From d8354dd428a8e1e495e8a89de47e5af522edad6d Mon Sep 17 00:00:00 2001 From: "Dr. David von Oheimb" Date: Fri, 4 Aug 2023 17:05:20 +0200 Subject: [PATCH] apps/cmp: improve -reqin option to read fallback public key from first request message file given --- apps/cmp.c | 50 ++++++++++++++++++- doc/man1/openssl-cmp.pod.in | 10 ++-- .../80-test_cmp_http_data/test_commands.csv | 3 ++ 3 files changed, 58 insertions(+), 5 deletions(-) diff --git a/apps/cmp.c b/apps/cmp.c index bd6bb0d77abd52..92d83f6b2dea8b 100644 --- a/apps/cmp.c +++ b/apps/cmp.c @@ -1554,6 +1554,48 @@ static int setup_protection_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine) return 1; } +static int set_fallback_pubkey(OSSL_CMP_CTX *ctx) +{ + char *file = opt_reqin, *end = file, bak; + OSSL_CMP_MSG *req; + const X509_PUBKEY *pubkey; + EVP_PKEY *pkey; + EVP_PKEY *pkey1; + int res = 0; + + /* temporarily separate first file name in opt_reqin */ + while (*end != ',' && !isspace(_UC(*end)) && *end != '\0') + end++; + bak = *end; + *end = '\0'; + req = OSSL_CMP_MSG_read(file, app_get0_libctx(), app_get0_propq()); + *end = bak; + + if (req == NULL) { + CMP_err1("failed to load ir/cr/kur file '%s' attempting to get fallback public key", + file); + return 0; + } + if ((pubkey = OSSL_CMP_MSG_get0_certreq_publickey(req)) == NULL + || (pkey = X509_PUBKEY_get0(pubkey)) == NULL) { + CMP_err1("failed to get fallback public key from ir/cr/kur file '%s'", + file); + goto err; + } + pkey1 = EVP_PKEY_dup(pkey); + if (pkey == NULL || !OSSL_CMP_CTX_set0_newPkey(ctx, 0 /* priv */, pkey1)) { + EVP_PKEY_free(pkey1); + CMP_err1("failed to get fallback public key obtained from ir/cr/kur file '%s'", + file); + goto err; + } + res = 1; + + err: + OSSL_CMP_MSG_free(req); + return res; +} + /* * Set up IR/CR/P10CR/KUR/CertConf/RR/GENM specific parts of the OSSL_CMP_CTX * based on options from CLI and/or config file. @@ -1573,9 +1615,9 @@ static int setup_request_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine) if (!set_name(opt_issuer, OSSL_CMP_CTX_set1_issuer, ctx, "issuer")) return 0; if (opt_cmd == CMP_IR || opt_cmd == CMP_CR || opt_cmd == CMP_KUR) { - if (opt_newkey == NULL + if (opt_reqin == NULL && opt_newkey == NULL && opt_key == NULL && opt_csr == NULL && opt_oldcert == NULL) { - CMP_err("missing -newkey (or -key) to be certified and no -csr, -oldcert, or -cert given for fallback public key"); + CMP_err("missing -newkey (or -key) to be certified and no -csr, -oldcert, -cert, or -reqin option given, which could provide fallback public key"); return 0; } if (opt_newkey == NULL @@ -1734,6 +1776,10 @@ static int setup_request_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine) EVP_PKEY_free(pkey); return 0; } + } else if (opt_reqin != NULL + && opt_key == NULL && opt_csr == NULL && opt_oldcert == NULL) { + if (!set_fallback_pubkey(ctx)) + return 0; } if (opt_days > 0 diff --git a/doc/man1/openssl-cmp.pod.in b/doc/man1/openssl-cmp.pod.in index 08dce40997bf2a..ae9343b3a0d8af 100644 --- a/doc/man1/openssl-cmp.pod.in +++ b/doc/man1/openssl-cmp.pod.in @@ -982,9 +982,13 @@ of CMP request messages. Thus, all options required for doing this (such as B<-cmd> and all options providing the required parameters) need to be given also when the B<-reqin> option is present. -Hint: In case the B<-reqin> option is given for a certificate request, -there are situations where the client has access to -the public key to be certified (e.g., via the B<-newkey> or B<-csr> options) but +If the B<-reqin> option is given for a certificate request +and no B<-newkey>, B<-key>, B<-oldcert>, or B<-csr> option is given, +a fallback public key is taken from the request message file +(if it is included in the certificate template). + +Hint: In case the B<-reqin> option is given for a certificate request, there are +situations where the client has access to the public key to be certified but not to the private key that by default will be needed for proof of possession. In this case the POPO is not actually needed (because the internally produced certificate request message will not be sent), and its generation diff --git a/test/recipes/80-test_cmp_http_data/test_commands.csv b/test/recipes/80-test_cmp_http_data/test_commands.csv index 69111dd2116fb3..f03f60185e1646 100644 --- a/test/recipes/80-test_cmp_http_data/test_commands.csv +++ b/test/recipes/80-test_cmp_http_data/test_commands.csv @@ -94,3 +94,6 @@ expected,description, -section,val, -cmd,val,val2, -cacertsout,val,val2, -infoty 0,rspin too few files - no server, -section,, -cmd,ir,,BLANK,,,-rspin,_RESULT_DIR/ip.der,,BLANK,,BLANK, -server,"""" 1,reqout_only ir - no server, -section,, -cmd,ir,,-reqout_only,_RESULT_DIR/ir2.der,,BLANK,,BLANK, -server,"""" 0,reqout_only non-existing directory and file, -section,, -cmd,ir,,-reqout_only,idontexist/idontexist,,BLANK,,BLANK, -server,"""" +0,reqin ir - no newkey, -section,, -cmd,ir,,-reqin,_RESULT_DIR/ir2.der,,-newkey,"""",-newkey,"""",-key,"""",-cert,"""",-secret,_PBM_SECRET +1,reqin ir and rspout - no newkey but -popo -1, -section,, -cmd,ir,,-reqin,_RESULT_DIR/ir2.der,,-rspout,_RESULT_DIR/ip2.der,-newkey,"""",--key,"""",-cert,"""",-secret,_PBM_SECRET,-popo,-1 +1,reqin ip and rspin - no newkey but -popo -1, -section,, -cmd,ir,,-reqin,_RESULT_DIR/ir2.der,,-rspin,_RESULT_DIR/ip2.der,,-newkey,"""",-key,"""",-cert,"""",-secret,_PBM_SECRET,-popo,-1, -server,"""",-disable_confirm