Skip to content

Latest commit

 

History

History
85 lines (56 loc) · 3.02 KB

ossl_cmp_msg_check_update.pod

File metadata and controls

85 lines (56 loc) · 3.02 KB
Raw

NAME

ossl_cmp_allow_unprotected_cb_t, ossl_cmp_msg_check_update - generic checks on a received CMP message, updating the context

SYNOPSIS

#include "cmp_local.h"

typedef int (*ossl_cmp_allow_unprotected_cb_t)(const OSSL_CMP_CTX *ctx,
                                               const OSSL_CMP_MSG *msg,
                                               int invalid_protection, int arg);

int ossl_cmp_msg_check_update(OSSL_CMP_CTX *ctx, const OSSL_CMP_MSG *msg,
                              ossl_cmp_allow_unprotected_cb_t cb, int cb_arg);

DESCRIPTION

ossl_cmp_msg_check_update() does all generic checks on the given message msg, which may be a server response or a request by some client, and updates the ctx accordingly.

The msg is checked for the following:

its protection is present and valid (or a callback function cb is present and indicates that a missing or invalid protection is acceptable),
its CMP protocol version is acceptable, namely OSSL_CMP_PVNO,
its body type is valid,
its transaction ID matches any transaction ID given in ctx, and
its recipNonce matches any senderNonce given in ctx.

In case no protection is present and cb is not NULL then this callback function is called with its invalid_protection parameter being 0, while in case an invalid protection is present the invalid_protection parameter is 1. The callback is passed also the arguments ctx, msg, and <cb_arg> (which typically contains the expected message type). The callback should return 1 on acceptance, 0 on rejection, or -1 on error. It should not put an error on the error stack since this could be misleading.

ossl_cmp_msg_check_update() adds all extraCerts contained in the <msg> to the list of untrusted certificates in ctx such that they are already usable for OSSL_CMP_validate_msg(), which is called internally, and for future use. Thus they are available also to the certificate confirmation callback, and the peer does not need to send them again (at least not in the same transaction). Note that it does not help validating the message before storing the extraCerts because they are not part of the protected portion of the message anyway. For efficiency, the extraCerts are prepended to the list so they get used first.

If all checks pass then ossl_cmp_msg_check_update() records in ctx the senderNonce of the received message as the new recipNonce and learns the transaction ID if none is currently present in ctx.

RETURN VALUES

ossl_cmp_msg_check_update() returns 1 on success, -1 on error.

SEE ALSO

OSSL_CMP_validate_msg(3)

HISTORY

The OpenSSL CMP support was added in OpenSSL 3.0.

COPYRIGHT

Copyright 2007-2020 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.