A local copy of OpenSSL from GitHub
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

339 lines
12 KiB

  1. /*
  2. * Copyright 2007-2020 The OpenSSL Project Authors. All Rights Reserved.
  3. * Copyright Nokia 2007-2019
  4. * Copyright Siemens AG 2015-2019
  5. *
  6. * Licensed under the Apache License 2.0 (the "License"). You may not use
  7. * this file except in compliance with the License. You can obtain a copy
  8. * in the file LICENSE in the source distribution or at
  9. * https://www.openssl.org/source/license.html
  10. */
  11. #include "cmp_local.h"
  12. /* explicit #includes not strictly needed since implied by the above: */
  13. #include <openssl/asn1t.h>
  14. #include <openssl/cmp.h>
  15. #include <openssl/crmf.h>
  16. #include <openssl/err.h>
  17. #include <openssl/x509.h>
  18. /*
  19. * This function is also used by the internal verify_PBMAC() in cmp_vfy.c.
  20. *
  21. * Calculate protection for given PKImessage according to
  22. * the algorithm and parameters in the message header's protectionAlg
  23. * using the credentials, library context, and property criteria in the ctx.
  24. *
  25. * returns ASN1_BIT_STRING representing the protection on success, else NULL
  26. */
  27. ASN1_BIT_STRING *ossl_cmp_calc_protection(const OSSL_CMP_CTX *ctx,
  28. const OSSL_CMP_MSG *msg)
  29. {
  30. ASN1_BIT_STRING *prot = NULL;
  31. OSSL_CMP_PROTECTEDPART prot_part;
  32. const ASN1_OBJECT *algorOID = NULL;
  33. const void *ppval = NULL;
  34. int pptype = 0;
  35. if (!ossl_assert(ctx != NULL && msg != NULL))
  36. return NULL;
  37. /* construct data to be signed */
  38. prot_part.header = msg->header;
  39. prot_part.body = msg->body;
  40. if (msg->header->protectionAlg == NULL) {
  41. ERR_raise(ERR_LIB_CMP, CMP_R_UNKNOWN_ALGORITHM_ID);
  42. return NULL;
  43. }
  44. X509_ALGOR_get0(&algorOID, &pptype, &ppval, msg->header->protectionAlg);
  45. if (OBJ_obj2nid(algorOID) == NID_id_PasswordBasedMAC) {
  46. int len;
  47. size_t prot_part_der_len;
  48. unsigned char *prot_part_der = NULL;
  49. size_t sig_len;
  50. unsigned char *protection = NULL;
  51. OSSL_CRMF_PBMPARAMETER *pbm = NULL;
  52. ASN1_STRING *pbm_str = NULL;
  53. const unsigned char *pbm_str_uc = NULL;
  54. if (ctx->secretValue == NULL) {
  55. ERR_raise(ERR_LIB_CMP, CMP_R_MISSING_PBM_SECRET);
  56. return NULL;
  57. }
  58. if (ppval == NULL) {
  59. ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CALCULATING_PROTECTION);
  60. return NULL;
  61. }
  62. len = i2d_OSSL_CMP_PROTECTEDPART(&prot_part, &prot_part_der);
  63. if (len < 0 || prot_part_der == NULL) {
  64. ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CALCULATING_PROTECTION);
  65. goto end;
  66. }
  67. prot_part_der_len = (size_t)len;
  68. pbm_str = (ASN1_STRING *)ppval;
  69. pbm_str_uc = pbm_str->data;
  70. pbm = d2i_OSSL_CRMF_PBMPARAMETER(NULL, &pbm_str_uc, pbm_str->length);
  71. if (pbm == NULL) {
  72. ERR_raise(ERR_LIB_CMP, CMP_R_WRONG_ALGORITHM_OID);
  73. goto end;
  74. }
  75. if (!OSSL_CRMF_pbm_new(ctx->libctx, ctx->propq,
  76. pbm, prot_part_der, prot_part_der_len,
  77. ctx->secretValue->data, ctx->secretValue->length,
  78. &protection, &sig_len))
  79. goto end;
  80. if ((prot = ASN1_BIT_STRING_new()) == NULL)
  81. return NULL;
  82. /* OpenSSL defaults all bit strings to be encoded as ASN.1 NamedBitList */
  83. prot->flags &= ~(ASN1_STRING_FLAG_BITS_LEFT | 0x07);
  84. prot->flags |= ASN1_STRING_FLAG_BITS_LEFT;
  85. if (!ASN1_BIT_STRING_set(prot, protection, sig_len)) {
  86. ASN1_BIT_STRING_free(prot);
  87. prot = NULL;
  88. }
  89. end:
  90. OSSL_CRMF_PBMPARAMETER_free(pbm);
  91. OPENSSL_free(protection);
  92. OPENSSL_free(prot_part_der);
  93. return prot;
  94. } else {
  95. int md_nid;
  96. const EVP_MD *md = NULL;
  97. if (ctx->pkey == NULL) {
  98. ERR_raise(ERR_LIB_CMP,
  99. CMP_R_MISSING_KEY_INPUT_FOR_CREATING_PROTECTION);
  100. return NULL;
  101. }
  102. if (!OBJ_find_sigid_algs(OBJ_obj2nid(algorOID), &md_nid, NULL)
  103. || (md = EVP_get_digestbynid(md_nid)) == NULL) {
  104. ERR_raise(ERR_LIB_CMP, CMP_R_UNKNOWN_ALGORITHM_ID);
  105. return NULL;
  106. }
  107. if ((prot = ASN1_BIT_STRING_new()) == NULL)
  108. return NULL;
  109. if (ASN1_item_sign_ex(ASN1_ITEM_rptr(OSSL_CMP_PROTECTEDPART), NULL,
  110. NULL, prot, &prot_part, NULL, ctx->pkey, md,
  111. ctx->libctx, ctx->propq))
  112. return prot;
  113. ASN1_BIT_STRING_free(prot);
  114. return NULL;
  115. }
  116. }
  117. int ossl_cmp_msg_add_extraCerts(OSSL_CMP_CTX *ctx, OSSL_CMP_MSG *msg)
  118. {
  119. if (!ossl_assert(ctx != NULL && msg != NULL))
  120. return 0;
  121. if (msg->extraCerts == NULL
  122. && (msg->extraCerts = sk_X509_new_null()) == NULL)
  123. return 0;
  124. /* Add first ctx->cert and its chain if using signature-based protection */
  125. if (!ctx->unprotectedSend && ctx->secretValue == NULL
  126. && ctx->cert != NULL && ctx->pkey != NULL) {
  127. int flags_prepend = X509_ADD_FLAG_UP_REF | X509_ADD_FLAG_NO_DUP
  128. | X509_ADD_FLAG_PREPEND | X509_ADD_FLAG_NO_SS;
  129. /* if not yet done try to build chain using available untrusted certs */
  130. if (ctx->chain == NULL) {
  131. ossl_cmp_debug(ctx,
  132. "trying to build chain for own CMP signer cert");
  133. ctx->chain =
  134. ossl_cmp_build_cert_chain(ctx->libctx, ctx->propq, NULL,
  135. ctx->untrusted, ctx->cert);
  136. if (ctx->chain != NULL) {
  137. ossl_cmp_debug(ctx,
  138. "success building chain for own CMP signer cert");
  139. } else {
  140. /* dump errors to avoid confusion when printing further ones */
  141. OSSL_CMP_CTX_print_errors(ctx);
  142. ossl_cmp_warn(ctx,
  143. "could not build chain for own CMP signer cert");
  144. }
  145. }
  146. if (ctx->chain != NULL) {
  147. if (!X509_add_certs(msg->extraCerts, ctx->chain, flags_prepend))
  148. return 0;
  149. } else {
  150. /* make sure that at least our own signer cert is included first */
  151. if (!X509_add_cert(msg->extraCerts, ctx->cert, flags_prepend))
  152. return 0;
  153. ossl_cmp_debug(ctx,
  154. "fallback: adding just own CMP signer cert");
  155. }
  156. }
  157. /* add any additional certificates from ctx->extraCertsOut */
  158. if (!X509_add_certs(msg->extraCerts, ctx->extraCertsOut,
  159. X509_ADD_FLAG_UP_REF | X509_ADD_FLAG_NO_DUP))
  160. return 0;
  161. /* in case extraCerts are empty list avoid empty ASN.1 sequence */
  162. if (sk_X509_num(msg->extraCerts) == 0) {
  163. sk_X509_free(msg->extraCerts);
  164. msg->extraCerts = NULL;
  165. }
  166. return 1;
  167. }
  168. /*
  169. * Create an X509_ALGOR structure for PasswordBasedMAC protection based on
  170. * the pbm settings in the context
  171. */
  172. static int set_pbmac_algor(const OSSL_CMP_CTX *ctx, X509_ALGOR **alg)
  173. {
  174. OSSL_CRMF_PBMPARAMETER *pbm = NULL;
  175. unsigned char *pbm_der = NULL;
  176. int pbm_der_len;
  177. ASN1_STRING *pbm_str = NULL;
  178. if (!ossl_assert(ctx != NULL))
  179. return 0;
  180. pbm = OSSL_CRMF_pbmp_new(ctx->libctx, ctx->pbm_slen,
  181. EVP_MD_type(ctx->pbm_owf), ctx->pbm_itercnt,
  182. ctx->pbm_mac);
  183. pbm_str = ASN1_STRING_new();
  184. if (pbm == NULL || pbm_str == NULL)
  185. goto err;
  186. if ((pbm_der_len = i2d_OSSL_CRMF_PBMPARAMETER(pbm, &pbm_der)) < 0)
  187. goto err;
  188. if (!ASN1_STRING_set(pbm_str, pbm_der, pbm_der_len))
  189. goto err;
  190. if (*alg == NULL && (*alg = X509_ALGOR_new()) == NULL)
  191. goto err;
  192. OPENSSL_free(pbm_der);
  193. X509_ALGOR_set0(*alg, OBJ_nid2obj(NID_id_PasswordBasedMAC),
  194. V_ASN1_SEQUENCE, pbm_str);
  195. OSSL_CRMF_PBMPARAMETER_free(pbm);
  196. return 1;
  197. err:
  198. ASN1_STRING_free(pbm_str);
  199. OPENSSL_free(pbm_der);
  200. OSSL_CRMF_PBMPARAMETER_free(pbm);
  201. return 0;
  202. }
  203. static int set_sig_algor(const OSSL_CMP_CTX *ctx, X509_ALGOR **alg)
  204. {
  205. int nid = 0;
  206. ASN1_OBJECT *algo = NULL;
  207. if (!OBJ_find_sigid_by_algs(&nid, EVP_MD_type(ctx->digest),
  208. EVP_PKEY_id(ctx->pkey))) {
  209. ERR_raise(ERR_LIB_CMP, CMP_R_UNSUPPORTED_KEY_TYPE);
  210. return 0;
  211. }
  212. if ((algo = OBJ_nid2obj(nid)) == NULL)
  213. return 0;
  214. if (*alg == NULL && (*alg = X509_ALGOR_new()) == NULL)
  215. return 0;
  216. if (X509_ALGOR_set0(*alg, algo, V_ASN1_UNDEF, NULL))
  217. return 1;
  218. ASN1_OBJECT_free(algo);
  219. return 0;
  220. }
  221. static int set_senderKID(const OSSL_CMP_CTX *ctx, OSSL_CMP_MSG *msg,
  222. const ASN1_OCTET_STRING *id)
  223. {
  224. if (id == NULL)
  225. id = ctx->referenceValue; /* standard for PBM, fallback for sig-based */
  226. return id == NULL || ossl_cmp_hdr_set1_senderKID(msg->header, id);
  227. }
  228. int ossl_cmp_msg_protect(OSSL_CMP_CTX *ctx, OSSL_CMP_MSG *msg)
  229. {
  230. if (!ossl_assert(ctx != NULL && msg != NULL))
  231. return 0;
  232. /*
  233. * For the case of re-protection remove pre-existing protection.
  234. * TODO: Consider also removing any pre-existing extraCerts.
  235. */
  236. X509_ALGOR_free(msg->header->protectionAlg);
  237. msg->header->protectionAlg = NULL;
  238. ASN1_BIT_STRING_free(msg->protection);
  239. msg->protection = NULL;
  240. if (ctx->unprotectedSend) {
  241. if (!set_senderKID(ctx, msg, NULL))
  242. goto err;
  243. } else if (ctx->secretValue != NULL) {
  244. /* use PasswordBasedMac according to 5.1.3.1 if secretValue is given */
  245. if (!set_pbmac_algor(ctx, &msg->header->protectionAlg))
  246. goto err;
  247. if (!set_senderKID(ctx, msg, NULL))
  248. goto err;
  249. /*
  250. * will add any additional certificates from ctx->extraCertsOut
  251. * while not needed to validate the protection certificate,
  252. * the option to do this might be handy for certain use cases
  253. */
  254. } else if (ctx->cert != NULL && ctx->pkey != NULL) {
  255. /* use MSG_SIG_ALG according to 5.1.3.3 if client cert and key given */
  256. /* make sure that key and certificate match */
  257. if (!X509_check_private_key(ctx->cert, ctx->pkey)) {
  258. ERR_raise(ERR_LIB_CMP, CMP_R_CERT_AND_KEY_DO_NOT_MATCH);
  259. goto err;
  260. }
  261. if (!set_sig_algor(ctx, &msg->header->protectionAlg))
  262. goto err;
  263. /* set senderKID to keyIdentifier of the cert according to 5.1.1 */
  264. if (!set_senderKID(ctx, msg, X509_get0_subject_key_id(ctx->cert)))
  265. goto err;
  266. /*
  267. * will add ctx->cert followed, if possible, by its chain built
  268. * from ctx->untrusted, and then ctx->extraCertsOut
  269. */
  270. } else {
  271. ERR_raise(ERR_LIB_CMP,
  272. CMP_R_MISSING_KEY_INPUT_FOR_CREATING_PROTECTION);
  273. goto err;
  274. }
  275. if (!ctx->unprotectedSend
  276. && ((msg->protection = ossl_cmp_calc_protection(ctx, msg)) == NULL))
  277. goto err;
  278. /*
  279. * For signature-based protection add ctx->cert followed by its chain.
  280. * Finally add any additional certificates from ctx->extraCertsOut;
  281. * even if not needed to validate the protection
  282. * the option to do this might be handy for certain use cases.
  283. */
  284. if (!ossl_cmp_msg_add_extraCerts(ctx, msg))
  285. goto err;
  286. /*
  287. * As required by RFC 4210 section 5.1.1., if the sender name is not known
  288. * to the client it set to NULL-DN. In this case for identification at least
  289. * the senderKID must be set, where we took the referenceValue as fallback.
  290. */
  291. if (!(ossl_cmp_general_name_is_NULL_DN(msg->header->sender)
  292. && msg->header->senderKID == NULL))
  293. return 1;
  294. ERR_raise(ERR_LIB_CMP, CMP_R_MISSING_SENDER_IDENTIFICATION);
  295. err:
  296. ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_PROTECTING_MESSAGE);
  297. return 0;
  298. }