cmp_client.c

Last change on this file was 109052, checked in by vboxsync, 3 weeks ago
openssl-3.4.1: Applied our changes, regenerated files, added missing files and functions. This time with a three way merge. bugref:10890
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 38.1 KB

Line
1	/*
2	* Copyright 2007-2024 The OpenSSL Project Authors. All Rights Reserved.
3	* Copyright Nokia 2007-2019
4	* Copyright Siemens AG 2015-2019
5	*
6	* Licensed under the Apache License 2.0 (the "License"). You may not use
7	* this file except in compliance with the License. You can obtain a copy
8	* in the file LICENSE in the source distribution or at
9	* https://www.openssl.org/source/license.html
10	*/
11
12	#include "cmp_local.h"
13	#include "internal/cryptlib.h"
14
15	/* explicit #includes not strictly needed since implied by the above: */
16	#include <openssl/bio.h>
17	#include <openssl/cmp.h>
18	#include <openssl/err.h>
19	#include <openssl/evp.h>
20	#include <openssl/x509v3.h>
21	#include <openssl/cmp_util.h>
22
23	#define IS_CREP(t) ((t) == OSSL_CMP_PKIBODY_IP \|\| (t) == OSSL_CMP_PKIBODY_CP \
24	\|\| (t) == OSSL_CMP_PKIBODY_KUP)
25
26	/*-
27	* Evaluate whether there's an exception (violating the standard) configured for
28	* handling negative responses without protection or with invalid protection.
29	* Returns 1 on acceptance, 0 on rejection, or -1 on (internal) error.
30	*/
31	static int unprotected_exception(const OSSL_CMP_CTX *ctx,
32	const OSSL_CMP_MSG *rep,
33	int invalid_protection,
34	ossl_unused int expected_type)
35	{
36	int rcvd_type = OSSL_CMP_MSG_get_bodytype(rep /* may be NULL */);
37	const char *msg_type = NULL;
38
39	if (!ossl_assert(ctx != NULL && rep != NULL))
40	return -1;
41
42	if (!ctx->unprotectedErrors)
43	return 0;
44
45	switch (rcvd_type) {
46	case OSSL_CMP_PKIBODY_ERROR:
47	msg_type = "error response";
48	break;
49	case OSSL_CMP_PKIBODY_RP:
50	{
51	OSSL_CMP_PKISI *si =
52	ossl_cmp_revrepcontent_get_pkisi(rep->body->value.rp,
53	OSSL_CMP_REVREQSID);
54
55	if (si == NULL)
56	return -1;
57	if (ossl_cmp_pkisi_get_status(si) == OSSL_CMP_PKISTATUS_rejection)
58	msg_type = "revocation response message with rejection status";
59	break;
60	}
61	case OSSL_CMP_PKIBODY_PKICONF:
62	msg_type = "PKI Confirmation message";
63	break;
64	default:
65	if (IS_CREP(rcvd_type)) {
66	int any_rid = OSSL_CMP_CERTREQID_NONE;
67	OSSL_CMP_CERTREPMESSAGE *crepmsg = rep->body->value.ip;
68	OSSL_CMP_CERTRESPONSE *crep =
69	ossl_cmp_certrepmessage_get0_certresponse(crepmsg, any_rid);
70
71	if (sk_OSSL_CMP_CERTRESPONSE_num(crepmsg->response) > 1)
72	return -1;
73	if (crep == NULL)
74	return -1;
75	if (ossl_cmp_pkisi_get_status(crep->status)
76	== OSSL_CMP_PKISTATUS_rejection)
77	msg_type = "CertRepMessage with rejection status";
78	}
79	}
80	if (msg_type == NULL)
81	return 0;
82	ossl_cmp_log2(WARN, ctx, "ignoring %s protection of %s",
83	invalid_protection ? "invalid" : "missing", msg_type);
84	return 1;
85	}
86
87	/* Save error info from PKIStatusInfo field of a certresponse into ctx */
88	static int save_statusInfo(OSSL_CMP_CTX ctx, OSSL_CMP_PKISI si)
89	{
90	int i;
91	OSSL_CMP_PKIFREETEXT *ss;
92
93	if (!ossl_assert(ctx != NULL && si != NULL))
94	return 0;
95
96	ctx->status = ossl_cmp_pkisi_get_status(si);
97	if (ctx->status < OSSL_CMP_PKISTATUS_accepted)
98	return 0;
99
100	ctx->failInfoCode = ossl_cmp_pkisi_get_pkifailureinfo(si);
101
102	if (!ossl_cmp_ctx_set0_statusString(ctx, sk_ASN1_UTF8STRING_new_null())
103	\|\| (ctx->statusString == NULL))
104	return 0;
105
106	ss = si->statusString; /* may be NULL */
107	for (i = 0; i < sk_ASN1_UTF8STRING_num(ss); i++) {
108	ASN1_UTF8STRING *str = sk_ASN1_UTF8STRING_value(ss, i);
109	ASN1_UTF8STRING *dup = ASN1_STRING_dup(str);
110
111	if (dup == NULL \|\| !sk_ASN1_UTF8STRING_push(ctx->statusString, dup)) {
112	ASN1_UTF8STRING_free(dup);
113	return 0;
114	}
115	}
116	return 1;
117	}
118
119	static int is_crep_with_waiting(const OSSL_CMP_MSG *resp, int rid)
120	{
121	OSSL_CMP_CERTREPMESSAGE *crepmsg;
122	OSSL_CMP_CERTRESPONSE *crep;
123	int bt = OSSL_CMP_MSG_get_bodytype(resp);
124
125	if (!IS_CREP(bt))
126	return 0;
127
128	crepmsg = resp->body->value.ip; /* same for cp and kup */
129	crep = ossl_cmp_certrepmessage_get0_certresponse(crepmsg, rid);
130
131	return (crep != NULL
132	&& ossl_cmp_pkisi_get_status(crep->status)
133	== OSSL_CMP_PKISTATUS_waiting);
134	}
135
136	/*-
137	* Perform the generic aspects of sending a request and receiving a response.
138	* Returns 1 on success and provides the received PKIMESSAGE in *rep.
139	* Returns 0 on error.
140	* Regardless of success, caller is responsible for freeing *rep (unless NULL).
141	*/
142	static int send_receive_check(OSSL_CMP_CTX ctx, const OSSL_CMP_MSG req,
143	OSSL_CMP_MSG **rep, int expected_type)
144	{
145	int begin_transaction =
146	expected_type != OSSL_CMP_PKIBODY_POLLREP
147	&& expected_type != OSSL_CMP_PKIBODY_PKICONF;
148	const char *req_type_str =
149	ossl_cmp_bodytype_to_string(OSSL_CMP_MSG_get_bodytype(req));
150	const char *expected_type_str = ossl_cmp_bodytype_to_string(expected_type);
151	int bak_msg_timeout = ctx->msg_timeout;
152	int bt;
153	time_t now = time(NULL);
154	int time_left;
155	OSSL_CMP_transfer_cb_t transfer_cb = ctx->transfer_cb;
156
157	#ifndef OPENSSL_NO_HTTP
158	if (transfer_cb == NULL)
159	transfer_cb = OSSL_CMP_MSG_http_perform;
160	#endif
161	*rep = NULL;
162
163	if (ctx->total_timeout != 0 /* not waiting indefinitely */) {
164	if (begin_transaction)
165	ctx->end_time = now + ctx->total_timeout;
166	if (now >= ctx->end_time) {
167	ERR_raise(ERR_LIB_CMP, CMP_R_TOTAL_TIMEOUT);
168	return 0;
169	}
170	if (!ossl_assert(ctx->end_time - now < INT_MAX)) {
171	/* actually cannot happen due to assignment in initial_certreq() */
172	ERR_raise(ERR_LIB_CMP, CMP_R_INVALID_ARGS);
173	return 0;
174	}
175	time_left = (int)(ctx->end_time - now);
176	if (ctx->msg_timeout == 0 \|\| time_left < ctx->msg_timeout)
177	ctx->msg_timeout = time_left;
178	}
179
180	/* should print error queue since transfer_cb may call ERR_clear_error() */
181	OSSL_CMP_CTX_print_errors(ctx);
182
183	if (ctx->server != NULL)
184	ossl_cmp_log1(INFO, ctx, "sending %s", req_type_str);
185
186	rep = (transfer_cb)(ctx, req);
187	ctx->msg_timeout = bak_msg_timeout;
188
189	if (*rep == NULL) {
190	ERR_raise_data(ERR_LIB_CMP,
191	ctx->total_timeout != 0 && time(NULL) >= ctx->end_time ?
192	CMP_R_TOTAL_TIMEOUT : CMP_R_TRANSFER_ERROR,
193	"request sent: %s, expected response: %s",
194	req_type_str, expected_type_str);
195	return 0;
196	}
197
198	bt = OSSL_CMP_MSG_get_bodytype(*rep);
199	/*
200	* The body type in the 'bt' variable is not yet verified.
201	* Still we use this preliminary value already for a progress report because
202	* the following msg verification may also produce log entries and may fail.
203	*/
204	ossl_cmp_log2(INFO, ctx, "received %s%s", ossl_cmp_bodytype_to_string(bt),
205	ossl_cmp_is_error_with_waiting(*rep) ? " (waiting)" : "");
206
207	/* copy received extraCerts to ctx->extraCertsIn so they can be retrieved */
208	if (bt != OSSL_CMP_PKIBODY_POLLREP && bt != OSSL_CMP_PKIBODY_PKICONF
209	&& !ossl_cmp_ctx_set1_extraCertsIn(ctx, (*rep)->extraCerts))
210	return 0;
211
212	if (!ossl_cmp_msg_check_update(ctx, *rep, unprotected_exception,
213	expected_type))
214	return 0;
215
216	/*
217	* rep can have the expected response type, which during polling is pollRep.
218	* When polling, also any other non-error response (the final response)
219	* is fine here. When not yet polling, delayed delivery may be initiated
220	* by the server returning an error message with 'waiting' status (or a
221	* response message of expected type ip/cp/kup with 'waiting' status).
222	*/
223	if (bt == expected_type
224	\|\| (expected_type == OSSL_CMP_PKIBODY_POLLREP
225	? bt != OSSL_CMP_PKIBODY_ERROR
226	: ossl_cmp_is_error_with_waiting(*rep)))
227	return 1;
228
229	/* received message type is not one of the expected ones (e.g., error) */
230	ERR_raise(ERR_LIB_CMP, bt == OSSL_CMP_PKIBODY_ERROR ? CMP_R_RECEIVED_ERROR :
231	CMP_R_UNEXPECTED_PKIBODY); /* in next line for mkerr.pl */
232
233	if (bt != OSSL_CMP_PKIBODY_ERROR) {
234	ERR_add_error_data(3, "message type is '",
235	ossl_cmp_bodytype_to_string(bt), "'");
236	} else {
237	OSSL_CMP_ERRORMSGCONTENT emc = (rep)->body->value.error;
238	OSSL_CMP_PKISI *si = emc->pKIStatusInfo;
239	char buf[OSSL_CMP_PKISI_BUFLEN];
240
241	if (save_statusInfo(ctx, si)
242	&& OSSL_CMP_CTX_snprint_PKIStatus(ctx, buf,
243	sizeof(buf)) != NULL)
244	ERR_add_error_data(1, buf);
245	if (emc->errorCode != NULL
246	&& BIO_snprintf(buf, sizeof(buf), "; errorCode: %08lX",
247	ASN1_INTEGER_get(emc->errorCode)) > 0)
248	ERR_add_error_data(1, buf);
249	if (emc->errorDetails != NULL) {
250	char *text = ossl_sk_ASN1_UTF8STRING2text(emc->errorDetails, ", ",
251	OSSL_CMP_PKISI_BUFLEN - 1);
252
253	if (text != NULL && *text != '\0')
254	ERR_add_error_data(2, "; errorDetails: ", text);
255	OPENSSL_free(text);
256	}
257	if (ctx->status != OSSL_CMP_PKISTATUS_rejection) {
258	ERR_raise(ERR_LIB_CMP, CMP_R_UNEXPECTED_PKISTATUS);
259	if (ctx->status == OSSL_CMP_PKISTATUS_waiting)
260	ctx->status = OSSL_CMP_PKISTATUS_rejection;
261	}
262	}
263	return 0;
264	}
265
266	/*-
267	* When a 'waiting' PKIStatus has been received, this function is used to
268	* poll, which should yield a pollRep or the final response.
269	* On receiving a pollRep, which includes a checkAfter value, it return this
270	* value if sleep == 0, else it sleeps as long as indicated and retries.
271	*
272	* A transaction timeout is enabled if ctx->total_timeout is != 0.
273	* In this case polling will continue until the timeout is reached and then
274	* polling is done a last time even if this is before the "checkAfter" time.
275	*
276	* Returns -1 on receiving pollRep if sleep == 0, setting the checkAfter value.
277	* Returns 1 on success and provides the received PKIMESSAGE in *rep.
278	* In this case the caller is responsible for freeing *rep.
279	* Returns 0 on error (which includes the cases that timeout has been reached
280	* or a response with 'waiting' status has been received).
281	*/
282	static int poll_for_response(OSSL_CMP_CTX *ctx, int sleep, int rid,
283	OSSL_CMP_MSG *rep, int checkAfter)
284	{
285	OSSL_CMP_MSG *preq = NULL;
286	OSSL_CMP_MSG *prep = NULL;
287
288	ossl_cmp_info(ctx,
289	"received 'waiting' PKIStatus, starting to poll for response");
290	*rep = NULL;
291	for (;;) {
292	if ((preq = ossl_cmp_pollReq_new(ctx, rid)) == NULL)
293	goto err;
294
295	if (!send_receive_check(ctx, preq, &prep, OSSL_CMP_PKIBODY_POLLREP))
296	goto err;
297
298	/* handle potential pollRep */
299	if (OSSL_CMP_MSG_get_bodytype(prep) == OSSL_CMP_PKIBODY_POLLREP) {
300	OSSL_CMP_POLLREPCONTENT *prc = prep->body->value.pollRep;
301	OSSL_CMP_POLLREP *pollRep = NULL;
302	int64_t check_after;
303	char str[OSSL_CMP_PKISI_BUFLEN];
304	int len;
305
306	if (sk_OSSL_CMP_POLLREP_num(prc) > 1) {
307	ERR_raise(ERR_LIB_CMP, CMP_R_MULTIPLE_RESPONSES_NOT_SUPPORTED);
308	goto err;
309	}
310	pollRep = ossl_cmp_pollrepcontent_get0_pollrep(prc, rid);
311	if (pollRep == NULL)
312	goto err;
313
314	if (!ASN1_INTEGER_get_int64(&check_after, pollRep->checkAfter)) {
315	ERR_raise(ERR_LIB_CMP, CMP_R_BAD_CHECKAFTER_IN_POLLREP);
316	goto err;
317	}
318	if (check_after < 0 \|\| (uint64_t)check_after
319	> (sleep ? ULONG_MAX / 1000 : INT_MAX)) {
320	ERR_raise(ERR_LIB_CMP, CMP_R_CHECKAFTER_OUT_OF_RANGE);
321	if (BIO_snprintf(str, OSSL_CMP_PKISI_BUFLEN, "value = %jd",
322	check_after) >= 0)
323	ERR_add_error_data(1, str);
324	goto err;
325	}
326
327	if (pollRep->reason == NULL
328	\|\| (len = BIO_snprintf(str, OSSL_CMP_PKISI_BUFLEN,
329	" with reason = '")) < 0) {
330	*str = '\0';
331	} else {
332	char *text = ossl_sk_ASN1_UTF8STRING2text(pollRep->reason, ", ",
333	sizeof(str) - len - 2);
334
335	if (text == NULL
336	\|\| BIO_snprintf(str + len, sizeof(str) - len,
337	"%s'", text) < 0)
338	*str = '\0';
339	OPENSSL_free(text);
340	}
341	ossl_cmp_log2(INFO, ctx,
342	"received polling response%s; checkAfter = %ld seconds",
343	str, check_after);
344
345	if (ctx->total_timeout != 0) { /* timeout is not infinite */
346	const int exp = OSSL_CMP_EXPECTED_RESP_TIME;
347	int64_t time_left = (int64_t)(ctx->end_time - exp - time(NULL));
348
349	if (time_left <= 0) {
350	ERR_raise(ERR_LIB_CMP, CMP_R_TOTAL_TIMEOUT);
351	goto err;
352	}
353	if (time_left < check_after)
354	check_after = time_left;
355	/* poll one last time just when timeout was reached */
356	}
357
358	OSSL_CMP_MSG_free(preq);
359	preq = NULL;
360	OSSL_CMP_MSG_free(prep);
361	prep = NULL;
362	if (sleep) {
363	OSSL_sleep((unsigned long)(1000 * check_after));
364	} else {
365	if (checkAfter != NULL)
366	*checkAfter = (int)check_after;
367	return -1; /* exits the loop */
368	}
369	} else if (is_crep_with_waiting(prep, rid)
370	\|\| ossl_cmp_is_error_with_waiting(prep)) {
371	/* received status must not be 'waiting' */
372	(void)ossl_cmp_exchange_error(ctx, OSSL_CMP_PKISTATUS_rejection,
373	OSSL_CMP_CTX_FAILINFO_badRequest,
374	"polling already started",
375	0 /* errorCode */, NULL);
376	ERR_raise(ERR_LIB_CMP, CMP_R_UNEXPECTED_PKISTATUS);
377	goto err;
378	} else {
379	ossl_cmp_info(ctx, "received final response after polling");
380	if (!ossl_cmp_ctx_set1_first_senderNonce(ctx, NULL))
381	return 0;
382	break;
383	}
384	}
385	if (prep == NULL)
386	goto err;
387
388	OSSL_CMP_MSG_free(preq);
389	*rep = prep;
390
391	return 1;
392	err:
393	(void)ossl_cmp_ctx_set1_first_senderNonce(ctx, NULL);
394	OSSL_CMP_MSG_free(preq);
395	OSSL_CMP_MSG_free(prep);
396	return 0;
397	}
398
399	static int save_senderNonce_if_waiting(OSSL_CMP_CTX *ctx,
400	const OSSL_CMP_MSG *rep, int rid)
401	{
402	/*
403	* Lightweight CMP Profile section 4.4 states: the senderNonce of the
404	* preceding request message because this value will be needed for checking
405	* the recipNonce of the final response to be received after polling.
406	*/
407	if ((is_crep_with_waiting(rep, rid)
408	\|\| ossl_cmp_is_error_with_waiting(rep))
409	&& !ossl_cmp_ctx_set1_first_senderNonce(ctx, ctx->senderNonce))
410	return 0;
411
412	return 1;
413	}
414
415	/*
416	* Send request and get response possibly with polling initiated by error msg.
417	* Polling for ip/cp/kup/ with 'waiting' status is handled by cert_response().
418	*/
419	static int send_receive_also_delayed(OSSL_CMP_CTX ctx, const OSSL_CMP_MSG req,
420	OSSL_CMP_MSG **rep, int expected_type)
421	{
422
423	if (!send_receive_check(ctx, req, rep, expected_type))
424	return 0;
425
426	if (ossl_cmp_is_error_with_waiting(*rep)) {
427	if (!save_senderNonce_if_waiting(ctx, *rep, OSSL_CMP_CERTREQID_NONE))
428	return 0;
429	/* not modifying ctx->status during certConf and error exchanges */
430	if (expected_type != OSSL_CMP_PKIBODY_PKICONF
431	&& !save_statusInfo(ctx, (*rep)->body->value.error->pKIStatusInfo))
432	return 0;
433
434	OSSL_CMP_MSG_free(*rep);
435	*rep = NULL;
436
437	if (poll_for_response(ctx, 1 /* can sleep */, OSSL_CMP_CERTREQID_NONE,
438	rep, NULL /* checkAfter */) <= 0) {
439	ERR_raise(ERR_LIB_CMP, CMP_R_POLLING_FAILED);
440	return 0;
441	}
442	}
443	if (OSSL_CMP_MSG_get_bodytype(*rep) != expected_type) {
444	ERR_raise(ERR_LIB_CMP, CMP_R_UNEXPECTED_PKIBODY);
445	return 0;
446	}
447
448	return 1;
449	}
450	/*
451	* Send certConf for IR, CR or KUR sequences and check response,
452	* not modifying ctx->status during the certConf exchange
453	*/
454	int ossl_cmp_exchange_certConf(OSSL_CMP_CTX *ctx, int certReqId,
455	int fail_info, const char *txt)
456	{
457	OSSL_CMP_MSG *certConf;
458	OSSL_CMP_MSG *PKIconf = NULL;
459	int res = 0;
460
461	/* OSSL_CMP_certConf_new() also checks if all necessary options are set */
462	certConf = ossl_cmp_certConf_new(ctx, certReqId, fail_info, txt);
463	if (certConf == NULL)
464	goto err;
465
466	res = send_receive_also_delayed(ctx, certConf, &PKIconf,
467	OSSL_CMP_PKIBODY_PKICONF);
468
469	err:
470	OSSL_CMP_MSG_free(certConf);
471	OSSL_CMP_MSG_free(PKIconf);
472	return res;
473	}
474
475	/* Send given error and check response */
476	int ossl_cmp_exchange_error(OSSL_CMP_CTX *ctx, int status, int fail_info,
477	const char txt, int errorCode, const char details)
478	{
479	OSSL_CMP_MSG *error = NULL;
480	OSSL_CMP_PKISI *si = NULL;
481	OSSL_CMP_MSG *PKIconf = NULL;
482	int res = 0;
483
484	/* not overwriting ctx->status on error exchange */
485	if ((si = OSSL_CMP_STATUSINFO_new(status, fail_info, txt)) == NULL)
486	goto err;
487	/* ossl_cmp_error_new() also checks if all necessary options are set */
488	if ((error = ossl_cmp_error_new(ctx, si, errorCode, details, 0)) == NULL)
489	goto err;
490
491	res = send_receive_also_delayed(ctx, error,
492	&PKIconf, OSSL_CMP_PKIBODY_PKICONF);
493
494	err:
495	OSSL_CMP_MSG_free(error);
496	OSSL_CMP_PKISI_free(si);
497	OSSL_CMP_MSG_free(PKIconf);
498	return res;
499	}
500
501	/*-
502	* Retrieve a copy of the certificate, if any, from the given CertResponse.
503	* Take into account PKIStatusInfo of CertResponse in ctx, report it on error.
504	* Returns NULL if not found or on error.
505	*/
506	static X509 get1_cert_status(OSSL_CMP_CTX ctx, int bodytype,
507	OSSL_CMP_CERTRESPONSE *crep)
508	{
509	char buf[OSSL_CMP_PKISI_BUFLEN];
510	X509 *crt = NULL;
511
512	if (!ossl_assert(ctx != NULL && crep != NULL))
513	return NULL;
514
515	switch (ossl_cmp_pkisi_get_status(crep->status)) {
516	case OSSL_CMP_PKISTATUS_waiting:
517	ossl_cmp_err(ctx,
518	"received \"waiting\" status for cert when actually aiming to extract cert");
519	ERR_raise(ERR_LIB_CMP, CMP_R_ENCOUNTERED_WAITING);
520	goto err;
521	case OSSL_CMP_PKISTATUS_grantedWithMods:
522	ossl_cmp_warn(ctx, "received \"grantedWithMods\" for certificate");
523	break;
524	case OSSL_CMP_PKISTATUS_accepted:
525	break;
526	/* get all information in case of a rejection before going to error */
527	case OSSL_CMP_PKISTATUS_rejection:
528	ossl_cmp_err(ctx, "received \"rejection\" status rather than cert");
529	ERR_raise(ERR_LIB_CMP, CMP_R_REQUEST_REJECTED_BY_SERVER);
530	goto err;
531	case OSSL_CMP_PKISTATUS_revocationWarning:
532	ossl_cmp_warn(ctx,
533	"received \"revocationWarning\" - a revocation of the cert is imminent");
534	break;
535	case OSSL_CMP_PKISTATUS_revocationNotification:
536	ossl_cmp_warn(ctx,
537	"received \"revocationNotification\" - a revocation of the cert has occurred");
538	break;
539	case OSSL_CMP_PKISTATUS_keyUpdateWarning:
540	if (bodytype != OSSL_CMP_PKIBODY_KUR) {
541	ERR_raise(ERR_LIB_CMP, CMP_R_ENCOUNTERED_KEYUPDATEWARNING);
542	goto err;
543	}
544	break;
545	default:
546	ossl_cmp_log1(ERROR, ctx,
547	"received unsupported PKIStatus %d for certificate",
548	ctx->status);
549	ERR_raise(ERR_LIB_CMP, CMP_R_UNKNOWN_PKISTATUS);
550	goto err;
551	}
552	crt = ossl_cmp_certresponse_get1_cert(ctx, crep);
553	if (crt == NULL) /* according to PKIStatus, we can expect a cert */
554	ERR_raise(ERR_LIB_CMP, CMP_R_CERTIFICATE_NOT_FOUND);
555
556	return crt;
557
558	err:
559	if (OSSL_CMP_CTX_snprint_PKIStatus(ctx, buf, sizeof(buf)) != NULL)
560	ERR_add_error_data(1, buf);
561	return NULL;
562	}
563
564	/*-
565	* Callback fn validating that the new certificate can be verified, using
566	* ctx->certConf_cb_arg, which has been initialized using opt_out_trusted, and
567	* ctx->untrusted, which at this point already contains msg->extraCerts.
568	* Returns 0 on acceptance, else a bit field reflecting PKIFailureInfo.
569	* Quoting from RFC 4210 section 5.1. Overall PKI Message:
570	* The extraCerts field can contain certificates that may be useful to
571	* the recipient. For example, this can be used by a CA or RA to
572	* present an end entity with certificates that it needs to verify its
573	* own new certificate (if, for example, the CA that issued the end
574	* entity's certificate is not a root CA for the end entity). Note that
575	* this field does not necessarily contain a certification path; the
576	* recipient may have to sort, select from, or otherwise process the
577	* extra certificates in order to use them.
578	* Note: While often handy, there is no hard requirement by CMP that
579	* an EE must be able to validate the certificates it gets enrolled.
580	*/
581	int OSSL_CMP_certConf_cb(OSSL_CMP_CTX ctx, X509 cert, int fail_info,
582	const char **text)
583	{
584	X509_STORE *out_trusted = OSSL_CMP_CTX_get_certConf_cb_arg(ctx);
585	STACK_OF(X509) *chain = NULL;
586
587	(void)text; /* make (artificial) use of var to prevent compiler warning */
588
589	if (fail_info != 0) /* accept any error flagged by CMP core library */
590	return fail_info;
591
592	if (out_trusted == NULL) {
593	ossl_cmp_debug(ctx, "trying to build chain for newly enrolled cert");
594	chain = X509_build_chain(cert, ctx->untrusted, out_trusted,
595	0, ctx->libctx, ctx->propq);
596	} else {
597	X509_STORE_CTX *csc = X509_STORE_CTX_new_ex(ctx->libctx, ctx->propq);
598
599	ossl_cmp_debug(ctx, "validating newly enrolled cert");
600	if (csc == NULL)
601	goto err;
602	if (!X509_STORE_CTX_init(csc, out_trusted, cert, ctx->untrusted))
603	goto err;
604	/* disable any cert status/revocation checking etc. */
605	X509_VERIFY_PARAM_clear_flags(X509_STORE_CTX_get0_param(csc),
606	~(X509_V_FLAG_USE_CHECK_TIME
607	\| X509_V_FLAG_NO_CHECK_TIME
608	\| X509_V_FLAG_PARTIAL_CHAIN
609	\| X509_V_FLAG_POLICY_CHECK));
610	if (X509_verify_cert(csc) <= 0)
611	goto err;
612
613	if (!ossl_x509_add_certs_new(&chain, X509_STORE_CTX_get0_chain(csc),
614	X509_ADD_FLAG_UP_REF \| X509_ADD_FLAG_NO_DUP
615	\| X509_ADD_FLAG_NO_SS)) {
616	sk_X509_free(chain);
617	chain = NULL;
618	}
619	err:
620	X509_STORE_CTX_free(csc);
621	}
622
623	if (sk_X509_num(chain) > 0)
624	X509_free(sk_X509_shift(chain)); /* remove leaf (EE) cert */
625	if (out_trusted != NULL) {
626	if (chain == NULL) {
627	ossl_cmp_err(ctx, "failed to validate newly enrolled cert");
628	fail_info = 1 << OSSL_CMP_PKIFAILUREINFO_incorrectData;
629	} else {
630	ossl_cmp_debug(ctx,
631	"success validating newly enrolled cert");
632	}
633	} else if (chain == NULL) {
634	ossl_cmp_warn(ctx, "could not build approximate chain for newly enrolled cert, resorting to received extraCerts");
635	chain = OSSL_CMP_CTX_get1_extraCertsIn(ctx);
636	} else {
637	ossl_cmp_debug(ctx,
638	"success building approximate chain for newly enrolled cert");
639	}
640	(void)ossl_cmp_ctx_set1_newChain(ctx, chain);
641	OSSL_STACK_OF_X509_free(chain);
642
643	return fail_info;
644	}
645
646	/*-
647	* Perform the generic handling of certificate responses for IR/CR/KUR/P10CR.
648	* \|rid\| must be OSSL_CMP_CERTREQID_NONE if not available, namely for p10cr
649	* Returns -1 on receiving pollRep if sleep == 0, setting the checkAfter value.
650	* Returns 1 on success and provides the received PKIMESSAGE in *resp.
651	* Returns 0 on error (which includes the case that timeout has been reached).
652	* Regardless of success, caller is responsible for freeing *resp (unless NULL).
653	*/
654	static int cert_response(OSSL_CMP_CTX *ctx, int sleep, int rid,
655	OSSL_CMP_MSG *resp, int checkAfter,
656	ossl_unused int req_type,
657	ossl_unused int expected_type)
658	{
659	EVP_PKEY *rkey = ossl_cmp_ctx_get0_newPubkey(ctx);
660	int fail_info = 0; /* no failure */
661	const char *txt = NULL;
662	OSSL_CMP_CERTREPMESSAGE *crepmsg = NULL;
663	OSSL_CMP_CERTRESPONSE *crep = NULL;
664	OSSL_CMP_certConf_cb_t cb;
665	X509 *cert;
666	char *subj = NULL;
667	int ret = 1;
668	int rcvd_type;
669	OSSL_CMP_PKISI *si;
670
671	if (!ossl_assert(ctx != NULL))
672	return 0;
673
674	retry:
675	rcvd_type = OSSL_CMP_MSG_get_bodytype(*resp);
676	if (IS_CREP(rcvd_type)) {
677	crepmsg = (resp)->body->value.ip; / same for cp and kup */
678	if (sk_OSSL_CMP_CERTRESPONSE_num(crepmsg->response) > 1) {
679	ERR_raise(ERR_LIB_CMP, CMP_R_MULTIPLE_RESPONSES_NOT_SUPPORTED);
680	return 0;
681	}
682	crep = ossl_cmp_certrepmessage_get0_certresponse(crepmsg, rid);
683	if (crep == NULL)
684	return 0;
685	si = crep->status;
686
687	if (rid == OSSL_CMP_CERTREQID_NONE) {
688	/* for OSSL_CMP_PKIBODY_P10CR learn CertReqId from response */
689	rid = ossl_cmp_asn1_get_int(crep->certReqId);
690	if (rid < OSSL_CMP_CERTREQID_NONE) {
691	ERR_raise(ERR_LIB_CMP, CMP_R_BAD_REQUEST_ID);
692	return 0;
693	}
694	}
695	} else if (rcvd_type == OSSL_CMP_PKIBODY_ERROR) {
696	si = (*resp)->body->value.error->pKIStatusInfo;
697	} else {
698	ERR_raise(ERR_LIB_CMP, CMP_R_UNEXPECTED_PKIBODY);
699	return 0;
700	}
701
702	if (!save_statusInfo(ctx, si))
703	return 0;
704
705	if (ossl_cmp_pkisi_get_status(si) == OSSL_CMP_PKISTATUS_waiting) {
706	/*
707	* Here we allow both and error message with waiting indication
708	* as well as a certificate response with waiting indication, where
709	* its flavor (ip, cp, or kup) may not strictly match ir/cr/p10cr/kur.
710	*/
711	OSSL_CMP_MSG_free(*resp);
712	*resp = NULL;
713	if ((ret = poll_for_response(ctx, sleep, rid, resp, checkAfter)) != 0) {
714	if (ret == -1) /* at this point implies sleep == 0 */
715	return ret; /* waiting */
716	goto retry; /* got some response other than pollRep */
717	} else {
718	ERR_raise(ERR_LIB_CMP, CMP_R_POLLING_FAILED);
719	return 0;
720	}
721	}
722
723	/* at this point, we have received ip/cp/kup/error without waiting */
724	if (rcvd_type == OSSL_CMP_PKIBODY_ERROR) {
725	ERR_raise(ERR_LIB_CMP, CMP_R_RECEIVED_ERROR);
726	return 0;
727	}
728	/* here we are strict on the flavor of ip/cp/kup: must match request */
729	if (rcvd_type != expected_type) {
730	ERR_raise(ERR_LIB_CMP, CMP_R_UNEXPECTED_PKIBODY);
731	return 0;
732	}
733
734	cert = get1_cert_status(ctx, (*resp)->body->type, crep);
735	if (cert == NULL) {
736	ERR_add_error_data(1, "; cannot extract certificate from response");
737	return 0;
738	}
739	if (!ossl_cmp_ctx_set0_newCert(ctx, cert))
740	return 0;
741
742	/*
743	* if the CMP server returned certificates in the caPubs field, copy them
744	* to the context so that they can be retrieved if necessary
745	*/
746	if (crepmsg != NULL && crepmsg->caPubs != NULL
747	&& !ossl_cmp_ctx_set1_caPubs(ctx, crepmsg->caPubs))
748	return 0;
749
750	subj = X509_NAME_oneline(X509_get_subject_name(cert), NULL, 0);
751	if (rkey != NULL
752	/* X509_check_private_key() also works if rkey is just public key */
753	&& !(X509_check_private_key(ctx->newCert, rkey))) {
754	fail_info = 1 << OSSL_CMP_PKIFAILUREINFO_incorrectData;
755	txt = "public key in new certificate does not match our enrollment key";
756	/*-
757	* not calling (void)ossl_cmp_exchange_error(ctx,
758	* OSSL_CMP_PKISTATUS_rejection, fail_info, txt)
759	* not throwing CMP_R_CERTIFICATE_NOT_ACCEPTED with txt
760	* not returning 0
761	* since we better leave this for the certConf_cb to decide
762	*/
763	}
764
765	/*
766	* Execute the certification checking callback function,
767	* which can determine whether to accept a newly enrolled certificate.
768	* It may overrule the pre-decision reflected in 'fail_info' and '*txt'.
769	*/
770	cb = ctx->certConf_cb != NULL ? ctx->certConf_cb : OSSL_CMP_certConf_cb;
771	if ((fail_info = cb(ctx, ctx->newCert, fail_info, &txt)) != 0
772	&& txt == NULL)
773	txt = "CMP client did not accept it";
774	if (fail_info != 0) /* immediately log error before any certConf exchange */
775	ossl_cmp_log1(ERROR, ctx,
776	"rejecting newly enrolled cert with subject: %s", subj);
777	/*
778	* certConf exchange should better be moved to do_certreq_seq() such that
779	* also more low-level errors with CertReqMessages get reported to server
780	*/
781	if (!ctx->disableConfirm
782	&& !ossl_cmp_hdr_has_implicitConfirm((*resp)->header)) {
783	if (!ossl_cmp_exchange_certConf(ctx, rid, fail_info, txt))
784	ret = 0;
785	}
786
787	/* not throwing failure earlier as transfer_cb may call ERR_clear_error() */
788	if (fail_info != 0) {
789	ERR_raise_data(ERR_LIB_CMP, CMP_R_CERTIFICATE_NOT_ACCEPTED,
790	"rejecting newly enrolled cert with subject: %s; %s",
791	subj, txt);
792	ctx->status = OSSL_CMP_PKISTATUS_rejection;
793	ret = 0;
794	}
795	OPENSSL_free(subj);
796	return ret;
797	}
798
799	static int initial_certreq(OSSL_CMP_CTX *ctx,
800	int req_type, const OSSL_CRMF_MSG *crm,
801	OSSL_CMP_MSG **p_rep, int rep_type)
802	{
803	OSSL_CMP_MSG *req;
804	int res;
805
806	ctx->status = OSSL_CMP_PKISTATUS_request;
807	if (!ossl_cmp_ctx_set0_newCert(ctx, NULL))
808	return 0;
809
810	/* also checks if all necessary options are set */
811	if ((req = ossl_cmp_certreq_new(ctx, req_type, crm)) == NULL)
812	return 0;
813
814	ctx->status = OSSL_CMP_PKISTATUS_trans;
815	res = send_receive_check(ctx, req, p_rep, rep_type);
816	OSSL_CMP_MSG_free(req);
817	return res;
818	}
819
820	int OSSL_CMP_try_certreq(OSSL_CMP_CTX *ctx, int req_type,
821	const OSSL_CRMF_MSG crm, int checkAfter)
822	{
823	OSSL_CMP_MSG *rep = NULL;
824	int is_p10 = req_type == OSSL_CMP_PKIBODY_P10CR;
825	int rid = is_p10 ? OSSL_CMP_CERTREQID_NONE : OSSL_CMP_CERTREQID;
826	int rep_type = is_p10 ? OSSL_CMP_PKIBODY_CP : req_type + 1;
827	int res = 0;
828
829	if (ctx == NULL) {
830	ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
831	return 0;
832	}
833
834	if (ctx->status != OSSL_CMP_PKISTATUS_waiting) { /* not polling already */
835	if (!initial_certreq(ctx, req_type, crm, &rep, rep_type))
836	goto err;
837
838	if (!save_senderNonce_if_waiting(ctx, rep, rid))
839	return 0;
840	} else {
841	if (req_type < 0)
842	return ossl_cmp_exchange_error(ctx, OSSL_CMP_PKISTATUS_rejection,
843	0, "polling aborted",
844	0 /* errorCode */, "by application");
845	res = poll_for_response(ctx, 0 /* no sleep */, rid, &rep, checkAfter);
846	if (res <= 0) /* waiting or error */
847	return res;
848	}
849	res = cert_response(ctx, 0 /* no sleep */, rid, &rep, checkAfter,
850	req_type, rep_type);
851
852	err:
853	OSSL_CMP_MSG_free(rep);
854	return res;
855	}
856
857	/*-
858	* Do the full sequence CR/IR/KUR/P10CR, CP/IP/KUP/CP,
859	* certConf, PKIconf, and polling if required.
860	* Will sleep as long as indicated by the server (according to checkAfter).
861	* All enrollment options need to be present in the context.
862	* Returns pointer to received certificate, or NULL if none was received.
863	*/
864	X509 OSSL_CMP_exec_certreq(OSSL_CMP_CTX ctx, int req_type,
865	const OSSL_CRMF_MSG *crm)
866	{
867	OSSL_CMP_MSG *rep = NULL;
868	int is_p10 = req_type == OSSL_CMP_PKIBODY_P10CR;
869	int rid = is_p10 ? OSSL_CMP_CERTREQID_NONE : OSSL_CMP_CERTREQID;
870	int rep_type = is_p10 ? OSSL_CMP_PKIBODY_CP : req_type + 1;
871	X509 *result = NULL;
872
873	if (ctx == NULL) {
874	ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
875	return NULL;
876	}
877
878	if (!initial_certreq(ctx, req_type, crm, &rep, rep_type))
879	goto err;
880
881	if (!save_senderNonce_if_waiting(ctx, rep, rid))
882	return 0;
883
884	if (cert_response(ctx, 1 /* sleep */, rid, &rep, NULL, req_type, rep_type)
885	<= 0)
886	goto err;
887
888	result = ctx->newCert;
889	err:
890	OSSL_CMP_MSG_free(rep);
891	return result;
892	}
893
894	int OSSL_CMP_exec_RR_ses(OSSL_CMP_CTX *ctx)
895	{
896	OSSL_CMP_MSG *rr = NULL;
897	OSSL_CMP_MSG *rp = NULL;
898	const int num_RevDetails = 1;
899	const int rsid = OSSL_CMP_REVREQSID;
900	OSSL_CMP_REVREPCONTENT *rrep = NULL;
901	OSSL_CMP_PKISI *si = NULL;
902	char buf[OSSL_CMP_PKISI_BUFLEN];
903	int ret = 0;
904
905	if (ctx == NULL) {
906	ERR_raise(ERR_LIB_CMP, CMP_R_INVALID_ARGS);
907	return 0;
908	}
909	ctx->status = OSSL_CMP_PKISTATUS_request;
910	if (ctx->oldCert == NULL && ctx->p10CSR == NULL
911	&& (ctx->serialNumber == NULL \|\| ctx->issuer == NULL)) {
912	ERR_raise(ERR_LIB_CMP, CMP_R_MISSING_REFERENCE_CERT);
913	return 0;
914	}
915
916	/* OSSL_CMP_rr_new() also checks if all necessary options are set */
917	if ((rr = ossl_cmp_rr_new(ctx)) == NULL)
918	goto end;
919
920	ctx->status = OSSL_CMP_PKISTATUS_trans;
921	if (!send_receive_also_delayed(ctx, rr, &rp, OSSL_CMP_PKIBODY_RP))
922	goto end;
923
924	rrep = rp->body->value.rp;
925	#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
926	if (sk_OSSL_CMP_PKISI_num(rrep->status) != num_RevDetails) {
927	ERR_raise(ERR_LIB_CMP, CMP_R_WRONG_RP_COMPONENT_COUNT);
928	goto end;
929	}
930	#else
931	if (sk_OSSL_CMP_PKISI_num(rrep->status) < 1) {
932	ERR_raise(ERR_LIB_CMP, CMP_R_WRONG_RP_COMPONENT_COUNT);
933	goto end;
934	}
935	#endif
936
937	/* evaluate PKIStatus field */
938	si = ossl_cmp_revrepcontent_get_pkisi(rrep, rsid);
939	if (!save_statusInfo(ctx, si))
940	goto err;
941	switch (ossl_cmp_pkisi_get_status(si)) {
942	case OSSL_CMP_PKISTATUS_accepted:
943	ossl_cmp_info(ctx, "revocation accepted (PKIStatus=accepted)");
944	ret = 1;
945	break;
946	case OSSL_CMP_PKISTATUS_grantedWithMods:
947	ossl_cmp_info(ctx, "revocation accepted (PKIStatus=grantedWithMods)");
948	ret = 1;
949	break;
950	case OSSL_CMP_PKISTATUS_rejection:
951	ERR_raise(ERR_LIB_CMP, CMP_R_REQUEST_REJECTED_BY_SERVER);
952	goto err;
953	case OSSL_CMP_PKISTATUS_revocationWarning:
954	ossl_cmp_info(ctx, "revocation accepted (PKIStatus=revocationWarning)");
955	ret = 1;
956	break;
957	case OSSL_CMP_PKISTATUS_revocationNotification:
958	/* interpretation as warning or error depends on CA */
959	ossl_cmp_warn(ctx,
960	"revocation accepted (PKIStatus=revocationNotification)");
961	ret = 1;
962	break;
963	case OSSL_CMP_PKISTATUS_waiting:
964	case OSSL_CMP_PKISTATUS_keyUpdateWarning:
965	ERR_raise(ERR_LIB_CMP, CMP_R_UNEXPECTED_PKISTATUS);
966	goto err;
967	default:
968	ERR_raise(ERR_LIB_CMP, CMP_R_UNKNOWN_PKISTATUS);
969	goto err;
970	}
971
972	/* check any present CertId in optional revCerts field */
973	if (sk_OSSL_CRMF_CERTID_num(rrep->revCerts) >= 1) {
974	OSSL_CRMF_CERTID *cid;
975	OSSL_CRMF_CERTTEMPLATE *tmpl =
976	sk_OSSL_CMP_REVDETAILS_value(rr->body->value.rr, rsid)->certDetails;
977	const X509_NAME *issuer = OSSL_CRMF_CERTTEMPLATE_get0_issuer(tmpl);
978	const ASN1_INTEGER *serial =
979	OSSL_CRMF_CERTTEMPLATE_get0_serialNumber(tmpl);
980
981	if (sk_OSSL_CRMF_CERTID_num(rrep->revCerts) != num_RevDetails) {
982	ERR_raise(ERR_LIB_CMP, CMP_R_WRONG_RP_COMPONENT_COUNT);
983	ret = 0;
984	goto err;
985	}
986	if ((cid = ossl_cmp_revrepcontent_get_CertId(rrep, rsid)) == NULL) {
987	ERR_raise(ERR_LIB_CMP, CMP_R_MISSING_CERTID);
988	ret = 0;
989	goto err;
990	}
991	if (X509_NAME_cmp(issuer, OSSL_CRMF_CERTID_get0_issuer(cid)) != 0) {
992	#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
993	ERR_raise(ERR_LIB_CMP, CMP_R_WRONG_CERTID_IN_RP);
994	ret = 0;
995	goto err;
996	#endif
997	}
998	if (ASN1_INTEGER_cmp(serial,
999	OSSL_CRMF_CERTID_get0_serialNumber(cid)) != 0) {
1000	#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
1001	ERR_raise(ERR_LIB_CMP, CMP_R_WRONG_SERIAL_IN_RP);
1002	ret = 0;
1003	goto err;
1004	#endif
1005	}
1006	}
1007
1008	/* check number of any optionally present crls */
1009	if (rrep->crls != NULL && sk_X509_CRL_num(rrep->crls) != num_RevDetails) {
1010	ERR_raise(ERR_LIB_CMP, CMP_R_WRONG_RP_COMPONENT_COUNT);
1011	ret = 0;
1012	goto err;
1013	}
1014
1015	err:
1016	if (ret == 0
1017	&& OSSL_CMP_CTX_snprint_PKIStatus(ctx, buf, sizeof(buf)) != NULL)
1018	ERR_add_error_data(1, buf);
1019
1020	end:
1021	OSSL_CMP_MSG_free(rr);
1022	OSSL_CMP_MSG_free(rp);
1023	return ret;
1024	}
1025
1026	STACK_OF(OSSL_CMP_ITAV) OSSL_CMP_exec_GENM_ses(OSSL_CMP_CTX ctx)
1027	{
1028	OSSL_CMP_MSG *genm;
1029	OSSL_CMP_MSG *genp = NULL;
1030	STACK_OF(OSSL_CMP_ITAV) *itavs = NULL;
1031
1032	if (ctx == NULL) {
1033	ERR_raise(ERR_LIB_CMP, CMP_R_INVALID_ARGS);
1034	return NULL;
1035	}
1036	ctx->status = OSSL_CMP_PKISTATUS_request;
1037
1038	if ((genm = ossl_cmp_genm_new(ctx)) == NULL)
1039	goto err;
1040
1041	ctx->status = OSSL_CMP_PKISTATUS_trans;
1042	if (!send_receive_also_delayed(ctx, genm, &genp, OSSL_CMP_PKIBODY_GENP))
1043	goto err;
1044	ctx->status = OSSL_CMP_PKISTATUS_accepted;
1045
1046	itavs = genp->body->value.genp;
1047	if (itavs == NULL)
1048	itavs = sk_OSSL_CMP_ITAV_new_null();
1049	/* received stack of itavs not to be freed with the genp */
1050	genp->body->value.genp = NULL;
1051
1052	err:
1053	OSSL_CMP_MSG_free(genm);
1054	OSSL_CMP_MSG_free(genp);
1055
1056	return itavs; /* NULL indicates error case */
1057	}

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/libs/openssl-3.4.1/crypto/cmp/cmp_client.c

Download in other formats: