28 enum { SCEP_OPERATION_GETCACAPS, SCEP_OPERATION_GETCACERT,
29 SCEP_OPERATION_GETCACERTCHAIN };
66 status = createScepAttributes( sessionInfoPtr, protocolInfo,
67 &iCmsAttributes,
FALSE, scepStatus );
70 status = envelopeSign( sessionInfoPtr->receiveBuffer, 0,
71 sessionInfoPtr->receiveBuffer,
72 sessionInfoPtr->receiveBufSize,
73 &sessionInfoPtr->receiveBufEnd,
89 sessionInfoPtr->receiveBufSize );
91 swrite( &sessionInfoPtr->stream, &httpDataInfo,
96 sessionInfoPtr->receiveBufEnd );
116 findSessionInfo( sessionInfoPtr->attributeList,
123 int requestPasswordSize, userPasswordSize =
DUMMY_INIT;
140 "Couldn't get challenge password from PKCS #10 request" ) );
142 requestPasswordSize = msgData.
length;
147 status = decodePKIUserValue( keyID, 64, &keyIDsize,
166 memcpy( userID, userNamePtr->value, userIDlen );
169 "Couldn't find PKI user information for %s",
181 userPasswordSize = msgData.
length;
182 status = updateSessionInfo( &sessionInfoPtr->attributeList,
184 userPassword, userPasswordSize,
195 "Couldn't copy read PKI user data from PKI user object "
196 "into session object" ) );
200 if( userPasswordSize != requestPasswordSize || \
201 !compareDataConstTime( userPassword, requestPassword,
209 "Password in PKCS #10 request doesn't match PKI user "
220 CRYPT_IATTRIBUTE_PKIUSERINFO );
226 "User information in PKCS #10 request can't be "
227 "reconciled with stored information for the user" ) );
247 int operationType,
status;
267 memcpy( rewrittenHttpReqInfo.attribute, httpReqInfo->value,
272 memcpy( rewrittenHttpReqInfo.value, httpReqInfo->extraData,
276 status = processCertQuery( sessionInfoPtr, &rewrittenHttpReqInfo,
280 &operationType, NULL, 0, NULL );
283 sendCertErrorResponse( sessionInfoPtr, status );
286 ENSURES( operationType == SCEP_OPERATION_GETCACAPS || \
287 operationType == SCEP_OPERATION_GETCACERT || \
288 operationType == SCEP_OPERATION_GETCACERTCHAIN );
292 if( operationType == SCEP_OPERATION_GETCACAPS )
296 sMemOpen( &stream, sessionInfoPtr->receiveBuffer, 1024 );
297 status = swrite( &stream,
"POSTPKIOperation\n", 17 );
299 status = swrite( &stream,
"SHA-1\n", 6 );
301 status = swrite( &stream,
"SHA-256\n", 8 );
303 status = swrite( &stream,
"SHAng\n", 6 );
305 status = swrite( &stream,
"DES3\n", 5 );
307 status = swrite( &stream,
"AES\n", 4 );
309 sessionInfoPtr->receiveBufEnd = stell( &stream );
310 sMemDisconnect( &stream );
318 sessionInfoPtr->receiveBufSize );
321 ( operationType == SCEP_OPERATION_GETCACERT ) ? \
328 "Couldn't export CA certificate%s for '%s' request",
329 ( operationType == SCEP_OPERATION_GETCACERT ) ? \
331 ( operationType == SCEP_OPERATION_GETCACERT ) ? \
332 "GetCACert" :
"GetCACertChain" ) );
334 sessionInfoPtr->receiveBufEnd = msgData.
length;
335 if( operationType == SCEP_OPERATION_GETCACERT )
337 return( writePkiDatagram( sessionInfoPtr,
341 return( writePkiDatagram( sessionInfoPtr,
369 *requestDataAvailable =
FALSE;
373 sessionInfoPtr->receiveBufEnd );
374 status = envelopeSigCheck( sessionInfoPtr->receiveBuffer,
375 sessionInfoPtr->receiveBufEnd,
376 sessionInfoPtr->receiveBuffer,
377 sessionInfoPtr->receiveBufSize, &dataLength,
379 &protocolInfo->iScepCert, &iCmsAttributes );
384 "Invalid CMS signed data in client request" ) );
395 "Bad signature on client request data" ) );
412 "Ephemeral SCEP client certificate isn't valid for "
413 "signing/encryption" ) );
422 protocolInfo->nonceSize = msgData.
length;
433 "Request is missing a nonce/transaction ID" ) );
435 protocolInfo->transIDsize = msgData.
length;
443 *requestDataAvailable =
TRUE;
448 if( protocolInfo->transIDsize != 17 || \
449 !isPKIUserValue( protocolInfo->transID, protocolInfo->transIDsize ) )
454 "Request has an invalid transaction ID '%s'",
455 sanitiseString( protocolInfo->transID,
456 protocolInfo->transIDsize,
457 protocolInfo->transIDsize ) ) );
459 status = updateSessionInfo( &sessionInfoPtr->attributeList,
461 protocolInfo->transID,
462 protocolInfo->transIDsize,
471 status = getScepStatusValue( iCmsAttributes,
480 "Incorrect SCEP message type %d", value ) );
484 status = envelopeUnwrap( sessionInfoPtr->receiveBuffer, dataLength,
485 sessionInfoPtr->receiveBuffer,
486 sessionInfoPtr->receiveBufSize, &dataLength,
487 sessionInfoPtr->privateKey );
492 "Couldn't decrypt CMS enveloped data in client request" ) );
497 sessionInfoPtr->receiveBuffer, dataLength,
506 "Invalid PKCS #10 request in client request" ) );
508 sessionInfoPtr->iCertRequest = createInfo.
cryptHandle;
528 status = checkPkiUserInfo( sessionInfoPtr, protocolInfo );
533 setkeyInfo.
cryptHandle = sessionInfoPtr->iCertRequest;
541 "Request couldn't be added to certificate store" ) );
546 sessionInfoPtr->iCertRequest );
554 "Couldn't issue certificate for user" ) );
556 sessionInfoPtr->iCertResponse = certMgmtInfo.
cryptCert;
576 sessionInfoPtr->receiveBufSize );
584 "Couldn't get PKCS #7 certificate chain from SCEP "
585 "response object" ) );
591 status = envelopeWrap( sessionInfoPtr->receiveBuffer, msgData.
length,
592 sessionInfoPtr->receiveBuffer,
593 sessionInfoPtr->receiveBufSize, &dataLength,
595 protocolInfo->iScepCert );
600 "Couldn't encrypt response data with client key" ) );
606 status = createScepAttributes( sessionInfoPtr, protocolInfo,
612 "Couldn't create SCEP response signing attributes" ) );
616 status = envelopeSign( sessionInfoPtr->receiveBuffer, dataLength,
617 sessionInfoPtr->receiveBuffer,
618 sessionInfoPtr->receiveBufSize,
619 &sessionInfoPtr->receiveBufEnd,
627 "Couldn't sign response data with CA key" ) );
630 sessionInfoPtr->receiveBufEnd );
662 sessionInfoPtr->receiveBufEnd = 0;
665 for( requestCount = 0; requestCount < 5; requestCount++ )
668 sessionInfoPtr->receiveBufSize, &httpReqInfo );
669 status = sread( &sessionInfoPtr->stream, &httpDataInfo,
673 sNetGetErrorInfo( &sessionInfoPtr->stream,
674 &sessionInfoPtr->errorInfo );
690 status = processAdditionalScepRequest( sessionInfoPtr,
695 if( requestCount >= 5 )
715 "Invalid PKI message length %d", length ) );
718 checkObjectEncoding( sessionInfoPtr->receiveBuffer, length );
725 sessionInfoPtr->receiveBufEnd =
length;
728 initSCEPprotocolInfo( &protocolInfo );
729 status = checkScepRequest( sessionInfoPtr, &protocolInfo,
737 sendErrorResponse( sessionInfoPtr, &protocolInfo, status );
739 sendCertErrorResponse( sessionInfoPtr, status );
744 status = issueCertFromRequest( sessionInfoPtr, &protocolInfo );
747 sendErrorResponse( sessionInfoPtr, &protocolInfo, status );
748 destroySCEPprotocolInfo( &protocolInfo );
753 status = createScepResponse( sessionInfoPtr, &protocolInfo );
757 destroySCEPprotocolInfo( &protocolInfo );
768 void initSCEPserverProcessing(
SESSION_INFO *sessionInfoPtr )
772 sessionInfoPtr->transactFunction = serverTransact;