cmp_server.c

Last change on this file was 109052, checked in by vboxsync, 3 weeks ago
openssl-3.4.1: Applied our changes, regenerated files, added missing files and functions. This time with a three way merge. bugref:10890
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 25.9 KB

Line
1	/*
2	* Copyright 2007-2024 The OpenSSL Project Authors. All Rights Reserved.
3	* Copyright Nokia 2007-2019
4	* Copyright Siemens AG 2015-2019
5	*
6	* Licensed under the Apache License 2.0 (the "License"). You may not use
7	* this file except in compliance with the License. You can obtain a copy
8	* in the file LICENSE in the source distribution or at
9	* https://www.openssl.org/source/license.html
10	*/
11
12	/* general CMP server functions */
13
14	#include <openssl/asn1t.h>
15
16	#include "cmp_local.h"
17
18	/* explicit #includes not strictly needed since implied by the above: */
19	#include <openssl/cmp.h>
20	#include <openssl/err.h>
21
22	/* the context for the generic CMP server */
23	struct ossl_cmp_srv_ctx_st {
24	OSSL_CMP_CTX ctx; / CMP client context reused for transactionID etc. */
25	void custom_ctx; / application-specific server context */
26	int certReqId; /* of ir/cr/kur, OSSL_CMP_CERTREQID_NONE for p10cr */
27	int polling; /* current transaction is in polling mode */
28
29	OSSL_CMP_SRV_cert_request_cb_t process_cert_request;
30	OSSL_CMP_SRV_rr_cb_t process_rr;
31	OSSL_CMP_SRV_genm_cb_t process_genm;
32	OSSL_CMP_SRV_error_cb_t process_error;
33	OSSL_CMP_SRV_certConf_cb_t process_certConf;
34	OSSL_CMP_SRV_pollReq_cb_t process_pollReq;
35	OSSL_CMP_SRV_delayed_delivery_cb_t delayed_delivery;
36	OSSL_CMP_SRV_clean_transaction_cb_t clean_transaction;
37
38	int sendUnprotectedErrors; /* Send error and rejection msgs unprotected */
39	int acceptUnprotected; /* Accept requests with no/invalid prot. */
40	int acceptRAVerified; /* Accept ir/cr/kur with POPO RAVerified */
41	int grantImplicitConfirm; /* Grant implicit confirmation if requested */
42
43	}; /* OSSL_CMP_SRV_CTX */
44
45	void OSSL_CMP_SRV_CTX_free(OSSL_CMP_SRV_CTX *srv_ctx)
46	{
47	if (srv_ctx == NULL)
48	return;
49
50	OSSL_CMP_CTX_free(srv_ctx->ctx);
51	OPENSSL_free(srv_ctx);
52	}
53
54	OSSL_CMP_SRV_CTX OSSL_CMP_SRV_CTX_new(OSSL_LIB_CTX libctx, const char *propq)
55	{
56	OSSL_CMP_SRV_CTX *ctx = OPENSSL_zalloc(sizeof(OSSL_CMP_SRV_CTX));
57
58	if (ctx == NULL)
59	goto err;
60
61	if ((ctx->ctx = OSSL_CMP_CTX_new(libctx, propq)) == NULL)
62	goto err;
63	ctx->certReqId = OSSL_CMP_CERTREQID_INVALID;
64	ctx->polling = 0;
65
66	/* all other elements are initialized to 0 or NULL, respectively */
67	return ctx;
68	err:
69	OSSL_CMP_SRV_CTX_free(ctx);
70	return NULL;
71	}
72
73	int OSSL_CMP_SRV_CTX_init(OSSL_CMP_SRV_CTX srv_ctx, void custom_ctx,
74	OSSL_CMP_SRV_cert_request_cb_t process_cert_request,
75	OSSL_CMP_SRV_rr_cb_t process_rr,
76	OSSL_CMP_SRV_genm_cb_t process_genm,
77	OSSL_CMP_SRV_error_cb_t process_error,
78	OSSL_CMP_SRV_certConf_cb_t process_certConf,
79	OSSL_CMP_SRV_pollReq_cb_t process_pollReq)
80	{
81	if (srv_ctx == NULL) {
82	ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
83	return 0;
84	}
85	srv_ctx->custom_ctx = custom_ctx;
86	srv_ctx->process_cert_request = process_cert_request;
87	srv_ctx->process_rr = process_rr;
88	srv_ctx->process_genm = process_genm;
89	srv_ctx->process_error = process_error;
90	srv_ctx->process_certConf = process_certConf;
91	srv_ctx->process_pollReq = process_pollReq;
92	return 1;
93	}
94
95	int OSSL_CMP_SRV_CTX_init_trans(OSSL_CMP_SRV_CTX *srv_ctx,
96	OSSL_CMP_SRV_delayed_delivery_cb_t delay,
97	OSSL_CMP_SRV_clean_transaction_cb_t clean)
98	{
99	if (srv_ctx == NULL) {
100	ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
101	return 0;
102	}
103	srv_ctx->delayed_delivery = delay;
104	srv_ctx->clean_transaction = clean;
105	return 1;
106	}
107
108	OSSL_CMP_CTX OSSL_CMP_SRV_CTX_get0_cmp_ctx(const OSSL_CMP_SRV_CTX srv_ctx)
109	{
110	if (srv_ctx == NULL) {
111	ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
112	return NULL;
113	}
114	return srv_ctx->ctx;
115	}
116
117	void OSSL_CMP_SRV_CTX_get0_custom_ctx(const OSSL_CMP_SRV_CTX srv_ctx)
118	{
119	if (srv_ctx == NULL) {
120	ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
121	return NULL;
122	}
123	return srv_ctx->custom_ctx;
124	}
125
126	int OSSL_CMP_SRV_CTX_set_send_unprotected_errors(OSSL_CMP_SRV_CTX *srv_ctx,
127	int val)
128	{
129	if (srv_ctx == NULL) {
130	ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
131	return 0;
132	}
133	srv_ctx->sendUnprotectedErrors = val != 0;
134	return 1;
135	}
136
137	int OSSL_CMP_SRV_CTX_set_accept_unprotected(OSSL_CMP_SRV_CTX *srv_ctx, int val)
138	{
139	if (srv_ctx == NULL) {
140	ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
141	return 0;
142	}
143	srv_ctx->acceptUnprotected = val != 0;
144	return 1;
145	}
146
147	int OSSL_CMP_SRV_CTX_set_accept_raverified(OSSL_CMP_SRV_CTX *srv_ctx, int val)
148	{
149	if (srv_ctx == NULL) {
150	ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
151	return 0;
152	}
153	srv_ctx->acceptRAVerified = val != 0;
154	return 1;
155	}
156
157	int OSSL_CMP_SRV_CTX_set_grant_implicit_confirm(OSSL_CMP_SRV_CTX *srv_ctx,
158	int val)
159	{
160	if (srv_ctx == NULL) {
161	ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
162	return 0;
163	}
164	srv_ctx->grantImplicitConfirm = val != 0;
165	return 1;
166	}
167
168	/* return error msg with waiting status if polling is initiated, else NULL */
169	static OSSL_CMP_MSG delayed_delivery(OSSL_CMP_SRV_CTX srv_ctx,
170	const OSSL_CMP_MSG *req)
171	{
172	int ret;
173	unsigned long err;
174	int status = OSSL_CMP_PKISTATUS_waiting,
175	fail_info = 0, errorCode = 0;
176	const char txt = NULL, details = NULL;
177	OSSL_CMP_PKISI *si;
178	OSSL_CMP_MSG *msg;
179
180	if (!ossl_assert(srv_ctx != NULL && srv_ctx->ctx != NULL && req != NULL
181	&& srv_ctx->delayed_delivery != NULL))
182	return NULL;
183
184	ret = srv_ctx->delayed_delivery(srv_ctx, req);
185	if (ret == 0)
186	return NULL;
187	if (ret == 1) {
188	srv_ctx->polling = 1;
189	} else {
190	status = OSSL_CMP_PKISTATUS_rejection;
191	fail_info = 1 << OSSL_CMP_PKIFAILUREINFO_systemFailure;
192	txt = "server application error";
193	err = ERR_peek_error();
194	errorCode = ERR_GET_REASON(err);
195	details = ERR_reason_error_string(err);
196	}
197
198	si = OSSL_CMP_STATUSINFO_new(status, fail_info, txt);
199	if (si == NULL)
200	return NULL;
201
202	msg = ossl_cmp_error_new(srv_ctx->ctx, si, errorCode, details,
203	srv_ctx->sendUnprotectedErrors);
204	OSSL_CMP_PKISI_free(si);
205	return msg;
206	}
207
208	/*
209	* Processes an ir/cr/p10cr/kur and returns a certification response.
210	* Only handles the first certification request contained in req
211	* returns an ip/cp/kup on success and NULL on error
212	*/
213	static OSSL_CMP_MSG process_cert_request(OSSL_CMP_SRV_CTX srv_ctx,
214	const OSSL_CMP_MSG *req)
215	{
216	OSSL_CMP_MSG *msg = NULL;
217	OSSL_CMP_PKISI *si = NULL;
218	X509 *certOut = NULL;
219	STACK_OF(X509) chainOut = NULL, caPubs = NULL;
220	const OSSL_CRMF_MSG *crm = NULL;
221	const X509_REQ *p10cr = NULL;
222	int bodytype;
223	int certReqId;
224
225	if (!ossl_assert(srv_ctx != NULL && srv_ctx->ctx != NULL && req != NULL))
226	return NULL;
227
228	switch (OSSL_CMP_MSG_get_bodytype(req)) {
229	case OSSL_CMP_PKIBODY_P10CR:
230	case OSSL_CMP_PKIBODY_CR:
231	bodytype = OSSL_CMP_PKIBODY_CP;
232	break;
233	case OSSL_CMP_PKIBODY_IR:
234	bodytype = OSSL_CMP_PKIBODY_IP;
235	break;
236	case OSSL_CMP_PKIBODY_KUR:
237	bodytype = OSSL_CMP_PKIBODY_KUP;
238	break;
239	default:
240	ERR_raise(ERR_LIB_CMP, CMP_R_UNEXPECTED_PKIBODY);
241	return NULL;
242	}
243
244	if (OSSL_CMP_MSG_get_bodytype(req) == OSSL_CMP_PKIBODY_P10CR) {
245	certReqId = OSSL_CMP_CERTREQID_NONE; /* p10cr does not include an Id */
246	p10cr = req->body->value.p10cr;
247	} else {
248	OSSL_CRMF_MSGS reqs = req->body->value.ir; / same for cr and kur */
249
250	if (sk_OSSL_CRMF_MSG_num(reqs) != 1) {
251	ERR_raise(ERR_LIB_CMP, CMP_R_MULTIPLE_REQUESTS_NOT_SUPPORTED);
252	return NULL;
253	}
254	if ((crm = sk_OSSL_CRMF_MSG_value(reqs, 0)) == NULL) {
255	ERR_raise(ERR_LIB_CMP, CMP_R_CERTREQMSG_NOT_FOUND);
256	return NULL;
257	}
258	certReqId = OSSL_CRMF_MSG_get_certReqId(crm);
259	if (certReqId != OSSL_CMP_CERTREQID) { /* so far, only possible value */
260	ERR_raise(ERR_LIB_CMP, CMP_R_BAD_REQUEST_ID);
261	return NULL;
262	}
263	}
264	srv_ctx->certReqId = certReqId;
265
266	if (!ossl_cmp_verify_popo(srv_ctx->ctx, req, srv_ctx->acceptRAVerified)) {
267	/* Proof of possession could not be verified */
268	si = OSSL_CMP_STATUSINFO_new(OSSL_CMP_PKISTATUS_rejection,
269	1 << OSSL_CMP_PKIFAILUREINFO_badPOP,
270	ERR_reason_error_string(ERR_peek_error()));
271	if (si == NULL)
272	return NULL;
273	} else {
274	OSSL_CMP_PKIHEADER *hdr = OSSL_CMP_MSG_get0_header(req);
275
276	si = srv_ctx->process_cert_request(srv_ctx, req, certReqId, crm, p10cr,
277	&certOut, &chainOut, &caPubs);
278	if (si == NULL)
279	goto err;
280	if (ossl_cmp_pkisi_get_status(si) == OSSL_CMP_PKISTATUS_waiting)
281	srv_ctx->polling = 1;
282	/* set OSSL_CMP_OPT_IMPLICIT_CONFIRM if and only if transaction ends */
283	if (!OSSL_CMP_CTX_set_option(srv_ctx->ctx,
284	OSSL_CMP_OPT_IMPLICIT_CONFIRM,
285	ossl_cmp_hdr_has_implicitConfirm(hdr)
286	&& srv_ctx->grantImplicitConfirm
287	/* do not set if polling starts: */
288	&& certOut != NULL))
289	goto err;
290	}
291
292	msg = ossl_cmp_certrep_new(srv_ctx->ctx, bodytype, certReqId, si,
293	certOut, NULL /* enc */, chainOut, caPubs,
294	srv_ctx->sendUnprotectedErrors);
295	/* When supporting OSSL_CRMF_POPO_KEYENC, "enc" will need to be set */
296	if (msg == NULL)
297	ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_CERTREP);
298
299	err:
300	OSSL_CMP_PKISI_free(si);
301	X509_free(certOut);
302	OSSL_STACK_OF_X509_free(chainOut);
303	OSSL_STACK_OF_X509_free(caPubs);
304	return msg;
305	}
306
307	static OSSL_CMP_MSG process_rr(OSSL_CMP_SRV_CTX srv_ctx,
308	const OSSL_CMP_MSG *req)
309	{
310	OSSL_CMP_MSG *msg = NULL;
311	OSSL_CMP_REVDETAILS *details;
312	OSSL_CRMF_CERTID *certId = NULL;
313	OSSL_CRMF_CERTTEMPLATE *tmpl;
314	const X509_NAME *issuer;
315	const ASN1_INTEGER *serial;
316	OSSL_CMP_PKISI *si;
317
318	if (!ossl_assert(srv_ctx != NULL && srv_ctx->ctx != NULL && req != NULL))
319	return NULL;
320
321	if (sk_OSSL_CMP_REVDETAILS_num(req->body->value.rr) != 1) {
322	ERR_raise(ERR_LIB_CMP, CMP_R_MULTIPLE_REQUESTS_NOT_SUPPORTED);
323	return NULL;
324	}
325	details = sk_OSSL_CMP_REVDETAILS_value(req->body->value.rr, 0);
326	if (details == NULL) {
327	ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_PROCESSING_MESSAGE);
328	return NULL;
329	}
330
331	tmpl = details->certDetails;
332	issuer = OSSL_CRMF_CERTTEMPLATE_get0_issuer(tmpl);
333	serial = OSSL_CRMF_CERTTEMPLATE_get0_serialNumber(tmpl);
334	if (issuer != NULL && serial != NULL
335	&& (certId = OSSL_CRMF_CERTID_gen(issuer, serial)) == NULL)
336	return NULL;
337	if ((si = srv_ctx->process_rr(srv_ctx, req, issuer, serial)) == NULL)
338	goto err;
339
340	if ((msg = ossl_cmp_rp_new(srv_ctx->ctx, si, certId,
341	srv_ctx->sendUnprotectedErrors)) == NULL)
342	ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_RR);
343
344	err:
345	OSSL_CRMF_CERTID_free(certId);
346	OSSL_CMP_PKISI_free(si);
347	return msg;
348	}
349
350	/*
351	* Processes genm and creates a genp message mirroring the contents of the
352	* incoming message
353	*/
354	static OSSL_CMP_MSG process_genm(OSSL_CMP_SRV_CTX srv_ctx,
355	const OSSL_CMP_MSG *req)
356	{
357	OSSL_CMP_GENMSGCONTENT *itavs;
358	OSSL_CMP_MSG *msg;
359
360	if (!ossl_assert(srv_ctx != NULL && srv_ctx->ctx != NULL && req != NULL))
361	return NULL;
362
363	if (!srv_ctx->process_genm(srv_ctx, req, req->body->value.genm, &itavs))
364	return NULL;
365
366	msg = ossl_cmp_genp_new(srv_ctx->ctx, itavs);
367	sk_OSSL_CMP_ITAV_pop_free(itavs, OSSL_CMP_ITAV_free);
368	return msg;
369	}
370
371	static OSSL_CMP_MSG process_error(OSSL_CMP_SRV_CTX srv_ctx,
372	const OSSL_CMP_MSG *req)
373	{
374	OSSL_CMP_ERRORMSGCONTENT *errorContent;
375	OSSL_CMP_MSG *msg;
376
377	if (!ossl_assert(srv_ctx != NULL && srv_ctx->ctx != NULL && req != NULL))
378	return NULL;
379	errorContent = req->body->value.error;
380	srv_ctx->process_error(srv_ctx, req, errorContent->pKIStatusInfo,
381	errorContent->errorCode, errorContent->errorDetails);
382
383	if ((msg = ossl_cmp_pkiconf_new(srv_ctx->ctx)) == NULL)
384	ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_PKICONF);
385	return msg;
386	}
387
388	static OSSL_CMP_MSG process_certConf(OSSL_CMP_SRV_CTX srv_ctx,
389	const OSSL_CMP_MSG *req)
390	{
391	OSSL_CMP_CTX *ctx;
392	OSSL_CMP_CERTCONFIRMCONTENT *ccc;
393	int num;
394	OSSL_CMP_MSG *msg = NULL;
395	OSSL_CMP_CERTSTATUS *status = NULL;
396
397	if (!ossl_assert(srv_ctx != NULL && srv_ctx->ctx != NULL && req != NULL))
398	return NULL;
399
400	ctx = srv_ctx->ctx;
401	ccc = req->body->value.certConf;
402	num = sk_OSSL_CMP_CERTSTATUS_num(ccc);
403
404	if (OSSL_CMP_CTX_get_option(ctx, OSSL_CMP_OPT_IMPLICIT_CONFIRM) == 1
405	\|\| ctx->status != OSSL_CMP_PKISTATUS_trans) {
406	ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_UNEXPECTED_CERTCONF);
407	return NULL;
408	}
409
410	if (num == 0) {
411	ossl_cmp_err(ctx, "certificate rejected by client");
412	} else {
413	if (num > 1)
414	ossl_cmp_warn(ctx, "All CertStatus but the first will be ignored");
415	status = sk_OSSL_CMP_CERTSTATUS_value(ccc, 0);
416	}
417
418	if (status != NULL) {
419	int certReqId = ossl_cmp_asn1_get_int(status->certReqId);
420	ASN1_OCTET_STRING *certHash = status->certHash;
421	OSSL_CMP_PKISI *si = status->statusInfo;
422
423	if (certReqId != srv_ctx->certReqId) {
424	ERR_raise(ERR_LIB_CMP, CMP_R_BAD_REQUEST_ID);
425	return NULL;
426	}
427	if (!srv_ctx->process_certConf(srv_ctx, req, certReqId, certHash, si))
428	return NULL; /* reason code may be: CMP_R_CERTHASH_UNMATCHED */
429
430	if (si != NULL
431	&& ossl_cmp_pkisi_get_status(si) != OSSL_CMP_PKISTATUS_accepted) {
432	int pki_status = ossl_cmp_pkisi_get_status(si);
433	const char *str = ossl_cmp_PKIStatus_to_string(pki_status);
434
435	ossl_cmp_log2(INFO, ctx, "certificate rejected by client %s %s",
436	str == NULL ? "without" : "with",
437	str == NULL ? "PKIStatus" : str);
438	}
439	}
440
441	if ((msg = ossl_cmp_pkiconf_new(ctx)) == NULL)
442	ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_PKICONF);
443	return msg;
444	}
445
446	/* pollReq is handled separately, to avoid recursive call */
447	static OSSL_CMP_MSG process_non_polling_request(OSSL_CMP_SRV_CTX srv_ctx,
448	const OSSL_CMP_MSG *req)
449	{
450	OSSL_CMP_MSG *rsp = NULL;
451
452	if (!ossl_assert(srv_ctx != NULL && srv_ctx->ctx != NULL && req != NULL
453	&& req->body != NULL))
454	return NULL;
455
456	switch (OSSL_CMP_MSG_get_bodytype(req)) {
457	case OSSL_CMP_PKIBODY_IR:
458	case OSSL_CMP_PKIBODY_CR:
459	case OSSL_CMP_PKIBODY_P10CR:
460	case OSSL_CMP_PKIBODY_KUR:
461	if (srv_ctx->process_cert_request == NULL)
462	ERR_raise(ERR_LIB_CMP, CMP_R_UNSUPPORTED_PKIBODY);
463	else
464	rsp = process_cert_request(srv_ctx, req);
465	break;
466	case OSSL_CMP_PKIBODY_RR:
467	if (srv_ctx->process_rr == NULL)
468	ERR_raise(ERR_LIB_CMP, CMP_R_UNSUPPORTED_PKIBODY);
469	else
470	rsp = process_rr(srv_ctx, req);
471	break;
472	case OSSL_CMP_PKIBODY_GENM:
473	if (srv_ctx->process_genm == NULL)
474	ERR_raise(ERR_LIB_CMP, CMP_R_UNSUPPORTED_PKIBODY);
475	else
476	rsp = process_genm(srv_ctx, req);
477	break;
478	case OSSL_CMP_PKIBODY_ERROR:
479	if (srv_ctx->process_error == NULL)
480	ERR_raise(ERR_LIB_CMP, CMP_R_UNSUPPORTED_PKIBODY);
481	else
482	rsp = process_error(srv_ctx, req);
483	break;
484	case OSSL_CMP_PKIBODY_CERTCONF:
485	if (srv_ctx->process_certConf == NULL)
486	ERR_raise(ERR_LIB_CMP, CMP_R_UNSUPPORTED_PKIBODY);
487	else
488	rsp = process_certConf(srv_ctx, req);
489	break;
490
491	case OSSL_CMP_PKIBODY_POLLREQ:
492	ERR_raise(ERR_LIB_CMP, CMP_R_UNEXPECTED_PKIBODY);
493	break;
494	default:
495	ERR_raise(ERR_LIB_CMP, CMP_R_UNSUPPORTED_PKIBODY);
496	break;
497	}
498
499	return rsp;
500	}
501
502	static OSSL_CMP_MSG process_pollReq(OSSL_CMP_SRV_CTX srv_ctx,
503	const OSSL_CMP_MSG *req)
504	{
505	OSSL_CMP_POLLREQCONTENT *prc;
506	OSSL_CMP_POLLREQ *pr;
507	int certReqId;
508	OSSL_CMP_MSG *orig_req;
509	int64_t check_after = 0;
510	OSSL_CMP_MSG *msg = NULL;
511
512	if (!ossl_assert(srv_ctx != NULL && srv_ctx->ctx != NULL && req != NULL))
513	return NULL;
514
515	if (!srv_ctx->polling) {
516	ERR_raise(ERR_LIB_CMP, CMP_R_UNEXPECTED_PKIBODY);
517	return NULL;
518	}
519
520	prc = req->body->value.pollReq;
521	if (sk_OSSL_CMP_POLLREQ_num(prc) != 1) {
522	ERR_raise(ERR_LIB_CMP, CMP_R_MULTIPLE_REQUESTS_NOT_SUPPORTED);
523	return NULL;
524	}
525
526	pr = sk_OSSL_CMP_POLLREQ_value(prc, 0);
527	certReqId = ossl_cmp_asn1_get_int(pr->certReqId);
528	if (!srv_ctx->process_pollReq(srv_ctx, req, certReqId,
529	&orig_req, &check_after))
530	return NULL;
531
532	if (orig_req != NULL) {
533	srv_ctx->polling = 0;
534	msg = process_non_polling_request(srv_ctx, orig_req);
535	OSSL_CMP_MSG_free(orig_req);
536	} else {
537	if ((msg = ossl_cmp_pollRep_new(srv_ctx->ctx, certReqId,
538	check_after)) == NULL)
539	ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_POLLREP);
540	}
541	return msg;
542	}
543
544	/*
545	* Determine whether missing/invalid protection of request message is allowed.
546	* Return 1 on acceptance, 0 on rejection, or -1 on (internal) error.
547	*/
548	static int unprotected_exception(const OSSL_CMP_CTX *ctx,
549	const OSSL_CMP_MSG *req,
550	int invalid_protection,
551	int accept_unprotected_requests)
552	{
553	if (!ossl_assert(ctx != NULL && req != NULL))
554	return -1;
555
556	if (accept_unprotected_requests) {
557	ossl_cmp_log1(WARN, ctx, "ignoring %s protection of request message",
558	invalid_protection ? "invalid" : "missing");
559	return 1;
560	}
561	if (OSSL_CMP_MSG_get_bodytype(req) == OSSL_CMP_PKIBODY_ERROR
562	&& OSSL_CMP_CTX_get_option(ctx, OSSL_CMP_OPT_UNPROTECTED_ERRORS) == 1) {
563	ossl_cmp_warn(ctx, "ignoring missing protection of error message");
564	return 1;
565	}
566	return 0;
567	}
568
569	/*
570	* returns created message and NULL on internal error
571	*/
572	OSSL_CMP_MSG OSSL_CMP_SRV_process_request(OSSL_CMP_SRV_CTX srv_ctx,
573	const OSSL_CMP_MSG *req)
574	{
575	OSSL_CMP_CTX *ctx;
576	ASN1_OCTET_STRING *backup_secret;
577	OSSL_CMP_PKIHEADER *hdr;
578	int req_type, rsp_type;
579	int req_verified = 0;
580	OSSL_CMP_MSG *rsp = NULL;
581
582	if (srv_ctx == NULL \|\| srv_ctx->ctx == NULL
583	\|\| req == NULL \|\| req->body == NULL
584	\|\| (hdr = OSSL_CMP_MSG_get0_header(req)) == NULL) {
585	ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
586	return 0;
587	}
588	ctx = srv_ctx->ctx;
589	backup_secret = ctx->secretValue;
590	req_type = OSSL_CMP_MSG_get_bodytype(req);
591	ossl_cmp_log1(DEBUG, ctx,
592	"received %s", ossl_cmp_bodytype_to_string(req_type));
593
594	/*
595	* Some things need to be done already before validating the message in
596	* order to be able to send an error message as far as needed and possible.
597	*/
598	if (hdr->sender->type != GEN_DIRNAME) {
599	ERR_raise(ERR_LIB_CMP, CMP_R_SENDER_GENERALNAME_TYPE_NOT_SUPPORTED);
600	goto err;
601	}
602	if (!OSSL_CMP_CTX_set1_recipient(ctx, hdr->sender->d.directoryName))
603	goto err;
604
605	if (srv_ctx->polling && req_type != OSSL_CMP_PKIBODY_POLLREQ
606	&& req_type != OSSL_CMP_PKIBODY_ERROR) {
607	ERR_raise(ERR_LIB_CMP, CMP_R_EXPECTED_POLLREQ);
608	goto err;
609	}
610
611	switch (req_type) {
612	case OSSL_CMP_PKIBODY_IR:
613	case OSSL_CMP_PKIBODY_CR:
614	case OSSL_CMP_PKIBODY_P10CR:
615	case OSSL_CMP_PKIBODY_KUR:
616	case OSSL_CMP_PKIBODY_RR:
617	case OSSL_CMP_PKIBODY_GENM:
618	case OSSL_CMP_PKIBODY_ERROR:
619	if (ctx->transactionID != NULL) {
620	char *tid = i2s_ASN1_OCTET_STRING(NULL, ctx->transactionID);
621
622	if (tid != NULL)
623	ossl_cmp_log1(WARN, ctx,
624	"Assuming that last transaction with ID=%s got aborted",
625	tid);
626	OPENSSL_free(tid);
627	}
628	/* start of a new transaction, reset transactionID and senderNonce */
629	if (!OSSL_CMP_CTX_set1_transactionID(ctx, NULL)
630	\|\| !OSSL_CMP_CTX_set1_senderNonce(ctx, NULL))
631	goto err;
632
633	if (srv_ctx->clean_transaction != NULL
634	&& !srv_ctx->clean_transaction(srv_ctx, NULL)) {
635	ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_PROCESSING_MESSAGE);
636	goto err;
637	}
638
639	break;
640	default:
641	/* transactionID should be already initialized */
642	if (ctx->transactionID == NULL) {
643	#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
644	ERR_raise(ERR_LIB_CMP, CMP_R_UNEXPECTED_PKIBODY);
645	goto err;
646	#endif
647	}
648	}
649
650	req_verified = ossl_cmp_msg_check_update(ctx, req, unprotected_exception,
651	srv_ctx->acceptUnprotected);
652	if (ctx->secretValue != NULL && ctx->pkey != NULL
653	&& ossl_cmp_hdr_get_protection_nid(hdr) != NID_id_PasswordBasedMAC)
654	ctx->secretValue = NULL; /* use MSG_SIG_ALG when protecting rsp */
655	if (!req_verified)
656	goto err;
657
658	if (req_type == OSSL_CMP_PKIBODY_POLLREQ) {
659	if (srv_ctx->process_pollReq == NULL)
660	ERR_raise(ERR_LIB_CMP, CMP_R_UNSUPPORTED_PKIBODY);
661	else
662	rsp = process_pollReq(srv_ctx, req);
663	} else {
664	if (srv_ctx->delayed_delivery != NULL
665	&& (rsp = delayed_delivery(srv_ctx, req)) != NULL) {
666	goto err;
667	}
668	rsp = process_non_polling_request(srv_ctx, req);
669	}
670
671	err:
672	if (rsp == NULL) {
673	/* on error, try to respond with CMP error message to client */
674	const char data = NULL, reason = NULL;
675	int flags = 0;
676	unsigned long err = ERR_peek_error_data(&data, &flags);
677	int fail_info = 1 << OSSL_CMP_PKIFAILUREINFO_badRequest;
678	/* fail_info is not very specific */
679	OSSL_CMP_PKISI *si = NULL;
680
681	if (!req_verified) {
682	/*
683	* Above ossl_cmp_msg_check_update() was not successfully executed,
684	* which normally would set ctx->transactionID and ctx->recipNonce.
685	* So anyway try to provide the right transactionID and recipNonce,
686	* while ignoring any (extra) error in next two function calls.
687	*/
688	if (ctx->transactionID == NULL)
689	(void)OSSL_CMP_CTX_set1_transactionID(ctx, hdr->transactionID);
690	(void)ossl_cmp_ctx_set1_recipNonce(ctx, hdr->senderNonce);
691	}
692
693	if ((flags & ERR_TXT_STRING) == 0 \|\| *data == '\0')
694	data = NULL;
695	reason = ERR_reason_error_string(err);
696	if ((si = OSSL_CMP_STATUSINFO_new(OSSL_CMP_PKISTATUS_rejection,
697	fail_info, reason)) != NULL) {
698	rsp = ossl_cmp_error_new(srv_ctx->ctx, si, err,
699	data, srv_ctx->sendUnprotectedErrors);
700	OSSL_CMP_PKISI_free(si);
701	}
702	}
703	OSSL_CMP_CTX_print_errors(ctx);
704	ctx->secretValue = backup_secret;
705
706	rsp_type =
707	rsp != NULL ? OSSL_CMP_MSG_get_bodytype(rsp) : OSSL_CMP_PKIBODY_ERROR;
708	if (rsp != NULL)
709	ossl_cmp_log1(DEBUG, ctx,
710	"sending %s", ossl_cmp_bodytype_to_string(rsp_type));
711	else
712	ossl_cmp_log(ERR, ctx, "cannot send proper CMP response");
713
714	/* determine whether to keep the transaction open or not */
715	ctx->status = OSSL_CMP_PKISTATUS_trans;
716	switch (rsp_type) {
717	case OSSL_CMP_PKIBODY_IP:
718	case OSSL_CMP_PKIBODY_CP:
719	case OSSL_CMP_PKIBODY_KUP:
720	if (OSSL_CMP_CTX_get_option(ctx, OSSL_CMP_OPT_IMPLICIT_CONFIRM) == 0)
721	break;
722	/* fall through */
723
724	case OSSL_CMP_PKIBODY_ERROR:
725	if (rsp != NULL && ossl_cmp_is_error_with_waiting(rsp))
726	break;
727	/* fall through */
728
729	case OSSL_CMP_PKIBODY_RP:
730	case OSSL_CMP_PKIBODY_PKICONF:
731	case OSSL_CMP_PKIBODY_GENP:
732	/* Other terminating response message types are not supported */
733	srv_ctx->certReqId = OSSL_CMP_CERTREQID_INVALID;
734	/* Prepare for next transaction, ignoring any errors here: */
735	if (srv_ctx->clean_transaction != NULL)
736	(void)srv_ctx->clean_transaction(srv_ctx, ctx->transactionID);
737	(void)OSSL_CMP_CTX_set1_transactionID(ctx, NULL);
738	(void)OSSL_CMP_CTX_set1_senderNonce(ctx, NULL);
739	ctx->status = OSSL_CMP_PKISTATUS_unspecified; /* transaction closed */
740
741	default: /* not closing transaction in other cases */
742	break;
743	}
744	return rsp;
745	}
746
747	/*
748	* Server interface that may substitute OSSL_CMP_MSG_http_perform at the client.
749	* The OSSL_CMP_SRV_CTX must be set as client_ctx->transfer_cb_arg.
750	* returns received message on success, else NULL and pushes an element on the
751	* error stack.
752	*/
753	OSSL_CMP_MSG OSSL_CMP_CTX_server_perform(OSSL_CMP_CTX client_ctx,
754	const OSSL_CMP_MSG *req)
755	{
756	OSSL_CMP_SRV_CTX *srv_ctx = NULL;
757
758	if (client_ctx == NULL \|\| req == NULL) {
759	ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
760	return NULL;
761	}
762
763	if ((srv_ctx = OSSL_CMP_CTX_get_transfer_cb_arg(client_ctx)) == NULL) {
764	ERR_raise(ERR_LIB_CMP, CMP_R_TRANSFER_ERROR);
765	return NULL;
766	}
767
768	return OSSL_CMP_SRV_process_request(srv_ctx, req);
769	}

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/libs/openssl-3.4.1/crypto/cmp/cmp_server.c

Download in other formats: