A local copy of OpenSSL from GitHub
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

641 lines
21 KiB

  1. /*
  2. * Copyright 2007-2020 The OpenSSL Project Authors. All Rights Reserved.
  3. * Copyright Nokia 2007-2019
  4. * Copyright Siemens AG 2015-2019
  5. *
  6. * Licensed under the Apache License 2.0 (the "License"). You may not use
  7. * this file except in compliance with the License. You can obtain a copy
  8. * in the file LICENSE in the source distribution or at
  9. * https://www.openssl.org/source/license.html
  10. */
  11. /* general CMP server functions */
  12. #include <openssl/asn1t.h>
  13. #include "cmp_local.h"
  14. /* explicit #includes not strictly needed since implied by the above: */
  15. #include <openssl/cmp.h>
  16. #include <openssl/err.h>
  17. /* the context for the generic CMP server */
  18. struct ossl_cmp_srv_ctx_st
  19. {
  20. OSSL_CMP_CTX *ctx; /* Client CMP context, partly reused for srv */
  21. void *custom_ctx; /* pointer to specific server context */
  22. OSSL_CMP_SRV_cert_request_cb_t process_cert_request;
  23. OSSL_CMP_SRV_rr_cb_t process_rr;
  24. OSSL_CMP_SRV_genm_cb_t process_genm;
  25. OSSL_CMP_SRV_error_cb_t process_error;
  26. OSSL_CMP_SRV_certConf_cb_t process_certConf;
  27. OSSL_CMP_SRV_pollReq_cb_t process_pollReq;
  28. int sendUnprotectedErrors; /* Send error and rejection msgs unprotected */
  29. int acceptUnprotected; /* Accept requests with no/invalid prot. */
  30. int acceptRAVerified; /* Accept ir/cr/kur with POPO RAVerified */
  31. int grantImplicitConfirm; /* Grant implicit confirmation if requested */
  32. }; /* OSSL_CMP_SRV_CTX */
  33. void OSSL_CMP_SRV_CTX_free(OSSL_CMP_SRV_CTX *srv_ctx)
  34. {
  35. if (srv_ctx == NULL)
  36. return;
  37. OSSL_CMP_CTX_free(srv_ctx->ctx);
  38. OPENSSL_free(srv_ctx);
  39. }
  40. OSSL_CMP_SRV_CTX *OSSL_CMP_SRV_CTX_new(OSSL_LIB_CTX *libctx, const char *propq)
  41. {
  42. OSSL_CMP_SRV_CTX *ctx = OPENSSL_zalloc(sizeof(OSSL_CMP_SRV_CTX));
  43. if (ctx == NULL)
  44. goto err;
  45. if ((ctx->ctx = OSSL_CMP_CTX_new(libctx, propq)) == NULL)
  46. goto err;
  47. /* all other elements are initialized to 0 or NULL, respectively */
  48. return ctx;
  49. err:
  50. OSSL_CMP_SRV_CTX_free(ctx);
  51. return NULL;
  52. }
  53. int OSSL_CMP_SRV_CTX_init(OSSL_CMP_SRV_CTX *srv_ctx, void *custom_ctx,
  54. OSSL_CMP_SRV_cert_request_cb_t process_cert_request,
  55. OSSL_CMP_SRV_rr_cb_t process_rr,
  56. OSSL_CMP_SRV_genm_cb_t process_genm,
  57. OSSL_CMP_SRV_error_cb_t process_error,
  58. OSSL_CMP_SRV_certConf_cb_t process_certConf,
  59. OSSL_CMP_SRV_pollReq_cb_t process_pollReq)
  60. {
  61. if (srv_ctx == NULL) {
  62. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  63. return 0;
  64. }
  65. srv_ctx->custom_ctx = custom_ctx;
  66. srv_ctx->process_cert_request = process_cert_request;
  67. srv_ctx->process_rr = process_rr;
  68. srv_ctx->process_genm = process_genm;
  69. srv_ctx->process_error = process_error;
  70. srv_ctx->process_certConf = process_certConf;
  71. srv_ctx->process_pollReq = process_pollReq;
  72. return 1;
  73. }
  74. OSSL_CMP_CTX *OSSL_CMP_SRV_CTX_get0_cmp_ctx(const OSSL_CMP_SRV_CTX *srv_ctx)
  75. {
  76. if (srv_ctx == NULL) {
  77. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  78. return NULL;
  79. }
  80. return srv_ctx->ctx;
  81. }
  82. void *OSSL_CMP_SRV_CTX_get0_custom_ctx(const OSSL_CMP_SRV_CTX *srv_ctx)
  83. {
  84. if (srv_ctx == NULL) {
  85. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  86. return NULL;
  87. }
  88. return srv_ctx->custom_ctx;
  89. }
  90. int OSSL_CMP_SRV_CTX_set_send_unprotected_errors(OSSL_CMP_SRV_CTX *srv_ctx,
  91. int val)
  92. {
  93. if (srv_ctx == NULL) {
  94. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  95. return 0;
  96. }
  97. srv_ctx->sendUnprotectedErrors = val != 0;
  98. return 1;
  99. }
  100. int OSSL_CMP_SRV_CTX_set_accept_unprotected(OSSL_CMP_SRV_CTX *srv_ctx, int val)
  101. {
  102. if (srv_ctx == NULL) {
  103. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  104. return 0;
  105. }
  106. srv_ctx->acceptUnprotected = val != 0;
  107. return 1;
  108. }
  109. int OSSL_CMP_SRV_CTX_set_accept_raverified(OSSL_CMP_SRV_CTX *srv_ctx, int val)
  110. {
  111. if (srv_ctx == NULL) {
  112. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  113. return 0;
  114. }
  115. srv_ctx->acceptRAVerified = val != 0;
  116. return 1;
  117. }
  118. int OSSL_CMP_SRV_CTX_set_grant_implicit_confirm(OSSL_CMP_SRV_CTX *srv_ctx,
  119. int val)
  120. {
  121. if (srv_ctx == NULL) {
  122. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  123. return 0;
  124. }
  125. srv_ctx->grantImplicitConfirm = val != 0;
  126. return 1;
  127. }
  128. /*
  129. * Processes an ir/cr/p10cr/kur and returns a certification response.
  130. * Only handles the first certification request contained in req
  131. * returns an ip/cp/kup on success and NULL on error
  132. */
  133. static OSSL_CMP_MSG *process_cert_request(OSSL_CMP_SRV_CTX *srv_ctx,
  134. const OSSL_CMP_MSG *req)
  135. {
  136. OSSL_CMP_MSG *msg = NULL;
  137. OSSL_CMP_PKISI *si = NULL;
  138. X509 *certOut = NULL;
  139. STACK_OF(X509) *chainOut = NULL, *caPubs = NULL;
  140. const OSSL_CRMF_MSG *crm = NULL;
  141. const X509_REQ *p10cr = NULL;
  142. int bodytype;
  143. int certReqId;
  144. if (!ossl_assert(srv_ctx != NULL && srv_ctx->ctx != NULL && req != NULL))
  145. return NULL;
  146. switch (ossl_cmp_msg_get_bodytype(req)) {
  147. case OSSL_CMP_PKIBODY_P10CR:
  148. case OSSL_CMP_PKIBODY_CR:
  149. bodytype = OSSL_CMP_PKIBODY_CP;
  150. break;
  151. case OSSL_CMP_PKIBODY_IR:
  152. bodytype = OSSL_CMP_PKIBODY_IP;
  153. break;
  154. case OSSL_CMP_PKIBODY_KUR:
  155. bodytype = OSSL_CMP_PKIBODY_KUP;
  156. break;
  157. default:
  158. ERR_raise(ERR_LIB_CMP, CMP_R_UNEXPECTED_PKIBODY);
  159. return NULL;
  160. }
  161. if (ossl_cmp_msg_get_bodytype(req) == OSSL_CMP_PKIBODY_P10CR) {
  162. certReqId = OSSL_CMP_CERTREQID;
  163. p10cr = req->body->value.p10cr;
  164. } else {
  165. OSSL_CRMF_MSGS *reqs = req->body->value.ir; /* same for cr and kur */
  166. if (sk_OSSL_CRMF_MSG_num(reqs) != 1) { /* TODO: handle case > 1 */
  167. ERR_raise(ERR_LIB_CMP, CMP_R_MULTIPLE_REQUESTS_NOT_SUPPORTED);
  168. return NULL;
  169. }
  170. if ((crm = sk_OSSL_CRMF_MSG_value(reqs, OSSL_CMP_CERTREQID)) == NULL) {
  171. ERR_raise(ERR_LIB_CMP, CMP_R_CERTREQMSG_NOT_FOUND);
  172. return NULL;
  173. }
  174. certReqId = OSSL_CRMF_MSG_get_certReqId(crm);
  175. }
  176. if (!ossl_cmp_verify_popo(srv_ctx->ctx, req, srv_ctx->acceptRAVerified)) {
  177. /* Proof of possession could not be verified */
  178. si = OSSL_CMP_STATUSINFO_new(OSSL_CMP_PKISTATUS_rejection,
  179. 1 << OSSL_CMP_PKIFAILUREINFO_badPOP,
  180. ERR_reason_error_string(ERR_peek_error()));
  181. if (si == NULL)
  182. return NULL;
  183. } else {
  184. OSSL_CMP_PKIHEADER *hdr = OSSL_CMP_MSG_get0_header(req);
  185. si = srv_ctx->process_cert_request(srv_ctx, req, certReqId, crm, p10cr,
  186. &certOut, &chainOut, &caPubs);
  187. if (si == NULL)
  188. goto err;
  189. /* set OSSL_CMP_OPT_IMPLICIT_CONFIRM if and only if transaction ends */
  190. if (!OSSL_CMP_CTX_set_option(srv_ctx->ctx,
  191. OSSL_CMP_OPT_IMPLICIT_CONFIRM,
  192. ossl_cmp_hdr_has_implicitConfirm(hdr)
  193. && srv_ctx->grantImplicitConfirm
  194. /* do not set if polling starts: */
  195. && certOut != NULL))
  196. goto err;
  197. }
  198. msg = ossl_cmp_certrep_new(srv_ctx->ctx, bodytype, certReqId, si,
  199. certOut, chainOut, caPubs, 0 /* encrypted */,
  200. srv_ctx->sendUnprotectedErrors);
  201. /*
  202. * TODO when implemented in ossl_cmp_certrep_new():
  203. * in case OSSL_CRMF_POPO_KEYENC, set encrypted
  204. */
  205. if (msg == NULL)
  206. ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_CERTREP);
  207. err:
  208. OSSL_CMP_PKISI_free(si);
  209. X509_free(certOut);
  210. sk_X509_pop_free(chainOut, X509_free);
  211. sk_X509_pop_free(caPubs, X509_free);
  212. return msg;
  213. }
  214. static OSSL_CMP_MSG *process_rr(OSSL_CMP_SRV_CTX *srv_ctx,
  215. const OSSL_CMP_MSG *req)
  216. {
  217. OSSL_CMP_MSG *msg = NULL;
  218. OSSL_CMP_REVDETAILS *details;
  219. OSSL_CRMF_CERTID *certId = NULL;
  220. OSSL_CRMF_CERTTEMPLATE *tmpl;
  221. const X509_NAME *issuer;
  222. ASN1_INTEGER *serial;
  223. OSSL_CMP_PKISI *si;
  224. if (!ossl_assert(srv_ctx != NULL && srv_ctx->ctx != NULL && req != NULL))
  225. return NULL;
  226. if (sk_OSSL_CMP_REVDETAILS_num(req->body->value.rr) != 1) {
  227. /* TODO: handle multiple elements if multiple requests have been sent */
  228. ERR_raise(ERR_LIB_CMP, CMP_R_MULTIPLE_REQUESTS_NOT_SUPPORTED);
  229. return NULL;
  230. }
  231. if ((details = sk_OSSL_CMP_REVDETAILS_value(req->body->value.rr,
  232. OSSL_CMP_REVREQSID)) == NULL) {
  233. ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_PROCESSING_MESSAGE);
  234. return NULL;
  235. }
  236. tmpl = details->certDetails;
  237. issuer = OSSL_CRMF_CERTTEMPLATE_get0_issuer(tmpl);
  238. serial = OSSL_CRMF_CERTTEMPLATE_get0_serialNumber(tmpl);
  239. if (issuer != NULL && serial != NULL
  240. && (certId = OSSL_CRMF_CERTID_gen(issuer, serial)) == NULL)
  241. return NULL;
  242. if ((si = srv_ctx->process_rr(srv_ctx, req, issuer, serial)) == NULL)
  243. goto err;
  244. if ((msg = ossl_cmp_rp_new(srv_ctx->ctx, si, certId,
  245. srv_ctx->sendUnprotectedErrors)) == NULL)
  246. ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_RR);
  247. err:
  248. OSSL_CRMF_CERTID_free(certId);
  249. OSSL_CMP_PKISI_free(si);
  250. return msg;
  251. }
  252. /*
  253. * Processes genm and creates a genp message mirroring the contents of the
  254. * incoming message
  255. */
  256. static OSSL_CMP_MSG *process_genm(OSSL_CMP_SRV_CTX *srv_ctx,
  257. const OSSL_CMP_MSG *req)
  258. {
  259. OSSL_CMP_GENMSGCONTENT *itavs;
  260. OSSL_CMP_MSG *msg;
  261. if (!ossl_assert(srv_ctx != NULL && srv_ctx->ctx != NULL && req != NULL))
  262. return NULL;
  263. if (!srv_ctx->process_genm(srv_ctx, req, req->body->value.genm, &itavs))
  264. return NULL;
  265. msg = ossl_cmp_genp_new(srv_ctx->ctx, itavs);
  266. sk_OSSL_CMP_ITAV_pop_free(itavs, OSSL_CMP_ITAV_free);
  267. return msg;
  268. }
  269. static OSSL_CMP_MSG *process_error(OSSL_CMP_SRV_CTX *srv_ctx,
  270. const OSSL_CMP_MSG *req)
  271. {
  272. OSSL_CMP_ERRORMSGCONTENT *errorContent;
  273. OSSL_CMP_MSG *msg;
  274. if (!ossl_assert(srv_ctx != NULL && srv_ctx->ctx != NULL && req != NULL))
  275. return NULL;
  276. errorContent = req->body->value.error;
  277. srv_ctx->process_error(srv_ctx, req, errorContent->pKIStatusInfo,
  278. errorContent->errorCode, errorContent->errorDetails);
  279. if ((msg = ossl_cmp_pkiconf_new(srv_ctx->ctx)) == NULL)
  280. ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_PKICONF);
  281. return msg;
  282. }
  283. static OSSL_CMP_MSG *process_certConf(OSSL_CMP_SRV_CTX *srv_ctx,
  284. const OSSL_CMP_MSG *req)
  285. {
  286. OSSL_CMP_CTX *ctx;
  287. OSSL_CMP_CERTCONFIRMCONTENT *ccc;
  288. int num;
  289. OSSL_CMP_MSG *msg = NULL;
  290. OSSL_CMP_CERTSTATUS *status = NULL;
  291. if (!ossl_assert(srv_ctx != NULL && srv_ctx->ctx != NULL && req != NULL))
  292. return NULL;
  293. ctx = srv_ctx->ctx;
  294. ccc = req->body->value.certConf;
  295. num = sk_OSSL_CMP_CERTSTATUS_num(ccc);
  296. if (OSSL_CMP_CTX_get_option(ctx, OSSL_CMP_OPT_IMPLICIT_CONFIRM) == 1) {
  297. ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_UNEXPECTED_CERTCONF);
  298. return NULL;
  299. }
  300. if (num == 0) {
  301. ossl_cmp_err(ctx, "certificate rejected by client");
  302. } else {
  303. if (num > 1)
  304. ossl_cmp_warn(ctx, "All CertStatus but the first will be ignored");
  305. status = sk_OSSL_CMP_CERTSTATUS_value(ccc, OSSL_CMP_CERTREQID);
  306. }
  307. if (status != NULL) {
  308. int certReqId = ossl_cmp_asn1_get_int(status->certReqId);
  309. ASN1_OCTET_STRING *certHash = status->certHash;
  310. OSSL_CMP_PKISI *si = status->statusInfo;
  311. if (!srv_ctx->process_certConf(srv_ctx, req, certReqId, certHash, si))
  312. return NULL; /* reason code may be: CMP_R_CERTHASH_UNMATCHED */
  313. if (si != NULL && ossl_cmp_pkisi_get_status(si)
  314. != OSSL_CMP_PKISTATUS_accepted) {
  315. int pki_status = ossl_cmp_pkisi_get_status(si);
  316. const char *str = ossl_cmp_PKIStatus_to_string(pki_status);
  317. ossl_cmp_log2(INFO, ctx, "certificate rejected by client %s %s",
  318. str == NULL ? "without" : "with",
  319. str == NULL ? "PKIStatus" : str);
  320. }
  321. }
  322. if ((msg = ossl_cmp_pkiconf_new(ctx)) == NULL)
  323. ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_PKICONF);
  324. return msg;
  325. }
  326. static OSSL_CMP_MSG *process_pollReq(OSSL_CMP_SRV_CTX *srv_ctx,
  327. const OSSL_CMP_MSG *req)
  328. {
  329. OSSL_CMP_POLLREQCONTENT *prc;
  330. OSSL_CMP_POLLREQ *pr;
  331. int certReqId;
  332. OSSL_CMP_MSG *certReq;
  333. int64_t check_after = 0;
  334. OSSL_CMP_MSG *msg = NULL;
  335. if (!ossl_assert(srv_ctx != NULL && srv_ctx->ctx != NULL && req != NULL))
  336. return NULL;
  337. prc = req->body->value.pollReq;
  338. if (sk_OSSL_CMP_POLLREQ_num(prc) != 1) { /* TODO: handle case > 1 */
  339. ERR_raise(ERR_LIB_CMP, CMP_R_MULTIPLE_REQUESTS_NOT_SUPPORTED);
  340. return NULL;
  341. }
  342. pr = sk_OSSL_CMP_POLLREQ_value(prc, 0);
  343. certReqId = ossl_cmp_asn1_get_int(pr->certReqId);
  344. if (!srv_ctx->process_pollReq(srv_ctx, req, certReqId,
  345. &certReq, &check_after))
  346. return NULL;
  347. if (certReq != NULL) {
  348. msg = process_cert_request(srv_ctx, certReq);
  349. OSSL_CMP_MSG_free(certReq);
  350. } else {
  351. if ((msg = ossl_cmp_pollRep_new(srv_ctx->ctx, certReqId,
  352. check_after)) == NULL)
  353. ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CREATING_POLLREP);
  354. }
  355. return msg;
  356. }
  357. /*
  358. * Determine whether missing/invalid protection of request message is allowed.
  359. * Return 1 on acceptance, 0 on rejection, or -1 on (internal) error.
  360. */
  361. static int unprotected_exception(const OSSL_CMP_CTX *ctx,
  362. const OSSL_CMP_MSG *req,
  363. int invalid_protection,
  364. int accept_unprotected_requests)
  365. {
  366. if (!ossl_assert(ctx != NULL && req != NULL))
  367. return -1;
  368. if (accept_unprotected_requests) {
  369. ossl_cmp_log1(WARN, ctx, "ignoring %s protection of request message",
  370. invalid_protection ? "invalid" : "missing");
  371. return 1;
  372. }
  373. if (ossl_cmp_msg_get_bodytype(req) == OSSL_CMP_PKIBODY_ERROR
  374. && OSSL_CMP_CTX_get_option(ctx, OSSL_CMP_OPT_UNPROTECTED_ERRORS) == 1) {
  375. ossl_cmp_warn(ctx, "ignoring missing protection of error message");
  376. return 1;
  377. }
  378. return 0;
  379. }
  380. /*
  381. * returns created message and NULL on internal error
  382. */
  383. OSSL_CMP_MSG *OSSL_CMP_SRV_process_request(OSSL_CMP_SRV_CTX *srv_ctx,
  384. const OSSL_CMP_MSG *req)
  385. {
  386. OSSL_CMP_CTX *ctx;
  387. ASN1_OCTET_STRING *backup_secret;
  388. OSSL_CMP_PKIHEADER *hdr;
  389. int req_type, rsp_type;
  390. int res;
  391. OSSL_CMP_MSG *rsp = NULL;
  392. if (srv_ctx == NULL || srv_ctx->ctx == NULL
  393. || req == NULL || req->body == NULL
  394. || (hdr = OSSL_CMP_MSG_get0_header(req)) == NULL) {
  395. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  396. return 0;
  397. }
  398. ctx = srv_ctx->ctx;
  399. backup_secret = ctx->secretValue;
  400. /*
  401. * Some things need to be done already before validating the message in
  402. * order to be able to send an error message as far as needed and possible.
  403. */
  404. if (hdr->sender->type != GEN_DIRNAME) {
  405. ERR_raise(ERR_LIB_CMP, CMP_R_SENDER_GENERALNAME_TYPE_NOT_SUPPORTED);
  406. goto err;
  407. }
  408. if (!OSSL_CMP_CTX_set1_recipient(ctx, hdr->sender->d.directoryName))
  409. goto err;
  410. req_type = ossl_cmp_msg_get_bodytype(req);
  411. switch (req_type) {
  412. case OSSL_CMP_PKIBODY_IR:
  413. case OSSL_CMP_PKIBODY_CR:
  414. case OSSL_CMP_PKIBODY_P10CR:
  415. case OSSL_CMP_PKIBODY_KUR:
  416. case OSSL_CMP_PKIBODY_RR:
  417. case OSSL_CMP_PKIBODY_GENM:
  418. case OSSL_CMP_PKIBODY_ERROR:
  419. if (ctx->transactionID != NULL) {
  420. char *tid;
  421. tid = OPENSSL_buf2hexstr(ctx->transactionID->data,
  422. ctx->transactionID->length);
  423. if (tid != NULL)
  424. ossl_cmp_log1(WARN, ctx,
  425. "Assuming that last transaction with ID=%s got aborted",
  426. tid);
  427. OPENSSL_free(tid);
  428. }
  429. /* start of a new transaction, reset transactionID and senderNonce */
  430. if (!OSSL_CMP_CTX_set1_transactionID(ctx, NULL)
  431. || !OSSL_CMP_CTX_set1_senderNonce(ctx, NULL))
  432. goto err;
  433. break;
  434. default:
  435. /* transactionID should be already initialized */
  436. if (ctx->transactionID == NULL) {
  437. #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
  438. ERR_raise(ERR_LIB_CMP, CMP_R_UNEXPECTED_PKIBODY);
  439. goto err;
  440. #endif
  441. }
  442. }
  443. res = ossl_cmp_msg_check_update(ctx, req, unprotected_exception,
  444. srv_ctx->acceptUnprotected);
  445. if (ctx->secretValue != NULL && ctx->pkey != NULL
  446. && ossl_cmp_hdr_get_protection_nid(hdr) != NID_id_PasswordBasedMAC)
  447. ctx->secretValue = NULL; /* use MSG_SIG_ALG when protecting rsp */
  448. if (!res)
  449. goto err;
  450. switch (req_type) {
  451. case OSSL_CMP_PKIBODY_IR:
  452. case OSSL_CMP_PKIBODY_CR:
  453. case OSSL_CMP_PKIBODY_P10CR:
  454. case OSSL_CMP_PKIBODY_KUR:
  455. if (srv_ctx->process_cert_request == NULL)
  456. ERR_raise(ERR_LIB_CMP, CMP_R_UNEXPECTED_PKIBODY);
  457. else
  458. rsp = process_cert_request(srv_ctx, req);
  459. break;
  460. case OSSL_CMP_PKIBODY_RR:
  461. if (srv_ctx->process_rr == NULL)
  462. ERR_raise(ERR_LIB_CMP, CMP_R_UNEXPECTED_PKIBODY);
  463. else
  464. rsp = process_rr(srv_ctx, req);
  465. break;
  466. case OSSL_CMP_PKIBODY_GENM:
  467. if (srv_ctx->process_genm == NULL)
  468. ERR_raise(ERR_LIB_CMP, CMP_R_UNEXPECTED_PKIBODY);
  469. else
  470. rsp = process_genm(srv_ctx, req);
  471. break;
  472. case OSSL_CMP_PKIBODY_ERROR:
  473. if (srv_ctx->process_error == NULL)
  474. ERR_raise(ERR_LIB_CMP, CMP_R_UNEXPECTED_PKIBODY);
  475. else
  476. rsp = process_error(srv_ctx, req);
  477. break;
  478. case OSSL_CMP_PKIBODY_CERTCONF:
  479. if (srv_ctx->process_certConf == NULL)
  480. ERR_raise(ERR_LIB_CMP, CMP_R_UNEXPECTED_PKIBODY);
  481. else
  482. rsp = process_certConf(srv_ctx, req);
  483. break;
  484. case OSSL_CMP_PKIBODY_POLLREQ:
  485. if (srv_ctx->process_pollReq == NULL)
  486. ERR_raise(ERR_LIB_CMP, CMP_R_UNEXPECTED_PKIBODY);
  487. else
  488. rsp = process_pollReq(srv_ctx, req);
  489. break;
  490. default:
  491. /* TODO possibly support further request message types */
  492. ERR_raise(ERR_LIB_CMP, CMP_R_UNEXPECTED_PKIBODY);
  493. break;
  494. }
  495. err:
  496. if (rsp == NULL) {
  497. /* on error, try to respond with CMP error message to client */
  498. const char *data = NULL;
  499. int flags = 0;
  500. unsigned long err = ERR_peek_error_data(&data, &flags);
  501. int fail_info = 1 << OSSL_CMP_PKIFAILUREINFO_badRequest;
  502. /* TODO fail_info could be more specific */
  503. OSSL_CMP_PKISI *si = NULL;
  504. if (ctx->transactionID == NULL) {
  505. /* ignore any (extra) error in next two function calls: */
  506. (void)OSSL_CMP_CTX_set1_transactionID(ctx, hdr->transactionID);
  507. (void)ossl_cmp_ctx_set1_recipNonce(ctx, hdr->senderNonce);
  508. }
  509. if ((si = OSSL_CMP_STATUSINFO_new(OSSL_CMP_PKISTATUS_rejection,
  510. fail_info, NULL)) != NULL) {
  511. if (err != 0 && (flags & ERR_TXT_STRING) != 0)
  512. data = ERR_reason_error_string(err);
  513. rsp = ossl_cmp_error_new(srv_ctx->ctx, si,
  514. err != 0 ? ERR_GET_REASON(err) : -1,
  515. data, srv_ctx->sendUnprotectedErrors);
  516. OSSL_CMP_PKISI_free(si);
  517. }
  518. }
  519. ctx->secretValue = backup_secret;
  520. /* possibly close the transaction */
  521. rsp_type =
  522. rsp != NULL ? ossl_cmp_msg_get_bodytype(rsp) : OSSL_CMP_PKIBODY_ERROR;
  523. switch (rsp_type) {
  524. case OSSL_CMP_PKIBODY_IP:
  525. case OSSL_CMP_PKIBODY_CP:
  526. case OSSL_CMP_PKIBODY_KUP:
  527. case OSSL_CMP_PKIBODY_RP:
  528. if (OSSL_CMP_CTX_get_option(ctx, OSSL_CMP_OPT_IMPLICIT_CONFIRM) == 0)
  529. break;
  530. /* fall through */
  531. case OSSL_CMP_PKIBODY_PKICONF:
  532. case OSSL_CMP_PKIBODY_GENP:
  533. case OSSL_CMP_PKIBODY_ERROR:
  534. /* TODO possibly support further terminating response message types */
  535. /* prepare for next transaction, ignoring any errors here: */
  536. (void)OSSL_CMP_CTX_set1_transactionID(ctx, NULL);
  537. (void)OSSL_CMP_CTX_set1_senderNonce(ctx, NULL);
  538. default: /* not closing transaction in other cases */
  539. break;
  540. }
  541. return rsp;
  542. }
  543. /*
  544. * Server interface that may substitute OSSL_CMP_MSG_http_perform at the client.
  545. * The OSSL_CMP_SRV_CTX must be set as client_ctx->transfer_cb_arg.
  546. * returns received message on success, else NULL and pushes an element on the
  547. * error stack.
  548. */
  549. OSSL_CMP_MSG * OSSL_CMP_CTX_server_perform(OSSL_CMP_CTX *client_ctx,
  550. const OSSL_CMP_MSG *req)
  551. {
  552. OSSL_CMP_SRV_CTX *srv_ctx = NULL;
  553. if (client_ctx == NULL || req == NULL) {
  554. ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
  555. return 0;
  556. }
  557. if ((srv_ctx = OSSL_CMP_CTX_get_transfer_cb_arg(client_ctx)) == NULL) {
  558. ERR_raise(ERR_LIB_CMP, CMP_R_TRANSFER_ERROR);
  559. return 0;
  560. }
  561. return OSSL_CMP_SRV_process_request(srv_ctx, req);
  562. }