summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/ts
diff options
context:
space:
mode:
Diffstat (limited to 'src/lib/libcrypto/ts')
-rw-r--r--src/lib/libcrypto/ts/ts.h839
-rw-r--r--src/lib/libcrypto/ts/ts_asn1.c895
-rw-r--r--src/lib/libcrypto/ts/ts_conf.c532
-rw-r--r--src/lib/libcrypto/ts/ts_err.c179
-rw-r--r--src/lib/libcrypto/ts/ts_lib.c150
-rw-r--r--src/lib/libcrypto/ts/ts_req_print.c104
-rw-r--r--src/lib/libcrypto/ts/ts_req_utils.c255
-rw-r--r--src/lib/libcrypto/ts/ts_rsp_print.c301
-rw-r--r--src/lib/libcrypto/ts/ts_rsp_sign.c1022
-rw-r--r--src/lib/libcrypto/ts/ts_rsp_utils.c436
-rw-r--r--src/lib/libcrypto/ts/ts_rsp_verify.c745
-rw-r--r--src/lib/libcrypto/ts/ts_verify_ctx.c166
12 files changed, 0 insertions, 5624 deletions
diff --git a/src/lib/libcrypto/ts/ts.h b/src/lib/libcrypto/ts/ts.h
deleted file mode 100644
index 4457d30dd7..0000000000
--- a/src/lib/libcrypto/ts/ts.h
+++ /dev/null
@@ -1,839 +0,0 @@
1/* $OpenBSD: ts.h,v 1.7 2014/07/10 22:45:58 jsing Exp $ */
2/* Written by Zoltan Glozik (zglozik@opentsa.org) for the OpenSSL
3 * project 2002, 2003, 2004.
4 */
5/* ====================================================================
6 * Copyright (c) 2006 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#ifndef HEADER_TS_H
60#define HEADER_TS_H
61
62#include <openssl/opensslconf.h>
63
64#ifndef OPENSSL_NO_BUFFER
65#include <openssl/buffer.h>
66#endif
67#ifndef OPENSSL_NO_EVP
68#include <openssl/evp.h>
69#endif
70#ifndef OPENSSL_NO_BIO
71#include <openssl/bio.h>
72#endif
73#include <openssl/stack.h>
74#include <openssl/asn1.h>
75#include <openssl/safestack.h>
76
77#ifndef OPENSSL_NO_RSA
78#include <openssl/rsa.h>
79#endif
80
81#ifndef OPENSSL_NO_DSA
82#include <openssl/dsa.h>
83#endif
84
85#ifndef OPENSSL_NO_DH
86#include <openssl/dh.h>
87#endif
88
89#ifdef __cplusplus
90extern "C" {
91#endif
92
93#include <openssl/x509.h>
94#include <openssl/x509v3.h>
95
96/*
97MessageImprint ::= SEQUENCE {
98 hashAlgorithm AlgorithmIdentifier,
99 hashedMessage OCTET STRING }
100*/
101
102typedef struct TS_msg_imprint_st {
103 X509_ALGOR *hash_algo;
104 ASN1_OCTET_STRING *hashed_msg;
105} TS_MSG_IMPRINT;
106
107/*
108TimeStampReq ::= SEQUENCE {
109 version INTEGER { v1(1) },
110 messageImprint MessageImprint,
111 --a hash algorithm OID and the hash value of the data to be
112 --time-stamped
113 reqPolicy TSAPolicyId OPTIONAL,
114 nonce INTEGER OPTIONAL,
115 certReq BOOLEAN DEFAULT FALSE,
116 extensions [0] IMPLICIT Extensions OPTIONAL }
117*/
118
119typedef struct TS_req_st {
120 ASN1_INTEGER *version;
121 TS_MSG_IMPRINT *msg_imprint;
122 ASN1_OBJECT *policy_id; /* OPTIONAL */
123 ASN1_INTEGER *nonce; /* OPTIONAL */
124 ASN1_BOOLEAN cert_req; /* DEFAULT FALSE */
125 STACK_OF(X509_EXTENSION) *extensions; /* [0] OPTIONAL */
126} TS_REQ;
127
128/*
129Accuracy ::= SEQUENCE {
130 seconds INTEGER OPTIONAL,
131 millis [0] INTEGER (1..999) OPTIONAL,
132 micros [1] INTEGER (1..999) OPTIONAL }
133*/
134
135typedef struct TS_accuracy_st {
136 ASN1_INTEGER *seconds;
137 ASN1_INTEGER *millis;
138 ASN1_INTEGER *micros;
139} TS_ACCURACY;
140
141/*
142TSTInfo ::= SEQUENCE {
143 version INTEGER { v1(1) },
144 policy TSAPolicyId,
145 messageImprint MessageImprint,
146 -- MUST have the same value as the similar field in
147 -- TimeStampReq
148 serialNumber INTEGER,
149 -- Time-Stamping users MUST be ready to accommodate integers
150 -- up to 160 bits.
151 genTime GeneralizedTime,
152 accuracy Accuracy OPTIONAL,
153 ordering BOOLEAN DEFAULT FALSE,
154 nonce INTEGER OPTIONAL,
155 -- MUST be present if the similar field was present
156 -- in TimeStampReq. In that case it MUST have the same value.
157 tsa [0] GeneralName OPTIONAL,
158 extensions [1] IMPLICIT Extensions OPTIONAL }
159*/
160
161typedef struct TS_tst_info_st {
162 ASN1_INTEGER *version;
163 ASN1_OBJECT *policy_id;
164 TS_MSG_IMPRINT *msg_imprint;
165 ASN1_INTEGER *serial;
166 ASN1_GENERALIZEDTIME *time;
167 TS_ACCURACY *accuracy;
168 ASN1_BOOLEAN ordering;
169 ASN1_INTEGER *nonce;
170 GENERAL_NAME *tsa;
171 STACK_OF(X509_EXTENSION) *extensions;
172} TS_TST_INFO;
173
174/*
175PKIStatusInfo ::= SEQUENCE {
176 status PKIStatus,
177 statusString PKIFreeText OPTIONAL,
178 failInfo PKIFailureInfo OPTIONAL }
179
180From RFC 1510 - section 3.1.1:
181PKIFreeText ::= SEQUENCE SIZE (1..MAX) OF UTF8String
182 -- text encoded as UTF-8 String (note: each UTF8String SHOULD
183 -- include an RFC 1766 language tag to indicate the language
184 -- of the contained text)
185*/
186
187/* Possible values for status. See ts_resp_print.c && ts_resp_verify.c. */
188
189#define TS_STATUS_GRANTED 0
190#define TS_STATUS_GRANTED_WITH_MODS 1
191#define TS_STATUS_REJECTION 2
192#define TS_STATUS_WAITING 3
193#define TS_STATUS_REVOCATION_WARNING 4
194#define TS_STATUS_REVOCATION_NOTIFICATION 5
195
196/* Possible values for failure_info. See ts_resp_print.c && ts_resp_verify.c */
197
198#define TS_INFO_BAD_ALG 0
199#define TS_INFO_BAD_REQUEST 2
200#define TS_INFO_BAD_DATA_FORMAT 5
201#define TS_INFO_TIME_NOT_AVAILABLE 14
202#define TS_INFO_UNACCEPTED_POLICY 15
203#define TS_INFO_UNACCEPTED_EXTENSION 16
204#define TS_INFO_ADD_INFO_NOT_AVAILABLE 17
205#define TS_INFO_SYSTEM_FAILURE 25
206
207typedef struct TS_status_info_st {
208 ASN1_INTEGER *status;
209 STACK_OF(ASN1_UTF8STRING) *text;
210 ASN1_BIT_STRING *failure_info;
211} TS_STATUS_INFO;
212
213DECLARE_STACK_OF(ASN1_UTF8STRING)
214DECLARE_ASN1_SET_OF(ASN1_UTF8STRING)
215
216/*
217TimeStampResp ::= SEQUENCE {
218 status PKIStatusInfo,
219 timeStampToken TimeStampToken OPTIONAL }
220*/
221
222typedef struct TS_resp_st {
223 TS_STATUS_INFO *status_info;
224 PKCS7 *token;
225 TS_TST_INFO *tst_info;
226} TS_RESP;
227
228/* The structure below would belong to the ESS component. */
229
230/*
231IssuerSerial ::= SEQUENCE {
232 issuer GeneralNames,
233 serialNumber CertificateSerialNumber
234 }
235*/
236
237typedef struct ESS_issuer_serial {
238 STACK_OF(GENERAL_NAME) *issuer;
239 ASN1_INTEGER *serial;
240} ESS_ISSUER_SERIAL;
241
242/*
243ESSCertID ::= SEQUENCE {
244 certHash Hash,
245 issuerSerial IssuerSerial OPTIONAL
246}
247*/
248
249typedef struct ESS_cert_id {
250 ASN1_OCTET_STRING *hash; /* Always SHA-1 digest. */
251 ESS_ISSUER_SERIAL *issuer_serial;
252} ESS_CERT_ID;
253
254DECLARE_STACK_OF(ESS_CERT_ID)
255DECLARE_ASN1_SET_OF(ESS_CERT_ID)
256
257/*
258SigningCertificate ::= SEQUENCE {
259 certs SEQUENCE OF ESSCertID,
260 policies SEQUENCE OF PolicyInformation OPTIONAL
261}
262*/
263
264typedef struct ESS_signing_cert {
265 STACK_OF(ESS_CERT_ID) *cert_ids;
266 STACK_OF(POLICYINFO) *policy_info;
267} ESS_SIGNING_CERT;
268
269
270TS_REQ *TS_REQ_new(void);
271void TS_REQ_free(TS_REQ *a);
272int i2d_TS_REQ(const TS_REQ *a, unsigned char **pp);
273TS_REQ *d2i_TS_REQ(TS_REQ **a, const unsigned char **pp, long length);
274
275TS_REQ *TS_REQ_dup(TS_REQ *a);
276
277TS_REQ *d2i_TS_REQ_fp(FILE *fp, TS_REQ **a);
278int i2d_TS_REQ_fp(FILE *fp, TS_REQ *a);
279TS_REQ *d2i_TS_REQ_bio(BIO *fp, TS_REQ **a);
280int i2d_TS_REQ_bio(BIO *fp, TS_REQ *a);
281
282TS_MSG_IMPRINT *TS_MSG_IMPRINT_new(void);
283void TS_MSG_IMPRINT_free(TS_MSG_IMPRINT *a);
284int i2d_TS_MSG_IMPRINT(const TS_MSG_IMPRINT *a, unsigned char **pp);
285TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT(TS_MSG_IMPRINT **a,
286 const unsigned char **pp, long length);
287
288TS_MSG_IMPRINT *TS_MSG_IMPRINT_dup(TS_MSG_IMPRINT *a);
289
290TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT **a);
291int i2d_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT *a);
292TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_bio(BIO *fp, TS_MSG_IMPRINT **a);
293int i2d_TS_MSG_IMPRINT_bio(BIO *fp, TS_MSG_IMPRINT *a);
294
295TS_RESP *TS_RESP_new(void);
296void TS_RESP_free(TS_RESP *a);
297int i2d_TS_RESP(const TS_RESP *a, unsigned char **pp);
298TS_RESP *d2i_TS_RESP(TS_RESP **a, const unsigned char **pp, long length);
299TS_TST_INFO *PKCS7_to_TS_TST_INFO(PKCS7 *token);
300TS_RESP *TS_RESP_dup(TS_RESP *a);
301
302TS_RESP *d2i_TS_RESP_fp(FILE *fp, TS_RESP **a);
303int i2d_TS_RESP_fp(FILE *fp, TS_RESP *a);
304TS_RESP *d2i_TS_RESP_bio(BIO *fp, TS_RESP **a);
305int i2d_TS_RESP_bio(BIO *fp, TS_RESP *a);
306
307TS_STATUS_INFO *TS_STATUS_INFO_new(void);
308void TS_STATUS_INFO_free(TS_STATUS_INFO *a);
309int i2d_TS_STATUS_INFO(const TS_STATUS_INFO *a, unsigned char **pp);
310TS_STATUS_INFO *d2i_TS_STATUS_INFO(TS_STATUS_INFO **a,
311 const unsigned char **pp, long length);
312TS_STATUS_INFO *TS_STATUS_INFO_dup(TS_STATUS_INFO *a);
313
314TS_TST_INFO *TS_TST_INFO_new(void);
315void TS_TST_INFO_free(TS_TST_INFO *a);
316int i2d_TS_TST_INFO(const TS_TST_INFO *a, unsigned char **pp);
317TS_TST_INFO *d2i_TS_TST_INFO(TS_TST_INFO **a, const unsigned char **pp,
318 long length);
319TS_TST_INFO *TS_TST_INFO_dup(TS_TST_INFO *a);
320
321TS_TST_INFO *d2i_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO **a);
322int i2d_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO *a);
323TS_TST_INFO *d2i_TS_TST_INFO_bio(BIO *fp, TS_TST_INFO **a);
324int i2d_TS_TST_INFO_bio(BIO *fp, TS_TST_INFO *a);
325
326TS_ACCURACY *TS_ACCURACY_new(void);
327void TS_ACCURACY_free(TS_ACCURACY *a);
328int i2d_TS_ACCURACY(const TS_ACCURACY *a, unsigned char **pp);
329TS_ACCURACY *d2i_TS_ACCURACY(TS_ACCURACY **a, const unsigned char **pp,
330 long length);
331TS_ACCURACY *TS_ACCURACY_dup(TS_ACCURACY *a);
332
333ESS_ISSUER_SERIAL *ESS_ISSUER_SERIAL_new(void);
334void ESS_ISSUER_SERIAL_free(ESS_ISSUER_SERIAL *a);
335int i2d_ESS_ISSUER_SERIAL(const ESS_ISSUER_SERIAL *a,
336 unsigned char **pp);
337ESS_ISSUER_SERIAL *d2i_ESS_ISSUER_SERIAL(ESS_ISSUER_SERIAL **a,
338 const unsigned char **pp, long length);
339ESS_ISSUER_SERIAL *ESS_ISSUER_SERIAL_dup(ESS_ISSUER_SERIAL *a);
340
341ESS_CERT_ID *ESS_CERT_ID_new(void);
342void ESS_CERT_ID_free(ESS_CERT_ID *a);
343int i2d_ESS_CERT_ID(const ESS_CERT_ID *a, unsigned char **pp);
344ESS_CERT_ID *d2i_ESS_CERT_ID(ESS_CERT_ID **a, const unsigned char **pp,
345 long length);
346ESS_CERT_ID *ESS_CERT_ID_dup(ESS_CERT_ID *a);
347
348ESS_SIGNING_CERT *ESS_SIGNING_CERT_new(void);
349void ESS_SIGNING_CERT_free(ESS_SIGNING_CERT *a);
350int i2d_ESS_SIGNING_CERT(const ESS_SIGNING_CERT *a,
351 unsigned char **pp);
352ESS_SIGNING_CERT *d2i_ESS_SIGNING_CERT(ESS_SIGNING_CERT **a,
353 const unsigned char **pp, long length);
354ESS_SIGNING_CERT *ESS_SIGNING_CERT_dup(ESS_SIGNING_CERT *a);
355
356void ERR_load_TS_strings(void);
357
358int TS_REQ_set_version(TS_REQ *a, long version);
359long TS_REQ_get_version(const TS_REQ *a);
360
361int TS_REQ_set_msg_imprint(TS_REQ *a, TS_MSG_IMPRINT *msg_imprint);
362TS_MSG_IMPRINT *TS_REQ_get_msg_imprint(TS_REQ *a);
363
364int TS_MSG_IMPRINT_set_algo(TS_MSG_IMPRINT *a, X509_ALGOR *alg);
365X509_ALGOR *TS_MSG_IMPRINT_get_algo(TS_MSG_IMPRINT *a);
366
367int TS_MSG_IMPRINT_set_msg(TS_MSG_IMPRINT *a, unsigned char *d, int len);
368ASN1_OCTET_STRING *TS_MSG_IMPRINT_get_msg(TS_MSG_IMPRINT *a);
369
370int TS_REQ_set_policy_id(TS_REQ *a, ASN1_OBJECT *policy);
371ASN1_OBJECT *TS_REQ_get_policy_id(TS_REQ *a);
372
373int TS_REQ_set_nonce(TS_REQ *a, const ASN1_INTEGER *nonce);
374const ASN1_INTEGER *TS_REQ_get_nonce(const TS_REQ *a);
375
376int TS_REQ_set_cert_req(TS_REQ *a, int cert_req);
377int TS_REQ_get_cert_req(const TS_REQ *a);
378
379STACK_OF(X509_EXTENSION) *TS_REQ_get_exts(TS_REQ *a);
380void TS_REQ_ext_free(TS_REQ *a);
381int TS_REQ_get_ext_count(TS_REQ *a);
382int TS_REQ_get_ext_by_NID(TS_REQ *a, int nid, int lastpos);
383int TS_REQ_get_ext_by_OBJ(TS_REQ *a, ASN1_OBJECT *obj, int lastpos);
384int TS_REQ_get_ext_by_critical(TS_REQ *a, int crit, int lastpos);
385X509_EXTENSION *TS_REQ_get_ext(TS_REQ *a, int loc);
386X509_EXTENSION *TS_REQ_delete_ext(TS_REQ *a, int loc);
387int TS_REQ_add_ext(TS_REQ *a, X509_EXTENSION *ex, int loc);
388void *TS_REQ_get_ext_d2i(TS_REQ *a, int nid, int *crit, int *idx);
389
390/* Function declarations for TS_REQ defined in ts/ts_req_print.c */
391
392int TS_REQ_print_bio(BIO *bio, TS_REQ *a);
393
394/* Function declarations for TS_RESP defined in ts/ts_resp_utils.c */
395
396int TS_RESP_set_status_info(TS_RESP *a, TS_STATUS_INFO *info);
397TS_STATUS_INFO *TS_RESP_get_status_info(TS_RESP *a);
398
399/* Caller loses ownership of PKCS7 and TS_TST_INFO objects. */
400void TS_RESP_set_tst_info(TS_RESP *a, PKCS7 *p7, TS_TST_INFO *tst_info);
401PKCS7 *TS_RESP_get_token(TS_RESP *a);
402TS_TST_INFO *TS_RESP_get_tst_info(TS_RESP *a);
403
404int TS_TST_INFO_set_version(TS_TST_INFO *a, long version);
405long TS_TST_INFO_get_version(const TS_TST_INFO *a);
406
407int TS_TST_INFO_set_policy_id(TS_TST_INFO *a, ASN1_OBJECT *policy_id);
408ASN1_OBJECT *TS_TST_INFO_get_policy_id(TS_TST_INFO *a);
409
410int TS_TST_INFO_set_msg_imprint(TS_TST_INFO *a, TS_MSG_IMPRINT *msg_imprint);
411TS_MSG_IMPRINT *TS_TST_INFO_get_msg_imprint(TS_TST_INFO *a);
412
413int TS_TST_INFO_set_serial(TS_TST_INFO *a, const ASN1_INTEGER *serial);
414const ASN1_INTEGER *TS_TST_INFO_get_serial(const TS_TST_INFO *a);
415
416int TS_TST_INFO_set_time(TS_TST_INFO *a, const ASN1_GENERALIZEDTIME *gtime);
417const ASN1_GENERALIZEDTIME *TS_TST_INFO_get_time(const TS_TST_INFO *a);
418
419int TS_TST_INFO_set_accuracy(TS_TST_INFO *a, TS_ACCURACY *accuracy);
420TS_ACCURACY *TS_TST_INFO_get_accuracy(TS_TST_INFO *a);
421
422int TS_ACCURACY_set_seconds(TS_ACCURACY *a, const ASN1_INTEGER *seconds);
423const ASN1_INTEGER *TS_ACCURACY_get_seconds(const TS_ACCURACY *a);
424
425int TS_ACCURACY_set_millis(TS_ACCURACY *a, const ASN1_INTEGER *millis);
426const ASN1_INTEGER *TS_ACCURACY_get_millis(const TS_ACCURACY *a);
427
428int TS_ACCURACY_set_micros(TS_ACCURACY *a, const ASN1_INTEGER *micros);
429const ASN1_INTEGER *TS_ACCURACY_get_micros(const TS_ACCURACY *a);
430
431int TS_TST_INFO_set_ordering(TS_TST_INFO *a, int ordering);
432int TS_TST_INFO_get_ordering(const TS_TST_INFO *a);
433
434int TS_TST_INFO_set_nonce(TS_TST_INFO *a, const ASN1_INTEGER *nonce);
435const ASN1_INTEGER *TS_TST_INFO_get_nonce(const TS_TST_INFO *a);
436
437int TS_TST_INFO_set_tsa(TS_TST_INFO *a, GENERAL_NAME *tsa);
438GENERAL_NAME *TS_TST_INFO_get_tsa(TS_TST_INFO *a);
439
440STACK_OF(X509_EXTENSION) *TS_TST_INFO_get_exts(TS_TST_INFO *a);
441void TS_TST_INFO_ext_free(TS_TST_INFO *a);
442int TS_TST_INFO_get_ext_count(TS_TST_INFO *a);
443int TS_TST_INFO_get_ext_by_NID(TS_TST_INFO *a, int nid, int lastpos);
444int TS_TST_INFO_get_ext_by_OBJ(TS_TST_INFO *a, ASN1_OBJECT *obj, int lastpos);
445int TS_TST_INFO_get_ext_by_critical(TS_TST_INFO *a, int crit, int lastpos);
446X509_EXTENSION *TS_TST_INFO_get_ext(TS_TST_INFO *a, int loc);
447X509_EXTENSION *TS_TST_INFO_delete_ext(TS_TST_INFO *a, int loc);
448int TS_TST_INFO_add_ext(TS_TST_INFO *a, X509_EXTENSION *ex, int loc);
449void *TS_TST_INFO_get_ext_d2i(TS_TST_INFO *a, int nid, int *crit, int *idx);
450
451/* Declarations related to response generation, defined in ts/ts_resp_sign.c. */
452
453/* Optional flags for response generation. */
454
455/* Don't include the TSA name in response. */
456#define TS_TSA_NAME 0x01
457
458/* Set ordering to true in response. */
459#define TS_ORDERING 0x02
460
461/*
462 * Include the signer certificate and the other specified certificates in
463 * the ESS signing certificate attribute beside the PKCS7 signed data.
464 * Only the signer certificates is included by default.
465 */
466#define TS_ESS_CERT_ID_CHAIN 0x04
467
468/* Forward declaration. */
469struct TS_resp_ctx;
470
471/* This must return a unique number less than 160 bits long. */
472typedef ASN1_INTEGER *(*TS_serial_cb)(struct TS_resp_ctx *, void *);
473
474/* This must return the seconds and microseconds since Jan 1, 1970 in
475 the sec and usec variables allocated by the caller.
476 Return non-zero for success and zero for failure. */
477typedef int (*TS_time_cb)(struct TS_resp_ctx *, void *, time_t *sec, long *usec);
478
479/* This must process the given extension.
480 * It can modify the TS_TST_INFO object of the context.
481 * Return values: !0 (processed), 0 (error, it must set the
482 * status info/failure info of the response).
483 */
484typedef int (*TS_extension_cb)(struct TS_resp_ctx *, X509_EXTENSION *, void *);
485
486typedef struct TS_resp_ctx {
487 X509 *signer_cert;
488 EVP_PKEY *signer_key;
489 STACK_OF(X509) *certs; /* Certs to include in signed data. */
490 STACK_OF(ASN1_OBJECT) *policies; /* Acceptable policies. */
491 ASN1_OBJECT *default_policy; /* It may appear in policies, too. */
492 STACK_OF(EVP_MD) *mds; /* Acceptable message digests. */
493 ASN1_INTEGER *seconds; /* accuracy, 0 means not specified. */
494 ASN1_INTEGER *millis; /* accuracy, 0 means not specified. */
495 ASN1_INTEGER *micros; /* accuracy, 0 means not specified. */
496 unsigned clock_precision_digits; /* fraction of seconds in
497 time stamp token. */
498 unsigned flags; /* Optional info, see values above. */
499
500 /* Callback functions. */
501 TS_serial_cb serial_cb;
502 void *serial_cb_data; /* User data for serial_cb. */
503
504 TS_time_cb time_cb;
505 void *time_cb_data; /* User data for time_cb. */
506
507 TS_extension_cb extension_cb;
508 void *extension_cb_data; /* User data for extension_cb. */
509
510 /* These members are used only while creating the response. */
511 TS_REQ *request;
512 TS_RESP *response;
513 TS_TST_INFO *tst_info;
514} TS_RESP_CTX;
515
516DECLARE_STACK_OF(EVP_MD)
517DECLARE_ASN1_SET_OF(EVP_MD)
518
519/* Creates a response context that can be used for generating responses. */
520TS_RESP_CTX *TS_RESP_CTX_new(void);
521void TS_RESP_CTX_free(TS_RESP_CTX *ctx);
522
523/* This parameter must be set. */
524int TS_RESP_CTX_set_signer_cert(TS_RESP_CTX *ctx, X509 *signer);
525
526/* This parameter must be set. */
527int TS_RESP_CTX_set_signer_key(TS_RESP_CTX *ctx, EVP_PKEY *key);
528
529/* This parameter must be set. */
530int TS_RESP_CTX_set_def_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *def_policy);
531
532/* No additional certs are included in the response by default. */
533int TS_RESP_CTX_set_certs(TS_RESP_CTX *ctx, STACK_OF(X509) *certs);
534
535/* Adds a new acceptable policy, only the default policy
536 is accepted by default. */
537int TS_RESP_CTX_add_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *policy);
538
539/* Adds a new acceptable message digest. Note that no message digests
540 are accepted by default. The md argument is shared with the caller. */
541int TS_RESP_CTX_add_md(TS_RESP_CTX *ctx, const EVP_MD *md);
542
543/* Accuracy is not included by default. */
544int TS_RESP_CTX_set_accuracy(TS_RESP_CTX *ctx,
545 int secs, int millis, int micros);
546
547/* Clock precision digits, i.e. the number of decimal digits:
548 '0' means sec, '3' msec, '6' usec, and so on. Default is 0. */
549int TS_RESP_CTX_set_clock_precision_digits(TS_RESP_CTX *ctx,
550 unsigned clock_precision_digits);
551/* At most we accept usec precision. */
552#define TS_MAX_CLOCK_PRECISION_DIGITS 6
553
554/* No flags are set by default. */
555void TS_RESP_CTX_add_flags(TS_RESP_CTX *ctx, int flags);
556
557/* Default callback always returns a constant. */
558void TS_RESP_CTX_set_serial_cb(TS_RESP_CTX *ctx, TS_serial_cb cb, void *data);
559
560/* Default callback rejects all extensions. The extension callback is called
561 * when the TS_TST_INFO object is already set up and not signed yet. */
562/* FIXME: extension handling is not tested yet. */
563void TS_RESP_CTX_set_extension_cb(TS_RESP_CTX *ctx,
564 TS_extension_cb cb, void *data);
565
566/* The following methods can be used in the callbacks. */
567int TS_RESP_CTX_set_status_info(TS_RESP_CTX *ctx,
568 int status, const char *text);
569
570/* Sets the status info only if it is still TS_STATUS_GRANTED. */
571int TS_RESP_CTX_set_status_info_cond(TS_RESP_CTX *ctx,
572 int status, const char *text);
573
574int TS_RESP_CTX_add_failure_info(TS_RESP_CTX *ctx, int failure);
575
576/* The get methods below can be used in the extension callback. */
577TS_REQ *TS_RESP_CTX_get_request(TS_RESP_CTX *ctx);
578
579TS_TST_INFO *TS_RESP_CTX_get_tst_info(TS_RESP_CTX *ctx);
580
581/*
582 * Creates the signed TS_TST_INFO and puts it in TS_RESP.
583 * In case of errors it sets the status info properly.
584 * Returns NULL only in case of memory allocation/fatal error.
585 */
586TS_RESP *TS_RESP_create_response(TS_RESP_CTX *ctx, BIO *req_bio);
587
588/*
589 * Declarations related to response verification,
590 * they are defined in ts/ts_resp_verify.c.
591 */
592
593int TS_RESP_verify_signature(PKCS7 *token, STACK_OF(X509) *certs,
594 X509_STORE *store, X509 **signer_out);
595
596/* Context structure for the generic verify method. */
597
598/* Verify the signer's certificate and the signature of the response. */
599#define TS_VFY_SIGNATURE (1u << 0)
600/* Verify the version number of the response. */
601#define TS_VFY_VERSION (1u << 1)
602/* Verify if the policy supplied by the user matches the policy of the TSA. */
603#define TS_VFY_POLICY (1u << 2)
604/* Verify the message imprint provided by the user. This flag should not be
605 specified with TS_VFY_DATA. */
606#define TS_VFY_IMPRINT (1u << 3)
607/* Verify the message imprint computed by the verify method from the user
608 provided data and the MD algorithm of the response. This flag should not be
609 specified with TS_VFY_IMPRINT. */
610#define TS_VFY_DATA (1u << 4)
611/* Verify the nonce value. */
612#define TS_VFY_NONCE (1u << 5)
613/* Verify if the TSA name field matches the signer certificate. */
614#define TS_VFY_SIGNER (1u << 6)
615/* Verify if the TSA name field equals to the user provided name. */
616#define TS_VFY_TSA_NAME (1u << 7)
617
618/* You can use the following convenience constants. */
619#define TS_VFY_ALL_IMPRINT (TS_VFY_SIGNATURE \
620 | TS_VFY_VERSION \
621 | TS_VFY_POLICY \
622 | TS_VFY_IMPRINT \
623 | TS_VFY_NONCE \
624 | TS_VFY_SIGNER \
625 | TS_VFY_TSA_NAME)
626#define TS_VFY_ALL_DATA (TS_VFY_SIGNATURE \
627 | TS_VFY_VERSION \
628 | TS_VFY_POLICY \
629 | TS_VFY_DATA \
630 | TS_VFY_NONCE \
631 | TS_VFY_SIGNER \
632 | TS_VFY_TSA_NAME)
633
634typedef struct TS_verify_ctx {
635 /* Set this to the union of TS_VFY_... flags you want to carry out. */
636 unsigned flags;
637
638 /* Must be set only with TS_VFY_SIGNATURE. certs is optional. */
639 X509_STORE *store;
640 STACK_OF(X509) *certs;
641
642 /* Must be set only with TS_VFY_POLICY. */
643 ASN1_OBJECT *policy;
644
645 /* Must be set only with TS_VFY_IMPRINT. If md_alg is NULL,
646 the algorithm from the response is used. */
647 X509_ALGOR *md_alg;
648 unsigned char *imprint;
649 unsigned imprint_len;
650
651 /* Must be set only with TS_VFY_DATA. */
652 BIO *data;
653
654 /* Must be set only with TS_VFY_TSA_NAME. */
655 ASN1_INTEGER *nonce;
656
657 /* Must be set only with TS_VFY_TSA_NAME. */
658 GENERAL_NAME *tsa_name;
659} TS_VERIFY_CTX;
660
661int TS_RESP_verify_response(TS_VERIFY_CTX *ctx, TS_RESP *response);
662int TS_RESP_verify_token(TS_VERIFY_CTX *ctx, PKCS7 *token);
663
664/*
665 * Declarations related to response verification context,
666 * they are defined in ts/ts_verify_ctx.c.
667 */
668
669/* Set all fields to zero. */
670TS_VERIFY_CTX *TS_VERIFY_CTX_new(void);
671void TS_VERIFY_CTX_init(TS_VERIFY_CTX *ctx);
672void TS_VERIFY_CTX_free(TS_VERIFY_CTX *ctx);
673void TS_VERIFY_CTX_cleanup(TS_VERIFY_CTX *ctx);
674
675/*
676 * If ctx is NULL, it allocates and returns a new object, otherwise
677 * it returns ctx. It initialises all the members as follows:
678 * flags = TS_VFY_ALL_IMPRINT & ~(TS_VFY_TSA_NAME | TS_VFY_SIGNATURE)
679 * certs = NULL
680 * store = NULL
681 * policy = policy from the request or NULL if absent (in this case
682 * TS_VFY_POLICY is cleared from flags as well)
683 * md_alg = MD algorithm from request
684 * imprint, imprint_len = imprint from request
685 * data = NULL
686 * nonce, nonce_len = nonce from the request or NULL if absent (in this case
687 * TS_VFY_NONCE is cleared from flags as well)
688 * tsa_name = NULL
689 * Important: after calling this method TS_VFY_SIGNATURE should be added!
690 */
691TS_VERIFY_CTX *TS_REQ_to_TS_VERIFY_CTX(TS_REQ *req, TS_VERIFY_CTX *ctx);
692
693/* Function declarations for TS_RESP defined in ts/ts_resp_print.c */
694
695int TS_RESP_print_bio(BIO *bio, TS_RESP *a);
696int TS_STATUS_INFO_print_bio(BIO *bio, TS_STATUS_INFO *a);
697int TS_TST_INFO_print_bio(BIO *bio, TS_TST_INFO *a);
698
699/* Common utility functions defined in ts/ts_lib.c */
700
701int TS_ASN1_INTEGER_print_bio(BIO *bio, const ASN1_INTEGER *num);
702int TS_OBJ_print_bio(BIO *bio, const ASN1_OBJECT *obj);
703int TS_ext_print_bio(BIO *bio, const STACK_OF(X509_EXTENSION) *extensions);
704int TS_X509_ALGOR_print_bio(BIO *bio, const X509_ALGOR *alg);
705int TS_MSG_IMPRINT_print_bio(BIO *bio, TS_MSG_IMPRINT *msg);
706
707/* Function declarations for handling configuration options,
708 defined in ts/ts_conf.c */
709
710X509 *TS_CONF_load_cert(const char *file);
711STACK_OF(X509) *TS_CONF_load_certs(const char *file);
712EVP_PKEY *TS_CONF_load_key(const char *file, const char *pass);
713const char *TS_CONF_get_tsa_section(CONF *conf, const char *section);
714int TS_CONF_set_serial(CONF *conf, const char *section, TS_serial_cb cb,
715 TS_RESP_CTX *ctx);
716int TS_CONF_set_crypto_device(CONF *conf, const char *section,
717 const char *device);
718int TS_CONF_set_default_engine(const char *name);
719int TS_CONF_set_signer_cert(CONF *conf, const char *section,
720 const char *cert, TS_RESP_CTX *ctx);
721int TS_CONF_set_certs(CONF *conf, const char *section, const char *certs,
722 TS_RESP_CTX *ctx);
723int TS_CONF_set_signer_key(CONF *conf, const char *section,
724 const char *key, const char *pass, TS_RESP_CTX *ctx);
725int TS_CONF_set_def_policy(CONF *conf, const char *section,
726 const char *policy, TS_RESP_CTX *ctx);
727int TS_CONF_set_policies(CONF *conf, const char *section, TS_RESP_CTX *ctx);
728int TS_CONF_set_digests(CONF *conf, const char *section, TS_RESP_CTX *ctx);
729int TS_CONF_set_accuracy(CONF *conf, const char *section, TS_RESP_CTX *ctx);
730int TS_CONF_set_clock_precision_digits(CONF *conf, const char *section,
731 TS_RESP_CTX *ctx);
732int TS_CONF_set_ordering(CONF *conf, const char *section, TS_RESP_CTX *ctx);
733int TS_CONF_set_tsa_name(CONF *conf, const char *section, TS_RESP_CTX *ctx);
734int TS_CONF_set_ess_cert_id_chain(CONF *conf, const char *section,
735 TS_RESP_CTX *ctx);
736
737/* -------------------------------------------------- */
738/* BEGIN ERROR CODES */
739/* The following lines are auto generated by the script mkerr.pl. Any changes
740 * made after this point may be overwritten when the script is next run.
741 */
742void ERR_load_TS_strings(void);
743
744/* Error codes for the TS functions. */
745
746/* Function codes. */
747#define TS_F_D2I_TS_RESP 147
748#define TS_F_DEF_SERIAL_CB 110
749#define TS_F_DEF_TIME_CB 111
750#define TS_F_ESS_ADD_SIGNING_CERT 112
751#define TS_F_ESS_CERT_ID_NEW_INIT 113
752#define TS_F_ESS_SIGNING_CERT_NEW_INIT 114
753#define TS_F_INT_TS_RESP_VERIFY_TOKEN 149
754#define TS_F_PKCS7_TO_TS_TST_INFO 148
755#define TS_F_TS_ACCURACY_SET_MICROS 115
756#define TS_F_TS_ACCURACY_SET_MILLIS 116
757#define TS_F_TS_ACCURACY_SET_SECONDS 117
758#define TS_F_TS_CHECK_IMPRINTS 100
759#define TS_F_TS_CHECK_NONCES 101
760#define TS_F_TS_CHECK_POLICY 102
761#define TS_F_TS_CHECK_SIGNING_CERTS 103
762#define TS_F_TS_CHECK_STATUS_INFO 104
763#define TS_F_TS_COMPUTE_IMPRINT 145
764#define TS_F_TS_CONF_SET_DEFAULT_ENGINE 146
765#define TS_F_TS_GET_STATUS_TEXT 105
766#define TS_F_TS_MSG_IMPRINT_SET_ALGO 118
767#define TS_F_TS_REQ_SET_MSG_IMPRINT 119
768#define TS_F_TS_REQ_SET_NONCE 120
769#define TS_F_TS_REQ_SET_POLICY_ID 121
770#define TS_F_TS_RESP_CREATE_RESPONSE 122
771#define TS_F_TS_RESP_CREATE_TST_INFO 123
772#define TS_F_TS_RESP_CTX_ADD_FAILURE_INFO 124
773#define TS_F_TS_RESP_CTX_ADD_MD 125
774#define TS_F_TS_RESP_CTX_ADD_POLICY 126
775#define TS_F_TS_RESP_CTX_NEW 127
776#define TS_F_TS_RESP_CTX_SET_ACCURACY 128
777#define TS_F_TS_RESP_CTX_SET_CERTS 129
778#define TS_F_TS_RESP_CTX_SET_DEF_POLICY 130
779#define TS_F_TS_RESP_CTX_SET_SIGNER_CERT 131
780#define TS_F_TS_RESP_CTX_SET_STATUS_INFO 132
781#define TS_F_TS_RESP_GET_POLICY 133
782#define TS_F_TS_RESP_SET_GENTIME_WITH_PRECISION 134
783#define TS_F_TS_RESP_SET_STATUS_INFO 135
784#define TS_F_TS_RESP_SET_TST_INFO 150
785#define TS_F_TS_RESP_SIGN 136
786#define TS_F_TS_RESP_VERIFY_SIGNATURE 106
787#define TS_F_TS_RESP_VERIFY_TOKEN 107
788#define TS_F_TS_TST_INFO_SET_ACCURACY 137
789#define TS_F_TS_TST_INFO_SET_MSG_IMPRINT 138
790#define TS_F_TS_TST_INFO_SET_NONCE 139
791#define TS_F_TS_TST_INFO_SET_POLICY_ID 140
792#define TS_F_TS_TST_INFO_SET_SERIAL 141
793#define TS_F_TS_TST_INFO_SET_TIME 142
794#define TS_F_TS_TST_INFO_SET_TSA 143
795#define TS_F_TS_VERIFY 108
796#define TS_F_TS_VERIFY_CERT 109
797#define TS_F_TS_VERIFY_CTX_NEW 144
798
799/* Reason codes. */
800#define TS_R_BAD_PKCS7_TYPE 132
801#define TS_R_BAD_TYPE 133
802#define TS_R_CERTIFICATE_VERIFY_ERROR 100
803#define TS_R_COULD_NOT_SET_ENGINE 127
804#define TS_R_COULD_NOT_SET_TIME 115
805#define TS_R_D2I_TS_RESP_INT_FAILED 128
806#define TS_R_DETACHED_CONTENT 134
807#define TS_R_ESS_ADD_SIGNING_CERT_ERROR 116
808#define TS_R_ESS_SIGNING_CERTIFICATE_ERROR 101
809#define TS_R_INVALID_NULL_POINTER 102
810#define TS_R_INVALID_SIGNER_CERTIFICATE_PURPOSE 117
811#define TS_R_MESSAGE_IMPRINT_MISMATCH 103
812#define TS_R_NONCE_MISMATCH 104
813#define TS_R_NONCE_NOT_RETURNED 105
814#define TS_R_NO_CONTENT 106
815#define TS_R_NO_TIME_STAMP_TOKEN 107
816#define TS_R_PKCS7_ADD_SIGNATURE_ERROR 118
817#define TS_R_PKCS7_ADD_SIGNED_ATTR_ERROR 119
818#define TS_R_PKCS7_TO_TS_TST_INFO_FAILED 129
819#define TS_R_POLICY_MISMATCH 108
820#define TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE 120
821#define TS_R_RESPONSE_SETUP_ERROR 121
822#define TS_R_SIGNATURE_FAILURE 109
823#define TS_R_THERE_MUST_BE_ONE_SIGNER 110
824#define TS_R_TIME_SYSCALL_ERROR 122
825#define TS_R_TOKEN_NOT_PRESENT 130
826#define TS_R_TOKEN_PRESENT 131
827#define TS_R_TSA_NAME_MISMATCH 111
828#define TS_R_TSA_UNTRUSTED 112
829#define TS_R_TST_INFO_SETUP_ERROR 123
830#define TS_R_TS_DATASIGN 124
831#define TS_R_UNACCEPTABLE_POLICY 125
832#define TS_R_UNSUPPORTED_MD_ALGORITHM 126
833#define TS_R_UNSUPPORTED_VERSION 113
834#define TS_R_WRONG_CONTENT_TYPE 114
835
836#ifdef __cplusplus
837}
838#endif
839#endif
diff --git a/src/lib/libcrypto/ts/ts_asn1.c b/src/lib/libcrypto/ts/ts_asn1.c
deleted file mode 100644
index 1386483247..0000000000
--- a/src/lib/libcrypto/ts/ts_asn1.c
+++ /dev/null
@@ -1,895 +0,0 @@
1/* $OpenBSD: ts_asn1.c,v 1.9 2015/07/24 15:25:44 jsing Exp $ */
2/* Written by Nils Larsch for the OpenSSL project 2004.
3 */
4/* ====================================================================
5 * Copyright (c) 2006 The OpenSSL Project. All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 *
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 *
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in
16 * the documentation and/or other materials provided with the
17 * distribution.
18 *
19 * 3. All advertising materials mentioning features or use of this
20 * software must display the following acknowledgment:
21 * "This product includes software developed by the OpenSSL Project
22 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
23 *
24 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
25 * endorse or promote products derived from this software without
26 * prior written permission. For written permission, please contact
27 * licensing@OpenSSL.org.
28 *
29 * 5. Products derived from this software may not be called "OpenSSL"
30 * nor may "OpenSSL" appear in their names without prior written
31 * permission of the OpenSSL Project.
32 *
33 * 6. Redistributions of any form whatsoever must retain the following
34 * acknowledgment:
35 * "This product includes software developed by the OpenSSL Project
36 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
37 *
38 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
39 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
40 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
41 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
42 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
43 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
44 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
45 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
46 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
47 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
48 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
49 * OF THE POSSIBILITY OF SUCH DAMAGE.
50 * ====================================================================
51 *
52 * This product includes cryptographic software written by Eric Young
53 * (eay@cryptsoft.com). This product includes software written by Tim
54 * Hudson (tjh@cryptsoft.com).
55 *
56 */
57
58#include <openssl/opensslconf.h>
59
60#include <openssl/ts.h>
61#include <openssl/err.h>
62#include <openssl/asn1t.h>
63
64static const ASN1_TEMPLATE TS_MSG_IMPRINT_seq_tt[] = {
65 {
66 .flags = 0,
67 .tag = 0,
68 .offset = offsetof(TS_MSG_IMPRINT, hash_algo),
69 .field_name = "hash_algo",
70 .item = &X509_ALGOR_it,
71 },
72 {
73 .flags = 0,
74 .tag = 0,
75 .offset = offsetof(TS_MSG_IMPRINT, hashed_msg),
76 .field_name = "hashed_msg",
77 .item = &ASN1_OCTET_STRING_it,
78 },
79};
80
81const ASN1_ITEM TS_MSG_IMPRINT_it = {
82 .itype = ASN1_ITYPE_SEQUENCE,
83 .utype = V_ASN1_SEQUENCE,
84 .templates = TS_MSG_IMPRINT_seq_tt,
85 .tcount = sizeof(TS_MSG_IMPRINT_seq_tt) / sizeof(ASN1_TEMPLATE),
86 .funcs = NULL,
87 .size = sizeof(TS_MSG_IMPRINT),
88 .sname = "TS_MSG_IMPRINT",
89};
90
91
92TS_MSG_IMPRINT *
93d2i_TS_MSG_IMPRINT(TS_MSG_IMPRINT **a, const unsigned char **in, long len)
94{
95 return (TS_MSG_IMPRINT *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
96 &TS_MSG_IMPRINT_it);
97}
98
99int
100i2d_TS_MSG_IMPRINT(const TS_MSG_IMPRINT *a, unsigned char **out)
101{
102 return ASN1_item_i2d((ASN1_VALUE *)a, out, &TS_MSG_IMPRINT_it);
103}
104
105TS_MSG_IMPRINT *
106TS_MSG_IMPRINT_new(void)
107{
108 return (TS_MSG_IMPRINT *)ASN1_item_new(&TS_MSG_IMPRINT_it);
109}
110
111void
112TS_MSG_IMPRINT_free(TS_MSG_IMPRINT *a)
113{
114 ASN1_item_free((ASN1_VALUE *)a, &TS_MSG_IMPRINT_it);
115}
116
117TS_MSG_IMPRINT *
118TS_MSG_IMPRINT_dup(TS_MSG_IMPRINT *x)
119{
120 return ASN1_item_dup(&TS_MSG_IMPRINT_it, x);
121}
122
123#ifndef OPENSSL_NO_BIO
124TS_MSG_IMPRINT *
125d2i_TS_MSG_IMPRINT_bio(BIO *bp, TS_MSG_IMPRINT **a)
126{
127 return ASN1_d2i_bio_of(TS_MSG_IMPRINT, TS_MSG_IMPRINT_new,
128 d2i_TS_MSG_IMPRINT, bp, a);
129}
130
131int
132i2d_TS_MSG_IMPRINT_bio(BIO *bp, TS_MSG_IMPRINT *a)
133{
134 return ASN1_i2d_bio_of_const(TS_MSG_IMPRINT, i2d_TS_MSG_IMPRINT, bp, a);
135}
136#endif
137
138TS_MSG_IMPRINT *
139d2i_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT **a)
140{
141 return ASN1_d2i_fp_of(TS_MSG_IMPRINT, TS_MSG_IMPRINT_new,
142 d2i_TS_MSG_IMPRINT, fp, a);
143}
144
145int
146i2d_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT *a)
147{
148 return ASN1_i2d_fp_of_const(TS_MSG_IMPRINT, i2d_TS_MSG_IMPRINT, fp, a);
149}
150
151static const ASN1_TEMPLATE TS_REQ_seq_tt[] = {
152 {
153 .flags = 0,
154 .tag = 0,
155 .offset = offsetof(TS_REQ, version),
156 .field_name = "version",
157 .item = &ASN1_INTEGER_it,
158 },
159 {
160 .flags = 0,
161 .tag = 0,
162 .offset = offsetof(TS_REQ, msg_imprint),
163 .field_name = "msg_imprint",
164 .item = &TS_MSG_IMPRINT_it,
165 },
166 {
167 .flags = ASN1_TFLG_OPTIONAL,
168 .tag = 0,
169 .offset = offsetof(TS_REQ, policy_id),
170 .field_name = "policy_id",
171 .item = &ASN1_OBJECT_it,
172 },
173 {
174 .flags = ASN1_TFLG_OPTIONAL,
175 .tag = 0,
176 .offset = offsetof(TS_REQ, nonce),
177 .field_name = "nonce",
178 .item = &ASN1_INTEGER_it,
179 },
180 {
181 .flags = ASN1_TFLG_OPTIONAL,
182 .tag = 0,
183 .offset = offsetof(TS_REQ, cert_req),
184 .field_name = "cert_req",
185 .item = &ASN1_FBOOLEAN_it,
186 },
187 {
188 .flags = ASN1_TFLG_IMPLICIT | ASN1_TFLG_SEQUENCE_OF | ASN1_TFLG_OPTIONAL,
189 .tag = 0,
190 .offset = offsetof(TS_REQ, extensions),
191 .field_name = "extensions",
192 .item = &X509_EXTENSION_it,
193 },
194};
195
196const ASN1_ITEM TS_REQ_it = {
197 .itype = ASN1_ITYPE_SEQUENCE,
198 .utype = V_ASN1_SEQUENCE,
199 .templates = TS_REQ_seq_tt,
200 .tcount = sizeof(TS_REQ_seq_tt) / sizeof(ASN1_TEMPLATE),
201 .funcs = NULL,
202 .size = sizeof(TS_REQ),
203 .sname = "TS_REQ",
204};
205
206
207TS_REQ *
208d2i_TS_REQ(TS_REQ **a, const unsigned char **in, long len)
209{
210 return (TS_REQ *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
211 &TS_REQ_it);
212}
213
214int
215i2d_TS_REQ(const TS_REQ *a, unsigned char **out)
216{
217 return ASN1_item_i2d((ASN1_VALUE *)a, out, &TS_REQ_it);
218}
219
220TS_REQ *
221TS_REQ_new(void)
222{
223 return (TS_REQ *)ASN1_item_new(&TS_REQ_it);
224}
225
226void
227TS_REQ_free(TS_REQ *a)
228{
229 ASN1_item_free((ASN1_VALUE *)a, &TS_REQ_it);
230}
231
232TS_REQ *
233TS_REQ_dup(TS_REQ *x)
234{
235 return ASN1_item_dup(&TS_REQ_it, x);
236}
237
238#ifndef OPENSSL_NO_BIO
239TS_REQ *
240d2i_TS_REQ_bio(BIO *bp, TS_REQ **a)
241{
242 return ASN1_d2i_bio_of(TS_REQ, TS_REQ_new, d2i_TS_REQ, bp, a);
243}
244
245int
246i2d_TS_REQ_bio(BIO *bp, TS_REQ *a)
247{
248 return ASN1_i2d_bio_of_const(TS_REQ, i2d_TS_REQ, bp, a);
249}
250#endif
251
252TS_REQ *
253d2i_TS_REQ_fp(FILE *fp, TS_REQ **a)
254{
255 return ASN1_d2i_fp_of(TS_REQ, TS_REQ_new, d2i_TS_REQ, fp, a);
256}
257
258int
259i2d_TS_REQ_fp(FILE *fp, TS_REQ *a)
260{
261 return ASN1_i2d_fp_of_const(TS_REQ, i2d_TS_REQ, fp, a);
262}
263
264static const ASN1_TEMPLATE TS_ACCURACY_seq_tt[] = {
265 {
266 .flags = ASN1_TFLG_OPTIONAL,
267 .tag = 0,
268 .offset = offsetof(TS_ACCURACY, seconds),
269 .field_name = "seconds",
270 .item = &ASN1_INTEGER_it,
271 },
272 {
273 .flags = ASN1_TFLG_IMPLICIT | ASN1_TFLG_OPTIONAL,
274 .tag = 0,
275 .offset = offsetof(TS_ACCURACY, millis),
276 .field_name = "millis",
277 .item = &ASN1_INTEGER_it,
278 },
279 {
280 .flags = ASN1_TFLG_IMPLICIT | ASN1_TFLG_OPTIONAL,
281 .tag = 1,
282 .offset = offsetof(TS_ACCURACY, micros),
283 .field_name = "micros",
284 .item = &ASN1_INTEGER_it,
285 },
286};
287
288const ASN1_ITEM TS_ACCURACY_it = {
289 .itype = ASN1_ITYPE_SEQUENCE,
290 .utype = V_ASN1_SEQUENCE,
291 .templates = TS_ACCURACY_seq_tt,
292 .tcount = sizeof(TS_ACCURACY_seq_tt) / sizeof(ASN1_TEMPLATE),
293 .funcs = NULL,
294 .size = sizeof(TS_ACCURACY),
295 .sname = "TS_ACCURACY",
296};
297
298
299TS_ACCURACY *
300d2i_TS_ACCURACY(TS_ACCURACY **a, const unsigned char **in, long len)
301{
302 return (TS_ACCURACY *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
303 &TS_ACCURACY_it);
304}
305
306int
307i2d_TS_ACCURACY(const TS_ACCURACY *a, unsigned char **out)
308{
309 return ASN1_item_i2d((ASN1_VALUE *)a, out, &TS_ACCURACY_it);
310}
311
312TS_ACCURACY *
313TS_ACCURACY_new(void)
314{
315 return (TS_ACCURACY *)ASN1_item_new(&TS_ACCURACY_it);
316}
317
318void
319TS_ACCURACY_free(TS_ACCURACY *a)
320{
321 ASN1_item_free((ASN1_VALUE *)a, &TS_ACCURACY_it);
322}
323
324TS_ACCURACY *
325TS_ACCURACY_dup(TS_ACCURACY *x)
326{
327 return ASN1_item_dup(&TS_ACCURACY_it, x);
328}
329
330static const ASN1_TEMPLATE TS_TST_INFO_seq_tt[] = {
331 {
332 .flags = 0,
333 .tag = 0,
334 .offset = offsetof(TS_TST_INFO, version),
335 .field_name = "version",
336 .item = &ASN1_INTEGER_it,
337 },
338 {
339 .flags = 0,
340 .tag = 0,
341 .offset = offsetof(TS_TST_INFO, policy_id),
342 .field_name = "policy_id",
343 .item = &ASN1_OBJECT_it,
344 },
345 {
346 .flags = 0,
347 .tag = 0,
348 .offset = offsetof(TS_TST_INFO, msg_imprint),
349 .field_name = "msg_imprint",
350 .item = &TS_MSG_IMPRINT_it,
351 },
352 {
353 .flags = 0,
354 .tag = 0,
355 .offset = offsetof(TS_TST_INFO, serial),
356 .field_name = "serial",
357 .item = &ASN1_INTEGER_it,
358 },
359 {
360 .flags = 0,
361 .tag = 0,
362 .offset = offsetof(TS_TST_INFO, time),
363 .field_name = "time",
364 .item = &ASN1_GENERALIZEDTIME_it,
365 },
366 {
367 .flags = ASN1_TFLG_OPTIONAL,
368 .tag = 0,
369 .offset = offsetof(TS_TST_INFO, accuracy),
370 .field_name = "accuracy",
371 .item = &TS_ACCURACY_it,
372 },
373 {
374 .flags = ASN1_TFLG_OPTIONAL,
375 .tag = 0,
376 .offset = offsetof(TS_TST_INFO, ordering),
377 .field_name = "ordering",
378 .item = &ASN1_FBOOLEAN_it,
379 },
380 {
381 .flags = ASN1_TFLG_OPTIONAL,
382 .tag = 0,
383 .offset = offsetof(TS_TST_INFO, nonce),
384 .field_name = "nonce",
385 .item = &ASN1_INTEGER_it,
386 },
387 {
388 .flags = ASN1_TFLG_EXPLICIT | ASN1_TFLG_OPTIONAL,
389 .tag = 0,
390 .offset = offsetof(TS_TST_INFO, tsa),
391 .field_name = "tsa",
392 .item = &GENERAL_NAME_it,
393 },
394 {
395 .flags = ASN1_TFLG_IMPLICIT | ASN1_TFLG_SEQUENCE_OF | ASN1_TFLG_OPTIONAL,
396 .tag = 1,
397 .offset = offsetof(TS_TST_INFO, extensions),
398 .field_name = "extensions",
399 .item = &X509_EXTENSION_it,
400 },
401};
402
403const ASN1_ITEM TS_TST_INFO_it = {
404 .itype = ASN1_ITYPE_SEQUENCE,
405 .utype = V_ASN1_SEQUENCE,
406 .templates = TS_TST_INFO_seq_tt,
407 .tcount = sizeof(TS_TST_INFO_seq_tt) / sizeof(ASN1_TEMPLATE),
408 .funcs = NULL,
409 .size = sizeof(TS_TST_INFO),
410 .sname = "TS_TST_INFO",
411};
412
413
414TS_TST_INFO *
415d2i_TS_TST_INFO(TS_TST_INFO **a, const unsigned char **in, long len)
416{
417 return (TS_TST_INFO *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
418 &TS_TST_INFO_it);
419}
420
421int
422i2d_TS_TST_INFO(const TS_TST_INFO *a, unsigned char **out)
423{
424 return ASN1_item_i2d((ASN1_VALUE *)a, out, &TS_TST_INFO_it);
425}
426
427TS_TST_INFO *
428TS_TST_INFO_new(void)
429{
430 return (TS_TST_INFO *)ASN1_item_new(&TS_TST_INFO_it);
431}
432
433void
434TS_TST_INFO_free(TS_TST_INFO *a)
435{
436 ASN1_item_free((ASN1_VALUE *)a, &TS_TST_INFO_it);
437}
438
439TS_TST_INFO *
440TS_TST_INFO_dup(TS_TST_INFO *x)
441{
442 return ASN1_item_dup(&TS_TST_INFO_it, x);
443}
444
445#ifndef OPENSSL_NO_BIO
446TS_TST_INFO *
447d2i_TS_TST_INFO_bio(BIO *bp, TS_TST_INFO **a)
448{
449 return ASN1_d2i_bio_of(TS_TST_INFO, TS_TST_INFO_new, d2i_TS_TST_INFO,
450 bp, a);
451}
452
453int
454i2d_TS_TST_INFO_bio(BIO *bp, TS_TST_INFO *a)
455{
456 return ASN1_i2d_bio_of_const(TS_TST_INFO, i2d_TS_TST_INFO, bp, a);
457}
458#endif
459
460TS_TST_INFO *
461d2i_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO **a)
462{
463 return ASN1_d2i_fp_of(TS_TST_INFO, TS_TST_INFO_new, d2i_TS_TST_INFO,
464 fp, a);
465}
466
467int
468i2d_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO *a)
469{
470 return ASN1_i2d_fp_of_const(TS_TST_INFO, i2d_TS_TST_INFO, fp, a);
471}
472
473static const ASN1_TEMPLATE TS_STATUS_INFO_seq_tt[] = {
474 {
475 .flags = 0,
476 .tag = 0,
477 .offset = offsetof(TS_STATUS_INFO, status),
478 .field_name = "status",
479 .item = &ASN1_INTEGER_it,
480 },
481 {
482 .flags = ASN1_TFLG_SEQUENCE_OF | ASN1_TFLG_OPTIONAL,
483 .tag = 0,
484 .offset = offsetof(TS_STATUS_INFO, text),
485 .field_name = "text",
486 .item = &ASN1_UTF8STRING_it,
487 },
488 {
489 .flags = ASN1_TFLG_OPTIONAL,
490 .tag = 0,
491 .offset = offsetof(TS_STATUS_INFO, failure_info),
492 .field_name = "failure_info",
493 .item = &ASN1_BIT_STRING_it,
494 },
495};
496
497const ASN1_ITEM TS_STATUS_INFO_it = {
498 .itype = ASN1_ITYPE_SEQUENCE,
499 .utype = V_ASN1_SEQUENCE,
500 .templates = TS_STATUS_INFO_seq_tt,
501 .tcount = sizeof(TS_STATUS_INFO_seq_tt) / sizeof(ASN1_TEMPLATE),
502 .funcs = NULL,
503 .size = sizeof(TS_STATUS_INFO),
504 .sname = "TS_STATUS_INFO",
505};
506
507
508TS_STATUS_INFO *
509d2i_TS_STATUS_INFO(TS_STATUS_INFO **a, const unsigned char **in, long len)
510{
511 return (TS_STATUS_INFO *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
512 &TS_STATUS_INFO_it);
513}
514
515int
516i2d_TS_STATUS_INFO(const TS_STATUS_INFO *a, unsigned char **out)
517{
518 return ASN1_item_i2d((ASN1_VALUE *)a, out, &TS_STATUS_INFO_it);
519}
520
521TS_STATUS_INFO *
522TS_STATUS_INFO_new(void)
523{
524 return (TS_STATUS_INFO *)ASN1_item_new(&TS_STATUS_INFO_it);
525}
526
527void
528TS_STATUS_INFO_free(TS_STATUS_INFO *a)
529{
530 ASN1_item_free((ASN1_VALUE *)a, &TS_STATUS_INFO_it);
531}
532
533TS_STATUS_INFO *
534TS_STATUS_INFO_dup(TS_STATUS_INFO *x)
535{
536 return ASN1_item_dup(&TS_STATUS_INFO_it, x);
537}
538
539static int
540ts_resp_set_tst_info(TS_RESP *a)
541{
542 long status;
543
544 status = ASN1_INTEGER_get(a->status_info->status);
545
546 if (a->token) {
547 if (status != 0 && status != 1) {
548 TSerr(TS_F_TS_RESP_SET_TST_INFO, TS_R_TOKEN_PRESENT);
549 return 0;
550 }
551 if (a->tst_info != NULL)
552 TS_TST_INFO_free(a->tst_info);
553 a->tst_info = PKCS7_to_TS_TST_INFO(a->token);
554 if (!a->tst_info) {
555 TSerr(TS_F_TS_RESP_SET_TST_INFO,
556 TS_R_PKCS7_TO_TS_TST_INFO_FAILED);
557 return 0;
558 }
559 } else if (status == 0 || status == 1) {
560 TSerr(TS_F_TS_RESP_SET_TST_INFO, TS_R_TOKEN_NOT_PRESENT);
561 return 0;
562 }
563
564 return 1;
565}
566
567static int
568ts_resp_cb(int op, ASN1_VALUE **pval, const ASN1_ITEM *it, void *exarg)
569{
570 TS_RESP *ts_resp = (TS_RESP *)*pval;
571
572 if (op == ASN1_OP_NEW_POST) {
573 ts_resp->tst_info = NULL;
574 } else if (op == ASN1_OP_FREE_POST) {
575 if (ts_resp->tst_info != NULL)
576 TS_TST_INFO_free(ts_resp->tst_info);
577 } else if (op == ASN1_OP_D2I_POST) {
578 if (ts_resp_set_tst_info(ts_resp) == 0)
579 return 0;
580 }
581 return 1;
582}
583
584static const ASN1_AUX TS_RESP_aux = {
585 .app_data = NULL,
586 .flags = 0,
587 .ref_offset = 0,
588 .ref_lock = 0,
589 .asn1_cb = ts_resp_cb,
590 .enc_offset = 0,
591};
592static const ASN1_TEMPLATE TS_RESP_seq_tt[] = {
593 {
594 .flags = 0,
595 .tag = 0,
596 .offset = offsetof(TS_RESP, status_info),
597 .field_name = "status_info",
598 .item = &TS_STATUS_INFO_it,
599 },
600 {
601 .flags = ASN1_TFLG_OPTIONAL,
602 .tag = 0,
603 .offset = offsetof(TS_RESP, token),
604 .field_name = "token",
605 .item = &PKCS7_it,
606 },
607};
608
609const ASN1_ITEM TS_RESP_it = {
610 .itype = ASN1_ITYPE_SEQUENCE,
611 .utype = V_ASN1_SEQUENCE,
612 .templates = TS_RESP_seq_tt,
613 .tcount = sizeof(TS_RESP_seq_tt) / sizeof(ASN1_TEMPLATE),
614 .funcs = &TS_RESP_aux,
615 .size = sizeof(TS_RESP),
616 .sname = "TS_RESP",
617};
618
619
620TS_RESP *
621d2i_TS_RESP(TS_RESP **a, const unsigned char **in, long len)
622{
623 return (TS_RESP *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
624 &TS_RESP_it);
625}
626
627int
628i2d_TS_RESP(const TS_RESP *a, unsigned char **out)
629{
630 return ASN1_item_i2d((ASN1_VALUE *)a, out, &TS_RESP_it);
631}
632
633TS_RESP *
634TS_RESP_new(void)
635{
636 return (TS_RESP *)ASN1_item_new(&TS_RESP_it);
637}
638
639void
640TS_RESP_free(TS_RESP *a)
641{
642 ASN1_item_free((ASN1_VALUE *)a, &TS_RESP_it);
643}
644
645TS_RESP *
646TS_RESP_dup(TS_RESP *x)
647{
648 return ASN1_item_dup(&TS_RESP_it, x);
649}
650
651#ifndef OPENSSL_NO_BIO
652TS_RESP *
653d2i_TS_RESP_bio(BIO *bp, TS_RESP **a)
654{
655 return ASN1_d2i_bio_of(TS_RESP, TS_RESP_new, d2i_TS_RESP, bp, a);
656}
657
658int
659i2d_TS_RESP_bio(BIO *bp, TS_RESP *a)
660{
661 return ASN1_i2d_bio_of_const(TS_RESP, i2d_TS_RESP, bp, a);
662}
663#endif
664
665TS_RESP *
666d2i_TS_RESP_fp(FILE *fp, TS_RESP **a)
667{
668 return ASN1_d2i_fp_of(TS_RESP, TS_RESP_new, d2i_TS_RESP, fp, a);
669}
670
671int
672i2d_TS_RESP_fp(FILE *fp, TS_RESP *a)
673{
674 return ASN1_i2d_fp_of_const(TS_RESP, i2d_TS_RESP, fp, a);
675}
676
677static const ASN1_TEMPLATE ESS_ISSUER_SERIAL_seq_tt[] = {
678 {
679 .flags = ASN1_TFLG_SEQUENCE_OF,
680 .tag = 0,
681 .offset = offsetof(ESS_ISSUER_SERIAL, issuer),
682 .field_name = "issuer",
683 .item = &GENERAL_NAME_it,
684 },
685 {
686 .flags = 0,
687 .tag = 0,
688 .offset = offsetof(ESS_ISSUER_SERIAL, serial),
689 .field_name = "serial",
690 .item = &ASN1_INTEGER_it,
691 },
692};
693
694const ASN1_ITEM ESS_ISSUER_SERIAL_it = {
695 .itype = ASN1_ITYPE_SEQUENCE,
696 .utype = V_ASN1_SEQUENCE,
697 .templates = ESS_ISSUER_SERIAL_seq_tt,
698 .tcount = sizeof(ESS_ISSUER_SERIAL_seq_tt) / sizeof(ASN1_TEMPLATE),
699 .funcs = NULL,
700 .size = sizeof(ESS_ISSUER_SERIAL),
701 .sname = "ESS_ISSUER_SERIAL",
702};
703
704
705ESS_ISSUER_SERIAL *
706d2i_ESS_ISSUER_SERIAL(ESS_ISSUER_SERIAL **a, const unsigned char **in, long len)
707{
708 return (ESS_ISSUER_SERIAL *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
709 &ESS_ISSUER_SERIAL_it);
710}
711
712int
713i2d_ESS_ISSUER_SERIAL(const ESS_ISSUER_SERIAL *a, unsigned char **out)
714{
715 return ASN1_item_i2d((ASN1_VALUE *)a, out, &ESS_ISSUER_SERIAL_it);
716}
717
718ESS_ISSUER_SERIAL *
719ESS_ISSUER_SERIAL_new(void)
720{
721 return (ESS_ISSUER_SERIAL *)ASN1_item_new(&ESS_ISSUER_SERIAL_it);
722}
723
724void
725ESS_ISSUER_SERIAL_free(ESS_ISSUER_SERIAL *a)
726{
727 ASN1_item_free((ASN1_VALUE *)a, &ESS_ISSUER_SERIAL_it);
728}
729
730ESS_ISSUER_SERIAL *
731ESS_ISSUER_SERIAL_dup(ESS_ISSUER_SERIAL *x)
732{
733 return ASN1_item_dup(&ESS_ISSUER_SERIAL_it, x);
734}
735
736static const ASN1_TEMPLATE ESS_CERT_ID_seq_tt[] = {
737 {
738 .flags = 0,
739 .tag = 0,
740 .offset = offsetof(ESS_CERT_ID, hash),
741 .field_name = "hash",
742 .item = &ASN1_OCTET_STRING_it,
743 },
744 {
745 .flags = ASN1_TFLG_OPTIONAL,
746 .tag = 0,
747 .offset = offsetof(ESS_CERT_ID, issuer_serial),
748 .field_name = "issuer_serial",
749 .item = &ESS_ISSUER_SERIAL_it,
750 },
751};
752
753const ASN1_ITEM ESS_CERT_ID_it = {
754 .itype = ASN1_ITYPE_SEQUENCE,
755 .utype = V_ASN1_SEQUENCE,
756 .templates = ESS_CERT_ID_seq_tt,
757 .tcount = sizeof(ESS_CERT_ID_seq_tt) / sizeof(ASN1_TEMPLATE),
758 .funcs = NULL,
759 .size = sizeof(ESS_CERT_ID),
760 .sname = "ESS_CERT_ID",
761};
762
763
764ESS_CERT_ID *
765d2i_ESS_CERT_ID(ESS_CERT_ID **a, const unsigned char **in, long len)
766{
767 return (ESS_CERT_ID *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
768 &ESS_CERT_ID_it);
769}
770
771int
772i2d_ESS_CERT_ID(const ESS_CERT_ID *a, unsigned char **out)
773{
774 return ASN1_item_i2d((ASN1_VALUE *)a, out, &ESS_CERT_ID_it);
775}
776
777ESS_CERT_ID *
778ESS_CERT_ID_new(void)
779{
780 return (ESS_CERT_ID *)ASN1_item_new(&ESS_CERT_ID_it);
781}
782
783void
784ESS_CERT_ID_free(ESS_CERT_ID *a)
785{
786 ASN1_item_free((ASN1_VALUE *)a, &ESS_CERT_ID_it);
787}
788
789ESS_CERT_ID *
790ESS_CERT_ID_dup(ESS_CERT_ID *x)
791{
792 return ASN1_item_dup(&ESS_CERT_ID_it, x);
793}
794
795static const ASN1_TEMPLATE ESS_SIGNING_CERT_seq_tt[] = {
796 {
797 .flags = ASN1_TFLG_SEQUENCE_OF,
798 .tag = 0,
799 .offset = offsetof(ESS_SIGNING_CERT, cert_ids),
800 .field_name = "cert_ids",
801 .item = &ESS_CERT_ID_it,
802 },
803 {
804 .flags = ASN1_TFLG_SEQUENCE_OF | ASN1_TFLG_OPTIONAL,
805 .tag = 0,
806 .offset = offsetof(ESS_SIGNING_CERT, policy_info),
807 .field_name = "policy_info",
808 .item = &POLICYINFO_it,
809 },
810};
811
812const ASN1_ITEM ESS_SIGNING_CERT_it = {
813 .itype = ASN1_ITYPE_SEQUENCE,
814 .utype = V_ASN1_SEQUENCE,
815 .templates = ESS_SIGNING_CERT_seq_tt,
816 .tcount = sizeof(ESS_SIGNING_CERT_seq_tt) / sizeof(ASN1_TEMPLATE),
817 .funcs = NULL,
818 .size = sizeof(ESS_SIGNING_CERT),
819 .sname = "ESS_SIGNING_CERT",
820};
821
822
823ESS_SIGNING_CERT *
824d2i_ESS_SIGNING_CERT(ESS_SIGNING_CERT **a, const unsigned char **in, long len)
825{
826 return (ESS_SIGNING_CERT *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
827 &ESS_SIGNING_CERT_it);
828}
829
830int
831i2d_ESS_SIGNING_CERT(const ESS_SIGNING_CERT *a, unsigned char **out)
832{
833 return ASN1_item_i2d((ASN1_VALUE *)a, out, &ESS_SIGNING_CERT_it);
834}
835
836ESS_SIGNING_CERT *
837ESS_SIGNING_CERT_new(void)
838{
839 return (ESS_SIGNING_CERT *)ASN1_item_new(&ESS_SIGNING_CERT_it);
840}
841
842void
843ESS_SIGNING_CERT_free(ESS_SIGNING_CERT *a)
844{
845 ASN1_item_free((ASN1_VALUE *)a, &ESS_SIGNING_CERT_it);
846}
847
848ESS_SIGNING_CERT *
849ESS_SIGNING_CERT_dup(ESS_SIGNING_CERT *x)
850{
851 return ASN1_item_dup(&ESS_SIGNING_CERT_it, x);
852}
853
854/* Getting encapsulated TS_TST_INFO object from PKCS7. */
855TS_TST_INFO *
856PKCS7_to_TS_TST_INFO(PKCS7 *token)
857{
858 PKCS7_SIGNED *pkcs7_signed;
859 PKCS7 *enveloped;
860 ASN1_TYPE *tst_info_wrapper;
861 ASN1_OCTET_STRING *tst_info_der;
862 const unsigned char *p;
863
864 if (!PKCS7_type_is_signed(token)) {
865 TSerr(TS_F_PKCS7_TO_TS_TST_INFO, TS_R_BAD_PKCS7_TYPE);
866 return NULL;
867 }
868
869 /* Content must be present. */
870 if (PKCS7_get_detached(token)) {
871 TSerr(TS_F_PKCS7_TO_TS_TST_INFO, TS_R_DETACHED_CONTENT);
872 return NULL;
873 }
874
875 /* We have a signed data with content. */
876 pkcs7_signed = token->d.sign;
877 enveloped = pkcs7_signed->contents;
878 if (OBJ_obj2nid(enveloped->type) != NID_id_smime_ct_TSTInfo) {
879 TSerr(TS_F_PKCS7_TO_TS_TST_INFO, TS_R_BAD_PKCS7_TYPE);
880 return NULL;
881 }
882
883 /* We have a DER encoded TST_INFO as the signed data. */
884 tst_info_wrapper = enveloped->d.other;
885 if (tst_info_wrapper->type != V_ASN1_OCTET_STRING) {
886 TSerr(TS_F_PKCS7_TO_TS_TST_INFO, TS_R_BAD_TYPE);
887 return NULL;
888 }
889
890 /* We have the correct ASN1_OCTET_STRING type. */
891 tst_info_der = tst_info_wrapper->value.octet_string;
892 /* At last, decode the TST_INFO. */
893 p = tst_info_der->data;
894 return d2i_TS_TST_INFO(NULL, &p, tst_info_der->length);
895}
diff --git a/src/lib/libcrypto/ts/ts_conf.c b/src/lib/libcrypto/ts/ts_conf.c
deleted file mode 100644
index bb98a6ff4c..0000000000
--- a/src/lib/libcrypto/ts/ts_conf.c
+++ /dev/null
@@ -1,532 +0,0 @@
1/* $OpenBSD: ts_conf.c,v 1.9 2015/02/11 03:19:37 doug Exp $ */
2/* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL
3 * project 2002.
4 */
5/* ====================================================================
6 * Copyright (c) 2006 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <string.h>
60
61#include <openssl/opensslconf.h>
62
63#include <openssl/crypto.h>
64#include <openssl/err.h>
65#include <openssl/pem.h>
66#include <openssl/ts.h>
67
68#ifndef OPENSSL_NO_ENGINE
69#include <openssl/engine.h>
70#endif
71
72/* Macro definitions for the configuration file. */
73
74#define BASE_SECTION "tsa"
75#define ENV_DEFAULT_TSA "default_tsa"
76#define ENV_SERIAL "serial"
77#define ENV_CRYPTO_DEVICE "crypto_device"
78#define ENV_SIGNER_CERT "signer_cert"
79#define ENV_CERTS "certs"
80#define ENV_SIGNER_KEY "signer_key"
81#define ENV_DEFAULT_POLICY "default_policy"
82#define ENV_OTHER_POLICIES "other_policies"
83#define ENV_DIGESTS "digests"
84#define ENV_ACCURACY "accuracy"
85#define ENV_ORDERING "ordering"
86#define ENV_TSA_NAME "tsa_name"
87#define ENV_ESS_CERT_ID_CHAIN "ess_cert_id_chain"
88#define ENV_VALUE_SECS "secs"
89#define ENV_VALUE_MILLISECS "millisecs"
90#define ENV_VALUE_MICROSECS "microsecs"
91#define ENV_CLOCK_PRECISION_DIGITS "clock_precision_digits"
92#define ENV_VALUE_YES "yes"
93#define ENV_VALUE_NO "no"
94
95/* Function definitions for certificate and key loading. */
96
97X509 *
98TS_CONF_load_cert(const char *file)
99{
100 BIO *cert = NULL;
101 X509 *x = NULL;
102
103 if ((cert = BIO_new_file(file, "r")) == NULL)
104 goto end;
105 x = PEM_read_bio_X509_AUX(cert, NULL, NULL, NULL);
106
107end:
108 if (x == NULL)
109 fprintf(stderr, "unable to load certificate: %s\n", file);
110 BIO_free(cert);
111 return x;
112}
113
114STACK_OF(X509) *
115TS_CONF_load_certs(const char *file)
116{
117 BIO *certs = NULL;
118 STACK_OF(X509) *othercerts = NULL;
119 STACK_OF(X509_INFO) *allcerts = NULL;
120 int i;
121
122 if (!(certs = BIO_new_file(file, "r")))
123 goto end;
124
125 if (!(othercerts = sk_X509_new_null()))
126 goto end;
127 allcerts = PEM_X509_INFO_read_bio(certs, NULL, NULL, NULL);
128 for (i = 0; i < sk_X509_INFO_num(allcerts); i++) {
129 X509_INFO *xi = sk_X509_INFO_value(allcerts, i);
130 if (xi->x509) {
131 if (sk_X509_push(othercerts, xi->x509) == 0) {
132 sk_X509_pop_free(othercerts, X509_free);
133 othercerts = NULL;
134 goto end;
135 }
136 xi->x509 = NULL;
137 }
138 }
139
140end:
141 if (othercerts == NULL)
142 fprintf(stderr, "unable to load certificates: %s\n", file);
143 sk_X509_INFO_pop_free(allcerts, X509_INFO_free);
144 BIO_free(certs);
145 return othercerts;
146}
147
148EVP_PKEY *
149TS_CONF_load_key(const char *file, const char *pass)
150{
151 BIO *key = NULL;
152 EVP_PKEY *pkey = NULL;
153
154 if (!(key = BIO_new_file(file, "r")))
155 goto end;
156 pkey = PEM_read_bio_PrivateKey(key, NULL, NULL, (char *) pass);
157
158end:
159 if (pkey == NULL)
160 fprintf(stderr, "unable to load private key: %s\n", file);
161 BIO_free(key);
162 return pkey;
163}
164
165/* Function definitions for handling configuration options. */
166
167static void
168TS_CONF_lookup_fail(const char *name, const char *tag)
169{
170 fprintf(stderr, "variable lookup failed for %s::%s\n", name, tag);
171}
172
173static void
174TS_CONF_invalid(const char *name, const char *tag)
175{
176 fprintf(stderr, "invalid variable value for %s::%s\n", name, tag);
177}
178
179const char *
180TS_CONF_get_tsa_section(CONF *conf, const char *section)
181{
182 if (!section) {
183 section = NCONF_get_string(conf, BASE_SECTION, ENV_DEFAULT_TSA);
184 if (!section)
185 TS_CONF_lookup_fail(BASE_SECTION, ENV_DEFAULT_TSA);
186 }
187 return section;
188}
189
190int
191TS_CONF_set_serial(CONF *conf, const char *section, TS_serial_cb cb,
192 TS_RESP_CTX *ctx)
193{
194 int ret = 0;
195 char *serial = NCONF_get_string(conf, section, ENV_SERIAL);
196
197 if (!serial) {
198 TS_CONF_lookup_fail(section, ENV_SERIAL);
199 goto err;
200 }
201 TS_RESP_CTX_set_serial_cb(ctx, cb, serial);
202
203 ret = 1;
204
205err:
206 return ret;
207}
208
209#ifndef OPENSSL_NO_ENGINE
210
211int
212TS_CONF_set_crypto_device(CONF *conf, const char *section, const char *device)
213{
214 int ret = 0;
215
216 if (!device)
217 device = NCONF_get_string(conf, section, ENV_CRYPTO_DEVICE);
218
219 if (device && !TS_CONF_set_default_engine(device)) {
220 TS_CONF_invalid(section, ENV_CRYPTO_DEVICE);
221 goto err;
222 }
223 ret = 1;
224
225err:
226 return ret;
227}
228
229int
230TS_CONF_set_default_engine(const char *name)
231{
232 ENGINE *e = NULL;
233 int ret = 0;
234
235 /* Leave the default if builtin specified. */
236 if (strcmp(name, "builtin") == 0)
237 return 1;
238
239 if (!(e = ENGINE_by_id(name)))
240 goto err;
241 /* All the operations are going to be carried out by the engine. */
242 if (!ENGINE_set_default(e, ENGINE_METHOD_ALL))
243 goto err;
244 ret = 1;
245
246err:
247 if (!ret) {
248 TSerr(TS_F_TS_CONF_SET_DEFAULT_ENGINE,
249 TS_R_COULD_NOT_SET_ENGINE);
250 ERR_asprintf_error_data("engine:%s", name);
251 }
252 if (e)
253 ENGINE_free(e);
254 return ret;
255}
256
257#endif
258
259int
260TS_CONF_set_signer_cert(CONF *conf, const char *section, const char *cert,
261 TS_RESP_CTX *ctx)
262{
263 int ret = 0;
264 X509 *cert_obj = NULL;
265
266 if (!cert)
267 cert = NCONF_get_string(conf, section, ENV_SIGNER_CERT);
268 if (!cert) {
269 TS_CONF_lookup_fail(section, ENV_SIGNER_CERT);
270 goto err;
271 }
272 if (!(cert_obj = TS_CONF_load_cert(cert)))
273 goto err;
274 if (!TS_RESP_CTX_set_signer_cert(ctx, cert_obj))
275 goto err;
276
277 ret = 1;
278
279err:
280 X509_free(cert_obj);
281 return ret;
282}
283
284int
285TS_CONF_set_certs(CONF *conf, const char *section, const char *certs,
286 TS_RESP_CTX *ctx)
287{
288 int ret = 0;
289 STACK_OF(X509) *certs_obj = NULL;
290
291 if (!certs)
292 certs = NCONF_get_string(conf, section, ENV_CERTS);
293 /* Certificate chain is optional. */
294 if (!certs)
295 goto end;
296 if (!(certs_obj = TS_CONF_load_certs(certs)))
297 goto err;
298 if (!TS_RESP_CTX_set_certs(ctx, certs_obj))
299 goto err;
300
301end:
302 ret = 1;
303err:
304 sk_X509_pop_free(certs_obj, X509_free);
305 return ret;
306}
307
308int
309TS_CONF_set_signer_key(CONF *conf, const char *section, const char *key,
310 const char *pass, TS_RESP_CTX *ctx)
311{
312 int ret = 0;
313 EVP_PKEY *key_obj = NULL;
314
315 if (!key)
316 key = NCONF_get_string(conf, section, ENV_SIGNER_KEY);
317 if (!key) {
318 TS_CONF_lookup_fail(section, ENV_SIGNER_KEY);
319 goto err;
320 }
321 if (!(key_obj = TS_CONF_load_key(key, pass)))
322 goto err;
323 if (!TS_RESP_CTX_set_signer_key(ctx, key_obj))
324 goto err;
325
326 ret = 1;
327
328err:
329 EVP_PKEY_free(key_obj);
330 return ret;
331}
332
333int
334TS_CONF_set_def_policy(CONF *conf, const char *section, const char *policy,
335 TS_RESP_CTX *ctx)
336{
337 int ret = 0;
338 ASN1_OBJECT *policy_obj = NULL;
339
340 if (!policy)
341 policy = NCONF_get_string(conf, section, ENV_DEFAULT_POLICY);
342 if (!policy) {
343 TS_CONF_lookup_fail(section, ENV_DEFAULT_POLICY);
344 goto err;
345 }
346 if (!(policy_obj = OBJ_txt2obj(policy, 0))) {
347 TS_CONF_invalid(section, ENV_DEFAULT_POLICY);
348 goto err;
349 }
350 if (!TS_RESP_CTX_set_def_policy(ctx, policy_obj))
351 goto err;
352
353 ret = 1;
354
355err:
356 ASN1_OBJECT_free(policy_obj);
357 return ret;
358}
359
360int
361TS_CONF_set_policies(CONF *conf, const char *section, TS_RESP_CTX *ctx)
362{
363 int ret = 0;
364 int i;
365 STACK_OF(CONF_VALUE) *list = NULL;
366 char *policies = NCONF_get_string(conf, section, ENV_OTHER_POLICIES);
367
368 /* If no other policy is specified, that's fine. */
369 if (policies && !(list = X509V3_parse_list(policies))) {
370 TS_CONF_invalid(section, ENV_OTHER_POLICIES);
371 goto err;
372 }
373 for (i = 0; i < sk_CONF_VALUE_num(list); ++i) {
374 CONF_VALUE *val = sk_CONF_VALUE_value(list, i);
375 const char *extval = val->value ? val->value : val->name;
376 ASN1_OBJECT *objtmp;
377 if (!(objtmp = OBJ_txt2obj(extval, 0))) {
378 TS_CONF_invalid(section, ENV_OTHER_POLICIES);
379 goto err;
380 }
381 if (!TS_RESP_CTX_add_policy(ctx, objtmp))
382 goto err;
383 ASN1_OBJECT_free(objtmp);
384 }
385
386 ret = 1;
387
388err:
389 sk_CONF_VALUE_pop_free(list, X509V3_conf_free);
390 return ret;
391}
392
393int
394TS_CONF_set_digests(CONF *conf, const char *section, TS_RESP_CTX *ctx)
395{
396 int ret = 0;
397 int i;
398 STACK_OF(CONF_VALUE) *list = NULL;
399 char *digests = NCONF_get_string(conf, section, ENV_DIGESTS);
400
401 if (!digests) {
402 TS_CONF_lookup_fail(section, ENV_DIGESTS);
403 goto err;
404 }
405 if (!(list = X509V3_parse_list(digests))) {
406 TS_CONF_invalid(section, ENV_DIGESTS);
407 goto err;
408 }
409 if (sk_CONF_VALUE_num(list) == 0) {
410 TS_CONF_invalid(section, ENV_DIGESTS);
411 goto err;
412 }
413 for (i = 0; i < sk_CONF_VALUE_num(list); ++i) {
414 CONF_VALUE *val = sk_CONF_VALUE_value(list, i);
415 const char *extval = val->value ? val->value : val->name;
416 const EVP_MD *md;
417 if (!(md = EVP_get_digestbyname(extval))) {
418 TS_CONF_invalid(section, ENV_DIGESTS);
419 goto err;
420 }
421 if (!TS_RESP_CTX_add_md(ctx, md))
422 goto err;
423 }
424
425 ret = 1;
426
427err:
428 sk_CONF_VALUE_pop_free(list, X509V3_conf_free);
429 return ret;
430}
431
432int
433TS_CONF_set_accuracy(CONF *conf, const char *section, TS_RESP_CTX *ctx)
434{
435 int ret = 0;
436 int i;
437 int secs = 0, millis = 0, micros = 0;
438 STACK_OF(CONF_VALUE) *list = NULL;
439 char *accuracy = NCONF_get_string(conf, section, ENV_ACCURACY);
440
441 if (accuracy && !(list = X509V3_parse_list(accuracy))) {
442 TS_CONF_invalid(section, ENV_ACCURACY);
443 goto err;
444 }
445 for (i = 0; i < sk_CONF_VALUE_num(list); ++i) {
446 CONF_VALUE *val = sk_CONF_VALUE_value(list, i);
447 if (strcmp(val->name, ENV_VALUE_SECS) == 0) {
448 if (val->value)
449 secs = atoi(val->value);
450 } else if (strcmp(val->name, ENV_VALUE_MILLISECS) == 0) {
451 if (val->value)
452 millis = atoi(val->value);
453 } else if (strcmp(val->name, ENV_VALUE_MICROSECS) == 0) {
454 if (val->value)
455 micros = atoi(val->value);
456 } else {
457 TS_CONF_invalid(section, ENV_ACCURACY);
458 goto err;
459 }
460 }
461 if (!TS_RESP_CTX_set_accuracy(ctx, secs, millis, micros))
462 goto err;
463
464 ret = 1;
465
466err:
467 sk_CONF_VALUE_pop_free(list, X509V3_conf_free);
468 return ret;
469}
470
471int
472TS_CONF_set_clock_precision_digits(CONF *conf, const char *section,
473 TS_RESP_CTX *ctx)
474{
475 int ret = 0;
476 long digits = 0;
477
478 /* If not specified, set the default value to 0, i.e. sec precision */
479 if (!NCONF_get_number_e(conf, section, ENV_CLOCK_PRECISION_DIGITS,
480 &digits))
481 digits = 0;
482 if (digits < 0 || digits > TS_MAX_CLOCK_PRECISION_DIGITS) {
483 TS_CONF_invalid(section, ENV_CLOCK_PRECISION_DIGITS);
484 goto err;
485 }
486
487 if (!TS_RESP_CTX_set_clock_precision_digits(ctx, digits))
488 goto err;
489
490 return 1;
491
492err:
493 return ret;
494}
495
496static int
497TS_CONF_add_flag(CONF *conf, const char *section, const char *field, int flag,
498 TS_RESP_CTX *ctx)
499{
500 /* Default is false. */
501 const char *value = NCONF_get_string(conf, section, field);
502
503 if (value) {
504 if (strcmp(value, ENV_VALUE_YES) == 0)
505 TS_RESP_CTX_add_flags(ctx, flag);
506 else if (strcmp(value, ENV_VALUE_NO) != 0) {
507 TS_CONF_invalid(section, field);
508 return 0;
509 }
510 }
511
512 return 1;
513}
514
515int
516TS_CONF_set_ordering(CONF *conf, const char *section, TS_RESP_CTX *ctx)
517{
518 return TS_CONF_add_flag(conf, section, ENV_ORDERING, TS_ORDERING, ctx);
519}
520
521int
522TS_CONF_set_tsa_name(CONF *conf, const char *section, TS_RESP_CTX *ctx)
523{
524 return TS_CONF_add_flag(conf, section, ENV_TSA_NAME, TS_TSA_NAME, ctx);
525}
526
527int
528TS_CONF_set_ess_cert_id_chain(CONF *conf, const char *section, TS_RESP_CTX *ctx)
529{
530 return TS_CONF_add_flag(conf, section, ENV_ESS_CERT_ID_CHAIN,
531 TS_ESS_CERT_ID_CHAIN, ctx);
532}
diff --git a/src/lib/libcrypto/ts/ts_err.c b/src/lib/libcrypto/ts/ts_err.c
deleted file mode 100644
index f71be883f8..0000000000
--- a/src/lib/libcrypto/ts/ts_err.c
+++ /dev/null
@@ -1,179 +0,0 @@
1/* $OpenBSD: ts_err.c,v 1.4 2014/07/10 22:45:58 jsing Exp $ */
2/* ====================================================================
3 * Copyright (c) 1999-2007 The OpenSSL Project. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 *
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 *
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in
14 * the documentation and/or other materials provided with the
15 * distribution.
16 *
17 * 3. All advertising materials mentioning features or use of this
18 * software must display the following acknowledgment:
19 * "This product includes software developed by the OpenSSL Project
20 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
21 *
22 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
23 * endorse or promote products derived from this software without
24 * prior written permission. For written permission, please contact
25 * openssl-core@OpenSSL.org.
26 *
27 * 5. Products derived from this software may not be called "OpenSSL"
28 * nor may "OpenSSL" appear in their names without prior written
29 * permission of the OpenSSL Project.
30 *
31 * 6. Redistributions of any form whatsoever must retain the following
32 * acknowledgment:
33 * "This product includes software developed by the OpenSSL Project
34 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
35 *
36 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
37 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
38 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
39 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
40 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
41 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
42 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
43 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
44 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
45 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
46 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
47 * OF THE POSSIBILITY OF SUCH DAMAGE.
48 * ====================================================================
49 *
50 * This product includes cryptographic software written by Eric Young
51 * (eay@cryptsoft.com). This product includes software written by Tim
52 * Hudson (tjh@cryptsoft.com).
53 *
54 */
55
56/* NOTE: this file was auto generated by the mkerr.pl script: any changes
57 * made to it will be overwritten when the script next updates this file,
58 * only reason strings will be preserved.
59 */
60
61#include <stdio.h>
62
63#include <openssl/opensslconf.h>
64
65#include <openssl/err.h>
66#include <openssl/ts.h>
67
68/* BEGIN ERROR CODES */
69#ifndef OPENSSL_NO_ERR
70
71#define ERR_FUNC(func) ERR_PACK(ERR_LIB_TS,func,0)
72#define ERR_REASON(reason) ERR_PACK(ERR_LIB_TS,0,reason)
73
74static ERR_STRING_DATA TS_str_functs[] = {
75 {ERR_FUNC(TS_F_D2I_TS_RESP), "d2i_TS_RESP"},
76 {ERR_FUNC(TS_F_DEF_SERIAL_CB), "DEF_SERIAL_CB"},
77 {ERR_FUNC(TS_F_DEF_TIME_CB), "DEF_TIME_CB"},
78 {ERR_FUNC(TS_F_ESS_ADD_SIGNING_CERT), "ESS_ADD_SIGNING_CERT"},
79 {ERR_FUNC(TS_F_ESS_CERT_ID_NEW_INIT), "ESS_CERT_ID_NEW_INIT"},
80 {ERR_FUNC(TS_F_ESS_SIGNING_CERT_NEW_INIT), "ESS_SIGNING_CERT_NEW_INIT"},
81 {ERR_FUNC(TS_F_INT_TS_RESP_VERIFY_TOKEN), "INT_TS_RESP_VERIFY_TOKEN"},
82 {ERR_FUNC(TS_F_PKCS7_TO_TS_TST_INFO), "PKCS7_to_TS_TST_INFO"},
83 {ERR_FUNC(TS_F_TS_ACCURACY_SET_MICROS), "TS_ACCURACY_set_micros"},
84 {ERR_FUNC(TS_F_TS_ACCURACY_SET_MILLIS), "TS_ACCURACY_set_millis"},
85 {ERR_FUNC(TS_F_TS_ACCURACY_SET_SECONDS), "TS_ACCURACY_set_seconds"},
86 {ERR_FUNC(TS_F_TS_CHECK_IMPRINTS), "TS_CHECK_IMPRINTS"},
87 {ERR_FUNC(TS_F_TS_CHECK_NONCES), "TS_CHECK_NONCES"},
88 {ERR_FUNC(TS_F_TS_CHECK_POLICY), "TS_CHECK_POLICY"},
89 {ERR_FUNC(TS_F_TS_CHECK_SIGNING_CERTS), "TS_CHECK_SIGNING_CERTS"},
90 {ERR_FUNC(TS_F_TS_CHECK_STATUS_INFO), "TS_CHECK_STATUS_INFO"},
91 {ERR_FUNC(TS_F_TS_COMPUTE_IMPRINT), "TS_COMPUTE_IMPRINT"},
92 {ERR_FUNC(TS_F_TS_CONF_SET_DEFAULT_ENGINE), "TS_CONF_set_default_engine"},
93 {ERR_FUNC(TS_F_TS_GET_STATUS_TEXT), "TS_GET_STATUS_TEXT"},
94 {ERR_FUNC(TS_F_TS_MSG_IMPRINT_SET_ALGO), "TS_MSG_IMPRINT_set_algo"},
95 {ERR_FUNC(TS_F_TS_REQ_SET_MSG_IMPRINT), "TS_REQ_set_msg_imprint"},
96 {ERR_FUNC(TS_F_TS_REQ_SET_NONCE), "TS_REQ_set_nonce"},
97 {ERR_FUNC(TS_F_TS_REQ_SET_POLICY_ID), "TS_REQ_set_policy_id"},
98 {ERR_FUNC(TS_F_TS_RESP_CREATE_RESPONSE), "TS_RESP_create_response"},
99 {ERR_FUNC(TS_F_TS_RESP_CREATE_TST_INFO), "TS_RESP_CREATE_TST_INFO"},
100 {ERR_FUNC(TS_F_TS_RESP_CTX_ADD_FAILURE_INFO), "TS_RESP_CTX_add_failure_info"},
101 {ERR_FUNC(TS_F_TS_RESP_CTX_ADD_MD), "TS_RESP_CTX_add_md"},
102 {ERR_FUNC(TS_F_TS_RESP_CTX_ADD_POLICY), "TS_RESP_CTX_add_policy"},
103 {ERR_FUNC(TS_F_TS_RESP_CTX_NEW), "TS_RESP_CTX_new"},
104 {ERR_FUNC(TS_F_TS_RESP_CTX_SET_ACCURACY), "TS_RESP_CTX_set_accuracy"},
105 {ERR_FUNC(TS_F_TS_RESP_CTX_SET_CERTS), "TS_RESP_CTX_set_certs"},
106 {ERR_FUNC(TS_F_TS_RESP_CTX_SET_DEF_POLICY), "TS_RESP_CTX_set_def_policy"},
107 {ERR_FUNC(TS_F_TS_RESP_CTX_SET_SIGNER_CERT), "TS_RESP_CTX_set_signer_cert"},
108 {ERR_FUNC(TS_F_TS_RESP_CTX_SET_STATUS_INFO), "TS_RESP_CTX_set_status_info"},
109 {ERR_FUNC(TS_F_TS_RESP_GET_POLICY), "TS_RESP_GET_POLICY"},
110 {ERR_FUNC(TS_F_TS_RESP_SET_GENTIME_WITH_PRECISION), "TS_RESP_SET_GENTIME_WITH_PRECISION"},
111 {ERR_FUNC(TS_F_TS_RESP_SET_STATUS_INFO), "TS_RESP_set_status_info"},
112 {ERR_FUNC(TS_F_TS_RESP_SET_TST_INFO), "TS_RESP_set_tst_info"},
113 {ERR_FUNC(TS_F_TS_RESP_SIGN), "TS_RESP_SIGN"},
114 {ERR_FUNC(TS_F_TS_RESP_VERIFY_SIGNATURE), "TS_RESP_verify_signature"},
115 {ERR_FUNC(TS_F_TS_RESP_VERIFY_TOKEN), "TS_RESP_verify_token"},
116 {ERR_FUNC(TS_F_TS_TST_INFO_SET_ACCURACY), "TS_TST_INFO_set_accuracy"},
117 {ERR_FUNC(TS_F_TS_TST_INFO_SET_MSG_IMPRINT), "TS_TST_INFO_set_msg_imprint"},
118 {ERR_FUNC(TS_F_TS_TST_INFO_SET_NONCE), "TS_TST_INFO_set_nonce"},
119 {ERR_FUNC(TS_F_TS_TST_INFO_SET_POLICY_ID), "TS_TST_INFO_set_policy_id"},
120 {ERR_FUNC(TS_F_TS_TST_INFO_SET_SERIAL), "TS_TST_INFO_set_serial"},
121 {ERR_FUNC(TS_F_TS_TST_INFO_SET_TIME), "TS_TST_INFO_set_time"},
122 {ERR_FUNC(TS_F_TS_TST_INFO_SET_TSA), "TS_TST_INFO_set_tsa"},
123 {ERR_FUNC(TS_F_TS_VERIFY), "TS_VERIFY"},
124 {ERR_FUNC(TS_F_TS_VERIFY_CERT), "TS_VERIFY_CERT"},
125 {ERR_FUNC(TS_F_TS_VERIFY_CTX_NEW), "TS_VERIFY_CTX_new"},
126 {0, NULL}
127};
128
129static ERR_STRING_DATA TS_str_reasons[]= {
130 {ERR_REASON(TS_R_BAD_PKCS7_TYPE) , "bad pkcs7 type"},
131 {ERR_REASON(TS_R_BAD_TYPE) , "bad type"},
132 {ERR_REASON(TS_R_CERTIFICATE_VERIFY_ERROR), "certificate verify error"},
133 {ERR_REASON(TS_R_COULD_NOT_SET_ENGINE) , "could not set engine"},
134 {ERR_REASON(TS_R_COULD_NOT_SET_TIME) , "could not set time"},
135 {ERR_REASON(TS_R_D2I_TS_RESP_INT_FAILED) , "d2i ts resp int failed"},
136 {ERR_REASON(TS_R_DETACHED_CONTENT) , "detached content"},
137 {ERR_REASON(TS_R_ESS_ADD_SIGNING_CERT_ERROR), "ess add signing cert error"},
138 {ERR_REASON(TS_R_ESS_SIGNING_CERTIFICATE_ERROR), "ess signing certificate error"},
139 {ERR_REASON(TS_R_INVALID_NULL_POINTER) , "invalid null pointer"},
140 {ERR_REASON(TS_R_INVALID_SIGNER_CERTIFICATE_PURPOSE), "invalid signer certificate purpose"},
141 {ERR_REASON(TS_R_MESSAGE_IMPRINT_MISMATCH), "message imprint mismatch"},
142 {ERR_REASON(TS_R_NONCE_MISMATCH) , "nonce mismatch"},
143 {ERR_REASON(TS_R_NONCE_NOT_RETURNED) , "nonce not returned"},
144 {ERR_REASON(TS_R_NO_CONTENT) , "no content"},
145 {ERR_REASON(TS_R_NO_TIME_STAMP_TOKEN) , "no time stamp token"},
146 {ERR_REASON(TS_R_PKCS7_ADD_SIGNATURE_ERROR), "pkcs7 add signature error"},
147 {ERR_REASON(TS_R_PKCS7_ADD_SIGNED_ATTR_ERROR), "pkcs7 add signed attr error"},
148 {ERR_REASON(TS_R_PKCS7_TO_TS_TST_INFO_FAILED), "pkcs7 to ts tst info failed"},
149 {ERR_REASON(TS_R_POLICY_MISMATCH) , "policy mismatch"},
150 {ERR_REASON(TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE), "private key does not match certificate"},
151 {ERR_REASON(TS_R_RESPONSE_SETUP_ERROR) , "response setup error"},
152 {ERR_REASON(TS_R_SIGNATURE_FAILURE) , "signature failure"},
153 {ERR_REASON(TS_R_THERE_MUST_BE_ONE_SIGNER), "there must be one signer"},
154 {ERR_REASON(TS_R_TIME_SYSCALL_ERROR) , "time syscall error"},
155 {ERR_REASON(TS_R_TOKEN_NOT_PRESENT) , "token not present"},
156 {ERR_REASON(TS_R_TOKEN_PRESENT) , "token present"},
157 {ERR_REASON(TS_R_TSA_NAME_MISMATCH) , "tsa name mismatch"},
158 {ERR_REASON(TS_R_TSA_UNTRUSTED) , "tsa untrusted"},
159 {ERR_REASON(TS_R_TST_INFO_SETUP_ERROR) , "tst info setup error"},
160 {ERR_REASON(TS_R_TS_DATASIGN) , "ts datasign"},
161 {ERR_REASON(TS_R_UNACCEPTABLE_POLICY) , "unacceptable policy"},
162 {ERR_REASON(TS_R_UNSUPPORTED_MD_ALGORITHM), "unsupported md algorithm"},
163 {ERR_REASON(TS_R_UNSUPPORTED_VERSION) , "unsupported version"},
164 {ERR_REASON(TS_R_WRONG_CONTENT_TYPE) , "wrong content type"},
165 {0, NULL}
166};
167
168#endif
169
170void
171ERR_load_TS_strings(void)
172{
173#ifndef OPENSSL_NO_ERR
174 if (ERR_func_error_string(TS_str_functs[0].error) == NULL) {
175 ERR_load_strings(0, TS_str_functs);
176 ERR_load_strings(0, TS_str_reasons);
177 }
178#endif
179}
diff --git a/src/lib/libcrypto/ts/ts_lib.c b/src/lib/libcrypto/ts/ts_lib.c
deleted file mode 100644
index 293564118f..0000000000
--- a/src/lib/libcrypto/ts/ts_lib.c
+++ /dev/null
@@ -1,150 +0,0 @@
1/* $OpenBSD: ts_lib.c,v 1.10 2015/09/10 14:29:22 jsing Exp $ */
2/* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL
3 * project 2002.
4 */
5/* ====================================================================
6 * Copyright (c) 2006 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <stdio.h>
60#include <string.h>
61
62#include <openssl/bn.h>
63#include <openssl/objects.h>
64#include <openssl/ts.h>
65#include <openssl/x509v3.h>
66
67/* Local function declarations. */
68
69/* Function definitions. */
70
71int
72TS_ASN1_INTEGER_print_bio(BIO *bio, const ASN1_INTEGER *num)
73{
74 BIGNUM num_bn;
75 int result = 0;
76 char *hex;
77
78 BN_init(&num_bn);
79 ASN1_INTEGER_to_BN(num, &num_bn);
80 if ((hex = BN_bn2hex(&num_bn))) {
81 result = BIO_write(bio, "0x", 2) > 0;
82 result = result && BIO_write(bio, hex, strlen(hex)) > 0;
83 free(hex);
84 }
85 BN_free(&num_bn);
86
87 return result;
88}
89
90int
91TS_OBJ_print_bio(BIO *bio, const ASN1_OBJECT *obj)
92{
93 char obj_txt[128];
94
95 int len = OBJ_obj2txt(obj_txt, sizeof(obj_txt), obj, 0);
96 if (len >= sizeof(obj_txt))
97 len = sizeof(obj_txt) - 1;
98 BIO_write(bio, obj_txt, len);
99 BIO_write(bio, "\n", 1);
100 return 1;
101}
102
103int
104TS_ext_print_bio(BIO *bio, const STACK_OF(X509_EXTENSION) *extensions)
105{
106 int i, critical, n;
107 X509_EXTENSION *ex;
108 ASN1_OBJECT *obj;
109
110 BIO_printf(bio, "Extensions:\n");
111 n = X509v3_get_ext_count(extensions);
112 for (i = 0; i < n; i++) {
113 ex = X509v3_get_ext(extensions, i);
114 obj = X509_EXTENSION_get_object(ex);
115 i2a_ASN1_OBJECT(bio, obj);
116 critical = X509_EXTENSION_get_critical(ex);
117 BIO_printf(bio, ": %s\n", critical ? "critical" : "");
118 if (!X509V3_EXT_print(bio, ex, 0, 4)) {
119 BIO_printf(bio, "%4s", "");
120 ASN1_STRING_print(bio, ex->value);
121 }
122 BIO_write(bio, "\n", 1);
123 }
124
125 return 1;
126}
127
128int
129TS_X509_ALGOR_print_bio(BIO *bio, const X509_ALGOR *alg)
130{
131 int i = OBJ_obj2nid(alg->algorithm);
132
133 return BIO_printf(bio, "Hash Algorithm: %s\n",
134 (i == NID_undef) ? "UNKNOWN" : OBJ_nid2ln(i));
135}
136
137int
138TS_MSG_IMPRINT_print_bio(BIO *bio, TS_MSG_IMPRINT *a)
139{
140 ASN1_OCTET_STRING *msg;
141
142 TS_X509_ALGOR_print_bio(bio, TS_MSG_IMPRINT_get_algo(a));
143
144 BIO_printf(bio, "Message data:\n");
145 msg = TS_MSG_IMPRINT_get_msg(a);
146 BIO_dump_indent(bio, (const char *)ASN1_STRING_data(msg),
147 ASN1_STRING_length(msg), 4);
148
149 return 1;
150}
diff --git a/src/lib/libcrypto/ts/ts_req_print.c b/src/lib/libcrypto/ts/ts_req_print.c
deleted file mode 100644
index 64a8133a58..0000000000
--- a/src/lib/libcrypto/ts/ts_req_print.c
+++ /dev/null
@@ -1,104 +0,0 @@
1/* $OpenBSD: ts_req_print.c,v 1.4 2014/07/11 08:44:49 jsing Exp $ */
2/* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL
3 * project 2002.
4 */
5/* ====================================================================
6 * Copyright (c) 2006 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <stdio.h>
60
61#include <openssl/bn.h>
62#include <openssl/objects.h>
63#include <openssl/ts.h>
64#include <openssl/x509v3.h>
65
66/* Function definitions. */
67
68int
69TS_REQ_print_bio(BIO *bio, TS_REQ *a)
70{
71 int v;
72 ASN1_OBJECT *policy_id;
73 const ASN1_INTEGER *nonce;
74
75 if (a == NULL)
76 return 0;
77
78 v = TS_REQ_get_version(a);
79 BIO_printf(bio, "Version: %d\n", v);
80
81 TS_MSG_IMPRINT_print_bio(bio, TS_REQ_get_msg_imprint(a));
82
83 BIO_printf(bio, "Policy OID: ");
84 policy_id = TS_REQ_get_policy_id(a);
85 if (policy_id == NULL)
86 BIO_printf(bio, "unspecified\n");
87 else
88 TS_OBJ_print_bio(bio, policy_id);
89
90 BIO_printf(bio, "Nonce: ");
91 nonce = TS_REQ_get_nonce(a);
92 if (nonce == NULL)
93 BIO_printf(bio, "unspecified");
94 else
95 TS_ASN1_INTEGER_print_bio(bio, nonce);
96 BIO_write(bio, "\n", 1);
97
98 BIO_printf(bio, "Certificate required: %s\n",
99 TS_REQ_get_cert_req(a) ? "yes" : "no");
100
101 TS_ext_print_bio(bio, TS_REQ_get_exts(a));
102
103 return 1;
104}
diff --git a/src/lib/libcrypto/ts/ts_req_utils.c b/src/lib/libcrypto/ts/ts_req_utils.c
deleted file mode 100644
index ab813b2b42..0000000000
--- a/src/lib/libcrypto/ts/ts_req_utils.c
+++ /dev/null
@@ -1,255 +0,0 @@
1/* $OpenBSD: ts_req_utils.c,v 1.4 2014/07/11 08:44:49 jsing Exp $ */
2/* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL
3 * project 2002.
4 */
5/* ====================================================================
6 * Copyright (c) 2006 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <stdio.h>
60
61#include <openssl/err.h>
62#include <openssl/objects.h>
63#include <openssl/ts.h>
64#include <openssl/x509v3.h>
65
66int
67TS_REQ_set_version(TS_REQ *a, long version)
68{
69 return ASN1_INTEGER_set(a->version, version);
70}
71
72long
73TS_REQ_get_version(const TS_REQ *a)
74{
75 return ASN1_INTEGER_get(a->version);
76}
77
78int
79TS_REQ_set_msg_imprint(TS_REQ *a, TS_MSG_IMPRINT *msg_imprint)
80{
81 TS_MSG_IMPRINT *new_msg_imprint;
82
83 if (a->msg_imprint == msg_imprint)
84 return 1;
85 new_msg_imprint = TS_MSG_IMPRINT_dup(msg_imprint);
86 if (new_msg_imprint == NULL) {
87 TSerr(TS_F_TS_REQ_SET_MSG_IMPRINT, ERR_R_MALLOC_FAILURE);
88 return 0;
89 }
90 TS_MSG_IMPRINT_free(a->msg_imprint);
91 a->msg_imprint = new_msg_imprint;
92 return 1;
93}
94
95TS_MSG_IMPRINT *
96TS_REQ_get_msg_imprint(TS_REQ *a)
97{
98 return a->msg_imprint;
99}
100
101int
102TS_MSG_IMPRINT_set_algo(TS_MSG_IMPRINT *a, X509_ALGOR *alg)
103{
104 X509_ALGOR *new_alg;
105
106 if (a->hash_algo == alg)
107 return 1;
108 new_alg = X509_ALGOR_dup(alg);
109 if (new_alg == NULL) {
110 TSerr(TS_F_TS_MSG_IMPRINT_SET_ALGO, ERR_R_MALLOC_FAILURE);
111 return 0;
112 }
113 X509_ALGOR_free(a->hash_algo);
114 a->hash_algo = new_alg;
115 return 1;
116}
117
118X509_ALGOR *
119TS_MSG_IMPRINT_get_algo(TS_MSG_IMPRINT *a)
120{
121 return a->hash_algo;
122}
123
124int
125TS_MSG_IMPRINT_set_msg(TS_MSG_IMPRINT *a, unsigned char *d, int len)
126{
127 return ASN1_OCTET_STRING_set(a->hashed_msg, d, len);
128}
129
130ASN1_OCTET_STRING *
131TS_MSG_IMPRINT_get_msg(TS_MSG_IMPRINT *a)
132{
133 return a->hashed_msg;
134}
135
136int
137TS_REQ_set_policy_id(TS_REQ *a, ASN1_OBJECT *policy)
138{
139 ASN1_OBJECT *new_policy;
140
141 if (a->policy_id == policy)
142 return 1;
143 new_policy = OBJ_dup(policy);
144 if (new_policy == NULL) {
145 TSerr(TS_F_TS_REQ_SET_POLICY_ID, ERR_R_MALLOC_FAILURE);
146 return 0;
147 }
148 ASN1_OBJECT_free(a->policy_id);
149 a->policy_id = new_policy;
150 return 1;
151}
152
153ASN1_OBJECT *
154TS_REQ_get_policy_id(TS_REQ *a)
155{
156 return a->policy_id;
157}
158
159int
160TS_REQ_set_nonce(TS_REQ *a, const ASN1_INTEGER *nonce)
161{
162 ASN1_INTEGER *new_nonce;
163
164 if (a->nonce == nonce)
165 return 1;
166 new_nonce = ASN1_INTEGER_dup(nonce);
167 if (new_nonce == NULL) {
168 TSerr(TS_F_TS_REQ_SET_NONCE, ERR_R_MALLOC_FAILURE);
169 return 0;
170 }
171 ASN1_INTEGER_free(a->nonce);
172 a->nonce = new_nonce;
173 return 1;
174}
175
176const ASN1_INTEGER *
177TS_REQ_get_nonce(const TS_REQ *a)
178{
179 return a->nonce;
180}
181
182int
183TS_REQ_set_cert_req(TS_REQ *a, int cert_req)
184{
185 a->cert_req = cert_req ? 0xFF : 0x00;
186 return 1;
187}
188
189int
190TS_REQ_get_cert_req(const TS_REQ *a)
191{
192 return a->cert_req ? 1 : 0;
193}
194
195STACK_OF(X509_EXTENSION) *TS_REQ_get_exts(TS_REQ *a)
196{
197 return a->extensions;
198}
199
200void
201TS_REQ_ext_free(TS_REQ *a)
202{
203 if (!a)
204 return;
205 sk_X509_EXTENSION_pop_free(a->extensions, X509_EXTENSION_free);
206 a->extensions = NULL;
207}
208
209int
210TS_REQ_get_ext_count(TS_REQ *a)
211{
212 return X509v3_get_ext_count(a->extensions);
213}
214
215int
216TS_REQ_get_ext_by_NID(TS_REQ *a, int nid, int lastpos)
217{
218 return X509v3_get_ext_by_NID(a->extensions, nid, lastpos);
219}
220
221int
222TS_REQ_get_ext_by_OBJ(TS_REQ *a, ASN1_OBJECT *obj, int lastpos)
223{
224 return X509v3_get_ext_by_OBJ(a->extensions, obj, lastpos);
225}
226
227int
228TS_REQ_get_ext_by_critical(TS_REQ *a, int crit, int lastpos)
229{
230 return X509v3_get_ext_by_critical(a->extensions, crit, lastpos);
231}
232
233X509_EXTENSION *
234TS_REQ_get_ext(TS_REQ *a, int loc)
235{
236 return X509v3_get_ext(a->extensions, loc);
237}
238
239X509_EXTENSION *
240TS_REQ_delete_ext(TS_REQ *a, int loc)
241{
242 return X509v3_delete_ext(a->extensions, loc);
243}
244
245int
246TS_REQ_add_ext(TS_REQ *a, X509_EXTENSION *ex, int loc)
247{
248 return X509v3_add_ext(&a->extensions, ex, loc) != NULL;
249}
250
251void *
252TS_REQ_get_ext_d2i(TS_REQ *a, int nid, int *crit, int *idx)
253{
254 return X509V3_get_d2i(a->extensions, nid, crit, idx);
255}
diff --git a/src/lib/libcrypto/ts/ts_rsp_print.c b/src/lib/libcrypto/ts/ts_rsp_print.c
deleted file mode 100644
index c442b71646..0000000000
--- a/src/lib/libcrypto/ts/ts_rsp_print.c
+++ /dev/null
@@ -1,301 +0,0 @@
1/* $OpenBSD: ts_rsp_print.c,v 1.5 2014/07/11 08:44:49 jsing Exp $ */
2/* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL
3 * project 2002.
4 */
5/* ====================================================================
6 * Copyright (c) 2006 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <stdio.h>
60
61#include <openssl/bn.h>
62#include <openssl/objects.h>
63#include <openssl/ts.h>
64#include <openssl/x509v3.h>
65
66struct status_map_st {
67 int bit;
68 const char *text;
69};
70
71/* Local function declarations. */
72
73static int TS_status_map_print(BIO *bio, struct status_map_st *a,
74 ASN1_BIT_STRING *v);
75static int TS_ACCURACY_print_bio(BIO *bio, const TS_ACCURACY *accuracy);
76
77/* Function definitions. */
78
79int
80TS_RESP_print_bio(BIO *bio, TS_RESP *a)
81{
82 TS_TST_INFO *tst_info;
83
84 BIO_printf(bio, "Status info:\n");
85 TS_STATUS_INFO_print_bio(bio, TS_RESP_get_status_info(a));
86
87 BIO_printf(bio, "\nTST info:\n");
88 tst_info = TS_RESP_get_tst_info(a);
89 if (tst_info != NULL)
90 TS_TST_INFO_print_bio(bio, TS_RESP_get_tst_info(a));
91 else
92 BIO_printf(bio, "Not included.\n");
93
94 return 1;
95}
96
97int
98TS_STATUS_INFO_print_bio(BIO *bio, TS_STATUS_INFO *a)
99{
100 static const char *status_map[] = {
101 "Granted.",
102 "Granted with modifications.",
103 "Rejected.",
104 "Waiting.",
105 "Revocation warning.",
106 "Revoked."
107 };
108 static struct status_map_st failure_map[] = {
109 {
110 TS_INFO_BAD_ALG,
111 "unrecognized or unsupported algorithm identifier"
112 },
113 {
114 TS_INFO_BAD_REQUEST,
115 "transaction not permitted or supported"
116 },
117 {
118 TS_INFO_BAD_DATA_FORMAT,
119 "the data submitted has the wrong format"
120 },
121 {
122 TS_INFO_TIME_NOT_AVAILABLE,
123 "the TSA's time source is not available"
124 },
125 {
126 TS_INFO_UNACCEPTED_POLICY,
127 "the requested TSA policy is not supported by the TSA"
128 },
129 {
130 TS_INFO_UNACCEPTED_EXTENSION,
131 "the requested extension is not supported by the TSA"
132 },
133 {
134 TS_INFO_ADD_INFO_NOT_AVAILABLE,
135 "the additional information requested could not be understood "
136 "or is not available"
137 },
138 {
139 TS_INFO_SYSTEM_FAILURE,
140 "the request cannot be handled due to system failure"
141 },
142 { -1, NULL }
143 };
144 long status;
145 int i, lines = 0;
146
147 /* Printing status code. */
148 BIO_printf(bio, "Status: ");
149 status = ASN1_INTEGER_get(a->status);
150 if (0 <= status &&
151 status < (long)(sizeof(status_map) / sizeof(status_map[0])))
152 BIO_printf(bio, "%s\n", status_map[status]);
153 else
154 BIO_printf(bio, "out of bounds\n");
155
156 /* Printing status description. */
157 BIO_printf(bio, "Status description: ");
158 for (i = 0; i < sk_ASN1_UTF8STRING_num(a->text); ++i) {
159 if (i > 0)
160 BIO_puts(bio, "\t");
161 ASN1_STRING_print_ex(bio, sk_ASN1_UTF8STRING_value(a->text, i),
162 0);
163 BIO_puts(bio, "\n");
164 }
165 if (i == 0)
166 BIO_printf(bio, "unspecified\n");
167
168 /* Printing failure information. */
169 BIO_printf(bio, "Failure info: ");
170 if (a->failure_info != NULL)
171 lines = TS_status_map_print(bio, failure_map, a->failure_info);
172 if (lines == 0)
173 BIO_printf(bio, "unspecified");
174 BIO_printf(bio, "\n");
175
176 return 1;
177}
178
179static int
180TS_status_map_print(BIO *bio, struct status_map_st *a, ASN1_BIT_STRING *v)
181{
182 int lines = 0;
183
184 for (; a->bit >= 0; ++a) {
185 if (ASN1_BIT_STRING_get_bit(v, a->bit)) {
186 if (++lines > 1)
187 BIO_printf(bio, ", ");
188 BIO_printf(bio, "%s", a->text);
189 }
190 }
191
192 return lines;
193}
194
195int
196TS_TST_INFO_print_bio(BIO *bio, TS_TST_INFO *a)
197{
198 int v;
199 ASN1_OBJECT *policy_id;
200 const ASN1_INTEGER *serial;
201 const ASN1_GENERALIZEDTIME *gtime;
202 TS_ACCURACY *accuracy;
203 const ASN1_INTEGER *nonce;
204 GENERAL_NAME *tsa_name;
205
206 if (a == NULL)
207 return 0;
208
209 /* Print version. */
210 v = TS_TST_INFO_get_version(a);
211 BIO_printf(bio, "Version: %d\n", v);
212
213 /* Print policy id. */
214 BIO_printf(bio, "Policy OID: ");
215 policy_id = TS_TST_INFO_get_policy_id(a);
216 TS_OBJ_print_bio(bio, policy_id);
217
218 /* Print message imprint. */
219 TS_MSG_IMPRINT_print_bio(bio, TS_TST_INFO_get_msg_imprint(a));
220
221 /* Print serial number. */
222 BIO_printf(bio, "Serial number: ");
223 serial = TS_TST_INFO_get_serial(a);
224 if (serial == NULL)
225 BIO_printf(bio, "unspecified");
226 else
227 TS_ASN1_INTEGER_print_bio(bio, serial);
228 BIO_write(bio, "\n", 1);
229
230 /* Print time stamp. */
231 BIO_printf(bio, "Time stamp: ");
232 gtime = TS_TST_INFO_get_time(a);
233 ASN1_GENERALIZEDTIME_print(bio, gtime);
234 BIO_write(bio, "\n", 1);
235
236 /* Print accuracy. */
237 BIO_printf(bio, "Accuracy: ");
238 accuracy = TS_TST_INFO_get_accuracy(a);
239 if (accuracy == NULL)
240 BIO_printf(bio, "unspecified");
241 else
242 TS_ACCURACY_print_bio(bio, accuracy);
243 BIO_write(bio, "\n", 1);
244
245 /* Print ordering. */
246 BIO_printf(bio, "Ordering: %s\n",
247 TS_TST_INFO_get_ordering(a) ? "yes" : "no");
248
249 /* Print nonce. */
250 BIO_printf(bio, "Nonce: ");
251 nonce = TS_TST_INFO_get_nonce(a);
252 if (nonce == NULL)
253 BIO_printf(bio, "unspecified");
254 else
255 TS_ASN1_INTEGER_print_bio(bio, nonce);
256 BIO_write(bio, "\n", 1);
257
258 /* Print TSA name. */
259 BIO_printf(bio, "TSA: ");
260 tsa_name = TS_TST_INFO_get_tsa(a);
261 if (tsa_name == NULL)
262 BIO_printf(bio, "unspecified");
263 else {
264 STACK_OF(CONF_VALUE) *nval;
265 if ((nval = i2v_GENERAL_NAME(NULL, tsa_name, NULL)))
266 X509V3_EXT_val_prn(bio, nval, 0, 0);
267 sk_CONF_VALUE_pop_free(nval, X509V3_conf_free);
268 }
269 BIO_write(bio, "\n", 1);
270
271 /* Print extensions. */
272 TS_ext_print_bio(bio, TS_TST_INFO_get_exts(a));
273
274 return 1;
275}
276
277static int
278TS_ACCURACY_print_bio(BIO *bio, const TS_ACCURACY *accuracy)
279{
280 const ASN1_INTEGER *seconds = TS_ACCURACY_get_seconds(accuracy);
281 const ASN1_INTEGER *millis = TS_ACCURACY_get_millis(accuracy);
282 const ASN1_INTEGER *micros = TS_ACCURACY_get_micros(accuracy);
283
284 if (seconds != NULL)
285 TS_ASN1_INTEGER_print_bio(bio, seconds);
286 else
287 BIO_printf(bio, "unspecified");
288 BIO_printf(bio, " seconds, ");
289 if (millis != NULL)
290 TS_ASN1_INTEGER_print_bio(bio, millis);
291 else
292 BIO_printf(bio, "unspecified");
293 BIO_printf(bio, " millis, ");
294 if (micros != NULL)
295 TS_ASN1_INTEGER_print_bio(bio, micros);
296 else
297 BIO_printf(bio, "unspecified");
298 BIO_printf(bio, " micros");
299
300 return 1;
301}
diff --git a/src/lib/libcrypto/ts/ts_rsp_sign.c b/src/lib/libcrypto/ts/ts_rsp_sign.c
deleted file mode 100644
index f9e8c53cc8..0000000000
--- a/src/lib/libcrypto/ts/ts_rsp_sign.c
+++ /dev/null
@@ -1,1022 +0,0 @@
1/* $OpenBSD: ts_rsp_sign.c,v 1.20 2016/03/11 07:08:45 mmcc Exp $ */
2/* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL
3 * project 2002.
4 */
5/* ====================================================================
6 * Copyright (c) 2006 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <sys/time.h>
60
61#include <string.h>
62
63#include <openssl/err.h>
64#include <openssl/objects.h>
65#include <openssl/pkcs7.h>
66#include <openssl/ts.h>
67
68/* Private function declarations. */
69
70static ASN1_INTEGER *def_serial_cb(struct TS_resp_ctx *, void *);
71static int def_time_cb(struct TS_resp_ctx *, void *, time_t *sec, long *usec);
72static int def_extension_cb(struct TS_resp_ctx *, X509_EXTENSION *, void *);
73
74static void TS_RESP_CTX_init(TS_RESP_CTX *ctx);
75static void TS_RESP_CTX_cleanup(TS_RESP_CTX *ctx);
76static int TS_RESP_check_request(TS_RESP_CTX *ctx);
77static ASN1_OBJECT *TS_RESP_get_policy(TS_RESP_CTX *ctx);
78static TS_TST_INFO *TS_RESP_create_tst_info(TS_RESP_CTX *ctx,
79 ASN1_OBJECT *policy);
80static int TS_RESP_process_extensions(TS_RESP_CTX *ctx);
81static int TS_RESP_sign(TS_RESP_CTX *ctx);
82
83static ESS_SIGNING_CERT *ESS_SIGNING_CERT_new_init(X509 *signcert,
84 STACK_OF(X509) *certs);
85static ESS_CERT_ID *ESS_CERT_ID_new_init(X509 *cert, int issuer_needed);
86static int TS_TST_INFO_content_new(PKCS7 *p7);
87static int ESS_add_signing_cert(PKCS7_SIGNER_INFO *si, ESS_SIGNING_CERT *sc);
88
89static ASN1_GENERALIZEDTIME *TS_RESP_set_genTime_with_precision(
90 ASN1_GENERALIZEDTIME *, time_t, long, unsigned);
91
92/* Default callbacks for response generation. */
93
94static ASN1_INTEGER *
95def_serial_cb(struct TS_resp_ctx *ctx, void *data)
96{
97 ASN1_INTEGER *serial = ASN1_INTEGER_new();
98
99 if (!serial)
100 goto err;
101 if (!ASN1_INTEGER_set(serial, 1))
102 goto err;
103 return serial;
104
105err:
106 TSerr(TS_F_DEF_SERIAL_CB, ERR_R_MALLOC_FAILURE);
107 TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
108 "Error during serial number generation.");
109 return NULL;
110}
111
112/* Use the gettimeofday function call. */
113static int
114def_time_cb(struct TS_resp_ctx *ctx, void *data, time_t *sec, long *usec)
115{
116 struct timeval tv;
117
118 if (gettimeofday(&tv, NULL) != 0) {
119 TSerr(TS_F_DEF_TIME_CB, TS_R_TIME_SYSCALL_ERROR);
120 TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
121 "Time is not available.");
122 TS_RESP_CTX_add_failure_info(ctx, TS_INFO_TIME_NOT_AVAILABLE);
123 return 0;
124 }
125 /* Return time to caller. */
126 *sec = tv.tv_sec;
127 *usec = tv.tv_usec;
128
129 return 1;
130}
131
132static int
133def_extension_cb(struct TS_resp_ctx *ctx, X509_EXTENSION *ext, void *data)
134{
135 /* No extensions are processed here. */
136 TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
137 "Unsupported extension.");
138 TS_RESP_CTX_add_failure_info(ctx, TS_INFO_UNACCEPTED_EXTENSION);
139 return 0;
140}
141
142/* TS_RESP_CTX management functions. */
143
144TS_RESP_CTX *
145TS_RESP_CTX_new(void)
146{
147 TS_RESP_CTX *ctx;
148
149 if (!(ctx = calloc(1, sizeof(TS_RESP_CTX)))) {
150 TSerr(TS_F_TS_RESP_CTX_NEW, ERR_R_MALLOC_FAILURE);
151 return NULL;
152 }
153
154 /* Setting default callbacks. */
155 ctx->serial_cb = def_serial_cb;
156 ctx->time_cb = def_time_cb;
157 ctx->extension_cb = def_extension_cb;
158
159 return ctx;
160}
161
162void
163TS_RESP_CTX_free(TS_RESP_CTX *ctx)
164{
165 if (!ctx)
166 return;
167
168 X509_free(ctx->signer_cert);
169 EVP_PKEY_free(ctx->signer_key);
170 sk_X509_pop_free(ctx->certs, X509_free);
171 sk_ASN1_OBJECT_pop_free(ctx->policies, ASN1_OBJECT_free);
172 ASN1_OBJECT_free(ctx->default_policy);
173 sk_EVP_MD_free(ctx->mds); /* No EVP_MD_free method exists. */
174 ASN1_INTEGER_free(ctx->seconds);
175 ASN1_INTEGER_free(ctx->millis);
176 ASN1_INTEGER_free(ctx->micros);
177 free(ctx);
178}
179
180int
181TS_RESP_CTX_set_signer_cert(TS_RESP_CTX *ctx, X509 *signer)
182{
183 if (X509_check_purpose(signer, X509_PURPOSE_TIMESTAMP_SIGN, 0) != 1) {
184 TSerr(TS_F_TS_RESP_CTX_SET_SIGNER_CERT,
185 TS_R_INVALID_SIGNER_CERTIFICATE_PURPOSE);
186 return 0;
187 }
188 X509_free(ctx->signer_cert);
189 ctx->signer_cert = signer;
190 CRYPTO_add(&ctx->signer_cert->references, +1, CRYPTO_LOCK_X509);
191 return 1;
192}
193
194int
195TS_RESP_CTX_set_signer_key(TS_RESP_CTX *ctx, EVP_PKEY *key)
196{
197 EVP_PKEY_free(ctx->signer_key);
198 ctx->signer_key = key;
199 CRYPTO_add(&ctx->signer_key->references, +1, CRYPTO_LOCK_EVP_PKEY);
200
201 return 1;
202}
203
204int
205TS_RESP_CTX_set_def_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *def_policy)
206{
207 if (ctx->default_policy)
208 ASN1_OBJECT_free(ctx->default_policy);
209 if (!(ctx->default_policy = OBJ_dup(def_policy)))
210 goto err;
211 return 1;
212
213err:
214 TSerr(TS_F_TS_RESP_CTX_SET_DEF_POLICY, ERR_R_MALLOC_FAILURE);
215 return 0;
216}
217
218int
219TS_RESP_CTX_set_certs(TS_RESP_CTX *ctx, STACK_OF(X509) *certs)
220{
221 int i;
222
223 if (ctx->certs) {
224 sk_X509_pop_free(ctx->certs, X509_free);
225 ctx->certs = NULL;
226 }
227 if (!certs)
228 return 1;
229 if (!(ctx->certs = sk_X509_dup(certs))) {
230 TSerr(TS_F_TS_RESP_CTX_SET_CERTS, ERR_R_MALLOC_FAILURE);
231 return 0;
232 }
233 for (i = 0; i < sk_X509_num(ctx->certs); ++i) {
234 X509 *cert = sk_X509_value(ctx->certs, i);
235 CRYPTO_add(&cert->references, +1, CRYPTO_LOCK_X509);
236 }
237
238 return 1;
239}
240
241int
242TS_RESP_CTX_add_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *policy)
243{
244 ASN1_OBJECT *copy = NULL;
245
246 /* Create new policy stack if necessary. */
247 if (!ctx->policies && !(ctx->policies = sk_ASN1_OBJECT_new_null()))
248 goto err;
249 if (!(copy = OBJ_dup(policy)))
250 goto err;
251 if (!sk_ASN1_OBJECT_push(ctx->policies, copy))
252 goto err;
253
254 return 1;
255
256err:
257 TSerr(TS_F_TS_RESP_CTX_ADD_POLICY, ERR_R_MALLOC_FAILURE);
258 ASN1_OBJECT_free(copy);
259 return 0;
260}
261
262int
263TS_RESP_CTX_add_md(TS_RESP_CTX *ctx, const EVP_MD *md)
264{
265 /* Create new md stack if necessary. */
266 if (!ctx->mds && !(ctx->mds = sk_EVP_MD_new_null()))
267 goto err;
268 /* Add the shared md, no copy needed. */
269 if (!sk_EVP_MD_push(ctx->mds, (EVP_MD *)md))
270 goto err;
271
272 return 1;
273
274err:
275 TSerr(TS_F_TS_RESP_CTX_ADD_MD, ERR_R_MALLOC_FAILURE);
276 return 0;
277}
278
279#define TS_RESP_CTX_accuracy_free(ctx) \
280 ASN1_INTEGER_free(ctx->seconds); \
281 ctx->seconds = NULL; \
282 ASN1_INTEGER_free(ctx->millis); \
283 ctx->millis = NULL; \
284 ASN1_INTEGER_free(ctx->micros); \
285 ctx->micros = NULL;
286
287int
288TS_RESP_CTX_set_accuracy(TS_RESP_CTX *ctx, int secs, int millis, int micros)
289{
290 TS_RESP_CTX_accuracy_free(ctx);
291 if (secs && (!(ctx->seconds = ASN1_INTEGER_new()) ||
292 !ASN1_INTEGER_set(ctx->seconds, secs)))
293 goto err;
294 if (millis && (!(ctx->millis = ASN1_INTEGER_new()) ||
295 !ASN1_INTEGER_set(ctx->millis, millis)))
296 goto err;
297 if (micros && (!(ctx->micros = ASN1_INTEGER_new()) ||
298 !ASN1_INTEGER_set(ctx->micros, micros)))
299 goto err;
300
301 return 1;
302
303err:
304 TS_RESP_CTX_accuracy_free(ctx);
305 TSerr(TS_F_TS_RESP_CTX_SET_ACCURACY, ERR_R_MALLOC_FAILURE);
306 return 0;
307}
308
309void
310TS_RESP_CTX_add_flags(TS_RESP_CTX *ctx, int flags)
311{
312 ctx->flags |= flags;
313}
314
315void
316TS_RESP_CTX_set_serial_cb(TS_RESP_CTX *ctx, TS_serial_cb cb, void *data)
317{
318 ctx->serial_cb = cb;
319 ctx->serial_cb_data = data;
320}
321
322void
323TS_RESP_CTX_set_extension_cb(TS_RESP_CTX *ctx, TS_extension_cb cb, void *data)
324{
325 ctx->extension_cb = cb;
326 ctx->extension_cb_data = data;
327}
328
329int
330TS_RESP_CTX_set_status_info(TS_RESP_CTX *ctx, int status, const char *text)
331{
332 TS_STATUS_INFO *si = NULL;
333 ASN1_UTF8STRING *utf8_text = NULL;
334 int ret = 0;
335
336 if (!(si = TS_STATUS_INFO_new()))
337 goto err;
338 if (!ASN1_INTEGER_set(si->status, status))
339 goto err;
340 if (text) {
341 if (!(utf8_text = ASN1_UTF8STRING_new()) ||
342 !ASN1_STRING_set(utf8_text, text, strlen(text)))
343 goto err;
344 if (!si->text && !(si->text = sk_ASN1_UTF8STRING_new_null()))
345 goto err;
346 if (!sk_ASN1_UTF8STRING_push(si->text, utf8_text))
347 goto err;
348 utf8_text = NULL; /* Ownership is lost. */
349 }
350 if (!TS_RESP_set_status_info(ctx->response, si))
351 goto err;
352 ret = 1;
353
354err:
355 if (!ret)
356 TSerr(TS_F_TS_RESP_CTX_SET_STATUS_INFO, ERR_R_MALLOC_FAILURE);
357 TS_STATUS_INFO_free(si);
358 ASN1_UTF8STRING_free(utf8_text);
359 return ret;
360}
361
362int
363TS_RESP_CTX_set_status_info_cond(TS_RESP_CTX *ctx, int status, const char *text)
364{
365 int ret = 1;
366 TS_STATUS_INFO *si = TS_RESP_get_status_info(ctx->response);
367
368 if (ASN1_INTEGER_get(si->status) == TS_STATUS_GRANTED) {
369 /* Status has not been set, set it now. */
370 ret = TS_RESP_CTX_set_status_info(ctx, status, text);
371 }
372 return ret;
373}
374
375int
376TS_RESP_CTX_add_failure_info(TS_RESP_CTX *ctx, int failure)
377{
378 TS_STATUS_INFO *si = TS_RESP_get_status_info(ctx->response);
379
380 if (!si->failure_info && !(si->failure_info = ASN1_BIT_STRING_new()))
381 goto err;
382 if (!ASN1_BIT_STRING_set_bit(si->failure_info, failure, 1))
383 goto err;
384 return 1;
385
386err:
387 TSerr(TS_F_TS_RESP_CTX_ADD_FAILURE_INFO, ERR_R_MALLOC_FAILURE);
388 return 0;
389}
390
391TS_REQ *
392TS_RESP_CTX_get_request(TS_RESP_CTX *ctx)
393{
394 return ctx->request;
395}
396
397TS_TST_INFO *
398TS_RESP_CTX_get_tst_info(TS_RESP_CTX *ctx)
399{
400 return ctx->tst_info;
401}
402
403int
404TS_RESP_CTX_set_clock_precision_digits(TS_RESP_CTX *ctx, unsigned precision)
405{
406 if (precision > TS_MAX_CLOCK_PRECISION_DIGITS)
407 return 0;
408 ctx->clock_precision_digits = precision;
409 return 1;
410}
411
412/* Main entry method of the response generation. */
413TS_RESP *
414TS_RESP_create_response(TS_RESP_CTX *ctx, BIO *req_bio)
415{
416 ASN1_OBJECT *policy;
417 TS_RESP *response;
418 int result = 0;
419
420 TS_RESP_CTX_init(ctx);
421
422 /* Creating the response object. */
423 if (!(ctx->response = TS_RESP_new())) {
424 TSerr(TS_F_TS_RESP_CREATE_RESPONSE, ERR_R_MALLOC_FAILURE);
425 goto end;
426 }
427
428 /* Parsing DER request. */
429 if (!(ctx->request = d2i_TS_REQ_bio(req_bio, NULL))) {
430 TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
431 "Bad request format or "
432 "system error.");
433 TS_RESP_CTX_add_failure_info(ctx, TS_INFO_BAD_DATA_FORMAT);
434 goto end;
435 }
436
437 /* Setting default status info. */
438 if (!TS_RESP_CTX_set_status_info(ctx, TS_STATUS_GRANTED, NULL))
439 goto end;
440
441 /* Checking the request format. */
442 if (!TS_RESP_check_request(ctx))
443 goto end;
444
445 /* Checking acceptable policies. */
446 if (!(policy = TS_RESP_get_policy(ctx)))
447 goto end;
448
449 /* Creating the TS_TST_INFO object. */
450 if (!(ctx->tst_info = TS_RESP_create_tst_info(ctx, policy)))
451 goto end;
452
453 /* Processing extensions. */
454 if (!TS_RESP_process_extensions(ctx))
455 goto end;
456
457 /* Generating the signature. */
458 if (!TS_RESP_sign(ctx))
459 goto end;
460
461 /* Everything was successful. */
462 result = 1;
463
464end:
465 if (!result) {
466 TSerr(TS_F_TS_RESP_CREATE_RESPONSE, TS_R_RESPONSE_SETUP_ERROR);
467 if (ctx->response != NULL) {
468 if (TS_RESP_CTX_set_status_info_cond(ctx,
469 TS_STATUS_REJECTION, "Error during response "
470 "generation.") == 0) {
471 TS_RESP_free(ctx->response);
472 ctx->response = NULL;
473 }
474 }
475 }
476 response = ctx->response;
477 ctx->response = NULL; /* Ownership will be returned to caller. */
478 TS_RESP_CTX_cleanup(ctx);
479 return response;
480}
481
482/* Initializes the variable part of the context. */
483static void
484TS_RESP_CTX_init(TS_RESP_CTX *ctx)
485{
486 ctx->request = NULL;
487 ctx->response = NULL;
488 ctx->tst_info = NULL;
489}
490
491/* Cleans up the variable part of the context. */
492static void
493TS_RESP_CTX_cleanup(TS_RESP_CTX *ctx)
494{
495 TS_REQ_free(ctx->request);
496 ctx->request = NULL;
497 TS_RESP_free(ctx->response);
498 ctx->response = NULL;
499 TS_TST_INFO_free(ctx->tst_info);
500 ctx->tst_info = NULL;
501}
502
503/* Checks the format and content of the request. */
504static int
505TS_RESP_check_request(TS_RESP_CTX *ctx)
506{
507 TS_REQ *request = ctx->request;
508 TS_MSG_IMPRINT *msg_imprint;
509 X509_ALGOR *md_alg;
510 int md_alg_id;
511 const ASN1_OCTET_STRING *digest;
512 EVP_MD *md = NULL;
513 int i;
514
515 /* Checking request version. */
516 if (TS_REQ_get_version(request) != 1) {
517 TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
518 "Bad request version.");
519 TS_RESP_CTX_add_failure_info(ctx, TS_INFO_BAD_REQUEST);
520 return 0;
521 }
522
523 /* Checking message digest algorithm. */
524 msg_imprint = TS_REQ_get_msg_imprint(request);
525 md_alg = TS_MSG_IMPRINT_get_algo(msg_imprint);
526 md_alg_id = OBJ_obj2nid(md_alg->algorithm);
527 for (i = 0; !md && i < sk_EVP_MD_num(ctx->mds); ++i) {
528 EVP_MD *current_md = sk_EVP_MD_value(ctx->mds, i);
529 if (md_alg_id == EVP_MD_type(current_md))
530 md = current_md;
531 }
532 if (!md) {
533 TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
534 "Message digest algorithm is "
535 "not supported.");
536 TS_RESP_CTX_add_failure_info(ctx, TS_INFO_BAD_ALG);
537 return 0;
538 }
539
540 /* No message digest takes parameter. */
541 if (md_alg->parameter &&
542 ASN1_TYPE_get(md_alg->parameter) != V_ASN1_NULL) {
543 TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
544 "Superfluous message digest "
545 "parameter.");
546 TS_RESP_CTX_add_failure_info(ctx, TS_INFO_BAD_ALG);
547 return 0;
548 }
549 /* Checking message digest size. */
550 digest = TS_MSG_IMPRINT_get_msg(msg_imprint);
551 if (digest->length != EVP_MD_size(md)) {
552 TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
553 "Bad message digest.");
554 TS_RESP_CTX_add_failure_info(ctx, TS_INFO_BAD_DATA_FORMAT);
555 return 0;
556 }
557
558 return 1;
559}
560
561/* Returns the TSA policy based on the requested and acceptable policies. */
562static ASN1_OBJECT *
563TS_RESP_get_policy(TS_RESP_CTX *ctx)
564{
565 ASN1_OBJECT *requested = TS_REQ_get_policy_id(ctx->request);
566 ASN1_OBJECT *policy = NULL;
567 int i;
568
569 if (ctx->default_policy == NULL) {
570 TSerr(TS_F_TS_RESP_GET_POLICY, TS_R_INVALID_NULL_POINTER);
571 return NULL;
572 }
573 /* Return the default policy if none is requested or the default is
574 requested. */
575 if (!requested || !OBJ_cmp(requested, ctx->default_policy))
576 policy = ctx->default_policy;
577
578 /* Check if the policy is acceptable. */
579 for (i = 0; !policy && i < sk_ASN1_OBJECT_num(ctx->policies); ++i) {
580 ASN1_OBJECT *current = sk_ASN1_OBJECT_value(ctx->policies, i);
581 if (!OBJ_cmp(requested, current))
582 policy = current;
583 }
584 if (!policy) {
585 TSerr(TS_F_TS_RESP_GET_POLICY, TS_R_UNACCEPTABLE_POLICY);
586 TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
587 "Requested policy is not "
588 "supported.");
589 TS_RESP_CTX_add_failure_info(ctx, TS_INFO_UNACCEPTED_POLICY);
590 }
591 return policy;
592}
593
594/* Creates the TS_TST_INFO object based on the settings of the context. */
595static TS_TST_INFO *
596TS_RESP_create_tst_info(TS_RESP_CTX *ctx, ASN1_OBJECT *policy)
597{
598 int result = 0;
599 TS_TST_INFO *tst_info = NULL;
600 ASN1_INTEGER *serial = NULL;
601 ASN1_GENERALIZEDTIME *asn1_time = NULL;
602 time_t sec;
603 long usec;
604 TS_ACCURACY *accuracy = NULL;
605 const ASN1_INTEGER *nonce;
606 GENERAL_NAME *tsa_name = NULL;
607
608 if (!(tst_info = TS_TST_INFO_new()))
609 goto end;
610 if (!TS_TST_INFO_set_version(tst_info, 1))
611 goto end;
612 if (!TS_TST_INFO_set_policy_id(tst_info, policy))
613 goto end;
614 if (!TS_TST_INFO_set_msg_imprint(tst_info, ctx->request->msg_imprint))
615 goto end;
616 if (!(serial = (*ctx->serial_cb)(ctx, ctx->serial_cb_data)) ||
617 !TS_TST_INFO_set_serial(tst_info, serial))
618 goto end;
619 if (!(*ctx->time_cb)(ctx, ctx->time_cb_data, &sec, &usec) ||
620 !(asn1_time = TS_RESP_set_genTime_with_precision(NULL, sec, usec,
621 ctx->clock_precision_digits)) ||
622 !TS_TST_INFO_set_time(tst_info, asn1_time))
623 goto end;
624
625 /* Setting accuracy if needed. */
626 if ((ctx->seconds || ctx->millis || ctx->micros) &&
627 !(accuracy = TS_ACCURACY_new()))
628 goto end;
629
630 if (ctx->seconds && !TS_ACCURACY_set_seconds(accuracy, ctx->seconds))
631 goto end;
632 if (ctx->millis && !TS_ACCURACY_set_millis(accuracy, ctx->millis))
633 goto end;
634 if (ctx->micros && !TS_ACCURACY_set_micros(accuracy, ctx->micros))
635 goto end;
636 if (accuracy && !TS_TST_INFO_set_accuracy(tst_info, accuracy))
637 goto end;
638
639 /* Setting ordering. */
640 if ((ctx->flags & TS_ORDERING) &&
641 !TS_TST_INFO_set_ordering(tst_info, 1))
642 goto end;
643
644 /* Setting nonce if needed. */
645 if ((nonce = TS_REQ_get_nonce(ctx->request)) != NULL &&
646 !TS_TST_INFO_set_nonce(tst_info, nonce))
647 goto end;
648
649 /* Setting TSA name to subject of signer certificate. */
650 if (ctx->flags & TS_TSA_NAME) {
651 if (!(tsa_name = GENERAL_NAME_new()))
652 goto end;
653 tsa_name->type = GEN_DIRNAME;
654 tsa_name->d.dirn =
655 X509_NAME_dup(ctx->signer_cert->cert_info->subject);
656 if (!tsa_name->d.dirn)
657 goto end;
658 if (!TS_TST_INFO_set_tsa(tst_info, tsa_name))
659 goto end;
660 }
661
662 result = 1;
663
664end:
665 if (!result) {
666 TS_TST_INFO_free(tst_info);
667 tst_info = NULL;
668 TSerr(TS_F_TS_RESP_CREATE_TST_INFO, TS_R_TST_INFO_SETUP_ERROR);
669 TS_RESP_CTX_set_status_info_cond(ctx, TS_STATUS_REJECTION,
670 "Error during TSTInfo "
671 "generation.");
672 }
673 GENERAL_NAME_free(tsa_name);
674 TS_ACCURACY_free(accuracy);
675 ASN1_GENERALIZEDTIME_free(asn1_time);
676 ASN1_INTEGER_free(serial);
677
678 return tst_info;
679}
680
681/* Processing the extensions of the request. */
682static int
683TS_RESP_process_extensions(TS_RESP_CTX *ctx)
684{
685 STACK_OF(X509_EXTENSION) *exts = TS_REQ_get_exts(ctx->request);
686 int i;
687 int ok = 1;
688
689 for (i = 0; ok && i < sk_X509_EXTENSION_num(exts); ++i) {
690 X509_EXTENSION *ext = sk_X509_EXTENSION_value(exts, i);
691 /* XXXXX The last argument was previously
692 (void *)ctx->extension_cb, but ISO C doesn't permit
693 converting a function pointer to void *. For lack of
694 better information, I'm placing a NULL there instead.
695 The callback can pick its own address out from the ctx
696 anyway...
697 */
698 ok = (*ctx->extension_cb)(ctx, ext, NULL);
699 }
700
701 return ok;
702}
703
704/* Functions for signing the TS_TST_INFO structure of the context. */
705static int
706TS_RESP_sign(TS_RESP_CTX *ctx)
707{
708 int ret = 0;
709 PKCS7 *p7 = NULL;
710 PKCS7_SIGNER_INFO *si;
711 STACK_OF(X509) *certs; /* Certificates to include in sc. */
712 ESS_SIGNING_CERT *sc = NULL;
713 ASN1_OBJECT *oid;
714 BIO *p7bio = NULL;
715 int i;
716
717 /* Check if signcert and pkey match. */
718 if (!X509_check_private_key(ctx->signer_cert, ctx->signer_key)) {
719 TSerr(TS_F_TS_RESP_SIGN,
720 TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE);
721 goto err;
722 }
723
724 /* Create a new PKCS7 signed object. */
725 if (!(p7 = PKCS7_new())) {
726 TSerr(TS_F_TS_RESP_SIGN, ERR_R_MALLOC_FAILURE);
727 goto err;
728 }
729 if (!PKCS7_set_type(p7, NID_pkcs7_signed))
730 goto err;
731
732 /* Force SignedData version to be 3 instead of the default 1. */
733 if (!ASN1_INTEGER_set(p7->d.sign->version, 3))
734 goto err;
735
736 /* Add signer certificate and optional certificate chain. */
737 if (TS_REQ_get_cert_req(ctx->request)) {
738 PKCS7_add_certificate(p7, ctx->signer_cert);
739 if (ctx->certs) {
740 for (i = 0; i < sk_X509_num(ctx->certs); ++i) {
741 X509 *cert = sk_X509_value(ctx->certs, i);
742 PKCS7_add_certificate(p7, cert);
743 }
744 }
745 }
746
747 /* Add a new signer info. */
748 if (!(si = PKCS7_add_signature(p7, ctx->signer_cert,
749 ctx->signer_key, EVP_sha1()))) {
750 TSerr(TS_F_TS_RESP_SIGN, TS_R_PKCS7_ADD_SIGNATURE_ERROR);
751 goto err;
752 }
753
754 /* Add content type signed attribute to the signer info. */
755 oid = OBJ_nid2obj(NID_id_smime_ct_TSTInfo);
756 if (!PKCS7_add_signed_attribute(si, NID_pkcs9_contentType,
757 V_ASN1_OBJECT, oid)) {
758 TSerr(TS_F_TS_RESP_SIGN, TS_R_PKCS7_ADD_SIGNED_ATTR_ERROR);
759 goto err;
760 }
761
762 /* Create the ESS SigningCertificate attribute which contains
763 the signer certificate id and optionally the certificate chain. */
764 certs = ctx->flags & TS_ESS_CERT_ID_CHAIN ? ctx->certs : NULL;
765 if (!(sc = ESS_SIGNING_CERT_new_init(ctx->signer_cert, certs)))
766 goto err;
767
768 /* Add SigningCertificate signed attribute to the signer info. */
769 if (!ESS_add_signing_cert(si, sc)) {
770 TSerr(TS_F_TS_RESP_SIGN, TS_R_ESS_ADD_SIGNING_CERT_ERROR);
771 goto err;
772 }
773
774 /* Add a new empty NID_id_smime_ct_TSTInfo encapsulated content. */
775 if (!TS_TST_INFO_content_new(p7))
776 goto err;
777
778 /* Add the DER encoded tst_info to the PKCS7 structure. */
779 if (!(p7bio = PKCS7_dataInit(p7, NULL))) {
780 TSerr(TS_F_TS_RESP_SIGN, ERR_R_MALLOC_FAILURE);
781 goto err;
782 }
783
784 /* Convert tst_info to DER. */
785 if (!i2d_TS_TST_INFO_bio(p7bio, ctx->tst_info)) {
786 TSerr(TS_F_TS_RESP_SIGN, TS_R_TS_DATASIGN);
787 goto err;
788 }
789
790 /* Create the signature and add it to the signer info. */
791 if (!PKCS7_dataFinal(p7, p7bio)) {
792 TSerr(TS_F_TS_RESP_SIGN, TS_R_TS_DATASIGN);
793 goto err;
794 }
795
796 /* Set new PKCS7 and TST_INFO objects. */
797 TS_RESP_set_tst_info(ctx->response, p7, ctx->tst_info);
798 p7 = NULL; /* Ownership is lost. */
799 ctx->tst_info = NULL; /* Ownership is lost. */
800
801 ret = 1;
802
803err:
804 if (!ret)
805 TS_RESP_CTX_set_status_info_cond(ctx, TS_STATUS_REJECTION,
806 "Error during signature "
807 "generation.");
808 BIO_free_all(p7bio);
809 ESS_SIGNING_CERT_free(sc);
810 PKCS7_free(p7);
811 return ret;
812}
813
814static ESS_SIGNING_CERT *
815ESS_SIGNING_CERT_new_init(X509 *signcert, STACK_OF(X509) *certs)
816{
817 ESS_CERT_ID *cid;
818 ESS_SIGNING_CERT *sc = NULL;
819 int i;
820
821 /* Creating the ESS_CERT_ID stack. */
822 if (!(sc = ESS_SIGNING_CERT_new()))
823 goto err;
824 if (!sc->cert_ids && !(sc->cert_ids = sk_ESS_CERT_ID_new_null()))
825 goto err;
826
827 /* Adding the signing certificate id. */
828 if (!(cid = ESS_CERT_ID_new_init(signcert, 0)) ||
829 !sk_ESS_CERT_ID_push(sc->cert_ids, cid))
830 goto err;
831 /* Adding the certificate chain ids. */
832 for (i = 0; i < sk_X509_num(certs); ++i) {
833 X509 *cert = sk_X509_value(certs, i);
834 if (!(cid = ESS_CERT_ID_new_init(cert, 1)) ||
835 !sk_ESS_CERT_ID_push(sc->cert_ids, cid))
836 goto err;
837 }
838
839 return sc;
840
841err:
842 ESS_SIGNING_CERT_free(sc);
843 TSerr(TS_F_ESS_SIGNING_CERT_NEW_INIT, ERR_R_MALLOC_FAILURE);
844 return NULL;
845}
846
847static ESS_CERT_ID *
848ESS_CERT_ID_new_init(X509 *cert, int issuer_needed)
849{
850 ESS_CERT_ID *cid = NULL;
851 GENERAL_NAME *name = NULL;
852
853 /* Recompute SHA1 hash of certificate if necessary (side effect). */
854 X509_check_purpose(cert, -1, 0);
855
856 if (!(cid = ESS_CERT_ID_new()))
857 goto err;
858 if (!ASN1_OCTET_STRING_set(cid->hash, cert->sha1_hash,
859 sizeof(cert->sha1_hash)))
860 goto err;
861
862 /* Setting the issuer/serial if requested. */
863 if (issuer_needed) {
864 /* Creating issuer/serial structure. */
865 if (!cid->issuer_serial &&
866 !(cid->issuer_serial = ESS_ISSUER_SERIAL_new()))
867 goto err;
868 /* Creating general name from the certificate issuer. */
869 if (!(name = GENERAL_NAME_new()))
870 goto err;
871 name->type = GEN_DIRNAME;
872 if (!(name->d.dirn = X509_NAME_dup(cert->cert_info->issuer)))
873 goto err;
874 if (!sk_GENERAL_NAME_push(cid->issuer_serial->issuer, name))
875 goto err;
876 name = NULL; /* Ownership is lost. */
877 /* Setting the serial number. */
878 ASN1_INTEGER_free(cid->issuer_serial->serial);
879 if (!(cid->issuer_serial->serial =
880 ASN1_INTEGER_dup(cert->cert_info->serialNumber)))
881 goto err;
882 }
883
884 return cid;
885
886err:
887 GENERAL_NAME_free(name);
888 ESS_CERT_ID_free(cid);
889 TSerr(TS_F_ESS_CERT_ID_NEW_INIT, ERR_R_MALLOC_FAILURE);
890 return NULL;
891}
892
893static int
894TS_TST_INFO_content_new(PKCS7 *p7)
895{
896 PKCS7 *ret = NULL;
897 ASN1_OCTET_STRING *octet_string = NULL;
898
899 /* Create new encapsulated NID_id_smime_ct_TSTInfo content. */
900 if (!(ret = PKCS7_new()))
901 goto err;
902 if (!(ret->d.other = ASN1_TYPE_new()))
903 goto err;
904 ret->type = OBJ_nid2obj(NID_id_smime_ct_TSTInfo);
905 if (!(octet_string = ASN1_OCTET_STRING_new()))
906 goto err;
907 ASN1_TYPE_set(ret->d.other, V_ASN1_OCTET_STRING, octet_string);
908 octet_string = NULL;
909
910 /* Add encapsulated content to signed PKCS7 structure. */
911 if (!PKCS7_set_content(p7, ret))
912 goto err;
913
914 return 1;
915
916err:
917 ASN1_OCTET_STRING_free(octet_string);
918 PKCS7_free(ret);
919 return 0;
920}
921
922static int
923ESS_add_signing_cert(PKCS7_SIGNER_INFO *si, ESS_SIGNING_CERT *sc)
924{
925 ASN1_STRING *seq = NULL;
926 unsigned char *p, *pp = NULL;
927 int len;
928
929 len = i2d_ESS_SIGNING_CERT(sc, NULL);
930 if (!(pp = malloc(len))) {
931 TSerr(TS_F_ESS_ADD_SIGNING_CERT, ERR_R_MALLOC_FAILURE);
932 goto err;
933 }
934 p = pp;
935 i2d_ESS_SIGNING_CERT(sc, &p);
936 if (!(seq = ASN1_STRING_new()) || !ASN1_STRING_set(seq, pp, len)) {
937 TSerr(TS_F_ESS_ADD_SIGNING_CERT, ERR_R_MALLOC_FAILURE);
938 goto err;
939 }
940 free(pp);
941 pp = NULL;
942 return PKCS7_add_signed_attribute(si,
943 NID_id_smime_aa_signingCertificate, V_ASN1_SEQUENCE, seq);
944
945err:
946 ASN1_STRING_free(seq);
947 free(pp);
948
949 return 0;
950}
951
952
953static ASN1_GENERALIZEDTIME *
954TS_RESP_set_genTime_with_precision(ASN1_GENERALIZEDTIME *asn1_time,
955 time_t sec, long usec, unsigned precision)
956{
957 struct tm *tm = NULL;
958 char genTime_str[17 + TS_MAX_CLOCK_PRECISION_DIGITS];
959 char usecstr[TS_MAX_CLOCK_PRECISION_DIGITS + 2];
960 char *p;
961 int rv;
962
963 if (precision > TS_MAX_CLOCK_PRECISION_DIGITS)
964 goto err;
965
966 if (!(tm = gmtime(&sec)))
967 goto err;
968
969 /*
970 * Put "genTime_str" in GeneralizedTime format. We work around the
971 * restrictions imposed by rfc3280 (i.e. "GeneralizedTime values MUST
972 * NOT include fractional seconds") and OpenSSL related functions to
973 * meet the rfc3161 requirement: "GeneralizedTime syntax can include
974 * fraction-of-second details".
975 */
976 if (precision > 0) {
977 /* To make things a bit harder, X.690 | ISO/IEC 8825-1 provides
978 the following restrictions for a DER-encoding, which OpenSSL
979 (specifically ASN1_GENERALIZEDTIME_check() function) doesn't
980 support:
981 "The encoding MUST terminate with a "Z" (which means "Zulu"
982 time). The decimal point element, if present, MUST be the
983 point option ".". The fractional-seconds elements,
984 if present, MUST omit all trailing 0's;
985 if the elements correspond to 0, they MUST be wholly
986 omitted, and the decimal point element also MUST be
987 omitted." */
988 (void) snprintf(usecstr, sizeof(usecstr), ".%06ld", usec);
989 /* truncate and trim trailing 0 */
990 usecstr[precision + 1] = '\0';
991 p = usecstr + strlen(usecstr) - 1;
992 while (p > usecstr && *p == '0')
993 *p-- = '\0';
994 /* if we've reached the beginning, delete the . too */
995 if (p == usecstr)
996 *p = '\0';
997
998 } else {
999 /* empty */
1000 usecstr[0] = '\0';
1001 }
1002 rv = snprintf(genTime_str, sizeof(genTime_str),
1003 "%04d%02d%02d%02d%02d%02d%sZ",
1004 tm->tm_year + 1900, tm->tm_mon + 1, tm->tm_mday,
1005 tm->tm_hour, tm->tm_min, tm->tm_sec, usecstr);
1006 if (rv == -1 || rv >= sizeof(genTime_str))
1007 goto err;
1008
1009 /* Now call OpenSSL to check and set our genTime value */
1010 if (!asn1_time && !(asn1_time = ASN1_GENERALIZEDTIME_new()))
1011 goto err;
1012 if (!ASN1_GENERALIZEDTIME_set_string(asn1_time, genTime_str)) {
1013 ASN1_GENERALIZEDTIME_free(asn1_time);
1014 goto err;
1015 }
1016
1017 return asn1_time;
1018
1019err:
1020 TSerr(TS_F_TS_RESP_SET_GENTIME_WITH_PRECISION, TS_R_COULD_NOT_SET_TIME);
1021 return NULL;
1022}
diff --git a/src/lib/libcrypto/ts/ts_rsp_utils.c b/src/lib/libcrypto/ts/ts_rsp_utils.c
deleted file mode 100644
index 39eb2a2963..0000000000
--- a/src/lib/libcrypto/ts/ts_rsp_utils.c
+++ /dev/null
@@ -1,436 +0,0 @@
1/* $OpenBSD: ts_rsp_utils.c,v 1.5 2015/07/29 14:58:34 jsing Exp $ */
2/* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL
3 * project 2002.
4 */
5/* ====================================================================
6 * Copyright (c) 2006 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <stdio.h>
60
61#include <openssl/err.h>
62#include <openssl/objects.h>
63#include <openssl/pkcs7.h>
64#include <openssl/ts.h>
65
66/* Function definitions. */
67
68int
69TS_RESP_set_status_info(TS_RESP *a, TS_STATUS_INFO *status_info)
70{
71 TS_STATUS_INFO *new_status_info;
72
73 if (a->status_info == status_info)
74 return 1;
75 new_status_info = TS_STATUS_INFO_dup(status_info);
76 if (new_status_info == NULL) {
77 TSerr(TS_F_TS_RESP_SET_STATUS_INFO, ERR_R_MALLOC_FAILURE);
78 return 0;
79 }
80 TS_STATUS_INFO_free(a->status_info);
81 a->status_info = new_status_info;
82
83 return 1;
84}
85
86TS_STATUS_INFO *
87TS_RESP_get_status_info(TS_RESP *a)
88{
89 return a->status_info;
90}
91
92/* Caller loses ownership of PKCS7 and TS_TST_INFO objects. */
93void
94TS_RESP_set_tst_info(TS_RESP *a, PKCS7 *p7, TS_TST_INFO *tst_info)
95{
96 /* Set new PKCS7 and TST_INFO objects. */
97 PKCS7_free(a->token);
98 a->token = p7;
99 TS_TST_INFO_free(a->tst_info);
100 a->tst_info = tst_info;
101}
102
103PKCS7 *
104TS_RESP_get_token(TS_RESP *a)
105{
106 return a->token;
107}
108
109TS_TST_INFO *
110TS_RESP_get_tst_info(TS_RESP *a)
111{
112 return a->tst_info;
113}
114
115int
116TS_TST_INFO_set_version(TS_TST_INFO *a, long version)
117{
118 return ASN1_INTEGER_set(a->version, version);
119}
120
121long
122TS_TST_INFO_get_version(const TS_TST_INFO *a)
123{
124 return ASN1_INTEGER_get(a->version);
125}
126
127int
128TS_TST_INFO_set_policy_id(TS_TST_INFO *a, ASN1_OBJECT *policy)
129{
130 ASN1_OBJECT *new_policy;
131
132 if (a->policy_id == policy)
133 return 1;
134 new_policy = OBJ_dup(policy);
135 if (new_policy == NULL) {
136 TSerr(TS_F_TS_TST_INFO_SET_POLICY_ID, ERR_R_MALLOC_FAILURE);
137 return 0;
138 }
139 ASN1_OBJECT_free(a->policy_id);
140 a->policy_id = new_policy;
141 return 1;
142}
143
144ASN1_OBJECT *
145TS_TST_INFO_get_policy_id(TS_TST_INFO *a)
146{
147 return a->policy_id;
148}
149
150int
151TS_TST_INFO_set_msg_imprint(TS_TST_INFO *a, TS_MSG_IMPRINT *msg_imprint)
152{
153 TS_MSG_IMPRINT *new_msg_imprint;
154
155 if (a->msg_imprint == msg_imprint)
156 return 1;
157 new_msg_imprint = TS_MSG_IMPRINT_dup(msg_imprint);
158 if (new_msg_imprint == NULL) {
159 TSerr(TS_F_TS_TST_INFO_SET_MSG_IMPRINT, ERR_R_MALLOC_FAILURE);
160 return 0;
161 }
162 TS_MSG_IMPRINT_free(a->msg_imprint);
163 a->msg_imprint = new_msg_imprint;
164 return 1;
165}
166
167TS_MSG_IMPRINT *
168TS_TST_INFO_get_msg_imprint(TS_TST_INFO *a)
169{
170 return a->msg_imprint;
171}
172
173int
174TS_TST_INFO_set_serial(TS_TST_INFO *a, const ASN1_INTEGER *serial)
175{
176 ASN1_INTEGER *new_serial;
177
178 if (a->serial == serial)
179 return 1;
180 new_serial = ASN1_INTEGER_dup(serial);
181 if (new_serial == NULL) {
182 TSerr(TS_F_TS_TST_INFO_SET_SERIAL, ERR_R_MALLOC_FAILURE);
183 return 0;
184 }
185 ASN1_INTEGER_free(a->serial);
186 a->serial = new_serial;
187 return 1;
188}
189
190const ASN1_INTEGER *
191TS_TST_INFO_get_serial(const TS_TST_INFO *a)
192{
193 return a->serial;
194}
195
196int
197TS_TST_INFO_set_time(TS_TST_INFO *a, const ASN1_GENERALIZEDTIME *gtime)
198{
199 ASN1_GENERALIZEDTIME *new_time;
200
201 if (a->time == gtime)
202 return 1;
203 new_time = ASN1_STRING_dup(gtime);
204 if (new_time == NULL) {
205 TSerr(TS_F_TS_TST_INFO_SET_TIME, ERR_R_MALLOC_FAILURE);
206 return 0;
207 }
208 ASN1_GENERALIZEDTIME_free(a->time);
209 a->time = new_time;
210 return 1;
211}
212
213const ASN1_GENERALIZEDTIME *
214TS_TST_INFO_get_time(const TS_TST_INFO *a)
215{
216 return a->time;
217}
218
219int
220TS_TST_INFO_set_accuracy(TS_TST_INFO *a, TS_ACCURACY *accuracy)
221{
222 TS_ACCURACY *new_accuracy;
223
224 if (a->accuracy == accuracy)
225 return 1;
226 new_accuracy = TS_ACCURACY_dup(accuracy);
227 if (new_accuracy == NULL) {
228 TSerr(TS_F_TS_TST_INFO_SET_ACCURACY, ERR_R_MALLOC_FAILURE);
229 return 0;
230 }
231 TS_ACCURACY_free(a->accuracy);
232 a->accuracy = new_accuracy;
233 return 1;
234}
235
236TS_ACCURACY *
237TS_TST_INFO_get_accuracy(TS_TST_INFO *a)
238{
239 return a->accuracy;
240}
241
242int
243TS_ACCURACY_set_seconds(TS_ACCURACY *a, const ASN1_INTEGER *seconds)
244{
245 ASN1_INTEGER *new_seconds;
246
247 if (a->seconds == seconds)
248 return 1;
249 new_seconds = ASN1_INTEGER_dup(seconds);
250 if (new_seconds == NULL) {
251 TSerr(TS_F_TS_ACCURACY_SET_SECONDS, ERR_R_MALLOC_FAILURE);
252 return 0;
253 }
254 ASN1_INTEGER_free(a->seconds);
255 a->seconds = new_seconds;
256 return 1;
257}
258
259const ASN1_INTEGER *
260TS_ACCURACY_get_seconds(const TS_ACCURACY *a)
261{
262 return a->seconds;
263}
264
265int
266TS_ACCURACY_set_millis(TS_ACCURACY *a, const ASN1_INTEGER *millis)
267{
268 ASN1_INTEGER *new_millis = NULL;
269
270 if (a->millis == millis)
271 return 1;
272 if (millis != NULL) {
273 new_millis = ASN1_INTEGER_dup(millis);
274 if (new_millis == NULL) {
275 TSerr(TS_F_TS_ACCURACY_SET_MILLIS,
276 ERR_R_MALLOC_FAILURE);
277 return 0;
278 }
279 }
280 ASN1_INTEGER_free(a->millis);
281 a->millis = new_millis;
282 return 1;
283}
284
285const ASN1_INTEGER *
286TS_ACCURACY_get_millis(const TS_ACCURACY *a)
287{
288 return a->millis;
289}
290
291int
292TS_ACCURACY_set_micros(TS_ACCURACY *a, const ASN1_INTEGER *micros)
293{
294 ASN1_INTEGER *new_micros = NULL;
295
296 if (a->micros == micros)
297 return 1;
298 if (micros != NULL) {
299 new_micros = ASN1_INTEGER_dup(micros);
300 if (new_micros == NULL) {
301 TSerr(TS_F_TS_ACCURACY_SET_MICROS,
302 ERR_R_MALLOC_FAILURE);
303 return 0;
304 }
305 }
306 ASN1_INTEGER_free(a->micros);
307 a->micros = new_micros;
308 return 1;
309}
310
311const ASN1_INTEGER *
312TS_ACCURACY_get_micros(const TS_ACCURACY *a)
313{
314 return a->micros;
315}
316
317int
318TS_TST_INFO_set_ordering(TS_TST_INFO *a, int ordering)
319{
320 a->ordering = ordering ? 0xFF : 0x00;
321 return 1;
322}
323
324int
325TS_TST_INFO_get_ordering(const TS_TST_INFO *a)
326{
327 return a->ordering ? 1 : 0;
328}
329
330int
331TS_TST_INFO_set_nonce(TS_TST_INFO *a, const ASN1_INTEGER *nonce)
332{
333 ASN1_INTEGER *new_nonce;
334
335 if (a->nonce == nonce)
336 return 1;
337 new_nonce = ASN1_INTEGER_dup(nonce);
338 if (new_nonce == NULL) {
339 TSerr(TS_F_TS_TST_INFO_SET_NONCE, ERR_R_MALLOC_FAILURE);
340 return 0;
341 }
342 ASN1_INTEGER_free(a->nonce);
343 a->nonce = new_nonce;
344 return 1;
345}
346
347const ASN1_INTEGER *
348TS_TST_INFO_get_nonce(const TS_TST_INFO *a)
349{
350 return a->nonce;
351}
352
353int
354TS_TST_INFO_set_tsa(TS_TST_INFO *a, GENERAL_NAME *tsa)
355{
356 GENERAL_NAME *new_tsa;
357
358 if (a->tsa == tsa)
359 return 1;
360 new_tsa = GENERAL_NAME_dup(tsa);
361 if (new_tsa == NULL) {
362 TSerr(TS_F_TS_TST_INFO_SET_TSA, ERR_R_MALLOC_FAILURE);
363 return 0;
364 }
365 GENERAL_NAME_free(a->tsa);
366 a->tsa = new_tsa;
367 return 1;
368}
369
370GENERAL_NAME *
371TS_TST_INFO_get_tsa(TS_TST_INFO *a)
372{
373 return a->tsa;
374}
375
376STACK_OF(X509_EXTENSION) *TS_TST_INFO_get_exts(TS_TST_INFO *a)
377{
378 return a->extensions;
379}
380
381void
382TS_TST_INFO_ext_free(TS_TST_INFO *a)
383{
384 if (!a)
385 return;
386 sk_X509_EXTENSION_pop_free(a->extensions, X509_EXTENSION_free);
387 a->extensions = NULL;
388}
389
390int
391TS_TST_INFO_get_ext_count(TS_TST_INFO *a)
392{
393 return X509v3_get_ext_count(a->extensions);
394}
395
396int
397TS_TST_INFO_get_ext_by_NID(TS_TST_INFO *a, int nid, int lastpos)
398{
399 return X509v3_get_ext_by_NID(a->extensions, nid, lastpos);
400}
401
402int
403TS_TST_INFO_get_ext_by_OBJ(TS_TST_INFO *a, ASN1_OBJECT *obj, int lastpos)
404{
405 return X509v3_get_ext_by_OBJ(a->extensions, obj, lastpos);
406}
407
408int
409TS_TST_INFO_get_ext_by_critical(TS_TST_INFO *a, int crit, int lastpos)
410{
411 return X509v3_get_ext_by_critical(a->extensions, crit, lastpos);
412}
413
414X509_EXTENSION *
415TS_TST_INFO_get_ext(TS_TST_INFO *a, int loc)
416{
417 return X509v3_get_ext(a->extensions, loc);
418}
419
420X509_EXTENSION *
421TS_TST_INFO_delete_ext(TS_TST_INFO *a, int loc)
422{
423 return X509v3_delete_ext(a->extensions, loc);
424}
425
426int
427TS_TST_INFO_add_ext(TS_TST_INFO *a, X509_EXTENSION *ex, int loc)
428{
429 return X509v3_add_ext(&a->extensions, ex, loc) != NULL;
430}
431
432void *
433TS_TST_INFO_get_ext_d2i(TS_TST_INFO *a, int nid, int *crit, int *idx)
434{
435 return X509V3_get_d2i(a->extensions, nid, crit, idx);
436}
diff --git a/src/lib/libcrypto/ts/ts_rsp_verify.c b/src/lib/libcrypto/ts/ts_rsp_verify.c
deleted file mode 100644
index 204c6a9df8..0000000000
--- a/src/lib/libcrypto/ts/ts_rsp_verify.c
+++ /dev/null
@@ -1,745 +0,0 @@
1/* $OpenBSD: ts_rsp_verify.c,v 1.16 2015/07/19 18:25:59 miod Exp $ */
2/* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL
3 * project 2002.
4 */
5/* ====================================================================
6 * Copyright (c) 2006 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <stdio.h>
60#include <string.h>
61
62#include <openssl/err.h>
63#include <openssl/objects.h>
64#include <openssl/pkcs7.h>
65#include <openssl/ts.h>
66
67/* Private function declarations. */
68
69static int TS_verify_cert(X509_STORE *store, STACK_OF(X509) *untrusted,
70 X509 *signer, STACK_OF(X509) **chain);
71static int TS_check_signing_certs(PKCS7_SIGNER_INFO *si, STACK_OF(X509) *chain);
72static ESS_SIGNING_CERT *ESS_get_signing_cert(PKCS7_SIGNER_INFO *si);
73static int TS_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert);
74static int TS_issuer_serial_cmp(ESS_ISSUER_SERIAL *is, X509_CINF *cinfo);
75static int int_TS_RESP_verify_token(TS_VERIFY_CTX *ctx,
76 PKCS7 *token, TS_TST_INFO *tst_info);
77static int TS_check_status_info(TS_RESP *response);
78static char *TS_get_status_text(STACK_OF(ASN1_UTF8STRING) *text);
79static int TS_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info);
80static int TS_compute_imprint(BIO *data, TS_TST_INFO *tst_info,
81 X509_ALGOR **md_alg,
82 unsigned char **imprint, unsigned *imprint_len);
83static int TS_check_imprints(X509_ALGOR *algor_a,
84 unsigned char *imprint_a, unsigned len_a,
85 TS_TST_INFO *tst_info);
86static int TS_check_nonces(const ASN1_INTEGER *a, TS_TST_INFO *tst_info);
87static int TS_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer);
88static int TS_find_name(STACK_OF(GENERAL_NAME) *gen_names, GENERAL_NAME *name);
89
90/*
91 * Local mapping between response codes and descriptions.
92 * Don't forget to change TS_STATUS_BUF_SIZE when modifying
93 * the elements of this array.
94 */
95static const char *TS_status_text[] = {
96 "granted",
97 "grantedWithMods",
98 "rejection",
99 "waiting",
100 "revocationWarning",
101 "revocationNotification"
102};
103
104#define TS_STATUS_TEXT_SIZE (sizeof(TS_status_text)/sizeof(*TS_status_text))
105
106/*
107 * This must be greater or equal to the sum of the strings in TS_status_text
108 * plus the number of its elements.
109 */
110#define TS_STATUS_BUF_SIZE 256
111
112static struct {
113 int code;
114 const char *text;
115} TS_failure_info[] = {
116 { TS_INFO_BAD_ALG, "badAlg" },
117 { TS_INFO_BAD_REQUEST, "badRequest" },
118 { TS_INFO_BAD_DATA_FORMAT, "badDataFormat" },
119 { TS_INFO_TIME_NOT_AVAILABLE, "timeNotAvailable" },
120 { TS_INFO_UNACCEPTED_POLICY, "unacceptedPolicy" },
121 { TS_INFO_UNACCEPTED_EXTENSION, "unacceptedExtension" },
122 { TS_INFO_ADD_INFO_NOT_AVAILABLE, "addInfoNotAvailable" },
123 { TS_INFO_SYSTEM_FAILURE, "systemFailure" }
124};
125
126#define TS_FAILURE_INFO_SIZE (sizeof(TS_failure_info) / \
127 sizeof(*TS_failure_info))
128
129/* Functions for verifying a signed TS_TST_INFO structure. */
130
131/*
132 * This function carries out the following tasks:
133 * - Checks if there is one and only one signer.
134 * - Search for the signing certificate in 'certs' and in the response.
135 * - Check the extended key usage and key usage fields of the signer
136 * certificate (done by the path validation).
137 * - Build and validate the certificate path.
138 * - Check if the certificate path meets the requirements of the
139 * SigningCertificate ESS signed attribute.
140 * - Verify the signature value.
141 * - Returns the signer certificate in 'signer', if 'signer' is not NULL.
142 */
143int
144TS_RESP_verify_signature(PKCS7 *token, STACK_OF(X509) *certs,
145 X509_STORE *store, X509 **signer_out)
146{
147 STACK_OF(PKCS7_SIGNER_INFO) *sinfos = NULL;
148 PKCS7_SIGNER_INFO *si;
149 STACK_OF(X509) *signers = NULL;
150 X509 *signer;
151 STACK_OF(X509) *chain = NULL;
152 char buf[4096];
153 int i, j = 0, ret = 0;
154 BIO *p7bio = NULL;
155
156 /* Some sanity checks first. */
157 if (!token) {
158 TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_INVALID_NULL_POINTER);
159 goto err;
160 }
161
162 /* Check for the correct content type */
163 if (!PKCS7_type_is_signed(token)) {
164 TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_WRONG_CONTENT_TYPE);
165 goto err;
166 }
167
168 /* Check if there is one and only one signer. */
169 sinfos = PKCS7_get_signer_info(token);
170 if (!sinfos || sk_PKCS7_SIGNER_INFO_num(sinfos) != 1) {
171 TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE,
172 TS_R_THERE_MUST_BE_ONE_SIGNER);
173 goto err;
174 }
175 si = sk_PKCS7_SIGNER_INFO_value(sinfos, 0);
176
177 /* Check for no content: no data to verify signature. */
178 if (PKCS7_get_detached(token)) {
179 TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_NO_CONTENT);
180 goto err;
181 }
182
183 /* Get hold of the signer certificate, search only internal
184 certificates if it was requested. */
185 signers = PKCS7_get0_signers(token, certs, 0);
186 if (!signers || sk_X509_num(signers) != 1)
187 goto err;
188 signer = sk_X509_value(signers, 0);
189
190 /* Now verify the certificate. */
191 if (!TS_verify_cert(store, certs, signer, &chain))
192 goto err;
193
194 /* Check if the signer certificate is consistent with the
195 ESS extension. */
196 if (!TS_check_signing_certs(si, chain))
197 goto err;
198
199 /* Creating the message digest. */
200 p7bio = PKCS7_dataInit(token, NULL);
201
202 /* We now have to 'read' from p7bio to calculate digests etc. */
203 while ((i = BIO_read(p7bio, buf, sizeof(buf))) > 0)
204 ;
205
206 /* Verifying the signature. */
207 j = PKCS7_signatureVerify(p7bio, token, si, signer);
208 if (j <= 0) {
209 TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_SIGNATURE_FAILURE);
210 goto err;
211 }
212
213 /* Return the signer certificate if needed. */
214 if (signer_out) {
215 *signer_out = signer;
216 CRYPTO_add(&signer->references, 1, CRYPTO_LOCK_X509);
217 }
218
219 ret = 1;
220
221err:
222 BIO_free_all(p7bio);
223 sk_X509_pop_free(chain, X509_free);
224 sk_X509_free(signers);
225
226 return ret;
227}
228
229/*
230 * The certificate chain is returned in chain. Caller is responsible for
231 * freeing the vector.
232 */
233static int
234TS_verify_cert(X509_STORE *store, STACK_OF(X509) *untrusted, X509 *signer,
235 STACK_OF(X509) **chain)
236{
237 X509_STORE_CTX cert_ctx;
238 int i;
239 int ret = 0;
240
241 /* chain is an out argument. */
242 *chain = NULL;
243 if (X509_STORE_CTX_init(&cert_ctx, store, signer, untrusted) == 0) {
244 TSerr(TS_F_TS_VERIFY_CERT, ERR_R_X509_LIB);
245 goto err;
246 }
247 X509_STORE_CTX_set_purpose(&cert_ctx, X509_PURPOSE_TIMESTAMP_SIGN);
248 i = X509_verify_cert(&cert_ctx);
249 if (i <= 0) {
250 int j = X509_STORE_CTX_get_error(&cert_ctx);
251
252 TSerr(TS_F_TS_VERIFY_CERT, TS_R_CERTIFICATE_VERIFY_ERROR);
253 ERR_asprintf_error_data("Verify error:%s",
254 X509_verify_cert_error_string(j));
255 goto err;
256 } else {
257 /* Get a copy of the certificate chain. */
258 *chain = X509_STORE_CTX_get1_chain(&cert_ctx);
259 ret = 1;
260 }
261
262err:
263 X509_STORE_CTX_cleanup(&cert_ctx);
264
265 return ret;
266}
267
268static int
269TS_check_signing_certs(PKCS7_SIGNER_INFO *si, STACK_OF(X509) *chain)
270{
271 ESS_SIGNING_CERT *ss = ESS_get_signing_cert(si);
272 STACK_OF(ESS_CERT_ID) *cert_ids = NULL;
273 X509 *cert;
274 int i = 0;
275 int ret = 0;
276
277 if (!ss)
278 goto err;
279 cert_ids = ss->cert_ids;
280 /* The signer certificate must be the first in cert_ids. */
281 cert = sk_X509_value(chain, 0);
282 if (TS_find_cert(cert_ids, cert) != 0)
283 goto err;
284
285 /* Check the other certificates of the chain if there are more
286 than one certificate ids in cert_ids. */
287 if (sk_ESS_CERT_ID_num(cert_ids) > 1) {
288 /* All the certificates of the chain must be in cert_ids. */
289 for (i = 1; i < sk_X509_num(chain); ++i) {
290 cert = sk_X509_value(chain, i);
291 if (TS_find_cert(cert_ids, cert) < 0)
292 goto err;
293 }
294 }
295 ret = 1;
296
297err:
298 if (!ret)
299 TSerr(TS_F_TS_CHECK_SIGNING_CERTS,
300 TS_R_ESS_SIGNING_CERTIFICATE_ERROR);
301 ESS_SIGNING_CERT_free(ss);
302 return ret;
303}
304
305static ESS_SIGNING_CERT *
306ESS_get_signing_cert(PKCS7_SIGNER_INFO *si)
307{
308 ASN1_TYPE *attr;
309 const unsigned char *p;
310
311 attr = PKCS7_get_signed_attribute(si,
312 NID_id_smime_aa_signingCertificate);
313 if (!attr)
314 return NULL;
315 if (attr->type != V_ASN1_SEQUENCE)
316 return NULL;
317 p = attr->value.sequence->data;
318 return d2i_ESS_SIGNING_CERT(NULL, &p, attr->value.sequence->length);
319}
320
321/* Returns < 0 if certificate is not found, certificate index otherwise. */
322static int
323TS_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert)
324{
325 int i;
326
327 if (!cert_ids || !cert)
328 return -1;
329
330 /* Recompute SHA1 hash of certificate if necessary (side effect). */
331 X509_check_purpose(cert, -1, 0);
332
333 /* Look for cert in the cert_ids vector. */
334 for (i = 0; i < sk_ESS_CERT_ID_num(cert_ids); ++i) {
335 ESS_CERT_ID *cid = sk_ESS_CERT_ID_value(cert_ids, i);
336
337 /* Check the SHA-1 hash first. */
338 if (cid->hash->length == sizeof(cert->sha1_hash) &&
339 !memcmp(cid->hash->data, cert->sha1_hash,
340 sizeof(cert->sha1_hash))) {
341 /* Check the issuer/serial as well if specified. */
342 ESS_ISSUER_SERIAL *is = cid->issuer_serial;
343 if (!is || !TS_issuer_serial_cmp(is, cert->cert_info))
344 return i;
345 }
346 }
347
348 return -1;
349}
350
351static int
352TS_issuer_serial_cmp(ESS_ISSUER_SERIAL *is, X509_CINF *cinfo)
353{
354 GENERAL_NAME *issuer;
355
356 if (!is || !cinfo || sk_GENERAL_NAME_num(is->issuer) != 1)
357 return -1;
358
359 /* Check the issuer first. It must be a directory name. */
360 issuer = sk_GENERAL_NAME_value(is->issuer, 0);
361 if (issuer->type != GEN_DIRNAME ||
362 X509_NAME_cmp(issuer->d.dirn, cinfo->issuer))
363 return -1;
364
365 /* Check the serial number, too. */
366 if (ASN1_INTEGER_cmp(is->serial, cinfo->serialNumber))
367 return -1;
368
369 return 0;
370}
371
372/*
373 * Verifies whether 'response' contains a valid response with regards
374 * to the settings of the context:
375 * - Gives an error message if the TS_TST_INFO is not present.
376 * - Calls _TS_RESP_verify_token to verify the token content.
377 */
378int
379TS_RESP_verify_response(TS_VERIFY_CTX *ctx, TS_RESP *response)
380{
381 PKCS7 *token = TS_RESP_get_token(response);
382 TS_TST_INFO *tst_info = TS_RESP_get_tst_info(response);
383 int ret = 0;
384
385 /* Check if we have a successful TS_TST_INFO object in place. */
386 if (!TS_check_status_info(response))
387 goto err;
388
389 /* Check the contents of the time stamp token. */
390 if (!int_TS_RESP_verify_token(ctx, token, tst_info))
391 goto err;
392
393 ret = 1;
394
395err:
396 return ret;
397}
398
399/*
400 * Tries to extract a TS_TST_INFO structure from the PKCS7 token and
401 * calls the internal int_TS_RESP_verify_token function for verifying it.
402 */
403int
404TS_RESP_verify_token(TS_VERIFY_CTX *ctx, PKCS7 *token)
405{
406 TS_TST_INFO *tst_info = PKCS7_to_TS_TST_INFO(token);
407 int ret = 0;
408
409 if (tst_info) {
410 ret = int_TS_RESP_verify_token(ctx, token, tst_info);
411 TS_TST_INFO_free(tst_info);
412 }
413 return ret;
414}
415
416/*
417 * Verifies whether the 'token' contains a valid time stamp token
418 * with regards to the settings of the context. Only those checks are
419 * carried out that are specified in the context:
420 * - Verifies the signature of the TS_TST_INFO.
421 * - Checks the version number of the response.
422 * - Check if the requested and returned policies math.
423 * - Check if the message imprints are the same.
424 * - Check if the nonces are the same.
425 * - Check if the TSA name matches the signer.
426 * - Check if the TSA name is the expected TSA.
427 */
428static int
429int_TS_RESP_verify_token(TS_VERIFY_CTX *ctx, PKCS7 *token,
430 TS_TST_INFO *tst_info)
431{
432 X509 *signer = NULL;
433 GENERAL_NAME *tsa_name = TS_TST_INFO_get_tsa(tst_info);
434 X509_ALGOR *md_alg = NULL;
435 unsigned char *imprint = NULL;
436 unsigned imprint_len = 0;
437 int ret = 0;
438
439 /* Verify the signature. */
440 if ((ctx->flags & TS_VFY_SIGNATURE) &&
441 !TS_RESP_verify_signature(token, ctx->certs, ctx->store, &signer))
442 goto err;
443
444 /* Check version number of response. */
445 if ((ctx->flags & TS_VFY_VERSION) &&
446 TS_TST_INFO_get_version(tst_info) != 1) {
447 TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_UNSUPPORTED_VERSION);
448 goto err;
449 }
450
451 /* Check policies. */
452 if ((ctx->flags & TS_VFY_POLICY) &&
453 !TS_check_policy(ctx->policy, tst_info))
454 goto err;
455
456 /* Check message imprints. */
457 if ((ctx->flags & TS_VFY_IMPRINT) &&
458 !TS_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len,
459 tst_info))
460 goto err;
461
462 /* Compute and check message imprints. */
463 if ((ctx->flags & TS_VFY_DATA) &&
464 (!TS_compute_imprint(ctx->data, tst_info,
465 &md_alg, &imprint, &imprint_len) ||
466 !TS_check_imprints(md_alg, imprint, imprint_len, tst_info)))
467 goto err;
468
469 /* Check nonces. */
470 if ((ctx->flags & TS_VFY_NONCE) &&
471 !TS_check_nonces(ctx->nonce, tst_info))
472 goto err;
473
474 /* Check whether TSA name and signer certificate match. */
475 if ((ctx->flags & TS_VFY_SIGNER) &&
476 tsa_name && !TS_check_signer_name(tsa_name, signer)) {
477 TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_NAME_MISMATCH);
478 goto err;
479 }
480
481 /* Check whether the TSA is the expected one. */
482 if ((ctx->flags & TS_VFY_TSA_NAME) &&
483 !TS_check_signer_name(ctx->tsa_name, signer)) {
484 TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_UNTRUSTED);
485 goto err;
486 }
487
488 ret = 1;
489
490err:
491 X509_free(signer);
492 X509_ALGOR_free(md_alg);
493 free(imprint);
494 return ret;
495}
496
497static int
498TS_check_status_info(TS_RESP *response)
499{
500 TS_STATUS_INFO *info = TS_RESP_get_status_info(response);
501 long status = ASN1_INTEGER_get(info->status);
502 const char *status_text = NULL;
503 char *embedded_status_text = NULL;
504 char failure_text[TS_STATUS_BUF_SIZE] = "";
505
506 /* Check if everything went fine. */
507 if (status == 0 || status == 1)
508 return 1;
509
510 /* There was an error, get the description in status_text. */
511 if (0 <= status && status < (long)TS_STATUS_TEXT_SIZE)
512 status_text = TS_status_text[status];
513 else
514 status_text = "unknown code";
515
516 /* Set the embedded_status_text to the returned description. */
517 if (sk_ASN1_UTF8STRING_num(info->text) > 0 &&
518 !(embedded_status_text = TS_get_status_text(info->text)))
519 return 0;
520
521 /* Filling in failure_text with the failure information. */
522 if (info->failure_info) {
523 int i;
524 int first = 1;
525 for (i = 0; i < (int)TS_FAILURE_INFO_SIZE; ++i) {
526 if (ASN1_BIT_STRING_get_bit(info->failure_info,
527 TS_failure_info[i].code)) {
528 if (!first)
529 strlcat(failure_text, ",",
530 TS_STATUS_BUF_SIZE);
531 else
532 first = 0;
533 strlcat(failure_text, TS_failure_info[i].text,
534 TS_STATUS_BUF_SIZE);
535 }
536 }
537 }
538 if (failure_text[0] == '\0')
539 strlcpy(failure_text, "unspecified", TS_STATUS_BUF_SIZE);
540
541 /* Making up the error string. */
542 TSerr(TS_F_TS_CHECK_STATUS_INFO, TS_R_NO_TIME_STAMP_TOKEN);
543 ERR_asprintf_error_data
544 ("status code: %s, status text: %s, failure codes: %s",
545 status_text,
546 embedded_status_text ? embedded_status_text : "unspecified",
547 failure_text);
548 free(embedded_status_text);
549
550 return 0;
551}
552
553static char *
554TS_get_status_text(STACK_OF(ASN1_UTF8STRING) *text)
555{
556 int i;
557 unsigned int length = 0;
558 char *result = NULL;
559
560 /* Determine length first. */
561 for (i = 0; i < sk_ASN1_UTF8STRING_num(text); ++i) {
562 ASN1_UTF8STRING *current = sk_ASN1_UTF8STRING_value(text, i);
563 length += ASN1_STRING_length(current);
564 length += 1; /* separator character */
565 }
566 /* Allocate memory (closing '\0' included). */
567 if (!(result = malloc(length))) {
568 TSerr(TS_F_TS_GET_STATUS_TEXT, ERR_R_MALLOC_FAILURE);
569 return NULL;
570 }
571 /* Concatenate the descriptions. */
572 result[0] = '\0';
573 for (i = 0; i < sk_ASN1_UTF8STRING_num(text); ++i) {
574 ASN1_UTF8STRING *current = sk_ASN1_UTF8STRING_value(text, i);
575 if (i > 0)
576 strlcat(result, "/", length);
577 strlcat(result, (const char *)ASN1_STRING_data(current), length);
578 }
579 return result;
580}
581
582static int
583TS_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info)
584{
585 ASN1_OBJECT *resp_oid = TS_TST_INFO_get_policy_id(tst_info);
586
587 if (OBJ_cmp(req_oid, resp_oid) != 0) {
588 TSerr(TS_F_TS_CHECK_POLICY, TS_R_POLICY_MISMATCH);
589 return 0;
590 }
591
592 return 1;
593}
594
595static int
596TS_compute_imprint(BIO *data, TS_TST_INFO *tst_info, X509_ALGOR **md_alg,
597 unsigned char **imprint, unsigned *imprint_len)
598{
599 TS_MSG_IMPRINT *msg_imprint = TS_TST_INFO_get_msg_imprint(tst_info);
600 X509_ALGOR *md_alg_resp = TS_MSG_IMPRINT_get_algo(msg_imprint);
601 const EVP_MD *md;
602 EVP_MD_CTX md_ctx;
603 unsigned char buffer[4096];
604 int length;
605
606 *md_alg = NULL;
607 *imprint = NULL;
608
609 /* Return the MD algorithm of the response. */
610 if (!(*md_alg = X509_ALGOR_dup(md_alg_resp)))
611 goto err;
612
613 /* Getting the MD object. */
614 if (!(md = EVP_get_digestbyobj((*md_alg)->algorithm))) {
615 TSerr(TS_F_TS_COMPUTE_IMPRINT, TS_R_UNSUPPORTED_MD_ALGORITHM);
616 goto err;
617 }
618
619 /* Compute message digest. */
620 length = EVP_MD_size(md);
621 if (length < 0)
622 goto err;
623 *imprint_len = length;
624 if (!(*imprint = malloc(*imprint_len))) {
625 TSerr(TS_F_TS_COMPUTE_IMPRINT, ERR_R_MALLOC_FAILURE);
626 goto err;
627 }
628
629 if (!EVP_DigestInit(&md_ctx, md))
630 goto err;
631 while ((length = BIO_read(data, buffer, sizeof(buffer))) > 0) {
632 if (!EVP_DigestUpdate(&md_ctx, buffer, length))
633 goto err;
634 }
635 if (!EVP_DigestFinal(&md_ctx, *imprint, NULL))
636 goto err;
637
638 return 1;
639
640err:
641 X509_ALGOR_free(*md_alg);
642 free(*imprint);
643 *imprint = NULL;
644 *imprint_len = 0;
645 return 0;
646}
647
648static int
649TS_check_imprints(X509_ALGOR *algor_a, unsigned char *imprint_a, unsigned len_a,
650 TS_TST_INFO *tst_info)
651{
652 TS_MSG_IMPRINT *b = TS_TST_INFO_get_msg_imprint(tst_info);
653 X509_ALGOR *algor_b = TS_MSG_IMPRINT_get_algo(b);
654 int ret = 0;
655
656 /* algor_a is optional. */
657 if (algor_a) {
658 /* Compare algorithm OIDs. */
659 if (OBJ_cmp(algor_a->algorithm, algor_b->algorithm))
660 goto err;
661
662 /* The parameter must be NULL in both. */
663 if ((algor_a->parameter &&
664 ASN1_TYPE_get(algor_a->parameter) != V_ASN1_NULL) ||
665 (algor_b->parameter &&
666 ASN1_TYPE_get(algor_b->parameter) != V_ASN1_NULL))
667 goto err;
668 }
669
670 /* Compare octet strings. */
671 ret = len_a == (unsigned) ASN1_STRING_length(b->hashed_msg) &&
672 memcmp(imprint_a, ASN1_STRING_data(b->hashed_msg), len_a) == 0;
673
674err:
675 if (!ret)
676 TSerr(TS_F_TS_CHECK_IMPRINTS, TS_R_MESSAGE_IMPRINT_MISMATCH);
677 return ret;
678}
679
680static int
681TS_check_nonces(const ASN1_INTEGER *a, TS_TST_INFO *tst_info)
682{
683 const ASN1_INTEGER *b = TS_TST_INFO_get_nonce(tst_info);
684
685 /* Error if nonce is missing. */
686 if (!b) {
687 TSerr(TS_F_TS_CHECK_NONCES, TS_R_NONCE_NOT_RETURNED);
688 return 0;
689 }
690
691 /* No error if a nonce is returned without being requested. */
692 if (ASN1_INTEGER_cmp(a, b) != 0) {
693 TSerr(TS_F_TS_CHECK_NONCES, TS_R_NONCE_MISMATCH);
694 return 0;
695 }
696
697 return 1;
698}
699
700/* Check if the specified TSA name matches either the subject
701 or one of the subject alternative names of the TSA certificate. */
702static int
703TS_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer)
704{
705 STACK_OF(GENERAL_NAME) *gen_names = NULL;
706 int idx = -1;
707 int found = 0;
708
709 if (signer == NULL)
710 return 0;
711
712 /* Check the subject name first. */
713 if (tsa_name->type == GEN_DIRNAME &&
714 X509_name_cmp(tsa_name->d.dirn, signer->cert_info->subject) == 0)
715 return 1;
716
717 /* Check all the alternative names. */
718 gen_names = X509_get_ext_d2i(signer, NID_subject_alt_name,
719 NULL, &idx);
720 while (gen_names != NULL &&
721 !(found = (TS_find_name(gen_names, tsa_name) >= 0))) {
722 /* Get the next subject alternative name,
723 although there should be no more than one. */
724 GENERAL_NAMES_free(gen_names);
725 gen_names = X509_get_ext_d2i(signer, NID_subject_alt_name,
726 NULL, &idx);
727 }
728 if (gen_names)
729 GENERAL_NAMES_free(gen_names);
730
731 return found;
732}
733
734/* Returns 1 if name is in gen_names, 0 otherwise. */
735static int
736TS_find_name(STACK_OF(GENERAL_NAME) *gen_names, GENERAL_NAME *name)
737{
738 int i, found;
739 for (i = 0, found = 0; !found && i < sk_GENERAL_NAME_num(gen_names);
740 ++i) {
741 GENERAL_NAME *current = sk_GENERAL_NAME_value(gen_names, i);
742 found = GENERAL_NAME_cmp(current, name) == 0;
743 }
744 return found ? i - 1 : -1;
745}
diff --git a/src/lib/libcrypto/ts/ts_verify_ctx.c b/src/lib/libcrypto/ts/ts_verify_ctx.c
deleted file mode 100644
index 7dda76e7d9..0000000000
--- a/src/lib/libcrypto/ts/ts_verify_ctx.c
+++ /dev/null
@@ -1,166 +0,0 @@
1/* $OpenBSD: ts_verify_ctx.c,v 1.8 2015/02/10 09:46:30 miod Exp $ */
2/* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL
3 * project 2003.
4 */
5/* ====================================================================
6 * Copyright (c) 2006 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <string.h>
60
61#include <openssl/err.h>
62#include <openssl/objects.h>
63#include <openssl/ts.h>
64
65TS_VERIFY_CTX *
66TS_VERIFY_CTX_new(void)
67{
68 TS_VERIFY_CTX *ctx = calloc(1, sizeof(TS_VERIFY_CTX));
69
70 if (!ctx)
71 TSerr(TS_F_TS_VERIFY_CTX_NEW, ERR_R_MALLOC_FAILURE);
72
73 return ctx;
74}
75
76void
77TS_VERIFY_CTX_init(TS_VERIFY_CTX *ctx)
78{
79 memset(ctx, 0, sizeof(TS_VERIFY_CTX));
80}
81
82void
83TS_VERIFY_CTX_free(TS_VERIFY_CTX *ctx)
84{
85 if (!ctx)
86 return;
87
88 TS_VERIFY_CTX_cleanup(ctx);
89 free(ctx);
90}
91
92void
93TS_VERIFY_CTX_cleanup(TS_VERIFY_CTX *ctx)
94{
95 if (!ctx)
96 return;
97
98 X509_STORE_free(ctx->store);
99 sk_X509_pop_free(ctx->certs, X509_free);
100
101 ASN1_OBJECT_free(ctx->policy);
102
103 X509_ALGOR_free(ctx->md_alg);
104 free(ctx->imprint);
105
106 BIO_free_all(ctx->data);
107
108 ASN1_INTEGER_free(ctx->nonce);
109
110 GENERAL_NAME_free(ctx->tsa_name);
111
112 TS_VERIFY_CTX_init(ctx);
113}
114
115TS_VERIFY_CTX *
116TS_REQ_to_TS_VERIFY_CTX(TS_REQ *req, TS_VERIFY_CTX *ctx)
117{
118 TS_VERIFY_CTX *ret = ctx;
119 ASN1_OBJECT *policy;
120 TS_MSG_IMPRINT *imprint;
121 X509_ALGOR *md_alg;
122 ASN1_OCTET_STRING *msg;
123 const ASN1_INTEGER *nonce;
124
125 if (ret)
126 TS_VERIFY_CTX_cleanup(ret);
127 else if (!(ret = TS_VERIFY_CTX_new()))
128 return NULL;
129
130 /* Setting flags. */
131 ret->flags = TS_VFY_ALL_IMPRINT & ~(TS_VFY_TSA_NAME | TS_VFY_SIGNATURE);
132
133 /* Setting policy. */
134 if ((policy = TS_REQ_get_policy_id(req)) != NULL) {
135 if (!(ret->policy = OBJ_dup(policy)))
136 goto err;
137 } else
138 ret->flags &= ~TS_VFY_POLICY;
139
140 /* Setting md_alg, imprint and imprint_len. */
141 imprint = TS_REQ_get_msg_imprint(req);
142 md_alg = TS_MSG_IMPRINT_get_algo(imprint);
143 if (!(ret->md_alg = X509_ALGOR_dup(md_alg)))
144 goto err;
145 msg = TS_MSG_IMPRINT_get_msg(imprint);
146 ret->imprint_len = ASN1_STRING_length(msg);
147 if (!(ret->imprint = malloc(ret->imprint_len)))
148 goto err;
149 memcpy(ret->imprint, ASN1_STRING_data(msg), ret->imprint_len);
150
151 /* Setting nonce. */
152 if ((nonce = TS_REQ_get_nonce(req)) != NULL) {
153 if (!(ret->nonce = ASN1_INTEGER_dup(nonce)))
154 goto err;
155 } else
156 ret->flags &= ~TS_VFY_NONCE;
157
158 return ret;
159
160err:
161 if (ctx)
162 TS_VERIFY_CTX_cleanup(ctx);
163 else
164 TS_VERIFY_CTX_free(ret);
165 return NULL;
166}
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-05-09 04:44:38 +0000