-static int TS_RESP_sign(TS_RESP_CTX *ctx)
- {
- int ret = 0;
- PKCS7 *p7 = NULL;
- PKCS7_SIGNER_INFO *si;
- STACK_OF(X509) *certs; /* Certificates to include in sc. */
- ESS_SIGNING_CERT *sc = NULL;
- ASN1_OBJECT *oid;
- BIO *p7bio = NULL;
- int i;
-
- /* Check if signcert and pkey match. */
- if (!X509_check_private_key(ctx->signer_cert, ctx->signer_key)) {
- TSerr(TS_F_TS_RESP_SIGN,
- TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE);
- goto err;
- }
-
- /* Create a new PKCS7 signed object. */
- if (!(p7 = PKCS7_new())) {
- TSerr(TS_F_TS_RESP_SIGN, ERR_R_MALLOC_FAILURE);
- goto err;
- }
- if (!PKCS7_set_type(p7, NID_pkcs7_signed)) goto err;
-
- /* Force SignedData version to be 3 instead of the default 1. */
- if (!ASN1_INTEGER_set(p7->d.sign->version, 3)) goto err;
-
- /* Add signer certificate and optional certificate chain. */
- if (TS_REQ_get_cert_req(ctx->request))
- {
- PKCS7_add_certificate(p7, ctx->signer_cert);
- if (ctx->certs)
- {
- for(i = 0; i < sk_X509_num(ctx->certs); ++i)
- {
- X509 *cert = sk_X509_value(ctx->certs, i);
- PKCS7_add_certificate(p7, cert);
- }
- }
- }
-
- /* Add a new signer info. */
- if (!(si = PKCS7_add_signature(p7, ctx->signer_cert,
- ctx->signer_key, EVP_sha1())))
- {
- TSerr(TS_F_TS_RESP_SIGN, TS_R_PKCS7_ADD_SIGNATURE_ERROR);
- goto err;
- }
-
- /* Add content type signed attribute to the signer info. */
- oid = OBJ_nid2obj(NID_id_smime_ct_TSTInfo);
- if (!PKCS7_add_signed_attribute(si, NID_pkcs9_contentType,
- V_ASN1_OBJECT, oid))
- {
- TSerr(TS_F_TS_RESP_SIGN, TS_R_PKCS7_ADD_SIGNED_ATTR_ERROR);
- goto err;
- }
-
- /* Create the ESS SigningCertificate attribute which contains
- the signer certificate id and optionally the certificate chain. */
- certs = ctx->flags & TS_ESS_CERT_ID_CHAIN ? ctx->certs : NULL;
- if (!(sc = ESS_SIGNING_CERT_new_init(ctx->signer_cert, certs)))
- goto err;
-
- /* Add SigningCertificate signed attribute to the signer info. */
- if (!ESS_add_signing_cert(si, sc))
- {
- TSerr(TS_F_TS_RESP_SIGN, TS_R_ESS_ADD_SIGNING_CERT_ERROR);
- goto err;
- }
-
- /* Add a new empty NID_id_smime_ct_TSTInfo encapsulated content. */
- if (!TS_TST_INFO_content_new(p7)) goto err;
-
- /* Add the DER encoded tst_info to the PKCS7 structure. */
- if (!(p7bio = PKCS7_dataInit(p7, NULL))) {
- TSerr(TS_F_TS_RESP_SIGN, ERR_R_MALLOC_FAILURE);
- goto err;
- }
-
- /* Convert tst_info to DER. */
- if (!i2d_TS_TST_INFO_bio(p7bio, ctx->tst_info))
- {
- TSerr(TS_F_TS_RESP_SIGN, TS_R_TS_DATASIGN);
- goto err;
- }
-
- /* Create the signature and add it to the signer info. */
- if (!PKCS7_dataFinal(p7, p7bio))
- {
- TSerr(TS_F_TS_RESP_SIGN, TS_R_TS_DATASIGN);
- goto err;
- }
-
- /* Set new PKCS7 and TST_INFO objects. */
- TS_RESP_set_tst_info(ctx->response, p7, ctx->tst_info);
- p7 = NULL; /* Ownership is lost. */
- ctx->tst_info = NULL; /* Ownership is lost. */
-
- ret = 1;
+static int ts_RESP_sign(TS_RESP_CTX *ctx)
+{
+ int ret = 0;
+ PKCS7 *p7 = NULL;
+ PKCS7_SIGNER_INFO *si;
+ STACK_OF(X509) *certs; /* Certificates to include in sc. */
+ ESS_SIGNING_CERT *sc = NULL;
+ ASN1_OBJECT *oid;
+ BIO *p7bio = NULL;
+ int i;
+
+ if (!X509_check_private_key(ctx->signer_cert, ctx->signer_key)) {
+ TSerr(TS_F_TS_RESP_SIGN, TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE);
+ goto err;
+ }
+
+ if ((p7 = PKCS7_new()) == NULL) {
+ TSerr(TS_F_TS_RESP_SIGN, ERR_R_MALLOC_FAILURE);
+ goto err;
+ }
+ if (!PKCS7_set_type(p7, NID_pkcs7_signed))
+ goto err;
+ if (!ASN1_INTEGER_set(p7->d.sign->version, 3))
+ goto err;
+
+ if (ctx->request->cert_req) {
+ PKCS7_add_certificate(p7, ctx->signer_cert);
+ if (ctx->certs) {
+ for (i = 0; i < sk_X509_num(ctx->certs); ++i) {
+ X509 *cert = sk_X509_value(ctx->certs, i);
+ PKCS7_add_certificate(p7, cert);
+ }
+ }
+ }
+
+ if ((si = PKCS7_add_signature(p7, ctx->signer_cert,
+ ctx->signer_key, ctx->signer_md)) == NULL) {
+ TSerr(TS_F_TS_RESP_SIGN, TS_R_PKCS7_ADD_SIGNATURE_ERROR);
+ goto err;
+ }
+
+ oid = OBJ_nid2obj(NID_id_smime_ct_TSTInfo);
+ if (!PKCS7_add_signed_attribute(si, NID_pkcs9_contentType,
+ V_ASN1_OBJECT, oid)) {
+ TSerr(TS_F_TS_RESP_SIGN, TS_R_PKCS7_ADD_SIGNED_ATTR_ERROR);
+ goto err;
+ }
+
+ certs = ctx->flags & TS_ESS_CERT_ID_CHAIN ? ctx->certs : NULL;
+ if ((sc = ess_SIGNING_CERT_new_init(ctx->signer_cert, certs)) == NULL)
+ goto err;
+ if (!ESS_add_signing_cert(si, sc)) {
+ TSerr(TS_F_TS_RESP_SIGN, TS_R_ESS_ADD_SIGNING_CERT_ERROR);
+ goto err;
+ }
+
+ if (!ts_TST_INFO_content_new(p7))
+ goto err;
+ if ((p7bio = PKCS7_dataInit(p7, NULL)) == NULL) {
+ TSerr(TS_F_TS_RESP_SIGN, ERR_R_MALLOC_FAILURE);
+ goto err;
+ }
+ if (!i2d_TS_TST_INFO_bio(p7bio, ctx->tst_info)) {
+ TSerr(TS_F_TS_RESP_SIGN, TS_R_TS_DATASIGN);
+ goto err;
+ }
+ if (!PKCS7_dataFinal(p7, p7bio)) {
+ TSerr(TS_F_TS_RESP_SIGN, TS_R_TS_DATASIGN);
+ goto err;
+ }
+ TS_RESP_set_tst_info(ctx->response, p7, ctx->tst_info);
+ p7 = NULL; /* Ownership is lost. */
+ ctx->tst_info = NULL; /* Ownership is lost. */
+
+ ret = 1;