1 /*
2 * Copyright 2007-2022 The OpenSSL Project Authors. All Rights Reserved.
3 * Copyright Nokia 2007-2019
4 * Copyright Siemens AG 2015-2019
5 *
6 * Licensed under the Apache License 2.0 (the "License"). You may not use
7 * this file except in compliance with the License. You can obtain a copy
8 * in the file LICENSE in the source distribution or at
9 * https://www.openssl.org/source/license.html
10 */
11
12 #include "cmp_local.h"
13 #include "crypto/asn1.h"
14
15 /* explicit #includes not strictly needed since implied by the above: */
16 #include <openssl/asn1t.h>
17 #include <openssl/cmp.h>
18 #include <openssl/crmf.h>
19 #include <openssl/err.h>
20 #include <openssl/x509.h>
21
22 /*
23 * This function is also used by the internal verify_PBMAC() in cmp_vfy.c.
24 *
25 * Calculate protection for given PKImessage according to
26 * the algorithm and parameters in the message header's protectionAlg
27 * using the credentials, library context, and property criteria in the ctx.
28 *
29 * returns ASN1_BIT_STRING representing the protection on success, else NULL
30 */
ossl_cmp_calc_protection(const OSSL_CMP_CTX * ctx,const OSSL_CMP_MSG * msg)31 ASN1_BIT_STRING *ossl_cmp_calc_protection(const OSSL_CMP_CTX *ctx,
32 const OSSL_CMP_MSG *msg)
33 {
34 ASN1_BIT_STRING *prot = NULL;
35 OSSL_CMP_PROTECTEDPART prot_part;
36 const ASN1_OBJECT *algorOID = NULL;
37 const void *ppval = NULL;
38 int pptype = 0;
39
40 if (!ossl_assert(ctx != NULL && msg != NULL))
41 return NULL;
42
43 /* construct data to be signed */
44 prot_part.header = msg->header;
45 prot_part.body = msg->body;
46
47 if (msg->header->protectionAlg == NULL) {
48 ERR_raise(ERR_LIB_CMP, CMP_R_UNKNOWN_ALGORITHM_ID);
49 return NULL;
50 }
51 X509_ALGOR_get0(&algorOID, &pptype, &ppval, msg->header->protectionAlg);
52
53 if (OBJ_obj2nid(algorOID) == NID_id_PasswordBasedMAC) {
54 int len;
55 size_t prot_part_der_len;
56 unsigned char *prot_part_der = NULL;
57 size_t sig_len;
58 unsigned char *protection = NULL;
59 OSSL_CRMF_PBMPARAMETER *pbm = NULL;
60 ASN1_STRING *pbm_str = NULL;
61 const unsigned char *pbm_str_uc = NULL;
62
63 if (ctx->secretValue == NULL) {
64 ERR_raise(ERR_LIB_CMP, CMP_R_MISSING_PBM_SECRET);
65 return NULL;
66 }
67 if (ppval == NULL) {
68 ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CALCULATING_PROTECTION);
69 return NULL;
70 }
71
72 len = i2d_OSSL_CMP_PROTECTEDPART(&prot_part, &prot_part_der);
73 if (len < 0 || prot_part_der == NULL) {
74 ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CALCULATING_PROTECTION);
75 goto end;
76 }
77 prot_part_der_len = (size_t)len;
78
79 pbm_str = (ASN1_STRING *)ppval;
80 pbm_str_uc = pbm_str->data;
81 pbm = d2i_OSSL_CRMF_PBMPARAMETER(NULL, &pbm_str_uc, pbm_str->length);
82 if (pbm == NULL) {
83 ERR_raise(ERR_LIB_CMP, CMP_R_WRONG_ALGORITHM_OID);
84 goto end;
85 }
86
87 if (!OSSL_CRMF_pbm_new(ctx->libctx, ctx->propq,
88 pbm, prot_part_der, prot_part_der_len,
89 ctx->secretValue->data, ctx->secretValue->length,
90 &protection, &sig_len))
91 goto end;
92
93 if ((prot = ASN1_BIT_STRING_new()) == NULL)
94 goto end;
95 /* OpenSSL defaults all bit strings to be encoded as ASN.1 NamedBitList */
96 ossl_asn1_string_set_bits_left(prot, 0);
97 if (!ASN1_BIT_STRING_set(prot, protection, sig_len)) {
98 ASN1_BIT_STRING_free(prot);
99 prot = NULL;
100 }
101 end:
102 OSSL_CRMF_PBMPARAMETER_free(pbm);
103 OPENSSL_free(protection);
104 OPENSSL_free(prot_part_der);
105 return prot;
106 } else {
107 int md_nid;
108 const EVP_MD *md = NULL;
109
110 if (ctx->pkey == NULL) {
111 ERR_raise(ERR_LIB_CMP,
112 CMP_R_MISSING_KEY_INPUT_FOR_CREATING_PROTECTION);
113 return NULL;
114 }
115 if (!OBJ_find_sigid_algs(OBJ_obj2nid(algorOID), &md_nid, NULL)
116 || (md = EVP_get_digestbynid(md_nid)) == NULL) {
117 ERR_raise(ERR_LIB_CMP, CMP_R_UNKNOWN_ALGORITHM_ID);
118 return NULL;
119 }
120
121 if ((prot = ASN1_BIT_STRING_new()) == NULL)
122 return NULL;
123 if (ASN1_item_sign_ex(ASN1_ITEM_rptr(OSSL_CMP_PROTECTEDPART), NULL,
124 NULL, prot, &prot_part, NULL, ctx->pkey, md,
125 ctx->libctx, ctx->propq))
126 return prot;
127 ASN1_BIT_STRING_free(prot);
128 return NULL;
129 }
130 }
131
ossl_cmp_msg_add_extraCerts(OSSL_CMP_CTX * ctx,OSSL_CMP_MSG * msg)132 int ossl_cmp_msg_add_extraCerts(OSSL_CMP_CTX *ctx, OSSL_CMP_MSG *msg)
133 {
134 if (!ossl_assert(ctx != NULL && msg != NULL))
135 return 0;
136
137 /* Add first ctx->cert and its chain if using signature-based protection */
138 if (!ctx->unprotectedSend && ctx->secretValue == NULL
139 && ctx->cert != NULL && ctx->pkey != NULL) {
140 int prepend = X509_ADD_FLAG_UP_REF | X509_ADD_FLAG_NO_DUP
141 | X509_ADD_FLAG_PREPEND | X509_ADD_FLAG_NO_SS;
142
143 /* if not yet done try to build chain using available untrusted certs */
144 if (ctx->chain == NULL) {
145 ossl_cmp_debug(ctx,
146 "trying to build chain for own CMP signer cert");
147 ctx->chain = X509_build_chain(ctx->cert, ctx->untrusted, NULL, 0,
148 ctx->libctx, ctx->propq);
149 if (ctx->chain != NULL) {
150 ossl_cmp_debug(ctx,
151 "success building chain for own CMP signer cert");
152 } else {
153 /* dump errors to avoid confusion when printing further ones */
154 OSSL_CMP_CTX_print_errors(ctx);
155 ossl_cmp_warn(ctx,
156 "could not build chain for own CMP signer cert");
157 }
158 }
159 if (ctx->chain != NULL) {
160 if (!ossl_x509_add_certs_new(&msg->extraCerts, ctx->chain, prepend))
161 return 0;
162 } else {
163 /* make sure that at least our own signer cert is included first */
164 if (!ossl_x509_add_cert_new(&msg->extraCerts, ctx->cert, prepend))
165 return 0;
166 ossl_cmp_debug(ctx, "fallback: adding just own CMP signer cert");
167 }
168 }
169
170 /* add any additional certificates from ctx->extraCertsOut */
171 if (!ossl_x509_add_certs_new(&msg->extraCerts, ctx->extraCertsOut,
172 X509_ADD_FLAG_UP_REF | X509_ADD_FLAG_NO_DUP))
173 return 0;
174
175 /* in case extraCerts are empty list avoid empty ASN.1 sequence */
176 if (sk_X509_num(msg->extraCerts) == 0) {
177 sk_X509_free(msg->extraCerts);
178 msg->extraCerts = NULL;
179 }
180 return 1;
181 }
182
183 /*
184 * Create an X509_ALGOR structure for PasswordBasedMAC protection based on
185 * the pbm settings in the context
186 */
pbmac_algor(const OSSL_CMP_CTX * ctx)187 static X509_ALGOR *pbmac_algor(const OSSL_CMP_CTX *ctx)
188 {
189 OSSL_CRMF_PBMPARAMETER *pbm = NULL;
190 unsigned char *pbm_der = NULL;
191 int pbm_der_len;
192 ASN1_STRING *pbm_str = NULL;
193 X509_ALGOR *alg = NULL;
194
195 if (!ossl_assert(ctx != NULL))
196 return NULL;
197
198 pbm = OSSL_CRMF_pbmp_new(ctx->libctx, ctx->pbm_slen,
199 EVP_MD_get_type(ctx->pbm_owf), ctx->pbm_itercnt,
200 ctx->pbm_mac);
201 pbm_str = ASN1_STRING_new();
202 if (pbm == NULL || pbm_str == NULL)
203 goto err;
204 if ((pbm_der_len = i2d_OSSL_CRMF_PBMPARAMETER(pbm, &pbm_der)) < 0)
205 goto err;
206 if (!ASN1_STRING_set(pbm_str, pbm_der, pbm_der_len))
207 goto err;
208 alg = ossl_X509_ALGOR_from_nid(NID_id_PasswordBasedMAC,
209 V_ASN1_SEQUENCE, pbm_str);
210 err:
211 if (alg == NULL)
212 ASN1_STRING_free(pbm_str);
213 OPENSSL_free(pbm_der);
214 OSSL_CRMF_PBMPARAMETER_free(pbm);
215 return alg;
216 }
217
sig_algor(const OSSL_CMP_CTX * ctx)218 static X509_ALGOR *sig_algor(const OSSL_CMP_CTX *ctx)
219 {
220 int nid = 0;
221
222 if (!OBJ_find_sigid_by_algs(&nid, EVP_MD_get_type(ctx->digest),
223 EVP_PKEY_get_id(ctx->pkey))) {
224 ERR_raise(ERR_LIB_CMP, CMP_R_UNSUPPORTED_KEY_TYPE);
225 return 0;
226 }
227 return ossl_X509_ALGOR_from_nid(nid, V_ASN1_UNDEF, NULL);
228 }
229
set_senderKID(const OSSL_CMP_CTX * ctx,OSSL_CMP_MSG * msg,const ASN1_OCTET_STRING * id)230 static int set_senderKID(const OSSL_CMP_CTX *ctx, OSSL_CMP_MSG *msg,
231 const ASN1_OCTET_STRING *id)
232 {
233 if (id == NULL)
234 id = ctx->referenceValue; /* standard for PBM, fallback for sig-based */
235 return id == NULL || ossl_cmp_hdr_set1_senderKID(msg->header, id);
236 }
237
ossl_cmp_msg_protect(OSSL_CMP_CTX * ctx,OSSL_CMP_MSG * msg)238 int ossl_cmp_msg_protect(OSSL_CMP_CTX *ctx, OSSL_CMP_MSG *msg)
239 {
240 if (!ossl_assert(ctx != NULL && msg != NULL))
241 return 0;
242
243 /*
244 * For the case of re-protection remove pre-existing protection.
245 */
246 X509_ALGOR_free(msg->header->protectionAlg);
247 msg->header->protectionAlg = NULL;
248 ASN1_BIT_STRING_free(msg->protection);
249 msg->protection = NULL;
250
251 if (ctx->unprotectedSend) {
252 if (!set_senderKID(ctx, msg, NULL))
253 goto err;
254 } else if (ctx->secretValue != NULL) {
255 /* use PasswordBasedMac according to 5.1.3.1 if secretValue is given */
256 if ((msg->header->protectionAlg = pbmac_algor(ctx)) == NULL)
257 goto err;
258 if (!set_senderKID(ctx, msg, NULL))
259 goto err;
260
261 /*
262 * will add any additional certificates from ctx->extraCertsOut
263 * while not needed to validate the protection certificate,
264 * the option to do this might be handy for certain use cases
265 */
266 } else if (ctx->cert != NULL && ctx->pkey != NULL) {
267 /* use MSG_SIG_ALG according to 5.1.3.3 if client cert and key given */
268
269 /* make sure that key and certificate match */
270 if (!X509_check_private_key(ctx->cert, ctx->pkey)) {
271 ERR_raise(ERR_LIB_CMP, CMP_R_CERT_AND_KEY_DO_NOT_MATCH);
272 goto err;
273 }
274
275 if ((msg->header->protectionAlg = sig_algor(ctx)) == NULL)
276 goto err;
277 /* set senderKID to keyIdentifier of the cert according to 5.1.1 */
278 if (!set_senderKID(ctx, msg, X509_get0_subject_key_id(ctx->cert)))
279 goto err;
280
281 /*
282 * will add ctx->cert followed, if possible, by its chain built
283 * from ctx->untrusted, and then ctx->extraCertsOut
284 */
285 } else {
286 ERR_raise(ERR_LIB_CMP,
287 CMP_R_MISSING_KEY_INPUT_FOR_CREATING_PROTECTION);
288 goto err;
289 }
290 if (!ctx->unprotectedSend
291 && ((msg->protection = ossl_cmp_calc_protection(ctx, msg)) == NULL))
292 goto err;
293
294 /*
295 * For signature-based protection add ctx->cert followed by its chain.
296 * Finally add any additional certificates from ctx->extraCertsOut;
297 * even if not needed to validate the protection
298 * the option to do this might be handy for certain use cases.
299 */
300 if (!ossl_cmp_msg_add_extraCerts(ctx, msg))
301 goto err;
302
303 /*
304 * As required by RFC 4210 section 5.1.1., if the sender name is not known
305 * to the client it set to NULL-DN. In this case for identification at least
306 * the senderKID must be set, where we took the referenceValue as fallback.
307 */
308 if (!(ossl_cmp_general_name_is_NULL_DN(msg->header->sender)
309 && msg->header->senderKID == NULL))
310 return 1;
311 ERR_raise(ERR_LIB_CMP, CMP_R_MISSING_SENDER_IDENTIFICATION);
312
313 err:
314 ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_PROTECTING_MESSAGE);
315 return 0;
316 }
317
