cmp_server.c 21 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642
  1. /*
  2. * Copyright 2007-2021 The OpenSSL Project Authors. All Rights Reserved.
  3. * Copyright Nokia 2007-2019
  4. * Copyright Siemens AG 2015-2019
  5. *
  6. * Licensed under the Apache License 2.0 (the "License"). You may not use
  7. * this file except in compliance with the License. You can obtain a copy
  8. * in the file LICENSE in the source distribution or at
  9. * https://www.openssl.org/source/license.html
  10. */
  11. /* general CMP server functions */
  12. #include <openssl/asn1t.h>
  13. #include "cmp_local.h"
  14. /* explicit #includes not strictly needed since implied by the above: */
  15. #include <openssl/cmp.h>
  16. #include <openssl/err.h>
  17. /* the context for the generic CMP server */
  18. struct ossl_cmp_srv_ctx_st
  19. {
  20. OSSL_CMP_CTX *ctx; /* Client CMP context, partly reused for srv */
  21. void *custom_ctx; /* pointer to specific server context */
  22. OSSL_CMP_SRV_cert_request_cb_t process_cert_request;
  23. OSSL_CMP_SRV_rr_cb_t process_rr;
  24. OSSL_CMP_SRV_genm_cb_t process_genm;
  25. OSSL_CMP_SRV_error_cb_t process_error;
  26. OSSL_CMP_SRV_certConf_cb_t process_certConf;
  27. OSSL_CMP_SRV_pollReq_cb_t process_pollReq;
  28. int sendUnprotectedErrors; /* Send error and rejection msgs unprotected */
  29. int acceptUnprotected; /* Accept requests with no/invalid prot. */
  30. int acceptRAVerified; /* Accept ir/cr/kur with POPO RAVerified */
  31. int grantImplicitConfirm; /* Grant implicit confirmation if requested */
  32. }; /* OSSL_CMP_SRV_CTX */
  33. void OSSL_CMP_SRV_CTX_free(OSSL_CMP_SRV_CTX *srv_ctx)
  34. {
  35. if (srv_ctx == NULL)
  36. return;
  37. OSSL_CMP_CTX_free(srv_ctx->ctx);
  38. OPENSSL_free(srv_ctx);
  39. }
  40. OSSL_CMP_SRV_CTX *OSSL_CMP_SRV_CTX_new(OSSL_LIB_CTX *libctx, const char *propq)
  41. {
  42. OSSL_CMP_SRV_CTX *ctx = OPENSSL_zalloc(sizeof(OSSL_CMP_SRV_CTX));
  43. if (ctx == NULL)
  44. goto err;
  45. if ((ctx->ctx = OSSL_CMP_CTX_new(libctx, propq)) == NULL)
  46. goto err;
  47. /* all other elements are initialized to 0 or NULL, respectively */
  48. return ctx;
  49. err:
  50. OSSL_CMP_SRV_CTX_free(ctx);
  51. return NULL;
  52. }
  53. int OSSL_CMP_SRV_CTX_init(OSSL_CMP_SRV_CTX *srv_ctx, void *custom_ctx,
  54. OSSL_CMP_SRV_cert_request_cb_t process_cert_request,
  55. OSSL_CMP_SRV_rr_cb_t process_rr,
  56. OSSL_CMP_SRV_genm_cb_t process_genm,
  57. OSSL_CMP_SRV_error_cb_t process_error,
  58. OSSL_CMP_SRV_certConf_cb_t process_certConf,
  59. OSSL_CMP_SRV_pollReq_cb_t process_pollReq)
  60. {
  61. if (srv_ctx == NULL) {
  62. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  63. return 0;
  64. }
  65. srv_ctx->custom_ctx = custom_ctx;
  66. srv_ctx->process_cert_request = process_cert_request;
  67. srv_ctx->process_rr = process_rr;
  68. srv_ctx->process_genm = process_genm;
  69. srv_ctx->process_error = process_error;
  70. srv_ctx->process_certConf = process_certConf;
  71. srv_ctx->process_pollReq = process_pollReq;
  72. return 1;
  73. }
  74. OSSL_CMP_CTX *OSSL_CMP_SRV_CTX_get0_cmp_ctx(const OSSL_CMP_SRV_CTX *srv_ctx)
  75. {
  76. if (srv_ctx == NULL) {
  77. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  78. return NULL;
  79. }
  80. return srv_ctx->ctx;
  81. }
  82. void *OSSL_CMP_SRV_CTX_get0_custom_ctx(const OSSL_CMP_SRV_CTX *srv_ctx)
  83. {
  84. if (srv_ctx == NULL) {
  85. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  86. return NULL;
  87. }
  88. return srv_ctx->custom_ctx;
  89. }
  90. int OSSL_CMP_SRV_CTX_set_send_unprotected_errors(OSSL_CMP_SRV_CTX *srv_ctx,
  91. int val)
  92. {
  93. if (srv_ctx == NULL) {
  94. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  95. return 0;
  96. }
  97. srv_ctx->sendUnprotectedErrors = val != 0;
  98. return 1;
  99. }
  100. int OSSL_CMP_SRV_CTX_set_accept_unprotected(OSSL_CMP_SRV_CTX *srv_ctx, int val)
  101. {
  102. if (srv_ctx == NULL) {
  103. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  104. return 0;
  105. }
  106. srv_ctx->acceptUnprotected = val != 0;
  107. return 1;
  108. }
  109. int OSSL_CMP_SRV_CTX_set_accept_raverified(OSSL_CMP_SRV_CTX *srv_ctx, int val)
  110. {
  111. if (srv_ctx == NULL) {
  112. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  113. return 0;
  114. }
  115. srv_ctx->acceptRAVerified = val != 0;
  116. return 1;
  117. }
  118. int OSSL_CMP_SRV_CTX_set_grant_implicit_confirm(OSSL_CMP_SRV_CTX *srv_ctx,
  119. int val)
  120. {
  121. if (srv_ctx == NULL) {
  122. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  123. return 0;
  124. }
  125. srv_ctx->grantImplicitConfirm = val != 0;
  126. return 1;
  127. }
  128. /*
  129. * Processes an ir/cr/p10cr/kur and returns a certification response.
  130. * Only handles the first certification request contained in req
  131. * returns an ip/cp/kup on success and NULL on error
  132. */
  133. static OSSL_CMP_MSG *process_cert_request(OSSL_CMP_SRV_CTX *srv_ctx,
  134. const OSSL_CMP_MSG *req)
  135. {
  136. OSSL_CMP_MSG *msg = NULL;
  137. OSSL_CMP_PKISI *si = NULL;
  138. X509 *certOut = NULL;
  139. STACK_OF(X509) *chainOut = NULL, *caPubs = NULL;
  140. const OSSL_CRMF_MSG *crm = NULL;
  141. const X509_REQ *p10cr = NULL;
  142. int bodytype;
  143. int certReqId;
  144. if (!ossl_assert(srv_ctx != NULL && srv_ctx->ctx != NULL && req != NULL))
  145. return NULL;
  146. switch (OSSL_CMP_MSG_get_bodytype(req)) {
  147. case OSSL_CMP_PKIBODY_P10CR:
  148. case OSSL_CMP_PKIBODY_CR:
  149. bodytype = OSSL_CMP_PKIBODY_CP;
  150. break;
  151. case OSSL_CMP_PKIBODY_IR:
  152. bodytype = OSSL_CMP_PKIBODY_IP;
  153. break;
  154. case OSSL_CMP_PKIBODY_KUR:
  155. bodytype = OSSL_CMP_PKIBODY_KUP;
  156. break;
  157. default:
  158. ERR_raise(ERR_LIB_CMP, CMP_R_UNEXPECTED_PKIBODY);
  159. return NULL;
  160. }
  161. if (OSSL_CMP_MSG_get_bodytype(req) == OSSL_CMP_PKIBODY_P10CR) {
  162. certReqId = OSSL_CMP_CERTREQID;
  163. p10cr = req->body->value.p10cr;
  164. } else {
  165. OSSL_CRMF_MSGS *reqs = req->body->value.ir; /* same for cr and kur */
  166. if (sk_OSSL_CRMF_MSG_num(reqs) != 1) {
  167. ERR_raise(ERR_LIB_CMP, CMP_R_MULTIPLE_REQUESTS_NOT_SUPPORTED);
  168. return NULL;
  169. }
  170. if ((crm = sk_OSSL_CRMF_MSG_value(reqs, OSSL_CMP_CERTREQID)) == NULL) {
  171. ERR_raise(ERR_LIB_CMP, CMP_R_CERTREQMSG_NOT_FOUND);
  172. return NULL;
  173. }
  174. certReqId = OSSL_CRMF_MSG_get_certReqId(crm);
  175. }
  176. if (!ossl_cmp_verify_popo(srv_ctx->ctx, req, srv_ctx->acceptRAVerified)) {
  177. /* Proof of possession could not be verified */
  178. si = OSSL_CMP_STATUSINFO_new(OSSL_CMP_PKISTATUS_rejection,
  179. 1 << OSSL_CMP_PKIFAILUREINFO_badPOP,
  180. ERR_reason_error_string(ERR_peek_error()));
  181. if (si == NULL)
  182. return NULL;
  183. } else {
  184. OSSL_CMP_PKIHEADER *hdr = OSSL_CMP_MSG_get0_header(req);
  185. si = srv_ctx->process_cert_request(srv_ctx, req, certReqId, crm, p10cr,
  186. &certOut, &chainOut, &caPubs);
  187. if (si == NULL)
  188. goto err;
  189. /* set OSSL_CMP_OPT_IMPLICIT_CONFIRM if and only if transaction ends */
  190. if (!OSSL_CMP_CTX_set_option(srv_ctx->ctx,
  191. OSSL_CMP_OPT_IMPLICIT_CONFIRM,
  192. ossl_cmp_hdr_has_implicitConfirm(hdr)
  193. && srv_ctx->grantImplicitConfirm
  194. /* do not set if polling starts: */
  195. && certOut != NULL))
  196. goto err;
  197. }
  198. msg = ossl_cmp_certrep_new(srv_ctx->ctx, bodytype, certReqId, si,
  199. certOut, NULL /* enc */, chainOut, caPubs,
  200. srv_ctx->sendUnprotectedErrors);
  201. if (msg == NULL)
  202. ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_CERTREP);
  203. err:
  204. OSSL_CMP_PKISI_free(si);
  205. X509_free(certOut);
  206. OSSL_STACK_OF_X509_free(chainOut);
  207. OSSL_STACK_OF_X509_free(caPubs);
  208. return msg;
  209. }
  210. static OSSL_CMP_MSG *process_rr(OSSL_CMP_SRV_CTX *srv_ctx,
  211. const OSSL_CMP_MSG *req)
  212. {
  213. OSSL_CMP_MSG *msg = NULL;
  214. OSSL_CMP_REVDETAILS *details;
  215. OSSL_CRMF_CERTID *certId = NULL;
  216. OSSL_CRMF_CERTTEMPLATE *tmpl;
  217. const X509_NAME *issuer;
  218. const ASN1_INTEGER *serial;
  219. OSSL_CMP_PKISI *si;
  220. if (!ossl_assert(srv_ctx != NULL && srv_ctx->ctx != NULL && req != NULL))
  221. return NULL;
  222. if (sk_OSSL_CMP_REVDETAILS_num(req->body->value.rr) != 1) {
  223. ERR_raise(ERR_LIB_CMP, CMP_R_MULTIPLE_REQUESTS_NOT_SUPPORTED);
  224. return NULL;
  225. }
  226. if ((details = sk_OSSL_CMP_REVDETAILS_value(req->body->value.rr,
  227. OSSL_CMP_REVREQSID)) == NULL) {
  228. ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_PROCESSING_MESSAGE);
  229. return NULL;
  230. }
  231. tmpl = details->certDetails;
  232. issuer = OSSL_CRMF_CERTTEMPLATE_get0_issuer(tmpl);
  233. serial = OSSL_CRMF_CERTTEMPLATE_get0_serialNumber(tmpl);
  234. if (issuer != NULL && serial != NULL
  235. && (certId = OSSL_CRMF_CERTID_gen(issuer, serial)) == NULL)
  236. return NULL;
  237. if ((si = srv_ctx->process_rr(srv_ctx, req, issuer, serial)) == NULL)
  238. goto err;
  239. if ((msg = ossl_cmp_rp_new(srv_ctx->ctx, si, certId,
  240. srv_ctx->sendUnprotectedErrors)) == NULL)
  241. ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_RR);
  242. err:
  243. OSSL_CRMF_CERTID_free(certId);
  244. OSSL_CMP_PKISI_free(si);
  245. return msg;
  246. }
  247. /*
  248. * Processes genm and creates a genp message mirroring the contents of the
  249. * incoming message
  250. */
  251. static OSSL_CMP_MSG *process_genm(OSSL_CMP_SRV_CTX *srv_ctx,
  252. const OSSL_CMP_MSG *req)
  253. {
  254. OSSL_CMP_GENMSGCONTENT *itavs;
  255. OSSL_CMP_MSG *msg;
  256. if (!ossl_assert(srv_ctx != NULL && srv_ctx->ctx != NULL && req != NULL))
  257. return NULL;
  258. if (!srv_ctx->process_genm(srv_ctx, req, req->body->value.genm, &itavs))
  259. return NULL;
  260. msg = ossl_cmp_genp_new(srv_ctx->ctx, itavs);
  261. sk_OSSL_CMP_ITAV_pop_free(itavs, OSSL_CMP_ITAV_free);
  262. return msg;
  263. }
  264. static OSSL_CMP_MSG *process_error(OSSL_CMP_SRV_CTX *srv_ctx,
  265. const OSSL_CMP_MSG *req)
  266. {
  267. OSSL_CMP_ERRORMSGCONTENT *errorContent;
  268. OSSL_CMP_MSG *msg;
  269. if (!ossl_assert(srv_ctx != NULL && srv_ctx->ctx != NULL && req != NULL))
  270. return NULL;
  271. errorContent = req->body->value.error;
  272. srv_ctx->process_error(srv_ctx, req, errorContent->pKIStatusInfo,
  273. errorContent->errorCode, errorContent->errorDetails);
  274. if ((msg = ossl_cmp_pkiconf_new(srv_ctx->ctx)) == NULL)
  275. ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_PKICONF);
  276. return msg;
  277. }
  278. static OSSL_CMP_MSG *process_certConf(OSSL_CMP_SRV_CTX *srv_ctx,
  279. const OSSL_CMP_MSG *req)
  280. {
  281. OSSL_CMP_CTX *ctx;
  282. OSSL_CMP_CERTCONFIRMCONTENT *ccc;
  283. int num;
  284. OSSL_CMP_MSG *msg = NULL;
  285. OSSL_CMP_CERTSTATUS *status = NULL;
  286. if (!ossl_assert(srv_ctx != NULL && srv_ctx->ctx != NULL && req != NULL))
  287. return NULL;
  288. ctx = srv_ctx->ctx;
  289. ccc = req->body->value.certConf;
  290. num = sk_OSSL_CMP_CERTSTATUS_num(ccc);
  291. if (OSSL_CMP_CTX_get_option(ctx, OSSL_CMP_OPT_IMPLICIT_CONFIRM) == 1
  292. || ctx->status != -2 /* transaction not open */) {
  293. ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_UNEXPECTED_CERTCONF);
  294. return NULL;
  295. }
  296. if (num == 0) {
  297. ossl_cmp_err(ctx, "certificate rejected by client");
  298. } else {
  299. if (num > 1)
  300. ossl_cmp_warn(ctx, "All CertStatus but the first will be ignored");
  301. status = sk_OSSL_CMP_CERTSTATUS_value(ccc, OSSL_CMP_CERTREQID);
  302. }
  303. if (status != NULL) {
  304. int certReqId = ossl_cmp_asn1_get_int(status->certReqId);
  305. ASN1_OCTET_STRING *certHash = status->certHash;
  306. OSSL_CMP_PKISI *si = status->statusInfo;
  307. if (!srv_ctx->process_certConf(srv_ctx, req, certReqId, certHash, si))
  308. return NULL; /* reason code may be: CMP_R_CERTHASH_UNMATCHED */
  309. if (si != NULL && ossl_cmp_pkisi_get_status(si)
  310. != OSSL_CMP_PKISTATUS_accepted) {
  311. int pki_status = ossl_cmp_pkisi_get_status(si);
  312. const char *str = ossl_cmp_PKIStatus_to_string(pki_status);
  313. ossl_cmp_log2(INFO, ctx, "certificate rejected by client %s %s",
  314. str == NULL ? "without" : "with",
  315. str == NULL ? "PKIStatus" : str);
  316. }
  317. }
  318. if ((msg = ossl_cmp_pkiconf_new(ctx)) == NULL)
  319. ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_PKICONF);
  320. return msg;
  321. }
  322. static OSSL_CMP_MSG *process_pollReq(OSSL_CMP_SRV_CTX *srv_ctx,
  323. const OSSL_CMP_MSG *req)
  324. {
  325. OSSL_CMP_POLLREQCONTENT *prc;
  326. OSSL_CMP_POLLREQ *pr;
  327. int certReqId;
  328. OSSL_CMP_MSG *certReq;
  329. int64_t check_after = 0;
  330. OSSL_CMP_MSG *msg = NULL;
  331. if (!ossl_assert(srv_ctx != NULL && srv_ctx->ctx != NULL && req != NULL))
  332. return NULL;
  333. prc = req->body->value.pollReq;
  334. if (sk_OSSL_CMP_POLLREQ_num(prc) != 1) {
  335. ERR_raise(ERR_LIB_CMP, CMP_R_MULTIPLE_REQUESTS_NOT_SUPPORTED);
  336. return NULL;
  337. }
  338. pr = sk_OSSL_CMP_POLLREQ_value(prc, 0);
  339. certReqId = ossl_cmp_asn1_get_int(pr->certReqId);
  340. if (!srv_ctx->process_pollReq(srv_ctx, req, certReqId,
  341. &certReq, &check_after))
  342. return NULL;
  343. if (certReq != NULL) {
  344. msg = process_cert_request(srv_ctx, certReq);
  345. OSSL_CMP_MSG_free(certReq);
  346. } else {
  347. if ((msg = ossl_cmp_pollRep_new(srv_ctx->ctx, certReqId,
  348. check_after)) == NULL)
  349. ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_POLLREP);
  350. }
  351. return msg;
  352. }
  353. /*
  354. * Determine whether missing/invalid protection of request message is allowed.
  355. * Return 1 on acceptance, 0 on rejection, or -1 on (internal) error.
  356. */
  357. static int unprotected_exception(const OSSL_CMP_CTX *ctx,
  358. const OSSL_CMP_MSG *req,
  359. int invalid_protection,
  360. int accept_unprotected_requests)
  361. {
  362. if (!ossl_assert(ctx != NULL && req != NULL))
  363. return -1;
  364. if (accept_unprotected_requests) {
  365. ossl_cmp_log1(WARN, ctx, "ignoring %s protection of request message",
  366. invalid_protection ? "invalid" : "missing");
  367. return 1;
  368. }
  369. if (OSSL_CMP_MSG_get_bodytype(req) == OSSL_CMP_PKIBODY_ERROR
  370. && OSSL_CMP_CTX_get_option(ctx, OSSL_CMP_OPT_UNPROTECTED_ERRORS) == 1) {
  371. ossl_cmp_warn(ctx, "ignoring missing protection of error message");
  372. return 1;
  373. }
  374. return 0;
  375. }
  376. /*
  377. * returns created message and NULL on internal error
  378. */
  379. OSSL_CMP_MSG *OSSL_CMP_SRV_process_request(OSSL_CMP_SRV_CTX *srv_ctx,
  380. const OSSL_CMP_MSG *req)
  381. {
  382. OSSL_CMP_CTX *ctx;
  383. ASN1_OCTET_STRING *backup_secret;
  384. OSSL_CMP_PKIHEADER *hdr;
  385. int req_type, rsp_type;
  386. int res;
  387. OSSL_CMP_MSG *rsp = NULL;
  388. if (srv_ctx == NULL || srv_ctx->ctx == NULL
  389. || req == NULL || req->body == NULL
  390. || (hdr = OSSL_CMP_MSG_get0_header(req)) == NULL) {
  391. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  392. return 0;
  393. }
  394. ctx = srv_ctx->ctx;
  395. backup_secret = ctx->secretValue;
  396. req_type = OSSL_CMP_MSG_get_bodytype(req);
  397. ossl_cmp_log1(DEBUG, ctx,
  398. "received %s", ossl_cmp_bodytype_to_string(req_type));
  399. /*
  400. * Some things need to be done already before validating the message in
  401. * order to be able to send an error message as far as needed and possible.
  402. */
  403. if (hdr->sender->type != GEN_DIRNAME) {
  404. ERR_raise(ERR_LIB_CMP, CMP_R_SENDER_GENERALNAME_TYPE_NOT_SUPPORTED);
  405. goto err;
  406. }
  407. if (!OSSL_CMP_CTX_set1_recipient(ctx, hdr->sender->d.directoryName))
  408. goto err;
  409. switch (req_type) {
  410. case OSSL_CMP_PKIBODY_IR:
  411. case OSSL_CMP_PKIBODY_CR:
  412. case OSSL_CMP_PKIBODY_P10CR:
  413. case OSSL_CMP_PKIBODY_KUR:
  414. case OSSL_CMP_PKIBODY_RR:
  415. case OSSL_CMP_PKIBODY_GENM:
  416. case OSSL_CMP_PKIBODY_ERROR:
  417. if (ctx->transactionID != NULL) {
  418. char *tid = i2s_ASN1_OCTET_STRING(NULL, ctx->transactionID);
  419. if (tid != NULL)
  420. ossl_cmp_log1(WARN, ctx,
  421. "Assuming that last transaction with ID=%s got aborted",
  422. tid);
  423. OPENSSL_free(tid);
  424. }
  425. /* start of a new transaction, reset transactionID and senderNonce */
  426. if (!OSSL_CMP_CTX_set1_transactionID(ctx, NULL)
  427. || !OSSL_CMP_CTX_set1_senderNonce(ctx, NULL))
  428. goto err;
  429. break;
  430. default:
  431. /* transactionID should be already initialized */
  432. if (ctx->transactionID == NULL) {
  433. #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
  434. ERR_raise(ERR_LIB_CMP, CMP_R_UNEXPECTED_PKIBODY);
  435. goto err;
  436. #endif
  437. }
  438. }
  439. res = ossl_cmp_msg_check_update(ctx, req, unprotected_exception,
  440. srv_ctx->acceptUnprotected);
  441. if (ctx->secretValue != NULL && ctx->pkey != NULL
  442. && ossl_cmp_hdr_get_protection_nid(hdr) != NID_id_PasswordBasedMAC)
  443. ctx->secretValue = NULL; /* use MSG_SIG_ALG when protecting rsp */
  444. if (!res)
  445. goto err;
  446. switch (req_type) {
  447. case OSSL_CMP_PKIBODY_IR:
  448. case OSSL_CMP_PKIBODY_CR:
  449. case OSSL_CMP_PKIBODY_P10CR:
  450. case OSSL_CMP_PKIBODY_KUR:
  451. if (srv_ctx->process_cert_request == NULL)
  452. ERR_raise(ERR_LIB_CMP, CMP_R_UNEXPECTED_PKIBODY);
  453. else
  454. rsp = process_cert_request(srv_ctx, req);
  455. break;
  456. case OSSL_CMP_PKIBODY_RR:
  457. if (srv_ctx->process_rr == NULL)
  458. ERR_raise(ERR_LIB_CMP, CMP_R_UNEXPECTED_PKIBODY);
  459. else
  460. rsp = process_rr(srv_ctx, req);
  461. break;
  462. case OSSL_CMP_PKIBODY_GENM:
  463. if (srv_ctx->process_genm == NULL)
  464. ERR_raise(ERR_LIB_CMP, CMP_R_UNEXPECTED_PKIBODY);
  465. else
  466. rsp = process_genm(srv_ctx, req);
  467. break;
  468. case OSSL_CMP_PKIBODY_ERROR:
  469. if (srv_ctx->process_error == NULL)
  470. ERR_raise(ERR_LIB_CMP, CMP_R_UNEXPECTED_PKIBODY);
  471. else
  472. rsp = process_error(srv_ctx, req);
  473. break;
  474. case OSSL_CMP_PKIBODY_CERTCONF:
  475. if (srv_ctx->process_certConf == NULL)
  476. ERR_raise(ERR_LIB_CMP, CMP_R_UNEXPECTED_PKIBODY);
  477. else
  478. rsp = process_certConf(srv_ctx, req);
  479. break;
  480. case OSSL_CMP_PKIBODY_POLLREQ:
  481. if (srv_ctx->process_pollReq == NULL)
  482. ERR_raise(ERR_LIB_CMP, CMP_R_UNEXPECTED_PKIBODY);
  483. else
  484. rsp = process_pollReq(srv_ctx, req);
  485. break;
  486. default:
  487. ERR_raise(ERR_LIB_CMP, CMP_R_UNEXPECTED_PKIBODY);
  488. break;
  489. }
  490. err:
  491. if (rsp == NULL) {
  492. /* on error, try to respond with CMP error message to client */
  493. const char *data = NULL, *reason = NULL;
  494. int flags = 0;
  495. unsigned long err = ERR_peek_error_data(&data, &flags);
  496. int fail_info = 1 << OSSL_CMP_PKIFAILUREINFO_badRequest;
  497. OSSL_CMP_PKISI *si = NULL;
  498. if (ctx->transactionID == NULL) {
  499. /* ignore any (extra) error in next two function calls: */
  500. (void)OSSL_CMP_CTX_set1_transactionID(ctx, hdr->transactionID);
  501. (void)ossl_cmp_ctx_set1_recipNonce(ctx, hdr->senderNonce);
  502. }
  503. if ((flags & ERR_TXT_STRING) == 0 || *data == '\0')
  504. data = NULL;
  505. reason = ERR_reason_error_string(err);
  506. if ((si = OSSL_CMP_STATUSINFO_new(OSSL_CMP_PKISTATUS_rejection,
  507. fail_info, reason)) != NULL) {
  508. rsp = ossl_cmp_error_new(srv_ctx->ctx, si, err,
  509. data, srv_ctx->sendUnprotectedErrors);
  510. OSSL_CMP_PKISI_free(si);
  511. }
  512. }
  513. OSSL_CMP_CTX_print_errors(ctx);
  514. ctx->secretValue = backup_secret;
  515. rsp_type =
  516. rsp != NULL ? OSSL_CMP_MSG_get_bodytype(rsp) : OSSL_CMP_PKIBODY_ERROR;
  517. if (rsp != NULL)
  518. ossl_cmp_log1(DEBUG, ctx,
  519. "sending %s", ossl_cmp_bodytype_to_string(rsp_type));
  520. else
  521. ossl_cmp_log(ERR, ctx, "cannot send proper CMP response");
  522. /* possibly close the transaction */
  523. ctx->status = -2; /* this indicates transaction is open */
  524. switch (rsp_type) {
  525. case OSSL_CMP_PKIBODY_IP:
  526. case OSSL_CMP_PKIBODY_CP:
  527. case OSSL_CMP_PKIBODY_KUP:
  528. if (OSSL_CMP_CTX_get_option(ctx, OSSL_CMP_OPT_IMPLICIT_CONFIRM) == 0)
  529. break;
  530. /* fall through */
  531. case OSSL_CMP_PKIBODY_RP:
  532. case OSSL_CMP_PKIBODY_PKICONF:
  533. case OSSL_CMP_PKIBODY_GENP:
  534. case OSSL_CMP_PKIBODY_ERROR:
  535. (void)OSSL_CMP_CTX_set1_transactionID(ctx, NULL);
  536. (void)OSSL_CMP_CTX_set1_senderNonce(ctx, NULL);
  537. ctx->status = -1; /* transaction closed */
  538. default: /* not closing transaction in other cases */
  539. break;
  540. }
  541. return rsp;
  542. }
  543. /*
  544. * Server interface that may substitute OSSL_CMP_MSG_http_perform at the client.
  545. * The OSSL_CMP_SRV_CTX must be set as client_ctx->transfer_cb_arg.
  546. * returns received message on success, else NULL and pushes an element on the
  547. * error stack.
  548. */
  549. OSSL_CMP_MSG *OSSL_CMP_CTX_server_perform(OSSL_CMP_CTX *client_ctx,
  550. const OSSL_CMP_MSG *req)
  551. {
  552. OSSL_CMP_SRV_CTX *srv_ctx = NULL;
  553. if (client_ctx == NULL || req == NULL) {
  554. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  555. return NULL;
  556. }
  557. if ((srv_ctx = OSSL_CMP_CTX_get_transfer_cb_arg(client_ctx)) == NULL) {
  558. ERR_raise(ERR_LIB_CMP, CMP_R_TRANSFER_ERROR);
  559. return NULL;
  560. }
  561. return OSSL_CMP_SRV_process_request(srv_ctx, req);
  562. }