crypto/cmp/cmp_ctx.c

   1 /*
   2  * Copyright 2007-2021 The OpenSSL Project Authors. All Rights Reserved.
   3  * Copyright Nokia 2007-2019
   4  * Copyright Siemens AG 2015-2019
   5  *
   6  * Licensed under the Apache License 2.0 (the "License").  You may not use
   7  * this file except in compliance with the License.  You can obtain a copy
   8  * in the file LICENSE in the source distribution or at
   9  * https://www.openssl.org/source/license.html
  10  */
  11
  12 #include <openssl/trace.h>
  13 #include <openssl/bio.h>
  14 #include <openssl/ocsp.h> /* for OCSP_REVOKED_STATUS_* */
  15
  16 #include "cmp_local.h"
  17
  18 /* explicit #includes not strictly needed since implied by the above: */
  19 #include <openssl/cmp.h>
  20 #include <openssl/crmf.h>
  21 #include <openssl/err.h>
  22
  23 /*
  24  * Get current certificate store containing trusted root CA certs
  25  */
  26 X509_STORE *OSSL_CMP_CTX_get0_trustedStore(const OSSL_CMP_CTX *ctx)
  27 {
  28     if (ctx == NULL) {
  29         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  30         return NULL;
  31     }
  32     return ctx->trusted;
  33 }
  34
  35 /*
  36  * Set certificate store containing trusted (root) CA certs and possibly CRLs
  37  * and a cert verification callback function used for CMP server authentication.
  38  * Any already existing store entry is freed. Given NULL, the entry is reset.
  39  */
  40 int OSSL_CMP_CTX_set0_trustedStore(OSSL_CMP_CTX *ctx, X509_STORE *store)
  41 {
  42     if (ctx == NULL) {
  43         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  44         return 0;
  45     }
  46     X509_STORE_free(ctx->trusted);
  47     ctx->trusted = store;
  48     return 1;
  49 }
  50
  51 /* Get current list of non-trusted intermediate certs */
  52 STACK_OF(X509) *OSSL_CMP_CTX_get0_untrusted(const OSSL_CMP_CTX *ctx)
  53 {
  54     if (ctx == NULL) {
  55         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  56         return NULL;
  57     }
  58     return ctx->untrusted;
  59 }
  60
  61 /*
  62  * Set untrusted certificates for path construction in authentication of
  63  * the CMP server and potentially others (TLS server, newly enrolled cert).
  64  */
  65 int OSSL_CMP_CTX_set1_untrusted(OSSL_CMP_CTX *ctx, STACK_OF(X509) *certs)
  66 {
  67     STACK_OF(X509) *untrusted = NULL;
  68
  69     if (ctx == NULL) {
  70         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  71         return 0;
  72     }
  73     if (!ossl_x509_add_certs_new(&untrusted, certs,
  74                                  X509_ADD_FLAG_UP_REF | X509_ADD_FLAG_NO_DUP))
  75         goto err;
  76     sk_X509_pop_free(ctx->untrusted, X509_free);
  77     ctx->untrusted = untrusted;
  78     return 1;
  79  err:
  80     sk_X509_pop_free(untrusted, X509_free);
  81     return 0;
  82 }
  83
  84 static int cmp_ctx_set_md(OSSL_CMP_CTX *ctx, EVP_MD **pmd, int nid)
  85 {
  86     EVP_MD *md = EVP_MD_fetch(ctx->libctx, OBJ_nid2sn(nid), ctx->propq);
  87     /* fetching in advance to be able to throw error early if unsupported */
  88
  89     if (md == NULL) {
  90         ERR_raise(ERR_LIB_CMP, CMP_R_UNSUPPORTED_ALGORITHM);
  91         return 0;
  92     }
  93     EVP_MD_free(*pmd);
  94     *pmd = md;
  95     return 1;
  96 }
  97
  98 /*
  99  * Allocates and initializes OSSL_CMP_CTX context structure with default values.
 100  * Returns new context on success, NULL on error
 101  */
 102 OSSL_CMP_CTX *OSSL_CMP_CTX_new(OSSL_LIB_CTX *libctx, const char *propq)
 103 {
 104     OSSL_CMP_CTX *ctx = OPENSSL_zalloc(sizeof(*ctx));
 105
 106     if (ctx == NULL)
 107         goto err;
 108
 109     ctx->libctx = libctx;
 110     if (propq != NULL && (ctx->propq = OPENSSL_strdup(propq)) == NULL)
 111         goto oom;
 112
 113     ctx->log_verbosity = OSSL_CMP_LOG_INFO;
 114
 115     ctx->status = -1;
 116     ctx->failInfoCode = -1;
 117
 118     ctx->keep_alive = 1;
 119     ctx->msg_timeout = -1;
 120
 121     if ((ctx->untrusted = sk_X509_new_null()) == NULL)
 122         goto oom;
 123
 124     ctx->pbm_slen = 16;
 125     if (!cmp_ctx_set_md(ctx, &ctx->pbm_owf, NID_sha256))
 126         goto err;
 127     ctx->pbm_itercnt = 500;
 128     ctx->pbm_mac = NID_hmac_sha1;
 129
 130     if (!cmp_ctx_set_md(ctx, &ctx->digest, NID_sha256))
 131         goto err;
 132     ctx->popoMethod = OSSL_CRMF_POPO_SIGNATURE;
 133     ctx->revocationReason = CRL_REASON_NONE;
 134
 135     /* all other elements are initialized to 0 or NULL, respectively */
 136     return ctx;
 137
 138  oom:
 139     ERR_raise(ERR_LIB_X509, ERR_R_MALLOC_FAILURE);
 140  err:
 141     OSSL_CMP_CTX_free(ctx);
 142     return NULL;
 143 }
 144
 145 /* Prepare the OSSL_CMP_CTX for next use, partly re-initializing OSSL_CMP_CTX */
 146 int OSSL_CMP_CTX_reinit(OSSL_CMP_CTX *ctx)
 147 {
 148     if (ctx == NULL) {
 149         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
 150         return 0;
 151     }
 152
 153     if (ctx->http_ctx != NULL) {
 154         (void)OSSL_HTTP_close(ctx->http_ctx, 1);
 155         ossl_cmp_debug(ctx, "disconnected from CMP server");
 156         ctx->http_ctx = NULL;
 157     }
 158     ctx->status = -1;
 159     ctx->failInfoCode = -1;
 160
 161     return ossl_cmp_ctx_set0_statusString(ctx, NULL)
 162         && ossl_cmp_ctx_set0_newCert(ctx, NULL)
 163         && ossl_cmp_ctx_set1_newChain(ctx, NULL)
 164         && ossl_cmp_ctx_set1_caPubs(ctx, NULL)
 165         && ossl_cmp_ctx_set1_extraCertsIn(ctx, NULL)
 166         && ossl_cmp_ctx_set0_validatedSrvCert(ctx, NULL)
 167         && OSSL_CMP_CTX_set1_transactionID(ctx, NULL)
 168         && OSSL_CMP_CTX_set1_senderNonce(ctx, NULL)
 169         && ossl_cmp_ctx_set1_recipNonce(ctx, NULL);
 170 }
 171
 172 /* Frees OSSL_CMP_CTX variables allocated in OSSL_CMP_CTX_new() */
 173 void OSSL_CMP_CTX_free(OSSL_CMP_CTX *ctx)
 174 {
 175     if (ctx == NULL)
 176         return;
 177
 178     if (ctx->http_ctx != NULL) {
 179         (void)OSSL_HTTP_close(ctx->http_ctx, 1);
 180         ossl_cmp_debug(ctx, "disconnected from CMP server");
 181     }
 182     OPENSSL_free(ctx->serverPath);
 183     OPENSSL_free(ctx->server);
 184     OPENSSL_free(ctx->proxy);
 185     OPENSSL_free(ctx->no_proxy);
 186
 187     X509_free(ctx->srvCert);
 188     X509_free(ctx->validatedSrvCert);
 189     X509_NAME_free(ctx->expected_sender);
 190     X509_STORE_free(ctx->trusted);
 191     sk_X509_pop_free(ctx->untrusted, X509_free);
 192
 193     X509_free(ctx->cert);
 194     sk_X509_pop_free(ctx->chain, X509_free);
 195     EVP_PKEY_free(ctx->pkey);
 196     ASN1_OCTET_STRING_free(ctx->referenceValue);
 197     if (ctx->secretValue != NULL)
 198         OPENSSL_cleanse(ctx->secretValue->data, ctx->secretValue->length);
 199     ASN1_OCTET_STRING_free(ctx->secretValue);
 200     EVP_MD_free(ctx->pbm_owf);
 201
 202     X509_NAME_free(ctx->recipient);
 203     EVP_MD_free(ctx->digest);
 204     ASN1_OCTET_STRING_free(ctx->transactionID);
 205     ASN1_OCTET_STRING_free(ctx->senderNonce);
 206     ASN1_OCTET_STRING_free(ctx->recipNonce);
 207     sk_OSSL_CMP_ITAV_pop_free(ctx->geninfo_ITAVs, OSSL_CMP_ITAV_free);
 208     sk_X509_pop_free(ctx->extraCertsOut, X509_free);
 209
 210     EVP_PKEY_free(ctx->newPkey);
 211     X509_NAME_free(ctx->issuer);
 212     X509_NAME_free(ctx->subjectName);
 213     sk_GENERAL_NAME_pop_free(ctx->subjectAltNames, GENERAL_NAME_free);
 214     sk_X509_EXTENSION_pop_free(ctx->reqExtensions, X509_EXTENSION_free);
 215     sk_POLICYINFO_pop_free(ctx->policies, POLICYINFO_free);
 216     X509_free(ctx->oldCert);
 217     X509_REQ_free(ctx->p10CSR);
 218
 219     sk_OSSL_CMP_ITAV_pop_free(ctx->genm_ITAVs, OSSL_CMP_ITAV_free);
 220
 221     sk_ASN1_UTF8STRING_pop_free(ctx->statusString, ASN1_UTF8STRING_free);
 222     X509_free(ctx->newCert);
 223     sk_X509_pop_free(ctx->newChain, X509_free);
 224     sk_X509_pop_free(ctx->caPubs, X509_free);
 225     sk_X509_pop_free(ctx->extraCertsIn, X509_free);
 226
 227     OPENSSL_free(ctx);
 228 }
 229
 230 int ossl_cmp_ctx_set_status(OSSL_CMP_CTX *ctx, int status)
 231 {
 232     if (!ossl_assert(ctx != NULL))
 233         return 0;
 234     ctx->status = status;
 235     return 1;
 236 }
 237
 238 /*
 239  * Returns the PKIStatus from the last CertRepMessage
 240  * or Revocation Response or error message, -1 on error
 241  */
 242 int OSSL_CMP_CTX_get_status(const OSSL_CMP_CTX *ctx)
 243 {
 244     if (ctx == NULL) {
 245         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
 246         return -1;
 247     }
 248     return ctx->status;
 249 }
 250
 251 /*
 252  * Returns the statusString from the last CertRepMessage
 253  * or Revocation Response or error message, NULL on error
 254  */
 255 OSSL_CMP_PKIFREETEXT *OSSL_CMP_CTX_get0_statusString(const OSSL_CMP_CTX *ctx)
 256 {
 257     if (ctx == NULL) {
 258         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
 259         return NULL;
 260     }
 261     return ctx->statusString;
 262 }
 263
 264 int ossl_cmp_ctx_set0_statusString(OSSL_CMP_CTX *ctx,
 265                                    OSSL_CMP_PKIFREETEXT *text)
 266 {
 267     if (!ossl_assert(ctx != NULL))
 268         return 0;
 269     sk_ASN1_UTF8STRING_pop_free(ctx->statusString, ASN1_UTF8STRING_free);
 270     ctx->statusString = text;
 271     return 1;
 272 }
 273
 274 int ossl_cmp_ctx_set0_validatedSrvCert(OSSL_CMP_CTX *ctx, X509 *cert)
 275 {
 276     if (!ossl_assert(ctx != NULL))
 277         return 0;
 278     X509_free(ctx->validatedSrvCert);
 279     ctx->validatedSrvCert = cert;
 280     return 1;
 281 }
 282
 283 /* Set callback function for checking if the cert is ok or should be rejected */
 284 int OSSL_CMP_CTX_set_certConf_cb(OSSL_CMP_CTX *ctx, OSSL_CMP_certConf_cb_t cb)
 285 {
 286     if (ctx == NULL) {
 287         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
 288         return 0;
 289     }
 290     ctx->certConf_cb = cb;
 291     return 1;
 292 }
 293
 294 /*
 295  * Set argument, respectively a pointer to a structure containing arguments,
 296  * optionally to be used by the certConf callback.
 297  */
 298 int OSSL_CMP_CTX_set_certConf_cb_arg(OSSL_CMP_CTX *ctx, void *arg)
 299 {
 300     if (ctx == NULL) {
 301         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
 302         return 0;
 303     }
 304     ctx->certConf_cb_arg = arg;
 305     return 1;
 306 }
 307
 308 /*
 309  * Get argument, respectively the pointer to a structure containing arguments,
 310  * optionally to be used by certConf callback.
 311  * Returns callback argument set previously (NULL if not set or on error)
 312  */
 313 void *OSSL_CMP_CTX_get_certConf_cb_arg(const OSSL_CMP_CTX *ctx)
 314 {
 315     if (ctx == NULL) {
 316         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
 317         return NULL;
 318     }
 319     return ctx->certConf_cb_arg;
 320 }
 321
 322 #ifndef OPENSSL_NO_TRACE
 323 static size_t ossl_cmp_log_trace_cb(const char *buf, size_t cnt,
 324                                     int category, int cmd, void *vdata)
 325 {
 326     OSSL_CMP_CTX *ctx = vdata;
 327     const char *msg;
 328     OSSL_CMP_severity level = -1;
 329     char *func = NULL;
 330     char *file = NULL;
 331     int line = 0;
 332
 333     if (buf == NULL || cnt == 0 || cmd != OSSL_TRACE_CTRL_WRITE || ctx == NULL)
 334         return 0;
 335     if (ctx->log_cb == NULL)
 336         return 1; /* silently drop message */
 337
 338     msg = ossl_cmp_log_parse_metadata(buf, &level, &func, &file, &line);
 339
 340     if (level > ctx->log_verbosity) /* excludes the case level is unknown */
 341         goto end; /* suppress output since severity is not sufficient */
 342
 343     if (!ctx->log_cb(func != NULL ? func : "(no func)",
 344                      file != NULL ? file : "(no file)",
 345                      line, level, msg))
 346         cnt = 0;
 347
 348  end:
 349     OPENSSL_free(func);
 350     OPENSSL_free(file);
 351     return cnt;
 352 }
 353 #endif
 354
 355 /* Print CMP log messages (i.e., diagnostic info) via the log cb of the ctx */
 356 int ossl_cmp_print_log(OSSL_CMP_severity level, const OSSL_CMP_CTX *ctx,
 357                        const char *func, const char *file, int line,
 358                        const char *level_str, const char *format, ...)
 359 {
 360     va_list args;
 361     char hugebuf[1024 * 2];
 362     int res = 0;
 363
 364     if (ctx == NULL || ctx->log_cb == NULL)
 365         return 1; /* silently drop message */
 366
 367     if (level > ctx->log_verbosity) /* excludes the case level is unknown */
 368         return 1; /* suppress output since severity is not sufficient */
 369
 370     if (format == NULL)
 371         return 0;
 372
 373     va_start(args, format);
 374
 375     if (func == NULL)
 376         func = "(unset function name)";
 377     if (file == NULL)
 378         file = "(unset file name)";
 379     if (level_str == NULL)
 380         level_str = "(unset level string)";
 381
 382 #ifndef OPENSSL_NO_TRACE
 383     if (OSSL_TRACE_ENABLED(CMP)) {
 384         OSSL_TRACE_BEGIN(CMP) {
 385             int printed =
 386                 BIO_snprintf(hugebuf, sizeof(hugebuf),
 387                              "%s:%s:%d:" OSSL_CMP_LOG_PREFIX "%s: ",
 388                              func, file, line, level_str);
 389             if (printed > 0 && (size_t)printed < sizeof(hugebuf)) {
 390                 if (BIO_vsnprintf(hugebuf + printed,
 391                                   sizeof(hugebuf) - printed, format, args) > 0)
 392                     res = BIO_puts(trc_out, hugebuf) > 0;
 393             }
 394         } OSSL_TRACE_END(CMP);
 395     }
 396 #else /* compensate for disabled trace API */
 397     {
 398         if (BIO_vsnprintf(hugebuf, sizeof(hugebuf), format, args) > 0)
 399             res = ctx->log_cb(func, file, line, level, hugebuf);
 400     }
 401 #endif
 402     va_end(args);
 403     return res;
 404 }
 405
 406 /* Set a callback function for error reporting and logging messages */
 407 int OSSL_CMP_CTX_set_log_cb(OSSL_CMP_CTX *ctx, OSSL_CMP_log_cb_t cb)
 408 {
 409     if (ctx == NULL) {
 410         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
 411         return 0;
 412     }
 413     ctx->log_cb = cb;
 414
 415 #ifndef OPENSSL_NO_TRACE
 416     /* do also in case cb == NULL, to switch off logging output: */
 417     if (!OSSL_trace_set_callback(OSSL_TRACE_CATEGORY_CMP,
 418                                  ossl_cmp_log_trace_cb, ctx))
 419         return 0;
 420 #endif
 421
 422     return 1;
 423 }
 424
 425 /* Print OpenSSL and CMP errors via the log cb of the ctx or ERR_print_errors */
 426 void OSSL_CMP_CTX_print_errors(const OSSL_CMP_CTX *ctx)
 427 {
 428     if (ctx != NULL && OSSL_CMP_LOG_ERR > ctx->log_verbosity)
 429         return; /* suppress output since severity is not sufficient */
 430     OSSL_CMP_print_errors_cb(ctx == NULL ? NULL : ctx->log_cb);
 431 }
 432
 433 /*
 434  * Set or clear the reference value to be used for identification
 435  * (i.e., the user name) when using PBMAC.
 436  */
 437 int OSSL_CMP_CTX_set1_referenceValue(OSSL_CMP_CTX *ctx,
 438                                      const unsigned char *ref, int len)
 439 {
 440     if (ctx == NULL) {
 441         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
 442         return 0;
 443     }
 444     return ossl_cmp_asn1_octet_string_set1_bytes(&ctx->referenceValue, ref,
 445                                                  len);
 446 }
 447
 448 /* Set or clear the password to be used for protecting messages with PBMAC */
 449 int OSSL_CMP_CTX_set1_secretValue(OSSL_CMP_CTX *ctx, const unsigned char *sec,
 450                                   const int len)
 451 {
 452     ASN1_OCTET_STRING *secretValue = NULL;
 453     if (ctx == NULL) {
 454         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
 455         return 0;
 456     }
 457     if (ossl_cmp_asn1_octet_string_set1_bytes(&secretValue, sec, len) != 1)
 458         return 0;
 459     if (ctx->secretValue != NULL) {
 460         OPENSSL_cleanse(ctx->secretValue->data, ctx->secretValue->length);
 461         ASN1_OCTET_STRING_free(ctx->secretValue);
 462     }
 463     ctx->secretValue = secretValue;
 464     return 1;
 465 }
 466
 467 /* Returns the cert chain computed by OSSL_CMP_certConf_cb(), NULL on error */
 468 STACK_OF(X509) *OSSL_CMP_CTX_get1_newChain(const OSSL_CMP_CTX *ctx)
 469 {
 470     if (ctx == NULL) {
 471         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
 472         return NULL;
 473     }
 474     return X509_chain_up_ref(ctx->newChain);
 475 }
 476
 477 /*
 478  * Copies any given stack of inbound X509 certificates to newChain
 479  * of the OSSL_CMP_CTX structure so that they may be retrieved later.
 480  */
 481 int ossl_cmp_ctx_set1_newChain(OSSL_CMP_CTX *ctx, STACK_OF(X509) *newChain)
 482 {
 483     if (!ossl_assert(ctx != NULL))
 484         return 0;
 485
 486     sk_X509_pop_free(ctx->newChain, X509_free);
 487     ctx->newChain = NULL;
 488     return newChain == NULL ||
 489         (ctx->newChain = X509_chain_up_ref(newChain)) != NULL;
 490 }
 491
 492 /* Returns the stack of extraCerts received in CertRepMessage, NULL on error */
 493 STACK_OF(X509) *OSSL_CMP_CTX_get1_extraCertsIn(const OSSL_CMP_CTX *ctx)
 494 {
 495     if (ctx == NULL) {
 496         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
 497         return NULL;
 498     }
 499     return X509_chain_up_ref(ctx->extraCertsIn);
 500 }
 501
 502 /*
 503  * Copies any given stack of inbound X509 certificates to extraCertsIn
 504  * of the OSSL_CMP_CTX structure so that they may be retrieved later.
 505  */
 506 int ossl_cmp_ctx_set1_extraCertsIn(OSSL_CMP_CTX *ctx,
 507                                    STACK_OF(X509) *extraCertsIn)
 508 {
 509     if (!ossl_assert(ctx != NULL))
 510         return 0;
 511
 512     sk_X509_pop_free(ctx->extraCertsIn, X509_free);
 513     ctx->extraCertsIn = NULL;
 514     return extraCertsIn == NULL
 515         || (ctx->extraCertsIn = X509_chain_up_ref(extraCertsIn)) != NULL;
 516 }
 517
 518 /*
 519  * Copies any given stack as the new stack of X509
 520  * certificates to send out in the extraCerts field.
 521  */
 522 int OSSL_CMP_CTX_set1_extraCertsOut(OSSL_CMP_CTX *ctx,
 523                                     STACK_OF(X509) *extraCertsOut)
 524 {
 525     if (ctx == NULL) {
 526         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
 527         return 0;
 528     }
 529
 530     sk_X509_pop_free(ctx->extraCertsOut, X509_free);
 531     ctx->extraCertsOut = NULL;
 532     return extraCertsOut == NULL
 533         || (ctx->extraCertsOut = X509_chain_up_ref(extraCertsOut)) != NULL;
 534 }
 535
 536 /*
 537  * Add the given policy info object
 538  * to the X509_EXTENSIONS of the requested certificate template.
 539  */
 540 int OSSL_CMP_CTX_push0_policy(OSSL_CMP_CTX *ctx, POLICYINFO *pinfo)
 541 {
 542     if (ctx == NULL || pinfo == NULL) {
 543         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
 544         return 0;
 545     }
 546
 547     if (ctx->policies == NULL
 548             && (ctx->policies = CERTIFICATEPOLICIES_new()) == NULL)
 549         return 0;
 550
 551     return sk_POLICYINFO_push(ctx->policies, pinfo);
 552 }
 553
 554 /* Add an ITAV for geninfo of the PKI message header */
 555 int OSSL_CMP_CTX_push0_geninfo_ITAV(OSSL_CMP_CTX *ctx, OSSL_CMP_ITAV *itav)
 556 {
 557     if (ctx == NULL) {
 558         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
 559         return 0;
 560     }
 561     return OSSL_CMP_ITAV_push0_stack_item(&ctx->geninfo_ITAVs, itav);
 562 }
 563
 564 /* Add an itav for the body of outgoing general messages */
 565 int OSSL_CMP_CTX_push0_genm_ITAV(OSSL_CMP_CTX *ctx, OSSL_CMP_ITAV *itav)
 566 {
 567     if (ctx == NULL) {
 568         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
 569         return 0;
 570     }
 571     return OSSL_CMP_ITAV_push0_stack_item(&ctx->genm_ITAVs, itav);
 572 }
 573
 574 /*
 575  * Returns a duplicate of the stack of X509 certificates that
 576  * were received in the caPubs field of the last CertRepMessage.
 577  * Returns NULL on error
 578  */
 579 STACK_OF(X509) *OSSL_CMP_CTX_get1_caPubs(const OSSL_CMP_CTX *ctx)
 580 {
 581     if (ctx == NULL) {
 582         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
 583         return NULL;
 584     }
 585     return X509_chain_up_ref(ctx->caPubs);
 586 }
 587
 588 /*
 589  * Copies any given stack of certificates to the given
 590  * OSSL_CMP_CTX structure so that they may be retrieved later.
 591  */
 592 int ossl_cmp_ctx_set1_caPubs(OSSL_CMP_CTX *ctx, STACK_OF(X509) *caPubs)
 593 {
 594     if (!ossl_assert(ctx != NULL))
 595         return 0;
 596
 597     sk_X509_pop_free(ctx->caPubs, X509_free);
 598     ctx->caPubs = NULL;
 599     return caPubs == NULL || (ctx->caPubs = X509_chain_up_ref(caPubs)) != NULL;
 600 }
 601
 602 #define char_dup OPENSSL_strdup
 603 #define char_free OPENSSL_free
 604 #define DEFINE_OSSL_CMP_CTX_set1(FIELD, TYPE) /* this uses _dup */ \
 605 int OSSL_CMP_CTX_set1_##FIELD(OSSL_CMP_CTX *ctx, const TYPE *val) \
 606 { \
 607     TYPE *val_dup = NULL; \
 608     \
 609     if (ctx == NULL) { \
 610         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT); \
 611         return 0; \
 612     } \
 613     \
 614     if (val != NULL && (val_dup = TYPE##_dup(val)) == NULL) \
 615         return 0; \
 616     TYPE##_free(ctx->FIELD); \
 617     ctx->FIELD = val_dup; \
 618     return 1; \
 619 }
 620
 621 #define X509_invalid(cert) (!ossl_x509v3_cache_extensions(cert))
 622 #define EVP_PKEY_invalid(key) 0
 623 #define DEFINE_OSSL_CMP_CTX_set1_up_ref(FIELD, TYPE) \
 624 int OSSL_CMP_CTX_set1_##FIELD(OSSL_CMP_CTX *ctx, TYPE *val) \
 625 { \
 626     if (ctx == NULL) { \
 627         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT); \
 628         return 0; \
 629     } \
 630     \
 631     /* prevent misleading error later on malformed cert or provider issue */ \
 632     if (val != NULL && TYPE##_invalid(val)) { \
 633         ERR_raise(ERR_LIB_CMP, CMP_R_POTENTIALLY_INVALID_CERTIFICATE); \
 634         return 0; \
 635     } \
 636     if (val != NULL && !TYPE##_up_ref(val)) \
 637         return 0; \
 638     TYPE##_free(ctx->FIELD); \
 639     ctx->FIELD = val; \
 640     return 1; \
 641 }
 642
 643 /*
 644  * Pins the server certificate to be directly trusted (even if it is expired)
 645  * for verifying response messages.
 646  * Cert pointer is not consumed. It may be NULL to clear the entry.
 647  */
 648 DEFINE_OSSL_CMP_CTX_set1_up_ref(srvCert, X509)
 649
 650 /* Set the X509 name of the recipient. Set in the PKIHeader */
 651 DEFINE_OSSL_CMP_CTX_set1(recipient, X509_NAME)
 652
 653 /* Store the X509 name of the expected sender in the PKIHeader of responses */
 654 DEFINE_OSSL_CMP_CTX_set1(expected_sender, X509_NAME)
 655
 656 /* Set the X509 name of the issuer. Set in the PKIHeader */
 657 DEFINE_OSSL_CMP_CTX_set1(issuer, X509_NAME)
 658
 659 /*
 660  * Set the subject name that will be placed in the certificate
 661  * request. This will be the subject name on the received certificate.
 662  */
 663 DEFINE_OSSL_CMP_CTX_set1(subjectName, X509_NAME)
 664
 665 /* Set the X.509v3 certificate request extensions to be used in IR/CR/KUR */
 666 int OSSL_CMP_CTX_set0_reqExtensions(OSSL_CMP_CTX *ctx, X509_EXTENSIONS *exts)
 667 {
 668     if (ctx == NULL) {
 669         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
 670         return 0;
 671     }
 672
 673     if (sk_GENERAL_NAME_num(ctx->subjectAltNames) > 0 && exts != NULL
 674             && X509v3_get_ext_by_NID(exts, NID_subject_alt_name, -1) >= 0) {
 675         ERR_raise(ERR_LIB_CMP, CMP_R_MULTIPLE_SAN_SOURCES);
 676         return 0;
 677     }
 678     sk_X509_EXTENSION_pop_free(ctx->reqExtensions, X509_EXTENSION_free);
 679     ctx->reqExtensions = exts;
 680     return 1;
 681 }
 682
 683 /* returns 1 if ctx contains a Subject Alternative Name extension, else 0 */
 684 int OSSL_CMP_CTX_reqExtensions_have_SAN(OSSL_CMP_CTX *ctx)
 685 {
 686     if (ctx == NULL) {
 687         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
 688         return -1;
 689     }
 690     /* if one of the following conditions 'fail' this is not an error */
 691     return ctx->reqExtensions != NULL
 692         && X509v3_get_ext_by_NID(ctx->reqExtensions,
 693                                  NID_subject_alt_name, -1) >= 0;
 694 }
 695
 696 /*
 697  * Add a GENERAL_NAME structure that will be added to the CRMF
 698  * request's extensions field to request subject alternative names.
 699  */
 700 int OSSL_CMP_CTX_push1_subjectAltName(OSSL_CMP_CTX *ctx,
 701                                       const GENERAL_NAME *name)
 702 {
 703     GENERAL_NAME *name_dup;
 704
 705     if (ctx == NULL || name == NULL) {
 706         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
 707         return 0;
 708     }
 709
 710     if (OSSL_CMP_CTX_reqExtensions_have_SAN(ctx) == 1) {
 711         ERR_raise(ERR_LIB_CMP, CMP_R_MULTIPLE_SAN_SOURCES);
 712         return 0;
 713     }
 714
 715     if (ctx->subjectAltNames == NULL
 716             && (ctx->subjectAltNames = sk_GENERAL_NAME_new_null()) == NULL)
 717         return 0;
 718     if ((name_dup = GENERAL_NAME_dup(name)) == NULL)
 719         return 0;
 720     if (!sk_GENERAL_NAME_push(ctx->subjectAltNames, name_dup)) {
 721         GENERAL_NAME_free(name_dup);
 722         return 0;
 723     }
 724     return 1;
 725 }
 726
 727 /*
 728  * Set our own client certificate, used for example in KUR and when
 729  * doing the IR with existing certificate.
 730  */
 731 DEFINE_OSSL_CMP_CTX_set1_up_ref(cert, X509)
 732
 733 int OSSL_CMP_CTX_build_cert_chain(OSSL_CMP_CTX *ctx, X509_STORE *own_trusted,
 734                                   STACK_OF(X509) *candidates)
 735 {
 736     STACK_OF(X509) *chain;
 737
 738     if (ctx == NULL) {
 739         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
 740         return 0;
 741     }
 742
 743     if (!ossl_x509_add_certs_new(&ctx->untrusted, candidates,
 744                                  X509_ADD_FLAG_UP_REF | X509_ADD_FLAG_NO_DUP))
 745         return 0;
 746
 747     ossl_cmp_debug(ctx, "trying to build chain for own CMP signer cert");
 748     chain = X509_build_chain(ctx->cert, ctx->untrusted, own_trusted, 0,
 749                              ctx->libctx, ctx->propq);
 750     if (chain == NULL) {
 751         ERR_raise(ERR_LIB_CMP, CMP_R_FAILED_BUILDING_OWN_CHAIN);
 752         return 0;
 753     }
 754     ossl_cmp_debug(ctx, "success building chain for own CMP signer cert");
 755     ctx->chain = chain;
 756     return 1;
 757 }
 758
 759 /*
 760  * Set the old certificate that we are updating in KUR
 761  * or the certificate to be revoked in RR, respectively.
 762  * Also used as reference cert (defaulting to cert) for deriving subject DN
 763  * and SANs. Its issuer is used as default recipient in the CMP message header.
 764  */
 765 DEFINE_OSSL_CMP_CTX_set1_up_ref(oldCert, X509)
 766
 767 /* Set the PKCS#10 CSR to be sent in P10CR */
 768 DEFINE_OSSL_CMP_CTX_set1(p10CSR, X509_REQ)
 769
 770 /*
 771  * Set the (newly received in IP/KUP/CP) certificate in the context.
 772  * TODO: this only permits for one cert to be enrolled at a time.
 773  */
 774 int ossl_cmp_ctx_set0_newCert(OSSL_CMP_CTX *ctx, X509 *cert)
 775 {
 776     if (!ossl_assert(ctx != NULL))
 777         return 0;
 778
 779     X509_free(ctx->newCert);
 780     ctx->newCert = cert;
 781     return 1;
 782 }
 783
 784 /*
 785  * Get the (newly received in IP/KUP/CP) client certificate from the context
 786  * TODO: this only permits for one client cert to be received...
 787  */
 788 X509 *OSSL_CMP_CTX_get0_newCert(const OSSL_CMP_CTX *ctx)
 789 {
 790     if (ctx == NULL) {
 791         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
 792         return NULL;
 793     }
 794     return ctx->newCert;
 795 }
 796
 797 /* Set the client's current private key */
 798 DEFINE_OSSL_CMP_CTX_set1_up_ref(pkey, EVP_PKEY)
 799
 800 /* Set new key pair. Used e.g. when doing Key Update */
 801 int OSSL_CMP_CTX_set0_newPkey(OSSL_CMP_CTX *ctx, int priv, EVP_PKEY *pkey)
 802 {
 803     if (ctx == NULL) {
 804         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
 805         return 0;
 806     }
 807
 808     EVP_PKEY_free(ctx->newPkey);
 809     ctx->newPkey = pkey;
 810     ctx->newPkey_priv = priv;
 811     return 1;
 812 }
 813
 814 /* Get the private/public key to use for cert enrollment, or NULL on error */
 815 EVP_PKEY *OSSL_CMP_CTX_get0_newPkey(const OSSL_CMP_CTX *ctx, int priv)
 816 {
 817     if (ctx == NULL) {
 818         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
 819         return NULL;
 820     }
 821
 822     if (ctx->newPkey != NULL)
 823         return priv && !ctx->newPkey_priv ? NULL : ctx->newPkey;
 824     if (ctx->p10CSR != NULL)
 825         return priv ? NULL : X509_REQ_get0_pubkey(ctx->p10CSR);
 826     return ctx->pkey; /* may be NULL */
 827 }
 828
 829 /* Set the given transactionID to the context */
 830 int OSSL_CMP_CTX_set1_transactionID(OSSL_CMP_CTX *ctx,
 831                                     const ASN1_OCTET_STRING *id)
 832 {
 833     if (ctx == NULL) {
 834         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
 835         return 0;
 836     }
 837     return ossl_cmp_asn1_octet_string_set1(&ctx->transactionID, id);
 838 }
 839
 840 /* Set the nonce to be used for the recipNonce in the message created next */
 841 int ossl_cmp_ctx_set1_recipNonce(OSSL_CMP_CTX *ctx,
 842                                  const ASN1_OCTET_STRING *nonce)
 843 {
 844     if (!ossl_assert(ctx != NULL))
 845         return 0;
 846     return ossl_cmp_asn1_octet_string_set1(&ctx->recipNonce, nonce);
 847 }
 848
 849 /* Stores the given nonce as the last senderNonce sent out */
 850 int OSSL_CMP_CTX_set1_senderNonce(OSSL_CMP_CTX *ctx,
 851                                   const ASN1_OCTET_STRING *nonce)
 852 {
 853     if (ctx == NULL) {
 854         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
 855         return 0;
 856     }
 857     return ossl_cmp_asn1_octet_string_set1(&ctx->senderNonce, nonce);
 858 }
 859
 860 /* Set the proxy server to use for HTTP(S) connections */
 861 DEFINE_OSSL_CMP_CTX_set1(proxy, char)
 862
 863 /* Set the (HTTP) host name of the CMP server */
 864 DEFINE_OSSL_CMP_CTX_set1(server, char)
 865
 866 /* Set the server exclusion list of the HTTP proxy server */
 867 DEFINE_OSSL_CMP_CTX_set1(no_proxy, char)
 868
 869 /* Set the http connect/disconnect callback function to be used for HTTP(S) */
 870 int OSSL_CMP_CTX_set_http_cb(OSSL_CMP_CTX *ctx, OSSL_HTTP_bio_cb_t cb)
 871 {
 872     if (ctx == NULL) {
 873         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
 874         return 0;
 875     }
 876     ctx->http_cb = cb;
 877     return 1;
 878 }
 879
 880 /* Set argument optionally to be used by the http connect/disconnect callback */
 881 int OSSL_CMP_CTX_set_http_cb_arg(OSSL_CMP_CTX *ctx, void *arg)
 882 {
 883     if (ctx == NULL) {
 884         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
 885         return 0;
 886     }
 887     ctx->http_cb_arg = arg;
 888     return 1;
 889 }
 890
 891 /*
 892  * Get argument optionally to be used by the http connect/disconnect callback
 893  * Returns callback argument set previously (NULL if not set or on error)
 894  */
 895 void *OSSL_CMP_CTX_get_http_cb_arg(const OSSL_CMP_CTX *ctx)
 896 {
 897     if (ctx == NULL) {
 898         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
 899         return NULL;
 900     }
 901     return ctx->http_cb_arg;
 902 }
 903
 904 /* Set callback function for sending CMP request and receiving response */
 905 int OSSL_CMP_CTX_set_transfer_cb(OSSL_CMP_CTX *ctx, OSSL_CMP_transfer_cb_t cb)
 906 {
 907     if (ctx == NULL) {
 908         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
 909         return 0;
 910     }
 911     ctx->transfer_cb = cb;
 912     return 1;
 913 }
 914
 915 /* Set argument optionally to be used by the transfer callback */
 916 int OSSL_CMP_CTX_set_transfer_cb_arg(OSSL_CMP_CTX *ctx, void *arg)
 917 {
 918     if (ctx == NULL) {
 919         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
 920         return 0;
 921     }
 922     ctx->transfer_cb_arg = arg;
 923     return 1;
 924 }
 925
 926 /*
 927  * Get argument optionally to be used by the transfer callback.
 928  * Returns callback argument set previously (NULL if not set or on error)
 929  */
 930 void *OSSL_CMP_CTX_get_transfer_cb_arg(const OSSL_CMP_CTX *ctx)
 931 {
 932     if (ctx == NULL) {
 933         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
 934         return NULL;
 935     }
 936     return ctx->transfer_cb_arg;
 937 }
 938
 939 /** Set the HTTP server port to be used */
 940 int OSSL_CMP_CTX_set_serverPort(OSSL_CMP_CTX *ctx, int port)
 941 {
 942     if (ctx == NULL) {
 943         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
 944         return 0;
 945     }
 946     ctx->serverPort = port;
 947     return 1;
 948 }
 949
 950 /* Set the HTTP path to be used on the server (e.g "pkix/") */
 951 DEFINE_OSSL_CMP_CTX_set1(serverPath, char)
 952
 953 /* Set the failInfo error code as bit encoding in OSSL_CMP_CTX */
 954 int ossl_cmp_ctx_set_failInfoCode(OSSL_CMP_CTX *ctx, int fail_info)
 955 {
 956     if (!ossl_assert(ctx != NULL))
 957         return 0;
 958     ctx->failInfoCode = fail_info;
 959     return 1;
 960 }
 961
 962 /*
 963  * Get the failInfo error code in OSSL_CMP_CTX as bit encoding.
 964  * Returns bit string as integer on success, -1 on error
 965  */
 966 int OSSL_CMP_CTX_get_failInfoCode(const OSSL_CMP_CTX *ctx)
 967 {
 968     if (ctx == NULL) {
 969         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
 970         return -1;
 971     }
 972     return ctx->failInfoCode;
 973 }
 974
 975 /* Set a Boolean or integer option of the context to the "val" arg */
 976 int OSSL_CMP_CTX_set_option(OSSL_CMP_CTX *ctx, int opt, int val)
 977 {
 978     int min_val;
 979
 980     if (ctx == NULL) {
 981         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
 982         return 0;
 983     }
 984
 985     switch (opt) {
 986     case OSSL_CMP_OPT_REVOCATION_REASON:
 987         min_val = OCSP_REVOKED_STATUS_NOSTATUS;
 988         break;
 989     case OSSL_CMP_OPT_POPO_METHOD:
 990         min_val = OSSL_CRMF_POPO_NONE;
 991         break;
 992     default:
 993         min_val = 0;
 994         break;
 995     }
 996     if (val < min_val) {
 997         ERR_raise(ERR_LIB_CMP, CMP_R_VALUE_TOO_SMALL);
 998         return 0;
 999     }
1000
1001     switch (opt) {
1002     case OSSL_CMP_OPT_LOG_VERBOSITY:
1003         if (val > OSSL_CMP_LOG_MAX) {
1004             ERR_raise(ERR_LIB_CMP, CMP_R_VALUE_TOO_LARGE);
1005             return 0;
1006         }
1007         ctx->log_verbosity = val;
1008         break;
1009     case OSSL_CMP_OPT_IMPLICIT_CONFIRM:
1010         ctx->implicitConfirm = val;
1011         break;
1012     case OSSL_CMP_OPT_DISABLE_CONFIRM:
1013         ctx->disableConfirm = val;
1014         break;
1015     case OSSL_CMP_OPT_UNPROTECTED_SEND:
1016         ctx->unprotectedSend = val;
1017         break;
1018     case OSSL_CMP_OPT_UNPROTECTED_ERRORS:
1019         ctx->unprotectedErrors = val;
1020         break;
1021     case OSSL_CMP_OPT_VALIDITY_DAYS:
1022         ctx->days = val;
1023         break;
1024     case OSSL_CMP_OPT_SUBJECTALTNAME_NODEFAULT:
1025         ctx->SubjectAltName_nodefault = val;
1026         break;
1027     case OSSL_CMP_OPT_SUBJECTALTNAME_CRITICAL:
1028         ctx->setSubjectAltNameCritical = val;
1029         break;
1030     case OSSL_CMP_OPT_POLICIES_CRITICAL:
1031         ctx->setPoliciesCritical = val;
1032         break;
1033     case OSSL_CMP_OPT_IGNORE_KEYUSAGE:
1034         ctx->ignore_keyusage = val;
1035         break;
1036     case OSSL_CMP_OPT_POPO_METHOD:
1037         if (val > OSSL_CRMF_POPO_KEYAGREE) {
1038             ERR_raise(ERR_LIB_CMP, CMP_R_VALUE_TOO_LARGE);
1039             return 0;
1040         }
1041         ctx->popoMethod = val;
1042         break;
1043     case OSSL_CMP_OPT_DIGEST_ALGNID:
1044         if (!cmp_ctx_set_md(ctx, &ctx->digest, val))
1045             return 0;
1046         break;
1047     case OSSL_CMP_OPT_OWF_ALGNID:
1048         if (!cmp_ctx_set_md(ctx, &ctx->pbm_owf, val))
1049             return 0;
1050         break;
1051     case OSSL_CMP_OPT_MAC_ALGNID:
1052         ctx->pbm_mac = val;
1053         break;
1054     case OSSL_CMP_OPT_KEEP_ALIVE:
1055         ctx->keep_alive = val;
1056         break;
1057     case OSSL_CMP_OPT_MSG_TIMEOUT:
1058         ctx->msg_timeout = val;
1059         break;
1060     case OSSL_CMP_OPT_TOTAL_TIMEOUT:
1061         ctx->total_timeout = val;
1062         break;
1063     case OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR:
1064         ctx->permitTAInExtraCertsForIR = val;
1065         break;
1066     case OSSL_CMP_OPT_REVOCATION_REASON:
1067         if (val > OCSP_REVOKED_STATUS_AACOMPROMISE) {
1068             ERR_raise(ERR_LIB_CMP, CMP_R_VALUE_TOO_LARGE);
1069             return 0;
1070         }
1071         ctx->revocationReason = val;
1072         break;
1073     default:
1074         ERR_raise(ERR_LIB_CMP, CMP_R_INVALID_OPTION);
1075         return 0;
1076     }
1077
1078     return 1;
1079 }
1080
1081 /*
1082  * Reads a Boolean or integer option value from the context.
1083  * Returns -1 on error (which is the default OSSL_CMP_OPT_REVOCATION_REASON)
1084  */
1085 int OSSL_CMP_CTX_get_option(const OSSL_CMP_CTX *ctx, int opt)
1086 {
1087     if (ctx == NULL) {
1088         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
1089         return -1;
1090     }
1091
1092     switch (opt) {
1093     case OSSL_CMP_OPT_LOG_VERBOSITY:
1094         return ctx->log_verbosity;
1095     case OSSL_CMP_OPT_IMPLICIT_CONFIRM:
1096         return ctx->implicitConfirm;
1097     case OSSL_CMP_OPT_DISABLE_CONFIRM:
1098         return ctx->disableConfirm;
1099     case OSSL_CMP_OPT_UNPROTECTED_SEND:
1100         return ctx->unprotectedSend;
1101     case OSSL_CMP_OPT_UNPROTECTED_ERRORS:
1102         return ctx->unprotectedErrors;
1103     case OSSL_CMP_OPT_VALIDITY_DAYS:
1104         return ctx->days;
1105     case OSSL_CMP_OPT_SUBJECTALTNAME_NODEFAULT:
1106         return ctx->SubjectAltName_nodefault;
1107     case OSSL_CMP_OPT_SUBJECTALTNAME_CRITICAL:
1108         return ctx->setSubjectAltNameCritical;
1109     case OSSL_CMP_OPT_POLICIES_CRITICAL:
1110         return ctx->setPoliciesCritical;
1111     case OSSL_CMP_OPT_IGNORE_KEYUSAGE:
1112         return ctx->ignore_keyusage;
1113     case OSSL_CMP_OPT_POPO_METHOD:
1114         return ctx->popoMethod;
1115     case OSSL_CMP_OPT_DIGEST_ALGNID:
1116         return EVP_MD_type(ctx->digest);
1117     case OSSL_CMP_OPT_OWF_ALGNID:
1118         return EVP_MD_type(ctx->pbm_owf);
1119     case OSSL_CMP_OPT_MAC_ALGNID:
1120         return ctx->pbm_mac;
1121     case OSSL_CMP_OPT_KEEP_ALIVE:
1122         return ctx->keep_alive;
1123     case OSSL_CMP_OPT_MSG_TIMEOUT:
1124         return ctx->msg_timeout;
1125     case OSSL_CMP_OPT_TOTAL_TIMEOUT:
1126         return ctx->total_timeout;
1127     case OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR:
1128         return ctx->permitTAInExtraCertsForIR;
1129     case OSSL_CMP_OPT_REVOCATION_REASON:
1130         return ctx->revocationReason;
1131     default:
1132         ERR_raise(ERR_LIB_CMP, CMP_R_INVALID_OPTION);
1133         return -1;
1134     }
1135 }