cmp_client.c@ 107935

Last change on this file since 107935 was 104078, checked in by vboxsync, 11 months ago
openssl-3.1.5: Applied and adjusted our OpenSSL changes to 3.1.4. bugref:10638
File size: 33.1 KB

Line
1	/*
2	* Copyright 2007-2023 The OpenSSL Project Authors. All Rights Reserved.
3	* Copyright Nokia 2007-2019
4	* Copyright Siemens AG 2015-2019
5	*
6	* Licensed under the Apache License 2.0 (the "License"). You may not use
7	* this file except in compliance with the License. You can obtain a copy
8	* in the file LICENSE in the source distribution or at
9	* https://www.openssl.org/source/license.html
10	*/
11
12	#include "cmp_local.h"
13	#include "internal/cryptlib.h"
14	#include "internal/e_os.h" /* ossl_sleep() */
15
16	/* explicit #includes not strictly needed since implied by the above: */
17	#include <openssl/bio.h>
18	#include <openssl/cmp.h>
19	#include <openssl/err.h>
20	#include <openssl/evp.h>
21	#include <openssl/x509v3.h>
22	#include <openssl/cmp_util.h>
23
24	#define IS_CREP(t) ((t) == OSSL_CMP_PKIBODY_IP \|\| (t) == OSSL_CMP_PKIBODY_CP \
25	\|\| (t) == OSSL_CMP_PKIBODY_KUP)
26
27	/*-
28	* Evaluate whether there's an exception (violating the standard) configured for
29	* handling negative responses without protection or with invalid protection.
30	* Returns 1 on acceptance, 0 on rejection, or -1 on (internal) error.
31	*/
32	static int unprotected_exception(const OSSL_CMP_CTX *ctx,
33	const OSSL_CMP_MSG *rep,
34	int invalid_protection,
35	int expected_type /* ignored here */)
36	{
37	int rcvd_type = OSSL_CMP_MSG_get_bodytype(rep /* may be NULL */);
38	const char *msg_type = NULL;
39
40	if (!ossl_assert(ctx != NULL && rep != NULL))
41	return -1;
42
43	if (!ctx->unprotectedErrors)
44	return 0;
45
46	switch (rcvd_type) {
47	case OSSL_CMP_PKIBODY_ERROR:
48	msg_type = "error response";
49	break;
50	case OSSL_CMP_PKIBODY_RP:
51	{
52	OSSL_CMP_PKISI *si =
53	ossl_cmp_revrepcontent_get_pkisi(rep->body->value.rp,
54	OSSL_CMP_REVREQSID);
55
56	if (si == NULL)
57	return -1;
58	if (ossl_cmp_pkisi_get_status(si) == OSSL_CMP_PKISTATUS_rejection)
59	msg_type = "revocation response message with rejection status";
60	break;
61	}
62	case OSSL_CMP_PKIBODY_PKICONF:
63	msg_type = "PKI Confirmation message";
64	break;
65	default:
66	if (IS_CREP(rcvd_type)) {
67	int any_rid = OSSL_CMP_CERTREQID_NONE;
68	OSSL_CMP_CERTREPMESSAGE *crepmsg = rep->body->value.ip;
69	OSSL_CMP_CERTRESPONSE *crep =
70	ossl_cmp_certrepmessage_get0_certresponse(crepmsg, any_rid);
71
72	if (sk_OSSL_CMP_CERTRESPONSE_num(crepmsg->response) > 1)
73	return -1;
74	if (crep == NULL)
75	return -1;
76	if (ossl_cmp_pkisi_get_status(crep->status)
77	== OSSL_CMP_PKISTATUS_rejection)
78	msg_type = "CertRepMessage with rejection status";
79	}
80	}
81	if (msg_type == NULL)
82	return 0;
83	ossl_cmp_log2(WARN, ctx, "ignoring %s protection of %s",
84	invalid_protection ? "invalid" : "missing", msg_type);
85	return 1;
86	}
87
88	/* Save error info from PKIStatusInfo field of a certresponse into ctx */
89	static int save_statusInfo(OSSL_CMP_CTX ctx, OSSL_CMP_PKISI si)
90	{
91	int i;
92	OSSL_CMP_PKIFREETEXT *ss;
93
94	if (!ossl_assert(ctx != NULL && si != NULL))
95	return 0;
96
97	ctx->status = ossl_cmp_pkisi_get_status(si);
98	if (ctx->status < OSSL_CMP_PKISTATUS_accepted)
99	return 0;
100
101	ctx->failInfoCode = ossl_cmp_pkisi_get_pkifailureinfo(si);
102
103	if (!ossl_cmp_ctx_set0_statusString(ctx, sk_ASN1_UTF8STRING_new_null())
104	\|\| (ctx->statusString == NULL))
105	return 0;
106
107	ss = si->statusString; /* may be NULL */
108	for (i = 0; i < sk_ASN1_UTF8STRING_num(ss); i++) {
109	ASN1_UTF8STRING *str = sk_ASN1_UTF8STRING_value(ss, i);
110
111	if (!sk_ASN1_UTF8STRING_push(ctx->statusString, ASN1_STRING_dup(str)))
112	return 0;
113	}
114	return 1;
115	}
116
117	/*-
118	* Perform the generic aspects of sending a request and receiving a response.
119	* Returns 1 on success and provides the received PKIMESSAGE in *rep.
120	* Returns 0 on error.
121	* Regardless of success, caller is responsible for freeing *rep (unless NULL).
122	*/
123	static int send_receive_check(OSSL_CMP_CTX ctx, const OSSL_CMP_MSG req,
124	OSSL_CMP_MSG **rep, int expected_type)
125	{
126	int begin_transaction =
127	expected_type != OSSL_CMP_PKIBODY_POLLREP
128	&& expected_type != OSSL_CMP_PKIBODY_PKICONF;
129	const char *req_type_str =
130	ossl_cmp_bodytype_to_string(OSSL_CMP_MSG_get_bodytype(req));
131	const char *expected_type_str = ossl_cmp_bodytype_to_string(expected_type);
132	int bak_msg_timeout = ctx->msg_timeout;
133	int bt;
134	time_t now = time(NULL);
135	int time_left;
136	OSSL_CMP_transfer_cb_t transfer_cb = ctx->transfer_cb;
137
138	if (transfer_cb == NULL)
139	transfer_cb = OSSL_CMP_MSG_http_perform;
140	*rep = NULL;
141
142	if (ctx->total_timeout != 0 /* not waiting indefinitely */) {
143	if (begin_transaction)
144	ctx->end_time = now + ctx->total_timeout;
145	if (now >= ctx->end_time) {
146	ERR_raise(ERR_LIB_CMP, CMP_R_TOTAL_TIMEOUT);
147	return 0;
148	}
149	if (!ossl_assert(ctx->end_time - now < INT_MAX)) {
150	/* actually cannot happen due to assignment in initial_certreq() */
151	ERR_raise(ERR_LIB_CMP, CMP_R_INVALID_ARGS);
152	return 0;
153	}
154	time_left = (int)(ctx->end_time - now);
155	if (ctx->msg_timeout == 0 \|\| time_left < ctx->msg_timeout)
156	ctx->msg_timeout = time_left;
157	}
158
159	/* should print error queue since transfer_cb may call ERR_clear_error() */
160	OSSL_CMP_CTX_print_errors(ctx);
161
162	ossl_cmp_log1(INFO, ctx, "sending %s", req_type_str);
163
164	rep = (transfer_cb)(ctx, req);
165	ctx->msg_timeout = bak_msg_timeout;
166
167	if (*rep == NULL) {
168	ERR_raise_data(ERR_LIB_CMP,
169	ctx->total_timeout != 0 && time(NULL) >= ctx->end_time ?
170	CMP_R_TOTAL_TIMEOUT : CMP_R_TRANSFER_ERROR,
171	"request sent: %s, expected response: %s",
172	req_type_str, expected_type_str);
173	return 0;
174	}
175
176	bt = OSSL_CMP_MSG_get_bodytype(*rep);
177	/*
178	* The body type in the 'bt' variable is not yet verified.
179	* Still we use this preliminary value already for a progress report because
180	* the following msg verification may also produce log entries and may fail.
181	*/
182	ossl_cmp_log1(INFO, ctx, "received %s", ossl_cmp_bodytype_to_string(bt));
183
184	/* copy received extraCerts to ctx->extraCertsIn so they can be retrieved */
185	if (bt != OSSL_CMP_PKIBODY_POLLREP && bt != OSSL_CMP_PKIBODY_PKICONF
186	&& !ossl_cmp_ctx_set1_extraCertsIn(ctx, (*rep)->extraCerts))
187	return 0;
188
189	if (!ossl_cmp_msg_check_update(ctx, *rep, unprotected_exception,
190	expected_type))
191	return 0;
192
193	if (bt == expected_type
194	/* as an answer to polling, there could be IP/CP/KUP: */
195	\|\| (IS_CREP(bt) && expected_type == OSSL_CMP_PKIBODY_POLLREP))
196	return 1;
197
198	/* received message type is not one of the expected ones (e.g., error) */
199	ERR_raise(ERR_LIB_CMP, bt == OSSL_CMP_PKIBODY_ERROR ? CMP_R_RECEIVED_ERROR :
200	CMP_R_UNEXPECTED_PKIBODY); /* in next line for mkerr.pl */
201
202	if (bt != OSSL_CMP_PKIBODY_ERROR) {
203	ERR_add_error_data(3, "message type is '",
204	ossl_cmp_bodytype_to_string(bt), "'");
205	} else {
206	OSSL_CMP_ERRORMSGCONTENT emc = (rep)->body->value.error;
207	OSSL_CMP_PKISI *si = emc->pKIStatusInfo;
208	char buf[OSSL_CMP_PKISI_BUFLEN];
209
210	if (save_statusInfo(ctx, si)
211	&& OSSL_CMP_CTX_snprint_PKIStatus(ctx, buf,
212	sizeof(buf)) != NULL)
213	ERR_add_error_data(1, buf);
214	if (emc->errorCode != NULL
215	&& BIO_snprintf(buf, sizeof(buf), "; errorCode: %08lX",
216	ASN1_INTEGER_get(emc->errorCode)) > 0)
217	ERR_add_error_data(1, buf);
218	if (emc->errorDetails != NULL) {
219	char *text = ossl_sk_ASN1_UTF8STRING2text(emc->errorDetails, ", ",
220	OSSL_CMP_PKISI_BUFLEN - 1);
221
222	if (text != NULL && *text != '\0')
223	ERR_add_error_data(2, "; errorDetails: ", text);
224	OPENSSL_free(text);
225	}
226	if (ctx->status != OSSL_CMP_PKISTATUS_rejection) {
227	ERR_raise(ERR_LIB_CMP, CMP_R_UNEXPECTED_PKISTATUS);
228	if (ctx->status == OSSL_CMP_PKISTATUS_waiting)
229	ctx->status = OSSL_CMP_PKISTATUS_rejection;
230	}
231	}
232	return 0;
233	}
234
235	/*-
236	* When a 'waiting' PKIStatus has been received, this function is used to
237	* poll, which should yield a pollRep or finally a CertRepMessage in ip/cp/kup.
238	* On receiving a pollRep, which includes a checkAfter value, it return this
239	* value if sleep == 0, else it sleeps as long as indicated and retries.
240	*
241	* A transaction timeout is enabled if ctx->total_timeout is != 0.
242	* In this case polling will continue until the timeout is reached and then
243	* polling is done a last time even if this is before the "checkAfter" time.
244	*
245	* Returns -1 on receiving pollRep if sleep == 0, setting the checkAfter value.
246	* Returns 1 on success and provides the received PKIMESSAGE in *rep.
247	* In this case the caller is responsible for freeing *rep.
248	* Returns 0 on error (which includes the case that timeout has been reached).
249	*/
250	static int poll_for_response(OSSL_CMP_CTX *ctx, int sleep, int rid,
251	OSSL_CMP_MSG *rep, int checkAfter)
252	{
253	OSSL_CMP_MSG *preq = NULL;
254	OSSL_CMP_MSG *prep = NULL;
255
256	ossl_cmp_info(ctx,
257	"received 'waiting' PKIStatus, starting to poll for response");
258	*rep = NULL;
259	for (;;) {
260	if ((preq = ossl_cmp_pollReq_new(ctx, rid)) == NULL)
261	goto err;
262
263	if (!send_receive_check(ctx, preq, &prep, OSSL_CMP_PKIBODY_POLLREP))
264	goto err;
265
266	/* handle potential pollRep */
267	if (OSSL_CMP_MSG_get_bodytype(prep) == OSSL_CMP_PKIBODY_POLLREP) {
268	OSSL_CMP_POLLREPCONTENT *prc = prep->body->value.pollRep;
269	OSSL_CMP_POLLREP *pollRep = NULL;
270	int64_t check_after;
271	char str[OSSL_CMP_PKISI_BUFLEN];
272	int len;
273
274	if (sk_OSSL_CMP_POLLREP_num(prc) > 1) {
275	ERR_raise(ERR_LIB_CMP, CMP_R_MULTIPLE_RESPONSES_NOT_SUPPORTED);
276	goto err;
277	}
278	pollRep = ossl_cmp_pollrepcontent_get0_pollrep(prc, rid);
279	if (pollRep == NULL)
280	goto err;
281
282	if (!ASN1_INTEGER_get_int64(&check_after, pollRep->checkAfter)) {
283	ERR_raise(ERR_LIB_CMP, CMP_R_BAD_CHECKAFTER_IN_POLLREP);
284	goto err;
285	}
286	if (check_after < 0 \|\| (uint64_t)check_after
287	> (sleep ? ULONG_MAX / 1000 : INT_MAX)) {
288	ERR_raise(ERR_LIB_CMP, CMP_R_CHECKAFTER_OUT_OF_RANGE);
289	if (BIO_snprintf(str, OSSL_CMP_PKISI_BUFLEN, "value = %jd",
290	check_after) >= 0)
291	ERR_add_error_data(1, str);
292	goto err;
293	}
294
295	if (pollRep->reason == NULL
296	\|\| (len = BIO_snprintf(str, OSSL_CMP_PKISI_BUFLEN,
297	" with reason = '")) < 0) {
298	*str = '\0';
299	} else {
300	char *text = ossl_sk_ASN1_UTF8STRING2text(pollRep->reason, ", ",
301	sizeof(str) - len - 2);
302
303	if (text == NULL
304	\|\| BIO_snprintf(str + len, sizeof(str) - len,
305	"%s'", text) < 0)
306	*str = '\0';
307	OPENSSL_free(text);
308	}
309	ossl_cmp_log2(INFO, ctx,
310	"received polling response%s; checkAfter = %ld seconds",
311	str, check_after);
312
313	if (ctx->total_timeout != 0) { /* timeout is not infinite */
314	const int exp = 5; /* expected max time per msg round trip */
315	int64_t time_left = (int64_t)(ctx->end_time - exp - time(NULL));
316
317	if (time_left <= 0) {
318	ERR_raise(ERR_LIB_CMP, CMP_R_TOTAL_TIMEOUT);
319	goto err;
320	}
321	if (time_left < check_after)
322	check_after = time_left;
323	/* poll one last time just when timeout was reached */
324	}
325
326	OSSL_CMP_MSG_free(preq);
327	preq = NULL;
328	OSSL_CMP_MSG_free(prep);
329	prep = NULL;
330	if (sleep) {
331	ossl_sleep((unsigned long)(1000 * check_after));
332	} else {
333	if (checkAfter != NULL)
334	*checkAfter = (int)check_after;
335	return -1; /* exits the loop */
336	}
337	} else {
338	ossl_cmp_info(ctx, "received ip/cp/kup after polling");
339	/* any other body type has been rejected by send_receive_check() */
340	break;
341	}
342	}
343	if (prep == NULL)
344	goto err;
345
346	OSSL_CMP_MSG_free(preq);
347	*rep = prep;
348
349	return 1;
350	err:
351	OSSL_CMP_MSG_free(preq);
352	OSSL_CMP_MSG_free(prep);
353	return 0;
354	}
355
356	/*
357	* Send certConf for IR, CR or KUR sequences and check response,
358	* not modifying ctx->status during the certConf exchange
359	*/
360	int ossl_cmp_exchange_certConf(OSSL_CMP_CTX *ctx, int certReqId,
361	int fail_info, const char *txt)
362	{
363	OSSL_CMP_MSG *certConf;
364	OSSL_CMP_MSG *PKIconf = NULL;
365	int res = 0;
366
367	/* OSSL_CMP_certConf_new() also checks if all necessary options are set */
368	certConf = ossl_cmp_certConf_new(ctx, certReqId, fail_info, txt);
369	if (certConf == NULL)
370	goto err;
371
372	res = send_receive_check(ctx, certConf, &PKIconf, OSSL_CMP_PKIBODY_PKICONF);
373
374	err:
375	OSSL_CMP_MSG_free(certConf);
376	OSSL_CMP_MSG_free(PKIconf);
377	return res;
378	}
379
380	/* Send given error and check response */
381	int ossl_cmp_exchange_error(OSSL_CMP_CTX *ctx, int status, int fail_info,
382	const char txt, int errorCode, const char details)
383	{
384	OSSL_CMP_MSG *error = NULL;
385	OSSL_CMP_PKISI *si = NULL;
386	OSSL_CMP_MSG *PKIconf = NULL;
387	int res = 0;
388
389	/* not overwriting ctx->status on error exchange */
390	if ((si = OSSL_CMP_STATUSINFO_new(status, fail_info, txt)) == NULL)
391	goto err;
392	/* ossl_cmp_error_new() also checks if all necessary options are set */
393	if ((error = ossl_cmp_error_new(ctx, si, errorCode, details, 0)) == NULL)
394	goto err;
395
396	res = send_receive_check(ctx, error, &PKIconf, OSSL_CMP_PKIBODY_PKICONF);
397
398	err:
399	OSSL_CMP_MSG_free(error);
400	OSSL_CMP_PKISI_free(si);
401	OSSL_CMP_MSG_free(PKIconf);
402	return res;
403	}
404
405	/*-
406	* Retrieve a copy of the certificate, if any, from the given CertResponse.
407	* Take into account PKIStatusInfo of CertResponse in ctx, report it on error.
408	* Returns NULL if not found or on error.
409	*/
410	static X509 get1_cert_status(OSSL_CMP_CTX ctx, int bodytype,
411	OSSL_CMP_CERTRESPONSE *crep)
412	{
413	char buf[OSSL_CMP_PKISI_BUFLEN];
414	X509 *crt = NULL;
415
416	if (!ossl_assert(ctx != NULL && crep != NULL))
417	return NULL;
418
419	switch (ossl_cmp_pkisi_get_status(crep->status)) {
420	case OSSL_CMP_PKISTATUS_waiting:
421	ossl_cmp_err(ctx,
422	"received \"waiting\" status for cert when actually aiming to extract cert");
423	ERR_raise(ERR_LIB_CMP, CMP_R_ENCOUNTERED_WAITING);
424	goto err;
425	case OSSL_CMP_PKISTATUS_grantedWithMods:
426	ossl_cmp_warn(ctx, "received \"grantedWithMods\" for certificate");
427	break;
428	case OSSL_CMP_PKISTATUS_accepted:
429	break;
430	/* get all information in case of a rejection before going to error */
431	case OSSL_CMP_PKISTATUS_rejection:
432	ossl_cmp_err(ctx, "received \"rejection\" status rather than cert");
433	ERR_raise(ERR_LIB_CMP, CMP_R_REQUEST_REJECTED_BY_SERVER);
434	goto err;
435	case OSSL_CMP_PKISTATUS_revocationWarning:
436	ossl_cmp_warn(ctx,
437	"received \"revocationWarning\" - a revocation of the cert is imminent");
438	break;
439	case OSSL_CMP_PKISTATUS_revocationNotification:
440	ossl_cmp_warn(ctx,
441	"received \"revocationNotification\" - a revocation of the cert has occurred");
442	break;
443	case OSSL_CMP_PKISTATUS_keyUpdateWarning:
444	if (bodytype != OSSL_CMP_PKIBODY_KUR) {
445	ERR_raise(ERR_LIB_CMP, CMP_R_ENCOUNTERED_KEYUPDATEWARNING);
446	goto err;
447	}
448	break;
449	default:
450	ossl_cmp_log1(ERROR, ctx,
451	"received unsupported PKIStatus %d for certificate",
452	ctx->status);
453	ERR_raise(ERR_LIB_CMP, CMP_R_UNKNOWN_PKISTATUS);
454	goto err;
455	}
456	crt = ossl_cmp_certresponse_get1_cert(ctx, crep);
457	if (crt == NULL) /* according to PKIStatus, we can expect a cert */
458	ERR_raise(ERR_LIB_CMP, CMP_R_CERTIFICATE_NOT_FOUND);
459
460	return crt;
461
462	err:
463	if (OSSL_CMP_CTX_snprint_PKIStatus(ctx, buf, sizeof(buf)) != NULL)
464	ERR_add_error_data(1, buf);
465	return NULL;
466	}
467
468	/*-
469	* Callback fn validating that the new certificate can be verified, using
470	* ctx->certConf_cb_arg, which has been initialized using opt_out_trusted, and
471	* ctx->untrusted, which at this point already contains msg->extraCerts.
472	* Returns 0 on acceptance, else a bit field reflecting PKIFailureInfo.
473	* Quoting from RFC 4210 section 5.1. Overall PKI Message:
474	* The extraCerts field can contain certificates that may be useful to
475	* the recipient. For example, this can be used by a CA or RA to
476	* present an end entity with certificates that it needs to verify its
477	* own new certificate (if, for example, the CA that issued the end
478	* entity's certificate is not a root CA for the end entity). Note that
479	* this field does not necessarily contain a certification path; the
480	* recipient may have to sort, select from, or otherwise process the
481	* extra certificates in order to use them.
482	* Note: While often handy, there is no hard requirement by CMP that
483	* an EE must be able to validate the certificates it gets enrolled.
484	*/
485	int OSSL_CMP_certConf_cb(OSSL_CMP_CTX ctx, X509 cert, int fail_info,
486	const char **text)
487	{
488	X509_STORE *out_trusted = OSSL_CMP_CTX_get_certConf_cb_arg(ctx);
489	STACK_OF(X509) *chain = NULL;
490	(void)text; /* make (artificial) use of var to prevent compiler warning */
491
492	if (fail_info != 0) /* accept any error flagged by CMP core library */
493	return fail_info;
494
495	if (out_trusted == NULL) {
496	ossl_cmp_debug(ctx, "trying to build chain for newly enrolled cert");
497	chain = X509_build_chain(cert, ctx->untrusted, out_trusted,
498	0, ctx->libctx, ctx->propq);
499	} else {
500	X509_STORE_CTX *csc = X509_STORE_CTX_new_ex(ctx->libctx, ctx->propq);
501
502	ossl_cmp_debug(ctx, "validating newly enrolled cert");
503	if (csc == NULL)
504	goto err;
505	if (!X509_STORE_CTX_init(csc, out_trusted, cert, ctx->untrusted))
506	goto err;
507	/* disable any cert status/revocation checking etc. */
508	X509_VERIFY_PARAM_clear_flags(X509_STORE_CTX_get0_param(csc),
509	~(X509_V_FLAG_USE_CHECK_TIME
510	\| X509_V_FLAG_NO_CHECK_TIME
511	\| X509_V_FLAG_PARTIAL_CHAIN
512	\| X509_V_FLAG_POLICY_CHECK));
513	if (X509_verify_cert(csc) <= 0)
514	goto err;
515
516	if (!ossl_x509_add_certs_new(&chain, X509_STORE_CTX_get0_chain(csc),
517	X509_ADD_FLAG_UP_REF \| X509_ADD_FLAG_NO_DUP
518	\| X509_ADD_FLAG_NO_SS)) {
519	sk_X509_free(chain);
520	chain = NULL;
521	}
522	err:
523	X509_STORE_CTX_free(csc);
524	}
525
526	if (sk_X509_num(chain) > 0)
527	X509_free(sk_X509_shift(chain)); /* remove leaf (EE) cert */
528	if (out_trusted != NULL) {
529	if (chain == NULL) {
530	ossl_cmp_err(ctx, "failed to validate newly enrolled cert");
531	fail_info = 1 << OSSL_CMP_PKIFAILUREINFO_incorrectData;
532	} else {
533	ossl_cmp_debug(ctx,
534	"success validating newly enrolled cert");
535	}
536	} else if (chain == NULL) {
537	ossl_cmp_warn(ctx, "could not build approximate chain for newly enrolled cert, resorting to received extraCerts");
538	chain = OSSL_CMP_CTX_get1_extraCertsIn(ctx);
539	} else {
540	ossl_cmp_debug(ctx,
541	"success building approximate chain for newly enrolled cert");
542	}
543	(void)ossl_cmp_ctx_set1_newChain(ctx, chain);
544	sk_X509_pop_free(chain, X509_free);
545
546	return fail_info;
547	}
548
549	/*-
550	* Perform the generic handling of certificate responses for IR/CR/KUR/P10CR.
551	* \|rid\| must be OSSL_CMP_CERTREQID_NONE if not available, namely for p10cr
552	* Returns -1 on receiving pollRep if sleep == 0, setting the checkAfter value.
553	* Returns 1 on success and provides the received PKIMESSAGE in *resp.
554	* Returns 0 on error (which includes the case that timeout has been reached).
555	* Regardless of success, caller is responsible for freeing *resp (unless NULL).
556	*/
557	static int cert_response(OSSL_CMP_CTX *ctx, int sleep, int rid,
558	OSSL_CMP_MSG *resp, int checkAfter,
559	int req_type, int expected_type)
560	{
561	EVP_PKEY *rkey = ossl_cmp_ctx_get0_newPubkey(ctx);
562	int fail_info = 0; /* no failure */
563	const char *txt = NULL;
564	OSSL_CMP_CERTREPMESSAGE *crepmsg;
565	OSSL_CMP_CERTRESPONSE *crep;
566	OSSL_CMP_certConf_cb_t cb;
567	X509 *cert;
568	char *subj = NULL;
569	int ret = 1;
570
571	if (!ossl_assert(ctx != NULL))
572	return 0;
573
574	retry:
575	crepmsg = (resp)->body->value.ip; / same for cp and kup */
576	if (sk_OSSL_CMP_CERTRESPONSE_num(crepmsg->response) > 1) {
577	ERR_raise(ERR_LIB_CMP, CMP_R_MULTIPLE_RESPONSES_NOT_SUPPORTED);
578	return 0;
579	}
580	crep = ossl_cmp_certrepmessage_get0_certresponse(crepmsg, rid);
581	if (crep == NULL)
582	return 0;
583	if (!save_statusInfo(ctx, crep->status))
584	return 0;
585	if (rid == OSSL_CMP_CERTREQID_NONE) { /* used for OSSL_CMP_PKIBODY_P10CR */
586	rid = ossl_cmp_asn1_get_int(crep->certReqId);
587	if (rid < OSSL_CMP_CERTREQID_NONE) {
588	ERR_raise(ERR_LIB_CMP, CMP_R_BAD_REQUEST_ID);
589	return 0;
590	}
591	}
592
593	if (ossl_cmp_pkisi_get_status(crep->status) == OSSL_CMP_PKISTATUS_waiting) {
594	OSSL_CMP_MSG_free(*resp);
595	*resp = NULL;
596	if ((ret = poll_for_response(ctx, sleep, rid, resp, checkAfter)) != 0) {
597	if (ret == -1) /* at this point implies sleep == 0 */
598	return ret; /* waiting */
599	goto retry; /* got ip/cp/kup, which may still indicate 'waiting' */
600	} else {
601	ERR_raise(ERR_LIB_CMP, CMP_R_POLLING_FAILED);
602	return 0;
603	}
604	}
605
606	cert = get1_cert_status(ctx, (*resp)->body->type, crep);
607	if (cert == NULL) {
608	ERR_add_error_data(1, "; cannot extract certificate from response");
609	return 0;
610	}
611	if (!ossl_cmp_ctx_set0_newCert(ctx, cert))
612	return 0;
613
614	/*
615	* if the CMP server returned certificates in the caPubs field, copy them
616	* to the context so that they can be retrieved if necessary
617	*/
618	if (crepmsg->caPubs != NULL
619	&& !ossl_cmp_ctx_set1_caPubs(ctx, crepmsg->caPubs))
620	return 0;
621
622	subj = X509_NAME_oneline(X509_get_subject_name(cert), NULL, 0);
623	if (rkey != NULL
624	/* X509_check_private_key() also works if rkey is just public key */
625	&& !(X509_check_private_key(ctx->newCert, rkey))) {
626	fail_info = 1 << OSSL_CMP_PKIFAILUREINFO_incorrectData;
627	txt = "public key in new certificate does not match our enrollment key";
628	/*-
629	* not calling (void)ossl_cmp_exchange_error(ctx,
630	* OSSL_CMP_PKISTATUS_rejection, fail_info, txt)
631	* not throwing CMP_R_CERTIFICATE_NOT_ACCEPTED with txt
632	* not returning 0
633	* since we better leave this for the certConf_cb to decide
634	*/
635	}
636
637	/*
638	* Execute the certification checking callback function,
639	* which can determine whether to accept a newly enrolled certificate.
640	* It may overrule the pre-decision reflected in 'fail_info' and '*txt'.
641	*/
642	cb = ctx->certConf_cb != NULL ? ctx->certConf_cb : OSSL_CMP_certConf_cb;
643	if ((fail_info = cb(ctx, ctx->newCert, fail_info, &txt)) != 0
644	&& txt == NULL)
645	txt = "CMP client did not accept it";
646	if (fail_info != 0) /* immediately log error before any certConf exchange */
647	ossl_cmp_log1(ERROR, ctx,
648	"rejecting newly enrolled cert with subject: %s", subj);
649	if (!ctx->disableConfirm
650	&& !ossl_cmp_hdr_has_implicitConfirm((*resp)->header)) {
651	if (!ossl_cmp_exchange_certConf(ctx, rid, fail_info, txt))
652	ret = 0;
653	}
654
655	/* not throwing failure earlier as transfer_cb may call ERR_clear_error() */
656	if (fail_info != 0) {
657	ERR_raise_data(ERR_LIB_CMP, CMP_R_CERTIFICATE_NOT_ACCEPTED,
658	"rejecting newly enrolled cert with subject: %s; %s",
659	subj, txt);
660	ctx->status = OSSL_CMP_PKISTATUS_rejection;
661	ret = 0;
662	}
663	OPENSSL_free(subj);
664	return ret;
665	}
666
667	static int initial_certreq(OSSL_CMP_CTX *ctx,
668	int req_type, const OSSL_CRMF_MSG *crm,
669	OSSL_CMP_MSG **p_rep, int rep_type)
670	{
671	OSSL_CMP_MSG *req;
672	int res;
673
674	ctx->status = OSSL_CMP_PKISTATUS_request;
675	if (!ossl_cmp_ctx_set0_newCert(ctx, NULL))
676	return 0;
677
678	/* also checks if all necessary options are set */
679	if ((req = ossl_cmp_certreq_new(ctx, req_type, crm)) == NULL)
680	return 0;
681
682	ctx->status = OSSL_CMP_PKISTATUS_trans;
683	res = send_receive_check(ctx, req, p_rep, rep_type);
684	OSSL_CMP_MSG_free(req);
685	return res;
686	}
687
688	int OSSL_CMP_try_certreq(OSSL_CMP_CTX *ctx, int req_type,
689	const OSSL_CRMF_MSG crm, int checkAfter)
690	{
691	OSSL_CMP_MSG *rep = NULL;
692	int is_p10 = req_type == OSSL_CMP_PKIBODY_P10CR;
693	int rid = is_p10 ? OSSL_CMP_CERTREQID_NONE : OSSL_CMP_CERTREQID;
694	int rep_type = is_p10 ? OSSL_CMP_PKIBODY_CP : req_type + 1;
695	int res = 0;
696
697	if (ctx == NULL) {
698	ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
699	return 0;
700	}
701
702	if (ctx->status != OSSL_CMP_PKISTATUS_waiting) { /* not polling already */
703	if (!initial_certreq(ctx, req_type, crm, &rep, rep_type))
704	goto err;
705	} else {
706	if (req_type < 0)
707	return ossl_cmp_exchange_error(ctx, OSSL_CMP_PKISTATUS_rejection,
708	0, "polling aborted",
709	0 /* errorCode */, "by application");
710	res = poll_for_response(ctx, 0 /* no sleep */, rid, &rep, checkAfter);
711	if (res <= 0) /* waiting or error */
712	return res;
713	}
714	res = cert_response(ctx, 0 /* no sleep */, rid, &rep, checkAfter,
715	req_type, rep_type);
716
717	err:
718	OSSL_CMP_MSG_free(rep);
719	return res;
720	}
721
722	/*-
723	* Do the full sequence CR/IR/KUR/P10CR, CP/IP/KUP/CP,
724	* certConf, PKIconf, and polling if required.
725	* Will sleep as long as indicated by the server (according to checkAfter).
726	* All enrollment options need to be present in the context.
727	* Returns pointer to received certificate, or NULL if none was received.
728	*/
729	X509 OSSL_CMP_exec_certreq(OSSL_CMP_CTX ctx, int req_type,
730	const OSSL_CRMF_MSG *crm)
731	{
732
733	OSSL_CMP_MSG *rep = NULL;
734	int is_p10 = req_type == OSSL_CMP_PKIBODY_P10CR;
735	int rid = is_p10 ? OSSL_CMP_CERTREQID_NONE : OSSL_CMP_CERTREQID;
736	int rep_type = is_p10 ? OSSL_CMP_PKIBODY_CP : req_type + 1;
737	X509 *result = NULL;
738
739	if (ctx == NULL) {
740	ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
741	return NULL;
742	}
743
744	if (!initial_certreq(ctx, req_type, crm, &rep, rep_type))
745	goto err;
746
747	if (cert_response(ctx, 1 /* sleep */, rid, &rep, NULL, req_type, rep_type)
748	<= 0)
749	goto err;
750
751	result = ctx->newCert;
752	err:
753	OSSL_CMP_MSG_free(rep);
754	return result;
755	}
756
757	int OSSL_CMP_exec_RR_ses(OSSL_CMP_CTX *ctx)
758	{
759	OSSL_CMP_MSG *rr = NULL;
760	OSSL_CMP_MSG *rp = NULL;
761	const int num_RevDetails = 1;
762	const int rsid = OSSL_CMP_REVREQSID;
763	OSSL_CMP_REVREPCONTENT *rrep = NULL;
764	OSSL_CMP_PKISI *si = NULL;
765	char buf[OSSL_CMP_PKISI_BUFLEN];
766	int ret = 0;
767
768	if (ctx == NULL) {
769	ERR_raise(ERR_LIB_CMP, CMP_R_INVALID_ARGS);
770	return 0;
771	}
772	ctx->status = OSSL_CMP_PKISTATUS_request;
773	if (ctx->oldCert == NULL && ctx->p10CSR == NULL) {
774	ERR_raise(ERR_LIB_CMP, CMP_R_MISSING_REFERENCE_CERT);
775	return 0;
776	}
777
778	/* OSSL_CMP_rr_new() also checks if all necessary options are set */
779	if ((rr = ossl_cmp_rr_new(ctx)) == NULL)
780	goto end;
781
782	ctx->status = OSSL_CMP_PKISTATUS_trans;
783	if (!send_receive_check(ctx, rr, &rp, OSSL_CMP_PKIBODY_RP))
784	goto end;
785
786	rrep = rp->body->value.rp;
787	#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
788	if (sk_OSSL_CMP_PKISI_num(rrep->status) != num_RevDetails) {
789	ERR_raise(ERR_LIB_CMP, CMP_R_WRONG_RP_COMPONENT_COUNT);
790	goto end;
791	}
792	#else
793	if (sk_OSSL_CMP_PKISI_num(rrep->status) < 1) {
794	ERR_raise(ERR_LIB_CMP, CMP_R_WRONG_RP_COMPONENT_COUNT);
795	goto end;
796	}
797	#endif
798
799	/* evaluate PKIStatus field */
800	si = ossl_cmp_revrepcontent_get_pkisi(rrep, rsid);
801	if (!save_statusInfo(ctx, si))
802	goto err;
803	switch (ossl_cmp_pkisi_get_status(si)) {
804	case OSSL_CMP_PKISTATUS_accepted:
805	ossl_cmp_info(ctx, "revocation accepted (PKIStatus=accepted)");
806	ret = 1;
807	break;
808	case OSSL_CMP_PKISTATUS_grantedWithMods:
809	ossl_cmp_info(ctx, "revocation accepted (PKIStatus=grantedWithMods)");
810	ret = 1;
811	break;
812	case OSSL_CMP_PKISTATUS_rejection:
813	ERR_raise(ERR_LIB_CMP, CMP_R_REQUEST_REJECTED_BY_SERVER);
814	goto err;
815	case OSSL_CMP_PKISTATUS_revocationWarning:
816	ossl_cmp_info(ctx, "revocation accepted (PKIStatus=revocationWarning)");
817	ret = 1;
818	break;
819	case OSSL_CMP_PKISTATUS_revocationNotification:
820	/* interpretation as warning or error depends on CA */
821	ossl_cmp_warn(ctx,
822	"revocation accepted (PKIStatus=revocationNotification)");
823	ret = 1;
824	break;
825	case OSSL_CMP_PKISTATUS_waiting:
826	case OSSL_CMP_PKISTATUS_keyUpdateWarning:
827	ERR_raise(ERR_LIB_CMP, CMP_R_UNEXPECTED_PKISTATUS);
828	goto err;
829	default:
830	ERR_raise(ERR_LIB_CMP, CMP_R_UNKNOWN_PKISTATUS);
831	goto err;
832	}
833
834	/* check any present CertId in optional revCerts field */
835	if (sk_OSSL_CRMF_CERTID_num(rrep->revCerts) >= 1) {
836	OSSL_CRMF_CERTID *cid;
837	OSSL_CRMF_CERTTEMPLATE *tmpl =
838	sk_OSSL_CMP_REVDETAILS_value(rr->body->value.rr, rsid)->certDetails;
839	const X509_NAME *issuer = OSSL_CRMF_CERTTEMPLATE_get0_issuer(tmpl);
840	const ASN1_INTEGER *serial = OSSL_CRMF_CERTTEMPLATE_get0_serialNumber(tmpl);
841
842	if (sk_OSSL_CRMF_CERTID_num(rrep->revCerts) != num_RevDetails) {
843	ERR_raise(ERR_LIB_CMP, CMP_R_WRONG_RP_COMPONENT_COUNT);
844	ret = 0;
845	goto err;
846	}
847	if ((cid = ossl_cmp_revrepcontent_get_CertId(rrep, rsid)) == NULL) {
848	ERR_raise(ERR_LIB_CMP, CMP_R_MISSING_CERTID);
849	ret = 0;
850	goto err;
851	}
852	if (X509_NAME_cmp(issuer, OSSL_CRMF_CERTID_get0_issuer(cid)) != 0) {
853	#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
854	ERR_raise(ERR_LIB_CMP, CMP_R_WRONG_CERTID_IN_RP);
855	ret = 0;
856	goto err;
857	#endif
858	}
859	if (ASN1_INTEGER_cmp(serial,
860	OSSL_CRMF_CERTID_get0_serialNumber(cid)) != 0) {
861	#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
862	ERR_raise(ERR_LIB_CMP, CMP_R_WRONG_SERIAL_IN_RP);
863	ret = 0;
864	goto err;
865	#endif
866	}
867	}
868
869	/* check number of any optionally present crls */
870	if (rrep->crls != NULL && sk_X509_CRL_num(rrep->crls) != num_RevDetails) {
871	ERR_raise(ERR_LIB_CMP, CMP_R_WRONG_RP_COMPONENT_COUNT);
872	ret = 0;
873	goto err;
874	}
875
876	err:
877	if (ret == 0
878	&& OSSL_CMP_CTX_snprint_PKIStatus(ctx, buf, sizeof(buf)) != NULL)
879	ERR_add_error_data(1, buf);
880
881	end:
882	OSSL_CMP_MSG_free(rr);
883	OSSL_CMP_MSG_free(rp);
884	return ret;
885	}
886
887	STACK_OF(OSSL_CMP_ITAV) OSSL_CMP_exec_GENM_ses(OSSL_CMP_CTX ctx)
888	{
889	OSSL_CMP_MSG *genm;
890	OSSL_CMP_MSG *genp = NULL;
891	STACK_OF(OSSL_CMP_ITAV) *itavs = NULL;
892
893	if (ctx == NULL) {
894	ERR_raise(ERR_LIB_CMP, CMP_R_INVALID_ARGS);
895	return NULL;
896	}
897	ctx->status = OSSL_CMP_PKISTATUS_request;
898
899	if ((genm = ossl_cmp_genm_new(ctx)) == NULL)
900	goto err;
901
902	ctx->status = OSSL_CMP_PKISTATUS_trans;
903	if (!send_receive_check(ctx, genm, &genp, OSSL_CMP_PKIBODY_GENP))
904	goto err;
905	ctx->status = OSSL_CMP_PKISTATUS_accepted;
906
907	itavs = genp->body->value.genp;
908	if (itavs == NULL)
909	itavs = sk_OSSL_CMP_ITAV_new_null();
910	/* received stack of itavs not to be freed with the genp */
911	genp->body->value.genp = NULL;
912
913	err:
914	OSSL_CMP_MSG_free(genm);
915	OSSL_CMP_MSG_free(genp);
916
917	return itavs; /* NULL indicates error case */
918	}

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/libs/openssl-3.1.7/crypto/cmp/cmp_client.c@ 107935

Download in other formats: