 *OSSL_CMP_CTX_get0_newCert(const OSSL_CMP_CTX *ctx) | |
703 | { | |
704 | if (ctx == NULL) { | |
705 | CMPerr(0, CMP_R_NULL_ARGUMENT); | |
706 | return NULL; | |
707 | } | |
708 | return ctx->newCert; | |
709 | } | |
710 | ||
711 | /* | |
712 | * Set the client's current private key. | |
713 | * Returns 1 on success, 0 on error | |
714 | */ | |
715 | DEFINE_OSSL_CMP_CTX_set1_up_ref(pkey, EVP_PKEY) | |
716 | ||
717 | /* | |
718 | * Set new key pair. Used e.g. when doing Key Update. | |
719 | * Returns 1 on success, 0 on error | |
720 | */ | |
721 | int OSSL_CMP_CTX_set0_newPkey(OSSL_CMP_CTX *ctx, int priv, EVP_PKEY *pkey) | |
722 | { | |
723 | if (ctx == NULL) { | |
724 | CMPerr(0, CMP_R_NULL_ARGUMENT); | |
725 | return 0; | |
726 | } | |
727 | ||
728 | EVP_PKEY_free(ctx->newPkey); | |
729 | ctx->newPkey = pkey; | |
730 | ctx->newPkey_priv = priv; | |
731 | return 1; | |
732 | } | |
733 | ||
734 | /* | |
735 | * gets the private/public key to use for certificate enrollment, NULL on error | |
736 | */ | |
737 | EVP_PKEY *OSSL_CMP_CTX_get0_newPkey(const OSSL_CMP_CTX *ctx, int priv) | |
738 | { | |
739 | if (ctx == NULL) { | |
740 | CMPerr(0, CMP_R_NULL_ARGUMENT); | |
741 | return NULL; | |
742 | } | |
743 | ||
744 | if (ctx->newPkey != NULL) | |
745 | return priv && !ctx->newPkey_priv ? NULL : ctx->newPkey; | |
746 | if (ctx->p10CSR != NULL) | |
747 | return priv ? NULL : X509_REQ_get0_pubkey(ctx->p10CSR); | |
748 | return ctx->pkey; /* may be NULL */ | |
749 | } | |
750 | ||
751 | /* | |
752 | * Sets the given transactionID to the context. | |
753 | * Returns 1 on success, 0 on error | |
754 | */ | |
755 | int OSSL_CMP_CTX_set1_transactionID(OSSL_CMP_CTX *ctx, | |
756 | const ASN1_OCTET_STRING *id) | |
757 | { | |
758 | if (ctx == NULL) { | |
759 | CMPerr(0, CMP_R_NULL_ARGUMENT); | |
760 | return 0; | |
761 | } | |
762 | return ossl_cmp_asn1_octet_string_set1(&ctx->transactionID, id); | |
763 | } | |
764 | ||
765 | /* | |
766 | * sets the given nonce to be used for the recipNonce in the next message to be | |
767 | * created. | |
768 | * returns 1 on success, 0 on error | |
769 | */ | |
770 | int ossl_cmp_ctx_set1_recipNonce(OSSL_CMP_CTX *ctx, | |
771 | const ASN1_OCTET_STRING *nonce) | |
772 | { | |
773 | if (!ossl_assert(ctx != NULL)) | |
774 | return 0; | |
775 | return ossl_cmp_asn1_octet_string_set1(&ctx->recipNonce, nonce); | |
776 | } | |
777 | ||
778 | /* | |
779 | * Stores the given nonce as the last senderNonce sent out. | |
780 | * Returns 1 on success, 0 on error | |
781 | */ | |
782 | int OSSL_CMP_CTX_set1_senderNonce(OSSL_CMP_CTX *ctx, | |
783 | const ASN1_OCTET_STRING *nonce) | |
784 | { | |
785 | if (ctx == NULL) { | |
786 | CMPerr(0, CMP_R_NULL_ARGUMENT); | |
787 | return 0; | |
788 | } | |
789 | return ossl_cmp_asn1_octet_string_set1(&ctx->senderNonce, nonce); | |
790 | } | |
791 | ||
792 | /* | |
793 | * Set the host name of the (HTTP) proxy server to use for all connections | |
794 | * returns 1 on success, 0 on error | |
795 | */ | |
796 | DEFINE_OSSL_CMP_CTX_set1(proxyName, char) | |
797 | ||
798 | /* | |
799 | * Set the (HTTP) host name of the CA server. | |
800 | * Returns 1 on success, 0 on error | |
801 | */ | |
802 | DEFINE_OSSL_CMP_CTX_set1(serverName, char) | |
803 | ||
804 | /* | |
805 | * Sets the (HTTP) proxy port to be used. | |
806 | * Returns 1 on success, 0 on error | |
807 | */ | |
808 | int OSSL_CMP_CTX_set_proxyPort(OSSL_CMP_CTX *ctx, int port) | |
809 | { | |
810 | if (ctx == NULL) { | |
811 | CMPerr(0, CMP_R_NULL_ARGUMENT); | |
812 | return 0; | |
813 | } | |
814 | ctx->proxyPort = port; | |
815 | return 1; | |
816 | } | |
817 | ||
818 | /* | |
819 | * sets the http connect/disconnect callback function to be used for HTTP(S) | |
820 | * returns 1 on success, 0 on error | |
821 | */ | |
29f178bd | 822 | int OSSL_CMP_CTX_set_http_cb(OSSL_CMP_CTX *ctx, OSSL_HTTP_bio_cb_t cb) |
7960dbec DDO |
823 | { |
824 | if (ctx == NULL) { | |
825 | CMPerr(0, CMP_R_NULL_ARGUMENT); | |
826 | return 0; | |
827 | } | |
828 | ctx->http_cb = cb; | |
829 | return 1; | |
830 | } | |
831 | ||
832 | /* | |
833 | * Set argument optionally to be used by the http connect/disconnect callback. | |
834 | * Returns 1 on success, 0 on error | |
835 | */ | |
836 | int OSSL_CMP_CTX_set_http_cb_arg(OSSL_CMP_CTX *ctx, void *arg) | |
837 | { | |
838 | if (ctx == NULL) { | |
839 | CMPerr(0, CMP_R_NULL_ARGUMENT); | |
840 | return 0; | |
841 | } | |
842 | ctx->http_cb_arg = arg; | |
843 | return 1; | |
844 | } | |
845 | ||
846 | /* | |
847 | * Get argument optionally to be used by the http connect/disconnect callback | |
848 | * Returns callback argument set previously (NULL if not set or on error) | |
849 | */ | |
850 | void *OSSL_CMP_CTX_get_http_cb_arg(const OSSL_CMP_CTX *ctx) | |
851 | { | |
852 | if (ctx == NULL) { | |
853 | CMPerr(0, CMP_R_NULL_ARGUMENT); | |
854 | return NULL; | |
855 | } | |
856 | return ctx->http_cb_arg; | |
857 | } | |
858 | ||
859 | /* | |
860 | * Set callback function for sending CMP request and receiving response. | |
861 | * Returns 1 on success, 0 on error | |
862 | */ | |
863 | int OSSL_CMP_CTX_set_transfer_cb(OSSL_CMP_CTX *ctx, OSSL_cmp_transfer_cb_t cb) | |
864 | { | |
865 | if (ctx == NULL) { | |
866 | CMPerr(0, CMP_R_NULL_ARGUMENT); | |
867 | return 0; | |
868 | } | |
869 | ctx->transfer_cb = cb; | |
870 | return 1; | |
871 | } | |
872 | ||
873 | /* | |
874 | * Set argument optionally to be used by the transfer callback. | |
875 | * Returns 1 on success, 0 on error | |
876 | */ | |
877 | int OSSL_CMP_CTX_set_transfer_cb_arg(OSSL_CMP_CTX *ctx, void *arg) | |
878 | { | |
879 | if (ctx == NULL) { | |
880 | CMPerr(0, CMP_R_NULL_ARGUMENT); | |
881 | return 0; | |
882 | } | |
883 | ctx->transfer_cb_arg = arg; | |
884 | return 1; | |
885 | } | |
886 | ||
887 | /* | |
888 | * Get argument optionally to be used by the transfer callback. | |
889 | * Returns callback argument set previously (NULL if not set or on error) | |
890 | */ | |
891 | void *OSSL_CMP_CTX_get_transfer_cb_arg(const OSSL_CMP_CTX *ctx) | |
892 | { | |
893 | if (ctx == NULL) { | |
894 | CMPerr(0, CMP_R_NULL_ARGUMENT); | |
895 | return NULL; | |
896 | } | |
897 | return ctx->transfer_cb_arg; | |
898 | } | |
899 | ||
900 | /* | |
901 | * Sets the (HTTP) server port to be used. | |
902 | * Returns 1 on success, 0 on error | |
903 | */ | |
904 | int OSSL_CMP_CTX_set_serverPort(OSSL_CMP_CTX *ctx, int port) | |
905 | { | |
906 | if (ctx == NULL) { | |
907 | CMPerr(0, CMP_R_NULL_ARGUMENT); | |
908 | return 0; | |
909 | } | |
910 | ctx->serverPort = port; | |
911 | return 1; | |
912 | } | |
913 | ||
914 | /* | |
915 | * Sets the HTTP path to be used on the server (e.g "pkix/"). | |
916 | * Returns 1 on success, 0 on error | |
917 | */ | |
918 | DEFINE_OSSL_CMP_CTX_set1(serverPath, char) | |
919 | ||
920 | /* | |
921 | * Set the failInfo error code as bit encoding in OSSL_CMP_CTX. | |
922 | * Returns 1 on success, 0 on error | |
923 | */ | |
924 | int ossl_cmp_ctx_set_failInfoCode(OSSL_CMP_CTX *ctx, int fail_info) | |
925 | { | |
926 | if (!ossl_assert(ctx != NULL)) | |
927 | return 0; | |
928 | ctx->failInfoCode = fail_info; | |
929 | return 1; | |
930 | } | |
931 | ||
932 | /* | |
933 | * Get the failInfo error code in OSSL_CMP_CTX as bit encoding. | |
934 | * Returns bit string as integer on success, -1 on error | |
935 | */ | |
936 | int OSSL_CMP_CTX_get_failInfoCode(const OSSL_CMP_CTX *ctx) | |
937 | { | |
938 | if (ctx == NULL) { | |
939 | CMPerr(0, CMP_R_NULL_ARGUMENT); | |
940 | return -1; | |
941 | } | |
942 | return ctx->failInfoCode; | |
943 | } | |
944 | ||
945 | /* | |
946 | * Sets a Boolean or integer option of the context to the "val" arg. | |
947 | * Returns 1 on success, 0 on error | |
948 | */ | |
3dbc5156 DDO |
949 | int OSSL_CMP_CTX_set_option(OSSL_CMP_CTX *ctx, int opt, int val) |
950 | { | |
7960dbec DDO |
951 | int min_val; |
952 | ||
953 | if (ctx == NULL) { | |
954 | CMPerr(0, CMP_R_NULL_ARGUMENT); | |
955 | return 0; | |
956 | } | |
957 | ||
958 | switch (opt) { | |
959 | case OSSL_CMP_OPT_REVOCATION_REASON: | |
960 | min_val = OCSP_REVOKED_STATUS_NOSTATUS; | |
961 | break; | |
962 | case OSSL_CMP_OPT_POPOMETHOD: | |
963 | min_val = OSSL_CRMF_POPO_NONE; | |
964 | break; | |
965 | default: | |
966 | min_val = 0; | |
967 | break; | |
968 | } | |
969 | if (val < min_val) { | |
970 | CMPerr(0, CMP_R_INVALID_ARGS); | |
971 | return 0; | |
972 | } | |
973 | ||
974 | switch (opt) { | |
975 | case OSSL_CMP_OPT_LOG_VERBOSITY: | |
976 | if (val > OSSL_CMP_LOG_DEBUG) { | |
977 | CMPerr(0, CMP_R_INVALID_ARGS); | |
978 | return 0; | |
979 | } | |
980 | ctx->log_verbosity = val; | |
981 | break; | |
982 | case OSSL_CMP_OPT_IMPLICITCONFIRM: | |
983 | ctx->implicitConfirm = val; | |
984 | break; | |
985 | case OSSL_CMP_OPT_DISABLECONFIRM: | |
986 | ctx->disableConfirm = val; | |
987 | break; | |
988 | case OSSL_CMP_OPT_UNPROTECTED_SEND: | |
989 | ctx->unprotectedSend = val; | |
990 | break; | |
991 | case OSSL_CMP_OPT_UNPROTECTED_ERRORS: | |
992 | ctx->unprotectedErrors = val; | |
993 | break; | |
994 | case OSSL_CMP_OPT_VALIDITYDAYS: | |
995 | ctx->days = val; | |
996 | break; | |
997 | case OSSL_CMP_OPT_SUBJECTALTNAME_NODEFAULT: | |
998 | ctx->SubjectAltName_nodefault = val; | |
999 | break; | |
1000 | case OSSL_CMP_OPT_SUBJECTALTNAME_CRITICAL: | |
1001 | ctx->setSubjectAltNameCritical = val; | |
1002 | break; | |
1003 | case OSSL_CMP_OPT_POLICIES_CRITICAL: | |
1004 | ctx->setPoliciesCritical = val; | |
1005 | break; | |
1006 | case OSSL_CMP_OPT_IGNORE_KEYUSAGE: | |
1007 | ctx->ignore_keyusage = val; | |
1008 | break; | |
1009 | case OSSL_CMP_OPT_POPOMETHOD: | |
1010 | if (val > OSSL_CRMF_POPO_KEYAGREE) { | |
1011 | CMPerr(0, CMP_R_INVALID_ARGS); | |
1012 | return 0; | |
1013 | } | |
1014 | ctx->popoMethod = val; | |
1015 | break; | |
1016 | case OSSL_CMP_OPT_DIGEST_ALGNID: | |
1017 | ctx->digest = val; | |
1018 | break; | |
1019 | case OSSL_CMP_OPT_OWF_ALGNID: | |
1020 | ctx->pbm_owf = val; | |
1021 | break; | |
1022 | case OSSL_CMP_OPT_MAC_ALGNID: | |
1023 | ctx->pbm_mac = val; | |
1024 | break; | |
1025 | case OSSL_CMP_OPT_MSGTIMEOUT: | |
1026 | ctx->msgtimeout = val; | |
1027 | break; | |
1028 | case OSSL_CMP_OPT_TOTALTIMEOUT: | |
1029 | ctx->totaltimeout = val; | |
1030 | break; | |
1031 | case OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR: | |
1032 | ctx->permitTAInExtraCertsForIR = val; | |
1033 | break; | |
1034 | case OSSL_CMP_OPT_REVOCATION_REASON: | |
1035 | if (val > OCSP_REVOKED_STATUS_AACOMPROMISE) { | |
1036 | CMPerr(0, CMP_R_INVALID_ARGS); | |
1037 | return 0; | |
1038 | } | |
1039 | ctx->revocationReason = val; | |
1040 | break; | |
1041 | default: | |
1042 | CMPerr(0, CMP_R_INVALID_ARGS); | |
1043 | return 0; | |
1044 | } | |
1045 | ||
1046 | return 1; | |
1047 | } | |
1048 | ||
1049 | /* | |
1050 | * Reads a Boolean or integer option value from the context. | |
1051 | * Returns -1 on error (which is the default OSSL_CMP_OPT_REVOCATION_REASON) | |
1052 | */ | |
3dbc5156 DDO |
1053 | int OSSL_CMP_CTX_get_option(const OSSL_CMP_CTX *ctx, int opt) |
1054 | { | |
7960dbec DDO |
1055 | if (ctx == NULL) { |
1056 | CMPerr(0, CMP_R_NULL_ARGUMENT); | |
1057 | return -1; | |
1058 | } | |
1059 | ||
1060 | switch (opt) { | |
1061 | case OSSL_CMP_OPT_LOG_VERBOSITY: | |
1062 | return ctx->log_verbosity; | |
1063 | case OSSL_CMP_OPT_IMPLICITCONFIRM: | |
1064 | return ctx->implicitConfirm; | |
1065 | case OSSL_CMP_OPT_DISABLECONFIRM: | |
1066 | return ctx->disableConfirm; | |
1067 | case OSSL_CMP_OPT_UNPROTECTED_SEND: | |
1068 | return ctx->unprotectedSend; | |
1069 | case OSSL_CMP_OPT_UNPROTECTED_ERRORS: | |
1070 | return ctx->unprotectedErrors; | |
1071 | case OSSL_CMP_OPT_VALIDITYDAYS: | |
1072 | return ctx->days; | |
1073 | case OSSL_CMP_OPT_SUBJECTALTNAME_NODEFAULT: | |
1074 | return ctx->SubjectAltName_nodefault; | |
1075 | case OSSL_CMP_OPT_SUBJECTALTNAME_CRITICAL: | |
1076 | return ctx->setSubjectAltNameCritical; | |
1077 | case OSSL_CMP_OPT_POLICIES_CRITICAL: | |
1078 | return ctx->setPoliciesCritical; | |
1079 | case OSSL_CMP_OPT_IGNORE_KEYUSAGE: | |
1080 | return ctx->ignore_keyusage; | |
1081 | case OSSL_CMP_OPT_POPOMETHOD: | |
1082 | return ctx->popoMethod; | |
1083 | case OSSL_CMP_OPT_DIGEST_ALGNID: | |
1084 | return ctx->digest; | |
1085 | case OSSL_CMP_OPT_OWF_ALGNID: | |
1086 | return ctx->pbm_owf; | |
1087 | case OSSL_CMP_OPT_MAC_ALGNID: | |
1088 | return ctx->pbm_mac; | |
1089 | case OSSL_CMP_OPT_MSGTIMEOUT: | |
1090 | return ctx->msgtimeout; | |
1091 | case OSSL_CMP_OPT_TOTALTIMEOUT: | |
1092 | return ctx->totaltimeout; | |
1093 | case OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR: | |
1094 | return ctx->permitTAInExtraCertsForIR; | |
1095 | case OSSL_CMP_OPT_REVOCATION_REASON: | |
1096 | return ctx->revocationReason; | |
1097 | default: | |
1098 | CMPerr(0, CMP_R_INVALID_ARGS); | |
1099 | return -1; | |
1100 | } | |
1101 | } |