1 /* 2 * Copyright 2007-2023 The OpenSSL Project Authors. All Rights Reserved. 3 * Copyright Nokia 2007-2019 4 * Copyright Siemens AG 2015-2019 5 * 6 * Licensed under the Apache License 2.0 (the "License"). You may not use 7 * this file except in compliance with the License. You can obtain a copy 8 * in the file LICENSE in the source distribution or at 9 * https://www.openssl.org/source/license.html 10 */ 11 12 #include "cmp_local.h" 13 14 /* explicit #includes not strictly needed since implied by the above: */ 15 #include <openssl/asn1t.h> 16 #include <openssl/cmp.h> 17 #include <openssl/crmf.h> 18 #include <openssl/err.h> 19 #include <openssl/x509.h> 20 21 /* 22 * This function is also used by the internal verify_PBMAC() in cmp_vfy.c. 23 * 24 * Calculate protection for given PKImessage according to 25 * the algorithm and parameters in the message header's protectionAlg 26 * using the credentials, library context, and property criteria in the ctx. 27 * 28 * returns ASN1_BIT_STRING representing the protection on success, else NULL 29 */ 30 ASN1_BIT_STRING *ossl_cmp_calc_protection(const OSSL_CMP_CTX *ctx, 31 const OSSL_CMP_MSG *msg) 32 { 33 ASN1_BIT_STRING *prot = NULL; 34 OSSL_CMP_PROTECTEDPART prot_part; 35 const ASN1_OBJECT *algorOID = NULL; 36 const void *ppval = NULL; 37 int pptype = 0; 38 39 if (!ossl_assert(ctx != NULL && msg != NULL)) 40 return NULL; 41 42 /* construct data to be signed */ 43 prot_part.header = msg->header; 44 prot_part.body = msg->body; 45 46 if (msg->header->protectionAlg == NULL) { 47 ERR_raise(ERR_LIB_CMP, CMP_R_UNKNOWN_ALGORITHM_ID); 48 return NULL; 49 } 50 X509_ALGOR_get0(&algorOID, &pptype, &ppval, msg->header->protectionAlg); 51 52 if (OBJ_obj2nid(algorOID) == NID_id_PasswordBasedMAC) { 53 int len; 54 size_t prot_part_der_len; 55 unsigned char *prot_part_der = NULL; 56 size_t sig_len; 57 unsigned char *protection = NULL; 58 OSSL_CRMF_PBMPARAMETER *pbm = NULL; 59 ASN1_STRING *pbm_str = NULL; 60 const unsigned char *pbm_str_uc = NULL; 61 62 if (ctx->secretValue == NULL) { 63 ERR_raise(ERR_LIB_CMP, CMP_R_MISSING_PBM_SECRET); 64 return NULL; 65 } 66 if (ppval == NULL) { 67 ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CALCULATING_PROTECTION); 68 return NULL; 69 } 70 71 len = i2d_OSSL_CMP_PROTECTEDPART(&prot_part, &prot_part_der); 72 if (len < 0 || prot_part_der == NULL) { 73 ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CALCULATING_PROTECTION); 74 goto end; 75 } 76 prot_part_der_len = (size_t)len; 77 78 pbm_str = (ASN1_STRING *)ppval; 79 pbm_str_uc = pbm_str->data; 80 pbm = d2i_OSSL_CRMF_PBMPARAMETER(NULL, &pbm_str_uc, pbm_str->length); 81 if (pbm == NULL) { 82 ERR_raise(ERR_LIB_CMP, CMP_R_WRONG_ALGORITHM_OID); 83 goto end; 84 } 85 86 if (!OSSL_CRMF_pbm_new(ctx->libctx, ctx->propq, 87 pbm, prot_part_der, prot_part_der_len, 88 ctx->secretValue->data, ctx->secretValue->length, 89 &protection, &sig_len)) 90 goto end; 91 92 if ((prot = ASN1_BIT_STRING_new()) == NULL) 93 goto end; 94 /* OpenSSL defaults all bit strings to be encoded as ASN.1 NamedBitList */ 95 prot->flags &= ~(ASN1_STRING_FLAG_BITS_LEFT | 0x07); 96 prot->flags |= ASN1_STRING_FLAG_BITS_LEFT; 97 if (!ASN1_BIT_STRING_set(prot, protection, sig_len)) { 98 ASN1_BIT_STRING_free(prot); 99 prot = NULL; 100 } 101 end: 102 OSSL_CRMF_PBMPARAMETER_free(pbm); 103 OPENSSL_free(protection); 104 OPENSSL_free(prot_part_der); 105 return prot; 106 } else { 107 int md_nid; 108 const EVP_MD *md = NULL; 109 110 if (ctx->pkey == NULL) { 111 ERR_raise(ERR_LIB_CMP, 112 CMP_R_MISSING_KEY_INPUT_FOR_CREATING_PROTECTION); 113 return NULL; 114 } 115 if (!OBJ_find_sigid_algs(OBJ_obj2nid(algorOID), &md_nid, NULL) 116 || (md = EVP_get_digestbynid(md_nid)) == NULL) { 117 ERR_raise(ERR_LIB_CMP, CMP_R_UNKNOWN_ALGORITHM_ID); 118 return NULL; 119 } 120 121 if ((prot = ASN1_BIT_STRING_new()) == NULL) 122 return NULL; 123 if (ASN1_item_sign_ex(ASN1_ITEM_rptr(OSSL_CMP_PROTECTEDPART), NULL, 124 NULL, prot, &prot_part, NULL, ctx->pkey, md, 125 ctx->libctx, ctx->propq)) 126 return prot; 127 ASN1_BIT_STRING_free(prot); 128 return NULL; 129 } 130 } 131 132 /* ctx is not const just because ctx->chain may get adapted */ 133 int ossl_cmp_msg_add_extraCerts(OSSL_CMP_CTX *ctx, OSSL_CMP_MSG *msg) 134 { 135 if (!ossl_assert(ctx != NULL && msg != NULL)) 136 return 0; 137 138 /* Add first ctx->cert and its chain if using signature-based protection */ 139 if (!ctx->unprotectedSend && ctx->secretValue == NULL 140 && ctx->cert != NULL && ctx->pkey != NULL) { 141 int prepend = X509_ADD_FLAG_UP_REF | X509_ADD_FLAG_NO_DUP 142 | X509_ADD_FLAG_PREPEND | X509_ADD_FLAG_NO_SS; 143 144 /* if not yet done try to build chain using available untrusted certs */ 145 if (ctx->chain == NULL) { 146 ossl_cmp_debug(ctx, 147 "trying to build chain for own CMP signer cert"); 148 ctx->chain = X509_build_chain(ctx->cert, ctx->untrusted, NULL, 0, 149 ctx->libctx, ctx->propq); 150 if (ctx->chain != NULL) { 151 ossl_cmp_debug(ctx, 152 "success building chain for own CMP signer cert"); 153 } else { 154 /* dump errors to avoid confusion when printing further ones */ 155 OSSL_CMP_CTX_print_errors(ctx); 156 ossl_cmp_warn(ctx, 157 "could not build chain for own CMP signer cert"); 158 } 159 } 160 if (ctx->chain != NULL) { 161 if (!ossl_x509_add_certs_new(&msg->extraCerts, ctx->chain, prepend)) 162 return 0; 163 } else { 164 /* make sure that at least our own signer cert is included first */ 165 if (!ossl_x509_add_cert_new(&msg->extraCerts, ctx->cert, prepend)) 166 return 0; 167 ossl_cmp_debug(ctx, "fallback: adding just own CMP signer cert"); 168 } 169 } 170 171 /* add any additional certificates from ctx->extraCertsOut */ 172 if (!ossl_x509_add_certs_new(&msg->extraCerts, ctx->extraCertsOut, 173 X509_ADD_FLAG_UP_REF | X509_ADD_FLAG_NO_DUP)) 174 return 0; 175 176 /* in case extraCerts are empty list avoid empty ASN.1 sequence */ 177 if (sk_X509_num(msg->extraCerts) == 0) { 178 sk_X509_free(msg->extraCerts); 179 msg->extraCerts = NULL; 180 } 181 return 1; 182 } 183 184 /* 185 * Create an X509_ALGOR structure for PasswordBasedMAC protection based on 186 * the pbm settings in the context 187 */ 188 static int set_pbmac_algor(const OSSL_CMP_CTX *ctx, X509_ALGOR **alg) 189 { 190 OSSL_CRMF_PBMPARAMETER *pbm = NULL; 191 unsigned char *pbm_der = NULL; 192 int pbm_der_len; 193 ASN1_STRING *pbm_str = NULL; 194 195 if (!ossl_assert(ctx != NULL)) 196 return 0; 197 198 pbm = OSSL_CRMF_pbmp_new(ctx->libctx, ctx->pbm_slen, 199 EVP_MD_get_type(ctx->pbm_owf), ctx->pbm_itercnt, 200 ctx->pbm_mac); 201 pbm_str = ASN1_STRING_new(); 202 if (pbm == NULL || pbm_str == NULL) 203 goto err; 204 205 if ((pbm_der_len = i2d_OSSL_CRMF_PBMPARAMETER(pbm, &pbm_der)) < 0) 206 goto err; 207 208 if (!ASN1_STRING_set(pbm_str, pbm_der, pbm_der_len)) 209 goto err; 210 if (*alg == NULL && (*alg = X509_ALGOR_new()) == NULL) 211 goto err; 212 OPENSSL_free(pbm_der); 213 214 X509_ALGOR_set0(*alg, OBJ_nid2obj(NID_id_PasswordBasedMAC), 215 V_ASN1_SEQUENCE, pbm_str); 216 OSSL_CRMF_PBMPARAMETER_free(pbm); 217 return 1; 218 219 err: 220 ASN1_STRING_free(pbm_str); 221 OPENSSL_free(pbm_der); 222 OSSL_CRMF_PBMPARAMETER_free(pbm); 223 return 0; 224 } 225 226 static int set_sig_algor(const OSSL_CMP_CTX *ctx, X509_ALGOR **alg) 227 { 228 int nid = 0; 229 ASN1_OBJECT *algo = NULL; 230 231 if (!OBJ_find_sigid_by_algs(&nid, EVP_MD_get_type(ctx->digest), 232 EVP_PKEY_get_id(ctx->pkey))) { 233 ERR_raise(ERR_LIB_CMP, CMP_R_UNSUPPORTED_KEY_TYPE); 234 return 0; 235 } 236 if ((algo = OBJ_nid2obj(nid)) == NULL) 237 return 0; 238 if (*alg == NULL && (*alg = X509_ALGOR_new()) == NULL) 239 return 0; 240 241 if (X509_ALGOR_set0(*alg, algo, V_ASN1_UNDEF, NULL)) 242 return 1; 243 ASN1_OBJECT_free(algo); 244 return 0; 245 } 246 247 static int set_senderKID(const OSSL_CMP_CTX *ctx, OSSL_CMP_MSG *msg, 248 const ASN1_OCTET_STRING *id) 249 { 250 if (id == NULL) 251 id = ctx->referenceValue; /* standard for PBM, fallback for sig-based */ 252 return id == NULL || ossl_cmp_hdr_set1_senderKID(msg->header, id); 253 } 254 255 /* ctx is not const just because ctx->chain may get adapted */ 256 int ossl_cmp_msg_protect(OSSL_CMP_CTX *ctx, OSSL_CMP_MSG *msg) 257 { 258 if (!ossl_assert(ctx != NULL && msg != NULL)) 259 return 0; 260 261 /* 262 * For the case of re-protection remove pre-existing protection. 263 */ 264 X509_ALGOR_free(msg->header->protectionAlg); 265 msg->header->protectionAlg = NULL; 266 ASN1_BIT_STRING_free(msg->protection); 267 msg->protection = NULL; 268 269 if (ctx->unprotectedSend) { 270 if (!set_senderKID(ctx, msg, NULL)) 271 goto err; 272 } else if (ctx->secretValue != NULL) { 273 /* use PasswordBasedMac according to 5.1.3.1 if secretValue is given */ 274 if (!set_pbmac_algor(ctx, &msg->header->protectionAlg)) 275 goto err; 276 if (!set_senderKID(ctx, msg, NULL)) 277 goto err; 278 279 /* 280 * will add any additional certificates from ctx->extraCertsOut 281 * while not needed to validate the protection certificate, 282 * the option to do this might be handy for certain use cases 283 */ 284 } else if (ctx->cert != NULL && ctx->pkey != NULL) { 285 /* use MSG_SIG_ALG according to 5.1.3.3 if client cert and key given */ 286 287 /* make sure that key and certificate match */ 288 if (!X509_check_private_key(ctx->cert, ctx->pkey)) { 289 ERR_raise(ERR_LIB_CMP, CMP_R_CERT_AND_KEY_DO_NOT_MATCH); 290 goto err; 291 } 292 293 if (!set_sig_algor(ctx, &msg->header->protectionAlg)) 294 goto err; 295 /* set senderKID to keyIdentifier of the cert according to 5.1.1 */ 296 if (!set_senderKID(ctx, msg, X509_get0_subject_key_id(ctx->cert))) 297 goto err; 298 299 /* 300 * will add ctx->cert followed, if possible, by its chain built 301 * from ctx->untrusted, and then ctx->extraCertsOut 302 */ 303 } else { 304 ERR_raise(ERR_LIB_CMP, 305 CMP_R_MISSING_KEY_INPUT_FOR_CREATING_PROTECTION); 306 goto err; 307 } 308 if (!ctx->unprotectedSend 309 && ((msg->protection = ossl_cmp_calc_protection(ctx, msg)) == NULL)) 310 goto err; 311 312 /* 313 * For signature-based protection add ctx->cert followed by its chain. 314 * Finally add any additional certificates from ctx->extraCertsOut; 315 * even if not needed to validate the protection 316 * the option to do this might be handy for certain use cases. 317 */ 318 if (!ossl_cmp_msg_add_extraCerts(ctx, msg)) 319 goto err; 320 321 /* 322 * As required by RFC 4210 section 5.1.1., if the sender name is not known 323 * to the client it set to NULL-DN. In this case for identification at least 324 * the senderKID must be set, where we took the referenceValue as fallback. 325 */ 326 if (!(ossl_cmp_general_name_is_NULL_DN(msg->header->sender) 327 && msg->header->senderKID == NULL)) 328 return 1; 329 ERR_raise(ERR_LIB_CMP, CMP_R_MISSING_SENDER_IDENTIFICATION); 330 331 err: 332 ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_PROTECTING_MESSAGE); 333 return 0; 334 } 335