Chunk 8 of CMP contribution to OpenSSL: CMP server and cmp_mock_srv.c for testing

Certificate Management Protocol (CMP, RFC 4210) extension to OpenSSL
Also includes CRMF (RFC 4211) and HTTP transfer (RFC 6712).
Adds the CMP and CRMF API to libcrypto and the "cmp" app to the CLI.
Adds extensive documentation and tests.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/11142)

41 files changed, 2102 insertions, 351 deletions

diff --git a/apps/build.info b/apps/build.info
index 495e56065e..2186de3a27 100644
--- a/apps/build.info
+++ b/apps/build.info
@@ -23,6 +23,9 @@ IF[{- !$disabled{'deprecated-3.0'} -}]
   $OPENSSLSRC=$OPENSSLSRC \
         dhparam.c dsa.c dsaparam.c gendsa.c rsa.c rsautl.c genrsa.c
 ENDIF
+IF[{- !$disabled{'cmp'} -}]
+  $OPENSSLSRC=$OPENSSLSRC cmp_mock_srv.c
+ENDIF
 
 IF[{- !$disabled{apps} -}]
   PROGRAMS=openssl
diff --git a/apps/cmp_mock_srv.c b/apps/cmp_mock_srv.c
new file mode 100644
index 0000000000..4cdda2417d
--- /dev/null
+++ b/apps/cmp_mock_srv.c
@@ -0,0 +1,406 @@
+/*
+ * Copyright 2018-2020 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright Siemens AG 2018-2020
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or atf
+ * https://www.openssl.org/source/license.html
+ */
+
+#include "apps.h"
+#include "cmp_mock_srv.h"
+
+#include <openssl/cmp.h>
+#include <openssl/err.h>
+#include <openssl/cmperr.h>
+
+/* the context for the CMP mock server */
+typedef struct
+{
+    X509 *certOut;             /* certificate to be returned in cp/ip/kup msg */
+    STACK_OF(X509) *chainOut;  /* chain of certOut to add to extraCerts field */
+    STACK_OF(X509) *caPubsOut; /* certs to return in caPubs field of ip msg */
+    OSSL_CMP_PKISI *statusOut; /* status for ip/cp/kup/rp msg unless polling */
+    int sendError;             /* send error response also on valid requests */
+    OSSL_CMP_MSG *certReq;     /* ir/cr/p10cr/kur remembered while polling */
+    int certReqId;             /* id of last ir/cr/kur, used for polling */
+    int pollCount;             /* number of polls before actual cert response */
+    int checkAfterTime;        /* time the client should wait between polling */
+} mock_srv_ctx;
+
+
+static void mock_srv_ctx_free(mock_srv_ctx *ctx)
+{
+    if (ctx == NULL)
+        return;
+
+    OSSL_CMP_PKISI_free(ctx->statusOut);
+    X509_free(ctx->certOut);
+    sk_X509_pop_free(ctx->chainOut, X509_free);
+    sk_X509_pop_free(ctx->caPubsOut, X509_free);
+    OSSL_CMP_MSG_free(ctx->certReq);
+    OPENSSL_free(ctx);
+}
+
+static mock_srv_ctx *mock_srv_ctx_new(void)
+{
+    mock_srv_ctx *ctx = OPENSSL_zalloc(sizeof(mock_srv_ctx));
+
+    if (ctx == NULL)
+        goto err;
+
+    if ((ctx->statusOut = OSSL_CMP_PKISI_new()) == NULL)
+        goto err;
+
+    ctx->certReqId = -1;
+
+    /* all other elements are initialized to 0 or NULL, respectively */
+    return ctx;
+ err:
+    mock_srv_ctx_free(ctx);
+    return NULL;
+}
+
+int ossl_cmp_mock_srv_set1_certOut(OSSL_CMP_SRV_CTX *srv_ctx, X509 *cert)
+{
+    mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
+
+    if (ctx == NULL) {
+        CMPerr(0, CMP_R_NULL_ARGUMENT);
+        return 0;
+    }
+    if (cert == NULL || X509_up_ref(cert)) {
+        X509_free(ctx->certOut);
+        ctx->certOut = cert;
+        return 1;
+    }
+    return 0;
+}
+
+int ossl_cmp_mock_srv_set1_chainOut(OSSL_CMP_SRV_CTX *srv_ctx,
+                                    STACK_OF(X509) *chain)
+{
+    mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
+    STACK_OF(X509) *chain_copy = NULL;
+
+    if (ctx == NULL) {
+        CMPerr(0, CMP_R_NULL_ARGUMENT);
+        return 0;
+    }
+    if (chain != NULL && (chain_copy = X509_chain_up_ref(chain)) == NULL)
+        return 0;
+    sk_X509_pop_free(ctx->chainOut, X509_free);
+    ctx->chainOut = chain_copy;
+    return 1;
+}
+
+int ossl_cmp_mock_srv_set1_caPubsOut(OSSL_CMP_SRV_CTX *srv_ctx,
+                                     STACK_OF(X509) *caPubs)
+{
+    mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
+    STACK_OF(X509) *caPubs_copy = NULL;
+
+    if (ctx == NULL) {
+        CMPerr(0, CMP_R_NULL_ARGUMENT);
+        return 0;
+    }
+    if (caPubs != NULL && (caPubs_copy = X509_chain_up_ref(caPubs)) == NULL)
+        return 0;
+    sk_X509_pop_free(ctx->caPubsOut, X509_free);
+    ctx->caPubsOut = caPubs_copy;
+    return 1;
+}
+
+int ossl_cmp_mock_srv_set_statusInfo(OSSL_CMP_SRV_CTX *srv_ctx, int status,
+                                     int fail_info, const char *text)
+{
+    mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
+    OSSL_CMP_PKISI *si;
+
+    if (ctx == NULL) {
+        CMPerr(0, CMP_R_NULL_ARGUMENT);
+        return 0;
+    }
+    if ((si = OSSL_CMP_STATUSINFO_new(status, fail_info, text)) == NULL)
+        return 0;
+    OSSL_CMP_PKISI_free(ctx->statusOut);
+    ctx->statusOut = si;
+    return 1;
+}
+
+int ossl_cmp_mock_srv_set_send_error(OSSL_CMP_SRV_CTX *srv_ctx, int val)
+{
+    mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
+
+    if (ctx == NULL) {
+        CMPerr(0, CMP_R_NULL_ARGUMENT);
+        return 0;
+    }
+    ctx->sendError = val != 0;
+    return 1;
+}
+
+int ossl_cmp_mock_srv_set_pollCount(OSSL_CMP_SRV_CTX *srv_ctx, int count)
+{
+    mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
+
+    if (ctx == NULL) {
+        CMPerr(0, CMP_R_NULL_ARGUMENT);
+        return 0;
+    }
+    if (count < 0) {
+        CMPerr(0, CMP_R_INVALID_ARGS);
+        return 0;
+    }
+    ctx->pollCount = count;
+    return 1;
+}
+
+int ossl_cmp_mock_srv_set_checkAfterTime(OSSL_CMP_SRV_CTX *srv_ctx, int sec)
+{
+    mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
+
+    if (ctx == NULL) {
+        CMPerr(0, CMP_R_NULL_ARGUMENT);
+        return 0;
+    }
+    ctx->checkAfterTime = sec;
+    return 1;
+}
+
+static OSSL_CMP_PKISI *process_cert_request(OSSL_CMP_SRV_CTX *srv_ctx,
+                                            const OSSL_CMP_MSG *cert_req,
+                                            int certReqId,
+                                            const OSSL_CRMF_MSG *crm,
+                                            const X509_REQ *p10cr,
+                                            X509 **certOut,
+                                            STACK_OF(X509) **chainOut,
+                                            STACK_OF(X509) **caPubs)
+{
+    mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
+    OSSL_CMP_PKISI *si = NULL;
+
+    if (ctx == NULL || cert_req == NULL
+            || certOut == NULL || chainOut == NULL || caPubs == NULL) {
+        CMPerr(0, CMP_R_NULL_ARGUMENT);
+        return NULL;
+    }
+    if (ctx->sendError) {
+        CMPerr(0, CMP_R_ERROR_PROCESSING_MSG);
+        return NULL;
+    }
+
+    *certOut = NULL;
+    *chainOut = NULL;
+    *caPubs = NULL;
+    ctx->certReqId = certReqId;
+    if (ctx->pollCount > 0) {
+        ctx->pollCount--;
+        OSSL_CMP_MSG_free(ctx->certReq);
+        if ((ctx->certReq = OSSL_CMP_MSG_dup(cert_req)) == NULL)
+            return NULL;
+        return OSSL_CMP_STATUSINFO_new(OSSL_CMP_PKISTATUS_waiting, 0, NULL);
+    }
+    if (ctx->certOut != NULL
+            && (*certOut = X509_dup(ctx->certOut)) == NULL)
+        goto err;
+    if (ctx->chainOut != NULL
+            && (*chainOut = X509_chain_up_ref(ctx->chainOut)) == NULL)
+        goto err;
+    if (ctx->caPubsOut != NULL
+            && (*caPubs = X509_chain_up_ref(ctx->caPubsOut)) == NULL)
+        goto err;
+    if (ctx->statusOut != NULL
+            && (si = OSSL_CMP_PKISI_dup(ctx->statusOut)) == NULL)
+        goto err;
+    return si;
+
+ err:
+    X509_free(*certOut);
+    *certOut = NULL;
+    sk_X509_pop_free(*chainOut, X509_free);
+    *chainOut = NULL;
+    sk_X509_pop_free(*caPubs, X509_free);
+    *caPubs = NULL;
+    return NULL;
+}
+
+static OSSL_CMP_PKISI *process_rr(OSSL_CMP_SRV_CTX *srv_ctx,
+                                  const OSSL_CMP_MSG *rr,
+                                  const X509_NAME *issuer,
+                                  const ASN1_INTEGER *serial)
+{
+    mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
+
+    if (ctx == NULL || rr == NULL || issuer == NULL || serial == NULL) {
+        CMPerr(0, CMP_R_NULL_ARGUMENT);
+        return NULL;
+    }
+    if (ctx->sendError || ctx->certOut == NULL) {
+        CMPerr(0, CMP_R_ERROR_PROCESSING_MSG);
+        return NULL;
+    }
+
+    /* accept revocation only for the certificate we sent in ir/cr/kur */
+    if (X509_NAME_cmp(issuer, X509_get_issuer_name(ctx->certOut)) != 0
+            || ASN1_INTEGER_cmp(serial,
+                                X509_get0_serialNumber(ctx->certOut)) != 0) {
+        CMPerr(0, CMP_R_REQUEST_NOT_ACCEPTED);
+        return NULL;
+    }
+    return OSSL_CMP_PKISI_dup(ctx->statusOut);
+}
+
+static int process_genm(OSSL_CMP_SRV_CTX *srv_ctx,
+                        const OSSL_CMP_MSG *genm,
+                        const STACK_OF(OSSL_CMP_ITAV) *in,
+                        STACK_OF(OSSL_CMP_ITAV) **out)
+{
+    mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
+
+    if (ctx == NULL || genm == NULL || in == NULL || out == NULL) {
+        CMPerr(0, CMP_R_NULL_ARGUMENT);
+        return 0;
+    }
+    if (ctx->sendError) {
+        CMPerr(0, CMP_R_ERROR_PROCESSING_MSG);
+        return 0;
+    }
+
+    *out = sk_OSSL_CMP_ITAV_deep_copy(in, OSSL_CMP_ITAV_dup,
+                                      OSSL_CMP_ITAV_free);
+    return *out != NULL;
+}
+
+static void process_error(OSSL_CMP_SRV_CTX *srv_ctx, const OSSL_CMP_MSG *error,
+                          const OSSL_CMP_PKISI *statusInfo,
+                          const ASN1_INTEGER *errorCode,
+                          const OSSL_CMP_PKIFREETEXT *errorDetails)
+{
+    mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
+    char buf[OSSL_CMP_PKISI_BUFLEN];
+    char *sibuf;
+    int i;
+
+    if (ctx == NULL || error == NULL) {
+        CMPerr(0, CMP_R_NULL_ARGUMENT);
+        return;
+    }
+
+    BIO_printf(bio_err, "mock server received error:\n");
+
+    if (statusInfo == NULL) {
+        BIO_printf(bio_err, "pkiStatusInfo absent\n");
+    } else {
+        sibuf = OSSL_CMP_snprint_PKIStatusInfo(statusInfo, buf, sizeof(buf));
+        BIO_printf(bio_err, "pkiStatusInfo: %s\n",
+                   sibuf != NULL ? sibuf: "<invalid>");
+    }
+
+    if (errorCode == NULL)
+        BIO_printf(bio_err, "errorCode absent\n");
+    else
+        BIO_printf(bio_err, "errorCode: %ld\n", ASN1_INTEGER_get(errorCode));
+
+    if (sk_ASN1_UTF8STRING_num(errorDetails) <= 0) {
+        BIO_printf(bio_err, "errorDetails absent\n");
+    } else {
+        BIO_printf(bio_err, "errorDetails: ");
+        for (i = 0; i < sk_ASN1_UTF8STRING_num(errorDetails); i++) {
+            if (i > 0)
+                BIO_printf(bio_err, ", ");
+            BIO_printf(bio_err, "\"");
+            ASN1_STRING_print(bio_err,
+                              sk_ASN1_UTF8STRING_value(errorDetails, i));
+            BIO_printf(bio_err, "\"");
+        }
+        BIO_printf(bio_err, "\n");
+    }
+}
+
+static int process_certConf(OSSL_CMP_SRV_CTX *srv_ctx,
+                            const OSSL_CMP_MSG *certConf, int certReqId,
+                            const ASN1_OCTET_STRING *certHash,
+                            const OSSL_CMP_PKISI *si)
+{
+    mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
+    ASN1_OCTET_STRING *digest;
+
+    if (ctx == NULL || certConf == NULL || certHash == NULL) {
+        CMPerr(0, CMP_R_NULL_ARGUMENT);
+        return 0;
+    }
+    if (ctx->sendError || ctx->certOut == NULL) {
+        CMPerr(0, CMP_R_ERROR_PROCESSING_MSG);
+        return 0;
+    }
+
+    if (certReqId != ctx->certReqId) {
+        /* in case of error, invalid reqId -1 */
+        CMPerr(0, CMP_R_BAD_REQUEST_ID);
+        return 0;
+    }
+
+    if ((digest = OSSL_CMP_X509_digest(ctx->certOut)) == NULL)
+        return 0;
+    if (ASN1_OCTET_STRING_cmp(certHash, digest) != 0) {
+        ASN1_OCTET_STRING_free(digest);
+        CMPerr(0, CMP_R_CERTHASH_UNMATCHED);
+        return 0;
+    }
+    ASN1_OCTET_STRING_free(digest);
+    return 1;
+}
+
+static int process_pollReq(OSSL_CMP_SRV_CTX *srv_ctx,
+                           const OSSL_CMP_MSG *pollReq, int certReqId,
+                           OSSL_CMP_MSG **certReq, int64_t *check_after)
+{
+    mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
+
+    if (ctx == NULL || pollReq == NULL
+            || certReq == NULL || check_after == NULL) {
+        CMPerr(0, CMP_R_NULL_ARGUMENT);
+        return 0;
+    }
+    if (ctx->sendError || ctx->certReq == NULL) {
+        *certReq = NULL;
+        CMPerr(0, CMP_R_ERROR_PROCESSING_MSG);
+        return 0;
+    }
+
+    if (ctx->pollCount == 0) {
+        *certReq = ctx->certReq;
+        ctx->certReq = NULL;
+        *check_after = 0;
+    } else {
+        ctx->pollCount--;
+        *certReq = NULL;
+        *check_after = ctx->checkAfterTime;
+    }
+    return 1;
+}
+
+OSSL_CMP_SRV_CTX *ossl_cmp_mock_srv_new(void)
+{
+    OSSL_CMP_SRV_CTX *srv_ctx = OSSL_CMP_SRV_CTX_new();
+    mock_srv_ctx *ctx = mock_srv_ctx_new();
+
+    if (srv_ctx != NULL && ctx != NULL
+            && OSSL_CMP_SRV_CTX_init(srv_ctx, ctx, process_cert_request,
+                                     process_rr, process_genm, process_error,
+                                     process_certConf, process_pollReq))
+        return srv_ctx;
+
+    mock_srv_ctx_free(ctx);
+    OSSL_CMP_SRV_CTX_free(srv_ctx);
+    return NULL;
+}
+
+void ossl_cmp_mock_srv_free(OSSL_CMP_SRV_CTX *srv_ctx)
+{
+    if (srv_ctx != NULL)
+        mock_srv_ctx_free(OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx));
+    OSSL_CMP_SRV_CTX_free(srv_ctx);
+}
diff --git a/apps/cmp_mock_srv.h b/apps/cmp_mock_srv.h
new file mode 100644
index 0000000000..bddc44df5b
--- /dev/null
+++ b/apps/cmp_mock_srv.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright 2018-2020 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright Siemens AG 2018-2020
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#ifndef OSSL_APPS_CMP_MOCK_SRV_H
+# define OSSL_APPS_CMP_MOCK_SRV_H
+
+# include <openssl/opensslconf.h>
+# ifndef OPENSSL_NO_CMP
+
+#  include <openssl/cmp.h>
+
+OSSL_CMP_SRV_CTX *ossl_cmp_mock_srv_new(void);
+void ossl_cmp_mock_srv_free(OSSL_CMP_SRV_CTX *srv_ctx);
+
+int ossl_cmp_mock_srv_set1_certOut(OSSL_CMP_SRV_CTX *srv_ctx, X509 *cert);
+int ossl_cmp_mock_srv_set1_chainOut(OSSL_CMP_SRV_CTX *srv_ctx,
+                                    STACK_OF(X509) *chain);
+int ossl_cmp_mock_srv_set1_caPubsOut(OSSL_CMP_SRV_CTX *srv_ctx,
+                                     STACK_OF(X509) *caPubs);
+int ossl_cmp_mock_srv_set_statusInfo(OSSL_CMP_SRV_CTX *srv_ctx, int status,
+                                     int fail_info, const char *text);
+int ossl_cmp_mock_srv_set_send_error(OSSL_CMP_SRV_CTX *srv_ctx, int val);
+int ossl_cmp_mock_srv_set_pollCount(OSSL_CMP_SRV_CTX *srv_ctx, int count);
+int ossl_cmp_mock_srv_set_checkAfterTime(OSSL_CMP_SRV_CTX *srv_ctx, int sec);
+
+# endif /* !defined(OPENSSL_NO_CMP) */
+#endif /* !defined(OSSL_APPS_CMP_MOCK_SRV_H) */
diff --git a/crypto/cmp/build.info b/crypto/cmp/build.info
index 41a5899319..1667334e2a 100644
--- a/crypto/cmp/build.info
+++ b/crypto/cmp/build.info
@@ -1,3 +1,4 @@
 LIBS=../../libcrypto
 SOURCE[../../libcrypto]= cmp_asn.c cmp_ctx.c cmp_err.c cmp_util.c \
-        cmp_status.c cmp_hdr.c cmp_protect.c cmp_msg.c cmp_vfy.c
+        cmp_status.c cmp_hdr.c cmp_protect.c cmp_msg.c cmp_vfy.c \
+        cmp_server.c
diff --git a/crypto/cmp/cmp_err.c b/crypto/cmp/cmp_err.c
index f82ef9e325..0d311a8ddf 100644
--- a/crypto/cmp/cmp_err.c
+++ b/crypto/cmp/cmp_err.c
@@ -1,6 +1,6 @@
 /*
  * Generated by util/mkerr.pl DO NOT EDIT
- * Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -17,9 +17,12 @@ static const ERR_STRING_DATA CMP_str_reasons[] = {
     {ERR_PACK(ERR_LIB_CMP, 0, CMP_R_ALGORITHM_NOT_SUPPORTED),
     "algorithm not supported"},
     {ERR_PACK(ERR_LIB_CMP, 0, CMP_R_BAD_REQUEST_ID), "bad request id"},
+    {ERR_PACK(ERR_LIB_CMP, 0, CMP_R_CERTHASH_UNMATCHED), "certhash unmatched"},
     {ERR_PACK(ERR_LIB_CMP, 0, CMP_R_CERTID_NOT_FOUND), "certid not found"},
     {ERR_PACK(ERR_LIB_CMP, 0, CMP_R_CERTIFICATE_NOT_FOUND),
     "certificate not found"},
+    {ERR_PACK(ERR_LIB_CMP, 0, CMP_R_CERTREQMSG_NOT_FOUND),
+    "certreqmsg not found"},
     {ERR_PACK(ERR_LIB_CMP, 0, CMP_R_CERTRESPONSE_NOT_FOUND),
     "certresponse not found"},
     {ERR_PACK(ERR_LIB_CMP, 0, CMP_R_CERT_AND_KEY_DO_NOT_MATCH),
@@ -48,10 +51,16 @@ static const ERR_STRING_DATA CMP_str_reasons[] = {
     {ERR_PACK(ERR_LIB_CMP, 0, CMP_R_ERROR_CREATING_RR), "error creating rr"},
     {ERR_PACK(ERR_LIB_CMP, 0, CMP_R_ERROR_PARSING_PKISTATUS),
     "error parsing pkistatus"},
+    {ERR_PACK(ERR_LIB_CMP, 0, CMP_R_ERROR_PROCESSING_MSG),
+    "error processing msg"},
     {ERR_PACK(ERR_LIB_CMP, 0, CMP_R_ERROR_PROTECTING_MESSAGE),
     "error protecting message"},
     {ERR_PACK(ERR_LIB_CMP, 0, CMP_R_ERROR_SETTING_CERTHASH),
     "error setting certhash"},
+    {ERR_PACK(ERR_LIB_CMP, 0, CMP_R_ERROR_TRANSFERRING_OUT),
+    "error transferring out"},
+    {ERR_PACK(ERR_LIB_CMP, 0, CMP_R_ERROR_UNEXPECTED_CERTCONF),
+    "error unexpected certconf"},
     {ERR_PACK(ERR_LIB_CMP, 0, CMP_R_ERROR_VALIDATING_PROTECTION),
     "error validating protection"},
     {ERR_PACK(ERR_LIB_CMP, 0, CMP_R_FAILED_EXTRACTING_PUBKEY),
@@ -72,6 +81,8 @@ static const ERR_STRING_DATA CMP_str_reasons[] = {
     "missing sender identification"},
     {ERR_PACK(ERR_LIB_CMP, 0, CMP_R_MISSING_TRUST_STORE),
     "missing trust store"},
+    {ERR_PACK(ERR_LIB_CMP, 0, CMP_R_MULTIPLE_REQUESTS_NOT_SUPPORTED),
+    "multiple requests not supported"},
     {ERR_PACK(ERR_LIB_CMP, 0, CMP_R_MULTIPLE_SAN_SOURCES),
     "multiple san sources"},
     {ERR_PACK(ERR_LIB_CMP, 0, CMP_R_NO_STDIO), "no stdio"},
diff --git a/crypto/cmp/cmp_hdr.c b/crypto/cmp/cmp_hdr.c
index 29f477f1b5..b5a9e9ba9e 100644
--- a/crypto/cmp/cmp_hdr.c
+++ b/crypto/cmp/cmp_hdr.c
@@ -153,25 +153,6 @@ int ossl_cmp_hdr_set1_senderKID(OSSL_CMP_PKIHEADER *hdr,
 }
 
 /* push the given text string to the given PKIFREETEXT ft */
-int ossl_cmp_pkifreetext_push_str(OSSL_CMP_PKIFREETEXT *ft, const char *text)
-{
-    ASN1_UTF8STRING *utf8string;
-
-    if (!ossl_assert(ft != NULL && text != NULL))
-        return 0;
-    if ((utf8string = ASN1_UTF8STRING_new()) == NULL)
-        return 0;
-    if (!ASN1_STRING_set(utf8string, text, -1))
-        goto err;
-    if (!sk_ASN1_UTF8STRING_push(ft, utf8string))
-        goto err;
-    return 1;
-
- err:
-    ASN1_UTF8STRING_free(utf8string);
-    return 0;
-}
-
 int ossl_cmp_hdr_push0_freeText(OSSL_CMP_PKIHEADER *hdr, ASN1_UTF8STRING *text)
 {
     if (!ossl_assert(hdr != NULL && text != NULL))
@@ -193,7 +174,8 @@ int ossl_cmp_hdr_push1_freeText(OSSL_CMP_PKIHEADER *hdr, ASN1_UTF8STRING *text)
             && (hdr->freeText = sk_ASN1_UTF8STRING_new_null()) == NULL)
         return 0;
 
-    return ossl_cmp_pkifreetext_push_str(hdr->freeText, (char *)text->data);
+    return
+        ossl_cmp_sk_ASN1_UTF8STRING_push_str(hdr->freeText, (char *)text->data);
 }
 
 int ossl_cmp_hdr_generalInfo_push0_item(OSSL_CMP_PKIHEADER *hdr,
@@ -205,7 +187,7 @@ int ossl_cmp_hdr_generalInfo_push0_item(OSSL_CMP_PKIHEADER *hdr,
 }
 
 int ossl_cmp_hdr_generalInfo_push1_items(OSSL_CMP_PKIHEADER *hdr,
-                                         STACK_OF(OSSL_CMP_ITAV) *itavs)
+                                         const STACK_OF(OSSL_CMP_ITAV) *itavs)
 {
     int i;
     OSSL_CMP_ITAV *itav;
@@ -250,7 +232,7 @@ int ossl_cmp_hdr_set_implicitConfirm(OSSL_CMP_PKIHEADER *hdr)
 }
 
 /* return 1 if implicitConfirm in the generalInfo field of the header is set */
-int ossl_cmp_hdr_check_implicitConfirm(const OSSL_CMP_PKIHEADER *hdr)
+int ossl_cmp_hdr_has_implicitConfirm(const OSSL_CMP_PKIHEADER *hdr)
 {
     int itavCount;
     int i;
@@ -287,7 +269,7 @@ int ossl_cmp_hdr_init(OSSL_CMP_CTX *ctx, OSSL_CMP_PKIHEADER *hdr)
         X509_get_subject_name(ctx->clCert) : ctx->subjectName;
     /*
      * The sender name is copied from the subject of the client cert, if any,
-     * or else from the the subject name provided for certification requests.
+     * or else from the subject name provided for certification requests.
      * As required by RFC 4210 section 5.1.1., if the sender name is not known
      * to the client it set to NULL-DN. In this case for identification at least
      * the senderKID must be set, which we take from any referenceValue given.
diff --git a/crypto/cmp/cmp_local.h b/crypto/cmp/cmp_local.h
index 015a3d4e67..ebc42d8c52 100644
--- a/crypto/cmp/cmp_local.h
+++ b/crypto/cmp/cmp_local.h
@@ -246,7 +246,6 @@ struct ossl_cmp_itav_st {
     } infoValue;
 } /* OSSL_CMP_ITAV */;
 DECLARE_ASN1_FUNCTIONS(OSSL_CMP_ITAV)
-DECLARE_ASN1_DUP_FUNCTION(OSSL_CMP_ITAV)
 
 typedef struct ossl_cmp_certorenccert_st {
     int type;
@@ -284,8 +283,6 @@ struct ossl_cmp_pkisi_st {
     OSSL_CMP_PKIFREETEXT *statusString;
     OSSL_CMP_PKIFAILUREINFO *failInfo;
 } /* OSSL_CMP_PKISI */;
-DECLARE_ASN1_FUNCTIONS(OSSL_CMP_PKISI)
-DECLARE_ASN1_DUP_FUNCTION(OSSL_CMP_PKISI)
 DECLARE_ASN1_DUP_FUNCTION(OSSL_CRMF_CERTID)
 
 /*-
@@ -296,10 +293,11 @@ DECLARE_ASN1_DUP_FUNCTION(OSSL_CRMF_CERTID)
  *      crlEntryDetails     Extensions       OPTIONAL
  *  }
  */
-typedef struct ossl_cmp_revdetails_st {
+struct ossl_cmp_revdetails_st {
     OSSL_CRMF_CERTTEMPLATE *certDetails;
     X509_EXTENSIONS *crlEntryDetails;
-} OSSL_CMP_REVDETAILS;
+} /* OSSL_CMP_REVDETAILS */;
+typedef struct ossl_cmp_revdetails_st OSSL_CMP_REVDETAILS;
 DECLARE_ASN1_FUNCTIONS(OSSL_CMP_REVDETAILS)
 DEFINE_STACK_OF(OSSL_CMP_REVDETAILS)
 
@@ -375,7 +373,6 @@ struct ossl_cmp_certstatus_st {
     OSSL_CMP_PKISI *statusInfo;
 } /* OSSL_CMP_CERTSTATUS */;
 DECLARE_ASN1_FUNCTIONS(OSSL_CMP_CERTSTATUS)
-
 typedef STACK_OF(OSSL_CMP_CERTSTATUS) OSSL_CMP_CERTCONFIRMCONTENT;
 DECLARE_ASN1_FUNCTIONS(OSSL_CMP_CERTCONFIRMCONTENT)
 
@@ -670,7 +667,6 @@ struct ossl_cmp_msg_st {
     STACK_OF(X509) *extraCerts; /* 1 */
 } /* OSSL_CMP_MSG */;
 DECLARE_ASN1_FUNCTIONS(OSSL_CMP_MSG)
-DECLARE_ASN1_DUP_FUNCTION(OSSL_CMP_MSG)
 
 /*-
  * ProtectedPart ::= SEQUENCE {
@@ -728,17 +724,6 @@ DECLARE_ASN1_FUNCTIONS(CMP_PROTECTEDPART)
  *   }
  */
 
-/*
- * constants
- */
-/* certReqId for the first - and so far only - certificate request */
-# define OSSL_CMP_CERTREQID 0
-/* sequence id for the first - and so far only - revocation request */
-# define OSSL_CMP_REVREQSID 0
-/*
- * functions
- */
-
 /* from cmp_asn.c */
 int ossl_cmp_asn1_get_int(const ASN1_INTEGER *a);
 
@@ -755,6 +740,9 @@ int ossl_cmp_sk_X509_add1_certs(STACK_OF(X509) *sk, STACK_OF(X509) *certs,
                                 int no_self_issued, int no_dups, int prepend);
 int ossl_cmp_X509_STORE_add1_certs(X509_STORE *store, STACK_OF(X509) *certs,
                                    int only_self_issued);
+STACK_OF(X509) *ossl_cmp_X509_STORE_get1_certs(X509_STORE *store);
+int ossl_cmp_sk_ASN1_UTF8STRING_push_str(STACK_OF(ASN1_UTF8STRING) *sk,
+                                         const char *text);
 int ossl_cmp_asn1_octet_string_set1(ASN1_OCTET_STRING **tgt,
                                     const ASN1_OCTET_STRING *src);
 int ossl_cmp_asn1_octet_string_set1_bytes(ASN1_OCTET_STRING **tgt,
@@ -800,13 +788,11 @@ int ossl_cmp_ctx_set1_recipNonce(OSSL_CMP_CTX *ctx,
                                  const ASN1_OCTET_STRING *nonce);
 
 /* from cmp_status.c */
-OSSL_CMP_PKISI *
-ossl_cmp_statusinfo_new(int s