From eb8dd9dca1228af0cd132f515509051ecfabf6f6 Mon Sep 17 00:00:00 2001 From: cvs2svn Date: Mon, 14 Apr 2025 17:32:06 +0000 Subject: This commit was manufactured by cvs2git to create tag 'tb_20250414'. --- src/lib/libcrypto/ts/ts.h | 660 --------------------- src/lib/libcrypto/ts/ts_asn1.c | 1077 ---------------------------------- src/lib/libcrypto/ts/ts_conf.c | 517 ---------------- src/lib/libcrypto/ts/ts_err.c | 126 ---- src/lib/libcrypto/ts/ts_lib.c | 163 ----- src/lib/libcrypto/ts/ts_local.h | 316 ---------- src/lib/libcrypto/ts/ts_req_print.c | 105 ---- src/lib/libcrypto/ts/ts_req_utils.c | 281 --------- src/lib/libcrypto/ts/ts_rsp_print.c | 306 ---------- src/lib/libcrypto/ts/ts_rsp_sign.c | 982 ------------------------------- src/lib/libcrypto/ts/ts_rsp_utils.c | 503 ---------------- src/lib/libcrypto/ts/ts_rsp_verify.c | 847 -------------------------- src/lib/libcrypto/ts/ts_verify_ctx.c | 236 -------- 13 files changed, 6119 deletions(-) delete mode 100644 src/lib/libcrypto/ts/ts.h delete mode 100644 src/lib/libcrypto/ts/ts_asn1.c delete mode 100644 src/lib/libcrypto/ts/ts_conf.c delete mode 100644 src/lib/libcrypto/ts/ts_err.c delete mode 100644 src/lib/libcrypto/ts/ts_lib.c delete mode 100644 src/lib/libcrypto/ts/ts_local.h delete mode 100644 src/lib/libcrypto/ts/ts_req_print.c delete mode 100644 src/lib/libcrypto/ts/ts_req_utils.c delete mode 100644 src/lib/libcrypto/ts/ts_rsp_print.c delete mode 100644 src/lib/libcrypto/ts/ts_rsp_sign.c delete mode 100644 src/lib/libcrypto/ts/ts_rsp_utils.c delete mode 100644 src/lib/libcrypto/ts/ts_rsp_verify.c delete mode 100644 src/lib/libcrypto/ts/ts_verify_ctx.c (limited to 'src/lib/libcrypto/ts') diff --git a/src/lib/libcrypto/ts/ts.h b/src/lib/libcrypto/ts/ts.h deleted file mode 100644 index c2b2a9ed3d..0000000000 --- a/src/lib/libcrypto/ts/ts.h +++ /dev/null @@ -1,660 +0,0 @@ -/* $OpenBSD: ts.h,v 1.24 2024/03/26 00:39:22 beck Exp $ */ -/* Written by Zoltan Glozik (zglozik@opentsa.org) for the OpenSSL - * project 2002, 2003, 2004. - */ -/* ==================================================================== - * Copyright (c) 2006 The OpenSSL Project. All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in - * the documentation and/or other materials provided with the - * distribution. - * - * 3. All advertising materials mentioning features or use of this - * software must display the following acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" - * - * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to - * endorse or promote products derived from this software without - * prior written permission. For written permission, please contact - * licensing@OpenSSL.org. - * - * 5. Products derived from this software may not be called "OpenSSL" - * nor may "OpenSSL" appear in their names without prior written - * permission of the OpenSSL Project. - * - * 6. Redistributions of any form whatsoever must retain the following - * acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" - * - * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY - * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR - * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR - * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT - * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; - * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, - * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED - * OF THE POSSIBILITY OF SUCH DAMAGE. - * ==================================================================== - * - * This product includes cryptographic software written by Eric Young - * (eay@cryptsoft.com). This product includes software written by Tim - * Hudson (tjh@cryptsoft.com). - * - */ - -#ifndef HEADER_TS_H -#define HEADER_TS_H - -#include - -#ifndef OPENSSL_NO_BUFFER -#include -#endif -#ifndef OPENSSL_NO_EVP -#include -#endif -#ifndef OPENSSL_NO_BIO -#include -#endif -#include -#include -#include - -#ifndef OPENSSL_NO_RSA -#include -#endif - -#ifndef OPENSSL_NO_DSA -#include -#endif - -#ifndef OPENSSL_NO_DH -#include -#endif - -#ifdef __cplusplus -extern "C" { -#endif - -#include -#include - -typedef struct TS_msg_imprint_st TS_MSG_IMPRINT; -typedef struct TS_req_st TS_REQ; -typedef struct TS_accuracy_st TS_ACCURACY; -typedef struct TS_tst_info_st TS_TST_INFO; - -/* Possible values for status. */ -#define TS_STATUS_GRANTED 0 -#define TS_STATUS_GRANTED_WITH_MODS 1 -#define TS_STATUS_REJECTION 2 -#define TS_STATUS_WAITING 3 -#define TS_STATUS_REVOCATION_WARNING 4 -#define TS_STATUS_REVOCATION_NOTIFICATION 5 - -/* Possible values for failure_info. */ -#define TS_INFO_BAD_ALG 0 -#define TS_INFO_BAD_REQUEST 2 -#define TS_INFO_BAD_DATA_FORMAT 5 -#define TS_INFO_TIME_NOT_AVAILABLE 14 -#define TS_INFO_UNACCEPTED_POLICY 15 -#define TS_INFO_UNACCEPTED_EXTENSION 16 -#define TS_INFO_ADD_INFO_NOT_AVAILABLE 17 -#define TS_INFO_SYSTEM_FAILURE 25 - -typedef struct TS_status_info_st TS_STATUS_INFO; - -DECLARE_STACK_OF(ASN1_UTF8STRING) - -typedef struct ESS_issuer_serial ESS_ISSUER_SERIAL; -typedef struct ESS_cert_id ESS_CERT_ID; -DECLARE_STACK_OF(ESS_CERT_ID) -typedef struct ESS_signing_cert ESS_SIGNING_CERT; - -typedef struct ESS_cert_id_v2 ESS_CERT_ID_V2; -DECLARE_STACK_OF(ESS_CERT_ID_V2) - -typedef struct ESS_signing_cert_v2 ESS_SIGNING_CERT_V2; - -typedef struct TS_resp_st TS_RESP; - -TS_REQ *TS_REQ_new(void); -void TS_REQ_free(TS_REQ *a); -int i2d_TS_REQ(const TS_REQ *a, unsigned char **pp); -TS_REQ *d2i_TS_REQ(TS_REQ **a, const unsigned char **pp, long length); - -TS_REQ *TS_REQ_dup(TS_REQ *a); - -TS_REQ *d2i_TS_REQ_fp(FILE *fp, TS_REQ **a); -int i2d_TS_REQ_fp(FILE *fp, TS_REQ *a); -TS_REQ *d2i_TS_REQ_bio(BIO *fp, TS_REQ **a); -int i2d_TS_REQ_bio(BIO *fp, TS_REQ *a); - -TS_MSG_IMPRINT *TS_MSG_IMPRINT_new(void); -void TS_MSG_IMPRINT_free(TS_MSG_IMPRINT *a); -int i2d_TS_MSG_IMPRINT(const TS_MSG_IMPRINT *a, unsigned char **pp); -TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT(TS_MSG_IMPRINT **a, - const unsigned char **pp, long length); - -TS_MSG_IMPRINT *TS_MSG_IMPRINT_dup(TS_MSG_IMPRINT *a); - -TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT **a); -int i2d_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT *a); -TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_bio(BIO *fp, TS_MSG_IMPRINT **a); -int i2d_TS_MSG_IMPRINT_bio(BIO *fp, TS_MSG_IMPRINT *a); - -TS_RESP *TS_RESP_new(void); -void TS_RESP_free(TS_RESP *a); -int i2d_TS_RESP(const TS_RESP *a, unsigned char **pp); -TS_RESP *d2i_TS_RESP(TS_RESP **a, const unsigned char **pp, long length); -TS_TST_INFO *PKCS7_to_TS_TST_INFO(PKCS7 *token); -TS_RESP *TS_RESP_dup(TS_RESP *a); - -TS_RESP *d2i_TS_RESP_fp(FILE *fp, TS_RESP **a); -int i2d_TS_RESP_fp(FILE *fp, TS_RESP *a); -TS_RESP *d2i_TS_RESP_bio(BIO *fp, TS_RESP **a); -int i2d_TS_RESP_bio(BIO *fp, TS_RESP *a); - -TS_STATUS_INFO *TS_STATUS_INFO_new(void); -void TS_STATUS_INFO_free(TS_STATUS_INFO *a); -int i2d_TS_STATUS_INFO(const TS_STATUS_INFO *a, unsigned char **pp); -TS_STATUS_INFO *d2i_TS_STATUS_INFO(TS_STATUS_INFO **a, - const unsigned char **pp, long length); -TS_STATUS_INFO *TS_STATUS_INFO_dup(TS_STATUS_INFO *a); - -TS_TST_INFO *TS_TST_INFO_new(void); -void TS_TST_INFO_free(TS_TST_INFO *a); -int i2d_TS_TST_INFO(const TS_TST_INFO *a, unsigned char **pp); -TS_TST_INFO *d2i_TS_TST_INFO(TS_TST_INFO **a, const unsigned char **pp, - long length); -TS_TST_INFO *TS_TST_INFO_dup(TS_TST_INFO *a); - -TS_TST_INFO *d2i_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO **a); -int i2d_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO *a); -TS_TST_INFO *d2i_TS_TST_INFO_bio(BIO *fp, TS_TST_INFO **a); -int i2d_TS_TST_INFO_bio(BIO *fp, TS_TST_INFO *a); - -TS_ACCURACY *TS_ACCURACY_new(void); -void TS_ACCURACY_free(TS_ACCURACY *a); -int i2d_TS_ACCURACY(const TS_ACCURACY *a, unsigned char **pp); -TS_ACCURACY *d2i_TS_ACCURACY(TS_ACCURACY **a, const unsigned char **pp, - long length); -TS_ACCURACY *TS_ACCURACY_dup(TS_ACCURACY *a); - -ESS_ISSUER_SERIAL *ESS_ISSUER_SERIAL_new(void); -void ESS_ISSUER_SERIAL_free(ESS_ISSUER_SERIAL *a); -int i2d_ESS_ISSUER_SERIAL(const ESS_ISSUER_SERIAL *a, - unsigned char **pp); -ESS_ISSUER_SERIAL *d2i_ESS_ISSUER_SERIAL(ESS_ISSUER_SERIAL **a, - const unsigned char **pp, long length); -ESS_ISSUER_SERIAL *ESS_ISSUER_SERIAL_dup(ESS_ISSUER_SERIAL *a); - -ESS_CERT_ID *ESS_CERT_ID_new(void); -void ESS_CERT_ID_free(ESS_CERT_ID *a); -int i2d_ESS_CERT_ID(const ESS_CERT_ID *a, unsigned char **pp); -ESS_CERT_ID *d2i_ESS_CERT_ID(ESS_CERT_ID **a, const unsigned char **pp, - long length); -ESS_CERT_ID *ESS_CERT_ID_dup(ESS_CERT_ID *a); - -ESS_SIGNING_CERT *ESS_SIGNING_CERT_new(void); -void ESS_SIGNING_CERT_free(ESS_SIGNING_CERT *a); -int i2d_ESS_SIGNING_CERT(const ESS_SIGNING_CERT *a, - unsigned char **pp); -ESS_SIGNING_CERT *d2i_ESS_SIGNING_CERT(ESS_SIGNING_CERT **a, - const unsigned char **pp, long length); -ESS_SIGNING_CERT *ESS_SIGNING_CERT_dup(ESS_SIGNING_CERT *a); - -int TS_REQ_set_version(TS_REQ *a, long version); -long TS_REQ_get_version(const TS_REQ *a); - -int TS_REQ_set_msg_imprint(TS_REQ *a, TS_MSG_IMPRINT *msg_imprint); -TS_MSG_IMPRINT *TS_REQ_get_msg_imprint(TS_REQ *a); - -int TS_MSG_IMPRINT_set_algo(TS_MSG_IMPRINT *a, X509_ALGOR *alg); -X509_ALGOR *TS_MSG_IMPRINT_get_algo(TS_MSG_IMPRINT *a); - -int TS_MSG_IMPRINT_set_msg(TS_MSG_IMPRINT *a, unsigned char *d, int len); -ASN1_OCTET_STRING *TS_MSG_IMPRINT_get_msg(TS_MSG_IMPRINT *a); - -int TS_REQ_set_policy_id(TS_REQ *a, const ASN1_OBJECT *policy); -ASN1_OBJECT *TS_REQ_get_policy_id(TS_REQ *a); - -int TS_REQ_set_nonce(TS_REQ *a, const ASN1_INTEGER *nonce); -const ASN1_INTEGER *TS_REQ_get_nonce(const TS_REQ *a); - -int TS_REQ_set_cert_req(TS_REQ *a, int cert_req); -int TS_REQ_get_cert_req(const TS_REQ *a); - -STACK_OF(X509_EXTENSION) *TS_REQ_get_exts(TS_REQ *a); -void TS_REQ_ext_free(TS_REQ *a); -int TS_REQ_get_ext_count(TS_REQ *a); -int TS_REQ_get_ext_by_NID(TS_REQ *a, int nid, int lastpos); -int TS_REQ_get_ext_by_OBJ(TS_REQ *a, const ASN1_OBJECT *obj, int lastpos); -int TS_REQ_get_ext_by_critical(TS_REQ *a, int crit, int lastpos); -X509_EXTENSION *TS_REQ_get_ext(TS_REQ *a, int loc); -X509_EXTENSION *TS_REQ_delete_ext(TS_REQ *a, int loc); -int TS_REQ_add_ext(TS_REQ *a, X509_EXTENSION *ex, int loc); -void *TS_REQ_get_ext_d2i(TS_REQ *a, int nid, int *crit, int *idx); - -/* Function declarations for TS_REQ defined in ts/ts_req_print.c */ - -int TS_REQ_print_bio(BIO *bio, TS_REQ *a); - -/* Function declarations for TS_RESP defined in ts/ts_rsp_utils.c */ - -int TS_RESP_set_status_info(TS_RESP *a, TS_STATUS_INFO *info); -TS_STATUS_INFO *TS_RESP_get_status_info(TS_RESP *a); - -const ASN1_UTF8STRING *TS_STATUS_INFO_get0_failure_info(const TS_STATUS_INFO *si); -const STACK_OF(ASN1_UTF8STRING) * - TS_STATUS_INFO_get0_text(const TS_STATUS_INFO *si); -const ASN1_INTEGER *TS_STATUS_INFO_get0_status(const TS_STATUS_INFO *si); -int TS_STATUS_INFO_set_status(TS_STATUS_INFO *si, int i); - -/* Caller loses ownership of PKCS7 and TS_TST_INFO objects. */ -void TS_RESP_set_tst_info(TS_RESP *a, PKCS7 *p7, TS_TST_INFO *tst_info); -PKCS7 *TS_RESP_get_token(TS_RESP *a); -TS_TST_INFO *TS_RESP_get_tst_info(TS_RESP *a); - -int TS_TST_INFO_set_version(TS_TST_INFO *a, long version); -long TS_TST_INFO_get_version(const TS_TST_INFO *a); - -int TS_TST_INFO_set_policy_id(TS_TST_INFO *a, ASN1_OBJECT *policy_id); -ASN1_OBJECT *TS_TST_INFO_get_policy_id(TS_TST_INFO *a); - -int TS_TST_INFO_set_msg_imprint(TS_TST_INFO *a, TS_MSG_IMPRINT *msg_imprint); -TS_MSG_IMPRINT *TS_TST_INFO_get_msg_imprint(TS_TST_INFO *a); - -int TS_TST_INFO_set_serial(TS_TST_INFO *a, const ASN1_INTEGER *serial); -const ASN1_INTEGER *TS_TST_INFO_get_serial(const TS_TST_INFO *a); - -int TS_TST_INFO_set_time(TS_TST_INFO *a, const ASN1_GENERALIZEDTIME *gtime); -const ASN1_GENERALIZEDTIME *TS_TST_INFO_get_time(const TS_TST_INFO *a); - -int TS_TST_INFO_set_accuracy(TS_TST_INFO *a, TS_ACCURACY *accuracy); -TS_ACCURACY *TS_TST_INFO_get_accuracy(TS_TST_INFO *a); - -int TS_ACCURACY_set_seconds(TS_ACCURACY *a, const ASN1_INTEGER *seconds); -const ASN1_INTEGER *TS_ACCURACY_get_seconds(const TS_ACCURACY *a); - -int TS_ACCURACY_set_millis(TS_ACCURACY *a, const ASN1_INTEGER *millis); -const ASN1_INTEGER *TS_ACCURACY_get_millis(const TS_ACCURACY *a); - -int TS_ACCURACY_set_micros(TS_ACCURACY *a, const ASN1_INTEGER *micros); -const ASN1_INTEGER *TS_ACCURACY_get_micros(const TS_ACCURACY *a); - -int TS_TST_INFO_set_ordering(TS_TST_INFO *a, int ordering); -int TS_TST_INFO_get_ordering(const TS_TST_INFO *a); - -int TS_TST_INFO_set_nonce(TS_TST_INFO *a, const ASN1_INTEGER *nonce); -const ASN1_INTEGER *TS_TST_INFO_get_nonce(const TS_TST_INFO *a); - -int TS_TST_INFO_set_tsa(TS_TST_INFO *a, GENERAL_NAME *tsa); -GENERAL_NAME *TS_TST_INFO_get_tsa(TS_TST_INFO *a); - -STACK_OF(X509_EXTENSION) *TS_TST_INFO_get_exts(TS_TST_INFO *a); -void TS_TST_INFO_ext_free(TS_TST_INFO *a); -int TS_TST_INFO_get_ext_count(TS_TST_INFO *a); -int TS_TST_INFO_get_ext_by_NID(TS_TST_INFO *a, int nid, int lastpos); -int TS_TST_INFO_get_ext_by_OBJ(TS_TST_INFO *a, const ASN1_OBJECT *obj, - int lastpos); -int TS_TST_INFO_get_ext_by_critical(TS_TST_INFO *a, int crit, int lastpos); -X509_EXTENSION *TS_TST_INFO_get_ext(TS_TST_INFO *a, int loc); -X509_EXTENSION *TS_TST_INFO_delete_ext(TS_TST_INFO *a, int loc); -int TS_TST_INFO_add_ext(TS_TST_INFO *a, X509_EXTENSION *ex, int loc); -void *TS_TST_INFO_get_ext_d2i(TS_TST_INFO *a, int nid, int *crit, int *idx); - -/* Declarations related to response generation, defined in ts/ts_rsp_sign.c. */ - -/* Optional flags for response generation. */ - -/* Don't include the TSA name in response. */ -#define TS_TSA_NAME 0x01 - -/* Set ordering to true in response. */ -#define TS_ORDERING 0x02 - -/* - * Include the signer certificate and the other specified certificates in - * the ESS signing certificate attribute beside the PKCS7 signed data. - * Only the signer certificates is included by default. - */ -#define TS_ESS_CERT_ID_CHAIN 0x04 - -/* Forward declaration. */ -struct TS_resp_ctx; - -/* This must return a unique number less than 160 bits long. */ -typedef ASN1_INTEGER *(*TS_serial_cb)(struct TS_resp_ctx *, void *); - -/* This must return the seconds and microseconds since Jan 1, 1970 in - the sec and usec variables allocated by the caller. - Return non-zero for success and zero for failure. */ -typedef int (*TS_time_cb)(struct TS_resp_ctx *, void *, time_t *sec, long *usec); - -/* This must process the given extension. - * It can modify the TS_TST_INFO object of the context. - * Return values: !0 (processed), 0 (error, it must set the - * status info/failure info of the response). - */ -typedef int (*TS_extension_cb)(struct TS_resp_ctx *, X509_EXTENSION *, void *); - -typedef struct TS_resp_ctx TS_RESP_CTX; - -DECLARE_STACK_OF(EVP_MD) - -/* Creates a response context that can be used for generating responses. */ -TS_RESP_CTX *TS_RESP_CTX_new(void); -void TS_RESP_CTX_free(TS_RESP_CTX *ctx); - -/* This parameter must be set. */ -int TS_RESP_CTX_set_signer_cert(TS_RESP_CTX *ctx, X509 *signer); - -/* This parameter must be set. */ -int TS_RESP_CTX_set_signer_key(TS_RESP_CTX *ctx, EVP_PKEY *key); - -/* This parameter must be set. */ -int TS_RESP_CTX_set_def_policy(TS_RESP_CTX *ctx, const ASN1_OBJECT *def_policy); - -/* No additional certs are included in the response by default. */ -int TS_RESP_CTX_set_certs(TS_RESP_CTX *ctx, STACK_OF(X509) *certs); - -/* Adds a new acceptable policy, only the default policy - is accepted by default. */ -int TS_RESP_CTX_add_policy(TS_RESP_CTX *ctx, const ASN1_OBJECT *policy); - -/* Adds a new acceptable message digest. Note that no message digests - are accepted by default. The md argument is shared with the caller. */ -int TS_RESP_CTX_add_md(TS_RESP_CTX *ctx, const EVP_MD *md); - -/* Accuracy is not included by default. */ -int TS_RESP_CTX_set_accuracy(TS_RESP_CTX *ctx, - int secs, int millis, int micros); - -/* Clock precision digits, i.e. the number of decimal digits: - '0' means sec, '3' msec, '6' usec, and so on. Default is 0. */ -int TS_RESP_CTX_set_clock_precision_digits(TS_RESP_CTX *ctx, - unsigned clock_precision_digits); -/* At most we accept sec precision. */ -#define TS_MAX_CLOCK_PRECISION_DIGITS 0 - -/* No flags are set by default. */ -void TS_RESP_CTX_add_flags(TS_RESP_CTX *ctx, int flags); - -/* Default callback always returns a constant. */ -void TS_RESP_CTX_set_serial_cb(TS_RESP_CTX *ctx, TS_serial_cb cb, void *data); - -/* Default callback uses gettimeofday() and gmtime(). */ -void TS_RESP_CTX_set_time_cb(TS_RESP_CTX *ctx, TS_time_cb cb, void *data); - -/* Default callback rejects all extensions. The extension callback is called - * when the TS_TST_INFO object is already set up and not signed yet. */ -/* FIXME: extension handling is not tested yet. */ -void TS_RESP_CTX_set_extension_cb(TS_RESP_CTX *ctx, - TS_extension_cb cb, void *data); - -/* The following methods can be used in the callbacks. */ -int TS_RESP_CTX_set_status_info(TS_RESP_CTX *ctx, - int status, const char *text); - -/* Sets the status info only if it is still TS_STATUS_GRANTED. */ -int TS_RESP_CTX_set_status_info_cond(TS_RESP_CTX *ctx, - int status, const char *text); - -int TS_RESP_CTX_add_failure_info(TS_RESP_CTX *ctx, int failure); - -/* The get methods below can be used in the extension callback. */ -TS_REQ *TS_RESP_CTX_get_request(TS_RESP_CTX *ctx); - -TS_TST_INFO *TS_RESP_CTX_get_tst_info(TS_RESP_CTX *ctx); - -/* - * Creates the signed TS_TST_INFO and puts it in TS_RESP. - * In case of errors it sets the status info properly. - * Returns NULL only in case of memory allocation/fatal error. - */ -TS_RESP *TS_RESP_create_response(TS_RESP_CTX *ctx, BIO *req_bio); - -/* - * Declarations related to response verification, - * they are defined in ts/ts_rsp_verify.c. - */ - -int TS_RESP_verify_signature(PKCS7 *token, STACK_OF(X509) *certs, - X509_STORE *store, X509 **signer_out); - -/* Context structure for the generic verify method. */ - -/* Verify the signer's certificate and the signature of the response. */ -#define TS_VFY_SIGNATURE (1u << 0) -/* Verify the version number of the response. */ -#define TS_VFY_VERSION (1u << 1) -/* Verify if the policy supplied by the user matches the policy of the TSA. */ -#define TS_VFY_POLICY (1u << 2) -/* Verify the message imprint provided by the user. This flag should not be - specified with TS_VFY_DATA. */ -#define TS_VFY_IMPRINT (1u << 3) -/* Verify the message imprint computed by the verify method from the user - provided data and the MD algorithm of the response. This flag should not be - specified with TS_VFY_IMPRINT. */ -#define TS_VFY_DATA (1u << 4) -/* Verify the nonce value. */ -#define TS_VFY_NONCE (1u << 5) -/* Verify if the TSA name field matches the signer certificate. */ -#define TS_VFY_SIGNER (1u << 6) -/* Verify if the TSA name field equals to the user provided name. */ -#define TS_VFY_TSA_NAME (1u << 7) - -/* You can use the following convenience constants. */ -#define TS_VFY_ALL_IMPRINT (TS_VFY_SIGNATURE \ - | TS_VFY_VERSION \ - | TS_VFY_POLICY \ - | TS_VFY_IMPRINT \ - | TS_VFY_NONCE \ - | TS_VFY_SIGNER \ - | TS_VFY_TSA_NAME) -#define TS_VFY_ALL_DATA (TS_VFY_SIGNATURE \ - | TS_VFY_VERSION \ - | TS_VFY_POLICY \ - | TS_VFY_DATA \ - | TS_VFY_NONCE \ - | TS_VFY_SIGNER \ - | TS_VFY_TSA_NAME) - -typedef struct TS_verify_ctx TS_VERIFY_CTX; - -int TS_RESP_verify_response(TS_VERIFY_CTX *ctx, TS_RESP *response); -int TS_RESP_verify_token(TS_VERIFY_CTX *ctx, PKCS7 *token); - -/* - * Declarations related to response verification context, - * they are defined in ts/ts_verify_ctx.c. - */ - -/* Set all fields to zero. */ -TS_VERIFY_CTX *TS_VERIFY_CTX_new(void); -void TS_VERIFY_CTX_free(TS_VERIFY_CTX *ctx); -void TS_VERIFY_CTX_cleanup(TS_VERIFY_CTX *ctx); - -int TS_VERIFY_CTX_add_flags(TS_VERIFY_CTX *ctx, int flags); -int TS_VERIFY_CTX_set_flags(TS_VERIFY_CTX *ctx, int flags); -BIO *TS_VERIFY_CTX_set_data(TS_VERIFY_CTX *ctx, BIO *bio); -X509_STORE *TS_VERIFY_CTX_set_store(TS_VERIFY_CTX *ctx, X509_STORE *store); -/* R$ special */ -#define TS_VERIFY_CTS_set_certs TS_VERIFY_CTX_set_certs -STACK_OF(X509) *TS_VERIFY_CTX_set_certs(TS_VERIFY_CTX *ctx, - STACK_OF(X509) *certs); -unsigned char *TS_VERIFY_CTX_set_imprint(TS_VERIFY_CTX *ctx, - unsigned char *imprint, long imprint_len); - -/* - * If ctx is NULL, it allocates and returns a new object, otherwise - * it returns ctx. It initialises all the members as follows: - * flags = TS_VFY_ALL_IMPRINT & ~(TS_VFY_TSA_NAME | TS_VFY_SIGNATURE) - * certs = NULL - * store = NULL - * policy = policy from the request or NULL if absent (in this case - * TS_VFY_POLICY is cleared from flags as well) - * md_alg = MD algorithm from request - * imprint, imprint_len = imprint from request - * data = NULL - * nonce, nonce_len = nonce from the request or NULL if absent (in this case - * TS_VFY_NONCE is cleared from flags as well) - * tsa_name = NULL - * Important: after calling this method TS_VFY_SIGNATURE should be added! - */ -TS_VERIFY_CTX *TS_REQ_to_TS_VERIFY_CTX(TS_REQ *req, TS_VERIFY_CTX *ctx); - -/* Function declarations for TS_RESP defined in ts/ts_rsp_print.c */ - -int TS_RESP_print_bio(BIO *bio, TS_RESP *a); -int TS_STATUS_INFO_print_bio(BIO *bio, TS_STATUS_INFO *a); -int TS_TST_INFO_print_bio(BIO *bio, TS_TST_INFO *a); - -/* Common utility functions defined in ts/ts_lib.c */ - -int TS_ASN1_INTEGER_print_bio(BIO *bio, const ASN1_INTEGER *num); -int TS_OBJ_print_bio(BIO *bio, const ASN1_OBJECT *obj); -int TS_ext_print_bio(BIO *bio, const STACK_OF(X509_EXTENSION) *extensions); -int TS_X509_ALGOR_print_bio(BIO *bio, const X509_ALGOR *alg); -int TS_MSG_IMPRINT_print_bio(BIO *bio, TS_MSG_IMPRINT *msg); - -/* Function declarations for handling configuration options, - defined in ts/ts_conf.c */ - -X509 *TS_CONF_load_cert(const char *file); -STACK_OF(X509) *TS_CONF_load_certs(const char *file); -EVP_PKEY *TS_CONF_load_key(const char *file, const char *pass); -const char *TS_CONF_get_tsa_section(CONF *conf, const char *section); -int TS_CONF_set_serial(CONF *conf, const char *section, TS_serial_cb cb, - TS_RESP_CTX *ctx); -int TS_CONF_set_signer_cert(CONF *conf, const char *section, - const char *cert, TS_RESP_CTX *ctx); -int TS_CONF_set_certs(CONF *conf, const char *section, const char *certs, - TS_RESP_CTX *ctx); -int TS_CONF_set_signer_key(CONF *conf, const char *section, - const char *key, const char *pass, TS_RESP_CTX *ctx); -int TS_CONF_set_def_policy(CONF *conf, const char *section, - const char *policy, TS_RESP_CTX *ctx); -int TS_CONF_set_policies(CONF *conf, const char *section, TS_RESP_CTX *ctx); -int TS_CONF_set_digests(CONF *conf, const char *section, TS_RESP_CTX *ctx); -int TS_CONF_set_accuracy(CONF *conf, const char *section, TS_RESP_CTX *ctx); -int TS_CONF_set_clock_precision_digits(CONF *conf, const char *section, - TS_RESP_CTX *ctx); -int TS_CONF_set_ordering(CONF *conf, const char *section, TS_RESP_CTX *ctx); -int TS_CONF_set_tsa_name(CONF *conf, const char *section, TS_RESP_CTX *ctx); -int TS_CONF_set_ess_cert_id_chain(CONF *conf, const char *section, - TS_RESP_CTX *ctx); - -void ERR_load_TS_strings(void); - -/* Error codes for the TS functions. */ - -/* Function codes. */ -#define TS_F_D2I_TS_RESP 147 -#define TS_F_DEF_SERIAL_CB 110 -#define TS_F_DEF_TIME_CB 111 -#define TS_F_ESS_ADD_SIGNING_CERT 112 -#define TS_F_ESS_CERT_ID_NEW_INIT 113 -#define TS_F_ESS_SIGNING_CERT_NEW_INIT 114 -#define TS_F_INT_TS_RESP_VERIFY_TOKEN 149 -#define TS_F_PKCS7_TO_TS_TST_INFO 148 -#define TS_F_TS_ACCURACY_SET_MICROS 115 -#define TS_F_TS_ACCURACY_SET_MILLIS 116 -#define TS_F_TS_ACCURACY_SET_SECONDS 117 -#define TS_F_TS_CHECK_IMPRINTS 100 -#define TS_F_TS_CHECK_NONCES 101 -#define TS_F_TS_CHECK_POLICY 102 -#define TS_F_TS_CHECK_SIGNING_CERTS 103 -#define TS_F_TS_CHECK_STATUS_INFO 104 -#define TS_F_TS_COMPUTE_IMPRINT 145 -#define TS_F_TS_CONF_SET_DEFAULT_ENGINE 146 -#define TS_F_TS_GET_STATUS_TEXT 105 -#define TS_F_TS_MSG_IMPRINT_SET_ALGO 118 -#define TS_F_TS_REQ_SET_MSG_IMPRINT 119 -#define TS_F_TS_REQ_SET_NONCE 120 -#define TS_F_TS_REQ_SET_POLICY_ID 121 -#define TS_F_TS_RESP_CREATE_RESPONSE 122 -#define TS_F_TS_RESP_CREATE_TST_INFO 123 -#define TS_F_TS_RESP_CTX_ADD_FAILURE_INFO 124 -#define TS_F_TS_RESP_CTX_ADD_MD 125 -#define TS_F_TS_RESP_CTX_ADD_POLICY 126 -#define TS_F_TS_RESP_CTX_NEW 127 -#define TS_F_TS_RESP_CTX_SET_ACCURACY 128 -#define TS_F_TS_RESP_CTX_SET_CERTS 129 -#define TS_F_TS_RESP_CTX_SET_DEF_POLICY 130 -#define TS_F_TS_RESP_CTX_SET_SIGNER_CERT 131 -#define TS_F_TS_RESP_CTX_SET_STATUS_INFO 132 -#define TS_F_TS_RESP_GET_POLICY 133 -#define TS_F_TS_RESP_SET_GENTIME_WITH_PRECISION 134 -#define TS_F_TS_RESP_SET_STATUS_INFO 135 -#define TS_F_TS_RESP_SET_TST_INFO 150 -#define TS_F_TS_RESP_SIGN 136 -#define TS_F_TS_RESP_VERIFY_SIGNATURE 106 -#define TS_F_TS_RESP_VERIFY_TOKEN 107 -#define TS_F_TS_TST_INFO_SET_ACCURACY 137 -#define TS_F_TS_TST_INFO_SET_MSG_IMPRINT 138 -#define TS_F_TS_TST_INFO_SET_NONCE 139 -#define TS_F_TS_TST_INFO_SET_POLICY_ID 140 -#define TS_F_TS_TST_INFO_SET_SERIAL 141 -#define TS_F_TS_TST_INFO_SET_TIME 142 -#define TS_F_TS_TST_INFO_SET_TSA 143 -#define TS_F_TS_VERIFY 108 -#define TS_F_TS_VERIFY_CERT 109 -#define TS_F_TS_VERIFY_CTX_NEW 144 - -/* Reason codes. */ -#define TS_R_BAD_PKCS7_TYPE 132 -#define TS_R_BAD_TYPE 133 -#define TS_R_CERTIFICATE_VERIFY_ERROR 100 -#define TS_R_COULD_NOT_SET_ENGINE 127 -#define TS_R_COULD_NOT_SET_TIME 115 -#define TS_R_D2I_TS_RESP_INT_FAILED 128 -#define TS_R_DETACHED_CONTENT 134 -#define TS_R_ESS_ADD_SIGNING_CERT_ERROR 116 -#define TS_R_ESS_SIGNING_CERTIFICATE_ERROR 101 -#define TS_R_INVALID_NULL_POINTER 102 -#define TS_R_INVALID_SIGNER_CERTIFICATE_PURPOSE 117 -#define TS_R_MESSAGE_IMPRINT_MISMATCH 103 -#define TS_R_NONCE_MISMATCH 104 -#define TS_R_NONCE_NOT_RETURNED 105 -#define TS_R_NO_CONTENT 106 -#define TS_R_NO_TIME_STAMP_TOKEN 107 -#define TS_R_PKCS7_ADD_SIGNATURE_ERROR 118 -#define TS_R_PKCS7_ADD_SIGNED_ATTR_ERROR 119 -#define TS_R_PKCS7_TO_TS_TST_INFO_FAILED 129 -#define TS_R_POLICY_MISMATCH 108 -#define TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE 120 -#define TS_R_RESPONSE_SETUP_ERROR 121 -#define TS_R_SIGNATURE_FAILURE 109 -#define TS_R_THERE_MUST_BE_ONE_SIGNER 110 -#define TS_R_TIME_SYSCALL_ERROR 122 -#define TS_R_TOKEN_NOT_PRESENT 130 -#define TS_R_TOKEN_PRESENT 131 -#define TS_R_TSA_NAME_MISMATCH 111 -#define TS_R_TSA_UNTRUSTED 112 -#define TS_R_TST_INFO_SETUP_ERROR 123 -#define TS_R_TS_DATASIGN 124 -#define TS_R_UNACCEPTABLE_POLICY 125 -#define TS_R_UNSUPPORTED_MD_ALGORITHM 126 -#define TS_R_UNSUPPORTED_VERSION 113 -#define TS_R_WRONG_CONTENT_TYPE 114 - -#ifdef __cplusplus -} -#endif -#endif diff --git a/src/lib/libcrypto/ts/ts_asn1.c b/src/lib/libcrypto/ts/ts_asn1.c deleted file mode 100644 index feb2da68f9..0000000000 --- a/src/lib/libcrypto/ts/ts_asn1.c +++ /dev/null @@ -1,1077 +0,0 @@ -/* $OpenBSD: ts_asn1.c,v 1.15 2024/04/15 15:52:46 tb Exp $ */ -/* Written by Nils Larsch for the OpenSSL project 2004. - */ -/* ==================================================================== - * Copyright (c) 2006 The OpenSSL Project. All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in - * the documentation and/or other materials provided with the - * distribution. - * - * 3. All advertising materials mentioning features or use of this - * software must display the following acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" - * - * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to - * endorse or promote products derived from this software without - * prior written permission. For written permission, please contact - * licensing@OpenSSL.org. - * - * 5. Products derived from this software may not be called "OpenSSL" - * nor may "OpenSSL" appear in their names without prior written - * permission of the OpenSSL Project. - * - * 6. Redistributions of any form whatsoever must retain the following - * acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" - * - * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY - * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR - * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR - * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT - * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; - * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, - * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED - * OF THE POSSIBILITY OF SUCH DAMAGE. - * ==================================================================== - * - * This product includes cryptographic software written by Eric Young - * (eay@cryptsoft.com). This product includes software written by Tim - * Hudson (tjh@cryptsoft.com). - * - */ - -#include - -#include -#include -#include - -#include "ts_local.h" - -static const ASN1_TEMPLATE TS_MSG_IMPRINT_seq_tt[] = { - { - .flags = 0, - .tag = 0, - .offset = offsetof(TS_MSG_IMPRINT, hash_algo), - .field_name = "hash_algo", - .item = &X509_ALGOR_it, - }, - { - .flags = 0, - .tag = 0, - .offset = offsetof(TS_MSG_IMPRINT, hashed_msg), - .field_name = "hashed_msg", - .item = &ASN1_OCTET_STRING_it, - }, -}; - -static const ASN1_ITEM TS_MSG_IMPRINT_it = { - .itype = ASN1_ITYPE_SEQUENCE, - .utype = V_ASN1_SEQUENCE, - .templates = TS_MSG_IMPRINT_seq_tt, - .tcount = sizeof(TS_MSG_IMPRINT_seq_tt) / sizeof(ASN1_TEMPLATE), - .funcs = NULL, - .size = sizeof(TS_MSG_IMPRINT), - .sname = "TS_MSG_IMPRINT", -}; - - -TS_MSG_IMPRINT * -d2i_TS_MSG_IMPRINT(TS_MSG_IMPRINT **a, const unsigned char **in, long len) -{ - return (TS_MSG_IMPRINT *)ASN1_item_d2i((ASN1_VALUE **)a, in, len, - &TS_MSG_IMPRINT_it); -} -LCRYPTO_ALIAS(d2i_TS_MSG_IMPRINT); - -int -i2d_TS_MSG_IMPRINT(const TS_MSG_IMPRINT *a, unsigned char **out) -{ - return ASN1_item_i2d((ASN1_VALUE *)a, out, &TS_MSG_IMPRINT_it); -} -LCRYPTO_ALIAS(i2d_TS_MSG_IMPRINT); - -TS_MSG_IMPRINT * -TS_MSG_IMPRINT_new(void) -{ - return (TS_MSG_IMPRINT *)ASN1_item_new(&TS_MSG_IMPRINT_it); -} -LCRYPTO_ALIAS(TS_MSG_IMPRINT_new); - -void -TS_MSG_IMPRINT_free(TS_MSG_IMPRINT *a) -{ - ASN1_item_free((ASN1_VALUE *)a, &TS_MSG_IMPRINT_it); -} -LCRYPTO_ALIAS(TS_MSG_IMPRINT_free); - -TS_MSG_IMPRINT * -TS_MSG_IMPRINT_dup(TS_MSG_IMPRINT *x) -{ - return ASN1_item_dup(&TS_MSG_IMPRINT_it, x); -} -LCRYPTO_ALIAS(TS_MSG_IMPRINT_dup); - -#ifndef OPENSSL_NO_BIO -TS_MSG_IMPRINT * -d2i_TS_MSG_IMPRINT_bio(BIO *bp, TS_MSG_IMPRINT **a) -{ - return ASN1_item_d2i_bio(&TS_MSG_IMPRINT_it, bp, a); -} -LCRYPTO_ALIAS(d2i_TS_MSG_IMPRINT_bio); - -int -i2d_TS_MSG_IMPRINT_bio(BIO *bp, TS_MSG_IMPRINT *a) -{ - return ASN1_item_i2d_bio(&TS_MSG_IMPRINT_it, bp, a); -} -LCRYPTO_ALIAS(i2d_TS_MSG_IMPRINT_bio); -#endif - -TS_MSG_IMPRINT * -d2i_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT **a) -{ - return ASN1_item_d2i_fp(&TS_MSG_IMPRINT_it, fp, a); -} -LCRYPTO_ALIAS(d2i_TS_MSG_IMPRINT_fp); - -int -i2d_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT *a) -{ - return ASN1_item_i2d_fp(&TS_MSG_IMPRINT_it, fp, a); -} -LCRYPTO_ALIAS(i2d_TS_MSG_IMPRINT_fp); - -static const ASN1_TEMPLATE TS_REQ_seq_tt[] = { - { - .flags = 0, - .tag = 0, - .offset = offsetof(TS_REQ, version), - .field_name = "version", - .item = &ASN1_INTEGER_it, - }, - { - .flags = 0, - .tag = 0, - .offset = offsetof(TS_REQ, msg_imprint), - .field_name = "msg_imprint", - .item = &TS_MSG_IMPRINT_it, - }, - { - .flags = ASN1_TFLG_OPTIONAL, - .tag = 0, - .offset = offsetof(TS_REQ, policy_id), - .field_name = "policy_id", - .item = &ASN1_OBJECT_it, - }, - { - .flags = ASN1_TFLG_OPTIONAL, - .tag = 0, - .offset = offsetof(TS_REQ, nonce), - .field_name = "nonce", - .item = &ASN1_INTEGER_it, - }, - { - .flags = ASN1_TFLG_OPTIONAL, - .tag = 0, - .offset = offsetof(TS_REQ, cert_req), - .field_name = "cert_req", - .item = &ASN1_FBOOLEAN_it, - }, - { - .flags = ASN1_TFLG_IMPLICIT | ASN1_TFLG_SEQUENCE_OF | ASN1_TFLG_OPTIONAL, - .tag = 0, - .offset = offsetof(TS_REQ, extensions), - .field_name = "extensions", - .item = &X509_EXTENSION_it, - }, -}; - -static const ASN1_ITEM TS_REQ_it = { - .itype = ASN1_ITYPE_SEQUENCE, - .utype = V_ASN1_SEQUENCE, - .templates = TS_REQ_seq_tt, - .tcount = sizeof(TS_REQ_seq_tt) / sizeof(ASN1_TEMPLATE), - .funcs = NULL, - .size = sizeof(TS_REQ), - .sname = "TS_REQ", -}; - - -TS_REQ * -d2i_TS_REQ(TS_REQ **a, const unsigned char **in, long len) -{ - return (TS_REQ *)ASN1_item_d2i((ASN1_VALUE **)a, in, len, - &TS_REQ_it); -} -LCRYPTO_ALIAS(d2i_TS_REQ); - -int -i2d_TS_REQ(const TS_REQ *a, unsigned char **out) -{ - return ASN1_item_i2d((ASN1_VALUE *)a, out, &TS_REQ_it); -} -LCRYPTO_ALIAS(i2d_TS_REQ); - -TS_REQ * -TS_REQ_new(void) -{ - return (TS_REQ *)ASN1_item_new(&TS_REQ_it); -} -LCRYPTO_ALIAS(TS_REQ_new); - -void -TS_REQ_free(TS_REQ *a) -{ - ASN1_item_free((ASN1_VALUE *)a, &TS_REQ_it); -} -LCRYPTO_ALIAS(TS_REQ_free); - -TS_REQ * -TS_REQ_dup(TS_REQ *x) -{ - return ASN1_item_dup(&TS_REQ_it, x); -} -LCRYPTO_ALIAS(TS_REQ_dup); - -#ifndef OPENSSL_NO_BIO -TS_REQ * -d2i_TS_REQ_bio(BIO *bp, TS_REQ **a) -{ - return ASN1_item_d2i_bio(&TS_REQ_it, bp, a); -} -LCRYPTO_ALIAS(d2i_TS_REQ_bio); - -int -i2d_TS_REQ_bio(BIO *bp, TS_REQ *a) -{ - return ASN1_item_i2d_bio(&TS_REQ_it, bp, a); -} -LCRYPTO_ALIAS(i2d_TS_REQ_bio); -#endif - -TS_REQ * -d2i_TS_REQ_fp(FILE *fp, TS_REQ **a) -{ - return ASN1_item_d2i_fp(&TS_REQ_it, fp, a); -} -LCRYPTO_ALIAS(d2i_TS_REQ_fp); - -int -i2d_TS_REQ_fp(FILE *fp, TS_REQ *a) -{ - return ASN1_item_i2d_fp(&TS_REQ_it, fp, a); -} -LCRYPTO_ALIAS(i2d_TS_REQ_fp); - -static const ASN1_TEMPLATE TS_ACCURACY_seq_tt[] = { - { - .flags = ASN1_TFLG_OPTIONAL, - .tag = 0, - .offset = offsetof(TS_ACCURACY, seconds), - .field_name = "seconds", - .item = &ASN1_INTEGER_it, - }, - { - .flags = ASN1_TFLG_IMPLICIT | ASN1_TFLG_OPTIONAL, - .tag = 0, - .offset = offsetof(TS_ACCURACY, millis), - .field_name = "millis", - .item = &ASN1_INTEGER_it, - }, - { - .flags = ASN1_TFLG_IMPLICIT | ASN1_TFLG_OPTIONAL, - .tag = 1, - .offset = offsetof(TS_ACCURACY, micros), - .field_name = "micros", - .item = &ASN1_INTEGER_it, - }, -}; - -static const ASN1_ITEM TS_ACCURACY_it = { - .itype = ASN1_ITYPE_SEQUENCE, - .utype = V_ASN1_SEQUENCE, - .templates = TS_ACCURACY_seq_tt, - .tcount = sizeof(TS_ACCURACY_seq_tt) / sizeof(ASN1_TEMPLATE), - .funcs = NULL, - .size = sizeof(TS_ACCURACY), - .sname = "TS_ACCURACY", -}; - - -TS_ACCURACY * -d2i_TS_ACCURACY(TS_ACCURACY **a, const unsigned char **in, long len) -{ - return (TS_ACCURACY *)ASN1_item_d2i((ASN1_VALUE **)a, in, len, - &TS_ACCURACY_it); -} -LCRYPTO_ALIAS(d2i_TS_ACCURACY); - -int -i2d_TS_ACCURACY(const TS_ACCURACY *a, unsigned char **out) -{ - return ASN1_item_i2d((ASN1_VALUE *)a, out, &TS_ACCURACY_it); -} -LCRYPTO_ALIAS(i2d_TS_ACCURACY); - -TS_ACCURACY * -TS_ACCURACY_new(void) -{ - return (TS_ACCURACY *)ASN1_item_new(&TS_ACCURACY_it); -} -LCRYPTO_ALIAS(TS_ACCURACY_new); - -void -TS_ACCURACY_free(TS_ACCURACY *a) -{ - ASN1_item_free((ASN1_VALUE *)a, &TS_ACCURACY_it); -} -LCRYPTO_ALIAS(TS_ACCURACY_free); - -TS_ACCURACY * -TS_ACCURACY_dup(TS_ACCURACY *x) -{ - return ASN1_item_dup(&TS_ACCURACY_it, x); -} -LCRYPTO_ALIAS(TS_ACCURACY_dup); - -static const ASN1_TEMPLATE TS_TST_INFO_seq_tt[] = { - { - .flags = 0, - .tag = 0, - .offset = offsetof(TS_TST_INFO, version), - .field_name = "version", - .item = &ASN1_INTEGER_it, - }, - { - .flags = 0, - .tag = 0, - .offset = offsetof(TS_TST_INFO, policy_id), - .field_name = "policy_id", - .item = &ASN1_OBJECT_it, - }, - { - .flags = 0, - .tag = 0, - .offset = offsetof(TS_TST_INFO, msg_imprint), - .field_name = "msg_imprint", - .item = &TS_MSG_IMPRINT_it, - }, - { - .flags = 0, - .tag = 0, - .offset = offsetof(TS_TST_INFO, serial), - .field_name = "serial", - .item = &ASN1_INTEGER_it, - }, - { - .flags = 0, - .tag = 0, - .offset = offsetof(TS_TST_INFO, time), - .field_name = "time", - .item = &ASN1_GENERALIZEDTIME_it, - }, - { - .flags = ASN1_TFLG_OPTIONAL, - .tag = 0, - .offset = offsetof(TS_TST_INFO, accuracy), - .field_name = "accuracy", - .item = &TS_ACCURACY_it, - }, - { - .flags = ASN1_TFLG_OPTIONAL, - .tag = 0, - .offset = offsetof(TS_TST_INFO, ordering), - .field_name = "ordering", - .item = &ASN1_FBOOLEAN_it, - }, - { - .flags = ASN1_TFLG_OPTIONAL, - .tag = 0, - .offset = offsetof(TS_TST_INFO, nonce), - .field_name = "nonce", - .item = &ASN1_INTEGER_it, - }, - { - .flags = ASN1_TFLG_EXPLICIT | ASN1_TFLG_OPTIONAL, - .tag = 0, - .offset = offsetof(TS_TST_INFO, tsa), - .field_name = "tsa", - .item = &GENERAL_NAME_it, - }, - { - .flags = ASN1_TFLG_IMPLICIT | ASN1_TFLG_SEQUENCE_OF | ASN1_TFLG_OPTIONAL, - .tag = 1, - .offset = offsetof(TS_TST_INFO, extensions), - .field_name = "extensions", - .item = &X509_EXTENSION_it, - }, -}; - -static const ASN1_ITEM TS_TST_INFO_it = { - .itype = ASN1_ITYPE_SEQUENCE, - .utype = V_ASN1_SEQUENCE, - .templates = TS_TST_INFO_seq_tt, - .tcount = sizeof(TS_TST_INFO_seq_tt) / sizeof(ASN1_TEMPLATE), - .funcs = NULL, - .size = sizeof(TS_TST_INFO), - .sname = "TS_TST_INFO", -}; - - -TS_TST_INFO * -d2i_TS_TST_INFO(TS_TST_INFO **a, const unsigned char **in, long len) -{ - return (TS_TST_INFO *)ASN1_item_d2i((ASN1_VALUE **)a, in, len, - &TS_TST_INFO_it); -} -LCRYPTO_ALIAS(d2i_TS_TST_INFO); - -int -i2d_TS_TST_INFO(const TS_TST_INFO *a, unsigned char **out) -{ - return ASN1_item_i2d((ASN1_VALUE *)a, out, &TS_TST_INFO_it); -} -LCRYPTO_ALIAS(i2d_TS_TST_INFO); - -TS_TST_INFO * -TS_TST_INFO_new(void) -{ - return (TS_TST_INFO *)ASN1_item_new(&TS_TST_INFO_it); -} -LCRYPTO_ALIAS(TS_TST_INFO_new); - -void -TS_TST_INFO_free(TS_TST_INFO *a) -{ - ASN1_item_free((ASN1_VALUE *)a, &TS_TST_INFO_it); -} -LCRYPTO_ALIAS(TS_TST_INFO_free); - -TS_TST_INFO * -TS_TST_INFO_dup(TS_TST_INFO *x) -{ - return ASN1_item_dup(&TS_TST_INFO_it, x); -} -LCRYPTO_ALIAS(TS_TST_INFO_dup); - -#ifndef OPENSSL_NO_BIO -TS_TST_INFO * -d2i_TS_TST_INFO_bio(BIO *bp, TS_TST_INFO **a) -{ - return ASN1_item_d2i_bio(&TS_TST_INFO_it, bp, a); -} -LCRYPTO_ALIAS(d2i_TS_TST_INFO_bio); - -int -i2d_TS_TST_INFO_bio(BIO *bp, TS_TST_INFO *a) -{ - return ASN1_item_i2d_bio(&TS_TST_INFO_it, bp, a); -} -LCRYPTO_ALIAS(i2d_TS_TST_INFO_bio); -#endif - -TS_TST_INFO * -d2i_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO **a) -{ - return ASN1_item_d2i_fp(&TS_TST_INFO_it, fp, a); -} -LCRYPTO_ALIAS(d2i_TS_TST_INFO_fp); - -int -i2d_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO *a) -{ - return ASN1_item_i2d_fp(&TS_TST_INFO_it, fp, a); -} -LCRYPTO_ALIAS(i2d_TS_TST_INFO_fp); - -static const ASN1_TEMPLATE TS_STATUS_INFO_seq_tt[] = { - { - .flags = 0, - .tag = 0, - .offset = offsetof(TS_STATUS_INFO, status), - .field_name = "status", - .item = &ASN1_INTEGER_it, - }, - { - .flags = ASN1_TFLG_SEQUENCE_OF | ASN1_TFLG_OPTIONAL, - .tag = 0, - .offset = offsetof(TS_STATUS_INFO, text), - .field_name = "text", - .item = &ASN1_UTF8STRING_it, - }, - { - .flags = ASN1_TFLG_OPTIONAL, - .tag = 0, - .offset = offsetof(TS_STATUS_INFO, failure_info), - .field_name = "failure_info", - .item = &ASN1_BIT_STRING_it, - }, -}; - -static const ASN1_ITEM TS_STATUS_INFO_it = { - .itype = ASN1_ITYPE_SEQUENCE, - .utype = V_ASN1_SEQUENCE, - .templates = TS_STATUS_INFO_seq_tt, - .tcount = sizeof(TS_STATUS_INFO_seq_tt) / sizeof(ASN1_TEMPLATE), - .funcs = NULL, - .size = sizeof(TS_STATUS_INFO), - .sname = "TS_STATUS_INFO", -}; - - -TS_STATUS_INFO * -d2i_TS_STATUS_INFO(TS_STATUS_INFO **a, const unsigned char **in, long len) -{ - return (TS_STATUS_INFO *)ASN1_item_d2i((ASN1_VALUE **)a, in, len, - &TS_STATUS_INFO_it); -} -LCRYPTO_ALIAS(d2i_TS_STATUS_INFO); - -int -i2d_TS_STATUS_INFO(const TS_STATUS_INFO *a, unsigned char **out) -{ - return ASN1_item_i2d((ASN1_VALUE *)a, out, &TS_STATUS_INFO_it); -} -LCRYPTO_ALIAS(i2d_TS_STATUS_INFO); - -TS_STATUS_INFO * -TS_STATUS_INFO_new(void) -{ - return (TS_STATUS_INFO *)ASN1_item_new(&TS_STATUS_INFO_it); -} -LCRYPTO_ALIAS(TS_STATUS_INFO_new); - -void -TS_STATUS_INFO_free(TS_STATUS_INFO *a) -{ - ASN1_item_free((ASN1_VALUE *)a, &TS_STATUS_INFO_it); -} -LCRYPTO_ALIAS(TS_STATUS_INFO_free); - -TS_STATUS_INFO * -TS_STATUS_INFO_dup(TS_STATUS_INFO *x) -{ - return ASN1_item_dup(&TS_STATUS_INFO_it, x); -} -LCRYPTO_ALIAS(TS_STATUS_INFO_dup); - -static int -ts_resp_set_tst_info(TS_RESP *a) -{ - long status; - - status = ASN1_INTEGER_get(a->status_info->status); - - if (a->token) { - if (status != 0 && status != 1) { - TSerror(TS_R_TOKEN_PRESENT); - return 0; - } - if (a->tst_info != NULL) - TS_TST_INFO_free(a->tst_info); - a->tst_info = PKCS7_to_TS_TST_INFO(a->token); - if (!a->tst_info) { - TSerror(TS_R_PKCS7_TO_TS_TST_INFO_FAILED); - return 0; - } - } else if (status == 0 || status == 1) { - TSerror(TS_R_TOKEN_NOT_PRESENT); - return 0; - } - - return 1; -} - -static int -ts_resp_cb(int op, ASN1_VALUE **pval, const ASN1_ITEM *it, void *exarg) -{ - TS_RESP *ts_resp = (TS_RESP *)*pval; - - if (op == ASN1_OP_NEW_POST) { - ts_resp->tst_info = NULL; - } else if (op == ASN1_OP_FREE_POST) { - if (ts_resp->tst_info != NULL) - TS_TST_INFO_free(ts_resp->tst_info); - } else if (op == ASN1_OP_D2I_POST) { - if (ts_resp_set_tst_info(ts_resp) == 0) - return 0; - } - return 1; -} - -static const ASN1_AUX TS_RESP_aux = { - .app_data = NULL, - .flags = 0, - .ref_offset = 0, - .ref_lock = 0, - .asn1_cb = ts_resp_cb, - .enc_offset = 0, -}; -static const ASN1_TEMPLATE TS_RESP_seq_tt[] = { - { - .flags = 0, - .tag = 0, - .offset = offsetof(TS_RESP, status_info), - .field_name = "status_info", - .item = &TS_STATUS_INFO_it, - }, - { - .flags = ASN1_TFLG_OPTIONAL, - .tag = 0, - .offset = offsetof(TS_RESP, token), - .field_name = "token", - .item = &PKCS7_it, - }, -}; - -static const ASN1_ITEM TS_RESP_it = { - .itype = ASN1_ITYPE_SEQUENCE, - .utype = V_ASN1_SEQUENCE, - .templates = TS_RESP_seq_tt, - .tcount = sizeof(TS_RESP_seq_tt) / sizeof(ASN1_TEMPLATE), - .funcs = &TS_RESP_aux, - .size = sizeof(TS_RESP), - .sname = "TS_RESP", -}; - - -TS_RESP * -d2i_TS_RESP(TS_RESP **a, const unsigned char **in, long len) -{ - return (TS_RESP *)ASN1_item_d2i((ASN1_VALUE **)a, in, len, - &TS_RESP_it); -} -LCRYPTO_ALIAS(d2i_TS_RESP); - -int -i2d_TS_RESP(const TS_RESP *a, unsigned char **out) -{ - return ASN1_item_i2d((ASN1_VALUE *)a, out, &TS_RESP_it); -} -LCRYPTO_ALIAS(i2d_TS_RESP); - -TS_RESP * -TS_RESP_new(void) -{ - return (TS_RESP *)ASN1_item_new(&TS_RESP_it); -} -LCRYPTO_ALIAS(TS_RESP_new); - -void -TS_RESP_free(TS_RESP *a) -{ - ASN1_item_free((ASN1_VALUE *)a, &TS_RESP_it); -} -LCRYPTO_ALIAS(TS_RESP_free); - -TS_RESP * -TS_RESP_dup(TS_RESP *x) -{ - return ASN1_item_dup(&TS_RESP_it, x); -} -LCRYPTO_ALIAS(TS_RESP_dup); - -#ifndef OPENSSL_NO_BIO -TS_RESP * -d2i_TS_RESP_bio(BIO *bp, TS_RESP **a) -{ - return ASN1_item_d2i_bio(&TS_RESP_it, bp, a); -} -LCRYPTO_ALIAS(d2i_TS_RESP_bio); - -int -i2d_TS_RESP_bio(BIO *bp, TS_RESP *a) -{ - return ASN1_item_i2d_bio(&TS_RESP_it, bp, a); -} -LCRYPTO_ALIAS(i2d_TS_RESP_bio); -#endif - -TS_RESP * -d2i_TS_RESP_fp(FILE *fp, TS_RESP **a) -{ - return ASN1_item_d2i_fp(&TS_RESP_it, fp, a); -} -LCRYPTO_ALIAS(d2i_TS_RESP_fp); - -int -i2d_TS_RESP_fp(FILE *fp, TS_RESP *a) -{ - return ASN1_item_i2d_fp(&TS_RESP_it, fp, a); -} -LCRYPTO_ALIAS(i2d_TS_RESP_fp); - -static const ASN1_TEMPLATE ESS_ISSUER_SERIAL_seq_tt[] = { - { - .flags = ASN1_TFLG_SEQUENCE_OF, - .tag = 0, - .offset = offsetof(ESS_ISSUER_SERIAL, issuer), - .field_name = "issuer", - .item = &GENERAL_NAME_it, - }, - { - .flags = 0, - .tag = 0, - .offset = offsetof(ESS_ISSUER_SERIAL, serial), - .field_name = "serial", - .item = &ASN1_INTEGER_it, - }, -}; - -static const ASN1_ITEM ESS_ISSUER_SERIAL_it = { - .itype = ASN1_ITYPE_SEQUENCE, - .utype = V_ASN1_SEQUENCE, - .templates = ESS_ISSUER_SERIAL_seq_tt, - .tcount = sizeof(ESS_ISSUER_SERIAL_seq_tt) / sizeof(ASN1_TEMPLATE), - .funcs = NULL, - .size = sizeof(ESS_ISSUER_SERIAL), - .sname = "ESS_ISSUER_SERIAL", -}; - - -ESS_ISSUER_SERIAL * -d2i_ESS_ISSUER_SERIAL(ESS_ISSUER_SERIAL **a, const unsigned char **in, long len) -{ - return (ESS_ISSUER_SERIAL *)ASN1_item_d2i((ASN1_VALUE **)a, in, len, - &ESS_ISSUER_SERIAL_it); -} -LCRYPTO_ALIAS(d2i_ESS_ISSUER_SERIAL); - -int -i2d_ESS_ISSUER_SERIAL(const ESS_ISSUER_SERIAL *a, unsigned char **out) -{ - return ASN1_item_i2d((ASN1_VALUE *)a, out, &ESS_ISSUER_SERIAL_it); -} -LCRYPTO_ALIAS(i2d_ESS_ISSUER_SERIAL); - -ESS_ISSUER_SERIAL * -ESS_ISSUER_SERIAL_new(void) -{ - return (ESS_ISSUER_SERIAL *)ASN1_item_new(&ESS_ISSUER_SERIAL_it); -} -LCRYPTO_ALIAS(ESS_ISSUER_SERIAL_new); - -void -ESS_ISSUER_SERIAL_free(ESS_ISSUER_SERIAL *a) -{ - ASN1_item_free((ASN1_VALUE *)a, &ESS_ISSUER_SERIAL_it); -} -LCRYPTO_ALIAS(ESS_ISSUER_SERIAL_free); - -ESS_ISSUER_SERIAL * -ESS_ISSUER_SERIAL_dup(ESS_ISSUER_SERIAL *x) -{ - return ASN1_item_dup(&ESS_ISSUER_SERIAL_it, x); -} -LCRYPTO_ALIAS(ESS_ISSUER_SERIAL_dup); - -static const ASN1_TEMPLATE ESS_CERT_ID_seq_tt[] = { - { - .flags = 0, - .tag = 0, - .offset = offsetof(ESS_CERT_ID, hash), - .field_name = "hash", - .item = &ASN1_OCTET_STRING_it, - }, - { - .flags = ASN1_TFLG_OPTIONAL, - .tag = 0, - .offset = offsetof(ESS_CERT_ID, issuer_serial), - .field_name = "issuer_serial", - .item = &ESS_ISSUER_SERIAL_it, - }, -}; - -static const ASN1_ITEM ESS_CERT_ID_it = { - .itype = ASN1_ITYPE_SEQUENCE, - .utype = V_ASN1_SEQUENCE, - .templates = ESS_CERT_ID_seq_tt, - .tcount = sizeof(ESS_CERT_ID_seq_tt) / sizeof(ASN1_TEMPLATE), - .funcs = NULL, - .size = sizeof(ESS_CERT_ID), - .sname = "ESS_CERT_ID", -}; - - -ESS_CERT_ID * -d2i_ESS_CERT_ID(ESS_CERT_ID **a, const unsigned char **in, long len) -{ - return (ESS_CERT_ID *)ASN1_item_d2i((ASN1_VALUE **)a, in, len, - &ESS_CERT_ID_it); -} -LCRYPTO_ALIAS(d2i_ESS_CERT_ID); - -int -i2d_ESS_CERT_ID(const ESS_CERT_ID *a, unsigned char **out) -{ - return ASN1_item_i2d((ASN1_VALUE *)a, out, &ESS_CERT_ID_it); -} -LCRYPTO_ALIAS(i2d_ESS_CERT_ID); - -ESS_CERT_ID * -ESS_CERT_ID_new(void) -{ - return (ESS_CERT_ID *)ASN1_item_new(&ESS_CERT_ID_it); -} -LCRYPTO_ALIAS(ESS_CERT_ID_new); - -void -ESS_CERT_ID_free(ESS_CERT_ID *a) -{ - ASN1_item_free((ASN1_VALUE *)a, &ESS_CERT_ID_it); -} -LCRYPTO_ALIAS(ESS_CERT_ID_free); - -ESS_CERT_ID * -ESS_CERT_ID_dup(ESS_CERT_ID *x) -{ - return ASN1_item_dup(&ESS_CERT_ID_it, x); -} -LCRYPTO_ALIAS(ESS_CERT_ID_dup); - -static const ASN1_TEMPLATE ESS_SIGNING_CERT_seq_tt[] = { - { - .flags = ASN1_TFLG_SEQUENCE_OF, - .tag = 0, - .offset = offsetof(ESS_SIGNING_CERT, cert_ids), - .field_name = "cert_ids", - .item = &ESS_CERT_ID_it, - }, - { - .flags = ASN1_TFLG_SEQUENCE_OF | ASN1_TFLG_OPTIONAL, - .tag = 0, - .offset = offsetof(ESS_SIGNING_CERT, policy_info), - .field_name = "policy_info", - .item = &POLICYINFO_it, - }, -}; - -static const ASN1_ITEM ESS_SIGNING_CERT_it = { - .itype = ASN1_ITYPE_SEQUENCE, - .utype = V_ASN1_SEQUENCE, - .templates = ESS_SIGNING_CERT_seq_tt, - .tcount = sizeof(ESS_SIGNING_CERT_seq_tt) / sizeof(ASN1_TEMPLATE), - .funcs = NULL, - .size = sizeof(ESS_SIGNING_CERT), - .sname = "ESS_SIGNING_CERT", -}; - - -ESS_SIGNING_CERT * -d2i_ESS_SIGNING_CERT(ESS_SIGNING_CERT **a, const unsigned char **in, long len) -{ - return (ESS_SIGNING_CERT *)ASN1_item_d2i((ASN1_VALUE **)a, in, len, - &ESS_SIGNING_CERT_it); -} -LCRYPTO_ALIAS(d2i_ESS_SIGNING_CERT); - -int -i2d_ESS_SIGNING_CERT(const ESS_SIGNING_CERT *a, unsigned char **out) -{ - return ASN1_item_i2d((ASN1_VALUE *)a, out, &ESS_SIGNING_CERT_it); -} -LCRYPTO_ALIAS(i2d_ESS_SIGNING_CERT); - -ESS_SIGNING_CERT * -ESS_SIGNING_CERT_new(void) -{ - return (ESS_SIGNING_CERT *)ASN1_item_new(&ESS_SIGNING_CERT_it); -} -LCRYPTO_ALIAS(ESS_SIGNING_CERT_new); - -void -ESS_SIGNING_CERT_free(ESS_SIGNING_CERT *a) -{ - ASN1_item_free((ASN1_VALUE *)a, &ESS_SIGNING_CERT_it); -} -LCRYPTO_ALIAS(ESS_SIGNING_CERT_free); - -ESS_SIGNING_CERT * -ESS_SIGNING_CERT_dup(ESS_SIGNING_CERT *x) -{ - return ASN1_item_dup(&ESS_SIGNING_CERT_it, x); -} -LCRYPTO_ALIAS(ESS_SIGNING_CERT_dup); - -static const ASN1_TEMPLATE ESS_CERT_ID_V2_seq_tt[] = { - { - .flags = ASN1_TFLG_OPTIONAL, - .tag = 0, - .offset = offsetof(ESS_CERT_ID_V2, hash_alg), - .field_name = "hash_alg", - .item = &X509_ALGOR_it, - }, - { - .flags = 0, - .tag = 0, - .offset = offsetof(ESS_CERT_ID_V2, hash), - .field_name = "hash", - .item = &ASN1_OCTET_STRING_it, - }, - { - .flags = ASN1_TFLG_OPTIONAL, - .tag = 0, - .offset = offsetof(ESS_CERT_ID_V2, issuer_serial), - .field_name = "issuer_serial", - .item = &ESS_ISSUER_SERIAL_it, - }, -}; - -static const ASN1_ITEM ESS_CERT_ID_V2_it = { - .itype = ASN1_ITYPE_SEQUENCE, - .utype = V_ASN1_SEQUENCE, - .templates = ESS_CERT_ID_V2_seq_tt, - .tcount = sizeof(ESS_CERT_ID_V2_seq_tt) / sizeof(ASN1_TEMPLATE), - .funcs = NULL, - .size = sizeof(ESS_CERT_ID_V2), - .sname = "ESS_CERT_ID_V2", -}; - -ESS_CERT_ID_V2 * -d2i_ESS_CERT_ID_V2(ESS_CERT_ID_V2 **a, const unsigned char **in, long len) -{ - return (ESS_CERT_ID_V2 *)ASN1_item_d2i((ASN1_VALUE **)a, in, len, - &ESS_CERT_ID_V2_it); -} - -int -i2d_ESS_CERT_ID_V2(const ESS_CERT_ID_V2 *a, unsigned char **out) -{ - return ASN1_item_i2d((ASN1_VALUE *)a, out, &ESS_CERT_ID_V2_it); -} - -ESS_CERT_ID_V2 * -ESS_CERT_ID_V2_new(void) -{ - return (ESS_CERT_ID_V2 *)ASN1_item_new(&ESS_CERT_ID_V2_it); -} - -void -ESS_CERT_ID_V2_free(ESS_CERT_ID_V2 *a) -{ - ASN1_item_free((ASN1_VALUE *)a, &ESS_CERT_ID_V2_it); -} - -ESS_CERT_ID_V2 * -ESS_CERT_ID_V2_dup(ESS_CERT_ID_V2 *x) -{ - return ASN1_item_dup(&ESS_CERT_ID_V2_it, x); -} - -static const ASN1_TEMPLATE ESS_SIGNING_CERT_V2_seq_tt[] = { - { - .flags = ASN1_TFLG_SEQUENCE_OF, - .tag = 0, - .offset = offsetof(ESS_SIGNING_CERT_V2, cert_ids), - .field_name = "cert_ids", - .item = &ESS_CERT_ID_V2_it, - }, - { - .flags = ASN1_TFLG_SEQUENCE_OF | ASN1_TFLG_OPTIONAL, - .tag = 0, - .offset = offsetof(ESS_SIGNING_CERT_V2, policy_info), - .field_name = "policy_info", - .item = &POLICYINFO_it, - }, -}; - -static const ASN1_ITEM ESS_SIGNING_CERT_V2_it = { - .itype = ASN1_ITYPE_SEQUENCE, - .utype = V_ASN1_SEQUENCE, - .templates = ESS_SIGNING_CERT_V2_seq_tt, - .tcount = sizeof(ESS_SIGNING_CERT_V2_seq_tt) / sizeof(ASN1_TEMPLATE), - .funcs = NULL, - .size = sizeof(ESS_SIGNING_CERT_V2), - .sname = "ESS_SIGNING_CERT_V2", -}; - -ESS_SIGNING_CERT_V2 * -d2i_ESS_SIGNING_CERT_V2(ESS_SIGNING_CERT_V2 **a, const unsigned char **in, long len) -{ - return (ESS_SIGNING_CERT_V2 *)ASN1_item_d2i((ASN1_VALUE **)a, in, len, - &ESS_SIGNING_CERT_V2_it); -} - -int -i2d_ESS_SIGNING_CERT_V2(const ESS_SIGNING_CERT_V2 *a, unsigned char **out) -{ - return ASN1_item_i2d((ASN1_VALUE *)a, out, &ESS_SIGNING_CERT_V2_it); -} - -ESS_SIGNING_CERT_V2 * -ESS_SIGNING_CERT_V2_new(void) -{ - return (ESS_SIGNING_CERT_V2 *)ASN1_item_new(&ESS_SIGNING_CERT_V2_it); -} - -void -ESS_SIGNING_CERT_V2_free(ESS_SIGNING_CERT_V2 *a) -{ - ASN1_item_free((ASN1_VALUE *)a, &ESS_SIGNING_CERT_V2_it); -} - -ESS_SIGNING_CERT_V2 * -ESS_SIGNING_CERT_V2_dup(ESS_SIGNING_CERT_V2 *x) -{ - return ASN1_item_dup(&ESS_SIGNING_CERT_V2_it, x); -} - -/* Getting encapsulated TS_TST_INFO object from PKCS7. */ -TS_TST_INFO * -PKCS7_to_TS_TST_INFO(PKCS7 *token) -{ - PKCS7_SIGNED *pkcs7_signed; - PKCS7 *enveloped; - ASN1_TYPE *tst_info_wrapper; - ASN1_OCTET_STRING *tst_info_der; - const unsigned char *p; - - if (!PKCS7_type_is_signed(token)) { - TSerror(TS_R_BAD_PKCS7_TYPE); - return NULL; - } - - /* Content must be present. */ - if (PKCS7_get_detached(token)) { - TSerror(TS_R_DETACHED_CONTENT); - return NULL; - } - - /* We have a signed data with content. */ - pkcs7_signed = token->d.sign; - enveloped = pkcs7_signed->contents; - if (OBJ_obj2nid(enveloped->type) != NID_id_smime_ct_TSTInfo) { - TSerror(TS_R_BAD_PKCS7_TYPE); - return NULL; - } - - /* We have a DER encoded TST_INFO as the signed data. */ - tst_info_wrapper = enveloped->d.other; - if (tst_info_wrapper->type != V_ASN1_OCTET_STRING) { - TSerror(TS_R_BAD_TYPE); - return NULL; - } - - /* We have the correct ASN1_OCTET_STRING type. */ - tst_info_der = tst_info_wrapper->value.octet_string; - /* At last, decode the TST_INFO. */ - p = tst_info_der->data; - return d2i_TS_TST_INFO(NULL, &p, tst_info_der->length); -} -LCRYPTO_ALIAS(PKCS7_to_TS_TST_INFO); diff --git a/src/lib/libcrypto/ts/ts_conf.c b/src/lib/libcrypto/ts/ts_conf.c deleted file mode 100644 index bd499238f5..0000000000 --- a/src/lib/libcrypto/ts/ts_conf.c +++ /dev/null @@ -1,517 +0,0 @@ -/* $OpenBSD: ts_conf.c,v 1.15 2024/08/26 22:01:28 op Exp $ */ -/* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL - * project 2002. - */ -/* ==================================================================== - * Copyright (c) 2006 The OpenSSL Project. All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in - * the documentation and/or other materials provided with the - * distribution. - * - * 3. All advertising materials mentioning features or use of this - * software must display the following acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" - * - * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to - * endorse or promote products derived from this software without - * prior written permission. For written permission, please contact - * licensing@OpenSSL.org. - * - * 5. Products derived from this software may not be called "OpenSSL" - * nor may "OpenSSL" appear in their names without prior written - * permission of the OpenSSL Project. - * - * 6. Redistributions of any form whatsoever must retain the following - * acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" - * - * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY - * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR - * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR - * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT - * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; - * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, - * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED - * OF THE POSSIBILITY OF SUCH DAMAGE. - * ==================================================================== - * - * This product includes cryptographic software written by Eric Young - * (eay@cryptsoft.com). This product includes software written by Tim - * Hudson (tjh@cryptsoft.com). - * - */ - -#include -#include -#include - -#include - -#include -#include -#include -#include - -/* Macro definitions for the configuration file. */ - -#define BASE_SECTION "tsa" -#define ENV_DEFAULT_TSA "default_tsa" -#define ENV_SERIAL "serial" -#define ENV_CRYPTO_DEVICE "crypto_device" -#define ENV_SIGNER_CERT "signer_cert" -#define ENV_CERTS "certs" -#define ENV_SIGNER_KEY "signer_key" -#define ENV_DEFAULT_POLICY "default_policy" -#define ENV_OTHER_POLICIES "other_policies" -#define ENV_DIGESTS "digests" -#define ENV_ACCURACY "accuracy" -#define ENV_ORDERING "ordering" -#define ENV_TSA_NAME "tsa_name" -#define ENV_ESS_CERT_ID_CHAIN "ess_cert_id_chain" -#define ENV_VALUE_SECS "secs" -#define ENV_VALUE_MILLISECS "millisecs" -#define ENV_VALUE_MICROSECS "microsecs" -#define ENV_CLOCK_PRECISION_DIGITS "clock_precision_digits" -#define ENV_VALUE_YES "yes" -#define ENV_VALUE_NO "no" - -/* Function definitions for certificate and key loading. */ - -X509 * -TS_CONF_load_cert(const char *file) -{ - BIO *cert = NULL; - X509 *x = NULL; - - if ((cert = BIO_new_file(file, "r")) == NULL) - goto end; - x = PEM_read_bio_X509_AUX(cert, NULL, NULL, NULL); - -end: - if (x == NULL) - fprintf(stderr, "unable to load certificate: %s\n", file); - BIO_free(cert); - return x; -} -LCRYPTO_ALIAS(TS_CONF_load_cert); - -STACK_OF(X509) * -TS_CONF_load_certs(const char *file) -{ - BIO *certs = NULL; - STACK_OF(X509) *othercerts = NULL; - STACK_OF(X509_INFO) *allcerts = NULL; - int i; - - if (!(certs = BIO_new_file(file, "r"))) - goto end; - - if (!(othercerts = sk_X509_new_null())) - goto end; - allcerts = PEM_X509_INFO_read_bio(certs, NULL, NULL, NULL); - for (i = 0; i < sk_X509_INFO_num(allcerts); i++) { - X509_INFO *xi = sk_X509_INFO_value(allcerts, i); - if (xi->x509) { - if (sk_X509_push(othercerts, xi->x509) == 0) { - sk_X509_pop_free(othercerts, X509_free); - othercerts = NULL; - goto end; - } - xi->x509 = NULL; - } - } - -end: - if (othercerts == NULL) - fprintf(stderr, "unable to load certificates: %s\n", file); - sk_X509_INFO_pop_free(allcerts, X509_INFO_free); - BIO_free(certs); - return othercerts; -} -LCRYPTO_ALIAS(TS_CONF_load_certs); - -EVP_PKEY * -TS_CONF_load_key(const char *file, const char *pass) -{ - BIO *key = NULL; - EVP_PKEY *pkey = NULL; - - if (!(key = BIO_new_file(file, "r"))) - goto end; - pkey = PEM_read_bio_PrivateKey(key, NULL, NULL, (char *) pass); - -end: - if (pkey == NULL) - fprintf(stderr, "unable to load private key: %s\n", file); - BIO_free(key); - return pkey; -} -LCRYPTO_ALIAS(TS_CONF_load_key); - -/* Function definitions for handling configuration options. */ - -static void -TS_CONF_lookup_fail(const char *name, const char *tag) -{ - fprintf(stderr, "variable lookup failed for %s::%s\n", name, tag); -} - -static void -TS_CONF_invalid(const char *name, const char *tag) -{ - fprintf(stderr, "invalid variable value for %s::%s\n", name, tag); -} - -const char * -TS_CONF_get_tsa_section(CONF *conf, const char *section) -{ - if (!section) { - section = NCONF_get_string(conf, BASE_SECTION, ENV_DEFAULT_TSA); - if (!section) - TS_CONF_lookup_fail(BASE_SECTION, ENV_DEFAULT_TSA); - } - return section; -} -LCRYPTO_ALIAS(TS_CONF_get_tsa_section); - -int -TS_CONF_set_serial(CONF *conf, const char *section, TS_serial_cb cb, - TS_RESP_CTX *ctx) -{ - int ret = 0; - char *serial = NCONF_get_string(conf, section, ENV_SERIAL); - - if (!serial) { - TS_CONF_lookup_fail(section, ENV_SERIAL); - goto err; - } - TS_RESP_CTX_set_serial_cb(ctx, cb, serial); - - ret = 1; - -err: - return ret; -} -LCRYPTO_ALIAS(TS_CONF_set_serial); - -int -TS_CONF_set_signer_cert(CONF *conf, const char *section, const char *cert, - TS_RESP_CTX *ctx) -{ - int ret = 0; - X509 *cert_obj = NULL; - - if (!cert) - cert = NCONF_get_string(conf, section, ENV_SIGNER_CERT); - if (!cert) { - TS_CONF_lookup_fail(section, ENV_SIGNER_CERT); - goto err; - } - if (!(cert_obj = TS_CONF_load_cert(cert))) - goto err; - if (!TS_RESP_CTX_set_signer_cert(ctx, cert_obj)) - goto err; - - ret = 1; - -err: - X509_free(cert_obj); - return ret; -} -LCRYPTO_ALIAS(TS_CONF_set_signer_cert); - -int -TS_CONF_set_certs(CONF *conf, const char *section, const char *certs, - TS_RESP_CTX *ctx) -{ - int ret = 0; - STACK_OF(X509) *certs_obj = NULL; - - if (!certs) - certs = NCONF_get_string(conf, section, ENV_CERTS); - /* Certificate chain is optional. */ - if (!certs) - goto end; - if (!(certs_obj = TS_CONF_load_certs(certs))) - goto err; - if (!TS_RESP_CTX_set_certs(ctx, certs_obj)) - goto err; - -end: - ret = 1; -err: - sk_X509_pop_free(certs_obj, X509_free); - return ret; -} -LCRYPTO_ALIAS(TS_CONF_set_certs); - -int -TS_CONF_set_signer_key(CONF *conf, const char *section, const char *key, - const char *pass, TS_RESP_CTX *ctx) -{ - int ret = 0; - EVP_PKEY *key_obj = NULL; - - if (!key) - key = NCONF_get_string(conf, section, ENV_SIGNER_KEY); - if (!key) { - TS_CONF_lookup_fail(section, ENV_SIGNER_KEY); - goto err; - } - if (!(key_obj = TS_CONF_load_key(key, pass))) - goto err; - if (!TS_RESP_CTX_set_signer_key(ctx, key_obj)) - goto err; - - ret = 1; - -err: - EVP_PKEY_free(key_obj); - return ret; -} -LCRYPTO_ALIAS(TS_CONF_set_signer_key); - -int -TS_CONF_set_def_policy(CONF *conf, const char *section, const char *policy, - TS_RESP_CTX *ctx) -{ - int ret = 0; - ASN1_OBJECT *policy_obj = NULL; - - if (!policy) - policy = NCONF_get_string(conf, section, ENV_DEFAULT_POLICY); - if (!policy) { - TS_CONF_lookup_fail(section, ENV_DEFAULT_POLICY); - goto err; - } - if (!(policy_obj = OBJ_txt2obj(policy, 0))) { - TS_CONF_invalid(section, ENV_DEFAULT_POLICY); - goto err; - } - if (!TS_RESP_CTX_set_def_policy(ctx, policy_obj)) - goto err; - - ret = 1; - -err: - ASN1_OBJECT_free(policy_obj); - return ret; -} -LCRYPTO_ALIAS(TS_CONF_set_def_policy); - -int -TS_CONF_set_policies(CONF *conf, const char *section, TS_RESP_CTX *ctx) -{ - int ret = 0; - int i; - STACK_OF(CONF_VALUE) *list = NULL; - char *policies = NCONF_get_string(conf, section, ENV_OTHER_POLICIES); - - /* If no other policy is specified, that's fine. */ - if (policies && !(list = X509V3_parse_list(policies))) { - TS_CONF_invalid(section, ENV_OTHER_POLICIES); - goto err; - } - for (i = 0; i < sk_CONF_VALUE_num(list); ++i) { - CONF_VALUE *val = sk_CONF_VALUE_value(list, i); - const char *extval = val->value ? val->value : val->name; - ASN1_OBJECT *objtmp; - if (!(objtmp = OBJ_txt2obj(extval, 0))) { - TS_CONF_invalid(section, ENV_OTHER_POLICIES); - goto err; - } - if (!TS_RESP_CTX_add_policy(ctx, objtmp)) - goto err; - ASN1_OBJECT_free(objtmp); - } - - ret = 1; - -err: - sk_CONF_VALUE_pop_free(list, X509V3_conf_free); - return ret; -} -LCRYPTO_ALIAS(TS_CONF_set_policies); - -int -TS_CONF_set_digests(CONF *conf, const char *section, TS_RESP_CTX *ctx) -{ - int ret = 0; - int i; - STACK_OF(CONF_VALUE) *list = NULL; - char *digests = NCONF_get_string(conf, section, ENV_DIGESTS); - - if (!digests) { - TS_CONF_lookup_fail(section, ENV_DIGESTS); - goto err; - } - if (!(list = X509V3_parse_list(digests))) { - TS_CONF_invalid(section, ENV_DIGESTS); - goto err; - } - if (sk_CONF_VALUE_num(list) == 0) { - TS_CONF_invalid(section, ENV_DIGESTS); - goto err; - } - for (i = 0; i < sk_CONF_VALUE_num(list); ++i) { - CONF_VALUE *val = sk_CONF_VALUE_value(list, i); - const char *extval = val->value ? val->value : val->name; - const EVP_MD *md; - if (!(md = EVP_get_digestbyname(extval))) { - TS_CONF_invalid(section, ENV_DIGESTS); - goto err; - } - if (!TS_RESP_CTX_add_md(ctx, md)) - goto err; - } - - ret = 1; - -err: - sk_CONF_VALUE_pop_free(list, X509V3_conf_free); - return ret; -} -LCRYPTO_ALIAS(TS_CONF_set_digests); - -int -TS_CONF_set_accuracy(CONF *conf, const char *section, TS_RESP_CTX *ctx) -{ - int ret = 0; - int i; - int secs = 0, millis = 0, micros = 0; - STACK_OF(CONF_VALUE) *list = NULL; - char *accuracy = NCONF_get_string(conf, section, ENV_ACCURACY); - const char *errstr; - - if (accuracy && !(list = X509V3_parse_list(accuracy))) { - TS_CONF_invalid(section, ENV_ACCURACY); - goto err; - } - for (i = 0; i < sk_CONF_VALUE_num(list); ++i) { - CONF_VALUE *val = sk_CONF_VALUE_value(list, i); - if (strcmp(val->name, ENV_VALUE_SECS) == 0) { - if (val->value) { - secs = strtonum(val->value, 0, INT_MAX, - &errstr); - if (errstr != NULL) { - TS_CONF_invalid(section, - ENV_VALUE_SECS); - goto err; - } - } - } else if (strcmp(val->name, ENV_VALUE_MILLISECS) == 0) { - if (val->value) { - millis = strtonum(val->value, 1, 999, &errstr); - if (errstr != NULL) { - TS_CONF_invalid(section, - ENV_VALUE_MILLISECS); - goto err; - } - } - } else if (strcmp(val->name, ENV_VALUE_MICROSECS) == 0) { - if (val->value) { - micros = strtonum(val->value, 1, 999, &errstr); - if (errstr != NULL) { - TS_CONF_invalid(section, - ENV_VALUE_MICROSECS); - goto err; - } - } - } else { - TS_CONF_invalid(section, ENV_ACCURACY); - goto err; - } - } - if (!TS_RESP_CTX_set_accuracy(ctx, secs, millis, micros)) - goto err; - - ret = 1; - -err: - sk_CONF_VALUE_pop_free(list, X509V3_conf_free); - return ret; -} -LCRYPTO_ALIAS(TS_CONF_set_accuracy); - -int -TS_CONF_set_clock_precision_digits(CONF *conf, const char *section, - TS_RESP_CTX *ctx) -{ - int ret = 0; - long digits = 0; - - /* If not specified, set the default value to 0, i.e. sec precision */ - if (!NCONF_get_number_e(conf, section, ENV_CLOCK_PRECISION_DIGITS, - &digits)) - digits = 0; - /* We only support second precision, so reject everything else */ - if (digits != 0) { - TS_CONF_invalid(section, ENV_CLOCK_PRECISION_DIGITS); - goto err; - } - - if (!TS_RESP_CTX_set_clock_precision_digits(ctx, digits)) - goto err; - - return 1; - -err: - return ret; -} -LCRYPTO_ALIAS(TS_CONF_set_clock_precision_digits); - -static int -TS_CONF_add_flag(CONF *conf, const char *section, const char *field, int flag, - TS_RESP_CTX *ctx) -{ - /* Default is false. */ - const char *value = NCONF_get_string(conf, section, field); - - if (value) { - if (strcmp(value, ENV_VALUE_YES) == 0) - TS_RESP_CTX_add_flags(ctx, flag); - else if (strcmp(value, ENV_VALUE_NO) != 0) { - TS_CONF_invalid(section, field); - return 0; - } - } - - return 1; -} - -int -TS_CONF_set_ordering(CONF *conf, const char *section, TS_RESP_CTX *ctx) -{ - return TS_CONF_add_flag(conf, section, ENV_ORDERING, TS_ORDERING, ctx); -} -LCRYPTO_ALIAS(TS_CONF_set_ordering); - -int -TS_CONF_set_tsa_name(CONF *conf, const char *section, TS_RESP_CTX *ctx) -{ - return TS_CONF_add_flag(conf, section, ENV_TSA_NAME, TS_TSA_NAME, ctx); -} -LCRYPTO_ALIAS(TS_CONF_set_tsa_name); - -int -TS_CONF_set_ess_cert_id_chain(CONF *conf, const char *section, TS_RESP_CTX *ctx) -{ - return TS_CONF_add_flag(conf, section, ENV_ESS_CERT_ID_CHAIN, - TS_ESS_CERT_ID_CHAIN, ctx); -} -LCRYPTO_ALIAS(TS_CONF_set_ess_cert_id_chain); diff --git a/src/lib/libcrypto/ts/ts_err.c b/src/lib/libcrypto/ts/ts_err.c deleted file mode 100644 index c0dcc73099..0000000000 --- a/src/lib/libcrypto/ts/ts_err.c +++ /dev/null @@ -1,126 +0,0 @@ -/* $OpenBSD: ts_err.c,v 1.8 2024/06/24 06:43:22 tb Exp $ */ -/* ==================================================================== - * Copyright (c) 1999-2007 The OpenSSL Project. All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in - * the documentation and/or other materials provided with the - * distribution. - * - * 3. All advertising materials mentioning features or use of this - * software must display the following acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" - * - * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to - * endorse or promote products derived from this software without - * prior written permission. For written permission, please contact - * openssl-core@OpenSSL.org. - * - * 5. Products derived from this software may not be called "OpenSSL" - * nor may "OpenSSL" appear in their names without prior written - * permission of the OpenSSL Project. - * - * 6. Redistributions of any form whatsoever must retain the following - * acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" - * - * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY - * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR - * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR - * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT - * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; - * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, - * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED - * OF THE POSSIBILITY OF SUCH DAMAGE. - * ==================================================================== - * - * This product includes cryptographic software written by Eric Young - * (eay@cryptsoft.com). This product includes software written by Tim - * Hudson (tjh@cryptsoft.com). - * - */ - -#include - -#include - -#include -#include - -#include "err_local.h" - -#ifndef OPENSSL_NO_ERR - -#define ERR_FUNC(func) ERR_PACK(ERR_LIB_TS,func,0) -#define ERR_REASON(reason) ERR_PACK(ERR_LIB_TS,0,reason) - -static const ERR_STRING_DATA TS_str_functs[] = { - {ERR_FUNC(0xfff), "CRYPTO_internal"}, - {0, NULL} -}; - -static const ERR_STRING_DATA TS_str_reasons[] = { - {ERR_REASON(TS_R_BAD_PKCS7_TYPE) , "bad pkcs7 type"}, - {ERR_REASON(TS_R_BAD_TYPE) , "bad type"}, - {ERR_REASON(TS_R_CERTIFICATE_VERIFY_ERROR), "certificate verify error"}, - {ERR_REASON(TS_R_COULD_NOT_SET_ENGINE) , "could not set engine"}, - {ERR_REASON(TS_R_COULD_NOT_SET_TIME) , "could not set time"}, - {ERR_REASON(TS_R_D2I_TS_RESP_INT_FAILED) , "d2i ts resp int failed"}, - {ERR_REASON(TS_R_DETACHED_CONTENT) , "detached content"}, - {ERR_REASON(TS_R_ESS_ADD_SIGNING_CERT_ERROR), "ess add signing cert error"}, - {ERR_REASON(TS_R_ESS_SIGNING_CERTIFICATE_ERROR), "ess signing certificate error"}, - {ERR_REASON(TS_R_INVALID_NULL_POINTER) , "invalid null pointer"}, - {ERR_REASON(TS_R_INVALID_SIGNER_CERTIFICATE_PURPOSE), "invalid signer certificate purpose"}, - {ERR_REASON(TS_R_MESSAGE_IMPRINT_MISMATCH), "message imprint mismatch"}, - {ERR_REASON(TS_R_NONCE_MISMATCH) , "nonce mismatch"}, - {ERR_REASON(TS_R_NONCE_NOT_RETURNED) , "nonce not returned"}, - {ERR_REASON(TS_R_NO_CONTENT) , "no content"}, - {ERR_REASON(TS_R_NO_TIME_STAMP_TOKEN) , "no time stamp token"}, - {ERR_REASON(TS_R_PKCS7_ADD_SIGNATURE_ERROR), "pkcs7 add signature error"}, - {ERR_REASON(TS_R_PKCS7_ADD_SIGNED_ATTR_ERROR), "pkcs7 add signed attr error"}, - {ERR_REASON(TS_R_PKCS7_TO_TS_TST_INFO_FAILED), "pkcs7 to ts tst info failed"}, - {ERR_REASON(TS_R_POLICY_MISMATCH) , "policy mismatch"}, - {ERR_REASON(TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE), "private key does not match certificate"}, - {ERR_REASON(TS_R_RESPONSE_SETUP_ERROR) , "response setup error"}, - {ERR_REASON(TS_R_SIGNATURE_FAILURE) , "signature failure"}, - {ERR_REASON(TS_R_THERE_MUST_BE_ONE_SIGNER), "there must be one signer"}, - {ERR_REASON(TS_R_TIME_SYSCALL_ERROR) , "time syscall error"}, - {ERR_REASON(TS_R_TOKEN_NOT_PRESENT) , "token not present"}, - {ERR_REASON(TS_R_TOKEN_PRESENT) , "token present"}, - {ERR_REASON(TS_R_TSA_NAME_MISMATCH) , "tsa name mismatch"}, - {ERR_REASON(TS_R_TSA_UNTRUSTED) , "tsa untrusted"}, - {ERR_REASON(TS_R_TST_INFO_SETUP_ERROR) , "tst info setup error"}, - {ERR_REASON(TS_R_TS_DATASIGN) , "ts datasign"}, - {ERR_REASON(TS_R_UNACCEPTABLE_POLICY) , "unacceptable policy"}, - {ERR_REASON(TS_R_UNSUPPORTED_MD_ALGORITHM), "unsupported md algorithm"}, - {ERR_REASON(TS_R_UNSUPPORTED_VERSION) , "unsupported version"}, - {ERR_REASON(TS_R_WRONG_CONTENT_TYPE) , "wrong content type"}, - {0, NULL} -}; - -#endif - -void -ERR_load_TS_strings(void) -{ -#ifndef OPENSSL_NO_ERR - if (ERR_func_error_string(TS_str_functs[0].error) == NULL) { - ERR_load_const_strings(TS_str_functs); - ERR_load_const_strings(TS_str_reasons); - } -#endif -} -LCRYPTO_ALIAS(ERR_load_TS_strings); diff --git a/src/lib/libcrypto/ts/ts_lib.c b/src/lib/libcrypto/ts/ts_lib.c deleted file mode 100644 index 7e40101752..0000000000 --- a/src/lib/libcrypto/ts/ts_lib.c +++ /dev/null @@ -1,163 +0,0 @@ -/* $OpenBSD: ts_lib.c,v 1.15 2025/01/07 14:22:19 tb Exp $ */ -/* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL - * project 2002. - */ -/* ==================================================================== - * Copyright (c) 2006 The OpenSSL Project. All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in - * the documentation and/or other materials provided with the - * distribution. - * - * 3. All advertising materials mentioning features or use of this - * software must display the following acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" - * - * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to - * endorse or promote products derived from this software without - * prior written permission. For written permission, please contact - * licensing@OpenSSL.org. - * - * 5. Products derived from this software may not be called "OpenSSL" - * nor may "OpenSSL" appear in their names without prior written - * permission of the OpenSSL Project. - * - * 6. Redistributions of any form whatsoever must retain the following - * acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" - * - * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY - * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR - * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR - * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT - * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; - * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, - * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED - * OF THE POSSIBILITY OF SUCH DAMAGE. - * ==================================================================== - * - * This product includes cryptographic software written by Eric Young - * (eay@cryptsoft.com). This product includes software written by Tim - * Hudson (tjh@cryptsoft.com). - * - */ - -#include -#include - -#include -#include -#include -#include - -#include "bn_local.h" -#include "x509_local.h" - -/* Local function declarations. */ - -/* Function definitions. */ - -int -TS_ASN1_INTEGER_print_bio(BIO *bio, const ASN1_INTEGER *num) -{ - BIGNUM *bn = NULL; - char *hex = NULL; - int ret = 0; - - /* XXX - OpenSSL decided to return -1 here for some stupid reason. */ - if ((bn = ASN1_INTEGER_to_BN(num, NULL)) == NULL) - goto err; - if ((hex = BN_bn2hex(bn)) == NULL) - goto err; - if (BIO_printf(bio, "0x%s", hex) <= 0) - goto err; - - ret = 1; - - err: - BN_free(bn); - free(hex); - - return ret; -} -LCRYPTO_ALIAS(TS_ASN1_INTEGER_print_bio); - -int -TS_OBJ_print_bio(BIO *bio, const ASN1_OBJECT *obj) -{ - char obj_txt[128]; - - int len = OBJ_obj2txt(obj_txt, sizeof(obj_txt), obj, 0); - if (len >= sizeof(obj_txt)) - len = sizeof(obj_txt) - 1; - BIO_write(bio, obj_txt, len); - BIO_write(bio, "\n", 1); - return 1; -} -LCRYPTO_ALIAS(TS_OBJ_print_bio); - -int -TS_ext_print_bio(BIO *bio, const STACK_OF(X509_EXTENSION) *extensions) -{ - int i, critical, n; - X509_EXTENSION *ex; - ASN1_OBJECT *obj; - - BIO_printf(bio, "Extensions:\n"); - n = X509v3_get_ext_count(extensions); - for (i = 0; i < n; i++) { - ex = X509v3_get_ext(extensions, i); - obj = X509_EXTENSION_get_object(ex); - i2a_ASN1_OBJECT(bio, obj); - critical = X509_EXTENSION_get_critical(ex); - BIO_printf(bio, ": %s\n", critical ? "critical" : ""); - if (!X509V3_EXT_print(bio, ex, 0, 4)) { - BIO_printf(bio, "%4s", ""); - ASN1_STRING_print(bio, ex->value); - } - BIO_write(bio, "\n", 1); - } - - return 1; -} -LCRYPTO_ALIAS(TS_ext_print_bio); - -int -TS_X509_ALGOR_print_bio(BIO *bio, const X509_ALGOR *alg) -{ - int i = OBJ_obj2nid(alg->algorithm); - - return BIO_printf(bio, "Hash Algorithm: %s\n", - (i == NID_undef) ? "UNKNOWN" : OBJ_nid2ln(i)); -} -LCRYPTO_ALIAS(TS_X509_ALGOR_print_bio); - -int -TS_MSG_IMPRINT_print_bio(BIO *bio, TS_MSG_IMPRINT *a) -{ - ASN1_OCTET_STRING *msg; - - TS_X509_ALGOR_print_bio(bio, TS_MSG_IMPRINT_get_algo(a)); - - BIO_printf(bio, "Message data:\n"); - msg = TS_MSG_IMPRINT_get_msg(a); - BIO_dump_indent(bio, (const char *)ASN1_STRING_data(msg), - ASN1_STRING_length(msg), 4); - - return 1; -} -LCRYPTO_ALIAS(TS_MSG_IMPRINT_print_bio); diff --git a/src/lib/libcrypto/ts/ts_local.h b/src/lib/libcrypto/ts/ts_local.h deleted file mode 100644 index 07c9861e02..0000000000 --- a/src/lib/libcrypto/ts/ts_local.h +++ /dev/null @@ -1,316 +0,0 @@ -/* $OpenBSD: ts_local.h,v 1.3 2022/11/26 17:23:18 tb Exp $ */ -/* Written by Zoltan Glozik (zglozik@opentsa.org) for the OpenSSL - * project 2002, 2003, 2004. - */ -/* ==================================================================== - * Copyright (c) 2006 The OpenSSL Project. All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in - * the documentation and/or other materials provided with the - * distribution. - * - * 3. All advertising materials mentioning features or use of this - * software must display the following acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" - * - * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to - * endorse or promote products derived from this software without - * prior written permission. For written permission, please contact - * licensing@OpenSSL.org. - * - * 5. Products derived from this software may not be called "OpenSSL" - * nor may "OpenSSL" appear in their names without prior written - * permission of the OpenSSL Project. - * - * 6. Redistributions of any form whatsoever must retain the following - * acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" - * - * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY - * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR - * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR - * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT - * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; - * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, - * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED - * OF THE POSSIBILITY OF SUCH DAMAGE. - * ==================================================================== - * - * This product includes cryptographic software written by Eric Young - * (eay@cryptsoft.com). This product includes software written by Tim - * Hudson (tjh@cryptsoft.com). - * - */ - -#ifndef HEADER_TS_LOCAL_H -#define HEADER_TS_LOCAL_H - -__BEGIN_HIDDEN_DECLS - -/* - * MessageImprint ::= SEQUENCE { - * hashAlgorithm AlgorithmIdentifier, - * hashedMessage OCTET STRING } - */ - -struct TS_msg_imprint_st { - X509_ALGOR *hash_algo; - ASN1_OCTET_STRING *hashed_msg; -}; - -/* - * TimeStampReq ::= SEQUENCE { - * version INTEGER { v1(1) }, - * messageImprint MessageImprint, - * --a hash algorithm OID and the hash value of the data to be - * --time-stamped - * reqPolicy TSAPolicyId OPTIONAL, - * nonce INTEGER OPTIONAL, - * certReq BOOLEAN DEFAULT FALSE, - * extensions [0] IMPLICIT Extensions OPTIONAL } - */ - -struct TS_req_st { - ASN1_INTEGER *version; - TS_MSG_IMPRINT *msg_imprint; - ASN1_OBJECT *policy_id; /* OPTIONAL */ - ASN1_INTEGER *nonce; /* OPTIONAL */ - ASN1_BOOLEAN cert_req; /* DEFAULT FALSE */ - STACK_OF(X509_EXTENSION) *extensions; /* [0] OPTIONAL */ -}; - -/* - * Accuracy ::= SEQUENCE { - * seconds INTEGER OPTIONAL, - * millis [0] INTEGER (1..999) OPTIONAL, - * micros [1] INTEGER (1..999) OPTIONAL } - */ - -struct TS_accuracy_st { - ASN1_INTEGER *seconds; - ASN1_INTEGER *millis; - ASN1_INTEGER *micros; -}; - -/* - * TSTInfo ::= SEQUENCE { - * version INTEGER { v1(1) }, - * policy TSAPolicyId, - * messageImprint MessageImprint, - * -- MUST have the same value as the similar field in - * -- TimeStampReq - * serialNumber INTEGER, - * -- Time-Stamping users MUST be ready to accommodate integers - * -- up to 160 bits. - * genTime GeneralizedTime, - * accuracy Accuracy OPTIONAL, - * ordering BOOLEAN DEFAULT FALSE, - * nonce INTEGER OPTIONAL, - * -- MUST be present if the similar field was present - * -- in TimeStampReq. In that case it MUST have the same value. - * tsa [0] GeneralName OPTIONAL, - * extensions [1] IMPLICIT Extensions OPTIONAL } - */ - -struct TS_tst_info_st { - ASN1_INTEGER *version; - ASN1_OBJECT *policy_id; - TS_MSG_IMPRINT *msg_imprint; - ASN1_INTEGER *serial; - ASN1_GENERALIZEDTIME *time; - TS_ACCURACY *accuracy; - ASN1_BOOLEAN ordering; - ASN1_INTEGER *nonce; - GENERAL_NAME *tsa; - STACK_OF(X509_EXTENSION) *extensions; -}; - -/* - * PKIStatusInfo ::= SEQUENCE { - * status PKIStatus, - * statusString PKIFreeText OPTIONAL, - * failInfo PKIFailureInfo OPTIONAL } - * - * From RFC 1510 - section 3.1.1: - * PKIFreeText ::= SEQUENCE SIZE (1..MAX) OF UTF8String - * -- text encoded as UTF-8 String (note: each UTF8String SHOULD - * -- include an RFC 1766 language tag to indicate the language - * -- of the contained text) - */ - -struct TS_status_info_st { - ASN1_INTEGER *status; - STACK_OF(ASN1_UTF8STRING) *text; - ASN1_BIT_STRING *failure_info; -}; - -/* - * TimeStampResp ::= SEQUENCE { - * status PKIStatusInfo, - * timeStampToken TimeStampToken OPTIONAL } - */ - -struct TS_resp_st { - TS_STATUS_INFO *status_info; - PKCS7 *token; - TS_TST_INFO *tst_info; -}; - -/* The structure below would belong to the ESS component. */ - -/* - * IssuerSerial ::= SEQUENCE { - * issuer GeneralNames, - * serialNumber CertificateSerialNumber - * } - */ - -struct ESS_issuer_serial { - STACK_OF(GENERAL_NAME) *issuer; - ASN1_INTEGER *serial; -}; - -/* - * ESSCertID ::= SEQUENCE { - * certHash Hash, - * issuerSerial IssuerSerial OPTIONAL - * } - */ - -struct ESS_cert_id { - ASN1_OCTET_STRING *hash; /* Always SHA-1 digest. */ - ESS_ISSUER_SERIAL *issuer_serial; -}; - -/* - * SigningCertificate ::= SEQUENCE { - * certs SEQUENCE OF ESSCertID, - * policies SEQUENCE OF PolicyInformation OPTIONAL - * } - */ - -struct ESS_signing_cert { - STACK_OF(ESS_CERT_ID) *cert_ids; - STACK_OF(POLICYINFO) *policy_info; -}; - -/* - * ESSCertIDv2 ::= SEQUENCE { - * hashAlgorithm AlgorithmIdentifier - * DEFAULT {algorithm id-sha256}, - * certHash Hash, - * issuerSerial IssuerSerial OPTIONAL } - */ - -struct ESS_cert_id_v2 { - X509_ALGOR *hash_alg; /* Default SHA-256. */ - ASN1_OCTET_STRING *hash; - ESS_ISSUER_SERIAL *issuer_serial; -}; - -/* - * SigningCertificateV2 ::= SEQUENCE { - * certs SEQUENCE OF ESSCertIDv2, - * policies SEQUENCE OF PolicyInformation OPTIONAL } - */ - -struct ESS_signing_cert_v2 { - STACK_OF(ESS_CERT_ID_V2) *cert_ids; - STACK_OF(POLICYINFO) *policy_info; -}; - -struct TS_resp_ctx { - X509 *signer_cert; - EVP_PKEY *signer_key; - STACK_OF(X509) *certs; /* Certs to include in signed data. */ - STACK_OF(ASN1_OBJECT) *policies; /* Acceptable policies. */ - ASN1_OBJECT *default_policy; /* It may appear in policies, too. */ - STACK_OF(EVP_MD) *mds; /* Acceptable message digests. */ - ASN1_INTEGER *seconds; /* accuracy, 0 means not specified. */ - ASN1_INTEGER *millis; /* accuracy, 0 means not specified. */ - ASN1_INTEGER *micros; /* accuracy, 0 means not specified. */ - unsigned clock_precision_digits; /* fraction of seconds in - time stamp token. */ - unsigned flags; /* Optional info, see values above. */ - - /* Callback functions. */ - TS_serial_cb serial_cb; - void *serial_cb_data; /* User data for serial_cb. */ - - TS_time_cb time_cb; - void *time_cb_data; /* User data for time_cb. */ - - TS_extension_cb extension_cb; - void *extension_cb_data; /* User data for extension_cb. */ - - /* These members are used only while creating the response. */ - TS_REQ *request; - TS_RESP *response; - TS_TST_INFO *tst_info; -}; - -/* Context structure for the generic verify method. */ - -struct TS_verify_ctx { - /* Set this to the union of TS_VFY_... flags you want to carry out. */ - unsigned flags; - - /* Must be set only with TS_VFY_SIGNATURE. certs is optional. */ - X509_STORE *store; - STACK_OF(X509) *certs; - - /* Must be set only with TS_VFY_POLICY. */ - ASN1_OBJECT *policy; - - /* Must be set only with TS_VFY_IMPRINT. If md_alg is NULL, - the algorithm from the response is used. */ - X509_ALGOR *md_alg; - unsigned char *imprint; - unsigned imprint_len; - - /* Must be set only with TS_VFY_DATA. */ - BIO *data; - - /* Must be set only with TS_VFY_TSA_NAME. */ - ASN1_INTEGER *nonce; - - /* Must be set only with TS_VFY_TSA_NAME. */ - GENERAL_NAME *tsa_name; -}; - -/* - * Public OpenSSL API that we do not currently want to expose. - */ - -ESS_CERT_ID_V2 *ESS_CERT_ID_V2_new(void); -void ESS_CERT_ID_V2_free(ESS_CERT_ID_V2 *a); -int i2d_ESS_CERT_ID_V2(const ESS_CERT_ID_V2 *a, unsigned char **pp); -ESS_CERT_ID_V2 *d2i_ESS_CERT_ID_V2(ESS_CERT_ID_V2 **a, const unsigned char **pp, - long length); -ESS_CERT_ID_V2 *ESS_CERT_ID_V2_dup(ESS_CERT_ID_V2 *a); - -ESS_SIGNING_CERT_V2 *ESS_SIGNING_CERT_V2_new(void); -void ESS_SIGNING_CERT_V2_free(ESS_SIGNING_CERT_V2 *a); -int i2d_ESS_SIGNING_CERT_V2(const ESS_SIGNING_CERT_V2 *a, - unsigned char **pp); -ESS_SIGNING_CERT_V2 *d2i_ESS_SIGNING_CERT_V2(ESS_SIGNING_CERT_V2 **a, - const unsigned char **pp, long length); -ESS_SIGNING_CERT_V2 *ESS_SIGNING_CERT_V2_dup(ESS_SIGNING_CERT_V2 *a); - -__END_HIDDEN_DECLS - -#endif /* !HEADER_TS_LOCAL_H */ diff --git a/src/lib/libcrypto/ts/ts_req_print.c b/src/lib/libcrypto/ts/ts_req_print.c deleted file mode 100644 index ddcdda97a3..0000000000 --- a/src/lib/libcrypto/ts/ts_req_print.c +++ /dev/null @@ -1,105 +0,0 @@ -/* $OpenBSD: ts_req_print.c,v 1.5 2023/07/07 07:25:21 beck Exp $ */ -/* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL - * project 2002. - */ -/* ==================================================================== - * Copyright (c) 2006 The OpenSSL Project. All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in - * the documentation and/or other materials provided with the - * distribution. - * - * 3. All advertising materials mentioning features or use of this - * software must display the following acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" - * - * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to - * endorse or promote products derived from this software without - * prior written permission. For written permission, please contact - * licensing@OpenSSL.org. - * - * 5. Products derived from this software may not be called "OpenSSL" - * nor may "OpenSSL" appear in their names without prior written - * permission of the OpenSSL Project. - * - * 6. Redistributions of any form whatsoever must retain the following - * acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" - * - * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY - * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR - * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR - * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT - * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; - * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, - * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED - * OF THE POSSIBILITY OF SUCH DAMAGE. - * ==================================================================== - * - * This product includes cryptographic software written by Eric Young - * (eay@cryptsoft.com). This product includes software written by Tim - * Hudson (tjh@cryptsoft.com). - * - */ - -#include - -#include -#include -#include -#include - -/* Function definitions. */ - -int -TS_REQ_print_bio(BIO *bio, TS_REQ *a) -{ - int v; - ASN1_OBJECT *policy_id; - const ASN1_INTEGER *nonce; - - if (a == NULL) - return 0; - - v = TS_REQ_get_version(a); - BIO_printf(bio, "Version: %d\n", v); - - TS_MSG_IMPRINT_print_bio(bio, TS_REQ_get_msg_imprint(a)); - - BIO_printf(bio, "Policy OID: "); - policy_id = TS_REQ_get_policy_id(a); - if (policy_id == NULL) - BIO_printf(bio, "unspecified\n"); - else - TS_OBJ_print_bio(bio, policy_id); - - BIO_printf(bio, "Nonce: "); - nonce = TS_REQ_get_nonce(a); - if (nonce == NULL) - BIO_printf(bio, "unspecified"); - else - TS_ASN1_INTEGER_print_bio(bio, nonce); - BIO_write(bio, "\n", 1); - - BIO_printf(bio, "Certificate required: %s\n", - TS_REQ_get_cert_req(a) ? "yes" : "no"); - - TS_ext_print_bio(bio, TS_REQ_get_exts(a)); - - return 1; -} -LCRYPTO_ALIAS(TS_REQ_print_bio); diff --git a/src/lib/libcrypto/ts/ts_req_utils.c b/src/lib/libcrypto/ts/ts_req_utils.c deleted file mode 100644 index d679418060..0000000000 --- a/src/lib/libcrypto/ts/ts_req_utils.c +++ /dev/null @@ -1,281 +0,0 @@ -/* $OpenBSD: ts_req_utils.c,v 1.9 2023/07/07 19:37:54 beck Exp $ */ -/* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL - * project 2002. - */ -/* ==================================================================== - * Copyright (c) 2006 The OpenSSL Project. All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in - * the documentation and/or other materials provided with the - * distribution. - * - * 3. All advertising materials mentioning features or use of this - * software must display the following acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" - * - * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to - * endorse or promote products derived from this software without - * prior written permission. For written permission, please contact - * licensing@OpenSSL.org. - * - * 5. Products derived from this software may not be called "OpenSSL" - * nor may "OpenSSL" appear in their names without prior written - * permission of the OpenSSL Project. - * - * 6. Redistributions of any form whatsoever must retain the following - * acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" - * - * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY - * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR - * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR - * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT - * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; - * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, - * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED - * OF THE POSSIBILITY OF SUCH DAMAGE. - * ==================================================================== - * - * This product includes cryptographic software written by Eric Young - * (eay@cryptsoft.com). This product includes software written by Tim - * Hudson (tjh@cryptsoft.com). - * - */ - -#include - -#include -#include -#include -#include - -#include "ts_local.h" - -int -TS_REQ_set_version(TS_REQ *a, long version) -{ - return ASN1_INTEGER_set(a->version, version); -} -LCRYPTO_ALIAS(TS_REQ_set_version); - -long -TS_REQ_get_version(const TS_REQ *a) -{ - return ASN1_INTEGER_get(a->version); -} -LCRYPTO_ALIAS(TS_REQ_get_version); - -int -TS_REQ_set_msg_imprint(TS_REQ *a, TS_MSG_IMPRINT *msg_imprint) -{ - TS_MSG_IMPRINT *new_msg_imprint; - - if (a->msg_imprint == msg_imprint) - return 1; - new_msg_imprint = TS_MSG_IMPRINT_dup(msg_imprint); - if (new_msg_imprint == NULL) { - TSerror(ERR_R_MALLOC_FAILURE); - return 0; - } - TS_MSG_IMPRINT_free(a->msg_imprint); - a->msg_imprint = new_msg_imprint; - return 1; -} -LCRYPTO_ALIAS(TS_REQ_set_msg_imprint); - -TS_MSG_IMPRINT * -TS_REQ_get_msg_imprint(TS_REQ *a) -{ - return a->msg_imprint; -} -LCRYPTO_ALIAS(TS_REQ_get_msg_imprint); - -int -TS_MSG_IMPRINT_set_algo(TS_MSG_IMPRINT *a, X509_ALGOR *alg) -{ - X509_ALGOR *new_alg; - - if (a->hash_algo == alg) - return 1; - new_alg = X509_ALGOR_dup(alg); - if (new_alg == NULL) { - TSerror(ERR_R_MALLOC_FAILURE); - return 0; - } - X509_ALGOR_free(a->hash_algo); - a->hash_algo = new_alg; - return 1; -} -LCRYPTO_ALIAS(TS_MSG_IMPRINT_set_algo); - -X509_ALGOR * -TS_MSG_IMPRINT_get_algo(TS_MSG_IMPRINT *a) -{ - return a->hash_algo; -} -LCRYPTO_ALIAS(TS_MSG_IMPRINT_get_algo); - -int -TS_MSG_IMPRINT_set_msg(TS_MSG_IMPRINT *a, unsigned char *d, int len) -{ - return ASN1_OCTET_STRING_set(a->hashed_msg, d, len); -} -LCRYPTO_ALIAS(TS_MSG_IMPRINT_set_msg); - -ASN1_OCTET_STRING * -TS_MSG_IMPRINT_get_msg(TS_MSG_IMPRINT *a) -{ - return a->hashed_msg; -} -LCRYPTO_ALIAS(TS_MSG_IMPRINT_get_msg); - -int -TS_REQ_set_policy_id(TS_REQ *a, const ASN1_OBJECT *policy) -{ - ASN1_OBJECT *new_policy; - - if (a->policy_id == policy) - return 1; - new_policy = OBJ_dup(policy); - if (new_policy == NULL) { - TSerror(ERR_R_MALLOC_FAILURE); - return 0; - } - ASN1_OBJECT_free(a->policy_id); - a->policy_id = new_policy; - return 1; -} -LCRYPTO_ALIAS(TS_REQ_set_policy_id); - -ASN1_OBJECT * -TS_REQ_get_policy_id(TS_REQ *a) -{ - return a->policy_id; -} -LCRYPTO_ALIAS(TS_REQ_get_policy_id); - -int -TS_REQ_set_nonce(TS_REQ *a, const ASN1_INTEGER *nonce) -{ - ASN1_INTEGER *new_nonce; - - if (a->nonce == nonce) - return 1; - new_nonce = ASN1_INTEGER_dup(nonce); - if (new_nonce == NULL) { - TSerror(ERR_R_MALLOC_FAILURE); - return 0; - } - ASN1_INTEGER_free(a->nonce); - a->nonce = new_nonce; - return 1; -} -LCRYPTO_ALIAS(TS_REQ_set_nonce); - -const ASN1_INTEGER * -TS_REQ_get_nonce(const TS_REQ *a) -{ - return a->nonce; -} -LCRYPTO_ALIAS(TS_REQ_get_nonce); - -int -TS_REQ_set_cert_req(TS_REQ *a, int cert_req) -{ - a->cert_req = cert_req ? 0xFF : 0x00; - return 1; -} -LCRYPTO_ALIAS(TS_REQ_set_cert_req); - -int -TS_REQ_get_cert_req(const TS_REQ *a) -{ - return a->cert_req ? 1 : 0; -} -LCRYPTO_ALIAS(TS_REQ_get_cert_req); - -STACK_OF(X509_EXTENSION) *TS_REQ_get_exts(TS_REQ *a) -{ - return a->extensions; -} -LCRYPTO_ALIAS(TS_REQ_get_exts); - -void -TS_REQ_ext_free(TS_REQ *a) -{ - if (!a) - return; - sk_X509_EXTENSION_pop_free(a->extensions, X509_EXTENSION_free); - a->extensions = NULL; -} -LCRYPTO_ALIAS(TS_REQ_ext_free); - -int -TS_REQ_get_ext_count(TS_REQ *a) -{ - return X509v3_get_ext_count(a->extensions); -} -LCRYPTO_ALIAS(TS_REQ_get_ext_count); - -int -TS_REQ_get_ext_by_NID(TS_REQ *a, int nid, int lastpos) -{ - return X509v3_get_ext_by_NID(a->extensions, nid, lastpos); -} -LCRYPTO_ALIAS(TS_REQ_get_ext_by_NID); - -int -TS_REQ_get_ext_by_OBJ(TS_REQ *a, const ASN1_OBJECT *obj, int lastpos) -{ - return X509v3_get_ext_by_OBJ(a->extensions, obj, lastpos); -} -LCRYPTO_ALIAS(TS_REQ_get_ext_by_OBJ); - -int -TS_REQ_get_ext_by_critical(TS_REQ *a, int crit, int lastpos) -{ - return X509v3_get_ext_by_critical(a->extensions, crit, lastpos); -} -LCRYPTO_ALIAS(TS_REQ_get_ext_by_critical); - -X509_EXTENSION * -TS_REQ_get_ext(TS_REQ *a, int loc) -{ - return X509v3_get_ext(a->extensions, loc); -} -LCRYPTO_ALIAS(TS_REQ_get_ext); - -X509_EXTENSION * -TS_REQ_delete_ext(TS_REQ *a, int loc) -{ - return X509v3_delete_ext(a->extensions, loc); -} -LCRYPTO_ALIAS(TS_REQ_delete_ext); - -int -TS_REQ_add_ext(TS_REQ *a, X509_EXTENSION *ex, int loc) -{ - return X509v3_add_ext(&a->extensions, ex, loc) != NULL; -} -LCRYPTO_ALIAS(TS_REQ_add_ext); - -void * -TS_REQ_get_ext_d2i(TS_REQ *a, int nid, int *crit, int *idx) -{ - return X509V3_get_d2i(a->extensions, nid, crit, idx); -} -LCRYPTO_ALIAS(TS_REQ_get_ext_d2i); diff --git a/src/lib/libcrypto/ts/ts_rsp_print.c b/src/lib/libcrypto/ts/ts_rsp_print.c deleted file mode 100644 index c65d226686..0000000000 --- a/src/lib/libcrypto/ts/ts_rsp_print.c +++ /dev/null @@ -1,306 +0,0 @@ -/* $OpenBSD: ts_rsp_print.c,v 1.7 2023/07/07 07:25:21 beck Exp $ */ -/* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL - * project 2002. - */ -/* ==================================================================== - * Copyright (c) 2006 The OpenSSL Project. All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in - * the documentation and/or other materials provided with the - * distribution. - * - * 3. All advertising materials mentioning features or use of this - * software must display the following acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" - * - * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to - * endorse or promote products derived from this software without - * prior written permission. For written permission, please contact - * licensing@OpenSSL.org. - * - * 5. Products derived from this software may not be called "OpenSSL" - * nor may "OpenSSL" appear in their names without prior written - * permission of the OpenSSL Project. - * - * 6. Redistributions of any form whatsoever must retain the following - * acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" - * - * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY - * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR - * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR - * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT - * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; - * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, - * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED - * OF THE POSSIBILITY OF SUCH DAMAGE. - * ==================================================================== - * - * This product includes cryptographic software written by Eric Young - * (eay@cryptsoft.com). This product includes software written by Tim - * Hudson (tjh@cryptsoft.com). - * - */ - -#include - -#include -#include -#include -#include - -#include "ts_local.h" - -struct status_map_st { - int bit; - const char *text; -}; - -/* Local function declarations. */ - -static int TS_status_map_print(BIO *bio, struct status_map_st *a, - ASN1_BIT_STRING *v); -static int TS_ACCURACY_print_bio(BIO *bio, const TS_ACCURACY *accuracy); - -/* Function definitions. */ - -int -TS_RESP_print_bio(BIO *bio, TS_RESP *a) -{ - TS_TST_INFO *tst_info; - - BIO_printf(bio, "Status info:\n"); - TS_STATUS_INFO_print_bio(bio, TS_RESP_get_status_info(a)); - - BIO_printf(bio, "\nTST info:\n"); - tst_info = TS_RESP_get_tst_info(a); - if (tst_info != NULL) - TS_TST_INFO_print_bio(bio, TS_RESP_get_tst_info(a)); - else - BIO_printf(bio, "Not included.\n"); - - return 1; -} -LCRYPTO_ALIAS(TS_RESP_print_bio); - -int -TS_STATUS_INFO_print_bio(BIO *bio, TS_STATUS_INFO *a) -{ - static const char *status_map[] = { - "Granted.", - "Granted with modifications.", - "Rejected.", - "Waiting.", - "Revocation warning.", - "Revoked." - }; - static struct status_map_st failure_map[] = { - { - TS_INFO_BAD_ALG, - "unrecognized or unsupported algorithm identifier" - }, - { - TS_INFO_BAD_REQUEST, - "transaction not permitted or supported" - }, - { - TS_INFO_BAD_DATA_FORMAT, - "the data submitted has the wrong format" - }, - { - TS_INFO_TIME_NOT_AVAILABLE, - "the TSA's time source is not available" - }, - { - TS_INFO_UNACCEPTED_POLICY, - "the requested TSA policy is not supported by the TSA" - }, - { - TS_INFO_UNACCEPTED_EXTENSION, - "the requested extension is not supported by the TSA" - }, - { - TS_INFO_ADD_INFO_NOT_AVAILABLE, - "the additional information requested could not be understood " - "or is not available" - }, - { - TS_INFO_SYSTEM_FAILURE, - "the request cannot be handled due to system failure" - }, - { -1, NULL } - }; - long status; - int i, lines = 0; - - /* Printing status code. */ - BIO_printf(bio, "Status: "); - status = ASN1_INTEGER_get(a->status); - if (0 <= status && - status < (long)(sizeof(status_map) / sizeof(status_map[0]))) - BIO_printf(bio, "%s\n", status_map[status]); - else - BIO_printf(bio, "out of bounds\n"); - - /* Printing status description. */ - BIO_printf(bio, "Status description: "); - for (i = 0; i < sk_ASN1_UTF8STRING_num(a->text); ++i) { - if (i > 0) - BIO_puts(bio, "\t"); - ASN1_STRING_print_ex(bio, sk_ASN1_UTF8STRING_value(a->text, i), - 0); - BIO_puts(bio, "\n"); - } - if (i == 0) - BIO_printf(bio, "unspecified\n"); - - /* Printing failure information. */ - BIO_printf(bio, "Failure info: "); - if (a->failure_info != NULL) - lines = TS_status_map_print(bio, failure_map, a->failure_info); - if (lines == 0) - BIO_printf(bio, "unspecified"); - BIO_printf(bio, "\n"); - - return 1; -} -LCRYPTO_ALIAS(TS_STATUS_INFO_print_bio); - -static int -TS_status_map_print(BIO *bio, struct status_map_st *a, ASN1_BIT_STRING *v) -{ - int lines = 0; - - for (; a->bit >= 0; ++a) { - if (ASN1_BIT_STRING_get_bit(v, a->bit)) { - if (++lines > 1) - BIO_printf(bio, ", "); - BIO_printf(bio, "%s", a->text); - } - } - - return lines; -} - -int -TS_TST_INFO_print_bio(BIO *bio, TS_TST_INFO *a) -{ - int v; - ASN1_OBJECT *policy_id; - const ASN1_INTEGER *serial; - const ASN1_GENERALIZEDTIME *gtime; - TS_ACCURACY *accuracy; - const ASN1_INTEGER *nonce; - GENERAL_NAME *tsa_name; - - if (a == NULL) - return 0; - - /* Print version. */ - v = TS_TST_INFO_get_version(a); - BIO_printf(bio, "Version: %d\n", v); - - /* Print policy id. */ - BIO_printf(bio, "Policy OID: "); - policy_id = TS_TST_INFO_get_policy_id(a); - TS_OBJ_print_bio(bio, policy_id); - - /* Print message imprint. */ - TS_MSG_IMPRINT_print_bio(bio, TS_TST_INFO_get_msg_imprint(a)); - - /* Print serial number. */ - BIO_printf(bio, "Serial number: "); - serial = TS_TST_INFO_get_serial(a); - if (serial == NULL) - BIO_printf(bio, "unspecified"); - else - TS_ASN1_INTEGER_print_bio(bio, serial); - BIO_write(bio, "\n", 1); - - /* Print time stamp. */ - BIO_printf(bio, "Time stamp: "); - gtime = TS_TST_INFO_get_time(a); - ASN1_GENERALIZEDTIME_print(bio, gtime); - BIO_write(bio, "\n", 1); - - /* Print accuracy. */ - BIO_printf(bio, "Accuracy: "); - accuracy = TS_TST_INFO_get_accuracy(a); - if (accuracy == NULL) - BIO_printf(bio, "unspecified"); - else - TS_ACCURACY_print_bio(bio, accuracy); - BIO_write(bio, "\n", 1); - - /* Print ordering. */ - BIO_printf(bio, "Ordering: %s\n", - TS_TST_INFO_get_ordering(a) ? "yes" : "no"); - - /* Print nonce. */ - BIO_printf(bio, "Nonce: "); - nonce = TS_TST_INFO_get_nonce(a); - if (nonce == NULL) - BIO_printf(bio, "unspecified"); - else - TS_ASN1_INTEGER_print_bio(bio, nonce); - BIO_write(bio, "\n", 1); - - /* Print TSA name. */ - BIO_printf(bio, "TSA: "); - tsa_name = TS_TST_INFO_get_tsa(a); - if (tsa_name == NULL) - BIO_printf(bio, "unspecified"); - else { - STACK_OF(CONF_VALUE) *nval; - if ((nval = i2v_GENERAL_NAME(NULL, tsa_name, NULL))) - X509V3_EXT_val_prn(bio, nval, 0, 0); - sk_CONF_VALUE_pop_free(nval, X509V3_conf_free); - } - BIO_write(bio, "\n", 1); - - /* Print extensions. */ - TS_ext_print_bio(bio, TS_TST_INFO_get_exts(a)); - - return 1; -} -LCRYPTO_ALIAS(TS_TST_INFO_print_bio); - -static int -TS_ACCURACY_print_bio(BIO *bio, const TS_ACCURACY *accuracy) -{ - const ASN1_INTEGER *seconds = TS_ACCURACY_get_seconds(accuracy); - const ASN1_INTEGER *millis = TS_ACCURACY_get_millis(accuracy); - const ASN1_INTEGER *micros = TS_ACCURACY_get_micros(accuracy); - - if (seconds != NULL) - TS_ASN1_INTEGER_print_bio(bio, seconds); - else - BIO_printf(bio, "unspecified"); - BIO_printf(bio, " seconds, "); - if (millis != NULL) - TS_ASN1_INTEGER_print_bio(bio, millis); - else - BIO_printf(bio, "unspecified"); - BIO_printf(bio, " millis, "); - if (micros != NULL) - TS_ASN1_INTEGER_print_bio(bio, micros); - else - BIO_printf(bio, "unspecified"); - BIO_printf(bio, " micros"); - - return 1; -} diff --git a/src/lib/libcrypto/ts/ts_rsp_sign.c b/src/lib/libcrypto/ts/ts_rsp_sign.c deleted file mode 100644 index e3101340c5..0000000000 --- a/src/lib/libcrypto/ts/ts_rsp_sign.c +++ /dev/null @@ -1,982 +0,0 @@ -/* $OpenBSD: ts_rsp_sign.c,v 1.35 2024/03/26 00:39:22 beck Exp $ */ -/* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL - * project 2002. - */ -/* ==================================================================== - * Copyright (c) 2006 The OpenSSL Project. All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in - * the documentation and/or other materials provided with the - * distribution. - * - * 3. All advertising materials mentioning features or use of this - * software must display the following acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" - * - * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to - * endorse or promote products derived from this software without - * prior written permission. For written permission, please contact - * licensing@OpenSSL.org. - * - * 5. Products derived from this software may not be called "OpenSSL" - * nor may "OpenSSL" appear in their names without prior written - * permission of the OpenSSL Project. - * - * 6. Redistributions of any form whatsoever must retain the following - * acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" - * - * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY - * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR - * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR - * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT - * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; - * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, - * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED - * OF THE POSSIBILITY OF SUCH DAMAGE. - * ==================================================================== - * - * This product includes cryptographic software written by Eric Young - * (eay@cryptsoft.com). This product includes software written by Tim - * Hudson (tjh@cryptsoft.com). - * - */ - -#include - -#include - -#include -#include -#include -#include - -#include "evp_local.h" -#include "ts_local.h" -#include "x509_local.h" - -/* Private function declarations. */ - -static ASN1_INTEGER *def_serial_cb(struct TS_resp_ctx *, void *); -static int def_time_cb(struct TS_resp_ctx *, void *, time_t *sec, long *usec); -static int def_extension_cb(struct TS_resp_ctx *, X509_EXTENSION *, void *); - -static void TS_RESP_CTX_init(TS_RESP_CTX *ctx); -static void TS_RESP_CTX_cleanup(TS_RESP_CTX *ctx); -static int TS_RESP_check_request(TS_RESP_CTX *ctx); -static ASN1_OBJECT *TS_RESP_get_policy(TS_RESP_CTX *ctx); -static TS_TST_INFO *TS_RESP_create_tst_info(TS_RESP_CTX *ctx, - ASN1_OBJECT *policy); -static int TS_RESP_process_extensions(TS_RESP_CTX *ctx); -static int TS_RESP_sign(TS_RESP_CTX *ctx); - -static ESS_SIGNING_CERT *ESS_SIGNING_CERT_new_init(X509 *signcert, - STACK_OF(X509) *certs); -static ESS_CERT_ID *ESS_CERT_ID_new_init(X509 *cert, int issuer_needed); -static int TS_TST_INFO_content_new(PKCS7 *p7); -static int ESS_add_signing_cert(PKCS7_SIGNER_INFO *si, ESS_SIGNING_CERT *sc); - -/* Default callbacks for response generation. */ - -static ASN1_INTEGER * -def_serial_cb(struct TS_resp_ctx *ctx, void *data) -{ - ASN1_INTEGER *serial; - - if ((serial = ASN1_INTEGER_new()) == NULL) - goto err; - if (!ASN1_INTEGER_set(serial, 1)) - goto err; - - return serial; - - err: - ASN1_INTEGER_free(serial); - TSerror(ERR_R_MALLOC_FAILURE); - TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, - "Error during serial number generation."); - - return NULL; -} - -/* Use the gettimeofday function call. */ -static int -def_time_cb(struct TS_resp_ctx *ctx, void *data, time_t *sec, long *usec) -{ - struct timeval tv; - - if (gettimeofday(&tv, NULL) != 0) { - TSerror(TS_R_TIME_SYSCALL_ERROR); - TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, - "Time is not available."); - TS_RESP_CTX_add_failure_info(ctx, TS_INFO_TIME_NOT_AVAILABLE); - return 0; - } - /* Return time to caller. */ - *sec = tv.tv_sec; - *usec = tv.tv_usec; - - return 1; -} - -static int -def_extension_cb(struct TS_resp_ctx *ctx, X509_EXTENSION *ext, void *data) -{ - /* No extensions are processed here. */ - TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, - "Unsupported extension."); - TS_RESP_CTX_add_failure_info(ctx, TS_INFO_UNACCEPTED_EXTENSION); - return 0; -} - -void -TS_RESP_CTX_set_time_cb(TS_RESP_CTX *ctx, TS_time_cb cb, void *data) -{ - ctx->time_cb = cb; - ctx->time_cb_data = data; -} -LCRYPTO_ALIAS(TS_RESP_CTX_set_time_cb); - -/* TS_RESP_CTX management functions. */ - -TS_RESP_CTX * -TS_RESP_CTX_new(void) -{ - TS_RESP_CTX *ctx; - - if (!(ctx = calloc(1, sizeof(TS_RESP_CTX)))) { - TSerror(ERR_R_MALLOC_FAILURE); - return NULL; - } - - /* Setting default callbacks. */ - ctx->serial_cb = def_serial_cb; - ctx->time_cb = def_time_cb; - ctx->extension_cb = def_extension_cb; - - return ctx; -} -LCRYPTO_ALIAS(TS_RESP_CTX_new); - -void -TS_RESP_CTX_free(TS_RESP_CTX *ctx) -{ - if (!ctx) - return; - - X509_free(ctx->signer_cert); - EVP_PKEY_free(ctx->signer_key); - sk_X509_pop_free(ctx->certs, X509_free); - sk_ASN1_OBJECT_pop_free(ctx->policies, ASN1_OBJECT_free); - ASN1_OBJECT_free(ctx->default_policy); - sk_EVP_MD_free(ctx->mds); /* No EVP_MD_free method exists. */ - ASN1_INTEGER_free(ctx->seconds); - ASN1_INTEGER_free(ctx->millis); - ASN1_INTEGER_free(ctx->micros); - free(ctx); -} -LCRYPTO_ALIAS(TS_RESP_CTX_free); - -int -TS_RESP_CTX_set_signer_cert(TS_RESP_CTX *ctx, X509 *signer) -{ - if (X509_check_purpose(signer, X509_PURPOSE_TIMESTAMP_SIGN, 0) != 1) { - TSerror(TS_R_INVALID_SIGNER_CERTIFICATE_PURPOSE); - return 0; - } - X509_free(ctx->signer_cert); - ctx->signer_cert = signer; - CRYPTO_add(&ctx->signer_cert->references, +1, CRYPTO_LOCK_X509); - return 1; -} -LCRYPTO_ALIAS(TS_RESP_CTX_set_signer_cert); - -int -TS_RESP_CTX_set_signer_key(TS_RESP_CTX *ctx, EVP_PKEY *key) -{ - EVP_PKEY_free(ctx->signer_key); - ctx->signer_key = key; - CRYPTO_add(&ctx->signer_key->references, +1, CRYPTO_LOCK_EVP_PKEY); - - return 1; -} -LCRYPTO_ALIAS(TS_RESP_CTX_set_signer_key); - -int -TS_RESP_CTX_set_def_policy(TS_RESP_CTX *ctx, const ASN1_OBJECT *def_policy) -{ - if (ctx->default_policy) - ASN1_OBJECT_free(ctx->default_policy); - if (!(ctx->default_policy = OBJ_dup(def_policy))) - goto err; - return 1; - -err: - TSerror(ERR_R_MALLOC_FAILURE); - return 0; -} -LCRYPTO_ALIAS(TS_RESP_CTX_set_def_policy); - -int -TS_RESP_CTX_set_certs(TS_RESP_CTX *ctx, STACK_OF(X509) *certs) -{ - int i; - - if (ctx->certs) { - sk_X509_pop_free(ctx->certs, X509_free); - ctx->certs = NULL; - } - if (!certs) - return 1; - if (!(ctx->certs = sk_X509_dup(certs))) { - TSerror(ERR_R_MALLOC_FAILURE); - return 0; - } - for (i = 0; i < sk_X509_num(ctx->certs); ++i) { - X509 *cert = sk_X509_value(ctx->certs, i); - CRYPTO_add(&cert->references, +1, CRYPTO_LOCK_X509); - } - - return 1; -} -LCRYPTO_ALIAS(TS_RESP_CTX_set_certs); - -int -TS_RESP_CTX_add_policy(TS_RESP_CTX *ctx, const ASN1_OBJECT *policy) -{ - ASN1_OBJECT *copy = NULL; - - /* Create new policy stack if necessary. */ - if (!ctx->policies && !(ctx->policies = sk_ASN1_OBJECT_new_null())) - goto err; - if (!(copy = OBJ_dup(policy))) - goto err; - if (!sk_ASN1_OBJECT_push(ctx->policies, copy)) - goto err; - - return 1; - -err: - TSerror(ERR_R_MALLOC_FAILURE); - ASN1_OBJECT_free(copy); - return 0; -} -LCRYPTO_ALIAS(TS_RESP_CTX_add_policy); - -int -TS_RESP_CTX_add_md(TS_RESP_CTX *ctx, const EVP_MD *md) -{ - /* Create new md stack if necessary. */ - if (!ctx->mds && !(ctx->mds = sk_EVP_MD_new_null())) - goto err; - /* Add the shared md, no copy needed. */ - if (!sk_EVP_MD_push(ctx->mds, (EVP_MD *)md)) - goto err; - - return 1; - -err: - TSerror(ERR_R_MALLOC_FAILURE); - return 0; -} -LCRYPTO_ALIAS(TS_RESP_CTX_add_md); - -#define TS_RESP_CTX_accuracy_free(ctx) \ - ASN1_INTEGER_free(ctx->seconds); \ - ctx->seconds = NULL; \ - ASN1_INTEGER_free(ctx->millis); \ - ctx->millis = NULL; \ - ASN1_INTEGER_free(ctx->micros); \ - ctx->micros = NULL; - -int -TS_RESP_CTX_set_accuracy(TS_RESP_CTX *ctx, int secs, int millis, int micros) -{ - TS_RESP_CTX_accuracy_free(ctx); - if (secs && (!(ctx->seconds = ASN1_INTEGER_new()) || - !ASN1_INTEGER_set(ctx->seconds, secs))) - goto err; - if (millis && (!(ctx->millis = ASN1_INTEGER_new()) || - !ASN1_INTEGER_set(ctx->millis, millis))) - goto err; - if (micros && (!(ctx->micros = ASN1_INTEGER_new()) || - !ASN1_INTEGER_set(ctx->micros, micros))) - goto err; - - return 1; - -err: - TS_RESP_CTX_accuracy_free(ctx); - TSerror(ERR_R_MALLOC_FAILURE); - return 0; -} -LCRYPTO_ALIAS(TS_RESP_CTX_set_accuracy); - -void -TS_RESP_CTX_add_flags(TS_RESP_CTX *ctx, int flags) -{ - ctx->flags |= flags; -} -LCRYPTO_ALIAS(TS_RESP_CTX_add_flags); - -void -TS_RESP_CTX_set_serial_cb(TS_RESP_CTX *ctx, TS_serial_cb cb, void *data) -{ - ctx->serial_cb = cb; - ctx->serial_cb_data = data; -} -LCRYPTO_ALIAS(TS_RESP_CTX_set_serial_cb); - -void -TS_RESP_CTX_set_extension_cb(TS_RESP_CTX *ctx, TS_extension_cb cb, void *data) -{ - ctx->extension_cb = cb; - ctx->extension_cb_data = data; -} -LCRYPTO_ALIAS(TS_RESP_CTX_set_extension_cb); - -int -TS_RESP_CTX_set_status_info(TS_RESP_CTX *ctx, int status, const char *text) -{ - TS_STATUS_INFO *si = NULL; - ASN1_UTF8STRING *utf8_text = NULL; - int ret = 0; - - if (!(si = TS_STATUS_INFO_new())) - goto err; - if (!ASN1_INTEGER_set(si->status, status)) - goto err; - if (text) { - if (!(utf8_text = ASN1_UTF8STRING_new()) || - !ASN1_STRING_set(utf8_text, text, strlen(text))) - goto err; - if (!si->text && !(si->text = sk_ASN1_UTF8STRING_new_null())) - goto err; - if (!sk_ASN1_UTF8STRING_push(si->text, utf8_text)) - goto err; - utf8_text = NULL; /* Ownership is lost. */ - } - if (!TS_RESP_set_status_info(ctx->response, si)) - goto err; - ret = 1; - -err: - if (!ret) - TSerror(ERR_R_MALLOC_FAILURE); - TS_STATUS_INFO_free(si); - ASN1_UTF8STRING_free(utf8_text); - return ret; -} -LCRYPTO_ALIAS(TS_RESP_CTX_set_status_info); - -int -TS_RESP_CTX_set_status_info_cond(TS_RESP_CTX *ctx, int status, const char *text) -{ - int ret = 1; - TS_STATUS_INFO *si = TS_RESP_get_status_info(ctx->response); - - if (ASN1_INTEGER_get(si->status) == TS_STATUS_GRANTED) { - /* Status has not been set, set it now. */ - ret = TS_RESP_CTX_set_status_info(ctx, status, text); - } - return ret; -} -LCRYPTO_ALIAS(TS_RESP_CTX_set_status_info_cond); - -int -TS_RESP_CTX_add_failure_info(TS_RESP_CTX *ctx, int failure) -{ - TS_STATUS_INFO *si = TS_RESP_get_status_info(ctx->response); - - if (!si->failure_info && !(si->failure_info = ASN1_BIT_STRING_new())) - goto err; - if (!ASN1_BIT_STRING_set_bit(si->failure_info, failure, 1)) - goto err; - return 1; - -err: - TSerror(ERR_R_MALLOC_FAILURE); - return 0; -} -LCRYPTO_ALIAS(TS_RESP_CTX_add_failure_info); - -TS_REQ * -TS_RESP_CTX_get_request(TS_RESP_CTX *ctx) -{ - return ctx->request; -} -LCRYPTO_ALIAS(TS_RESP_CTX_get_request); - -TS_TST_INFO * -TS_RESP_CTX_get_tst_info(TS_RESP_CTX *ctx) -{ - return ctx->tst_info; -} -LCRYPTO_ALIAS(TS_RESP_CTX_get_tst_info); - -int -TS_RESP_CTX_set_clock_precision_digits(TS_RESP_CTX *ctx, unsigned precision) -{ - if (precision > 0) - return 0; - ctx->clock_precision_digits = precision; - return 1; -} -LCRYPTO_ALIAS(TS_RESP_CTX_set_clock_precision_digits); - -/* Main entry method of the response generation. */ -TS_RESP * -TS_RESP_create_response(TS_RESP_CTX *ctx, BIO *req_bio) -{ - ASN1_OBJECT *policy; - TS_RESP *response; - int result = 0; - - TS_RESP_CTX_init(ctx); - - /* Creating the response object. */ - if (!(ctx->response = TS_RESP_new())) { - TSerror(ERR_R_MALLOC_FAILURE); - goto end; - } - - /* Parsing DER request. */ - if (!(ctx->request = d2i_TS_REQ_bio(req_bio, NULL))) { - TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, - "Bad request format or " - "system error."); - TS_RESP_CTX_add_failure_info(ctx, TS_INFO_BAD_DATA_FORMAT); - goto end; - } - - /* Setting default status info. */ - if (!TS_RESP_CTX_set_status_info(ctx, TS_STATUS_GRANTED, NULL)) - goto end; - - /* Checking the request format. */ - if (!TS_RESP_check_request(ctx)) - goto end; - - /* Checking acceptable policies. */ - if (!(policy = TS_RESP_get_policy(ctx))) - goto end; - - /* Creating the TS_TST_INFO object. */ - if (!(ctx->tst_info = TS_RESP_create_tst_info(ctx, policy))) - goto end; - - /* Processing extensions. */ - if (!TS_RESP_process_extensions(ctx)) - goto end; - - /* Generating the signature. */ - if (!TS_RESP_sign(ctx)) - goto end; - - /* Everything was successful. */ - result = 1; - -end: - if (!result) { - TSerror(TS_R_RESPONSE_SETUP_ERROR); - if (ctx->response != NULL) { - if (TS_RESP_CTX_set_status_info_cond(ctx, - TS_STATUS_REJECTION, "Error during response " - "generation.") == 0) { - TS_RESP_free(ctx->response); - ctx->response = NULL; - } - } - } - response = ctx->response; - ctx->response = NULL; /* Ownership will be returned to caller. */ - TS_RESP_CTX_cleanup(ctx); - return response; -} -LCRYPTO_ALIAS(TS_RESP_create_response); - -/* Initializes the variable part of the context. */ -static void -TS_RESP_CTX_init(TS_RESP_CTX *ctx) -{ - ctx->request = NULL; - ctx->response = NULL; - ctx->tst_info = NULL; -} - -/* Cleans up the variable part of the context. */ -static void -TS_RESP_CTX_cleanup(TS_RESP_CTX *ctx) -{ - TS_REQ_free(ctx->request); - ctx->request = NULL; - TS_RESP_free(ctx->response); - ctx->response = NULL; - TS_TST_INFO_free(ctx->tst_info); - ctx->tst_info = NULL; -} - -/* Checks the format and content of the request. */ -static int -TS_RESP_check_request(TS_RESP_CTX *ctx) -{ - TS_REQ *request = ctx->request; - TS_MSG_IMPRINT *msg_imprint; - X509_ALGOR *md_alg; - int md_alg_id; - const ASN1_OCTET_STRING *digest; - EVP_MD *md = NULL; - int i; - - /* Checking request version. */ - if (TS_REQ_get_version(request) != 1) { - TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, - "Bad request version."); - TS_RESP_CTX_add_failure_info(ctx, TS_INFO_BAD_REQUEST); - return 0; - } - - /* Checking message digest algorithm. */ - msg_imprint = TS_REQ_get_msg_imprint(request); - md_alg = TS_MSG_IMPRINT_get_algo(msg_imprint); - md_alg_id = OBJ_obj2nid(md_alg->algorithm); - for (i = 0; !md && i < sk_EVP_MD_num(ctx->mds); ++i) { - EVP_MD *current_md = sk_EVP_MD_value(ctx->mds, i); - if (md_alg_id == EVP_MD_type(current_md)) - md = current_md; - } - if (!md) { - TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, - "Message digest algorithm is " - "not supported."); - TS_RESP_CTX_add_failure_info(ctx, TS_INFO_BAD_ALG); - return 0; - } - - /* No message digest takes parameter. */ - if (md_alg->parameter && - ASN1_TYPE_get(md_alg->parameter) != V_ASN1_NULL) { - TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, - "Superfluous message digest " - "parameter."); - TS_RESP_CTX_add_failure_info(ctx, TS_INFO_BAD_ALG); - return 0; - } - /* Checking message digest size. */ - digest = TS_MSG_IMPRINT_get_msg(msg_imprint); - if (digest->length != EVP_MD_size(md)) { - TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, - "Bad message digest."); - TS_RESP_CTX_add_failure_info(ctx, TS_INFO_BAD_DATA_FORMAT); - return 0; - } - - return 1; -} - -/* Returns the TSA policy based on the requested and acceptable policies. */ -static ASN1_OBJECT * -TS_RESP_get_policy(TS_RESP_CTX *ctx) -{ - ASN1_OBJECT *requested = TS_REQ_get_policy_id(ctx->request); - ASN1_OBJECT *policy = NULL; - int i; - - if (ctx->default_policy == NULL) { - TSerror(TS_R_INVALID_NULL_POINTER); - return NULL; - } - /* Return the default policy if none is requested or the default is - requested. */ - if (!requested || !OBJ_cmp(requested, ctx->default_policy)) - policy = ctx->default_policy; - - /* Check if the policy is acceptable. */ - for (i = 0; !policy && i < sk_ASN1_OBJECT_num(ctx->policies); ++i) { - ASN1_OBJECT *current = sk_ASN1_OBJECT_value(ctx->policies, i); - if (!OBJ_cmp(requested, current)) - policy = current; - } - if (!policy) { - TSerror(TS_R_UNACCEPTABLE_POLICY); - TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, - "Requested policy is not " - "supported."); - TS_RESP_CTX_add_failure_info(ctx, TS_INFO_UNACCEPTED_POLICY); - } - return policy; -} - -/* Creates the TS_TST_INFO object based on the settings of the context. */ -static TS_TST_INFO * -TS_RESP_create_tst_info(TS_RESP_CTX *ctx, ASN1_OBJECT *policy) -{ - int result = 0; - TS_TST_INFO *tst_info = NULL; - ASN1_INTEGER *serial = NULL; - ASN1_GENERALIZEDTIME *asn1_time = NULL; - time_t sec; - long usec; - TS_ACCURACY *accuracy = NULL; - const ASN1_INTEGER *nonce; - GENERAL_NAME *tsa_name = NULL; - - if (!(tst_info = TS_TST_INFO_new())) - goto end; - if (!TS_TST_INFO_set_version(tst_info, 1)) - goto end; - if (!TS_TST_INFO_set_policy_id(tst_info, policy)) - goto end; - if (!TS_TST_INFO_set_msg_imprint(tst_info, ctx->request->msg_imprint)) - goto end; - if (!(serial = (*ctx->serial_cb)(ctx, ctx->serial_cb_data)) || - !TS_TST_INFO_set_serial(tst_info, serial)) - goto end; - if (!(*ctx->time_cb)(ctx, ctx->time_cb_data, &sec, &usec) || - ((asn1_time = ASN1_GENERALIZEDTIME_set(NULL, sec)) == NULL) || - !TS_TST_INFO_set_time(tst_info, asn1_time)) - goto end; - - /* Setting accuracy if needed. */ - if ((ctx->seconds || ctx->millis || ctx->micros) && - !(accuracy = TS_ACCURACY_new())) - goto end; - - if (ctx->seconds && !TS_ACCURACY_set_seconds(accuracy, ctx->seconds)) - goto end; - if (ctx->millis && !TS_ACCURACY_set_millis(accuracy, ctx->millis)) - goto end; - if (ctx->micros && !TS_ACCURACY_set_micros(accuracy, ctx->micros)) - goto end; - if (accuracy && !TS_TST_INFO_set_accuracy(tst_info, accuracy)) - goto end; - - /* Setting ordering. */ - if ((ctx->flags & TS_ORDERING) && - !TS_TST_INFO_set_ordering(tst_info, 1)) - goto end; - - /* Setting nonce if needed. */ - if ((nonce = TS_REQ_get_nonce(ctx->request)) != NULL && - !TS_TST_INFO_set_nonce(tst_info, nonce)) - goto end; - - /* Setting TSA name to subject of signer certificate. */ - if (ctx->flags & TS_TSA_NAME) { - if (!(tsa_name = GENERAL_NAME_new())) - goto end; - tsa_name->type = GEN_DIRNAME; - tsa_name->d.dirn = - X509_NAME_dup(X509_get_subject_name(ctx->signer_cert)); - if (!tsa_name->d.dirn) - goto end; - if (!TS_TST_INFO_set_tsa(tst_info, tsa_name)) - goto end; - } - - result = 1; - -end: - if (!result) { - TS_TST_INFO_free(tst_info); - tst_info = NULL; - TSerror(TS_R_TST_INFO_SETUP_ERROR); - TS_RESP_CTX_set_status_info_cond(ctx, TS_STATUS_REJECTION, - "Error during TSTInfo " - "generation."); - } - GENERAL_NAME_free(tsa_name); - TS_ACCURACY_free(accuracy); - ASN1_GENERALIZEDTIME_free(asn1_time); - ASN1_INTEGER_free(serial); - - return tst_info; -} - -/* Processing the extensions of the request. */ -static int -TS_RESP_process_extensions(TS_RESP_CTX *ctx) -{ - STACK_OF(X509_EXTENSION) *exts = TS_REQ_get_exts(ctx->request); - int i; - int ok = 1; - - for (i = 0; ok && i < sk_X509_EXTENSION_num(exts); ++i) { - X509_EXTENSION *ext = sk_X509_EXTENSION_value(exts, i); - /* XXXXX The last argument was previously - (void *)ctx->extension_cb, but ISO C doesn't permit - converting a function pointer to void *. For lack of - better information, I'm placing a NULL there instead. - The callback can pick its own address out from the ctx - anyway... - */ - ok = (*ctx->extension_cb)(ctx, ext, NULL); - } - - return ok; -} - -/* Functions for signing the TS_TST_INFO structure of the context. */ -static int -TS_RESP_sign(TS_RESP_CTX *ctx) -{ - int ret = 0; - PKCS7 *p7 = NULL; - PKCS7_SIGNER_INFO *si; - STACK_OF(X509) *certs; /* Certificates to include in sc. */ - ESS_SIGNING_CERT *sc = NULL; - ASN1_OBJECT *oid; - BIO *p7bio = NULL; - int i; - - /* Check if signcert and pkey match. */ - if (!X509_check_private_key(ctx->signer_cert, ctx->signer_key)) { - TSerror(TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE); - goto err; - } - - /* Create a new PKCS7 signed object. */ - if (!(p7 = PKCS7_new())) { - TSerror(ERR_R_MALLOC_FAILURE); - goto err; - } - if (!PKCS7_set_type(p7, NID_pkcs7_signed)) - goto err; - - /* Force SignedData version to be 3 instead of the default 1. */ - if (!ASN1_INTEGER_set(p7->d.sign->version, 3)) - goto err; - - /* Add signer certificate and optional certificate chain. */ - if (TS_REQ_get_cert_req(ctx->request)) { - PKCS7_add_certificate(p7, ctx->signer_cert); - if (ctx->certs) { - for (i = 0; i < sk_X509_num(ctx->certs); ++i) { - X509 *cert = sk_X509_value(ctx->certs, i); - PKCS7_add_certificate(p7, cert); - } - } - } - - /* Add a new signer info. */ - if (!(si = PKCS7_add_signature(p7, ctx->signer_cert, - ctx->signer_key, EVP_sha1()))) { - TSerror(TS_R_PKCS7_ADD_SIGNATURE_ERROR); - goto err; - } - - /* Add content type signed attribute to the signer info. */ - oid = OBJ_nid2obj(NID_id_smime_ct_TSTInfo); - if (!PKCS7_add_signed_attribute(si, NID_pkcs9_contentType, - V_ASN1_OBJECT, oid)) { - TSerror(TS_R_PKCS7_ADD_SIGNED_ATTR_ERROR); - goto err; - } - - /* Create the ESS SigningCertificate attribute which contains - the signer certificate id and optionally the certificate chain. */ - certs = ctx->flags & TS_ESS_CERT_ID_CHAIN ? ctx->certs : NULL; - if (!(sc = ESS_SIGNING_CERT_new_init(ctx->signer_cert, certs))) - goto err; - - /* Add SigningCertificate signed attribute to the signer info. */ - if (!ESS_add_signing_cert(si, sc)) { - TSerror(TS_R_ESS_ADD_SIGNING_CERT_ERROR); - goto err; - } - - /* Add a new empty NID_id_smime_ct_TSTInfo encapsulated content. */ - if (!TS_TST_INFO_content_new(p7)) - goto err; - - /* Add the DER encoded tst_info to the PKCS7 structure. */ - if (!(p7bio = PKCS7_dataInit(p7, NULL))) { - TSerror(ERR_R_MALLOC_FAILURE); - goto err; - } - - /* Convert tst_info to DER. */ - if (!i2d_TS_TST_INFO_bio(p7bio, ctx->tst_info)) { - TSerror(TS_R_TS_DATASIGN); - goto err; - } - - /* Create the signature and add it to the signer info. */ - if (!PKCS7_dataFinal(p7, p7bio)) { - TSerror(TS_R_TS_DATASIGN); - goto err; - } - - /* Set new PKCS7 and TST_INFO objects. */ - TS_RESP_set_tst_info(ctx->response, p7, ctx->tst_info); - p7 = NULL; /* Ownership is lost. */ - ctx->tst_info = NULL; /* Ownership is lost. */ - - ret = 1; - -err: - if (!ret) - TS_RESP_CTX_set_status_info_cond(ctx, TS_STATUS_REJECTION, - "Error during signature " - "generation."); - BIO_free_all(p7bio); - ESS_SIGNING_CERT_free(sc); - PKCS7_free(p7); - return ret; -} - -static ESS_SIGNING_CERT * -ESS_SIGNING_CERT_new_init(X509 *signcert, STACK_OF(X509) *certs) -{ - ESS_CERT_ID *cid; - ESS_SIGNING_CERT *sc = NULL; - int i; - - /* Creating the ESS_CERT_ID stack. */ - if (!(sc = ESS_SIGNING_CERT_new())) - goto err; - if (!sc->cert_ids && !(sc->cert_ids = sk_ESS_CERT_ID_new_null())) - goto err; - - /* Adding the signing certificate id. */ - if (!(cid = ESS_CERT_ID_new_init(signcert, 0)) || - !sk_ESS_CERT_ID_push(sc->cert_ids, cid)) - goto err; - /* Adding the certificate chain ids. */ - for (i = 0; i < sk_X509_num(certs); ++i) { - X509 *cert = sk_X509_value(certs, i); - if (!(cid = ESS_CERT_ID_new_init(cert, 1)) || - !sk_ESS_CERT_ID_push(sc->cert_ids, cid)) - goto err; - } - - return sc; - -err: - ESS_SIGNING_CERT_free(sc); - TSerror(ERR_R_MALLOC_FAILURE); - return NULL; -} - -static ESS_CERT_ID * -ESS_CERT_ID_new_init(X509 *cert, int issuer_needed) -{ - ESS_CERT_ID *cid = NULL; - GENERAL_NAME *name = NULL; - unsigned char cert_hash[TS_HASH_LEN]; - - /* Recompute SHA1 hash of certificate if necessary (side effect). */ - X509_check_purpose(cert, -1, 0); - - if (!(cid = ESS_CERT_ID_new())) - goto err; - - if (!X509_digest(cert, TS_HASH_EVP, cert_hash, NULL)) - goto err; - - if (!ASN1_OCTET_STRING_set(cid->hash, cert_hash, sizeof(cert_hash))) - goto err; - - /* Setting the issuer/serial if requested. */ - if (issuer_needed) { - /* Creating issuer/serial structure. */ - if (!cid->issuer_serial && - !(cid->issuer_serial = ESS_ISSUER_SERIAL_new())) - goto err; - /* Creating general name from the certificate issuer. */ - if (!(name = GENERAL_NAME_new())) - goto err; - name->type = GEN_DIRNAME; - if ((name->d.dirn = X509_NAME_dup(X509_get_issuer_name(cert))) == NULL) - goto err; - if (!sk_GENERAL_NAME_push(cid->issuer_serial->issuer, name)) - goto err; - name = NULL; /* Ownership is lost. */ - /* Setting the serial number. */ - ASN1_INTEGER_free(cid->issuer_serial->serial); - if (!(cid->issuer_serial->serial = - ASN1_INTEGER_dup(X509_get_serialNumber(cert)))) - goto err; - } - - return cid; - -err: - GENERAL_NAME_free(name); - ESS_CERT_ID_free(cid); - TSerror(ERR_R_MALLOC_FAILURE); - return NULL; -} - -static int -TS_TST_INFO_content_new(PKCS7 *p7) -{ - PKCS7 *ret = NULL; - ASN1_OCTET_STRING *octet_string = NULL; - - /* Create new encapsulated NID_id_smime_ct_TSTInfo content. */ - if (!(ret = PKCS7_new())) - goto err; - if (!(ret->d.other = ASN1_TYPE_new())) - goto err; - ret->type = OBJ_nid2obj(NID_id_smime_ct_TSTInfo); - if (!(octet_string = ASN1_OCTET_STRING_new())) - goto err; - ASN1_TYPE_set(ret->d.other, V_ASN1_OCTET_STRING, octet_string); - octet_string = NULL; - - /* Add encapsulated content to signed PKCS7 structure. */ - if (!PKCS7_set_content(p7, ret)) - goto err; - - return 1; - -err: - ASN1_OCTET_STRING_free(octet_string); - PKCS7_free(ret); - return 0; -} - -static int -ESS_add_signing_cert(PKCS7_SIGNER_INFO *si, ESS_SIGNING_CERT *sc) -{ - ASN1_STRING *seq = NULL; - unsigned char *p, *pp = NULL; - int len; - - len = i2d_ESS_SIGNING_CERT(sc, NULL); - if (!(pp = malloc(len))) { - TSerror(ERR_R_MALLOC_FAILURE); - goto err; - } - p = pp; - i2d_ESS_SIGNING_CERT(sc, &p); - if (!(seq = ASN1_STRING_new()) || !ASN1_STRING_set(seq, pp, len)) { - TSerror(ERR_R_MALLOC_FAILURE); - goto err; - } - free(pp); - pp = NULL; - return PKCS7_add_signed_attribute(si, - NID_id_smime_aa_signingCertificate, V_ASN1_SEQUENCE, seq); - -err: - ASN1_STRING_free(seq); - free(pp); - - return 0; -} diff --git a/src/lib/libcrypto/ts/ts_rsp_utils.c b/src/lib/libcrypto/ts/ts_rsp_utils.c deleted file mode 100644 index 34994adce8..0000000000 --- a/src/lib/libcrypto/ts/ts_rsp_utils.c +++ /dev/null @@ -1,503 +0,0 @@ -/* $OpenBSD: ts_rsp_utils.c,v 1.11 2023/07/07 19:37:54 beck Exp $ */ -/* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL - * project 2002. - */ -/* ==================================================================== - * Copyright (c) 2006 The OpenSSL Project. All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in - * the documentation and/or other materials provided with the - * distribution. - * - * 3. All advertising materials mentioning features or use of this - * software must display the following acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" - * - * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to - * endorse or promote products derived from this software without - * prior written permission. For written permission, please contact - * licensing@OpenSSL.org. - * - * 5. Products derived from this software may not be called "OpenSSL" - * nor may "OpenSSL" appear in their names without prior written - * permission of the OpenSSL Project. - * - * 6. Redistributions of any form whatsoever must retain the following - * acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" - * - * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY - * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR - * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR - * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT - * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; - * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, - * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED - * OF THE POSSIBILITY OF SUCH DAMAGE. - * ==================================================================== - * - * This product includes cryptographic software written by Eric Young - * (eay@cryptsoft.com). This product includes software written by Tim - * Hudson (tjh@cryptsoft.com). - * - */ - -#include - -#include -#include -#include -#include - -#include "ts_local.h" - -/* Function definitions. */ - -int -TS_RESP_set_status_info(TS_RESP *a, TS_STATUS_INFO *status_info) -{ - TS_STATUS_INFO *new_status_info; - - if (a->status_info == status_info) - return 1; - new_status_info = TS_STATUS_INFO_dup(status_info); - if (new_status_info == NULL) { - TSerror(ERR_R_MALLOC_FAILURE); - return 0; - } - TS_STATUS_INFO_free(a->status_info); - a->status_info = new_status_info; - - return 1; -} -LCRYPTO_ALIAS(TS_RESP_set_status_info); - -TS_STATUS_INFO * -TS_RESP_get_status_info(TS_RESP *a) -{ - return a->status_info; -} -LCRYPTO_ALIAS(TS_RESP_get_status_info); - -const ASN1_UTF8STRING * -TS_STATUS_INFO_get0_failure_info(const TS_STATUS_INFO *si) -{ - return si->failure_info; -} -LCRYPTO_ALIAS(TS_STATUS_INFO_get0_failure_info); - -const STACK_OF(ASN1_UTF8STRING) * -TS_STATUS_INFO_get0_text(const TS_STATUS_INFO *si) -{ - return si->text; -} -LCRYPTO_ALIAS(TS_STATUS_INFO_get0_text); - -const ASN1_INTEGER * -TS_STATUS_INFO_get0_status(const TS_STATUS_INFO *si) -{ - return si->status; -} -LCRYPTO_ALIAS(TS_STATUS_INFO_get0_status); - -int -TS_STATUS_INFO_set_status(TS_STATUS_INFO *si, int i) -{ - return ASN1_INTEGER_set(si->status, i); -} -LCRYPTO_ALIAS(TS_STATUS_INFO_set_status); - -/* Caller loses ownership of PKCS7 and TS_TST_INFO objects. */ -void -TS_RESP_set_tst_info(TS_RESP *a, PKCS7 *p7, TS_TST_INFO *tst_info) -{ - /* Set new PKCS7 and TST_INFO objects. */ - PKCS7_free(a->token); - a->token = p7; - TS_TST_INFO_free(a->tst_info); - a->tst_info = tst_info; -} -LCRYPTO_ALIAS(TS_RESP_set_tst_info); - -PKCS7 * -TS_RESP_get_token(TS_RESP *a) -{ - return a->token; -} -LCRYPTO_ALIAS(TS_RESP_get_token); - -TS_TST_INFO * -TS_RESP_get_tst_info(TS_RESP *a) -{ - return a->tst_info; -} -LCRYPTO_ALIAS(TS_RESP_get_tst_info); - -int -TS_TST_INFO_set_version(TS_TST_INFO *a, long version) -{ - return ASN1_INTEGER_set(a->version, version); -} -LCRYPTO_ALIAS(TS_TST_INFO_set_version); - -long -TS_TST_INFO_get_version(const TS_TST_INFO *a) -{ - return ASN1_INTEGER_get(a->version); -} -LCRYPTO_ALIAS(TS_TST_INFO_get_version); - -int -TS_TST_INFO_set_policy_id(TS_TST_INFO *a, ASN1_OBJECT *policy) -{ - ASN1_OBJECT *new_policy; - - if (a->policy_id == policy) - return 1; - new_policy = OBJ_dup(policy); - if (new_policy == NULL) { - TSerror(ERR_R_MALLOC_FAILURE); - return 0; - } - ASN1_OBJECT_free(a->policy_id); - a->policy_id = new_policy; - return 1; -} -LCRYPTO_ALIAS(TS_TST_INFO_set_policy_id); - -ASN1_OBJECT * -TS_TST_INFO_get_policy_id(TS_TST_INFO *a) -{ - return a->policy_id; -} -LCRYPTO_ALIAS(TS_TST_INFO_get_policy_id); - -int -TS_TST_INFO_set_msg_imprint(TS_TST_INFO *a, TS_MSG_IMPRINT *msg_imprint) -{ - TS_MSG_IMPRINT *new_msg_imprint; - - if (a->msg_imprint == msg_imprint) - return 1; - new_msg_imprint = TS_MSG_IMPRINT_dup(msg_imprint); - if (new_msg_imprint == NULL) { - TSerror(ERR_R_MALLOC_FAILURE); - return 0; - } - TS_MSG_IMPRINT_free(a->msg_imprint); - a->msg_imprint = new_msg_imprint; - return 1; -} -LCRYPTO_ALIAS(TS_TST_INFO_set_msg_imprint); - -TS_MSG_IMPRINT * -TS_TST_INFO_get_msg_imprint(TS_TST_INFO *a) -{ - return a->msg_imprint; -} -LCRYPTO_ALIAS(TS_TST_INFO_get_msg_imprint); - -int -TS_TST_INFO_set_serial(TS_TST_INFO *a, const ASN1_INTEGER *serial) -{ - ASN1_INTEGER *new_serial; - - if (a->serial == serial) - return 1; - new_serial = ASN1_INTEGER_dup(serial); - if (new_serial == NULL) { - TSerror(ERR_R_MALLOC_FAILURE); - return 0; - } - ASN1_INTEGER_free(a->serial); - a->serial = new_serial; - return 1; -} -LCRYPTO_ALIAS(TS_TST_INFO_set_serial); - -const ASN1_INTEGER * -TS_TST_INFO_get_serial(const TS_TST_INFO *a) -{ - return a->serial; -} -LCRYPTO_ALIAS(TS_TST_INFO_get_serial); - -int -TS_TST_INFO_set_time(TS_TST_INFO *a, const ASN1_GENERALIZEDTIME *gtime) -{ - ASN1_GENERALIZEDTIME *new_time; - - if (a->time == gtime) - return 1; - new_time = ASN1_STRING_dup(gtime); - if (new_time == NULL) { - TSerror(ERR_R_MALLOC_FAILURE); - return 0; - } - ASN1_GENERALIZEDTIME_free(a->time); - a->time = new_time; - return 1; -} -LCRYPTO_ALIAS(TS_TST_INFO_set_time); - -const ASN1_GENERALIZEDTIME * -TS_TST_INFO_get_time(const TS_TST_INFO *a) -{ - return a->time; -} -LCRYPTO_ALIAS(TS_TST_INFO_get_time); - -int -TS_TST_INFO_set_accuracy(TS_TST_INFO *a, TS_ACCURACY *accuracy) -{ - TS_ACCURACY *new_accuracy; - - if (a->accuracy == accuracy) - return 1; - new_accuracy = TS_ACCURACY_dup(accuracy); - if (new_accuracy == NULL) { - TSerror(ERR_R_MALLOC_FAILURE); - return 0; - } - TS_ACCURACY_free(a->accuracy); - a->accuracy = new_accuracy; - return 1; -} -LCRYPTO_ALIAS(TS_TST_INFO_set_accuracy); - -TS_ACCURACY * -TS_TST_INFO_get_accuracy(TS_TST_INFO *a) -{ - return a->accuracy; -} -LCRYPTO_ALIAS(TS_TST_INFO_get_accuracy); - -int -TS_ACCURACY_set_seconds(TS_ACCURACY *a, const ASN1_INTEGER *seconds) -{ - ASN1_INTEGER *new_seconds; - - if (a->seconds == seconds) - return 1; - new_seconds = ASN1_INTEGER_dup(seconds); - if (new_seconds == NULL) { - TSerror(ERR_R_MALLOC_FAILURE); - return 0; - } - ASN1_INTEGER_free(a->seconds); - a->seconds = new_seconds; - return 1; -} -LCRYPTO_ALIAS(TS_ACCURACY_set_seconds); - -const ASN1_INTEGER * -TS_ACCURACY_get_seconds(const TS_ACCURACY *a) -{ - return a->seconds; -} -LCRYPTO_ALIAS(TS_ACCURACY_get_seconds); - -int -TS_ACCURACY_set_millis(TS_ACCURACY *a, const ASN1_INTEGER *millis) -{ - ASN1_INTEGER *new_millis = NULL; - - if (a->millis == millis) - return 1; - if (millis != NULL) { - new_millis = ASN1_INTEGER_dup(millis); - if (new_millis == NULL) { - TSerror(ERR_R_MALLOC_FAILURE); - return 0; - } - } - ASN1_INTEGER_free(a->millis); - a->millis = new_millis; - return 1; -} -LCRYPTO_ALIAS(TS_ACCURACY_set_millis); - -const ASN1_INTEGER * -TS_ACCURACY_get_millis(const TS_ACCURACY *a) -{ - return a->millis; -} -LCRYPTO_ALIAS(TS_ACCURACY_get_millis); - -int -TS_ACCURACY_set_micros(TS_ACCURACY *a, const ASN1_INTEGER *micros) -{ - ASN1_INTEGER *new_micros = NULL; - - if (a->micros == micros) - return 1; - if (micros != NULL) { - new_micros = ASN1_INTEGER_dup(micros); - if (new_micros == NULL) { - TSerror(ERR_R_MALLOC_FAILURE); - return 0; - } - } - ASN1_INTEGER_free(a->micros); - a->micros = new_micros; - return 1; -} -LCRYPTO_ALIAS(TS_ACCURACY_set_micros); - -const ASN1_INTEGER * -TS_ACCURACY_get_micros(const TS_ACCURACY *a) -{ - return a->micros; -} -LCRYPTO_ALIAS(TS_ACCURACY_get_micros); - -int -TS_TST_INFO_set_ordering(TS_TST_INFO *a, int ordering) -{ - a->ordering = ordering ? 0xFF : 0x00; - return 1; -} -LCRYPTO_ALIAS(TS_TST_INFO_set_ordering); - -int -TS_TST_INFO_get_ordering(const TS_TST_INFO *a) -{ - return a->ordering ? 1 : 0; -} -LCRYPTO_ALIAS(TS_TST_INFO_get_ordering); - -int -TS_TST_INFO_set_nonce(TS_TST_INFO *a, const ASN1_INTEGER *nonce) -{ - ASN1_INTEGER *new_nonce; - - if (a->nonce == nonce) - return 1; - new_nonce = ASN1_INTEGER_dup(nonce); - if (new_nonce == NULL) { - TSerror(ERR_R_MALLOC_FAILURE); - return 0; - } - ASN1_INTEGER_free(a->nonce); - a->nonce = new_nonce; - return 1; -} -LCRYPTO_ALIAS(TS_TST_INFO_set_nonce); - -const ASN1_INTEGER * -TS_TST_INFO_get_nonce(const TS_TST_INFO *a) -{ - return a->nonce; -} -LCRYPTO_ALIAS(TS_TST_INFO_get_nonce); - -int -TS_TST_INFO_set_tsa(TS_TST_INFO *a, GENERAL_NAME *tsa) -{ - GENERAL_NAME *new_tsa; - - if (a->tsa == tsa) - return 1; - new_tsa = GENERAL_NAME_dup(tsa); - if (new_tsa == NULL) { - TSerror(ERR_R_MALLOC_FAILURE); - return 0; - } - GENERAL_NAME_free(a->tsa); - a->tsa = new_tsa; - return 1; -} -LCRYPTO_ALIAS(TS_TST_INFO_set_tsa); - -GENERAL_NAME * -TS_TST_INFO_get_tsa(TS_TST_INFO *a) -{ - return a->tsa; -} -LCRYPTO_ALIAS(TS_TST_INFO_get_tsa); - -STACK_OF(X509_EXTENSION) *TS_TST_INFO_get_exts(TS_TST_INFO *a) -{ - return a->extensions; -} -LCRYPTO_ALIAS(TS_TST_INFO_get_exts); - -void -TS_TST_INFO_ext_free(TS_TST_INFO *a) -{ - if (!a) - return; - sk_X509_EXTENSION_pop_free(a->extensions, X509_EXTENSION_free); - a->extensions = NULL; -} -LCRYPTO_ALIAS(TS_TST_INFO_ext_free); - -int -TS_TST_INFO_get_ext_count(TS_TST_INFO *a) -{ - return X509v3_get_ext_count(a->extensions); -} -LCRYPTO_ALIAS(TS_TST_INFO_get_ext_count); - -int -TS_TST_INFO_get_ext_by_NID(TS_TST_INFO *a, int nid, int lastpos) -{ - return X509v3_get_ext_by_NID(a->extensions, nid, lastpos); -} -LCRYPTO_ALIAS(TS_TST_INFO_get_ext_by_NID); - -int -TS_TST_INFO_get_ext_by_OBJ(TS_TST_INFO *a, const ASN1_OBJECT *obj, int lastpos) -{ - return X509v3_get_ext_by_OBJ(a->extensions, obj, lastpos); -} -LCRYPTO_ALIAS(TS_TST_INFO_get_ext_by_OBJ); - -int -TS_TST_INFO_get_ext_by_critical(TS_TST_INFO *a, int crit, int lastpos) -{ - return X509v3_get_ext_by_critical(a->extensions, crit, lastpos); -} -LCRYPTO_ALIAS(TS_TST_INFO_get_ext_by_critical); - -X509_EXTENSION * -TS_TST_INFO_get_ext(TS_TST_INFO *a, int loc) -{ - return X509v3_get_ext(a->extensions, loc); -} -LCRYPTO_ALIAS(TS_TST_INFO_get_ext); - -X509_EXTENSION * -TS_TST_INFO_delete_ext(TS_TST_INFO *a, int loc) -{ - return X509v3_delete_ext(a->extensions, loc); -} -LCRYPTO_ALIAS(TS_TST_INFO_delete_ext); - -int -TS_TST_INFO_add_ext(TS_TST_INFO *a, X509_EXTENSION *ex, int loc) -{ - return X509v3_add_ext(&a->extensions, ex, loc) != NULL; -} -LCRYPTO_ALIAS(TS_TST_INFO_add_ext); - -void * -TS_TST_INFO_get_ext_d2i(TS_TST_INFO *a, int nid, int *crit, int *idx) -{ - return X509V3_get_d2i(a->extensions, nid, crit, idx); -} -LCRYPTO_ALIAS(TS_TST_INFO_get_ext_d2i); diff --git a/src/lib/libcrypto/ts/ts_rsp_verify.c b/src/lib/libcrypto/ts/ts_rsp_verify.c deleted file mode 100644 index 69236f68ab..0000000000 --- a/src/lib/libcrypto/ts/ts_rsp_verify.c +++ /dev/null @@ -1,847 +0,0 @@ -/* $OpenBSD: ts_rsp_verify.c,v 1.30 2023/07/07 07:25:21 beck Exp $ */ -/* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL - * project 2002. - */ -/* ==================================================================== - * Copyright (c) 2006 The OpenSSL Project. All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in - * the documentation and/or other materials provided with the - * distribution. - * - * 3. All advertising materials mentioning features or use of this - * software must display the following acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" - * - * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to - * endorse or promote products derived from this software without - * prior written permission. For written permission, please contact - * licensing@OpenSSL.org. - * - * 5. Products derived from this software may not be called "OpenSSL" - * nor may "OpenSSL" appear in their names without prior written - * permission of the OpenSSL Project. - * - * 6. Redistributions of any form whatsoever must retain the following - * acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" - * - * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY - * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR - * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR - * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT - * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; - * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, - * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED - * OF THE POSSIBILITY OF SUCH DAMAGE. - * ==================================================================== - * - * This product includes cryptographic software written by Eric Young - * (eay@cryptsoft.com). This product includes software written by Tim - * Hudson (tjh@cryptsoft.com). - * - */ - -#include -#include - -#include -#include -#include -#include - -#include "evp_local.h" -#include "ts_local.h" -#include "x509_local.h" - -/* Private function declarations. */ - -static int TS_verify_cert(X509_STORE *store, STACK_OF(X509) *untrusted, - X509 *signer, STACK_OF(X509) **chain); -static int TS_check_signing_certs(PKCS7_SIGNER_INFO *si, STACK_OF(X509) *chain); -static ESS_SIGNING_CERT *ESS_get_signing_cert(PKCS7_SIGNER_INFO *si); -static int TS_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert); -static ESS_SIGNING_CERT_V2 *ESS_get_signing_cert_v2(PKCS7_SIGNER_INFO *si); -static int TS_find_cert_v2(STACK_OF(ESS_CERT_ID_V2) *cert_ids, X509 *cert); -static int TS_issuer_serial_cmp(ESS_ISSUER_SERIAL *is, X509 *cert); -static int int_TS_RESP_verify_token(TS_VERIFY_CTX *ctx, - PKCS7 *token, TS_TST_INFO *tst_info); -static int TS_check_status_info(TS_RESP *response); -static char *TS_get_status_text(STACK_OF(ASN1_UTF8STRING) *text); -static int TS_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info); -static int TS_compute_imprint(BIO *data, TS_TST_INFO *tst_info, - X509_ALGOR **md_alg, - unsigned char **imprint, unsigned *imprint_len); -static int TS_check_imprints(X509_ALGOR *algor_a, - unsigned char *imprint_a, unsigned len_a, - TS_TST_INFO *tst_info); -static int TS_check_nonces(const ASN1_INTEGER *a, TS_TST_INFO *tst_info); -static int TS_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer); -static int TS_find_name(STACK_OF(GENERAL_NAME) *gen_names, GENERAL_NAME *name); - -/* - * Local mapping between response codes and descriptions. - * Don't forget to change TS_STATUS_BUF_SIZE when modifying - * the elements of this array. - */ -static const char *TS_status_text[] = { - "granted", - "grantedWithMods", - "rejection", - "waiting", - "revocationWarning", - "revocationNotification" -}; - -#define TS_STATUS_TEXT_SIZE (sizeof(TS_status_text)/sizeof(*TS_status_text)) - -/* - * This must be greater or equal to the sum of the strings in TS_status_text - * plus the number of its elements. - */ -#define TS_STATUS_BUF_SIZE 256 - -static struct { - int code; - const char *text; -} TS_failure_info[] = { - { TS_INFO_BAD_ALG, "badAlg" }, - { TS_INFO_BAD_REQUEST, "badRequest" }, - { TS_INFO_BAD_DATA_FORMAT, "badDataFormat" }, - { TS_INFO_TIME_NOT_AVAILABLE, "timeNotAvailable" }, - { TS_INFO_UNACCEPTED_POLICY, "unacceptedPolicy" }, - { TS_INFO_UNACCEPTED_EXTENSION, "unacceptedExtension" }, - { TS_INFO_ADD_INFO_NOT_AVAILABLE, "addInfoNotAvailable" }, - { TS_INFO_SYSTEM_FAILURE, "systemFailure" } -}; - -#define TS_FAILURE_INFO_SIZE (sizeof(TS_failure_info) / \ - sizeof(*TS_failure_info)) - -/* Functions for verifying a signed TS_TST_INFO structure. */ - -/* - * This function carries out the following tasks: - * - Checks if there is one and only one signer. - * - Search for the signing certificate in 'certs' and in the response. - * - Check the extended key usage and key usage fields of the signer - * certificate (done by the path validation). - * - Build and validate the certificate path. - * - Check if the certificate path meets the requirements of the - * SigningCertificate ESS signed attribute. - * - Verify the signature value. - * - Returns the signer certificate in 'signer', if 'signer' is not NULL. - */ -int -TS_RESP_verify_signature(PKCS7 *token, STACK_OF(X509) *certs, - X509_STORE *store, X509 **signer_out) -{ - STACK_OF(PKCS7_SIGNER_INFO) *sinfos = NULL; - PKCS7_SIGNER_INFO *si; - STACK_OF(X509) *signers = NULL; - X509 *signer; - STACK_OF(X509) *chain = NULL; - char buf[4096]; - int i, j = 0, ret = 0; - BIO *p7bio = NULL; - - /* Some sanity checks first. */ - if (!token) { - TSerror(TS_R_INVALID_NULL_POINTER); - goto err; - } - - /* Check for the correct content type */ - if (!PKCS7_type_is_signed(token)) { - TSerror(TS_R_WRONG_CONTENT_TYPE); - goto err; - } - - /* Check if there is one and only one signer. */ - sinfos = PKCS7_get_signer_info(token); - if (!sinfos || sk_PKCS7_SIGNER_INFO_num(sinfos) != 1) { - TSerror(TS_R_THERE_MUST_BE_ONE_SIGNER); - goto err; - } - si = sk_PKCS7_SIGNER_INFO_value(sinfos, 0); - - /* Check for no content: no data to verify signature. */ - if (PKCS7_get_detached(token)) { - TSerror(TS_R_NO_CONTENT); - goto err; - } - - /* Get hold of the signer certificate, search only internal - certificates if it was requested. */ - signers = PKCS7_get0_signers(token, certs, 0); - if (!signers || sk_X509_num(signers) != 1) - goto err; - signer = sk_X509_value(signers, 0); - - /* Now verify the certificate. */ - if (!TS_verify_cert(store, certs, signer, &chain)) - goto err; - - /* Check if the signer certificate is consistent with the - ESS extension. */ - if (!TS_check_signing_certs(si, chain)) - goto err; - - /* Creating the message digest. */ - p7bio = PKCS7_dataInit(token, NULL); - - /* We now have to 'read' from p7bio to calculate digests etc. */ - while ((i = BIO_read(p7bio, buf, sizeof(buf))) > 0) - ; - - /* Verifying the signature. */ - j = PKCS7_signatureVerify(p7bio, token, si, signer); - if (j <= 0) { - TSerror(TS_R_SIGNATURE_FAILURE); - goto err; - } - - /* Return the signer certificate if needed. */ - if (signer_out) { - *signer_out = signer; - CRYPTO_add(&signer->references, 1, CRYPTO_LOCK_X509); - } - - ret = 1; - -err: - BIO_free_all(p7bio); - sk_X509_pop_free(chain, X509_free); - sk_X509_free(signers); - - return ret; -} -LCRYPTO_ALIAS(TS_RESP_verify_signature); - -/* - * The certificate chain is returned in chain. Caller is responsible for - * freeing the vector. - */ -static int -TS_verify_cert(X509_STORE *store, STACK_OF(X509) *untrusted, X509 *signer, - STACK_OF(X509) **chain) -{ - X509_STORE_CTX cert_ctx; - int i; - int ret = 0; - - /* chain is an out argument. */ - *chain = NULL; - if (X509_STORE_CTX_init(&cert_ctx, store, signer, untrusted) == 0) { - TSerror(ERR_R_X509_LIB); - goto err; - } - if (X509_STORE_CTX_set_purpose(&cert_ctx, - X509_PURPOSE_TIMESTAMP_SIGN) == 0) - goto err; - i = X509_verify_cert(&cert_ctx); - if (i <= 0) { - int j = X509_STORE_CTX_get_error(&cert_ctx); - - TSerror(TS_R_CERTIFICATE_VERIFY_ERROR); - ERR_asprintf_error_data("Verify error:%s", - X509_verify_cert_error_string(j)); - goto err; - } else { - /* Get a copy of the certificate chain. */ - *chain = X509_STORE_CTX_get1_chain(&cert_ctx); - ret = 1; - } - -err: - X509_STORE_CTX_cleanup(&cert_ctx); - - return ret; -} - -static int -TS_check_signing_certs(PKCS7_SIGNER_INFO *si, STACK_OF(X509) *chain) -{ - ESS_SIGNING_CERT *ss = NULL; - STACK_OF(ESS_CERT_ID) *cert_ids; - ESS_SIGNING_CERT_V2 *ssv2 = NULL; - STACK_OF(ESS_CERT_ID_V2) *cert_ids_v2; - X509 *cert; - int i = 0; - int ret = 0; - - if ((ss = ESS_get_signing_cert(si)) != NULL) { - cert_ids = ss->cert_ids; - /* The signer certificate must be the first in cert_ids. */ - cert = sk_X509_value(chain, 0); - - if (TS_find_cert(cert_ids, cert) != 0) - goto err; - - /* - * Check the other certificates of the chain if there are more - * than one certificate ids in cert_ids. - */ - if (sk_ESS_CERT_ID_num(cert_ids) > 1) { - /* All the certificates of the chain must be in cert_ids. */ - for (i = 1; i < sk_X509_num(chain); i++) { - cert = sk_X509_value(chain, i); - - if (TS_find_cert(cert_ids, cert) < 0) - goto err; - } - } - } - - if ((ssv2 = ESS_get_signing_cert_v2(si)) != NULL) { - cert_ids_v2 = ssv2->cert_ids; - /* The signer certificate must be the first in cert_ids_v2. */ - cert = sk_X509_value(chain, 0); - - if (TS_find_cert_v2(cert_ids_v2, cert) != 0) - goto err; - - /* - * Check the other certificates of the chain if there are more - * than one certificate ids in cert_ids_v2. - */ - if (sk_ESS_CERT_ID_V2_num(cert_ids_v2) > 1) { - /* All the certificates of the chain must be in cert_ids_v2. */ - for (i = 1; i < sk_X509_num(chain); i++) { - cert = sk_X509_value(chain, i); - - if (TS_find_cert_v2(cert_ids_v2, cert) < 0) - goto err; - } - } - } - - ret = 1; - -err: - if (!ret) - TSerror(TS_R_ESS_SIGNING_CERTIFICATE_ERROR); - ESS_SIGNING_CERT_free(ss); - ESS_SIGNING_CERT_V2_free(ssv2); - return ret; -} - -static ESS_SIGNING_CERT * -ESS_get_signing_cert(PKCS7_SIGNER_INFO *si) -{ - ASN1_TYPE *attr; - const unsigned char *p; - - attr = PKCS7_get_signed_attribute(si, - NID_id_smime_aa_signingCertificate); - if (!attr) - return NULL; - if (attr->type != V_ASN1_SEQUENCE) - return NULL; - p = attr->value.sequence->data; - return d2i_ESS_SIGNING_CERT(NULL, &p, attr->value.sequence->length); -} - -static ESS_SIGNING_CERT_V2 * -ESS_get_signing_cert_v2(PKCS7_SIGNER_INFO *si) -{ - ASN1_TYPE *attr; - const unsigned char *p; - - attr = PKCS7_get_signed_attribute(si, NID_id_smime_aa_signingCertificateV2); - if (attr == NULL) - return NULL; - p = attr->value.sequence->data; - return d2i_ESS_SIGNING_CERT_V2(NULL, &p, attr->value.sequence->length); -} - -/* Returns < 0 if certificate is not found, certificate index otherwise. */ -static int -TS_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert) -{ - int i; - unsigned char cert_hash[TS_HASH_LEN]; - - if (!cert_ids || !cert) - return -1; - - if (!X509_digest(cert, TS_HASH_EVP, cert_hash, NULL)) - return -1; - - /* Recompute SHA1 hash of certificate if necessary (side effect). */ - if (X509_check_purpose(cert, -1, 0) == -1) - return -1; - - /* Look for cert in the cert_ids vector. */ - for (i = 0; i < sk_ESS_CERT_ID_num(cert_ids); ++i) { - ESS_CERT_ID *cid = sk_ESS_CERT_ID_value(cert_ids, i); - - /* Check the SHA-1 hash first. */ - if (cid->hash->length == TS_HASH_LEN && !memcmp(cid->hash->data, - cert_hash, TS_HASH_LEN)) { - /* Check the issuer/serial as well if specified. */ - ESS_ISSUER_SERIAL *is = cid->issuer_serial; - - if (is == NULL || TS_issuer_serial_cmp(is, cert) == 0) - return i; - } - } - - return -1; -} - -/* Returns < 0 if certificate is not found, certificate index otherwise. */ -static int -TS_find_cert_v2(STACK_OF(ESS_CERT_ID_V2) *cert_ids, X509 *cert) -{ - int i; - unsigned char cert_digest[EVP_MAX_MD_SIZE]; - unsigned int len; - - /* Look for cert in the cert_ids vector. */ - for (i = 0; i < sk_ESS_CERT_ID_V2_num(cert_ids); ++i) { - ESS_CERT_ID_V2 *cid = sk_ESS_CERT_ID_V2_value(cert_ids, i); - const EVP_MD *md = EVP_sha256(); - - if (cid->hash_alg != NULL) - md = EVP_get_digestbyobj(cid->hash_alg->algorithm); - if (md == NULL) - return -1; - - if (!X509_digest(cert, md, cert_digest, &len)) - return -1; - - if ((unsigned int)cid->hash->length != len) - return -1; - - if (memcmp(cid->hash->data, cert_digest, cid->hash->length) == 0) { - ESS_ISSUER_SERIAL *is = cid->issuer_serial; - - if (is == NULL || TS_issuer_serial_cmp(is, cert) == 0) - return i; - } - } - - return -1; -} - -static int -TS_issuer_serial_cmp(ESS_ISSUER_SERIAL *is, X509 *cert) -{ - GENERAL_NAME *issuer; - - if (is == NULL || cert == NULL || sk_GENERAL_NAME_num(is->issuer) != 1) - return -1; - - /* Check the issuer first. It must be a directory name. */ - issuer = sk_GENERAL_NAME_value(is->issuer, 0); - if (issuer->type != GEN_DIRNAME || - X509_NAME_cmp(issuer->d.dirn, X509_get_issuer_name(cert))) - return -1; - - /* Check the serial number, too. */ - if (ASN1_INTEGER_cmp(is->serial, X509_get_serialNumber(cert))) - return -1; - - return 0; -} - -/* - * Verifies whether 'response' contains a valid response with regards - * to the settings of the context: - * - Gives an error message if the TS_TST_INFO is not present. - * - Calls _TS_RESP_verify_token to verify the token content. - */ -int -TS_RESP_verify_response(TS_VERIFY_CTX *ctx, TS_RESP *response) -{ - PKCS7 *token = TS_RESP_get_token(response); - TS_TST_INFO *tst_info = TS_RESP_get_tst_info(response); - int ret = 0; - - /* Check if we have a successful TS_TST_INFO object in place. */ - if (!TS_check_status_info(response)) - goto err; - - /* Check the contents of the time stamp token. */ - if (!int_TS_RESP_verify_token(ctx, token, tst_info)) - goto err; - - ret = 1; - -err: - return ret; -} -LCRYPTO_ALIAS(TS_RESP_verify_response); - -/* - * Tries to extract a TS_TST_INFO structure from the PKCS7 token and - * calls the internal int_TS_RESP_verify_token function for verifying it. - */ -int -TS_RESP_verify_token(TS_VERIFY_CTX *ctx, PKCS7 *token) -{ - TS_TST_INFO *tst_info = PKCS7_to_TS_TST_INFO(token); - int ret = 0; - - if (tst_info) { - ret = int_TS_RESP_verify_token(ctx, token, tst_info); - TS_TST_INFO_free(tst_info); - } - return ret; -} -LCRYPTO_ALIAS(TS_RESP_verify_token); - -/* - * Verifies whether the 'token' contains a valid time stamp token - * with regards to the settings of the context. Only those checks are - * carried out that are specified in the context: - * - Verifies the signature of the TS_TST_INFO. - * - Checks the version number of the response. - * - Check if the requested and returned policies math. - * - Check if the message imprints are the same. - * - Check if the nonces are the same. - * - Check if the TSA name matches the signer. - * - Check if the TSA name is the expected TSA. - */ -static int -int_TS_RESP_verify_token(TS_VERIFY_CTX *ctx, PKCS7 *token, - TS_TST_INFO *tst_info) -{ - X509 *signer = NULL; - GENERAL_NAME *tsa_name = TS_TST_INFO_get_tsa(tst_info); - X509_ALGOR *md_alg = NULL; - unsigned char *imprint = NULL; - unsigned imprint_len = 0; - int ret = 0; - - /* Verify the signature. */ - if ((ctx->flags & TS_VFY_SIGNATURE) && - !TS_RESP_verify_signature(token, ctx->certs, ctx->store, &signer)) - goto err; - - /* Check version number of response. */ - if ((ctx->flags & TS_VFY_VERSION) && - TS_TST_INFO_get_version(tst_info) != 1) { - TSerror(TS_R_UNSUPPORTED_VERSION); - goto err; - } - - /* Check policies. */ - if ((ctx->flags & TS_VFY_POLICY) && - !TS_check_policy(ctx->policy, tst_info)) - goto err; - - /* Check message imprints. */ - if ((ctx->flags & TS_VFY_IMPRINT) && - !TS_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len, - tst_info)) - goto err; - - /* Compute and check message imprints. */ - if ((ctx->flags & TS_VFY_DATA) && - (!TS_compute_imprint(ctx->data, tst_info, - &md_alg, &imprint, &imprint_len) || - !TS_check_imprints(md_alg, imprint, imprint_len, tst_info))) - goto err; - - /* Check nonces. */ - if ((ctx->flags & TS_VFY_NONCE) && - !TS_check_nonces(ctx->nonce, tst_info)) - goto err; - - /* Check whether TSA name and signer certificate match. */ - if ((ctx->flags & TS_VFY_SIGNER) && - tsa_name && !TS_check_signer_name(tsa_name, signer)) { - TSerror(TS_R_TSA_NAME_MISMATCH); - goto err; - } - - /* Check whether the TSA is the expected one. */ - if ((ctx->flags & TS_VFY_TSA_NAME) && - !TS_check_signer_name(ctx->tsa_name, signer)) { - TSerror(TS_R_TSA_UNTRUSTED); - goto err; - } - - ret = 1; - -err: - X509_free(signer); - X509_ALGOR_free(md_alg); - free(imprint); - return ret; -} - -static int -TS_check_status_info(TS_RESP *response) -{ - TS_STATUS_INFO *info = TS_RESP_get_status_info(response); - long status = ASN1_INTEGER_get(info->status); - const char *status_text = NULL; - char *embedded_status_text = NULL; - char failure_text[TS_STATUS_BUF_SIZE] = ""; - - /* Check if everything went fine. */ - if (status == 0 || status == 1) - return 1; - - /* There was an error, get the description in status_text. */ - if (0 <= status && status < (long)TS_STATUS_TEXT_SIZE) - status_text = TS_status_text[status]; - else - status_text = "unknown code"; - - /* Set the embedded_status_text to the returned description. */ - if (sk_ASN1_UTF8STRING_num(info->text) > 0 && - !(embedded_status_text = TS_get_status_text(info->text))) - return 0; - - /* Filling in failure_text with the failure information. */ - if (info->failure_info) { - int i; - int first = 1; - for (i = 0; i < (int)TS_FAILURE_INFO_SIZE; ++i) { - if (ASN1_BIT_STRING_get_bit(info->failure_info, - TS_failure_info[i].code)) { - if (!first) - strlcat(failure_text, ",", - TS_STATUS_BUF_SIZE); - else - first = 0; - strlcat(failure_text, TS_failure_info[i].text, - TS_STATUS_BUF_SIZE); - } - } - } - if (failure_text[0] == '\0') - strlcpy(failure_text, "unspecified", TS_STATUS_BUF_SIZE); - - /* Making up the error string. */ - TSerror(TS_R_NO_TIME_STAMP_TOKEN); - ERR_asprintf_error_data - ("status code: %s, status text: %s, failure codes: %s", - status_text, - embedded_status_text ? embedded_status_text : "unspecified", - failure_text); - free(embedded_status_text); - - return 0; -} - -static char * -TS_get_status_text(STACK_OF(ASN1_UTF8STRING) *text) -{ - int i; - unsigned int length = 0; - char *result = NULL; - - /* Determine length first. */ - for (i = 0; i < sk_ASN1_UTF8STRING_num(text); ++i) { - ASN1_UTF8STRING *current = sk_ASN1_UTF8STRING_value(text, i); - length += ASN1_STRING_length(current); - length += 1; /* separator character */ - } - /* Allocate memory (closing '\0' included). */ - if (!(result = malloc(length))) { - TSerror(ERR_R_MALLOC_FAILURE); - return NULL; - } - /* Concatenate the descriptions. */ - result[0] = '\0'; - for (i = 0; i < sk_ASN1_UTF8STRING_num(text); ++i) { - ASN1_UTF8STRING *current = sk_ASN1_UTF8STRING_value(text, i); - if (i > 0) - strlcat(result, "/", length); - strlcat(result, (const char *)ASN1_STRING_data(current), length); - } - return result; -} - -static int -TS_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info) -{ - ASN1_OBJECT *resp_oid = TS_TST_INFO_get_policy_id(tst_info); - - if (OBJ_cmp(req_oid, resp_oid) != 0) { - TSerror(TS_R_POLICY_MISMATCH); - return 0; - } - - return 1; -} - -static int -TS_compute_imprint(BIO *data, TS_TST_INFO *tst_info, X509_ALGOR **out_md_alg, - unsigned char **out_imprint, unsigned int *out_imprint_len) -{ - TS_MSG_IMPRINT *msg_imprint; - X509_ALGOR *md_alg_resp; - X509_ALGOR *md_alg = NULL; - unsigned char *imprint = NULL; - unsigned int imprint_len = 0; - const EVP_MD *md; - EVP_MD_CTX md_ctx; - unsigned char buffer[4096]; - int length; - - *out_md_alg = NULL; - *out_imprint = NULL; - *out_imprint_len = 0; - - /* Retrieve the MD algorithm of the response. */ - msg_imprint = TS_TST_INFO_get_msg_imprint(tst_info); - md_alg_resp = TS_MSG_IMPRINT_get_algo(msg_imprint); - if ((md_alg = X509_ALGOR_dup(md_alg_resp)) == NULL) - goto err; - - /* Getting the MD object. */ - if ((md = EVP_get_digestbyobj((md_alg)->algorithm)) == NULL) { - TSerror(TS_R_UNSUPPORTED_MD_ALGORITHM); - goto err; - } - - /* Compute message digest. */ - if ((length = EVP_MD_size(md)) < 0) - goto err; - imprint_len = length; - if ((imprint = malloc(imprint_len)) == NULL) { - TSerror(ERR_R_MALLOC_FAILURE); - goto err; - } - - if (!EVP_DigestInit(&md_ctx, md)) - goto err; - while ((length = BIO_read(data, buffer, sizeof(buffer))) > 0) { - if (!EVP_DigestUpdate(&md_ctx, buffer, length)) - goto err; - } - if (!EVP_DigestFinal(&md_ctx, imprint, NULL)) - goto err; - - *out_md_alg = md_alg; - md_alg = NULL; - *out_imprint = imprint; - imprint = NULL; - *out_imprint_len = imprint_len; - - return 1; - -err: - X509_ALGOR_free(md_alg); - free(imprint); - return 0; -} - -static int -TS_check_imprints(X509_ALGOR *algor_a, unsigned char *imprint_a, unsigned len_a, - TS_TST_INFO *tst_info) -{ - TS_MSG_IMPRINT *b = TS_TST_INFO_get_msg_imprint(tst_info); - X509_ALGOR *algor_b = TS_MSG_IMPRINT_get_algo(b); - int ret = 0; - - /* algor_a is optional. */ - if (algor_a) { - /* Compare algorithm OIDs. */ - if (OBJ_cmp(algor_a->algorithm, algor_b->algorithm)) - goto err; - - /* The parameter must be NULL in both. */ - if ((algor_a->parameter && - ASN1_TYPE_get(algor_a->parameter) != V_ASN1_NULL) || - (algor_b->parameter && - ASN1_TYPE_get(algor_b->parameter) != V_ASN1_NULL)) - goto err; - } - - /* Compare octet strings. */ - ret = len_a == (unsigned) ASN1_STRING_length(b->hashed_msg) && - memcmp(imprint_a, ASN1_STRING_data(b->hashed_msg), len_a) == 0; - -err: - if (!ret) - TSerror(TS_R_MESSAGE_IMPRINT_MISMATCH); - return ret; -} - -static int -TS_check_nonces(const ASN1_INTEGER *a, TS_TST_INFO *tst_info) -{ - const ASN1_INTEGER *b = TS_TST_INFO_get_nonce(tst_info); - - /* Error if nonce is missing. */ - if (!b) { - TSerror(TS_R_NONCE_NOT_RETURNED); - return 0; - } - - /* No error if a nonce is returned without being requested. */ - if (ASN1_INTEGER_cmp(a, b) != 0) { - TSerror(TS_R_NONCE_MISMATCH); - return 0; - } - - return 1; -} - -/* Check if the specified TSA name matches either the subject - or one of the subject alternative names of the TSA certificate. */ -static int -TS_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer) -{ - STACK_OF(GENERAL_NAME) *gen_names = NULL; - int idx = -1; - int found = 0; - - if (signer == NULL) - return 0; - - /* Check the subject name first. */ - if (tsa_name->type == GEN_DIRNAME && - X509_name_cmp(tsa_name->d.dirn, X509_get_subject_name(signer)) == 0) - return 1; - - /* Check all the alternative names. */ - gen_names = X509_get_ext_d2i(signer, NID_subject_alt_name, - NULL, &idx); - while (gen_names != NULL && - !(found = (TS_find_name(gen_names, tsa_name) >= 0))) { - /* Get the next subject alternative name, - although there should be no more than one. */ - GENERAL_NAMES_free(gen_names); - gen_names = X509_get_ext_d2i(signer, NID_subject_alt_name, - NULL, &idx); - } - if (gen_names) - GENERAL_NAMES_free(gen_names); - - return found; -} - -/* Returns 1 if name is in gen_names, 0 otherwise. */ -static int -TS_find_name(STACK_OF(GENERAL_NAME) *gen_names, GENERAL_NAME *name) -{ - int i, found; - for (i = 0, found = 0; !found && i < sk_GENERAL_NAME_num(gen_names); - ++i) { - GENERAL_NAME *current = sk_GENERAL_NAME_value(gen_names, i); - found = GENERAL_NAME_cmp(current, name) == 0; - } - return found ? i - 1 : -1; -} diff --git a/src/lib/libcrypto/ts/ts_verify_ctx.c b/src/lib/libcrypto/ts/ts_verify_ctx.c deleted file mode 100644 index 5a2d95c680..0000000000 --- a/src/lib/libcrypto/ts/ts_verify_ctx.c +++ /dev/null @@ -1,236 +0,0 @@ -/* $OpenBSD: ts_verify_ctx.c,v 1.14 2023/07/07 07:25:21 beck Exp $ */ -/* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL - * project 2003. - */ -/* ==================================================================== - * Copyright (c) 2006 The OpenSSL Project. All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in - * the documentation and/or other materials provided with the - * distribution. - * - * 3. All advertising materials mentioning features or use of this - * software must display the following acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" - * - * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to - * endorse or promote products derived from this software without - * prior written permission. For written permission, please contact - * licensing@OpenSSL.org. - * - * 5. Products derived from this software may not be called "OpenSSL" - * nor may "OpenSSL" appear in their names without prior written - * permission of the OpenSSL Project. - * - * 6. Redistributions of any form whatsoever must retain the following - * acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" - * - * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY - * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR - * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR - * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT - * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; - * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, - * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED - * OF THE POSSIBILITY OF SUCH DAMAGE. - * ==================================================================== - * - * This product includes cryptographic software written by Eric Young - * (eay@cryptsoft.com). This product includes software written by Tim - * Hudson (tjh@cryptsoft.com). - * - */ - -#include - -#include -#include -#include - -#include "ts_local.h" - -TS_VERIFY_CTX * -TS_VERIFY_CTX_new(void) -{ - TS_VERIFY_CTX *ctx = calloc(1, sizeof(TS_VERIFY_CTX)); - - if (!ctx) - TSerror(ERR_R_MALLOC_FAILURE); - - return ctx; -} -LCRYPTO_ALIAS(TS_VERIFY_CTX_new); - -void -TS_VERIFY_CTX_free(TS_VERIFY_CTX *ctx) -{ - if (!ctx) - return; - - TS_VERIFY_CTX_cleanup(ctx); - free(ctx); -} -LCRYPTO_ALIAS(TS_VERIFY_CTX_free); - -void -TS_VERIFY_CTX_cleanup(TS_VERIFY_CTX *ctx) -{ - if (!ctx) - return; - - X509_STORE_free(ctx->store); - sk_X509_pop_free(ctx->certs, X509_free); - - ASN1_OBJECT_free(ctx->policy); - - X509_ALGOR_free(ctx->md_alg); - free(ctx->imprint); - - BIO_free_all(ctx->data); - - ASN1_INTEGER_free(ctx->nonce); - - GENERAL_NAME_free(ctx->tsa_name); - - memset(ctx, 0, sizeof(*ctx)); -} -LCRYPTO_ALIAS(TS_VERIFY_CTX_cleanup); - -/* - * XXX: The following accessors demonstrate the amount of care and thought that - * went into OpenSSL 1.1 API design and the review thereof: for whatever reason - * these functions return what was passed in. Correct memory management is left - * as an exercise for the reader... Unfortunately, careful consumers like - * openssl-ruby assume this behavior, so we're stuck with this insanity. The - * cherry on top is the TS_VERIFY_CTS_set_certs() [sic!] function that made it - * into the public API. - * - * Outstanding job, R$ and tjh, A+. - */ - -int -TS_VERIFY_CTX_add_flags(TS_VERIFY_CTX *ctx, int flags) -{ - ctx->flags |= flags; - - return ctx->flags; -} -LCRYPTO_ALIAS(TS_VERIFY_CTX_add_flags); - -int -TS_VERIFY_CTX_set_flags(TS_VERIFY_CTX *ctx, int flags) -{ - ctx->flags = flags; - - return ctx->flags; -} -LCRYPTO_ALIAS(TS_VERIFY_CTX_set_flags); - -BIO * -TS_VERIFY_CTX_set_data(TS_VERIFY_CTX *ctx, BIO *bio) -{ - ctx->data = bio; - - return ctx->data; -} -LCRYPTO_ALIAS(TS_VERIFY_CTX_set_data); - -X509_STORE * -TS_VERIFY_CTX_set_store(TS_VERIFY_CTX *ctx, X509_STORE *store) -{ - ctx->store = store; - - return ctx->store; -} -LCRYPTO_ALIAS(TS_VERIFY_CTX_set_store); - -STACK_OF(X509) * -TS_VERIFY_CTX_set_certs(TS_VERIFY_CTX *ctx, STACK_OF(X509) *certs) -{ - ctx->certs = certs; - - return ctx->certs; -} -LCRYPTO_ALIAS(TS_VERIFY_CTX_set_certs); - -unsigned char * -TS_VERIFY_CTX_set_imprint(TS_VERIFY_CTX *ctx, unsigned char *imprint, - long imprint_len) -{ - free(ctx->imprint); - - ctx->imprint = imprint; - ctx->imprint_len = imprint_len; - - return ctx->imprint; -} -LCRYPTO_ALIAS(TS_VERIFY_CTX_set_imprint); - -TS_VERIFY_CTX * -TS_REQ_to_TS_VERIFY_CTX(TS_REQ *req, TS_VERIFY_CTX *ctx) -{ - TS_VERIFY_CTX *ret = ctx; - ASN1_OBJECT *policy; - TS_MSG_IMPRINT *imprint; - X509_ALGOR *md_alg; - ASN1_OCTET_STRING *msg; - const ASN1_INTEGER *nonce; - - if (ret) - TS_VERIFY_CTX_cleanup(ret); - else if (!(ret = TS_VERIFY_CTX_new())) - return NULL; - - /* Setting flags. */ - ret->flags = TS_VFY_ALL_IMPRINT & ~(TS_VFY_TSA_NAME | TS_VFY_SIGNATURE); - - /* Setting policy. */ - if ((policy = TS_REQ_get_policy_id(req)) != NULL) { - if (!(ret->policy = OBJ_dup(policy))) - goto err; - } else - ret->flags &= ~TS_VFY_POLICY; - - /* Setting md_alg, imprint and imprint_len. */ - imprint = TS_REQ_get_msg_imprint(req); - md_alg = TS_MSG_IMPRINT_get_algo(imprint); - if (!(ret->md_alg = X509_ALGOR_dup(md_alg))) - goto err; - msg = TS_MSG_IMPRINT_get_msg(imprint); - ret->imprint_len = ASN1_STRING_length(msg); - if (!(ret->imprint = malloc(ret->imprint_len))) - goto err; - memcpy(ret->imprint, ASN1_STRING_data(msg), ret->imprint_len); - - /* Setting nonce. */ - if ((nonce = TS_REQ_get_nonce(req)) != NULL) { - if (!(ret->nonce = ASN1_INTEGER_dup(nonce))) - goto err; - } else - ret->flags &= ~TS_VFY_NONCE; - - return ret; - -err: - if (ctx) - TS_VERIFY_CTX_cleanup(ctx); - else - TS_VERIFY_CTX_free(ret); - return NULL; -} -LCRYPTO_ALIAS(TS_REQ_to_TS_VERIFY_CTX); -- cgit v1.2.3-55-g6feb