../deps/openssl/openssl/apps/cmp.c

1

/*

2

3

* Copyright Nokia 2007-2019

4

* Copyright Siemens AG 2015-2019

5

*

6

* Licensed under the Apache License 2.0 (the "License"). You may not use

7

* this file except in compliance with the License. You can obtain a copy

8

* in the file LICENSE in the source distribution or at

9

* https://www.openssl.org/source/license.html

10

*/

11

12

/* This app is disabled when OPENSSL_NO_CMP is defined. */

13

14

#include <string.h>

15

#include <ctype.h>

16

17

#include "apps.h"

18

#include "http_server.h"

19

#include "s_apps.h"

20

#include "progs.h"

21

22

#include "cmp_mock_srv.h"

23

24

/* tweaks needed due to missing unistd.h on Windows */

25

#if defined(_WIN32) && !defined(__BORLANDC__)

26

# define access _access

27

#endif

28

#ifndef F_OK0

29

# define F_OK0 0

30

#endif

31

32

#include <openssl/ui.h>

33

#include <openssl/pkcs12.h>

34

#include <openssl/ssl.h>

35

36

/* explicit #includes not strictly needed since implied by the above: */

37

#include <stdlib.h>

38

#include <openssl/cmp.h>

39

#include <openssl/cmp_util.h>

40

#include <openssl/crmf.h>

41

#include <openssl/crypto.h>

42

#include <openssl/err.h>

43

#include <openssl/store.h>

44

#include <openssl/objects.h>

45

#include <openssl/x509.h>

46

47

static char *prog;

48

static char *opt_config = NULL((void*)0);

49

#define CMP_SECTION"cmp" "cmp"

50

#define SECTION_NAME_MAX40 40 /* max length of section name */

51

#define DEFAULT_SECTION"default" "default"

52

static char *opt_section = CMP_SECTION"cmp";

53

static int opt_verbosity = OSSL_CMP_LOG_INFO6;

54

55

static int read_config(void);

56

57

static CONF *conf = NULL((void*)0); /* OpenSSL config file context structure */

58

static OSSL_CMP_CTX *cmp_ctx = NULL((void*)0); /* the client-side CMP context */

59

60

/* the type of cmp command we want to send */

61

typedef enum {

62

CMP_IR,

63

CMP_KUR,

64

CMP_CR,

65

CMP_P10CR,

66

CMP_RR,

67

CMP_GENM

68

} cmp_cmd_t;

69

70

/* message transfer */

71

#ifndef OPENSSL_NO_SOCK

72

static char *opt_server = NULL((void*)0);

73

static char *opt_proxy = NULL((void*)0);

74

static char *opt_no_proxy = NULL((void*)0);

75

#endif

76

static char *opt_recipient = NULL((void*)0);

77

static char *opt_path = NULL((void*)0);

78

static int opt_keep_alive = 1;

79

static int opt_msg_timeout = -1;

80

static int opt_total_timeout = -1;

81

82

/* server authentication */

83

static char *opt_trusted = NULL((void*)0);

84

static char *opt_untrusted = NULL((void*)0);

85

static char *opt_srvcert = NULL((void*)0);

86

static char *opt_expect_sender = NULL((void*)0);

87

static int opt_ignore_keyusage = 0;

88

static int opt_unprotected_errors = 0;

89

static char *opt_extracertsout = NULL((void*)0);

90

static char *opt_cacertsout = NULL((void*)0);

91

92

/* client authentication */

93

static char *opt_ref = NULL((void*)0);

94

static char *opt_secret = NULL((void*)0);

95

static char *opt_cert = NULL((void*)0);

96

static char *opt_own_trusted = NULL((void*)0);

97

static char *opt_key = NULL((void*)0);

98

static char *opt_keypass = NULL((void*)0);

99

static char *opt_digest = NULL((void*)0);

100

static char *opt_mac = NULL((void*)0);

101

static char *opt_extracerts = NULL((void*)0);

102

static int opt_unprotected_requests = 0;

103

104

/* generic message */

105

static char *opt_cmd_s = NULL((void*)0);

106

static int opt_cmd = -1;

107

static char *opt_geninfo = NULL((void*)0);

108

static char *opt_infotype_s = NULL((void*)0);

109

static int opt_infotype = NID_undef0;

110

111

/* certificate enrollment */

112

static char *opt_newkey = NULL((void*)0);

113

static char *opt_newkeypass = NULL((void*)0);

114

static char *opt_subject = NULL((void*)0);

115

static char *opt_issuer = NULL((void*)0);

116

static int opt_days = 0;

117

static char *opt_reqexts = NULL((void*)0);

118

static char *opt_sans = NULL((void*)0);

119

static int opt_san_nodefault = 0;

120

static char *opt_policies = NULL((void*)0);

121

static char *opt_policy_oids = NULL((void*)0);

122

static int opt_policy_oids_critical = 0;

123

static int opt_popo = OSSL_CRMF_POPO_NONE-1 - 1;

124

static char *opt_csr = NULL((void*)0);

125

static char *opt_out_trusted = NULL((void*)0);

126

static int opt_implicit_confirm = 0;

127

static int opt_disable_confirm = 0;

128

static char *opt_certout = NULL((void*)0);

129

static char *opt_chainout = NULL((void*)0);

130

131

/* certificate enrollment and revocation */

132

static char *opt_oldcert = NULL((void*)0);

133

static int opt_revreason = CRL_REASON_NONE-1;

134

135

/* credentials format */

136

static char *opt_certform_s = "PEM";

137

static int opt_certform = FORMAT_PEM(5 | 0x8000);

138

static char *opt_keyform_s = NULL((void*)0);

139

static int opt_keyform = FORMAT_UNDEF0;

140

static char *opt_otherpass = NULL((void*)0);

141

static char *opt_engine = NULL((void*)0);

142

143

#ifndef OPENSSL_NO_SOCK

144

/* TLS connection */

145

static int opt_tls_used = 0;

146

static char *opt_tls_cert = NULL((void*)0);

147

static char *opt_tls_key = NULL((void*)0);

148

static char *opt_tls_keypass = NULL((void*)0);

149

static char *opt_tls_extra = NULL((void*)0);

150

static char *opt_tls_trusted = NULL((void*)0);

151

static char *opt_tls_host = NULL((void*)0);

152

#endif

153

154

/* client-side debugging */

155

static int opt_batch = 0;

156

static int opt_repeat = 1;

157

static char *opt_reqin = NULL((void*)0);

158

static int opt_reqin_new_tid = 0;

159

static char *opt_reqout = NULL((void*)0);

160

static char *opt_rspin = NULL((void*)0);

161

static char *opt_rspout = NULL((void*)0);

162

static int opt_use_mock_srv = 0;

163

164

/* mock server */

165

#ifndef OPENSSL_NO_SOCK

166

static char *opt_port = NULL((void*)0);

167

static int opt_max_msgs = 0;

168

#endif

169

static char *opt_srv_ref = NULL((void*)0);

170

static char *opt_srv_secret = NULL((void*)0);

171

static char *opt_srv_cert = NULL((void*)0);

172

static char *opt_srv_key = NULL((void*)0);

173

static char *opt_srv_keypass = NULL((void*)0);

174

175

static char *opt_srv_trusted = NULL((void*)0);

176

static char *opt_srv_untrusted = NULL((void*)0);

177

static char *opt_rsp_cert = NULL((void*)0);

178

static char *opt_rsp_extracerts = NULL((void*)0);

179

static char *opt_rsp_capubs = NULL((void*)0);

180

static int opt_poll_count = 0;

181

static int opt_check_after = 1;

182

static int opt_grant_implicitconf = 0;

183

184

static int opt_pkistatus = OSSL_CMP_PKISTATUS_accepted0;

185

static int opt_failure = INT_MIN(-2147483647 -1);

186

static int opt_failurebits = 0;

187

static char *opt_statusstring = NULL((void*)0);

188

static int opt_send_error = 0;

189

static int opt_send_unprotected = 0;

190

static int opt_send_unprot_err = 0;

191

static int opt_accept_unprotected = 0;

192

static int opt_accept_unprot_err = 0;

193

static int opt_accept_raverified = 0;

194

195

static X509_VERIFY_PARAM *vpm = NULL((void*)0);

196

197

typedef enum OPTION_choice {

198

OPT_COMMONOPT_ERR = -1, OPT_EOF = 0, OPT_HELP,

199

OPT_CONFIG, OPT_SECTION, OPT_VERBOSITY,

200

201

OPT_CMD, OPT_INFOTYPE, OPT_GENINFO,

202

203

OPT_NEWKEY, OPT_NEWKEYPASS, OPT_SUBJECT, OPT_ISSUER,

204

OPT_DAYS, OPT_REQEXTS,

205

OPT_SANS, OPT_SAN_NODEFAULT,

206

OPT_POLICIES, OPT_POLICY_OIDS, OPT_POLICY_OIDS_CRITICAL,

207

OPT_POPO, OPT_CSR,

208

OPT_OUT_TRUSTED, OPT_IMPLICIT_CONFIRM, OPT_DISABLE_CONFIRM,

209

OPT_CERTOUT, OPT_CHAINOUT,

210

211

OPT_OLDCERT, OPT_REVREASON,

212

213

#ifndef OPENSSL_NO_SOCK

214

OPT_SERVER, OPT_PROXY, OPT_NO_PROXY,

215

#endif

216

OPT_RECIPIENT, OPT_PATH,

217

OPT_KEEP_ALIVE, OPT_MSG_TIMEOUT, OPT_TOTAL_TIMEOUT,

218

219

OPT_TRUSTED, OPT_UNTRUSTED, OPT_SRVCERT,

220

OPT_EXPECT_SENDER,

221

OPT_IGNORE_KEYUSAGE, OPT_UNPROTECTED_ERRORS,

222

OPT_EXTRACERTSOUT, OPT_CACERTSOUT,

223

224

OPT_REF, OPT_SECRET, OPT_CERT, OPT_OWN_TRUSTED, OPT_KEY, OPT_KEYPASS,

225

OPT_DIGEST, OPT_MAC, OPT_EXTRACERTS,

226

OPT_UNPROTECTED_REQUESTS,

227

228

OPT_CERTFORM, OPT_KEYFORM,

229

OPT_OTHERPASS,

230

#ifndef OPENSSL_NO_ENGINE

231

OPT_ENGINE,

232

#endif

233

OPT_PROV_ENUMOPT_PROV__FIRST=1600, OPT_PROV_PROVIDER, OPT_PROV_PROVIDER_PATH
, OPT_PROV_PROPQUERY, OPT_PROV__LAST,

234

OPT_R_ENUMOPT_R__FIRST=1500, OPT_R_RAND, OPT_R_WRITERAND, OPT_R__LAST,

235

236

#ifndef OPENSSL_NO_SOCK

237

OPT_TLS_USED, OPT_TLS_CERT, OPT_TLS_KEY,

238

OPT_TLS_KEYPASS,

239

OPT_TLS_EXTRA, OPT_TLS_TRUSTED, OPT_TLS_HOST,

240

#endif

241

242

OPT_BATCH, OPT_REPEAT,

243

OPT_REQIN, OPT_REQIN_NEW_TID, OPT_REQOUT, OPT_RSPIN, OPT_RSPOUT,

244

OPT_USE_MOCK_SRV,

245

246

#ifndef OPENSSL_NO_SOCK

247

OPT_PORT, OPT_MAX_MSGS,

248

#endif

249

OPT_SRV_REF, OPT_SRV_SECRET,

250

OPT_SRV_CERT, OPT_SRV_KEY, OPT_SRV_KEYPASS,

251

OPT_SRV_TRUSTED, OPT_SRV_UNTRUSTED,

252

OPT_RSP_CERT, OPT_RSP_EXTRACERTS, OPT_RSP_CAPUBS,

253

OPT_POLL_COUNT, OPT_CHECK_AFTER,

254

OPT_GRANT_IMPLICITCONF,

255

OPT_PKISTATUS, OPT_FAILURE,

256

OPT_FAILUREBITS, OPT_STATUSSTRING,

257

OPT_SEND_ERROR, OPT_SEND_UNPROTECTED,

258

OPT_SEND_UNPROT_ERR, OPT_ACCEPT_UNPROTECTED,

259

OPT_ACCEPT_UNPROT_ERR, OPT_ACCEPT_RAVERIFIED,

260

261

OPT_V_ENUMOPT_V__FIRST=2000, OPT_V_POLICY, OPT_V_PURPOSE, OPT_V_VERIFY_NAME
, OPT_V_VERIFY_DEPTH, OPT_V_ATTIME, OPT_V_VERIFY_HOSTNAME, OPT_V_VERIFY_EMAIL
, OPT_V_VERIFY_IP, OPT_V_IGNORE_CRITICAL, OPT_V_ISSUER_CHECKS
, OPT_V_CRL_CHECK, OPT_V_CRL_CHECK_ALL, OPT_V_POLICY_CHECK, OPT_V_EXPLICIT_POLICY
, OPT_V_INHIBIT_ANY, OPT_V_INHIBIT_MAP, OPT_V_X509_STRICT, OPT_V_EXTENDED_CRL
, OPT_V_USE_DELTAS, OPT_V_POLICY_PRINT, OPT_V_CHECK_SS_SIG, OPT_V_TRUSTED_FIRST
, OPT_V_SUITEB_128_ONLY, OPT_V_SUITEB_128, OPT_V_SUITEB_192, OPT_V_PARTIAL_CHAIN
, OPT_V_NO_ALT_CHAINS, OPT_V_NO_CHECK_TIME, OPT_V_VERIFY_AUTH_LEVEL
, OPT_V_ALLOW_PROXY_CERTS, OPT_V__LAST

262

} OPTION_CHOICE;

263

264

const OPTIONS cmp_options[] = {

265

/* entries must be in the same order as enumerated above!! */

266

{"help", OPT_HELP, '-', "Display this summary"},

267

{"config", OPT_CONFIG, 's',

268

"Configuration file to use. \"\" = none. Default from env variable OPENSSL_CONF"},

269

{"section", OPT_SECTION, 's',

270

"Section(s) in config file to get options from. \"\" = 'default'. Default 'cmp'"},

271

{"verbosity", OPT_VERBOSITY, 'N',

272

"Log level; 3=ERR, 4=WARN, 6=INFO, 7=DEBUG, 8=TRACE. Default 6 = INFO"},

273

274

OPT_SECTION("Generic message"){ OPT_SECTION_STR, 1, '-', "Generic message" " options:\n" },

275

{"cmd", OPT_CMD, 's', "CMP request to send: ir/cr/kur/p10cr/rr/genm"},

276

{"infotype", OPT_INFOTYPE, 's',

277

"InfoType name for requesting specific info in genm, e.g. 'signKeyPairTypes'"},

278

{"geninfo", OPT_GENINFO, 's',

279

"generalInfo integer values to place in request PKIHeader with given OID"},

280

{OPT_MORE_STR, 0, 0,

281

"specified in the form <OID>:int:<n>, e.g. \"1.2.3.4:int:56789\""},

282

283

OPT_SECTION("Certificate enrollment"){ OPT_SECTION_STR, 1, '-', "Certificate enrollment" " options:\n"
},

284

{"newkey", OPT_NEWKEY, 's',

285

"Private or public key for the requested cert. Default: CSR key or client key"},

286

{"newkeypass", OPT_NEWKEYPASS, 's', "New private key pass phrase source"},

287

{"subject", OPT_SUBJECT, 's',

288

"Distinguished Name (DN) of subject to use in the requested cert template"},

289

{OPT_MORE_STR, 0, 0,

290

"For kur, default is subject of -csr arg or reference cert (see -oldcert)"},

291

{OPT_MORE_STR, 0, 0,

292

"this default is used for ir and cr only if no Subject Alt Names are set"},

293

{"issuer", OPT_ISSUER, 's',

294

"DN of the issuer to place in the requested certificate template"},

295

{OPT_MORE_STR, 0, 0,

296

"also used as recipient if neither -recipient nor -srvcert are given"},

297

{"days", OPT_DAYS, 'N',

298

"Requested validity time of the new certificate in number of days"},

299

{"reqexts", OPT_REQEXTS, 's',

300

"Name of config file section defining certificate request extensions."},

301

{OPT_MORE_STR, 0, 0,

302

"Augments or replaces any extensions contained CSR given with -csr"},

303

{"sans", OPT_SANS, 's',

304

"Subject Alt Names (IPADDR/DNS/URI) to add as (critical) cert req extension"},

305

{"san_nodefault", OPT_SAN_NODEFAULT, '-',

306

"Do not take default SANs from reference certificate (see -oldcert)"},

307

{"policies", OPT_POLICIES, 's',

308

"Name of config file section defining policies certificate request extension"},

309

{"policy_oids", OPT_POLICY_OIDS, 's',

310

"Policy OID(s) to add as policies certificate request extension"},

311

{"policy_oids_critical", OPT_POLICY_OIDS_CRITICAL, '-',

312

"Flag the policy OID(s) given with -policy_oids as critical"},

313

{"popo", OPT_POPO, 'n',

314

"Proof-of-Possession (POPO) method to use for ir/cr/kur where"},

315

{OPT_MORE_STR, 0, 0,

316

"-1 = NONE, 0 = RAVERIFIED, 1 = SIGNATURE (default), 2 = KEYENC"},

317

{"csr", OPT_CSR, 's',

318

"PKCS#10 CSR file in PEM or DER format to convert or to use in p10cr"},

319

{"out_trusted", OPT_OUT_TRUSTED, 's',

320

"Certificates to trust when verifying newly enrolled certificates"},

321

{"implicit_confirm", OPT_IMPLICIT_CONFIRM, '-',

322

"Request implicit confirmation of newly enrolled certificates"},

323

{"disable_confirm", OPT_DISABLE_CONFIRM, '-',

324

"Do not confirm newly enrolled certificate w/o requesting implicit"},

325

{OPT_MORE_STR, 0, 0,

326

"confirmation. WARNING: This leads to behavior violating RFC 4210"},

327

{"certout", OPT_CERTOUT, 's',

328

"File to save newly enrolled certificate"},

329

{"chainout", OPT_CHAINOUT, 's',

330

"File to save the chain of newly enrolled certificate"},

331

332

OPT_SECTION("Certificate enrollment and revocation"){ OPT_SECTION_STR, 1, '-', "Certificate enrollment and revocation"
" options:\n" },

333

334

{"oldcert", OPT_OLDCERT, 's',

335

"Certificate to be updated (defaulting to -cert) or to be revoked in rr;"},

336

{OPT_MORE_STR, 0, 0,

337

"also used as reference (defaulting to -cert) for subject DN and SANs."},

338

{OPT_MORE_STR, 0, 0,

339

"Issuer is used as recipient unless -recipient, -srvcert, or -issuer given"},

340

{"revreason", OPT_REVREASON, 'n',

341

"Reason code to include in revocation request (rr); possible values:"},

342

{OPT_MORE_STR, 0, 0,

343

"0..6, 8..10 (see RFC5280, 5.3.1) or -1. Default -1 = none included"},

344

345

OPT_SECTION("Message transfer"){ OPT_SECTION_STR, 1, '-', "Message transfer" " options:\n" },

346

#ifdef OPENSSL_NO_SOCK

347

{OPT_MORE_STR, 0, 0,

348

"NOTE: -server, -proxy, and -no_proxy not supported due to no-sock build"},

349

#else

350

{"server", OPT_SERVER, 's',

351

"[http[s]://]address[:port][/path] of CMP server. Default port 80 or 443."},

352

{OPT_MORE_STR, 0, 0,

353

"address may be a DNS name or an IP address; path can be overridden by -path"},

354

{"proxy", OPT_PROXY, 's',

355

"[http[s]://]address[:port][/path] of HTTP(S) proxy to use; path is ignored"},

356

{"no_proxy", OPT_NO_PROXY, 's',

357

"List of addresses of servers not to use HTTP(S) proxy for"},

358

{OPT_MORE_STR, 0, 0,

359

"Default from environment variable 'no_proxy', else 'NO_PROXY', else none"},

360

#endif

361

{"recipient", OPT_RECIPIENT, 's',

362

"DN of CA. Default: subject of -srvcert, -issuer, issuer of -oldcert or -cert"},

363

{"path", OPT_PATH, 's',

364

"HTTP path (aka CMP alias) at the CMP server. Default from -server, else \"/\""},

365

{"keep_alive", OPT_KEEP_ALIVE, 'N',

366

"Persistent HTTP connections. 0: no, 1 (the default): request, 2: require"},

367

{"msg_timeout", OPT_MSG_TIMEOUT, 'N',

368

"Number of seconds allowed per CMP message round trip, or 0 for infinite"},

369

{"total_timeout", OPT_TOTAL_TIMEOUT, 'N',

370

"Overall time an enrollment incl. polling may take. Default 0 = infinite"},

371

372

OPT_SECTION("Server authentication"){ OPT_SECTION_STR, 1, '-', "Server authentication" " options:\n"
},

373

{"trusted", OPT_TRUSTED, 's',

374

"Certificates to trust as chain roots when verifying signed CMP responses"},

375

{OPT_MORE_STR, 0, 0, "unless -srvcert is given"},

376

{"untrusted", OPT_UNTRUSTED, 's',

377

"Intermediate CA certs for chain construction for CMP/TLS/enrolled certs"},

378

{"srvcert", OPT_SRVCERT, 's',

379

"Server cert to pin and trust directly when verifying signed CMP responses"},

380

{"expect_sender", OPT_EXPECT_SENDER, 's',

381

"DN of expected sender of responses. Defaults to subject of -srvcert, if any"},

382

{"ignore_keyusage", OPT_IGNORE_KEYUSAGE, '-',

383

"Ignore CMP signer cert key usage, else 'digitalSignature' must be allowed"},

384

{"unprotected_errors", OPT_UNPROTECTED_ERRORS, '-',

385

"Accept missing or invalid protection of regular error messages and negative"},

386

{OPT_MORE_STR, 0, 0,

387

"certificate responses (ip/cp/kup), revocation responses (rp), and PKIConf"},

388

{OPT_MORE_STR, 0, 0,

389

"WARNING: This setting leads to behavior allowing violation of RFC 4210"},

390

{"extracertsout", OPT_EXTRACERTSOUT, 's',

391

"File to save extra certificates received in the extraCerts field"},

392

{"cacertsout", OPT_CACERTSOUT, 's',

393

"File to save CA certificates received in the caPubs field of 'ip' messages"},

394

395

OPT_SECTION("Client authentication"){ OPT_SECTION_STR, 1, '-', "Client authentication" " options:\n"
},

396

{"ref", OPT_REF, 's',

397

"Reference value to use as senderKID in case no -cert is given"},

398

{"secret", OPT_SECRET, 's',

399

"Prefer PBM (over signatures) for protecting msgs with given password source"},

400

{"cert", OPT_CERT, 's',

401

"Client's CMP signer certificate; its public key must match the -key argument"},

402

{OPT_MORE_STR, 0, 0,

403

"This also used as default reference for subject DN and SANs."},

404

{OPT_MORE_STR, 0, 0,

405

"Any further certs included are appended to the untrusted certs"},

406

{"own_trusted", OPT_OWN_TRUSTED, 's',

407

"Optional certs to verify chain building for own CMP signer cert"},

408

{"key", OPT_KEY, 's', "CMP signer private key, not used when -secret given"},

409

{"keypass", OPT_KEYPASS, 's',

410

"Client private key (and cert and old cert) pass phrase source"},

411

{"digest", OPT_DIGEST, 's',

412

"Digest to use in message protection and POPO signatures. Default \"sha256\""},

413

{"mac", OPT_MAC, 's',

414

"MAC algorithm to use in PBM-based message protection. Default \"hmac-sha1\""},

415

{"extracerts", OPT_EXTRACERTS, 's',

416

"Certificates to append in extraCerts field of outgoing messages."},

417

{OPT_MORE_STR, 0, 0,

418

"This can be used as the default CMP signer cert chain to include"},

419

{"unprotected_requests", OPT_UNPROTECTED_REQUESTS, '-',

420

"Send messages without CMP-level protection"},

421

422

OPT_SECTION("Credentials format"){ OPT_SECTION_STR, 1, '-', "Credentials format" " options:\n"
},

423

{"certform", OPT_CERTFORM, 's',

424

"Format (PEM or DER) to use when saving a certificate to a file. Default PEM"},

425

{"keyform", OPT_KEYFORM, 's',

426

"Format of the key input (ENGINE, other values ignored)"},

427

{"otherpass", OPT_OTHERPASS, 's',

428

"Pass phrase source potentially needed for loading certificates of others"},

429

#ifndef OPENSSL_NO_ENGINE

430

{"engine", OPT_ENGINE, 's',

431

"Use crypto engine with given identifier, possibly a hardware device."},

432

{OPT_MORE_STR, 0, 0,

433

"Engines may also be defined in OpenSSL config file engine section."},

434

#endif

435

OPT_PROV_OPTIONS{ OPT_SECTION_STR, 1, '-', "Provider" " options:\n" }, { "provider-path"
, OPT_PROV_PROVIDER_PATH, 's', "Provider load path (must be before 'provider' argument if required)"
}, { "provider", OPT_PROV_PROVIDER, 's', "Provider to load (can be specified multiple times)"
}, { "propquery", OPT_PROV_PROPQUERY, 's', "Property query used when fetching algorithms"
},

436

OPT_R_OPTIONS{ OPT_SECTION_STR, 1, '-', "Random state" " options:\n" }, {"rand"
, OPT_R_RAND, 's', "Load the given file(s) into the random number generator"
}, {"writerand", OPT_R_WRITERAND, '>', "Write random data to the specified file"
},

437

438

OPT_SECTION("TLS connection"){ OPT_SECTION_STR, 1, '-', "TLS connection" " options:\n" },

439

#ifdef OPENSSL_NO_SOCK

440

{OPT_MORE_STR, 0, 0,

441

"NOTE: -tls_used and all other TLS options not supported due to no-sock build"},

442

#else

443

{"tls_used", OPT_TLS_USED, '-',

444

"Enable using TLS (also when other TLS options are not set)"},

445

{"tls_cert", OPT_TLS_CERT, 's',

446

"Client's TLS certificate. May include chain to be provided to TLS server"},

447

{"tls_key", OPT_TLS_KEY, 's',

448

"Private key for the client's TLS certificate"},

449

{"tls_keypass", OPT_TLS_KEYPASS, 's',

450

"Pass phrase source for the client's private TLS key (and TLS cert)"},

451

{"tls_extra", OPT_TLS_EXTRA, 's',

452

"Extra certificates to provide to TLS server during TLS handshake"},

453

{"tls_trusted", OPT_TLS_TRUSTED, 's',

454

"Trusted certificates to use for verifying the TLS server certificate;"},

455

{OPT_MORE_STR, 0, 0, "this implies host name validation"},

456

{"tls_host", OPT_TLS_HOST, 's',

457

"Address to be checked (rather than -server) during TLS host name validation"},

458

#endif

459

460

OPT_SECTION("Client-side debugging"){ OPT_SECTION_STR, 1, '-', "Client-side debugging" " options:\n"
},

461

{"batch", OPT_BATCH, '-',

462

"Do not interactively prompt for input when a password is required etc."},

463

{"repeat", OPT_REPEAT, 'p',

464

"Invoke the transaction the given positive number of times. Default 1"},

465

{"reqin", OPT_REQIN, 's', "Take sequence of CMP requests from file(s)"},

466

{"reqin_new_tid", OPT_REQIN_NEW_TID, '-',

467

"Use fresh transactionID for CMP requests read from -reqin"},

468

{"reqout", OPT_REQOUT, 's', "Save sequence of CMP requests to file(s)"},

469

{"rspin", OPT_RSPIN, 's',

470

"Process sequence of CMP responses provided in file(s), skipping server"},

471

{"rspout", OPT_RSPOUT, 's', "Save sequence of CMP responses to file(s)"},

472

473

{"use_mock_srv", OPT_USE_MOCK_SRV, '-',

474

"Use internal mock server at API level, bypassing socket-based HTTP"},

475

476

OPT_SECTION("Mock server"){ OPT_SECTION_STR, 1, '-', "Mock server" " options:\n" },

477

#ifdef OPENSSL_NO_SOCK

478

{OPT_MORE_STR, 0, 0,

479

"NOTE: -port and -max_msgs not supported due to no-sock build"},

480

#else

481

{"port", OPT_PORT, 's',

482

"Act as HTTP-based mock server listening on given port"},

483

{"max_msgs", OPT_MAX_MSGS, 'N',

484

"max number of messages handled by HTTP mock server. Default: 0 = unlimited"},

485

#endif

486

487

{"srv_ref", OPT_SRV_REF, 's',

488

"Reference value to use as senderKID of server in case no -srv_cert is given"},

489

{"srv_secret", OPT_SRV_SECRET, 's',

490

"Password source for server authentication with a pre-shared key (secret)"},

491

{"srv_cert", OPT_SRV_CERT, 's', "Certificate of the server"},

492

{"srv_key", OPT_SRV_KEY, 's',

493

"Private key used by the server for signing messages"},

494

{"srv_keypass", OPT_SRV_KEYPASS, 's',

495

"Server private key (and cert) pass phrase source"},

496

497

{"srv_trusted", OPT_SRV_TRUSTED, 's',

498

"Trusted certificates for client authentication"},

499

{"srv_untrusted", OPT_SRV_UNTRUSTED, 's',

500

"Intermediate certs that may be useful for verifying CMP protection"},

501

{"rsp_cert", OPT_RSP_CERT, 's',

502

"Certificate to be returned as mock enrollment result"},

503

{"rsp_extracerts", OPT_RSP_EXTRACERTS, 's',

504

"Extra certificates to be included in mock certification responses"},

505

{"rsp_capubs", OPT_RSP_CAPUBS, 's',

506

"CA certificates to be included in mock ip response"},

507

{"poll_count", OPT_POLL_COUNT, 'N',

508

"Number of times the client must poll before receiving a certificate"},

509

{"check_after", OPT_CHECK_AFTER, 'N',

510

"The check_after value (time to wait) to include in poll response"},

511

{"grant_implicitconf", OPT_GRANT_IMPLICITCONF, '-',

512

"Grant implicit confirmation of newly enrolled certificate"},

513

514

{"pkistatus", OPT_PKISTATUS, 'N',

515

"PKIStatus to be included in server response. Possible values: 0..6"},

516

{"failure", OPT_FAILURE, 'N',

517

"A single failure info bit number to include in server response, 0..26"},

518

{"failurebits", OPT_FAILUREBITS, 'N',

519

"Number representing failure bits to include in server response, 0..2^27 - 1"},

520

{"statusstring", OPT_STATUSSTRING, 's',

521

"Status string to be included in server response"},

522

{"send_error", OPT_SEND_ERROR, '-',

523

"Force server to reply with error message"},

524

{"send_unprotected", OPT_SEND_UNPROTECTED, '-',

525

"Send response messages without CMP-level protection"},

526

{"send_unprot_err", OPT_SEND_UNPROT_ERR, '-',

527

"In case of negative responses, server shall send unprotected error messages,"},

528

{OPT_MORE_STR, 0, 0,

529

"certificate responses (ip/cp/kup), and revocation responses (rp)."},

530

{OPT_MORE_STR, 0, 0,

531

"WARNING: This setting leads to behavior violating RFC 4210"},

532

{"accept_unprotected", OPT_ACCEPT_UNPROTECTED, '-',

533

"Accept missing or invalid protection of requests"},

534

{"accept_unprot_err", OPT_ACCEPT_UNPROT_ERR, '-',

535

"Accept unprotected error messages from client"},

536

{"accept_raverified", OPT_ACCEPT_RAVERIFIED, '-',

537

"Accept RAVERIFIED as proof-of-possession (POPO)"},

538

539

OPT_V_OPTIONS{ OPT_SECTION_STR, 1, '-', "Validation" " options:\n" }, { "policy"
, OPT_V_POLICY, 's', "adds policy to the acceptable policy set"
}, { "purpose", OPT_V_PURPOSE, 's', "certificate chain purpose"
}, { "verify_name", OPT_V_VERIFY_NAME, 's', "verification policy name"
}, { "verify_depth", OPT_V_VERIFY_DEPTH, 'n', "chain depth limit"
}, { "auth_level", OPT_V_VERIFY_AUTH_LEVEL, 'n', "chain authentication security level"
}, { "attime", OPT_V_ATTIME, 'M', "verification epoch time" }
, { "verify_hostname", OPT_V_VERIFY_HOSTNAME, 's', "expected peer hostname"
}, { "verify_email", OPT_V_VERIFY_EMAIL, 's', "expected peer email"
}, { "verify_ip", OPT_V_VERIFY_IP, 's', "expected peer IP address"
}, { "ignore_critical", OPT_V_IGNORE_CRITICAL, '-', "permit unhandled critical extensions"
}, { "issuer_checks", OPT_V_ISSUER_CHECKS, '-', "(deprecated)"
}, { "crl_check", OPT_V_CRL_CHECK, '-', "check leaf certificate revocation"
}, { "crl_check_all", OPT_V_CRL_CHECK_ALL, '-', "check full chain revocation"
}, { "policy_check", OPT_V_POLICY_CHECK, '-', "perform rfc5280 policy checks"
}, { "explicit_policy", OPT_V_EXPLICIT_POLICY, '-', "set policy variable require-explicit-policy"
}, { "inhibit_any", OPT_V_INHIBIT_ANY, '-', "set policy variable inhibit-any-policy"
}, { "inhibit_map", OPT_V_INHIBIT_MAP, '-', "set policy variable inhibit-policy-mapping"
}, { "x509_strict", OPT_V_X509_STRICT, '-', "disable certificate compatibility work-arounds"
}, { "extended_crl", OPT_V_EXTENDED_CRL, '-', "enable extended CRL features"
}, { "use_deltas", OPT_V_USE_DELTAS, '-', "use delta CRLs"}, {
"policy_print", OPT_V_POLICY_PRINT, '-', "print policy processing diagnostics"
}, { "check_ss_sig", OPT_V_CHECK_SS_SIG, '-', "check root CA self-signatures"
}, { "trusted_first", OPT_V_TRUSTED_FIRST, '-', "search trust store first (default)"
}, { "suiteB_128_only", OPT_V_SUITEB_128_ONLY, '-', "Suite B 128-bit-only mode"
}, { "suiteB_128", OPT_V_SUITEB_128, '-', "Suite B 128-bit mode allowing 192-bit algorithms"
}, { "suiteB_192", OPT_V_SUITEB_192, '-', "Suite B 192-bit-only mode"
}, { "partial_chain", OPT_V_PARTIAL_CHAIN, '-', "accept chains anchored by intermediate trust-store CAs"
}, { "no_alt_chains", OPT_V_NO_ALT_CHAINS, '-', "(deprecated)"
}, { "no_check_time", OPT_V_NO_CHECK_TIME, '-', "ignore certificate validity time"
}, { "allow_proxy_certs", OPT_V_ALLOW_PROXY_CERTS, '-', "allow the use of proxy certificates"
},

540

{NULL((void*)0)}

541

};

542

543

typedef union {

544

char **txt;

545

int *num;

546

long *num_long;

547

} varref;

548

static varref cmp_vars[] = { /* must be in same order as enumerated above! */

549

{&opt_config}, {&opt_section}, {(char **)&opt_verbosity},

550

551

{&opt_cmd_s}, {&opt_infotype_s}, {&opt_geninfo},

552

553

{&opt_newkey}, {&opt_newkeypass}, {&opt_subject}, {&opt_issuer},

554

{(char **)&opt_days}, {&opt_reqexts},

555

{&opt_sans}, {(char **)&opt_san_nodefault},

556

{&opt_policies}, {&opt_policy_oids}, {(char **)&opt_policy_oids_critical},

557

{(char **)&opt_popo}, {&opt_csr},

558

{&opt_out_trusted},

559

{(char **)&opt_implicit_confirm}, {(char **)&opt_disable_confirm},

560

{&opt_certout}, {&opt_chainout},

561

562

{&opt_oldcert}, {(char **)&opt_revreason},

563

564

#ifndef OPENSSL_NO_SOCK

565

{&opt_server}, {&opt_proxy}, {&opt_no_proxy},

566

#endif

567

{&opt_recipient}, {&opt_path}, {(char **)&opt_keep_alive},

568

{(char **)&opt_msg_timeout}, {(char **)&opt_total_timeout},

569

570

{&opt_trusted}, {&opt_untrusted}, {&opt_srvcert},

571

{&opt_expect_sender},

572

{(char **)&opt_ignore_keyusage}, {(char **)&opt_unprotected_errors},

573

{&opt_extracertsout}, {&opt_cacertsout},

574

575

{&opt_ref}, {&opt_secret},

576

{&opt_cert}, {&opt_own_trusted}, {&opt_key}, {&opt_keypass},

577

{&opt_digest}, {&opt_mac}, {&opt_extracerts},

578

{(char **)&opt_unprotected_requests},

579

580

{&opt_certform_s}, {&opt_keyform_s},

581

{&opt_otherpass},

582

#ifndef OPENSSL_NO_ENGINE

583

{&opt_engine},

584

#endif

585

586

#ifndef OPENSSL_NO_SOCK

587

{(char **)&opt_tls_used}, {&opt_tls_cert}, {&opt_tls_key},

588

{&opt_tls_keypass},

589

{&opt_tls_extra}, {&opt_tls_trusted}, {&opt_tls_host},

590

#endif

591

592

{(char **)&opt_batch}, {(char **)&opt_repeat},

593

{&opt_reqin}, {(char **)&opt_reqin_new_tid},

594

{&opt_reqout}, {&opt_rspin}, {&opt_rspout},

595

596

{(char **)&opt_use_mock_srv},

597

#ifndef OPENSSL_NO_SOCK

598

{&opt_port}, {(char **)&opt_max_msgs},

599

#endif

600

{&opt_srv_ref}, {&opt_srv_secret},

601

{&opt_srv_cert}, {&opt_srv_key}, {&opt_srv_keypass},

602

{&opt_srv_trusted}, {&opt_srv_untrusted},

603

{&opt_rsp_cert}, {&opt_rsp_extracerts}, {&opt_rsp_capubs},

604

{(char **)&opt_poll_count}, {(char **)&opt_check_after},

605

{(char **)&opt_grant_implicitconf},

606

{(char **)&opt_pkistatus}, {(char **)&opt_failure},

607

{(char **)&opt_failurebits}, {&opt_statusstring},

608

{(char **)&opt_send_error}, {(char **)&opt_send_unprotected},

609

{(char **)&opt_send_unprot_err}, {(char **)&opt_accept_unprotected},

610

{(char **)&opt_accept_unprot_err}, {(char **)&opt_accept_raverified},

611

612

{NULL((void*)0)}

613

};

614

615

#define FUNC(strcmp(__func__, "(unknown function)") == 0 ? "CMP" : __func__
) (strcmp(OPENSSL_FUNC__func__, "(unknown function)") == 0 \

616

? "CMP" : OPENSSL_FUNC__func__)

617

#define CMP_print(bio, level, prefix, msg, a1, a2, a3)((void)(level > opt_verbosity ? 0 : (BIO_printf(bio, "%s:%s:%d:CMP %s: "
msg "\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP"
: __func__), "../deps/openssl/openssl/apps/cmp.c", 617, prefix
, a1, a2, a3)))) \

618

((void)(level > opt_verbosity ? 0 : \

619

(BIO_printf(bio, "%s:%s:%d:CMP %s: " msg "\n", \

620

FUNC(strcmp(__func__, "(unknown function)") == 0 ? "CMP" : __func__
), OPENSSL_FILE"../deps/openssl/openssl/apps/cmp.c", OPENSSL_LINE620, prefix, a1, a2, a3))))

621

#define CMP_DEBUG(m, a1, a2, a3)((void)(7 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
m "\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP"
: __func__), "../deps/openssl/openssl/apps/cmp.c", 621, "debug"
, a1, a2, a3)))) \

622

CMP_print(bio_out, OSSL_CMP_LOG_DEBUG, "debug", m, a1, a2, a3)((void)(7 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
m "\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP"
: __func__), "../deps/openssl/openssl/apps/cmp.c", 622, "debug"
, a1, a2, a3))))

623

#define CMP_debug(msg)((void)(7 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
msg"%s%s%s" "\n", (strcmp(__func__, "(unknown function)") ==
0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c",
623, "debug", "", "", "")))) CMP_DEBUG(msg"%s%s%s", "", "", "")((void)(7 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
msg"%s%s%s" "\n", (strcmp(__func__, "(unknown function)") ==
0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c",
623, "debug", "", "", ""))))

624

#define CMP_debug1(msg, a1)((void)(7 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
msg"%s%s" "\n", (strcmp(__func__, "(unknown function)") == 0
? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c", 624
, "debug", a1, "", "")))) CMP_DEBUG(msg"%s%s", a1, "", "")((void)(7 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
msg"%s%s" "\n", (strcmp(__func__, "(unknown function)") == 0
? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c", 624
, "debug", a1, "", ""))))

625

#define CMP_debug2(msg, a1, a2)((void)(7 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
msg"%s" "\n", (strcmp(__func__, "(unknown function)") == 0 ?
"CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c", 625
, "debug", a1, a2, "")))) CMP_DEBUG(msg"%s", a1, a2, "")((void)(7 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
msg"%s" "\n", (strcmp(__func__, "(unknown function)") == 0 ?
"CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c", 625
, "debug", a1, a2, ""))))

626

#define CMP_debug3(msg, a1, a2, a3)((void)(7 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
msg "\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP"
: __func__), "../deps/openssl/openssl/apps/cmp.c", 626, "debug"
, a1, a2, a3)))) CMP_DEBUG(msg, a1, a2, a3)((void)(7 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
msg "\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP"
: __func__), "../deps/openssl/openssl/apps/cmp.c", 626, "debug"
, a1, a2, a3))))

627

#define CMP_INFO(msg, a1, a2, a3)((void)(6 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
msg "\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP"
: __func__), "../deps/openssl/openssl/apps/cmp.c", 627, "info"
, a1, a2, a3)))) \

628

CMP_print(bio_out, OSSL_CMP_LOG_INFO, "info", msg, a1, a2, a3)((void)(6 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
msg "\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP"
: __func__), "../deps/openssl/openssl/apps/cmp.c", 628, "info"
, a1, a2, a3))))

629

#define CMP_info(msg)((void)(6 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
msg"%s%s%s" "\n", (strcmp(__func__, "(unknown function)") ==
0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c",
629, "info", "", "", "")))) CMP_INFO(msg"%s%s%s", "", "", "")((void)(6 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
msg"%s%s%s" "\n", (strcmp(__func__, "(unknown function)") ==
0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c",
629, "info", "", "", ""))))

630

#define CMP_info1(msg, a1)((void)(6 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
msg"%s%s" "\n", (strcmp(__func__, "(unknown function)") == 0
? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c", 630
, "info", a1, "", "")))) CMP_INFO(msg"%s%s", a1, "", "")((void)(6 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
msg"%s%s" "\n", (strcmp(__func__, "(unknown function)") == 0
? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c", 630
, "info", a1, "", ""))))

631

#define CMP_info2(msg, a1, a2)((void)(6 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
msg"%s" "\n", (strcmp(__func__, "(unknown function)") == 0 ?
"CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c", 631
, "info", a1, a2, "")))) CMP_INFO(msg"%s", a1, a2, "")((void)(6 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
msg"%s" "\n", (strcmp(__func__, "(unknown function)") == 0 ?
"CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c", 631
, "info", a1, a2, ""))))

632

#define CMP_info3(msg, a1, a2, a3)((void)(6 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
msg "\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP"
: __func__), "../deps/openssl/openssl/apps/cmp.c", 632, "info"
, a1, a2, a3)))) CMP_INFO(msg, a1, a2, a3)((void)(6 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
msg "\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP"
: __func__), "../deps/openssl/openssl/apps/cmp.c", 632, "info"
, a1, a2, a3))))

633

#define CMP_WARN(m, a1, a2, a3)((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
m "\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP"
: __func__), "../deps/openssl/openssl/apps/cmp.c", 633, "warning"
, a1, a2, a3)))) \

634

CMP_print(bio_out, OSSL_CMP_LOG_WARNING, "warning", m, a1, a2, a3)((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
m "\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP"
: __func__), "../deps/openssl/openssl/apps/cmp.c", 634, "warning"
, a1, a2, a3))))

635

#define CMP_warn(msg)((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
msg"%s%s%s" "\n", (strcmp(__func__, "(unknown function)") ==
0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c",
635, "warning", "", "", "")))) CMP_WARN(msg"%s%s%s", "", "", "")((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
msg"%s%s%s" "\n", (strcmp(__func__, "(unknown function)") ==
0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c",
635, "warning", "", "", ""))))

636

#define CMP_warn1(msg, a1)((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
msg"%s%s" "\n", (strcmp(__func__, "(unknown function)") == 0
? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c", 636
, "warning", a1, "", "")))) CMP_WARN(msg"%s%s", a1, "", "")((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
msg"%s%s" "\n", (strcmp(__func__, "(unknown function)") == 0
? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c", 636
, "warning", a1, "", ""))))

637

#define CMP_warn2(msg, a1, a2)((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
msg"%s" "\n", (strcmp(__func__, "(unknown function)") == 0 ?
"CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c", 637
, "warning", a1, a2, "")))) CMP_WARN(msg"%s", a1, a2, "")((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
msg"%s" "\n", (strcmp(__func__, "(unknown function)") == 0 ?
"CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c", 637
, "warning", a1, a2, ""))))

638

#define CMP_warn3(msg, a1, a2, a3)((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
msg "\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP"
: __func__), "../deps/openssl/openssl/apps/cmp.c", 638, "warning"
, a1, a2, a3)))) CMP_WARN(msg, a1, a2, a3)((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
msg "\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP"
: __func__), "../deps/openssl/openssl/apps/cmp.c", 638, "warning"
, a1, a2, a3))))

639

#define CMP_ERR(msg, a1, a2, a3)((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
msg "\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP"
: __func__), "../deps/openssl/openssl/apps/cmp.c", 639, "error"
, a1, a2, a3)))) \

640

CMP_print(bio_err, OSSL_CMP_LOG_ERR, "error", msg, a1, a2, a3)((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
msg "\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP"
: __func__), "../deps/openssl/openssl/apps/cmp.c", 640, "error"
, a1, a2, a3))))

641

#define CMP_err(msg)((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
msg"%s%s%s" "\n", (strcmp(__func__, "(unknown function)") ==
0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c",
641, "error", "", "", "")))) CMP_ERR(msg"%s%s%s", "", "", "")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
msg"%s%s%s" "\n", (strcmp(__func__, "(unknown function)") ==
0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c",
641, "error", "", "", ""))))

642

#define CMP_err1(msg, a1)((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
msg"%s%s" "\n", (strcmp(__func__, "(unknown function)") == 0
? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c", 642
, "error", a1, "", "")))) CMP_ERR(msg"%s%s", a1, "", "")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
msg"%s%s" "\n", (strcmp(__func__, "(unknown function)") == 0
? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c", 642
, "error", a1, "", ""))))

643

#define CMP_err2(msg, a1, a2)((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
msg"%s" "\n", (strcmp(__func__, "(unknown function)") == 0 ?
"CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c", 643
, "error", a1, a2, "")))) CMP_ERR(msg"%s", a1, a2, "")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
msg"%s" "\n", (strcmp(__func__, "(unknown function)") == 0 ?
"CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c", 643
, "error", a1, a2, ""))))

644

#define CMP_err3(msg, a1, a2, a3)((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
msg "\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP"
: __func__), "../deps/openssl/openssl/apps/cmp.c", 644, "error"
, a1, a2, a3)))) CMP_ERR(msg, a1, a2, a3)((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
msg "\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP"
: __func__), "../deps/openssl/openssl/apps/cmp.c", 644, "error"
, a1, a2, a3))))

645

646

static int print_to_bio_out(const char *func, const char *file, int line,

647

OSSL_CMP_severity level, const char *msg)

648

{

649

return OSSL_CMP_print_to_bio(bio_out, func, file, line, level, msg);

650

}

651

652

static int print_to_bio_err(const char *func, const char *file, int line,

653

OSSL_CMP_severity level, const char *msg)

654

{

655

return OSSL_CMP_print_to_bio(bio_err, func, file, line, level, msg);

656

}

657

658

static int set_verbosity(int level)

659

{

660

if (level < OSSL_CMP_LOG_EMERG0 || level > OSSL_CMP_LOG_MAX8) {

661

CMP_err1("Logging verbosity level %d out of range (0 .. 8)", level)((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"Logging verbosity level %d out of range (0 .. 8)""%s%s" "\n"
, (strcmp(__func__, "(unknown function)") == 0 ? "CMP" : __func__
), "../deps/openssl/openssl/apps/cmp.c", 661, "error", level,
"", ""))));

662

return 0;

663

}

664

opt_verbosity = level;

665

return 1;

666

}

667

668

static EVP_PKEY *load_key_pwd(const char *uri, int format,

669

const char *pass, ENGINE *eng, const char *desc)

670

{

671

char *pass_string = get_passwd(pass, desc);

672

EVP_PKEY *pkey = load_key(uri, format, 0, pass_string, eng, desc);

673

674

clear_free(pass_string);

675

return pkey;

676

}

677

678

static X509 *load_cert_pwd(const char *uri, const char *pass, const char *desc)

679

{

680

X509 *cert;

681

char *pass_string = get_passwd(pass, desc);

682

683

cert = load_cert_pass(uri, FORMAT_UNDEF0, 0, pass_string, desc);

684

clear_free(pass_string);

685

return cert;

686

}

687

688

static X509_REQ *load_csr_autofmt(const char *infile, const char *desc)

689

{

690

X509_REQ *csr;

691

BIO *bio_bak = bio_err;

692

693

bio_err = NULL((void*)0); /* do not show errors on more than one try */

694

csr = load_csr(infile, FORMAT_PEM(5 | 0x8000), desc);

695

bio_err = bio_bak;

696

if (csr == NULL((void*)0)) {

697

ERR_clear_error();

698

csr = load_csr(infile, FORMAT_ASN14, desc);

699

}

700

if (csr == NULL((void*)0)) {

701

ERR_print_errors(bio_err);

702

BIO_printf(bio_err, "error: unable to load %s from file '%s'\n", desc,

703

infile);

704

} else {

705

EVP_PKEY *pkey = X509_REQ_get0_pubkey(csr);

706

int ret = do_X509_REQ_verify(csr, pkey, NULL((void*)0) /* vfyopts */);

707

708

if (pkey == NULL((void*)0) || ret < 0)

709

CMP_warn("error while verifying CSR self-signature")((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"error while verifying CSR self-signature""%s%s%s" "\n", (strcmp
(__func__, "(unknown function)") == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 709, "warning", "", "", ""))));

710

else if (ret == 0)

711

CMP_warn("CSR self-signature does not match the contents")((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"CSR self-signature does not match the contents""%s%s%s" "\n"
, (strcmp(__func__, "(unknown function)") == 0 ? "CMP" : __func__
), "../deps/openssl/openssl/apps/cmp.c", 711, "warning", "", ""
, ""))));

712

}

713

return csr;

714

}

715

716

/* set expected host name/IP addr and clears the email addr in the given ts */

717

static int truststore_set_host_etc(X509_STORE *ts, const char *host)

718

{

719

X509_VERIFY_PARAM *ts_vpm = X509_STORE_get0_param(ts);

720

721

/* first clear any host names, IP, and email addresses */

722

if (!X509_VERIFY_PARAM_set1_host(ts_vpm, NULL((void*)0), 0)

723

|| !X509_VERIFY_PARAM_set1_ip(ts_vpm, NULL((void*)0), 0)

724

|| !X509_VERIFY_PARAM_set1_email(ts_vpm, NULL((void*)0), 0))

725

return 0;

726

X509_VERIFY_PARAM_set_hostflags(ts_vpm,

727

X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT0x1 |

728

X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS0x4);

729

return (host != NULL((void*)0) && X509_VERIFY_PARAM_set1_ip_asc(ts_vpm, host))

730

|| X509_VERIFY_PARAM_set1_host(ts_vpm, host, 0);

731

}

732

733

/* write OSSL_CMP_MSG DER-encoded to the specified file name item */

734

static int write_PKIMESSAGE(const OSSL_CMP_MSG *msg, char **filenames)

735

{

736

char *file;

737

738

if (msg == NULL((void*)0) || filenames == NULL((void*)0)) {

739

CMP_err("NULL arg to write_PKIMESSAGE")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"NULL arg to write_PKIMESSAGE""%s%s%s" "\n", (strcmp(__func__
, "(unknown function)") == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 739, "error", "", "", ""))));

740

return 0;

741

}

742

if (*filenames == NULL((void*)0)) {

743

CMP_err("not enough file names provided for writing PKIMessage")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"not enough file names provided for writing PKIMessage""%s%s%s"
"\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP" :
__func__), "../deps/openssl/openssl/apps/cmp.c", 743, "error"
, "", "", ""))));

744

return 0;

745

}

746

747

file = *filenames;

748

*filenames = next_item(file);

749

if (OSSL_CMP_MSG_write(file, msg) < 0) {

750

CMP_err1("cannot write PKIMessage to file '%s'", file)((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"cannot write PKIMessage to file '%s'""%s%s" "\n", (strcmp(__func__
, "(unknown function)") == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 750, "error", file, "", ""))));

751

return 0;

752

}

753

return 1;

754

}

755

756

/* read DER-encoded OSSL_CMP_MSG from the specified file name item */

757

static OSSL_CMP_MSG *read_PKIMESSAGE(char **filenames)

758

{

759

char *file;

760

OSSL_CMP_MSG *ret;

761

762

if (filenames == NULL((void*)0)) {

763

CMP_err("NULL arg to read_PKIMESSAGE")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"NULL arg to read_PKIMESSAGE""%s%s%s" "\n", (strcmp(__func__
, "(unknown function)") == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 763, "error", "", "", ""))));

764

return NULL((void*)0);

765

}

766

if (*filenames == NULL((void*)0)) {

767

CMP_err("not enough file names provided for reading PKIMessage")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"not enough file names provided for reading PKIMessage""%s%s%s"
"\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP" :
__func__), "../deps/openssl/openssl/apps/cmp.c", 767, "error"
, "", "", ""))));

768

return NULL((void*)0);

769

}

770

771

file = *filenames;

772

*filenames = next_item(file);

773

774

ret = OSSL_CMP_MSG_read(file, app_get0_libctx(), app_get0_propq());

775

if (ret == NULL((void*)0))

776

CMP_err1("cannot read PKIMessage from file '%s'", file)((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"cannot read PKIMessage from file '%s'""%s%s" "\n", (strcmp(
__func__, "(unknown function)") == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 776, "error", file, "", ""))));

777

return ret;

778

}

779

780

/*-

781

* Sends the PKIMessage req and on success place the response in *res

782

* basically like OSSL_CMP_MSG_http_perform(), but in addition allows

783

* to dump the sequence of requests and responses to files and/or

784

* to take the sequence of requests and responses from files.

785

*/

786

static OSSL_CMP_MSG *read_write_req_resp(OSSL_CMP_CTX *ctx,

787

const OSSL_CMP_MSG *req)

788

{

789

OSSL_CMP_MSG *req_new = NULL((void*)0);

790

OSSL_CMP_MSG *res = NULL((void*)0);

791

OSSL_CMP_PKIHEADER *hdr;

792

const char *prev_opt_rspin = opt_rspin;

793

794

if (req != NULL((void*)0) && opt_reqout != NULL((void*)0)

795

&& !write_PKIMESSAGE(req, &opt_reqout))

796

goto err;

797

if (opt_reqin != NULL((void*)0) && opt_rspin == NULL((void*)0)) {

798

if ((req_new = read_PKIMESSAGE(&opt_reqin)) == NULL((void*)0))

799

goto err;

800

/*-

801

* The transaction ID in req_new read from opt_reqin may not be fresh.

802

* In this case the server may complain "Transaction id already in use."

803

* The following workaround unfortunately requires re-protection.

804

*/

805

if (opt_reqin_new_tid

806

&& !OSSL_CMP_MSG_update_transactionID(ctx, req_new))

807

goto err;

808

}

809

810

if (opt_rspin != NULL((void*)0)) {

811

res = read_PKIMESSAGE(&opt_rspin);

812

} else {

813

const OSSL_CMP_MSG *actual_req = opt_reqin != NULL((void*)0) ? req_new : req;

814

815

res = opt_use_mock_srv

816

? OSSL_CMP_CTX_server_perform(ctx, actual_req)

817

: OSSL_CMP_MSG_http_perform(ctx, actual_req);

818

}

819

if (res == NULL((void*)0))

820

goto err;

821

822

if (opt_reqin != NULL((void*)0) || prev_opt_rspin != NULL((void*)0)) {

823

/* need to satisfy nonce and transactionID checks */

824

ASN1_OCTET_STRING *nonce;

825

ASN1_OCTET_STRING *tid;

826

827

hdr = OSSL_CMP_MSG_get0_header(res);

828

nonce = OSSL_CMP_HDR_get0_recipNonce(hdr);

829

tid = OSSL_CMP_HDR_get0_transactionID(hdr);

830

if (!OSSL_CMP_CTX_set1_senderNonce(ctx, nonce)

831

|| !OSSL_CMP_CTX_set1_transactionID(ctx, tid)) {

832

OSSL_CMP_MSG_free(res);

833

res = NULL((void*)0);

834

goto err;

835

}

836

}

837

838

if (opt_rspout != NULL((void*)0) && !write_PKIMESSAGE(res, &opt_rspout)) {

839

OSSL_CMP_MSG_free(res);

840

res = NULL((void*)0);

841

}

842

843

err:

844

OSSL_CMP_MSG_free(req_new);

845

return res;

846

}

847

848

static int set_name(const char *str,

849

int (*set_fn) (OSSL_CMP_CTX *ctx, const X509_NAME *name),

850

OSSL_CMP_CTX *ctx, const char *desc)

851

{

852

if (str != NULL((void*)0)) {

853

X509_NAME *n = parse_name(str, MBSTRING_ASC(0x1000|1), 1, desc);

854

855

if (n == NULL((void*)0))

856

return 0;

857

if (!(*set_fn) (ctx, n)) {

858

X509_NAME_free(n);

859

CMP_err("out of memory")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"out of memory""%s%s%s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 859, "error", "", "", ""))));

860

return 0;

861

}

862

X509_NAME_free(n);

863

}

864

return 1;

865

}

866

867

static int set_gennames(OSSL_CMP_CTX *ctx, char *names, const char *desc)

868

{

869

char *next;

870

871

for (; names != NULL((void*)0); names = next) {

872

GENERAL_NAME *n;

873

874

next = next_item(names);

875

if (strcmp(names, "critical") == 0) {

876

(void)OSSL_CMP_CTX_set_option(ctx,

877

OSSL_CMP_OPT_SUBJECTALTNAME_CRITICAL22,

878

1);

879

continue;

880

}

881

882

/* try IP address first, then URI or domain name */

883

(void)ERR_set_mark();

884

n = a2i_GENERAL_NAME(NULL((void*)0), NULL((void*)0), NULL((void*)0), GEN_IPADD7, names, 0);

885

if (n == NULL((void*)0))

886

n = a2i_GENERAL_NAME(NULL((void*)0), NULL((void*)0), NULL((void*)0),

887

strchr(names, ':') != NULL((void*)0) ? GEN_URI6 : GEN_DNS2,

888

names, 0);

889

(void)ERR_pop_to_mark();

890

891

if (n == NULL((void*)0)) {

892

CMP_err2("bad syntax of %s '%s'", desc, names)((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"bad syntax of %s '%s'""%s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 892, "error", desc, names, ""))));

893

return 0;

894

}

895

if (!OSSL_CMP_CTX_push1_subjectAltName(ctx, n)) {

896

GENERAL_NAME_free(n);

897

CMP_err("out of memory")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"out of memory""%s%s%s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 897, "error", "", "", ""))));

898

return 0;

899

}

900

GENERAL_NAME_free(n);

901

}

902

return 1;

903

}

904

905

static X509_STORE *load_trusted(char *input, int for_new_cert, const char *desc)

906

{

907

X509_STORE *ts = load_certstore(input, opt_otherpass, desc, vpm);

908

909

if (ts == NULL((void*)0))

910

return NULL((void*)0);

911

X509_STORE_set_verify_cb(ts, X509_STORE_CTX_print_verify_cb);

912

913

/* copy vpm to store */

914

if (X509_STORE_set1_param(ts, vpm /* may be NULL */)

915

&& (for_new_cert || truststore_set_host_etc(ts, NULL((void*)0))))

916

return ts;

917

BIO_printf(bio_err, "error setting verification parameters for %s\n", desc);

918

OSSL_CMP_CTX_print_errors(cmp_ctx);

919

X509_STORE_free(ts);

920

return NULL((void*)0);

921

}

922

923

typedef int (*add_X509_stack_fn_t)(void *ctx, const STACK_OF(X509)struct stack_st_X509 *certs);

924

925

static int setup_certs(char *files, const char *desc, void *ctx,

926

add_X509_stack_fn_t set1_fn)

927

{

928

STACK_OF(X509)struct stack_st_X509 *certs;

929

int ok;

930

931

if (files == NULL((void*)0))

932

return 1;

933

if ((certs = load_certs_multifile(files, opt_otherpass, desc, vpm)) == NULL((void*)0))

934

return 0;

935

ok = (*set1_fn)(ctx, certs);

936

sk_X509_pop_free(certs, X509_free)OPENSSL_sk_pop_free(ossl_check_X509_sk_type(certs),ossl_check_X509_freefunc_type
(X509_free));

937

return ok;

938

}

939

940

941

/*

942

* parse and transform some options, checking their syntax.

943

* Returns 1 on success, 0 on error

944

*/

945

static int transform_opts(void)

946

{

947

if (opt_cmd_s != NULL((void*)0)) {

948

if (!strcmp(opt_cmd_s, "ir")) {

949

opt_cmd = CMP_IR;

950

} else if (!strcmp(opt_cmd_s, "kur")) {

951

opt_cmd = CMP_KUR;

952

} else if (!strcmp(opt_cmd_s, "cr")) {

953

opt_cmd = CMP_CR;

954

} else if (!strcmp(opt_cmd_s, "p10cr")) {

955

opt_cmd = CMP_P10CR;

956

} else if (!strcmp(opt_cmd_s, "rr")) {

957

opt_cmd = CMP_RR;

958

} else if (!strcmp(opt_cmd_s, "genm")) {

959

opt_cmd = CMP_GENM;

960

} else {

961

CMP_err1("unknown cmp command '%s'", opt_cmd_s)((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"unknown cmp command '%s'""%s%s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 961, "error", opt_cmd_s, "", ""))));

962

return 0;

963

}

964

} else {

965

CMP_err("no cmp command to execute")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"no cmp command to execute""%s%s%s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 965, "error", "", "", ""))));

966

return 0;

967

}

968

969

#ifndef OPENSSL_NO_ENGINE

970

# define FORMAT_OPTIONS (OPT_FMT_PEMDER(1L << 1) | OPT_FMT_PKCS12(1L << 2) | OPT_FMT_ENGINE(1L << 4))

971

#else

972

# define FORMAT_OPTIONS (OPT_FMT_PEMDER(1L << 1) | OPT_FMT_PKCS12(1L << 2))

973

#endif

974

975

if (opt_keyform_s != NULL((void*)0)

976

&& !opt_format(opt_keyform_s, FORMAT_OPTIONS, &opt_keyform)) {

977

CMP_err("unknown option given for key loading format")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"unknown option given for key loading format""%s%s%s" "\n", (
strcmp(__func__, "(unknown function)") == 0 ? "CMP" : __func__
), "../deps/openssl/openssl/apps/cmp.c", 977, "error", "", ""
, ""))));

978

return 0;

979

}

980

981

#undef FORMAT_OPTIONS

982

983

if (opt_certform_s != NULL((void*)0)

984

&& !opt_format(opt_certform_s, OPT_FMT_PEMDER(1L << 1), &opt_certform)) {

985

CMP_err("unknown option given for certificate storing format")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"unknown option given for certificate storing format""%s%s%s"
"\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP" :
__func__), "../deps/openssl/openssl/apps/cmp.c", 985, "error"
, "", "", ""))));

986

return 0;

987

}

988

989

return 1;

990

}

991

992

static OSSL_CMP_SRV_CTX *setup_srv_ctx(ENGINE *engine)

993

{

994

OSSL_CMP_CTX *ctx; /* extra CMP (client) ctx partly used by server */

995

OSSL_CMP_SRV_CTX *srv_ctx = ossl_cmp_mock_srv_new(app_get0_libctx(),

996

app_get0_propq());

997

998

if (srv_ctx == NULL((void*)0))

999

return NULL((void*)0);

1000

ctx = OSSL_CMP_SRV_CTX_get0_cmp_ctx(srv_ctx);

1001

1002

if (opt_srv_ref == NULL((void*)0)) {

1003

if (opt_srv_cert == NULL((void*)0)) {

1004

/* opt_srv_cert should determine the sender */

1005

CMP_err("must give -srv_ref for mock server if no -srv_cert given")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"must give -srv_ref for mock server if no -srv_cert given""%s%s%s"
"\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP" :
__func__), "../deps/openssl/openssl/apps/cmp.c", 1005, "error"
, "", "", ""))));

1006

goto err;

1007

}

1008

} else {

1009

if (!OSSL_CMP_CTX_set1_referenceValue(ctx, (unsigned char *)opt_srv_ref,

1010

strlen(opt_srv_ref)))

1011

goto err;

1012

}

1013

1014

if (opt_srv_secret != NULL((void*)0)) {

1015

int res;

1016

char *pass_str = get_passwd(opt_srv_secret, "PBMAC secret of mock server");

1017

1018

if (pass_str != NULL((void*)0)) {

1019

cleanse(opt_srv_secret);

1020

res = OSSL_CMP_CTX_set1_secretValue(ctx, (unsigned char *)pass_str,

1021

strlen(pass_str));

1022

clear_free(pass_str);

1023

if (res == 0)

1024

goto err;

1025

}

1026

} else if (opt_srv_cert == NULL((void*)0)) {

1027

CMP_err("mock server credentials must be given if -use_mock_srv or -port is used")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"mock server credentials must be given if -use_mock_srv or -port is used"
"%s%s%s" "\n", (strcmp(__func__, "(unknown function)") == 0 ?
"CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c", 1027
, "error", "", "", ""))));

1028

goto err;

1029

} else {

1030

CMP_warn("mock server will not be able to handle PBM-protected requests since -srv_secret is not given")((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"mock server will not be able to handle PBM-protected requests since -srv_secret is not given"
"%s%s%s" "\n", (strcmp(__func__, "(unknown function)") == 0 ?
"CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c", 1030
, "warning", "", "", ""))));

1031

}

1032

1033

if (opt_srv_secret == NULL((void*)0)

1034

&& ((opt_srv_cert == NULL((void*)0)) != (opt_srv_key == NULL((void*)0)))) {

1035

CMP_err("must give both -srv_cert and -srv_key options or neither")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"must give both -srv_cert and -srv_key options or neither""%s%s%s"
"\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP" :
__func__), "../deps/openssl/openssl/apps/cmp.c", 1035, "error"
, "", "", ""))));

1036

goto err;

1037

}

1038

if (opt_srv_cert != NULL((void*)0)) {

1039

X509 *srv_cert = load_cert_pwd(opt_srv_cert, opt_srv_keypass,

1040

"certificate of the mock server");

1041

1042

if (srv_cert == NULL((void*)0) || !OSSL_CMP_CTX_set1_cert(ctx, srv_cert)) {

1043

X509_free(srv_cert);

1044

goto err;

1045

}

1046

X509_free(srv_cert);

1047

}

1048

if (opt_srv_key != NULL((void*)0)) {

1049

EVP_PKEY *pkey = load_key_pwd(opt_srv_key, opt_keyform,

1050

opt_srv_keypass,

1051

engine, "private key for mock server cert");

1052

1053

if (pkey == NULL((void*)0) || !OSSL_CMP_CTX_set1_pkey(ctx, pkey)) {

1054

EVP_PKEY_free(pkey);

1055

goto err;

1056

}

1057

EVP_PKEY_free(pkey);

1058

}

1059

cleanse(opt_srv_keypass);

1060

1061

if (opt_srv_trusted != NULL((void*)0)) {

1062

X509_STORE *ts =

1063

load_trusted(opt_srv_trusted, 0, "certs trusted by mock server");

1064

1065

if (ts == NULL((void*)0) || !OSSL_CMP_CTX_set0_trustedStore(ctx, ts)) {

1066

X509_STORE_free(ts);

1067

goto err;

1068

}

1069

} else {

1070

CMP_warn("mock server will not be able to handle signature-protected requests since -srv_trusted is not given")((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"mock server will not be able to handle signature-protected requests since -srv_trusted is not given"
"%s%s%s" "\n", (strcmp(__func__, "(unknown function)") == 0 ?
"CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c", 1070
, "warning", "", "", ""))));

1071

}

1072

if (!setup_certs(opt_srv_untrusted,

1073

"untrusted certificates for mock server", ctx,

1074

(add_X509_stack_fn_t)OSSL_CMP_CTX_set1_untrusted))

1075

goto err;

1076

1077

if (opt_rsp_cert == NULL((void*)0)) {

1078

CMP_warn("no -rsp_cert given for mock server")((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"no -rsp_cert given for mock server""%s%s%s" "\n", (strcmp(__func__
, "(unknown function)") == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 1078, "warning", "", "", ""))));

1079

} else {

1080

X509 *cert = load_cert_pwd(opt_rsp_cert, opt_keypass,

1081

"cert to be returned by the mock server");

1082

1083

if (cert == NULL((void*)0))

1084

goto err;

1085

/* from server perspective the server is the client */

1086

if (!ossl_cmp_mock_srv_set1_certOut(srv_ctx, cert)) {

1087

X509_free(cert);

1088

goto err;

1089

}

1090

X509_free(cert);

1091

}

1092

if (!setup_certs(opt_rsp_extracerts,

1093

"CMP extra certificates for mock server", srv_ctx,

1094

(add_X509_stack_fn_t)ossl_cmp_mock_srv_set1_chainOut))

1095

goto err;

1096

if (!setup_certs(opt_rsp_capubs, "caPubs for mock server", srv_ctx,

1097

(add_X509_stack_fn_t)ossl_cmp_mock_srv_set1_caPubsOut))

1098

goto err;

1099

(void)ossl_cmp_mock_srv_set_pollCount(srv_ctx, opt_poll_count);

1100

(void)ossl_cmp_mock_srv_set_checkAfterTime(srv_ctx, opt_check_after);

1101

if (opt_grant_implicitconf)

1102

(void)OSSL_CMP_SRV_CTX_set_grant_implicit_confirm(srv_ctx, 1);

1103

1104

if (opt_failure != INT_MIN(-2147483647 -1)) { /* option has been set explicity */

1105

if (opt_failure < 0 || OSSL_CMP_PKIFAILUREINFO_MAX26 < opt_failure) {

1106

CMP_err1("-failure out of range, should be >= 0 and <= %d",((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"-failure out of range, should be >= 0 and <= %d""%s%s"
"\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP" :
__func__), "../deps/openssl/openssl/apps/cmp.c", 1107, "error"
, 26, "", ""))))

1107

OSSL_CMP_PKIFAILUREINFO_MAX)((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"-failure out of range, should be >= 0 and <= %d""%s%s"
"\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP" :
__func__), "../deps/openssl/openssl/apps/cmp.c", 1107, "error"
, 26, "", ""))));

1108

goto err;

1109

}

1110

if (opt_failurebits != 0)

1111

CMP_warn("-failurebits overrides -failure")((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"-failurebits overrides -failure""%s%s%s" "\n", (strcmp(__func__
, "(unknown function)") == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 1111, "warning", "", "", ""))));

1112

else

1113

opt_failurebits = 1 << opt_failure;

1114

}

1115

if ((unsigned)opt_failurebits > OSSL_CMP_PKIFAILUREINFO_MAX_BIT_PATTERN((1 << (26 + 1)) - 1)) {

1116

CMP_err("-failurebits out of range")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"-failurebits out of range""%s%s%s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 1116, "error", "", "", ""))));

1117

goto err;

1118

}

1119

if (!ossl_cmp_mock_srv_set_statusInfo(srv_ctx, opt_pkistatus,

1120

opt_failurebits, opt_statusstring))

1121

goto err;

1122

1123

if (opt_send_error)

1124

(void)ossl_cmp_mock_srv_set_send_error(srv_ctx, 1);

1125

1126

if (opt_send_unprotected)

1127

(void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_UNPROTECTED_SEND30, 1);

1128

if (opt_send_unprot_err)

1129

(void)OSSL_CMP_SRV_CTX_set_send_unprotected_errors(srv_ctx, 1);

1130

if (opt_accept_unprotected)

1131

(void)OSSL_CMP_SRV_CTX_set_accept_unprotected(srv_ctx, 1);

1132

if (opt_accept_unprot_err)

1133

(void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_UNPROTECTED_ERRORS31, 1);

1134

if (opt_accept_raverified)

1135

(void)OSSL_CMP_SRV_CTX_set_accept_raverified(srv_ctx, 1);

1136

1137

return srv_ctx;

1138

1139

err:

1140

ossl_cmp_mock_srv_free(srv_ctx);

1141

return NULL((void*)0);

1142

}

1143

1144

/*

1145

* set up verification aspects of OSSL_CMP_CTX w.r.t. opts from config file/CLI.

1146

* Returns pointer on success, NULL on error

1147

*/

1148

static int setup_verification_ctx(OSSL_CMP_CTX *ctx)

1149

{

1150

if (!setup_certs(opt_untrusted, "untrusted certificates", ctx,

1151

(add_X509_stack_fn_t)OSSL_CMP_CTX_set1_untrusted))

1152

return 0;

1153

1154

if (opt_srvcert != NULL((void*)0) || opt_trusted != NULL((void*)0)) {

1155

X509 *srvcert;

1156

X509_STORE *ts;

1157

int ok;

1158

1159

if (opt_srvcert != NULL((void*)0)) {

1160

if (opt_trusted != NULL((void*)0)) {

1161

CMP_warn("-trusted option is ignored since -srvcert option is present")((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"-trusted option is ignored since -srvcert option is present"
"%s%s%s" "\n", (strcmp(__func__, "(unknown function)") == 0 ?
"CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c", 1161
, "warning", "", "", ""))));

1162

opt_trusted = NULL((void*)0);

1163

}

1164

if (opt_recipient != NULL((void*)0)) {

1165

CMP_warn("-recipient option is ignored since -srvcert option is present")((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"-recipient option is ignored since -srvcert option is present"
"%s%s%s" "\n", (strcmp(__func__, "(unknown function)") == 0 ?
"CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c", 1165
, "warning", "", "", ""))));

1166

opt_recipient = NULL((void*)0);

1167

}

1168

srvcert = load_cert_pwd(opt_srvcert, opt_otherpass,

1169

"directly trusted CMP server certificate");

1170

ok = srvcert != NULL((void*)0) && OSSL_CMP_CTX_set1_srvCert(ctx, srvcert);

1171

X509_free(srvcert);

1172

if (!ok)

1173

return 0;

1174

}

1175

if (opt_trusted != NULL((void*)0)) {

1176

/*

1177

* the 0 arg below clears any expected host/ip/email address;

1178

* opt_expect_sender is used instead

1179

*/

1180

ts = load_trusted(opt_trusted, 0, "certs trusted by client");

1181

1182

if (ts == NULL((void*)0) || !OSSL_CMP_CTX_set0_trustedStore(ctx, ts)) {

1183

X509_STORE_free(ts);

1184

return 0;

1185

}

1186

}

1187

}

1188

1189

if (opt_ignore_keyusage)

1190

(void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_IGNORE_KEYUSAGE35, 1);

1191

1192

if (opt_unprotected_errors)

1193

(void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_UNPROTECTED_ERRORS31, 1);

1194

1195

if (opt_out_trusted != NULL((void*)0)) { /* for use in OSSL_CMP_certConf_cb() */

1196

X509_VERIFY_PARAM *out_vpm = NULL((void*)0);

1197

X509_STORE *out_trusted =

1198

load_trusted(opt_out_trusted, 1,

1199

"trusted certs for verifying newly enrolled cert");

1200

1201

if (out_trusted == NULL((void*)0))

1202

return 0;

1203

/* ignore any -attime here, new certs are current anyway */

1204

out_vpm = X509_STORE_get0_param(out_trusted);

1205

X509_VERIFY_PARAM_clear_flags(out_vpm, X509_V_FLAG_USE_CHECK_TIME0x2);

1206

1207

(void)OSSL_CMP_CTX_set_certConf_cb_arg(ctx, out_trusted);

1208

}

1209

1210

if (opt_disable_confirm)

1211

(void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_DISABLE_CONFIRM26, 1);

1212

1213

if (opt_implicit_confirm)

1214

(void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_IMPLICIT_CONFIRM25, 1);

1215

1216

return 1;

1217

}

1218

1219

#ifndef OPENSSL_NO_SOCK

1220

/*

1221

* set up ssl_ctx for the OSSL_CMP_CTX based on options from config file/CLI.

1222

* Returns pointer on success, NULL on error

1223

*/

1224

static SSL_CTX *setup_ssl_ctx(OSSL_CMP_CTX *ctx, const char *host,

1225

ENGINE *engine)

1226

{

1227

STACK_OF(X509)struct stack_st_X509 *untrusted = OSSL_CMP_CTX_get0_untrusted(ctx);

1228

EVP_PKEY *pkey = NULL((void*)0);

1229

X509_STORE *trust_store = NULL((void*)0);

1230

SSL_CTX *ssl_ctx;

1231

int i;

1232

1233

ssl_ctx = SSL_CTX_new(TLS_client_method());

1234

if (ssl_ctx == NULL((void*)0))

1235

return NULL((void*)0);

1236

1237

if (opt_tls_trusted != NULL((void*)0)) {

1238

trust_store = load_trusted(opt_tls_trusted, 0, "trusted TLS certs");

1239

if (trust_store == NULL((void*)0))

1240

goto err;

1241

SSL_CTX_set_cert_store(ssl_ctx, trust_store);

1242

}

1243

1244

if (opt_tls_cert != NULL((void*)0) && opt_tls_key != NULL((void*)0)) {

1245

X509 *cert;

1246

STACK_OF(X509)struct stack_st_X509 *certs = NULL((void*)0);

1247

int ok;

1248

1249

if (!load_cert_certs(opt_tls_cert, &cert, &certs, 0, opt_tls_keypass,

1250

"TLS client certificate (optionally with chain)",

1251

vpm))

1252

/* need opt_tls_keypass if opt_tls_cert is encrypted PKCS#12 file */

1253

goto err;

1254

1255

ok = SSL_CTX_use_certificate(ssl_ctx, cert) > 0;

1256

X509_free(cert);

1257

1258

/*

1259

* Any further certs and any untrusted certs are used for constructing

1260

* the chain to be provided with the TLS client cert to the TLS server.

1261

*/

1262

if (!ok || !SSL_CTX_set0_chain(ssl_ctx, certs)SSL_CTX_ctrl(ssl_ctx,88,0,(char *)(certs))) {

1263

CMP_err1("unable to use client TLS certificate file '%s'",((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"unable to use client TLS certificate file '%s'""%s%s" "\n",
(strcmp(__func__, "(unknown function)") == 0 ? "CMP" : __func__
), "../deps/openssl/openssl/apps/cmp.c", 1264, "error", opt_tls_cert
, "", ""))))

1264

opt_tls_cert)((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"unable to use client TLS certificate file '%s'""%s%s" "\n",
(strcmp(__func__, "(unknown function)") == 0 ? "CMP" : __func__
), "../deps/openssl/openssl/apps/cmp.c", 1264, "error", opt_tls_cert
, "", ""))));

1265

sk_X509_pop_free(certs, X509_free)OPENSSL_sk_pop_free(ossl_check_X509_sk_type(certs),ossl_check_X509_freefunc_type
(X509_free));

1266

goto err;

1267

}

1268

for (i = 0; i < sk_X509_num(untrusted)OPENSSL_sk_num(ossl_check_const_X509_sk_type(untrusted)); i++) {

1269

cert = sk_X509_value(untrusted, i)((X509 *)OPENSSL_sk_value(ossl_check_const_X509_sk_type(untrusted
), (i)));

1270

if (!SSL_CTX_add1_chain_cert(ssl_ctx, cert)SSL_CTX_ctrl(ssl_ctx,89,1,(char *)(cert))) {

1271

CMP_err("could not add untrusted cert to TLS client cert chain")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"could not add untrusted cert to TLS client cert chain""%s%s%s"
"\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP" :
__func__), "../deps/openssl/openssl/apps/cmp.c", 1271, "error"
, "", "", ""))));

1272

goto err;

1273

}

1274

}

1275

1276

{

1277

X509_VERIFY_PARAM *tls_vpm = NULL((void*)0);

1278

unsigned long bak_flags = 0; /* compiler warns without init */

1279

1280

if (trust_store != NULL((void*)0)) {

1281

tls_vpm = X509_STORE_get0_param(trust_store);

1282

bak_flags = X509_VERIFY_PARAM_get_flags(tls_vpm);

1283

/* disable any cert status/revocation checking etc. */

1284

X509_VERIFY_PARAM_clear_flags(tls_vpm,

1285

~(X509_V_FLAG_USE_CHECK_TIME0x2

1286

| X509_V_FLAG_NO_CHECK_TIME0x200000));

1287

}

1288

CMP_debug("trying to build cert chain for own TLS cert")((void)(7 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"trying to build cert chain for own TLS cert""%s%s%s" "\n", (
strcmp(__func__, "(unknown function)") == 0 ? "CMP" : __func__
), "../deps/openssl/openssl/apps/cmp.c", 1288, "debug", "", ""
, ""))));

1289

if (SSL_CTX_build_cert_chain(ssl_ctx,SSL_CTX_ctrl(ssl_ctx,105, 0x1 | 0x2, ((void*)0))

1290

SSL_BUILD_CHAIN_FLAG_UNTRUSTED |SSL_CTX_ctrl(ssl_ctx,105, 0x1 | 0x2, ((void*)0))

1291

SSL_BUILD_CHAIN_FLAG_NO_ROOT)SSL_CTX_ctrl(ssl_ctx,105, 0x1 | 0x2, ((void*)0))) {

1292

CMP_debug("success building cert chain for own TLS cert")((void)(7 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"success building cert chain for own TLS cert""%s%s%s" "\n",
(strcmp(__func__, "(unknown function)") == 0 ? "CMP" : __func__
), "../deps/openssl/openssl/apps/cmp.c", 1292, "debug", "", ""
, ""))));

1293

} else {

1294

OSSL_CMP_CTX_print_errors(ctx);

1295

CMP_warn("could not build cert chain for own TLS cert")((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"could not build cert chain for own TLS cert""%s%s%s" "\n", (
strcmp(__func__, "(unknown function)") == 0 ? "CMP" : __func__
), "../deps/openssl/openssl/apps/cmp.c", 1295, "warning", "",
"", ""))));

1296

}

1297

if (trust_store != NULL((void*)0))

1298

X509_VERIFY_PARAM_set_flags(tls_vpm, bak_flags);

1299

}

1300

1301

/* If present we append to the list also the certs from opt_tls_extra */

1302

if (opt_tls_extra != NULL((void*)0)) {

1303

STACK_OF(X509)struct stack_st_X509 *tls_extra = load_certs_multifile(opt_tls_extra,

1304

opt_otherpass,

1305

"extra certificates for TLS",

1306

vpm);

1307

int res = 1;

1308

1309

if (tls_extra == NULL((void*)0))

1310

goto err;

1311

for (i = 0; i < sk_X509_num(tls_extra)OPENSSL_sk_num(ossl_check_const_X509_sk_type(tls_extra)); i++) {

1312

cert = sk_X509_value(tls_extra, i)((X509 *)OPENSSL_sk_value(ossl_check_const_X509_sk_type(tls_extra
), (i)));

1313

if (res != 0)

1314

res = SSL_CTX_add_extra_chain_cert(ssl_ctx, cert)SSL_CTX_ctrl(ssl_ctx,14,0,(char *)(cert));

1315

if (res == 0)

1316

X509_free(cert);

1317

}

1318

sk_X509_free(tls_extra)OPENSSL_sk_free(ossl_check_X509_sk_type(tls_extra));

1319

if (res == 0) {

1320

BIO_printf(bio_err, "error: unable to add TLS extra certs\n");

1321

goto err;

1322

}

1323

}

1324

1325

pkey = load_key_pwd(opt_tls_key, opt_keyform, opt_tls_keypass,

1326

engine, "TLS client private key");

1327

cleanse(opt_tls_keypass);

1328

if (pkey == NULL((void*)0))

1329

goto err;

1330

/*

1331

* verify the key matches the cert,

1332

* not using SSL_CTX_check_private_key(ssl_ctx)

1333

* because it gives poor and sometimes misleading diagnostics

1334

*/

1335

if (!X509_check_private_key(SSL_CTX_get0_certificate(ssl_ctx),

1336

pkey)) {

1337

CMP_err2("TLS private key '%s' does not match the TLS certificate '%s'\n",((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"TLS private key '%s' does not match the TLS certificate '%s'\n"
"%s" "\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP"
: __func__), "../deps/openssl/openssl/apps/cmp.c", 1338, "error"
, opt_tls_key, opt_tls_cert, ""))))

1338

opt_tls_key, opt_tls_cert)((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"TLS private key '%s' does not match the TLS certificate '%s'\n"
"%s" "\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP"
: __func__), "../deps/openssl/openssl/apps/cmp.c", 1338, "error"
, opt_tls_key, opt_tls_cert, ""))));

1339

EVP_PKEY_free(pkey);

1340

pkey = NULL((void*)0); /* otherwise, for some reason double free! */

1341

goto err;

1342

}

1343

if (SSL_CTX_use_PrivateKey(ssl_ctx, pkey) <= 0) {

1344

CMP_err1("unable to use TLS client private key '%s'", opt_tls_key)((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"unable to use TLS client private key '%s'""%s%s" "\n", (strcmp
(__func__, "(unknown function)") == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 1344, "error", opt_tls_key, "", ""))));

1345

EVP_PKEY_free(pkey);

1346

pkey = NULL((void*)0); /* otherwise, for some reason double free! */

1347

goto err;

1348

}

1349

EVP_PKEY_free(pkey); /* we do not need the handle any more */

1350

}

1351

if (opt_tls_trusted != NULL((void*)0)) {

1352

/* enable and parameterize server hostname/IP address check */

1353

if (!truststore_set_host_etc(trust_store,

1354

opt_tls_host != NULL((void*)0) ? opt_tls_host : host))

1355

goto err;

1356

SSL_CTX_set_verify(ssl_ctx, SSL_VERIFY_PEER0x01, NULL((void*)0));

1357

}

1358

return ssl_ctx;

1359

err:

1360

SSL_CTX_free(ssl_ctx);

1361

return NULL((void*)0);

1362

}

1363

#endif /* OPENSSL_NO_SOCK */

1364

1365

/*

1366

* set up protection aspects of OSSL_CMP_CTX based on options from config

1367

* file/CLI while parsing options and checking their consistency.

1368

* Returns 1 on success, 0 on error

1369

*/

1370

static int setup_protection_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)

1371

{

1372

if (!opt_unprotected_requests && opt_secret == NULL((void*)0) && opt_key == NULL((void*)0)) {

1373

CMP_err("must give -key or -secret unless -unprotected_requests is used")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"must give -key or -secret unless -unprotected_requests is used"
"%s%s%s" "\n", (strcmp(__func__, "(unknown function)") == 0 ?
"CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c", 1373
, "error", "", "", ""))));

1374

return 0;

1375

}

1376

1377

if (opt_ref == NULL((void*)0) && opt_cert == NULL((void*)0) && opt_subject == NULL((void*)0)) {

1378

/* cert or subject should determine the sender */

1379

CMP_err("must give -ref if no -cert and no -subject given")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"must give -ref if no -cert and no -subject given""%s%s%s" "\n"
, (strcmp(__func__, "(unknown function)") == 0 ? "CMP" : __func__
), "../deps/openssl/openssl/apps/cmp.c", 1379, "error", "", ""
, ""))));

1380

return 0;

1381

}

1382

if (!opt_secret && ((opt_cert == NULL((void*)0)) != (opt_key == NULL((void*)0)))) {

1383

CMP_err("must give both -cert and -key options or neither")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"must give both -cert and -key options or neither""%s%s%s" "\n"
, (strcmp(__func__, "(unknown function)") == 0 ? "CMP" : __func__
), "../deps/openssl/openssl/apps/cmp.c", 1383, "error", "", ""
, ""))));

1384

return 0;

1385

}

1386

if (opt_secret != NULL((void*)0)) {

1387

char *pass_string = get_passwd(opt_secret, "PBMAC");

1388

int res;

1389

1390

if (pass_string != NULL((void*)0)) {

1391

cleanse(opt_secret);

1392

res = OSSL_CMP_CTX_set1_secretValue(ctx,

1393

(unsigned char *)pass_string,

1394

strlen(pass_string));

1395

clear_free(pass_string);

1396

if (res == 0)

1397

return 0;

1398

}

1399

if (opt_cert != NULL((void*)0) || opt_key != NULL((void*)0))

1400

CMP_warn("-cert and -key not used for protection since -secret is given")((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"-cert and -key not used for protection since -secret is given"
"%s%s%s" "\n", (strcmp(__func__, "(unknown function)") == 0 ?
"CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c", 1400
, "warning", "", "", ""))));

1401

}

1402

if (opt_ref != NULL((void*)0)

1403

&& !OSSL_CMP_CTX_set1_referenceValue(ctx, (unsigned char *)opt_ref,

1404

strlen(opt_ref)))

1405

return 0;

1406

1407

if (opt_key != NULL((void*)0)) {

1408

EVP_PKEY *pkey = load_key_pwd(opt_key, opt_keyform, opt_keypass, engine,

1409

"private key for CMP client certificate");

1410

1411

if (pkey == NULL((void*)0) || !OSSL_CMP_CTX_set1_pkey(ctx, pkey)) {

1412

EVP_PKEY_free(pkey);

1413

return 0;

1414

}

1415

EVP_PKEY_free(pkey);

1416

}

1417

if (opt_secret == NULL((void*)0) && opt_srvcert == NULL((void*)0) && opt_trusted == NULL((void*)0))

1418

CMP_warn("will not authenticate server due to missing -secret, -trusted, or -srvcert")((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"will not authenticate server due to missing -secret, -trusted, or -srvcert"
"%s%s%s" "\n", (strcmp(__func__, "(unknown function)") == 0 ?
"CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c", 1418
, "warning", "", "", ""))));

1419

1420

if (opt_cert != NULL((void*)0)) {

1421

X509 *cert;

1422

STACK_OF(X509)struct stack_st_X509 *certs = NULL((void*)0);

1423

X509_STORE *own_trusted = NULL((void*)0);

1424

int ok;

1425

1426

if (!load_cert_certs(opt_cert, &cert, &certs, 0, opt_keypass,

1427

"CMP client certificate (optionally with chain)",

1428

vpm))

1429

/* opt_keypass is needed if opt_cert is an encrypted PKCS#12 file */

1430

return 0;

1431

ok = OSSL_CMP_CTX_set1_cert(ctx, cert);

1432

X509_free(cert);

1433

if (!ok) {

1434

CMP_err("out of memory")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"out of memory""%s%s%s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 1434, "error", "", "", ""))));

1435

} else {

1436

if (opt_own_trusted != NULL((void*)0)) {

1437

own_trusted = load_trusted(opt_own_trusted, 0,

1438

"trusted certs for verifying own CMP signer cert");

1439

ok = own_trusted != NULL((void*)0);

1440

}

1441

ok = ok && OSSL_CMP_CTX_build_cert_chain(ctx, own_trusted, certs);

1442

}

1443

X509_STORE_free(own_trusted);

1444

sk_X509_pop_free(certs, X509_free)OPENSSL_sk_pop_free(ossl_check_X509_sk_type(certs),ossl_check_X509_freefunc_type
(X509_free));

1445

if (!ok)

1446

return 0;

1447

} else if (opt_own_trusted != NULL((void*)0)) {

1448

CMP_warn("-own_trusted option is ignored without -cert")((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"-own_trusted option is ignored without -cert""%s%s%s" "\n",
(strcmp(__func__, "(unknown function)") == 0 ? "CMP" : __func__
), "../deps/openssl/openssl/apps/cmp.c", 1448, "warning", "",
"", ""))));

1449

}

1450

1451

if (!setup_certs(opt_extracerts, "extra certificates for CMP", ctx,

1452

(add_X509_stack_fn_t)OSSL_CMP_CTX_set1_extraCertsOut))

1453

return 0;

1454

cleanse(opt_otherpass);

1455

1456

if (opt_unprotected_requests)

1457

(void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_UNPROTECTED_SEND30, 1);

1458

1459

if (opt_digest != NULL((void*)0)) {

1460

int digest = OBJ_ln2nid(opt_digest);

1461

1462

if (digest == NID_undef0) {

1463

CMP_err1("digest algorithm name not recognized: '%s'", opt_digest)((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"digest algorithm name not recognized: '%s'""%s%s" "\n", (strcmp
(__func__, "(unknown function)") == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 1463, "error", opt_digest, "", ""))));

1464

return 0;

1465

}

1466

if (!OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_DIGEST_ALGNID34, digest)

1467

|| !OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_OWF_ALGNID32, digest)) {

1468

CMP_err1("digest algorithm name not supported: '%s'", opt_digest)((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"digest algorithm name not supported: '%s'""%s%s" "\n", (strcmp
(__func__, "(unknown function)") == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 1468, "error", opt_digest, "", ""))));

1469

return 0;

1470

}

1471

}

1472

1473

if (opt_mac != NULL((void*)0)) {

1474

int mac = OBJ_ln2nid(opt_mac);

1475

if (mac == NID_undef0) {

1476

CMP_err1("MAC algorithm name not recognized: '%s'", opt_mac)((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"MAC algorithm name not recognized: '%s'""%s%s" "\n", (strcmp
(__func__, "(unknown function)") == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 1476, "error", opt_mac, "", ""))));

1477

return 0;

1478

}

1479

(void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_MAC_ALGNID33, mac);

1480

}

1481

return 1;

1482

}

1483

1484

/*

1485

* set up IR/CR/KUR/CertConf/RR specific parts of the OSSL_CMP_CTX

1486

* based on options from config file/CLI.

1487

* Returns pointer on success, NULL on error

1488

*/

1489

static int setup_request_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)

1490

{

1491

X509_REQ *csr = NULL((void*)0);

1492

X509_EXTENSIONS *exts = NULL((void*)0);

1493

X509V3_CTX ext_ctx;

1494

1495

if (opt_subject == NULL((void*)0)

1496

&& opt_csr == NULL((void*)0) && opt_oldcert == NULL((void*)0) && opt_cert == NULL((void*)0)

1497

&& opt_cmd != CMP_RR && opt_cmd != CMP_GENM)

1498

CMP_warn("no -subject given; no -csr or -oldcert or -cert available for fallback")((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"no -subject given; no -csr or -oldcert or -cert available for fallback"
"%s%s%s" "\n", (strcmp(__func__, "(unknown function)") == 0 ?
"CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c", 1498
, "warning", "", "", ""))));

1499

1500

if (opt_cmd == CMP_IR || opt_cmd == CMP_CR || opt_cmd == CMP_KUR) {

1501

if (opt_newkey == NULL((void*)0) && opt_key == NULL((void*)0) && opt_csr == NULL((void*)0)) {

1502

CMP_err("missing -newkey (or -key) to be certified and no -csr given")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"missing -newkey (or -key) to be certified and no -csr given"
"%s%s%s" "\n", (strcmp(__func__, "(unknown function)") == 0 ?
"CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c", 1502
, "error", "", "", ""))));

1503

return 0;

1504

}

1505

if (opt_certout == NULL((void*)0)) {

1506

CMP_err("-certout not given, nowhere to save newly enrolled certificate")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"-certout not given, nowhere to save newly enrolled certificate"
"%s%s%s" "\n", (strcmp(__func__, "(unknown function)") == 0 ?
"CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c", 1506
, "error", "", "", ""))));

1507

return 0;

1508

}

1509

if (!set_name(opt_subject, OSSL_CMP_CTX_set1_subjectName, ctx, "subject")

1510

|| !set_name(opt_issuer, OSSL_CMP_CTX_set1_issuer, ctx, "issuer"))

1511

return 0;

1512

} else {

1513

const char *msg = "option is ignored for commands other than 'ir', 'cr', and 'kur'";

1514

1515

if (opt_subject != NULL((void*)0)) {

1516

if (opt_ref == NULL((void*)0) && opt_cert == NULL((void*)0)) {

1517

/* use subject as default sender unless oldcert subject is used */

1518

if (!set_name(opt_subject, OSSL_CMP_CTX_set1_subjectName, ctx, "subject"))

1519

return 0;

1520

} else {

1521

CMP_warn1("-subject %s since -ref or -cert is given", msg)((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"-subject %s since -ref or -cert is given""%s%s" "\n", (strcmp
(__func__, "(unknown function)") == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 1521, "warning", msg, "", ""))));

1522

}

1523

}

1524

if (opt_issuer != NULL((void*)0))

1525

CMP_warn1("-issuer %s", msg)((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"-issuer %s""%s%s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 1525, "warning", msg, "", ""))));

1526

if (opt_reqexts != NULL((void*)0))

1527

CMP_warn1("-reqexts %s", msg)((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"-reqexts %s""%s%s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 1527, "warning", msg, "", ""))));

1528

if (opt_san_nodefault)

1529

CMP_warn1("-san_nodefault %s", msg)((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"-san_nodefault %s""%s%s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 1529, "warning", msg, "", ""))));

1530

if (opt_sans != NULL((void*)0))

1531

CMP_warn1("-sans %s", msg)((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"-sans %s""%s%s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 1531, "warning", msg, "", ""))));

1532

if (opt_policies != NULL((void*)0))

1533

CMP_warn1("-policies %s", msg)((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"-policies %s""%s%s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 1533, "warning", msg, "", ""))));

1534

if (opt_policy_oids != NULL((void*)0))

1535

CMP_warn1("-policy_oids %s", msg)((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"-policy_oids %s""%s%s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 1535, "warning", msg, "", ""))));

1536

}

1537

if (opt_cmd == CMP_KUR) {

1538

char *ref_cert = opt_oldcert != NULL((void*)0) ? opt_oldcert : opt_cert;

1539

1540

if (ref_cert == NULL((void*)0) && opt_csr == NULL((void*)0)) {

1541

CMP_err("missing -oldcert for certificate to be updated and no -csr given")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"missing -oldcert for certificate to be updated and no -csr given"
"%s%s%s" "\n", (strcmp(__func__, "(unknown function)") == 0 ?
"CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c", 1541
, "error", "", "", ""))));

1542

return 0;

1543

}

1544

if (opt_subject != NULL((void*)0))

1545

CMP_warn2("given -subject '%s' overrides the subject of '%s' for KUR",((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"given -subject '%s' overrides the subject of '%s' for KUR""%s"
"\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP" :
__func__), "../deps/openssl/openssl/apps/cmp.c", 1546, "warning"
, opt_subject, ref_cert != ((void*)0) ? ref_cert : opt_csr, ""
))))

1546

opt_subject, ref_cert != NULL ? ref_cert : opt_csr)((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"given -subject '%s' overrides the subject of '%s' for KUR""%s"
"\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP" :
__func__), "../deps/openssl/openssl/apps/cmp.c", 1546, "warning"
, opt_subject, ref_cert != ((void*)0) ? ref_cert : opt_csr, ""
))));

1547

}

1548

if (opt_cmd == CMP_RR) {

1549

if (opt_oldcert == NULL((void*)0) && opt_csr == NULL((void*)0)) {

1550

CMP_err("missing -oldcert for certificate to be revoked and no -csr given")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"missing -oldcert for certificate to be revoked and no -csr given"
"%s%s%s" "\n", (strcmp(__func__, "(unknown function)") == 0 ?
"CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c", 1550
, "error", "", "", ""))));

1551

return 0;

1552

}

1553

if (opt_oldcert != NULL((void*)0) && opt_csr != NULL((void*)0))

1554

CMP_warn("ignoring -csr since certificate to be revoked is given")((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"ignoring -csr since certificate to be revoked is given""%s%s%s"
"\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP" :
__func__), "../deps/openssl/openssl/apps/cmp.c", 1554, "warning"
, "", "", ""))));

1555

}

1556

if (opt_cmd == CMP_P10CR && opt_csr == NULL((void*)0)) {

1557

CMP_err("missing PKCS#10 CSR for p10cr")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"missing PKCS#10 CSR for p10cr""%s%s%s" "\n", (strcmp(__func__
, "(unknown function)") == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 1557, "error", "", "", ""))));

1558

return 0;

1559

}

1560

1561

if (opt_recipient == NULL((void*)0) && opt_srvcert == NULL((void*)0) && opt_issuer == NULL((void*)0)

1562

&& opt_oldcert == NULL((void*)0) && opt_cert == NULL((void*)0))

1563

CMP_warn("missing -recipient, -srvcert, -issuer, -oldcert or -cert; recipient will be set to \"NULL-DN\"")((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"missing -recipient, -srvcert, -issuer, -oldcert or -cert; recipient will be set to \"NULL-DN\""
"%s%s%s" "\n", (strcmp(__func__, "(unknown function)") == 0 ?
"CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c", 1563
, "warning", "", "", ""))));

1564

1565

if (opt_cmd == CMP_P10CR || opt_cmd == CMP_RR) {

1566

const char *msg = "option is ignored for 'p10cr' and 'rr' commands";

1567

1568

if (opt_newkeypass != NULL((void*)0))

1569

CMP_warn1("-newkeytype %s", msg)((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"-newkeytype %s""%s%s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 1569, "warning", msg, "", ""))));

1570

if (opt_newkey != NULL((void*)0))

1571

CMP_warn1("-newkey %s", msg)((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"-newkey %s""%s%s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 1571, "warning", msg, "", ""))));

1572

if (opt_days != 0)

1573

CMP_warn1("-days %s", msg)((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"-days %s""%s%s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 1573, "warning", msg, "", ""))));

1574

if (opt_popo != OSSL_CRMF_POPO_NONE-1 - 1)

1575

CMP_warn1("-popo %s", msg)((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"-popo %s""%s%s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 1575, "warning", msg, "", ""))));

1576

} else if (opt_newkey != NULL((void*)0)) {

1577

const char *file = opt_newkey;

1578

const int format = opt_keyform;

1579

const char *pass = opt_newkeypass;

1580

const char *desc = "new private key for cert to be enrolled";

1581

EVP_PKEY *pkey;

1582

int priv = 1;

1583

BIO *bio_bak = bio_err;

1584

1585

bio_err = NULL((void*)0); /* suppress diagnostics on first try loading key */

1586

pkey = load_key_pwd(file, format, pass, engine, desc);

1587

bio_err = bio_bak;

1588

if (pkey == NULL((void*)0)) {

1589

ERR_clear_error();

1590

desc = opt_csr == NULL((void*)0)

1591

? "fallback public key for cert to be enrolled"

1592

: "public key for checking cert resulting from p10cr";

1593

pkey = load_pubkey(file, format, 0, pass, engine, desc);

1594

priv = 0;

1595

}

1596

cleanse(opt_newkeypass);

1597

if (pkey == NULL((void*)0) || !OSSL_CMP_CTX_set0_newPkey(ctx, priv, pkey)) {

1598

EVP_PKEY_free(pkey);

1599

return 0;

1600

}

1601

}

1602

1603

if (opt_days > 0

1604

&& !OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_VALIDITY_DAYS20,

1605

opt_days)) {

1606

CMP_err("could not set requested cert validity period")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"could not set requested cert validity period""%s%s%s" "\n",
(strcmp(__func__, "(unknown function)") == 0 ? "CMP" : __func__
), "../deps/openssl/openssl/apps/cmp.c", 1606, "error", "", ""
, ""))));

1607

return 0;

1608

}

1609

1610

if (opt_policies != NULL((void*)0) && opt_policy_oids != NULL((void*)0)) {

1611

CMP_err("cannot have policies both via -policies and via -policy_oids")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"cannot have policies both via -policies and via -policy_oids"
"%s%s%s" "\n", (strcmp(__func__, "(unknown function)") == 0 ?
"CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c", 1611
, "error", "", "", ""))));

1612

return 0;

1613

}

1614

1615

if (opt_csr != NULL((void*)0)) {

1616

if (opt_cmd == CMP_GENM) {

1617

CMP_warn("-csr option is ignored for command 'genm'")((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"-csr option is ignored for command 'genm'""%s%s%s" "\n", (strcmp
(__func__, "(unknown function)") == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 1617, "warning", "", "", ""))));

1618

} else {

1619

if ((csr = load_csr_autofmt(opt_csr, "PKCS#10 CSR")) == NULL((void*)0))

1620

return 0;

1621

if (!OSSL_CMP_CTX_set1_p10CSR(ctx, csr))

1622

goto oom;

1623

}

1624

}

1625

if (opt_reqexts != NULL((void*)0) || opt_policies != NULL((void*)0)) {

1626

if ((exts = sk_X509_EXTENSION_new_null()((struct stack_st_X509_EXTENSION *)OPENSSL_sk_new_null())) == NULL((void*)0))

1627

goto oom;

1628

X509V3_set_ctx(&ext_ctx, NULL((void*)0), NULL((void*)0), csr, NULL((void*)0), X509V3_CTX_REPLACE0x2);

1629

X509V3_set_nconf(&ext_ctx, conf);

1630

if (opt_reqexts != NULL((void*)0)

1631

&& !X509V3_EXT_add_nconf_sk(conf, &ext_ctx, opt_reqexts, &exts)) {

1632

CMP_err1("cannot load certificate request extension section '%s'",((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"cannot load certificate request extension section '%s'""%s%s"
"\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP" :
__func__), "../deps/openssl/openssl/apps/cmp.c", 1633, "error"
, opt_reqexts, "", ""))))

1633

opt_reqexts)((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"cannot load certificate request extension section '%s'""%s%s"
"\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP" :
__func__), "../deps/openssl/openssl/apps/cmp.c", 1633, "error"
, opt_reqexts, "", ""))));

1634

goto exts_err;

1635

}

1636

if (opt_policies != NULL((void*)0)

1637

&& !X509V3_EXT_add_nconf_sk(conf, &ext_ctx, opt_policies, &exts)) {

1638

CMP_err1("cannot load policy cert request extension section '%s'",((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"cannot load policy cert request extension section '%s'""%s%s"
"\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP" :
__func__), "../deps/openssl/openssl/apps/cmp.c", 1639, "error"
, opt_policies, "", ""))))

1639

opt_policies)((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"cannot load policy cert request extension section '%s'""%s%s"
"\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP" :
__func__), "../deps/openssl/openssl/apps/cmp.c", 1639, "error"
, opt_policies, "", ""))));

1640

goto exts_err;

1641

}

1642

OSSL_CMP_CTX_set0_reqExtensions(ctx, exts);

1643

}

1644

X509_REQ_free(csr);

1645

/* After here, must not goto oom/exts_err */

1646

1647

if (OSSL_CMP_CTX_reqExtensions_have_SAN(ctx) && opt_sans != NULL((void*)0)) {

1648

CMP_err("cannot have Subject Alternative Names both via -reqexts and via -sans")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"cannot have Subject Alternative Names both via -reqexts and via -sans"
"%s%s%s" "\n", (strcmp(__func__, "(unknown function)") == 0 ?
"CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c", 1648
, "error", "", "", ""))));

1649

return 0;

1650

}

1651

if (!set_gennames(ctx, opt_sans, "Subject Alternative Name"))

1652

return 0;

1653

1654

if (opt_san_nodefault) {

1655

if (opt_sans != NULL((void*)0))

1656

CMP_warn("-opt_san_nodefault has no effect when -sans is used")((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"-opt_san_nodefault has no effect when -sans is used""%s%s%s"
"\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP" :
__func__), "../deps/openssl/openssl/apps/cmp.c", 1656, "warning"
, "", "", ""))));

1657

(void)OSSL_CMP_CTX_set_option(ctx,

1658

OSSL_CMP_OPT_SUBJECTALTNAME_NODEFAULT21, 1);

1659

}

1660

1661

if (opt_policy_oids_critical) {

1662

if (opt_policy_oids == NULL((void*)0))

1663

CMP_warn("-opt_policy_oids_critical has no effect unless -policy_oids is given")((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"-opt_policy_oids_critical has no effect unless -policy_oids is given"
"%s%s%s" "\n", (strcmp(__func__, "(unknown function)") == 0 ?
"CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c", 1663
, "warning", "", "", ""))));

1664

(void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_POLICIES_CRITICAL23, 1);

1665

}

1666

1667

while (opt_policy_oids != NULL((void*)0)) {

1668

ASN1_OBJECT *policy;

1669

POLICYINFO *pinfo;

1670

char *next = next_item(opt_policy_oids);

1671

1672

if ((policy = OBJ_txt2obj(opt_policy_oids, 1)) == 0) {

1673

CMP_err1("unknown policy OID '%s'", opt_policy_oids)((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"unknown policy OID '%s'""%s%s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 1673, "error", opt_policy_oids, "", ""))));

1674

return 0;

1675

}

1676

1677

if ((pinfo = POLICYINFO_new()) == NULL((void*)0)) {

1678

ASN1_OBJECT_free(policy);

1679

return 0;

1680

}

1681

pinfo->policyid = policy;

1682

1683

if (!OSSL_CMP_CTX_push0_policy(ctx, pinfo)) {

1684

CMP_err1("cannot add policy with OID '%s'", opt_policy_oids)((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"cannot add policy with OID '%s'""%s%s" "\n", (strcmp(__func__
, "(unknown function)") == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 1684, "error", opt_policy_oids, "", ""))));

1685

POLICYINFO_free(pinfo);

1686

return 0;

1687

}

1688

opt_policy_oids = next;

1689

}

1690

1691

if (opt_popo >= OSSL_CRMF_POPO_NONE-1)

1692

(void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_POPO_METHOD24, opt_popo);

1693

1694

if (opt_oldcert != NULL((void*)0)) {

1695

if (opt_cmd == CMP_GENM) {

1696

CMP_warn("-oldcert option is ignored for command 'genm'")((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"-oldcert option is ignored for command 'genm'""%s%s%s" "\n"
, (strcmp(__func__, "(unknown function)") == 0 ? "CMP" : __func__
), "../deps/openssl/openssl/apps/cmp.c", 1696, "warning", "",
"", ""))));

1697

} else {

1698

X509 *oldcert = load_cert_pwd(opt_oldcert, opt_keypass,

1699

opt_cmd == CMP_KUR ?

1700

"certificate to be updated" :

1701

opt_cmd == CMP_RR ?

1702

"certificate to be revoked" :

1703

"reference certificate (oldcert)");

1704

/* opt_keypass needed if opt_oldcert is an encrypted PKCS#12 file */

1705

1706

if (oldcert == NULL((void*)0))

1707

return 0;

1708

if (!OSSL_CMP_CTX_set1_oldCert(ctx, oldcert)) {

1709

X509_free(oldcert);

1710

CMP_err("out of memory")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"out of memory""%s%s%s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 1710, "error", "", "", ""))));

1711

return 0;

1712

}

1713

X509_free(oldcert);

1714

}

1715

}

1716

cleanse(opt_keypass);

1717

if (opt_revreason > CRL_REASON_NONE-1)

1718

(void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_REVOCATION_REASON27,

1719

opt_revreason);

1720

1721

return 1;

1722

1723

oom:

1724

CMP_err("out of memory")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"out of memory""%s%s%s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 1724, "error", "", "", ""))));

1725

exts_err:

1726

sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free)OPENSSL_sk_pop_free(ossl_check_X509_EXTENSION_sk_type(exts),ossl_check_X509_EXTENSION_freefunc_type
(X509_EXTENSION_free));

1727

X509_REQ_free(csr);

1728

return 0;

1729

}

1730

1731

static int handle_opt_geninfo(OSSL_CMP_CTX *ctx)

1732

{

1733

long value;

1734

ASN1_OBJECT *type;

1735

ASN1_INTEGER *aint;

1736

ASN1_TYPE *val;

1737

OSSL_CMP_ITAV *itav;

1738

char *endstr;

1739

char *valptr = strchr(opt_geninfo, ':');

1740

1741

if (valptr == NULL((void*)0)) {

1742

CMP_err("missing ':' in -geninfo option")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"missing ':' in -geninfo option""%s%s%s" "\n", (strcmp(__func__
, "(unknown function)") == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 1742, "error", "", "", ""))));

1743

return 0;

1744

}

1745

valptr[0] = '\0';

1746

valptr++;

1747

1748

if (OPENSSL_strncasecmp(valptr, "int:", 4) != 0) {

1749

CMP_err("missing 'int:' in -geninfo option")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"missing 'int:' in -geninfo option""%s%s%s" "\n", (strcmp(__func__
, "(unknown function)") == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 1749, "error", "", "", ""))));

1750

return 0;

1751

}

1752

valptr += 4;

1753

1754

value = strtol(valptr, &endstr, 10);

1755

if (endstr == valptr || *endstr != '\0') {

1756

CMP_err("cannot parse int in -geninfo option")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"cannot parse int in -geninfo option""%s%s%s" "\n", (strcmp(
__func__, "(unknown function)") == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 1756, "error", "", "", ""))));

1757

return 0;

1758

}

1759

1760

type = OBJ_txt2obj(opt_geninfo, 1);

1761

if (type == NULL((void*)0)) {

1762

CMP_err("cannot parse OID in -geninfo option")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"cannot parse OID in -geninfo option""%s%s%s" "\n", (strcmp(
__func__, "(unknown function)") == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 1762, "error", "", "", ""))));

1763

return 0;

1764

}

1765

1766

if ((aint = ASN1_INTEGER_new()) == NULL((void*)0))

1767

goto oom;

1768

1769

val = ASN1_TYPE_new();

1770

if (!ASN1_INTEGER_set(aint, value) || val == NULL((void*)0)) {

1771

ASN1_INTEGER_free(aint);

1772

goto oom;

1773

}

1774

ASN1_TYPE_set(val, V_ASN1_INTEGER2, aint);

1775

itav = OSSL_CMP_ITAV_create(type, val);

1776

if (itav == NULL((void*)0)) {

1777

ASN1_TYPE_free(val);

1778

goto oom;

1779

}

1780

1781

if (!OSSL_CMP_CTX_push0_geninfo_ITAV(ctx, itav)) {

1782

OSSL_CMP_ITAV_free(itav);

1783

return 0;

1784

}

1785

return 1;

1786

1787

oom:

1788

ASN1_OBJECT_free(type);

1789

CMP_err("out of memory")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"out of memory""%s%s%s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 1789, "error", "", "", ""))));

1790

return 0;

1791

}

1792

1793

1794

/*

1795

* set up the client-side OSSL_CMP_CTX based on options from config file/CLI

1796

* while parsing options and checking their consistency.

1797

* Prints reason for error to bio_err.

1798

* Returns 1 on success, 0 on error

1799

*/

1800

static int setup_client_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)

1801

{

1802

int ret = 0;

1803

char *host = NULL((void*)0), *port = NULL((void*)0), *path = NULL((void*)0), *used_path = opt_path;

1804

#ifndef OPENSSL_NO_SOCK

1805

int portnum, ssl;

1806

static char server_port[32] = { '\0' };

1807

const char *proxy_host = NULL((void*)0);

1808

#endif

1809

char server_buf[200] = "mock server";

1810

char proxy_buf[200] = "";

1811

1812

if (!opt_use_mock_srv && opt_rspin == NULL((void*)0)) { /* note: -port is not given */

1813

#ifndef OPENSSL_NO_SOCK

1814

if (opt_server == NULL((void*)0)) {

1815

CMP_err("missing -server or -use_mock_srv or -rspin option")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"missing -server or -use_mock_srv or -rspin option""%s%s%s" "\n"
, (strcmp(__func__, "(unknown function)") == 0 ? "CMP" : __func__
), "../deps/openssl/openssl/apps/cmp.c", 1815, "error", "", ""
, ""))));

1816

goto err;

1817

}

1818

#else

1819

CMP_err("missing -use_mock_srv or -rspin option; -server option is not supported due to no-sock build")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"missing -use_mock_srv or -rspin option; -server option is not supported due to no-sock build"
"%s%s%s" "\n", (strcmp(__func__, "(unknown function)") == 0 ?
"CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c", 1819
, "error", "", "", ""))));

1820

goto err;

1821

#endif

1822

}

1823

#ifndef OPENSSL_NO_SOCK

1824

if (opt_server == NULL((void*)0)) {

1825

if (opt_proxy != NULL((void*)0))

1826

CMP_warn("ignoring -proxy option since -server is not given")((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"ignoring -proxy option since -server is not given""%s%s%s" "\n"
, (strcmp(__func__, "(unknown function)") == 0 ? "CMP" : __func__
), "../deps/openssl/openssl/apps/cmp.c", 1826, "warning", "",
"", ""))));

1827

if (opt_no_proxy != NULL((void*)0))

1828

CMP_warn("ignoring -no_proxy option since -server is not given")((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"ignoring -no_proxy option since -server is not given""%s%s%s"
"\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP" :
__func__), "../deps/openssl/openssl/apps/cmp.c", 1828, "warning"
, "", "", ""))));

1829

if (opt_tls_used) {

1830

CMP_warn("ignoring -tls_used option since -server is not given")((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"ignoring -tls_used option since -server is not given""%s%s%s"
"\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP" :
__func__), "../deps/openssl/openssl/apps/cmp.c", 1830, "warning"
, "", "", ""))));

1831

opt_tls_used = 0;

1832

}

1833

goto set_path;

1834

}

1835

if (!OSSL_HTTP_parse_url(opt_server, &ssl, NULL((void*)0) /* user */, &host, &port,

1836

&portnum, &path, NULL((void*)0) /* q */, NULL((void*)0) /* frag */)) {

1837

CMP_err1("cannot parse -server URL: %s", opt_server)((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"cannot parse -server URL: %s""%s%s" "\n", (strcmp(__func__,
"(unknown function)") == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 1837, "error", opt_server, "", ""))));

1838

goto err;

1839

}

1840

if (ssl && !opt_tls_used) {

1841

CMP_err("missing -tls_used option since -server URL indicates https")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"missing -tls_used option since -server URL indicates https"
"%s%s%s" "\n", (strcmp(__func__, "(unknown function)") == 0 ?
"CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c", 1841
, "error", "", "", ""))));

1842

goto err;

1843

}

1844

1845

BIO_snprintf(server_port, sizeof(server_port), "%s", port);

1846

if (opt_path == NULL((void*)0))

1847

used_path = path;

1848

if (!OSSL_CMP_CTX_set1_server(ctx, host)

1849

|| !OSSL_CMP_CTX_set_serverPort(ctx, portnum))

1850

goto oom;

1851

if (opt_proxy != NULL((void*)0) && !OSSL_CMP_CTX_set1_proxy(ctx, opt_proxy))

1852

goto oom;

1853

if (opt_no_proxy != NULL((void*)0) && !OSSL_CMP_CTX_set1_no_proxy(ctx, opt_no_proxy))

1854

goto oom;

1855

(void)BIO_snprintf(server_buf, sizeof(server_buf), "http%s://%s:%s/%s",

1856

opt_tls_used ? "s" : "", host, port,

1857

*used_path == '/' ? used_path + 1 : used_path);

1858

1859

proxy_host = OSSL_HTTP_adapt_proxy(opt_proxy, opt_no_proxy, host, ssl);

1860

if (proxy_host != NULL((void*)0))

1861

(void)BIO_snprintf(proxy_buf, sizeof(proxy_buf), " via %s", proxy_host);

1862

1863

set_path:

1864

#endif

1865

1866

if (!OSSL_CMP_CTX_set1_serverPath(ctx, used_path))

1867

goto oom;

1868

if (!transform_opts())

1869

goto err;

1870

1871

if (opt_infotype_s != NULL((void*)0)) {

1872

char id_buf[100] = "id-it-";

1873

1874

strncat(id_buf, opt_infotype_s, sizeof(id_buf) - strlen(id_buf) - 1);

1875

if ((opt_infotype = OBJ_sn2nid(id_buf)) == NID_undef0) {

1876

CMP_err("unknown OID name in -infotype option")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"unknown OID name in -infotype option""%s%s%s" "\n", (strcmp
(__func__, "(unknown function)") == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 1876, "error", "", "", ""))));

1877

goto err;

1878

}

1879

}

1880

1881

if (!setup_verification_ctx(ctx))

1882

goto err;

1883

1884

if (opt_keep_alive != 1)

1885

(void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_KEEP_ALIVE10,

1886

opt_keep_alive);

1887

if (opt_total_timeout > 0 && opt_msg_timeout > 0

1888

&& opt_total_timeout < opt_msg_timeout) {

1889

CMP_err2("-total_timeout argument = %d must not be < %d (-msg_timeout)",((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"-total_timeout argument = %d must not be < %d (-msg_timeout)"
"%s" "\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP"
: __func__), "../deps/openssl/openssl/apps/cmp.c", 1890, "error"
, opt_total_timeout, opt_msg_timeout, ""))))

1890

opt_total_timeout, opt_msg_timeout)((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"-total_timeout argument = %d must not be < %d (-msg_timeout)"
"%s" "\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP"
: __func__), "../deps/openssl/openssl/apps/cmp.c", 1890, "error"
, opt_total_timeout, opt_msg_timeout, ""))));

1891

goto err;

1892

}

1893

if (opt_msg_timeout >= 0) /* must do this before setup_ssl_ctx() */

1894

(void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_MSG_TIMEOUT11,

1895

opt_msg_timeout);

1896

if (opt_total_timeout >= 0)

1897

(void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_TOTAL_TIMEOUT12,

1898

opt_total_timeout);

1899

1900

if (opt_reqin != NULL((void*)0) && opt_rspin != NULL((void*)0))

1901

CMP_warn("-reqin is ignored since -rspin is present")((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"-reqin is ignored since -rspin is present""%s%s%s" "\n", (strcmp
(__func__, "(unknown function)") == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 1901, "warning", "", "", ""))));

1902

if (opt_reqin_new_tid && opt_reqin == NULL((void*)0))

1903

CMP_warn("-reqin_new_tid is ignored since -reqin is not present")((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"-reqin_new_tid is ignored since -reqin is not present""%s%s%s"
"\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP" :
__func__), "../deps/openssl/openssl/apps/cmp.c", 1903, "warning"
, "", "", ""))));

1904

if (opt_reqin != NULL((void*)0) || opt_reqout != NULL((void*)0)

1905

|| opt_rspin != NULL((void*)0) || opt_rspout != NULL((void*)0) || opt_use_mock_srv)

1906

(void)OSSL_CMP_CTX_set_transfer_cb(ctx, read_write_req_resp);

1907

1908

#ifndef OPENSSL_NO_SOCK

1909

if (opt_tls_used) {

1910

APP_HTTP_TLS_INFO *info;

1911

1912

if (opt_tls_cert != NULL((void*)0)

1913

|| opt_tls_key != NULL((void*)0) || opt_tls_keypass != NULL((void*)0)) {

1914

if (opt_tls_key == NULL((void*)0)) {

1915

CMP_err("missing -tls_key option")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"missing -tls_key option""%s%s%s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 1915, "error", "", "", ""))));

1916

goto err;

1917

} else if (opt_tls_cert == NULL((void*)0)) {

1918

CMP_err("missing -tls_cert option")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"missing -tls_cert option""%s%s%s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 1918, "error", "", "", ""))));

1919

goto err;

1920

}

1921

}

1922

1923

if ((info = OPENSSL_zalloc(sizeof(*info))CRYPTO_zalloc(sizeof(*info), "../deps/openssl/openssl/apps/cmp.c"
, 1923)) == NULL((void*)0))

1924

goto err;

1925

(void)OSSL_CMP_CTX_set_http_cb_arg(ctx, info);

1926

/* info will be freed along with CMP ctx */

1927

info->server = opt_server;

1928

info->port = server_port;

1929

/* workaround for callback design flaw, see #17088: */

1930

info->use_proxy = proxy_host != NULL((void*)0);

1931

info->timeout = OSSL_CMP_CTX_get_option(ctx, OSSL_CMP_OPT_MSG_TIMEOUT11);

1932

info->ssl_ctx = setup_ssl_ctx(ctx, host, engine);

1933

1934

if (info->ssl_ctx == NULL((void*)0))

1935

goto err;

1936

(void)OSSL_CMP_CTX_set_http_cb(ctx, app_http_tls_cb);

1937

}

1938

#endif

1939

1940

if (!setup_protection_ctx(ctx, engine))

1941

goto err;

1942

1943

if (!setup_request_ctx(ctx, engine))

1944

goto err;

1945

1946

if (!set_name(opt_recipient, OSSL_CMP_CTX_set1_recipient, ctx, "recipient")

1947

|| !set_name(opt_expect_sender, OSSL_CMP_CTX_set1_expected_sender,

1948

ctx, "expected sender"))

1949

goto err;

1950

1951

if (opt_geninfo != NULL((void*)0) && !handle_opt_geninfo(ctx))

1952

goto err;

1953

1954

/* not printing earlier, to minimize confusion in case setup fails before */

1955

if (opt_rspin != NULL((void*)0))

1956

CMP_info("will not contact any server since -rspin is given")((void)(6 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"will not contact any server since -rspin is given""%s%s%s" "\n"
, (strcmp(__func__, "(unknown function)") == 0 ? "CMP" : __func__
), "../deps/openssl/openssl/apps/cmp.c", 1956, "info", "", ""
, ""))));

1957

else

1958

CMP_info2("will contact %s%s", server_buf, proxy_buf)((void)(6 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"will contact %s%s""%s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 1958, "info", server_buf, proxy_buf, ""))));

1959

1960

ret = 1;

1961

1962

err:

1963

OPENSSL_free(host)CRYPTO_free(host, "../deps/openssl/openssl/apps/cmp.c", 1963);

1964

OPENSSL_free(port)CRYPTO_free(port, "../deps/openssl/openssl/apps/cmp.c", 1964);

1965

OPENSSL_free(path)CRYPTO_free(path, "../deps/openssl/openssl/apps/cmp.c", 1965);

1966

return ret;

1967

oom:

1968

CMP_err("out of memory")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"out of memory""%s%s%s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 1968, "error", "", "", ""))));

1969

goto err;

1970

}

1971

1972

/*

1973

* write out the given certificate to the output specified by bio.

1974

* Depending on options use either PEM or DER format.

1975

* Returns 1 on success, 0 on error

1976

*/

1977

static int write_cert(BIO *bio, X509 *cert)

1978

{

1979

if ((opt_certform == FORMAT_PEM(5 | 0x8000) && PEM_write_bio_X509(bio, cert))

1980

|| (opt_certform == FORMAT_ASN14 && i2d_X509_bio(bio, cert)))

1981

return 1;

1982

if (opt_certform != FORMAT_PEM(5 | 0x8000) && opt_certform != FORMAT_ASN14)

1983

BIO_printf(bio_err,

1984

"error: unsupported type '%s' for writing certificates\n",

1985

opt_certform_s);

1986

return 0;

1987

}

1988

1989

/*

1990

* If destFile != NULL writes out a stack of certs to the given file.

1991

* In any case frees the certs.

1992

* Depending on options use either PEM or DER format,

1993

* where DER does not make much sense for writing more than one cert!

1994

* Returns number of written certificates on success, -1 on error.

1995

*/

1996

static int save_free_certs(OSSL_CMP_CTX *ctx,

1997

STACK_OF(X509)struct stack_st_X509 *certs, char *destFile, char *desc)

1998

{

1999

BIO *bio = NULL((void*)0);

2000

int i;

2001

int n = sk_X509_num(certs)OPENSSL_sk_num(ossl_check_const_X509_sk_type(certs));

2002

2003

if (destFile == NULL((void*)0))

2004

goto end;

2005

CMP_info3("received %d %s certificate(s), saving to file '%s'",((void)(6 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"received %d %s certificate(s), saving to file '%s'" "\n", (
strcmp(__func__, "(unknown function)") == 0 ? "CMP" : __func__
), "../deps/openssl/openssl/apps/cmp.c", 2006, "info", n, desc
, destFile))))

2006

n, desc, destFile)((void)(6 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"received %d %s certificate(s), saving to file '%s'" "\n", (
strcmp(__func__, "(unknown function)") == 0 ? "CMP" : __func__
), "../deps/openssl/openssl/apps/cmp.c", 2006, "info", n, desc
, destFile))));

2007

if (n > 1 && opt_certform != FORMAT_PEM(5 | 0x8000))

2008

CMP_warn("saving more than one certificate in non-PEM format")((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"saving more than one certificate in non-PEM format""%s%s%s"
"\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP" :
__func__), "../deps/openssl/openssl/apps/cmp.c", 2008, "warning"
, "", "", ""))));

2009

2010

if (destFile == NULL((void*)0) || (bio = BIO_new(BIO_s_file())) == NULL((void*)0)

2011

|| !BIO_write_filename(bio, (char *)destFile)(int)BIO_ctrl(bio,108, 0x01|0x04,(char *)destFile)) {

2012

CMP_err1("could not open file '%s' for writing", destFile)((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"could not open file '%s' for writing""%s%s" "\n", (strcmp(__func__
, "(unknown function)") == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 2012, "error", destFile, "", ""))));

2013

n = -1;

2014

goto end;

2015

}

2016

2017

for (i = 0; i < n; i++) {

2018

if (!write_cert(bio, sk_X509_value(certs, i)((X509 *)OPENSSL_sk_value(ossl_check_const_X509_sk_type(certs
), (i))))) {

2019

CMP_err1("cannot write certificate to file '%s'", destFile)((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"cannot write certificate to file '%s'""%s%s" "\n", (strcmp(
__func__, "(unknown function)") == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 2019, "error", destFile, "", ""))));

2020

n = -1;

2021

goto end;

2022

}

2023

}

2024

2025

end:

2026

BIO_free(bio);

2027

sk_X509_pop_free(certs, X509_free)OPENSSL_sk_pop_free(ossl_check_X509_sk_type(certs),ossl_check_X509_freefunc_type
(X509_free));

2028

return n;

2029

}

2030

2031

static void print_itavs(STACK_OF(OSSL_CMP_ITAV)struct stack_st_OSSL_CMP_ITAV *itavs)

2032

{

2033

OSSL_CMP_ITAV *itav = NULL((void*)0);

2034

char buf[128];

2035

int i, r;

2036

int n = sk_OSSL_CMP_ITAV_num(itavs)OPENSSL_sk_num(ossl_check_const_OSSL_CMP_ITAV_sk_type(itavs)); /* itavs == NULL leads to 0 */

2037

2038

if (n == 0) {

2039

CMP_info("genp contains no ITAV")((void)(6 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"genp contains no ITAV""%s%s%s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 2039, "info", "", "", ""))));

2040

return;

2041

}

2042

2043

for (i = 0; i < n; i++) {

2044

itav = sk_OSSL_CMP_ITAV_value(itavs, i)((OSSL_CMP_ITAV *)OPENSSL_sk_value(ossl_check_const_OSSL_CMP_ITAV_sk_type
(itavs), (i)));

2045

r = OBJ_obj2txt(buf, 128, OSSL_CMP_ITAV_get0_type(itav), 0);

2046

if (r < 0)

2047

CMP_err("could not get ITAV details")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"could not get ITAV details""%s%s%s" "\n", (strcmp(__func__,
"(unknown function)") == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 2047, "error", "", "", ""))));

2048

else if (r == 0)

2049

CMP_info("genp contains empty ITAV")((void)(6 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"genp contains empty ITAV""%s%s%s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 2049, "info", "", "", ""))));

2050

else

2051

CMP_info1("genp contains ITAV of type: %s", buf)((void)(6 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"genp contains ITAV of type: %s""%s%s" "\n", (strcmp(__func__
, "(unknown function)") == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 2051, "info", buf, "", ""))));

2052

}

2053

}

2054

2055

static char opt_item[SECTION_NAME_MAX40 + 1];

2056

/* get previous name from a comma or space-separated list of names */

2057

static const char *prev_item(const char *opt, const char *end)

2058

{

2059

const char *beg;

2060

size_t len;

2061

2062

if (end == opt)

2063

return NULL((void*)0);

2064

beg = end;

2065

while (beg > opt) {

2066

--beg;

2067

if (beg[0] == ',' || isspace(beg[0])((*__ctype_b_loc ())[(int) ((beg[0]))] & (unsigned short int
) _ISspace)) {

2068

++beg;

2069

break;

2070

}

2071

}

2072

len = end - beg;

2073

if (len > SECTION_NAME_MAX40) {

2074

CMP_warn3("using only first %d characters of section name starting with \"%.*s\"",((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"using only first %d characters of section name starting with \"%.*s\""
"\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP" :
__func__), "../deps/openssl/openssl/apps/cmp.c", 2075, "warning"
, 40, 40, beg))))

2075

SECTION_NAME_MAX, SECTION_NAME_MAX, beg)((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"using only first %d characters of section name starting with \"%.*s\""
"\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP" :
__func__), "../deps/openssl/openssl/apps/cmp.c", 2075, "warning"
, 40, 40, beg))));

2076

len = SECTION_NAME_MAX40;

2077

}

2078

memcpy(opt_item, beg, len);

2079

opt_item[len] = '\0';

2080

while (beg > opt) {

2081

--beg;

2082

if (beg[0] != ',' && !isspace(beg[0])((*__ctype_b_loc ())[(int) ((beg[0]))] & (unsigned short int
) _ISspace)) {

2083

++beg;

2084

break;

2085

}

2086

}

2087

return beg;

2088

}

2089

2090

/* get str value for name from a comma-separated hierarchy of config sections */

2091

static char *conf_get_string(const CONF *src_conf, const char *groups,

2092

const char *name)

2093

{

2094

char *res = NULL((void*)0);

2095

const char *end = groups + strlen(groups);

2096

2097

while ((end = prev_item(groups, end)) != NULL((void*)0)) {

2098

if ((res = NCONF_get_string(src_conf, opt_item, name)) != NULL((void*)0))

2099

return res;

2100

}

2101

return res;

2102

}

2103

2104

/* get long val for name from a comma-separated hierarchy of config sections */

2105

static int conf_get_number_e(const CONF *conf_, const char *groups,

2106

const char *name, long *result)

2107

{

2108

char *str = conf_get_string(conf_, groups, name);

2109

char *tailptr;

2110

long res;

2111

2112

if (str == NULL((void*)0) || *str == '\0')

2113

return 0;

2114

2115

res = strtol(str, &tailptr, 10);

2116

if (res == LONG_MIN(-9223372036854775807L -1L) || res == LONG_MAX9223372036854775807L || *tailptr != '\0')

2117

return 0;

2118

2119

*result = res;

2120

return 1;

2121

}

2122

2123

/*

2124

* use the command line option table to read values from the CMP section

2125

* of openssl.cnf. Defaults are taken from the config file, they can be

2126

* overwritten on the command line.

2127

*/

2128

static int read_config(void)

2129

{

2130

unsigned int i;

2131

long num = 0;

2132

char *txt = NULL((void*)0);

2133

const OPTIONS *opt;

2134

int start_opt = OPT_VERBOSITY - OPT_HELP;

2135

int start_idx = OPT_VERBOSITY - 2;

2136

/*

2137

* starting with offset OPT_VERBOSITY because OPT_CONFIG and OPT_SECTION

2138

* would not make sense within the config file.

2139

*/

2140

int n_options = OSSL_NELEM(cmp_options)(sizeof(cmp_options)/sizeof((cmp_options)[0])) - 1;

2141

2142

for (opt = &cmp_options[start_opt], i = start_idx;

2143

opt->name != NULL((void*)0); i++, opt++)

2144

if (!strcmp(opt->name, OPT_SECTION_STR)

2145

|| !strcmp(opt->name, OPT_MORE_STR))

2146

n_options--;

2147

OPENSSL_assert(OSSL_NELEM(cmp_vars) == n_options(void)(((sizeof(cmp_vars)/sizeof((cmp_vars)[0])) == n_options
+ OPT_PROV__FIRST + 1 - OPT_PROV__LAST + OPT_R__FIRST + 1 - OPT_R__LAST
+ OPT_V__FIRST + 1 - OPT_V__LAST) ? 0 : (OPENSSL_die("assertion failed: "
"OSSL_NELEM(cmp_vars) == n_options + OPT_PROV__FIRST + 1 - OPT_PROV__LAST + OPT_R__FIRST + 1 - OPT_R__LAST + OPT_V__FIRST + 1 - OPT_V__LAST"
, "../deps/openssl/openssl/apps/cmp.c", 2150), 1))

2148

+ OPT_PROV__FIRST + 1 - OPT_PROV__LAST(void)(((sizeof(cmp_vars)/sizeof((cmp_vars)[0])) == n_options
+ OPT_PROV__FIRST + 1 - OPT_PROV__LAST + OPT_R__FIRST + 1 - OPT_R__LAST
+ OPT_V__FIRST + 1 - OPT_V__LAST) ? 0 : (OPENSSL_die("assertion failed: "
"OSSL_NELEM(cmp_vars) == n_options + OPT_PROV__FIRST + 1 - OPT_PROV__LAST + OPT_R__FIRST + 1 - OPT_R__LAST + OPT_V__FIRST + 1 - OPT_V__LAST"
, "../deps/openssl/openssl/apps/cmp.c", 2150), 1))

2149

+ OPT_R__FIRST + 1 - OPT_R__LAST(void)(((sizeof(cmp_vars)/sizeof((cmp_vars)[0])) == n_options
+ OPT_PROV__FIRST + 1 - OPT_PROV__LAST + OPT_R__FIRST + 1 - OPT_R__LAST
+ OPT_V__FIRST + 1 - OPT_V__LAST) ? 0 : (OPENSSL_die("assertion failed: "
"OSSL_NELEM(cmp_vars) == n_options + OPT_PROV__FIRST + 1 - OPT_PROV__LAST + OPT_R__FIRST + 1 - OPT_R__LAST + OPT_V__FIRST + 1 - OPT_V__LAST"
, "../deps/openssl/openssl/apps/cmp.c", 2150), 1))

2150

+ OPT_V__FIRST + 1 - OPT_V__LAST)(void)(((sizeof(cmp_vars)/sizeof((cmp_vars)[0])) == n_options
+ OPT_PROV__FIRST + 1 - OPT_PROV__LAST + OPT_R__FIRST + 1 - OPT_R__LAST
+ OPT_V__FIRST + 1 - OPT_V__LAST) ? 0 : (OPENSSL_die("assertion failed: "
"OSSL_NELEM(cmp_vars) == n_options + OPT_PROV__FIRST + 1 - OPT_PROV__LAST + OPT_R__FIRST + 1 - OPT_R__LAST + OPT_V__FIRST + 1 - OPT_V__LAST"
, "../deps/openssl/openssl/apps/cmp.c", 2150), 1));

2151

for (opt = &cmp_options[start_opt], i = start_idx;

2152

opt->name != NULL((void*)0); i++, opt++) {

2153

int provider_option = (OPT_PROV__FIRST <= opt->retval

2154

&& opt->retval < OPT_PROV__LAST);

2155

int rand_state_option = (OPT_R__FIRST <= opt->retval

2156

&& opt->retval < OPT_R__LAST);

2157

int verification_option = (OPT_V__FIRST <= opt->retval

2158

&& opt->retval < OPT_V__LAST);

2159

2160

if (strcmp(opt->name, OPT_SECTION_STR) == 0

2161

|| strcmp(opt->name, OPT_MORE_STR) == 0) {

2162

i--;

2163

continue;

2164

}

2165

if (provider_option || rand_state_option || verification_option)

2166

i--;

2167

switch (opt->valtype) {

2168

case '-':

2169

case 'p':

2170

case 'n':

2171

case 'N':

2172

case 'l':

2173

if (!conf_get_number_e(conf, opt_section, opt->name, &num)) {

2174

ERR_clear_error();

2175

continue; /* option not provided */

2176

}

2177

if (opt->valtype == 'p' && num <= 0) {

2178

opt_printf_stderr("Non-positive number \"%ld\" for config option -%s\n",

2179

num, opt->name);

2180

return -1;

2181

}

2182

if (opt->valtype == 'N' && num < 0) {

2183

opt_printf_stderr("Negative number \"%ld\" for config option -%s\n",

2184

num, opt->name);

2185

return -1;

2186

}

2187

break;

2188

case 's':

2189

case '>':

2190

case 'M':

2191

txt = conf_get_string(conf, opt_section, opt->name);

2192

if (txt == NULL((void*)0)) {

2193

ERR_clear_error();

2194

continue; /* option not provided */

2195

}

2196

break;

2197

default:

2198

CMP_err2("internal: unsupported type '%c' for option '%s'",((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"internal: unsupported type '%c' for option '%s'""%s" "\n", (
strcmp(__func__, "(unknown function)") == 0 ? "CMP" : __func__
), "../deps/openssl/openssl/apps/cmp.c", 2199, "error", opt->
valtype, opt->name, ""))))

2199

opt->valtype, opt->name)((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"internal: unsupported type '%c' for option '%s'""%s" "\n", (
strcmp(__func__, "(unknown function)") == 0 ? "CMP" : __func__
), "../deps/openssl/openssl/apps/cmp.c", 2199, "error", opt->
valtype, opt->name, ""))));

2200

return 0;

2201

break;

2202

}

2203

if (provider_option || verification_option) {

2204

int conf_argc = 1;

2205

char *conf_argv[3];

2206

char arg1[82];

2207

2208

BIO_snprintf(arg1, 81, "-%s", (char *)opt->name);

2209

conf_argv[0] = prog;

2210

conf_argv[1] = arg1;

2211

if (opt->valtype == '-') {

2212

if (num != 0)

2213

conf_argc = 2;

2214

} else {

2215

conf_argc = 3;

2216

conf_argv[2] = conf_get_string(conf, opt_section, opt->name);

2217

/* not NULL */

2218

}

2219

if (conf_argc > 1) {

2220

(void)opt_init(conf_argc, conf_argv, cmp_options);

2221

2222

if (provider_option

2223

? !opt_provider(opt_next())

2224

: !opt_verify(opt_next(), vpm)) {

2225

CMP_err2("for option '%s' in config file section '%s'",((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"for option '%s' in config file section '%s'""%s" "\n", (strcmp
(__func__, "(unknown function)") == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 2226, "error", opt->name, opt_section, ""))))

2226

opt->name, opt_section)((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"for option '%s' in config file section '%s'""%s" "\n", (strcmp
(__func__, "(unknown function)") == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 2226, "error", opt->name, opt_section, ""))));

2227

return 0;

2228

}

2229

}

2230

} else {

2231

switch (opt->valtype) {

2232

case '-':

2233

case 'p':

2234

case 'n':

2235

case 'N':

2236

if (num < INT_MIN(-2147483647 -1) || INT_MAX2147483647 < num) {

2237

BIO_printf(bio_err,

2238

"integer value out of range for option '%s'\n",

2239

opt->name);

2240

return 0;

2241

}

2242

*cmp_vars[i].num = (int)num;

2243

break;

2244

case 'l':

2245

*cmp_vars[i].num_long = num;

2246

break;

2247

default:

2248

if (txt != NULL((void*)0) && txt[0] == '\0')

2249

txt = NULL((void*)0); /* reset option on empty string input */

2250

*cmp_vars[i].txt = txt;

2251

break;

2252

}

2253

}

2254

}

2255

2256

return 1;

2257

}

2258

2259

static char *opt_str(void)

2260

{

2261

char *arg = opt_arg();

2262

2263

if (arg[0] == '\0') {

2264

CMP_warn1("%s option argument is empty string, resetting option",((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"%s option argument is empty string, resetting option""%s%s"
"\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP" :
__func__), "../deps/openssl/openssl/apps/cmp.c", 2265, "warning"
, opt_flag(), "", ""))))

2265

opt_flag())((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"%s option argument is empty string, resetting option""%s%s"
"\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP" :
__func__), "../deps/openssl/openssl/apps/cmp.c", 2265, "warning"
, opt_flag(), "", ""))));

2266

arg = NULL((void*)0);

2267

} else if (arg[0] == '-') {

2268

CMP_warn1("%s option argument starts with hyphen", opt_flag())((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"%s option argument starts with hyphen""%s%s" "\n", (strcmp(
__func__, "(unknown function)") == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 2268, "warning", opt_flag(), "", ""))));

2269

}

2270

return arg;

2271

}

2272

2273

/* returns 1 on success, 0 on error, -1 on -help (i.e., stop with success) */

2274

static int get_opts(int argc, char **argv)

2275

{

2276

OPTION_CHOICE o;

2277

2278

prog = opt_init(argc, argv, cmp_options);

2279

2280

while ((o = opt_next()) != OPT_EOF) {

2281

switch (o) {

2282

case OPT_EOF:

2283

case OPT_ERR:

2284

opthelp:

2285

BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);

2286

return 0;

2287

case OPT_HELP:

2288

opt_help(cmp_options);

2289

return -1;

2290

case OPT_CONFIG: /* has already been handled */

2291

case OPT_SECTION: /* has already been handled */

2292

break;

2293

case OPT_VERBOSITY:

2294

if (!set_verbosity(opt_int_arg()))

2295

goto opthelp;

2296

break;

2297

#ifndef OPENSSL_NO_SOCK

2298

case OPT_SERVER:

2299

opt_server = opt_str();

2300

break;

2301

case OPT_PROXY:

2302

opt_proxy = opt_str();

2303

break;

2304

case OPT_NO_PROXY:

2305

opt_no_proxy = opt_str();

2306

break;

2307

#endif

2308

case OPT_RECIPIENT:

2309

opt_recipient = opt_str();

2310

break;

2311

case OPT_PATH:

2312

opt_path = opt_str();

2313

break;

2314

case OPT_KEEP_ALIVE:

2315

opt_keep_alive = opt_int_arg();

2316

if (opt_keep_alive > 2) {

2317

CMP_err("-keep_alive argument must be 0, 1, or 2")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"-keep_alive argument must be 0, 1, or 2""%s%s%s" "\n", (strcmp
(__func__, "(unknown function)") == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 2317, "error", "", "", ""))));

2318

goto opthelp;

2319

}

2320

break;

2321

case OPT_MSG_TIMEOUT:

2322

opt_msg_timeout = opt_int_arg();

2323

break;

2324

case OPT_TOTAL_TIMEOUT:

2325

opt_total_timeout = opt_int_arg();

2326

break;

2327

#ifndef OPENSSL_NO_SOCK

2328

case OPT_TLS_USED:

2329

opt_tls_used = 1;

2330

break;

2331

case OPT_TLS_CERT:

2332

opt_tls_cert = opt_str();

2333

break;

2334

case OPT_TLS_KEY:

2335

opt_tls_key = opt_str();

2336

break;

2337

case OPT_TLS_KEYPASS:

2338

opt_tls_keypass = opt_str();

2339

break;

2340

case OPT_TLS_EXTRA:

2341

opt_tls_extra = opt_str();

2342

break;

2343

case OPT_TLS_TRUSTED:

2344

opt_tls_trusted = opt_str();

2345

break;

2346

case OPT_TLS_HOST:

2347

opt_tls_host = opt_str();

2348

break;

2349

#endif

2350

2351

case OPT_REF:

2352

opt_ref = opt_str();

2353

break;

2354

case OPT_SECRET:

2355

opt_secret = opt_str();

2356

break;

2357

case OPT_CERT:

2358

opt_cert = opt_str();

2359

break;

2360

case OPT_OWN_TRUSTED:

2361

opt_own_trusted = opt_str();

2362

break;

2363

case OPT_KEY:

2364

opt_key = opt_str();

2365

break;

2366

case OPT_KEYPASS:

2367

opt_keypass = opt_str();

2368

break;

2369

case OPT_DIGEST:

2370

opt_digest = opt_str();

2371

break;

2372

case OPT_MAC:

2373

opt_mac = opt_str();

2374

break;

2375

case OPT_EXTRACERTS:

2376

opt_extracerts = opt_str();

2377

break;

2378

case OPT_UNPROTECTED_REQUESTS:

2379

opt_unprotected_requests = 1;

2380

break;

2381

2382

case OPT_TRUSTED:

2383

opt_trusted = opt_str();

2384

break;

2385

case OPT_UNTRUSTED:

2386

opt_untrusted = opt_str();

2387

break;

2388

case OPT_SRVCERT:

2389

opt_srvcert = opt_str();

2390

break;

2391

case OPT_EXPECT_SENDER:

2392

opt_expect_sender = opt_str();

2393

break;

2394

case OPT_IGNORE_KEYUSAGE:

2395

opt_ignore_keyusage = 1;

2396

break;

2397

case OPT_UNPROTECTED_ERRORS:

2398

opt_unprotected_errors = 1;

2399

break;

2400

case OPT_EXTRACERTSOUT:

2401

opt_extracertsout = opt_str();

2402

break;

2403

case OPT_CACERTSOUT:

2404

opt_cacertsout = opt_str();

2405

break;

2406

2407

case OPT_V_CASESOPT_V__FIRST: case OPT_V__LAST: break; case OPT_V_POLICY: case
OPT_V_PURPOSE: case OPT_V_VERIFY_NAME: case OPT_V_VERIFY_DEPTH
: case OPT_V_VERIFY_AUTH_LEVEL: case OPT_V_ATTIME: case OPT_V_VERIFY_HOSTNAME
: case OPT_V_VERIFY_EMAIL: case OPT_V_VERIFY_IP: case OPT_V_IGNORE_CRITICAL
: case OPT_V_ISSUER_CHECKS: case OPT_V_CRL_CHECK: case OPT_V_CRL_CHECK_ALL
: case OPT_V_POLICY_CHECK: case OPT_V_EXPLICIT_POLICY: case OPT_V_INHIBIT_ANY
: case OPT_V_INHIBIT_MAP: case OPT_V_X509_STRICT: case OPT_V_EXTENDED_CRL
: case OPT_V_USE_DELTAS: case OPT_V_POLICY_PRINT: case OPT_V_CHECK_SS_SIG
: case OPT_V_TRUSTED_FIRST: case OPT_V_SUITEB_128_ONLY: case OPT_V_SUITEB_128
: case OPT_V_SUITEB_192: case OPT_V_PARTIAL_CHAIN: case OPT_V_NO_ALT_CHAINS
: case OPT_V_NO_CHECK_TIME: case OPT_V_ALLOW_PROXY_CERTS:

2408

if (!opt_verify(o, vpm))

2409

goto opthelp;

2410

break;

2411

case OPT_CMD:

2412

opt_cmd_s = opt_str();

2413

break;

2414

case OPT_INFOTYPE:

2415

opt_infotype_s = opt_str();

2416

break;

2417

case OPT_GENINFO:

2418

opt_geninfo = opt_str();

2419

break;

2420

2421

case OPT_NEWKEY:

2422

opt_newkey = opt_str();

2423

break;

2424

case OPT_NEWKEYPASS:

2425

opt_newkeypass = opt_str();

2426

break;

2427

case OPT_SUBJECT:

2428

opt_subject = opt_str();

2429

break;

2430

case OPT_ISSUER:

2431

opt_issuer = opt_str();

2432

break;

2433

case OPT_DAYS:

2434

opt_days = opt_int_arg();

2435

break;

2436

case OPT_REQEXTS:

2437

opt_reqexts = opt_str();

2438

break;

2439

case OPT_SANS:

2440

opt_sans = opt_str();

2441

break;

2442

case OPT_SAN_NODEFAULT:

2443

opt_san_nodefault = 1;

2444

break;

2445

case OPT_POLICIES:

2446

opt_policies = opt_str();

2447

break;

2448

case OPT_POLICY_OIDS:

2449

opt_policy_oids = opt_str();

2450

break;

2451

case OPT_POLICY_OIDS_CRITICAL:

2452

opt_policy_oids_critical = 1;

2453

break;

2454

case OPT_POPO:

2455

opt_popo = opt_int_arg();

2456

if (opt_popo < OSSL_CRMF_POPO_NONE-1

2457

|| opt_popo > OSSL_CRMF_POPO_KEYENC2) {

2458

CMP_err("invalid popo spec. Valid values are -1 .. 2")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"invalid popo spec. Valid values are -1 .. 2""%s%s%s" "\n", (
strcmp(__func__, "(unknown function)") == 0 ? "CMP" : __func__
), "../deps/openssl/openssl/apps/cmp.c", 2458, "error", "", ""
, ""))));

2459

goto opthelp;

2460

}

2461

break;

2462

case OPT_CSR:

2463

opt_csr = opt_arg();

2464

break;

2465

case OPT_OUT_TRUSTED:

2466

opt_out_trusted = opt_str();

2467

break;

2468

case OPT_IMPLICIT_CONFIRM:

2469

opt_implicit_confirm = 1;

2470

break;

2471

case OPT_DISABLE_CONFIRM:

2472

opt_disable_confirm = 1;

2473

break;

2474

case OPT_CERTOUT:

2475

opt_certout = opt_str();

2476

break;

2477

case OPT_CHAINOUT:

2478

opt_chainout = opt_str();

2479

break;

2480

case OPT_OLDCERT:

2481

opt_oldcert = opt_str();

2482

break;

2483

case OPT_REVREASON:

2484

opt_revreason = opt_int_arg();

2485

if (opt_revreason < CRL_REASON_NONE-1

2486

|| opt_revreason > CRL_REASON_AA_COMPROMISE10

2487

|| opt_revreason == 7) {

2488

CMP_err("invalid revreason. Valid values are -1 .. 6, 8 .. 10")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"invalid revreason. Valid values are -1 .. 6, 8 .. 10""%s%s%s"
"\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP" :
__func__), "../deps/openssl/openssl/apps/cmp.c", 2488, "error"
, "", "", ""))));

2489

goto opthelp;

2490

}

2491

break;

2492

case OPT_CERTFORM:

2493

opt_certform_s = opt_str();

2494

break;

2495

case OPT_KEYFORM:

2496

opt_keyform_s = opt_str();

2497

break;

2498

case OPT_OTHERPASS:

2499

opt_otherpass = opt_str();

2500

break;

2501

#ifndef OPENSSL_NO_ENGINE

2502

case OPT_ENGINE:

2503

opt_engine = opt_str();

2504

break;

2505

#endif

2506

case OPT_PROV_CASESOPT_PROV__FIRST: case OPT_PROV__LAST: break; case OPT_PROV_PROVIDER
: case OPT_PROV_PROVIDER_PATH: case OPT_PROV_PROPQUERY:

2507

if (!opt_provider(o))

2508

goto opthelp;

2509

break;

2510

case OPT_R_CASESOPT_R__FIRST: case OPT_R__LAST: break; case OPT_R_RAND: case OPT_R_WRITERAND:

2511

if (!opt_rand(o))

2512

goto opthelp;

2513

break;

2514

2515

case OPT_BATCH:

2516

opt_batch = 1;

2517

break;

2518

case OPT_REPEAT:

2519

opt_repeat = opt_int_arg();

2520

break;

2521

case OPT_REQIN:

2522

opt_reqin = opt_str();

2523

break;

2524

case OPT_REQIN_NEW_TID:

2525

opt_reqin_new_tid = 1;

2526

break;

2527

case OPT_REQOUT:

2528

opt_reqout = opt_str();

2529

break;

2530

case OPT_RSPIN:

2531

opt_rspin = opt_str();

2532

break;

2533

case OPT_RSPOUT:

2534

opt_rspout = opt_str();

2535

break;

2536

case OPT_USE_MOCK_SRV:

2537

opt_use_mock_srv = 1;

2538

break;

2539

2540

#ifndef OPENSSL_NO_SOCK

2541

case OPT_PORT:

2542

opt_port = opt_str();

2543

break;

2544

case OPT_MAX_MSGS:

2545

opt_max_msgs = opt_int_arg();

2546

break;

2547

#endif

2548

case OPT_SRV_REF:

2549

opt_srv_ref = opt_str();

2550

break;

2551

case OPT_SRV_SECRET:

2552

opt_srv_secret = opt_str();

2553

break;

2554

case OPT_SRV_CERT:

2555

opt_srv_cert = opt_str();

2556

break;

2557

case OPT_SRV_KEY:

2558

opt_srv_key = opt_str();

2559

break;

2560

case OPT_SRV_KEYPASS:

2561

opt_srv_keypass = opt_str();

2562

break;

2563

case OPT_SRV_TRUSTED:

2564

opt_srv_trusted = opt_str();

2565

break;

2566

case OPT_SRV_UNTRUSTED:

2567

opt_srv_untrusted = opt_str();

2568

break;

2569

case OPT_RSP_CERT:

2570

opt_rsp_cert = opt_str();

2571

break;

2572

case OPT_RSP_EXTRACERTS:

2573

opt_rsp_extracerts = opt_str();

2574

break;

2575

case OPT_RSP_CAPUBS:

2576

opt_rsp_capubs = opt_str();

2577

break;

2578

case OPT_POLL_COUNT:

2579

opt_poll_count = opt_int_arg();

2580

break;

2581

case OPT_CHECK_AFTER:

2582

opt_check_after = opt_int_arg();

2583

break;

2584

case OPT_GRANT_IMPLICITCONF:

2585

opt_grant_implicitconf = 1;

2586

break;

2587

case OPT_PKISTATUS:

2588

opt_pkistatus = opt_int_arg();

2589

break;

2590

case OPT_FAILURE:

2591

opt_failure = opt_int_arg();

2592

break;

2593

case OPT_FAILUREBITS:

2594

opt_failurebits = opt_int_arg();

2595

break;

2596

case OPT_STATUSSTRING:

2597

opt_statusstring = opt_str();

2598

break;

2599

case OPT_SEND_ERROR:

2600

opt_send_error = 1;

2601

break;

2602

case OPT_SEND_UNPROTECTED:

2603

opt_send_unprotected = 1;

2604

break;

2605

case OPT_SEND_UNPROT_ERR:

2606

opt_send_unprot_err = 1;

2607

break;

2608

case OPT_ACCEPT_UNPROTECTED:

2609

opt_accept_unprotected = 1;

2610

break;

2611

case OPT_ACCEPT_UNPROT_ERR:

2612

opt_accept_unprot_err = 1;

2613

break;

2614

case OPT_ACCEPT_RAVERIFIED:

2615

opt_accept_raverified = 1;

2616

break;

2617

}

2618

}

2619

2620

/* No extra args. */

2621

argc = opt_num_rest();

2622

argv = opt_rest();

2623

if (argc != 0)

2624

goto opthelp;

2625

return 1;

2626

}

2627

2628

#ifndef OPENSSL_NO_SOCK

2629

static int cmp_server(OSSL_CMP_CTX *srv_cmp_ctx) {

2630

BIO *acbio;

2631

BIO *cbio = NULL((void*)0);

2632

int keep_alive = 0;

2633

int msgs = 0;

2634

int retry = 1;

2635

int ret = 1;

2636

2637

if ((acbio = http_server_init_bio(prog, opt_port)) == NULL((void*)0))

2638

return 0;

2639

while (opt_max_msgs <= 0 || msgs < opt_max_msgs) {

2640

char *path = NULL((void*)0);

2641

OSSL_CMP_MSG *req = NULL((void*)0);

2642

OSSL_CMP_MSG *resp = NULL((void*)0);

2643

2644

ret = http_server_get_asn1_req(ASN1_ITEM_rptr(OSSL_CMP_MSG)(OSSL_CMP_MSG_it()),

2645

(ASN1_VALUE **)&req, &path,

2646

&cbio, acbio, &keep_alive,

2647

prog, opt_port, 0, 0);

2648

if (ret == 0) { /* no request yet */

2649

if (retry) {

2650

ossl_sleep(1000);

2651

retry = 0;

2652

continue;

2653

}

2654

ret = 0;

2655

goto next;

2656

}

2657

if (ret++ == -1) /* fatal error */

2658

break;

2659

2660

ret = 0;

2661

msgs++;

2662

if (req != NULL((void*)0)) {

2663

if (strcmp(path, "") != 0 && strcmp(path, "pkix/") != 0) {

2664

(void)http_server_send_status(cbio, 404, "Not Found");

2665

CMP_err1("expecting empty path or 'pkix/' but got '%s'",((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"expecting empty path or 'pkix/' but got '%s'""%s%s" "\n", (
strcmp(__func__, "(unknown function)") == 0 ? "CMP" : __func__
), "../deps/openssl/openssl/apps/cmp.c", 2666, "error", path,
"", ""))))

2666

path)((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"expecting empty path or 'pkix/' but got '%s'""%s%s" "\n", (
strcmp(__func__, "(unknown function)") == 0 ? "CMP" : __func__
), "../deps/openssl/openssl/apps/cmp.c", 2666, "error", path,
"", ""))));

2667

OPENSSL_free(path)CRYPTO_free(path, "../deps/openssl/openssl/apps/cmp.c", 2667);

2668

OSSL_CMP_MSG_free(req);

2669

goto next;

2670

}

2671

OPENSSL_free(path)CRYPTO_free(path, "../deps/openssl/openssl/apps/cmp.c", 2671);

2672

resp = OSSL_CMP_CTX_server_perform(cmp_ctx, req);

2673

OSSL_CMP_MSG_free(req);

2674

if (resp == NULL((void*)0)) {

2675

(void)http_server_send_status(cbio,

2676

500, "Internal Server Error");

2677

break; /* treated as fatal error */

2678

}

2679

ret = http_server_send_asn1_resp(cbio, keep_alive,

2680

"application/pkixcmp",

2681

ASN1_ITEM_rptr(OSSL_CMP_MSG)(OSSL_CMP_MSG_it()),

2682

(const ASN1_VALUE *)resp);

2683

OSSL_CMP_MSG_free(resp);

2684

if (!ret)

2685

break; /* treated as fatal error */

2686

}

2687

if (!ret) { /* on transmission error, cancel CMP transaction */

2689

(void)OSSL_CMP_CTX_set1_transactionID(srv_cmp_ctx, NULL((void*)0));

2690

(void)OSSL_CMP_CTX_set1_senderNonce(srv_cmp_ctx, NULL((void*)0));

2691

}

2692

if (!ret || !keep_alive

2693

|| OSSL_CMP_CTX_get_status(srv_cmp_ctx) == -1

2694

/* transaction closed by OSSL_CMP_CTX_server_perform() */) {

2695

BIO_free_all(cbio);

2696

cbio = NULL((void*)0);

2697

}

2698

}

2699

2700

BIO_free_all(cbio);

2701

BIO_free_all(acbio);

2702

return ret;

2703

}

2704

#endif

2705

2706

int cmp_main(int argc, char **argv)

2707

{

2708

char *configfile = NULL((void*)0);

2709

int i;

2710

X509 *newcert = NULL((void*)0);

2711

ENGINE *engine = NULL((void*)0);

2712

OSSL_CMP_CTX *srv_cmp_ctx = NULL((void*)0);

2713

int ret = 0; /* default: failure */

2714

2715

prog = opt_appname(argv[0]);

2716

if (argc <= 1) {

2717

opt_help(cmp_options);

2718

goto err;

2719

}

2720

2721

/*

2722

* handle options -config, -section, and -verbosity upfront

2723

* to take effect for other options

2724

*/

2725

for (i = 1; i < argc - 1; i++) {

2726

if (*argv[i] == '-') {

2727

if (!strcmp(argv[i] + 1, cmp_options[OPT_CONFIG - OPT_HELP].name))

2728

opt_config = argv[++i];

2729

else if (!strcmp(argv[i] + 1,

2730

cmp_options[OPT_SECTION - OPT_HELP].name))

2731

opt_section = argv[++i];

2732

else if (strcmp(argv[i] + 1,

2733

cmp_options[OPT_VERBOSITY - OPT_HELP].name) == 0

2734

&& !set_verbosity(atoi(argv[++i])))

2735

goto err;

2736

}

2737

}

2738

if (opt_section[0] == '\0') /* empty string */

2739

opt_section = DEFAULT_SECTION"default";

2740

2741

vpm = X509_VERIFY_PARAM_new();

2742

if (vpm == NULL((void*)0)) {

2743

CMP_err("out of memory")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"out of memory""%s%s%s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 2743, "error", "", "", ""))));

2744

goto err;

2745

}

2746

2747

/* read default values for options from config file */

2748

configfile = opt_config != NULL((void*)0) ? opt_config : default_config_file;

2749

if (configfile != NULL((void*)0) && configfile[0] != '\0' /* non-empty string */

2750

&& (configfile != default_config_file || access(configfile, F_OK0) != -1)) {

2751

CMP_info2("using section(s) '%s' of OpenSSL configuration file '%s'",((void)(6 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"using section(s) '%s' of OpenSSL configuration file '%s'""%s"
"\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP" :
__func__), "../deps/openssl/openssl/apps/cmp.c", 2752, "info"
, opt_section, configfile, ""))))

2752

opt_section, configfile)((void)(6 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"using section(s) '%s' of OpenSSL configuration file '%s'""%s"
"\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP" :
__func__), "../deps/openssl/openssl/apps/cmp.c", 2752, "info"
, opt_section, configfile, ""))));

2753

conf = app_load_config(configfile)app_load_config_internal(configfile, 0);

2754

if (conf == NULL((void*)0)) {

2755

goto err;

2756

} else {

2757

if (strcmp(opt_section, CMP_SECTION"cmp") == 0) { /* default */

2758

if (!NCONF_get_section(conf, opt_section))

2759

CMP_info2("no [%s] section found in config file '%s';"((void)(6 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"no [%s] section found in config file '%s';" " will thus use just [default] and unnamed section if present"
"%s" "\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP"
: __func__), "../deps/openssl/openssl/apps/cmp.c", 2761, "info"
, opt_section, configfile, ""))))

2760

" will thus use just [default] and unnamed section if present",((void)(6 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"no [%s] section found in config file '%s';" " will thus use just [default] and unnamed section if present"
"%s" "\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP"
: __func__), "../deps/openssl/openssl/apps/cmp.c", 2761, "info"
, opt_section, configfile, ""))))

2761

opt_section, configfile)((void)(6 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"no [%s] section found in config file '%s';" " will thus use just [default] and unnamed section if present"
"%s" "\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP"
: __func__), "../deps/openssl/openssl/apps/cmp.c", 2761, "info"
, opt_section, configfile, ""))));

2762

} else {

2763

const char *end = opt_section + strlen(opt_section);

2764

while ((end = prev_item(opt_section, end)) != NULL((void*)0)) {

2765

if (!NCONF_get_section(conf, opt_item)) {

2766

CMP_err2("no [%s] section found in config file '%s'",((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"no [%s] section found in config file '%s'""%s" "\n", (strcmp
(__func__, "(unknown function)") == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 2767, "error", opt_item, configfile, ""))))

2767

opt_item, configfile)((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"no [%s] section found in config file '%s'""%s" "\n", (strcmp
(__func__, "(unknown function)") == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 2767, "error", opt_item, configfile, ""))));

2768

goto err;

2769

}

2770

}

2771

}

2772

ret = read_config();

2773

if (!set_verbosity(opt_verbosity)) /* just for checking range */

2774

ret = -1;

2775

if (ret <= 0) {

2776

if (ret == -1)

2777

BIO_printf(bio_err, "Use -help for summary.\n");

2778

goto err;

2779

}

2780

}

2781

}

2782

(void)BIO_flush(bio_err)(int)BIO_ctrl(bio_err,11,0,((void*)0)); /* prevent interference with opt_help() */

2783

2784

ret = get_opts(argc, argv);

2785

if (ret <= 0)

2786

goto err;

2787

ret = 0;

2788

if (!app_RAND_load())

2789

goto err;

2790

2791

if (opt_batch)

2792

set_base_ui_method(UI_null());

2793

2794

if (opt_engine != NULL((void*)0)) {

2795

engine = setup_engine_methods(opt_engine, 0 /* not: ENGINE_METHOD_ALL */, 0);

2796

if (engine == NULL((void*)0)) {

2797

CMP_err1("cannot load engine %s", opt_engine)((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"cannot load engine %s""%s%s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 2797, "error", opt_engine, "", ""))));

2798

goto err;

2799

}

2800

}

2801

2802

cmp_ctx = OSSL_CMP_CTX_new(app_get0_libctx(), app_get0_propq());

2803

if (cmp_ctx == NULL((void*)0))

2804

goto err;

2805

OSSL_CMP_CTX_set_log_verbosity(cmp_ctx, opt_verbosity)OSSL_CMP_CTX_set_option(cmp_ctx, 0, opt_verbosity);

2806

if (!OSSL_CMP_CTX_set_log_cb(cmp_ctx, print_to_bio_out)) {

2807

CMP_err1("cannot set up error reporting and logging for %s", prog)((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"cannot set up error reporting and logging for %s""%s%s" "\n"
, (strcmp(__func__, "(unknown function)") == 0 ? "CMP" : __func__
), "../deps/openssl/openssl/apps/cmp.c", 2807, "error", prog,
"", ""))));

2808

goto err;

2809

}

2810

2811

#ifndef OPENSSL_NO_SOCK

2812

if ((opt_tls_cert != NULL((void*)0) || opt_tls_key != NULL((void*)0)

2813

|| opt_tls_keypass != NULL((void*)0) || opt_tls_extra != NULL((void*)0)

2814

|| opt_tls_trusted != NULL((void*)0) || opt_tls_host != NULL((void*)0))

2815

&& !opt_tls_used)

2816

CMP_warn("Ingnoring TLS options(s) since -tls_used is not given")((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"Ingnoring TLS options(s) since -tls_used is not given""%s%s%s"
"\n", (strcmp(__func__, "(unknown function)") == 0 ? "CMP" :
__func__), "../deps/openssl/openssl/apps/cmp.c", 2816, "warning"
, "", "", ""))));

2817

if (opt_port != NULL((void*)0)) {

2818

if (opt_tls_used) {

2819

CMP_err("-tls_used option not supported with -port option")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"-tls_used option not supported with -port option""%s%s%s" "\n"
, (strcmp(__func__, "(unknown function)") == 0 ? "CMP" : __func__
), "../deps/openssl/openssl/apps/cmp.c", 2819, "error", "", ""
, ""))));

2820

goto err;

2821

}

2822

if (opt_use_mock_srv || opt_server != NULL((void*)0) || opt_rspin != NULL((void*)0)) {

2823

CMP_err("cannot use -port with -use_mock_srv, -server, or -rspin options")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"cannot use -port with -use_mock_srv, -server, or -rspin options"
"%s%s%s" "\n", (strcmp(__func__, "(unknown function)") == 0 ?
"CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c", 2823
, "error", "", "", ""))));

2824

goto err;

2825

}

2826

}

2827

if (opt_server != NULL((void*)0) && opt_use_mock_srv) {

2828

CMP_err("cannot use both -server and -use_mock_srv options")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"cannot use both -server and -use_mock_srv options""%s%s%s" "\n"
, (strcmp(__func__, "(unknown function)") == 0 ? "CMP" : __func__
), "../deps/openssl/openssl/apps/cmp.c", 2828, "error", "", ""
, ""))));

2829

goto err;

2830

}

2831

#endif

2832

if (opt_rspin != NULL((void*)0) && opt_use_mock_srv) {

2833

CMP_err("cannot use both -rspin and -use_mock_srv options")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"cannot use both -rspin and -use_mock_srv options""%s%s%s" "\n"
, (strcmp(__func__, "(unknown function)") == 0 ? "CMP" : __func__
), "../deps/openssl/openssl/apps/cmp.c", 2833, "error", "", ""
, ""))));

2834

goto err;

2835

}

2836

2837

if (opt_use_mock_srv

2838

#ifndef OPENSSL_NO_SOCK

2839

|| opt_port != NULL((void*)0)

2840

#endif

2841

) {

2842

OSSL_CMP_SRV_CTX *srv_ctx;

2843

2844

if ((srv_ctx = setup_srv_ctx(engine)) == NULL((void*)0))

2845

goto err;

2846

srv_cmp_ctx = OSSL_CMP_SRV_CTX_get0_cmp_ctx(srv_ctx);

2847

OSSL_CMP_CTX_set_transfer_cb_arg(cmp_ctx, srv_ctx);

2848

if (!OSSL_CMP_CTX_set_log_cb(srv_cmp_ctx, print_to_bio_err)) {

2849

CMP_err1("cannot set up error reporting and logging for %s", prog)((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"cannot set up error reporting and logging for %s""%s%s" "\n"
, (strcmp(__func__, "(unknown function)") == 0 ? "CMP" : __func__
), "../deps/openssl/openssl/apps/cmp.c", 2849, "error", prog,
"", ""))));

2850

goto err;

2851

}

2852

OSSL_CMP_CTX_set_log_verbosity(srv_cmp_ctx, opt_verbosity)OSSL_CMP_CTX_set_option(srv_cmp_ctx, 0, opt_verbosity);

2853

}

2854

2855

#ifndef OPENSSL_NO_SOCK

2856

if (opt_tls_used && (opt_use_mock_srv || opt_rspin != NULL((void*)0))) {

2857

CMP_warn("ignoring -tls_used option since -use_mock_srv or -rspin is given")((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"ignoring -tls_used option since -use_mock_srv or -rspin is given"
"%s%s%s" "\n", (strcmp(__func__, "(unknown function)") == 0 ?
"CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c", 2857
, "warning", "", "", ""))));

2858

opt_tls_used = 0;

2859

}

2860

2861

if (opt_port != NULL((void*)0)) { /* act as very basic CMP HTTP server */

2862

ret = cmp_server(srv_cmp_ctx);

2863

goto err;

2864

}

2865

2866

/* act as CMP client, possibly using internal mock server */

2867

2868

if (opt_server != NULL((void*)0)) {

2869

if (opt_rspin != NULL((void*)0)) {

2870

CMP_warn("ignoring -server option since -rspin is given")((void)(4 > opt_verbosity ? 0 : (BIO_printf(bio_out, "%s:%s:%d:CMP %s: "
"ignoring -server option since -rspin is given""%s%s%s" "\n"
, (strcmp(__func__, "(unknown function)") == 0 ? "CMP" : __func__
), "../deps/openssl/openssl/apps/cmp.c", 2870, "warning", "",
"", ""))));

2871

opt_server = NULL((void*)0);

2872

}

2873

}

2874

#endif

2875

2876

if (!setup_client_ctx(cmp_ctx, engine)) {

2877

CMP_err("cannot set up CMP context")((void)(3 > opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"cannot set up CMP context""%s%s%s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 2877, "error", "", "", ""))));

2878

goto err;

2879

}

2880

for (i = 0; i < opt_repeat; i++) {

2881

/* everything is ready, now connect and perform the command! */

2882

switch (opt_cmd) {

2883

case CMP_IR:

2884

newcert = OSSL_CMP_exec_IR_ses(cmp_ctx)OSSL_CMP_exec_certreq(cmp_ctx, 0, ((void*)0));

2885

if (newcert != NULL((void*)0))

2886

ret = 1;

2887

break;

2888

case CMP_KUR:

2889

newcert = OSSL_CMP_exec_KUR_ses(cmp_ctx)OSSL_CMP_exec_certreq(cmp_ctx, 7, ((void*)0));

2890

if (newcert != NULL((void*)0))

2891

ret = 1;

2892

break;

2893

case CMP_CR:

2894

newcert = OSSL_CMP_exec_CR_ses(cmp_ctx)OSSL_CMP_exec_certreq(cmp_ctx, 2, ((void*)0));

2895

if (newcert != NULL((void*)0))

2896

ret = 1;

2897

break;

2898

case CMP_P10CR:

2899

newcert = OSSL_CMP_exec_P10CR_ses(cmp_ctx)OSSL_CMP_exec_certreq(cmp_ctx, 4, ((void*)0));

2900

if (newcert != NULL((void*)0))

2901

ret = 1;

2902

break;

2903

case CMP_RR:

2904

ret = OSSL_CMP_exec_RR_ses(cmp_ctx);

2905

break;

2906

case CMP_GENM:

2907

{

2908

STACK_OF(OSSL_CMP_ITAV)struct stack_st_OSSL_CMP_ITAV *itavs;

2909

2910

if (opt_infotype != NID_undef0) {

2911

OSSL_CMP_ITAV *itav =

2912

OSSL_CMP_ITAV_create(OBJ_nid2obj(opt_infotype), NULL((void*)0));

2913

if (itav == NULL((void*)0))

2914

goto err;

2915

OSSL_CMP_CTX_push0_genm_ITAV(cmp_ctx, itav);

2916

}

2917

2918

if ((itavs = OSSL_CMP_exec_GENM_ses(cmp_ctx)) != NULL((void*)0)) {

2919

print_itavs(itavs);

2920

sk_OSSL_CMP_ITAV_pop_free(itavs, OSSL_CMP_ITAV_free)OPENSSL_sk_pop_free(ossl_check_OSSL_CMP_ITAV_sk_type(itavs),ossl_check_OSSL_CMP_ITAV_freefunc_type
(OSSL_CMP_ITAV_free));

2921

ret = 1;

2922

}

2923

break;

2924

}

2925

default:

2926

break;

2927

}

2928

if (OSSL_CMP_CTX_get_status(cmp_ctx) < 0)

2929

goto err; /* we got no response, maybe even did not send request */

2930

2931

{

2932

/* print PKIStatusInfo */

2933

int status = OSSL_CMP_CTX_get_status(cmp_ctx);

2934

char *buf = app_malloc(OSSL_CMP_PKISI_BUFLEN1024, "PKIStatusInfo buf");

2935

const char *string =

2936

OSSL_CMP_CTX_snprint_PKIStatus(cmp_ctx, buf,

2937

OSSL_CMP_PKISI_BUFLEN1024);

2938

const char *from = "", *server = "";

2939

2940

#ifndef OPENSSL_NO_SOCK

2941

if (opt_server != NULL((void*)0)) {

2942

from = " from ";

2943

server = opt_server;

2944

}

2945

#endif

2946

CMP_print(bio_err,((void)(status == 0 ? 6 : status == 2 || status == 3 ? 3 : 4 >
opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"received%s%s %s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 2957, status == 0 ? "info" : status == 2 ? "server error" :
status == 3 ? "internal error" : "warning", from, server, string
!= ((void*)0) ? string : "<unknown PKIStatus>"))))

2947

status == OSSL_CMP_PKISTATUS_accepted((void)(status == 0 ? 6 : status == 2 || status == 3 ? 3 : 4 >
opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"received%s%s %s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 2957, status == 0 ? "info" : status == 2 ? "server error" :
status == 3 ? "internal error" : "warning", from, server, string
!= ((void*)0) ? string : "<unknown PKIStatus>"))))

2948

? OSSL_CMP_LOG_INFO :((void)(status == 0 ? 6 : status == 2 || status == 3 ? 3 : 4 >
opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"received%s%s %s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 2957, status == 0 ? "info" : status == 2 ? "server error" :
status == 3 ? "internal error" : "warning", from, server, string
!= ((void*)0) ? string : "<unknown PKIStatus>"))))

2949

status == OSSL_CMP_PKISTATUS_rejection((void)(status == 0 ? 6 : status == 2 || status == 3 ? 3 : 4 >
opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"received%s%s %s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 2957, status == 0 ? "info" : status == 2 ? "server error" :
status == 3 ? "internal error" : "warning", from, server, string
!= ((void*)0) ? string : "<unknown PKIStatus>"))))

2950

|| status == OSSL_CMP_PKISTATUS_waiting((void)(status == 0 ? 6 : status == 2 || status == 3 ? 3 : 4 >
opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"received%s%s %s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 2957, status == 0 ? "info" : status == 2 ? "server error" :
status == 3 ? "internal error" : "warning", from, server, string
!= ((void*)0) ? string : "<unknown PKIStatus>"))))

2951

? OSSL_CMP_LOG_ERR : OSSL_CMP_LOG_WARNING,((void)(status == 0 ? 6 : status == 2 || status == 3 ? 3 : 4 >
opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"received%s%s %s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 2957, status == 0 ? "info" : status == 2 ? "server error" :
status == 3 ? "internal error" : "warning", from, server, string
!= ((void*)0) ? string : "<unknown PKIStatus>"))))

2952

status == OSSL_CMP_PKISTATUS_accepted ? "info" :((void)(status == 0 ? 6 : status == 2 || status == 3 ? 3 : 4 >
opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"received%s%s %s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 2957, status == 0 ? "info" : status == 2 ? "server error" :
status == 3 ? "internal error" : "warning", from, server, string
!= ((void*)0) ? string : "<unknown PKIStatus>"))))

2953

status == OSSL_CMP_PKISTATUS_rejection ? "server error" :((void)(status == 0 ? 6 : status == 2 || status == 3 ? 3 : 4 >
opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"received%s%s %s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 2957, status == 0 ? "info" : status == 2 ? "server error" :
status == 3 ? "internal error" : "warning", from, server, string
!= ((void*)0) ? string : "<unknown PKIStatus>"))))

2954

status == OSSL_CMP_PKISTATUS_waiting ? "internal error"((void)(status == 0 ? 6 : status == 2 || status == 3 ? 3 : 4 >
opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"received%s%s %s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 2957, status == 0 ? "info" : status == 2 ? "server error" :
status == 3 ? "internal error" : "warning", from, server, string
!= ((void*)0) ? string : "<unknown PKIStatus>"))))

2955

: "warning",((void)(status == 0 ? 6 : status == 2 || status == 3 ? 3 : 4 >
opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"received%s%s %s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 2957, status == 0 ? "info" : status == 2 ? "server error" :
status == 3 ? "internal error" : "warning", from, server, string
!= ((void*)0) ? string : "<unknown PKIStatus>"))))

2956

"received%s%s %s", from, server,((void)(status == 0 ? 6 : status == 2 || status == 3 ? 3 : 4 >
opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"received%s%s %s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 2957, status == 0 ? "info" : status == 2 ? "server error" :
status == 3 ? "internal error" : "warning", from, server, string
!= ((void*)0) ? string : "<unknown PKIStatus>"))))

2957

string != NULL ? string : "<unknown PKIStatus>")((void)(status == 0 ? 6 : status == 2 || status == 3 ? 3 : 4 >
opt_verbosity ? 0 : (BIO_printf(bio_err, "%s:%s:%d:CMP %s: "
"received%s%s %s" "\n", (strcmp(__func__, "(unknown function)"
) == 0 ? "CMP" : __func__), "../deps/openssl/openssl/apps/cmp.c"
, 2957, status == 0 ? "info" : status == 2 ? "server error" :
status == 3 ? "internal error" : "warning", from, server, string
!= ((void*)0) ? string : "<unknown PKIStatus>"))));

2958

OPENSSL_free(buf)CRYPTO_free(buf, "../deps/openssl/openssl/apps/cmp.c", 2958);

2959

}

2960

2961

if (save_free_certs(cmp_ctx, OSSL_CMP_CTX_get1_extraCertsIn(cmp_ctx),

2962

opt_extracertsout, "extra") < 0)

2963

ret = 0;

2964

if (!ret)

2965

goto err;

2966

ret = 0;

2967

if (save_free_certs(cmp_ctx, OSSL_CMP_CTX_get1_caPubs(cmp_ctx),

2968

opt_cacertsout, "CA") < 0)

2969

goto err;

2970

if (newcert != NULL((void*)0)) {

2971

STACK_OF(X509)struct stack_st_X509 *certs = sk_X509_new_null()((struct stack_st_X509 *)OPENSSL_sk_new_null());

2972

2973

if (!X509_add_cert(certs, newcert, X509_ADD_FLAG_UP_REF0x1)) {

2974

sk_X509_free(certs)OPENSSL_sk_free(ossl_check_X509_sk_type(certs));

2975

goto err;

2976

}

2977

if (save_free_certs(cmp_ctx, certs, opt_certout, "enrolled") < 0)

2978

goto err;

2979

}

2980

if (save_free_certs(cmp_ctx, OSSL_CMP_CTX_get1_newChain(cmp_ctx),

2981

opt_chainout, "chain") < 0)

2982

goto err;

2983

2984

if (!OSSL_CMP_CTX_reinit(cmp_ctx))

2985

goto err;

2986

}

2987

ret = 1;

2988

2989

err:

2990

/* in case we ended up here on error without proper cleaning */

2991

cleanse(opt_keypass);

2992

cleanse(opt_newkeypass);

2993

cleanse(opt_otherpass);

2994

#ifndef OPENSSL_NO_SOCK

2995

cleanse(opt_tls_keypass);

2996

#endif

2997

cleanse(opt_secret);

2998

cleanse(opt_srv_keypass);

2999

cleanse(opt_srv_secret);

3000

3001

if (ret != 1)

3002

OSSL_CMP_CTX_print_errors(cmp_ctx);

3003

3004

ossl_cmp_mock_srv_free(OSSL_CMP_CTX_get_transfer_cb_arg(cmp_ctx));

3005

#ifndef OPENSSL_NO_SOCK

3006

APP_HTTP_TLS_INFO_free(OSSL_CMP_CTX_get_http_cb_arg(cmp_ctx));

3007

#endif

3008

X509_STORE_free(OSSL_CMP_CTX_get_certConf_cb_arg(cmp_ctx));

3009

OSSL_CMP_CTX_free(cmp_ctx);

3010

X509_VERIFY_PARAM_free(vpm);

3011

release_engine(engine);

3012

3013

NCONF_free(conf); /* must not do as long as opt_... variables are used */

3014

OSSL_CMP_log_close();

3015

3016

return ret == 0 ? EXIT_FAILURE1 : EXIT_SUCCESS0; /* ret == -1 for -help */

3017

}

File:	out/../deps/openssl/openssl/apps/cmp.c
Warning:	line 2622, column 5 Value stored to 'argv' is never read

Bug Summary

Annotated Source Code