Bug Summary

File:out/../deps/openssl/openssl/crypto/cmp/cmp_ctx.c
Warning:line 381, column 9
Value stored to 'level_str' is never read

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple x86_64-unknown-linux-gnu -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name cmp_ctx.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=all -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/home/maurizio/node-v18.6.0/out -resource-dir /usr/local/lib/clang/16.0.0 -D V8_DEPRECATION_WARNINGS -D V8_IMMINENT_DEPRECATION_WARNINGS -D _GLIBCXX_USE_CXX11_ABI=1 -D NODE_OPENSSL_CONF_NAME=nodejs_conf -D NODE_OPENSSL_HAS_QUIC -D __STDC_FORMAT_MACROS -D OPENSSL_NO_PINSHARED -D OPENSSL_THREADS -D OPENSSL_NO_HW -D OPENSSL_API_COMPAT=0x10100001L -D STATIC_LEGACY -D NDEBUG -D OPENSSL_USE_NODELETE -D L_ENDIAN -D OPENSSL_BUILDING_OPENSSL -D AES_ASM -D BSAES_ASM -D CMLL_ASM -D ECP_NISTZ256_ASM -D GHASH_ASM -D KECCAK1600_ASM -D MD5_ASM -D OPENSSL_BN_ASM_GF2m -D OPENSSL_BN_ASM_MONT -D OPENSSL_BN_ASM_MONT5 -D OPENSSL_CPUID_OBJ -D OPENSSL_IA32_SSE2 -D PADLOCK_ASM -D POLY1305_ASM -D SHA1_ASM -D SHA256_ASM -D SHA512_ASM -D VPAES_ASM -D WHIRLPOOL_ASM -D X25519_ASM -D OPENSSL_PIC -D MODULESDIR="/home/maurizio/node-v18.6.0/out/Release/obj.target/deps/openssl/lib/openssl-modules" -D OPENSSLDIR="/home/maurizio/node-v18.6.0/out/Release/obj.target/deps/openssl" -D OPENSSLDIR="/etc/ssl" -D ENGINESDIR="/dev/null" -D TERMIOS -I ../deps/openssl/openssl -I ../deps/openssl/openssl/include -I ../deps/openssl/openssl/crypto -I ../deps/openssl/openssl/crypto/include -I ../deps/openssl/openssl/crypto/modes -I ../deps/openssl/openssl/crypto/ec/curve448 -I ../deps/openssl/openssl/crypto/ec/curve448/arch_32 -I ../deps/openssl/openssl/providers/common/include -I ../deps/openssl/openssl/providers/implementations/include -I ../deps/openssl/config -I ../deps/openssl/config/archs/linux-x86_64/asm -I ../deps/openssl/config/archs/linux-x86_64/asm/include -I ../deps/openssl/config/archs/linux-x86_64/asm/crypto -I ../deps/openssl/config/archs/linux-x86_64/asm/crypto/include/internal -I ../deps/openssl/config/archs/linux-x86_64/asm/providers/common/include -internal-isystem /usr/local/lib/clang/16.0.0/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-redhat-linux/8/../../../../x86_64-redhat-linux/include -internal-externc-isystem /include -internal-externc-isystem /usr/include -O3 -Wno-unused-parameter -Wno-missing-field-initializers -Wno-old-style-declaration -fdebug-compilation-dir=/home/maurizio/node-v18.6.0/out -ferror-limit 19 -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /tmp/scan-build-2022-08-22-142216-507842-1 -x c ../deps/openssl/openssl/crypto/cmp/cmp_ctx.c
1/*
2 * Copyright 2007-2021 The OpenSSL Project Authors. All Rights Reserved.
3 * Copyright Nokia 2007-2019
4 * Copyright Siemens AG 2015-2019
5 *
6 * Licensed under the Apache License 2.0 (the "License"). You may not use
7 * this file except in compliance with the License. You can obtain a copy
8 * in the file LICENSE in the source distribution or at
9 * https://www.openssl.org/source/license.html
10 */
11
12#include <openssl/trace.h>
13#include <openssl/bio.h>
14#include <openssl/ocsp.h> /* for OCSP_REVOKED_STATUS_* */
15
16#include "cmp_local.h"
17
18/* explicit #includes not strictly needed since implied by the above: */
19#include <openssl/cmp.h>
20#include <openssl/crmf.h>
21#include <openssl/err.h>
22
23/*
24 * Get current certificate store containing trusted root CA certs
25 */
26X509_STORE *OSSL_CMP_CTX_get0_trustedStore(const OSSL_CMP_CTX *ctx)
27{
28 if (ctx == NULL((void*)0)) {
29 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,29,__func__), ERR_set_error)((58),(103),((void*)0));
30 return NULL((void*)0);
31 }
32 return ctx->trusted;
33}
34
35/*
36 * Set certificate store containing trusted (root) CA certs and possibly CRLs
37 * and a cert verification callback function used for CMP server authentication.
38 * Any already existing store entry is freed. Given NULL, the entry is reset.
39 */
40int OSSL_CMP_CTX_set0_trustedStore(OSSL_CMP_CTX *ctx, X509_STORE *store)
41{
42 if (ctx == NULL((void*)0)) {
43 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,43,__func__), ERR_set_error)((58),(103),((void*)0));
44 return 0;
45 }
46 X509_STORE_free(ctx->trusted);
47 ctx->trusted = store;
48 return 1;
49}
50
51/* Get current list of non-trusted intermediate certs */
52STACK_OF(X509)struct stack_st_X509 *OSSL_CMP_CTX_get0_untrusted(const OSSL_CMP_CTX *ctx)
53{
54 if (ctx == NULL((void*)0)) {
55 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,55,__func__), ERR_set_error)((58),(103),((void*)0));
56 return NULL((void*)0);
57 }
58 return ctx->untrusted;
59}
60
61/*
62 * Set untrusted certificates for path construction in authentication of
63 * the CMP server and potentially others (TLS server, newly enrolled cert).
64 */
65int OSSL_CMP_CTX_set1_untrusted(OSSL_CMP_CTX *ctx, STACK_OF(X509)struct stack_st_X509 *certs)
66{
67 STACK_OF(X509)struct stack_st_X509 *untrusted = NULL((void*)0);
68
69 if (ctx == NULL((void*)0)) {
70 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,70,__func__), ERR_set_error)((58),(103),((void*)0));
71 return 0;
72 }
73 if (!ossl_x509_add_certs_new(&untrusted, certs,
74 X509_ADD_FLAG_UP_REF0x1 | X509_ADD_FLAG_NO_DUP0x4))
75 goto err;
76 sk_X509_pop_free(ctx->untrusted, X509_free)OPENSSL_sk_pop_free(ossl_check_X509_sk_type(ctx->untrusted
),ossl_check_X509_freefunc_type(X509_free));
77 ctx->untrusted = untrusted;
78 return 1;
79 err:
80 sk_X509_pop_free(untrusted, X509_free)OPENSSL_sk_pop_free(ossl_check_X509_sk_type(untrusted),ossl_check_X509_freefunc_type
(X509_free));
81 return 0;
82}
83
84static int cmp_ctx_set_md(OSSL_CMP_CTX *ctx, EVP_MD **pmd, int nid)
85{
86 EVP_MD *md = EVP_MD_fetch(ctx->libctx, OBJ_nid2sn(nid), ctx->propq);
87 /* fetching in advance to be able to throw error early if unsupported */
88
89 if (md == NULL((void*)0)) {
90 ERR_raise(ERR_LIB_CMP, CMP_R_UNSUPPORTED_ALGORITHM)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,90,__func__), ERR_set_error)((58),(136),((void*)0));
91 return 0;
92 }
93 EVP_MD_free(*pmd);
94 *pmd = md;
95 return 1;
96}
97
98/*
99 * Allocates and initializes OSSL_CMP_CTX context structure with default values.
100 * Returns new context on success, NULL on error
101 */
102OSSL_CMP_CTX *OSSL_CMP_CTX_new(OSSL_LIB_CTX *libctx, const char *propq)
103{
104 OSSL_CMP_CTX *ctx = OPENSSL_zalloc(sizeof(*ctx))CRYPTO_zalloc(sizeof(*ctx), "../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
, 104);
105
106 if (ctx == NULL((void*)0))
107 goto err;
108
109 ctx->libctx = libctx;
110 if (propq != NULL((void*)0) && (ctx->propq = OPENSSL_strdup(propq)CRYPTO_strdup(propq, "../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
, 110)) == NULL((void*)0))
111 goto oom;
112
113 ctx->log_verbosity = OSSL_CMP_LOG_INFO6;
114
115 ctx->status = -1;
116 ctx->failInfoCode = -1;
117
118 ctx->keep_alive = 1;
119 ctx->msg_timeout = -1;
120
121 if ((ctx->untrusted = sk_X509_new_null()((struct stack_st_X509 *)OPENSSL_sk_new_null())) == NULL((void*)0))
122 goto oom;
123
124 ctx->pbm_slen = 16;
125 if (!cmp_ctx_set_md(ctx, &ctx->pbm_owf, NID_sha256672))
126 goto err;
127 ctx->pbm_itercnt = 500;
128 ctx->pbm_mac = NID_hmac_sha1781;
129
130 if (!cmp_ctx_set_md(ctx, &ctx->digest, NID_sha256672))
131 goto err;
132 ctx->popoMethod = OSSL_CRMF_POPO_SIGNATURE1;
133 ctx->revocationReason = CRL_REASON_NONE-1;
134
135 /* all other elements are initialized to 0 or NULL, respectively */
136 return ctx;
137
138 oom:
139 ERR_raise(ERR_LIB_X509, ERR_R_MALLOC_FAILURE)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,139,__func__), ERR_set_error)((11),((256|((0x1 << 18L)
|(0x2 << 18L)))),((void*)0));
140 err:
141 OSSL_CMP_CTX_free(ctx);
142 return NULL((void*)0);
143}
144
145/* Prepare the OSSL_CMP_CTX for next use, partly re-initializing OSSL_CMP_CTX */
146int OSSL_CMP_CTX_reinit(OSSL_CMP_CTX *ctx)
147{
148 if (ctx == NULL((void*)0)) {
149 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,149,__func__), ERR_set_error)((58),(103),((void*)0));
150 return 0;
151 }
152
153 if (ctx->http_ctx != NULL((void*)0)) {
154 (void)OSSL_HTTP_close(ctx->http_ctx, 1);
155 ossl_cmp_debug(ctx, "disconnected from CMP server")ossl_cmp_print_log(7, ctx, __func__, "../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
, 155, "DEBUG", "%s", "disconnected from CMP server");
156 ctx->http_ctx = NULL((void*)0);
157 }
158 ctx->status = -1;
159 ctx->failInfoCode = -1;
160
161 return ossl_cmp_ctx_set0_statusString(ctx, NULL((void*)0))
162 && ossl_cmp_ctx_set0_newCert(ctx, NULL((void*)0))
163 && ossl_cmp_ctx_set1_newChain(ctx, NULL((void*)0))
164 && ossl_cmp_ctx_set1_caPubs(ctx, NULL((void*)0))
165 && ossl_cmp_ctx_set1_extraCertsIn(ctx, NULL((void*)0))
166 && ossl_cmp_ctx_set0_validatedSrvCert(ctx, NULL((void*)0))
167 && OSSL_CMP_CTX_set1_transactionID(ctx, NULL((void*)0))
168 && OSSL_CMP_CTX_set1_senderNonce(ctx, NULL((void*)0))
169 && ossl_cmp_ctx_set1_recipNonce(ctx, NULL((void*)0));
170}
171
172/* Frees OSSL_CMP_CTX variables allocated in OSSL_CMP_CTX_new() */
173void OSSL_CMP_CTX_free(OSSL_CMP_CTX *ctx)
174{
175 if (ctx == NULL((void*)0))
176 return;
177
178 if (ctx->http_ctx != NULL((void*)0)) {
179 (void)OSSL_HTTP_close(ctx->http_ctx, 1);
180 ossl_cmp_debug(ctx, "disconnected from CMP server")ossl_cmp_print_log(7, ctx, __func__, "../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
, 180, "DEBUG", "%s", "disconnected from CMP server");
181 }
182 OPENSSL_free(ctx->propq)CRYPTO_free(ctx->propq, "../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
, 182);
183 OPENSSL_free(ctx->serverPath)CRYPTO_free(ctx->serverPath, "../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
, 183);
184 OPENSSL_free(ctx->server)CRYPTO_free(ctx->server, "../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
, 184);
185 OPENSSL_free(ctx->proxy)CRYPTO_free(ctx->proxy, "../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
, 185);
186 OPENSSL_free(ctx->no_proxy)CRYPTO_free(ctx->no_proxy, "../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
, 186);
187
188 X509_free(ctx->srvCert);
189 X509_free(ctx->validatedSrvCert);
190 X509_NAME_free(ctx->expected_sender);
191 X509_STORE_free(ctx->trusted);
192 sk_X509_pop_free(ctx->untrusted, X509_free)OPENSSL_sk_pop_free(ossl_check_X509_sk_type(ctx->untrusted
),ossl_check_X509_freefunc_type(X509_free));
193
194 X509_free(ctx->cert);
195 sk_X509_pop_free(ctx->chain, X509_free)OPENSSL_sk_pop_free(ossl_check_X509_sk_type(ctx->chain),ossl_check_X509_freefunc_type
(X509_free));
196 EVP_PKEY_free(ctx->pkey);
197 ASN1_OCTET_STRING_free(ctx->referenceValue);
198 if (ctx->secretValue != NULL((void*)0))
199 OPENSSL_cleanse(ctx->secretValue->data, ctx->secretValue->length);
200 ASN1_OCTET_STRING_free(ctx->secretValue);
201 EVP_MD_free(ctx->pbm_owf);
202
203 X509_NAME_free(ctx->recipient);
204 EVP_MD_free(ctx->digest);
205 ASN1_OCTET_STRING_free(ctx->transactionID);
206 ASN1_OCTET_STRING_free(ctx->senderNonce);
207 ASN1_OCTET_STRING_free(ctx->recipNonce);
208 sk_OSSL_CMP_ITAV_pop_free(ctx->geninfo_ITAVs, OSSL_CMP_ITAV_free)OPENSSL_sk_pop_free(ossl_check_OSSL_CMP_ITAV_sk_type(ctx->
geninfo_ITAVs),ossl_check_OSSL_CMP_ITAV_freefunc_type(OSSL_CMP_ITAV_free
));
209 sk_X509_pop_free(ctx->extraCertsOut, X509_free)OPENSSL_sk_pop_free(ossl_check_X509_sk_type(ctx->extraCertsOut
),ossl_check_X509_freefunc_type(X509_free));
210
211 EVP_PKEY_free(ctx->newPkey);
212 X509_NAME_free(ctx->issuer);
213 X509_NAME_free(ctx->subjectName);
214 sk_GENERAL_NAME_pop_free(ctx->subjectAltNames, GENERAL_NAME_free)OPENSSL_sk_pop_free(ossl_check_GENERAL_NAME_sk_type(ctx->subjectAltNames
),ossl_check_GENERAL_NAME_freefunc_type(GENERAL_NAME_free));
215 sk_X509_EXTENSION_pop_free(ctx->reqExtensions, X509_EXTENSION_free)OPENSSL_sk_pop_free(ossl_check_X509_EXTENSION_sk_type(ctx->
reqExtensions),ossl_check_X509_EXTENSION_freefunc_type(X509_EXTENSION_free
));
216 sk_POLICYINFO_pop_free(ctx->policies, POLICYINFO_free)OPENSSL_sk_pop_free(ossl_check_POLICYINFO_sk_type(ctx->policies
),ossl_check_POLICYINFO_freefunc_type(POLICYINFO_free));
217 X509_free(ctx->oldCert);
218 X509_REQ_free(ctx->p10CSR);
219
220 sk_OSSL_CMP_ITAV_pop_free(ctx->genm_ITAVs, OSSL_CMP_ITAV_free)OPENSSL_sk_pop_free(ossl_check_OSSL_CMP_ITAV_sk_type(ctx->
genm_ITAVs),ossl_check_OSSL_CMP_ITAV_freefunc_type(OSSL_CMP_ITAV_free
));
221
222 sk_ASN1_UTF8STRING_pop_free(ctx->statusString, ASN1_UTF8STRING_free)OPENSSL_sk_pop_free(ossl_check_ASN1_UTF8STRING_sk_type(ctx->
statusString),ossl_check_ASN1_UTF8STRING_freefunc_type(ASN1_UTF8STRING_free
));
223 X509_free(ctx->newCert);
224 sk_X509_pop_free(ctx->newChain, X509_free)OPENSSL_sk_pop_free(ossl_check_X509_sk_type(ctx->newChain)
,ossl_check_X509_freefunc_type(X509_free));
225 sk_X509_pop_free(ctx->caPubs, X509_free)OPENSSL_sk_pop_free(ossl_check_X509_sk_type(ctx->caPubs),ossl_check_X509_freefunc_type
(X509_free));
226 sk_X509_pop_free(ctx->extraCertsIn, X509_free)OPENSSL_sk_pop_free(ossl_check_X509_sk_type(ctx->extraCertsIn
),ossl_check_X509_freefunc_type(X509_free));
227
228 OPENSSL_free(ctx)CRYPTO_free(ctx, "../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
, 228);
229}
230
231int ossl_cmp_ctx_set_status(OSSL_CMP_CTX *ctx, int status)
232{
233 if (!ossl_assert(ctx != NULL)((ctx != ((void*)0)) != 0))
234 return 0;
235 ctx->status = status;
236 return 1;
237}
238
239/*
240 * Returns the PKIStatus from the last CertRepMessage
241 * or Revocation Response or error message, -1 on error
242 */
243int OSSL_CMP_CTX_get_status(const OSSL_CMP_CTX *ctx)
244{
245 if (ctx == NULL((void*)0)) {
246 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,246,__func__), ERR_set_error)((58),(103),((void*)0));
247 return -1;
248 }
249 return ctx->status;
250}
251
252/*
253 * Returns the statusString from the last CertRepMessage
254 * or Revocation Response or error message, NULL on error
255 */
256OSSL_CMP_PKIFREETEXT *OSSL_CMP_CTX_get0_statusString(const OSSL_CMP_CTX *ctx)
257{
258 if (ctx == NULL((void*)0)) {
259 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,259,__func__), ERR_set_error)((58),(103),((void*)0));
260 return NULL((void*)0);
261 }
262 return ctx->statusString;
263}
264
265int ossl_cmp_ctx_set0_statusString(OSSL_CMP_CTX *ctx,
266 OSSL_CMP_PKIFREETEXT *text)
267{
268 if (!ossl_assert(ctx != NULL)((ctx != ((void*)0)) != 0))
269 return 0;
270 sk_ASN1_UTF8STRING_pop_free(ctx->statusString, ASN1_UTF8STRING_free)OPENSSL_sk_pop_free(ossl_check_ASN1_UTF8STRING_sk_type(ctx->
statusString),ossl_check_ASN1_UTF8STRING_freefunc_type(ASN1_UTF8STRING_free
));
271 ctx->statusString = text;
272 return 1;
273}
274
275int ossl_cmp_ctx_set0_validatedSrvCert(OSSL_CMP_CTX *ctx, X509 *cert)
276{
277 if (!ossl_assert(ctx != NULL)((ctx != ((void*)0)) != 0))
278 return 0;
279 X509_free(ctx->validatedSrvCert);
280 ctx->validatedSrvCert = cert;
281 return 1;
282}
283
284/* Set callback function for checking if the cert is ok or should be rejected */
285int OSSL_CMP_CTX_set_certConf_cb(OSSL_CMP_CTX *ctx, OSSL_CMP_certConf_cb_t cb)
286{
287 if (ctx == NULL((void*)0)) {
288 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,288,__func__), ERR_set_error)((58),(103),((void*)0));
289 return 0;
290 }
291 ctx->certConf_cb = cb;
292 return 1;
293}
294
295/*
296 * Set argument, respectively a pointer to a structure containing arguments,
297 * optionally to be used by the certConf callback.
298 */
299int OSSL_CMP_CTX_set_certConf_cb_arg(OSSL_CMP_CTX *ctx, void *arg)
300{
301 if (ctx == NULL((void*)0)) {
302 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,302,__func__), ERR_set_error)((58),(103),((void*)0));
303 return 0;
304 }
305 ctx->certConf_cb_arg = arg;
306 return 1;
307}
308
309/*
310 * Get argument, respectively the pointer to a structure containing arguments,
311 * optionally to be used by certConf callback.
312 * Returns callback argument set previously (NULL if not set or on error)
313 */
314void *OSSL_CMP_CTX_get_certConf_cb_arg(const OSSL_CMP_CTX *ctx)
315{
316 if (ctx == NULL((void*)0)) {
317 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,317,__func__), ERR_set_error)((58),(103),((void*)0));
318 return NULL((void*)0);
319 }
320 return ctx->certConf_cb_arg;
321}
322
323#ifndef OPENSSL_NO_TRACE
324static size_t ossl_cmp_log_trace_cb(const char *buf, size_t cnt,
325 int category, int cmd, void *vdata)
326{
327 OSSL_CMP_CTX *ctx = vdata;
328 const char *msg;
329 OSSL_CMP_severity level = -1;
330 char *func = NULL((void*)0);
331 char *file = NULL((void*)0);
332 int line = 0;
333
334 if (buf == NULL((void*)0) || cnt == 0 || cmd != OSSL_TRACE_CTRL_WRITE1 || ctx == NULL((void*)0))
335 return 0;
336 if (ctx->log_cb == NULL((void*)0))
337 return 1; /* silently drop message */
338
339 msg = ossl_cmp_log_parse_metadata(buf, &level, &func, &file, &line);
340
341 if (level > ctx->log_verbosity) /* excludes the case level is unknown */
342 goto end; /* suppress output since severity is not sufficient */
343
344 if (!ctx->log_cb(func != NULL((void*)0) ? func : "(no func)",
345 file != NULL((void*)0) ? file : "(no file)",
346 line, level, msg))
347 cnt = 0;
348
349 end:
350 OPENSSL_free(func)CRYPTO_free(func, "../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
, 350);
351 OPENSSL_free(file)CRYPTO_free(file, "../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
, 351);
352 return cnt;
353}
354#endif
355
356/* Print CMP log messages (i.e., diagnostic info) via the log cb of the ctx */
357int ossl_cmp_print_log(OSSL_CMP_severity level, const OSSL_CMP_CTX *ctx,
358 const char *func, const char *file, int line,
359 const char *level_str, const char *format, ...)
360{
361 va_list args;
362 char hugebuf[1024 * 2];
363 int res = 0;
364
365 if (ctx == NULL((void*)0) || ctx->log_cb == NULL((void*)0))
366 return 1; /* silently drop message */
367
368 if (level > ctx->log_verbosity) /* excludes the case level is unknown */
369 return 1; /* suppress output since severity is not sufficient */
370
371 if (format == NULL((void*)0))
372 return 0;
373
374 va_start(args, format)__builtin_va_start(args, format);
375
376 if (func == NULL((void*)0))
377 func = "(unset function name)";
378 if (file == NULL((void*)0))
379 file = "(unset file name)";
380 if (level_str == NULL((void*)0))
381 level_str = "(unset level string)";
Value stored to 'level_str' is never read
382
383#ifndef OPENSSL_NO_TRACE
384 if (OSSL_TRACE_ENABLED(CMP)(0)) {
385 OSSL_TRACE_BEGIN(CMP)do { BIO *trc_out = ((void*)0); if (0) {
386 int printed =
387 BIO_snprintf(hugebuf, sizeof(hugebuf),
388 "%s:%s:%d:" OSSL_CMP_LOG_PREFIX"CMP " "%s: ",
389 func, file, line, level_str);
390 if (printed > 0 && (size_t)printed < sizeof(hugebuf)) {
391 if (BIO_vsnprintf(hugebuf + printed,
392 sizeof(hugebuf) - printed, format, args) > 0)
393 res = BIO_puts(trc_out, hugebuf) > 0;
394 }
395 } OSSL_TRACE_END(CMP)} while(0);
396 }
397#else /* compensate for disabled trace API */
398 {
399 if (BIO_vsnprintf(hugebuf, sizeof(hugebuf), format, args) > 0)
400 res = ctx->log_cb(func, file, line, level, hugebuf);
401 }
402#endif
403 va_end(args)__builtin_va_end(args);
404 return res;
405}
406
407/* Set a callback function for error reporting and logging messages */
408int OSSL_CMP_CTX_set_log_cb(OSSL_CMP_CTX *ctx, OSSL_CMP_log_cb_t cb)
409{
410 if (ctx == NULL((void*)0)) {
411 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,411,__func__), ERR_set_error)((58),(103),((void*)0));
412 return 0;
413 }
414 ctx->log_cb = cb;
415
416#ifndef OPENSSL_NO_TRACE
417 /* do also in case cb == NULL, to switch off logging output: */
418 if (!OSSL_trace_set_callback(OSSL_TRACE_CATEGORY_CMP13,
419 ossl_cmp_log_trace_cb, ctx))
420 return 0;
421#endif
422
423 return 1;
424}
425
426/* Print OpenSSL and CMP errors via the log cb of the ctx or ERR_print_errors */
427void OSSL_CMP_CTX_print_errors(const OSSL_CMP_CTX *ctx)
428{
429 if (ctx != NULL((void*)0) && OSSL_CMP_LOG_ERR3 > ctx->log_verbosity)
430 return; /* suppress output since severity is not sufficient */
431 OSSL_CMP_print_errors_cb(ctx == NULL((void*)0) ? NULL((void*)0) : ctx->log_cb);
432}
433
434/*
435 * Set or clear the reference value to be used for identification
436 * (i.e., the user name) when using PBMAC.
437 */
438int OSSL_CMP_CTX_set1_referenceValue(OSSL_CMP_CTX *ctx,
439 const unsigned char *ref, int len)
440{
441 if (ctx == NULL((void*)0)) {
442 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,442,__func__), ERR_set_error)((58),(103),((void*)0));
443 return 0;
444 }
445 return ossl_cmp_asn1_octet_string_set1_bytes(&ctx->referenceValue, ref,
446 len);
447}
448
449/* Set or clear the password to be used for protecting messages with PBMAC */
450int OSSL_CMP_CTX_set1_secretValue(OSSL_CMP_CTX *ctx, const unsigned char *sec,
451 const int len)
452{
453 ASN1_OCTET_STRING *secretValue = NULL((void*)0);
454 if (ctx == NULL((void*)0)) {
455 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,455,__func__), ERR_set_error)((58),(103),((void*)0));
456 return 0;
457 }
458 if (ossl_cmp_asn1_octet_string_set1_bytes(&secretValue, sec, len) != 1)
459 return 0;
460 if (ctx->secretValue != NULL((void*)0)) {
461 OPENSSL_cleanse(ctx->secretValue->data, ctx->secretValue->length);
462 ASN1_OCTET_STRING_free(ctx->secretValue);
463 }
464 ctx->secretValue = secretValue;
465 return 1;
466}
467
468/* Returns the cert chain computed by OSSL_CMP_certConf_cb(), NULL on error */
469STACK_OF(X509)struct stack_st_X509 *OSSL_CMP_CTX_get1_newChain(const OSSL_CMP_CTX *ctx)
470{
471 if (ctx == NULL((void*)0)) {
472 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,472,__func__), ERR_set_error)((58),(103),((void*)0));
473 return NULL((void*)0);
474 }
475 return X509_chain_up_ref(ctx->newChain);
476}
477
478/*
479 * Copies any given stack of inbound X509 certificates to newChain
480 * of the OSSL_CMP_CTX structure so that they may be retrieved later.
481 */
482int ossl_cmp_ctx_set1_newChain(OSSL_CMP_CTX *ctx, STACK_OF(X509)struct stack_st_X509 *newChain)
483{
484 if (!ossl_assert(ctx != NULL)((ctx != ((void*)0)) != 0))
485 return 0;
486
487 sk_X509_pop_free(ctx->newChain, X509_free)OPENSSL_sk_pop_free(ossl_check_X509_sk_type(ctx->newChain)
,ossl_check_X509_freefunc_type(X509_free));
488 ctx->newChain = NULL((void*)0);
489 return newChain == NULL((void*)0) ||
490 (ctx->newChain = X509_chain_up_ref(newChain)) != NULL((void*)0);
491}
492
493/* Returns the stack of extraCerts received in CertRepMessage, NULL on error */
494STACK_OF(X509)struct stack_st_X509 *OSSL_CMP_CTX_get1_extraCertsIn(const OSSL_CMP_CTX *ctx)
495{
496 if (ctx == NULL((void*)0)) {
497 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,497,__func__), ERR_set_error)((58),(103),((void*)0));
498 return NULL((void*)0);
499 }
500 return X509_chain_up_ref(ctx->extraCertsIn);
501}
502
503/*
504 * Copies any given stack of inbound X509 certificates to extraCertsIn
505 * of the OSSL_CMP_CTX structure so that they may be retrieved later.
506 */
507int ossl_cmp_ctx_set1_extraCertsIn(OSSL_CMP_CTX *ctx,
508 STACK_OF(X509)struct stack_st_X509 *extraCertsIn)
509{
510 if (!ossl_assert(ctx != NULL)((ctx != ((void*)0)) != 0))
511 return 0;
512
513 sk_X509_pop_free(ctx->extraCertsIn, X509_free)OPENSSL_sk_pop_free(ossl_check_X509_sk_type(ctx->extraCertsIn
),ossl_check_X509_freefunc_type(X509_free));
514 ctx->extraCertsIn = NULL((void*)0);
515 return extraCertsIn == NULL((void*)0)
516 || (ctx->extraCertsIn = X509_chain_up_ref(extraCertsIn)) != NULL((void*)0);
517}
518
519/*
520 * Copies any given stack as the new stack of X509
521 * certificates to send out in the extraCerts field.
522 */
523int OSSL_CMP_CTX_set1_extraCertsOut(OSSL_CMP_CTX *ctx,
524 STACK_OF(X509)struct stack_st_X509 *extraCertsOut)
525{
526 if (ctx == NULL((void*)0)) {
527 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,527,__func__), ERR_set_error)((58),(103),((void*)0));
528 return 0;
529 }
530
531 sk_X509_pop_free(ctx->extraCertsOut, X509_free)OPENSSL_sk_pop_free(ossl_check_X509_sk_type(ctx->extraCertsOut
),ossl_check_X509_freefunc_type(X509_free));
532 ctx->extraCertsOut = NULL((void*)0);
533 return extraCertsOut == NULL((void*)0)
534 || (ctx->extraCertsOut = X509_chain_up_ref(extraCertsOut)) != NULL((void*)0);
535}
536
537/*
538 * Add the given policy info object
539 * to the X509_EXTENSIONS of the requested certificate template.
540 */
541int OSSL_CMP_CTX_push0_policy(OSSL_CMP_CTX *ctx, POLICYINFO *pinfo)
542{
543 if (ctx == NULL((void*)0) || pinfo == NULL((void*)0)) {
544 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,544,__func__), ERR_set_error)((58),(103),((void*)0));
545 return 0;
546 }
547
548 if (ctx->policies == NULL((void*)0)
549 && (ctx->policies = CERTIFICATEPOLICIES_new()) == NULL((void*)0))
550 return 0;
551
552 return sk_POLICYINFO_push(ctx->policies, pinfo)OPENSSL_sk_push(ossl_check_POLICYINFO_sk_type(ctx->policies
), ossl_check_POLICYINFO_type(pinfo));
553}
554
555/* Add an ITAV for geninfo of the PKI message header */
556int OSSL_CMP_CTX_push0_geninfo_ITAV(OSSL_CMP_CTX *ctx, OSSL_CMP_ITAV *itav)
557{
558 if (ctx == NULL((void*)0)) {
559 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,559,__func__), ERR_set_error)((58),(103),((void*)0));
560 return 0;
561 }
562 return OSSL_CMP_ITAV_push0_stack_item(&ctx->geninfo_ITAVs, itav);
563}
564
565/* Add an itav for the body of outgoing general messages */
566int OSSL_CMP_CTX_push0_genm_ITAV(OSSL_CMP_CTX *ctx, OSSL_CMP_ITAV *itav)
567{
568 if (ctx == NULL((void*)0)) {
569 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,569,__func__), ERR_set_error)((58),(103),((void*)0));
570 return 0;
571 }
572 return OSSL_CMP_ITAV_push0_stack_item(&ctx->genm_ITAVs, itav);
573}
574
575/*
576 * Returns a duplicate of the stack of X509 certificates that
577 * were received in the caPubs field of the last CertRepMessage.
578 * Returns NULL on error
579 */
580STACK_OF(X509)struct stack_st_X509 *OSSL_CMP_CTX_get1_caPubs(const OSSL_CMP_CTX *ctx)
581{
582 if (ctx == NULL((void*)0)) {
583 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,583,__func__), ERR_set_error)((58),(103),((void*)0));
584 return NULL((void*)0);
585 }
586 return X509_chain_up_ref(ctx->caPubs);
587}
588
589/*
590 * Copies any given stack of certificates to the given
591 * OSSL_CMP_CTX structure so that they may be retrieved later.
592 */
593int ossl_cmp_ctx_set1_caPubs(OSSL_CMP_CTX *ctx, STACK_OF(X509)struct stack_st_X509 *caPubs)
594{
595 if (!ossl_assert(ctx != NULL)((ctx != ((void*)0)) != 0))
596 return 0;
597
598 sk_X509_pop_free(ctx->caPubs, X509_free)OPENSSL_sk_pop_free(ossl_check_X509_sk_type(ctx->caPubs),ossl_check_X509_freefunc_type
(X509_free));
599 ctx->caPubs = NULL((void*)0);
600 return caPubs == NULL((void*)0) || (ctx->caPubs = X509_chain_up_ref(caPubs)) != NULL((void*)0);
601}
602
603#define char_dupOPENSSL_strdup OPENSSL_strdup
604#define char_freeOPENSSL_free OPENSSL_free
605#define DEFINE_OSSL_CMP_CTX_set1(FIELD, TYPE)int OSSL_CMP_CTX_set1_FIELD(OSSL_CMP_CTX *ctx, const TYPE *val
) { TYPE *val_dup = ((void*)0); if (ctx == ((void*)0)) { (ERR_new
(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,605,__func__), ERR_set_error)((58),(103),((void*)0)); return
0; } if (val != ((void*)0) && (val_dup = TYPE_dup(val
)) == ((void*)0)) return 0; TYPE_free(ctx->FIELD); ctx->
FIELD = val_dup; return 1; } /* this uses _dup */ \
606int OSSL_CMP_CTX_set1_##FIELD(OSSL_CMP_CTX *ctx, const TYPE *val) \
607{ \
608 TYPE *val_dup = NULL((void*)0); \
609 \
610 if (ctx == NULL((void*)0)) { \
611 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,611,__func__), ERR_set_error)((58),(103),((void*)0)); \
612 return 0; \
613 } \
614 \
615 if (val != NULL((void*)0) && (val_dup = TYPE##_dup(val)) == NULL((void*)0)) \
616 return 0; \
617 TYPE##_free(ctx->FIELD); \
618 ctx->FIELD = val_dup; \
619 return 1; \
620}
621
622#define X509_invalid(cert)(!ossl_x509v3_cache_extensions(cert)) (!ossl_x509v3_cache_extensions(cert))
623#define EVP_PKEY_invalid(key)0 0
624#define DEFINE_OSSL_CMP_CTX_set1_up_ref(FIELD, TYPE)int OSSL_CMP_CTX_set1_FIELD(OSSL_CMP_CTX *ctx, TYPE *val) { if
(ctx == ((void*)0)) { (ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,624,__func__), ERR_set_error)((58),(103),((void*)0)); return
0; } if (val != ((void*)0) && TYPE_invalid(val)) { (
ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,624,__func__), ERR_set_error)((58),(147),((void*)0)); return
0; } if (val != ((void*)0) && !TYPE_up_ref(val)) return
0; TYPE_free(ctx->FIELD); ctx->FIELD = val; return 1; } \
625int OSSL_CMP_CTX_set1_##FIELD(OSSL_CMP_CTX *ctx, TYPE *val) \
626{ \
627 if (ctx == NULL((void*)0)) { \
628 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,628,__func__), ERR_set_error)((58),(103),((void*)0)); \
629 return 0; \
630 } \
631 \
632 /* prevent misleading error later on malformed cert or provider issue */ \
633 if (val != NULL((void*)0) && TYPE##_invalid(val)) { \
634 ERR_raise(ERR_LIB_CMP, CMP_R_POTENTIALLY_INVALID_CERTIFICATE)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,634,__func__), ERR_set_error)((58),(147),((void*)0)); \
635 return 0; \
636 } \
637 if (val != NULL((void*)0) && !TYPE##_up_ref(val)) \
638 return 0; \
639 TYPE##_free(ctx->FIELD); \
640 ctx->FIELD = val; \
641 return 1; \
642}
643
644/*
645 * Pins the server certificate to be directly trusted (even if it is expired)
646 * for verifying response messages.
647 * Cert pointer is not consumed. It may be NULL to clear the entry.
648 */
649DEFINE_OSSL_CMP_CTX_set1_up_ref(srvCert, X509)int OSSL_CMP_CTX_set1_srvCert(OSSL_CMP_CTX *ctx, X509 *val) {
if (ctx == ((void*)0)) { (ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,649,__func__), ERR_set_error)((58),(103),((void*)0)); return
0; } if (val != ((void*)0) && (!ossl_x509v3_cache_extensions
(val))) { (ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,649,__func__), ERR_set_error)((58),(147),((void*)0)); return
0; } if (val != ((void*)0) && !X509_up_ref(val)) return
0; X509_free(ctx->srvCert); ctx->srvCert = val; return
1; }
650
651/* Set the X509 name of the recipient. Set in the PKIHeader */
652DEFINE_OSSL_CMP_CTX_set1(recipient, X509_NAME)int OSSL_CMP_CTX_set1_recipient(OSSL_CMP_CTX *ctx, const X509_NAME
*val) { X509_NAME *val_dup = ((void*)0); if (ctx == ((void*)
0)) { (ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,652,__func__), ERR_set_error)((58),(103),((void*)0)); return
0; } if (val != ((void*)0) && (val_dup = X509_NAME_dup
(val)) == ((void*)0)) return 0; X509_NAME_free(ctx->recipient
); ctx->recipient = val_dup; return 1; }
653
654/* Store the X509 name of the expected sender in the PKIHeader of responses */
655DEFINE_OSSL_CMP_CTX_set1(expected_sender, X509_NAME)int OSSL_CMP_CTX_set1_expected_sender(OSSL_CMP_CTX *ctx, const
X509_NAME *val) { X509_NAME *val_dup = ((void*)0); if (ctx ==
((void*)0)) { (ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,655,__func__), ERR_set_error)((58),(103),((void*)0)); return
0; } if (val != ((void*)0) && (val_dup = X509_NAME_dup
(val)) == ((void*)0)) return 0; X509_NAME_free(ctx->expected_sender
); ctx->expected_sender = val_dup; return 1; }
656
657/* Set the X509 name of the issuer. Set in the PKIHeader */
658DEFINE_OSSL_CMP_CTX_set1(issuer, X509_NAME)int OSSL_CMP_CTX_set1_issuer(OSSL_CMP_CTX *ctx, const X509_NAME
*val) { X509_NAME *val_dup = ((void*)0); if (ctx == ((void*)
0)) { (ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,658,__func__), ERR_set_error)((58),(103),((void*)0)); return
0; } if (val != ((void*)0) && (val_dup = X509_NAME_dup
(val)) == ((void*)0)) return 0; X509_NAME_free(ctx->issuer
); ctx->issuer = val_dup; return 1; }
659
660/*
661 * Set the subject name that will be placed in the certificate
662 * request. This will be the subject name on the received certificate.
663 */
664DEFINE_OSSL_CMP_CTX_set1(subjectName, X509_NAME)int OSSL_CMP_CTX_set1_subjectName(OSSL_CMP_CTX *ctx, const X509_NAME
*val) { X509_NAME *val_dup = ((void*)0); if (ctx == ((void*)
0)) { (ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,664,__func__), ERR_set_error)((58),(103),((void*)0)); return
0; } if (val != ((void*)0) && (val_dup = X509_NAME_dup
(val)) == ((void*)0)) return 0; X509_NAME_free(ctx->subjectName
); ctx->subjectName = val_dup; return 1; }
665
666/* Set the X.509v3 certificate request extensions to be used in IR/CR/KUR */
667int OSSL_CMP_CTX_set0_reqExtensions(OSSL_CMP_CTX *ctx, X509_EXTENSIONS *exts)
668{
669 if (ctx == NULL((void*)0)) {
670 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,670,__func__), ERR_set_error)((58),(103),((void*)0));
671 return 0;
672 }
673
674 if (sk_GENERAL_NAME_num(ctx->subjectAltNames)OPENSSL_sk_num(ossl_check_const_GENERAL_NAME_sk_type(ctx->
subjectAltNames)) > 0 && exts != NULL((void*)0)
675 && X509v3_get_ext_by_NID(exts, NID_subject_alt_name85, -1) >= 0) {
676 ERR_raise(ERR_LIB_CMP, CMP_R_MULTIPLE_SAN_SOURCES)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,676,__func__), ERR_set_error)((58),(102),((void*)0));
677 return 0;
678 }
679 sk_X509_EXTENSION_pop_free(ctx->reqExtensions, X509_EXTENSION_free)OPENSSL_sk_pop_free(ossl_check_X509_EXTENSION_sk_type(ctx->
reqExtensions),ossl_check_X509_EXTENSION_freefunc_type(X509_EXTENSION_free
));
680 ctx->reqExtensions = exts;
681 return 1;
682}
683
684/* returns 1 if ctx contains a Subject Alternative Name extension, else 0 */
685int OSSL_CMP_CTX_reqExtensions_have_SAN(OSSL_CMP_CTX *ctx)
686{
687 if (ctx == NULL((void*)0)) {
688 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,688,__func__), ERR_set_error)((58),(103),((void*)0));
689 return -1;
690 }
691 /* if one of the following conditions 'fail' this is not an error */
692 return ctx->reqExtensions != NULL((void*)0)
693 && X509v3_get_ext_by_NID(ctx->reqExtensions,
694 NID_subject_alt_name85, -1) >= 0;
695}
696
697/*
698 * Add a GENERAL_NAME structure that will be added to the CRMF
699 * request's extensions field to request subject alternative names.
700 */
701int OSSL_CMP_CTX_push1_subjectAltName(OSSL_CMP_CTX *ctx,
702 const GENERAL_NAME *name)
703{
704 GENERAL_NAME *name_dup;
705
706 if (ctx == NULL((void*)0) || name == NULL((void*)0)) {
707 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,707,__func__), ERR_set_error)((58),(103),((void*)0));
708 return 0;
709 }
710
711 if (OSSL_CMP_CTX_reqExtensions_have_SAN(ctx) == 1) {
712 ERR_raise(ERR_LIB_CMP, CMP_R_MULTIPLE_SAN_SOURCES)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,712,__func__), ERR_set_error)((58),(102),((void*)0));
713 return 0;
714 }
715
716 if (ctx->subjectAltNames == NULL((void*)0)
717 && (ctx->subjectAltNames = sk_GENERAL_NAME_new_null()((struct stack_st_GENERAL_NAME *)OPENSSL_sk_new_null())) == NULL((void*)0))
718 return 0;
719 if ((name_dup = GENERAL_NAME_dup(name)) == NULL((void*)0))
720 return 0;
721 if (!sk_GENERAL_NAME_push(ctx->subjectAltNames, name_dup)OPENSSL_sk_push(ossl_check_GENERAL_NAME_sk_type(ctx->subjectAltNames
), ossl_check_GENERAL_NAME_type(name_dup))) {
722 GENERAL_NAME_free(name_dup);
723 return 0;
724 }
725 return 1;
726}
727
728/*
729 * Set our own client certificate, used for example in KUR and when
730 * doing the IR with existing certificate.
731 */
732DEFINE_OSSL_CMP_CTX_set1_up_ref(cert, X509)int OSSL_CMP_CTX_set1_cert(OSSL_CMP_CTX *ctx, X509 *val) { if
(ctx == ((void*)0)) { (ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,732,__func__), ERR_set_error)((58),(103),((void*)0)); return
0; } if (val != ((void*)0) && (!ossl_x509v3_cache_extensions
(val))) { (ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,732,__func__), ERR_set_error)((58),(147),((void*)0)); return
0; } if (val != ((void*)0) && !X509_up_ref(val)) return
0; X509_free(ctx->cert); ctx->cert = val; return 1; }
733
734int OSSL_CMP_CTX_build_cert_chain(OSSL_CMP_CTX *ctx, X509_STORE *own_trusted,
735 STACK_OF(X509)struct stack_st_X509 *candidates)
736{
737 STACK_OF(X509)struct stack_st_X509 *chain;
738
739 if (ctx == NULL((void*)0)) {
740 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,740,__func__), ERR_set_error)((58),(103),((void*)0));
741 return 0;
742 }
743
744 if (!ossl_x509_add_certs_new(&ctx->untrusted, candidates,
745 X509_ADD_FLAG_UP_REF0x1 | X509_ADD_FLAG_NO_DUP0x4))
746 return 0;
747
748 ossl_cmp_debug(ctx, "trying to build chain for own CMP signer cert")ossl_cmp_print_log(7, ctx, __func__, "../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
, 748, "DEBUG", "%s", "trying to build chain for own CMP signer cert"
);
749 chain = X509_build_chain(ctx->cert, ctx->untrusted, own_trusted, 0,
750 ctx->libctx, ctx->propq);
751 if (chain == NULL((void*)0)) {
752 ERR_raise(ERR_LIB_CMP, CMP_R_FAILED_BUILDING_OWN_CHAIN)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,752,__func__), ERR_set_error)((58),(164),((void*)0));
753 return 0;
754 }
755 ossl_cmp_debug(ctx, "success building chain for own CMP signer cert")ossl_cmp_print_log(7, ctx, __func__, "../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
, 755, "DEBUG", "%s", "success building chain for own CMP signer cert"
);
756 ctx->chain = chain;
757 return 1;
758}
759
760/*
761 * Set the old certificate that we are updating in KUR
762 * or the certificate to be revoked in RR, respectively.
763 * Also used as reference cert (defaulting to cert) for deriving subject DN
764 * and SANs. Its issuer is used as default recipient in the CMP message header.
765 */
766DEFINE_OSSL_CMP_CTX_set1_up_ref(oldCert, X509)int OSSL_CMP_CTX_set1_oldCert(OSSL_CMP_CTX *ctx, X509 *val) {
if (ctx == ((void*)0)) { (ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,766,__func__), ERR_set_error)((58),(103),((void*)0)); return
0; } if (val != ((void*)0) && (!ossl_x509v3_cache_extensions
(val))) { (ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,766,__func__), ERR_set_error)((58),(147),((void*)0)); return
0; } if (val != ((void*)0) && !X509_up_ref(val)) return
0; X509_free(ctx->oldCert); ctx->oldCert = val; return
1; }
767
768/* Set the PKCS#10 CSR to be sent in P10CR */
769DEFINE_OSSL_CMP_CTX_set1(p10CSR, X509_REQ)int OSSL_CMP_CTX_set1_p10CSR(OSSL_CMP_CTX *ctx, const X509_REQ
*val) { X509_REQ *val_dup = ((void*)0); if (ctx == ((void*)0
)) { (ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,769,__func__), ERR_set_error)((58),(103),((void*)0)); return
0; } if (val != ((void*)0) && (val_dup = X509_REQ_dup
(val)) == ((void*)0)) return 0; X509_REQ_free(ctx->p10CSR)
; ctx->p10CSR = val_dup; return 1; }
770
771/*
772 * Set the (newly received in IP/KUP/CP) certificate in the context.
773 * This only permits for one cert to be enrolled at a time.
774 */
775int ossl_cmp_ctx_set0_newCert(OSSL_CMP_CTX *ctx, X509 *cert)
776{
777 if (!ossl_assert(ctx != NULL)((ctx != ((void*)0)) != 0))
778 return 0;
779
780 X509_free(ctx->newCert);
781 ctx->newCert = cert;
782 return 1;
783}
784
785/*
786 * Get the (newly received in IP/KUP/CP) client certificate from the context
787 * This only permits for one client cert to be received...
788 */
789X509 *OSSL_CMP_CTX_get0_newCert(const OSSL_CMP_CTX *ctx)
790{
791 if (ctx == NULL((void*)0)) {
792 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,792,__func__), ERR_set_error)((58),(103),((void*)0));
793 return NULL((void*)0);
794 }
795 return ctx->newCert;
796}
797
798/* Set the client's current private key */
799DEFINE_OSSL_CMP_CTX_set1_up_ref(pkey, EVP_PKEY)int OSSL_CMP_CTX_set1_pkey(OSSL_CMP_CTX *ctx, EVP_PKEY *val) {
if (ctx == ((void*)0)) { (ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,799,__func__), ERR_set_error)((58),(103),((void*)0)); return
0; } if (val != ((void*)0) && 0) { (ERR_new(), ERR_set_debug
("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c",799,__func__)
, ERR_set_error)((58),(147),((void*)0)); return 0; } if (val !=
((void*)0) && !EVP_PKEY_up_ref(val)) return 0; EVP_PKEY_free
(ctx->pkey); ctx->pkey = val; return 1; }
800
801/* Set new key pair. Used e.g. when doing Key Update */
802int OSSL_CMP_CTX_set0_newPkey(OSSL_CMP_CTX *ctx, int priv, EVP_PKEY *pkey)
803{
804 if (ctx == NULL((void*)0)) {
805 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,805,__func__), ERR_set_error)((58),(103),((void*)0));
806 return 0;
807 }
808
809 EVP_PKEY_free(ctx->newPkey);
810 ctx->newPkey = pkey;
811 ctx->newPkey_priv = priv;
812 return 1;
813}
814
815/* Get the private/public key to use for cert enrollment, or NULL on error */
816EVP_PKEY *OSSL_CMP_CTX_get0_newPkey(const OSSL_CMP_CTX *ctx, int priv)
817{
818 if (ctx == NULL((void*)0)) {
819 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,819,__func__), ERR_set_error)((58),(103),((void*)0));
820 return NULL((void*)0);
821 }
822
823 if (ctx->newPkey != NULL((void*)0))
824 return priv && !ctx->newPkey_priv ? NULL((void*)0) : ctx->newPkey;
825 if (ctx->p10CSR != NULL((void*)0))
826 return priv ? NULL((void*)0) : X509_REQ_get0_pubkey(ctx->p10CSR);
827 return ctx->pkey; /* may be NULL */
828}
829
830/* Set the given transactionID to the context */
831int OSSL_CMP_CTX_set1_transactionID(OSSL_CMP_CTX *ctx,
832 const ASN1_OCTET_STRING *id)
833{
834 if (ctx == NULL((void*)0)) {
835 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,835,__func__), ERR_set_error)((58),(103),((void*)0));
836 return 0;
837 }
838 return ossl_cmp_asn1_octet_string_set1(&ctx->transactionID, id);
839}
840
841/* Set the nonce to be used for the recipNonce in the message created next */
842int ossl_cmp_ctx_set1_recipNonce(OSSL_CMP_CTX *ctx,
843 const ASN1_OCTET_STRING *nonce)
844{
845 if (!ossl_assert(ctx != NULL)((ctx != ((void*)0)) != 0))
846 return 0;
847 return ossl_cmp_asn1_octet_string_set1(&ctx->recipNonce, nonce);
848}
849
850/* Stores the given nonce as the last senderNonce sent out */
851int OSSL_CMP_CTX_set1_senderNonce(OSSL_CMP_CTX *ctx,
852 const ASN1_OCTET_STRING *nonce)
853{
854 if (ctx == NULL((void*)0)) {
855 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,855,__func__), ERR_set_error)((58),(103),((void*)0));
856 return 0;
857 }
858 return ossl_cmp_asn1_octet_string_set1(&ctx->senderNonce, nonce);
859}
860
861/* Set the proxy server to use for HTTP(S) connections */
862DEFINE_OSSL_CMP_CTX_set1(proxy, char)int OSSL_CMP_CTX_set1_proxy(OSSL_CMP_CTX *ctx, const char *val
) { char *val_dup = ((void*)0); if (ctx == ((void*)0)) { (ERR_new
(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,862,__func__), ERR_set_error)((58),(103),((void*)0)); return
0; } if (val != ((void*)0) && (val_dup = CRYPTO_strdup
(val, "../deps/openssl/openssl/crypto/cmp/cmp_ctx.c", 862)) ==
((void*)0)) return 0; CRYPTO_free(ctx->proxy, "../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
, 862); ctx->proxy = val_dup; return 1; }
863
864/* Set the (HTTP) host name of the CMP server */
865DEFINE_OSSL_CMP_CTX_set1(server, char)int OSSL_CMP_CTX_set1_server(OSSL_CMP_CTX *ctx, const char *val
) { char *val_dup = ((void*)0); if (ctx == ((void*)0)) { (ERR_new
(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,865,__func__), ERR_set_error)((58),(103),((void*)0)); return
0; } if (val != ((void*)0) && (val_dup = CRYPTO_strdup
(val, "../deps/openssl/openssl/crypto/cmp/cmp_ctx.c", 865)) ==
((void*)0)) return 0; CRYPTO_free(ctx->server, "../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
, 865); ctx->server = val_dup; return 1; }
866
867/* Set the server exclusion list of the HTTP proxy server */
868DEFINE_OSSL_CMP_CTX_set1(no_proxy, char)int OSSL_CMP_CTX_set1_no_proxy(OSSL_CMP_CTX *ctx, const char *
val) { char *val_dup = ((void*)0); if (ctx == ((void*)0)) { (
ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,868,__func__), ERR_set_error)((58),(103),((void*)0)); return
0; } if (val != ((void*)0) && (val_dup = CRYPTO_strdup
(val, "../deps/openssl/openssl/crypto/cmp/cmp_ctx.c", 868)) ==
((void*)0)) return 0; CRYPTO_free(ctx->no_proxy, "../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
, 868); ctx->no_proxy = val_dup; return 1; }
869
870/* Set the http connect/disconnect callback function to be used for HTTP(S) */
871int OSSL_CMP_CTX_set_http_cb(OSSL_CMP_CTX *ctx, OSSL_HTTP_bio_cb_t cb)
872{
873 if (ctx == NULL((void*)0)) {
874 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,874,__func__), ERR_set_error)((58),(103),((void*)0));
875 return 0;
876 }
877 ctx->http_cb = cb;
878 return 1;
879}
880
881/* Set argument optionally to be used by the http connect/disconnect callback */
882int OSSL_CMP_CTX_set_http_cb_arg(OSSL_CMP_CTX *ctx, void *arg)
883{
884 if (ctx == NULL((void*)0)) {
885 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,885,__func__), ERR_set_error)((58),(103),((void*)0));
886 return 0;
887 }
888 ctx->http_cb_arg = arg;
889 return 1;
890}
891
892/*
893 * Get argument optionally to be used by the http connect/disconnect callback
894 * Returns callback argument set previously (NULL if not set or on error)
895 */
896void *OSSL_CMP_CTX_get_http_cb_arg(const OSSL_CMP_CTX *ctx)
897{
898 if (ctx == NULL((void*)0)) {
899 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,899,__func__), ERR_set_error)((58),(103),((void*)0));
900 return NULL((void*)0);
901 }
902 return ctx->http_cb_arg;
903}
904
905/* Set callback function for sending CMP request and receiving response */
906int OSSL_CMP_CTX_set_transfer_cb(OSSL_CMP_CTX *ctx, OSSL_CMP_transfer_cb_t cb)
907{
908 if (ctx == NULL((void*)0)) {
909 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,909,__func__), ERR_set_error)((58),(103),((void*)0));
910 return 0;
911 }
912 ctx->transfer_cb = cb;
913 return 1;
914}
915
916/* Set argument optionally to be used by the transfer callback */
917int OSSL_CMP_CTX_set_transfer_cb_arg(OSSL_CMP_CTX *ctx, void *arg)
918{
919 if (ctx == NULL((void*)0)) {
920 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,920,__func__), ERR_set_error)((58),(103),((void*)0));
921 return 0;
922 }
923 ctx->transfer_cb_arg = arg;
924 return 1;
925}
926
927/*
928 * Get argument optionally to be used by the transfer callback.
929 * Returns callback argument set previously (NULL if not set or on error)
930 */
931void *OSSL_CMP_CTX_get_transfer_cb_arg(const OSSL_CMP_CTX *ctx)
932{
933 if (ctx == NULL((void*)0)) {
934 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,934,__func__), ERR_set_error)((58),(103),((void*)0));
935 return NULL((void*)0);
936 }
937 return ctx->transfer_cb_arg;
938}
939
940/** Set the HTTP server port to be used */
941int OSSL_CMP_CTX_set_serverPort(OSSL_CMP_CTX *ctx, int port)
942{
943 if (ctx == NULL((void*)0)) {
944 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,944,__func__), ERR_set_error)((58),(103),((void*)0));
945 return 0;
946 }
947 ctx->serverPort = port;
948 return 1;
949}
950
951/* Set the HTTP path to be used on the server (e.g "pkix/") */
952DEFINE_OSSL_CMP_CTX_set1(serverPath, char)int OSSL_CMP_CTX_set1_serverPath(OSSL_CMP_CTX *ctx, const char
*val) { char *val_dup = ((void*)0); if (ctx == ((void*)0)) {
(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,952,__func__), ERR_set_error)((58),(103),((void*)0)); return
0; } if (val != ((void*)0) && (val_dup = CRYPTO_strdup
(val, "../deps/openssl/openssl/crypto/cmp/cmp_ctx.c", 952)) ==
((void*)0)) return 0; CRYPTO_free(ctx->serverPath, "../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
, 952); ctx->serverPath = val_dup; return 1; }
953
954/* Set the failInfo error code as bit encoding in OSSL_CMP_CTX */
955int ossl_cmp_ctx_set_failInfoCode(OSSL_CMP_CTX *ctx, int fail_info)
956{
957 if (!ossl_assert(ctx != NULL)((ctx != ((void*)0)) != 0))
958 return 0;
959 ctx->failInfoCode = fail_info;
960 return 1;
961}
962
963/*
964 * Get the failInfo error code in OSSL_CMP_CTX as bit encoding.
965 * Returns bit string as integer on success, -1 on error
966 */
967int OSSL_CMP_CTX_get_failInfoCode(const OSSL_CMP_CTX *ctx)
968{
969 if (ctx == NULL((void*)0)) {
970 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,970,__func__), ERR_set_error)((58),(103),((void*)0));
971 return -1;
972 }
973 return ctx->failInfoCode;
974}
975
976/* Set a Boolean or integer option of the context to the "val" arg */
977int OSSL_CMP_CTX_set_option(OSSL_CMP_CTX *ctx, int opt, int val)
978{
979 int min_val;
980
981 if (ctx == NULL((void*)0)) {
982 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,982,__func__), ERR_set_error)((58),(103),((void*)0));
983 return 0;
984 }
985
986 switch (opt) {
987 case OSSL_CMP_OPT_REVOCATION_REASON27:
988 min_val = OCSP_REVOKED_STATUS_NOSTATUS-1;
989 break;
990 case OSSL_CMP_OPT_POPO_METHOD24:
991 min_val = OSSL_CRMF_POPO_NONE-1;
992 break;
993 default:
994 min_val = 0;
995 break;
996 }
997 if (val < min_val) {
998 ERR_raise(ERR_LIB_CMP, CMP_R_VALUE_TOO_SMALL)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,998,__func__), ERR_set_error)((58),(177),((void*)0));
999 return 0;
1000 }
1001
1002 switch (opt) {
1003 case OSSL_CMP_OPT_LOG_VERBOSITY0:
1004 if (val > OSSL_CMP_LOG_MAX8) {
1005 ERR_raise(ERR_LIB_CMP, CMP_R_VALUE_TOO_LARGE)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,1005,__func__), ERR_set_error)((58),(175),((void*)0));
1006 return 0;
1007 }
1008 ctx->log_verbosity = val;
1009 break;
1010 case OSSL_CMP_OPT_IMPLICIT_CONFIRM25:
1011 ctx->implicitConfirm = val;
1012 break;
1013 case OSSL_CMP_OPT_DISABLE_CONFIRM26:
1014 ctx->disableConfirm = val;
1015 break;
1016 case OSSL_CMP_OPT_UNPROTECTED_SEND30:
1017 ctx->unprotectedSend = val;
1018 break;
1019 case OSSL_CMP_OPT_UNPROTECTED_ERRORS31:
1020 ctx->unprotectedErrors = val;
1021 break;
1022 case OSSL_CMP_OPT_VALIDITY_DAYS20:
1023 ctx->days = val;
1024 break;
1025 case OSSL_CMP_OPT_SUBJECTALTNAME_NODEFAULT21:
1026 ctx->SubjectAltName_nodefault = val;
1027 break;
1028 case OSSL_CMP_OPT_SUBJECTALTNAME_CRITICAL22:
1029 ctx->setSubjectAltNameCritical = val;
1030 break;
1031 case OSSL_CMP_OPT_POLICIES_CRITICAL23:
1032 ctx->setPoliciesCritical = val;
1033 break;
1034 case OSSL_CMP_OPT_IGNORE_KEYUSAGE35:
1035 ctx->ignore_keyusage = val;
1036 break;
1037 case OSSL_CMP_OPT_POPO_METHOD24:
1038 if (val > OSSL_CRMF_POPO_KEYAGREE3) {
1039 ERR_raise(ERR_LIB_CMP, CMP_R_VALUE_TOO_LARGE)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,1039,__func__), ERR_set_error)((58),(175),((void*)0));
1040 return 0;
1041 }
1042 ctx->popoMethod = val;
1043 break;
1044 case OSSL_CMP_OPT_DIGEST_ALGNID34:
1045 if (!cmp_ctx_set_md(ctx, &ctx->digest, val))
1046 return 0;
1047 break;
1048 case OSSL_CMP_OPT_OWF_ALGNID32:
1049 if (!cmp_ctx_set_md(ctx, &ctx->pbm_owf, val))
1050 return 0;
1051 break;
1052 case OSSL_CMP_OPT_MAC_ALGNID33:
1053 ctx->pbm_mac = val;
1054 break;
1055 case OSSL_CMP_OPT_KEEP_ALIVE10:
1056 ctx->keep_alive = val;
1057 break;
1058 case OSSL_CMP_OPT_MSG_TIMEOUT11:
1059 ctx->msg_timeout = val;
1060 break;
1061 case OSSL_CMP_OPT_TOTAL_TIMEOUT12:
1062 ctx->total_timeout = val;
1063 break;
1064 case OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR36:
1065 ctx->permitTAInExtraCertsForIR = val;
1066 break;
1067 case OSSL_CMP_OPT_REVOCATION_REASON27:
1068 if (val > OCSP_REVOKED_STATUS_AACOMPROMISE10) {
1069 ERR_raise(ERR_LIB_CMP, CMP_R_VALUE_TOO_LARGE)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,1069,__func__), ERR_set_error)((58),(175),((void*)0));
1070 return 0;
1071 }
1072 ctx->revocationReason = val;
1073 break;
1074 default:
1075 ERR_raise(ERR_LIB_CMP, CMP_R_INVALID_OPTION)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,1075,__func__), ERR_set_error)((58),(174),((void*)0));
1076 return 0;
1077 }
1078
1079 return 1;
1080}
1081
1082/*
1083 * Reads a Boolean or integer option value from the context.
1084 * Returns -1 on error (which is the default OSSL_CMP_OPT_REVOCATION_REASON)
1085 */
1086int OSSL_CMP_CTX_get_option(const OSSL_CMP_CTX *ctx, int opt)
1087{
1088 if (ctx == NULL((void*)0)) {
1089 ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,1089,__func__), ERR_set_error)((58),(103),((void*)0));
1090 return -1;
1091 }
1092
1093 switch (opt) {
1094 case OSSL_CMP_OPT_LOG_VERBOSITY0:
1095 return ctx->log_verbosity;
1096 case OSSL_CMP_OPT_IMPLICIT_CONFIRM25:
1097 return ctx->implicitConfirm;
1098 case OSSL_CMP_OPT_DISABLE_CONFIRM26:
1099 return ctx->disableConfirm;
1100 case OSSL_CMP_OPT_UNPROTECTED_SEND30:
1101 return ctx->unprotectedSend;
1102 case OSSL_CMP_OPT_UNPROTECTED_ERRORS31:
1103 return ctx->unprotectedErrors;
1104 case OSSL_CMP_OPT_VALIDITY_DAYS20:
1105 return ctx->days;
1106 case OSSL_CMP_OPT_SUBJECTALTNAME_NODEFAULT21:
1107 return ctx->SubjectAltName_nodefault;
1108 case OSSL_CMP_OPT_SUBJECTALTNAME_CRITICAL22:
1109 return ctx->setSubjectAltNameCritical;
1110 case OSSL_CMP_OPT_POLICIES_CRITICAL23:
1111 return ctx->setPoliciesCritical;
1112 case OSSL_CMP_OPT_IGNORE_KEYUSAGE35:
1113 return ctx->ignore_keyusage;
1114 case OSSL_CMP_OPT_POPO_METHOD24:
1115 return ctx->popoMethod;
1116 case OSSL_CMP_OPT_DIGEST_ALGNID34:
1117 return EVP_MD_get_type(ctx->digest);
1118 case OSSL_CMP_OPT_OWF_ALGNID32:
1119 return EVP_MD_get_type(ctx->pbm_owf);
1120 case OSSL_CMP_OPT_MAC_ALGNID33:
1121 return ctx->pbm_mac;
1122 case OSSL_CMP_OPT_KEEP_ALIVE10:
1123 return ctx->keep_alive;
1124 case OSSL_CMP_OPT_MSG_TIMEOUT11:
1125 return ctx->msg_timeout;
1126 case OSSL_CMP_OPT_TOTAL_TIMEOUT12:
1127 return ctx->total_timeout;
1128 case OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR36:
1129 return ctx->permitTAInExtraCertsForIR;
1130 case OSSL_CMP_OPT_REVOCATION_REASON27:
1131 return ctx->revocationReason;
1132 default:
1133 ERR_raise(ERR_LIB_CMP, CMP_R_INVALID_OPTION)(ERR_new(), ERR_set_debug("../deps/openssl/openssl/crypto/cmp/cmp_ctx.c"
,1133,__func__), ERR_set_error)((58),(174),((void*)0));
1134 return -1;
1135 }
1136}