diff options
| author | Dr. David von Oheimb <David.von.Oheimb@siemens.com> | 2020-08-28 13:37:04 +0200 |
|---|---|---|
| committer | Dr. David von Oheimb <David.von.Oheimb@siemens.com> | 2020-09-08 23:24:42 +0200 |
| commit | b434b2c08d2025936fb8b7ece3a5908613333f6b (patch) | |
| tree | df6b0138916fd32ad87797f5af867aeab83d3b98 /crypto/cmp | |
| parent | 15633d74dcfe446d309d612c69fd075616d45c5b (diff) | |
Allow unauthenticated CMP server if missing -trusted, -srvcert, and -secret options
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12806)
Diffstat (limited to 'crypto/cmp')
| -rw-r--r-- | crypto/cmp/cmp_vfy.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/crypto/cmp/cmp_vfy.c b/crypto/cmp/cmp_vfy.c index 9b8a88f94b..f5026e0bbc 100644 --- a/crypto/cmp/cmp_vfy.c +++ b/crypto/cmp/cmp_vfy.c @@ -568,6 +568,10 @@ int OSSL_CMP_validate_msg(OSSL_CMP_CTX *ctx, const OSSL_CMP_MSG *msg) switch (ossl_cmp_hdr_get_protection_nid(msg->header)) { /* 5.1.3.1. Shared Secret Information */ case NID_id_PasswordBasedMAC: + if (ctx->secretValue == NULL) { + ossl_cmp_warn(ctx, "no secret available for verifying PBM-based CMP message protection"); + return 1; + } if (verify_PBMAC(ctx, msg)) { /* * RFC 4210, 5.3.2: 'Note that if the PKI Message Protection is @@ -615,6 +619,10 @@ int OSSL_CMP_validate_msg(OSSL_CMP_CTX *ctx, const OSSL_CMP_MSG *msg) default: scrt = ctx->srvCert; if (scrt == NULL) { + if (ctx->trusted == NULL) { + ossl_cmp_warn(ctx, "no trust store nor pinned server cert available for verifying signature-based CMP message protection"); + return 1; + } if (check_msg_find_cert(ctx, msg)) return 1; } else { /* use pinned sender cert */ |