cmp_mock_srv.c 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411
  1. /*
  2. * Copyright 2018-2021 The OpenSSL Project Authors. All Rights Reserved.
  3. * Copyright Siemens AG 2018-2020
  4. *
  5. * Licensed under the Apache License 2.0 (the "License"). You may not use
  6. * this file except in compliance with the License. You can obtain a copy
  7. * in the file LICENSE in the source distribution or atf
  8. * https://www.openssl.org/source/license.html
  9. */
  10. #include "apps.h"
  11. #include "cmp_mock_srv.h"
  12. #include <openssl/cmp.h>
  13. #include <openssl/err.h>
  14. #include <openssl/cmperr.h>
  15. /* the context for the CMP mock server */
  16. typedef struct
  17. {
  18. X509 *certOut; /* certificate to be returned in cp/ip/kup msg */
  19. STACK_OF(X509) *chainOut; /* chain of certOut to add to extraCerts field */
  20. STACK_OF(X509) *caPubsOut; /* certs to return in caPubs field of ip msg */
  21. OSSL_CMP_PKISI *statusOut; /* status for ip/cp/kup/rp msg unless polling */
  22. int sendError; /* send error response also on valid requests */
  23. OSSL_CMP_MSG *certReq; /* ir/cr/p10cr/kur remembered while polling */
  24. int certReqId; /* id of last ir/cr/kur, used for polling */
  25. int pollCount; /* number of polls before actual cert response */
  26. int checkAfterTime; /* time the client should wait between polling */
  27. } mock_srv_ctx;
  28. static void mock_srv_ctx_free(mock_srv_ctx *ctx)
  29. {
  30. if (ctx == NULL)
  31. return;
  32. OSSL_CMP_PKISI_free(ctx->statusOut);
  33. X509_free(ctx->certOut);
  34. sk_X509_pop_free(ctx->chainOut, X509_free);
  35. sk_X509_pop_free(ctx->caPubsOut, X509_free);
  36. OSSL_CMP_MSG_free(ctx->certReq);
  37. OPENSSL_free(ctx);
  38. }
  39. static mock_srv_ctx *mock_srv_ctx_new(void)
  40. {
  41. mock_srv_ctx *ctx = OPENSSL_zalloc(sizeof(mock_srv_ctx));
  42. if (ctx == NULL)
  43. goto err;
  44. if ((ctx->statusOut = OSSL_CMP_PKISI_new()) == NULL)
  45. goto err;
  46. ctx->certReqId = -1;
  47. /* all other elements are initialized to 0 or NULL, respectively */
  48. return ctx;
  49. err:
  50. mock_srv_ctx_free(ctx);
  51. return NULL;
  52. }
  53. int ossl_cmp_mock_srv_set1_certOut(OSSL_CMP_SRV_CTX *srv_ctx, X509 *cert)
  54. {
  55. mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
  56. if (ctx == NULL) {
  57. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  58. return 0;
  59. }
  60. if (cert == NULL || X509_up_ref(cert)) {
  61. X509_free(ctx->certOut);
  62. ctx->certOut = cert;
  63. return 1;
  64. }
  65. return 0;
  66. }
  67. int ossl_cmp_mock_srv_set1_chainOut(OSSL_CMP_SRV_CTX *srv_ctx,
  68. STACK_OF(X509) *chain)
  69. {
  70. mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
  71. STACK_OF(X509) *chain_copy = NULL;
  72. if (ctx == NULL) {
  73. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  74. return 0;
  75. }
  76. if (chain != NULL && (chain_copy = X509_chain_up_ref(chain)) == NULL)
  77. return 0;
  78. sk_X509_pop_free(ctx->chainOut, X509_free);
  79. ctx->chainOut = chain_copy;
  80. return 1;
  81. }
  82. int ossl_cmp_mock_srv_set1_caPubsOut(OSSL_CMP_SRV_CTX *srv_ctx,
  83. STACK_OF(X509) *caPubs)
  84. {
  85. mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
  86. STACK_OF(X509) *caPubs_copy = NULL;
  87. if (ctx == NULL) {
  88. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  89. return 0;
  90. }
  91. if (caPubs != NULL && (caPubs_copy = X509_chain_up_ref(caPubs)) == NULL)
  92. return 0;
  93. sk_X509_pop_free(ctx->caPubsOut, X509_free);
  94. ctx->caPubsOut = caPubs_copy;
  95. return 1;
  96. }
  97. int ossl_cmp_mock_srv_set_statusInfo(OSSL_CMP_SRV_CTX *srv_ctx, int status,
  98. int fail_info, const char *text)
  99. {
  100. mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
  101. OSSL_CMP_PKISI *si;
  102. if (ctx == NULL) {
  103. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  104. return 0;
  105. }
  106. if ((si = OSSL_CMP_STATUSINFO_new(status, fail_info, text)) == NULL)
  107. return 0;
  108. OSSL_CMP_PKISI_free(ctx->statusOut);
  109. ctx->statusOut = si;
  110. return 1;
  111. }
  112. int ossl_cmp_mock_srv_set_send_error(OSSL_CMP_SRV_CTX *srv_ctx, int val)
  113. {
  114. mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
  115. if (ctx == NULL) {
  116. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  117. return 0;
  118. }
  119. ctx->sendError = val != 0;
  120. return 1;
  121. }
  122. int ossl_cmp_mock_srv_set_pollCount(OSSL_CMP_SRV_CTX *srv_ctx, int count)
  123. {
  124. mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
  125. if (ctx == NULL) {
  126. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  127. return 0;
  128. }
  129. if (count < 0) {
  130. ERR_raise(ERR_LIB_CMP, CMP_R_INVALID_ARGS);
  131. return 0;
  132. }
  133. ctx->pollCount = count;
  134. return 1;
  135. }
  136. int ossl_cmp_mock_srv_set_checkAfterTime(OSSL_CMP_SRV_CTX *srv_ctx, int sec)
  137. {
  138. mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
  139. if (ctx == NULL) {
  140. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  141. return 0;
  142. }
  143. ctx->checkAfterTime = sec;
  144. return 1;
  145. }
  146. static OSSL_CMP_PKISI *process_cert_request(OSSL_CMP_SRV_CTX *srv_ctx,
  147. const OSSL_CMP_MSG *cert_req,
  148. int certReqId,
  149. const OSSL_CRMF_MSG *crm,
  150. const X509_REQ *p10cr,
  151. X509 **certOut,
  152. STACK_OF(X509) **chainOut,
  153. STACK_OF(X509) **caPubs)
  154. {
  155. mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
  156. OSSL_CMP_PKISI *si = NULL;
  157. if (ctx == NULL || cert_req == NULL
  158. || certOut == NULL || chainOut == NULL || caPubs == NULL) {
  159. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  160. return NULL;
  161. }
  162. if (ctx->sendError) {
  163. ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_PROCESSING_MESSAGE);
  164. return NULL;
  165. }
  166. *certOut = NULL;
  167. *chainOut = NULL;
  168. *caPubs = NULL;
  169. ctx->certReqId = certReqId;
  170. if (ctx->pollCount > 0) {
  171. ctx->pollCount--;
  172. OSSL_CMP_MSG_free(ctx->certReq);
  173. if ((ctx->certReq = OSSL_CMP_MSG_dup(cert_req)) == NULL)
  174. return NULL;
  175. return OSSL_CMP_STATUSINFO_new(OSSL_CMP_PKISTATUS_waiting, 0, NULL);
  176. }
  177. if (ctx->certOut != NULL
  178. && (*certOut = X509_dup(ctx->certOut)) == NULL)
  179. goto err;
  180. if (ctx->chainOut != NULL
  181. && (*chainOut = X509_chain_up_ref(ctx->chainOut)) == NULL)
  182. goto err;
  183. if (ctx->caPubsOut != NULL
  184. && (*caPubs = X509_chain_up_ref(ctx->caPubsOut)) == NULL)
  185. goto err;
  186. if (ctx->statusOut != NULL
  187. && (si = OSSL_CMP_PKISI_dup(ctx->statusOut)) == NULL)
  188. goto err;
  189. return si;
  190. err:
  191. X509_free(*certOut);
  192. *certOut = NULL;
  193. sk_X509_pop_free(*chainOut, X509_free);
  194. *chainOut = NULL;
  195. sk_X509_pop_free(*caPubs, X509_free);
  196. *caPubs = NULL;
  197. return NULL;
  198. }
  199. static OSSL_CMP_PKISI *process_rr(OSSL_CMP_SRV_CTX *srv_ctx,
  200. const OSSL_CMP_MSG *rr,
  201. const X509_NAME *issuer,
  202. const ASN1_INTEGER *serial)
  203. {
  204. mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
  205. if (ctx == NULL || rr == NULL) {
  206. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  207. return NULL;
  208. }
  209. if (ctx->sendError || ctx->certOut == NULL) {
  210. ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_PROCESSING_MESSAGE);
  211. return NULL;
  212. }
  213. /* Allow any RR derived from CSR, which may include subject and serial */
  214. if (issuer == NULL || serial == NULL)
  215. return OSSL_CMP_PKISI_dup(ctx->statusOut);
  216. /* accept revocation only for the certificate we sent in ir/cr/kur */
  217. if (X509_NAME_cmp(issuer, X509_get_issuer_name(ctx->certOut)) != 0
  218. || ASN1_INTEGER_cmp(serial,
  219. X509_get0_serialNumber(ctx->certOut)) != 0) {
  220. ERR_raise_data(ERR_LIB_CMP, CMP_R_REQUEST_NOT_ACCEPTED,
  221. "wrong certificate to revoke");
  222. return NULL;
  223. }
  224. return OSSL_CMP_PKISI_dup(ctx->statusOut);
  225. }
  226. static int process_genm(OSSL_CMP_SRV_CTX *srv_ctx,
  227. const OSSL_CMP_MSG *genm,
  228. const STACK_OF(OSSL_CMP_ITAV) *in,
  229. STACK_OF(OSSL_CMP_ITAV) **out)
  230. {
  231. mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
  232. if (ctx == NULL || genm == NULL || in == NULL || out == NULL) {
  233. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  234. return 0;
  235. }
  236. if (ctx->sendError) {
  237. ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_PROCESSING_MESSAGE);
  238. return 0;
  239. }
  240. *out = sk_OSSL_CMP_ITAV_deep_copy(in, OSSL_CMP_ITAV_dup,
  241. OSSL_CMP_ITAV_free);
  242. return *out != NULL;
  243. }
  244. static void process_error(OSSL_CMP_SRV_CTX *srv_ctx, const OSSL_CMP_MSG *error,
  245. const OSSL_CMP_PKISI *statusInfo,
  246. const ASN1_INTEGER *errorCode,
  247. const OSSL_CMP_PKIFREETEXT *errorDetails)
  248. {
  249. mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
  250. char buf[OSSL_CMP_PKISI_BUFLEN];
  251. char *sibuf;
  252. int i;
  253. if (ctx == NULL || error == NULL) {
  254. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  255. return;
  256. }
  257. BIO_printf(bio_err, "mock server received error:\n");
  258. if (statusInfo == NULL) {
  259. BIO_printf(bio_err, "pkiStatusInfo absent\n");
  260. } else {
  261. sibuf = OSSL_CMP_snprint_PKIStatusInfo(statusInfo, buf, sizeof(buf));
  262. BIO_printf(bio_err, "pkiStatusInfo: %s\n",
  263. sibuf != NULL ? sibuf: "<invalid>");
  264. }
  265. if (errorCode == NULL)
  266. BIO_printf(bio_err, "errorCode absent\n");
  267. else
  268. BIO_printf(bio_err, "errorCode: %ld\n", ASN1_INTEGER_get(errorCode));
  269. if (sk_ASN1_UTF8STRING_num(errorDetails) <= 0) {
  270. BIO_printf(bio_err, "errorDetails absent\n");
  271. } else {
  272. BIO_printf(bio_err, "errorDetails: ");
  273. for (i = 0; i < sk_ASN1_UTF8STRING_num(errorDetails); i++) {
  274. if (i > 0)
  275. BIO_printf(bio_err, ", ");
  276. BIO_printf(bio_err, "\"");
  277. ASN1_STRING_print(bio_err,
  278. sk_ASN1_UTF8STRING_value(errorDetails, i));
  279. BIO_printf(bio_err, "\"");
  280. }
  281. BIO_printf(bio_err, "\n");
  282. }
  283. }
  284. static int process_certConf(OSSL_CMP_SRV_CTX *srv_ctx,
  285. const OSSL_CMP_MSG *certConf, int certReqId,
  286. const ASN1_OCTET_STRING *certHash,
  287. const OSSL_CMP_PKISI *si)
  288. {
  289. mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
  290. ASN1_OCTET_STRING *digest;
  291. if (ctx == NULL || certConf == NULL || certHash == NULL) {
  292. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  293. return 0;
  294. }
  295. if (ctx->sendError || ctx->certOut == NULL) {
  296. ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_PROCESSING_MESSAGE);
  297. return 0;
  298. }
  299. if (certReqId != ctx->certReqId) {
  300. /* in case of error, invalid reqId -1 */
  301. ERR_raise(ERR_LIB_CMP, CMP_R_BAD_REQUEST_ID);
  302. return 0;
  303. }
  304. if ((digest = X509_digest_sig(ctx->certOut, NULL, NULL)) == NULL)
  305. return 0;
  306. if (ASN1_OCTET_STRING_cmp(certHash, digest) != 0) {
  307. ASN1_OCTET_STRING_free(digest);
  308. ERR_raise(ERR_LIB_CMP, CMP_R_CERTHASH_UNMATCHED);
  309. return 0;
  310. }
  311. ASN1_OCTET_STRING_free(digest);
  312. return 1;
  313. }
  314. static int process_pollReq(OSSL_CMP_SRV_CTX *srv_ctx,
  315. const OSSL_CMP_MSG *pollReq, int certReqId,
  316. OSSL_CMP_MSG **certReq, int64_t *check_after)
  317. {
  318. mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
  319. if (ctx == NULL || pollReq == NULL
  320. || certReq == NULL || check_after == NULL) {
  321. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  322. return 0;
  323. }
  324. if (ctx->sendError || ctx->certReq == NULL) {
  325. *certReq = NULL;
  326. ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_PROCESSING_MESSAGE);
  327. return 0;
  328. }
  329. if (ctx->pollCount == 0) {
  330. *certReq = ctx->certReq;
  331. ctx->certReq = NULL;
  332. *check_after = 0;
  333. } else {
  334. ctx->pollCount--;
  335. *certReq = NULL;
  336. *check_after = ctx->checkAfterTime;
  337. }
  338. return 1;
  339. }
  340. OSSL_CMP_SRV_CTX *ossl_cmp_mock_srv_new(OSSL_LIB_CTX *libctx, const char *propq)
  341. {
  342. OSSL_CMP_SRV_CTX *srv_ctx = OSSL_CMP_SRV_CTX_new(libctx, propq);
  343. mock_srv_ctx *ctx = mock_srv_ctx_new();
  344. if (srv_ctx != NULL && ctx != NULL
  345. && OSSL_CMP_SRV_CTX_init(srv_ctx, ctx, process_cert_request,
  346. process_rr, process_genm, process_error,
  347. process_certConf, process_pollReq))
  348. return srv_ctx;
  349. mock_srv_ctx_free(ctx);
  350. OSSL_CMP_SRV_CTX_free(srv_ctx);
  351. return NULL;
  352. }
  353. void ossl_cmp_mock_srv_free(OSSL_CMP_SRV_CTX *srv_ctx)
  354. {
  355. if (srv_ctx != NULL)
  356. mock_srv_ctx_free(OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx));
  357. OSSL_CMP_SRV_CTX_free(srv_ctx);
  358. }