/****************************************************************************
*																			*
*								Write CMP Messages							*
*						Copyright Peter Gutmann 1999-2009					*
*																			*
****************************************************************************/

#if defined( INC_ALL )
  #include "crypt.h"
  #include "asn1.h"
  #include "asn1_ext.h"
  #include "session.h"
  #include "cmp.h"
#else
  #include "crypt.h"
  #include "enc_dec/asn1.h"
  #include "enc_dec/asn1_ext.h"
  #include "session/session.h"
  #include "session/cmp.h"
#endif /* Compiler-specific includes */

/* Enabling the following define forces the use of full headers at all times.
   cryptlib always sends minimal headers once it detects that the other side 
   is using cryptlib, ommitting as much of the unnecessary junk as possible, 
   which significantly reduces the overall message size */

/* #define USE_FULL_HEADERS */

#ifdef USE_CMP

/****************************************************************************
*																			*
*								Utility Routines							*
*																			*
****************************************************************************/

/* Write full certificate ID information.  This is written as an attribute 
   in the generalInfo field of the message header to allow unambiguous
   identification of the signing certificate, which the standard CMP format 
   can't do.  Although CMP uses a gratuitously incompatible definition of 
   the standard attribute type (calling it InfoTypeAndValue), it's possible 
   to shoehorn a standard attribute type in by taking the "ANY" in "ANY 
   DEFINED BY x" to mean "SET OF AttributeValue" (for once the use of 
   obsolete ASN.1 is a help, since it's so imprecise that we can shovel in 
   anything and it's still valid):

	SigningCertificate ::=  SEQUENCE {
		certs			SEQUENCE OF ESSCertID	-- Size (1)
		}

	ESSCertID ::= SEQUENCE {
		certID			OCTET STRING
		}

   All that we really need to identify certificates is the certificate ID, 
   so instead of writing a full ESSCertID (which also contains an optional 
   incompatible reinvention of the CMS IssuerAndSerialNumber) we write the 
   sole mandatory field, the certificate hash, which also keeps the overall 
   size down.
   
   This is further complicated though by the fact that certificate attributes
   are defined as SET OF while CMS attributes are defined as SEQUENCE (and of 
   course CMP has to gratuitously invent its own type which is neither of the 
   two).  This means that the read code would need to know whether a given 
   OID corresponds to a certificate or CMS attribute and read it 
   appropriately.  Because this is just too much of a mess, we pretend that 
   all attributes are certificate attributes (since this is a PKIX protocol)
   and encode them as a uniform SET OF */

CHECK_RETVAL \
static int sizeofCertID( IN_HANDLE const CRYPT_CONTEXT iCryptCert )
	{
	const int essCertIDSize = objSize( objSize( objSize( objSize( 20 ) ) ) );
					/* Infinitely-nested SHA-1 hash */

	REQUIRES( isHandleRangeValid( iCryptCert ) );

	return( objSize( sizeofOID( OID_ESS_CERTID ) + \
					 sizeofObject( essCertIDSize ) ) );
	}

CHECK_RETVAL STDC_NONNULL_ARG( ( 1 ) ) \
static int writeCertID( INOUT STREAM *stream, 
						IN_HANDLE const CRYPT_CONTEXT iCryptCert )
	{
	MESSAGE_DATA msgData;
	BYTE certHash[ CRYPT_MAX_HASHSIZE + 8 ];
	int essCertIDSize, payloadSize, status;

	assert( isWritePtr( stream, sizeof( STREAM ) ) );
	
	REQUIRES( isHandleRangeValid( iCryptCert ) );

	/* Find out how big the payload will be */
	setMessageData( &msgData, certHash, CRYPT_MAX_HASHSIZE );
	status = krnlSendMessage( iCryptCert, IMESSAGE_GETATTRIBUTE_S,
							  &msgData, CRYPT_CERTINFO_FINGERPRINT_SHA1 );
	if( cryptStatusError( status ) )
		return( status );
	essCertIDSize = ( int ) sizeofObject( msgData.length );
	payloadSize = objSize( objSize( objSize( essCertIDSize ) ) );

	/* Write the signing certificate ID information */
	writeSequence( stream, sizeofOID( OID_ESS_CERTID ) + \
						   ( int ) sizeofObject( payloadSize ) );
	writeOID( stream, OID_ESS_CERTID );
	writeSet( stream, payloadSize );
	writeSequence( stream, objSize( objSize( essCertIDSize ) ) );
	writeSequence( stream, objSize( essCertIDSize ) );
	writeSequence( stream, essCertIDSize );
	return( writeOctetString( stream, certHash, msgData.length, 
							  DEFAULT_TAG ) );
	}

/* Initialise the information needed to send client/server DNs in the PKI 
   header */

CHECK_RETVAL STDC_NONNULL_ARG( ( 1, 2, 3, 4, 5 ) ) \
static int initDNInfo( INOUT SESSION_INFO *sessionInfoPtr,
					   OUT_HANDLE_OPT CRYPT_HANDLE *senderNameObject,
					   OUT_HANDLE_OPT CRYPT_HANDLE *recipNameObject,
					   OUT_LENGTH_SHORT_Z int *senderNameLength,
					   OUT_LENGTH_SHORT_Z int *recipNameLength,
					   const BOOLEAN isInitialClientMessage,
					   const BOOLEAN isClientCryptOnlyKey )
	{
	MESSAGE_DATA msgData;
	int status;

	assert( isWritePtr( sessionInfoPtr, sizeof( SESSION_INFO ) ) );
	assert( isWritePtr( senderNameObject, sizeof( CRYPT_HANDLE ) ) );
	assert( isWritePtr( recipNameObject, sizeof( CRYPT_HANDLE ) ) );
	assert( isWritePtr( senderNameLength, sizeof( int ) ) );
	assert( isWritePtr( recipNameLength, sizeof( int ) ) );

	/* Clear return values */
	*senderNameObject = *recipNameObject = CRYPT_ERROR;
	*senderNameLength = *recipNameLength = 0;

	/* Get the objects that we'll be using for our source of DN 
	   information */
	if( isServer( sessionInfoPtr ) )
		{
		*senderNameObject = sessionInfoPtr->privateKey;
		*recipNameObject = sessionInfoPtr->iCertResponse;
		}
	else
		{
		*senderNameObject = isClientCryptOnlyKey ? \
							sessionInfoPtr->iAuthOutContext : \
							sessionInfoPtr->iCertRequest;
		*recipNameObject = sessionInfoPtr->iAuthInContext;
		}

	/* Get the sender DN information */
	setMessageData( &msgData, NULL, 0 );
	status = krnlSendMessage( *senderNameObject, IMESSAGE_GETATTRIBUTE_S,
							  &msgData, CRYPT_IATTRIBUTE_SUBJECT );
	if( status == CRYPT_ERROR_NOTFOUND && isInitialClientMessage )
		{
		/* If there's no subject DN present and it's the first message in a 
		   client's ir exchange, this isn't an error because the subject 
		   usually won't know their DN yet.  That's the theory anyway, 
		   some X.500-obsessive servers will reject a message with no 
		   sender name but there isn't really anything that we can do about 
		   this, particularly since we can't tell in advance what beaviour 
		   the server will exhibit */
		if( sessionInfoPtr->iCertResponse == CRYPT_ERROR )
			{
			*senderNameObject = CRYPT_ERROR;
			msgData.length = ( int ) sizeofObject( 0 );
			status = CRYPT_OK;
			}
		else
			{
			/* Try again with the response from the server, which contains 
			   our newly-allocated DN */
			*senderNameObject = sessionInfoPtr->iCertResponse;
			status = krnlSendMessage( *senderNameObject,
									  IMESSAGE_GETATTRIBUTE_S, &msgData,
									  CRYPT_IATTRIBUTE_SUBJECT );
			}
		}
	if( cryptStatusError( status ) )
		return( status );
	*senderNameLength = msgData.length;

	/* Get the recipient DN information */
	setMessageData( &msgData, NULL, 0 );
	if( *recipNameObject != CRYPT_ERROR )
		{
		status = krnlSendMessage( *recipNameObject, IMESSAGE_GETATTRIBUTE_S, 
								  &msgData, CRYPT_IATTRIBUTE_SUBJECT );
		}
	else
		{
		/* If we're sending an error response there may not be any recipient 
		   name information present yet if the error occurred before the 
		   recipient information could be established, and if this is a MAC-
		   authenticated PKIBoot we don't have the CA's certificate yet so 
		   we don't know its DN.  To work around this we send a zero-length 
		   DN (this is one of those places where an optional field is 
		   specified as being mandatory, to lend balance to the places where 
		   mandatory fields are specified as optional) */
		msgData.length = ( int ) sizeofObject( 0 );
		}
	if( cryptStatusError( status ) )
		return( status );
	*recipNameLength = msgData.length;

	return( CRYPT_OK );
	}

/****************************************************************************
*																			*
*								Write a PKI Header							*
*																			*
****************************************************************************/

/* Write a PKI header.  Fields marked with a * are unnecessary and are only 
   sent when we're not sending minimal headers.  Fields marked with a + are
   only sent in the first message or when not sending minimal headers:

	header				SEQUENCE {
		version			INTEGER (2),
	   *sender		[4]	EXPLICIT DirectoryName,	-- DN of initiator
	   *recipient	[4]	EXPLICIT DirectoryName,	-- DN of responder
		protAlgo	[1]	EXPLICIT AlgorithmIdentifier,
	   +protKeyID	[2] EXPLICIT OCTET STRING,
		transID		[4] EXPLICIT OCTET STRING SIZE (16),-- Random/copied from sender
	   *nonce		[5] EXPLICIT OCTET STRING SIZE (16),-- Random
	   *nonceX		[6] EXPLICIT OCTET STRING SIZE (n),	-- Copied from sender
		generalInfo	[8] EXPLICIT SEQUENCE OF Info OPT	-- cryptlib-specific info
		} 

   The handling can get a bit complex if we're writing a header in response
   to an error in reading the other side's header.  Since CMP includes such 
   a large amount of unnecessary or redundant information, it's not really 
   possible to detect in advance if we've got enough information to send a
   header or not, the best that we can do is to require that enough of the 
   header fields have been read (indicated by the 'headerRead' flag in the 
   protocol information) before we try and create our own header in 
   response */

CHECK_RETVAL STDC_NONNULL_ARG( ( 1, 2, 3 ) ) \
static int writePkiHeader( INOUT STREAM *stream, 
						   INOUT SESSION_INFO *sessionInfoPtr,
						   INOUT CMP_PROTOCOL_INFO *protocolInfo )
	{
	CRYPT_HANDLE senderNameObject DUMMY_INIT, recipNameObject DUMMY_INIT;
	STREAM nullStream;
	MESSAGE_DATA msgData;
#ifdef USE_FULL_HEADERS
	const BOOLEAN sendFullHeader = TRUE;
#else
	BOOLEAN sendFullHeader = FALSE;
#endif /* USE_FULL_HEADERS */
	BOOLEAN sendClibID = FALSE, sendCertID = FALSE, sendMacInfo = FALSE;
	BOOLEAN sendUserID = FALSE;
	int senderNameLength, recipNameLength, attributeLength = 0;
	int protInfoLength DUMMY_INIT, totalLength, hashAlgo, status;

	assert( isWritePtr( stream, sizeof( STREAM ) ) );
	assert( isWritePtr( sessionInfoPtr, sizeof( SESSION_INFO ) ) );
	assert( isWritePtr( protocolInfo, sizeof( CMP_PROTOCOL_INFO ) ) );

	/* Determine which of the many unnecessary and inexplicable bits of the 
	   CMP header we actually have to send:

		sendCertID: Sent on the first message where it's required (which 
			isn't necessarily the first message in an exchange, for example 
			it's not used in an ir/ip), either to identify the CA's cert in 
			a CTL sent in a PKIBoot response or to identify the signing 
			certificate when we're using signature-based message 
			authentication.

		sendClibID: Sent on the first message to tell the other side that 
			this is a cryptlib client/server.

		sendFullHeader: Sent if the other side isn't running cryptlib, unless
			we're doing PKIBoot, for which we couldn't send full headers even 
			if we wanted to 
	
		sendMacInfo: Sent if we're using MAC integrity protection and the
			the other side isn't running cryptlib, or if this is the first 
			message.

		sendUserID: Sent on the first message or if we're sending full 
			headers, provided that it's actually available to send */
	if( !( sessionInfoPtr->protocolFlags & CMP_PFLAG_CERTIDSENT ) && \
		( ( isServer( sessionInfoPtr ) && \
			protocolInfo->operation == CTAG_PB_GENM ) || \
		  !protocolInfo->useMACsend ) )
		sendCertID = TRUE;
	if( !( sessionInfoPtr->protocolFlags & CMP_PFLAG_CLIBIDSENT ) )
		sendClibID = TRUE;
#ifndef USE_FULL_HEADERS
	if( !protocolInfo->isCryptlib && \
		protocolInfo->operation != CTAG_PB_GENM )
		sendFullHeader = TRUE;
#endif /* !USE_FULL_HEADERS */
	if( protocolInfo->useMACsend && \
		!( protocolInfo->isCryptlib && \
		   ( sessionInfoPtr->protocolFlags & CMP_PFLAG_MACINFOSENT ) ) )
		sendMacInfo = TRUE;
	if( ( sendFullHeader || \
		  !( sessionInfoPtr->protocolFlags & CMP_PFLAG_USERIDSENT ) ) && \
		( protocolInfo->userIDsize > 0 ) )
		sendUserID = TRUE;

	REQUIRES( !sendFullHeader || !protocolInfo->headerRead || \
			  ( protocolInfo->userIDsize > 0 && \
				protocolInfo->userIDsize < MAX_INTLENGTH_SHORT ) );
	REQUIRES( protocolInfo->transIDsize > 0 && \
			  protocolInfo->transIDsize < MAX_INTLENGTH_SHORT );

	/* Get any other state information that we may need */
	status = krnlSendMessage( sessionInfoPtr->ownerHandle, 
							  IMESSAGE_GETATTRIBUTE, &hashAlgo, 
							  CRYPT_OPTION_ENCR_HASH );
	ENSURES( cryptStatusOK( status ) );
	protocolInfo->hashAlgo = hashAlgo;	/* int vs.enum */

	/* Determine how big the sender and recipient information will be.  We 
	   shouldn't need to send a recipient name for an ir because it won't
	   usually be known yet, but various implementations can't handle a 
	   zero-length GeneralName so we supply it if it's available even though 
	   it's redundant */
	if( sendFullHeader )
		{
		status = initDNInfo( sessionInfoPtr, &senderNameObject, 
							 &recipNameObject, &senderNameLength, 
							 &recipNameLength, 
							 ( protocolInfo->operation == CTAG_PB_IR ) ? \
								TRUE : FALSE,
							 protocolInfo->cryptOnlyKey );
		if( cryptStatusError( status ) )
			return( status );
		}
	else
		{
		/* We're not using sender or recipient information since it doesn't 
		   serve any useful purpose, just set the fields to an empty 
		   SEQUENCE */
		senderNameLength = recipNameLength = sizeofObject( 0 );
		}

	/* Determine how big the remaining header data will be */
	sMemNullOpen( &nullStream );
	if( protocolInfo->useMACsend )
		{
		status = writeMacInfo( &nullStream, protocolInfo, sendMacInfo );
		}
	else
		{
		status = writeContextAlgoID( &nullStream, protocolInfo->authContext, 
									 protocolInfo->hashAlgo );
		}
	if( cryptStatusOK( status ) )
		protInfoLength = stell( &nullStream );
	sMemClose( &nullStream );
	if( cryptStatusError( status ) )
		return( status );
	if( sendClibID )
		{
		attributeLength += sizeofObject( \
								sizeofOID( OID_CRYPTLIB_PRESENCECHECK ) + \
								sizeofObject( 0 ) );
		}
	if( sendCertID )
		{
		const int certIDsize = sizeofCertID( protocolInfo->authContext );

		ENSURES( certIDsize > 0 && certIDsize < MAX_INTLENGTH_SHORT );

		attributeLength += certIDsize;
		}
	totalLength = sizeofShortInteger( CMP_VERSION ) + \
				  objSize( senderNameLength ) + objSize( recipNameLength ) + \
				  objSize( protInfoLength ) + \
				  objSize( sizeofObject( protocolInfo->transIDsize ) );
	if( sendUserID )
		totalLength += objSize( sizeofObject( protocolInfo->userIDsize ) );
	if( sendFullHeader )
		{
		if( protocolInfo->senderNonceSize > 0 )
			totalLength += objSize( \
								sizeofObject( protocolInfo->senderNonceSize ) );
		if( protocolInfo->recipNonceSize > 0 )
			totalLength += objSize( \
								sizeofObject( protocolInfo->recipNonceSize ) );
		}
	if( attributeLength > 0 )
		totalLength += objSize( objSize( attributeLength ) );

	/* Perform an early check for data-size problems before we go through 
	   all of the following code */
	if( sizeofObject( totalLength ) <= 0 || \
		sizeofObject( totalLength ) > sMemDataLeft( stream ) )
		return( CRYPT_ERROR_OVERFLOW );

	/* Write the PKI header wrapper, version information, and sender and 
	   recipient names if there's name information present */
	writeSequence( stream, totalLength );
	writeShortInteger( stream, CMP_VERSION, DEFAULT_TAG );
	if( sendFullHeader )
		{
		writeConstructed( stream, senderNameLength, 4 );
		if( senderNameObject != CRYPT_ERROR )
			{
			status = exportAttributeToStream( stream, senderNameObject, 
											  CRYPT_IATTRIBUTE_SUBJECT );
			if( cryptStatusError( status ) )
				return( status );
			}
		else
			writeSequence( stream, 0 );
		writeConstructed( stream, recipNameLength, 4 );
		if( recipNameObject != CRYPT_ERROR )
			{
			status = exportAttributeToStream( stream, recipNameObject, 
											  CRYPT_IATTRIBUTE_SUBJECT );
			}
		else
			status = writeSequence( stream, 0 );
		}
	else
		{
		/* This is one of the portions of CMP where an optional field is 
		   marked as mandatory, to balance out the mandatory fields that are 
		   marked as optional.  To work around this we write the names as 
		   zero-length DNs */
		writeConstructed( stream, senderNameLength, 4 );
		writeSequence( stream, 0 );
		writeConstructed( stream, recipNameLength, 4 );
		status = writeSequence( stream, 0 );
		}
	if( cryptStatusError( status ) )
		return( status );

	/* Write the protection information, assorted nonces and IDs, and extra
	   information that the other side may be able to make use of */
	writeConstructed( stream, protInfoLength, CTAG_PH_PROTECTIONALGO );
	if( protocolInfo->useMACsend )
		{
		status = writeMacInfo( stream, protocolInfo, sendMacInfo );
		sessionInfoPtr->protocolFlags |= CMP_PFLAG_MACINFOSENT;
		}
	else
		{
		status = writeContextAlgoID( stream, protocolInfo->authContext, 
									 protocolInfo->hashAlgo );
		}
	if( cryptStatusError( status ) )
		return( status );
	if( sendUserID )
		{
		/* We're using full headers or we're the client sending our first
		   message, identify the sender key */
		writeConstructed( stream, objSize( protocolInfo->userIDsize ),
						  CTAG_PH_SENDERKID );
		writeOctetString( stream, protocolInfo->userID,
						  protocolInfo->userIDsize, DEFAULT_TAG );
		DEBUG_PRINT(( "%s: Writing userID.\n",
					  protocolInfo->isServer ? "SVR" : "CLI" ));
		DEBUG_DUMP_HEX( protocolInfo->isServer ? "SVR" : "CLI", 
						protocolInfo->userID, protocolInfo->userIDsize );
		sessionInfoPtr->protocolFlags |= CMP_PFLAG_USERIDSENT;
		}
	writeConstructed( stream, objSize( protocolInfo->transIDsize ),
					  CTAG_PH_TRANSACTIONID );
	status = writeOctetString( stream, protocolInfo->transID,
							   protocolInfo->transIDsize, DEFAULT_TAG );
	if( cryptStatusError( status ) )
		return( status );
	if( sendFullHeader )
		{
		if( protocolInfo->senderNonceSize > 0 )
			{
			/* We're using nonces, generate a new sender nonce (the initial 
			   nonce will have been set when the protocol state was 
			   initialised) */
			setMessageData( &msgData, protocolInfo->senderNonce,
							protocolInfo->senderNonceSize );
			krnlSendMessage( SYSTEM_OBJECT_HANDLE, IMESSAGE_GETATTRIBUTE_S,
							 &msgData, CRYPT_IATTRIBUTE_RANDOM_NONCE );
			writeConstructed( stream, 
							  objSize( protocolInfo->senderNonceSize ),
							  CTAG_PH_SENDERNONCE );
			status = writeOctetString( stream, protocolInfo->senderNonce,
									   protocolInfo->senderNonceSize, 
									   DEFAULT_TAG );
			}
		if( protocolInfo->recipNonceSize > 0 )
			{
			writeConstructed( stream, 
							  objSize( protocolInfo->recipNonceSize ),
							  CTAG_PH_RECIPNONCE );
			status = writeOctetString( stream, protocolInfo->recipNonce,
									   protocolInfo->recipNonceSize, 
									   DEFAULT_TAG );
			}
		}
	if( cryptStatusError( status ) )
		return( status );
	if( attributeLength > 0 )
		{
		ENSURES( sendClibID || sendCertID );

		/* We haven't sent any messages yet, let the other side know that 
		   we're running cryptlib and identify our signing certificate as
		   required */
		writeConstructed( stream, objSize( attributeLength ),
						  CTAG_PH_GENERALINFO );
		writeSequence( stream, attributeLength );
		if( sendClibID )
			{
			sessionInfoPtr->protocolFlags |= CMP_PFLAG_CLIBIDSENT;
			writeSequence( stream, sizeofOID( OID_CRYPTLIB_PRESENCECHECK ) + \
								   sizeofObject( 0 ) );
			writeOID( stream, OID_CRYPTLIB_PRESENCECHECK );
			status = writeSet( stream, 0 );
			}
		if( sendCertID )
			{
			sessionInfoPtr->protocolFlags |= CMP_PFLAG_CERTIDSENT;
			status = writeCertID( stream, protocolInfo->authContext );
			}
		}
	return( status );
	}

/****************************************************************************
*																			*
*							Write a PKI Message								*
*																			*
****************************************************************************/

/* Write a PKI message:

	PkiMessage ::= SEQUENCE {
		header			PKIHeader,
		body			CHOICE { [0]... [24]... },
		protection	[0]	BIT STRING
		} */

CHECK_RETVAL STDC_NONNULL_ARG( ( 1, 2 ) ) \
int writePkiMessage( INOUT SESSION_INFO *sessionInfoPtr,
					 INOUT CMP_PROTOCOL_INFO *protocolInfo,
					 IN_ENUM( CMPBODY ) const CMPBODY_TYPE bodyType )
	{
	WRITEMESSAGE_FUNCTION writeMessageFunction;
	BYTE protInfo[ 64 + MAX_PKCENCRYPTED_SIZE + 8 ], headerBuffer[ 8 + 8 ];
	STREAM stream;
	int headerSize DUMMY_INIT, protInfoSize, status;

	assert( isWritePtr( sessionInfoPtr, sizeof( SESSION_INFO ) ) );
	assert( isWritePtr( protocolInfo, sizeof( CMP_PROTOCOL_INFO ) ) );

	REQUIRES( bodyType > CMPBODY_NONE && bodyType < CMPBODY_LAST );

	DEBUG_PRINT(( "%s: Writing message body type %d.\n",
				  protocolInfo->isServer ? "SVR" : "CLI", bodyType ));

	/* Write the header and payload so that we can MAC/sign it */
	sMemOpen( &stream, sessionInfoPtr->receiveBuffer,
			  sessionInfoPtr->receiveBufSize );
	status = writePkiHeader( &stream, sessionInfoPtr, protocolInfo );
	if( cryptStatusError( status ) )
		{
		sMemClose( &stream );
		return( status );
		}

	/* Write the message data */
	writeMessageFunction = getMessageWriteFunction( bodyType, 
										isServer( sessionInfoPtr ) );
	ENSURES( writeMessageFunction != NULL );
	status = writeMessageFunction( &stream, sessionInfoPtr, protocolInfo );
	if( cryptStatusError( status ) )
		{
		sMemClose( &stream );
		return( status );
		}

	/* Generate the MAC or signature as appropriate */
	if( protocolInfo->useMACsend )
		{
		INJECT_FAULT( BADSIG_HASH, SESSION_BADSIG_HASH_CMP_1 );
		status = writeMacProtinfo( protocolInfo->iMacContext,
						sessionInfoPtr->receiveBuffer, stell( &stream ),
						protInfo, 64 + MAX_PKCENCRYPTED_SIZE, &protInfoSize );
		INJECT_FAULT( BADSIG_HASH, SESSION_BADSIG_HASH_CMP_2 );
		INJECT_FAULT( BADSIG_DATA, SESSION_BADSIG_DATA_CMP_1 );
		}
	else
		{
		status = writeSignedProtinfo( protocolInfo->authContext, 
						protocolInfo->hashAlgo, protocolInfo->hashParam,
						sessionInfoPtr->receiveBuffer, stell( &stream ),
						protInfo, 64 + MAX_PKCENCRYPTED_SIZE, &protInfoSize );
		INJECT_FAULT( BADSIG_SIG, SESSION_BADSIG_SIG_CMP_1 );
		}
	if( cryptStatusError( status ) )
		{
		sMemClose( &stream );
		return( status );
		}

	/* Attach the MAC/signature to the payload */
	writeConstructed( &stream, protInfoSize, CTAG_PM_PROTECTION );
	status = swrite( &stream, protInfo, protInfoSize );
	if( cryptStatusOK( status ) )
		sessionInfoPtr->receiveBufEnd = stell( &stream );
	sMemDisconnect( &stream );
	if( cryptStatusError( status ) )
		return( status );

	/* Write the wrapper and move it onto the front of the message:

		receiveBuffer								  receiveBufSize
			|												|
			v												v
			+-------+-----------------------+---------------+
			|		|						|				|
			+-------+-----------------------+---------------+
			|<--+-->|<--- receiveBufend --->|
				|
			headerSize

	   Unfortunately we can't just assume a fixed-length header because a 
	   few messages (conf and pkiConf) will be short, leading to a 1-byte 
	   length rather than the more typical 2-byte length */
	sMemOpen( &stream, headerBuffer, 8 );
	status = writeSequence( &stream, sessionInfoPtr->receiveBufEnd );
	if( cryptStatusOK( status ) )
		headerSize = stell( &stream );
	sMemDisconnect( &stream );
	ENSURES( cryptStatusOK( status ) );
	REQUIRES( rangeCheck( headerSize, sessionInfoPtr->receiveBufEnd,
						  sessionInfoPtr->receiveBufSize ) );
	memmove( sessionInfoPtr->receiveBuffer + headerSize,
			 sessionInfoPtr->receiveBuffer,
			 sessionInfoPtr->receiveBufEnd );
	memcpy( sessionInfoPtr->receiveBuffer, headerBuffer, headerSize );
	sessionInfoPtr->receiveBufEnd += headerSize;

	return( CRYPT_OK );
	}
#endif /* USE_CMP */
