crypto/cmp/cmp_ctx.c

   1 /*
   2  * Copyright 2007-2019 The OpenSSL Project Authors. All Rights Reserved.
   3  * Copyright Nokia 2007-2019
   4  * Copyright Siemens AG 2015-2019
   5  *
   6  * Licensed under the Apache License 2.0 (the "License").  You may not use
   7  * this file except in compliance with the License.  You can obtain a copy
   8  * in the file LICENSE in the source distribution or at
   9  * https://www.openssl.org/source/license.html
  10  */
  11
  12 #include <openssl/trace.h>
  13 #include <openssl/bio.h>
  14 #include <openssl/ocsp.h> /* for OCSP_REVOKED_STATUS_* */
  15
  16 #include "cmp_local.h"
  17
  18 /* explicit #includes not strictly needed since implied by the above: */
  19 #include <openssl/cmp.h>
  20 #include <openssl/crmf.h>
  21 #include <openssl/err.h>
  22
  23 /*
  24  * Get current certificate store containing trusted root CA certs
  25  */
  26 X509_STORE *OSSL_CMP_CTX_get0_trustedStore(const OSSL_CMP_CTX *ctx)
  27 {
  28     if (ctx == NULL) {
  29         CMPerr(0, CMP_R_NULL_ARGUMENT);
  30         return NULL;
  31     }
  32     return ctx->trusted;
  33 }
  34
  35 /*
  36  * Set certificate store containing trusted (root) CA certs and possibly CRLs
  37  * and a cert verification callback function used for CMP server authentication.
  38  * Any already existing store entry is freed. Given NULL, the entry is reset.
  39  * returns 1 on success, 0 on error
  40  */
  41 int OSSL_CMP_CTX_set0_trustedStore(OSSL_CMP_CTX *ctx, X509_STORE *store)
  42 {
  43     if (ctx == NULL) {
  44         CMPerr(0, CMP_R_NULL_ARGUMENT);
  45         return 0;
  46     }
  47     X509_STORE_free(ctx->trusted);
  48     ctx->trusted = store;
  49     return 1;
  50 }
  51
  52 /*
  53  * Get current list of non-trusted intermediate certs
  54  */
  55 STACK_OF(X509) *OSSL_CMP_CTX_get0_untrusted_certs(const OSSL_CMP_CTX *ctx)
  56 {
  57     if (ctx == NULL) {
  58         CMPerr(0, CMP_R_NULL_ARGUMENT);
  59         return NULL;
  60     }
  61     return ctx->untrusted_certs;
  62 }
  63
  64 /*
  65  * Set untrusted certificates for path construction in authentication of
  66  * the CMP server and potentially others (TLS server, newly enrolled cert).
  67  * returns 1 on success, 0 on error
  68  */
  69 int OSSL_CMP_CTX_set1_untrusted_certs(OSSL_CMP_CTX *ctx, STACK_OF(X509) *certs)
  70 {
  71     STACK_OF(X509) *untrusted_certs;
  72     if (ctx == NULL) {
  73         CMPerr(0, CMP_R_NULL_ARGUMENT);
  74         return 0;
  75     }
  76     if ((untrusted_certs = sk_X509_new_null()) == NULL)
  77         return 0;
  78     if (ossl_cmp_sk_X509_add1_certs(untrusted_certs, certs, 0, 1, 0) != 1)
  79         goto err;
  80     sk_X509_pop_free(ctx->untrusted_certs, X509_free);
  81     ctx->untrusted_certs = untrusted_certs;
  82     return 1;
  83  err:
  84     sk_X509_pop_free(untrusted_certs, X509_free);
  85     return 0;
  86 }
  87
  88 /*
  89  * Allocates and initializes OSSL_CMP_CTX context structure with default values.
  90  * Returns new context on success, NULL on error
  91  */
  92 OSSL_CMP_CTX *OSSL_CMP_CTX_new(void)
  93 {
  94     OSSL_CMP_CTX *ctx = OPENSSL_zalloc(sizeof(*ctx));
  95
  96     if (ctx == NULL)
  97         return NULL;
  98
  99     ctx->log_verbosity = OSSL_CMP_LOG_INFO;
 100
 101     ctx->status = -1;
 102     ctx->failInfoCode = -1;
 103
 104     ctx->serverPort = OSSL_CMP_DEFAULT_PORT;
 105     ctx->proxyPort = OSSL_CMP_DEFAULT_PORT;
 106     ctx->msg_timeout = 2 * 60;
 107
 108     if ((ctx->untrusted_certs = sk_X509_new_null()) == NULL)
 109         goto err;
 110
 111     ctx->pbm_slen = 16;
 112     ctx->pbm_owf = NID_sha256;
 113     ctx->pbm_itercnt = 500;
 114     ctx->pbm_mac = NID_hmac_sha1;
 115
 116     ctx->digest = NID_sha256;
 117     ctx->popoMethod = OSSL_CRMF_POPO_SIGNATURE;
 118     ctx->revocationReason = CRL_REASON_NONE;
 119
 120     /* all other elements are initialized to 0 or NULL, respectively */
 121     return ctx;
 122
 123  err:
 124     OSSL_CMP_CTX_free(ctx);
 125     return NULL;
 126 }
 127
 128 /*
 129  * Prepare the OSSL_CMP_CTX for next use, partly re-initializing OSSL_CMP_CTX
 130  */
 131 int OSSL_CMP_CTX_reinit(OSSL_CMP_CTX *ctx)
 132 {
 133     if (ctx == NULL) {
 134         CMPerr(0, CMP_R_NULL_ARGUMENT);
 135         return 0;
 136     }
 137
 138     ctx->status = -1;
 139     ctx->failInfoCode = -1;
 140
 141     return ossl_cmp_ctx_set0_statusString(ctx, NULL)
 142         && ossl_cmp_ctx_set0_newCert(ctx, NULL)
 143         && ossl_cmp_ctx_set1_caPubs(ctx, NULL)
 144         && ossl_cmp_ctx_set1_extraCertsIn(ctx, NULL)
 145         && ossl_cmp_ctx_set0_validatedSrvCert(ctx, NULL)
 146         && OSSL_CMP_CTX_set1_transactionID(ctx, NULL)
 147         && OSSL_CMP_CTX_set1_senderNonce(ctx, NULL)
 148         && ossl_cmp_ctx_set1_recipNonce(ctx, NULL);
 149 }
 150
 151 /*
 152  * Frees OSSL_CMP_CTX variables allocated in OSSL_CMP_CTX_new()
 153  */
 154 void OSSL_CMP_CTX_free(OSSL_CMP_CTX *ctx)
 155 {
 156     if (ctx == NULL)
 157         return;
 158
 159     OPENSSL_free(ctx->serverPath);
 160     OPENSSL_free(ctx->serverName);
 161     OPENSSL_free(ctx->proxyName);
 162
 163     X509_free(ctx->srvCert);
 164     X509_free(ctx->validatedSrvCert);
 165     X509_NAME_free(ctx->expected_sender);
 166     X509_STORE_free(ctx->trusted);
 167     sk_X509_pop_free(ctx->untrusted_certs, X509_free);
 168
 169     X509_free(ctx->clCert);
 170     EVP_PKEY_free(ctx->pkey);
 171     ASN1_OCTET_STRING_free(ctx->referenceValue);
 172     if (ctx->secretValue != NULL)
 173         OPENSSL_cleanse(ctx->secretValue->data, ctx->secretValue->length);
 174     ASN1_OCTET_STRING_free(ctx->secretValue);
 175
 176     X509_NAME_free(ctx->recipient);
 177     ASN1_OCTET_STRING_free(ctx->transactionID);
 178     ASN1_OCTET_STRING_free(ctx->senderNonce);
 179     ASN1_OCTET_STRING_free(ctx->recipNonce);
 180     sk_OSSL_CMP_ITAV_pop_free(ctx->geninfo_ITAVs, OSSL_CMP_ITAV_free);
 181     sk_X509_pop_free(ctx->extraCertsOut, X509_free);
 182
 183     EVP_PKEY_free(ctx->newPkey);
 184     X509_NAME_free(ctx->issuer);
 185     X509_NAME_free(ctx->subjectName);
 186     sk_GENERAL_NAME_pop_free(ctx->subjectAltNames, GENERAL_NAME_free);
 187     sk_X509_EXTENSION_pop_free(ctx->reqExtensions, X509_EXTENSION_free);
 188     sk_POLICYINFO_pop_free(ctx->policies, POLICYINFO_free);
 189     X509_free(ctx->oldCert);
 190     X509_REQ_free(ctx->p10CSR);
 191
 192     sk_OSSL_CMP_ITAV_pop_free(ctx->genm_ITAVs, OSSL_CMP_ITAV_free);
 193
 194     sk_ASN1_UTF8STRING_pop_free(ctx->statusString, ASN1_UTF8STRING_free);
 195     X509_free(ctx->newCert);
 196     sk_X509_pop_free(ctx->caPubs, X509_free);
 197     sk_X509_pop_free(ctx->extraCertsIn, X509_free);
 198
 199     OPENSSL_free(ctx);
 200 }
 201
 202 int ossl_cmp_ctx_set_status(OSSL_CMP_CTX *ctx, int status)
 203 {
 204     if (!ossl_assert(ctx != NULL))
 205         return 0;
 206     ctx->status = status;
 207     return 1;
 208 }
 209
 210 /*
 211  * Returns the PKIStatus from the last CertRepMessage
 212  * or Revocation Response or error message, -1 on error
 213  */
 214 int OSSL_CMP_CTX_get_status(const OSSL_CMP_CTX *ctx)
 215 {
 216     if (ctx == NULL) {
 217         CMPerr(0, CMP_R_NULL_ARGUMENT);
 218         return -1;
 219     }
 220     return ctx->status;
 221 }
 222
 223 /*
 224  * Returns the statusString from the last CertRepMessage
 225  * or Revocation Response or error message, NULL on error
 226  */
 227 OSSL_CMP_PKIFREETEXT *OSSL_CMP_CTX_get0_statusString(const OSSL_CMP_CTX *ctx)
 228 {
 229     if (ctx == NULL) {
 230         CMPerr(0, CMP_R_NULL_ARGUMENT);
 231         return NULL;
 232     }
 233     return ctx->statusString;
 234 }
 235
 236 int ossl_cmp_ctx_set0_statusString(OSSL_CMP_CTX *ctx,
 237                                    OSSL_CMP_PKIFREETEXT *text)
 238 {
 239     if (!ossl_assert(ctx != NULL))
 240         return 0;
 241     sk_ASN1_UTF8STRING_pop_free(ctx->statusString, ASN1_UTF8STRING_free);
 242     ctx->statusString = text;
 243     return 1;
 244 }
 245
 246 int ossl_cmp_ctx_set0_validatedSrvCert(OSSL_CMP_CTX *ctx, X509 *cert)
 247 {
 248     if (!ossl_assert(ctx != NULL))
 249         return 0;
 250     X509_free(ctx->validatedSrvCert);
 251     ctx->validatedSrvCert = cert;
 252     return 1;
 253 }
 254
 255 /*
 256  * Set callback function for checking if the cert is ok or should
 257  * it be rejected.
 258  * Returns 1 on success, 0 on error
 259  */
 260 int OSSL_CMP_CTX_set_certConf_cb(OSSL_CMP_CTX *ctx, OSSL_CMP_certConf_cb_t cb)
 261 {
 262     if (ctx == NULL) {
 263         CMPerr(0, CMP_R_NULL_ARGUMENT);
 264         return 0;
 265     }
 266     ctx->certConf_cb = cb;
 267     return 1;
 268 }
 269
 270 /*
 271  * Set argument, respectively a pointer to a structure containing arguments,
 272  * optionally to be used by the certConf callback.
 273  * Returns 1 on success, 0 on error
 274  */
 275 int OSSL_CMP_CTX_set_certConf_cb_arg(OSSL_CMP_CTX *ctx, void *arg)
 276 {
 277     if (ctx == NULL) {
 278         CMPerr(0, CMP_R_NULL_ARGUMENT);
 279         return 0;
 280     }
 281     ctx->certConf_cb_arg = arg;
 282     return 1;
 283 }
 284
 285 /*
 286  * Get argument, respectively the pointer to a structure containing arguments,
 287  * optionally to be used by certConf callback.
 288  * Returns callback argument set previously (NULL if not set or on error)
 289  */
 290 void *OSSL_CMP_CTX_get_certConf_cb_arg(const OSSL_CMP_CTX *ctx)
 291 {
 292     if (ctx == NULL) {
 293         CMPerr(0, CMP_R_NULL_ARGUMENT);
 294         return NULL;
 295     }
 296     return ctx->certConf_cb_arg;
 297 }
 298
 299 #ifndef OPENSSL_NO_TRACE
 300 static size_t ossl_cmp_log_trace_cb(const char *buf, size_t cnt,
 301                                     int category, int cmd, void *vdata)
 302 {
 303     OSSL_CMP_CTX *ctx = vdata;
 304     const char *msg;
 305     OSSL_CMP_severity level = -1;
 306     char *func = NULL;
 307     char *file = NULL;
 308     int line = 0;
 309
 310     if (buf == NULL || cnt == 0 || cmd != OSSL_TRACE_CTRL_WRITE || ctx == NULL)
 311         return 0;
 312     if (ctx->log_cb == NULL)
 313         return 1; /* silently drop message */
 314
 315     msg = ossl_cmp_log_parse_metadata(buf, &level, &func, &file, &line);
 316
 317     if (level > ctx->log_verbosity) /* excludes the case level is unknown */
 318         goto end; /* suppress output since severity is not sufficient */
 319
 320     if (!ctx->log_cb(func != NULL ? func : "(no func)",
 321                      file != NULL ? file : "(no file)",
 322                      line, level, msg))
 323         cnt = 0;
 324
 325  end:
 326     OPENSSL_free(func);
 327     OPENSSL_free(file);
 328     return cnt;
 329 }
 330 #endif
 331
 332 /* Print CMP log messages (i.e., diagnostic info) via the log cb of the ctx */
 333 int ossl_cmp_print_log(OSSL_CMP_severity level, const OSSL_CMP_CTX *ctx,
 334                        const char *func, const char *file, int line,
 335                        const char *level_str, const char *format, ...)
 336 {
 337     va_list args;
 338     char hugebuf[1024 * 2];
 339     int res = 0;
 340
 341     if (ctx == NULL || ctx->log_cb == NULL)
 342         return 1; /* silently drop message */
 343
 344     if (level > ctx->log_verbosity) /* excludes the case level is unknown */
 345         return 1; /* suppress output since severity is not sufficient */
 346
 347     if (format == NULL)
 348         return 0;
 349
 350     va_start(args, format);
 351
 352     if (func == NULL)
 353         func = "(unset function name)";
 354     if (file == NULL)
 355         file = "(unset file name)";
 356     if (level_str == NULL)
 357         level_str = "(unset level string)";
 358
 359 #ifndef OPENSSL_NO_TRACE
 360     if (OSSL_TRACE_ENABLED(CMP)) {
 361         OSSL_TRACE_BEGIN(CMP) {
 362             int printed =
 363                 BIO_snprintf(hugebuf, sizeof(hugebuf),
 364                              "%s:%s:%d:" OSSL_CMP_LOG_PREFIX "%s: ",
 365                              func, file, line, level_str);
 366             if (printed > 0 && (size_t)printed < sizeof(hugebuf)) {
 367                 if (BIO_vsnprintf(hugebuf + printed,
 368                                   sizeof(hugebuf) - printed, format, args) > 0)
 369                     res = BIO_puts(trc_out, hugebuf) > 0;
 370             }
 371         } OSSL_TRACE_END(CMP);
 372     }
 373 #else /* compensate for disabled trace API */
 374     {
 375         if (BIO_vsnprintf(hugebuf, sizeof(hugebuf), format, args) > 0)
 376             res = ctx->log_cb(func, file, line, level, hugebuf);
 377     }
 378 #endif
 379     va_end(args);
 380     return res;
 381 }
 382
 383 /*
 384  * Set a callback function for error reporting and logging messages.
 385  * Returns 1 on success, 0 on error
 386  */
 387 int OSSL_CMP_CTX_set_log_cb(OSSL_CMP_CTX *ctx, OSSL_CMP_log_cb_t cb)
 388 {
 389     if (ctx == NULL) {
 390         CMPerr(0, CMP_R_NULL_ARGUMENT);
 391         return 0;
 392     }
 393     ctx->log_cb = cb;
 394
 395 #ifndef OPENSSL_NO_TRACE
 396     /* do also in case cb == NULL, to switch off logging output: */
 397     if (!OSSL_trace_set_callback(OSSL_TRACE_CATEGORY_CMP,
 398                                  ossl_cmp_log_trace_cb, ctx))
 399         return 0;
 400 #endif
 401
 402     return 1;
 403 }
 404
 405 /* Print OpenSSL and CMP errors via the log cb of the ctx or ERR_print_errors */
 406 void OSSL_CMP_CTX_print_errors(OSSL_CMP_CTX *ctx)
 407 {
 408     OSSL_CMP_print_errors_cb(ctx == NULL ? NULL : ctx->log_cb);
 409 }
 410
 411 /*
 412  * Set or clear the reference value to be used for identification
 413  * (i.e., the user name) when using PBMAC.
 414  * Returns 1 on success, 0 on error
 415  */
 416 int OSSL_CMP_CTX_set1_referenceValue(OSSL_CMP_CTX *ctx,
 417                                      const unsigned char *ref, int len)
 418 {
 419     if (ctx == NULL) {
 420         CMPerr(0, CMP_R_NULL_ARGUMENT);
 421         return 0;
 422     }
 423     return ossl_cmp_asn1_octet_string_set1_bytes(&ctx->referenceValue, ref,
 424                                                  len);
 425 }
 426
 427 /*
 428  * Set or clear the password to be used for protecting messages with PBMAC.
 429  * Returns 1 on success, 0 on error
 430  */
 431 int OSSL_CMP_CTX_set1_secretValue(OSSL_CMP_CTX *ctx, const unsigned char *sec,
 432                                   const int len)
 433 {
 434     ASN1_OCTET_STRING *secretValue = NULL;
 435     if (ctx == NULL) {
 436         CMPerr(0, CMP_R_NULL_ARGUMENT);
 437         return 0;
 438     }
 439     if (ossl_cmp_asn1_octet_string_set1_bytes(&secretValue, sec, len) != 1)
 440         return 0;
 441     if (ctx->secretValue != NULL) {
 442         OPENSSL_cleanse(ctx->secretValue->data, ctx->secretValue->length);
 443         ASN1_OCTET_STRING_free(ctx->secretValue);
 444     }
 445     ctx->secretValue = secretValue;
 446     return 1;
 447 }
 448
 449 /*
 450  * Returns the stack of certificates received in a response message.
 451  * The stack is duplicated so the caller must handle freeing it!
 452  * Returns pointer to created stack on success, NULL on error
 453  */
 454 STACK_OF(X509) *OSSL_CMP_CTX_get1_extraCertsIn(const OSSL_CMP_CTX *ctx)
 455 {
 456     if (ctx == NULL) {
 457         CMPerr(0, CMP_R_NULL_ARGUMENT);
 458         return NULL;
 459     }
 460     if (ctx->extraCertsIn == NULL)
 461         return sk_X509_new_null();
 462     return X509_chain_up_ref(ctx->extraCertsIn);
 463 }
 464
 465 /*
 466  * Copies any given stack of inbound X509 certificates to extraCertsIn
 467  * of the OSSL_CMP_CTX structure so that they may be retrieved later.
 468  * Returns 1 on success, 0 on error.
 469  */
 470 int ossl_cmp_ctx_set1_extraCertsIn(OSSL_CMP_CTX *ctx,
 471                                    STACK_OF(X509) *extraCertsIn)
 472 {
 473     if (!ossl_assert(ctx != NULL))
 474         return 0;
 475
 476     sk_X509_pop_free(ctx->extraCertsIn, X509_free);
 477     ctx->extraCertsIn = NULL;
 478     if (extraCertsIn == NULL)
 479         return 1;
 480     return (ctx->extraCertsIn = X509_chain_up_ref(extraCertsIn)) != NULL;
 481 }
 482
 483 /*
 484  * Duplicate and set the given stack as the new stack of X509
 485  * certificates to send out in the extraCerts field.
 486  * Returns 1 on success, 0 on error
 487  */
 488 int OSSL_CMP_CTX_set1_extraCertsOut(OSSL_CMP_CTX *ctx,
 489                                     STACK_OF(X509) *extraCertsOut)
 490 {
 491     if (ctx == NULL) {
 492         CMPerr(0, CMP_R_NULL_ARGUMENT);
 493         return 0;
 494     }
 495
 496     sk_X509_pop_free(ctx->extraCertsOut, X509_free);
 497     ctx->extraCertsOut = NULL;
 498     if (extraCertsOut == NULL)
 499         return 1;
 500     return (ctx->extraCertsOut = X509_chain_up_ref(extraCertsOut)) != NULL;
 501 }
 502
 503 /*
 504  * Add the given policy info object
 505  * to the X509_EXTENSIONS of the requested certificate template.
 506  * Returns 1 on success, 0 on error.
 507  */
 508 int OSSL_CMP_CTX_push0_policy(OSSL_CMP_CTX *ctx, POLICYINFO *pinfo)
 509 {
 510     if (ctx == NULL || pinfo == NULL) {
 511         CMPerr(0, CMP_R_NULL_ARGUMENT);
 512         return 0;
 513     }
 514
 515     if (ctx->policies == NULL
 516             && (ctx->policies = CERTIFICATEPOLICIES_new()) == NULL)
 517         return 0;
 518
 519     return sk_POLICYINFO_push(ctx->policies, pinfo);
 520 }
 521
 522 /*
 523  * Add an ITAV for geninfo of the PKI message header
 524  */
 525 int OSSL_CMP_CTX_push0_geninfo_ITAV(OSSL_CMP_CTX *ctx, OSSL_CMP_ITAV *itav)
 526 {
 527     if (ctx == NULL) {
 528         CMPerr(0, CMP_R_NULL_ARGUMENT);
 529         return 0;
 530     }
 531     return OSSL_CMP_ITAV_push0_stack_item(&ctx->geninfo_ITAVs, itav);
 532 }
 533
 534 /*
 535  * Add an itav for the body of outgoing general messages
 536  */
 537 int OSSL_CMP_CTX_push0_genm_ITAV(OSSL_CMP_CTX *ctx, OSSL_CMP_ITAV *itav)
 538 {
 539     if (ctx == NULL) {
 540         CMPerr(0, CMP_R_NULL_ARGUMENT);
 541         return 0;
 542     }
 543     return OSSL_CMP_ITAV_push0_stack_item(&ctx->genm_ITAVs, itav);
 544 }
 545
 546 /*
 547  * Returns a duplicate of the stack of X509 certificates that
 548  * were received in the caPubs field of the last CertRepMessage.
 549  * Returns NULL on error
 550  */
 551 STACK_OF(X509) *OSSL_CMP_CTX_get1_caPubs(const OSSL_CMP_CTX *ctx)
 552 {
 553     if (ctx == NULL) {
 554         CMPerr(0, CMP_R_NULL_ARGUMENT);
 555         return NULL;
 556     }
 557     if (ctx->caPubs == NULL)
 558         return sk_X509_new_null();
 559     return X509_chain_up_ref(ctx->caPubs);
 560 }
 561
 562 /*
 563  * Duplicate and copy the given stack of certificates to the given
 564  * OSSL_CMP_CTX structure so that they may be retrieved later.
 565  * Returns 1 on success, 0 on error
 566  */
 567 int ossl_cmp_ctx_set1_caPubs(OSSL_CMP_CTX *ctx, STACK_OF(X509) *caPubs)
 568 {
 569     if (!ossl_assert(ctx != NULL))
 570         return 0;
 571
 572     sk_X509_pop_free(ctx->caPubs, X509_free);
 573     ctx->caPubs = NULL;
 574     if (caPubs == NULL)
 575         return 1;
 576     return (ctx->caPubs = X509_chain_up_ref(caPubs)) != NULL;
 577 }
 578
 579 #define char_dup OPENSSL_strdup
 580 #define char_free OPENSSL_free
 581 #define DEFINE_OSSL_CMP_CTX_set1(FIELD, TYPE) /* this uses _dup */ \
 582 int OSSL_CMP_CTX_set1_##FIELD(OSSL_CMP_CTX *ctx, const TYPE *val) \
 583 { \
 584     TYPE *val_dup = NULL; \
 585     \
 586     if (ctx == NULL) { \
 587         CMPerr(0, CMP_R_NULL_ARGUMENT); \
 588         return 0; \
 589     } \
 590     \
 591     if (val != NULL && (val_dup = TYPE##_dup(val)) == NULL) \
 592         return 0; \
 593     TYPE##_free(ctx->FIELD); \
 594     ctx->FIELD = val_dup; \
 595     return 1; \
 596 }
 597
 598 #define DEFINE_OSSL_CMP_CTX_set1_up_ref(FIELD, TYPE) \
 599 int OSSL_CMP_CTX_set1_##FIELD(OSSL_CMP_CTX *ctx, TYPE *val) \
 600 { \
 601     if (ctx == NULL) { \
 602         CMPerr(0, CMP_R_NULL_ARGUMENT); \
 603         return 0; \
 604     } \
 605     \
 606     if (val != NULL && !TYPE##_up_ref(val)) \
 607         return 0; \
 608     TYPE##_free(ctx->FIELD); \
 609     ctx->FIELD = val; \
 610     return 1; \
 611 }
 612
 613 /*
 614  * Pins the server certificate to be directly trusted (even if it is expired)
 615  * for verifying response messages.
 616  * Cert pointer is not consumed. It may be NULL to clear the entry.
 617  * Returns 1 on success, 0 on error
 618  */
 619 DEFINE_OSSL_CMP_CTX_set1_up_ref(srvCert, X509)
 620
 621 /*
 622  * Set the X509 name of the recipient. Set in the PKIHeader.
 623  * returns 1 on success, 0 on error
 624  */
 625 DEFINE_OSSL_CMP_CTX_set1(recipient, X509_NAME)
 626
 627 /*
 628  * Store the X509 name of the expected sender in the PKIHeader of responses.
 629  * Returns 1 on success, 0 on error
 630  */
 631 DEFINE_OSSL_CMP_CTX_set1(expected_sender, X509_NAME)
 632
 633 /*
 634  * Set the X509 name of the issuer. Set in the PKIHeader.
 635  * Returns 1 on success, 0 on error
 636  */
 637 DEFINE_OSSL_CMP_CTX_set1(issuer, X509_NAME)
 638
 639 /*
 640  * Set the subject name that will be placed in the certificate
 641  * request. This will be the subject name on the received certificate.
 642  * Returns 1 on success, 0 on error
 643  */
 644 DEFINE_OSSL_CMP_CTX_set1(subjectName, X509_NAME)
 645
 646 /*
 647  * Set the X.509v3 certificate request extensions to be used in IR/CR/KUR.
 648  * Returns 1 on success, 0 on error
 649  */
 650 int OSSL_CMP_CTX_set0_reqExtensions(OSSL_CMP_CTX *ctx, X509_EXTENSIONS *exts)
 651 {
 652     if (ctx == NULL) {
 653         CMPerr(0, CMP_R_NULL_ARGUMENT);
 654         return 0;
 655     }
 656
 657     if (sk_GENERAL_NAME_num(ctx->subjectAltNames) > 0 && exts != NULL
 658             && X509v3_get_ext_by_NID(exts, NID_subject_alt_name, -1) >= 0) {
 659         CMPerr(0, CMP_R_MULTIPLE_SAN_SOURCES);
 660         return 0;
 661     }
 662     sk_X509_EXTENSION_pop_free(ctx->reqExtensions, X509_EXTENSION_free);
 663     ctx->reqExtensions = exts;
 664     return 1;
 665 }
 666
 667 /* returns 1 if ctx contains a Subject Alternative Name extension, else 0 */
 668 int OSSL_CMP_CTX_reqExtensions_have_SAN(OSSL_CMP_CTX *ctx)
 669 {
 670     if (ctx == NULL) {
 671         CMPerr(0, CMP_R_NULL_ARGUMENT);
 672         return -1;
 673     }
 674     /* if one of the following conditions 'fail' this is not an error */
 675     return ctx->reqExtensions != NULL
 676         && X509v3_get_ext_by_NID(ctx->reqExtensions,
 677                                  NID_subject_alt_name, -1) >= 0;
 678 }
 679
 680 /*
 681  * Add a GENERAL_NAME structure that will be added to the CRMF
 682  * request's extensions field to request subject alternative names.
 683  * Returns 1 on success, 0 on error
 684  */
 685 int OSSL_CMP_CTX_push1_subjectAltName(OSSL_CMP_CTX *ctx,
 686                                       const GENERAL_NAME *name)
 687 {
 688     GENERAL_NAME *name_dup;
 689
 690     if (ctx == NULL || name == NULL) {
 691         CMPerr(0, CMP_R_NULL_ARGUMENT);
 692         return 0;
 693     }
 694
 695     if (OSSL_CMP_CTX_reqExtensions_have_SAN(ctx) == 1) {
 696         CMPerr(0, CMP_R_MULTIPLE_SAN_SOURCES);
 697         return 0;
 698     }
 699
 700     if (ctx->subjectAltNames == NULL
 701             && (ctx->subjectAltNames = sk_GENERAL_NAME_new_null()) == NULL)
 702         return 0;
 703     if ((name_dup = GENERAL_NAME_dup(name)) == NULL)
 704         return 0;
 705     if (!sk_GENERAL_NAME_push(ctx->subjectAltNames, name_dup)) {
 706         GENERAL_NAME_free(name_dup);
 707         return 0;
 708     }
 709     return 1;
 710 }
 711
 712 /*
 713  * Set our own client certificate, used for example in KUR and when
 714  * doing the IR with existing certificate.
 715  * Returns 1 on success, 0 on error
 716  */
 717 DEFINE_OSSL_CMP_CTX_set1_up_ref(clCert, X509)
 718
 719 /*
 720  * Set the old certificate that we are updating in KUR
 721  * or the certificate to be revoked in RR, respectively.
 722  * Also used as reference cert (defaulting to clCert) for deriving subject DN
 723  * and SANs. Its issuer is used as default recipient in the CMP message header.
 724  * Returns 1 on success, 0 on error
 725  */
 726 DEFINE_OSSL_CMP_CTX_set1_up_ref(oldCert, X509)
 727
 728 /*
 729  * Set the PKCS#10 CSR to be sent in P10CR.
 730  * Returns 1 on success, 0 on error
 731  */
 732 DEFINE_OSSL_CMP_CTX_set1(p10CSR, X509_REQ)
 733
 734 /*
 735  * Sets the (newly received in IP/KUP/CP) certificate in the context.
 736  * Returns 1 on success, 0 on error
 737  * TODO: this only permits for one cert to be enrolled at a time.
 738  */
 739 int ossl_cmp_ctx_set0_newCert(OSSL_CMP_CTX *ctx, X509 *cert)
 740 {
 741     if (!ossl_assert(ctx != NULL))
 742         return 0;
 743
 744     X509_free(ctx->newCert);
 745     ctx->newCert = cert;
 746     return 1;
 747 }
 748
 749 /*
 750  * Get the (newly received in IP/KUP/CP) client certificate from the context
 751  * TODO: this only permits for one client cert to be received...
 752  */
 753 X509 *OSSL_CMP_CTX_get0_newCert(const OSSL_CMP_CTX *ctx)
 754 {
 755     if (ctx == NULL) {
 756         CMPerr(0, CMP_R_NULL_ARGUMENT);
 757         return NULL;
 758     }
 759     return ctx->newCert;
 760 }
 761
 762 /*
 763  * Set the client's current private key.
 764  * Returns 1 on success, 0 on error
 765  */
 766 DEFINE_OSSL_CMP_CTX_set1_up_ref(pkey, EVP_PKEY)
 767
 768 /*
 769  * Set new key pair. Used e.g. when doing Key Update.
 770  * Returns 1 on success, 0 on error
 771  */
 772 int OSSL_CMP_CTX_set0_newPkey(OSSL_CMP_CTX *ctx, int priv, EVP_PKEY *pkey)
 773 {
 774     if (ctx == NULL) {
 775         CMPerr(0, CMP_R_NULL_ARGUMENT);
 776         return 0;
 777     }
 778
 779     EVP_PKEY_free(ctx->newPkey);
 780     ctx->newPkey = pkey;
 781     ctx->newPkey_priv = priv;
 782     return 1;
 783 }
 784
 785 /*
 786  * gets the private/public key to use for certificate enrollment, NULL on error
 787  */
 788 EVP_PKEY *OSSL_CMP_CTX_get0_newPkey(const OSSL_CMP_CTX *ctx, int priv)
 789 {
 790     if (ctx == NULL) {
 791         CMPerr(0, CMP_R_NULL_ARGUMENT);
 792         return NULL;
 793     }
 794
 795     if (ctx->newPkey != NULL)
 796         return priv && !ctx->newPkey_priv ? NULL : ctx->newPkey;
 797     if (ctx->p10CSR != NULL)
 798         return priv ? NULL : X509_REQ_get0_pubkey(ctx->p10CSR);
 799     return ctx->pkey; /* may be NULL */
 800 }
 801
 802 /*
 803  * Sets the given transactionID to the context.
 804  * Returns 1 on success, 0 on error
 805  */
 806 int OSSL_CMP_CTX_set1_transactionID(OSSL_CMP_CTX *ctx,
 807                                     const ASN1_OCTET_STRING *id)
 808 {
 809     if (ctx == NULL) {
 810         CMPerr(0, CMP_R_NULL_ARGUMENT);
 811         return 0;
 812     }
 813     return ossl_cmp_asn1_octet_string_set1(&ctx->transactionID, id);
 814 }
 815
 816 /*
 817  * sets the given nonce to be used for the recipNonce in the next message to be
 818  * created.
 819  * returns 1 on success, 0 on error
 820  */
 821 int ossl_cmp_ctx_set1_recipNonce(OSSL_CMP_CTX *ctx,
 822                                  const ASN1_OCTET_STRING *nonce)
 823 {
 824     if (!ossl_assert(ctx != NULL))
 825         return 0;
 826     return ossl_cmp_asn1_octet_string_set1(&ctx->recipNonce, nonce);
 827 }
 828
 829 /*
 830  * Stores the given nonce as the last senderNonce sent out.
 831  * Returns 1 on success, 0 on error
 832  */
 833 int OSSL_CMP_CTX_set1_senderNonce(OSSL_CMP_CTX *ctx,
 834                                   const ASN1_OCTET_STRING *nonce)
 835 {
 836     if (ctx == NULL) {
 837         CMPerr(0, CMP_R_NULL_ARGUMENT);
 838         return 0;
 839     }
 840     return ossl_cmp_asn1_octet_string_set1(&ctx->senderNonce, nonce);
 841 }
 842
 843 /*
 844  * Set the host name of the (HTTP) proxy server to use for all connections
 845  * returns 1 on success, 0 on error
 846  */
 847 DEFINE_OSSL_CMP_CTX_set1(proxyName, char)
 848
 849 /*
 850  * Set the (HTTP) host name of the CA server.
 851  * Returns 1 on success, 0 on error
 852  */
 853 DEFINE_OSSL_CMP_CTX_set1(serverName, char)
 854
 855 /*
 856  * Sets the (HTTP) proxy port to be used.
 857  * Returns 1 on success, 0 on error
 858  */
 859 int OSSL_CMP_CTX_set_proxyPort(OSSL_CMP_CTX *ctx, int port)
 860 {
 861     if (ctx == NULL) {
 862         CMPerr(0, CMP_R_NULL_ARGUMENT);
 863         return 0;
 864     }
 865     ctx->proxyPort = port;
 866     return 1;
 867 }
 868
 869 /*
 870  * sets the http connect/disconnect callback function to be used for HTTP(S)
 871  * returns 1 on success, 0 on error
 872  */
 873 int OSSL_CMP_CTX_set_http_cb(OSSL_CMP_CTX *ctx, OSSL_HTTP_bio_cb_t cb)
 874 {
 875     if (ctx == NULL) {
 876         CMPerr(0, CMP_R_NULL_ARGUMENT);
 877         return 0;
 878     }
 879     ctx->http_cb = cb;
 880     return 1;
 881 }
 882
 883 /*
 884  * Set argument optionally to be used by the http connect/disconnect callback.
 885  * Returns 1 on success, 0 on error
 886  */
 887 int OSSL_CMP_CTX_set_http_cb_arg(OSSL_CMP_CTX *ctx, void *arg)
 888 {
 889     if (ctx == NULL) {
 890         CMPerr(0, CMP_R_NULL_ARGUMENT);
 891         return 0;
 892     }
 893     ctx->http_cb_arg = arg;
 894     return 1;
 895 }
 896
 897 /*
 898  * Get argument optionally to be used by the http connect/disconnect callback
 899  * Returns callback argument set previously (NULL if not set or on error)
 900  */
 901 void *OSSL_CMP_CTX_get_http_cb_arg(const OSSL_CMP_CTX *ctx)
 902 {
 903     if (ctx == NULL) {
 904         CMPerr(0, CMP_R_NULL_ARGUMENT);
 905         return NULL;
 906     }
 907     return ctx->http_cb_arg;
 908 }
 909
 910 /*
 911  * Set callback function for sending CMP request and receiving response.
 912  * Returns 1 on success, 0 on error
 913  */
 914 int OSSL_CMP_CTX_set_transfer_cb(OSSL_CMP_CTX *ctx, OSSL_CMP_transfer_cb_t cb)
 915 {
 916     if (ctx == NULL) {
 917         CMPerr(0, CMP_R_NULL_ARGUMENT);
 918         return 0;
 919     }
 920     ctx->transfer_cb = cb;
 921     return 1;
 922 }
 923
 924 /*
 925  * Set argument optionally to be used by the transfer callback.
 926  * Returns 1 on success, 0 on error
 927  */
 928 int OSSL_CMP_CTX_set_transfer_cb_arg(OSSL_CMP_CTX *ctx, void *arg)
 929 {
 930     if (ctx == NULL) {
 931         CMPerr(0, CMP_R_NULL_ARGUMENT);
 932         return 0;
 933     }
 934     ctx->transfer_cb_arg = arg;
 935     return 1;
 936 }
 937
 938 /*
 939  * Get argument optionally to be used by the transfer callback.
 940  * Returns callback argument set previously (NULL if not set or on error)
 941  */
 942 void *OSSL_CMP_CTX_get_transfer_cb_arg(const OSSL_CMP_CTX *ctx)
 943 {
 944     if (ctx == NULL) {
 945         CMPerr(0, CMP_R_NULL_ARGUMENT);
 946         return NULL;
 947     }
 948     return ctx->transfer_cb_arg;
 949 }
 950
 951 /*
 952  * Sets the (HTTP) server port to be used.
 953  * Returns 1 on success, 0 on error
 954  */
 955 int OSSL_CMP_CTX_set_serverPort(OSSL_CMP_CTX *ctx, int port)
 956 {
 957     if (ctx == NULL) {
 958         CMPerr(0, CMP_R_NULL_ARGUMENT);
 959         return 0;
 960     }
 961     ctx->serverPort = port;
 962     return 1;
 963 }
 964
 965 /*
 966  * Sets the HTTP path to be used on the server (e.g "pkix/").
 967  * Returns 1 on success, 0 on error
 968  */
 969 DEFINE_OSSL_CMP_CTX_set1(serverPath, char)
 970
 971 /*
 972  * Set the failInfo error code as bit encoding in OSSL_CMP_CTX.
 973  * Returns 1 on success, 0 on error
 974  */
 975 int ossl_cmp_ctx_set_failInfoCode(OSSL_CMP_CTX *ctx, int fail_info)
 976 {
 977     if (!ossl_assert(ctx != NULL))
 978         return 0;
 979     ctx->failInfoCode = fail_info;
 980     return 1;
 981 }
 982
 983 /*
 984  * Get the failInfo error code in OSSL_CMP_CTX as bit encoding.
 985  * Returns bit string as integer on success, -1 on error
 986  */
 987 int OSSL_CMP_CTX_get_failInfoCode(const OSSL_CMP_CTX *ctx)
 988 {
 989     if (ctx == NULL) {
 990         CMPerr(0, CMP_R_NULL_ARGUMENT);
 991         return -1;
 992     }
 993     return ctx->failInfoCode;
 994 }
 995
 996 /*
 997  * Sets a Boolean or integer option of the context to the "val" arg.
 998  * Returns 1 on success, 0 on error
 999  */
1000 int OSSL_CMP_CTX_set_option(OSSL_CMP_CTX *ctx, int opt, int val)
1001 {
1002     int min_val;
1003
1004     if (ctx == NULL) {
1005         CMPerr(0, CMP_R_NULL_ARGUMENT);
1006         return 0;
1007     }
1008
1009     switch (opt) {
1010     case OSSL_CMP_OPT_REVOCATION_REASON:
1011         min_val = OCSP_REVOKED_STATUS_NOSTATUS;
1012         break;
1013     case OSSL_CMP_OPT_POPO_METHOD:
1014         min_val = OSSL_CRMF_POPO_NONE;
1015         break;
1016     default:
1017         min_val = 0;
1018         break;
1019     }
1020     if (val < min_val) {
1021         CMPerr(0, CMP_R_INVALID_ARGS);
1022         return 0;
1023     }
1024
1025     switch (opt) {
1026     case OSSL_CMP_OPT_LOG_VERBOSITY:
1027         if (val > OSSL_CMP_LOG_DEBUG) {
1028             CMPerr(0, CMP_R_INVALID_ARGS);
1029             return 0;
1030         }
1031         ctx->log_verbosity = val;
1032         break;
1033     case OSSL_CMP_OPT_IMPLICIT_CONFIRM:
1034         ctx->implicitConfirm = val;
1035         break;
1036     case OSSL_CMP_OPT_DISABLE_CONFIRM:
1037         ctx->disableConfirm = val;
1038         break;
1039     case OSSL_CMP_OPT_UNPROTECTED_SEND:
1040         ctx->unprotectedSend = val;
1041         break;
1042     case OSSL_CMP_OPT_UNPROTECTED_ERRORS:
1043         ctx->unprotectedErrors = val;
1044         break;
1045     case OSSL_CMP_OPT_VALIDITY_DAYS:
1046         ctx->days = val;
1047         break;
1048     case OSSL_CMP_OPT_SUBJECTALTNAME_NODEFAULT:
1049         ctx->SubjectAltName_nodefault = val;
1050         break;
1051     case OSSL_CMP_OPT_SUBJECTALTNAME_CRITICAL:
1052         ctx->setSubjectAltNameCritical = val;
1053         break;
1054     case OSSL_CMP_OPT_POLICIES_CRITICAL:
1055         ctx->setPoliciesCritical = val;
1056         break;
1057     case OSSL_CMP_OPT_IGNORE_KEYUSAGE:
1058         ctx->ignore_keyusage = val;
1059         break;
1060     case OSSL_CMP_OPT_POPO_METHOD:
1061         if (val > OSSL_CRMF_POPO_KEYAGREE) {
1062             CMPerr(0, CMP_R_INVALID_ARGS);
1063             return 0;
1064         }
1065         ctx->popoMethod = val;
1066         break;
1067     case OSSL_CMP_OPT_DIGEST_ALGNID:
1068         ctx->digest = val;
1069         break;
1070     case OSSL_CMP_OPT_OWF_ALGNID:
1071         ctx->pbm_owf = val;
1072         break;
1073     case OSSL_CMP_OPT_MAC_ALGNID:
1074         ctx->pbm_mac = val;
1075         break;
1076     case OSSL_CMP_OPT_MSG_TIMEOUT:
1077         ctx->msg_timeout = val;
1078         break;
1079     case OSSL_CMP_OPT_TOTAL_TIMEOUT:
1080         ctx->total_timeout = val;
1081         break;
1082     case OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR:
1083         ctx->permitTAInExtraCertsForIR = val;
1084         break;
1085     case OSSL_CMP_OPT_REVOCATION_REASON:
1086         if (val > OCSP_REVOKED_STATUS_AACOMPROMISE) {
1087             CMPerr(0, CMP_R_INVALID_ARGS);
1088             return 0;
1089         }
1090         ctx->revocationReason = val;
1091         break;
1092     default:
1093         CMPerr(0, CMP_R_INVALID_ARGS);
1094         return 0;
1095     }
1096
1097     return 1;
1098 }
1099
1100 /*
1101  * Reads a Boolean or integer option value from the context.
1102  * Returns -1 on error (which is the default OSSL_CMP_OPT_REVOCATION_REASON)
1103  */
1104 int OSSL_CMP_CTX_get_option(const OSSL_CMP_CTX *ctx, int opt)
1105 {
1106     if (ctx == NULL) {
1107         CMPerr(0, CMP_R_NULL_ARGUMENT);
1108         return -1;
1109     }
1110
1111     switch (opt) {
1112     case OSSL_CMP_OPT_LOG_VERBOSITY:
1113         return ctx->log_verbosity;
1114     case OSSL_CMP_OPT_IMPLICIT_CONFIRM:
1115         return ctx->implicitConfirm;
1116     case OSSL_CMP_OPT_DISABLE_CONFIRM:
1117         return ctx->disableConfirm;
1118     case OSSL_CMP_OPT_UNPROTECTED_SEND:
1119         return ctx->unprotectedSend;
1120     case OSSL_CMP_OPT_UNPROTECTED_ERRORS:
1121         return ctx->unprotectedErrors;
1122     case OSSL_CMP_OPT_VALIDITY_DAYS:
1123         return ctx->days;
1124     case OSSL_CMP_OPT_SUBJECTALTNAME_NODEFAULT:
1125         return ctx->SubjectAltName_nodefault;
1126     case OSSL_CMP_OPT_SUBJECTALTNAME_CRITICAL:
1127         return ctx->setSubjectAltNameCritical;
1128     case OSSL_CMP_OPT_POLICIES_CRITICAL:
1129         return ctx->setPoliciesCritical;
1130     case OSSL_CMP_OPT_IGNORE_KEYUSAGE:
1131         return ctx->ignore_keyusage;
1132     case OSSL_CMP_OPT_POPO_METHOD:
1133         return ctx->popoMethod;
1134     case OSSL_CMP_OPT_DIGEST_ALGNID:
1135         return ctx->digest;
1136     case OSSL_CMP_OPT_OWF_ALGNID:
1137         return ctx->pbm_owf;
1138     case OSSL_CMP_OPT_MAC_ALGNID:
1139         return ctx->pbm_mac;
1140     case OSSL_CMP_OPT_MSG_TIMEOUT:
1141         return ctx->msg_timeout;
1142     case OSSL_CMP_OPT_TOTAL_TIMEOUT:
1143         return ctx->total_timeout;
1144     case OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR:
1145         return ctx->permitTAInExtraCertsForIR;
1146     case OSSL_CMP_OPT_REVOCATION_REASON:
1147         return ctx->revocationReason;
1148     default:
1149         CMPerr(0, CMP_R_INVALID_ARGS);
1150         return -1;
1151     }
1152 }