2 /* Written by Zoltan Glozik (zglozik@opentsa.org) for the OpenSSL
3 * project 2002, 2003, 2004.
5 /* ====================================================================
6 * Copyright (c) 2006 The OpenSSL Project. All rights reserved.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
34 * 6. Redistributions of any form whatsoever must retain the following
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
62 #include <openssl/symhacks.h>
64 #include <openssl/buffer.h>
67 #include <openssl/evp.h>
70 #include <openssl/bio.h>
72 #include <openssl/stack.h>
73 #include <openssl/asn1.h>
74 #include <openssl/safestack.h>
77 #include <openssl/rsa.h>
81 #include <openssl/dsa.h>
85 #include <openssl/dh.h>
88 #include <openssl/evp.h>
96 /* Under Win32 this is defined in wincrypt.h */
100 #include <openssl/x509.h>
101 #include <openssl/x509v3.h>
104 MessageImprint ::= SEQUENCE {
105 hashAlgorithm AlgorithmIdentifier,
106 hashedMessage OCTET STRING }
109 typedef struct TS_msg_imprint_st
111 X509_ALGOR *hash_algo;
112 ASN1_OCTET_STRING *hashed_msg;
116 TimeStampReq ::= SEQUENCE {
117 version INTEGER { v1(1) },
118 messageImprint MessageImprint,
119 --a hash algorithm OID and the hash value of the data to be
121 reqPolicy TSAPolicyId OPTIONAL,
122 nonce INTEGER OPTIONAL,
123 certReq BOOLEAN DEFAULT FALSE,
124 extensions [0] IMPLICIT Extensions OPTIONAL }
127 typedef struct TS_req_st
129 ASN1_INTEGER *version;
130 TS_MSG_IMPRINT *msg_imprint;
131 ASN1_OBJECT *policy_id; /* OPTIONAL */
132 ASN1_INTEGER *nonce; /* OPTIONAL */
133 ASN1_BOOLEAN cert_req; /* DEFAULT FALSE */
134 STACK_OF(X509_EXTENSION) *extensions; /* [0] OPTIONAL */
138 Accuracy ::= SEQUENCE {
139 seconds INTEGER OPTIONAL,
140 millis [0] INTEGER (1..999) OPTIONAL,
141 micros [1] INTEGER (1..999) OPTIONAL }
144 typedef struct TS_accuracy_st
146 ASN1_INTEGER *seconds;
147 ASN1_INTEGER *millis;
148 ASN1_INTEGER *micros;
152 TSTInfo ::= SEQUENCE {
153 version INTEGER { v1(1) },
155 messageImprint MessageImprint,
156 -- MUST have the same value as the similar field in
158 serialNumber INTEGER,
159 -- Time-Stamping users MUST be ready to accommodate integers
161 genTime GeneralizedTime,
162 accuracy Accuracy OPTIONAL,
163 ordering BOOLEAN DEFAULT FALSE,
164 nonce INTEGER OPTIONAL,
165 -- MUST be present if the similar field was present
166 -- in TimeStampReq. In that case it MUST have the same value.
167 tsa [0] GeneralName OPTIONAL,
168 extensions [1] IMPLICIT Extensions OPTIONAL }
171 typedef struct TS_tst_info_st
173 ASN1_INTEGER *version;
174 ASN1_OBJECT *policy_id;
175 TS_MSG_IMPRINT *msg_imprint;
176 ASN1_INTEGER *serial;
177 ASN1_GENERALIZEDTIME *time;
178 TS_ACCURACY *accuracy;
179 ASN1_BOOLEAN ordering;
182 STACK_OF(X509_EXTENSION) *extensions;
186 PKIStatusInfo ::= SEQUENCE {
188 statusString PKIFreeText OPTIONAL,
189 failInfo PKIFailureInfo OPTIONAL }
191 From RFC 1510 - section 3.1.1:
192 PKIFreeText ::= SEQUENCE SIZE (1..MAX) OF UTF8String
193 -- text encoded as UTF-8 String (note: each UTF8String SHOULD
194 -- include an RFC 1766 language tag to indicate the language
195 -- of the contained text)
198 /* Possible values for status. See ts_resp_print.c && ts_resp_verify.c. */
200 #define TS_STATUS_GRANTED 0
201 #define TS_STATUS_GRANTED_WITH_MODS 1
202 #define TS_STATUS_REJECTION 2
203 #define TS_STATUS_WAITING 3
204 #define TS_STATUS_REVOCATION_WARNING 4
205 #define TS_STATUS_REVOCATION_NOTIFICATION 5
207 /* Possible values for failure_info. See ts_resp_print.c && ts_resp_verify.c */
209 #define TS_INFO_BAD_ALG 0
210 #define TS_INFO_BAD_REQUEST 2
211 #define TS_INFO_BAD_DATA_FORMAT 5
212 #define TS_INFO_TIME_NOT_AVAILABLE 14
213 #define TS_INFO_UNACCEPTED_POLICY 15
214 #define TS_INFO_UNACCEPTED_EXTENSION 16
215 #define TS_INFO_ADD_INFO_NOT_AVAILABLE 17
216 #define TS_INFO_SYSTEM_FAILURE 25
218 typedef struct TS_status_info_st
220 ASN1_INTEGER *status;
221 STACK_OF(ASN1_UTF8STRING) *text;
222 ASN1_BIT_STRING *failure_info;
225 DECLARE_STACK_OF(ASN1_UTF8STRING)
226 DECLARE_ASN1_SET_OF(ASN1_UTF8STRING)
229 TimeStampResp ::= SEQUENCE {
230 status PKIStatusInfo,
231 timeStampToken TimeStampToken OPTIONAL }
234 typedef struct TS_resp_st
236 TS_STATUS_INFO *status_info;
238 TS_TST_INFO *tst_info;
241 /* The structure below would belong to the ESS component. */
244 IssuerSerial ::= SEQUENCE {
246 serialNumber CertificateSerialNumber
250 typedef struct ESS_issuer_serial
252 STACK_OF(GENERAL_NAME) *issuer;
253 ASN1_INTEGER *serial;
257 ESSCertID ::= SEQUENCE {
259 issuerSerial IssuerSerial OPTIONAL
263 typedef struct ESS_cert_id
265 ASN1_OCTET_STRING *hash; /* Always SHA-1 digest. */
266 ESS_ISSUER_SERIAL *issuer_serial;
269 DECLARE_STACK_OF(ESS_CERT_ID)
270 DECLARE_ASN1_SET_OF(ESS_CERT_ID)
273 SigningCertificate ::= SEQUENCE {
274 certs SEQUENCE OF ESSCertID,
275 policies SEQUENCE OF PolicyInformation OPTIONAL
279 typedef struct ESS_signing_cert
281 STACK_OF(ESS_CERT_ID) *cert_ids;
282 STACK_OF(POLICYINFO) *policy_info;
286 TS_REQ *TS_REQ_new(void);
287 void TS_REQ_free(TS_REQ *a);
288 int i2d_TS_REQ(const TS_REQ *a, unsigned char **pp);
289 TS_REQ *d2i_TS_REQ(TS_REQ **a, const unsigned char **pp, long length);
291 TS_REQ *TS_REQ_dup(TS_REQ *a);
293 TS_REQ *d2i_TS_REQ_fp(FILE *fp, TS_REQ **a);
294 int i2d_TS_REQ_fp(FILE *fp, TS_REQ *a);
295 TS_REQ *d2i_TS_REQ_bio(BIO *fp, TS_REQ **a);
296 int i2d_TS_REQ_bio(BIO *fp, TS_REQ *a);
298 TS_MSG_IMPRINT *TS_MSG_IMPRINT_new(void);
299 void TS_MSG_IMPRINT_free(TS_MSG_IMPRINT *a);
300 int i2d_TS_MSG_IMPRINT(const TS_MSG_IMPRINT *a, unsigned char **pp);
301 TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT(TS_MSG_IMPRINT **a,
302 const unsigned char **pp, long length);
304 TS_MSG_IMPRINT *TS_MSG_IMPRINT_dup(TS_MSG_IMPRINT *a);
306 TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT **a);
307 int i2d_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT *a);
308 TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_bio(BIO *fp, TS_MSG_IMPRINT **a);
309 int i2d_TS_MSG_IMPRINT_bio(BIO *fp, TS_MSG_IMPRINT *a);
311 TS_RESP *TS_RESP_new(void);
312 void TS_RESP_free(TS_RESP *a);
313 int i2d_TS_RESP(const TS_RESP *a, unsigned char **pp);
314 TS_RESP *d2i_TS_RESP(TS_RESP **a, const unsigned char **pp, long length);
315 TS_TST_INFO *PKCS7_to_TS_TST_INFO(PKCS7 *token);
316 TS_RESP *TS_RESP_dup(TS_RESP *a);
318 TS_RESP *d2i_TS_RESP_fp(FILE *fp, TS_RESP **a);
319 int i2d_TS_RESP_fp(FILE *fp, TS_RESP *a);
320 TS_RESP *d2i_TS_RESP_bio(BIO *fp, TS_RESP **a);
321 int i2d_TS_RESP_bio(BIO *fp, TS_RESP *a);
323 TS_STATUS_INFO *TS_STATUS_INFO_new(void);
324 void TS_STATUS_INFO_free(TS_STATUS_INFO *a);
325 int i2d_TS_STATUS_INFO(const TS_STATUS_INFO *a, unsigned char **pp);
326 TS_STATUS_INFO *d2i_TS_STATUS_INFO(TS_STATUS_INFO **a,
327 const unsigned char **pp, long length);
328 TS_STATUS_INFO *TS_STATUS_INFO_dup(TS_STATUS_INFO *a);
330 TS_TST_INFO *TS_TST_INFO_new(void);
331 void TS_TST_INFO_free(TS_TST_INFO *a);
332 int i2d_TS_TST_INFO(const TS_TST_INFO *a, unsigned char **pp);
333 TS_TST_INFO *d2i_TS_TST_INFO(TS_TST_INFO **a, const unsigned char **pp,
335 TS_TST_INFO *TS_TST_INFO_dup(TS_TST_INFO *a);
337 TS_TST_INFO *d2i_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO **a);
338 int i2d_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO *a);
339 TS_TST_INFO *d2i_TS_TST_INFO_bio(BIO *fp, TS_TST_INFO **a);
340 int i2d_TS_TST_INFO_bio(BIO *fp, TS_TST_INFO *a);
342 TS_ACCURACY *TS_ACCURACY_new(void);
343 void TS_ACCURACY_free(TS_ACCURACY *a);
344 int i2d_TS_ACCURACY(const TS_ACCURACY *a, unsigned char **pp);
345 TS_ACCURACY *d2i_TS_ACCURACY(TS_ACCURACY **a, const unsigned char **pp,
347 TS_ACCURACY *TS_ACCURACY_dup(TS_ACCURACY *a);
349 ESS_ISSUER_SERIAL *ESS_ISSUER_SERIAL_new(void);
350 void ESS_ISSUER_SERIAL_free(ESS_ISSUER_SERIAL *a);
351 int i2d_ESS_ISSUER_SERIAL(const ESS_ISSUER_SERIAL *a,
353 ESS_ISSUER_SERIAL *d2i_ESS_ISSUER_SERIAL(ESS_ISSUER_SERIAL **a,
354 const unsigned char **pp, long length);
355 ESS_ISSUER_SERIAL *ESS_ISSUER_SERIAL_dup(ESS_ISSUER_SERIAL *a);
357 ESS_CERT_ID *ESS_CERT_ID_new(void);
358 void ESS_CERT_ID_free(ESS_CERT_ID *a);
359 int i2d_ESS_CERT_ID(const ESS_CERT_ID *a, unsigned char **pp);
360 ESS_CERT_ID *d2i_ESS_CERT_ID(ESS_CERT_ID **a, const unsigned char **pp,
362 ESS_CERT_ID *ESS_CERT_ID_dup(ESS_CERT_ID *a);
364 ESS_SIGNING_CERT *ESS_SIGNING_CERT_new(void);
365 void ESS_SIGNING_CERT_free(ESS_SIGNING_CERT *a);
366 int i2d_ESS_SIGNING_CERT(const ESS_SIGNING_CERT *a,
368 ESS_SIGNING_CERT *d2i_ESS_SIGNING_CERT(ESS_SIGNING_CERT **a,
369 const unsigned char **pp, long length);
370 ESS_SIGNING_CERT *ESS_SIGNING_CERT_dup(ESS_SIGNING_CERT *a);
372 void ERR_load_TS_strings(void);
374 int TS_REQ_set_version(TS_REQ *a, long version);
375 long TS_REQ_get_version(TS_REQ *a);
377 int TS_REQ_set_msg_imprint(TS_REQ *a, TS_MSG_IMPRINT *msg_imprint);
378 TS_MSG_IMPRINT *TS_REQ_get_msg_imprint(TS_REQ *a);
380 int TS_MSG_IMPRINT_set_algo(TS_MSG_IMPRINT *a, X509_ALGOR *alg);
381 X509_ALGOR *TS_MSG_IMPRINT_get_algo(TS_MSG_IMPRINT *a);
383 int TS_MSG_IMPRINT_set_msg(TS_MSG_IMPRINT *a, unsigned char *d, int len);
384 ASN1_OCTET_STRING *TS_MSG_IMPRINT_get_msg(TS_MSG_IMPRINT *a);
386 int TS_REQ_set_policy_id(TS_REQ *a, ASN1_OBJECT *policy);
387 ASN1_OBJECT *TS_REQ_get_policy_id(TS_REQ *a);
389 int TS_REQ_set_nonce(TS_REQ *a, ASN1_INTEGER *nonce);
390 ASN1_INTEGER *TS_REQ_get_nonce(TS_REQ *a);
392 int TS_REQ_set_cert_req(TS_REQ *a, int cert_req);
393 int TS_REQ_get_cert_req(TS_REQ *a);
395 STACK_OF(X509_EXTENSION) *TS_REQ_get_exts(TS_REQ *a);
396 void TS_REQ_ext_free(TS_REQ *a);
397 int TS_REQ_get_ext_count(TS_REQ *a);
398 int TS_REQ_get_ext_by_NID(TS_REQ *a, int nid, int lastpos);
399 int TS_REQ_get_ext_by_OBJ(TS_REQ *a, ASN1_OBJECT *obj, int lastpos);
400 int TS_REQ_get_ext_by_critical(TS_REQ *a, int crit, int lastpos);
401 X509_EXTENSION *TS_REQ_get_ext(TS_REQ *a, int loc);
402 X509_EXTENSION *TS_REQ_delete_ext(TS_REQ *a, int loc);
403 int TS_REQ_add_ext(TS_REQ *a, X509_EXTENSION *ex, int loc);
404 void *TS_REQ_get_ext_d2i(TS_REQ *a, int nid, int *crit, int *idx);
406 /* Function declarations for TS_REQ defined in ts/ts_req_print.c */
408 int TS_REQ_print_bio(BIO *bio, TS_REQ *a);
410 /* Function declarations for TS_RESP defined in ts/ts_resp_utils.c */
412 int TS_RESP_set_status_info(TS_RESP *a, TS_STATUS_INFO *info);
413 TS_STATUS_INFO *TS_RESP_get_status_info(TS_RESP *a);
415 /* Caller loses ownership of PKCS7 and TS_TST_INFO objects. */
416 void TS_RESP_set_tst_info(TS_RESP *a, PKCS7 *p7, TS_TST_INFO *tst_info);
417 PKCS7 *TS_RESP_get_token(TS_RESP *a);
418 TS_TST_INFO *TS_RESP_get_tst_info(TS_RESP *a);
420 int TS_TST_INFO_set_version(TS_TST_INFO *a, long version);
421 long TS_TST_INFO_get_version(TS_TST_INFO *a);
423 int TS_TST_INFO_set_policy_id(TS_TST_INFO *a, ASN1_OBJECT *policy_id);
424 ASN1_OBJECT *TS_TST_INFO_get_policy_id(TS_TST_INFO *a);
426 int TS_TST_INFO_set_msg_imprint(TS_TST_INFO *a, TS_MSG_IMPRINT *msg_imprint);
427 TS_MSG_IMPRINT *TS_TST_INFO_get_msg_imprint(TS_TST_INFO *a);
429 int TS_TST_INFO_set_serial(TS_TST_INFO *a, ASN1_INTEGER *serial);
430 ASN1_INTEGER *TS_TST_INFO_get_serial(TS_TST_INFO *a);
432 int TS_TST_INFO_set_time(TS_TST_INFO *a, ASN1_GENERALIZEDTIME *gtime);
433 ASN1_GENERALIZEDTIME *TS_TST_INFO_get_time(TS_TST_INFO *a);
435 int TS_TST_INFO_set_accuracy(TS_TST_INFO *a, TS_ACCURACY *accuracy);
436 TS_ACCURACY *TS_TST_INFO_get_accuracy(TS_TST_INFO *a);
438 int TS_ACCURACY_set_seconds(TS_ACCURACY *a, ASN1_INTEGER *seconds);
439 ASN1_INTEGER *TS_ACCURACY_get_seconds(TS_ACCURACY *a);
441 int TS_ACCURACY_set_millis(TS_ACCURACY *a, ASN1_INTEGER *millis);
442 ASN1_INTEGER *TS_ACCURACY_get_millis(TS_ACCURACY *a);
444 int TS_ACCURACY_set_micros(TS_ACCURACY *a, ASN1_INTEGER *micros);
445 ASN1_INTEGER *TS_ACCURACY_get_micros(TS_ACCURACY *a);
447 int TS_TST_INFO_set_ordering(TS_TST_INFO *a, int ordering);
448 int TS_TST_INFO_get_ordering(TS_TST_INFO *a);
450 int TS_TST_INFO_set_nonce(TS_TST_INFO *a, ASN1_INTEGER *nonce);
451 ASN1_INTEGER *TS_TST_INFO_get_nonce(TS_TST_INFO *a);
453 int TS_TST_INFO_set_tsa(TS_TST_INFO *a, GENERAL_NAME *tsa);
454 GENERAL_NAME *TS_TST_INFO_get_tsa(TS_TST_INFO *a);
456 STACK_OF(X509_EXTENSION) *TS_TST_INFO_get_exts(TS_TST_INFO *a);
457 void TS_TST_INFO_ext_free(TS_TST_INFO *a);
458 int TS_TST_INFO_get_ext_count(TS_TST_INFO *a);
459 int TS_TST_INFO_get_ext_by_NID(TS_TST_INFO *a, int nid, int lastpos);
460 int TS_TST_INFO_get_ext_by_OBJ(TS_TST_INFO *a, ASN1_OBJECT *obj, int lastpos);
461 int TS_TST_INFO_get_ext_by_critical(TS_TST_INFO *a, int crit, int lastpos);
462 X509_EXTENSION *TS_TST_INFO_get_ext(TS_TST_INFO *a, int loc);
463 X509_EXTENSION *TS_TST_INFO_delete_ext(TS_TST_INFO *a, int loc);
464 int TS_TST_INFO_add_ext(TS_TST_INFO *a, X509_EXTENSION *ex, int loc);
465 void *TS_TST_INFO_get_ext_d2i(TS_TST_INFO *a, int nid, int *crit, int *idx);
467 /* Declarations related to response generation, defined in ts/ts_resp_sign.c. */
469 /* Optional flags for response generation. */
471 /* Don't include the TSA name in response. */
472 #define TS_TSA_NAME 0x01
474 /* Set ordering to true in response. */
475 #define TS_ORDERING 0x02
478 * Include the signer certificate and the other specified certificates in
479 * the ESS signing certificate attribute beside the PKCS7 signed data.
480 * Only the signer certificates is included by default.
482 #define TS_ESS_CERT_ID_CHAIN 0x04
484 /* Forward declaration. */
487 /* This must return a unique number less than 160 bits long. */
488 typedef ASN1_INTEGER *(*TS_serial_cb)(struct TS_resp_ctx *, void *);
490 /* This must return the seconds and microseconds since Jan 1, 1970 in
491 the sec and usec variables allocated by the caller.
492 Return non-zero for success and zero for failure. */
493 typedef int (*TS_time_cb)(struct TS_resp_ctx *, void *, long *sec, long *usec);
495 /* This must process the given extension.
496 * It can modify the TS_TST_INFO object of the context.
497 * Return values: !0 (processed), 0 (error, it must set the
498 * status info/failure info of the response).
500 typedef int (*TS_extension_cb)(struct TS_resp_ctx *, X509_EXTENSION *, void *);
502 typedef struct TS_resp_ctx
505 EVP_PKEY *signer_key;
506 STACK_OF(X509) *certs; /* Certs to include in signed data. */
507 STACK_OF(ASN1_OBJECT) *policies; /* Acceptable policies. */
508 ASN1_OBJECT *default_policy; /* It may appear in policies, too. */
509 STACK_OF(EVP_MD) *mds; /* Acceptable message digests. */
510 ASN1_INTEGER *seconds; /* accuracy, 0 means not specified. */
511 ASN1_INTEGER *millis; /* accuracy, 0 means not specified. */
512 ASN1_INTEGER *micros; /* accuracy, 0 means not specified. */
513 unsigned clock_precision_digits; /* fraction of seconds in
515 unsigned flags; /* Optional info, see values above. */
517 /* Callback functions. */
518 TS_serial_cb serial_cb;
519 void *serial_cb_data; /* User data for serial_cb. */
522 void *time_cb_data; /* User data for time_cb. */
524 TS_extension_cb extension_cb;
525 void *extension_cb_data; /* User data for extension_cb. */
527 /* These members are used only while creating the response. */
530 TS_TST_INFO *tst_info;
533 DECLARE_STACK_OF(EVP_MD)
534 DECLARE_ASN1_SET_OF(EVP_MD)
536 /* Creates a response context that can be used for generating responses. */
537 TS_RESP_CTX *TS_RESP_CTX_new(void);
538 void TS_RESP_CTX_free(TS_RESP_CTX *ctx);
540 /* This parameter must be set. */
541 int TS_RESP_CTX_set_signer_cert(TS_RESP_CTX *ctx, X509 *signer);
543 /* This parameter must be set. */
544 int TS_RESP_CTX_set_signer_key(TS_RESP_CTX *ctx, EVP_PKEY *key);
546 /* This parameter must be set. */
547 int TS_RESP_CTX_set_def_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *def_policy);
549 /* No additional certs are included in the response by default. */
550 int TS_RESP_CTX_set_certs(TS_RESP_CTX *ctx, STACK_OF(X509) *certs);
552 /* Adds a new acceptable policy, only the default policy
553 is accepted by default. */
554 int TS_RESP_CTX_add_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *policy);
556 /* Adds a new acceptable message digest. Note that no message digests
557 are accepted by default. The md argument is shared with the caller. */
558 int TS_RESP_CTX_add_md(TS_RESP_CTX *ctx, const EVP_MD *md);
560 /* Accuracy is not included by default. */
561 int TS_RESP_CTX_set_accuracy(TS_RESP_CTX *ctx,
562 int secs, int millis, int micros);
564 /* Clock precision digits, i.e. the number of decimal digits:
565 '0' means sec, '3' msec, '6' usec, and so on. Default is 0. */
566 int TS_RESP_CTX_set_clock_precision_digits(TS_RESP_CTX *ctx,
567 unsigned clock_precision_digits);
568 /* At most we accept usec precision. */
569 #define TS_MAX_CLOCK_PRECISION_DIGITS 6
571 /* No flags are set by default. */
572 void TS_RESP_CTX_add_flags(TS_RESP_CTX *ctx, int flags);
574 /* Default callback always returns a constant. */
575 void TS_RESP_CTX_set_serial_cb(TS_RESP_CTX *ctx, TS_serial_cb cb, void *data);
577 /* Default callback uses the gettimeofday() and gmtime() system calls. */
578 void TS_RESP_CTX_set_time_cb(TS_RESP_CTX *ctx, TS_time_cb cb, void *data);
580 /* Default callback rejects all extensions. The extension callback is called
581 * when the TS_TST_INFO object is already set up and not signed yet. */
582 /* FIXME: extension handling is not tested yet. */
583 void TS_RESP_CTX_set_extension_cb(TS_RESP_CTX *ctx,
584 TS_extension_cb cb, void *data);
586 /* The following methods can be used in the callbacks. */
587 int TS_RESP_CTX_set_status_info(TS_RESP_CTX *ctx,
588 int status, const char *text);
590 /* Sets the status info only if it is still TS_STATUS_GRANTED. */
591 int TS_RESP_CTX_set_status_info_cond(TS_RESP_CTX *ctx,
592 int status, const char *text);
594 int TS_RESP_CTX_add_failure_info(TS_RESP_CTX *ctx, int failure);
596 /* The get methods below can be used in the extension callback. */
597 TS_REQ *TS_RESP_CTX_get_request(TS_RESP_CTX *ctx);
599 TS_TST_INFO *TS_RESP_CTX_get_tst_info(TS_RESP_CTX *ctx);
602 * Creates the signed TS_TST_INFO and puts it in TS_RESP.
603 * In case of errors it sets the status info properly.
604 * Returns NULL only in case of memory allocation/fatal error.
606 TS_RESP *TS_RESP_create_response(TS_RESP_CTX *ctx, BIO *req_bio);
609 * Declarations related to response verification,
610 * they are defined in ts/ts_resp_verify.c.
613 int TS_RESP_verify_signature(PKCS7 *token, STACK_OF(X509) *certs,
614 X509_STORE *store, X509 **signer_out);
616 /* Context structure for the generic verify method. */
618 /* Verify the signer's certificate and the signature of the response. */
619 #define TS_VFY_SIGNATURE (1u << 0)
620 /* Verify the version number of the response. */
621 #define TS_VFY_VERSION (1u << 1)
622 /* Verify if the policy supplied by the user matches the policy of the TSA. */
623 #define TS_VFY_POLICY (1u << 2)
624 /* Verify the message imprint provided by the user. This flag should not be
625 specified with TS_VFY_DATA. */
626 #define TS_VFY_IMPRINT (1u << 3)
627 /* Verify the message imprint computed by the verify method from the user
628 provided data and the MD algorithm of the response. This flag should not be
629 specified with TS_VFY_IMPRINT. */
630 #define TS_VFY_DATA (1u << 4)
631 /* Verify the nonce value. */
632 #define TS_VFY_NONCE (1u << 5)
633 /* Verify if the TSA name field matches the signer certificate. */
634 #define TS_VFY_SIGNER (1u << 6)
635 /* Verify if the TSA name field equals to the user provided name. */
636 #define TS_VFY_TSA_NAME (1u << 7)
638 /* You can use the following convenience constants. */
639 #define TS_VFY_ALL_IMPRINT (TS_VFY_SIGNATURE \
646 #define TS_VFY_ALL_DATA (TS_VFY_SIGNATURE \
654 typedef struct TS_verify_ctx
656 /* Set this to the union of TS_VFY_... flags you want to carry out. */
659 /* Must be set only with TS_VFY_SIGNATURE. certs is optional. */
661 STACK_OF(X509) *certs;
663 /* Must be set only with TS_VFY_POLICY. */
666 /* Must be set only with TS_VFY_IMPRINT. If md_alg is NULL,
667 the algorithm from the response is used. */
669 unsigned char *imprint;
670 unsigned imprint_len;
672 /* Must be set only with TS_VFY_DATA. */
675 /* Must be set only with TS_VFY_TSA_NAME. */
678 /* Must be set only with TS_VFY_TSA_NAME. */
679 GENERAL_NAME *tsa_name;
682 int TS_RESP_verify_response(TS_VERIFY_CTX *ctx, TS_RESP *response);
683 int TS_RESP_verify_token(TS_VERIFY_CTX *ctx, PKCS7 *token);
686 * Declarations related to response verification context,
687 * they are defined in ts/ts_verify_ctx.c.
690 /* Set all fields to zero. */
691 TS_VERIFY_CTX *TS_VERIFY_CTX_new(void);
692 void TS_VERIFY_CTX_init(TS_VERIFY_CTX *ctx);
693 void TS_VERIFY_CTX_free(TS_VERIFY_CTX *ctx);
694 void TS_VERIFY_CTX_cleanup(TS_VERIFY_CTX *ctx);
697 * If ctx is NULL, it allocates and returns a new object, otherwise
698 * it returns ctx. It initialises all the members as follows:
699 * flags = TS_VFY_ALL_IMPRINT & ~(TS_VFY_TSA_NAME | TS_VFY_SIGNATURE)
702 * policy = policy from the request or NULL if absent (in this case
703 * TS_VFY_POLICY is cleared from flags as well)
704 * md_alg = MD algorithm from request
705 * imprint, imprint_len = imprint from request
707 * nonce, nonce_len = nonce from the request or NULL if absent (in this case
708 * TS_VFY_NONCE is cleared from flags as well)
710 * Important: after calling this method TS_VFY_SIGNATURE should be added!
712 TS_VERIFY_CTX *TS_REQ_to_TS_VERIFY_CTX(TS_REQ *req, TS_VERIFY_CTX *ctx);
714 /* Function declarations for TS_RESP defined in ts/ts_resp_print.c */
716 int TS_RESP_print_bio(BIO *bio, TS_RESP *a);
717 int TS_STATUS_INFO_print_bio(BIO *bio, TS_STATUS_INFO *a);
718 int TS_TST_INFO_print_bio(BIO *bio, TS_TST_INFO *a);
720 /* Common utility functions defined in ts/ts_lib.c */
722 int TS_ASN1_INTEGER_print_bio(BIO *bio, ASN1_INTEGER *num);
723 int TS_OBJ_print_bio(BIO *bio, ASN1_OBJECT *obj);
724 int TS_ext_print_bio(BIO *bio, STACK_OF(X509_EXTENSION) *extensions);
725 int TS_X509_ALGOR_print_bio(BIO *bio, X509_ALGOR *alg);
726 int TS_MSG_IMPRINT_print_bio(BIO *bio, TS_MSG_IMPRINT *msg);
728 /* Function declarations for handling configuration options,
729 defined in ts/ts_conf.c */
731 X509 *TS_CONF_load_cert(const char *file);
732 STACK_OF(X509) *TS_CONF_load_certs(const char *file);
733 EVP_PKEY *TS_CONF_load_key(const char *file, const char *pass);
734 const char *TS_CONF_get_tsa_section(CONF *conf, const char *section);
735 int TS_CONF_set_serial(CONF *conf, const char *section, TS_serial_cb cb,
737 int TS_CONF_set_crypto_device(CONF *conf, const char *section,
739 int TS_CONF_set_default_engine(const char *name);
740 int TS_CONF_set_signer_cert(CONF *conf, const char *section,
741 const char *cert, TS_RESP_CTX *ctx);
742 int TS_CONF_set_certs(CONF *conf, const char *section, const char *certs,
744 int TS_CONF_set_signer_key(CONF *conf, const char *section,
745 const char *key, const char *pass, TS_RESP_CTX *ctx);
746 int TS_CONF_set_def_policy(CONF *conf, const char *section,
747 const char *policy, TS_RESP_CTX *ctx);
748 int TS_CONF_set_policies(CONF *conf, const char *section, TS_RESP_CTX *ctx);
749 int TS_CONF_set_digests(CONF *conf, const char *section, TS_RESP_CTX *ctx);
750 int TS_CONF_set_accuracy(CONF *conf, const char *section, TS_RESP_CTX *ctx);
751 int TS_CONF_set_clock_precision_digits(CONF *conf, const char *section,
753 int TS_CONF_set_ordering(CONF *conf, const char *section, TS_RESP_CTX *ctx);
754 int TS_CONF_set_tsa_name(CONF *conf, const char *section, TS_RESP_CTX *ctx);
755 int TS_CONF_set_ess_cert_id_chain(CONF *conf, const char *section,
758 /* -------------------------------------------------- */
759 /* BEGIN ERROR CODES */
760 /* The following lines are auto generated by the script mkerr.pl. Any changes
761 * made after this point may be overwritten when the script is next run.
763 void ERR_load_TS_strings(void);
765 /* Error codes for the TS functions. */
767 /* Function codes. */
768 #define TS_F_D2I_TS_RESP 147
769 #define TS_F_DEF_SERIAL_CB 110
770 #define TS_F_DEF_TIME_CB 111
771 #define TS_F_ESS_ADD_SIGNING_CERT 112
772 #define TS_F_ESS_CERT_ID_NEW_INIT 113
773 #define TS_F_ESS_SIGNING_CERT_NEW_INIT 114
774 #define TS_F_PKCS7_TO_TS_TST_INFO 148
775 #define TS_F_TS_ACCURACY_SET_MICROS 115
776 #define TS_F_TS_ACCURACY_SET_MILLIS 116
777 #define TS_F_TS_ACCURACY_SET_SECONDS 117
778 #define TS_F_TS_CHECK_IMPRINTS 100
779 #define TS_F_TS_CHECK_NONCES 101
780 #define TS_F_TS_CHECK_POLICY 102
781 #define TS_F_TS_CHECK_SIGNING_CERTS 103
782 #define TS_F_TS_CHECK_STATUS_INFO 104
783 #define TS_F_TS_COMPUTE_IMPRINT 145
784 #define TS_F_TS_CONF_SET_DEFAULT_ENGINE 146
785 #define TS_F_TS_GET_STATUS_TEXT 105
786 #define TS_F_TS_MSG_IMPRINT_SET_ALGO 118
787 #define TS_F_TS_REQ_SET_MSG_IMPRINT 119
788 #define TS_F_TS_REQ_SET_NONCE 120
789 #define TS_F_TS_REQ_SET_POLICY_ID 121
790 #define TS_F_TS_RESP_CREATE_RESPONSE 122
791 #define TS_F_TS_RESP_CREATE_TST_INFO 123
792 #define TS_F_TS_RESP_CTX_ADD_FAILURE_INFO 124
793 #define TS_F_TS_RESP_CTX_ADD_MD 125
794 #define TS_F_TS_RESP_CTX_ADD_POLICY 126
795 #define TS_F_TS_RESP_CTX_NEW 127
796 #define TS_F_TS_RESP_CTX_SET_ACCURACY 128
797 #define TS_F_TS_RESP_CTX_SET_CERTS 129
798 #define TS_F_TS_RESP_CTX_SET_DEF_POLICY 130
799 #define TS_F_TS_RESP_CTX_SET_SIGNER_CERT 131
800 #define TS_F_TS_RESP_CTX_SET_STATUS_INFO 132
801 #define TS_F_TS_RESP_GET_POLICY 133
802 #define TS_F_TS_RESP_SET_GENTIME_WITH_PRECISION 134
803 #define TS_F_TS_RESP_SET_STATUS_INFO 135
804 #define TS_F_TS_RESP_SIGN 136
805 #define TS_F_TS_RESP_VERIFY_SIGNATURE 106
806 #define TS_F_TS_RESP_VERIFY_TOKEN 107
807 #define TS_F_TS_TST_INFO_SET_ACCURACY 137
808 #define TS_F_TS_TST_INFO_SET_MSG_IMPRINT 138
809 #define TS_F_TS_TST_INFO_SET_NONCE 139
810 #define TS_F_TS_TST_INFO_SET_POLICY_ID 140
811 #define TS_F_TS_TST_INFO_SET_SERIAL 141
812 #define TS_F_TS_TST_INFO_SET_TIME 142
813 #define TS_F_TS_TST_INFO_SET_TSA 143
814 #define TS_F_TS_VERIFY 108
815 #define TS_F_TS_VERIFY_CERT 109
816 #define TS_F_TS_VERIFY_CTX_NEW 144
819 #define TS_R_BAD_PKCS7_TYPE 132
820 #define TS_R_BAD_TYPE 133
821 #define TS_R_CERTIFICATE_VERIFY_ERROR 100
822 #define TS_R_COULD_NOT_SET_ENGINE 127
823 #define TS_R_COULD_NOT_SET_TIME 115
824 #define TS_R_D2I_TS_RESP_INT_FAILED 128
825 #define TS_R_DETACHED_CONTENT 134
826 #define TS_R_ESS_ADD_SIGNING_CERT_ERROR 116
827 #define TS_R_ESS_SIGNING_CERTIFICATE_ERROR 101
828 #define TS_R_INVALID_NULL_POINTER 102
829 #define TS_R_INVALID_SIGNER_CERTIFICATE_PURPOSE 117
830 #define TS_R_MESSAGE_IMPRINT_MISMATCH 103
831 #define TS_R_NONCE_MISMATCH 104
832 #define TS_R_NONCE_NOT_RETURNED 105
833 #define TS_R_NO_CONTENT 106
834 #define TS_R_NO_TIME_STAMP_TOKEN 107
835 #define TS_R_PKCS7_ADD_SIGNATURE_ERROR 118
836 #define TS_R_PKCS7_ADD_SIGNED_ATTR_ERROR 119
837 #define TS_R_PKCS7_TO_TS_TST_INFO_FAILED 129
838 #define TS_R_POLICY_MISMATCH 108
839 #define TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE 120
840 #define TS_R_RESPONSE_SETUP_ERROR 121
841 #define TS_R_SIGNATURE_FAILURE 109
842 #define TS_R_THERE_MUST_BE_ONE_SIGNER 110
843 #define TS_R_TIME_SYSCALL_ERROR 122
844 #define TS_R_TOKEN_NOT_PRESENT 130
845 #define TS_R_TOKEN_PRESENT 131
846 #define TS_R_TSA_NAME_MISMATCH 111
847 #define TS_R_TSA_UNTRUSTED 112
848 #define TS_R_TST_INFO_SETUP_ERROR 123
849 #define TS_R_TS_DATASIGN 124
850 #define TS_R_UNACCEPTABLE_POLICY 125
851 #define TS_R_UNSUPPORTED_MD_ALGORITHM 126
852 #define TS_R_UNSUPPORTED_VERSION 113
853 #define TS_R_WRONG_CONTENT_TYPE 114