cmp_ctx.c 33 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119
  1. /*
  2. * Copyright 2007-2021 The OpenSSL Project Authors. All Rights Reserved.
  3. * Copyright Nokia 2007-2019
  4. * Copyright Siemens AG 2015-2019
  5. *
  6. * Licensed under the Apache License 2.0 (the "License"). You may not use
  7. * this file except in compliance with the License. You can obtain a copy
  8. * in the file LICENSE in the source distribution or at
  9. * https://www.openssl.org/source/license.html
  10. */
  11. #include <openssl/trace.h>
  12. #include <openssl/bio.h>
  13. #include <openssl/ocsp.h> /* for OCSP_REVOKED_STATUS_* */
  14. #include "cmp_local.h"
  15. /* explicit #includes not strictly needed since implied by the above: */
  16. #include <openssl/cmp.h>
  17. #include <openssl/crmf.h>
  18. #include <openssl/err.h>
  19. /*
  20. * Get current certificate store containing trusted root CA certs
  21. */
  22. X509_STORE *OSSL_CMP_CTX_get0_trustedStore(const OSSL_CMP_CTX *ctx)
  23. {
  24. if (ctx == NULL) {
  25. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  26. return NULL;
  27. }
  28. return ctx->trusted;
  29. }
  30. /*
  31. * Set certificate store containing trusted (root) CA certs and possibly CRLs
  32. * and a cert verification callback function used for CMP server authentication.
  33. * Any already existing store entry is freed. Given NULL, the entry is reset.
  34. */
  35. int OSSL_CMP_CTX_set0_trustedStore(OSSL_CMP_CTX *ctx, X509_STORE *store)
  36. {
  37. if (ctx == NULL) {
  38. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  39. return 0;
  40. }
  41. X509_STORE_free(ctx->trusted);
  42. ctx->trusted = store;
  43. return 1;
  44. }
  45. /* Get current list of non-trusted intermediate certs */
  46. STACK_OF(X509) *OSSL_CMP_CTX_get0_untrusted(const OSSL_CMP_CTX *ctx)
  47. {
  48. if (ctx == NULL) {
  49. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  50. return NULL;
  51. }
  52. return ctx->untrusted;
  53. }
  54. /*
  55. * Set untrusted certificates for path construction in authentication of
  56. * the CMP server and potentially others (TLS server, newly enrolled cert).
  57. */
  58. int OSSL_CMP_CTX_set1_untrusted(OSSL_CMP_CTX *ctx, STACK_OF(X509) *certs)
  59. {
  60. STACK_OF(X509) *untrusted = NULL;
  61. if (ctx == NULL) {
  62. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  63. return 0;
  64. }
  65. if (!ossl_x509_add_certs_new(&untrusted, certs,
  66. X509_ADD_FLAG_UP_REF | X509_ADD_FLAG_NO_DUP))
  67. goto err;
  68. sk_X509_pop_free(ctx->untrusted, X509_free);
  69. ctx->untrusted = untrusted;
  70. return 1;
  71. err:
  72. sk_X509_pop_free(untrusted, X509_free);
  73. return 0;
  74. }
  75. static int cmp_ctx_set_md(OSSL_CMP_CTX *ctx, EVP_MD **pmd, int nid)
  76. {
  77. EVP_MD *md = EVP_MD_fetch(ctx->libctx, OBJ_nid2sn(nid), ctx->propq);
  78. /* fetching in advance to be able to throw error early if unsupported */
  79. if (md == NULL) {
  80. ERR_raise(ERR_LIB_CMP, CMP_R_UNSUPPORTED_ALGORITHM);
  81. return 0;
  82. }
  83. EVP_MD_free(*pmd);
  84. *pmd = md;
  85. return 1;
  86. }
  87. /*
  88. * Allocates and initializes OSSL_CMP_CTX context structure with default values.
  89. * Returns new context on success, NULL on error
  90. */
  91. OSSL_CMP_CTX *OSSL_CMP_CTX_new(OSSL_LIB_CTX *libctx, const char *propq)
  92. {
  93. OSSL_CMP_CTX *ctx = OPENSSL_zalloc(sizeof(*ctx));
  94. if (ctx == NULL)
  95. goto err;
  96. ctx->libctx = libctx;
  97. if (propq != NULL && (ctx->propq = OPENSSL_strdup(propq)) == NULL)
  98. goto err;
  99. ctx->log_verbosity = OSSL_CMP_LOG_INFO;
  100. ctx->status = -1;
  101. ctx->failInfoCode = -1;
  102. ctx->msg_timeout = 2 * 60;
  103. if ((ctx->untrusted = sk_X509_new_null()) == NULL)
  104. goto err;
  105. ctx->pbm_slen = 16;
  106. if (!cmp_ctx_set_md(ctx, &ctx->pbm_owf, NID_sha256))
  107. goto err;
  108. ctx->pbm_itercnt = 500;
  109. ctx->pbm_mac = NID_hmac_sha1;
  110. if (!cmp_ctx_set_md(ctx, &ctx->digest, NID_sha256))
  111. goto err;
  112. ctx->popoMethod = OSSL_CRMF_POPO_SIGNATURE;
  113. ctx->revocationReason = CRL_REASON_NONE;
  114. /* all other elements are initialized to 0 or NULL, respectively */
  115. return ctx;
  116. err:
  117. OSSL_CMP_CTX_free(ctx);
  118. ERR_raise(ERR_LIB_X509, ERR_R_MALLOC_FAILURE);
  119. return NULL;
  120. }
  121. /* Prepare the OSSL_CMP_CTX for next use, partly re-initializing OSSL_CMP_CTX */
  122. int OSSL_CMP_CTX_reinit(OSSL_CMP_CTX *ctx)
  123. {
  124. if (ctx == NULL) {
  125. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  126. return 0;
  127. }
  128. ctx->status = -1;
  129. ctx->failInfoCode = -1;
  130. return ossl_cmp_ctx_set0_statusString(ctx, NULL)
  131. && ossl_cmp_ctx_set0_newCert(ctx, NULL)
  132. && ossl_cmp_ctx_set1_newChain(ctx, NULL)
  133. && ossl_cmp_ctx_set1_caPubs(ctx, NULL)
  134. && ossl_cmp_ctx_set1_extraCertsIn(ctx, NULL)
  135. && ossl_cmp_ctx_set0_validatedSrvCert(ctx, NULL)
  136. && OSSL_CMP_CTX_set1_transactionID(ctx, NULL)
  137. && OSSL_CMP_CTX_set1_senderNonce(ctx, NULL)
  138. && ossl_cmp_ctx_set1_recipNonce(ctx, NULL);
  139. }
  140. /* Frees OSSL_CMP_CTX variables allocated in OSSL_CMP_CTX_new() */
  141. void OSSL_CMP_CTX_free(OSSL_CMP_CTX *ctx)
  142. {
  143. if (ctx == NULL)
  144. return;
  145. OPENSSL_free(ctx->serverPath);
  146. OPENSSL_free(ctx->server);
  147. OPENSSL_free(ctx->proxy);
  148. OPENSSL_free(ctx->no_proxy);
  149. X509_free(ctx->srvCert);
  150. X509_free(ctx->validatedSrvCert);
  151. X509_NAME_free(ctx->expected_sender);
  152. X509_STORE_free(ctx->trusted);
  153. sk_X509_pop_free(ctx->untrusted, X509_free);
  154. X509_free(ctx->cert);
  155. sk_X509_pop_free(ctx->chain, X509_free);
  156. EVP_PKEY_free(ctx->pkey);
  157. ASN1_OCTET_STRING_free(ctx->referenceValue);
  158. if (ctx->secretValue != NULL)
  159. OPENSSL_cleanse(ctx->secretValue->data, ctx->secretValue->length);
  160. ASN1_OCTET_STRING_free(ctx->secretValue);
  161. EVP_MD_free(ctx->pbm_owf);
  162. X509_NAME_free(ctx->recipient);
  163. EVP_MD_free(ctx->digest);
  164. ASN1_OCTET_STRING_free(ctx->transactionID);
  165. ASN1_OCTET_STRING_free(ctx->senderNonce);
  166. ASN1_OCTET_STRING_free(ctx->recipNonce);
  167. sk_OSSL_CMP_ITAV_pop_free(ctx->geninfo_ITAVs, OSSL_CMP_ITAV_free);
  168. sk_X509_pop_free(ctx->extraCertsOut, X509_free);
  169. EVP_PKEY_free(ctx->newPkey);
  170. X509_NAME_free(ctx->issuer);
  171. X509_NAME_free(ctx->subjectName);
  172. sk_GENERAL_NAME_pop_free(ctx->subjectAltNames, GENERAL_NAME_free);
  173. sk_X509_EXTENSION_pop_free(ctx->reqExtensions, X509_EXTENSION_free);
  174. sk_POLICYINFO_pop_free(ctx->policies, POLICYINFO_free);
  175. X509_free(ctx->oldCert);
  176. X509_REQ_free(ctx->p10CSR);
  177. sk_OSSL_CMP_ITAV_pop_free(ctx->genm_ITAVs, OSSL_CMP_ITAV_free);
  178. sk_ASN1_UTF8STRING_pop_free(ctx->statusString, ASN1_UTF8STRING_free);
  179. X509_free(ctx->newCert);
  180. sk_X509_pop_free(ctx->newChain, X509_free);
  181. sk_X509_pop_free(ctx->caPubs, X509_free);
  182. sk_X509_pop_free(ctx->extraCertsIn, X509_free);
  183. OPENSSL_free(ctx);
  184. }
  185. int ossl_cmp_ctx_set_status(OSSL_CMP_CTX *ctx, int status)
  186. {
  187. if (!ossl_assert(ctx != NULL))
  188. return 0;
  189. ctx->status = status;
  190. return 1;
  191. }
  192. /*
  193. * Returns the PKIStatus from the last CertRepMessage
  194. * or Revocation Response or error message, -1 on error
  195. */
  196. int OSSL_CMP_CTX_get_status(const OSSL_CMP_CTX *ctx)
  197. {
  198. if (ctx == NULL) {
  199. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  200. return -1;
  201. }
  202. return ctx->status;
  203. }
  204. /*
  205. * Returns the statusString from the last CertRepMessage
  206. * or Revocation Response or error message, NULL on error
  207. */
  208. OSSL_CMP_PKIFREETEXT *OSSL_CMP_CTX_get0_statusString(const OSSL_CMP_CTX *ctx)
  209. {
  210. if (ctx == NULL) {
  211. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  212. return NULL;
  213. }
  214. return ctx->statusString;
  215. }
  216. int ossl_cmp_ctx_set0_statusString(OSSL_CMP_CTX *ctx,
  217. OSSL_CMP_PKIFREETEXT *text)
  218. {
  219. if (!ossl_assert(ctx != NULL))
  220. return 0;
  221. sk_ASN1_UTF8STRING_pop_free(ctx->statusString, ASN1_UTF8STRING_free);
  222. ctx->statusString = text;
  223. return 1;
  224. }
  225. int ossl_cmp_ctx_set0_validatedSrvCert(OSSL_CMP_CTX *ctx, X509 *cert)
  226. {
  227. if (!ossl_assert(ctx != NULL))
  228. return 0;
  229. X509_free(ctx->validatedSrvCert);
  230. ctx->validatedSrvCert = cert;
  231. return 1;
  232. }
  233. /* Set callback function for checking if the cert is ok or should be rejected */
  234. int OSSL_CMP_CTX_set_certConf_cb(OSSL_CMP_CTX *ctx, OSSL_CMP_certConf_cb_t cb)
  235. {
  236. if (ctx == NULL) {
  237. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  238. return 0;
  239. }
  240. ctx->certConf_cb = cb;
  241. return 1;
  242. }
  243. /*
  244. * Set argument, respectively a pointer to a structure containing arguments,
  245. * optionally to be used by the certConf callback.
  246. */
  247. int OSSL_CMP_CTX_set_certConf_cb_arg(OSSL_CMP_CTX *ctx, void *arg)
  248. {
  249. if (ctx == NULL) {
  250. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  251. return 0;
  252. }
  253. ctx->certConf_cb_arg = arg;
  254. return 1;
  255. }
  256. /*
  257. * Get argument, respectively the pointer to a structure containing arguments,
  258. * optionally to be used by certConf callback.
  259. * Returns callback argument set previously (NULL if not set or on error)
  260. */
  261. void *OSSL_CMP_CTX_get_certConf_cb_arg(const OSSL_CMP_CTX *ctx)
  262. {
  263. if (ctx == NULL) {
  264. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  265. return NULL;
  266. }
  267. return ctx->certConf_cb_arg;
  268. }
  269. #ifndef OPENSSL_NO_TRACE
  270. static size_t ossl_cmp_log_trace_cb(const char *buf, size_t cnt,
  271. int category, int cmd, void *vdata)
  272. {
  273. OSSL_CMP_CTX *ctx = vdata;
  274. const char *msg;
  275. OSSL_CMP_severity level = -1;
  276. char *func = NULL;
  277. char *file = NULL;
  278. int line = 0;
  279. if (buf == NULL || cnt == 0 || cmd != OSSL_TRACE_CTRL_WRITE || ctx == NULL)
  280. return 0;
  281. if (ctx->log_cb == NULL)
  282. return 1; /* silently drop message */
  283. msg = ossl_cmp_log_parse_metadata(buf, &level, &func, &file, &line);
  284. if (level > ctx->log_verbosity) /* excludes the case level is unknown */
  285. goto end; /* suppress output since severity is not sufficient */
  286. if (!ctx->log_cb(func != NULL ? func : "(no func)",
  287. file != NULL ? file : "(no file)",
  288. line, level, msg))
  289. cnt = 0;
  290. end:
  291. OPENSSL_free(func);
  292. OPENSSL_free(file);
  293. return cnt;
  294. }
  295. #endif
  296. /* Print CMP log messages (i.e., diagnostic info) via the log cb of the ctx */
  297. int ossl_cmp_print_log(OSSL_CMP_severity level, const OSSL_CMP_CTX *ctx,
  298. const char *func, const char *file, int line,
  299. const char *level_str, const char *format, ...)
  300. {
  301. va_list args;
  302. char hugebuf[1024 * 2];
  303. int res = 0;
  304. if (ctx == NULL || ctx->log_cb == NULL)
  305. return 1; /* silently drop message */
  306. if (level > ctx->log_verbosity) /* excludes the case level is unknown */
  307. return 1; /* suppress output since severity is not sufficient */
  308. if (format == NULL)
  309. return 0;
  310. va_start(args, format);
  311. if (func == NULL)
  312. func = "(unset function name)";
  313. if (file == NULL)
  314. file = "(unset file name)";
  315. if (level_str == NULL)
  316. level_str = "(unset level string)";
  317. #ifndef OPENSSL_NO_TRACE
  318. if (OSSL_TRACE_ENABLED(CMP)) {
  319. OSSL_TRACE_BEGIN(CMP) {
  320. int printed =
  321. BIO_snprintf(hugebuf, sizeof(hugebuf),
  322. "%s:%s:%d:" OSSL_CMP_LOG_PREFIX "%s: ",
  323. func, file, line, level_str);
  324. if (printed > 0 && (size_t)printed < sizeof(hugebuf)) {
  325. if (BIO_vsnprintf(hugebuf + printed,
  326. sizeof(hugebuf) - printed, format, args) > 0)
  327. res = BIO_puts(trc_out, hugebuf) > 0;
  328. }
  329. } OSSL_TRACE_END(CMP);
  330. }
  331. #else /* compensate for disabled trace API */
  332. {
  333. if (BIO_vsnprintf(hugebuf, sizeof(hugebuf), format, args) > 0)
  334. res = ctx->log_cb(func, file, line, level, hugebuf);
  335. }
  336. #endif
  337. va_end(args);
  338. return res;
  339. }
  340. /* Set a callback function for error reporting and logging messages */
  341. int OSSL_CMP_CTX_set_log_cb(OSSL_CMP_CTX *ctx, OSSL_CMP_log_cb_t cb)
  342. {
  343. if (ctx == NULL) {
  344. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  345. return 0;
  346. }
  347. ctx->log_cb = cb;
  348. #ifndef OPENSSL_NO_TRACE
  349. /* do also in case cb == NULL, to switch off logging output: */
  350. if (!OSSL_trace_set_callback(OSSL_TRACE_CATEGORY_CMP,
  351. ossl_cmp_log_trace_cb, ctx))
  352. return 0;
  353. #endif
  354. return 1;
  355. }
  356. /* Print OpenSSL and CMP errors via the log cb of the ctx or ERR_print_errors */
  357. void OSSL_CMP_CTX_print_errors(const OSSL_CMP_CTX *ctx)
  358. {
  359. if (ctx != NULL && OSSL_CMP_LOG_ERR > ctx->log_verbosity)
  360. return; /* suppress output since severity is not sufficient */
  361. OSSL_CMP_print_errors_cb(ctx == NULL ? NULL : ctx->log_cb);
  362. }
  363. /*
  364. * Set or clear the reference value to be used for identification
  365. * (i.e., the user name) when using PBMAC.
  366. */
  367. int OSSL_CMP_CTX_set1_referenceValue(OSSL_CMP_CTX *ctx,
  368. const unsigned char *ref, int len)
  369. {
  370. if (ctx == NULL) {
  371. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  372. return 0;
  373. }
  374. return ossl_cmp_asn1_octet_string_set1_bytes(&ctx->referenceValue, ref,
  375. len);
  376. }
  377. /* Set or clear the password to be used for protecting messages with PBMAC */
  378. int OSSL_CMP_CTX_set1_secretValue(OSSL_CMP_CTX *ctx, const unsigned char *sec,
  379. const int len)
  380. {
  381. ASN1_OCTET_STRING *secretValue = NULL;
  382. if (ctx == NULL) {
  383. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  384. return 0;
  385. }
  386. if (ossl_cmp_asn1_octet_string_set1_bytes(&secretValue, sec, len) != 1)
  387. return 0;
  388. if (ctx->secretValue != NULL) {
  389. OPENSSL_cleanse(ctx->secretValue->data, ctx->secretValue->length);
  390. ASN1_OCTET_STRING_free(ctx->secretValue);
  391. }
  392. ctx->secretValue = secretValue;
  393. return 1;
  394. }
  395. /* Returns the cert chain computed by OSSL_CMP_certConf_cb(), NULL on error */
  396. STACK_OF(X509) *OSSL_CMP_CTX_get1_newChain(const OSSL_CMP_CTX *ctx)
  397. {
  398. if (ctx == NULL) {
  399. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  400. return NULL;
  401. }
  402. return X509_chain_up_ref(ctx->newChain);
  403. }
  404. /*
  405. * Copies any given stack of inbound X509 certificates to newChain
  406. * of the OSSL_CMP_CTX structure so that they may be retrieved later.
  407. */
  408. int ossl_cmp_ctx_set1_newChain(OSSL_CMP_CTX *ctx, STACK_OF(X509) *newChain)
  409. {
  410. if (!ossl_assert(ctx != NULL))
  411. return 0;
  412. sk_X509_pop_free(ctx->newChain, X509_free);
  413. ctx->newChain = NULL;
  414. return newChain == NULL ||
  415. (ctx->newChain = X509_chain_up_ref(newChain)) != NULL;
  416. }
  417. /* Returns the stack of extraCerts received in CertRepMessage, NULL on error */
  418. STACK_OF(X509) *OSSL_CMP_CTX_get1_extraCertsIn(const OSSL_CMP_CTX *ctx)
  419. {
  420. if (ctx == NULL) {
  421. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  422. return NULL;
  423. }
  424. return X509_chain_up_ref(ctx->extraCertsIn);
  425. }
  426. /*
  427. * Copies any given stack of inbound X509 certificates to extraCertsIn
  428. * of the OSSL_CMP_CTX structure so that they may be retrieved later.
  429. */
  430. int ossl_cmp_ctx_set1_extraCertsIn(OSSL_CMP_CTX *ctx,
  431. STACK_OF(X509) *extraCertsIn)
  432. {
  433. if (!ossl_assert(ctx != NULL))
  434. return 0;
  435. sk_X509_pop_free(ctx->extraCertsIn, X509_free);
  436. ctx->extraCertsIn = NULL;
  437. return extraCertsIn == NULL
  438. || (ctx->extraCertsIn = X509_chain_up_ref(extraCertsIn)) != NULL;
  439. }
  440. /*
  441. * Copies any given stack as the new stack of X509
  442. * certificates to send out in the extraCerts field.
  443. */
  444. int OSSL_CMP_CTX_set1_extraCertsOut(OSSL_CMP_CTX *ctx,
  445. STACK_OF(X509) *extraCertsOut)
  446. {
  447. if (ctx == NULL) {
  448. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  449. return 0;
  450. }
  451. sk_X509_pop_free(ctx->extraCertsOut, X509_free);
  452. ctx->extraCertsOut = NULL;
  453. return extraCertsOut == NULL
  454. || (ctx->extraCertsOut = X509_chain_up_ref(extraCertsOut)) != NULL;
  455. }
  456. /*
  457. * Add the given policy info object
  458. * to the X509_EXTENSIONS of the requested certificate template.
  459. */
  460. int OSSL_CMP_CTX_push0_policy(OSSL_CMP_CTX *ctx, POLICYINFO *pinfo)
  461. {
  462. if (ctx == NULL || pinfo == NULL) {
  463. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  464. return 0;
  465. }
  466. if (ctx->policies == NULL
  467. && (ctx->policies = CERTIFICATEPOLICIES_new()) == NULL)
  468. return 0;
  469. return sk_POLICYINFO_push(ctx->policies, pinfo);
  470. }
  471. /* Add an ITAV for geninfo of the PKI message header */
  472. int OSSL_CMP_CTX_push0_geninfo_ITAV(OSSL_CMP_CTX *ctx, OSSL_CMP_ITAV *itav)
  473. {
  474. if (ctx == NULL) {
  475. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  476. return 0;
  477. }
  478. return OSSL_CMP_ITAV_push0_stack_item(&ctx->geninfo_ITAVs, itav);
  479. }
  480. /* Add an itav for the body of outgoing general messages */
  481. int OSSL_CMP_CTX_push0_genm_ITAV(OSSL_CMP_CTX *ctx, OSSL_CMP_ITAV *itav)
  482. {
  483. if (ctx == NULL) {
  484. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  485. return 0;
  486. }
  487. return OSSL_CMP_ITAV_push0_stack_item(&ctx->genm_ITAVs, itav);
  488. }
  489. /*
  490. * Returns a duplicate of the stack of X509 certificates that
  491. * were received in the caPubs field of the last CertRepMessage.
  492. * Returns NULL on error
  493. */
  494. STACK_OF(X509) *OSSL_CMP_CTX_get1_caPubs(const OSSL_CMP_CTX *ctx)
  495. {
  496. if (ctx == NULL) {
  497. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  498. return NULL;
  499. }
  500. return X509_chain_up_ref(ctx->caPubs);
  501. }
  502. /*
  503. * Copies any given stack of certificates to the given
  504. * OSSL_CMP_CTX structure so that they may be retrieved later.
  505. */
  506. int ossl_cmp_ctx_set1_caPubs(OSSL_CMP_CTX *ctx, STACK_OF(X509) *caPubs)
  507. {
  508. if (!ossl_assert(ctx != NULL))
  509. return 0;
  510. sk_X509_pop_free(ctx->caPubs, X509_free);
  511. ctx->caPubs = NULL;
  512. return caPubs == NULL || (ctx->caPubs = X509_chain_up_ref(caPubs)) != NULL;
  513. }
  514. #define char_dup OPENSSL_strdup
  515. #define char_free OPENSSL_free
  516. #define DEFINE_OSSL_CMP_CTX_set1(FIELD, TYPE) /* this uses _dup */ \
  517. int OSSL_CMP_CTX_set1_##FIELD(OSSL_CMP_CTX *ctx, const TYPE *val) \
  518. { \
  519. TYPE *val_dup = NULL; \
  520. \
  521. if (ctx == NULL) { \
  522. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT); \
  523. return 0; \
  524. } \
  525. \
  526. if (val != NULL && (val_dup = TYPE##_dup(val)) == NULL) \
  527. return 0; \
  528. TYPE##_free(ctx->FIELD); \
  529. ctx->FIELD = val_dup; \
  530. return 1; \
  531. }
  532. #define X509_invalid(cert) (!ossl_x509v3_cache_extensions(cert))
  533. #define EVP_PKEY_invalid(key) 0
  534. #define DEFINE_OSSL_CMP_CTX_set1_up_ref(FIELD, TYPE) \
  535. int OSSL_CMP_CTX_set1_##FIELD(OSSL_CMP_CTX *ctx, TYPE *val) \
  536. { \
  537. if (ctx == NULL) { \
  538. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT); \
  539. return 0; \
  540. } \
  541. \
  542. /* prevent misleading error later on malformed cert or provider issue */ \
  543. if (val != NULL && TYPE##_invalid(val)) { \
  544. ERR_raise(ERR_LIB_CMP, CMP_R_POTENTIALLY_INVALID_CERTIFICATE); \
  545. return 0; \
  546. } \
  547. if (val != NULL && !TYPE##_up_ref(val)) \
  548. return 0; \
  549. TYPE##_free(ctx->FIELD); \
  550. ctx->FIELD = val; \
  551. return 1; \
  552. }
  553. /*
  554. * Pins the server certificate to be directly trusted (even if it is expired)
  555. * for verifying response messages.
  556. * Cert pointer is not consumed. It may be NULL to clear the entry.
  557. */
  558. DEFINE_OSSL_CMP_CTX_set1_up_ref(srvCert, X509)
  559. /* Set the X509 name of the recipient. Set in the PKIHeader */
  560. DEFINE_OSSL_CMP_CTX_set1(recipient, X509_NAME)
  561. /* Store the X509 name of the expected sender in the PKIHeader of responses */
  562. DEFINE_OSSL_CMP_CTX_set1(expected_sender, X509_NAME)
  563. /* Set the X509 name of the issuer. Set in the PKIHeader */
  564. DEFINE_OSSL_CMP_CTX_set1(issuer, X509_NAME)
  565. /*
  566. * Set the subject name that will be placed in the certificate
  567. * request. This will be the subject name on the received certificate.
  568. */
  569. DEFINE_OSSL_CMP_CTX_set1(subjectName, X509_NAME)
  570. /* Set the X.509v3 certificate request extensions to be used in IR/CR/KUR */
  571. int OSSL_CMP_CTX_set0_reqExtensions(OSSL_CMP_CTX *ctx, X509_EXTENSIONS *exts)
  572. {
  573. if (ctx == NULL) {
  574. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  575. return 0;
  576. }
  577. if (sk_GENERAL_NAME_num(ctx->subjectAltNames) > 0 && exts != NULL
  578. && X509v3_get_ext_by_NID(exts, NID_subject_alt_name, -1) >= 0) {
  579. ERR_raise(ERR_LIB_CMP, CMP_R_MULTIPLE_SAN_SOURCES);
  580. return 0;
  581. }
  582. sk_X509_EXTENSION_pop_free(ctx->reqExtensions, X509_EXTENSION_free);
  583. ctx->reqExtensions = exts;
  584. return 1;
  585. }
  586. /* returns 1 if ctx contains a Subject Alternative Name extension, else 0 */
  587. int OSSL_CMP_CTX_reqExtensions_have_SAN(OSSL_CMP_CTX *ctx)
  588. {
  589. if (ctx == NULL) {
  590. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  591. return -1;
  592. }
  593. /* if one of the following conditions 'fail' this is not an error */
  594. return ctx->reqExtensions != NULL
  595. && X509v3_get_ext_by_NID(ctx->reqExtensions,
  596. NID_subject_alt_name, -1) >= 0;
  597. }
  598. /*
  599. * Add a GENERAL_NAME structure that will be added to the CRMF
  600. * request's extensions field to request subject alternative names.
  601. */
  602. int OSSL_CMP_CTX_push1_subjectAltName(OSSL_CMP_CTX *ctx,
  603. const GENERAL_NAME *name)
  604. {
  605. GENERAL_NAME *name_dup;
  606. if (ctx == NULL || name == NULL) {
  607. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  608. return 0;
  609. }
  610. if (OSSL_CMP_CTX_reqExtensions_have_SAN(ctx) == 1) {
  611. ERR_raise(ERR_LIB_CMP, CMP_R_MULTIPLE_SAN_SOURCES);
  612. return 0;
  613. }
  614. if (ctx->subjectAltNames == NULL
  615. && (ctx->subjectAltNames = sk_GENERAL_NAME_new_null()) == NULL)
  616. return 0;
  617. if ((name_dup = GENERAL_NAME_dup(name)) == NULL)
  618. return 0;
  619. if (!sk_GENERAL_NAME_push(ctx->subjectAltNames, name_dup)) {
  620. GENERAL_NAME_free(name_dup);
  621. return 0;
  622. }
  623. return 1;
  624. }
  625. /*
  626. * Set our own client certificate, used for example in KUR and when
  627. * doing the IR with existing certificate.
  628. */
  629. DEFINE_OSSL_CMP_CTX_set1_up_ref(cert, X509)
  630. int OSSL_CMP_CTX_build_cert_chain(OSSL_CMP_CTX *ctx, X509_STORE *own_trusted,
  631. STACK_OF(X509) *candidates)
  632. {
  633. STACK_OF(X509) *chain;
  634. if (ctx == NULL) {
  635. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  636. return 0;
  637. }
  638. if (!ossl_x509_add_certs_new(&ctx->untrusted, candidates,
  639. X509_ADD_FLAG_UP_REF | X509_ADD_FLAG_NO_DUP))
  640. return 0;
  641. ossl_cmp_debug(ctx, "trying to build chain for own CMP signer cert");
  642. chain = ossl_cmp_build_cert_chain(ctx->libctx, ctx->propq, own_trusted,
  643. ctx->untrusted, ctx->cert);
  644. if (chain == NULL) {
  645. ERR_raise(ERR_LIB_CMP, CMP_R_FAILED_BUILDING_OWN_CHAIN);
  646. return 0;
  647. }
  648. ossl_cmp_debug(ctx, "success building chain for own CMP signer cert");
  649. ctx->chain = chain;
  650. return 1;
  651. }
  652. /*
  653. * Set the old certificate that we are updating in KUR
  654. * or the certificate to be revoked in RR, respectively.
  655. * Also used as reference cert (defaulting to cert) for deriving subject DN
  656. * and SANs. Its issuer is used as default recipient in the CMP message header.
  657. */
  658. DEFINE_OSSL_CMP_CTX_set1_up_ref(oldCert, X509)
  659. /* Set the PKCS#10 CSR to be sent in P10CR */
  660. DEFINE_OSSL_CMP_CTX_set1(p10CSR, X509_REQ)
  661. /*
  662. * Set the (newly received in IP/KUP/CP) certificate in the context.
  663. * TODO: this only permits for one cert to be enrolled at a time.
  664. */
  665. int ossl_cmp_ctx_set0_newCert(OSSL_CMP_CTX *ctx, X509 *cert)
  666. {
  667. if (!ossl_assert(ctx != NULL))
  668. return 0;
  669. X509_free(ctx->newCert);
  670. ctx->newCert = cert;
  671. return 1;
  672. }
  673. /*
  674. * Get the (newly received in IP/KUP/CP) client certificate from the context
  675. * TODO: this only permits for one client cert to be received...
  676. */
  677. X509 *OSSL_CMP_CTX_get0_newCert(const OSSL_CMP_CTX *ctx)
  678. {
  679. if (ctx == NULL) {
  680. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  681. return NULL;
  682. }
  683. return ctx->newCert;
  684. }
  685. /* Set the client's current private key */
  686. DEFINE_OSSL_CMP_CTX_set1_up_ref(pkey, EVP_PKEY)
  687. /* Set new key pair. Used e.g. when doing Key Update */
  688. int OSSL_CMP_CTX_set0_newPkey(OSSL_CMP_CTX *ctx, int priv, EVP_PKEY *pkey)
  689. {
  690. if (ctx == NULL) {
  691. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  692. return 0;
  693. }
  694. EVP_PKEY_free(ctx->newPkey);
  695. ctx->newPkey = pkey;
  696. ctx->newPkey_priv = priv;
  697. return 1;
  698. }
  699. /* Get the private/public key to use for cert enrollment, or NULL on error */
  700. EVP_PKEY *OSSL_CMP_CTX_get0_newPkey(const OSSL_CMP_CTX *ctx, int priv)
  701. {
  702. if (ctx == NULL) {
  703. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  704. return NULL;
  705. }
  706. if (ctx->newPkey != NULL)
  707. return priv && !ctx->newPkey_priv ? NULL : ctx->newPkey;
  708. if (ctx->p10CSR != NULL)
  709. return priv ? NULL : X509_REQ_get0_pubkey(ctx->p10CSR);
  710. return ctx->pkey; /* may be NULL */
  711. }
  712. /* Set the given transactionID to the context */
  713. int OSSL_CMP_CTX_set1_transactionID(OSSL_CMP_CTX *ctx,
  714. const ASN1_OCTET_STRING *id)
  715. {
  716. if (ctx == NULL) {
  717. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  718. return 0;
  719. }
  720. return ossl_cmp_asn1_octet_string_set1(&ctx->transactionID, id);
  721. }
  722. /* Set the nonce to be used for the recipNonce in the message created next */
  723. int ossl_cmp_ctx_set1_recipNonce(OSSL_CMP_CTX *ctx,
  724. const ASN1_OCTET_STRING *nonce)
  725. {
  726. if (!ossl_assert(ctx != NULL))
  727. return 0;
  728. return ossl_cmp_asn1_octet_string_set1(&ctx->recipNonce, nonce);
  729. }
  730. /* Stores the given nonce as the last senderNonce sent out */
  731. int OSSL_CMP_CTX_set1_senderNonce(OSSL_CMP_CTX *ctx,
  732. const ASN1_OCTET_STRING *nonce)
  733. {
  734. if (ctx == NULL) {
  735. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  736. return 0;
  737. }
  738. return ossl_cmp_asn1_octet_string_set1(&ctx->senderNonce, nonce);
  739. }
  740. /* Set the proxy server to use for HTTP(S) connections */
  741. DEFINE_OSSL_CMP_CTX_set1(proxy, char)
  742. /* Set the (HTTP) host name of the CMP server */
  743. DEFINE_OSSL_CMP_CTX_set1(server, char)
  744. /* Set the server exclusion list of the HTTP proxy server */
  745. DEFINE_OSSL_CMP_CTX_set1(no_proxy, char)
  746. /* Set the http connect/disconnect callback function to be used for HTTP(S) */
  747. int OSSL_CMP_CTX_set_http_cb(OSSL_CMP_CTX *ctx, OSSL_HTTP_bio_cb_t cb)
  748. {
  749. if (ctx == NULL) {
  750. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  751. return 0;
  752. }
  753. ctx->http_cb = cb;
  754. return 1;
  755. }
  756. /* Set argument optionally to be used by the http connect/disconnect callback */
  757. int OSSL_CMP_CTX_set_http_cb_arg(OSSL_CMP_CTX *ctx, void *arg)
  758. {
  759. if (ctx == NULL) {
  760. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  761. return 0;
  762. }
  763. ctx->http_cb_arg = arg;
  764. return 1;
  765. }
  766. /*
  767. * Get argument optionally to be used by the http connect/disconnect callback
  768. * Returns callback argument set previously (NULL if not set or on error)
  769. */
  770. void *OSSL_CMP_CTX_get_http_cb_arg(const OSSL_CMP_CTX *ctx)
  771. {
  772. if (ctx == NULL) {
  773. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  774. return NULL;
  775. }
  776. return ctx->http_cb_arg;
  777. }
  778. /* Set callback function for sending CMP request and receiving response */
  779. int OSSL_CMP_CTX_set_transfer_cb(OSSL_CMP_CTX *ctx, OSSL_CMP_transfer_cb_t cb)
  780. {
  781. if (ctx == NULL) {
  782. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  783. return 0;
  784. }
  785. ctx->transfer_cb = cb;
  786. return 1;
  787. }
  788. /* Set argument optionally to be used by the transfer callback */
  789. int OSSL_CMP_CTX_set_transfer_cb_arg(OSSL_CMP_CTX *ctx, void *arg)
  790. {
  791. if (ctx == NULL) {
  792. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  793. return 0;
  794. }
  795. ctx->transfer_cb_arg = arg;
  796. return 1;
  797. }
  798. /*
  799. * Get argument optionally to be used by the transfer callback.
  800. * Returns callback argument set previously (NULL if not set or on error)
  801. */
  802. void *OSSL_CMP_CTX_get_transfer_cb_arg(const OSSL_CMP_CTX *ctx)
  803. {
  804. if (ctx == NULL) {
  805. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  806. return NULL;
  807. }
  808. return ctx->transfer_cb_arg;
  809. }
  810. /** Set the HTTP server port to be used */
  811. int OSSL_CMP_CTX_set_serverPort(OSSL_CMP_CTX *ctx, int port)
  812. {
  813. if (ctx == NULL) {
  814. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  815. return 0;
  816. }
  817. ctx->serverPort = port;
  818. return 1;
  819. }
  820. /* Set the HTTP path to be used on the server (e.g "pkix/") */
  821. DEFINE_OSSL_CMP_CTX_set1(serverPath, char)
  822. /* Set the failInfo error code as bit encoding in OSSL_CMP_CTX */
  823. int ossl_cmp_ctx_set_failInfoCode(OSSL_CMP_CTX *ctx, int fail_info)
  824. {
  825. if (!ossl_assert(ctx != NULL))
  826. return 0;
  827. ctx->failInfoCode = fail_info;
  828. return 1;
  829. }
  830. /*
  831. * Get the failInfo error code in OSSL_CMP_CTX as bit encoding.
  832. * Returns bit string as integer on success, -1 on error
  833. */
  834. int OSSL_CMP_CTX_get_failInfoCode(const OSSL_CMP_CTX *ctx)
  835. {
  836. if (ctx == NULL) {
  837. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  838. return -1;
  839. }
  840. return ctx->failInfoCode;
  841. }
  842. /* Set a Boolean or integer option of the context to the "val" arg */
  843. int OSSL_CMP_CTX_set_option(OSSL_CMP_CTX *ctx, int opt, int val)
  844. {
  845. int min_val;
  846. if (ctx == NULL) {
  847. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  848. return 0;
  849. }
  850. switch (opt) {
  851. case OSSL_CMP_OPT_REVOCATION_REASON:
  852. min_val = OCSP_REVOKED_STATUS_NOSTATUS;
  853. break;
  854. case OSSL_CMP_OPT_POPO_METHOD:
  855. min_val = OSSL_CRMF_POPO_NONE;
  856. break;
  857. default:
  858. min_val = 0;
  859. break;
  860. }
  861. if (val < min_val) {
  862. ERR_raise(ERR_LIB_CMP, CMP_R_VALUE_TOO_SMALL);
  863. return 0;
  864. }
  865. switch (opt) {
  866. case OSSL_CMP_OPT_LOG_VERBOSITY:
  867. if (val > OSSL_CMP_LOG_MAX) {
  868. ERR_raise(ERR_LIB_CMP, CMP_R_VALUE_TOO_LARGE);
  869. return 0;
  870. }
  871. ctx->log_verbosity = val;
  872. break;
  873. case OSSL_CMP_OPT_IMPLICIT_CONFIRM:
  874. ctx->implicitConfirm = val;
  875. break;
  876. case OSSL_CMP_OPT_DISABLE_CONFIRM:
  877. ctx->disableConfirm = val;
  878. break;
  879. case OSSL_CMP_OPT_UNPROTECTED_SEND:
  880. ctx->unprotectedSend = val;
  881. break;
  882. case OSSL_CMP_OPT_UNPROTECTED_ERRORS:
  883. ctx->unprotectedErrors = val;
  884. break;
  885. case OSSL_CMP_OPT_VALIDITY_DAYS:
  886. ctx->days = val;
  887. break;
  888. case OSSL_CMP_OPT_SUBJECTALTNAME_NODEFAULT:
  889. ctx->SubjectAltName_nodefault = val;
  890. break;
  891. case OSSL_CMP_OPT_SUBJECTALTNAME_CRITICAL:
  892. ctx->setSubjectAltNameCritical = val;
  893. break;
  894. case OSSL_CMP_OPT_POLICIES_CRITICAL:
  895. ctx->setPoliciesCritical = val;
  896. break;
  897. case OSSL_CMP_OPT_IGNORE_KEYUSAGE:
  898. ctx->ignore_keyusage = val;
  899. break;
  900. case OSSL_CMP_OPT_POPO_METHOD:
  901. if (val > OSSL_CRMF_POPO_KEYAGREE) {
  902. ERR_raise(ERR_LIB_CMP, CMP_R_VALUE_TOO_LARGE);
  903. return 0;
  904. }
  905. ctx->popoMethod = val;
  906. break;
  907. case OSSL_CMP_OPT_DIGEST_ALGNID:
  908. if (!cmp_ctx_set_md(ctx, &ctx->digest, val))
  909. return 0;
  910. break;
  911. case OSSL_CMP_OPT_OWF_ALGNID:
  912. if (!cmp_ctx_set_md(ctx, &ctx->pbm_owf, val))
  913. return 0;
  914. break;
  915. case OSSL_CMP_OPT_MAC_ALGNID:
  916. ctx->pbm_mac = val;
  917. break;
  918. case OSSL_CMP_OPT_MSG_TIMEOUT:
  919. ctx->msg_timeout = val;
  920. break;
  921. case OSSL_CMP_OPT_TOTAL_TIMEOUT:
  922. ctx->total_timeout = val;
  923. break;
  924. case OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR:
  925. ctx->permitTAInExtraCertsForIR = val;
  926. break;
  927. case OSSL_CMP_OPT_REVOCATION_REASON:
  928. if (val > OCSP_REVOKED_STATUS_AACOMPROMISE) {
  929. ERR_raise(ERR_LIB_CMP, CMP_R_VALUE_TOO_LARGE);
  930. return 0;
  931. }
  932. ctx->revocationReason = val;
  933. break;
  934. default:
  935. ERR_raise(ERR_LIB_CMP, CMP_R_INVALID_OPTION);
  936. return 0;
  937. }
  938. return 1;
  939. }
  940. /*
  941. * Reads a Boolean or integer option value from the context.
  942. * Returns -1 on error (which is the default OSSL_CMP_OPT_REVOCATION_REASON)
  943. */
  944. int OSSL_CMP_CTX_get_option(const OSSL_CMP_CTX *ctx, int opt)
  945. {
  946. if (ctx == NULL) {
  947. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  948. return -1;
  949. }
  950. switch (opt) {
  951. case OSSL_CMP_OPT_LOG_VERBOSITY:
  952. return ctx->log_verbosity;
  953. case OSSL_CMP_OPT_IMPLICIT_CONFIRM:
  954. return ctx->implicitConfirm;
  955. case OSSL_CMP_OPT_DISABLE_CONFIRM:
  956. return ctx->disableConfirm;
  957. case OSSL_CMP_OPT_UNPROTECTED_SEND:
  958. return ctx->unprotectedSend;
  959. case OSSL_CMP_OPT_UNPROTECTED_ERRORS:
  960. return ctx->unprotectedErrors;
  961. case OSSL_CMP_OPT_VALIDITY_DAYS:
  962. return ctx->days;
  963. case OSSL_CMP_OPT_SUBJECTALTNAME_NODEFAULT:
  964. return ctx->SubjectAltName_nodefault;
  965. case OSSL_CMP_OPT_SUBJECTALTNAME_CRITICAL:
  966. return ctx->setSubjectAltNameCritical;
  967. case OSSL_CMP_OPT_POLICIES_CRITICAL:
  968. return ctx->setPoliciesCritical;
  969. case OSSL_CMP_OPT_IGNORE_KEYUSAGE:
  970. return ctx->ignore_keyusage;
  971. case OSSL_CMP_OPT_POPO_METHOD:
  972. return ctx->popoMethod;
  973. case OSSL_CMP_OPT_DIGEST_ALGNID:
  974. return EVP_MD_type(ctx->digest);
  975. case OSSL_CMP_OPT_OWF_ALGNID:
  976. return EVP_MD_type(ctx->pbm_owf);
  977. case OSSL_CMP_OPT_MAC_ALGNID:
  978. return ctx->pbm_mac;
  979. case OSSL_CMP_OPT_MSG_TIMEOUT:
  980. return ctx->msg_timeout;
  981. case OSSL_CMP_OPT_TOTAL_TIMEOUT:
  982. return ctx->total_timeout;
  983. case OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR:
  984. return ctx->permitTAInExtraCertsForIR;
  985. case OSSL_CMP_OPT_REVOCATION_REASON:
  986. return ctx->revocationReason;
  987. default:
  988. ERR_raise(ERR_LIB_CMP, CMP_R_INVALID_OPTION);
  989. return -1;
  990. }
  991. }