aboutsummaryrefslogtreecommitdiffstats
path: root/crypto/ts
diff options
context:
space:
mode:
Diffstat (limited to 'crypto/ts')
-rw-r--r--crypto/ts/Makefile272
-rw-r--r--crypto/ts/build.info5
-rw-r--r--crypto/ts/ts.h865
-rw-r--r--crypto/ts/ts_asn1.c126
-rw-r--r--crypto/ts/ts_conf.c242
-rw-r--r--crypto/ts/ts_err.c322
-rw-r--r--crypto/ts/ts_lcl.h211
-rw-r--r--crypto/ts/ts_lib.c98
-rw-r--r--crypto/ts/ts_req_print.c77
-rw-r--r--crypto/ts/ts_req_utils.c67
-rw-r--r--crypto/ts/ts_rsp_print.c166
-rw-r--r--crypto/ts/ts_rsp_sign.c569
-rw-r--r--crypto/ts/ts_rsp_utils.c91
-rw-r--r--crypto/ts/ts_rsp_verify.c502
-rw-r--r--crypto/ts/ts_verify_ctx.c138
15 files changed, 1243 insertions, 2508 deletions
diff --git a/crypto/ts/Makefile b/crypto/ts/Makefile
deleted file mode 100644
index 4a3c0f0017e8..000000000000
--- a/crypto/ts/Makefile
+++ /dev/null
@@ -1,272 +0,0 @@
-#
-# SSLeay/crypto/ts/Makefile
-#
-
-DIR= ts
-TOP= ../..
-CC= cc
-INCLUDES= -I.. -I../../include
-CFLAG = -g
-INSTALL_PREFIX=
-OPENSSLDIR= /usr/local/ssl
-INSTALLTOP=/usr/local/ssl
-MAKEDEPPROG= makedepend
-MAKEDEPEND= $(TOP)/util/domd $(TOP) -MD $(MAKEDEPPROG)
-MAKEFILE= Makefile
-AR= ar r
-
-PEX_LIBS=
-EX_LIBS=
-
-CFLAGS= $(INCLUDES) $(CFLAG)
-
-GENERAL= Makefile
-TEST=
-APPS=
-
-LIB=$(TOP)/libcrypto.a
-LIBSRC= ts_err.c ts_req_utils.c ts_req_print.c ts_rsp_utils.c ts_rsp_print.c \
- ts_rsp_sign.c ts_rsp_verify.c ts_verify_ctx.c ts_lib.c ts_conf.c \
- ts_asn1.c
-LIBOBJ= ts_err.o ts_req_utils.o ts_req_print.o ts_rsp_utils.o ts_rsp_print.o \
- ts_rsp_sign.o ts_rsp_verify.o ts_verify_ctx.o ts_lib.o ts_conf.o \
- ts_asn1.o
-
-SRC= $(LIBSRC)
-
-EXHEADER= ts.h
-HEADER= $(EXHEADER)
-
-ALL= $(GENERAL) $(SRC) $(HEADER)
-
-top:
- (cd ../..; $(MAKE) DIRS=crypto SDIRS=$(DIR) sub_all)
-
-test:
-
-all: lib
-
-lib: $(LIBOBJ)
- $(AR) $(LIB) $(LIBOBJ)
- $(RANLIB) $(LIB) || echo Never mind.
- @touch lib
-
-files:
- $(PERL) $(TOP)/util/files.pl Makefile >> $(TOP)/MINFO
-
-links:
- @$(PERL) $(TOP)/util/mklink.pl ../../include/openssl $(EXHEADER)
- @$(PERL) $(TOP)/util/mklink.pl ../../test $(TEST)
- @$(PERL) $(TOP)/util/mklink.pl ../../apps $(APPS)
-
-install:
- @[ -n "$(INSTALLTOP)" ] # should be set by top Makefile...
- @headerlist="$(EXHEADER)"; for i in $$headerlist ; \
- do \
- (cp $$i $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i; \
- chmod 644 $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i ); \
- done;
-
-tags:
- ctags $(SRC)
-
-lint:
- lint -DLINT $(INCLUDES) $(SRC)>fluff
-
-update: depend
-
-depend:
- $(MAKEDEPEND) -- $(CFLAG) $(INCLUDES) $(DEPFLAG) -- $(LIBSRC)
-
-dclean:
- $(PERL) -pe 'if (/^# DO NOT DELETE THIS LINE/) {print; exit(0);}' $(MAKEFILE) >Makefile.new
- mv -f Makefile.new $(MAKEFILE)
-
-clean:
- rm -f *.o *.obj lib tags core .pure .nfs* *.old *.bak fluff enc dec sign verify
-
-# DO NOT DELETE THIS LINE -- make depend depends on it.
-
-ts_asn1.o: ../../include/openssl/asn1.h ../../include/openssl/asn1t.h
-ts_asn1.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
-ts_asn1.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
-ts_asn1.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
-ts_asn1.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
-ts_asn1.o: ../../include/openssl/ecdh.h ../../include/openssl/ecdsa.h
-ts_asn1.o: ../../include/openssl/err.h ../../include/openssl/evp.h
-ts_asn1.o: ../../include/openssl/lhash.h ../../include/openssl/obj_mac.h
-ts_asn1.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
-ts_asn1.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
-ts_asn1.o: ../../include/openssl/pkcs7.h ../../include/openssl/rsa.h
-ts_asn1.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
-ts_asn1.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
-ts_asn1.o: ../../include/openssl/ts.h ../../include/openssl/x509.h
-ts_asn1.o: ../../include/openssl/x509_vfy.h ../../include/openssl/x509v3.h
-ts_asn1.o: ts_asn1.c
-ts_conf.o: ../../e_os.h ../../include/openssl/asn1.h
-ts_conf.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
-ts_conf.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
-ts_conf.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
-ts_conf.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
-ts_conf.o: ../../include/openssl/ecdh.h ../../include/openssl/ecdsa.h
-ts_conf.o: ../../include/openssl/engine.h ../../include/openssl/err.h
-ts_conf.o: ../../include/openssl/evp.h ../../include/openssl/lhash.h
-ts_conf.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
-ts_conf.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
-ts_conf.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pem.h
-ts_conf.o: ../../include/openssl/pem2.h ../../include/openssl/pkcs7.h
-ts_conf.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
-ts_conf.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
-ts_conf.o: ../../include/openssl/symhacks.h ../../include/openssl/ts.h
-ts_conf.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
-ts_conf.o: ../../include/openssl/x509v3.h ../cryptlib.h ts_conf.c
-ts_err.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
-ts_err.o: ../../include/openssl/buffer.h ../../include/openssl/conf.h
-ts_err.o: ../../include/openssl/crypto.h ../../include/openssl/dh.h
-ts_err.o: ../../include/openssl/dsa.h ../../include/openssl/e_os2.h
-ts_err.o: ../../include/openssl/ec.h ../../include/openssl/ecdh.h
-ts_err.o: ../../include/openssl/ecdsa.h ../../include/openssl/err.h
-ts_err.o: ../../include/openssl/evp.h ../../include/openssl/lhash.h
-ts_err.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
-ts_err.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
-ts_err.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pkcs7.h
-ts_err.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
-ts_err.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
-ts_err.o: ../../include/openssl/symhacks.h ../../include/openssl/ts.h
-ts_err.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
-ts_err.o: ../../include/openssl/x509v3.h ts_err.c
-ts_lib.o: ../../e_os.h ../../include/openssl/asn1.h ../../include/openssl/bio.h
-ts_lib.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
-ts_lib.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
-ts_lib.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
-ts_lib.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
-ts_lib.o: ../../include/openssl/ecdh.h ../../include/openssl/ecdsa.h
-ts_lib.o: ../../include/openssl/err.h ../../include/openssl/evp.h
-ts_lib.o: ../../include/openssl/lhash.h ../../include/openssl/obj_mac.h
-ts_lib.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
-ts_lib.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
-ts_lib.o: ../../include/openssl/pkcs7.h ../../include/openssl/rsa.h
-ts_lib.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
-ts_lib.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
-ts_lib.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
-ts_lib.o: ../../include/openssl/x509v3.h ../cryptlib.h ts.h ts_lib.c
-ts_req_print.o: ../../e_os.h ../../include/openssl/asn1.h
-ts_req_print.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
-ts_req_print.o: ../../include/openssl/buffer.h ../../include/openssl/conf.h
-ts_req_print.o: ../../include/openssl/crypto.h ../../include/openssl/dh.h
-ts_req_print.o: ../../include/openssl/dsa.h ../../include/openssl/e_os2.h
-ts_req_print.o: ../../include/openssl/ec.h ../../include/openssl/ecdh.h
-ts_req_print.o: ../../include/openssl/ecdsa.h ../../include/openssl/err.h
-ts_req_print.o: ../../include/openssl/evp.h ../../include/openssl/lhash.h
-ts_req_print.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
-ts_req_print.o: ../../include/openssl/opensslconf.h
-ts_req_print.o: ../../include/openssl/opensslv.h
-ts_req_print.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pkcs7.h
-ts_req_print.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
-ts_req_print.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
-ts_req_print.o: ../../include/openssl/symhacks.h ../../include/openssl/ts.h
-ts_req_print.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
-ts_req_print.o: ../../include/openssl/x509v3.h ../cryptlib.h ts_req_print.c
-ts_req_utils.o: ../../e_os.h ../../include/openssl/asn1.h
-ts_req_utils.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
-ts_req_utils.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
-ts_req_utils.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
-ts_req_utils.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
-ts_req_utils.o: ../../include/openssl/ecdh.h ../../include/openssl/ecdsa.h
-ts_req_utils.o: ../../include/openssl/err.h ../../include/openssl/evp.h
-ts_req_utils.o: ../../include/openssl/lhash.h ../../include/openssl/obj_mac.h
-ts_req_utils.o: ../../include/openssl/objects.h
-ts_req_utils.o: ../../include/openssl/opensslconf.h
-ts_req_utils.o: ../../include/openssl/opensslv.h
-ts_req_utils.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pkcs7.h
-ts_req_utils.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
-ts_req_utils.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
-ts_req_utils.o: ../../include/openssl/symhacks.h ../../include/openssl/ts.h
-ts_req_utils.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
-ts_req_utils.o: ../../include/openssl/x509v3.h ../cryptlib.h ts_req_utils.c
-ts_rsp_print.o: ../../e_os.h ../../include/openssl/asn1.h
-ts_rsp_print.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
-ts_rsp_print.o: ../../include/openssl/buffer.h ../../include/openssl/conf.h
-ts_rsp_print.o: ../../include/openssl/crypto.h ../../include/openssl/dh.h
-ts_rsp_print.o: ../../include/openssl/dsa.h ../../include/openssl/e_os2.h
-ts_rsp_print.o: ../../include/openssl/ec.h ../../include/openssl/ecdh.h
-ts_rsp_print.o: ../../include/openssl/ecdsa.h ../../include/openssl/err.h
-ts_rsp_print.o: ../../include/openssl/evp.h ../../include/openssl/lhash.h
-ts_rsp_print.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
-ts_rsp_print.o: ../../include/openssl/opensslconf.h
-ts_rsp_print.o: ../../include/openssl/opensslv.h
-ts_rsp_print.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pkcs7.h
-ts_rsp_print.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
-ts_rsp_print.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
-ts_rsp_print.o: ../../include/openssl/symhacks.h ../../include/openssl/x509.h
-ts_rsp_print.o: ../../include/openssl/x509_vfy.h ../../include/openssl/x509v3.h
-ts_rsp_print.o: ../cryptlib.h ts.h ts_rsp_print.c
-ts_rsp_sign.o: ../../e_os.h ../../include/openssl/asn1.h
-ts_rsp_sign.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
-ts_rsp_sign.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
-ts_rsp_sign.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
-ts_rsp_sign.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
-ts_rsp_sign.o: ../../include/openssl/ecdh.h ../../include/openssl/ecdsa.h
-ts_rsp_sign.o: ../../include/openssl/err.h ../../include/openssl/evp.h
-ts_rsp_sign.o: ../../include/openssl/lhash.h ../../include/openssl/obj_mac.h
-ts_rsp_sign.o: ../../include/openssl/objects.h
-ts_rsp_sign.o: ../../include/openssl/opensslconf.h
-ts_rsp_sign.o: ../../include/openssl/opensslv.h
-ts_rsp_sign.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pkcs7.h
-ts_rsp_sign.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
-ts_rsp_sign.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
-ts_rsp_sign.o: ../../include/openssl/symhacks.h ../../include/openssl/ts.h
-ts_rsp_sign.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
-ts_rsp_sign.o: ../../include/openssl/x509v3.h ../cryptlib.h ../o_time.h
-ts_rsp_sign.o: ts_rsp_sign.c
-ts_rsp_utils.o: ../../e_os.h ../../include/openssl/asn1.h
-ts_rsp_utils.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
-ts_rsp_utils.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
-ts_rsp_utils.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
-ts_rsp_utils.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
-ts_rsp_utils.o: ../../include/openssl/ecdh.h ../../include/openssl/ecdsa.h
-ts_rsp_utils.o: ../../include/openssl/err.h ../../include/openssl/evp.h
-ts_rsp_utils.o: ../../include/openssl/lhash.h ../../include/openssl/obj_mac.h
-ts_rsp_utils.o: ../../include/openssl/objects.h
-ts_rsp_utils.o: ../../include/openssl/opensslconf.h
-ts_rsp_utils.o: ../../include/openssl/opensslv.h
-ts_rsp_utils.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pkcs7.h
-ts_rsp_utils.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
-ts_rsp_utils.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
-ts_rsp_utils.o: ../../include/openssl/symhacks.h ../../include/openssl/ts.h
-ts_rsp_utils.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
-ts_rsp_utils.o: ../../include/openssl/x509v3.h ../cryptlib.h ts_rsp_utils.c
-ts_rsp_verify.o: ../../e_os.h ../../include/openssl/asn1.h
-ts_rsp_verify.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
-ts_rsp_verify.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
-ts_rsp_verify.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
-ts_rsp_verify.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
-ts_rsp_verify.o: ../../include/openssl/ecdh.h ../../include/openssl/ecdsa.h
-ts_rsp_verify.o: ../../include/openssl/err.h ../../include/openssl/evp.h
-ts_rsp_verify.o: ../../include/openssl/lhash.h ../../include/openssl/obj_mac.h
-ts_rsp_verify.o: ../../include/openssl/objects.h
-ts_rsp_verify.o: ../../include/openssl/opensslconf.h
-ts_rsp_verify.o: ../../include/openssl/opensslv.h
-ts_rsp_verify.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pkcs7.h
-ts_rsp_verify.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
-ts_rsp_verify.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
-ts_rsp_verify.o: ../../include/openssl/symhacks.h ../../include/openssl/ts.h
-ts_rsp_verify.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
-ts_rsp_verify.o: ../../include/openssl/x509v3.h ../cryptlib.h ts_rsp_verify.c
-ts_verify_ctx.o: ../../e_os.h ../../include/openssl/asn1.h
-ts_verify_ctx.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
-ts_verify_ctx.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
-ts_verify_ctx.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
-ts_verify_ctx.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
-ts_verify_ctx.o: ../../include/openssl/ecdh.h ../../include/openssl/ecdsa.h
-ts_verify_ctx.o: ../../include/openssl/err.h ../../include/openssl/evp.h
-ts_verify_ctx.o: ../../include/openssl/lhash.h ../../include/openssl/obj_mac.h
-ts_verify_ctx.o: ../../include/openssl/objects.h
-ts_verify_ctx.o: ../../include/openssl/opensslconf.h
-ts_verify_ctx.o: ../../include/openssl/opensslv.h
-ts_verify_ctx.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pkcs7.h
-ts_verify_ctx.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
-ts_verify_ctx.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
-ts_verify_ctx.o: ../../include/openssl/symhacks.h ../../include/openssl/ts.h
-ts_verify_ctx.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
-ts_verify_ctx.o: ../../include/openssl/x509v3.h ../cryptlib.h ts_verify_ctx.c
diff --git a/crypto/ts/build.info b/crypto/ts/build.info
new file mode 100644
index 000000000000..98e633d57ae9
--- /dev/null
+++ b/crypto/ts/build.info
@@ -0,0 +1,5 @@
+LIBS=../../libcrypto
+SOURCE[../../libcrypto]=\
+ ts_err.c ts_req_utils.c ts_req_print.c ts_rsp_utils.c ts_rsp_print.c \
+ ts_rsp_sign.c ts_rsp_verify.c ts_verify_ctx.c ts_lib.c ts_conf.c \
+ ts_asn1.c
diff --git a/crypto/ts/ts.h b/crypto/ts/ts.h
deleted file mode 100644
index 2daa1b2fb594..000000000000
--- a/crypto/ts/ts.h
+++ /dev/null
@@ -1,865 +0,0 @@
-/* crypto/ts/ts.h */
-/*
- * Written by Zoltan Glozik (zglozik@opentsa.org) for the OpenSSL project
- * 2002, 2003, 2004.
- */
-/* ====================================================================
- * Copyright (c) 2006 The OpenSSL Project. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in
- * the documentation and/or other materials provided with the
- * distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- * software must display the following acknowledgment:
- * "This product includes software developed by the OpenSSL Project
- * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- * endorse or promote products derived from this software without
- * prior written permission. For written permission, please contact
- * licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- * nor may "OpenSSL" appear in their names without prior written
- * permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- * acknowledgment:
- * "This product includes software developed by the OpenSSL Project
- * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com). This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-#ifndef HEADER_TS_H
-# define HEADER_TS_H
-
-# include <openssl/opensslconf.h>
-# include <openssl/symhacks.h>
-# ifndef OPENSSL_NO_BUFFER
-# include <openssl/buffer.h>
-# endif
-# ifndef OPENSSL_NO_EVP
-# include <openssl/evp.h>
-# endif
-# ifndef OPENSSL_NO_BIO
-# include <openssl/bio.h>
-# endif
-# include <openssl/stack.h>
-# include <openssl/asn1.h>
-# include <openssl/safestack.h>
-
-# ifndef OPENSSL_NO_RSA
-# include <openssl/rsa.h>
-# endif
-
-# ifndef OPENSSL_NO_DSA
-# include <openssl/dsa.h>
-# endif
-
-# ifndef OPENSSL_NO_DH
-# include <openssl/dh.h>
-# endif
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-# ifdef WIN32
-/* Under Win32 this is defined in wincrypt.h */
-# undef X509_NAME
-# endif
-
-# include <openssl/x509.h>
-# include <openssl/x509v3.h>
-
-/*-
-MessageImprint ::= SEQUENCE {
- hashAlgorithm AlgorithmIdentifier,
- hashedMessage OCTET STRING }
-*/
-
-typedef struct TS_msg_imprint_st {
- X509_ALGOR *hash_algo;
- ASN1_OCTET_STRING *hashed_msg;
-} TS_MSG_IMPRINT;
-
-/*-
-TimeStampReq ::= SEQUENCE {
- version INTEGER { v1(1) },
- messageImprint MessageImprint,
- --a hash algorithm OID and the hash value of the data to be
- --time-stamped
- reqPolicy TSAPolicyId OPTIONAL,
- nonce INTEGER OPTIONAL,
- certReq BOOLEAN DEFAULT FALSE,
- extensions [0] IMPLICIT Extensions OPTIONAL }
-*/
-
-typedef struct TS_req_st {
- ASN1_INTEGER *version;
- TS_MSG_IMPRINT *msg_imprint;
- ASN1_OBJECT *policy_id; /* OPTIONAL */
- ASN1_INTEGER *nonce; /* OPTIONAL */
- ASN1_BOOLEAN cert_req; /* DEFAULT FALSE */
- STACK_OF(X509_EXTENSION) *extensions; /* [0] OPTIONAL */
-} TS_REQ;
-
-/*-
-Accuracy ::= SEQUENCE {
- seconds INTEGER OPTIONAL,
- millis [0] INTEGER (1..999) OPTIONAL,
- micros [1] INTEGER (1..999) OPTIONAL }
-*/
-
-typedef struct TS_accuracy_st {
- ASN1_INTEGER *seconds;
- ASN1_INTEGER *millis;
- ASN1_INTEGER *micros;
-} TS_ACCURACY;
-
-/*-
-TSTInfo ::= SEQUENCE {
- version INTEGER { v1(1) },
- policy TSAPolicyId,
- messageImprint MessageImprint,
- -- MUST have the same value as the similar field in
- -- TimeStampReq
- serialNumber INTEGER,
- -- Time-Stamping users MUST be ready to accommodate integers
- -- up to 160 bits.
- genTime GeneralizedTime,
- accuracy Accuracy OPTIONAL,
- ordering BOOLEAN DEFAULT FALSE,
- nonce INTEGER OPTIONAL,
- -- MUST be present if the similar field was present
- -- in TimeStampReq. In that case it MUST have the same value.
- tsa [0] GeneralName OPTIONAL,
- extensions [1] IMPLICIT Extensions OPTIONAL }
-*/
-
-typedef struct TS_tst_info_st {
- ASN1_INTEGER *version;
- ASN1_OBJECT *policy_id;
- TS_MSG_IMPRINT *msg_imprint;
- ASN1_INTEGER *serial;
- ASN1_GENERALIZEDTIME *time;
- TS_ACCURACY *accuracy;
- ASN1_BOOLEAN ordering;
- ASN1_INTEGER *nonce;
- GENERAL_NAME *tsa;
- STACK_OF(X509_EXTENSION) *extensions;
-} TS_TST_INFO;
-
-/*-
-PKIStatusInfo ::= SEQUENCE {
- status PKIStatus,
- statusString PKIFreeText OPTIONAL,
- failInfo PKIFailureInfo OPTIONAL }
-
-From RFC 1510 - section 3.1.1:
-PKIFreeText ::= SEQUENCE SIZE (1..MAX) OF UTF8String
- -- text encoded as UTF-8 String (note: each UTF8String SHOULD
- -- include an RFC 1766 language tag to indicate the language
- -- of the contained text)
-*/
-
-/* Possible values for status. See ts_resp_print.c && ts_resp_verify.c. */
-
-# define TS_STATUS_GRANTED 0
-# define TS_STATUS_GRANTED_WITH_MODS 1
-# define TS_STATUS_REJECTION 2
-# define TS_STATUS_WAITING 3
-# define TS_STATUS_REVOCATION_WARNING 4
-# define TS_STATUS_REVOCATION_NOTIFICATION 5
-
-/*
- * Possible values for failure_info. See ts_resp_print.c && ts_resp_verify.c
- */
-
-# define TS_INFO_BAD_ALG 0
-# define TS_INFO_BAD_REQUEST 2
-# define TS_INFO_BAD_DATA_FORMAT 5
-# define TS_INFO_TIME_NOT_AVAILABLE 14
-# define TS_INFO_UNACCEPTED_POLICY 15
-# define TS_INFO_UNACCEPTED_EXTENSION 16
-# define TS_INFO_ADD_INFO_NOT_AVAILABLE 17
-# define TS_INFO_SYSTEM_FAILURE 25
-
-typedef struct TS_status_info_st {
- ASN1_INTEGER *status;
- STACK_OF(ASN1_UTF8STRING) *text;
- ASN1_BIT_STRING *failure_info;
-} TS_STATUS_INFO;
-
-DECLARE_STACK_OF(ASN1_UTF8STRING)
-DECLARE_ASN1_SET_OF(ASN1_UTF8STRING)
-
-/*-
-TimeStampResp ::= SEQUENCE {
- status PKIStatusInfo,
- timeStampToken TimeStampToken OPTIONAL }
-*/
-
-typedef struct TS_resp_st {
- TS_STATUS_INFO *status_info;
- PKCS7 *token;
- TS_TST_INFO *tst_info;
-} TS_RESP;
-
-/* The structure below would belong to the ESS component. */
-
-/*-
-IssuerSerial ::= SEQUENCE {
- issuer GeneralNames,
- serialNumber CertificateSerialNumber
- }
-*/
-
-typedef struct ESS_issuer_serial {
- STACK_OF(GENERAL_NAME) *issuer;
- ASN1_INTEGER *serial;
-} ESS_ISSUER_SERIAL;
-
-/*-
-ESSCertID ::= SEQUENCE {
- certHash Hash,
- issuerSerial IssuerSerial OPTIONAL
-}
-*/
-
-typedef struct ESS_cert_id {
- ASN1_OCTET_STRING *hash; /* Always SHA-1 digest. */
- ESS_ISSUER_SERIAL *issuer_serial;
-} ESS_CERT_ID;
-
-DECLARE_STACK_OF(ESS_CERT_ID)
-DECLARE_ASN1_SET_OF(ESS_CERT_ID)
-
-/*-
-SigningCertificate ::= SEQUENCE {
- certs SEQUENCE OF ESSCertID,
- policies SEQUENCE OF PolicyInformation OPTIONAL
-}
-*/
-
-typedef struct ESS_signing_cert {
- STACK_OF(ESS_CERT_ID) *cert_ids;
- STACK_OF(POLICYINFO) *policy_info;
-} ESS_SIGNING_CERT;
-
-TS_REQ *TS_REQ_new(void);
-void TS_REQ_free(TS_REQ *a);
-int i2d_TS_REQ(const TS_REQ *a, unsigned char **pp);
-TS_REQ *d2i_TS_REQ(TS_REQ **a, const unsigned char **pp, long length);
-
-TS_REQ *TS_REQ_dup(TS_REQ *a);
-
-TS_REQ *d2i_TS_REQ_fp(FILE *fp, TS_REQ **a);
-int i2d_TS_REQ_fp(FILE *fp, TS_REQ *a);
-TS_REQ *d2i_TS_REQ_bio(BIO *fp, TS_REQ **a);
-int i2d_TS_REQ_bio(BIO *fp, TS_REQ *a);
-
-TS_MSG_IMPRINT *TS_MSG_IMPRINT_new(void);
-void TS_MSG_IMPRINT_free(TS_MSG_IMPRINT *a);
-int i2d_TS_MSG_IMPRINT(const TS_MSG_IMPRINT *a, unsigned char **pp);
-TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT(TS_MSG_IMPRINT **a,
- const unsigned char **pp, long length);
-
-TS_MSG_IMPRINT *TS_MSG_IMPRINT_dup(TS_MSG_IMPRINT *a);
-
-TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT **a);
-int i2d_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT *a);
-TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_bio(BIO *fp, TS_MSG_IMPRINT **a);
-int i2d_TS_MSG_IMPRINT_bio(BIO *fp, TS_MSG_IMPRINT *a);
-
-TS_RESP *TS_RESP_new(void);
-void TS_RESP_free(TS_RESP *a);
-int i2d_TS_RESP(const TS_RESP *a, unsigned char **pp);
-TS_RESP *d2i_TS_RESP(TS_RESP **a, const unsigned char **pp, long length);
-TS_TST_INFO *PKCS7_to_TS_TST_INFO(PKCS7 *token);
-TS_RESP *TS_RESP_dup(TS_RESP *a);
-
-TS_RESP *d2i_TS_RESP_fp(FILE *fp, TS_RESP **a);
-int i2d_TS_RESP_fp(FILE *fp, TS_RESP *a);
-TS_RESP *d2i_TS_RESP_bio(BIO *fp, TS_RESP **a);
-int i2d_TS_RESP_bio(BIO *fp, TS_RESP *a);
-
-TS_STATUS_INFO *TS_STATUS_INFO_new(void);
-void TS_STATUS_INFO_free(TS_STATUS_INFO *a);
-int i2d_TS_STATUS_INFO(const TS_STATUS_INFO *a, unsigned char **pp);
-TS_STATUS_INFO *d2i_TS_STATUS_INFO(TS_STATUS_INFO **a,
- const unsigned char **pp, long length);
-TS_STATUS_INFO *TS_STATUS_INFO_dup(TS_STATUS_INFO *a);
-
-TS_TST_INFO *TS_TST_INFO_new(void);
-void TS_TST_INFO_free(TS_TST_INFO *a);
-int i2d_TS_TST_INFO(const TS_TST_INFO *a, unsigned char **pp);
-TS_TST_INFO *d2i_TS_TST_INFO(TS_TST_INFO **a, const unsigned char **pp,
- long length);
-TS_TST_INFO *TS_TST_INFO_dup(TS_TST_INFO *a);
-
-TS_TST_INFO *d2i_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO **a);
-int i2d_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO *a);
-TS_TST_INFO *d2i_TS_TST_INFO_bio(BIO *fp, TS_TST_INFO **a);
-int i2d_TS_TST_INFO_bio(BIO *fp, TS_TST_INFO *a);
-
-TS_ACCURACY *TS_ACCURACY_new(void);
-void TS_ACCURACY_free(TS_ACCURACY *a);
-int i2d_TS_ACCURACY(const TS_ACCURACY *a, unsigned char **pp);
-TS_ACCURACY *d2i_TS_ACCURACY(TS_ACCURACY **a, const unsigned char **pp,
- long length);
-TS_ACCURACY *TS_ACCURACY_dup(TS_ACCURACY *a);
-
-ESS_ISSUER_SERIAL *ESS_ISSUER_SERIAL_new(void);
-void ESS_ISSUER_SERIAL_free(ESS_ISSUER_SERIAL *a);
-int i2d_ESS_ISSUER_SERIAL(const ESS_ISSUER_SERIAL *a, unsigned char **pp);
-ESS_ISSUER_SERIAL *d2i_ESS_ISSUER_SERIAL(ESS_ISSUER_SERIAL **a,
- const unsigned char **pp,
- long length);
-ESS_ISSUER_SERIAL *ESS_ISSUER_SERIAL_dup(ESS_ISSUER_SERIAL *a);
-
-ESS_CERT_ID *ESS_CERT_ID_new(void);
-void ESS_CERT_ID_free(ESS_CERT_ID *a);
-int i2d_ESS_CERT_ID(const ESS_CERT_ID *a, unsigned char **pp);
-ESS_CERT_ID *d2i_ESS_CERT_ID(ESS_CERT_ID **a, const unsigned char **pp,
- long length);
-ESS_CERT_ID *ESS_CERT_ID_dup(ESS_CERT_ID *a);
-
-ESS_SIGNING_CERT *ESS_SIGNING_CERT_new(void);
-void ESS_SIGNING_CERT_free(ESS_SIGNING_CERT *a);
-int i2d_ESS_SIGNING_CERT(const ESS_SIGNING_CERT *a, unsigned char **pp);
-ESS_SIGNING_CERT *d2i_ESS_SIGNING_CERT(ESS_SIGNING_CERT **a,
- const unsigned char **pp, long length);
-ESS_SIGNING_CERT *ESS_SIGNING_CERT_dup(ESS_SIGNING_CERT *a);
-
-void ERR_load_TS_strings(void);
-
-int TS_REQ_set_version(TS_REQ *a, long version);
-long TS_REQ_get_version(const TS_REQ *a);
-
-int TS_REQ_set_msg_imprint(TS_REQ *a, TS_MSG_IMPRINT *msg_imprint);
-TS_MSG_IMPRINT *TS_REQ_get_msg_imprint(TS_REQ *a);
-
-int TS_MSG_IMPRINT_set_algo(TS_MSG_IMPRINT *a, X509_ALGOR *alg);
-X509_ALGOR *TS_MSG_IMPRINT_get_algo(TS_MSG_IMPRINT *a);
-
-int TS_MSG_IMPRINT_set_msg(TS_MSG_IMPRINT *a, unsigned char *d, int len);
-ASN1_OCTET_STRING *TS_MSG_IMPRINT_get_msg(TS_MSG_IMPRINT *a);
-
-int TS_REQ_set_policy_id(TS_REQ *a, ASN1_OBJECT *policy);
-ASN1_OBJECT *TS_REQ_get_policy_id(TS_REQ *a);
-
-int TS_REQ_set_nonce(TS_REQ *a, const ASN1_INTEGER *nonce);
-const ASN1_INTEGER *TS_REQ_get_nonce(const TS_REQ *a);
-
-int TS_REQ_set_cert_req(TS_REQ *a, int cert_req);
-int TS_REQ_get_cert_req(const TS_REQ *a);
-
-STACK_OF(X509_EXTENSION) *TS_REQ_get_exts(TS_REQ *a);
-void TS_REQ_ext_free(TS_REQ *a);
-int TS_REQ_get_ext_count(TS_REQ *a);
-int TS_REQ_get_ext_by_NID(TS_REQ *a, int nid, int lastpos);
-int TS_REQ_get_ext_by_OBJ(TS_REQ *a, ASN1_OBJECT *obj, int lastpos);
-int TS_REQ_get_ext_by_critical(TS_REQ *a, int crit, int lastpos);
-X509_EXTENSION *TS_REQ_get_ext(TS_REQ *a, int loc);
-X509_EXTENSION *TS_REQ_delete_ext(TS_REQ *a, int loc);
-int TS_REQ_add_ext(TS_REQ *a, X509_EXTENSION *ex, int loc);
-void *TS_REQ_get_ext_d2i(TS_REQ *a, int nid, int *crit, int *idx);
-
-/* Function declarations for TS_REQ defined in ts/ts_req_print.c */
-
-int TS_REQ_print_bio(BIO *bio, TS_REQ *a);
-
-/* Function declarations for TS_RESP defined in ts/ts_resp_utils.c */
-
-int TS_RESP_set_status_info(TS_RESP *a, TS_STATUS_INFO *info);
-TS_STATUS_INFO *TS_RESP_get_status_info(TS_RESP *a);
-
-/* Caller loses ownership of PKCS7 and TS_TST_INFO objects. */
-void TS_RESP_set_tst_info(TS_RESP *a, PKCS7 *p7, TS_TST_INFO *tst_info);
-PKCS7 *TS_RESP_get_token(TS_RESP *a);
-TS_TST_INFO *TS_RESP_get_tst_info(TS_RESP *a);
-
-int TS_TST_INFO_set_version(TS_TST_INFO *a, long version);
-long TS_TST_INFO_get_version(const TS_TST_INFO *a);
-
-int TS_TST_INFO_set_policy_id(TS_TST_INFO *a, ASN1_OBJECT *policy_id);
-ASN1_OBJECT *TS_TST_INFO_get_policy_id(TS_TST_INFO *a);
-
-int TS_TST_INFO_set_msg_imprint(TS_TST_INFO *a, TS_MSG_IMPRINT *msg_imprint);
-TS_MSG_IMPRINT *TS_TST_INFO_get_msg_imprint(TS_TST_INFO *a);
-
-int TS_TST_INFO_set_serial(TS_TST_INFO *a, const ASN1_INTEGER *serial);
-const ASN1_INTEGER *TS_TST_INFO_get_serial(const TS_TST_INFO *a);
-
-int TS_TST_INFO_set_time(TS_TST_INFO *a, const ASN1_GENERALIZEDTIME *gtime);
-const ASN1_GENERALIZEDTIME *TS_TST_INFO_get_time(const TS_TST_INFO *a);
-
-int TS_TST_INFO_set_accuracy(TS_TST_INFO *a, TS_ACCURACY *accuracy);
-TS_ACCURACY *TS_TST_INFO_get_accuracy(TS_TST_INFO *a);
-
-int TS_ACCURACY_set_seconds(TS_ACCURACY *a, const ASN1_INTEGER *seconds);
-const ASN1_INTEGER *TS_ACCURACY_get_seconds(const TS_ACCURACY *a);
-
-int TS_ACCURACY_set_millis(TS_ACCURACY *a, const ASN1_INTEGER *millis);
-const ASN1_INTEGER *TS_ACCURACY_get_millis(const TS_ACCURACY *a);
-
-int TS_ACCURACY_set_micros(TS_ACCURACY *a, const ASN1_INTEGER *micros);
-const ASN1_INTEGER *TS_ACCURACY_get_micros(const TS_ACCURACY *a);
-
-int TS_TST_INFO_set_ordering(TS_TST_INFO *a, int ordering);
-int TS_TST_INFO_get_ordering(const TS_TST_INFO *a);
-
-int TS_TST_INFO_set_nonce(TS_TST_INFO *a, const ASN1_INTEGER *nonce);
-const ASN1_INTEGER *TS_TST_INFO_get_nonce(const TS_TST_INFO *a);
-
-int TS_TST_INFO_set_tsa(TS_TST_INFO *a, GENERAL_NAME *tsa);
-GENERAL_NAME *TS_TST_INFO_get_tsa(TS_TST_INFO *a);
-
-STACK_OF(X509_EXTENSION) *TS_TST_INFO_get_exts(TS_TST_INFO *a);
-void TS_TST_INFO_ext_free(TS_TST_INFO *a);
-int TS_TST_INFO_get_ext_count(TS_TST_INFO *a);
-int TS_TST_INFO_get_ext_by_NID(TS_TST_INFO *a, int nid, int lastpos);
-int TS_TST_INFO_get_ext_by_OBJ(TS_TST_INFO *a, ASN1_OBJECT *obj, int lastpos);
-int TS_TST_INFO_get_ext_by_critical(TS_TST_INFO *a, int crit, int lastpos);
-X509_EXTENSION *TS_TST_INFO_get_ext(TS_TST_INFO *a, int loc);
-X509_EXTENSION *TS_TST_INFO_delete_ext(TS_TST_INFO *a, int loc);
-int TS_TST_INFO_add_ext(TS_TST_INFO *a, X509_EXTENSION *ex, int loc);
-void *TS_TST_INFO_get_ext_d2i(TS_TST_INFO *a, int nid, int *crit, int *idx);
-
-/*
- * Declarations related to response generation, defined in ts/ts_resp_sign.c.
- */
-
-/* Optional flags for response generation. */
-
-/* Don't include the TSA name in response. */
-# define TS_TSA_NAME 0x01
-
-/* Set ordering to true in response. */
-# define TS_ORDERING 0x02
-
-/*
- * Include the signer certificate and the other specified certificates in
- * the ESS signing certificate attribute beside the PKCS7 signed data.
- * Only the signer certificates is included by default.
- */
-# define TS_ESS_CERT_ID_CHAIN 0x04
-
-/* Forward declaration. */
-struct TS_resp_ctx;
-
-/* This must return a unique number less than 160 bits long. */
-typedef ASN1_INTEGER *(*TS_serial_cb) (struct TS_resp_ctx *, void *);
-
-/*
- * This must return the seconds and microseconds since Jan 1, 1970 in the sec
- * and usec variables allocated by the caller. Return non-zero for success
- * and zero for failure.
- */
-typedef int (*TS_time_cb) (struct TS_resp_ctx *, void *, long *sec,
- long *usec);
-
-/*
- * This must process the given extension. It can modify the TS_TST_INFO
- * object of the context. Return values: !0 (processed), 0 (error, it must
- * set the status info/failure info of the response).
- */
-typedef int (*TS_extension_cb) (struct TS_resp_ctx *, X509_EXTENSION *,
- void *);
-
-typedef struct TS_resp_ctx {
- X509 *signer_cert;
- EVP_PKEY *signer_key;
- STACK_OF(X509) *certs; /* Certs to include in signed data. */
- STACK_OF(ASN1_OBJECT) *policies; /* Acceptable policies. */
- ASN1_OBJECT *default_policy; /* It may appear in policies, too. */
- STACK_OF(EVP_MD) *mds; /* Acceptable message digests. */
- ASN1_INTEGER *seconds; /* accuracy, 0 means not specified. */
- ASN1_INTEGER *millis; /* accuracy, 0 means not specified. */
- ASN1_INTEGER *micros; /* accuracy, 0 means not specified. */
- unsigned clock_precision_digits; /* fraction of seconds in time stamp
- * token. */
- unsigned flags; /* Optional info, see values above. */
- /* Callback functions. */
- TS_serial_cb serial_cb;
- void *serial_cb_data; /* User data for serial_cb. */
- TS_time_cb time_cb;
- void *time_cb_data; /* User data for time_cb. */
- TS_extension_cb extension_cb;
- void *extension_cb_data; /* User data for extension_cb. */
- /* These members are used only while creating the response. */
- TS_REQ *request;
- TS_RESP *response;
- TS_TST_INFO *tst_info;
-} TS_RESP_CTX;
-
-DECLARE_STACK_OF(EVP_MD)
-DECLARE_ASN1_SET_OF(EVP_MD)
-
-/* Creates a response context that can be used for generating responses. */
-TS_RESP_CTX *TS_RESP_CTX_new(void);
-void TS_RESP_CTX_free(TS_RESP_CTX *ctx);
-
-/* This parameter must be set. */
-int TS_RESP_CTX_set_signer_cert(TS_RESP_CTX *ctx, X509 *signer);
-
-/* This parameter must be set. */
-int TS_RESP_CTX_set_signer_key(TS_RESP_CTX *ctx, EVP_PKEY *key);
-
-/* This parameter must be set. */
-int TS_RESP_CTX_set_def_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *def_policy);
-
-/* No additional certs are included in the response by default. */
-int TS_RESP_CTX_set_certs(TS_RESP_CTX *ctx, STACK_OF(X509) *certs);
-
-/*
- * Adds a new acceptable policy, only the default policy is accepted by
- * default.
- */
-int TS_RESP_CTX_add_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *policy);
-
-/*
- * Adds a new acceptable message digest. Note that no message digests are
- * accepted by default. The md argument is shared with the caller.
- */
-int TS_RESP_CTX_add_md(TS_RESP_CTX *ctx, const EVP_MD *md);
-
-/* Accuracy is not included by default. */
-int TS_RESP_CTX_set_accuracy(TS_RESP_CTX *ctx,
- int secs, int millis, int micros);
-
-/*
- * Clock precision digits, i.e. the number of decimal digits: '0' means sec,
- * '3' msec, '6' usec, and so on. Default is 0.
- */
-int TS_RESP_CTX_set_clock_precision_digits(TS_RESP_CTX *ctx,
- unsigned clock_precision_digits);
-/* At most we accept usec precision. */
-# define TS_MAX_CLOCK_PRECISION_DIGITS 6
-
-/* Maximum status message length */
-# define TS_MAX_STATUS_LENGTH (1024 * 1024)
-
-/* No flags are set by default. */
-void TS_RESP_CTX_add_flags(TS_RESP_CTX *ctx, int flags);
-
-/* Default callback always returns a constant. */
-void TS_RESP_CTX_set_serial_cb(TS_RESP_CTX *ctx, TS_serial_cb cb, void *data);
-
-/* Default callback uses the gettimeofday() and gmtime() system calls. */
-void TS_RESP_CTX_set_time_cb(TS_RESP_CTX *ctx, TS_time_cb cb, void *data);
-
-/*
- * Default callback rejects all extensions. The extension callback is called
- * when the TS_TST_INFO object is already set up and not signed yet.
- */
-/* FIXME: extension handling is not tested yet. */
-void TS_RESP_CTX_set_extension_cb(TS_RESP_CTX *ctx,
- TS_extension_cb cb, void *data);
-
-/* The following methods can be used in the callbacks. */
-int TS_RESP_CTX_set_status_info(TS_RESP_CTX *ctx,
- int status, const char *text);
-
-/* Sets the status info only if it is still TS_STATUS_GRANTED. */
-int TS_RESP_CTX_set_status_info_cond(TS_RESP_CTX *ctx,
- int status, const char *text);
-
-int TS_RESP_CTX_add_failure_info(TS_RESP_CTX *ctx, int failure);
-
-/* The get methods below can be used in the extension callback. */
-TS_REQ *TS_RESP_CTX_get_request(TS_RESP_CTX *ctx);
-
-TS_TST_INFO *TS_RESP_CTX_get_tst_info(TS_RESP_CTX *ctx);
-
-/*
- * Creates the signed TS_TST_INFO and puts it in TS_RESP.
- * In case of errors it sets the status info properly.
- * Returns NULL only in case of memory allocation/fatal error.
- */
-TS_RESP *TS_RESP_create_response(TS_RESP_CTX *ctx, BIO *req_bio);
-
-/*
- * Declarations related to response verification,
- * they are defined in ts/ts_resp_verify.c.
- */
-
-int TS_RESP_verify_signature(PKCS7 *token, STACK_OF(X509) *certs,
- X509_STORE *store, X509 **signer_out);
-
-/* Context structure for the generic verify method. */
-
-/* Verify the signer's certificate and the signature of the response. */
-# define TS_VFY_SIGNATURE (1u << 0)
-/* Verify the version number of the response. */
-# define TS_VFY_VERSION (1u << 1)
-/* Verify if the policy supplied by the user matches the policy of the TSA. */
-# define TS_VFY_POLICY (1u << 2)
-/*
- * Verify the message imprint provided by the user. This flag should not be
- * specified with TS_VFY_DATA.
- */
-# define TS_VFY_IMPRINT (1u << 3)
-/*
- * Verify the message imprint computed by the verify method from the user
- * provided data and the MD algorithm of the response. This flag should not
- * be specified with TS_VFY_IMPRINT.
- */
-# define TS_VFY_DATA (1u << 4)
-/* Verify the nonce value. */
-# define TS_VFY_NONCE (1u << 5)
-/* Verify if the TSA name field matches the signer certificate. */
-# define TS_VFY_SIGNER (1u << 6)
-/* Verify if the TSA name field equals to the user provided name. */
-# define TS_VFY_TSA_NAME (1u << 7)
-
-/* You can use the following convenience constants. */
-# define TS_VFY_ALL_IMPRINT (TS_VFY_SIGNATURE \
- | TS_VFY_VERSION \
- | TS_VFY_POLICY \
- | TS_VFY_IMPRINT \
- | TS_VFY_NONCE \
- | TS_VFY_SIGNER \
- | TS_VFY_TSA_NAME)
-# define TS_VFY_ALL_DATA (TS_VFY_SIGNATURE \
- | TS_VFY_VERSION \
- | TS_VFY_POLICY \
- | TS_VFY_DATA \
- | TS_VFY_NONCE \
- | TS_VFY_SIGNER \
- | TS_VFY_TSA_NAME)
-
-typedef struct TS_verify_ctx {
- /* Set this to the union of TS_VFY_... flags you want to carry out. */
- unsigned flags;
- /* Must be set only with TS_VFY_SIGNATURE. certs is optional. */
- X509_STORE *store;
- STACK_OF(X509) *certs;
- /* Must be set only with TS_VFY_POLICY. */
- ASN1_OBJECT *policy;
- /*
- * Must be set only with TS_VFY_IMPRINT. If md_alg is NULL, the
- * algorithm from the response is used.
- */
- X509_ALGOR *md_alg;
- unsigned char *imprint;
- unsigned imprint_len;
- /* Must be set only with TS_VFY_DATA. */
- BIO *data;
- /* Must be set only with TS_VFY_TSA_NAME. */
- ASN1_INTEGER *nonce;
- /* Must be set only with TS_VFY_TSA_NAME. */
- GENERAL_NAME *tsa_name;
-} TS_VERIFY_CTX;
-
-int TS_RESP_verify_response(TS_VERIFY_CTX *ctx, TS_RESP *response);
-int TS_RESP_verify_token(TS_VERIFY_CTX *ctx, PKCS7 *token);
-
-/*
- * Declarations related to response verification context,
- * they are defined in ts/ts_verify_ctx.c.
- */
-
-/* Set all fields to zero. */
-TS_VERIFY_CTX *TS_VERIFY_CTX_new(void);
-void TS_VERIFY_CTX_init(TS_VERIFY_CTX *ctx);
-void TS_VERIFY_CTX_free(TS_VERIFY_CTX *ctx);
-void TS_VERIFY_CTX_cleanup(TS_VERIFY_CTX *ctx);
-
-/*-
- * If ctx is NULL, it allocates and returns a new object, otherwise
- * it returns ctx. It initialises all the members as follows:
- * flags = TS_VFY_ALL_IMPRINT & ~(TS_VFY_TSA_NAME | TS_VFY_SIGNATURE)
- * certs = NULL
- * store = NULL
- * policy = policy from the request or NULL if absent (in this case
- * TS_VFY_POLICY is cleared from flags as well)
- * md_alg = MD algorithm from request
- * imprint, imprint_len = imprint from request
- * data = NULL
- * nonce, nonce_len = nonce from the request or NULL if absent (in this case
- * TS_VFY_NONCE is cleared from flags as well)
- * tsa_name = NULL
- * Important: after calling this method TS_VFY_SIGNATURE should be added!
- */
-TS_VERIFY_CTX *TS_REQ_to_TS_VERIFY_CTX(TS_REQ *req, TS_VERIFY_CTX *ctx);
-
-/* Function declarations for TS_RESP defined in ts/ts_resp_print.c */
-
-int TS_RESP_print_bio(BIO *bio, TS_RESP *a);
-int TS_STATUS_INFO_print_bio(BIO *bio, TS_STATUS_INFO *a);
-int TS_TST_INFO_print_bio(BIO *bio, TS_TST_INFO *a);
-
-/* Common utility functions defined in ts/ts_lib.c */
-
-int TS_ASN1_INTEGER_print_bio(BIO *bio, const ASN1_INTEGER *num);
-int TS_OBJ_print_bio(BIO *bio, const ASN1_OBJECT *obj);
-int TS_ext_print_bio(BIO *bio, const STACK_OF(X509_EXTENSION) *extensions);
-int TS_X509_ALGOR_print_bio(BIO *bio, const X509_ALGOR *alg);
-int TS_MSG_IMPRINT_print_bio(BIO *bio, TS_MSG_IMPRINT *msg);
-
-/*
- * Function declarations for handling configuration options, defined in
- * ts/ts_conf.c
- */
-
-X509 *TS_CONF_load_cert(const char *file);
-STACK_OF(X509) *TS_CONF_load_certs(const char *file);
-EVP_PKEY *TS_CONF_load_key(const char *file, const char *pass);
-const char *TS_CONF_get_tsa_section(CONF *conf, const char *section);
-int TS_CONF_set_serial(CONF *conf, const char *section, TS_serial_cb cb,
- TS_RESP_CTX *ctx);
-int TS_CONF_set_crypto_device(CONF *conf, const char *section,
- const char *device);
-int TS_CONF_set_default_engine(const char *name);
-int TS_CONF_set_signer_cert(CONF *conf, const char *section,
- const char *cert, TS_RESP_CTX *ctx);
-int TS_CONF_set_certs(CONF *conf, const char *section, const char *certs,
- TS_RESP_CTX *ctx);
-int TS_CONF_set_signer_key(CONF *conf, const char *section,
- const char *key, const char *pass,
- TS_RESP_CTX *ctx);
-int TS_CONF_set_def_policy(CONF *conf, const char *section,
- const char *policy, TS_RESP_CTX *ctx);
-int TS_CONF_set_policies(CONF *conf, const char *section, TS_RESP_CTX *ctx);
-int TS_CONF_set_digests(CONF *conf, const char *section, TS_RESP_CTX *ctx);
-int TS_CONF_set_accuracy(CONF *conf, const char *section, TS_RESP_CTX *ctx);
-int TS_CONF_set_clock_precision_digits(CONF *conf, const char *section,
- TS_RESP_CTX *ctx);
-int TS_CONF_set_ordering(CONF *conf, const char *section, TS_RESP_CTX *ctx);
-int TS_CONF_set_tsa_name(CONF *conf, const char *section, TS_RESP_CTX *ctx);
-int TS_CONF_set_ess_cert_id_chain(CONF *conf, const char *section,
- TS_RESP_CTX *ctx);
-
-/* -------------------------------------------------- */
-/* BEGIN ERROR CODES */
-/*
- * The following lines are auto generated by the script mkerr.pl. Any changes
- * made after this point may be overwritten when the script is next run.
- */
-void ERR_load_TS_strings(void);
-
-/* Error codes for the TS functions. */
-
-/* Function codes. */
-# define TS_F_D2I_TS_RESP 147
-# define TS_F_DEF_SERIAL_CB 110
-# define TS_F_DEF_TIME_CB 111
-# define TS_F_ESS_ADD_SIGNING_CERT 112
-# define TS_F_ESS_CERT_ID_NEW_INIT 113
-# define TS_F_ESS_SIGNING_CERT_NEW_INIT 114
-# define TS_F_INT_TS_RESP_VERIFY_TOKEN 149
-# define TS_F_PKCS7_TO_TS_TST_INFO 148
-# define TS_F_TS_ACCURACY_SET_MICROS 115
-# define TS_F_TS_ACCURACY_SET_MILLIS 116
-# define TS_F_TS_ACCURACY_SET_SECONDS 117
-# define TS_F_TS_CHECK_IMPRINTS 100
-# define TS_F_TS_CHECK_NONCES 101
-# define TS_F_TS_CHECK_POLICY 102
-# define TS_F_TS_CHECK_SIGNING_CERTS 103
-# define TS_F_TS_CHECK_STATUS_INFO 104
-# define TS_F_TS_COMPUTE_IMPRINT 145
-# define TS_F_TS_CONF_SET_DEFAULT_ENGINE 146
-# define TS_F_TS_GET_STATUS_TEXT 105
-# define TS_F_TS_MSG_IMPRINT_SET_ALGO 118
-# define TS_F_TS_REQ_SET_MSG_IMPRINT 119
-# define TS_F_TS_REQ_SET_NONCE 120
-# define TS_F_TS_REQ_SET_POLICY_ID 121
-# define TS_F_TS_RESP_CREATE_RESPONSE 122
-# define TS_F_TS_RESP_CREATE_TST_INFO 123
-# define TS_F_TS_RESP_CTX_ADD_FAILURE_INFO 124
-# define TS_F_TS_RESP_CTX_ADD_MD 125
-# define TS_F_TS_RESP_CTX_ADD_POLICY 126
-# define TS_F_TS_RESP_CTX_NEW 127
-# define TS_F_TS_RESP_CTX_SET_ACCURACY 128
-# define TS_F_TS_RESP_CTX_SET_CERTS 129
-# define TS_F_TS_RESP_CTX_SET_DEF_POLICY 130
-# define TS_F_TS_RESP_CTX_SET_SIGNER_CERT 131
-# define TS_F_TS_RESP_CTX_SET_STATUS_INFO 132
-# define TS_F_TS_RESP_GET_POLICY 133
-# define TS_F_TS_RESP_SET_GENTIME_WITH_PRECISION 134
-# define TS_F_TS_RESP_SET_STATUS_INFO 135
-# define TS_F_TS_RESP_SET_TST_INFO 150
-# define TS_F_TS_RESP_SIGN 136
-# define TS_F_TS_RESP_VERIFY_SIGNATURE 106
-# define TS_F_TS_RESP_VERIFY_TOKEN 107
-# define TS_F_TS_TST_INFO_SET_ACCURACY 137
-# define TS_F_TS_TST_INFO_SET_MSG_IMPRINT 138
-# define TS_F_TS_TST_INFO_SET_NONCE 139
-# define TS_F_TS_TST_INFO_SET_POLICY_ID 140
-# define TS_F_TS_TST_INFO_SET_SERIAL 141
-# define TS_F_TS_TST_INFO_SET_TIME 142
-# define TS_F_TS_TST_INFO_SET_TSA 143
-# define TS_F_TS_VERIFY 108
-# define TS_F_TS_VERIFY_CERT 109
-# define TS_F_TS_VERIFY_CTX_NEW 144
-
-/* Reason codes. */
-# define TS_R_BAD_PKCS7_TYPE 132
-# define TS_R_BAD_TYPE 133
-# define TS_R_CERTIFICATE_VERIFY_ERROR 100
-# define TS_R_COULD_NOT_SET_ENGINE 127
-# define TS_R_COULD_NOT_SET_TIME 115
-# define TS_R_D2I_TS_RESP_INT_FAILED 128
-# define TS_R_DETACHED_CONTENT 134
-# define TS_R_ESS_ADD_SIGNING_CERT_ERROR 116
-# define TS_R_ESS_SIGNING_CERTIFICATE_ERROR 101
-# define TS_R_INVALID_NULL_POINTER 102
-# define TS_R_INVALID_SIGNER_CERTIFICATE_PURPOSE 117
-# define TS_R_MESSAGE_IMPRINT_MISMATCH 103
-# define TS_R_NONCE_MISMATCH 104
-# define TS_R_NONCE_NOT_RETURNED 105
-# define TS_R_NO_CONTENT 106
-# define TS_R_NO_TIME_STAMP_TOKEN 107
-# define TS_R_PKCS7_ADD_SIGNATURE_ERROR 118
-# define TS_R_PKCS7_ADD_SIGNED_ATTR_ERROR 119
-# define TS_R_PKCS7_TO_TS_TST_INFO_FAILED 129
-# define TS_R_POLICY_MISMATCH 108
-# define TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE 120
-# define TS_R_RESPONSE_SETUP_ERROR 121
-# define TS_R_SIGNATURE_FAILURE 109
-# define TS_R_THERE_MUST_BE_ONE_SIGNER 110
-# define TS_R_TIME_SYSCALL_ERROR 122
-# define TS_R_TOKEN_NOT_PRESENT 130
-# define TS_R_TOKEN_PRESENT 131
-# define TS_R_TSA_NAME_MISMATCH 111
-# define TS_R_TSA_UNTRUSTED 112
-# define TS_R_TST_INFO_SETUP_ERROR 123
-# define TS_R_TS_DATASIGN 124
-# define TS_R_UNACCEPTABLE_POLICY 125
-# define TS_R_UNSUPPORTED_MD_ALGORITHM 126
-# define TS_R_UNSUPPORTED_VERSION 113
-# define TS_R_WRONG_CONTENT_TYPE 114
-
-#ifdef __cplusplus
-}
-#endif
-#endif
diff --git a/crypto/ts/ts_asn1.c b/crypto/ts/ts_asn1.c
index 657dc4ca4d9d..8707207082c9 100644
--- a/crypto/ts/ts_asn1.c
+++ b/crypto/ts/ts_asn1.c
@@ -1,73 +1,24 @@
-/* crypto/ts/ts_asn1.c */
/*
- * Written by Nils Larsch for the OpenSSL project 2004.
- */
-/* ====================================================================
- * Copyright (c) 2006 The OpenSSL Project. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in
- * the documentation and/or other materials provided with the
- * distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- * software must display the following acknowledgment:
- * "This product includes software developed by the OpenSSL Project
- * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- * endorse or promote products derived from this software without
- * prior written permission. For written permission, please contact
- * licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- * nor may "OpenSSL" appear in their names without prior written
- * permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- * acknowledgment:
- * "This product includes software developed by the OpenSSL Project
- * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com). This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
+ * Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
*
+ * Licensed under the OpenSSL license (the "License"). You may not use
+ * this file except in compliance with the License. You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
*/
#include <openssl/ts.h>
#include <openssl/err.h>
#include <openssl/asn1t.h>
+#include "ts_lcl.h"
ASN1_SEQUENCE(TS_MSG_IMPRINT) = {
ASN1_SIMPLE(TS_MSG_IMPRINT, hash_algo, X509_ALGOR),
ASN1_SIMPLE(TS_MSG_IMPRINT, hashed_msg, ASN1_OCTET_STRING)
-} ASN1_SEQUENCE_END(TS_MSG_IMPRINT)
+} static_ASN1_SEQUENCE_END(TS_MSG_IMPRINT)
IMPLEMENT_ASN1_FUNCTIONS_const(TS_MSG_IMPRINT)
IMPLEMENT_ASN1_DUP_FUNCTION(TS_MSG_IMPRINT)
-#ifndef OPENSSL_NO_BIO
TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_bio(BIO *bp, TS_MSG_IMPRINT **a)
{
return ASN1_d2i_bio_of(TS_MSG_IMPRINT, TS_MSG_IMPRINT_new,
@@ -78,8 +29,7 @@ int i2d_TS_MSG_IMPRINT_bio(BIO *bp, TS_MSG_IMPRINT *a)
{
return ASN1_i2d_bio_of_const(TS_MSG_IMPRINT, i2d_TS_MSG_IMPRINT, bp, a);
}
-#endif
-#ifndef OPENSSL_NO_FP_API
+#ifndef OPENSSL_NO_STDIO
TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT **a)
{
return ASN1_d2i_fp_of(TS_MSG_IMPRINT, TS_MSG_IMPRINT_new,
@@ -99,11 +49,10 @@ ASN1_SEQUENCE(TS_REQ) = {
ASN1_OPT(TS_REQ, nonce, ASN1_INTEGER),
ASN1_OPT(TS_REQ, cert_req, ASN1_FBOOLEAN),
ASN1_IMP_SEQUENCE_OF_OPT(TS_REQ, extensions, X509_EXTENSION, 0)
-} ASN1_SEQUENCE_END(TS_REQ)
+} static_ASN1_SEQUENCE_END(TS_REQ)
IMPLEMENT_ASN1_FUNCTIONS_const(TS_REQ)
IMPLEMENT_ASN1_DUP_FUNCTION(TS_REQ)
-#ifndef OPENSSL_NO_BIO
TS_REQ *d2i_TS_REQ_bio(BIO *bp, TS_REQ **a)
{
return ASN1_d2i_bio_of(TS_REQ, TS_REQ_new, d2i_TS_REQ, bp, a);
@@ -113,8 +62,7 @@ int i2d_TS_REQ_bio(BIO *bp, TS_REQ *a)
{
return ASN1_i2d_bio_of_const(TS_REQ, i2d_TS_REQ, bp, a);
}
-#endif
-#ifndef OPENSSL_NO_FP_API
+#ifndef OPENSSL_NO_STDIO
TS_REQ *d2i_TS_REQ_fp(FILE *fp, TS_REQ **a)
{
return ASN1_d2i_fp_of(TS_REQ, TS_REQ_new, d2i_TS_REQ, fp, a);
@@ -130,7 +78,7 @@ ASN1_SEQUENCE(TS_ACCURACY) = {
ASN1_OPT(TS_ACCURACY, seconds, ASN1_INTEGER),
ASN1_IMP_OPT(TS_ACCURACY, millis, ASN1_INTEGER, 0),
ASN1_IMP_OPT(TS_ACCURACY, micros, ASN1_INTEGER, 1)
-} ASN1_SEQUENCE_END(TS_ACCURACY)
+} static_ASN1_SEQUENCE_END(TS_ACCURACY)
IMPLEMENT_ASN1_FUNCTIONS_const(TS_ACCURACY)
IMPLEMENT_ASN1_DUP_FUNCTION(TS_ACCURACY)
@@ -146,11 +94,10 @@ ASN1_SEQUENCE(TS_TST_INFO) = {
ASN1_OPT(TS_TST_INFO, nonce, ASN1_INTEGER),
ASN1_EXP_OPT(TS_TST_INFO, tsa, GENERAL_NAME, 0),
ASN1_IMP_SEQUENCE_OF_OPT(TS_TST_INFO, extensions, X509_EXTENSION, 1)
-} ASN1_SEQUENCE_END(TS_TST_INFO)
+} static_ASN1_SEQUENCE_END(TS_TST_INFO)
IMPLEMENT_ASN1_FUNCTIONS_const(TS_TST_INFO)
IMPLEMENT_ASN1_DUP_FUNCTION(TS_TST_INFO)
-#ifndef OPENSSL_NO_BIO
TS_TST_INFO *d2i_TS_TST_INFO_bio(BIO *bp, TS_TST_INFO **a)
{
return ASN1_d2i_bio_of(TS_TST_INFO, TS_TST_INFO_new, d2i_TS_TST_INFO, bp,
@@ -161,8 +108,7 @@ int i2d_TS_TST_INFO_bio(BIO *bp, TS_TST_INFO *a)
{
return ASN1_i2d_bio_of_const(TS_TST_INFO, i2d_TS_TST_INFO, bp, a);
}
-#endif
-#ifndef OPENSSL_NO_FP_API
+#ifndef OPENSSL_NO_STDIO
TS_TST_INFO *d2i_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO **a)
{
return ASN1_d2i_fp_of(TS_TST_INFO, TS_TST_INFO_new, d2i_TS_TST_INFO, fp,
@@ -179,7 +125,7 @@ ASN1_SEQUENCE(TS_STATUS_INFO) = {
ASN1_SIMPLE(TS_STATUS_INFO, status, ASN1_INTEGER),
ASN1_SEQUENCE_OF_OPT(TS_STATUS_INFO, text, ASN1_UTF8STRING),
ASN1_OPT(TS_STATUS_INFO, failure_info, ASN1_BIT_STRING)
-} ASN1_SEQUENCE_END(TS_STATUS_INFO)
+} static_ASN1_SEQUENCE_END(TS_STATUS_INFO)
IMPLEMENT_ASN1_FUNCTIONS_const(TS_STATUS_INFO)
IMPLEMENT_ASN1_DUP_FUNCTION(TS_STATUS_INFO)
@@ -195,8 +141,7 @@ static int ts_resp_set_tst_info(TS_RESP *a)
TSerr(TS_F_TS_RESP_SET_TST_INFO, TS_R_TOKEN_PRESENT);
return 0;
}
- if (a->tst_info != NULL)
- TS_TST_INFO_free(a->tst_info);
+ TS_TST_INFO_free(a->tst_info);
a->tst_info = PKCS7_to_TS_TST_INFO(a->token);
if (!a->tst_info) {
TSerr(TS_F_TS_RESP_SET_TST_INFO,
@@ -218,8 +163,7 @@ static int ts_resp_cb(int op, ASN1_VALUE **pval, const ASN1_ITEM *it,
if (op == ASN1_OP_NEW_POST) {
ts_resp->tst_info = NULL;
} else if (op == ASN1_OP_FREE_POST) {
- if (ts_resp->tst_info != NULL)
- TS_TST_INFO_free(ts_resp->tst_info);
+ TS_TST_INFO_free(ts_resp->tst_info);
} else if (op == ASN1_OP_D2I_POST) {
if (ts_resp_set_tst_info(ts_resp) == 0)
return 0;
@@ -230,13 +174,12 @@ static int ts_resp_cb(int op, ASN1_VALUE **pval, const ASN1_ITEM *it,
ASN1_SEQUENCE_cb(TS_RESP, ts_resp_cb) = {
ASN1_SIMPLE(TS_RESP, status_info, TS_STATUS_INFO),
ASN1_OPT(TS_RESP, token, PKCS7),
-} ASN1_SEQUENCE_END_cb(TS_RESP, TS_RESP)
+} static_ASN1_SEQUENCE_END_cb(TS_RESP, TS_RESP)
IMPLEMENT_ASN1_FUNCTIONS_const(TS_RESP)
IMPLEMENT_ASN1_DUP_FUNCTION(TS_RESP)
-#ifndef OPENSSL_NO_BIO
TS_RESP *d2i_TS_RESP_bio(BIO *bp, TS_RESP **a)
{
return ASN1_d2i_bio_of(TS_RESP, TS_RESP_new, d2i_TS_RESP, bp, a);
@@ -246,8 +189,7 @@ int i2d_TS_RESP_bio(BIO *bp, TS_RESP *a)
{
return ASN1_i2d_bio_of_const(TS_RESP, i2d_TS_RESP, bp, a);
}
-#endif
-#ifndef OPENSSL_NO_FP_API
+#ifndef OPENSSL_NO_STDIO
TS_RESP *d2i_TS_RESP_fp(FILE *fp, TS_RESP **a)
{
return ASN1_d2i_fp_of(TS_RESP, TS_RESP_new, d2i_TS_RESP, fp, a);
@@ -262,7 +204,7 @@ int i2d_TS_RESP_fp(FILE *fp, TS_RESP *a)
ASN1_SEQUENCE(ESS_ISSUER_SERIAL) = {
ASN1_SEQUENCE_OF(ESS_ISSUER_SERIAL, issuer, GENERAL_NAME),
ASN1_SIMPLE(ESS_ISSUER_SERIAL, serial, ASN1_INTEGER)
-} ASN1_SEQUENCE_END(ESS_ISSUER_SERIAL)
+} static_ASN1_SEQUENCE_END(ESS_ISSUER_SERIAL)
IMPLEMENT_ASN1_FUNCTIONS_const(ESS_ISSUER_SERIAL)
IMPLEMENT_ASN1_DUP_FUNCTION(ESS_ISSUER_SERIAL)
@@ -270,7 +212,7 @@ IMPLEMENT_ASN1_DUP_FUNCTION(ESS_ISSUER_SERIAL)
ASN1_SEQUENCE(ESS_CERT_ID) = {
ASN1_SIMPLE(ESS_CERT_ID, hash, ASN1_OCTET_STRING),
ASN1_OPT(ESS_CERT_ID, issuer_serial, ESS_ISSUER_SERIAL)
-} ASN1_SEQUENCE_END(ESS_CERT_ID)
+} static_ASN1_SEQUENCE_END(ESS_CERT_ID)
IMPLEMENT_ASN1_FUNCTIONS_const(ESS_CERT_ID)
IMPLEMENT_ASN1_DUP_FUNCTION(ESS_CERT_ID)
@@ -278,11 +220,28 @@ IMPLEMENT_ASN1_DUP_FUNCTION(ESS_CERT_ID)
ASN1_SEQUENCE(ESS_SIGNING_CERT) = {
ASN1_SEQUENCE_OF(ESS_SIGNING_CERT, cert_ids, ESS_CERT_ID),
ASN1_SEQUENCE_OF_OPT(ESS_SIGNING_CERT, policy_info, POLICYINFO)
-} ASN1_SEQUENCE_END(ESS_SIGNING_CERT)
+} static_ASN1_SEQUENCE_END(ESS_SIGNING_CERT)
IMPLEMENT_ASN1_FUNCTIONS_const(ESS_SIGNING_CERT)
IMPLEMENT_ASN1_DUP_FUNCTION(ESS_SIGNING_CERT)
+ASN1_SEQUENCE(ESS_CERT_ID_V2) = {
+ ASN1_OPT(ESS_CERT_ID_V2, hash_alg, X509_ALGOR),
+ ASN1_SIMPLE(ESS_CERT_ID_V2, hash, ASN1_OCTET_STRING),
+ ASN1_OPT(ESS_CERT_ID_V2, issuer_serial, ESS_ISSUER_SERIAL)
+} static_ASN1_SEQUENCE_END(ESS_CERT_ID_V2)
+
+IMPLEMENT_ASN1_FUNCTIONS_const(ESS_CERT_ID_V2)
+IMPLEMENT_ASN1_DUP_FUNCTION(ESS_CERT_ID_V2)
+
+ASN1_SEQUENCE(ESS_SIGNING_CERT_V2) = {
+ ASN1_SEQUENCE_OF(ESS_SIGNING_CERT_V2, cert_ids, ESS_CERT_ID_V2),
+ ASN1_SEQUENCE_OF_OPT(ESS_SIGNING_CERT_V2, policy_info, POLICYINFO)
+} static_ASN1_SEQUENCE_END(ESS_SIGNING_CERT_V2)
+
+IMPLEMENT_ASN1_FUNCTIONS_const(ESS_SIGNING_CERT_V2)
+IMPLEMENT_ASN1_DUP_FUNCTION(ESS_SIGNING_CERT_V2)
+
/* Getting encapsulated TS_TST_INFO object from PKCS7. */
TS_TST_INFO *PKCS7_to_TS_TST_INFO(PKCS7 *token)
{
@@ -296,31 +255,22 @@ TS_TST_INFO *PKCS7_to_TS_TST_INFO(PKCS7 *token)
TSerr(TS_F_PKCS7_TO_TS_TST_INFO, TS_R_BAD_PKCS7_TYPE);
return NULL;
}
-
- /* Content must be present. */
if (PKCS7_get_detached(token)) {
TSerr(TS_F_PKCS7_TO_TS_TST_INFO, TS_R_DETACHED_CONTENT);
return NULL;
}
-
- /* We have a signed data with content. */
pkcs7_signed = token->d.sign;
enveloped = pkcs7_signed->contents;
if (OBJ_obj2nid(enveloped->type) != NID_id_smime_ct_TSTInfo) {
TSerr(TS_F_PKCS7_TO_TS_TST_INFO, TS_R_BAD_PKCS7_TYPE);
return NULL;
}
-
- /* We have a DER encoded TST_INFO as the signed data. */
tst_info_wrapper = enveloped->d.other;
if (tst_info_wrapper->type != V_ASN1_OCTET_STRING) {
TSerr(TS_F_PKCS7_TO_TS_TST_INFO, TS_R_BAD_TYPE);
return NULL;
}
-
- /* We have the correct ASN1_OCTET_STRING type. */
tst_info_der = tst_info_wrapper->value.octet_string;
- /* At last, decode the TST_INFO. */
p = tst_info_der->data;
return d2i_TS_TST_INFO(NULL, &p, tst_info_der->length);
}
diff --git a/crypto/ts/ts_conf.c b/crypto/ts/ts_conf.c
index 4716b2336d65..625089a59bf9 100644
--- a/crypto/ts/ts_conf.c
+++ b/crypto/ts/ts_conf.c
@@ -1,74 +1,21 @@
-/* crypto/ts/ts_conf.c */
/*
- * Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL project
- * 2002.
- */
-/* ====================================================================
- * Copyright (c) 2006 The OpenSSL Project. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in
- * the documentation and/or other materials provided with the
- * distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- * software must display the following acknowledgment:
- * "This product includes software developed by the OpenSSL Project
- * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- * endorse or promote products derived from this software without
- * prior written permission. For written permission, please contact
- * licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- * nor may "OpenSSL" appear in their names without prior written
- * permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- * acknowledgment:
- * "This product includes software developed by the OpenSSL Project
- * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com). This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
+ * Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
*
+ * Licensed under the OpenSSL license (the "License"). You may not use
+ * this file except in compliance with the License. You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
*/
#include <string.h>
#include <openssl/crypto.h>
-#include "cryptlib.h"
+#include "internal/cryptlib.h"
#include <openssl/pem.h>
-#ifndef OPENSSL_NO_ENGINE
-# include <openssl/engine.h>
-#endif
+#include <openssl/engine.h>
#include <openssl/ts.h>
/* Macro definitions for the configuration file. */
-
#define BASE_SECTION "tsa"
#define ENV_DEFAULT_TSA "default_tsa"
#define ENV_SERIAL "serial"
@@ -76,6 +23,7 @@
#define ENV_SIGNER_CERT "signer_cert"
#define ENV_CERTS "certs"
#define ENV_SIGNER_KEY "signer_key"
+#define ENV_SIGNER_DIGEST "signer_digest"
#define ENV_DEFAULT_POLICY "default_policy"
#define ENV_OTHER_POLICIES "other_policies"
#define ENV_DIGESTS "digests"
@@ -89,6 +37,7 @@
#define ENV_CLOCK_PRECISION_DIGITS "clock_precision_digits"
#define ENV_VALUE_YES "yes"
#define ENV_VALUE_NO "no"
+#define ENV_ESS_CERT_ID_ALG "ess_cert_id_alg"
/* Function definitions for certificate and key loading. */
@@ -102,7 +51,7 @@ X509 *TS_CONF_load_cert(const char *file)
x = PEM_read_bio_X509_AUX(cert, NULL, NULL, NULL);
end:
if (x == NULL)
- fprintf(stderr, "unable to load certificate: %s\n", file);
+ TSerr(TS_F_TS_CONF_LOAD_CERT, TS_R_CANNOT_LOAD_CERT);
BIO_free(cert);
return x;
}
@@ -114,11 +63,11 @@ STACK_OF(X509) *TS_CONF_load_certs(const char *file)
STACK_OF(X509_INFO) *allcerts = NULL;
int i;
- if (!(certs = BIO_new_file(file, "r")))
+ if ((certs = BIO_new_file(file, "r")) == NULL)
goto end;
-
- if (!(othercerts = sk_X509_new_null()))
+ if ((othercerts = sk_X509_new_null()) == NULL)
goto end;
+
allcerts = PEM_X509_INFO_read_bio(certs, NULL, NULL, NULL);
for (i = 0; i < sk_X509_INFO_num(allcerts); i++) {
X509_INFO *xi = sk_X509_INFO_value(allcerts, i);
@@ -129,7 +78,7 @@ STACK_OF(X509) *TS_CONF_load_certs(const char *file)
}
end:
if (othercerts == NULL)
- fprintf(stderr, "unable to load certificates: %s\n", file);
+ TSerr(TS_F_TS_CONF_LOAD_CERTS, TS_R_CANNOT_LOAD_CERT);
sk_X509_INFO_pop_free(allcerts, X509_INFO_free);
BIO_free(certs);
return othercerts;
@@ -140,26 +89,28 @@ EVP_PKEY *TS_CONF_load_key(const char *file, const char *pass)
BIO *key = NULL;
EVP_PKEY *pkey = NULL;
- if (!(key = BIO_new_file(file, "r")))
+ if ((key = BIO_new_file(file, "r")) == NULL)
goto end;
pkey = PEM_read_bio_PrivateKey(key, NULL, NULL, (char *)pass);
end:
if (pkey == NULL)
- fprintf(stderr, "unable to load private key: %s\n", file);
+ TSerr(TS_F_TS_CONF_LOAD_KEY, TS_R_CANNOT_LOAD_KEY);
BIO_free(key);
return pkey;
}
/* Function definitions for handling configuration options. */
-static void TS_CONF_lookup_fail(const char *name, const char *tag)
+static void ts_CONF_lookup_fail(const char *name, const char *tag)
{
- fprintf(stderr, "variable lookup failed for %s::%s\n", name, tag);
+ TSerr(TS_F_TS_CONF_LOOKUP_FAIL, TS_R_VAR_LOOKUP_FAILURE);
+ ERR_add_error_data(3, name, "::", tag);
}
-static void TS_CONF_invalid(const char *name, const char *tag)
+static void ts_CONF_invalid(const char *name, const char *tag)
{
- fprintf(stderr, "invalid variable value for %s::%s\n", name, tag);
+ TSerr(TS_F_TS_CONF_INVALID, TS_R_VAR_BAD_VALUE);
+ ERR_add_error_data(3, name, "::", tag);
}
const char *TS_CONF_get_tsa_section(CONF *conf, const char *section)
@@ -167,7 +118,7 @@ const char *TS_CONF_get_tsa_section(CONF *conf, const char *section)
if (!section) {
section = NCONF_get_string(conf, BASE_SECTION, ENV_DEFAULT_TSA);
if (!section)
- TS_CONF_lookup_fail(BASE_SECTION, ENV_DEFAULT_TSA);
+ ts_CONF_lookup_fail(BASE_SECTION, ENV_DEFAULT_TSA);
}
return section;
}
@@ -178,7 +129,7 @@ int TS_CONF_set_serial(CONF *conf, const char *section, TS_serial_cb cb,
int ret = 0;
char *serial = NCONF_get_string(conf, section, ENV_SERIAL);
if (!serial) {
- TS_CONF_lookup_fail(section, ENV_SERIAL);
+ ts_CONF_lookup_fail(section, ENV_SERIAL);
goto err;
}
TS_RESP_CTX_set_serial_cb(ctx, cb, serial);
@@ -195,11 +146,11 @@ int TS_CONF_set_crypto_device(CONF *conf, const char *section,
{
int ret = 0;
- if (!device)
+ if (device == NULL)
device = NCONF_get_string(conf, section, ENV_CRYPTO_DEVICE);
if (device && !TS_CONF_set_default_engine(device)) {
- TS_CONF_invalid(section, ENV_CRYPTO_DEVICE);
+ ts_CONF_invalid(section, ENV_CRYPTO_DEVICE);
goto err;
}
ret = 1;
@@ -212,26 +163,23 @@ int TS_CONF_set_default_engine(const char *name)
ENGINE *e = NULL;
int ret = 0;
- /* Leave the default if builtin specified. */
if (strcmp(name, "builtin") == 0)
return 1;
- if (!(e = ENGINE_by_id(name)))
+ if ((e = ENGINE_by_id(name)) == NULL)
goto err;
- /* Enable the use of the NCipher HSM for forked children. */
if (strcmp(name, "chil") == 0)
ENGINE_ctrl(e, ENGINE_CTRL_CHIL_SET_FORKCHECK, 1, 0, 0);
- /* All the operations are going to be carried out by the engine. */
if (!ENGINE_set_default(e, ENGINE_METHOD_ALL))
goto err;
ret = 1;
+
err:
if (!ret) {
TSerr(TS_F_TS_CONF_SET_DEFAULT_ENGINE, TS_R_COULD_NOT_SET_ENGINE);
ERR_add_error_data(2, "engine:", name);
}
- if (e)
- ENGINE_free(e);
+ ENGINE_free(e);
return ret;
}
@@ -242,13 +190,15 @@ int TS_CONF_set_signer_cert(CONF *conf, const char *section,
{
int ret = 0;
X509 *cert_obj = NULL;
- if (!cert)
+
+ if (cert == NULL) {
cert = NCONF_get_string(conf, section, ENV_SIGNER_CERT);
- if (!cert) {
- TS_CONF_lookup_fail(section, ENV_SIGNER_CERT);
- goto err;
+ if (cert == NULL) {
+ ts_CONF_lookup_fail(section, ENV_SIGNER_CERT);
+ goto err;
+ }
}
- if (!(cert_obj = TS_CONF_load_cert(cert)))
+ if ((cert_obj = TS_CONF_load_cert(cert)) == NULL)
goto err;
if (!TS_RESP_CTX_set_signer_cert(ctx, cert_obj))
goto err;
@@ -264,12 +214,13 @@ int TS_CONF_set_certs(CONF *conf, const char *section, const char *certs,
{
int ret = 0;
STACK_OF(X509) *certs_obj = NULL;
- if (!certs)
- certs = NCONF_get_string(conf, section, ENV_CERTS);
- /* Certificate chain is optional. */
- if (!certs)
- goto end;
- if (!(certs_obj = TS_CONF_load_certs(certs)))
+
+ if (certs == NULL) {
+ /* Certificate chain is optional. */
+ if ((certs = NCONF_get_string(conf, section, ENV_CERTS)) == NULL)
+ goto end;
+ }
+ if ((certs_obj = TS_CONF_load_certs(certs)) == NULL)
goto err;
if (!TS_RESP_CTX_set_certs(ctx, certs_obj))
goto err;
@@ -289,10 +240,10 @@ int TS_CONF_set_signer_key(CONF *conf, const char *section,
if (!key)
key = NCONF_get_string(conf, section, ENV_SIGNER_KEY);
if (!key) {
- TS_CONF_lookup_fail(section, ENV_SIGNER_KEY);
+ ts_CONF_lookup_fail(section, ENV_SIGNER_KEY);
goto err;
}
- if (!(key_obj = TS_CONF_load_key(key, pass)))
+ if ((key_obj = TS_CONF_load_key(key, pass)) == NULL)
goto err;
if (!TS_RESP_CTX_set_signer_key(ctx, key_obj))
goto err;
@@ -303,6 +254,30 @@ int TS_CONF_set_signer_key(CONF *conf, const char *section,
return ret;
}
+int TS_CONF_set_signer_digest(CONF *conf, const char *section,
+ const char *md, TS_RESP_CTX *ctx)
+{
+ int ret = 0;
+ const EVP_MD *sign_md = NULL;
+ if (md == NULL)
+ md = NCONF_get_string(conf, section, ENV_SIGNER_DIGEST);
+ if (md == NULL) {
+ ts_CONF_lookup_fail(section, ENV_SIGNER_DIGEST);
+ goto err;
+ }
+ sign_md = EVP_get_digestbyname(md);
+ if (sign_md == NULL) {
+ ts_CONF_invalid(section, ENV_SIGNER_DIGEST);
+ goto err;
+ }
+ if (!TS_RESP_CTX_set_signer_digest(ctx, sign_md))
+ goto err;
+
+ ret = 1;
+ err:
+ return ret;
+}
+
int TS_CONF_set_def_policy(CONF *conf, const char *section,
const char *policy, TS_RESP_CTX *ctx)
{
@@ -311,11 +286,11 @@ int TS_CONF_set_def_policy(CONF *conf, const char *section,
if (!policy)
policy = NCONF_get_string(conf, section, ENV_DEFAULT_POLICY);
if (!policy) {
- TS_CONF_lookup_fail(section, ENV_DEFAULT_POLICY);
+ ts_CONF_lookup_fail(section, ENV_DEFAULT_POLICY);
goto err;
}
- if (!(policy_obj = OBJ_txt2obj(policy, 0))) {
- TS_CONF_invalid(section, ENV_DEFAULT_POLICY);
+ if ((policy_obj = OBJ_txt2obj(policy, 0)) == NULL) {
+ ts_CONF_invalid(section, ENV_DEFAULT_POLICY);
goto err;
}
if (!TS_RESP_CTX_set_def_policy(ctx, policy_obj))
@@ -332,19 +307,20 @@ int TS_CONF_set_policies(CONF *conf, const char *section, TS_RESP_CTX *ctx)
int ret = 0;
int i;
STACK_OF(CONF_VALUE) *list = NULL;
- char *policies = NCONF_get_string(conf, section,
- ENV_OTHER_POLICIES);
+ char *policies = NCONF_get_string(conf, section, ENV_OTHER_POLICIES);
+
/* If no other policy is specified, that's fine. */
- if (policies && !(list = X509V3_parse_list(policies))) {
- TS_CONF_invalid(section, ENV_OTHER_POLICIES);
+ if (policies && (list = X509V3_parse_list(policies)) == NULL) {
+ ts_CONF_invalid(section, ENV_OTHER_POLICIES);
goto err;
}
for (i = 0; i < sk_CONF_VALUE_num(list); ++i) {
CONF_VALUE *val = sk_CONF_VALUE_value(list, i);
const char *extval = val->value ? val->value : val->name;
ASN1_OBJECT *objtmp;
- if (!(objtmp = OBJ_txt2obj(extval, 0))) {
- TS_CONF_invalid(section, ENV_OTHER_POLICIES);
+
+ if ((objtmp = OBJ_txt2obj(extval, 0)) == NULL) {
+ ts_CONF_invalid(section, ENV_OTHER_POLICIES);
goto err;
}
if (!TS_RESP_CTX_add_policy(ctx, objtmp))
@@ -364,24 +340,26 @@ int TS_CONF_set_digests(CONF *conf, const char *section, TS_RESP_CTX *ctx)
int i;
STACK_OF(CONF_VALUE) *list = NULL;
char *digests = NCONF_get_string(conf, section, ENV_DIGESTS);
- if (!digests) {
- TS_CONF_lookup_fail(section, ENV_DIGESTS);
+
+ if (digests == NULL) {
+ ts_CONF_lookup_fail(section, ENV_DIGESTS);
goto err;
}
- if (!(list = X509V3_parse_list(digests))) {
- TS_CONF_invalid(section, ENV_DIGESTS);
+ if ((list = X509V3_parse_list(digests)) == NULL) {
+ ts_CONF_invalid(section, ENV_DIGESTS);
goto err;
}
if (sk_CONF_VALUE_num(list) == 0) {
- TS_CONF_invalid(section, ENV_DIGESTS);
+ ts_CONF_invalid(section, ENV_DIGESTS);
goto err;
}
for (i = 0; i < sk_CONF_VALUE_num(list); ++i) {
CONF_VALUE *val = sk_CONF_VALUE_value(list, i);
const char *extval = val->value ? val->value : val->name;
const EVP_MD *md;
- if (!(md = EVP_get_digestbyname(extval))) {
- TS_CONF_invalid(section, ENV_DIGESTS);
+
+ if ((md = EVP_get_digestbyname(extval)) == NULL) {
+ ts_CONF_invalid(section, ENV_DIGESTS);
goto err;
}
if (!TS_RESP_CTX_add_md(ctx, md))
@@ -402,8 +380,8 @@ int TS_CONF_set_accuracy(CONF *conf, const char *section, TS_RESP_CTX *ctx)
STACK_OF(CONF_VALUE) *list = NULL;
char *accuracy = NCONF_get_string(conf, section, ENV_ACCURACY);
- if (accuracy && !(list = X509V3_parse_list(accuracy))) {
- TS_CONF_invalid(section, ENV_ACCURACY);
+ if (accuracy && (list = X509V3_parse_list(accuracy)) == NULL) {
+ ts_CONF_invalid(section, ENV_ACCURACY);
goto err;
}
for (i = 0; i < sk_CONF_VALUE_num(list); ++i) {
@@ -418,7 +396,7 @@ int TS_CONF_set_accuracy(CONF *conf, const char *section, TS_RESP_CTX *ctx)
if (val->value)
micros = atoi(val->value);
} else {
- TS_CONF_invalid(section, ENV_ACCURACY);
+ ts_CONF_invalid(section, ENV_ACCURACY);
goto err;
}
}
@@ -444,7 +422,7 @@ int TS_CONF_set_clock_precision_digits(CONF *conf, const char *section,
&digits))
digits = 0;
if (digits < 0 || digits > TS_MAX_CLOCK_PRECISION_DIGITS) {
- TS_CONF_invalid(section, ENV_CLOCK_PRECISION_DIGITS);
+ ts_CONF_invalid(section, ENV_CLOCK_PRECISION_DIGITS);
goto err;
}
@@ -456,16 +434,16 @@ int TS_CONF_set_clock_precision_digits(CONF *conf, const char *section,
return ret;
}
-static int TS_CONF_add_flag(CONF *conf, const char *section,
+static int ts_CONF_add_flag(CONF *conf, const char *section,
const char *field, int flag, TS_RESP_CTX *ctx)
{
- /* Default is false. */
const char *value = NCONF_get_string(conf, section, field);
+
if (value) {
if (strcmp(value, ENV_VALUE_YES) == 0)
TS_RESP_CTX_add_flags(ctx, flag);
else if (strcmp(value, ENV_VALUE_NO) != 0) {
- TS_CONF_invalid(section, field);
+ ts_CONF_invalid(section, field);
return 0;
}
}
@@ -475,17 +453,41 @@ static int TS_CONF_add_flag(CONF *conf, const char *section,
int TS_CONF_set_ordering(CONF *conf, const char *section, TS_RESP_CTX *ctx)
{
- return TS_CONF_add_flag(conf, section, ENV_ORDERING, TS_ORDERING, ctx);
+ return ts_CONF_add_flag(conf, section, ENV_ORDERING, TS_ORDERING, ctx);
}
int TS_CONF_set_tsa_name(CONF *conf, const char *section, TS_RESP_CTX *ctx)
{
- return TS_CONF_add_flag(conf, section, ENV_TSA_NAME, TS_TSA_NAME, ctx);
+ return ts_CONF_add_flag(conf, section, ENV_TSA_NAME, TS_TSA_NAME, ctx);
}
int TS_CONF_set_ess_cert_id_chain(CONF *conf, const char *section,
TS_RESP_CTX *ctx)
{
- return TS_CONF_add_flag(conf, section, ENV_ESS_CERT_ID_CHAIN,
+ return ts_CONF_add_flag(conf, section, ENV_ESS_CERT_ID_CHAIN,
TS_ESS_CERT_ID_CHAIN, ctx);
}
+
+int TS_CONF_set_ess_cert_id_digest(CONF *conf, const char *section,
+ TS_RESP_CTX *ctx)
+{
+ int ret = 0;
+ const EVP_MD *cert_md = NULL;
+ const char *md = NCONF_get_string(conf, section, ENV_ESS_CERT_ID_ALG);
+
+ if (md == NULL)
+ md = "sha1";
+
+ cert_md = EVP_get_digestbyname(md);
+ if (cert_md == NULL) {
+ ts_CONF_invalid(section, ENV_ESS_CERT_ID_ALG);
+ goto err;
+ }
+
+ if (!TS_RESP_CTX_set_ess_cert_id_digest(ctx, cert_md))
+ goto err;
+
+ ret = 1;
+err:
+ return ret;
+}
diff --git a/crypto/ts/ts_err.c b/crypto/ts/ts_err.c
index ff1abf453381..1f3854d8491e 100644
--- a/crypto/ts/ts_err.c
+++ b/crypto/ts/ts_err.c
@@ -1,188 +1,184 @@
-/* crypto/ts/ts_err.c */
-/* ====================================================================
- * Copyright (c) 1999-2007 The OpenSSL Project. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in
- * the documentation and/or other materials provided with the
- * distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- * software must display the following acknowledgment:
- * "This product includes software developed by the OpenSSL Project
- * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- * endorse or promote products derived from this software without
- * prior written permission. For written permission, please contact
- * openssl-core@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- * nor may "OpenSSL" appear in their names without prior written
- * permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- * acknowledgment:
- * "This product includes software developed by the OpenSSL Project
- * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com). This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
/*
- * NOTE: this file was auto generated by the mkerr.pl script: any changes
- * made to it will be overwritten when the script next updates this file,
- * only reason strings will be preserved.
+ * Generated by util/mkerr.pl DO NOT EDIT
+ * Copyright 1995-2017 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the OpenSSL license (the "License"). You may not use
+ * this file except in compliance with the License. You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
*/
-#include <stdio.h>
#include <openssl/err.h>
-#include <openssl/ts.h>
+#include <openssl/tserr.h>
-/* BEGIN ERROR CODES */
#ifndef OPENSSL_NO_ERR
-# define ERR_FUNC(func) ERR_PACK(ERR_LIB_TS,func,0)
-# define ERR_REASON(reason) ERR_PACK(ERR_LIB_TS,0,reason)
-
-static ERR_STRING_DATA TS_str_functs[] = {
- {ERR_FUNC(TS_F_D2I_TS_RESP), "d2i_TS_RESP"},
- {ERR_FUNC(TS_F_DEF_SERIAL_CB), "DEF_SERIAL_CB"},
- {ERR_FUNC(TS_F_DEF_TIME_CB), "DEF_TIME_CB"},
- {ERR_FUNC(TS_F_ESS_ADD_SIGNING_CERT), "ESS_ADD_SIGNING_CERT"},
- {ERR_FUNC(TS_F_ESS_CERT_ID_NEW_INIT), "ESS_CERT_ID_NEW_INIT"},
- {ERR_FUNC(TS_F_ESS_SIGNING_CERT_NEW_INIT), "ESS_SIGNING_CERT_NEW_INIT"},
- {ERR_FUNC(TS_F_INT_TS_RESP_VERIFY_TOKEN), "INT_TS_RESP_VERIFY_TOKEN"},
- {ERR_FUNC(TS_F_PKCS7_TO_TS_TST_INFO), "PKCS7_to_TS_TST_INFO"},
- {ERR_FUNC(TS_F_TS_ACCURACY_SET_MICROS), "TS_ACCURACY_set_micros"},
- {ERR_FUNC(TS_F_TS_ACCURACY_SET_MILLIS), "TS_ACCURACY_set_millis"},
- {ERR_FUNC(TS_F_TS_ACCURACY_SET_SECONDS), "TS_ACCURACY_set_seconds"},
- {ERR_FUNC(TS_F_TS_CHECK_IMPRINTS), "TS_CHECK_IMPRINTS"},
- {ERR_FUNC(TS_F_TS_CHECK_NONCES), "TS_CHECK_NONCES"},
- {ERR_FUNC(TS_F_TS_CHECK_POLICY), "TS_CHECK_POLICY"},
- {ERR_FUNC(TS_F_TS_CHECK_SIGNING_CERTS), "TS_CHECK_SIGNING_CERTS"},
- {ERR_FUNC(TS_F_TS_CHECK_STATUS_INFO), "TS_CHECK_STATUS_INFO"},
- {ERR_FUNC(TS_F_TS_COMPUTE_IMPRINT), "TS_COMPUTE_IMPRINT"},
- {ERR_FUNC(TS_F_TS_CONF_SET_DEFAULT_ENGINE), "TS_CONF_set_default_engine"},
- {ERR_FUNC(TS_F_TS_GET_STATUS_TEXT), "TS_GET_STATUS_TEXT"},
- {ERR_FUNC(TS_F_TS_MSG_IMPRINT_SET_ALGO), "TS_MSG_IMPRINT_set_algo"},
- {ERR_FUNC(TS_F_TS_REQ_SET_MSG_IMPRINT), "TS_REQ_set_msg_imprint"},
- {ERR_FUNC(TS_F_TS_REQ_SET_NONCE), "TS_REQ_set_nonce"},
- {ERR_FUNC(TS_F_TS_REQ_SET_POLICY_ID), "TS_REQ_set_policy_id"},
- {ERR_FUNC(TS_F_TS_RESP_CREATE_RESPONSE), "TS_RESP_create_response"},
- {ERR_FUNC(TS_F_TS_RESP_CREATE_TST_INFO), "TS_RESP_CREATE_TST_INFO"},
- {ERR_FUNC(TS_F_TS_RESP_CTX_ADD_FAILURE_INFO),
+static const ERR_STRING_DATA TS_str_functs[] = {
+ {ERR_PACK(ERR_LIB_TS, TS_F_DEF_SERIAL_CB, 0), "def_serial_cb"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_DEF_TIME_CB, 0), "def_time_cb"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_ESS_ADD_SIGNING_CERT, 0),
+ "ess_add_signing_cert"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_ESS_ADD_SIGNING_CERT_V2, 0),
+ "ess_add_signing_cert_v2"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_ESS_CERT_ID_NEW_INIT, 0),
+ "ess_CERT_ID_new_init"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_ESS_CERT_ID_V2_NEW_INIT, 0),
+ "ess_cert_id_v2_new_init"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_ESS_SIGNING_CERT_NEW_INIT, 0),
+ "ess_SIGNING_CERT_new_init"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_ESS_SIGNING_CERT_V2_NEW_INIT, 0),
+ "ess_signing_cert_v2_new_init"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_INT_TS_RESP_VERIFY_TOKEN, 0),
+ "int_ts_RESP_verify_token"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_PKCS7_TO_TS_TST_INFO, 0),
+ "PKCS7_to_TS_TST_INFO"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_ACCURACY_SET_MICROS, 0),
+ "TS_ACCURACY_set_micros"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_ACCURACY_SET_MILLIS, 0),
+ "TS_ACCURACY_set_millis"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_ACCURACY_SET_SECONDS, 0),
+ "TS_ACCURACY_set_seconds"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_CHECK_IMPRINTS, 0), "ts_check_imprints"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_CHECK_NONCES, 0), "ts_check_nonces"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_CHECK_POLICY, 0), "ts_check_policy"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_CHECK_SIGNING_CERTS, 0),
+ "ts_check_signing_certs"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_CHECK_STATUS_INFO, 0),
+ "ts_check_status_info"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_COMPUTE_IMPRINT, 0), "ts_compute_imprint"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_CONF_INVALID, 0), "ts_CONF_invalid"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_CONF_LOAD_CERT, 0), "TS_CONF_load_cert"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_CONF_LOAD_CERTS, 0), "TS_CONF_load_certs"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_CONF_LOAD_KEY, 0), "TS_CONF_load_key"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_CONF_LOOKUP_FAIL, 0), "ts_CONF_lookup_fail"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_CONF_SET_DEFAULT_ENGINE, 0),
+ "TS_CONF_set_default_engine"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_GET_STATUS_TEXT, 0), "ts_get_status_text"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_MSG_IMPRINT_SET_ALGO, 0),
+ "TS_MSG_IMPRINT_set_algo"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_REQ_SET_MSG_IMPRINT, 0),
+ "TS_REQ_set_msg_imprint"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_REQ_SET_NONCE, 0), "TS_REQ_set_nonce"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_REQ_SET_POLICY_ID, 0),
+ "TS_REQ_set_policy_id"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_CREATE_RESPONSE, 0),
+ "TS_RESP_create_response"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_CREATE_TST_INFO, 0),
+ "ts_RESP_create_tst_info"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_CTX_ADD_FAILURE_INFO, 0),
"TS_RESP_CTX_add_failure_info"},
- {ERR_FUNC(TS_F_TS_RESP_CTX_ADD_MD), "TS_RESP_CTX_add_md"},
- {ERR_FUNC(TS_F_TS_RESP_CTX_ADD_POLICY), "TS_RESP_CTX_add_policy"},
- {ERR_FUNC(TS_F_TS_RESP_CTX_NEW), "TS_RESP_CTX_new"},
- {ERR_FUNC(TS_F_TS_RESP_CTX_SET_ACCURACY), "TS_RESP_CTX_set_accuracy"},
- {ERR_FUNC(TS_F_TS_RESP_CTX_SET_CERTS), "TS_RESP_CTX_set_certs"},
- {ERR_FUNC(TS_F_TS_RESP_CTX_SET_DEF_POLICY), "TS_RESP_CTX_set_def_policy"},
- {ERR_FUNC(TS_F_TS_RESP_CTX_SET_SIGNER_CERT),
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_CTX_ADD_MD, 0), "TS_RESP_CTX_add_md"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_CTX_ADD_POLICY, 0),
+ "TS_RESP_CTX_add_policy"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_CTX_NEW, 0), "TS_RESP_CTX_new"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_CTX_SET_ACCURACY, 0),
+ "TS_RESP_CTX_set_accuracy"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_CTX_SET_CERTS, 0),
+ "TS_RESP_CTX_set_certs"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_CTX_SET_DEF_POLICY, 0),
+ "TS_RESP_CTX_set_def_policy"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_CTX_SET_SIGNER_CERT, 0),
"TS_RESP_CTX_set_signer_cert"},
- {ERR_FUNC(TS_F_TS_RESP_CTX_SET_STATUS_INFO),
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_CTX_SET_STATUS_INFO, 0),
"TS_RESP_CTX_set_status_info"},
- {ERR_FUNC(TS_F_TS_RESP_GET_POLICY), "TS_RESP_GET_POLICY"},
- {ERR_FUNC(TS_F_TS_RESP_SET_GENTIME_WITH_PRECISION),
- "TS_RESP_SET_GENTIME_WITH_PRECISION"},
- {ERR_FUNC(TS_F_TS_RESP_SET_STATUS_INFO), "TS_RESP_set_status_info"},
- {ERR_FUNC(TS_F_TS_RESP_SET_TST_INFO), "TS_RESP_set_tst_info"},
- {ERR_FUNC(TS_F_TS_RESP_SIGN), "TS_RESP_SIGN"},
- {ERR_FUNC(TS_F_TS_RESP_VERIFY_SIGNATURE), "TS_RESP_verify_signature"},
- {ERR_FUNC(TS_F_TS_RESP_VERIFY_TOKEN), "TS_RESP_verify_token"},
- {ERR_FUNC(TS_F_TS_TST_INFO_SET_ACCURACY), "TS_TST_INFO_set_accuracy"},
- {ERR_FUNC(TS_F_TS_TST_INFO_SET_MSG_IMPRINT),
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_GET_POLICY, 0), "ts_RESP_get_policy"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_SET_GENTIME_WITH_PRECISION, 0),
+ "TS_RESP_set_genTime_with_precision"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_SET_STATUS_INFO, 0),
+ "TS_RESP_set_status_info"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_SET_TST_INFO, 0),
+ "TS_RESP_set_tst_info"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_SIGN, 0), "ts_RESP_sign"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_VERIFY_SIGNATURE, 0),
+ "TS_RESP_verify_signature"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_TST_INFO_SET_ACCURACY, 0),
+ "TS_TST_INFO_set_accuracy"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_TST_INFO_SET_MSG_IMPRINT, 0),
"TS_TST_INFO_set_msg_imprint"},
- {ERR_FUNC(TS_F_TS_TST_INFO_SET_NONCE), "TS_TST_INFO_set_nonce"},
- {ERR_FUNC(TS_F_TS_TST_INFO_SET_POLICY_ID), "TS_TST_INFO_set_policy_id"},
- {ERR_FUNC(TS_F_TS_TST_INFO_SET_SERIAL), "TS_TST_INFO_set_serial"},
- {ERR_FUNC(TS_F_TS_TST_INFO_SET_TIME), "TS_TST_INFO_set_time"},
- {ERR_FUNC(TS_F_TS_TST_INFO_SET_TSA), "TS_TST_INFO_set_tsa"},
- {ERR_FUNC(TS_F_TS_VERIFY), "TS_VERIFY"},
- {ERR_FUNC(TS_F_TS_VERIFY_CERT), "TS_VERIFY_CERT"},
- {ERR_FUNC(TS_F_TS_VERIFY_CTX_NEW), "TS_VERIFY_CTX_new"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_TST_INFO_SET_NONCE, 0),
+ "TS_TST_INFO_set_nonce"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_TST_INFO_SET_POLICY_ID, 0),
+ "TS_TST_INFO_set_policy_id"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_TST_INFO_SET_SERIAL, 0),
+ "TS_TST_INFO_set_serial"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_TST_INFO_SET_TIME, 0),
+ "TS_TST_INFO_set_time"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_TST_INFO_SET_TSA, 0), "TS_TST_INFO_set_tsa"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_VERIFY, 0), ""},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_VERIFY_CERT, 0), "ts_verify_cert"},
+ {ERR_PACK(ERR_LIB_TS, TS_F_TS_VERIFY_CTX_NEW, 0), "TS_VERIFY_CTX_new"},
{0, NULL}
};
-static ERR_STRING_DATA TS_str_reasons[] = {
- {ERR_REASON(TS_R_BAD_PKCS7_TYPE), "bad pkcs7 type"},
- {ERR_REASON(TS_R_BAD_TYPE), "bad type"},
- {ERR_REASON(TS_R_CERTIFICATE_VERIFY_ERROR), "certificate verify error"},
- {ERR_REASON(TS_R_COULD_NOT_SET_ENGINE), "could not set engine"},
- {ERR_REASON(TS_R_COULD_NOT_SET_TIME), "could not set time"},
- {ERR_REASON(TS_R_D2I_TS_RESP_INT_FAILED), "d2i ts resp int failed"},
- {ERR_REASON(TS_R_DETACHED_CONTENT), "detached content"},
- {ERR_REASON(TS_R_ESS_ADD_SIGNING_CERT_ERROR),
- "ess add signing cert error"},
- {ERR_REASON(TS_R_ESS_SIGNING_CERTIFICATE_ERROR),
- "ess signing certificate error"},
- {ERR_REASON(TS_R_INVALID_NULL_POINTER), "invalid null pointer"},
- {ERR_REASON(TS_R_INVALID_SIGNER_CERTIFICATE_PURPOSE),
- "invalid signer certificate purpose"},
- {ERR_REASON(TS_R_MESSAGE_IMPRINT_MISMATCH), "message imprint mismatch"},
- {ERR_REASON(TS_R_NONCE_MISMATCH), "nonce mismatch"},
- {ERR_REASON(TS_R_NONCE_NOT_RETURNED), "nonce not returned"},
- {ERR_REASON(TS_R_NO_CONTENT), "no content"},
- {ERR_REASON(TS_R_NO_TIME_STAMP_TOKEN), "no time stamp token"},
- {ERR_REASON(TS_R_PKCS7_ADD_SIGNATURE_ERROR), "pkcs7 add signature error"},
- {ERR_REASON(TS_R_PKCS7_ADD_SIGNED_ATTR_ERROR),
- "pkcs7 add signed attr error"},
- {ERR_REASON(TS_R_PKCS7_TO_TS_TST_INFO_FAILED),
- "pkcs7 to ts tst info failed"},
- {ERR_REASON(TS_R_POLICY_MISMATCH), "policy mismatch"},
- {ERR_REASON(TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE),
- "private key does not match certificate"},
- {ERR_REASON(TS_R_RESPONSE_SETUP_ERROR), "response setup error"},
- {ERR_REASON(TS_R_SIGNATURE_FAILURE), "signature failure"},
- {ERR_REASON(TS_R_THERE_MUST_BE_ONE_SIGNER), "there must be one signer"},
- {ERR_REASON(TS_R_TIME_SYSCALL_ERROR), "time syscall error"},
- {ERR_REASON(TS_R_TOKEN_NOT_PRESENT), "token not present"},
- {ERR_REASON(TS_R_TOKEN_PRESENT), "token present"},
- {ERR_REASON(TS_R_TSA_NAME_MISMATCH), "tsa name mismatch"},
- {ERR_REASON(TS_R_TSA_UNTRUSTED), "tsa untrusted"},
- {ERR_REASON(TS_R_TST_INFO_SETUP_ERROR), "tst info setup error"},
- {ERR_REASON(TS_R_TS_DATASIGN), "ts datasign"},
- {ERR_REASON(TS_R_UNACCEPTABLE_POLICY), "unacceptable policy"},
- {ERR_REASON(TS_R_UNSUPPORTED_MD_ALGORITHM), "unsupported md algorithm"},
- {ERR_REASON(TS_R_UNSUPPORTED_VERSION), "unsupported version"},
- {ERR_REASON(TS_R_WRONG_CONTENT_TYPE), "wrong content type"},
+static const ERR_STRING_DATA TS_str_reasons[] = {
+ {ERR_PACK(ERR_LIB_TS, 0, TS_R_BAD_PKCS7_TYPE), "bad pkcs7 type"},
+ {ERR_PACK(ERR_LIB_TS, 0, TS_R_BAD_TYPE), "bad type"},
+ {ERR_PACK(ERR_LIB_TS, 0, TS_R_CANNOT_LOAD_CERT), "cannot load certificate"},
+ {ERR_PACK(ERR_LIB_TS, 0, TS_R_CANNOT_LOAD_KEY), "cannot load private key"},
+ {ERR_PACK(ERR_LIB_TS, 0, TS_R_CERTIFICATE_VERIFY_ERROR),
+ "certificate verify error"},
+ {ERR_PACK(ERR_LIB_TS, 0, TS_R_COULD_NOT_SET_ENGINE),
+ "could not set engine"},
+ {ERR_PACK(ERR_LIB_TS, 0, TS_R_COULD_NOT_SET_TIME), "could not set time"},
+ {ERR_PACK(ERR_LIB_TS, 0, TS_R_DETACHED_CONTENT), "detached content"},
+ {ERR_PACK(ERR_LIB_TS, 0, TS_R_ESS_ADD_SIGNING_CERT_ERROR),
+ "ess add signing cert error"},
+ {ERR_PACK(ERR_LIB_TS, 0, TS_R_ESS_ADD_SIGNING_CERT_V2_ERROR),
+ "ess add signing cert v2 error"},
+ {ERR_PACK(ERR_LIB_TS, 0, TS_R_ESS_SIGNING_CERTIFICATE_ERROR),
+ "ess signing certificate error"},
+ {ERR_PACK(ERR_LIB_TS, 0, TS_R_INVALID_NULL_POINTER),
+ "invalid null pointer"},
+ {ERR_PACK(ERR_LIB_TS, 0, TS_R_INVALID_SIGNER_CERTIFICATE_PURPOSE),
+ "invalid signer certificate purpose"},
+ {ERR_PACK(ERR_LIB_TS, 0, TS_R_MESSAGE_IMPRINT_MISMATCH),
+ "message imprint mismatch"},
+ {ERR_PACK(ERR_LIB_TS, 0, TS_R_NONCE_MISMATCH), "nonce mismatch"},
+ {ERR_PACK(ERR_LIB_TS, 0, TS_R_NONCE_NOT_RETURNED), "nonce not returned"},
+ {ERR_PACK(ERR_LIB_TS, 0, TS_R_NO_CONTENT), "no content"},
+ {ERR_PACK(ERR_LIB_TS, 0, TS_R_NO_TIME_STAMP_TOKEN), "no time stamp token"},
+ {ERR_PACK(ERR_LIB_TS, 0, TS_R_PKCS7_ADD_SIGNATURE_ERROR),
+ "pkcs7 add signature error"},
+ {ERR_PACK(ERR_LIB_TS, 0, TS_R_PKCS7_ADD_SIGNED_ATTR_ERROR),
+ "pkcs7 add signed attr error"},
+ {ERR_PACK(ERR_LIB_TS, 0, TS_R_PKCS7_TO_TS_TST_INFO_FAILED),
+ "pkcs7 to ts tst info failed"},
+ {ERR_PACK(ERR_LIB_TS, 0, TS_R_POLICY_MISMATCH), "policy mismatch"},
+ {ERR_PACK(ERR_LIB_TS, 0, TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE),
+ "private key does not match certificate"},
+ {ERR_PACK(ERR_LIB_TS, 0, TS_R_RESPONSE_SETUP_ERROR),
+ "response setup error"},
+ {ERR_PACK(ERR_LIB_TS, 0, TS_R_SIGNATURE_FAILURE), "signature failure"},
+ {ERR_PACK(ERR_LIB_TS, 0, TS_R_THERE_MUST_BE_ONE_SIGNER),
+ "there must be one signer"},
+ {ERR_PACK(ERR_LIB_TS, 0, TS_R_TIME_SYSCALL_ERROR), "time syscall error"},
+ {ERR_PACK(ERR_LIB_TS, 0, TS_R_TOKEN_NOT_PRESENT), "token not present"},
+ {ERR_PACK(ERR_LIB_TS, 0, TS_R_TOKEN_PRESENT), "token present"},
+ {ERR_PACK(ERR_LIB_TS, 0, TS_R_TSA_NAME_MISMATCH), "tsa name mismatch"},
+ {ERR_PACK(ERR_LIB_TS, 0, TS_R_TSA_UNTRUSTED), "tsa untrusted"},
+ {ERR_PACK(ERR_LIB_TS, 0, TS_R_TST_INFO_SETUP_ERROR),
+ "tst info setup error"},
+ {ERR_PACK(ERR_LIB_TS, 0, TS_R_TS_DATASIGN), "ts datasign"},
+ {ERR_PACK(ERR_LIB_TS, 0, TS_R_UNACCEPTABLE_POLICY), "unacceptable policy"},
+ {ERR_PACK(ERR_LIB_TS, 0, TS_R_UNSUPPORTED_MD_ALGORITHM),
+ "unsupported md algorithm"},
+ {ERR_PACK(ERR_LIB_TS, 0, TS_R_UNSUPPORTED_VERSION), "unsupported version"},
+ {ERR_PACK(ERR_LIB_TS, 0, TS_R_VAR_BAD_VALUE), "var bad value"},
+ {ERR_PACK(ERR_LIB_TS, 0, TS_R_VAR_LOOKUP_FAILURE),
+ "cannot find config variable"},
+ {ERR_PACK(ERR_LIB_TS, 0, TS_R_WRONG_CONTENT_TYPE), "wrong content type"},
{0, NULL}
};
#endif
-void ERR_load_TS_strings(void)
+int ERR_load_TS_strings(void)
{
#ifndef OPENSSL_NO_ERR
-
if (ERR_func_error_string(TS_str_functs[0].error) == NULL) {
- ERR_load_strings(0, TS_str_functs);
- ERR_load_strings(0, TS_str_reasons);
+ ERR_load_strings_const(TS_str_functs);
+ ERR_load_strings_const(TS_str_reasons);
}
#endif
+ return 1;
}
diff --git a/crypto/ts/ts_lcl.h b/crypto/ts/ts_lcl.h
new file mode 100644
index 000000000000..771784fef7c8
--- /dev/null
+++ b/crypto/ts/ts_lcl.h
@@ -0,0 +1,211 @@
+/*
+ * Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the OpenSSL license (the "License"). You may not use
+ * this file except in compliance with the License. You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+/*-
+ * MessageImprint ::= SEQUENCE {
+ * hashAlgorithm AlgorithmIdentifier,
+ * hashedMessage OCTET STRING }
+ */
+struct TS_msg_imprint_st {
+ X509_ALGOR *hash_algo;
+ ASN1_OCTET_STRING *hashed_msg;
+};
+
+/*-
+ * TimeStampResp ::= SEQUENCE {
+ * status PKIStatusInfo,
+ * timeStampToken TimeStampToken OPTIONAL }
+ */
+struct TS_resp_st {
+ TS_STATUS_INFO *status_info;
+ PKCS7 *token;
+ TS_TST_INFO *tst_info;
+};
+
+/*-
+ * TimeStampReq ::= SEQUENCE {
+ * version INTEGER { v1(1) },
+ * messageImprint MessageImprint,
+ * --a hash algorithm OID and the hash value of the data to be
+ * --time-stamped
+ * reqPolicy TSAPolicyId OPTIONAL,
+ * nonce INTEGER OPTIONAL,
+ * certReq BOOLEAN DEFAULT FALSE,
+ * extensions [0] IMPLICIT Extensions OPTIONAL }
+ */
+struct TS_req_st {
+ ASN1_INTEGER *version;
+ TS_MSG_IMPRINT *msg_imprint;
+ ASN1_OBJECT *policy_id;
+ ASN1_INTEGER *nonce;
+ ASN1_BOOLEAN cert_req;
+ STACK_OF(X509_EXTENSION) *extensions;
+};
+
+/*-
+ * Accuracy ::= SEQUENCE {
+ * seconds INTEGER OPTIONAL,
+ * millis [0] INTEGER (1..999) OPTIONAL,
+ * micros [1] INTEGER (1..999) OPTIONAL }
+ */
+struct TS_accuracy_st {
+ ASN1_INTEGER *seconds;
+ ASN1_INTEGER *millis;
+ ASN1_INTEGER *micros;
+};
+
+/*-
+ * TSTInfo ::= SEQUENCE {
+ * version INTEGER { v1(1) },
+ * policy TSAPolicyId,
+ * messageImprint MessageImprint,
+ * -- MUST have the same value as the similar field in
+ * -- TimeStampReq
+ * serialNumber INTEGER,
+ * -- Time-Stamping users MUST be ready to accommodate integers
+ * -- up to 160 bits.
+ * genTime GeneralizedTime,
+ * accuracy Accuracy OPTIONAL,
+ * ordering BOOLEAN DEFAULT FALSE,
+ * nonce INTEGER OPTIONAL,
+ * -- MUST be present if the similar field was present
+ * -- in TimeStampReq. In that case it MUST have the same value.
+ * tsa [0] GeneralName OPTIONAL,
+ * extensions [1] IMPLICIT Extensions OPTIONAL }
+ */
+struct TS_tst_info_st {
+ ASN1_INTEGER *version;
+ ASN1_OBJECT *policy_id;
+ TS_MSG_IMPRINT *msg_imprint;
+ ASN1_INTEGER *serial;
+ ASN1_GENERALIZEDTIME *time;
+ TS_ACCURACY *accuracy;
+ ASN1_BOOLEAN ordering;
+ ASN1_INTEGER *nonce;
+ GENERAL_NAME *tsa;
+ STACK_OF(X509_EXTENSION) *extensions;
+};
+
+struct TS_status_info_st {
+ ASN1_INTEGER *status;
+ STACK_OF(ASN1_UTF8STRING) *text;
+ ASN1_BIT_STRING *failure_info;
+};
+
+/*-
+ * IssuerSerial ::= SEQUENCE {
+ * issuer GeneralNames,
+ * serialNumber CertificateSerialNumber
+ * }
+ */
+struct ESS_issuer_serial {
+ STACK_OF(GENERAL_NAME) *issuer;
+ ASN1_INTEGER *serial;
+};
+
+/*-
+ * ESSCertID ::= SEQUENCE {
+ * certHash Hash,
+ * issuerSerial IssuerSerial OPTIONAL
+ * }
+ */
+struct ESS_cert_id {
+ ASN1_OCTET_STRING *hash; /* Always SHA-1 digest. */
+ ESS_ISSUER_SERIAL *issuer_serial;
+};
+
+/*-
+ * SigningCertificate ::= SEQUENCE {
+ * certs SEQUENCE OF ESSCertID,
+ * policies SEQUENCE OF PolicyInformation OPTIONAL
+ * }
+ */
+struct ESS_signing_cert {
+ STACK_OF(ESS_CERT_ID) *cert_ids;
+ STACK_OF(POLICYINFO) *policy_info;
+};
+
+/*-
+ * ESSCertIDv2 ::= SEQUENCE {
+ * hashAlgorithm AlgorithmIdentifier
+ * DEFAULT {algorithm id-sha256},
+ * certHash Hash,
+ * issuerSerial IssuerSerial OPTIONAL
+ * }
+ */
+
+struct ESS_cert_id_v2_st {
+ X509_ALGOR *hash_alg; /* Default: SHA-256 */
+ ASN1_OCTET_STRING *hash;
+ ESS_ISSUER_SERIAL *issuer_serial;
+};
+
+/*-
+ * SigningCertificateV2 ::= SEQUENCE {
+ * certs SEQUENCE OF ESSCertIDv2,
+ * policies SEQUENCE OF PolicyInformation OPTIONAL
+ * }
+ */
+
+struct ESS_signing_cert_v2_st {
+ STACK_OF(ESS_CERT_ID_V2) *cert_ids;
+ STACK_OF(POLICYINFO) *policy_info;
+};
+
+
+struct TS_resp_ctx {
+ X509 *signer_cert;
+ EVP_PKEY *signer_key;
+ const EVP_MD *signer_md;
+ const EVP_MD *ess_cert_id_digest;
+ STACK_OF(X509) *certs; /* Certs to include in signed data. */
+ STACK_OF(ASN1_OBJECT) *policies; /* Acceptable policies. */
+ ASN1_OBJECT *default_policy; /* It may appear in policies, too. */
+ STACK_OF(EVP_MD) *mds; /* Acceptable message digests. */
+ ASN1_INTEGER *seconds; /* accuracy, 0 means not specified. */
+ ASN1_INTEGER *millis; /* accuracy, 0 means not specified. */
+ ASN1_INTEGER *micros; /* accuracy, 0 means not specified. */
+ unsigned clock_precision_digits; /* fraction of seconds in time stamp
+ * token. */
+ unsigned flags; /* Optional info, see values above. */
+ /* Callback functions. */
+ TS_serial_cb serial_cb;
+ void *serial_cb_data; /* User data for serial_cb. */
+ TS_time_cb time_cb;
+ void *time_cb_data; /* User data for time_cb. */
+ TS_extension_cb extension_cb;
+ void *extension_cb_data; /* User data for extension_cb. */
+ /* These members are used only while creating the response. */
+ TS_REQ *request;
+ TS_RESP *response;
+ TS_TST_INFO *tst_info;
+};
+
+struct TS_verify_ctx {
+ /* Set this to the union of TS_VFY_... flags you want to carry out. */
+ unsigned flags;
+ /* Must be set only with TS_VFY_SIGNATURE. certs is optional. */
+ X509_STORE *store;
+ STACK_OF(X509) *certs;
+ /* Must be set only with TS_VFY_POLICY. */
+ ASN1_OBJECT *policy;
+ /*
+ * Must be set only with TS_VFY_IMPRINT. If md_alg is NULL, the
+ * algorithm from the response is used.
+ */
+ X509_ALGOR *md_alg;
+ unsigned char *imprint;
+ unsigned imprint_len;
+ /* Must be set only with TS_VFY_DATA. */
+ BIO *data;
+ /* Must be set only with TS_VFY_TSA_NAME. */
+ ASN1_INTEGER *nonce;
+ /* Must be set only with TS_VFY_TSA_NAME. */
+ GENERAL_NAME *tsa_name;
+};
diff --git a/crypto/ts/ts_lib.c b/crypto/ts/ts_lib.c
index e0f106353723..ce2e12c593e0 100644
--- a/crypto/ts/ts_lib.c
+++ b/crypto/ts/ts_lib.c
@@ -1,87 +1,36 @@
-/* crypto/ts/ts_lib.c */
/*
- * Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL project
- * 2002.
- */
-/* ====================================================================
- * Copyright (c) 2006 The OpenSSL Project. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in
- * the documentation and/or other materials provided with the
- * distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- * software must display the following acknowledgment:
- * "This product includes software developed by the OpenSSL Project
- * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- * endorse or promote products derived from this software without
- * prior written permission. For written permission, please contact
- * licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- * nor may "OpenSSL" appear in their names without prior written
- * permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- * acknowledgment:
- * "This product includes software developed by the OpenSSL Project
- * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com). This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
+ * Copyright 2006-2018 The OpenSSL Project Authors. All Rights Reserved.
*
+ * Licensed under the OpenSSL license (the "License"). You may not use
+ * this file except in compliance with the License. You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
*/
#include <stdio.h>
-#include "cryptlib.h"
+#include "internal/cryptlib.h"
#include <openssl/objects.h>
#include <openssl/bn.h>
+#include <openssl/x509.h>
#include <openssl/x509v3.h>
-#include "ts.h"
-
-/* Local function declarations. */
-
-/* Function definitions. */
+#include <openssl/ts.h>
+#include "ts_lcl.h"
int TS_ASN1_INTEGER_print_bio(BIO *bio, const ASN1_INTEGER *num)
{
- BIGNUM num_bn;
+ BIGNUM *num_bn;
int result = 0;
char *hex;
- BN_init(&num_bn);
- ASN1_INTEGER_to_BN(num, &num_bn);
- if ((hex = BN_bn2hex(&num_bn))) {
+ num_bn = ASN1_INTEGER_to_BN(num, NULL);
+ if (num_bn == NULL)
+ return -1;
+ if ((hex = BN_bn2hex(num_bn))) {
result = BIO_write(bio, "0x", 2) > 0;
result = result && BIO_write(bio, hex, strlen(hex)) > 0;
OPENSSL_free(hex);
}
- BN_free(&num_bn);
+ BN_free(num_bn);
return result;
}
@@ -107,12 +56,13 @@ int TS_ext_print_bio(BIO *bio, const STACK_OF(X509_EXTENSION) *extensions)
for (i = 0; i < n; i++) {
ex = X509v3_get_ext(extensions, i);
obj = X509_EXTENSION_get_object(ex);
- i2a_ASN1_OBJECT(bio, obj);
+ if (i2a_ASN1_OBJECT(bio, obj) < 0)
+ return 0;
critical = X509_EXTENSION_get_critical(ex);
- BIO_printf(bio, ": %s\n", critical ? "critical" : "");
+ BIO_printf(bio, ":%s\n", critical ? " critical" : "");
if (!X509V3_EXT_print(bio, ex, 0, 4)) {
BIO_printf(bio, "%4s", "");
- M_ASN1_OCTET_STRING_print(bio, ex->value);
+ ASN1_STRING_print(bio, X509_EXTENSION_get_data(ex));
}
BIO_write(bio, "\n", 1);
}
@@ -129,14 +79,14 @@ int TS_X509_ALGOR_print_bio(BIO *bio, const X509_ALGOR *alg)
int TS_MSG_IMPRINT_print_bio(BIO *bio, TS_MSG_IMPRINT *a)
{
- const ASN1_OCTET_STRING *msg;
+ ASN1_OCTET_STRING *msg;
- TS_X509_ALGOR_print_bio(bio, TS_MSG_IMPRINT_get_algo(a));
+ TS_X509_ALGOR_print_bio(bio, a->hash_algo);
BIO_printf(bio, "Message data:\n");
- msg = TS_MSG_IMPRINT_get_msg(a);
- BIO_dump_indent(bio, (const char *)M_ASN1_STRING_data(msg),
- M_ASN1_STRING_length(msg), 4);
+ msg = a->hashed_msg;
+ BIO_dump_indent(bio, (const char *)ASN1_STRING_get0_data(msg),
+ ASN1_STRING_length(msg), 4);
return 1;
}
diff --git a/crypto/ts/ts_req_print.c b/crypto/ts/ts_req_print.c
index 31940eef5027..0dedf47d924b 100644
--- a/crypto/ts/ts_req_print.c
+++ b/crypto/ts/ts_req_print.c
@@ -1,76 +1,24 @@
-/* crypto/ts/ts_req_print.c */
/*
- * Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL project
- * 2002.
- */
-/* ====================================================================
- * Copyright (c) 2006 The OpenSSL Project. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in
- * the documentation and/or other materials provided with the
- * distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- * software must display the following acknowledgment:
- * "This product includes software developed by the OpenSSL Project
- * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- * endorse or promote products derived from this software without
- * prior written permission. For written permission, please contact
- * licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- * nor may "OpenSSL" appear in their names without prior written
- * permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- * acknowledgment:
- * "This product includes software developed by the OpenSSL Project
- * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com). This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
+ * Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
*
+ * Licensed under the OpenSSL license (the "License"). You may not use
+ * this file except in compliance with the License. You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
*/
#include <stdio.h>
-#include "cryptlib.h"
+#include "internal/cryptlib.h"
#include <openssl/objects.h>
#include <openssl/bn.h>
#include <openssl/x509v3.h>
#include <openssl/ts.h>
-
-/* Function definitions. */
+#include "ts_lcl.h"
int TS_REQ_print_bio(BIO *bio, TS_REQ *a)
{
int v;
ASN1_OBJECT *policy_id;
- const ASN1_INTEGER *nonce;
if (a == NULL)
return 0;
@@ -78,7 +26,7 @@ int TS_REQ_print_bio(BIO *bio, TS_REQ *a)
v = TS_REQ_get_version(a);
BIO_printf(bio, "Version: %d\n", v);
- TS_MSG_IMPRINT_print_bio(bio, TS_REQ_get_msg_imprint(a));
+ TS_MSG_IMPRINT_print_bio(bio, a->msg_imprint);
BIO_printf(bio, "Policy OID: ");
policy_id = TS_REQ_get_policy_id(a);
@@ -88,17 +36,16 @@ int TS_REQ_print_bio(BIO *bio, TS_REQ *a)
TS_OBJ_print_bio(bio, policy_id);
BIO_printf(bio, "Nonce: ");
- nonce = TS_REQ_get_nonce(a);
- if (nonce == NULL)
+ if (a->nonce == NULL)
BIO_printf(bio, "unspecified");
else
- TS_ASN1_INTEGER_print_bio(bio, nonce);
+ TS_ASN1_INTEGER_print_bio(bio, a->nonce);
BIO_write(bio, "\n", 1);
BIO_printf(bio, "Certificate required: %s\n",
- TS_REQ_get_cert_req(a) ? "yes" : "no");
+ a->cert_req ? "yes" : "no");
- TS_ext_print_bio(bio, TS_REQ_get_exts(a));
+ TS_ext_print_bio(bio, a->extensions);
return 1;
}
diff --git a/crypto/ts/ts_req_utils.c b/crypto/ts/ts_req_utils.c
index 362e5e589a97..2073d3395d75 100644
--- a/crypto/ts/ts_req_utils.c
+++ b/crypto/ts/ts_req_utils.c
@@ -1,67 +1,18 @@
-/* crypto/ts/ts_req_utils.c */
/*
- * Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL project
- * 2002.
- */
-/* ====================================================================
- * Copyright (c) 2006 The OpenSSL Project. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in
- * the documentation and/or other materials provided with the
- * distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- * software must display the following acknowledgment:
- * "This product includes software developed by the OpenSSL Project
- * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- * endorse or promote products derived from this software without
- * prior written permission. For written permission, please contact
- * licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- * nor may "OpenSSL" appear in their names without prior written
- * permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- * acknowledgment:
- * "This product includes software developed by the OpenSSL Project
- * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com). This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
+ * Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
*
+ * Licensed under the OpenSSL license (the "License"). You may not use
+ * this file except in compliance with the License. You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
*/
#include <stdio.h>
-#include "cryptlib.h"
+#include "internal/cryptlib.h"
#include <openssl/objects.h>
#include <openssl/x509v3.h>
#include <openssl/ts.h>
+#include "ts_lcl.h"
int TS_REQ_set_version(TS_REQ *a, long version)
{
@@ -125,7 +76,7 @@ ASN1_OCTET_STRING *TS_MSG_IMPRINT_get_msg(TS_MSG_IMPRINT *a)
return a->hashed_msg;
}
-int TS_REQ_set_policy_id(TS_REQ *a, ASN1_OBJECT *policy)
+int TS_REQ_set_policy_id(TS_REQ *a, const ASN1_OBJECT *policy)
{
ASN1_OBJECT *new_policy;
@@ -201,7 +152,7 @@ int TS_REQ_get_ext_by_NID(TS_REQ *a, int nid, int lastpos)
return X509v3_get_ext_by_NID(a->extensions, nid, lastpos);
}
-int TS_REQ_get_ext_by_OBJ(TS_REQ *a, ASN1_OBJECT *obj, int lastpos)
+int TS_REQ_get_ext_by_OBJ(TS_REQ *a, const ASN1_OBJECT *obj, int lastpos)
{
return X509v3_get_ext_by_OBJ(a->extensions, obj, lastpos);
}
diff --git a/crypto/ts/ts_rsp_print.c b/crypto/ts/ts_rsp_print.c
index e706a5687a58..6eb0ec8d7504 100644
--- a/crypto/ts/ts_rsp_print.c
+++ b/crypto/ts/ts_rsp_print.c
@@ -1,93 +1,38 @@
-/* crypto/ts/ts_resp_print.c */
/*
- * Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL project
- * 2002.
- */
-/* ====================================================================
- * Copyright (c) 2006 The OpenSSL Project. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in
- * the documentation and/or other materials provided with the
- * distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- * software must display the following acknowledgment:
- * "This product includes software developed by the OpenSSL Project
- * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- * endorse or promote products derived from this software without
- * prior written permission. For written permission, please contact
- * licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- * nor may "OpenSSL" appear in their names without prior written
- * permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- * acknowledgment:
- * "This product includes software developed by the OpenSSL Project
- * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com). This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
+ * Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
*
+ * Licensed under the OpenSSL license (the "License"). You may not use
+ * this file except in compliance with the License. You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
*/
#include <stdio.h>
-#include "cryptlib.h"
+#include "internal/cryptlib.h"
#include <openssl/objects.h>
#include <openssl/bn.h>
#include <openssl/x509v3.h>
-#include "ts.h"
+#include <openssl/ts.h>
+#include "ts_lcl.h"
struct status_map_st {
int bit;
const char *text;
};
-/* Local function declarations. */
+static int ts_status_map_print(BIO *bio, const struct status_map_st *a,
+ const ASN1_BIT_STRING *v);
+static int ts_ACCURACY_print_bio(BIO *bio, const TS_ACCURACY *accuracy);
-static int TS_status_map_print(BIO *bio, struct status_map_st *a,
- ASN1_BIT_STRING *v);
-static int TS_ACCURACY_print_bio(BIO *bio, const TS_ACCURACY *accuracy);
-
-/* Function definitions. */
int TS_RESP_print_bio(BIO *bio, TS_RESP *a)
{
- TS_TST_INFO *tst_info;
-
BIO_printf(bio, "Status info:\n");
- TS_STATUS_INFO_print_bio(bio, TS_RESP_get_status_info(a));
+ TS_STATUS_INFO_print_bio(bio, a->status_info);
BIO_printf(bio, "\nTST info:\n");
- tst_info = TS_RESP_get_tst_info(a);
- if (tst_info != NULL)
- TS_TST_INFO_print_bio(bio, TS_RESP_get_tst_info(a));
+ if (a->tst_info != NULL)
+ TS_TST_INFO_print_bio(bio, a->tst_info);
else
BIO_printf(bio, "Not included.\n");
@@ -104,7 +49,7 @@ int TS_STATUS_INFO_print_bio(BIO *bio, TS_STATUS_INFO *a)
"Revocation warning.",
"Revoked."
};
- static struct status_map_st failure_map[] = {
+ static const struct status_map_st failure_map[] = {
{TS_INFO_BAD_ALG,
"unrecognized or unsupported algorithm identifier"},
{TS_INFO_BAD_REQUEST,
@@ -127,16 +72,13 @@ int TS_STATUS_INFO_print_bio(BIO *bio, TS_STATUS_INFO *a)
long status;
int i, lines = 0;
- /* Printing status code. */
BIO_printf(bio, "Status: ");
status = ASN1_INTEGER_get(a->status);
- if (0 <= status
- && status < (long)(sizeof(status_map) / sizeof(status_map[0])))
+ if (0 <= status && status < (long)OSSL_NELEM(status_map))
BIO_printf(bio, "%s\n", status_map[status]);
else
BIO_printf(bio, "out of bounds\n");
- /* Printing status description. */
BIO_printf(bio, "Status description: ");
for (i = 0; i < sk_ASN1_UTF8STRING_num(a->text); ++i) {
if (i > 0)
@@ -147,10 +89,9 @@ int TS_STATUS_INFO_print_bio(BIO *bio, TS_STATUS_INFO *a)
if (i == 0)
BIO_printf(bio, "unspecified\n");
- /* Printing failure information. */
BIO_printf(bio, "Failure info: ");
if (a->failure_info != NULL)
- lines = TS_status_map_print(bio, failure_map, a->failure_info);
+ lines = ts_status_map_print(bio, failure_map, a->failure_info);
if (lines == 0)
BIO_printf(bio, "unspecified");
BIO_printf(bio, "\n");
@@ -158,8 +99,8 @@ int TS_STATUS_INFO_print_bio(BIO *bio, TS_STATUS_INFO *a)
return 1;
}
-static int TS_status_map_print(BIO *bio, struct status_map_st *a,
- ASN1_BIT_STRING *v)
+static int ts_status_map_print(BIO *bio, const struct status_map_st *a,
+ const ASN1_BIT_STRING *v)
{
int lines = 0;
@@ -177,102 +118,75 @@ static int TS_status_map_print(BIO *bio, struct status_map_st *a,
int TS_TST_INFO_print_bio(BIO *bio, TS_TST_INFO *a)
{
int v;
- ASN1_OBJECT *policy_id;
- const ASN1_INTEGER *serial;
- const ASN1_GENERALIZEDTIME *gtime;
- TS_ACCURACY *accuracy;
- const ASN1_INTEGER *nonce;
- GENERAL_NAME *tsa_name;
if (a == NULL)
return 0;
- /* Print version. */
- v = TS_TST_INFO_get_version(a);
+ v = ASN1_INTEGER_get(a->version);
BIO_printf(bio, "Version: %d\n", v);
- /* Print policy id. */
BIO_printf(bio, "Policy OID: ");
- policy_id = TS_TST_INFO_get_policy_id(a);
- TS_OBJ_print_bio(bio, policy_id);
+ TS_OBJ_print_bio(bio, a->policy_id);
- /* Print message imprint. */
- TS_MSG_IMPRINT_print_bio(bio, TS_TST_INFO_get_msg_imprint(a));
+ TS_MSG_IMPRINT_print_bio(bio, a->msg_imprint);
- /* Print serial number. */
BIO_printf(bio, "Serial number: ");
- serial = TS_TST_INFO_get_serial(a);
- if (serial == NULL)
+ if (a->serial == NULL)
BIO_printf(bio, "unspecified");
else
- TS_ASN1_INTEGER_print_bio(bio, serial);
+ TS_ASN1_INTEGER_print_bio(bio, a->serial);
BIO_write(bio, "\n", 1);
- /* Print time stamp. */
BIO_printf(bio, "Time stamp: ");
- gtime = TS_TST_INFO_get_time(a);
- ASN1_GENERALIZEDTIME_print(bio, gtime);
+ ASN1_GENERALIZEDTIME_print(bio, a->time);
BIO_write(bio, "\n", 1);
- /* Print accuracy. */
BIO_printf(bio, "Accuracy: ");
- accuracy = TS_TST_INFO_get_accuracy(a);
- if (accuracy == NULL)
+ if (a->accuracy == NULL)
BIO_printf(bio, "unspecified");
else
- TS_ACCURACY_print_bio(bio, accuracy);
+ ts_ACCURACY_print_bio(bio, a->accuracy);
BIO_write(bio, "\n", 1);
- /* Print ordering. */
- BIO_printf(bio, "Ordering: %s\n",
- TS_TST_INFO_get_ordering(a) ? "yes" : "no");
+ BIO_printf(bio, "Ordering: %s\n", a->ordering ? "yes" : "no");
- /* Print nonce. */
BIO_printf(bio, "Nonce: ");
- nonce = TS_TST_INFO_get_nonce(a);
- if (nonce == NULL)
+ if (a->nonce == NULL)
BIO_printf(bio, "unspecified");
else
- TS_ASN1_INTEGER_print_bio(bio, nonce);
+ TS_ASN1_INTEGER_print_bio(bio, a->nonce);
BIO_write(bio, "\n", 1);
- /* Print TSA name. */
BIO_printf(bio, "TSA: ");
- tsa_name = TS_TST_INFO_get_tsa(a);
- if (tsa_name == NULL)
+ if (a->tsa == NULL)
BIO_printf(bio, "unspecified");
else {
STACK_OF(CONF_VALUE) *nval;
- if ((nval = i2v_GENERAL_NAME(NULL, tsa_name, NULL)))
+ if ((nval = i2v_GENERAL_NAME(NULL, a->tsa, NULL)))
X509V3_EXT_val_prn(bio, nval, 0, 0);
sk_CONF_VALUE_pop_free(nval, X509V3_conf_free);
}
BIO_write(bio, "\n", 1);
- /* Print extensions. */
- TS_ext_print_bio(bio, TS_TST_INFO_get_exts(a));
+ TS_ext_print_bio(bio, a->extensions);
return 1;
}
-static int TS_ACCURACY_print_bio(BIO *bio, const TS_ACCURACY *accuracy)
+static int ts_ACCURACY_print_bio(BIO *bio, const TS_ACCURACY *a)
{
- const ASN1_INTEGER *seconds = TS_ACCURACY_get_seconds(accuracy);
- const ASN1_INTEGER *millis = TS_ACCURACY_get_millis(accuracy);
- const ASN1_INTEGER *micros = TS_ACCURACY_get_micros(accuracy);
-
- if (seconds != NULL)
- TS_ASN1_INTEGER_print_bio(bio, seconds);
+ if (a->seconds != NULL)
+ TS_ASN1_INTEGER_print_bio(bio, a->seconds);
else
BIO_printf(bio, "unspecified");
BIO_printf(bio, " seconds, ");
- if (millis != NULL)
- TS_ASN1_INTEGER_print_bio(bio, millis);
+ if (a->millis != NULL)
+ TS_ASN1_INTEGER_print_bio(bio, a->millis);
else
BIO_printf(bio, "unspecified");
BIO_printf(bio, " millis, ");
- if (micros != NULL)
- TS_ASN1_INTEGER_print_bio(bio, micros);
+ if (a->micros != NULL)
+ TS_ASN1_INTEGER_print_bio(bio, a->micros);
else
BIO_printf(bio, "unspecified");
BIO_printf(bio, " micros");
diff --git a/crypto/ts/ts_rsp_sign.c b/crypto/ts/ts_rsp_sign.c
index d55e903e836a..1b2b84ef6b67 100644
--- a/crypto/ts/ts_rsp_sign.c
+++ b/crypto/ts/ts_rsp_sign.c
@@ -1,108 +1,64 @@
-/* crypto/ts/ts_resp_sign.c */
/*
- * Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL project
- * 2002.
- */
-/* ====================================================================
- * Copyright (c) 2006-2018 The OpenSSL Project. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in
- * the documentation and/or other materials provided with the
- * distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- * software must display the following acknowledgment:
- * "This product includes software developed by the OpenSSL Project
- * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- * endorse or promote products derived from this software without
- * prior written permission. For written permission, please contact
- * licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- * nor may "OpenSSL" appear in their names without prior written
- * permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- * acknowledgment:
- * "This product includes software developed by the OpenSSL Project
- * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com). This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
+ * Copyright 2006-2018 The OpenSSL Project Authors. All Rights Reserved.
*
+ * Licensed under the OpenSSL license (the "License"). You may not use
+ * this file except in compliance with the License. You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
*/
-#include "cryptlib.h"
-#include "o_time.h"
-
-#if defined(OPENSSL_SYS_UNIX)
-# include <sys/time.h>
-#endif
+#include "e_os.h"
+#include "internal/cryptlib.h"
#include <openssl/objects.h>
#include <openssl/ts.h>
#include <openssl/pkcs7.h>
-
-/* Private function declarations. */
+#include <openssl/crypto.h>
+#include "ts_lcl.h"
static ASN1_INTEGER *def_serial_cb(struct TS_resp_ctx *, void *);
static int def_time_cb(struct TS_resp_ctx *, void *, long *sec, long *usec);
static int def_extension_cb(struct TS_resp_ctx *, X509_EXTENSION *, void *);
-static void TS_RESP_CTX_init(TS_RESP_CTX *ctx);
-static void TS_RESP_CTX_cleanup(TS_RESP_CTX *ctx);
-static int TS_RESP_check_request(TS_RESP_CTX *ctx);
-static ASN1_OBJECT *TS_RESP_get_policy(TS_RESP_CTX *ctx);
-static TS_TST_INFO *TS_RESP_create_tst_info(TS_RESP_CTX *ctx,
+static void ts_RESP_CTX_init(TS_RESP_CTX *ctx);
+static void ts_RESP_CTX_cleanup(TS_RESP_CTX *ctx);
+static int ts_RESP_check_request(TS_RESP_CTX *ctx);
+static ASN1_OBJECT *ts_RESP_get_policy(TS_RESP_CTX *ctx);
+static TS_TST_INFO *ts_RESP_create_tst_info(TS_RESP_CTX *ctx,
ASN1_OBJECT *policy);
-static int TS_RESP_process_extensions(TS_RESP_CTX *ctx);
-static int TS_RESP_sign(TS_RESP_CTX *ctx);
+static int ts_RESP_process_extensions(TS_RESP_CTX *ctx);
+static int ts_RESP_sign(TS_RESP_CTX *ctx);
-static ESS_SIGNING_CERT *ESS_SIGNING_CERT_new_init(X509 *signcert,
+static ESS_SIGNING_CERT *ess_SIGNING_CERT_new_init(X509 *signcert,
STACK_OF(X509) *certs);
-static ESS_CERT_ID *ESS_CERT_ID_new_init(X509 *cert, int issuer_needed);
-static int TS_TST_INFO_content_new(PKCS7 *p7);
-static int ESS_add_signing_cert(PKCS7_SIGNER_INFO *si, ESS_SIGNING_CERT *sc);
+static ESS_CERT_ID *ess_CERT_ID_new_init(X509 *cert, int issuer_needed);
+static int ts_TST_INFO_content_new(PKCS7 *p7);
+static int ess_add_signing_cert(PKCS7_SIGNER_INFO *si, ESS_SIGNING_CERT *sc);
+
+static ESS_SIGNING_CERT_V2 *ess_signing_cert_v2_new_init(const EVP_MD *hash_alg,
+ X509 *signcert,
+ STACK_OF(X509)
+ *certs);
+static ESS_CERT_ID_V2 *ess_cert_id_v2_new_init(const EVP_MD *hash_alg,
+ X509 *cert, int issuer_needed);
+static int ess_add_signing_cert_v2(PKCS7_SIGNER_INFO *si,
+ ESS_SIGNING_CERT_V2 *sc);
static ASN1_GENERALIZEDTIME
*TS_RESP_set_genTime_with_precision(ASN1_GENERALIZEDTIME *, long, long,
unsigned);
-/* Default callbacks for response generation. */
-
+/* Default callback for response generation. */
static ASN1_INTEGER *def_serial_cb(struct TS_resp_ctx *ctx, void *data)
{
ASN1_INTEGER *serial = ASN1_INTEGER_new();
- if (!serial)
+
+ if (serial == NULL)
goto err;
if (!ASN1_INTEGER_set(serial, 1))
goto err;
return serial;
+
err:
TSerr(TS_F_DEF_SERIAL_CB, ERR_R_MALLOC_FAILURE);
TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
@@ -112,7 +68,6 @@ static ASN1_INTEGER *def_serial_cb(struct TS_resp_ctx *ctx, void *data)
#if defined(OPENSSL_SYS_UNIX)
-/* Use the gettimeofday function call. */
static int def_time_cb(struct TS_resp_ctx *ctx, void *data,
long *sec, long *usec)
{
@@ -124,7 +79,6 @@ static int def_time_cb(struct TS_resp_ctx *ctx, void *data,
TS_RESP_CTX_add_failure_info(ctx, TS_INFO_TIME_NOT_AVAILABLE);
return 0;
}
- /* Return time to caller. */
*sec = tv.tv_sec;
*usec = tv.tv_usec;
@@ -133,7 +87,6 @@ static int def_time_cb(struct TS_resp_ctx *ctx, void *data,
#else
-/* Use the time function call that provides only seconds precision. */
static int def_time_cb(struct TS_resp_ctx *ctx, void *data,
long *sec, long *usec)
{
@@ -145,7 +98,6 @@ static int def_time_cb(struct TS_resp_ctx *ctx, void *data,
TS_RESP_CTX_add_failure_info(ctx, TS_INFO_TIME_NOT_AVAILABLE);
return 0;
}
- /* Return time to caller, only second precision. */
*sec = (long)t;
*usec = 0;
@@ -157,7 +109,6 @@ static int def_time_cb(struct TS_resp_ctx *ctx, void *data,
static int def_extension_cb(struct TS_resp_ctx *ctx, X509_EXTENSION *ext,
void *data)
{
- /* No extensions are processed here. */
TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
"Unsupported extension.");
TS_RESP_CTX_add_failure_info(ctx, TS_INFO_UNACCEPTED_EXTENSION);
@@ -166,17 +117,17 @@ static int def_extension_cb(struct TS_resp_ctx *ctx, X509_EXTENSION *ext,
/* TS_RESP_CTX management functions. */
-TS_RESP_CTX *TS_RESP_CTX_new()
+TS_RESP_CTX *TS_RESP_CTX_new(void)
{
TS_RESP_CTX *ctx;
- if (!(ctx = (TS_RESP_CTX *)OPENSSL_malloc(sizeof(TS_RESP_CTX)))) {
+ if ((ctx = OPENSSL_zalloc(sizeof(*ctx))) == NULL) {
TSerr(TS_F_TS_RESP_CTX_NEW, ERR_R_MALLOC_FAILURE);
return NULL;
}
- memset(ctx, 0, sizeof(TS_RESP_CTX));
- /* Setting default callbacks. */
+ ctx->signer_md = EVP_sha256();
+
ctx->serial_cb = def_serial_cb;
ctx->time_cb = def_time_cb;
ctx->extension_cb = def_extension_cb;
@@ -208,28 +159,31 @@ int TS_RESP_CTX_set_signer_cert(TS_RESP_CTX *ctx, X509 *signer)
TS_R_INVALID_SIGNER_CERTIFICATE_PURPOSE);
return 0;
}
- if (ctx->signer_cert)
- X509_free(ctx->signer_cert);
+ X509_free(ctx->signer_cert);
ctx->signer_cert = signer;
- CRYPTO_add(&ctx->signer_cert->references, +1, CRYPTO_LOCK_X509);
+ X509_up_ref(ctx->signer_cert);
return 1;
}
int TS_RESP_CTX_set_signer_key(TS_RESP_CTX *ctx, EVP_PKEY *key)
{
- if (ctx->signer_key)
- EVP_PKEY_free(ctx->signer_key);
+ EVP_PKEY_free(ctx->signer_key);
ctx->signer_key = key;
- CRYPTO_add(&ctx->signer_key->references, +1, CRYPTO_LOCK_EVP_PKEY);
+ EVP_PKEY_up_ref(ctx->signer_key);
return 1;
}
-int TS_RESP_CTX_set_def_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *def_policy)
+int TS_RESP_CTX_set_signer_digest(TS_RESP_CTX *ctx, const EVP_MD *md)
{
- if (ctx->default_policy)
- ASN1_OBJECT_free(ctx->default_policy);
- if (!(ctx->default_policy = OBJ_dup(def_policy)))
+ ctx->signer_md = md;
+ return 1;
+}
+
+int TS_RESP_CTX_set_def_policy(TS_RESP_CTX *ctx, const ASN1_OBJECT *def_policy)
+{
+ ASN1_OBJECT_free(ctx->default_policy);
+ if ((ctx->default_policy = OBJ_dup(def_policy)) == NULL)
goto err;
return 1;
err:
@@ -240,13 +194,11 @@ int TS_RESP_CTX_set_def_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *def_policy)
int TS_RESP_CTX_set_certs(TS_RESP_CTX *ctx, STACK_OF(X509) *certs)
{
- if (ctx->certs) {
- sk_X509_pop_free(ctx->certs, X509_free);
- ctx->certs = NULL;
- }
+ sk_X509_pop_free(ctx->certs, X509_free);
+ ctx->certs = NULL;
if (!certs)
return 1;
- if (!(ctx->certs = X509_chain_up_ref(certs))) {
+ if ((ctx->certs = X509_chain_up_ref(certs)) == NULL) {
TSerr(TS_F_TS_RESP_CTX_SET_CERTS, ERR_R_MALLOC_FAILURE);
return 0;
}
@@ -254,14 +206,14 @@ int TS_RESP_CTX_set_certs(TS_RESP_CTX *ctx, STACK_OF(X509) *certs)
return 1;
}
-int TS_RESP_CTX_add_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *policy)
+int TS_RESP_CTX_add_policy(TS_RESP_CTX *ctx, const ASN1_OBJECT *policy)
{
ASN1_OBJECT *copy = NULL;
- /* Create new policy stack if necessary. */
- if (!ctx->policies && !(ctx->policies = sk_ASN1_OBJECT_new_null()))
+ if (ctx->policies == NULL
+ && (ctx->policies = sk_ASN1_OBJECT_new_null()) == NULL)
goto err;
- if (!(copy = OBJ_dup(policy)))
+ if ((copy = OBJ_dup(policy)) == NULL)
goto err;
if (!sk_ASN1_OBJECT_push(ctx->policies, copy))
goto err;
@@ -275,11 +227,10 @@ int TS_RESP_CTX_add_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *policy)
int TS_RESP_CTX_add_md(TS_RESP_CTX *ctx, const EVP_MD *md)
{
- /* Create new md stack if necessary. */
- if (!ctx->mds && !(ctx->mds = sk_EVP_MD_new_null()))
+ if (ctx->mds == NULL
+ && (ctx->mds = sk_EVP_MD_new_null()) == NULL)
goto err;
- /* Add the shared md, no copy needed. */
- if (!sk_EVP_MD_push(ctx->mds, (EVP_MD *)md))
+ if (!sk_EVP_MD_push(ctx->mds, md))
goto err;
return 1;
@@ -301,14 +252,17 @@ int TS_RESP_CTX_set_accuracy(TS_RESP_CTX *ctx,
{
TS_RESP_CTX_accuracy_free(ctx);
- if (secs && (!(ctx->seconds = ASN1_INTEGER_new())
- || !ASN1_INTEGER_set(ctx->seconds, secs)))
+ if (secs
+ && ((ctx->seconds = ASN1_INTEGER_new()) == NULL
+ || !ASN1_INTEGER_set(ctx->seconds, secs)))
goto err;
- if (millis && (!(ctx->millis = ASN1_INTEGER_new())
- || !ASN1_INTEGER_set(ctx->millis, millis)))
+ if (millis
+ && ((ctx->millis = ASN1_INTEGER_new()) == NULL
+ || !ASN1_INTEGER_set(ctx->millis, millis)))
goto err;
- if (micros && (!(ctx->micros = ASN1_INTEGER_new())
- || !ASN1_INTEGER_set(ctx->micros, micros)))
+ if (micros
+ && ((ctx->micros = ASN1_INTEGER_new()) == NULL
+ || !ASN1_INTEGER_set(ctx->micros, micros)))
goto err;
return 1;
@@ -349,15 +303,16 @@ int TS_RESP_CTX_set_status_info(TS_RESP_CTX *ctx,
ASN1_UTF8STRING *utf8_text = NULL;
int ret = 0;
- if (!(si = TS_STATUS_INFO_new()))
+ if ((si = TS_STATUS_INFO_new()) == NULL)
goto err;
if (!ASN1_INTEGER_set(si->status, status))
goto err;
if (text) {
- if (!(utf8_text = ASN1_UTF8STRING_new())
+ if ((utf8_text = ASN1_UTF8STRING_new()) == NULL
|| !ASN1_STRING_set(utf8_text, text, strlen(text)))
goto err;
- if (!si->text && !(si->text = sk_ASN1_UTF8STRING_new_null()))
+ if (si->text == NULL
+ && (si->text = sk_ASN1_UTF8STRING_new_null()) == NULL)
goto err;
if (!sk_ASN1_UTF8STRING_push(si->text, utf8_text))
goto err;
@@ -378,10 +333,9 @@ int TS_RESP_CTX_set_status_info_cond(TS_RESP_CTX *ctx,
int status, const char *text)
{
int ret = 1;
- TS_STATUS_INFO *si = TS_RESP_get_status_info(ctx->response);
+ TS_STATUS_INFO *si = ctx->response->status_info;
if (ASN1_INTEGER_get(si->status) == TS_STATUS_GRANTED) {
- /* Status has not been set, set it now. */
ret = TS_RESP_CTX_set_status_info(ctx, status, text);
}
return ret;
@@ -389,8 +343,9 @@ int TS_RESP_CTX_set_status_info_cond(TS_RESP_CTX *ctx,
int TS_RESP_CTX_add_failure_info(TS_RESP_CTX *ctx, int failure)
{
- TS_STATUS_INFO *si = TS_RESP_get_status_info(ctx->response);
- if (!si->failure_info && !(si->failure_info = ASN1_BIT_STRING_new()))
+ TS_STATUS_INFO *si = ctx->response->status_info;
+ if (si->failure_info == NULL
+ && (si->failure_info = ASN1_BIT_STRING_new()) == NULL)
goto err;
if (!ASN1_BIT_STRING_set_bit(si->failure_info, failure, 1))
goto err;
@@ -426,48 +381,32 @@ TS_RESP *TS_RESP_create_response(TS_RESP_CTX *ctx, BIO *req_bio)
TS_RESP *response;
int result = 0;
- TS_RESP_CTX_init(ctx);
+ ts_RESP_CTX_init(ctx);
- /* Creating the response object. */
- if (!(ctx->response = TS_RESP_new())) {
+ if ((ctx->response = TS_RESP_new()) == NULL) {
TSerr(TS_F_TS_RESP_CREATE_RESPONSE, ERR_R_MALLOC_FAILURE);
goto end;
}
-
- /* Parsing DER request. */
- if (!(ctx->request = d2i_TS_REQ_bio(req_bio, NULL))) {
+ if ((ctx->request = d2i_TS_REQ_bio(req_bio, NULL)) == NULL) {
TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
- "Bad request format or " "system error.");
+ "Bad request format or system error.");
TS_RESP_CTX_add_failure_info(ctx, TS_INFO_BAD_DATA_FORMAT);
goto end;
}
-
- /* Setting default status info. */
if (!TS_RESP_CTX_set_status_info(ctx, TS_STATUS_GRANTED, NULL))
goto end;
-
- /* Checking the request format. */
- if (!TS_RESP_check_request(ctx))
+ if (!ts_RESP_check_request(ctx))
goto end;
-
- /* Checking acceptable policies. */
- if (!(policy = TS_RESP_get_policy(ctx)))
+ if ((policy = ts_RESP_get_policy(ctx)) == NULL)
goto end;
-
- /* Creating the TS_TST_INFO object. */
- if (!(ctx->tst_info = TS_RESP_create_tst_info(ctx, policy)))
+ if ((ctx->tst_info = ts_RESP_create_tst_info(ctx, policy)) == NULL)
goto end;
-
- /* Processing extensions. */
- if (!TS_RESP_process_extensions(ctx))
+ if (!ts_RESP_process_extensions(ctx))
goto end;
-
- /* Generating the signature. */
- if (!TS_RESP_sign(ctx))
+ if (!ts_RESP_sign(ctx))
goto end;
-
- /* Everything was successful. */
result = 1;
+
end:
if (!result) {
TSerr(TS_F_TS_RESP_CREATE_RESPONSE, TS_R_RESPONSE_SETUP_ERROR);
@@ -483,12 +422,12 @@ TS_RESP *TS_RESP_create_response(TS_RESP_CTX *ctx, BIO *req_bio)
}
response = ctx->response;
ctx->response = NULL; /* Ownership will be returned to caller. */
- TS_RESP_CTX_cleanup(ctx);
+ ts_RESP_CTX_cleanup(ctx);
return response;
}
/* Initializes the variable part of the context. */
-static void TS_RESP_CTX_init(TS_RESP_CTX *ctx)
+static void ts_RESP_CTX_init(TS_RESP_CTX *ctx)
{
ctx->request = NULL;
ctx->response = NULL;
@@ -496,7 +435,7 @@ static void TS_RESP_CTX_init(TS_RESP_CTX *ctx)
}
/* Cleans up the variable part of the context. */
-static void TS_RESP_CTX_cleanup(TS_RESP_CTX *ctx)
+static void ts_RESP_CTX_cleanup(TS_RESP_CTX *ctx)
{
TS_REQ_free(ctx->request);
ctx->request = NULL;
@@ -507,17 +446,16 @@ static void TS_RESP_CTX_cleanup(TS_RESP_CTX *ctx)
}
/* Checks the format and content of the request. */
-static int TS_RESP_check_request(TS_RESP_CTX *ctx)
+static int ts_RESP_check_request(TS_RESP_CTX *ctx)
{
TS_REQ *request = ctx->request;
TS_MSG_IMPRINT *msg_imprint;
X509_ALGOR *md_alg;
int md_alg_id;
const ASN1_OCTET_STRING *digest;
- EVP_MD *md = NULL;
+ const EVP_MD *md = NULL;
int i;
- /* Checking request version. */
if (TS_REQ_get_version(request) != 1) {
TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
"Bad request version.");
@@ -525,12 +463,11 @@ static int TS_RESP_check_request(TS_RESP_CTX *ctx)
return 0;
}
- /* Checking message digest algorithm. */
- msg_imprint = TS_REQ_get_msg_imprint(request);
- md_alg = TS_MSG_IMPRINT_get_algo(msg_imprint);
+ msg_imprint = request->msg_imprint;
+ md_alg = msg_imprint->hash_algo;
md_alg_id = OBJ_obj2nid(md_alg->algorithm);
for (i = 0; !md && i < sk_EVP_MD_num(ctx->mds); ++i) {
- EVP_MD *current_md = sk_EVP_MD_value(ctx->mds, i);
+ const EVP_MD *current_md = sk_EVP_MD_value(ctx->mds, i);
if (md_alg_id == EVP_MD_type(current_md))
md = current_md;
}
@@ -542,7 +479,6 @@ static int TS_RESP_check_request(TS_RESP_CTX *ctx)
return 0;
}
- /* No message digest takes parameter. */
if (md_alg->parameter && ASN1_TYPE_get(md_alg->parameter) != V_ASN1_NULL) {
TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
"Superfluous message digest "
@@ -550,8 +486,7 @@ static int TS_RESP_check_request(TS_RESP_CTX *ctx)
TS_RESP_CTX_add_failure_info(ctx, TS_INFO_BAD_ALG);
return 0;
}
- /* Checking message digest size. */
- digest = TS_MSG_IMPRINT_get_msg(msg_imprint);
+ digest = msg_imprint->hashed_msg;
if (digest->length != EVP_MD_size(md)) {
TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
"Bad message digest.");
@@ -563,9 +498,9 @@ static int TS_RESP_check_request(TS_RESP_CTX *ctx)
}
/* Returns the TSA policy based on the requested and acceptable policies. */
-static ASN1_OBJECT *TS_RESP_get_policy(TS_RESP_CTX *ctx)
+static ASN1_OBJECT *ts_RESP_get_policy(TS_RESP_CTX *ctx)
{
- ASN1_OBJECT *requested = TS_REQ_get_policy_id(ctx->request);
+ ASN1_OBJECT *requested = ctx->request->policy_id;
ASN1_OBJECT *policy = NULL;
int i;
@@ -573,10 +508,6 @@ static ASN1_OBJECT *TS_RESP_get_policy(TS_RESP_CTX *ctx)
TSerr(TS_F_TS_RESP_GET_POLICY, TS_R_INVALID_NULL_POINTER);
return NULL;
}
- /*
- * Return the default policy if none is requested or the default is
- * requested.
- */
if (!requested || !OBJ_cmp(requested, ctx->default_policy))
policy = ctx->default_policy;
@@ -596,7 +527,7 @@ static ASN1_OBJECT *TS_RESP_get_policy(TS_RESP_CTX *ctx)
}
/* Creates the TS_TST_INFO object based on the settings of the context. */
-static TS_TST_INFO *TS_RESP_create_tst_info(TS_RESP_CTX *ctx,
+static TS_TST_INFO *ts_RESP_create_tst_info(TS_RESP_CTX *ctx,
ASN1_OBJECT *policy)
{
int result = 0;
@@ -608,7 +539,7 @@ static TS_TST_INFO *TS_RESP_create_tst_info(TS_RESP_CTX *ctx,
const ASN1_INTEGER *nonce;
GENERAL_NAME *tsa_name = NULL;
- if (!(tst_info = TS_TST_INFO_new()))
+ if ((tst_info = TS_TST_INFO_new()) == NULL)
goto end;
if (!TS_TST_INFO_set_version(tst_info, 1))
goto end;
@@ -616,21 +547,19 @@ static TS_TST_INFO *TS_RESP_create_tst_info(TS_RESP_CTX *ctx,
goto end;
if (!TS_TST_INFO_set_msg_imprint(tst_info, ctx->request->msg_imprint))
goto end;
- if (!(serial = (*ctx->serial_cb) (ctx, ctx->serial_cb_data))
+ if ((serial = ctx->serial_cb(ctx, ctx->serial_cb_data)) == NULL
|| !TS_TST_INFO_set_serial(tst_info, serial))
goto end;
- if (!(*ctx->time_cb) (ctx, ctx->time_cb_data, &sec, &usec)
- || !(asn1_time = TS_RESP_set_genTime_with_precision(NULL,
- sec, usec,
- ctx->clock_precision_digits))
+ if (!ctx->time_cb(ctx, ctx->time_cb_data, &sec, &usec)
+ || (asn1_time =
+ TS_RESP_set_genTime_with_precision(NULL, sec, usec,
+ ctx->clock_precision_digits)) == NULL
|| !TS_TST_INFO_set_time(tst_info, asn1_time))
goto end;
- /* Setting accuracy if needed. */
if ((ctx->seconds || ctx->millis || ctx->micros)
- && !(accuracy = TS_ACCURACY_new()))
+ && (accuracy = TS_ACCURACY_new()) == NULL)
goto end;
-
if (ctx->seconds && !TS_ACCURACY_set_seconds(accuracy, ctx->seconds))
goto end;
if (ctx->millis && !TS_ACCURACY_set_millis(accuracy, ctx->millis))
@@ -640,23 +569,20 @@ static TS_TST_INFO *TS_RESP_create_tst_info(TS_RESP_CTX *ctx,
if (accuracy && !TS_TST_INFO_set_accuracy(tst_info, accuracy))
goto end;
- /* Setting ordering. */
if ((ctx->flags & TS_ORDERING)
&& !TS_TST_INFO_set_ordering(tst_info, 1))
goto end;
- /* Setting nonce if needed. */
- if ((nonce = TS_REQ_get_nonce(ctx->request)) != NULL
+ if ((nonce = ctx->request->nonce) != NULL
&& !TS_TST_INFO_set_nonce(tst_info, nonce))
goto end;
- /* Setting TSA name to subject of signer certificate. */
if (ctx->flags & TS_TSA_NAME) {
- if (!(tsa_name = GENERAL_NAME_new()))
+ if ((tsa_name = GENERAL_NAME_new()) == NULL)
goto end;
tsa_name->type = GEN_DIRNAME;
tsa_name->d.dirn =
- X509_NAME_dup(ctx->signer_cert->cert_info->subject);
+ X509_NAME_dup(X509_get_subject_name(ctx->signer_cert));
if (!tsa_name->d.dirn)
goto end;
if (!TS_TST_INFO_set_tsa(tst_info, tsa_name))
@@ -682,16 +608,16 @@ static TS_TST_INFO *TS_RESP_create_tst_info(TS_RESP_CTX *ctx,
}
/* Processing the extensions of the request. */
-static int TS_RESP_process_extensions(TS_RESP_CTX *ctx)
+static int ts_RESP_process_extensions(TS_RESP_CTX *ctx)
{
- STACK_OF(X509_EXTENSION) *exts = TS_REQ_get_exts(ctx->request);
+ STACK_OF(X509_EXTENSION) *exts = ctx->request->extensions;
int i;
int ok = 1;
for (i = 0; ok && i < sk_X509_EXTENSION_num(exts); ++i) {
X509_EXTENSION *ext = sk_X509_EXTENSION_value(exts, i);
/*
- * XXXXX The last argument was previously (void *)ctx->extension_cb,
+ * The last argument was previously (void *)ctx->extension_cb,
* but ISO C doesn't permit converting a function pointer to void *.
* For lack of better information, I'm placing a NULL there instead.
* The callback can pick its own address out from the ctx anyway...
@@ -703,37 +629,33 @@ static int TS_RESP_process_extensions(TS_RESP_CTX *ctx)
}
/* Functions for signing the TS_TST_INFO structure of the context. */
-static int TS_RESP_sign(TS_RESP_CTX *ctx)
+static int ts_RESP_sign(TS_RESP_CTX *ctx)
{
int ret = 0;
PKCS7 *p7 = NULL;
PKCS7_SIGNER_INFO *si;
STACK_OF(X509) *certs; /* Certificates to include in sc. */
+ ESS_SIGNING_CERT_V2 *sc2 = NULL;
ESS_SIGNING_CERT *sc = NULL;
ASN1_OBJECT *oid;
BIO *p7bio = NULL;
int i;
- /* Check if signcert and pkey match. */
if (!X509_check_private_key(ctx->signer_cert, ctx->signer_key)) {
TSerr(TS_F_TS_RESP_SIGN, TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE);
goto err;
}
- /* Create a new PKCS7 signed object. */
- if (!(p7 = PKCS7_new())) {
+ if ((p7 = PKCS7_new()) == NULL) {
TSerr(TS_F_TS_RESP_SIGN, ERR_R_MALLOC_FAILURE);
goto err;
}
if (!PKCS7_set_type(p7, NID_pkcs7_signed))
goto err;
-
- /* Force SignedData version to be 3 instead of the default 1. */
if (!ASN1_INTEGER_set(p7->d.sign->version, 3))
goto err;
- /* Add signer certificate and optional certificate chain. */
- if (TS_REQ_get_cert_req(ctx->request)) {
+ if (ctx->request->cert_req) {
PKCS7_add_certificate(p7, ctx->signer_cert);
if (ctx->certs) {
for (i = 0; i < sk_X509_num(ctx->certs); ++i) {
@@ -743,14 +665,12 @@ static int TS_RESP_sign(TS_RESP_CTX *ctx)
}
}
- /* Add a new signer info. */
- if (!(si = PKCS7_add_signature(p7, ctx->signer_cert,
- ctx->signer_key, EVP_sha1()))) {
+ if ((si = PKCS7_add_signature(p7, ctx->signer_cert,
+ ctx->signer_key, ctx->signer_md)) == NULL) {
TSerr(TS_F_TS_RESP_SIGN, TS_R_PKCS7_ADD_SIGNATURE_ERROR);
goto err;
}
- /* Add content type signed attribute to the signer info. */
oid = OBJ_nid2obj(NID_id_smime_ct_TSTInfo);
if (!PKCS7_add_signed_attribute(si, NID_pkcs9_contentType,
V_ASN1_OBJECT, oid)) {
@@ -758,43 +678,42 @@ static int TS_RESP_sign(TS_RESP_CTX *ctx)
goto err;
}
- /*
- * Create the ESS SigningCertificate attribute which contains the signer
- * certificate id and optionally the certificate chain.
- */
certs = ctx->flags & TS_ESS_CERT_ID_CHAIN ? ctx->certs : NULL;
- if (!(sc = ESS_SIGNING_CERT_new_init(ctx->signer_cert, certs)))
- goto err;
+ if (ctx->ess_cert_id_digest == NULL
+ || ctx->ess_cert_id_digest == EVP_sha1()) {
+ if ((sc = ess_SIGNING_CERT_new_init(ctx->signer_cert, certs)) == NULL)
+ goto err;
- /* Add SigningCertificate signed attribute to the signer info. */
- if (!ESS_add_signing_cert(si, sc)) {
- TSerr(TS_F_TS_RESP_SIGN, TS_R_ESS_ADD_SIGNING_CERT_ERROR);
- goto err;
+ if (!ess_add_signing_cert(si, sc)) {
+ TSerr(TS_F_TS_RESP_SIGN, TS_R_ESS_ADD_SIGNING_CERT_ERROR);
+ goto err;
+ }
+ } else {
+ sc2 = ess_signing_cert_v2_new_init(ctx->ess_cert_id_digest,
+ ctx->signer_cert, certs);
+ if (sc2 == NULL)
+ goto err;
+
+ if (!ess_add_signing_cert_v2(si, sc2)) {
+ TSerr(TS_F_TS_RESP_SIGN, TS_R_ESS_ADD_SIGNING_CERT_V2_ERROR);
+ goto err;
+ }
}
- /* Add a new empty NID_id_smime_ct_TSTInfo encapsulated content. */
- if (!TS_TST_INFO_content_new(p7))
+ if (!ts_TST_INFO_content_new(p7))
goto err;
-
- /* Add the DER encoded tst_info to the PKCS7 structure. */
- if (!(p7bio = PKCS7_dataInit(p7, NULL))) {
+ if ((p7bio = PKCS7_dataInit(p7, NULL)) == NULL) {
TSerr(TS_F_TS_RESP_SIGN, ERR_R_MALLOC_FAILURE);
goto err;
}
-
- /* Convert tst_info to DER. */
if (!i2d_TS_TST_INFO_bio(p7bio, ctx->tst_info)) {
TSerr(TS_F_TS_RESP_SIGN, TS_R_TS_DATASIGN);
goto err;
}
-
- /* Create the signature and add it to the signer info. */
if (!PKCS7_dataFinal(p7, p7bio)) {
TSerr(TS_F_TS_RESP_SIGN, TS_R_TS_DATASIGN);
goto err;
}
-
- /* Set new PKCS7 and TST_INFO objects. */
TS_RESP_set_tst_info(ctx->response, p7, ctx->tst_info);
p7 = NULL; /* Ownership is lost. */
ctx->tst_info = NULL; /* Ownership is lost. */
@@ -806,32 +725,31 @@ static int TS_RESP_sign(TS_RESP_CTX *ctx)
"Error during signature "
"generation.");
BIO_free_all(p7bio);
+ ESS_SIGNING_CERT_V2_free(sc2);
ESS_SIGNING_CERT_free(sc);
PKCS7_free(p7);
return ret;
}
-static ESS_SIGNING_CERT *ESS_SIGNING_CERT_new_init(X509 *signcert,
+static ESS_SIGNING_CERT *ess_SIGNING_CERT_new_init(X509 *signcert,
STACK_OF(X509) *certs)
{
ESS_CERT_ID *cid;
ESS_SIGNING_CERT *sc = NULL;
int i;
- /* Creating the ESS_CERT_ID stack. */
- if (!(sc = ESS_SIGNING_CERT_new()))
+ if ((sc = ESS_SIGNING_CERT_new()) == NULL)
goto err;
- if (!sc->cert_ids && !(sc->cert_ids = sk_ESS_CERT_ID_new_null()))
+ if (sc->cert_ids == NULL
+ && (sc->cert_ids = sk_ESS_CERT_ID_new_null()) == NULL)
goto err;
- /* Adding the signing certificate id. */
- if (!(cid = ESS_CERT_ID_new_init(signcert, 0))
+ if ((cid = ess_CERT_ID_new_init(signcert, 0)) == NULL
|| !sk_ESS_CERT_ID_push(sc->cert_ids, cid))
goto err;
- /* Adding the certificate chain ids. */
for (i = 0; i < sk_X509_num(certs); ++i) {
X509 *cert = sk_X509_value(certs, i);
- if (!(cid = ESS_CERT_ID_new_init(cert, 1))
+ if ((cid = ess_CERT_ID_new_init(cert, 1)) == NULL
|| !sk_ESS_CERT_ID_push(sc->cert_ids, cid))
goto err;
}
@@ -843,39 +761,36 @@ static ESS_SIGNING_CERT *ESS_SIGNING_CERT_new_init(X509 *signcert,
return NULL;
}
-static ESS_CERT_ID *ESS_CERT_ID_new_init(X509 *cert, int issuer_needed)
+static ESS_CERT_ID *ess_CERT_ID_new_init(X509 *cert, int issuer_needed)
{
ESS_CERT_ID *cid = NULL;
GENERAL_NAME *name = NULL;
+ unsigned char cert_sha1[SHA_DIGEST_LENGTH];
- /* Recompute SHA1 hash of certificate if necessary (side effect). */
+ /* Call for side-effect of computing hash and caching extensions */
X509_check_purpose(cert, -1, 0);
-
- if (!(cid = ESS_CERT_ID_new()))
+ if ((cid = ESS_CERT_ID_new()) == NULL)
goto err;
- if (!ASN1_OCTET_STRING_set(cid->hash, cert->sha1_hash,
- sizeof(cert->sha1_hash)))
+ X509_digest(cert, EVP_sha1(), cert_sha1, NULL);
+ if (!ASN1_OCTET_STRING_set(cid->hash, cert_sha1, SHA_DIGEST_LENGTH))
goto err;
/* Setting the issuer/serial if requested. */
if (issuer_needed) {
- /* Creating issuer/serial structure. */
- if (!cid->issuer_serial
- && !(cid->issuer_serial = ESS_ISSUER_SERIAL_new()))
+ if (cid->issuer_serial == NULL
+ && (cid->issuer_serial = ESS_ISSUER_SERIAL_new()) == NULL)
goto err;
- /* Creating general name from the certificate issuer. */
- if (!(name = GENERAL_NAME_new()))
+ if ((name = GENERAL_NAME_new()) == NULL)
goto err;
name->type = GEN_DIRNAME;
- if (!(name->d.dirn = X509_NAME_dup(cert->cert_info->issuer)))
+ if ((name->d.dirn = X509_NAME_dup(X509_get_issuer_name(cert))) == NULL)
goto err;
if (!sk_GENERAL_NAME_push(cid->issuer_serial->issuer, name))
goto err;
name = NULL; /* Ownership is lost. */
- /* Setting the serial number. */
ASN1_INTEGER_free(cid->issuer_serial->serial);
if (!(cid->issuer_serial->serial =
- ASN1_INTEGER_dup(cert->cert_info->serialNumber)))
+ ASN1_INTEGER_dup(X509_get_serialNumber(cert))))
goto err;
}
@@ -887,18 +802,18 @@ static ESS_CERT_ID *ESS_CERT_ID_new_init(X509 *cert, int issuer_needed)
return NULL;
}
-static int TS_TST_INFO_content_new(PKCS7 *p7)
+static int ts_TST_INFO_content_new(PKCS7 *p7)
{
PKCS7 *ret = NULL;
ASN1_OCTET_STRING *octet_string = NULL;
/* Create new encapsulated NID_id_smime_ct_TSTInfo content. */
- if (!(ret = PKCS7_new()))
+ if ((ret = PKCS7_new()) == NULL)
goto err;
- if (!(ret->d.other = ASN1_TYPE_new()))
+ if ((ret->d.other = ASN1_TYPE_new()) == NULL)
goto err;
ret->type = OBJ_nid2obj(NID_id_smime_ct_TSTInfo);
- if (!(octet_string = ASN1_OCTET_STRING_new()))
+ if ((octet_string = ASN1_OCTET_STRING_new()) == NULL)
goto err;
ASN1_TYPE_set(ret->d.other, V_ASN1_OCTET_STRING, octet_string);
octet_string = NULL;
@@ -914,20 +829,20 @@ static int TS_TST_INFO_content_new(PKCS7 *p7)
return 0;
}
-static int ESS_add_signing_cert(PKCS7_SIGNER_INFO *si, ESS_SIGNING_CERT *sc)
+static int ess_add_signing_cert(PKCS7_SIGNER_INFO *si, ESS_SIGNING_CERT *sc)
{
ASN1_STRING *seq = NULL;
unsigned char *p, *pp = NULL;
int len;
len = i2d_ESS_SIGNING_CERT(sc, NULL);
- if (!(pp = (unsigned char *)OPENSSL_malloc(len))) {
+ if ((pp = OPENSSL_malloc(len)) == NULL) {
TSerr(TS_F_ESS_ADD_SIGNING_CERT, ERR_R_MALLOC_FAILURE);
goto err;
}
p = pp;
i2d_ESS_SIGNING_CERT(sc, &p);
- if (!(seq = ASN1_STRING_new()) || !ASN1_STRING_set(seq, pp, len)) {
+ if ((seq = ASN1_STRING_new()) == NULL || !ASN1_STRING_set(seq, pp, len)) {
TSerr(TS_F_ESS_ADD_SIGNING_CERT, ERR_R_MALLOC_FAILURE);
goto err;
}
@@ -943,13 +858,136 @@ static int ESS_add_signing_cert(PKCS7_SIGNER_INFO *si, ESS_SIGNING_CERT *sc)
return 0;
}
-static ASN1_GENERALIZEDTIME
-*TS_RESP_set_genTime_with_precision(ASN1_GENERALIZEDTIME *asn1_time,
- long sec, long usec, unsigned precision)
+static ESS_SIGNING_CERT_V2 *ess_signing_cert_v2_new_init(const EVP_MD *hash_alg,
+ X509 *signcert,
+ STACK_OF(X509) *certs)
+{
+ ESS_CERT_ID_V2 *cid = NULL;
+ ESS_SIGNING_CERT_V2 *sc = NULL;
+ int i;
+
+ if ((sc = ESS_SIGNING_CERT_V2_new()) == NULL)
+ goto err;
+ if ((cid = ess_cert_id_v2_new_init(hash_alg, signcert, 0)) == NULL)
+ goto err;
+ if (!sk_ESS_CERT_ID_V2_push(sc->cert_ids, cid))
+ goto err;
+ cid = NULL;
+
+ for (i = 0; i < sk_X509_num(certs); ++i) {
+ X509 *cert = sk_X509_value(certs, i);
+
+ if ((cid = ess_cert_id_v2_new_init(hash_alg, cert, 1)) == NULL)
+ goto err;
+ if (!sk_ESS_CERT_ID_V2_push(sc->cert_ids, cid))
+ goto err;
+ cid = NULL;
+ }
+
+ return sc;
+ err:
+ ESS_SIGNING_CERT_V2_free(sc);
+ ESS_CERT_ID_V2_free(cid);
+ TSerr(TS_F_ESS_SIGNING_CERT_V2_NEW_INIT, ERR_R_MALLOC_FAILURE);
+ return NULL;
+}
+
+static ESS_CERT_ID_V2 *ess_cert_id_v2_new_init(const EVP_MD *hash_alg,
+ X509 *cert, int issuer_needed)
+{
+ ESS_CERT_ID_V2 *cid = NULL;
+ GENERAL_NAME *name = NULL;
+ unsigned char hash[EVP_MAX_MD_SIZE];
+ unsigned int hash_len = sizeof(hash);
+ X509_ALGOR *alg = NULL;
+
+ memset(hash, 0, sizeof(hash));
+
+ if ((cid = ESS_CERT_ID_V2_new()) == NULL)
+ goto err;
+
+ if (hash_alg != EVP_sha256()) {
+ alg = X509_ALGOR_new();
+ if (alg == NULL)
+ goto err;
+ X509_ALGOR_set_md(alg, hash_alg);
+ if (alg->algorithm == NULL)
+ goto err;
+ cid->hash_alg = alg;
+ alg = NULL;
+ } else {
+ cid->hash_alg = NULL;
+ }
+
+ if (!X509_digest(cert, hash_alg, hash, &hash_len))
+ goto err;
+
+ if (!ASN1_OCTET_STRING_set(cid->hash, hash, hash_len))
+ goto err;
+
+ if (issuer_needed) {
+ if ((cid->issuer_serial = ESS_ISSUER_SERIAL_new()) == NULL)
+ goto err;
+ if ((name = GENERAL_NAME_new()) == NULL)
+ goto err;
+ name->type = GEN_DIRNAME;
+ if ((name->d.dirn = X509_NAME_dup(X509_get_issuer_name(cert))) == NULL)
+ goto err;
+ if (!sk_GENERAL_NAME_push(cid->issuer_serial->issuer, name))
+ goto err;
+ name = NULL; /* Ownership is lost. */
+ ASN1_INTEGER_free(cid->issuer_serial->serial);
+ cid->issuer_serial->serial =
+ ASN1_INTEGER_dup(X509_get_serialNumber(cert));
+ if (cid->issuer_serial->serial == NULL)
+ goto err;
+ }
+
+ return cid;
+ err:
+ X509_ALGOR_free(alg);
+ GENERAL_NAME_free(name);
+ ESS_CERT_ID_V2_free(cid);
+ TSerr(TS_F_ESS_CERT_ID_V2_NEW_INIT, ERR_R_MALLOC_FAILURE);
+ return NULL;
+}
+
+static int ess_add_signing_cert_v2(PKCS7_SIGNER_INFO *si,
+ ESS_SIGNING_CERT_V2 *sc)
+{
+ ASN1_STRING *seq = NULL;
+ unsigned char *p, *pp = NULL;
+ int len = i2d_ESS_SIGNING_CERT_V2(sc, NULL);
+
+ if ((pp = OPENSSL_malloc(len)) == NULL) {
+ TSerr(TS_F_ESS_ADD_SIGNING_CERT_V2, ERR_R_MALLOC_FAILURE);
+ goto err;
+ }
+
+ p = pp;
+ i2d_ESS_SIGNING_CERT_V2(sc, &p);
+ if ((seq = ASN1_STRING_new()) == NULL || !ASN1_STRING_set(seq, pp, len)) {
+ TSerr(TS_F_ESS_ADD_SIGNING_CERT_V2, ERR_R_MALLOC_FAILURE);
+ goto err;
+ }
+
+ OPENSSL_free(pp);
+ pp = NULL;
+ return PKCS7_add_signed_attribute(si,
+ NID_id_smime_aa_signingCertificateV2,
+ V_ASN1_SEQUENCE, seq);
+ err:
+ ASN1_STRING_free(seq);
+ OPENSSL_free(pp);
+ return 0;
+}
+
+static ASN1_GENERALIZEDTIME *TS_RESP_set_genTime_with_precision(
+ ASN1_GENERALIZEDTIME *asn1_time, long sec, long usec,
+ unsigned precision)
{
time_t time_sec = (time_t)sec;
- struct tm *tm = NULL;
- struct tm result = {0};
+ struct tm *tm = NULL, tm_result;
char genTime_str[17 + TS_MAX_CLOCK_PRECISION_DIGITS];
char *p = genTime_str;
char *p_end = genTime_str + sizeof(genTime_str);
@@ -957,7 +995,7 @@ static ASN1_GENERALIZEDTIME
if (precision > TS_MAX_CLOCK_PRECISION_DIGITS)
goto err;
- if (!(tm = OPENSSL_gmtime(&time_sec, &result)))
+ if ((tm = OPENSSL_gmtime(&time_sec, &tm_result)) == NULL)
goto err;
/*
@@ -972,12 +1010,7 @@ static ASN1_GENERALIZEDTIME
tm->tm_year + 1900, tm->tm_mon + 1, tm->tm_mday,
tm->tm_hour, tm->tm_min, tm->tm_sec);
if (precision > 0) {
- /* Add fraction of seconds (leave space for dot and null). */
BIO_snprintf(p, 2 + precision, ".%06ld", usec);
- /*
- * We cannot use the snprintf return value, because it might have
- * been truncated.
- */
p += strlen(p);
/*
@@ -996,27 +1029,29 @@ static ASN1_GENERALIZEDTIME
* this loop even if all the digits are zero.
*/
while (*--p == '0')
- /*
- * empty
- */ ;
- /* p points to either the dot or the last non-zero digit. */
+ continue;
if (*p != '.')
++p;
}
- /* Add the trailing Z and the terminating null. */
*p++ = 'Z';
*p++ = '\0';
- /* Now call OpenSSL to check and set our genTime value */
- if (!asn1_time && !(asn1_time = M_ASN1_GENERALIZEDTIME_new()))
+ if (asn1_time == NULL
+ && (asn1_time = ASN1_GENERALIZEDTIME_new()) == NULL)
goto err;
if (!ASN1_GENERALIZEDTIME_set_string(asn1_time, genTime_str)) {
ASN1_GENERALIZEDTIME_free(asn1_time);
goto err;
}
-
return asn1_time;
+
err:
TSerr(TS_F_TS_RESP_SET_GENTIME_WITH_PRECISION, TS_R_COULD_NOT_SET_TIME);
return NULL;
}
+
+int TS_RESP_CTX_set_ess_cert_id_digest(TS_RESP_CTX *ctx, const EVP_MD *md)
+{
+ ctx->ess_cert_id_digest = md;
+ return 1;
+}
diff --git a/crypto/ts/ts_rsp_utils.c b/crypto/ts/ts_rsp_utils.c
index f6f63329a0c2..3ecee39a22c2 100644
--- a/crypto/ts/ts_rsp_utils.c
+++ b/crypto/ts/ts_rsp_utils.c
@@ -1,69 +1,18 @@
-/* crypto/ts/ts_resp_utils.c */
/*
- * Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL project
- * 2002.
- */
-/* ====================================================================
- * Copyright (c) 2006 The OpenSSL Project. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in
- * the documentation and/or other materials provided with the
- * distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- * software must display the following acknowledgment:
- * "This product includes software developed by the OpenSSL Project
- * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- * endorse or promote products derived from this software without
- * prior written permission. For written permission, please contact
- * licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- * nor may "OpenSSL" appear in their names without prior written
- * permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- * acknowledgment:
- * "This product includes software developed by the OpenSSL Project
- * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com). This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
+ * Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
*
+ * Licensed under the OpenSSL license (the "License"). You may not use
+ * this file except in compliance with the License. You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
*/
#include <stdio.h>
-#include "cryptlib.h"
+#include "internal/cryptlib.h"
#include <openssl/objects.h>
#include <openssl/ts.h>
#include <openssl/pkcs7.h>
-
-/* Function definitions. */
+#include "ts_lcl.h"
int TS_RESP_set_status_info(TS_RESP *a, TS_STATUS_INFO *status_info)
{
@@ -90,7 +39,6 @@ TS_STATUS_INFO *TS_RESP_get_status_info(TS_RESP *a)
/* Caller loses ownership of PKCS7 and TS_TST_INFO objects. */
void TS_RESP_set_tst_info(TS_RESP *a, PKCS7 *p7, TS_TST_INFO *tst_info)
{
- /* Set new PKCS7 and TST_INFO objects. */
PKCS7_free(a->token);
a->token = p7;
TS_TST_INFO_free(a->tst_info);
@@ -186,7 +134,7 @@ int TS_TST_INFO_set_time(TS_TST_INFO *a, const ASN1_GENERALIZEDTIME *gtime)
if (a->time == gtime)
return 1;
- new_time = M_ASN1_GENERALIZEDTIME_dup(gtime);
+ new_time = ASN1_STRING_dup(gtime);
if (new_time == NULL) {
TSerr(TS_F_TS_TST_INFO_SET_TIME, ERR_R_MALLOC_FAILURE);
return 0;
@@ -365,7 +313,7 @@ int TS_TST_INFO_get_ext_by_NID(TS_TST_INFO *a, int nid, int lastpos)
return X509v3_get_ext_by_NID(a->extensions, nid, lastpos);
}
-int TS_TST_INFO_get_ext_by_OBJ(TS_TST_INFO *a, ASN1_OBJECT *obj, int lastpos)
+int TS_TST_INFO_get_ext_by_OBJ(TS_TST_INFO *a, const ASN1_OBJECT *obj, int lastpos)
{
return X509v3_get_ext_by_OBJ(a->extensions, obj, lastpos);
}
@@ -394,3 +342,24 @@ void *TS_TST_INFO_get_ext_d2i(TS_TST_INFO *a, int nid, int *crit, int *idx)
{
return X509V3_get_d2i(a->extensions, nid, crit, idx);
}
+
+int TS_STATUS_INFO_set_status(TS_STATUS_INFO *a, int i)
+{
+ return ASN1_INTEGER_set(a->status, i);
+}
+
+const ASN1_INTEGER *TS_STATUS_INFO_get0_status(const TS_STATUS_INFO *a)
+{
+ return a->status;
+}
+
+const STACK_OF(ASN1_UTF8STRING) *
+TS_STATUS_INFO_get0_text(const TS_STATUS_INFO *a)
+{
+ return a->text;
+}
+
+const ASN1_BIT_STRING *TS_STATUS_INFO_get0_failure_info(const TS_STATUS_INFO *a)
+{
+ return a->failure_info;
+}
diff --git a/crypto/ts/ts_rsp_verify.c b/crypto/ts/ts_rsp_verify.c
index 7918236287f3..9deda81b07fb 100644
--- a/crypto/ts/ts_rsp_verify.c
+++ b/crypto/ts/ts_rsp_verify.c
@@ -1,99 +1,56 @@
-/* crypto/ts/ts_resp_verify.c */
/*
- * Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL project
- * 2002.
- */
-/* ====================================================================
- * Copyright (c) 2006 The OpenSSL Project. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in
- * the documentation and/or other materials provided with the
- * distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- * software must display the following acknowledgment:
- * "This product includes software developed by the OpenSSL Project
- * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- * endorse or promote products derived from this software without
- * prior written permission. For written permission, please contact
- * licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- * nor may "OpenSSL" appear in their names without prior written
- * permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- * acknowledgment:
- * "This product includes software developed by the OpenSSL Project
- * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com). This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
+ * Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
*
+ * Licensed under the OpenSSL license (the "License"). You may not use
+ * this file except in compliance with the License. You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
*/
#include <stdio.h>
-#include "cryptlib.h"
+#include "internal/cryptlib.h"
#include <openssl/objects.h>
#include <openssl/ts.h>
#include <openssl/pkcs7.h>
+#include "ts_lcl.h"
-/* Private function declarations. */
-
-static int TS_verify_cert(X509_STORE *store, STACK_OF(X509) *untrusted,
+static int ts_verify_cert(X509_STORE *store, STACK_OF(X509) *untrusted,
X509 *signer, STACK_OF(X509) **chain);
-static int TS_check_signing_certs(PKCS7_SIGNER_INFO *si,
+static int ts_check_signing_certs(PKCS7_SIGNER_INFO *si,
STACK_OF(X509) *chain);
-static ESS_SIGNING_CERT *ESS_get_signing_cert(PKCS7_SIGNER_INFO *si);
-static int TS_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert);
-static int TS_issuer_serial_cmp(ESS_ISSUER_SERIAL *is, X509_CINF *cinfo);
-static int int_TS_RESP_verify_token(TS_VERIFY_CTX *ctx,
+static ESS_SIGNING_CERT *ess_get_signing_cert(PKCS7_SIGNER_INFO *si);
+static int ts_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert);
+static int ts_issuer_serial_cmp(ESS_ISSUER_SERIAL *is, X509 *cert);
+static int int_ts_RESP_verify_token(TS_VERIFY_CTX *ctx,
PKCS7 *token, TS_TST_INFO *tst_info);
-static int TS_check_status_info(TS_RESP *response);
-static char *TS_get_status_text(STACK_OF(ASN1_UTF8STRING) *text);
-static int TS_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info);
-static int TS_compute_imprint(BIO *data, TS_TST_INFO *tst_info,
+static int ts_check_status_info(TS_RESP *response);
+static char *ts_get_status_text(STACK_OF(ASN1_UTF8STRING) *text);
+static int ts_check_policy(const ASN1_OBJECT *req_oid,
+ const TS_TST_INFO *tst_info);
+static int ts_compute_imprint(BIO *data, TS_TST_INFO *tst_info,
X509_ALGOR **md_alg,
unsigned char **imprint, unsigned *imprint_len);
-static int TS_check_imprints(X509_ALGOR *algor_a,
- unsigned char *imprint_a, unsigned len_a,
+static int ts_check_imprints(X509_ALGOR *algor_a,
+ const unsigned char *imprint_a, unsigned len_a,
TS_TST_INFO *tst_info);
-static int TS_check_nonces(const ASN1_INTEGER *a, TS_TST_INFO *tst_info);
-static int TS_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer);
-static int TS_find_name(STACK_OF(GENERAL_NAME) *gen_names,
+static int ts_check_nonces(const ASN1_INTEGER *a, TS_TST_INFO *tst_info);
+static int ts_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer);
+static int ts_find_name(STACK_OF(GENERAL_NAME) *gen_names,
GENERAL_NAME *name);
+static int ts_find_cert_v2(STACK_OF(ESS_CERT_ID_V2) *cert_ids, X509 *cert);
+static ESS_SIGNING_CERT_V2 *ess_get_signing_cert_v2(PKCS7_SIGNER_INFO *si);
+
+/*
+ * This must be large enough to hold all values in ts_status_text (with
+ * comma separator) or all text fields in ts_failure_info (also with comma).
+ */
+#define TS_STATUS_BUF_SIZE 256
/*
* Local mapping between response codes and descriptions.
- * Don't forget to change TS_STATUS_BUF_SIZE when modifying
- * the elements of this array.
*/
-static const char *TS_status_text[] = { "granted",
+static const char *ts_status_text[] = {
+ "granted",
"grantedWithMods",
"rejection",
"waiting",
@@ -101,48 +58,22 @@ static const char *TS_status_text[] = { "granted",
"revocationNotification"
};
-#define TS_STATUS_TEXT_SIZE (sizeof(TS_status_text)/sizeof(*TS_status_text))
-
-/*
- * This must be greater or equal to the sum of the strings in TS_status_text
- * plus the number of its elements.
- */
-#define TS_STATUS_BUF_SIZE 256
+#define TS_STATUS_TEXT_SIZE OSSL_NELEM(ts_status_text)
static struct {
int code;
const char *text;
-} TS_failure_info[] = {
- {
- TS_INFO_BAD_ALG, "badAlg"
- },
- {
- TS_INFO_BAD_REQUEST, "badRequest"
- },
- {
- TS_INFO_BAD_DATA_FORMAT, "badDataFormat"
- },
- {
- TS_INFO_TIME_NOT_AVAILABLE, "timeNotAvailable"
- },
- {
- TS_INFO_UNACCEPTED_POLICY, "unacceptedPolicy"
- },
- {
- TS_INFO_UNACCEPTED_EXTENSION, "unacceptedExtension"
- },
- {
- TS_INFO_ADD_INFO_NOT_AVAILABLE, "addInfoNotAvailable"
- },
- {
- TS_INFO_SYSTEM_FAILURE, "systemFailure"
- }
+} ts_failure_info[] = {
+ {TS_INFO_BAD_ALG, "badAlg"},
+ {TS_INFO_BAD_REQUEST, "badRequest"},
+ {TS_INFO_BAD_DATA_FORMAT, "badDataFormat"},
+ {TS_INFO_TIME_NOT_AVAILABLE, "timeNotAvailable"},
+ {TS_INFO_UNACCEPTED_POLICY, "unacceptedPolicy"},
+ {TS_INFO_UNACCEPTED_EXTENSION, "unacceptedExtension"},
+ {TS_INFO_ADD_INFO_NOT_AVAILABLE, "addInfoNotAvailable"},
+ {TS_INFO_SYSTEM_FAILURE, "systemFailure"}
};
-#define TS_FAILURE_INFO_SIZE (sizeof(TS_failure_info) / \
- sizeof(*TS_failure_info))
-
-/* Functions for verifying a signed TS_TST_INFO structure. */
/*-
* This function carries out the following tasks:
@@ -173,22 +104,16 @@ int TS_RESP_verify_signature(PKCS7 *token, STACK_OF(X509) *certs,
TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_INVALID_NULL_POINTER);
goto err;
}
-
- /* Check for the correct content type */
if (!PKCS7_type_is_signed(token)) {
TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_WRONG_CONTENT_TYPE);
goto err;
}
-
- /* Check if there is one and only one signer. */
sinfos = PKCS7_get_signer_info(token);
if (!sinfos || sk_PKCS7_SIGNER_INFO_num(sinfos) != 1) {
TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_THERE_MUST_BE_ONE_SIGNER);
goto err;
}
si = sk_PKCS7_SIGNER_INFO_value(sinfos, 0);
-
- /* Check for no content: no data to verify signature. */
if (PKCS7_get_detached(token)) {
TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_NO_CONTENT);
goto err;
@@ -203,35 +128,26 @@ int TS_RESP_verify_signature(PKCS7 *token, STACK_OF(X509) *certs,
goto err;
signer = sk_X509_value(signers, 0);
- /* Now verify the certificate. */
- if (!TS_verify_cert(store, certs, signer, &chain))
+ if (!ts_verify_cert(store, certs, signer, &chain))
goto err;
-
- /*
- * Check if the signer certificate is consistent with the ESS extension.
- */
- if (!TS_check_signing_certs(si, chain))
+ if (!ts_check_signing_certs(si, chain))
goto err;
-
- /* Creating the message digest. */
p7bio = PKCS7_dataInit(token, NULL);
/* We now have to 'read' from p7bio to calculate digests etc. */
- while ((i = BIO_read(p7bio, buf, sizeof(buf))) > 0) ;
+ while ((i = BIO_read(p7bio, buf, sizeof(buf))) > 0)
+ continue;
- /* Verifying the signature. */
j = PKCS7_signatureVerify(p7bio, token, si, signer);
if (j <= 0) {
TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_SIGNATURE_FAILURE);
goto err;
}
- /* Return the signer certificate if needed. */
if (signer_out) {
*signer_out = signer;
- CRYPTO_add(&signer->references, 1, CRYPTO_LOCK_X509);
+ X509_up_ref(signer);
}
-
ret = 1;
err:
@@ -246,74 +162,102 @@ int TS_RESP_verify_signature(PKCS7 *token, STACK_OF(X509) *certs,
* The certificate chain is returned in chain. Caller is responsible for
* freeing the vector.
*/
-static int TS_verify_cert(X509_STORE *store, STACK_OF(X509) *untrusted,
+static int ts_verify_cert(X509_STORE *store, STACK_OF(X509) *untrusted,
X509 *signer, STACK_OF(X509) **chain)
{
- X509_STORE_CTX cert_ctx;
+ X509_STORE_CTX *cert_ctx = NULL;
int i;
- int ret = 1;
+ int ret = 0;
- /* chain is an out argument. */
*chain = NULL;
- if (!X509_STORE_CTX_init(&cert_ctx, store, signer, untrusted))
- return 0;
- X509_STORE_CTX_set_purpose(&cert_ctx, X509_PURPOSE_TIMESTAMP_SIGN);
- i = X509_verify_cert(&cert_ctx);
+ cert_ctx = X509_STORE_CTX_new();
+ if (cert_ctx == NULL) {
+ TSerr(TS_F_TS_VERIFY_CERT, ERR_R_MALLOC_FAILURE);
+ goto err;
+ }
+ if (!X509_STORE_CTX_init(cert_ctx, store, signer, untrusted))
+ goto end;
+ X509_STORE_CTX_set_purpose(cert_ctx, X509_PURPOSE_TIMESTAMP_SIGN);
+ i = X509_verify_cert(cert_ctx);
if (i <= 0) {
- int j = X509_STORE_CTX_get_error(&cert_ctx);
+ int j = X509_STORE_CTX_get_error(cert_ctx);
TSerr(TS_F_TS_VERIFY_CERT, TS_R_CERTIFICATE_VERIFY_ERROR);
ERR_add_error_data(2, "Verify error:",
X509_verify_cert_error_string(j));
- ret = 0;
- } else {
- /* Get a copy of the certificate chain. */
- *chain = X509_STORE_CTX_get1_chain(&cert_ctx);
+ goto err;
}
+ *chain = X509_STORE_CTX_get1_chain(cert_ctx);
+ ret = 1;
+ goto end;
- X509_STORE_CTX_cleanup(&cert_ctx);
+err:
+ ret = 0;
+end:
+ X509_STORE_CTX_free(cert_ctx);
return ret;
}
-static int TS_check_signing_certs(PKCS7_SIGNER_INFO *si,
+static int ts_check_signing_certs(PKCS7_SIGNER_INFO *si,
STACK_OF(X509) *chain)
{
- ESS_SIGNING_CERT *ss = ESS_get_signing_cert(si);
+ ESS_SIGNING_CERT *ss = ess_get_signing_cert(si);
STACK_OF(ESS_CERT_ID) *cert_ids = NULL;
+ ESS_SIGNING_CERT_V2 *ssv2 = ess_get_signing_cert_v2(si);
+ STACK_OF(ESS_CERT_ID_V2) *cert_ids_v2 = NULL;
X509 *cert;
int i = 0;
int ret = 0;
- if (!ss)
- goto err;
- cert_ids = ss->cert_ids;
- /* The signer certificate must be the first in cert_ids. */
- cert = sk_X509_value(chain, 0);
- if (TS_find_cert(cert_ids, cert) != 0)
- goto err;
+ if (ss != NULL) {
+ cert_ids = ss->cert_ids;
+ cert = sk_X509_value(chain, 0);
+ if (ts_find_cert(cert_ids, cert) != 0)
+ goto err;
- /*
- * Check the other certificates of the chain if there are more than one
- * certificate ids in cert_ids.
- */
- if (sk_ESS_CERT_ID_num(cert_ids) > 1) {
- /* All the certificates of the chain must be in cert_ids. */
- for (i = 1; i < sk_X509_num(chain); ++i) {
- cert = sk_X509_value(chain, i);
- if (TS_find_cert(cert_ids, cert) < 0)
- goto err;
+ /*
+ * Check the other certificates of the chain if there are more than one
+ * certificate ids in cert_ids.
+ */
+ if (sk_ESS_CERT_ID_num(cert_ids) > 1) {
+ for (i = 1; i < sk_X509_num(chain); ++i) {
+ cert = sk_X509_value(chain, i);
+ if (ts_find_cert(cert_ids, cert) < 0)
+ goto err;
+ }
+ }
+ } else if (ssv2 != NULL) {
+ cert_ids_v2 = ssv2->cert_ids;
+ cert = sk_X509_value(chain, 0);
+ if (ts_find_cert_v2(cert_ids_v2, cert) != 0)
+ goto err;
+
+ /*
+ * Check the other certificates of the chain if there are more than one
+ * certificate ids in cert_ids.
+ */
+ if (sk_ESS_CERT_ID_V2_num(cert_ids_v2) > 1) {
+ for (i = 1; i < sk_X509_num(chain); ++i) {
+ cert = sk_X509_value(chain, i);
+ if (ts_find_cert_v2(cert_ids_v2, cert) < 0)
+ goto err;
+ }
}
+ } else {
+ goto err;
}
+
ret = 1;
err:
if (!ret)
TSerr(TS_F_TS_CHECK_SIGNING_CERTS,
TS_R_ESS_SIGNING_CERTIFICATE_ERROR);
ESS_SIGNING_CERT_free(ss);
+ ESS_SIGNING_CERT_V2_free(ssv2);
return ret;
}
-static ESS_SIGNING_CERT *ESS_get_signing_cert(PKCS7_SIGNER_INFO *si)
+static ESS_SIGNING_CERT *ess_get_signing_cert(PKCS7_SIGNER_INFO *si)
{
ASN1_TYPE *attr;
const unsigned char *p;
@@ -324,14 +268,29 @@ static ESS_SIGNING_CERT *ESS_get_signing_cert(PKCS7_SIGNER_INFO *si)
return d2i_ESS_SIGNING_CERT(NULL, &p, attr->value.sequence->length);
}
+static ESS_SIGNING_CERT_V2 *ess_get_signing_cert_v2(PKCS7_SIGNER_INFO *si)
+{
+ ASN1_TYPE *attr;
+ const unsigned char *p;
+
+ attr = PKCS7_get_signed_attribute(si, NID_id_smime_aa_signingCertificateV2);
+ if (attr == NULL)
+ return NULL;
+ p = attr->value.sequence->data;
+ return d2i_ESS_SIGNING_CERT_V2(NULL, &p, attr->value.sequence->length);
+}
+
/* Returns < 0 if certificate is not found, certificate index otherwise. */
-static int TS_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert)
+static int ts_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert)
{
int i;
+ unsigned char cert_sha1[SHA_DIGEST_LENGTH];
if (!cert_ids || !cert)
return -1;
+ X509_digest(cert, EVP_sha1(), cert_sha1, NULL);
+
/* Recompute SHA1 hash of certificate if necessary (side effect). */
X509_check_purpose(cert, -1, 0);
@@ -339,13 +298,10 @@ static int TS_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert)
for (i = 0; i < sk_ESS_CERT_ID_num(cert_ids); ++i) {
ESS_CERT_ID *cid = sk_ESS_CERT_ID_value(cert_ids, i);
- /* Check the SHA-1 hash first. */
- if (cid->hash->length == sizeof(cert->sha1_hash)
- && !memcmp(cid->hash->data, cert->sha1_hash,
- sizeof(cert->sha1_hash))) {
- /* Check the issuer/serial as well if specified. */
+ if (cid->hash->length == SHA_DIGEST_LENGTH
+ && memcmp(cid->hash->data, cert_sha1, SHA_DIGEST_LENGTH) == 0) {
ESS_ISSUER_SERIAL *is = cid->issuer_serial;
- if (!is || !TS_issuer_serial_cmp(is, cert->cert_info))
+ if (!is || !ts_issuer_serial_cmp(is, cert))
return i;
}
}
@@ -353,21 +309,51 @@ static int TS_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert)
return -1;
}
-static int TS_issuer_serial_cmp(ESS_ISSUER_SERIAL *is, X509_CINF *cinfo)
+/* Returns < 0 if certificate is not found, certificate index otherwise. */
+static int ts_find_cert_v2(STACK_OF(ESS_CERT_ID_V2) *cert_ids, X509 *cert)
+{
+ int i;
+ unsigned char cert_digest[EVP_MAX_MD_SIZE];
+ unsigned int len;
+
+ /* Look for cert in the cert_ids vector. */
+ for (i = 0; i < sk_ESS_CERT_ID_V2_num(cert_ids); ++i) {
+ ESS_CERT_ID_V2 *cid = sk_ESS_CERT_ID_V2_value(cert_ids, i);
+ const EVP_MD *md;
+
+ if (cid->hash_alg != NULL)
+ md = EVP_get_digestbyobj(cid->hash_alg->algorithm);
+ else
+ md = EVP_sha256();
+
+ X509_digest(cert, md, cert_digest, &len);
+ if (cid->hash->length != (int)len)
+ return -1;
+
+ if (memcmp(cid->hash->data, cert_digest, cid->hash->length) == 0) {
+ ESS_ISSUER_SERIAL *is = cid->issuer_serial;
+
+ if (is == NULL || !ts_issuer_serial_cmp(is, cert))
+ return i;
+ }
+ }
+
+ return -1;
+}
+
+static int ts_issuer_serial_cmp(ESS_ISSUER_SERIAL *is, X509 *cert)
{
GENERAL_NAME *issuer;
- if (!is || !cinfo || sk_GENERAL_NAME_num(is->issuer) != 1)
+ if (!is || !cert || sk_GENERAL_NAME_num(is->issuer) != 1)
return -1;
- /* Check the issuer first. It must be a directory name. */
issuer = sk_GENERAL_NAME_value(is->issuer, 0);
if (issuer->type != GEN_DIRNAME
- || X509_NAME_cmp(issuer->d.dirn, cinfo->issuer))
+ || X509_NAME_cmp(issuer->d.dirn, X509_get_issuer_name(cert)))
return -1;
- /* Check the serial number, too. */
- if (ASN1_INTEGER_cmp(is->serial, cinfo->serialNumber))
+ if (ASN1_INTEGER_cmp(is->serial, X509_get_serialNumber(cert)))
return -1;
return 0;
@@ -381,19 +367,16 @@ static int TS_issuer_serial_cmp(ESS_ISSUER_SERIAL *is, X509_CINF *cinfo)
*/
int TS_RESP_verify_response(TS_VERIFY_CTX *ctx, TS_RESP *response)
{
- PKCS7 *token = TS_RESP_get_token(response);
- TS_TST_INFO *tst_info = TS_RESP_get_tst_info(response);
+ PKCS7 *token = response->token;
+ TS_TST_INFO *tst_info = response->tst_info;
int ret = 0;
- /* Check if we have a successful TS_TST_INFO object in place. */
- if (!TS_check_status_info(response))
+ if (!ts_check_status_info(response))
goto err;
-
- /* Check the contents of the time stamp token. */
- if (!int_TS_RESP_verify_token(ctx, token, tst_info))
+ if (!int_ts_RESP_verify_token(ctx, token, tst_info))
goto err;
-
ret = 1;
+
err:
return ret;
}
@@ -407,7 +390,7 @@ int TS_RESP_verify_token(TS_VERIFY_CTX *ctx, PKCS7 *token)
TS_TST_INFO *tst_info = PKCS7_to_TS_TST_INFO(token);
int ret = 0;
if (tst_info) {
- ret = int_TS_RESP_verify_token(ctx, token, tst_info);
+ ret = int_ts_RESP_verify_token(ctx, token, tst_info);
TS_TST_INFO_free(tst_info);
}
return ret;
@@ -425,11 +408,11 @@ int TS_RESP_verify_token(TS_VERIFY_CTX *ctx, PKCS7 *token)
* - Check if the TSA name matches the signer.
* - Check if the TSA name is the expected TSA.
*/
-static int int_TS_RESP_verify_token(TS_VERIFY_CTX *ctx,
+static int int_ts_RESP_verify_token(TS_VERIFY_CTX *ctx,
PKCS7 *token, TS_TST_INFO *tst_info)
{
X509 *signer = NULL;
- GENERAL_NAME *tsa_name = TS_TST_INFO_get_tsa(tst_info);
+ GENERAL_NAME *tsa_name = tst_info->tsa;
X509_ALGOR *md_alg = NULL;
unsigned char *imprint = NULL;
unsigned imprint_len = 0;
@@ -442,56 +425,41 @@ static int int_TS_RESP_verify_token(TS_VERIFY_CTX *ctx,
flags |= TS_VFY_SIGNATURE;
}
- /* Verify the signature. */
if ((flags & TS_VFY_SIGNATURE)
&& !TS_RESP_verify_signature(token, ctx->certs, ctx->store, &signer))
goto err;
-
- /* Check version number of response. */
if ((flags & TS_VFY_VERSION)
&& TS_TST_INFO_get_version(tst_info) != 1) {
TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_UNSUPPORTED_VERSION);
goto err;
}
-
- /* Check policies. */
if ((flags & TS_VFY_POLICY)
- && !TS_check_policy(ctx->policy, tst_info))
+ && !ts_check_policy(ctx->policy, tst_info))
goto err;
-
- /* Check message imprints. */
if ((flags & TS_VFY_IMPRINT)
- && !TS_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len,
+ && !ts_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len,
tst_info))
goto err;
-
- /* Compute and check message imprints. */
if ((flags & TS_VFY_DATA)
- && (!TS_compute_imprint(ctx->data, tst_info,
+ && (!ts_compute_imprint(ctx->data, tst_info,
&md_alg, &imprint, &imprint_len)
- || !TS_check_imprints(md_alg, imprint, imprint_len, tst_info)))
+ || !ts_check_imprints(md_alg, imprint, imprint_len, tst_info)))
goto err;
-
- /* Check nonces. */
if ((flags & TS_VFY_NONCE)
- && !TS_check_nonces(ctx->nonce, tst_info))
+ && !ts_check_nonces(ctx->nonce, tst_info))
goto err;
-
- /* Check whether TSA name and signer certificate match. */
if ((flags & TS_VFY_SIGNER)
- && tsa_name && !TS_check_signer_name(tsa_name, signer)) {
+ && tsa_name && !ts_check_signer_name(tsa_name, signer)) {
TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_NAME_MISMATCH);
goto err;
}
-
- /* Check whether the TSA is the expected one. */
if ((flags & TS_VFY_TSA_NAME)
- && !TS_check_signer_name(ctx->tsa_name, signer)) {
+ && !ts_check_signer_name(ctx->tsa_name, signer)) {
TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_UNTRUSTED);
goto err;
}
-
ret = 1;
+
err:
X509_free(signer);
X509_ALGOR_free(md_alg);
@@ -499,48 +467,45 @@ static int int_TS_RESP_verify_token(TS_VERIFY_CTX *ctx,
return ret;
}
-static int TS_check_status_info(TS_RESP *response)
+static int ts_check_status_info(TS_RESP *response)
{
- TS_STATUS_INFO *info = TS_RESP_get_status_info(response);
+ TS_STATUS_INFO *info = response->status_info;
long status = ASN1_INTEGER_get(info->status);
const char *status_text = NULL;
char *embedded_status_text = NULL;
char failure_text[TS_STATUS_BUF_SIZE] = "";
- /* Check if everything went fine. */
if (status == 0 || status == 1)
return 1;
/* There was an error, get the description in status_text. */
- if (0 <= status && status < (long)TS_STATUS_TEXT_SIZE)
- status_text = TS_status_text[status];
+ if (0 <= status && status < (long) OSSL_NELEM(ts_status_text))
+ status_text = ts_status_text[status];
else
status_text = "unknown code";
- /* Set the embedded_status_text to the returned description. */
if (sk_ASN1_UTF8STRING_num(info->text) > 0
- && !(embedded_status_text = TS_get_status_text(info->text)))
+ && (embedded_status_text = ts_get_status_text(info->text)) == NULL)
return 0;
- /* Filling in failure_text with the failure information. */
+ /* Fill in failure_text with the failure information. */
if (info->failure_info) {
int i;
int first = 1;
- for (i = 0; i < (int)TS_FAILURE_INFO_SIZE; ++i) {
+ for (i = 0; i < (int)OSSL_NELEM(ts_failure_info); ++i) {
if (ASN1_BIT_STRING_get_bit(info->failure_info,
- TS_failure_info[i].code)) {
+ ts_failure_info[i].code)) {
if (!first)
strcat(failure_text, ",");
else
first = 0;
- strcat(failure_text, TS_failure_info[i].text);
+ strcat(failure_text, ts_failure_info[i].text);
}
}
}
if (failure_text[0] == '\0')
strcpy(failure_text, "unspecified");
- /* Making up the error string. */
TSerr(TS_F_TS_CHECK_STATUS_INFO, TS_R_NO_TIME_STAMP_TOKEN);
ERR_add_error_data(6,
"status code: ", status_text,
@@ -552,14 +517,13 @@ static int TS_check_status_info(TS_RESP *response)
return 0;
}
-static char *TS_get_status_text(STACK_OF(ASN1_UTF8STRING) *text)
+static char *ts_get_status_text(STACK_OF(ASN1_UTF8STRING) *text)
{
int i;
int length = 0;
char *result = NULL;
char *p;
- /* Determine length first. */
for (i = 0; i < sk_ASN1_UTF8STRING_num(text); ++i) {
ASN1_UTF8STRING *current = sk_ASN1_UTF8STRING_value(text, i);
if (ASN1_STRING_length(current) > TS_MAX_STATUS_LENGTH - length - 1)
@@ -567,29 +531,28 @@ static char *TS_get_status_text(STACK_OF(ASN1_UTF8STRING) *text)
length += ASN1_STRING_length(current);
length += 1; /* separator character */
}
- /* Allocate memory (closing '\0' included). */
- if (!(result = OPENSSL_malloc(length))) {
+ if ((result = OPENSSL_malloc(length)) == NULL) {
TSerr(TS_F_TS_GET_STATUS_TEXT, ERR_R_MALLOC_FAILURE);
return NULL;
}
- /* Concatenate the descriptions. */
+
for (i = 0, p = result; i < sk_ASN1_UTF8STRING_num(text); ++i) {
ASN1_UTF8STRING *current = sk_ASN1_UTF8STRING_value(text, i);
length = ASN1_STRING_length(current);
if (i > 0)
*p++ = '/';
- strncpy(p, (const char *)ASN1_STRING_data(current), length);
+ strncpy(p, (const char *)ASN1_STRING_get0_data(current), length);
p += length;
}
- /* We do have space for this, too. */
*p = '\0';
return result;
}
-static int TS_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info)
+static int ts_check_policy(const ASN1_OBJECT *req_oid,
+ const TS_TST_INFO *tst_info)
{
- ASN1_OBJECT *resp_oid = TS_TST_INFO_get_policy_id(tst_info);
+ const ASN1_OBJECT *resp_oid = tst_info->policy_id;
if (OBJ_cmp(req_oid, resp_oid) != 0) {
TSerr(TS_F_TS_CHECK_POLICY, TS_R_POLICY_MISMATCH);
@@ -599,51 +562,53 @@ static int TS_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info)
return 1;
}
-static int TS_compute_imprint(BIO *data, TS_TST_INFO *tst_info,
+static int ts_compute_imprint(BIO *data, TS_TST_INFO *tst_info,
X509_ALGOR **md_alg,
unsigned char **imprint, unsigned *imprint_len)
{
- TS_MSG_IMPRINT *msg_imprint = TS_TST_INFO_get_msg_imprint(tst_info);
- X509_ALGOR *md_alg_resp = TS_MSG_IMPRINT_get_algo(msg_imprint);
+ TS_MSG_IMPRINT *msg_imprint = tst_info->msg_imprint;
+ X509_ALGOR *md_alg_resp = msg_imprint->hash_algo;
const EVP_MD *md;
- EVP_MD_CTX md_ctx;
+ EVP_MD_CTX *md_ctx = NULL;
unsigned char buffer[4096];
int length;
*md_alg = NULL;
*imprint = NULL;
- /* Return the MD algorithm of the response. */
- if (!(*md_alg = X509_ALGOR_dup(md_alg_resp)))
+ if ((*md_alg = X509_ALGOR_dup(md_alg_resp)) == NULL)
goto err;
-
- /* Getting the MD object. */
- if (!(md = EVP_get_digestbyobj((*md_alg)->algorithm))) {
+ if ((md = EVP_get_digestbyobj((*md_alg)->algorithm)) == NULL) {
TSerr(TS_F_TS_COMPUTE_IMPRINT, TS_R_UNSUPPORTED_MD_ALGORITHM);
goto err;
}
-
- /* Compute message digest. */
length = EVP_MD_size(md);
if (length < 0)
goto err;
*imprint_len = length;
- if (!(*imprint = OPENSSL_malloc(*imprint_len))) {
+ if ((*imprint = OPENSSL_malloc(*imprint_len)) == NULL) {
TSerr(TS_F_TS_COMPUTE_IMPRINT, ERR_R_MALLOC_FAILURE);
goto err;
}
- if (!EVP_DigestInit(&md_ctx, md))
+ md_ctx = EVP_MD_CTX_new();
+ if (md_ctx == NULL) {
+ TSerr(TS_F_TS_COMPUTE_IMPRINT, ERR_R_MALLOC_FAILURE);
+ goto err;
+ }
+ if (!EVP_DigestInit(md_ctx, md))
goto err;
while ((length = BIO_read(data, buffer, sizeof(buffer))) > 0) {
- if (!EVP_DigestUpdate(&md_ctx, buffer, length))
+ if (!EVP_DigestUpdate(md_ctx, buffer, length))
goto err;
}
- if (!EVP_DigestFinal(&md_ctx, *imprint, NULL))
+ if (!EVP_DigestFinal(md_ctx, *imprint, NULL))
goto err;
+ EVP_MD_CTX_free(md_ctx);
return 1;
err:
+ EVP_MD_CTX_free(md_ctx);
X509_ALGOR_free(*md_alg);
OPENSSL_free(*imprint);
*imprint_len = 0;
@@ -651,17 +616,15 @@ static int TS_compute_imprint(BIO *data, TS_TST_INFO *tst_info,
return 0;
}
-static int TS_check_imprints(X509_ALGOR *algor_a,
- unsigned char *imprint_a, unsigned len_a,
+static int ts_check_imprints(X509_ALGOR *algor_a,
+ const unsigned char *imprint_a, unsigned len_a,
TS_TST_INFO *tst_info)
{
- TS_MSG_IMPRINT *b = TS_TST_INFO_get_msg_imprint(tst_info);
- X509_ALGOR *algor_b = TS_MSG_IMPRINT_get_algo(b);
+ TS_MSG_IMPRINT *b = tst_info->msg_imprint;
+ X509_ALGOR *algor_b = b->hash_algo;
int ret = 0;
- /* algor_a is optional. */
if (algor_a) {
- /* Compare algorithm OIDs. */
if (OBJ_cmp(algor_a->algorithm, algor_b->algorithm))
goto err;
@@ -673,20 +636,18 @@ static int TS_check_imprints(X509_ALGOR *algor_a,
goto err;
}
- /* Compare octet strings. */
ret = len_a == (unsigned)ASN1_STRING_length(b->hashed_msg) &&
- memcmp(imprint_a, ASN1_STRING_data(b->hashed_msg), len_a) == 0;
+ memcmp(imprint_a, ASN1_STRING_get0_data(b->hashed_msg), len_a) == 0;
err:
if (!ret)
TSerr(TS_F_TS_CHECK_IMPRINTS, TS_R_MESSAGE_IMPRINT_MISMATCH);
return ret;
}
-static int TS_check_nonces(const ASN1_INTEGER *a, TS_TST_INFO *tst_info)
+static int ts_check_nonces(const ASN1_INTEGER *a, TS_TST_INFO *tst_info)
{
- const ASN1_INTEGER *b = TS_TST_INFO_get_nonce(tst_info);
+ const ASN1_INTEGER *b = tst_info->nonce;
- /* Error if nonce is missing. */
if (!b) {
TSerr(TS_F_TS_CHECK_NONCES, TS_R_NONCE_NOT_RETURNED);
return 0;
@@ -705,37 +666,34 @@ static int TS_check_nonces(const ASN1_INTEGER *a, TS_TST_INFO *tst_info)
* Check if the specified TSA name matches either the subject or one of the
* subject alternative names of the TSA certificate.
*/
-static int TS_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer)
+static int ts_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer)
{
STACK_OF(GENERAL_NAME) *gen_names = NULL;
int idx = -1;
int found = 0;
- /* Check the subject name first. */
if (tsa_name->type == GEN_DIRNAME
- && X509_name_cmp(tsa_name->d.dirn, signer->cert_info->subject) == 0)
+ && X509_name_cmp(tsa_name->d.dirn, X509_get_subject_name(signer)) == 0)
return 1;
-
- /* Check all the alternative names. */
gen_names = X509_get_ext_d2i(signer, NID_subject_alt_name, NULL, &idx);
- while (gen_names != NULL
- && !(found = TS_find_name(gen_names, tsa_name) >= 0)) {
+ while (gen_names != NULL) {
+ found = ts_find_name(gen_names, tsa_name) >= 0;
+ if (found)
+ break;
/*
* Get the next subject alternative name, although there should be no
* more than one.
*/
GENERAL_NAMES_free(gen_names);
- gen_names = X509_get_ext_d2i(signer, NID_subject_alt_name,
- NULL, &idx);
+ gen_names = X509_get_ext_d2i(signer, NID_subject_alt_name, NULL, &idx);
}
- if (gen_names)
- GENERAL_NAMES_free(gen_names);
+ GENERAL_NAMES_free(gen_names);
return found;
}
/* Returns 1 if name is in gen_names, 0 otherwise. */
-static int TS_find_name(STACK_OF(GENERAL_NAME) *gen_names, GENERAL_NAME *name)
+static int ts_find_name(STACK_OF(GENERAL_NAME) *gen_names, GENERAL_NAME *name)
{
int i, found;
for (i = 0, found = 0; !found && i < sk_GENERAL_NAME_num(gen_names); ++i) {
diff --git a/crypto/ts/ts_verify_ctx.c b/crypto/ts/ts_verify_ctx.c
index 3e6fcb57beff..d4792ee04f59 100644
--- a/crypto/ts/ts_verify_ctx.c
+++ b/crypto/ts/ts_verify_ctx.c
@@ -1,73 +1,22 @@
-/* crypto/ts/ts_verify_ctx.c */
/*
- * Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL project
- * 2003.
- */
-/* ====================================================================
- * Copyright (c) 2006 The OpenSSL Project. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in
- * the documentation and/or other materials provided with the
- * distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- * software must display the following acknowledgment:
- * "This product includes software developed by the OpenSSL Project
- * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- * endorse or promote products derived from this software without
- * prior written permission. For written permission, please contact
- * licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- * nor may "OpenSSL" appear in their names without prior written
- * permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- * acknowledgment:
- * "This product includes software developed by the OpenSSL Project
- * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com). This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
+ * Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
*
+ * Licensed under the OpenSSL license (the "License"). You may not use
+ * this file except in compliance with the License. You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
*/
-#include "cryptlib.h"
+#include "internal/cryptlib.h"
#include <openssl/objects.h>
#include <openssl/ts.h>
+#include "ts_lcl.h"
TS_VERIFY_CTX *TS_VERIFY_CTX_new(void)
{
- TS_VERIFY_CTX *ctx =
- (TS_VERIFY_CTX *)OPENSSL_malloc(sizeof(TS_VERIFY_CTX));
- if (ctx)
- memset(ctx, 0, sizeof(TS_VERIFY_CTX));
- else
+ TS_VERIFY_CTX *ctx = OPENSSL_zalloc(sizeof(*ctx));
+
+ if (ctx == NULL)
TSerr(TS_F_TS_VERIFY_CTX_NEW, ERR_R_MALLOC_FAILURE);
return ctx;
}
@@ -75,7 +24,7 @@ TS_VERIFY_CTX *TS_VERIFY_CTX_new(void)
void TS_VERIFY_CTX_init(TS_VERIFY_CTX *ctx)
{
OPENSSL_assert(ctx != NULL);
- memset(ctx, 0, sizeof(TS_VERIFY_CTX));
+ memset(ctx, 0, sizeof(*ctx));
}
void TS_VERIFY_CTX_free(TS_VERIFY_CTX *ctx)
@@ -87,6 +36,45 @@ void TS_VERIFY_CTX_free(TS_VERIFY_CTX *ctx)
OPENSSL_free(ctx);
}
+int TS_VERIFY_CTX_add_flags(TS_VERIFY_CTX *ctx, int f)
+{
+ ctx->flags |= f;
+ return ctx->flags;
+}
+
+int TS_VERIFY_CTX_set_flags(TS_VERIFY_CTX *ctx, int f)
+{
+ ctx->flags = f;
+ return ctx->flags;
+}
+
+BIO *TS_VERIFY_CTX_set_data(TS_VERIFY_CTX *ctx, BIO *b)
+{
+ ctx->data = b;
+ return ctx->data;
+}
+
+X509_STORE *TS_VERIFY_CTX_set_store(TS_VERIFY_CTX *ctx, X509_STORE *s)
+{
+ ctx->store = s;
+ return ctx->store;
+}
+
+STACK_OF(X509) *TS_VERIFY_CTS_set_certs(TS_VERIFY_CTX *ctx,
+ STACK_OF(X509) *certs)
+{
+ ctx->certs = certs;
+ return ctx->certs;
+}
+
+unsigned char *TS_VERIFY_CTX_set_imprint(TS_VERIFY_CTX *ctx,
+ unsigned char *hexstr, long len)
+{
+ ctx->imprint = hexstr;
+ ctx->imprint_len = len;
+ return ctx->imprint;
+}
+
void TS_VERIFY_CTX_cleanup(TS_VERIFY_CTX *ctx)
{
if (!ctx)
@@ -121,33 +109,29 @@ TS_VERIFY_CTX *TS_REQ_to_TS_VERIFY_CTX(TS_REQ *req, TS_VERIFY_CTX *ctx)
OPENSSL_assert(req != NULL);
if (ret)
TS_VERIFY_CTX_cleanup(ret);
- else if (!(ret = TS_VERIFY_CTX_new()))
+ else if ((ret = TS_VERIFY_CTX_new()) == NULL)
return NULL;
- /* Setting flags. */
ret->flags = TS_VFY_ALL_IMPRINT & ~(TS_VFY_TSA_NAME | TS_VFY_SIGNATURE);
- /* Setting policy. */
- if ((policy = TS_REQ_get_policy_id(req)) != NULL) {
- if (!(ret->policy = OBJ_dup(policy)))
+ if ((policy = req->policy_id) != NULL) {
+ if ((ret->policy = OBJ_dup(policy)) == NULL)
goto err;
} else
ret->flags &= ~TS_VFY_POLICY;
- /* Setting md_alg, imprint and imprint_len. */
- imprint = TS_REQ_get_msg_imprint(req);
- md_alg = TS_MSG_IMPRINT_get_algo(imprint);
- if (!(ret->md_alg = X509_ALGOR_dup(md_alg)))
+ imprint = req->msg_imprint;
+ md_alg = imprint->hash_algo;
+ if ((ret->md_alg = X509_ALGOR_dup(md_alg)) == NULL)
goto err;
- msg = TS_MSG_IMPRINT_get_msg(imprint);
+ msg = imprint->hashed_msg;
ret->imprint_len = ASN1_STRING_length(msg);
- if (!(ret->imprint = OPENSSL_malloc(ret->imprint_len)))
+ if ((ret->imprint = OPENSSL_malloc(ret->imprint_len)) == NULL)
goto err;
- memcpy(ret->imprint, ASN1_STRING_data(msg), ret->imprint_len);
+ memcpy(ret->imprint, ASN1_STRING_get0_data(msg), ret->imprint_len);
- /* Setting nonce. */
- if ((nonce = TS_REQ_get_nonce(req)) != NULL) {
- if (!(ret->nonce = ASN1_INTEGER_dup(nonce)))
+ if ((nonce = req->nonce) != NULL) {
+ if ((ret->nonce = ASN1_INTEGER_dup(nonce)) == NULL)
goto err;
} else
ret->flags &= ~TS_VFY_NONCE;