1/*
2 * Copyright 2007-2023 The OpenSSL Project Authors. All Rights Reserved.
3 * Copyright Nokia 2007-2019
4 * Copyright Siemens AG 2015-2019
5 *
6 * Licensed under the Apache License 2.0 (the "License").  You may not use
7 * this file except in compliance with the License.  You can obtain a copy
8 * in the file LICENSE in the source distribution or at
9 * https://www.openssl.org/source/license.html
10 */
11
12#include "cmp_local.h"
13
14/* explicit #includes not strictly needed since implied by the above: */
15#include <openssl/asn1t.h>
16#include <openssl/cmp.h>
17#include <openssl/crmf.h>
18#include <openssl/err.h>
19#include <openssl/x509.h>
20
21/*
22 * This function is also used by the internal verify_PBMAC() in cmp_vfy.c.
23 *
24 * Calculate protection for given PKImessage according to
25 * the algorithm and parameters in the message header's protectionAlg
26 * using the credentials, library context, and property criteria in the ctx.
27 *
28 * returns ASN1_BIT_STRING representing the protection on success, else NULL
29 */
30ASN1_BIT_STRING *ossl_cmp_calc_protection(const OSSL_CMP_CTX *ctx,
31                                          const OSSL_CMP_MSG *msg)
32{
33    ASN1_BIT_STRING *prot = NULL;
34    OSSL_CMP_PROTECTEDPART prot_part;
35    const ASN1_OBJECT *algorOID = NULL;
36    const void *ppval = NULL;
37    int pptype = 0;
38
39    if (!ossl_assert(ctx != NULL && msg != NULL))
40        return NULL;
41
42    /* construct data to be signed */
43    prot_part.header = msg->header;
44    prot_part.body = msg->body;
45
46    if (msg->header->protectionAlg == NULL) {
47        ERR_raise(ERR_LIB_CMP, CMP_R_UNKNOWN_ALGORITHM_ID);
48        return NULL;
49    }
50    X509_ALGOR_get0(&algorOID, &pptype, &ppval, msg->header->protectionAlg);
51
52    if (OBJ_obj2nid(algorOID) == NID_id_PasswordBasedMAC) {
53        int len;
54        size_t prot_part_der_len;
55        unsigned char *prot_part_der = NULL;
56        size_t sig_len;
57        unsigned char *protection = NULL;
58        OSSL_CRMF_PBMPARAMETER *pbm = NULL;
59        ASN1_STRING *pbm_str = NULL;
60        const unsigned char *pbm_str_uc = NULL;
61
62        if (ctx->secretValue == NULL) {
63            ERR_raise(ERR_LIB_CMP, CMP_R_MISSING_PBM_SECRET);
64            return NULL;
65        }
66        if (ppval == NULL) {
67            ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CALCULATING_PROTECTION);
68            return NULL;
69        }
70
71        len = i2d_OSSL_CMP_PROTECTEDPART(&prot_part, &prot_part_der);
72        if (len < 0 || prot_part_der == NULL) {
73            ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CALCULATING_PROTECTION);
74            goto end;
75        }
76        prot_part_der_len = (size_t)len;
77
78        pbm_str = (ASN1_STRING *)ppval;
79        pbm_str_uc = pbm_str->data;
80        pbm = d2i_OSSL_CRMF_PBMPARAMETER(NULL, &pbm_str_uc, pbm_str->length);
81        if (pbm == NULL) {
82            ERR_raise(ERR_LIB_CMP, CMP_R_WRONG_ALGORITHM_OID);
83            goto end;
84        }
85
86        if (!OSSL_CRMF_pbm_new(ctx->libctx, ctx->propq,
87                               pbm, prot_part_der, prot_part_der_len,
88                               ctx->secretValue->data, ctx->secretValue->length,
89                               &protection, &sig_len))
90            goto end;
91
92        if ((prot = ASN1_BIT_STRING_new()) == NULL)
93            goto end;
94        /* OpenSSL defaults all bit strings to be encoded as ASN.1 NamedBitList */
95        prot->flags &= ~(ASN1_STRING_FLAG_BITS_LEFT | 0x07);
96        prot->flags |= ASN1_STRING_FLAG_BITS_LEFT;
97        if (!ASN1_BIT_STRING_set(prot, protection, sig_len)) {
98            ASN1_BIT_STRING_free(prot);
99            prot = NULL;
100        }
101    end:
102        OSSL_CRMF_PBMPARAMETER_free(pbm);
103        OPENSSL_free(protection);
104        OPENSSL_free(prot_part_der);
105        return prot;
106    } else {
107        int md_nid;
108        const EVP_MD *md = NULL;
109
110        if (ctx->pkey == NULL) {
111            ERR_raise(ERR_LIB_CMP,
112                      CMP_R_MISSING_KEY_INPUT_FOR_CREATING_PROTECTION);
113            return NULL;
114        }
115        if (!OBJ_find_sigid_algs(OBJ_obj2nid(algorOID), &md_nid, NULL)
116                || (md = EVP_get_digestbynid(md_nid)) == NULL) {
117            ERR_raise(ERR_LIB_CMP, CMP_R_UNKNOWN_ALGORITHM_ID);
118            return NULL;
119        }
120
121        if ((prot = ASN1_BIT_STRING_new()) == NULL)
122            return NULL;
123        if (ASN1_item_sign_ex(ASN1_ITEM_rptr(OSSL_CMP_PROTECTEDPART), NULL,
124                              NULL, prot, &prot_part, NULL, ctx->pkey, md,
125                              ctx->libctx, ctx->propq))
126            return prot;
127        ASN1_BIT_STRING_free(prot);
128        return NULL;
129    }
130}
131
132/* ctx is not const just because ctx->chain may get adapted */
133int ossl_cmp_msg_add_extraCerts(OSSL_CMP_CTX *ctx, OSSL_CMP_MSG *msg)
134{
135    if (!ossl_assert(ctx != NULL && msg != NULL))
136        return 0;
137
138    /* Add first ctx->cert and its chain if using signature-based protection */
139    if (!ctx->unprotectedSend && ctx->secretValue == NULL
140            && ctx->cert != NULL && ctx->pkey != NULL) {
141        int prepend = X509_ADD_FLAG_UP_REF | X509_ADD_FLAG_NO_DUP
142            | X509_ADD_FLAG_PREPEND | X509_ADD_FLAG_NO_SS;
143
144        /* if not yet done try to build chain using available untrusted certs */
145        if (ctx->chain == NULL) {
146            ossl_cmp_debug(ctx,
147                           "trying to build chain for own CMP signer cert");
148            ctx->chain = X509_build_chain(ctx->cert, ctx->untrusted, NULL, 0,
149                                          ctx->libctx, ctx->propq);
150            if (ctx->chain != NULL) {
151                ossl_cmp_debug(ctx,
152                               "success building chain for own CMP signer cert");
153            } else {
154                /* dump errors to avoid confusion when printing further ones */
155                OSSL_CMP_CTX_print_errors(ctx);
156                ossl_cmp_warn(ctx,
157                              "could not build chain for own CMP signer cert");
158            }
159        }
160        if (ctx->chain != NULL) {
161            if (!ossl_x509_add_certs_new(&msg->extraCerts, ctx->chain, prepend))
162                return 0;
163        } else {
164            /* make sure that at least our own signer cert is included first */
165            if (!ossl_x509_add_cert_new(&msg->extraCerts, ctx->cert, prepend))
166                return 0;
167            ossl_cmp_debug(ctx, "fallback: adding just own CMP signer cert");
168        }
169    }
170
171    /* add any additional certificates from ctx->extraCertsOut */
172    if (!ossl_x509_add_certs_new(&msg->extraCerts, ctx->extraCertsOut,
173                                 X509_ADD_FLAG_UP_REF | X509_ADD_FLAG_NO_DUP))
174        return 0;
175
176    /* in case extraCerts are empty list avoid empty ASN.1 sequence */
177    if (sk_X509_num(msg->extraCerts) == 0) {
178        sk_X509_free(msg->extraCerts);
179        msg->extraCerts = NULL;
180    }
181    return 1;
182}
183
184/*
185 * Create an X509_ALGOR structure for PasswordBasedMAC protection based on
186 * the pbm settings in the context
187 */
188static int set_pbmac_algor(const OSSL_CMP_CTX *ctx, X509_ALGOR **alg)
189{
190    OSSL_CRMF_PBMPARAMETER *pbm = NULL;
191    unsigned char *pbm_der = NULL;
192    int pbm_der_len;
193    ASN1_STRING *pbm_str = NULL;
194
195    if (!ossl_assert(ctx != NULL))
196        return 0;
197
198    pbm = OSSL_CRMF_pbmp_new(ctx->libctx, ctx->pbm_slen,
199                             EVP_MD_get_type(ctx->pbm_owf), ctx->pbm_itercnt,
200                             ctx->pbm_mac);
201    pbm_str = ASN1_STRING_new();
202    if (pbm == NULL || pbm_str == NULL)
203        goto err;
204
205    if ((pbm_der_len = i2d_OSSL_CRMF_PBMPARAMETER(pbm, &pbm_der)) < 0)
206        goto err;
207
208    if (!ASN1_STRING_set(pbm_str, pbm_der, pbm_der_len))
209        goto err;
210    if (*alg == NULL && (*alg = X509_ALGOR_new()) == NULL)
211        goto err;
212    OPENSSL_free(pbm_der);
213
214    X509_ALGOR_set0(*alg, OBJ_nid2obj(NID_id_PasswordBasedMAC),
215                    V_ASN1_SEQUENCE, pbm_str);
216    OSSL_CRMF_PBMPARAMETER_free(pbm);
217    return 1;
218
219 err:
220    ASN1_STRING_free(pbm_str);
221    OPENSSL_free(pbm_der);
222    OSSL_CRMF_PBMPARAMETER_free(pbm);
223    return 0;
224}
225
226static int set_sig_algor(const OSSL_CMP_CTX *ctx, X509_ALGOR **alg)
227{
228    int nid = 0;
229    ASN1_OBJECT *algo = NULL;
230
231    if (!OBJ_find_sigid_by_algs(&nid, EVP_MD_get_type(ctx->digest),
232                                EVP_PKEY_get_id(ctx->pkey))) {
233        ERR_raise(ERR_LIB_CMP, CMP_R_UNSUPPORTED_KEY_TYPE);
234        return 0;
235    }
236    if ((algo = OBJ_nid2obj(nid)) == NULL)
237        return 0;
238    if (*alg == NULL && (*alg = X509_ALGOR_new()) == NULL)
239        return 0;
240
241    if (X509_ALGOR_set0(*alg, algo, V_ASN1_UNDEF, NULL))
242        return 1;
243    ASN1_OBJECT_free(algo);
244    return 0;
245}
246
247static int set_senderKID(const OSSL_CMP_CTX *ctx, OSSL_CMP_MSG *msg,
248                         const ASN1_OCTET_STRING *id)
249{
250    if (id == NULL)
251        id = ctx->referenceValue; /* standard for PBM, fallback for sig-based */
252    return id == NULL || ossl_cmp_hdr_set1_senderKID(msg->header, id);
253}
254
255/* ctx is not const just because ctx->chain may get adapted */
256int ossl_cmp_msg_protect(OSSL_CMP_CTX *ctx, OSSL_CMP_MSG *msg)
257{
258    if (!ossl_assert(ctx != NULL && msg != NULL))
259        return 0;
260
261    /*
262     * For the case of re-protection remove pre-existing protection.
263     */
264    X509_ALGOR_free(msg->header->protectionAlg);
265    msg->header->protectionAlg = NULL;
266    ASN1_BIT_STRING_free(msg->protection);
267    msg->protection = NULL;
268
269    if (ctx->unprotectedSend) {
270        if (!set_senderKID(ctx, msg, NULL))
271            goto err;
272    } else if (ctx->secretValue != NULL) {
273        /* use PasswordBasedMac according to 5.1.3.1 if secretValue is given */
274        if (!set_pbmac_algor(ctx, &msg->header->protectionAlg))
275            goto err;
276        if (!set_senderKID(ctx, msg, NULL))
277            goto err;
278
279        /*
280         * will add any additional certificates from ctx->extraCertsOut
281         * while not needed to validate the protection certificate,
282         * the option to do this might be handy for certain use cases
283         */
284    } else if (ctx->cert != NULL && ctx->pkey != NULL) {
285        /* use MSG_SIG_ALG according to 5.1.3.3 if client cert and key given */
286
287        /* make sure that key and certificate match */
288        if (!X509_check_private_key(ctx->cert, ctx->pkey)) {
289            ERR_raise(ERR_LIB_CMP, CMP_R_CERT_AND_KEY_DO_NOT_MATCH);
290            goto err;
291        }
292
293        if (!set_sig_algor(ctx, &msg->header->protectionAlg))
294            goto err;
295        /* set senderKID to keyIdentifier of the cert according to 5.1.1 */
296        if (!set_senderKID(ctx, msg, X509_get0_subject_key_id(ctx->cert)))
297            goto err;
298
299        /*
300         * will add ctx->cert followed, if possible, by its chain built
301         * from ctx->untrusted, and then ctx->extraCertsOut
302         */
303    } else {
304        ERR_raise(ERR_LIB_CMP,
305                  CMP_R_MISSING_KEY_INPUT_FOR_CREATING_PROTECTION);
306        goto err;
307    }
308    if (!ctx->unprotectedSend
309            && ((msg->protection = ossl_cmp_calc_protection(ctx, msg)) == NULL))
310        goto err;
311
312    /*
313     * For signature-based protection add ctx->cert followed by its chain.
314     * Finally add any additional certificates from ctx->extraCertsOut;
315     * even if not needed to validate the protection
316     * the option to do this might be handy for certain use cases.
317     */
318    if (!ossl_cmp_msg_add_extraCerts(ctx, msg))
319        goto err;
320
321    /*
322     * As required by RFC 4210 section 5.1.1., if the sender name is not known
323     * to the client it set to NULL-DN. In this case for identification at least
324     * the senderKID must be set, where we took the referenceValue as fallback.
325     */
326    if (!(ossl_cmp_general_name_is_NULL_DN(msg->header->sender)
327          && msg->header->senderKID == NULL))
328        return 1;
329    ERR_raise(ERR_LIB_CMP, CMP_R_MISSING_SENDER_IDENTIFICATION);
330
331 err:
332    ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_PROTECTING_MESSAGE);
333    return 0;
334}
335