abc/GmSSL
1
0
Fork 0
mirror of https://github.com/guanzhi/GmSSL.git synced 2026-06-13 08:23:50 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/master'

Browse Source 
# Conflicts:
#	README.md
This commit is contained in:
Zhi Guan
2017-02-14 16:12:29 +08:00
parent d2254170b8
commit 43fed1108d
3503 changed files with 320546 additions and 408546 deletions
Download Patch File Download Diff File Expand all files Collapse all files

289
crypto/ts/Makefile
View File

@@ -1,289 +0,0 @@
#
# SSLeay/crypto/ts/Makefile
#
DIR= ts
TOP= ../..
CC= cc
INCLUDES= -I.. -I../../include
CFLAG = -g
INSTALL_PREFIX=
OPENSSLDIR= /usr/local/ssl
INSTALLTOP=/usr/local/ssl
MAKEDEPPROG= makedepend
MAKEDEPEND= $(TOP)/util/domd $(TOP) -MD $(MAKEDEPPROG)
MAKEFILE= Makefile
AR= ar r
PEX_LIBS=
EX_LIBS=
CFLAGS= $(INCLUDES) $(CFLAG)
GENERAL= Makefile
TEST=
APPS=
LIB=$(TOP)/libcrypto.a
LIBSRC= ts_err.c ts_req_utils.c ts_req_print.c ts_rsp_utils.c ts_rsp_print.c \
ts_rsp_sign.c ts_rsp_verify.c ts_verify_ctx.c ts_lib.c ts_conf.c \
ts_asn1.c
LIBOBJ= ts_err.o ts_req_utils.o ts_req_print.o ts_rsp_utils.o ts_rsp_print.o \
ts_rsp_sign.o ts_rsp_verify.o ts_verify_ctx.o ts_lib.o ts_conf.o \
ts_asn1.o
SRC= $(LIBSRC)
EXHEADER= ts.h
HEADER= $(EXHEADER)
ALL= $(GENERAL) $(SRC) $(HEADER)
top:
(cd ../..; $(MAKE) DIRS=crypto SDIRS=$(DIR) sub_all)
test:
all: lib
lib: $(LIBOBJ)
$(AR) $(LIB) $(LIBOBJ)
$(RANLIB) $(LIB) || echo Never mind.
@touch lib
files:
$(PERL) $(TOP)/util/files.pl Makefile >> $(TOP)/MINFO
links:
@$(PERL) $(TOP)/util/mklink.pl ../../include/openssl $(EXHEADER)
@$(PERL) $(TOP)/util/mklink.pl ../../test $(TEST)
@$(PERL) $(TOP)/util/mklink.pl ../../apps $(APPS)
install:
@[ -n "$(INSTALLTOP)" ] # should be set by top Makefile...
@headerlist="$(EXHEADER)"; for i in $$headerlist ; \
do \
(cp $$i $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i; \
chmod 644 $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i ); \
done;
tags:
ctags $(SRC)
lint:
lint -DLINT $(INCLUDES) $(SRC)>fluff
update: depend
depend:
$(MAKEDEPEND) -- $(CFLAG) $(INCLUDES) $(DEPFLAG) -- $(LIBSRC)
dclean:
$(PERL) -pe 'if (/^# DO NOT DELETE THIS LINE/) {print; exit(0);}' $(MAKEFILE) >Makefile.new
mv -f Makefile.new $(MAKEFILE)
clean:
rm -f *.o *.obj lib tags core .pure .nfs* *.old *.bak fluff enc dec sign verify
# DO NOT DELETE THIS LINE -- make depend depends on it.
ts_asn1.o: ../../include/openssl/asn1.h ../../include/openssl/asn1t.h
ts_asn1.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
ts_asn1.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
ts_asn1.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
ts_asn1.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
ts_asn1.o: ../../include/openssl/ecdh.h ../../include/openssl/ecdsa.h
ts_asn1.o: ../../include/openssl/err.h ../../include/openssl/evp.h
ts_asn1.o: ../../include/openssl/kdf.h ../../include/openssl/lhash.h
ts_asn1.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
ts_asn1.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
ts_asn1.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pkcs7.h
ts_asn1.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
ts_asn1.o: ../../include/openssl/sha.h ../../include/openssl/sm2.h
ts_asn1.o: ../../include/openssl/sm3.h ../../include/openssl/stack.h
ts_asn1.o: ../../include/openssl/symhacks.h ../../include/openssl/ts.h
ts_asn1.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
ts_asn1.o: ../../include/openssl/x509v3.h ts_asn1.c
ts_conf.o: ../../e_os.h ../../include/openssl/asn1.h
ts_conf.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
ts_conf.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
ts_conf.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
ts_conf.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
ts_conf.o: ../../include/openssl/ecdh.h ../../include/openssl/ecdsa.h
ts_conf.o: ../../include/openssl/engine.h ../../include/openssl/err.h
ts_conf.o: ../../include/openssl/evp.h ../../include/openssl/kdf.h
ts_conf.o: ../../include/openssl/lhash.h ../../include/openssl/obj_mac.h
ts_conf.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
ts_conf.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
ts_conf.o: ../../include/openssl/pem.h ../../include/openssl/pem2.h
ts_conf.o: ../../include/openssl/pkcs7.h ../../include/openssl/rsa.h
ts_conf.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
ts_conf.o: ../../include/openssl/sm2.h ../../include/openssl/sm3.h
ts_conf.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
ts_conf.o: ../../include/openssl/ts.h ../../include/openssl/x509.h
ts_conf.o: ../../include/openssl/x509_vfy.h ../../include/openssl/x509v3.h
ts_conf.o: ../cryptlib.h ts_conf.c
ts_err.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
ts_err.o: ../../include/openssl/buffer.h ../../include/openssl/conf.h
ts_err.o: ../../include/openssl/crypto.h ../../include/openssl/dh.h
ts_err.o: ../../include/openssl/dsa.h ../../include/openssl/e_os2.h
ts_err.o: ../../include/openssl/ec.h ../../include/openssl/ecdh.h
ts_err.o: ../../include/openssl/ecdsa.h ../../include/openssl/err.h
ts_err.o: ../../include/openssl/evp.h ../../include/openssl/kdf.h
ts_err.o: ../../include/openssl/lhash.h ../../include/openssl/obj_mac.h
ts_err.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
ts_err.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
ts_err.o: ../../include/openssl/pkcs7.h ../../include/openssl/rsa.h
ts_err.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
ts_err.o: ../../include/openssl/sm2.h ../../include/openssl/sm3.h
ts_err.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
ts_err.o: ../../include/openssl/ts.h ../../include/openssl/x509.h
ts_err.o: ../../include/openssl/x509_vfy.h ../../include/openssl/x509v3.h
ts_err.o: ts_err.c
ts_lib.o: ../../e_os.h ../../include/openssl/asn1.h ../../include/openssl/bio.h
ts_lib.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
ts_lib.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
ts_lib.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
ts_lib.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
ts_lib.o: ../../include/openssl/ecdh.h ../../include/openssl/ecdsa.h
ts_lib.o: ../../include/openssl/err.h ../../include/openssl/evp.h
ts_lib.o: ../../include/openssl/kdf.h ../../include/openssl/lhash.h
ts_lib.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
ts_lib.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
ts_lib.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pkcs7.h
ts_lib.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
ts_lib.o: ../../include/openssl/sha.h ../../include/openssl/sm2.h
ts_lib.o: ../../include/openssl/sm3.h ../../include/openssl/stack.h
ts_lib.o: ../../include/openssl/symhacks.h ../../include/openssl/x509.h
ts_lib.o: ../../include/openssl/x509_vfy.h ../../include/openssl/x509v3.h
ts_lib.o: ../cryptlib.h ts.h ts_lib.c
ts_req_print.o: ../../e_os.h ../../include/openssl/asn1.h
ts_req_print.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
ts_req_print.o: ../../include/openssl/buffer.h ../../include/openssl/conf.h
ts_req_print.o: ../../include/openssl/crypto.h ../../include/openssl/dh.h
ts_req_print.o: ../../include/openssl/dsa.h ../../include/openssl/e_os2.h
ts_req_print.o: ../../include/openssl/ec.h ../../include/openssl/ecdh.h
ts_req_print.o: ../../include/openssl/ecdsa.h ../../include/openssl/err.h
ts_req_print.o: ../../include/openssl/evp.h ../../include/openssl/kdf.h
ts_req_print.o: ../../include/openssl/lhash.h ../../include/openssl/obj_mac.h
ts_req_print.o: ../../include/openssl/objects.h
ts_req_print.o: ../../include/openssl/opensslconf.h
ts_req_print.o: ../../include/openssl/opensslv.h
ts_req_print.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pkcs7.h
ts_req_print.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
ts_req_print.o: ../../include/openssl/sha.h ../../include/openssl/sm2.h
ts_req_print.o: ../../include/openssl/sm3.h ../../include/openssl/stack.h
ts_req_print.o: ../../include/openssl/symhacks.h ../../include/openssl/ts.h
ts_req_print.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
ts_req_print.o: ../../include/openssl/x509v3.h ../cryptlib.h ts_req_print.c
ts_req_utils.o: ../../e_os.h ../../include/openssl/asn1.h
ts_req_utils.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
ts_req_utils.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
ts_req_utils.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
ts_req_utils.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
ts_req_utils.o: ../../include/openssl/ecdh.h ../../include/openssl/ecdsa.h
ts_req_utils.o: ../../include/openssl/err.h ../../include/openssl/evp.h
ts_req_utils.o: ../../include/openssl/kdf.h ../../include/openssl/lhash.h
ts_req_utils.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
ts_req_utils.o: ../../include/openssl/opensslconf.h
ts_req_utils.o: ../../include/openssl/opensslv.h
ts_req_utils.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pkcs7.h
ts_req_utils.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
ts_req_utils.o: ../../include/openssl/sha.h ../../include/openssl/sm2.h
ts_req_utils.o: ../../include/openssl/sm3.h ../../include/openssl/stack.h
ts_req_utils.o: ../../include/openssl/symhacks.h ../../include/openssl/ts.h
ts_req_utils.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
ts_req_utils.o: ../../include/openssl/x509v3.h ../cryptlib.h ts_req_utils.c
ts_rsp_print.o: ../../e_os.h ../../include/openssl/asn1.h
ts_rsp_print.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
ts_rsp_print.o: ../../include/openssl/buffer.h ../../include/openssl/conf.h
ts_rsp_print.o: ../../include/openssl/crypto.h ../../include/openssl/dh.h
ts_rsp_print.o: ../../include/openssl/dsa.h ../../include/openssl/e_os2.h
ts_rsp_print.o: ../../include/openssl/ec.h ../../include/openssl/ecdh.h
ts_rsp_print.o: ../../include/openssl/ecdsa.h ../../include/openssl/err.h
ts_rsp_print.o: ../../include/openssl/evp.h ../../include/openssl/kdf.h
ts_rsp_print.o: ../../include/openssl/lhash.h ../../include/openssl/obj_mac.h
ts_rsp_print.o: ../../include/openssl/objects.h
ts_rsp_print.o: ../../include/openssl/opensslconf.h
ts_rsp_print.o: ../../include/openssl/opensslv.h
ts_rsp_print.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pkcs7.h
ts_rsp_print.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
ts_rsp_print.o: ../../include/openssl/sha.h ../../include/openssl/sm2.h
ts_rsp_print.o: ../../include/openssl/sm3.h ../../include/openssl/stack.h
ts_rsp_print.o: ../../include/openssl/symhacks.h ../../include/openssl/x509.h
ts_rsp_print.o: ../../include/openssl/x509_vfy.h ../../include/openssl/x509v3.h
ts_rsp_print.o: ../cryptlib.h ts.h ts_rsp_print.c
ts_rsp_sign.o: ../../e_os.h ../../include/openssl/asn1.h
ts_rsp_sign.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
ts_rsp_sign.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
ts_rsp_sign.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
ts_rsp_sign.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
ts_rsp_sign.o: ../../include/openssl/ecdh.h ../../include/openssl/ecdsa.h
ts_rsp_sign.o: ../../include/openssl/err.h ../../include/openssl/evp.h
ts_rsp_sign.o: ../../include/openssl/kdf.h ../../include/openssl/lhash.h
ts_rsp_sign.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
ts_rsp_sign.o: ../../include/openssl/opensslconf.h
ts_rsp_sign.o: ../../include/openssl/opensslv.h
ts_rsp_sign.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pkcs7.h
ts_rsp_sign.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
ts_rsp_sign.o: ../../include/openssl/sha.h ../../include/openssl/sm2.h
ts_rsp_sign.o: ../../include/openssl/sm3.h ../../include/openssl/stack.h
ts_rsp_sign.o: ../../include/openssl/symhacks.h ../../include/openssl/ts.h
ts_rsp_sign.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
ts_rsp_sign.o: ../../include/openssl/x509v3.h ../cryptlib.h ts_rsp_sign.c
ts_rsp_utils.o: ../../e_os.h ../../include/openssl/asn1.h
ts_rsp_utils.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
ts_rsp_utils.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
ts_rsp_utils.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
ts_rsp_utils.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
ts_rsp_utils.o: ../../include/openssl/ecdh.h ../../include/openssl/ecdsa.h
ts_rsp_utils.o: ../../include/openssl/err.h ../../include/openssl/evp.h
ts_rsp_utils.o: ../../include/openssl/kdf.h ../../include/openssl/lhash.h
ts_rsp_utils.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
ts_rsp_utils.o: ../../include/openssl/opensslconf.h
ts_rsp_utils.o: ../../include/openssl/opensslv.h
ts_rsp_utils.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pkcs7.h
ts_rsp_utils.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
ts_rsp_utils.o: ../../include/openssl/sha.h ../../include/openssl/sm2.h
ts_rsp_utils.o: ../../include/openssl/sm3.h ../../include/openssl/stack.h
ts_rsp_utils.o: ../../include/openssl/symhacks.h ../../include/openssl/ts.h
ts_rsp_utils.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
ts_rsp_utils.o: ../../include/openssl/x509v3.h ../cryptlib.h ts_rsp_utils.c
ts_rsp_verify.o: ../../e_os.h ../../include/openssl/asn1.h
ts_rsp_verify.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
ts_rsp_verify.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
ts_rsp_verify.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
ts_rsp_verify.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
ts_rsp_verify.o: ../../include/openssl/ecdh.h ../../include/openssl/ecdsa.h
ts_rsp_verify.o: ../../include/openssl/err.h ../../include/openssl/evp.h
ts_rsp_verify.o: ../../include/openssl/kdf.h ../../include/openssl/lhash.h
ts_rsp_verify.o: ../../include/openssl/obj_mac.h
ts_rsp_verify.o: ../../include/openssl/objects.h
ts_rsp_verify.o: ../../include/openssl/opensslconf.h
ts_rsp_verify.o: ../../include/openssl/opensslv.h
ts_rsp_verify.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pkcs7.h
ts_rsp_verify.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
ts_rsp_verify.o: ../../include/openssl/sha.h ../../include/openssl/sm2.h
ts_rsp_verify.o: ../../include/openssl/sm3.h ../../include/openssl/stack.h
ts_rsp_verify.o: ../../include/openssl/symhacks.h ../../include/openssl/ts.h
ts_rsp_verify.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
ts_rsp_verify.o: ../../include/openssl/x509v3.h ../cryptlib.h ts_rsp_verify.c
ts_verify_ctx.o: ../../e_os.h ../../include/openssl/asn1.h
ts_verify_ctx.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
ts_verify_ctx.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
ts_verify_ctx.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
ts_verify_ctx.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
ts_verify_ctx.o: ../../include/openssl/ecdh.h ../../include/openssl/ecdsa.h
ts_verify_ctx.o: ../../include/openssl/err.h ../../include/openssl/evp.h
ts_verify_ctx.o: ../../include/openssl/kdf.h ../../include/openssl/lhash.h
ts_verify_ctx.o: ../../include/openssl/obj_mac.h
ts_verify_ctx.o: ../../include/openssl/objects.h
ts_verify_ctx.o: ../../include/openssl/opensslconf.h
ts_verify_ctx.o: ../../include/openssl/opensslv.h
ts_verify_ctx.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pkcs7.h
ts_verify_ctx.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
ts_verify_ctx.o: ../../include/openssl/sha.h ../../include/openssl/sm2.h
ts_verify_ctx.o: ../../include/openssl/sm3.h ../../include/openssl/stack.h
ts_verify_ctx.o: ../../include/openssl/symhacks.h ../../include/openssl/ts.h
ts_verify_ctx.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
ts_verify_ctx.o: ../../include/openssl/x509v3.h ../cryptlib.h ts_verify_ctx.c

289
crypto/ts/Makefile.save
View File

@@ -1,289 +0,0 @@
#
# SSLeay/crypto/ts/Makefile
#
DIR= ts
TOP= ../..
CC= cc
INCLUDES= -I.. -I../../include
CFLAG = -g
INSTALL_PREFIX=
OPENSSLDIR= /usr/local/ssl
INSTALLTOP=/usr/local/ssl
MAKEDEPPROG= makedepend
MAKEDEPEND= $(TOP)/util/domd $(TOP) -MD $(MAKEDEPPROG)
MAKEFILE= Makefile
AR= ar r
PEX_LIBS=
EX_LIBS=
CFLAGS= $(INCLUDES) $(CFLAG)
GENERAL= Makefile
TEST=
APPS=
LIB=$(TOP)/libcrypto.a
LIBSRC= ts_err.c ts_req_utils.c ts_req_print.c ts_rsp_utils.c ts_rsp_print.c \
ts_rsp_sign.c ts_rsp_verify.c ts_verify_ctx.c ts_lib.c ts_conf.c \
ts_asn1.c
LIBOBJ= ts_err.o ts_req_utils.o ts_req_print.o ts_rsp_utils.o ts_rsp_print.o \
ts_rsp_sign.o ts_rsp_verify.o ts_verify_ctx.o ts_lib.o ts_conf.o \
ts_asn1.o
SRC= $(LIBSRC)
EXHEADER= ts.h
HEADER= $(EXHEADER)
ALL= $(GENERAL) $(SRC) $(HEADER)
top:
(cd ../..; $(MAKE) DIRS=crypto SDIRS=$(DIR) sub_all)
test:
all: lib
lib: $(LIBOBJ)
$(AR) $(LIB) $(LIBOBJ)
$(RANLIB) $(LIB) || echo Never mind.
@touch lib
files:
$(PERL) $(TOP)/util/files.pl Makefile >> $(TOP)/MINFO
links:
@$(PERL) $(TOP)/util/mklink.pl ../../include/openssl $(EXHEADER)
@$(PERL) $(TOP)/util/mklink.pl ../../test $(TEST)
@$(PERL) $(TOP)/util/mklink.pl ../../apps $(APPS)
install:
@[ -n "$(INSTALLTOP)" ] # should be set by top Makefile...
@headerlist="$(EXHEADER)"; for i in $$headerlist ; \
do \
(cp $$i $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i; \
chmod 644 $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i ); \
done;
tags:
ctags $(SRC)
lint:
lint -DLINT $(INCLUDES) $(SRC)>fluff
update: depend
depend:
$(MAKEDEPEND) -- $(CFLAG) $(INCLUDES) $(DEPFLAG) -- $(LIBSRC)
dclean:
$(PERL) -pe 'if (/^# DO NOT DELETE THIS LINE/) {print; exit(0);}' $(MAKEFILE) >Makefile.new
mv -f Makefile.new $(MAKEFILE)
clean:
rm -f *.o *.obj lib tags core .pure .nfs* *.old *.bak fluff enc dec sign verify
# DO NOT DELETE THIS LINE -- make depend depends on it.
ts_asn1.o: ../../include/openssl/asn1.h ../../include/openssl/asn1t.h
ts_asn1.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
ts_asn1.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
ts_asn1.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
ts_asn1.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
ts_asn1.o: ../../include/openssl/ecdh.h ../../include/openssl/ecdsa.h
ts_asn1.o: ../../include/openssl/err.h ../../include/openssl/evp.h
ts_asn1.o: ../../include/openssl/kdf.h ../../include/openssl/lhash.h
ts_asn1.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
ts_asn1.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
ts_asn1.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pkcs7.h
ts_asn1.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
ts_asn1.o: ../../include/openssl/sha.h ../../include/openssl/sm2.h
ts_asn1.o: ../../include/openssl/sm3.h ../../include/openssl/stack.h
ts_asn1.o: ../../include/openssl/symhacks.h ../../include/openssl/ts.h
ts_asn1.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
ts_asn1.o: ../../include/openssl/x509v3.h ts_asn1.c
ts_conf.o: ../../e_os.h ../../include/openssl/asn1.h
ts_conf.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
ts_conf.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
ts_conf.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
ts_conf.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
ts_conf.o: ../../include/openssl/ecdh.h ../../include/openssl/ecdsa.h
ts_conf.o: ../../include/openssl/engine.h ../../include/openssl/err.h
ts_conf.o: ../../include/openssl/evp.h ../../include/openssl/kdf.h
ts_conf.o: ../../include/openssl/lhash.h ../../include/openssl/obj_mac.h
ts_conf.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
ts_conf.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
ts_conf.o: ../../include/openssl/pem.h ../../include/openssl/pem2.h
ts_conf.o: ../../include/openssl/pkcs7.h ../../include/openssl/rsa.h
ts_conf.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
ts_conf.o: ../../include/openssl/sm2.h ../../include/openssl/sm3.h
ts_conf.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
ts_conf.o: ../../include/openssl/ts.h ../../include/openssl/x509.h
ts_conf.o: ../../include/openssl/x509_vfy.h ../../include/openssl/x509v3.h
ts_conf.o: ../cryptlib.h ts_conf.c
ts_err.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
ts_err.o: ../../include/openssl/buffer.h ../../include/openssl/conf.h
ts_err.o: ../../include/openssl/crypto.h ../../include/openssl/dh.h
ts_err.o: ../../include/openssl/dsa.h ../../include/openssl/e_os2.h
ts_err.o: ../../include/openssl/ec.h ../../include/openssl/ecdh.h
ts_err.o: ../../include/openssl/ecdsa.h ../../include/openssl/err.h
ts_err.o: ../../include/openssl/evp.h ../../include/openssl/kdf.h
ts_err.o: ../../include/openssl/lhash.h ../../include/openssl/obj_mac.h
ts_err.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
ts_err.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
ts_err.o: ../../include/openssl/pkcs7.h ../../include/openssl/rsa.h
ts_err.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
ts_err.o: ../../include/openssl/sm2.h ../../include/openssl/sm3.h
ts_err.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
ts_err.o: ../../include/openssl/ts.h ../../include/openssl/x509.h
ts_err.o: ../../include/openssl/x509_vfy.h ../../include/openssl/x509v3.h
ts_err.o: ts_err.c
ts_lib.o: ../../e_os.h ../../include/openssl/asn1.h ../../include/openssl/bio.h
ts_lib.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
ts_lib.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
ts_lib.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
ts_lib.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
ts_lib.o: ../../include/openssl/ecdh.h ../../include/openssl/ecdsa.h
ts_lib.o: ../../include/openssl/err.h ../../include/openssl/evp.h
ts_lib.o: ../../include/openssl/kdf.h ../../include/openssl/lhash.h
ts_lib.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
ts_lib.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
ts_lib.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pkcs7.h
ts_lib.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
ts_lib.o: ../../include/openssl/sha.h ../../include/openssl/sm2.h
ts_lib.o: ../../include/openssl/sm3.h ../../include/openssl/stack.h
ts_lib.o: ../../include/openssl/symhacks.h ../../include/openssl/x509.h
ts_lib.o: ../../include/openssl/x509_vfy.h ../../include/openssl/x509v3.h
ts_lib.o: ../cryptlib.h ts.h ts_lib.c
ts_req_print.o: ../../e_os.h ../../include/openssl/asn1.h
ts_req_print.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
ts_req_print.o: ../../include/openssl/buffer.h ../../include/openssl/conf.h
ts_req_print.o: ../../include/openssl/crypto.h ../../include/openssl/dh.h
ts_req_print.o: ../../include/openssl/dsa.h ../../include/openssl/e_os2.h
ts_req_print.o: ../../include/openssl/ec.h ../../include/openssl/ecdh.h
ts_req_print.o: ../../include/openssl/ecdsa.h ../../include/openssl/err.h
ts_req_print.o: ../../include/openssl/evp.h ../../include/openssl/kdf.h
ts_req_print.o: ../../include/openssl/lhash.h ../../include/openssl/obj_mac.h
ts_req_print.o: ../../include/openssl/objects.h
ts_req_print.o: ../../include/openssl/opensslconf.h
ts_req_print.o: ../../include/openssl/opensslv.h
ts_req_print.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pkcs7.h
ts_req_print.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
ts_req_print.o: ../../include/openssl/sha.h ../../include/openssl/sm2.h
ts_req_print.o: ../../include/openssl/sm3.h ../../include/openssl/stack.h
ts_req_print.o: ../../include/openssl/symhacks.h ../../include/openssl/ts.h
ts_req_print.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
ts_req_print.o: ../../include/openssl/x509v3.h ../cryptlib.h ts_req_print.c
ts_req_utils.o: ../../e_os.h ../../include/openssl/asn1.h
ts_req_utils.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
ts_req_utils.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
ts_req_utils.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
ts_req_utils.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
ts_req_utils.o: ../../include/openssl/ecdh.h ../../include/openssl/ecdsa.h
ts_req_utils.o: ../../include/openssl/err.h ../../include/openssl/evp.h
ts_req_utils.o: ../../include/openssl/kdf.h ../../include/openssl/lhash.h
ts_req_utils.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
ts_req_utils.o: ../../include/openssl/opensslconf.h
ts_req_utils.o: ../../include/openssl/opensslv.h
ts_req_utils.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pkcs7.h
ts_req_utils.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
ts_req_utils.o: ../../include/openssl/sha.h ../../include/openssl/sm2.h
ts_req_utils.o: ../../include/openssl/sm3.h ../../include/openssl/stack.h
ts_req_utils.o: ../../include/openssl/symhacks.h ../../include/openssl/ts.h
ts_req_utils.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
ts_req_utils.o: ../../include/openssl/x509v3.h ../cryptlib.h ts_req_utils.c
ts_rsp_print.o: ../../e_os.h ../../include/openssl/asn1.h
ts_rsp_print.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
ts_rsp_print.o: ../../include/openssl/buffer.h ../../include/openssl/conf.h
ts_rsp_print.o: ../../include/openssl/crypto.h ../../include/openssl/dh.h
ts_rsp_print.o: ../../include/openssl/dsa.h ../../include/openssl/e_os2.h
ts_rsp_print.o: ../../include/openssl/ec.h ../../include/openssl/ecdh.h
ts_rsp_print.o: ../../include/openssl/ecdsa.h ../../include/openssl/err.h
ts_rsp_print.o: ../../include/openssl/evp.h ../../include/openssl/kdf.h
ts_rsp_print.o: ../../include/openssl/lhash.h ../../include/openssl/obj_mac.h
ts_rsp_print.o: ../../include/openssl/objects.h
ts_rsp_print.o: ../../include/openssl/opensslconf.h
ts_rsp_print.o: ../../include/openssl/opensslv.h
ts_rsp_print.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pkcs7.h
ts_rsp_print.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
ts_rsp_print.o: ../../include/openssl/sha.h ../../include/openssl/sm2.h
ts_rsp_print.o: ../../include/openssl/sm3.h ../../include/openssl/stack.h
ts_rsp_print.o: ../../include/openssl/symhacks.h ../../include/openssl/x509.h
ts_rsp_print.o: ../../include/openssl/x509_vfy.h ../../include/openssl/x509v3.h
ts_rsp_print.o: ../cryptlib.h ts.h ts_rsp_print.c
ts_rsp_sign.o: ../../e_os.h ../../include/openssl/asn1.h
ts_rsp_sign.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
ts_rsp_sign.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
ts_rsp_sign.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
ts_rsp_sign.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
ts_rsp_sign.o: ../../include/openssl/ecdh.h ../../include/openssl/ecdsa.h
ts_rsp_sign.o: ../../include/openssl/err.h ../../include/openssl/evp.h
ts_rsp_sign.o: ../../include/openssl/kdf.h ../../include/openssl/lhash.h
ts_rsp_sign.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
ts_rsp_sign.o: ../../include/openssl/opensslconf.h
ts_rsp_sign.o: ../../include/openssl/opensslv.h
ts_rsp_sign.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pkcs7.h
ts_rsp_sign.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
ts_rsp_sign.o: ../../include/openssl/sha.h ../../include/openssl/sm2.h
ts_rsp_sign.o: ../../include/openssl/sm3.h ../../include/openssl/stack.h
ts_rsp_sign.o: ../../include/openssl/symhacks.h ../../include/openssl/ts.h
ts_rsp_sign.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
ts_rsp_sign.o: ../../include/openssl/x509v3.h ../cryptlib.h ts_rsp_sign.c
ts_rsp_utils.o: ../../e_os.h ../../include/openssl/asn1.h
ts_rsp_utils.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
ts_rsp_utils.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
ts_rsp_utils.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
ts_rsp_utils.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
ts_rsp_utils.o: ../../include/openssl/ecdh.h ../../include/openssl/ecdsa.h
ts_rsp_utils.o: ../../include/openssl/err.h ../../include/openssl/evp.h
ts_rsp_utils.o: ../../include/openssl/kdf.h ../../include/openssl/lhash.h
ts_rsp_utils.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
ts_rsp_utils.o: ../../include/openssl/opensslconf.h
ts_rsp_utils.o: ../../include/openssl/opensslv.h
ts_rsp_utils.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pkcs7.h
ts_rsp_utils.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
ts_rsp_utils.o: ../../include/openssl/sha.h ../../include/openssl/sm2.h
ts_rsp_utils.o: ../../include/openssl/sm3.h ../../include/openssl/stack.h
ts_rsp_utils.o: ../../include/openssl/symhacks.h ../../include/openssl/ts.h
ts_rsp_utils.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
ts_rsp_utils.o: ../../include/openssl/x509v3.h ../cryptlib.h ts_rsp_utils.c
ts_rsp_verify.o: ../../e_os.h ../../include/openssl/asn1.h
ts_rsp_verify.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
ts_rsp_verify.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
ts_rsp_verify.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
ts_rsp_verify.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
ts_rsp_verify.o: ../../include/openssl/ecdh.h ../../include/openssl/ecdsa.h
ts_rsp_verify.o: ../../include/openssl/err.h ../../include/openssl/evp.h
ts_rsp_verify.o: ../../include/openssl/kdf.h ../../include/openssl/lhash.h
ts_rsp_verify.o: ../../include/openssl/obj_mac.h
ts_rsp_verify.o: ../../include/openssl/objects.h
ts_rsp_verify.o: ../../include/openssl/opensslconf.h
ts_rsp_verify.o: ../../include/openssl/opensslv.h
ts_rsp_verify.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pkcs7.h
ts_rsp_verify.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
ts_rsp_verify.o: ../../include/openssl/sha.h ../../include/openssl/sm2.h
ts_rsp_verify.o: ../../include/openssl/sm3.h ../../include/openssl/stack.h
ts_rsp_verify.o: ../../include/openssl/symhacks.h ../../include/openssl/ts.h
ts_rsp_verify.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
ts_rsp_verify.o: ../../include/openssl/x509v3.h ../cryptlib.h ts_rsp_verify.c
ts_verify_ctx.o: ../../e_os.h ../../include/openssl/asn1.h
ts_verify_ctx.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
ts_verify_ctx.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
ts_verify_ctx.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
ts_verify_ctx.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
ts_verify_ctx.o: ../../include/openssl/ecdh.h ../../include/openssl/ecdsa.h
ts_verify_ctx.o: ../../include/openssl/err.h ../../include/openssl/evp.h
ts_verify_ctx.o: ../../include/openssl/kdf.h ../../include/openssl/lhash.h
ts_verify_ctx.o: ../../include/openssl/obj_mac.h
ts_verify_ctx.o: ../../include/openssl/objects.h
ts_verify_ctx.o: ../../include/openssl/opensslconf.h
ts_verify_ctx.o: ../../include/openssl/opensslv.h
ts_verify_ctx.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pkcs7.h
ts_verify_ctx.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
ts_verify_ctx.o: ../../include/openssl/sha.h ../../include/openssl/sm2.h
ts_verify_ctx.o: ../../include/openssl/sm3.h ../../include/openssl/stack.h
ts_verify_ctx.o: ../../include/openssl/symhacks.h ../../include/openssl/ts.h
ts_verify_ctx.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
ts_verify_ctx.o: ../../include/openssl/x509v3.h ../cryptlib.h ts_verify_ctx.c

5
crypto/ts/build.info Normal file
View File

@@ -0,0 +1,5 @@
LIBS=../../libcrypto
SOURCE[../../libcrypto]=\
ts_err.c ts_req_utils.c ts_req_print.c ts_rsp_utils.c ts_rsp_print.c \
ts_rsp_sign.c ts_rsp_verify.c ts_verify_ctx.c ts_lib.c ts_conf.c \
ts_asn1.c

862
crypto/ts/ts.h
View File

@@ -1,862 +0,0 @@
/* crypto/ts/ts.h */
/*
* Written by Zoltan Glozik (zglozik@opentsa.org) for the OpenSSL project
* 2002, 2003, 2004.
*/
/* ====================================================================
* Copyright (c) 2006 The OpenSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. All advertising materials mentioning features or use of this
* software must display the following acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
*
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
* endorse or promote products derived from this software without
* prior written permission. For written permission, please contact
* licensing@OpenSSL.org.
*
* 5. Products derived from this software may not be called "OpenSSL"
* nor may "OpenSSL" appear in their names without prior written
* permission of the OpenSSL Project.
*
* 6. Redistributions of any form whatsoever must retain the following
* acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
*
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
* ====================================================================
*
* This product includes cryptographic software written by Eric Young
* (eay@cryptsoft.com). This product includes software written by Tim
* Hudson (tjh@cryptsoft.com).
*
*/
#ifndef HEADER_TS_H
# define HEADER_TS_H
# include <openssl/opensslconf.h>
# include <openssl/symhacks.h>
# ifndef OPENSSL_NO_BUFFER
# include <openssl/buffer.h>
# endif
# ifndef OPENSSL_NO_EVP
# include <openssl/evp.h>
# endif
# ifndef OPENSSL_NO_BIO
# include <openssl/bio.h>
# endif
# include <openssl/stack.h>
# include <openssl/asn1.h>
# include <openssl/safestack.h>
# ifndef OPENSSL_NO_RSA
# include <openssl/rsa.h>
# endif
# ifndef OPENSSL_NO_DSA
# include <openssl/dsa.h>
# endif
# ifndef OPENSSL_NO_DH
# include <openssl/dh.h>
# endif
#ifdef __cplusplus
extern "C" {
#endif
# ifdef WIN32
/* Under Win32 this is defined in wincrypt.h */
# undef X509_NAME
# endif
# include <openssl/x509.h>
# include <openssl/x509v3.h>
/*-
MessageImprint ::= SEQUENCE {
hashAlgorithm AlgorithmIdentifier,
hashedMessage OCTET STRING }
*/
typedef struct TS_msg_imprint_st {
X509_ALGOR *hash_algo;
ASN1_OCTET_STRING *hashed_msg;
} TS_MSG_IMPRINT;
/*-
TimeStampReq ::= SEQUENCE {
version INTEGER { v1(1) },
messageImprint MessageImprint,
--a hash algorithm OID and the hash value of the data to be
--time-stamped
reqPolicy TSAPolicyId OPTIONAL,
nonce INTEGER OPTIONAL,
certReq BOOLEAN DEFAULT FALSE,
extensions [0] IMPLICIT Extensions OPTIONAL }
*/
typedef struct TS_req_st {
ASN1_INTEGER *version;
TS_MSG_IMPRINT *msg_imprint;
ASN1_OBJECT *policy_id; /* OPTIONAL */
ASN1_INTEGER *nonce; /* OPTIONAL */
ASN1_BOOLEAN cert_req; /* DEFAULT FALSE */
STACK_OF(X509_EXTENSION) *extensions; /* [0] OPTIONAL */
} TS_REQ;
/*-
Accuracy ::= SEQUENCE {
seconds INTEGER OPTIONAL,
millis [0] INTEGER (1..999) OPTIONAL,
micros [1] INTEGER (1..999) OPTIONAL }
*/
typedef struct TS_accuracy_st {
ASN1_INTEGER *seconds;
ASN1_INTEGER *millis;
ASN1_INTEGER *micros;
} TS_ACCURACY;
/*-
TSTInfo ::= SEQUENCE {
version INTEGER { v1(1) },
policy TSAPolicyId,
messageImprint MessageImprint,
-- MUST have the same value as the similar field in
-- TimeStampReq
serialNumber INTEGER,
-- Time-Stamping users MUST be ready to accommodate integers
-- up to 160 bits.
genTime GeneralizedTime,
accuracy Accuracy OPTIONAL,
ordering BOOLEAN DEFAULT FALSE,
nonce INTEGER OPTIONAL,
-- MUST be present if the similar field was present
-- in TimeStampReq. In that case it MUST have the same value.
tsa [0] GeneralName OPTIONAL,
extensions [1] IMPLICIT Extensions OPTIONAL }
*/
typedef struct TS_tst_info_st {
ASN1_INTEGER *version;
ASN1_OBJECT *policy_id;
TS_MSG_IMPRINT *msg_imprint;
ASN1_INTEGER *serial;
ASN1_GENERALIZEDTIME *time;
TS_ACCURACY *accuracy;
ASN1_BOOLEAN ordering;
ASN1_INTEGER *nonce;
GENERAL_NAME *tsa;
STACK_OF(X509_EXTENSION) *extensions;
} TS_TST_INFO;
/*-
PKIStatusInfo ::= SEQUENCE {
status PKIStatus,
statusString PKIFreeText OPTIONAL,
failInfo PKIFailureInfo OPTIONAL }
From RFC 1510 - section 3.1.1:
PKIFreeText ::= SEQUENCE SIZE (1..MAX) OF UTF8String
-- text encoded as UTF-8 String (note: each UTF8String SHOULD
-- include an RFC 1766 language tag to indicate the language
-- of the contained text)
*/
/* Possible values for status. See ts_resp_print.c && ts_resp_verify.c. */
# define TS_STATUS_GRANTED 0
# define TS_STATUS_GRANTED_WITH_MODS 1
# define TS_STATUS_REJECTION 2
# define TS_STATUS_WAITING 3
# define TS_STATUS_REVOCATION_WARNING 4
# define TS_STATUS_REVOCATION_NOTIFICATION 5
/*
* Possible values for failure_info. See ts_resp_print.c && ts_resp_verify.c
*/
# define TS_INFO_BAD_ALG 0
# define TS_INFO_BAD_REQUEST 2
# define TS_INFO_BAD_DATA_FORMAT 5
# define TS_INFO_TIME_NOT_AVAILABLE 14
# define TS_INFO_UNACCEPTED_POLICY 15
# define TS_INFO_UNACCEPTED_EXTENSION 16
# define TS_INFO_ADD_INFO_NOT_AVAILABLE 17
# define TS_INFO_SYSTEM_FAILURE 25
typedef struct TS_status_info_st {
ASN1_INTEGER *status;
STACK_OF(ASN1_UTF8STRING) *text;
ASN1_BIT_STRING *failure_info;
} TS_STATUS_INFO;
DECLARE_STACK_OF(ASN1_UTF8STRING)
DECLARE_ASN1_SET_OF(ASN1_UTF8STRING)
/*-
TimeStampResp ::= SEQUENCE {
status PKIStatusInfo,
timeStampToken TimeStampToken OPTIONAL }
*/
typedef struct TS_resp_st {
TS_STATUS_INFO *status_info;
PKCS7 *token;
TS_TST_INFO *tst_info;
} TS_RESP;
/* The structure below would belong to the ESS component. */
/*-
IssuerSerial ::= SEQUENCE {
issuer GeneralNames,
serialNumber CertificateSerialNumber
}
*/
typedef struct ESS_issuer_serial {
STACK_OF(GENERAL_NAME) *issuer;
ASN1_INTEGER *serial;
} ESS_ISSUER_SERIAL;
/*-
ESSCertID ::= SEQUENCE {
certHash Hash,
issuerSerial IssuerSerial OPTIONAL
}
*/
typedef struct ESS_cert_id {
ASN1_OCTET_STRING *hash; /* Always SHA-1 digest. */
ESS_ISSUER_SERIAL *issuer_serial;
} ESS_CERT_ID;
DECLARE_STACK_OF(ESS_CERT_ID)
DECLARE_ASN1_SET_OF(ESS_CERT_ID)
/*-
SigningCertificate ::= SEQUENCE {
certs SEQUENCE OF ESSCertID,
policies SEQUENCE OF PolicyInformation OPTIONAL
}
*/
typedef struct ESS_signing_cert {
STACK_OF(ESS_CERT_ID) *cert_ids;
STACK_OF(POLICYINFO) *policy_info;
} ESS_SIGNING_CERT;
TS_REQ *TS_REQ_new(void);
void TS_REQ_free(TS_REQ *a);
int i2d_TS_REQ(const TS_REQ *a, unsigned char **pp);
TS_REQ *d2i_TS_REQ(TS_REQ **a, const unsigned char **pp, long length);
TS_REQ *TS_REQ_dup(TS_REQ *a);
TS_REQ *d2i_TS_REQ_fp(FILE *fp, TS_REQ **a);
int i2d_TS_REQ_fp(FILE *fp, TS_REQ *a);
TS_REQ *d2i_TS_REQ_bio(BIO *fp, TS_REQ **a);
int i2d_TS_REQ_bio(BIO *fp, TS_REQ *a);
TS_MSG_IMPRINT *TS_MSG_IMPRINT_new(void);
void TS_MSG_IMPRINT_free(TS_MSG_IMPRINT *a);
int i2d_TS_MSG_IMPRINT(const TS_MSG_IMPRINT *a, unsigned char **pp);
TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT(TS_MSG_IMPRINT **a,
const unsigned char **pp, long length);
TS_MSG_IMPRINT *TS_MSG_IMPRINT_dup(TS_MSG_IMPRINT *a);
TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT **a);
int i2d_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT *a);
TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_bio(BIO *fp, TS_MSG_IMPRINT **a);
int i2d_TS_MSG_IMPRINT_bio(BIO *fp, TS_MSG_IMPRINT *a);
TS_RESP *TS_RESP_new(void);
void TS_RESP_free(TS_RESP *a);
int i2d_TS_RESP(const TS_RESP *a, unsigned char **pp);
TS_RESP *d2i_TS_RESP(TS_RESP **a, const unsigned char **pp, long length);
TS_TST_INFO *PKCS7_to_TS_TST_INFO(PKCS7 *token);
TS_RESP *TS_RESP_dup(TS_RESP *a);
TS_RESP *d2i_TS_RESP_fp(FILE *fp, TS_RESP **a);
int i2d_TS_RESP_fp(FILE *fp, TS_RESP *a);
TS_RESP *d2i_TS_RESP_bio(BIO *fp, TS_RESP **a);
int i2d_TS_RESP_bio(BIO *fp, TS_RESP *a);
TS_STATUS_INFO *TS_STATUS_INFO_new(void);
void TS_STATUS_INFO_free(TS_STATUS_INFO *a);
int i2d_TS_STATUS_INFO(const TS_STATUS_INFO *a, unsigned char **pp);
TS_STATUS_INFO *d2i_TS_STATUS_INFO(TS_STATUS_INFO **a,
const unsigned char **pp, long length);
TS_STATUS_INFO *TS_STATUS_INFO_dup(TS_STATUS_INFO *a);
TS_TST_INFO *TS_TST_INFO_new(void);
void TS_TST_INFO_free(TS_TST_INFO *a);
int i2d_TS_TST_INFO(const TS_TST_INFO *a, unsigned char **pp);
TS_TST_INFO *d2i_TS_TST_INFO(TS_TST_INFO **a, const unsigned char **pp,
long length);
TS_TST_INFO *TS_TST_INFO_dup(TS_TST_INFO *a);
TS_TST_INFO *d2i_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO **a);
int i2d_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO *a);
TS_TST_INFO *d2i_TS_TST_INFO_bio(BIO *fp, TS_TST_INFO **a);
int i2d_TS_TST_INFO_bio(BIO *fp, TS_TST_INFO *a);
TS_ACCURACY *TS_ACCURACY_new(void);
void TS_ACCURACY_free(TS_ACCURACY *a);
int i2d_TS_ACCURACY(const TS_ACCURACY *a, unsigned char **pp);
TS_ACCURACY *d2i_TS_ACCURACY(TS_ACCURACY **a, const unsigned char **pp,
long length);
TS_ACCURACY *TS_ACCURACY_dup(TS_ACCURACY *a);
ESS_ISSUER_SERIAL *ESS_ISSUER_SERIAL_new(void);
void ESS_ISSUER_SERIAL_free(ESS_ISSUER_SERIAL *a);
int i2d_ESS_ISSUER_SERIAL(const ESS_ISSUER_SERIAL *a, unsigned char **pp);
ESS_ISSUER_SERIAL *d2i_ESS_ISSUER_SERIAL(ESS_ISSUER_SERIAL **a,
const unsigned char **pp,
long length);
ESS_ISSUER_SERIAL *ESS_ISSUER_SERIAL_dup(ESS_ISSUER_SERIAL *a);
ESS_CERT_ID *ESS_CERT_ID_new(void);
void ESS_CERT_ID_free(ESS_CERT_ID *a);
int i2d_ESS_CERT_ID(const ESS_CERT_ID *a, unsigned char **pp);
ESS_CERT_ID *d2i_ESS_CERT_ID(ESS_CERT_ID **a, const unsigned char **pp,
long length);
ESS_CERT_ID *ESS_CERT_ID_dup(ESS_CERT_ID *a);
ESS_SIGNING_CERT *ESS_SIGNING_CERT_new(void);
void ESS_SIGNING_CERT_free(ESS_SIGNING_CERT *a);
int i2d_ESS_SIGNING_CERT(const ESS_SIGNING_CERT *a, unsigned char **pp);
ESS_SIGNING_CERT *d2i_ESS_SIGNING_CERT(ESS_SIGNING_CERT **a,
const unsigned char **pp, long length);
ESS_SIGNING_CERT *ESS_SIGNING_CERT_dup(ESS_SIGNING_CERT *a);
void ERR_load_TS_strings(void);
int TS_REQ_set_version(TS_REQ *a, long version);
long TS_REQ_get_version(const TS_REQ *a);
int TS_REQ_set_msg_imprint(TS_REQ *a, TS_MSG_IMPRINT *msg_imprint);
TS_MSG_IMPRINT *TS_REQ_get_msg_imprint(TS_REQ *a);
int TS_MSG_IMPRINT_set_algo(TS_MSG_IMPRINT *a, X509_ALGOR *alg);
X509_ALGOR *TS_MSG_IMPRINT_get_algo(TS_MSG_IMPRINT *a);
int TS_MSG_IMPRINT_set_msg(TS_MSG_IMPRINT *a, unsigned char *d, int len);
ASN1_OCTET_STRING *TS_MSG_IMPRINT_get_msg(TS_MSG_IMPRINT *a);
int TS_REQ_set_policy_id(TS_REQ *a, ASN1_OBJECT *policy);
ASN1_OBJECT *TS_REQ_get_policy_id(TS_REQ *a);
int TS_REQ_set_nonce(TS_REQ *a, const ASN1_INTEGER *nonce);
const ASN1_INTEGER *TS_REQ_get_nonce(const TS_REQ *a);
int TS_REQ_set_cert_req(TS_REQ *a, int cert_req);
int TS_REQ_get_cert_req(const TS_REQ *a);
STACK_OF(X509_EXTENSION) *TS_REQ_get_exts(TS_REQ *a);
void TS_REQ_ext_free(TS_REQ *a);
int TS_REQ_get_ext_count(TS_REQ *a);
int TS_REQ_get_ext_by_NID(TS_REQ *a, int nid, int lastpos);
int TS_REQ_get_ext_by_OBJ(TS_REQ *a, ASN1_OBJECT *obj, int lastpos);
int TS_REQ_get_ext_by_critical(TS_REQ *a, int crit, int lastpos);
X509_EXTENSION *TS_REQ_get_ext(TS_REQ *a, int loc);
X509_EXTENSION *TS_REQ_delete_ext(TS_REQ *a, int loc);
int TS_REQ_add_ext(TS_REQ *a, X509_EXTENSION *ex, int loc);
void *TS_REQ_get_ext_d2i(TS_REQ *a, int nid, int *crit, int *idx);
/* Function declarations for TS_REQ defined in ts/ts_req_print.c */
int TS_REQ_print_bio(BIO *bio, TS_REQ *a);
/* Function declarations for TS_RESP defined in ts/ts_resp_utils.c */
int TS_RESP_set_status_info(TS_RESP *a, TS_STATUS_INFO *info);
TS_STATUS_INFO *TS_RESP_get_status_info(TS_RESP *a);
/* Caller loses ownership of PKCS7 and TS_TST_INFO objects. */
void TS_RESP_set_tst_info(TS_RESP *a, PKCS7 *p7, TS_TST_INFO *tst_info);
PKCS7 *TS_RESP_get_token(TS_RESP *a);
TS_TST_INFO *TS_RESP_get_tst_info(TS_RESP *a);
int TS_TST_INFO_set_version(TS_TST_INFO *a, long version);
long TS_TST_INFO_get_version(const TS_TST_INFO *a);
int TS_TST_INFO_set_policy_id(TS_TST_INFO *a, ASN1_OBJECT *policy_id);
ASN1_OBJECT *TS_TST_INFO_get_policy_id(TS_TST_INFO *a);
int TS_TST_INFO_set_msg_imprint(TS_TST_INFO *a, TS_MSG_IMPRINT *msg_imprint);
TS_MSG_IMPRINT *TS_TST_INFO_get_msg_imprint(TS_TST_INFO *a);
int TS_TST_INFO_set_serial(TS_TST_INFO *a, const ASN1_INTEGER *serial);
const ASN1_INTEGER *TS_TST_INFO_get_serial(const TS_TST_INFO *a);
int TS_TST_INFO_set_time(TS_TST_INFO *a, const ASN1_GENERALIZEDTIME *gtime);
const ASN1_GENERALIZEDTIME *TS_TST_INFO_get_time(const TS_TST_INFO *a);
int TS_TST_INFO_set_accuracy(TS_TST_INFO *a, TS_ACCURACY *accuracy);
TS_ACCURACY *TS_TST_INFO_get_accuracy(TS_TST_INFO *a);
int TS_ACCURACY_set_seconds(TS_ACCURACY *a, const ASN1_INTEGER *seconds);
const ASN1_INTEGER *TS_ACCURACY_get_seconds(const TS_ACCURACY *a);
int TS_ACCURACY_set_millis(TS_ACCURACY *a, const ASN1_INTEGER *millis);
const ASN1_INTEGER *TS_ACCURACY_get_millis(const TS_ACCURACY *a);
int TS_ACCURACY_set_micros(TS_ACCURACY *a, const ASN1_INTEGER *micros);
const ASN1_INTEGER *TS_ACCURACY_get_micros(const TS_ACCURACY *a);
int TS_TST_INFO_set_ordering(TS_TST_INFO *a, int ordering);
int TS_TST_INFO_get_ordering(const TS_TST_INFO *a);
int TS_TST_INFO_set_nonce(TS_TST_INFO *a, const ASN1_INTEGER *nonce);
const ASN1_INTEGER *TS_TST_INFO_get_nonce(const TS_TST_INFO *a);
int TS_TST_INFO_set_tsa(TS_TST_INFO *a, GENERAL_NAME *tsa);
GENERAL_NAME *TS_TST_INFO_get_tsa(TS_TST_INFO *a);
STACK_OF(X509_EXTENSION) *TS_TST_INFO_get_exts(TS_TST_INFO *a);
void TS_TST_INFO_ext_free(TS_TST_INFO *a);
int TS_TST_INFO_get_ext_count(TS_TST_INFO *a);
int TS_TST_INFO_get_ext_by_NID(TS_TST_INFO *a, int nid, int lastpos);
int TS_TST_INFO_get_ext_by_OBJ(TS_TST_INFO *a, ASN1_OBJECT *obj, int lastpos);
int TS_TST_INFO_get_ext_by_critical(TS_TST_INFO *a, int crit, int lastpos);
X509_EXTENSION *TS_TST_INFO_get_ext(TS_TST_INFO *a, int loc);
X509_EXTENSION *TS_TST_INFO_delete_ext(TS_TST_INFO *a, int loc);
int TS_TST_INFO_add_ext(TS_TST_INFO *a, X509_EXTENSION *ex, int loc);
void *TS_TST_INFO_get_ext_d2i(TS_TST_INFO *a, int nid, int *crit, int *idx);
/*
* Declarations related to response generation, defined in ts/ts_resp_sign.c.
*/
/* Optional flags for response generation. */
/* Don't include the TSA name in response. */
# define TS_TSA_NAME 0x01
/* Set ordering to true in response. */
# define TS_ORDERING 0x02
/*
* Include the signer certificate and the other specified certificates in
* the ESS signing certificate attribute beside the PKCS7 signed data.
* Only the signer certificates is included by default.
*/
# define TS_ESS_CERT_ID_CHAIN 0x04
/* Forward declaration. */
struct TS_resp_ctx;
/* This must return a unique number less than 160 bits long. */
typedef ASN1_INTEGER *(*TS_serial_cb) (struct TS_resp_ctx *, void *);
/*
* This must return the seconds and microseconds since Jan 1, 1970 in the sec
* and usec variables allocated by the caller. Return non-zero for success
* and zero for failure.
*/
typedef int (*TS_time_cb) (struct TS_resp_ctx *, void *, long *sec,
long *usec);
/*
* This must process the given extension. It can modify the TS_TST_INFO
* object of the context. Return values: !0 (processed), 0 (error, it must
* set the status info/failure info of the response).
*/
typedef int (*TS_extension_cb) (struct TS_resp_ctx *, X509_EXTENSION *,
void *);
typedef struct TS_resp_ctx {
X509 *signer_cert;
EVP_PKEY *signer_key;
STACK_OF(X509) *certs; /* Certs to include in signed data. */
STACK_OF(ASN1_OBJECT) *policies; /* Acceptable policies. */
ASN1_OBJECT *default_policy; /* It may appear in policies, too. */
STACK_OF(EVP_MD) *mds; /* Acceptable message digests. */
ASN1_INTEGER *seconds; /* accuracy, 0 means not specified. */
ASN1_INTEGER *millis; /* accuracy, 0 means not specified. */
ASN1_INTEGER *micros; /* accuracy, 0 means not specified. */
unsigned clock_precision_digits; /* fraction of seconds in time stamp
* token. */
unsigned flags; /* Optional info, see values above. */
/* Callback functions. */
TS_serial_cb serial_cb;
void *serial_cb_data; /* User data for serial_cb. */
TS_time_cb time_cb;
void *time_cb_data; /* User data for time_cb. */
TS_extension_cb extension_cb;
void *extension_cb_data; /* User data for extension_cb. */
/* These members are used only while creating the response. */
TS_REQ *request;
TS_RESP *response;
TS_TST_INFO *tst_info;
} TS_RESP_CTX;
DECLARE_STACK_OF(EVP_MD)
DECLARE_ASN1_SET_OF(EVP_MD)
/* Creates a response context that can be used for generating responses. */
TS_RESP_CTX *TS_RESP_CTX_new(void);
void TS_RESP_CTX_free(TS_RESP_CTX *ctx);
/* This parameter must be set. */
int TS_RESP_CTX_set_signer_cert(TS_RESP_CTX *ctx, X509 *signer);
/* This parameter must be set. */
int TS_RESP_CTX_set_signer_key(TS_RESP_CTX *ctx, EVP_PKEY *key);
/* This parameter must be set. */
int TS_RESP_CTX_set_def_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *def_policy);
/* No additional certs are included in the response by default. */
int TS_RESP_CTX_set_certs(TS_RESP_CTX *ctx, STACK_OF(X509) *certs);
/*
* Adds a new acceptable policy, only the default policy is accepted by
* default.
*/
int TS_RESP_CTX_add_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *policy);
/*
* Adds a new acceptable message digest. Note that no message digests are
* accepted by default. The md argument is shared with the caller.
*/
int TS_RESP_CTX_add_md(TS_RESP_CTX *ctx, const EVP_MD *md);
/* Accuracy is not included by default. */
int TS_RESP_CTX_set_accuracy(TS_RESP_CTX *ctx,
int secs, int millis, int micros);
/*
* Clock precision digits, i.e. the number of decimal digits: '0' means sec,
* '3' msec, '6' usec, and so on. Default is 0.
*/
int TS_RESP_CTX_set_clock_precision_digits(TS_RESP_CTX *ctx,
unsigned clock_precision_digits);
/* At most we accept usec precision. */
# define TS_MAX_CLOCK_PRECISION_DIGITS 6
/* No flags are set by default. */
void TS_RESP_CTX_add_flags(TS_RESP_CTX *ctx, int flags);
/* Default callback always returns a constant. */
void TS_RESP_CTX_set_serial_cb(TS_RESP_CTX *ctx, TS_serial_cb cb, void *data);
/* Default callback uses the gettimeofday() and gmtime() system calls. */
void TS_RESP_CTX_set_time_cb(TS_RESP_CTX *ctx, TS_time_cb cb, void *data);
/*
* Default callback rejects all extensions. The extension callback is called
* when the TS_TST_INFO object is already set up and not signed yet.
*/
/* FIXME: extension handling is not tested yet. */
void TS_RESP_CTX_set_extension_cb(TS_RESP_CTX *ctx,
TS_extension_cb cb, void *data);
/* The following methods can be used in the callbacks. */
int TS_RESP_CTX_set_status_info(TS_RESP_CTX *ctx,
int status, const char *text);
/* Sets the status info only if it is still TS_STATUS_GRANTED. */
int TS_RESP_CTX_set_status_info_cond(TS_RESP_CTX *ctx,
int status, const char *text);
int TS_RESP_CTX_add_failure_info(TS_RESP_CTX *ctx, int failure);
/* The get methods below can be used in the extension callback. */
TS_REQ *TS_RESP_CTX_get_request(TS_RESP_CTX *ctx);
TS_TST_INFO *TS_RESP_CTX_get_tst_info(TS_RESP_CTX *ctx);
/*
* Creates the signed TS_TST_INFO and puts it in TS_RESP.
* In case of errors it sets the status info properly.
* Returns NULL only in case of memory allocation/fatal error.
*/
TS_RESP *TS_RESP_create_response(TS_RESP_CTX *ctx, BIO *req_bio);
/*
* Declarations related to response verification,
* they are defined in ts/ts_resp_verify.c.
*/
int TS_RESP_verify_signature(PKCS7 *token, STACK_OF(X509) *certs,
X509_STORE *store, X509 **signer_out);
/* Context structure for the generic verify method. */
/* Verify the signer's certificate and the signature of the response. */
# define TS_VFY_SIGNATURE (1u << 0)
/* Verify the version number of the response. */
# define TS_VFY_VERSION (1u << 1)
/* Verify if the policy supplied by the user matches the policy of the TSA. */
# define TS_VFY_POLICY (1u << 2)
/*
* Verify the message imprint provided by the user. This flag should not be
* specified with TS_VFY_DATA.
*/
# define TS_VFY_IMPRINT (1u << 3)
/*
* Verify the message imprint computed by the verify method from the user
* provided data and the MD algorithm of the response. This flag should not
* be specified with TS_VFY_IMPRINT.
*/
# define TS_VFY_DATA (1u << 4)
/* Verify the nonce value. */
# define TS_VFY_NONCE (1u << 5)
/* Verify if the TSA name field matches the signer certificate. */
# define TS_VFY_SIGNER (1u << 6)
/* Verify if the TSA name field equals to the user provided name. */
# define TS_VFY_TSA_NAME (1u << 7)
/* You can use the following convenience constants. */
# define TS_VFY_ALL_IMPRINT (TS_VFY_SIGNATURE \
| TS_VFY_VERSION \
| TS_VFY_POLICY \
| TS_VFY_IMPRINT \
| TS_VFY_NONCE \
| TS_VFY_SIGNER \
| TS_VFY_TSA_NAME)
# define TS_VFY_ALL_DATA (TS_VFY_SIGNATURE \
| TS_VFY_VERSION \
| TS_VFY_POLICY \
| TS_VFY_DATA \
| TS_VFY_NONCE \
| TS_VFY_SIGNER \
| TS_VFY_TSA_NAME)
typedef struct TS_verify_ctx {
/* Set this to the union of TS_VFY_... flags you want to carry out. */
unsigned flags;
/* Must be set only with TS_VFY_SIGNATURE. certs is optional. */
X509_STORE *store;
STACK_OF(X509) *certs;
/* Must be set only with TS_VFY_POLICY. */
ASN1_OBJECT *policy;
/*
* Must be set only with TS_VFY_IMPRINT. If md_alg is NULL, the
* algorithm from the response is used.
*/
X509_ALGOR *md_alg;
unsigned char *imprint;
unsigned imprint_len;
/* Must be set only with TS_VFY_DATA. */
BIO *data;
/* Must be set only with TS_VFY_TSA_NAME. */
ASN1_INTEGER *nonce;
/* Must be set only with TS_VFY_TSA_NAME. */
GENERAL_NAME *tsa_name;
} TS_VERIFY_CTX;
int TS_RESP_verify_response(TS_VERIFY_CTX *ctx, TS_RESP *response);
int TS_RESP_verify_token(TS_VERIFY_CTX *ctx, PKCS7 *token);
/*
* Declarations related to response verification context,
* they are defined in ts/ts_verify_ctx.c.
*/
/* Set all fields to zero. */
TS_VERIFY_CTX *TS_VERIFY_CTX_new(void);
void TS_VERIFY_CTX_init(TS_VERIFY_CTX *ctx);
void TS_VERIFY_CTX_free(TS_VERIFY_CTX *ctx);
void TS_VERIFY_CTX_cleanup(TS_VERIFY_CTX *ctx);
/*-
* If ctx is NULL, it allocates and returns a new object, otherwise
* it returns ctx. It initialises all the members as follows:
* flags = TS_VFY_ALL_IMPRINT & ~(TS_VFY_TSA_NAME | TS_VFY_SIGNATURE)
* certs = NULL
* store = NULL
* policy = policy from the request or NULL if absent (in this case
* TS_VFY_POLICY is cleared from flags as well)
* md_alg = MD algorithm from request
* imprint, imprint_len = imprint from request
* data = NULL
* nonce, nonce_len = nonce from the request or NULL if absent (in this case
* TS_VFY_NONCE is cleared from flags as well)
* tsa_name = NULL
* Important: after calling this method TS_VFY_SIGNATURE should be added!
*/
TS_VERIFY_CTX *TS_REQ_to_TS_VERIFY_CTX(TS_REQ *req, TS_VERIFY_CTX *ctx);
/* Function declarations for TS_RESP defined in ts/ts_resp_print.c */
int TS_RESP_print_bio(BIO *bio, TS_RESP *a);
int TS_STATUS_INFO_print_bio(BIO *bio, TS_STATUS_INFO *a);
int TS_TST_INFO_print_bio(BIO *bio, TS_TST_INFO *a);
/* Common utility functions defined in ts/ts_lib.c */
int TS_ASN1_INTEGER_print_bio(BIO *bio, const ASN1_INTEGER *num);
int TS_OBJ_print_bio(BIO *bio, const ASN1_OBJECT *obj);
int TS_ext_print_bio(BIO *bio, const STACK_OF(X509_EXTENSION) *extensions);
int TS_X509_ALGOR_print_bio(BIO *bio, const X509_ALGOR *alg);
int TS_MSG_IMPRINT_print_bio(BIO *bio, TS_MSG_IMPRINT *msg);
/*
* Function declarations for handling configuration options, defined in
* ts/ts_conf.c
*/
X509 *TS_CONF_load_cert(const char *file);
STACK_OF(X509) *TS_CONF_load_certs(const char *file);
EVP_PKEY *TS_CONF_load_key(const char *file, const char *pass);
const char *TS_CONF_get_tsa_section(CONF *conf, const char *section);
int TS_CONF_set_serial(CONF *conf, const char *section, TS_serial_cb cb,
TS_RESP_CTX *ctx);
int TS_CONF_set_crypto_device(CONF *conf, const char *section,
const char *device);
int TS_CONF_set_default_engine(const char *name);
int TS_CONF_set_signer_cert(CONF *conf, const char *section,
const char *cert, TS_RESP_CTX *ctx);
int TS_CONF_set_certs(CONF *conf, const char *section, const char *certs,
TS_RESP_CTX *ctx);
int TS_CONF_set_signer_key(CONF *conf, const char *section,
const char *key, const char *pass,
TS_RESP_CTX *ctx);
int TS_CONF_set_def_policy(CONF *conf, const char *section,
const char *policy, TS_RESP_CTX *ctx);
int TS_CONF_set_policies(CONF *conf, const char *section, TS_RESP_CTX *ctx);
int TS_CONF_set_digests(CONF *conf, const char *section, TS_RESP_CTX *ctx);
int TS_CONF_set_accuracy(CONF *conf, const char *section, TS_RESP_CTX *ctx);
int TS_CONF_set_clock_precision_digits(CONF *conf, const char *section,
TS_RESP_CTX *ctx);
int TS_CONF_set_ordering(CONF *conf, const char *section, TS_RESP_CTX *ctx);
int TS_CONF_set_tsa_name(CONF *conf, const char *section, TS_RESP_CTX *ctx);
int TS_CONF_set_ess_cert_id_chain(CONF *conf, const char *section,
TS_RESP_CTX *ctx);
/* -------------------------------------------------- */
/* BEGIN ERROR CODES */
/*
* The following lines are auto generated by the script mkerr.pl. Any changes
* made after this point may be overwritten when the script is next run.
*/
void ERR_load_TS_strings(void);
/* Error codes for the TS functions. */
/* Function codes. */
# define TS_F_D2I_TS_RESP 147
# define TS_F_DEF_SERIAL_CB 110
# define TS_F_DEF_TIME_CB 111
# define TS_F_ESS_ADD_SIGNING_CERT 112
# define TS_F_ESS_CERT_ID_NEW_INIT 113
# define TS_F_ESS_SIGNING_CERT_NEW_INIT 114
# define TS_F_INT_TS_RESP_VERIFY_TOKEN 149
# define TS_F_PKCS7_TO_TS_TST_INFO 148
# define TS_F_TS_ACCURACY_SET_MICROS 115
# define TS_F_TS_ACCURACY_SET_MILLIS 116
# define TS_F_TS_ACCURACY_SET_SECONDS 117
# define TS_F_TS_CHECK_IMPRINTS 100
# define TS_F_TS_CHECK_NONCES 101
# define TS_F_TS_CHECK_POLICY 102
# define TS_F_TS_CHECK_SIGNING_CERTS 103
# define TS_F_TS_CHECK_STATUS_INFO 104
# define TS_F_TS_COMPUTE_IMPRINT 145
# define TS_F_TS_CONF_SET_DEFAULT_ENGINE 146
# define TS_F_TS_GET_STATUS_TEXT 105
# define TS_F_TS_MSG_IMPRINT_SET_ALGO 118
# define TS_F_TS_REQ_SET_MSG_IMPRINT 119
# define TS_F_TS_REQ_SET_NONCE 120
# define TS_F_TS_REQ_SET_POLICY_ID 121
# define TS_F_TS_RESP_CREATE_RESPONSE 122
# define TS_F_TS_RESP_CREATE_TST_INFO 123
# define TS_F_TS_RESP_CTX_ADD_FAILURE_INFO 124
# define TS_F_TS_RESP_CTX_ADD_MD 125
# define TS_F_TS_RESP_CTX_ADD_POLICY 126
# define TS_F_TS_RESP_CTX_NEW 127
# define TS_F_TS_RESP_CTX_SET_ACCURACY 128
# define TS_F_TS_RESP_CTX_SET_CERTS 129
# define TS_F_TS_RESP_CTX_SET_DEF_POLICY 130
# define TS_F_TS_RESP_CTX_SET_SIGNER_CERT 131
# define TS_F_TS_RESP_CTX_SET_STATUS_INFO 132
# define TS_F_TS_RESP_GET_POLICY 133
# define TS_F_TS_RESP_SET_GENTIME_WITH_PRECISION 134
# define TS_F_TS_RESP_SET_STATUS_INFO 135
# define TS_F_TS_RESP_SET_TST_INFO 150
# define TS_F_TS_RESP_SIGN 136
# define TS_F_TS_RESP_VERIFY_SIGNATURE 106
# define TS_F_TS_RESP_VERIFY_TOKEN 107
# define TS_F_TS_TST_INFO_SET_ACCURACY 137
# define TS_F_TS_TST_INFO_SET_MSG_IMPRINT 138
# define TS_F_TS_TST_INFO_SET_NONCE 139
# define TS_F_TS_TST_INFO_SET_POLICY_ID 140
# define TS_F_TS_TST_INFO_SET_SERIAL 141
# define TS_F_TS_TST_INFO_SET_TIME 142
# define TS_F_TS_TST_INFO_SET_TSA 143
# define TS_F_TS_VERIFY 108
# define TS_F_TS_VERIFY_CERT 109
# define TS_F_TS_VERIFY_CTX_NEW 144
/* Reason codes. */
# define TS_R_BAD_PKCS7_TYPE 132
# define TS_R_BAD_TYPE 133
# define TS_R_CERTIFICATE_VERIFY_ERROR 100
# define TS_R_COULD_NOT_SET_ENGINE 127
# define TS_R_COULD_NOT_SET_TIME 115
# define TS_R_D2I_TS_RESP_INT_FAILED 128
# define TS_R_DETACHED_CONTENT 134
# define TS_R_ESS_ADD_SIGNING_CERT_ERROR 116
# define TS_R_ESS_SIGNING_CERTIFICATE_ERROR 101
# define TS_R_INVALID_NULL_POINTER 102
# define TS_R_INVALID_SIGNER_CERTIFICATE_PURPOSE 117
# define TS_R_MESSAGE_IMPRINT_MISMATCH 103
# define TS_R_NONCE_MISMATCH 104
# define TS_R_NONCE_NOT_RETURNED 105
# define TS_R_NO_CONTENT 106
# define TS_R_NO_TIME_STAMP_TOKEN 107
# define TS_R_PKCS7_ADD_SIGNATURE_ERROR 118
# define TS_R_PKCS7_ADD_SIGNED_ATTR_ERROR 119
# define TS_R_PKCS7_TO_TS_TST_INFO_FAILED 129
# define TS_R_POLICY_MISMATCH 108
# define TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE 120
# define TS_R_RESPONSE_SETUP_ERROR 121
# define TS_R_SIGNATURE_FAILURE 109
# define TS_R_THERE_MUST_BE_ONE_SIGNER 110
# define TS_R_TIME_SYSCALL_ERROR 122
# define TS_R_TOKEN_NOT_PRESENT 130
# define TS_R_TOKEN_PRESENT 131
# define TS_R_TSA_NAME_MISMATCH 111
# define TS_R_TSA_UNTRUSTED 112
# define TS_R_TST_INFO_SETUP_ERROR 123
# define TS_R_TS_DATASIGN 124
# define TS_R_UNACCEPTABLE_POLICY 125
# define TS_R_UNSUPPORTED_MD_ALGORITHM 126
# define TS_R_UNSUPPORTED_VERSION 113
# define TS_R_WRONG_CONTENT_TYPE 114
#ifdef __cplusplus
}
#endif
#endif

109
crypto/ts/ts_asn1.c
View File

@@ -1,73 +1,24 @@
/* crypto/ts/ts_asn1.c */
/*
* Written by Nils Larsch for the OpenSSL project 2004.
*/
/* ====================================================================
* Copyright (c) 2006 The OpenSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. All advertising materials mentioning features or use of this
* software must display the following acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
*
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
* endorse or promote products derived from this software without
* prior written permission. For written permission, please contact
* licensing@OpenSSL.org.
*
* 5. Products derived from this software may not be called "OpenSSL"
* nor may "OpenSSL" appear in their names without prior written
* permission of the OpenSSL Project.
*
* 6. Redistributions of any form whatsoever must retain the following
* acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
*
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
* ====================================================================
*
* This product includes cryptographic software written by Eric Young
* (eay@cryptsoft.com). This product includes software written by Tim
* Hudson (tjh@cryptsoft.com).
* Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include <openssl/ts.h>
#include <openssl/err.h>
#include <openssl/asn1t.h>
#include "ts_lcl.h"
ASN1_SEQUENCE(TS_MSG_IMPRINT) = {
ASN1_SIMPLE(TS_MSG_IMPRINT, hash_algo, X509_ALGOR),
ASN1_SIMPLE(TS_MSG_IMPRINT, hashed_msg, ASN1_OCTET_STRING)
} ASN1_SEQUENCE_END(TS_MSG_IMPRINT)
} static_ASN1_SEQUENCE_END(TS_MSG_IMPRINT)
IMPLEMENT_ASN1_FUNCTIONS_const(TS_MSG_IMPRINT)
IMPLEMENT_ASN1_DUP_FUNCTION(TS_MSG_IMPRINT)
#ifndef OPENSSL_NO_BIO
TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_bio(BIO *bp, TS_MSG_IMPRINT **a)
{
return ASN1_d2i_bio_of(TS_MSG_IMPRINT, TS_MSG_IMPRINT_new,
@@ -78,8 +29,7 @@ int i2d_TS_MSG_IMPRINT_bio(BIO *bp, TS_MSG_IMPRINT *a)
{
return ASN1_i2d_bio_of_const(TS_MSG_IMPRINT, i2d_TS_MSG_IMPRINT, bp, a);
}
#endif
#ifndef OPENSSL_NO_FP_API
#ifndef OPENSSL_NO_STDIO
TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT **a)
{
return ASN1_d2i_fp_of(TS_MSG_IMPRINT, TS_MSG_IMPRINT_new,
@@ -99,11 +49,10 @@ ASN1_SEQUENCE(TS_REQ) = {
ASN1_OPT(TS_REQ, nonce, ASN1_INTEGER),
ASN1_OPT(TS_REQ, cert_req, ASN1_FBOOLEAN),
ASN1_IMP_SEQUENCE_OF_OPT(TS_REQ, extensions, X509_EXTENSION, 0)
} ASN1_SEQUENCE_END(TS_REQ)
} static_ASN1_SEQUENCE_END(TS_REQ)
IMPLEMENT_ASN1_FUNCTIONS_const(TS_REQ)
IMPLEMENT_ASN1_DUP_FUNCTION(TS_REQ)
#ifndef OPENSSL_NO_BIO
TS_REQ *d2i_TS_REQ_bio(BIO *bp, TS_REQ **a)
{
return ASN1_d2i_bio_of(TS_REQ, TS_REQ_new, d2i_TS_REQ, bp, a);
@@ -113,8 +62,7 @@ int i2d_TS_REQ_bio(BIO *bp, TS_REQ *a)
{
return ASN1_i2d_bio_of_const(TS_REQ, i2d_TS_REQ, bp, a);
}
#endif
#ifndef OPENSSL_NO_FP_API
#ifndef OPENSSL_NO_STDIO
TS_REQ *d2i_TS_REQ_fp(FILE *fp, TS_REQ **a)
{
return ASN1_d2i_fp_of(TS_REQ, TS_REQ_new, d2i_TS_REQ, fp, a);
@@ -130,7 +78,7 @@ ASN1_SEQUENCE(TS_ACCURACY) = {
ASN1_OPT(TS_ACCURACY, seconds, ASN1_INTEGER),
ASN1_IMP_OPT(TS_ACCURACY, millis, ASN1_INTEGER, 0),
ASN1_IMP_OPT(TS_ACCURACY, micros, ASN1_INTEGER, 1)
} ASN1_SEQUENCE_END(TS_ACCURACY)
} static_ASN1_SEQUENCE_END(TS_ACCURACY)
IMPLEMENT_ASN1_FUNCTIONS_const(TS_ACCURACY)
IMPLEMENT_ASN1_DUP_FUNCTION(TS_ACCURACY)
@@ -146,11 +94,10 @@ ASN1_SEQUENCE(TS_TST_INFO) = {
ASN1_OPT(TS_TST_INFO, nonce, ASN1_INTEGER),
ASN1_EXP_OPT(TS_TST_INFO, tsa, GENERAL_NAME, 0),
ASN1_IMP_SEQUENCE_OF_OPT(TS_TST_INFO, extensions, X509_EXTENSION, 1)
} ASN1_SEQUENCE_END(TS_TST_INFO)
} static_ASN1_SEQUENCE_END(TS_TST_INFO)
IMPLEMENT_ASN1_FUNCTIONS_const(TS_TST_INFO)
IMPLEMENT_ASN1_DUP_FUNCTION(TS_TST_INFO)
#ifndef OPENSSL_NO_BIO
TS_TST_INFO *d2i_TS_TST_INFO_bio(BIO *bp, TS_TST_INFO **a)
{
return ASN1_d2i_bio_of(TS_TST_INFO, TS_TST_INFO_new, d2i_TS_TST_INFO, bp,
@@ -161,8 +108,7 @@ int i2d_TS_TST_INFO_bio(BIO *bp, TS_TST_INFO *a)
{
return ASN1_i2d_bio_of_const(TS_TST_INFO, i2d_TS_TST_INFO, bp, a);
}
#endif
#ifndef OPENSSL_NO_FP_API
#ifndef OPENSSL_NO_STDIO
TS_TST_INFO *d2i_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO **a)
{
return ASN1_d2i_fp_of(TS_TST_INFO, TS_TST_INFO_new, d2i_TS_TST_INFO, fp,
@@ -179,7 +125,7 @@ ASN1_SEQUENCE(TS_STATUS_INFO) = {
ASN1_SIMPLE(TS_STATUS_INFO, status, ASN1_INTEGER),
ASN1_SEQUENCE_OF_OPT(TS_STATUS_INFO, text, ASN1_UTF8STRING),
ASN1_OPT(TS_STATUS_INFO, failure_info, ASN1_BIT_STRING)
} ASN1_SEQUENCE_END(TS_STATUS_INFO)
} static_ASN1_SEQUENCE_END(TS_STATUS_INFO)
IMPLEMENT_ASN1_FUNCTIONS_const(TS_STATUS_INFO)
IMPLEMENT_ASN1_DUP_FUNCTION(TS_STATUS_INFO)
@@ -195,8 +141,7 @@ static int ts_resp_set_tst_info(TS_RESP *a)
TSerr(TS_F_TS_RESP_SET_TST_INFO, TS_R_TOKEN_PRESENT);
return 0;
}
if (a->tst_info != NULL)
TS_TST_INFO_free(a->tst_info);
TS_TST_INFO_free(a->tst_info);
a->tst_info = PKCS7_to_TS_TST_INFO(a->token);
if (!a->tst_info) {
TSerr(TS_F_TS_RESP_SET_TST_INFO,
@@ -218,8 +163,7 @@ static int ts_resp_cb(int op, ASN1_VALUE **pval, const ASN1_ITEM *it,
if (op == ASN1_OP_NEW_POST) {
ts_resp->tst_info = NULL;
} else if (op == ASN1_OP_FREE_POST) {
if (ts_resp->tst_info != NULL)
TS_TST_INFO_free(ts_resp->tst_info);
TS_TST_INFO_free(ts_resp->tst_info);
} else if (op == ASN1_OP_D2I_POST) {
if (ts_resp_set_tst_info(ts_resp) == 0)
return 0;
@@ -230,13 +174,12 @@ static int ts_resp_cb(int op, ASN1_VALUE **pval, const ASN1_ITEM *it,
ASN1_SEQUENCE_cb(TS_RESP, ts_resp_cb) = {
ASN1_SIMPLE(TS_RESP, status_info, TS_STATUS_INFO),
ASN1_OPT(TS_RESP, token, PKCS7),
} ASN1_SEQUENCE_END_cb(TS_RESP, TS_RESP)
} static_ASN1_SEQUENCE_END_cb(TS_RESP, TS_RESP)
IMPLEMENT_ASN1_FUNCTIONS_const(TS_RESP)
IMPLEMENT_ASN1_DUP_FUNCTION(TS_RESP)
#ifndef OPENSSL_NO_BIO
TS_RESP *d2i_TS_RESP_bio(BIO *bp, TS_RESP **a)
{
return ASN1_d2i_bio_of(TS_RESP, TS_RESP_new, d2i_TS_RESP, bp, a);
@@ -246,8 +189,7 @@ int i2d_TS_RESP_bio(BIO *bp, TS_RESP *a)
{
return ASN1_i2d_bio_of_const(TS_RESP, i2d_TS_RESP, bp, a);
}
#endif
#ifndef OPENSSL_NO_FP_API
#ifndef OPENSSL_NO_STDIO
TS_RESP *d2i_TS_RESP_fp(FILE *fp, TS_RESP **a)
{
return ASN1_d2i_fp_of(TS_RESP, TS_RESP_new, d2i_TS_RESP, fp, a);
@@ -262,7 +204,7 @@ int i2d_TS_RESP_fp(FILE *fp, TS_RESP *a)
ASN1_SEQUENCE(ESS_ISSUER_SERIAL) = {
ASN1_SEQUENCE_OF(ESS_ISSUER_SERIAL, issuer, GENERAL_NAME),
ASN1_SIMPLE(ESS_ISSUER_SERIAL, serial, ASN1_INTEGER)
} ASN1_SEQUENCE_END(ESS_ISSUER_SERIAL)
} static_ASN1_SEQUENCE_END(ESS_ISSUER_SERIAL)
IMPLEMENT_ASN1_FUNCTIONS_const(ESS_ISSUER_SERIAL)
IMPLEMENT_ASN1_DUP_FUNCTION(ESS_ISSUER_SERIAL)
@@ -270,7 +212,7 @@ IMPLEMENT_ASN1_DUP_FUNCTION(ESS_ISSUER_SERIAL)
ASN1_SEQUENCE(ESS_CERT_ID) = {
ASN1_SIMPLE(ESS_CERT_ID, hash, ASN1_OCTET_STRING),
ASN1_OPT(ESS_CERT_ID, issuer_serial, ESS_ISSUER_SERIAL)
} ASN1_SEQUENCE_END(ESS_CERT_ID)
} static_ASN1_SEQUENCE_END(ESS_CERT_ID)
IMPLEMENT_ASN1_FUNCTIONS_const(ESS_CERT_ID)
IMPLEMENT_ASN1_DUP_FUNCTION(ESS_CERT_ID)
@@ -278,7 +220,7 @@ IMPLEMENT_ASN1_DUP_FUNCTION(ESS_CERT_ID)
ASN1_SEQUENCE(ESS_SIGNING_CERT) = {
ASN1_SEQUENCE_OF(ESS_SIGNING_CERT, cert_ids, ESS_CERT_ID),
ASN1_SEQUENCE_OF_OPT(ESS_SIGNING_CERT, policy_info, POLICYINFO)
} ASN1_SEQUENCE_END(ESS_SIGNING_CERT)
} static_ASN1_SEQUENCE_END(ESS_SIGNING_CERT)
IMPLEMENT_ASN1_FUNCTIONS_const(ESS_SIGNING_CERT)
IMPLEMENT_ASN1_DUP_FUNCTION(ESS_SIGNING_CERT)
@@ -296,31 +238,22 @@ TS_TST_INFO *PKCS7_to_TS_TST_INFO(PKCS7 *token)
TSerr(TS_F_PKCS7_TO_TS_TST_INFO, TS_R_BAD_PKCS7_TYPE);
return NULL;
}
/* Content must be present. */
if (PKCS7_get_detached(token)) {
TSerr(TS_F_PKCS7_TO_TS_TST_INFO, TS_R_DETACHED_CONTENT);
return NULL;
}
/* We have a signed data with content. */
pkcs7_signed = token->d.sign;
enveloped = pkcs7_signed->contents;
if (OBJ_obj2nid(enveloped->type) != NID_id_smime_ct_TSTInfo) {
TSerr(TS_F_PKCS7_TO_TS_TST_INFO, TS_R_BAD_PKCS7_TYPE);
return NULL;
}
/* We have a DER encoded TST_INFO as the signed data. */
tst_info_wrapper = enveloped->d.other;
if (tst_info_wrapper->type != V_ASN1_OCTET_STRING) {
TSerr(TS_F_PKCS7_TO_TS_TST_INFO, TS_R_BAD_TYPE);
return NULL;
}
/* We have the correct ASN1_OCTET_STRING type. */
tst_info_der = tst_info_wrapper->value.octet_string;
/* At last, decode the TST_INFO. */
p = tst_info_der->data;
return d2i_TS_TST_INFO(NULL, &p, tst_info_der->length);
}

217
crypto/ts/ts_conf.c
View File

@@ -1,74 +1,21 @@
/* crypto/ts/ts_conf.c */
/*
* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL project
* 2002.
*/
/* ====================================================================
* Copyright (c) 2006 The OpenSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. All advertising materials mentioning features or use of this
* software must display the following acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
*
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
* endorse or promote products derived from this software without
* prior written permission. For written permission, please contact
* licensing@OpenSSL.org.
*
* 5. Products derived from this software may not be called "OpenSSL"
* nor may "OpenSSL" appear in their names without prior written
* permission of the OpenSSL Project.
*
* 6. Redistributions of any form whatsoever must retain the following
* acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
*
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
* ====================================================================
*
* This product includes cryptographic software written by Eric Young
* (eay@cryptsoft.com). This product includes software written by Tim
* Hudson (tjh@cryptsoft.com).
* Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include <string.h>
#include <openssl/crypto.h>
#include "cryptlib.h"
#include "internal/cryptlib.h"
#include <openssl/pem.h>
#ifndef OPENSSL_NO_ENGINE
# include <openssl/engine.h>
#endif
#include <openssl/engine.h>
#include <openssl/ts.h>
/* Macro definitions for the configuration file. */
#define BASE_SECTION "tsa"
#define ENV_DEFAULT_TSA "default_tsa"
#define ENV_SERIAL "serial"
@@ -76,6 +23,7 @@
#define ENV_SIGNER_CERT "signer_cert"
#define ENV_CERTS "certs"
#define ENV_SIGNER_KEY "signer_key"
#define ENV_SIGNER_DIGEST "signer_digest"
#define ENV_DEFAULT_POLICY "default_policy"
#define ENV_OTHER_POLICIES "other_policies"
#define ENV_DIGESTS "digests"
@@ -102,7 +50,7 @@ X509 *TS_CONF_load_cert(const char *file)
x = PEM_read_bio_X509_AUX(cert, NULL, NULL, NULL);
end:
if (x == NULL)
fprintf(stderr, "unable to load certificate: %s\n", file);
TSerr(TS_F_TS_CONF_LOAD_CERT, TS_R_CANNOT_LOAD_CERT);
BIO_free(cert);
return x;
}
@@ -114,11 +62,11 @@ STACK_OF(X509) *TS_CONF_load_certs(const char *file)
STACK_OF(X509_INFO) *allcerts = NULL;
int i;
if (!(certs = BIO_new_file(file, "r")))
if ((certs = BIO_new_file(file, "r")) == NULL)
goto end;
if ((othercerts = sk_X509_new_null()) == NULL)
goto end;
if (!(othercerts = sk_X509_new_null()))
goto end;
allcerts = PEM_X509_INFO_read_bio(certs, NULL, NULL, NULL);
for (i = 0; i < sk_X509_INFO_num(allcerts); i++) {
X509_INFO *xi = sk_X509_INFO_value(allcerts, i);
@@ -129,7 +77,7 @@ STACK_OF(X509) *TS_CONF_load_certs(const char *file)
}
end:
if (othercerts == NULL)
fprintf(stderr, "unable to load certificates: %s\n", file);
TSerr(TS_F_TS_CONF_LOAD_CERTS, TS_R_CANNOT_LOAD_CERT);
sk_X509_INFO_pop_free(allcerts, X509_INFO_free);
BIO_free(certs);
return othercerts;
@@ -140,26 +88,28 @@ EVP_PKEY *TS_CONF_load_key(const char *file, const char *pass)
BIO *key = NULL;
EVP_PKEY *pkey = NULL;
if (!(key = BIO_new_file(file, "r")))
if ((key = BIO_new_file(file, "r")) == NULL)
goto end;
pkey = PEM_read_bio_PrivateKey(key, NULL, NULL, (char *)pass);
end:
if (pkey == NULL)
fprintf(stderr, "unable to load private key: %s\n", file);
TSerr(TS_F_TS_CONF_LOAD_KEY, TS_R_CANNOT_LOAD_KEY);
BIO_free(key);
return pkey;
}
/* Function definitions for handling configuration options. */
static void TS_CONF_lookup_fail(const char *name, const char *tag)
static void ts_CONF_lookup_fail(const char *name, const char *tag)
{
fprintf(stderr, "variable lookup failed for %s::%s\n", name, tag);
TSerr(TS_F_TS_CONF_LOOKUP_FAIL, TS_R_VAR_LOOKUP_FAILURE);
ERR_add_error_data(3, name, "::", tag);
}
static void TS_CONF_invalid(const char *name, const char *tag)
static void ts_CONF_invalid(const char *name, const char *tag)
{
fprintf(stderr, "invalid variable value for %s::%s\n", name, tag);
TSerr(TS_F_TS_CONF_INVALID, TS_R_VAR_BAD_VALUE);
ERR_add_error_data(3, name, "::", tag);
}
const char *TS_CONF_get_tsa_section(CONF *conf, const char *section)
@@ -167,7 +117,7 @@ const char *TS_CONF_get_tsa_section(CONF *conf, const char *section)
if (!section) {
section = NCONF_get_string(conf, BASE_SECTION, ENV_DEFAULT_TSA);
if (!section)
TS_CONF_lookup_fail(BASE_SECTION, ENV_DEFAULT_TSA);
ts_CONF_lookup_fail(BASE_SECTION, ENV_DEFAULT_TSA);
}
return section;
}
@@ -178,7 +128,7 @@ int TS_CONF_set_serial(CONF *conf, const char *section, TS_serial_cb cb,
int ret = 0;
char *serial = NCONF_get_string(conf, section, ENV_SERIAL);
if (!serial) {
TS_CONF_lookup_fail(section, ENV_SERIAL);
ts_CONF_lookup_fail(section, ENV_SERIAL);
goto err;
}
TS_RESP_CTX_set_serial_cb(ctx, cb, serial);
@@ -195,11 +145,11 @@ int TS_CONF_set_crypto_device(CONF *conf, const char *section,
{
int ret = 0;
if (!device)
if (device == NULL)
device = NCONF_get_string(conf, section, ENV_CRYPTO_DEVICE);
if (device && !TS_CONF_set_default_engine(device)) {
TS_CONF_invalid(section, ENV_CRYPTO_DEVICE);
ts_CONF_invalid(section, ENV_CRYPTO_DEVICE);
goto err;
}
ret = 1;
@@ -212,26 +162,23 @@ int TS_CONF_set_default_engine(const char *name)
ENGINE *e = NULL;
int ret = 0;
/* Leave the default if builtin specified. */
if (strcmp(name, "builtin") == 0)
return 1;
if (!(e = ENGINE_by_id(name)))
if ((e = ENGINE_by_id(name)) == NULL)
goto err;
/* Enable the use of the NCipher HSM for forked children. */
if (strcmp(name, "chil") == 0)
ENGINE_ctrl(e, ENGINE_CTRL_CHIL_SET_FORKCHECK, 1, 0, 0);
/* All the operations are going to be carried out by the engine. */
if (!ENGINE_set_default(e, ENGINE_METHOD_ALL))
goto err;
ret = 1;
err:
if (!ret) {
TSerr(TS_F_TS_CONF_SET_DEFAULT_ENGINE, TS_R_COULD_NOT_SET_ENGINE);
ERR_add_error_data(2, "engine:", name);
}
if (e)
ENGINE_free(e);
ENGINE_free(e);
return ret;
}
@@ -242,13 +189,15 @@ int TS_CONF_set_signer_cert(CONF *conf, const char *section,
{
int ret = 0;
X509 *cert_obj = NULL;
if (!cert)
if (cert == NULL) {
cert = NCONF_get_string(conf, section, ENV_SIGNER_CERT);
if (!cert) {
TS_CONF_lookup_fail(section, ENV_SIGNER_CERT);
goto err;
if (cert == NULL) {
ts_CONF_lookup_fail(section, ENV_SIGNER_CERT);
goto err;
}
}
if (!(cert_obj = TS_CONF_load_cert(cert)))
if ((cert_obj = TS_CONF_load_cert(cert)) == NULL)
goto err;
if (!TS_RESP_CTX_set_signer_cert(ctx, cert_obj))
goto err;
@@ -264,12 +213,13 @@ int TS_CONF_set_certs(CONF *conf, const char *section, const char *certs,
{
int ret = 0;
STACK_OF(X509) *certs_obj = NULL;
if (!certs)
certs = NCONF_get_string(conf, section, ENV_CERTS);
/* Certificate chain is optional. */
if (!certs)
goto end;
if (!(certs_obj = TS_CONF_load_certs(certs)))
if (certs == NULL) {
/* Certificate chain is optional. */
if ((certs = NCONF_get_string(conf, section, ENV_CERTS)) == NULL)
goto end;
}
if ((certs_obj = TS_CONF_load_certs(certs)) == NULL)
goto err;
if (!TS_RESP_CTX_set_certs(ctx, certs_obj))
goto err;
@@ -289,10 +239,10 @@ int TS_CONF_set_signer_key(CONF *conf, const char *section,
if (!key)
key = NCONF_get_string(conf, section, ENV_SIGNER_KEY);
if (!key) {
TS_CONF_lookup_fail(section, ENV_SIGNER_KEY);
ts_CONF_lookup_fail(section, ENV_SIGNER_KEY);
goto err;
}
if (!(key_obj = TS_CONF_load_key(key, pass)))
if ((key_obj = TS_CONF_load_key(key, pass)) == NULL)
goto err;
if (!TS_RESP_CTX_set_signer_key(ctx, key_obj))
goto err;
@@ -303,6 +253,30 @@ int TS_CONF_set_signer_key(CONF *conf, const char *section,
return ret;
}
int TS_CONF_set_signer_digest(CONF *conf, const char *section,
const char *md, TS_RESP_CTX *ctx)
{
int ret = 0;
const EVP_MD *sign_md = NULL;
if (md == NULL)
md = NCONF_get_string(conf, section, ENV_SIGNER_DIGEST);
if (md == NULL) {
ts_CONF_lookup_fail(section, ENV_SIGNER_DIGEST);
goto err;
}
sign_md = EVP_get_digestbyname(md);
if (sign_md == NULL) {
ts_CONF_invalid(section, ENV_SIGNER_DIGEST);
goto err;
}
if (!TS_RESP_CTX_set_signer_digest(ctx, sign_md))
goto err;
ret = 1;
err:
return ret;
}
int TS_CONF_set_def_policy(CONF *conf, const char *section,
const char *policy, TS_RESP_CTX *ctx)
{
@@ -311,11 +285,11 @@ int TS_CONF_set_def_policy(CONF *conf, const char *section,
if (!policy)
policy = NCONF_get_string(conf, section, ENV_DEFAULT_POLICY);
if (!policy) {
TS_CONF_lookup_fail(section, ENV_DEFAULT_POLICY);
ts_CONF_lookup_fail(section, ENV_DEFAULT_POLICY);
goto err;
}
if (!(policy_obj = OBJ_txt2obj(policy, 0))) {
TS_CONF_invalid(section, ENV_DEFAULT_POLICY);
if ((policy_obj = OBJ_txt2obj(policy, 0)) == NULL) {
ts_CONF_invalid(section, ENV_DEFAULT_POLICY);
goto err;
}
if (!TS_RESP_CTX_set_def_policy(ctx, policy_obj))
@@ -332,19 +306,20 @@ int TS_CONF_set_policies(CONF *conf, const char *section, TS_RESP_CTX *ctx)
int ret = 0;
int i;
STACK_OF(CONF_VALUE) *list = NULL;
char *policies = NCONF_get_string(conf, section,
ENV_OTHER_POLICIES);
char *policies = NCONF_get_string(conf, section, ENV_OTHER_POLICIES);
/* If no other policy is specified, that's fine. */
if (policies && !(list = X509V3_parse_list(policies))) {
TS_CONF_invalid(section, ENV_OTHER_POLICIES);
if (policies && (list = X509V3_parse_list(policies)) == NULL) {
ts_CONF_invalid(section, ENV_OTHER_POLICIES);
goto err;
}
for (i = 0; i < sk_CONF_VALUE_num(list); ++i) {
CONF_VALUE *val = sk_CONF_VALUE_value(list, i);
const char *extval = val->value ? val->value : val->name;
ASN1_OBJECT *objtmp;
if (!(objtmp = OBJ_txt2obj(extval, 0))) {
TS_CONF_invalid(section, ENV_OTHER_POLICIES);
if ((objtmp = OBJ_txt2obj(extval, 0)) == NULL) {
ts_CONF_invalid(section, ENV_OTHER_POLICIES);
goto err;
}
if (!TS_RESP_CTX_add_policy(ctx, objtmp))
@@ -364,24 +339,26 @@ int TS_CONF_set_digests(CONF *conf, const char *section, TS_RESP_CTX *ctx)
int i;
STACK_OF(CONF_VALUE) *list = NULL;
char *digests = NCONF_get_string(conf, section, ENV_DIGESTS);
if (!digests) {
TS_CONF_lookup_fail(section, ENV_DIGESTS);
if (digests == NULL) {
ts_CONF_lookup_fail(section, ENV_DIGESTS);
goto err;
}
if (!(list = X509V3_parse_list(digests))) {
TS_CONF_invalid(section, ENV_DIGESTS);
if ((list = X509V3_parse_list(digests)) == NULL) {
ts_CONF_invalid(section, ENV_DIGESTS);
goto err;
}
if (sk_CONF_VALUE_num(list) == 0) {
TS_CONF_invalid(section, ENV_DIGESTS);
ts_CONF_invalid(section, ENV_DIGESTS);
goto err;
}
for (i = 0; i < sk_CONF_VALUE_num(list); ++i) {
CONF_VALUE *val = sk_CONF_VALUE_value(list, i);
const char *extval = val->value ? val->value : val->name;
const EVP_MD *md;
if (!(md = EVP_get_digestbyname(extval))) {
TS_CONF_invalid(section, ENV_DIGESTS);
if ((md = EVP_get_digestbyname(extval)) == NULL) {
ts_CONF_invalid(section, ENV_DIGESTS);
goto err;
}
if (!TS_RESP_CTX_add_md(ctx, md))
@@ -402,8 +379,8 @@ int TS_CONF_set_accuracy(CONF *conf, const char *section, TS_RESP_CTX *ctx)
STACK_OF(CONF_VALUE) *list = NULL;
char *accuracy = NCONF_get_string(conf, section, ENV_ACCURACY);
if (accuracy && !(list = X509V3_parse_list(accuracy))) {
TS_CONF_invalid(section, ENV_ACCURACY);
if (accuracy && (list = X509V3_parse_list(accuracy)) == NULL) {
ts_CONF_invalid(section, ENV_ACCURACY);
goto err;
}
for (i = 0; i < sk_CONF_VALUE_num(list); ++i) {
@@ -418,7 +395,7 @@ int TS_CONF_set_accuracy(CONF *conf, const char *section, TS_RESP_CTX *ctx)
if (val->value)
micros = atoi(val->value);
} else {
TS_CONF_invalid(section, ENV_ACCURACY);
ts_CONF_invalid(section, ENV_ACCURACY);
goto err;
}
}
@@ -444,7 +421,7 @@ int TS_CONF_set_clock_precision_digits(CONF *conf, const char *section,
&digits))
digits = 0;
if (digits < 0 || digits > TS_MAX_CLOCK_PRECISION_DIGITS) {
TS_CONF_invalid(section, ENV_CLOCK_PRECISION_DIGITS);
ts_CONF_invalid(section, ENV_CLOCK_PRECISION_DIGITS);
goto err;
}
@@ -456,16 +433,16 @@ int TS_CONF_set_clock_precision_digits(CONF *conf, const char *section,
return ret;
}
static int TS_CONF_add_flag(CONF *conf, const char *section,
static int ts_CONF_add_flag(CONF *conf, const char *section,
const char *field, int flag, TS_RESP_CTX *ctx)
{
/* Default is false. */
const char *value = NCONF_get_string(conf, section, field);
if (value) {
if (strcmp(value, ENV_VALUE_YES) == 0)
TS_RESP_CTX_add_flags(ctx, flag);
else if (strcmp(value, ENV_VALUE_NO) != 0) {
TS_CONF_invalid(section, field);
ts_CONF_invalid(section, field);
return 0;
}
}
@@ -475,17 +452,17 @@ static int TS_CONF_add_flag(CONF *conf, const char *section,
int TS_CONF_set_ordering(CONF *conf, const char *section, TS_RESP_CTX *ctx)
{
return TS_CONF_add_flag(conf, section, ENV_ORDERING, TS_ORDERING, ctx);
return ts_CONF_add_flag(conf, section, ENV_ORDERING, TS_ORDERING, ctx);
}
int TS_CONF_set_tsa_name(CONF *conf, const char *section, TS_RESP_CTX *ctx)
{
return TS_CONF_add_flag(conf, section, ENV_TSA_NAME, TS_TSA_NAME, ctx);
return ts_CONF_add_flag(conf, section, ENV_TSA_NAME, TS_TSA_NAME, ctx);
}
int TS_CONF_set_ess_cert_id_chain(CONF *conf, const char *section,
TS_RESP_CTX *ctx)
{
return TS_CONF_add_flag(conf, section, ENV_ESS_CERT_ID_CHAIN,
return ts_CONF_add_flag(conf, section, ENV_ESS_CERT_ID_CHAIN,
TS_ESS_CERT_ID_CHAIN, ctx);
}

116
crypto/ts/ts_err.c
View File

@@ -1,62 +1,11 @@
/* crypto/ts/ts_err.c */
/* ====================================================================
* Copyright (c) 1999-2007 The OpenSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. All advertising materials mentioning features or use of this
* software must display the following acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
*
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
* endorse or promote products derived from this software without
* prior written permission. For written permission, please contact
* openssl-core@OpenSSL.org.
*
* 5. Products derived from this software may not be called "OpenSSL"
* nor may "OpenSSL" appear in their names without prior written
* permission of the OpenSSL Project.
*
* 6. Redistributions of any form whatsoever must retain the following
* acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
*
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
* ====================================================================
*
* This product includes cryptographic software written by Eric Young
* (eay@cryptsoft.com). This product includes software written by Tim
* Hudson (tjh@cryptsoft.com).
*
*/
/*
* NOTE: this file was auto generated by the mkerr.pl script: any changes
* made to it will be overwritten when the script next updates this file,
* only reason strings will be preserved.
* Generated by util/mkerr.pl DO NOT EDIT
* Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include <stdio.h>
@@ -70,31 +19,35 @@
# define ERR_REASON(reason) ERR_PACK(ERR_LIB_TS,0,reason)
static ERR_STRING_DATA TS_str_functs[] = {
{ERR_FUNC(TS_F_D2I_TS_RESP), "d2i_TS_RESP"},
{ERR_FUNC(TS_F_DEF_SERIAL_CB), "DEF_SERIAL_CB"},
{ERR_FUNC(TS_F_DEF_TIME_CB), "DEF_TIME_CB"},
{ERR_FUNC(TS_F_ESS_ADD_SIGNING_CERT), "ESS_ADD_SIGNING_CERT"},
{ERR_FUNC(TS_F_ESS_CERT_ID_NEW_INIT), "ESS_CERT_ID_NEW_INIT"},
{ERR_FUNC(TS_F_ESS_SIGNING_CERT_NEW_INIT), "ESS_SIGNING_CERT_NEW_INIT"},
{ERR_FUNC(TS_F_INT_TS_RESP_VERIFY_TOKEN), "INT_TS_RESP_VERIFY_TOKEN"},
{ERR_FUNC(TS_F_DEF_SERIAL_CB), "def_serial_cb"},
{ERR_FUNC(TS_F_DEF_TIME_CB), "def_time_cb"},
{ERR_FUNC(TS_F_ESS_ADD_SIGNING_CERT), "ESS_add_signing_cert"},
{ERR_FUNC(TS_F_ESS_CERT_ID_NEW_INIT), "ess_CERT_ID_new_init"},
{ERR_FUNC(TS_F_ESS_SIGNING_CERT_NEW_INIT), "ess_SIGNING_CERT_new_init"},
{ERR_FUNC(TS_F_INT_TS_RESP_VERIFY_TOKEN), "int_ts_RESP_verify_token"},
{ERR_FUNC(TS_F_PKCS7_TO_TS_TST_INFO), "PKCS7_to_TS_TST_INFO"},
{ERR_FUNC(TS_F_TS_ACCURACY_SET_MICROS), "TS_ACCURACY_set_micros"},
{ERR_FUNC(TS_F_TS_ACCURACY_SET_MILLIS), "TS_ACCURACY_set_millis"},
{ERR_FUNC(TS_F_TS_ACCURACY_SET_SECONDS), "TS_ACCURACY_set_seconds"},
{ERR_FUNC(TS_F_TS_CHECK_IMPRINTS), "TS_CHECK_IMPRINTS"},
{ERR_FUNC(TS_F_TS_CHECK_NONCES), "TS_CHECK_NONCES"},
{ERR_FUNC(TS_F_TS_CHECK_POLICY), "TS_CHECK_POLICY"},
{ERR_FUNC(TS_F_TS_CHECK_SIGNING_CERTS), "TS_CHECK_SIGNING_CERTS"},
{ERR_FUNC(TS_F_TS_CHECK_STATUS_INFO), "TS_CHECK_STATUS_INFO"},
{ERR_FUNC(TS_F_TS_COMPUTE_IMPRINT), "TS_COMPUTE_IMPRINT"},
{ERR_FUNC(TS_F_TS_CHECK_IMPRINTS), "ts_check_imprints"},
{ERR_FUNC(TS_F_TS_CHECK_NONCES), "ts_check_nonces"},
{ERR_FUNC(TS_F_TS_CHECK_POLICY), "ts_check_policy"},
{ERR_FUNC(TS_F_TS_CHECK_SIGNING_CERTS), "ts_check_signing_certs"},
{ERR_FUNC(TS_F_TS_CHECK_STATUS_INFO), "ts_check_status_info"},
{ERR_FUNC(TS_F_TS_COMPUTE_IMPRINT), "ts_compute_imprint"},
{ERR_FUNC(TS_F_TS_CONF_INVALID), "ts_CONF_invalid"},
{ERR_FUNC(TS_F_TS_CONF_LOAD_CERT), "TS_CONF_load_cert"},
{ERR_FUNC(TS_F_TS_CONF_LOAD_CERTS), "TS_CONF_load_certs"},
{ERR_FUNC(TS_F_TS_CONF_LOAD_KEY), "TS_CONF_load_key"},
{ERR_FUNC(TS_F_TS_CONF_LOOKUP_FAIL), "ts_CONF_lookup_fail"},
{ERR_FUNC(TS_F_TS_CONF_SET_DEFAULT_ENGINE), "TS_CONF_set_default_engine"},
{ERR_FUNC(TS_F_TS_GET_STATUS_TEXT), "TS_GET_STATUS_TEXT"},
{ERR_FUNC(TS_F_TS_GET_STATUS_TEXT), "ts_get_status_text"},
{ERR_FUNC(TS_F_TS_MSG_IMPRINT_SET_ALGO), "TS_MSG_IMPRINT_set_algo"},
{ERR_FUNC(TS_F_TS_REQ_SET_MSG_IMPRINT), "TS_REQ_set_msg_imprint"},
{ERR_FUNC(TS_F_TS_REQ_SET_NONCE), "TS_REQ_set_nonce"},
{ERR_FUNC(TS_F_TS_REQ_SET_POLICY_ID), "TS_REQ_set_policy_id"},
{ERR_FUNC(TS_F_TS_RESP_CREATE_RESPONSE), "TS_RESP_create_response"},
{ERR_FUNC(TS_F_TS_RESP_CREATE_TST_INFO), "TS_RESP_CREATE_TST_INFO"},
{ERR_FUNC(TS_F_TS_RESP_CREATE_TST_INFO), "ts_RESP_create_tst_info"},
{ERR_FUNC(TS_F_TS_RESP_CTX_ADD_FAILURE_INFO),
"TS_RESP_CTX_add_failure_info"},
{ERR_FUNC(TS_F_TS_RESP_CTX_ADD_MD), "TS_RESP_CTX_add_md"},
@@ -107,14 +60,13 @@ static ERR_STRING_DATA TS_str_functs[] = {
"TS_RESP_CTX_set_signer_cert"},
{ERR_FUNC(TS_F_TS_RESP_CTX_SET_STATUS_INFO),
"TS_RESP_CTX_set_status_info"},
{ERR_FUNC(TS_F_TS_RESP_GET_POLICY), "TS_RESP_GET_POLICY"},
{ERR_FUNC(TS_F_TS_RESP_GET_POLICY), "ts_RESP_get_policy"},
{ERR_FUNC(TS_F_TS_RESP_SET_GENTIME_WITH_PRECISION),
"TS_RESP_SET_GENTIME_WITH_PRECISION"},
"TS_RESP_set_genTime_with_precision"},
{ERR_FUNC(TS_F_TS_RESP_SET_STATUS_INFO), "TS_RESP_set_status_info"},
{ERR_FUNC(TS_F_TS_RESP_SET_TST_INFO), "TS_RESP_set_tst_info"},
{ERR_FUNC(TS_F_TS_RESP_SIGN), "TS_RESP_SIGN"},
{ERR_FUNC(TS_F_TS_RESP_SIGN), "ts_RESP_sign"},
{ERR_FUNC(TS_F_TS_RESP_VERIFY_SIGNATURE), "TS_RESP_verify_signature"},
{ERR_FUNC(TS_F_TS_RESP_VERIFY_TOKEN), "TS_RESP_verify_token"},
{ERR_FUNC(TS_F_TS_TST_INFO_SET_ACCURACY), "TS_TST_INFO_set_accuracy"},
{ERR_FUNC(TS_F_TS_TST_INFO_SET_MSG_IMPRINT),
"TS_TST_INFO_set_msg_imprint"},
@@ -124,7 +76,7 @@ static ERR_STRING_DATA TS_str_functs[] = {
{ERR_FUNC(TS_F_TS_TST_INFO_SET_TIME), "TS_TST_INFO_set_time"},
{ERR_FUNC(TS_F_TS_TST_INFO_SET_TSA), "TS_TST_INFO_set_tsa"},
{ERR_FUNC(TS_F_TS_VERIFY), "TS_VERIFY"},
{ERR_FUNC(TS_F_TS_VERIFY_CERT), "TS_VERIFY_CERT"},
{ERR_FUNC(TS_F_TS_VERIFY_CERT), "ts_verify_cert"},
{ERR_FUNC(TS_F_TS_VERIFY_CTX_NEW), "TS_VERIFY_CTX_new"},
{0, NULL}
};
@@ -132,10 +84,11 @@ static ERR_STRING_DATA TS_str_functs[] = {
static ERR_STRING_DATA TS_str_reasons[] = {
{ERR_REASON(TS_R_BAD_PKCS7_TYPE), "bad pkcs7 type"},
{ERR_REASON(TS_R_BAD_TYPE), "bad type"},
{ERR_REASON(TS_R_CANNOT_LOAD_CERT), "cannot load certificate"},
{ERR_REASON(TS_R_CANNOT_LOAD_KEY), "cannot load private key"},
{ERR_REASON(TS_R_CERTIFICATE_VERIFY_ERROR), "certificate verify error"},
{ERR_REASON(TS_R_COULD_NOT_SET_ENGINE), "could not set engine"},
{ERR_REASON(TS_R_COULD_NOT_SET_TIME), "could not set time"},
{ERR_REASON(TS_R_D2I_TS_RESP_INT_FAILED), "d2i ts resp int failed"},
{ERR_REASON(TS_R_DETACHED_CONTENT), "detached content"},
{ERR_REASON(TS_R_ESS_ADD_SIGNING_CERT_ERROR),
"ess add signing cert error"},
@@ -170,13 +123,15 @@ static ERR_STRING_DATA TS_str_reasons[] = {
{ERR_REASON(TS_R_UNACCEPTABLE_POLICY), "unacceptable policy"},
{ERR_REASON(TS_R_UNSUPPORTED_MD_ALGORITHM), "unsupported md algorithm"},
{ERR_REASON(TS_R_UNSUPPORTED_VERSION), "unsupported version"},
{ERR_REASON(TS_R_VAR_BAD_VALUE), "var bad value"},
{ERR_REASON(TS_R_VAR_LOOKUP_FAILURE), "cannot find config variable"},
{ERR_REASON(TS_R_WRONG_CONTENT_TYPE), "wrong content type"},
{0, NULL}
};
#endif
void ERR_load_TS_strings(void)
int ERR_load_TS_strings(void)
{
#ifndef OPENSSL_NO_ERR
@@ -185,4 +140,5 @@ void ERR_load_TS_strings(void)
ERR_load_strings(0, TS_str_reasons);
}
#endif
return 1;
}

183
crypto/ts/ts_lcl.h Normal file
View File

@@ -0,0 +1,183 @@
/*
* Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
/*-
* MessageImprint ::= SEQUENCE {
* hashAlgorithm AlgorithmIdentifier,
* hashedMessage OCTET STRING }
*/
struct TS_msg_imprint_st {
X509_ALGOR *hash_algo;
ASN1_OCTET_STRING *hashed_msg;
};
/*-
* TimeStampResp ::= SEQUENCE {
* status PKIStatusInfo,
* timeStampToken TimeStampToken OPTIONAL }
*/
struct TS_resp_st {
TS_STATUS_INFO *status_info;
PKCS7 *token;
TS_TST_INFO *tst_info;
};
/*-
* TimeStampReq ::= SEQUENCE {
* version INTEGER { v1(1) },
* messageImprint MessageImprint,
* --a hash algorithm OID and the hash value of the data to be
* --time-stamped
* reqPolicy TSAPolicyId OPTIONAL,
* nonce INTEGER OPTIONAL,
* certReq BOOLEAN DEFAULT FALSE,
* extensions [0] IMPLICIT Extensions OPTIONAL }
*/
struct TS_req_st {
ASN1_INTEGER *version;
TS_MSG_IMPRINT *msg_imprint;
ASN1_OBJECT *policy_id;
ASN1_INTEGER *nonce;
ASN1_BOOLEAN cert_req;
STACK_OF(X509_EXTENSION) *extensions;
};
/*-
* Accuracy ::= SEQUENCE {
* seconds INTEGER OPTIONAL,
* millis [0] INTEGER (1..999) OPTIONAL,
* micros [1] INTEGER (1..999) OPTIONAL }
*/
struct TS_accuracy_st {
ASN1_INTEGER *seconds;
ASN1_INTEGER *millis;
ASN1_INTEGER *micros;
};
/*-
* TSTInfo ::= SEQUENCE {
* version INTEGER { v1(1) },
* policy TSAPolicyId,
* messageImprint MessageImprint,
* -- MUST have the same value as the similar field in
* -- TimeStampReq
* serialNumber INTEGER,
* -- Time-Stamping users MUST be ready to accommodate integers
* -- up to 160 bits.
* genTime GeneralizedTime,
* accuracy Accuracy OPTIONAL,
* ordering BOOLEAN DEFAULT FALSE,
* nonce INTEGER OPTIONAL,
* -- MUST be present if the similar field was present
* -- in TimeStampReq. In that case it MUST have the same value.
* tsa [0] GeneralName OPTIONAL,
* extensions [1] IMPLICIT Extensions OPTIONAL }
*/
struct TS_tst_info_st {
ASN1_INTEGER *version;
ASN1_OBJECT *policy_id;
TS_MSG_IMPRINT *msg_imprint;
ASN1_INTEGER *serial;
ASN1_GENERALIZEDTIME *time;
TS_ACCURACY *accuracy;
ASN1_BOOLEAN ordering;
ASN1_INTEGER *nonce;
GENERAL_NAME *tsa;
STACK_OF(X509_EXTENSION) *extensions;
};
struct TS_status_info_st {
ASN1_INTEGER *status;
STACK_OF(ASN1_UTF8STRING) *text;
ASN1_BIT_STRING *failure_info;
};
/*-
* IssuerSerial ::= SEQUENCE {
* issuer GeneralNames,
* serialNumber CertificateSerialNumber
* }
*/
struct ESS_issuer_serial {
STACK_OF(GENERAL_NAME) *issuer;
ASN1_INTEGER *serial;
};
/*-
* ESSCertID ::= SEQUENCE {
* certHash Hash,
* issuerSerial IssuerSerial OPTIONAL
* }
*/
struct ESS_cert_id {
ASN1_OCTET_STRING *hash; /* Always SHA-1 digest. */
ESS_ISSUER_SERIAL *issuer_serial;
};
/*-
* SigningCertificate ::= SEQUENCE {
* certs SEQUENCE OF ESSCertID,
* policies SEQUENCE OF PolicyInformation OPTIONAL
* }
*/
struct ESS_signing_cert {
STACK_OF(ESS_CERT_ID) *cert_ids;
STACK_OF(POLICYINFO) *policy_info;
};
struct TS_resp_ctx {
X509 *signer_cert;
EVP_PKEY *signer_key;
const EVP_MD *signer_md;
STACK_OF(X509) *certs; /* Certs to include in signed data. */
STACK_OF(ASN1_OBJECT) *policies; /* Acceptable policies. */
ASN1_OBJECT *default_policy; /* It may appear in policies, too. */
STACK_OF(EVP_MD) *mds; /* Acceptable message digests. */
ASN1_INTEGER *seconds; /* accuracy, 0 means not specified. */
ASN1_INTEGER *millis; /* accuracy, 0 means not specified. */
ASN1_INTEGER *micros; /* accuracy, 0 means not specified. */
unsigned clock_precision_digits; /* fraction of seconds in time stamp
* token. */
unsigned flags; /* Optional info, see values above. */
/* Callback functions. */
TS_serial_cb serial_cb;
void *serial_cb_data; /* User data for serial_cb. */
TS_time_cb time_cb;
void *time_cb_data; /* User data for time_cb. */
TS_extension_cb extension_cb;
void *extension_cb_data; /* User data for extension_cb. */
/* These members are used only while creating the response. */
TS_REQ *request;
TS_RESP *response;
TS_TST_INFO *tst_info;
};
struct TS_verify_ctx {
/* Set this to the union of TS_VFY_... flags you want to carry out. */
unsigned flags;
/* Must be set only with TS_VFY_SIGNATURE. certs is optional. */
X509_STORE *store;
STACK_OF(X509) *certs;
/* Must be set only with TS_VFY_POLICY. */
ASN1_OBJECT *policy;
/*
* Must be set only with TS_VFY_IMPRINT. If md_alg is NULL, the
* algorithm from the response is used.
*/
X509_ALGOR *md_alg;
unsigned char *imprint;
unsigned imprint_len;
/* Must be set only with TS_VFY_DATA. */
BIO *data;
/* Must be set only with TS_VFY_TSA_NAME. */
ASN1_INTEGER *nonce;
/* Must be set only with TS_VFY_TSA_NAME. */
GENERAL_NAME *tsa_name;
};

104
crypto/ts/ts_lib.c
View File

@@ -1,87 +1,37 @@
/* crypto/ts/ts_lib.c */
/*
* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL project
* 2002.
*/
/* ====================================================================
* Copyright (c) 2006 The OpenSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. All advertising materials mentioning features or use of this
* software must display the following acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
*
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
* endorse or promote products derived from this software without
* prior written permission. For written permission, please contact
* licensing@OpenSSL.org.
*
* 5. Products derived from this software may not be called "OpenSSL"
* nor may "OpenSSL" appear in their names without prior written
* permission of the OpenSSL Project.
*
* 6. Redistributions of any form whatsoever must retain the following
* acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
*
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
* ====================================================================
*
* This product includes cryptographic software written by Eric Young
* (eay@cryptsoft.com). This product includes software written by Tim
* Hudson (tjh@cryptsoft.com).
* Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include <stdio.h>
#include "cryptlib.h"
#include "internal/cryptlib.h"
#include <openssl/objects.h>
#include <openssl/bn.h>
#include <openssl/x509.h>
#include <openssl/x509v3.h>
#include "ts.h"
/* Local function declarations. */
/* Function definitions. */
#include <openssl/ts.h>
#include "ts_lcl.h"
int TS_ASN1_INTEGER_print_bio(BIO *bio, const ASN1_INTEGER *num)
{
BIGNUM num_bn;
BIGNUM *num_bn;
int result = 0;
char *hex;
BN_init(&num_bn);
ASN1_INTEGER_to_BN(num, &num_bn);
if ((hex = BN_bn2hex(&num_bn))) {
num_bn = BN_new();
if (num_bn == NULL)
return -1;
ASN1_INTEGER_to_BN(num, num_bn);
if ((hex = BN_bn2hex(num_bn))) {
result = BIO_write(bio, "0x", 2) > 0;
result = result && BIO_write(bio, hex, strlen(hex)) > 0;
OPENSSL_free(hex);
}
BN_free(&num_bn);
BN_free(num_bn);
return result;
}
@@ -90,9 +40,8 @@ int TS_OBJ_print_bio(BIO *bio, const ASN1_OBJECT *obj)
{
char obj_txt[128];
int len = OBJ_obj2txt(obj_txt, sizeof(obj_txt), obj, 0);
BIO_write(bio, obj_txt, len);
BIO_write(bio, "\n", 1);
OBJ_obj2txt(obj_txt, sizeof(obj_txt), obj, 0);
BIO_printf(bio, "%s\n", obj_txt);
return 1;
}
@@ -108,12 +57,13 @@ int TS_ext_print_bio(BIO *bio, const STACK_OF(X509_EXTENSION) *extensions)
for (i = 0; i < n; i++) {
ex = X509v3_get_ext(extensions, i);
obj = X509_EXTENSION_get_object(ex);
i2a_ASN1_OBJECT(bio, obj);
if (i2a_ASN1_OBJECT(bio, obj) < 0)
return 0;
critical = X509_EXTENSION_get_critical(ex);
BIO_printf(bio, ": %s\n", critical ? "critical" : "");
BIO_printf(bio, ":%s\n", critical ? " critical" : "");
if (!X509V3_EXT_print(bio, ex, 0, 4)) {
BIO_printf(bio, "%4s", "");
M_ASN1_OCTET_STRING_print(bio, ex->value);
ASN1_STRING_print(bio, X509_EXTENSION_get_data(ex));
}
BIO_write(bio, "\n", 1);
}
@@ -130,14 +80,14 @@ int TS_X509_ALGOR_print_bio(BIO *bio, const X509_ALGOR *alg)
int TS_MSG_IMPRINT_print_bio(BIO *bio, TS_MSG_IMPRINT *a)
{
const ASN1_OCTET_STRING *msg;
ASN1_OCTET_STRING *msg;
TS_X509_ALGOR_print_bio(bio, TS_MSG_IMPRINT_get_algo(a));
TS_X509_ALGOR_print_bio(bio, a->hash_algo);
BIO_printf(bio, "Message data:\n");
msg = TS_MSG_IMPRINT_get_msg(a);
BIO_dump_indent(bio, (const char *)M_ASN1_STRING_data(msg),
M_ASN1_STRING_length(msg), 4);
msg = a->hashed_msg;
BIO_dump_indent(bio, (const char *)ASN1_STRING_get0_data(msg),
ASN1_STRING_length(msg), 4);
return 1;
}

77
crypto/ts/ts_req_print.c
View File

@@ -1,76 +1,24 @@
/* crypto/ts/ts_req_print.c */
/*
* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL project
* 2002.
*/
/* ====================================================================
* Copyright (c) 2006 The OpenSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. All advertising materials mentioning features or use of this
* software must display the following acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
*
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
* endorse or promote products derived from this software without
* prior written permission. For written permission, please contact
* licensing@OpenSSL.org.
*
* 5. Products derived from this software may not be called "OpenSSL"
* nor may "OpenSSL" appear in their names without prior written
* permission of the OpenSSL Project.
*
* 6. Redistributions of any form whatsoever must retain the following
* acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
*
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
* ====================================================================
*
* This product includes cryptographic software written by Eric Young
* (eay@cryptsoft.com). This product includes software written by Tim
* Hudson (tjh@cryptsoft.com).
* Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include <stdio.h>
#include "cryptlib.h"
#include "internal/cryptlib.h"
#include <openssl/objects.h>
#include <openssl/bn.h>
#include <openssl/x509v3.h>
#include <openssl/ts.h>
/* Function definitions. */
#include "ts_lcl.h"
int TS_REQ_print_bio(BIO *bio, TS_REQ *a)
{
int v;
ASN1_OBJECT *policy_id;
const ASN1_INTEGER *nonce;
if (a == NULL)
return 0;
@@ -78,7 +26,7 @@ int TS_REQ_print_bio(BIO *bio, TS_REQ *a)
v = TS_REQ_get_version(a);
BIO_printf(bio, "Version: %d\n", v);
TS_MSG_IMPRINT_print_bio(bio, TS_REQ_get_msg_imprint(a));
TS_MSG_IMPRINT_print_bio(bio, a->msg_imprint);
BIO_printf(bio, "Policy OID: ");
policy_id = TS_REQ_get_policy_id(a);
@@ -88,17 +36,16 @@ int TS_REQ_print_bio(BIO *bio, TS_REQ *a)
TS_OBJ_print_bio(bio, policy_id);
BIO_printf(bio, "Nonce: ");
nonce = TS_REQ_get_nonce(a);
if (nonce == NULL)
if (a->nonce == NULL)
BIO_printf(bio, "unspecified");
else
TS_ASN1_INTEGER_print_bio(bio, nonce);
TS_ASN1_INTEGER_print_bio(bio, a->nonce);
BIO_write(bio, "\n", 1);
BIO_printf(bio, "Certificate required: %s\n",
TS_REQ_get_cert_req(a) ? "yes" : "no");
a->cert_req ? "yes" : "no");
TS_ext_print_bio(bio, TS_REQ_get_exts(a));
TS_ext_print_bio(bio, a->extensions);
return 1;
}

67
crypto/ts/ts_req_utils.c
View File

@@ -1,67 +1,18 @@
/* crypto/ts/ts_req_utils.c */
/*
* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL project
* 2002.
*/
/* ====================================================================
* Copyright (c) 2006 The OpenSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. All advertising materials mentioning features or use of this
* software must display the following acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
*
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
* endorse or promote products derived from this software without
* prior written permission. For written permission, please contact
* licensing@OpenSSL.org.
*
* 5. Products derived from this software may not be called "OpenSSL"
* nor may "OpenSSL" appear in their names without prior written
* permission of the OpenSSL Project.
*
* 6. Redistributions of any form whatsoever must retain the following
* acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
*
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
* ====================================================================
*
* This product includes cryptographic software written by Eric Young
* (eay@cryptsoft.com). This product includes software written by Tim
* Hudson (tjh@cryptsoft.com).
* Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include <stdio.h>
#include "cryptlib.h"
#include "internal/cryptlib.h"
#include <openssl/objects.h>
#include <openssl/x509v3.h>
#include <openssl/ts.h>
#include "ts_lcl.h"
int TS_REQ_set_version(TS_REQ *a, long version)
{
@@ -125,7 +76,7 @@ ASN1_OCTET_STRING *TS_MSG_IMPRINT_get_msg(TS_MSG_IMPRINT *a)
return a->hashed_msg;
}
int TS_REQ_set_policy_id(TS_REQ *a, ASN1_OBJECT *policy)
int TS_REQ_set_policy_id(TS_REQ *a, const ASN1_OBJECT *policy)
{
ASN1_OBJECT *new_policy;
@@ -201,7 +152,7 @@ int TS_REQ_get_ext_by_NID(TS_REQ *a, int nid, int lastpos)
return X509v3_get_ext_by_NID(a->extensions, nid, lastpos);
}
int TS_REQ_get_ext_by_OBJ(TS_REQ *a, ASN1_OBJECT *obj, int lastpos)
int TS_REQ_get_ext_by_OBJ(TS_REQ *a, const ASN1_OBJECT *obj, int lastpos)
{
return X509v3_get_ext_by_OBJ(a->extensions, obj, lastpos);
}

166
crypto/ts/ts_rsp_print.c
View File

@@ -1,93 +1,38 @@
/* crypto/ts/ts_resp_print.c */
/*
* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL project
* 2002.
*/
/* ====================================================================
* Copyright (c) 2006 The OpenSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. All advertising materials mentioning features or use of this
* software must display the following acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
*
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
* endorse or promote products derived from this software without
* prior written permission. For written permission, please contact
* licensing@OpenSSL.org.
*
* 5. Products derived from this software may not be called "OpenSSL"
* nor may "OpenSSL" appear in their names without prior written
* permission of the OpenSSL Project.
*
* 6. Redistributions of any form whatsoever must retain the following
* acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
*
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
* ====================================================================
*
* This product includes cryptographic software written by Eric Young
* (eay@cryptsoft.com). This product includes software written by Tim
* Hudson (tjh@cryptsoft.com).
* Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include <stdio.h>
#include "cryptlib.h"
#include "internal/cryptlib.h"
#include <openssl/objects.h>
#include <openssl/bn.h>
#include <openssl/x509v3.h>
#include "ts.h"
#include <openssl/ts.h>
#include "ts_lcl.h"
struct status_map_st {
int bit;
const char *text;
};
/* Local function declarations. */
static int ts_status_map_print(BIO *bio, const struct status_map_st *a,
const ASN1_BIT_STRING *v);
static int ts_ACCURACY_print_bio(BIO *bio, const TS_ACCURACY *accuracy);
static int TS_status_map_print(BIO *bio, struct status_map_st *a,
ASN1_BIT_STRING *v);
static int TS_ACCURACY_print_bio(BIO *bio, const TS_ACCURACY *accuracy);
/* Function definitions. */
int TS_RESP_print_bio(BIO *bio, TS_RESP *a)
{
TS_TST_INFO *tst_info;
BIO_printf(bio, "Status info:\n");
TS_STATUS_INFO_print_bio(bio, TS_RESP_get_status_info(a));
TS_STATUS_INFO_print_bio(bio, a->status_info);
BIO_printf(bio, "\nTST info:\n");
tst_info = TS_RESP_get_tst_info(a);
if (tst_info != NULL)
TS_TST_INFO_print_bio(bio, TS_RESP_get_tst_info(a));
if (a->tst_info != NULL)
TS_TST_INFO_print_bio(bio, a->tst_info);
else
BIO_printf(bio, "Not included.\n");
@@ -104,7 +49,7 @@ int TS_STATUS_INFO_print_bio(BIO *bio, TS_STATUS_INFO *a)
"Revocation warning.",
"Revoked."
};
static struct status_map_st failure_map[] = {
static const struct status_map_st failure_map[] = {
{TS_INFO_BAD_ALG,
"unrecognized or unsupported algorithm identifier"},
{TS_INFO_BAD_REQUEST,
@@ -127,16 +72,13 @@ int TS_STATUS_INFO_print_bio(BIO *bio, TS_STATUS_INFO *a)
long status;
int i, lines = 0;
/* Printing status code. */
BIO_printf(bio, "Status: ");
status = ASN1_INTEGER_get(a->status);
if (0 <= status
&& status < (long)(sizeof(status_map) / sizeof(status_map[0])))
if (0 <= status && status < (long)OSSL_NELEM(status_map))
BIO_printf(bio, "%s\n", status_map[status]);
else
BIO_printf(bio, "out of bounds\n");
/* Printing status description. */
BIO_printf(bio, "Status description: ");
for (i = 0; i < sk_ASN1_UTF8STRING_num(a->text); ++i) {
if (i > 0)
@@ -147,10 +89,9 @@ int TS_STATUS_INFO_print_bio(BIO *bio, TS_STATUS_INFO *a)
if (i == 0)
BIO_printf(bio, "unspecified\n");
/* Printing failure information. */
BIO_printf(bio, "Failure info: ");
if (a->failure_info != NULL)
lines = TS_status_map_print(bio, failure_map, a->failure_info);
lines = ts_status_map_print(bio, failure_map, a->failure_info);
if (lines == 0)
BIO_printf(bio, "unspecified");
BIO_printf(bio, "\n");
@@ -158,8 +99,8 @@ int TS_STATUS_INFO_print_bio(BIO *bio, TS_STATUS_INFO *a)
return 1;
}
static int TS_status_map_print(BIO *bio, struct status_map_st *a,
ASN1_BIT_STRING *v)
static int ts_status_map_print(BIO *bio, const struct status_map_st *a,
const ASN1_BIT_STRING *v)
{
int lines = 0;
@@ -177,102 +118,75 @@ static int TS_status_map_print(BIO *bio, struct status_map_st *a,
int TS_TST_INFO_print_bio(BIO *bio, TS_TST_INFO *a)
{
int v;
ASN1_OBJECT *policy_id;
const ASN1_INTEGER *serial;
const ASN1_GENERALIZEDTIME *gtime;
TS_ACCURACY *accuracy;
const ASN1_INTEGER *nonce;
GENERAL_NAME *tsa_name;
if (a == NULL)
return 0;
/* Print version. */
v = TS_TST_INFO_get_version(a);
v = ASN1_INTEGER_get(a->version);
BIO_printf(bio, "Version: %d\n", v);
/* Print policy id. */
BIO_printf(bio, "Policy OID: ");
policy_id = TS_TST_INFO_get_policy_id(a);
TS_OBJ_print_bio(bio, policy_id);
TS_OBJ_print_bio(bio, a->policy_id);
/* Print message imprint. */
TS_MSG_IMPRINT_print_bio(bio, TS_TST_INFO_get_msg_imprint(a));
TS_MSG_IMPRINT_print_bio(bio, a->msg_imprint);
/* Print serial number. */
BIO_printf(bio, "Serial number: ");
serial = TS_TST_INFO_get_serial(a);
if (serial == NULL)
if (a->serial == NULL)
BIO_printf(bio, "unspecified");
else
TS_ASN1_INTEGER_print_bio(bio, serial);
TS_ASN1_INTEGER_print_bio(bio, a->serial);
BIO_write(bio, "\n", 1);
/* Print time stamp. */
BIO_printf(bio, "Time stamp: ");
gtime = TS_TST_INFO_get_time(a);
ASN1_GENERALIZEDTIME_print(bio, gtime);
ASN1_GENERALIZEDTIME_print(bio, a->time);
BIO_write(bio, "\n", 1);
/* Print accuracy. */
BIO_printf(bio, "Accuracy: ");
accuracy = TS_TST_INFO_get_accuracy(a);
if (accuracy == NULL)
if (a->accuracy == NULL)
BIO_printf(bio, "unspecified");
else
TS_ACCURACY_print_bio(bio, accuracy);
ts_ACCURACY_print_bio(bio, a->accuracy);
BIO_write(bio, "\n", 1);
/* Print ordering. */
BIO_printf(bio, "Ordering: %s\n",
TS_TST_INFO_get_ordering(a) ? "yes" : "no");
BIO_printf(bio, "Ordering: %s\n", a->ordering ? "yes" : "no");
/* Print nonce. */
BIO_printf(bio, "Nonce: ");
nonce = TS_TST_INFO_get_nonce(a);
if (nonce == NULL)
if (a->nonce == NULL)
BIO_printf(bio, "unspecified");
else
TS_ASN1_INTEGER_print_bio(bio, nonce);
TS_ASN1_INTEGER_print_bio(bio, a->nonce);
BIO_write(bio, "\n", 1);
/* Print TSA name. */
BIO_printf(bio, "TSA: ");
tsa_name = TS_TST_INFO_get_tsa(a);
if (tsa_name == NULL)
if (a->tsa == NULL)
BIO_printf(bio, "unspecified");
else {
STACK_OF(CONF_VALUE) *nval;
if ((nval = i2v_GENERAL_NAME(NULL, tsa_name, NULL)))
if ((nval = i2v_GENERAL_NAME(NULL, a->tsa, NULL)))
X509V3_EXT_val_prn(bio, nval, 0, 0);
sk_CONF_VALUE_pop_free(nval, X509V3_conf_free);
}
BIO_write(bio, "\n", 1);
/* Print extensions. */
TS_ext_print_bio(bio, TS_TST_INFO_get_exts(a));
TS_ext_print_bio(bio, a->extensions);
return 1;
}
static int TS_ACCURACY_print_bio(BIO *bio, const TS_ACCURACY *accuracy)
static int ts_ACCURACY_print_bio(BIO *bio, const TS_ACCURACY *a)
{
const ASN1_INTEGER *seconds = TS_ACCURACY_get_seconds(accuracy);
const ASN1_INTEGER *millis = TS_ACCURACY_get_millis(accuracy);
const ASN1_INTEGER *micros = TS_ACCURACY_get_micros(accuracy);
if (seconds != NULL)
TS_ASN1_INTEGER_print_bio(bio, seconds);
if (a->seconds != NULL)
TS_ASN1_INTEGER_print_bio(bio, a->seconds);
else
BIO_printf(bio, "unspecified");
BIO_printf(bio, " seconds, ");
if (millis != NULL)
TS_ASN1_INTEGER_print_bio(bio, millis);
if (a->millis != NULL)
TS_ASN1_INTEGER_print_bio(bio, a->millis);
else
BIO_printf(bio, "unspecified");
BIO_printf(bio, " millis, ");
if (micros != NULL)
TS_ASN1_INTEGER_print_bio(bio, micros);
if (a->micros != NULL)
TS_ASN1_INTEGER_print_bio(bio, a->micros);
else
BIO_printf(bio, "unspecified");
BIO_printf(bio, " micros");

386
crypto/ts/ts_rsp_sign.c
View File

@@ -1,63 +1,13 @@
/* crypto/ts/ts_resp_sign.c */
/*
* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL project
* 2002.
*/
/* ====================================================================
* Copyright (c) 2006 The OpenSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. All advertising materials mentioning features or use of this
* software must display the following acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
*
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
* endorse or promote products derived from this software without
* prior written permission. For written permission, please contact
* licensing@OpenSSL.org.
*
* 5. Products derived from this software may not be called "OpenSSL"
* nor may "OpenSSL" appear in their names without prior written
* permission of the OpenSSL Project.
*
* 6. Redistributions of any form whatsoever must retain the following
* acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
*
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
* ====================================================================
*
* This product includes cryptographic software written by Eric Young
* (eay@cryptsoft.com). This product includes software written by Tim
* Hudson (tjh@cryptsoft.com).
* Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include "cryptlib.h"
#include "internal/cryptlib.h"
#if defined(OPENSSL_SYS_UNIX)
# include <sys/time.h>
@@ -66,42 +16,42 @@
#include <openssl/objects.h>
#include <openssl/ts.h>
#include <openssl/pkcs7.h>
/* Private function declarations. */
#include "ts_lcl.h"
static ASN1_INTEGER *def_serial_cb(struct TS_resp_ctx *, void *);
static int def_time_cb(struct TS_resp_ctx *, void *, long *sec, long *usec);
static int def_extension_cb(struct TS_resp_ctx *, X509_EXTENSION *, void *);
static void TS_RESP_CTX_init(TS_RESP_CTX *ctx);
static void TS_RESP_CTX_cleanup(TS_RESP_CTX *ctx);
static int TS_RESP_check_request(TS_RESP_CTX *ctx);
static ASN1_OBJECT *TS_RESP_get_policy(TS_RESP_CTX *ctx);
static TS_TST_INFO *TS_RESP_create_tst_info(TS_RESP_CTX *ctx,
static void ts_RESP_CTX_init(TS_RESP_CTX *ctx);
static void ts_RESP_CTX_cleanup(TS_RESP_CTX *ctx);
static int ts_RESP_check_request(TS_RESP_CTX *ctx);
static ASN1_OBJECT *ts_RESP_get_policy(TS_RESP_CTX *ctx);
static TS_TST_INFO *ts_RESP_create_tst_info(TS_RESP_CTX *ctx,
ASN1_OBJECT *policy);
static int TS_RESP_process_extensions(TS_RESP_CTX *ctx);
static int TS_RESP_sign(TS_RESP_CTX *ctx);
static int ts_RESP_process_extensions(TS_RESP_CTX *ctx);
static int ts_RESP_sign(TS_RESP_CTX *ctx);
static ESS_SIGNING_CERT *ESS_SIGNING_CERT_new_init(X509 *signcert,
static ESS_SIGNING_CERT *ess_SIGNING_CERT_new_init(X509 *signcert,
STACK_OF(X509) *certs);
static ESS_CERT_ID *ESS_CERT_ID_new_init(X509 *cert, int issuer_needed);
static int TS_TST_INFO_content_new(PKCS7 *p7);
static ESS_CERT_ID *ess_CERT_ID_new_init(X509 *cert, int issuer_needed);
static int ts_TST_INFO_content_new(PKCS7 *p7);
static int ESS_add_signing_cert(PKCS7_SIGNER_INFO *si, ESS_SIGNING_CERT *sc);
static ASN1_GENERALIZEDTIME
*TS_RESP_set_genTime_with_precision(ASN1_GENERALIZEDTIME *, long, long,
unsigned);
/* Default callbacks for response generation. */
/* Default callback for response generation. */
static ASN1_INTEGER *def_serial_cb(struct TS_resp_ctx *ctx, void *data)
{
ASN1_INTEGER *serial = ASN1_INTEGER_new();
if (!serial)
if (serial == NULL)
goto err;
if (!ASN1_INTEGER_set(serial, 1))
goto err;
return serial;
err:
TSerr(TS_F_DEF_SERIAL_CB, ERR_R_MALLOC_FAILURE);
TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
@@ -111,7 +61,6 @@ static ASN1_INTEGER *def_serial_cb(struct TS_resp_ctx *ctx, void *data)
#if defined(OPENSSL_SYS_UNIX)
/* Use the gettimeofday function call. */
static int def_time_cb(struct TS_resp_ctx *ctx, void *data,
long *sec, long *usec)
{
@@ -123,7 +72,6 @@ static int def_time_cb(struct TS_resp_ctx *ctx, void *data,
TS_RESP_CTX_add_failure_info(ctx, TS_INFO_TIME_NOT_AVAILABLE);
return 0;
}
/* Return time to caller. */
*sec = tv.tv_sec;
*usec = tv.tv_usec;
@@ -132,7 +80,6 @@ static int def_time_cb(struct TS_resp_ctx *ctx, void *data,
#else
/* Use the time function call that provides only seconds precision. */
static int def_time_cb(struct TS_resp_ctx *ctx, void *data,
long *sec, long *usec)
{
@@ -144,7 +91,6 @@ static int def_time_cb(struct TS_resp_ctx *ctx, void *data,
TS_RESP_CTX_add_failure_info(ctx, TS_INFO_TIME_NOT_AVAILABLE);
return 0;
}
/* Return time to caller, only second precision. */
*sec = (long)t;
*usec = 0;
@@ -156,7 +102,6 @@ static int def_time_cb(struct TS_resp_ctx *ctx, void *data,
static int def_extension_cb(struct TS_resp_ctx *ctx, X509_EXTENSION *ext,
void *data)
{
/* No extensions are processed here. */
TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
"Unsupported extension.");
TS_RESP_CTX_add_failure_info(ctx, TS_INFO_UNACCEPTED_EXTENSION);
@@ -169,13 +114,13 @@ TS_RESP_CTX *TS_RESP_CTX_new()
{
TS_RESP_CTX *ctx;
if (!(ctx = (TS_RESP_CTX *)OPENSSL_malloc(sizeof(TS_RESP_CTX)))) {
if ((ctx = OPENSSL_zalloc(sizeof(*ctx))) == NULL) {
TSerr(TS_F_TS_RESP_CTX_NEW, ERR_R_MALLOC_FAILURE);
return NULL;
}
memset(ctx, 0, sizeof(TS_RESP_CTX));
/* Setting default callbacks. */
ctx->signer_md = EVP_sha256();
ctx->serial_cb = def_serial_cb;
ctx->time_cb = def_time_cb;
ctx->extension_cb = def_extension_cb;
@@ -207,28 +152,31 @@ int TS_RESP_CTX_set_signer_cert(TS_RESP_CTX *ctx, X509 *signer)
TS_R_INVALID_SIGNER_CERTIFICATE_PURPOSE);
return 0;
}
if (ctx->signer_cert)
X509_free(ctx->signer_cert);
X509_free(ctx->signer_cert);
ctx->signer_cert = signer;
CRYPTO_add(&ctx->signer_cert->references, +1, CRYPTO_LOCK_X509);
X509_up_ref(ctx->signer_cert);
return 1;
}
int TS_RESP_CTX_set_signer_key(TS_RESP_CTX *ctx, EVP_PKEY *key)
{
if (ctx->signer_key)
EVP_PKEY_free(ctx->signer_key);
EVP_PKEY_free(ctx->signer_key);
ctx->signer_key = key;
CRYPTO_add(&ctx->signer_key->references, +1, CRYPTO_LOCK_EVP_PKEY);
EVP_PKEY_up_ref(ctx->signer_key);
return 1;
}
int TS_RESP_CTX_set_def_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *def_policy)
int TS_RESP_CTX_set_signer_digest(TS_RESP_CTX *ctx, const EVP_MD *md)
{
if (ctx->default_policy)
ASN1_OBJECT_free(ctx->default_policy);
if (!(ctx->default_policy = OBJ_dup(def_policy)))
ctx->signer_md = md;
return 1;
}
int TS_RESP_CTX_set_def_policy(TS_RESP_CTX *ctx, const ASN1_OBJECT *def_policy)
{
ASN1_OBJECT_free(ctx->default_policy);
if ((ctx->default_policy = OBJ_dup(def_policy)) == NULL)
goto err;
return 1;
err:
@@ -239,13 +187,11 @@ int TS_RESP_CTX_set_def_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *def_policy)
int TS_RESP_CTX_set_certs(TS_RESP_CTX *ctx, STACK_OF(X509) *certs)
{
if (ctx->certs) {
sk_X509_pop_free(ctx->certs, X509_free);
ctx->certs = NULL;
}
sk_X509_pop_free(ctx->certs, X509_free);
ctx->certs = NULL;
if (!certs)
return 1;
if (!(ctx->certs = X509_chain_up_ref(certs))) {
if ((ctx->certs = X509_chain_up_ref(certs)) == NULL) {
TSerr(TS_F_TS_RESP_CTX_SET_CERTS, ERR_R_MALLOC_FAILURE);
return 0;
}
@@ -253,14 +199,14 @@ int TS_RESP_CTX_set_certs(TS_RESP_CTX *ctx, STACK_OF(X509) *certs)
return 1;
}
int TS_RESP_CTX_add_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *policy)
int TS_RESP_CTX_add_policy(TS_RESP_CTX *ctx, const ASN1_OBJECT *policy)
{
ASN1_OBJECT *copy = NULL;
/* Create new policy stack if necessary. */
if (!ctx->policies && !(ctx->policies = sk_ASN1_OBJECT_new_null()))
if (ctx->policies == NULL
&& (ctx->policies = sk_ASN1_OBJECT_new_null()) == NULL)
goto err;
if (!(copy = OBJ_dup(policy)))
if ((copy = OBJ_dup(policy)) == NULL)
goto err;
if (!sk_ASN1_OBJECT_push(ctx->policies, copy))
goto err;
@@ -274,11 +220,10 @@ int TS_RESP_CTX_add_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *policy)
int TS_RESP_CTX_add_md(TS_RESP_CTX *ctx, const EVP_MD *md)
{
/* Create new md stack if necessary. */
if (!ctx->mds && !(ctx->mds = sk_EVP_MD_new_null()))
if (ctx->mds == NULL
&& (ctx->mds = sk_EVP_MD_new_null()) == NULL)
goto err;
/* Add the shared md, no copy needed. */
if (!sk_EVP_MD_push(ctx->mds, (EVP_MD *)md))
if (!sk_EVP_MD_push(ctx->mds, md))
goto err;
return 1;
@@ -300,14 +245,17 @@ int TS_RESP_CTX_set_accuracy(TS_RESP_CTX *ctx,
{
TS_RESP_CTX_accuracy_free(ctx);
if (secs && (!(ctx->seconds = ASN1_INTEGER_new())
|| !ASN1_INTEGER_set(ctx->seconds, secs)))
if (secs
&& ((ctx->seconds = ASN1_INTEGER_new()) == NULL
|| !ASN1_INTEGER_set(ctx->seconds, secs)))
goto err;
if (millis && (!(ctx->millis = ASN1_INTEGER_new())
|| !ASN1_INTEGER_set(ctx->millis, millis)))
if (millis
&& ((ctx->millis = ASN1_INTEGER_new()) == NULL
|| !ASN1_INTEGER_set(ctx->millis, millis)))
goto err;
if (micros && (!(ctx->micros = ASN1_INTEGER_new())
|| !ASN1_INTEGER_set(ctx->micros, micros)))
if (micros
&& ((ctx->micros = ASN1_INTEGER_new()) == NULL
|| !ASN1_INTEGER_set(ctx->micros, micros)))
goto err;
return 1;
@@ -348,15 +296,16 @@ int TS_RESP_CTX_set_status_info(TS_RESP_CTX *ctx,
ASN1_UTF8STRING *utf8_text = NULL;
int ret = 0;
if (!(si = TS_STATUS_INFO_new()))
if ((si = TS_STATUS_INFO_new()) == NULL)
goto err;
if (!ASN1_INTEGER_set(si->status, status))
goto err;
if (text) {
if (!(utf8_text = ASN1_UTF8STRING_new())
if ((utf8_text = ASN1_UTF8STRING_new()) == NULL
|| !ASN1_STRING_set(utf8_text, text, strlen(text)))
goto err;
if (!si->text && !(si->text = sk_ASN1_UTF8STRING_new_null()))
if (si->text == NULL
&& (si->text = sk_ASN1_UTF8STRING_new_null()) == NULL)
goto err;
if (!sk_ASN1_UTF8STRING_push(si->text, utf8_text))
goto err;
@@ -377,10 +326,9 @@ int TS_RESP_CTX_set_status_info_cond(TS_RESP_CTX *ctx,
int status, const char *text)
{
int ret = 1;
TS_STATUS_INFO *si = TS_RESP_get_status_info(ctx->response);
TS_STATUS_INFO *si = ctx->response->status_info;
if (ASN1_INTEGER_get(si->status) == TS_STATUS_GRANTED) {
/* Status has not been set, set it now. */
ret = TS_RESP_CTX_set_status_info(ctx, status, text);
}
return ret;
@@ -388,8 +336,9 @@ int TS_RESP_CTX_set_status_info_cond(TS_RESP_CTX *ctx,
int TS_RESP_CTX_add_failure_info(TS_RESP_CTX *ctx, int failure)
{
TS_STATUS_INFO *si = TS_RESP_get_status_info(ctx->response);
if (!si->failure_info && !(si->failure_info = ASN1_BIT_STRING_new()))
TS_STATUS_INFO *si = ctx->response->status_info;
if (si->failure_info == NULL
&& (si->failure_info = ASN1_BIT_STRING_new()) == NULL)
goto err;
if (!ASN1_BIT_STRING_set_bit(si->failure_info, failure, 1))
goto err;
@@ -425,48 +374,32 @@ TS_RESP *TS_RESP_create_response(TS_RESP_CTX *ctx, BIO *req_bio)
TS_RESP *response;
int result = 0;
TS_RESP_CTX_init(ctx);
ts_RESP_CTX_init(ctx);
/* Creating the response object. */
if (!(ctx->response = TS_RESP_new())) {
if ((ctx->response = TS_RESP_new()) == NULL) {
TSerr(TS_F_TS_RESP_CREATE_RESPONSE, ERR_R_MALLOC_FAILURE);
goto end;
}
/* Parsing DER request. */
if (!(ctx->request = d2i_TS_REQ_bio(req_bio, NULL))) {
if ((ctx->request = d2i_TS_REQ_bio(req_bio, NULL)) == NULL) {
TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
"Bad request format or " "system error.");
"Bad request format or system error.");
TS_RESP_CTX_add_failure_info(ctx, TS_INFO_BAD_DATA_FORMAT);
goto end;
}
/* Setting default status info. */
if (!TS_RESP_CTX_set_status_info(ctx, TS_STATUS_GRANTED, NULL))
goto end;
/* Checking the request format. */
if (!TS_RESP_check_request(ctx))
if (!ts_RESP_check_request(ctx))
goto end;
/* Checking acceptable policies. */
if (!(policy = TS_RESP_get_policy(ctx)))
if ((policy = ts_RESP_get_policy(ctx)) == NULL)
goto end;
/* Creating the TS_TST_INFO object. */
if (!(ctx->tst_info = TS_RESP_create_tst_info(ctx, policy)))
if ((ctx->tst_info = ts_RESP_create_tst_info(ctx, policy)) == NULL)
goto end;
/* Processing extensions. */
if (!TS_RESP_process_extensions(ctx))
if (!ts_RESP_process_extensions(ctx))
goto end;
/* Generating the signature. */
if (!TS_RESP_sign(ctx))
if (!ts_RESP_sign(ctx))
goto end;
/* Everything was successful. */
result = 1;
end:
if (!result) {
TSerr(TS_F_TS_RESP_CREATE_RESPONSE, TS_R_RESPONSE_SETUP_ERROR);
@@ -482,12 +415,12 @@ TS_RESP *TS_RESP_create_response(TS_RESP_CTX *ctx, BIO *req_bio)
}
response = ctx->response;
ctx->response = NULL; /* Ownership will be returned to caller. */
TS_RESP_CTX_cleanup(ctx);
ts_RESP_CTX_cleanup(ctx);
return response;
}
/* Initializes the variable part of the context. */
static void TS_RESP_CTX_init(TS_RESP_CTX *ctx)
static void ts_RESP_CTX_init(TS_RESP_CTX *ctx)
{
ctx->request = NULL;
ctx->response = NULL;
@@ -495,7 +428,7 @@ static void TS_RESP_CTX_init(TS_RESP_CTX *ctx)
}
/* Cleans up the variable part of the context. */
static void TS_RESP_CTX_cleanup(TS_RESP_CTX *ctx)
static void ts_RESP_CTX_cleanup(TS_RESP_CTX *ctx)
{
TS_REQ_free(ctx->request);
ctx->request = NULL;
@@ -506,17 +439,16 @@ static void TS_RESP_CTX_cleanup(TS_RESP_CTX *ctx)
}
/* Checks the format and content of the request. */
static int TS_RESP_check_request(TS_RESP_CTX *ctx)
static int ts_RESP_check_request(TS_RESP_CTX *ctx)
{
TS_REQ *request = ctx->request;
TS_MSG_IMPRINT *msg_imprint;
X509_ALGOR *md_alg;
int md_alg_id;
const ASN1_OCTET_STRING *digest;
EVP_MD *md = NULL;
const EVP_MD *md = NULL;
int i;
/* Checking request version. */
if (TS_REQ_get_version(request) != 1) {
TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
"Bad request version.");
@@ -524,12 +456,11 @@ static int TS_RESP_check_request(TS_RESP_CTX *ctx)
return 0;
}
/* Checking message digest algorithm. */
msg_imprint = TS_REQ_get_msg_imprint(request);
md_alg = TS_MSG_IMPRINT_get_algo(msg_imprint);
msg_imprint = request->msg_imprint;
md_alg = msg_imprint->hash_algo;
md_alg_id = OBJ_obj2nid(md_alg->algorithm);
for (i = 0; !md && i < sk_EVP_MD_num(ctx->mds); ++i) {
EVP_MD *current_md = sk_EVP_MD_value(ctx->mds, i);
const EVP_MD *current_md = sk_EVP_MD_value(ctx->mds, i);
if (md_alg_id == EVP_MD_type(current_md))
md = current_md;
}
@@ -541,7 +472,6 @@ static int TS_RESP_check_request(TS_RESP_CTX *ctx)
return 0;
}
/* No message digest takes parameter. */
if (md_alg->parameter && ASN1_TYPE_get(md_alg->parameter) != V_ASN1_NULL) {
TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
"Superfluous message digest "
@@ -549,8 +479,7 @@ static int TS_RESP_check_request(TS_RESP_CTX *ctx)
TS_RESP_CTX_add_failure_info(ctx, TS_INFO_BAD_ALG);
return 0;
}
/* Checking message digest size. */
digest = TS_MSG_IMPRINT_get_msg(msg_imprint);
digest = msg_imprint->hashed_msg;
if (digest->length != EVP_MD_size(md)) {
TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
"Bad message digest.");
@@ -562,9 +491,9 @@ static int TS_RESP_check_request(TS_RESP_CTX *ctx)
}
/* Returns the TSA policy based on the requested and acceptable policies. */
static ASN1_OBJECT *TS_RESP_get_policy(TS_RESP_CTX *ctx)
static ASN1_OBJECT *ts_RESP_get_policy(TS_RESP_CTX *ctx)
{
ASN1_OBJECT *requested = TS_REQ_get_policy_id(ctx->request);
ASN1_OBJECT *requested = ctx->request->policy_id;
ASN1_OBJECT *policy = NULL;
int i;
@@ -572,10 +501,6 @@ static ASN1_OBJECT *TS_RESP_get_policy(TS_RESP_CTX *ctx)
TSerr(TS_F_TS_RESP_GET_POLICY, TS_R_INVALID_NULL_POINTER);
return NULL;
}
/*
* Return the default policy if none is requested or the default is
* requested.
*/
if (!requested || !OBJ_cmp(requested, ctx->default_policy))
policy = ctx->default_policy;
@@ -595,7 +520,7 @@ static ASN1_OBJECT *TS_RESP_get_policy(TS_RESP_CTX *ctx)
}
/* Creates the TS_TST_INFO object based on the settings of the context. */
static TS_TST_INFO *TS_RESP_create_tst_info(TS_RESP_CTX *ctx,
static TS_TST_INFO *ts_RESP_create_tst_info(TS_RESP_CTX *ctx,
ASN1_OBJECT *policy)
{
int result = 0;
@@ -607,7 +532,7 @@ static TS_TST_INFO *TS_RESP_create_tst_info(TS_RESP_CTX *ctx,
const ASN1_INTEGER *nonce;
GENERAL_NAME *tsa_name = NULL;
if (!(tst_info = TS_TST_INFO_new()))
if ((tst_info = TS_TST_INFO_new()) == NULL)
goto end;
if (!TS_TST_INFO_set_version(tst_info, 1))
goto end;
@@ -615,21 +540,19 @@ static TS_TST_INFO *TS_RESP_create_tst_info(TS_RESP_CTX *ctx,
goto end;
if (!TS_TST_INFO_set_msg_imprint(tst_info, ctx->request->msg_imprint))
goto end;
if (!(serial = (*ctx->serial_cb) (ctx, ctx->serial_cb_data))
if ((serial = ctx->serial_cb(ctx, ctx->serial_cb_data)) == NULL
|| !TS_TST_INFO_set_serial(tst_info, serial))
goto end;
if (!(*ctx->time_cb) (ctx, ctx->time_cb_data, &sec, &usec)
|| !(asn1_time = TS_RESP_set_genTime_with_precision(NULL,
sec, usec,
ctx->clock_precision_digits))
if (!ctx->time_cb(ctx, ctx->time_cb_data, &sec, &usec)
|| (asn1_time =
TS_RESP_set_genTime_with_precision(NULL, sec, usec,
ctx->clock_precision_digits)) == NULL
|| !TS_TST_INFO_set_time(tst_info, asn1_time))
goto end;
/* Setting accuracy if needed. */
if ((ctx->seconds || ctx->millis || ctx->micros)
&& !(accuracy = TS_ACCURACY_new()))
&& (accuracy = TS_ACCURACY_new()) == NULL)
goto end;
if (ctx->seconds && !TS_ACCURACY_set_seconds(accuracy, ctx->seconds))
goto end;
if (ctx->millis && !TS_ACCURACY_set_millis(accuracy, ctx->millis))
@@ -639,23 +562,20 @@ static TS_TST_INFO *TS_RESP_create_tst_info(TS_RESP_CTX *ctx,
if (accuracy && !TS_TST_INFO_set_accuracy(tst_info, accuracy))
goto end;
/* Setting ordering. */
if ((ctx->flags & TS_ORDERING)
&& !TS_TST_INFO_set_ordering(tst_info, 1))
goto end;
/* Setting nonce if needed. */
if ((nonce = TS_REQ_get_nonce(ctx->request)) != NULL
if ((nonce = ctx->request->nonce) != NULL
&& !TS_TST_INFO_set_nonce(tst_info, nonce))
goto end;
/* Setting TSA name to subject of signer certificate. */
if (ctx->flags & TS_TSA_NAME) {
if (!(tsa_name = GENERAL_NAME_new()))
if ((tsa_name = GENERAL_NAME_new()) == NULL)
goto end;
tsa_name->type = GEN_DIRNAME;
tsa_name->d.dirn =
X509_NAME_dup(ctx->signer_cert->cert_info->subject);
X509_NAME_dup(X509_get_subject_name(ctx->signer_cert));
if (!tsa_name->d.dirn)
goto end;
if (!TS_TST_INFO_set_tsa(tst_info, tsa_name))
@@ -681,16 +601,16 @@ static TS_TST_INFO *TS_RESP_create_tst_info(TS_RESP_CTX *ctx,
}
/* Processing the extensions of the request. */
static int TS_RESP_process_extensions(TS_RESP_CTX *ctx)
static int ts_RESP_process_extensions(TS_RESP_CTX *ctx)
{
STACK_OF(X509_EXTENSION) *exts = TS_REQ_get_exts(ctx->request);
STACK_OF(X509_EXTENSION) *exts = ctx->request->extensions;
int i;
int ok = 1;
for (i = 0; ok && i < sk_X509_EXTENSION_num(exts); ++i) {
X509_EXTENSION *ext = sk_X509_EXTENSION_value(exts, i);
/*
* XXXXX The last argument was previously (void *)ctx->extension_cb,
* The last argument was previously (void *)ctx->extension_cb,
* but ISO C doesn't permit converting a function pointer to void *.
* For lack of better information, I'm placing a NULL there instead.
* The callback can pick its own address out from the ctx anyway...
@@ -702,7 +622,7 @@ static int TS_RESP_process_extensions(TS_RESP_CTX *ctx)
}
/* Functions for signing the TS_TST_INFO structure of the context. */
static int TS_RESP_sign(TS_RESP_CTX *ctx)
static int ts_RESP_sign(TS_RESP_CTX *ctx)
{
int ret = 0;
PKCS7 *p7 = NULL;
@@ -713,26 +633,21 @@ static int TS_RESP_sign(TS_RESP_CTX *ctx)
BIO *p7bio = NULL;
int i;
/* Check if signcert and pkey match. */
if (!X509_check_private_key(ctx->signer_cert, ctx->signer_key)) {
TSerr(TS_F_TS_RESP_SIGN, TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE);
goto err;
}
/* Create a new PKCS7 signed object. */
if (!(p7 = PKCS7_new())) {
if ((p7 = PKCS7_new()) == NULL) {
TSerr(TS_F_TS_RESP_SIGN, ERR_R_MALLOC_FAILURE);
goto err;
}
if (!PKCS7_set_type(p7, NID_pkcs7_signed))
goto err;
/* Force SignedData version to be 3 instead of the default 1. */
if (!ASN1_INTEGER_set(p7->d.sign->version, 3))
goto err;
/* Add signer certificate and optional certificate chain. */
if (TS_REQ_get_cert_req(ctx->request)) {
if (ctx->request->cert_req) {
PKCS7_add_certificate(p7, ctx->signer_cert);
if (ctx->certs) {
for (i = 0; i < sk_X509_num(ctx->certs); ++i) {
@@ -742,14 +657,12 @@ static int TS_RESP_sign(TS_RESP_CTX *ctx)
}
}
/* Add a new signer info. */
if (!(si = PKCS7_add_signature(p7, ctx->signer_cert,
ctx->signer_key, EVP_sha1()))) {
if ((si = PKCS7_add_signature(p7, ctx->signer_cert,
ctx->signer_key, ctx->signer_md)) == NULL) {
TSerr(TS_F_TS_RESP_SIGN, TS_R_PKCS7_ADD_SIGNATURE_ERROR);
goto err;
}
/* Add content type signed attribute to the signer info. */
oid = OBJ_nid2obj(NID_id_smime_ct_TSTInfo);
if (!PKCS7_add_signed_attribute(si, NID_pkcs9_contentType,
V_ASN1_OBJECT, oid)) {
@@ -757,43 +670,28 @@ static int TS_RESP_sign(TS_RESP_CTX *ctx)
goto err;
}
/*
* Create the ESS SigningCertificate attribute which contains the signer
* certificate id and optionally the certificate chain.
*/
certs = ctx->flags & TS_ESS_CERT_ID_CHAIN ? ctx->certs : NULL;
if (!(sc = ESS_SIGNING_CERT_new_init(ctx->signer_cert, certs)))
if ((sc = ess_SIGNING_CERT_new_init(ctx->signer_cert, certs)) == NULL)
goto err;
/* Add SigningCertificate signed attribute to the signer info. */
if (!ESS_add_signing_cert(si, sc)) {
TSerr(TS_F_TS_RESP_SIGN, TS_R_ESS_ADD_SIGNING_CERT_ERROR);
goto err;
}
/* Add a new empty NID_id_smime_ct_TSTInfo encapsulated content. */
if (!TS_TST_INFO_content_new(p7))
if (!ts_TST_INFO_content_new(p7))
goto err;
/* Add the DER encoded tst_info to the PKCS7 structure. */
if (!(p7bio = PKCS7_dataInit(p7, NULL))) {
if ((p7bio = PKCS7_dataInit(p7, NULL)) == NULL) {
TSerr(TS_F_TS_RESP_SIGN, ERR_R_MALLOC_FAILURE);
goto err;
}
/* Convert tst_info to DER. */
if (!i2d_TS_TST_INFO_bio(p7bio, ctx->tst_info)) {
TSerr(TS_F_TS_RESP_SIGN, TS_R_TS_DATASIGN);
goto err;
}
/* Create the signature and add it to the signer info. */
if (!PKCS7_dataFinal(p7, p7bio)) {
TSerr(TS_F_TS_RESP_SIGN, TS_R_TS_DATASIGN);
goto err;
}
/* Set new PKCS7 and TST_INFO objects. */
TS_RESP_set_tst_info(ctx->response, p7, ctx->tst_info);
p7 = NULL; /* Ownership is lost. */
ctx->tst_info = NULL; /* Ownership is lost. */
@@ -810,27 +708,25 @@ static int TS_RESP_sign(TS_RESP_CTX *ctx)
return ret;
}
static ESS_SIGNING_CERT *ESS_SIGNING_CERT_new_init(X509 *signcert,
static ESS_SIGNING_CERT *ess_SIGNING_CERT_new_init(X509 *signcert,
STACK_OF(X509) *certs)
{
ESS_CERT_ID *cid;
ESS_SIGNING_CERT *sc = NULL;
int i;
/* Creating the ESS_CERT_ID stack. */
if (!(sc = ESS_SIGNING_CERT_new()))
if ((sc = ESS_SIGNING_CERT_new()) == NULL)
goto err;
if (!sc->cert_ids && !(sc->cert_ids = sk_ESS_CERT_ID_new_null()))
if (sc->cert_ids == NULL
&& (sc->cert_ids = sk_ESS_CERT_ID_new_null()) == NULL)
goto err;
/* Adding the signing certificate id. */
if (!(cid = ESS_CERT_ID_new_init(signcert, 0))
if ((cid = ess_CERT_ID_new_init(signcert, 0)) == NULL
|| !sk_ESS_CERT_ID_push(sc->cert_ids, cid))
goto err;
/* Adding the certificate chain ids. */
for (i = 0; i < sk_X509_num(certs); ++i) {
X509 *cert = sk_X509_value(certs, i);
if (!(cid = ESS_CERT_ID_new_init(cert, 1))
if ((cid = ess_CERT_ID_new_init(cert, 1)) == NULL
|| !sk_ESS_CERT_ID_push(sc->cert_ids, cid))
goto err;
}
@@ -842,39 +738,36 @@ static ESS_SIGNING_CERT *ESS_SIGNING_CERT_new_init(X509 *signcert,
return NULL;
}
static ESS_CERT_ID *ESS_CERT_ID_new_init(X509 *cert, int issuer_needed)
static ESS_CERT_ID *ess_CERT_ID_new_init(X509 *cert, int issuer_needed)
{
ESS_CERT_ID *cid = NULL;
GENERAL_NAME *name = NULL;
unsigned char cert_sha1[SHA_DIGEST_LENGTH];
/* Recompute SHA1 hash of certificate if necessary (side effect). */
/* Call for side-effect of computing hash and caching extensions */
X509_check_purpose(cert, -1, 0);
if (!(cid = ESS_CERT_ID_new()))
if ((cid = ESS_CERT_ID_new()) == NULL)
goto err;
if (!ASN1_OCTET_STRING_set(cid->hash, cert->sha1_hash,
sizeof(cert->sha1_hash)))
X509_digest(cert, EVP_sha1(), cert_sha1, NULL);
if (!ASN1_OCTET_STRING_set(cid->hash, cert_sha1, SHA_DIGEST_LENGTH))
goto err;
/* Setting the issuer/serial if requested. */
if (issuer_needed) {
/* Creating issuer/serial structure. */
if (!cid->issuer_serial
&& !(cid->issuer_serial = ESS_ISSUER_SERIAL_new()))
if (cid->issuer_serial == NULL
&& (cid->issuer_serial = ESS_ISSUER_SERIAL_new()) == NULL)
goto err;
/* Creating general name from the certificate issuer. */
if (!(name = GENERAL_NAME_new()))
if ((name = GENERAL_NAME_new()) == NULL)
goto err;
name->type = GEN_DIRNAME;
if (!(name->d.dirn = X509_NAME_dup(cert->cert_info->issuer)))
if ((name->d.dirn = X509_NAME_dup(X509_get_issuer_name(cert))) == NULL)
goto err;
if (!sk_GENERAL_NAME_push(cid->issuer_serial->issuer, name))
goto err;
name = NULL; /* Ownership is lost. */
/* Setting the serial number. */
ASN1_INTEGER_free(cid->issuer_serial->serial);
if (!(cid->issuer_serial->serial =
ASN1_INTEGER_dup(cert->cert_info->serialNumber)))
ASN1_INTEGER_dup(X509_get_serialNumber(cert))))
goto err;
}
@@ -886,18 +779,18 @@ static ESS_CERT_ID *ESS_CERT_ID_new_init(X509 *cert, int issuer_needed)
return NULL;
}
static int TS_TST_INFO_content_new(PKCS7 *p7)
static int ts_TST_INFO_content_new(PKCS7 *p7)
{
PKCS7 *ret = NULL;
ASN1_OCTET_STRING *octet_string = NULL;
/* Create new encapsulated NID_id_smime_ct_TSTInfo content. */
if (!(ret = PKCS7_new()))
if ((ret = PKCS7_new()) == NULL)
goto err;
if (!(ret->d.other = ASN1_TYPE_new()))
if ((ret->d.other = ASN1_TYPE_new()) == NULL)
goto err;
ret->type = OBJ_nid2obj(NID_id_smime_ct_TSTInfo);
if (!(octet_string = ASN1_OCTET_STRING_new()))
if ((octet_string = ASN1_OCTET_STRING_new()) == NULL)
goto err;
ASN1_TYPE_set(ret->d.other, V_ASN1_OCTET_STRING, octet_string);
octet_string = NULL;
@@ -920,13 +813,13 @@ static int ESS_add_signing_cert(PKCS7_SIGNER_INFO *si, ESS_SIGNING_CERT *sc)
int len;
len = i2d_ESS_SIGNING_CERT(sc, NULL);
if (!(pp = (unsigned char *)OPENSSL_malloc(len))) {
if ((pp = OPENSSL_malloc(len)) == NULL) {
TSerr(TS_F_ESS_ADD_SIGNING_CERT, ERR_R_MALLOC_FAILURE);
goto err;
}
p = pp;
i2d_ESS_SIGNING_CERT(sc, &p);
if (!(seq = ASN1_STRING_new()) || !ASN1_STRING_set(seq, pp, len)) {
if ((seq = ASN1_STRING_new()) == NULL || !ASN1_STRING_set(seq, pp, len)) {
TSerr(TS_F_ESS_ADD_SIGNING_CERT, ERR_R_MALLOC_FAILURE);
goto err;
}
@@ -955,7 +848,7 @@ static ASN1_GENERALIZEDTIME
if (precision > TS_MAX_CLOCK_PRECISION_DIGITS)
goto err;
if (!(tm = gmtime(&time_sec)))
if ((tm = gmtime(&time_sec)) == NULL)
goto err;
/*
@@ -970,12 +863,7 @@ static ASN1_GENERALIZEDTIME
tm->tm_year + 1900, tm->tm_mon + 1, tm->tm_mday,
tm->tm_hour, tm->tm_min, tm->tm_sec);
if (precision > 0) {
/* Add fraction of seconds (leave space for dot and null). */
BIO_snprintf(p, 2 + precision, ".%06ld", usec);
/*
* We cannot use the snprintf return value, because it might have
* been truncated.
*/
p += strlen(p);
/*
@@ -994,26 +882,22 @@ static ASN1_GENERALIZEDTIME
* this loop even if all the digits are zero.
*/
while (*--p == '0')
/*
* empty
*/ ;
/* p points to either the dot or the last non-zero digit. */
continue;
if (*p != '.')
++p;
}
/* Add the trailing Z and the terminating null. */
*p++ = 'Z';
*p++ = '\0';
/* Now call OpenSSL to check and set our genTime value */
if (!asn1_time && !(asn1_time = M_ASN1_GENERALIZEDTIME_new()))
if (asn1_time == NULL
&& (asn1_time = ASN1_GENERALIZEDTIME_new()) == NULL)
goto err;
if (!ASN1_GENERALIZEDTIME_set_string(asn1_time, genTime_str)) {
ASN1_GENERALIZEDTIME_free(asn1_time);
goto err;
}
return asn1_time;
err:
TSerr(TS_F_TS_RESP_SET_GENTIME_WITH_PRECISION, TS_R_COULD_NOT_SET_TIME);
return NULL;

91
crypto/ts/ts_rsp_utils.c
View File

@@ -1,69 +1,18 @@
/* crypto/ts/ts_resp_utils.c */
/*
* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL project
* 2002.
*/
/* ====================================================================
* Copyright (c) 2006 The OpenSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. All advertising materials mentioning features or use of this
* software must display the following acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
*
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
* endorse or promote products derived from this software without
* prior written permission. For written permission, please contact
* licensing@OpenSSL.org.
*
* 5. Products derived from this software may not be called "OpenSSL"
* nor may "OpenSSL" appear in their names without prior written
* permission of the OpenSSL Project.
*
* 6. Redistributions of any form whatsoever must retain the following
* acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
*
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
* ====================================================================
*
* This product includes cryptographic software written by Eric Young
* (eay@cryptsoft.com). This product includes software written by Tim
* Hudson (tjh@cryptsoft.com).
* Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include <stdio.h>
#include "cryptlib.h"
#include "internal/cryptlib.h"
#include <openssl/objects.h>
#include <openssl/ts.h>
#include <openssl/pkcs7.h>
/* Function definitions. */
#include "ts_lcl.h"
int TS_RESP_set_status_info(TS_RESP *a, TS_STATUS_INFO *status_info)
{
@@ -90,7 +39,6 @@ TS_STATUS_INFO *TS_RESP_get_status_info(TS_RESP *a)
/* Caller loses ownership of PKCS7 and TS_TST_INFO objects. */
void TS_RESP_set_tst_info(TS_RESP *a, PKCS7 *p7, TS_TST_INFO *tst_info)
{
/* Set new PKCS7 and TST_INFO objects. */
PKCS7_free(a->token);
a->token = p7;
TS_TST_INFO_free(a->tst_info);
@@ -186,7 +134,7 @@ int TS_TST_INFO_set_time(TS_TST_INFO *a, const ASN1_GENERALIZEDTIME *gtime)
if (a->time == gtime)
return 1;
new_time = M_ASN1_GENERALIZEDTIME_dup(gtime);
new_time = ASN1_STRING_dup(gtime);
if (new_time == NULL) {
TSerr(TS_F_TS_TST_INFO_SET_TIME, ERR_R_MALLOC_FAILURE);
return 0;
@@ -365,7 +313,7 @@ int TS_TST_INFO_get_ext_by_NID(TS_TST_INFO *a, int nid, int lastpos)
return X509v3_get_ext_by_NID(a->extensions, nid, lastpos);
}
int TS_TST_INFO_get_ext_by_OBJ(TS_TST_INFO *a, ASN1_OBJECT *obj, int lastpos)
int TS_TST_INFO_get_ext_by_OBJ(TS_TST_INFO *a, const ASN1_OBJECT *obj, int lastpos)
{
return X509v3_get_ext_by_OBJ(a->extensions, obj, lastpos);
}
@@ -394,3 +342,24 @@ void *TS_TST_INFO_get_ext_d2i(TS_TST_INFO *a, int nid, int *crit, int *idx)
{
return X509V3_get_d2i(a->extensions, nid, crit, idx);
}
int TS_STATUS_INFO_set_status(TS_STATUS_INFO *a, int i)
{
return ASN1_INTEGER_set(a->status, i);
}
const ASN1_INTEGER *TS_STATUS_INFO_get0_status(const TS_STATUS_INFO *a)
{
return a->status;
}
const STACK_OF(ASN1_UTF8STRING) *
TS_STATUS_INFO_get0_text(const TS_STATUS_INFO *a)
{
return a->text;
}
const ASN1_BIT_STRING *TS_STATUS_INFO_get0_failure_info(const TS_STATUS_INFO *a)
{
return a->failure_info;
}

437
crypto/ts/ts_rsp_verify.c
View File

@@ -1,99 +1,54 @@
/* crypto/ts/ts_resp_verify.c */
/*
* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL project
* 2002.
*/
/* ====================================================================
* Copyright (c) 2006 The OpenSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. All advertising materials mentioning features or use of this
* software must display the following acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
*
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
* endorse or promote products derived from this software without
* prior written permission. For written permission, please contact
* licensing@OpenSSL.org.
*
* 5. Products derived from this software may not be called "OpenSSL"
* nor may "OpenSSL" appear in their names without prior written
* permission of the OpenSSL Project.
*
* 6. Redistributions of any form whatsoever must retain the following
* acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
*
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
* ====================================================================
*
* This product includes cryptographic software written by Eric Young
* (eay@cryptsoft.com). This product includes software written by Tim
* Hudson (tjh@cryptsoft.com).
* Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include <stdio.h>
#include "cryptlib.h"
#include "internal/cryptlib.h"
#include <openssl/objects.h>
#include <openssl/ts.h>
#include <openssl/pkcs7.h>
#include "ts_lcl.h"
/* Private function declarations. */
static int TS_verify_cert(X509_STORE *store, STACK_OF(X509) *untrusted,
static int ts_verify_cert(X509_STORE *store, STACK_OF(X509) *untrusted,
X509 *signer, STACK_OF(X509) **chain);
static int TS_check_signing_certs(PKCS7_SIGNER_INFO *si,
static int ts_check_signing_certs(PKCS7_SIGNER_INFO *si,
STACK_OF(X509) *chain);
static ESS_SIGNING_CERT *ESS_get_signing_cert(PKCS7_SIGNER_INFO *si);
static int TS_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert);
static int TS_issuer_serial_cmp(ESS_ISSUER_SERIAL *is, X509_CINF *cinfo);
static int int_TS_RESP_verify_token(TS_VERIFY_CTX *ctx,
static ESS_SIGNING_CERT *ess_get_signing_cert(PKCS7_SIGNER_INFO *si);
static int ts_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert);
static int ts_issuer_serial_cmp(ESS_ISSUER_SERIAL *is, X509 *cert);
static int int_ts_RESP_verify_token(TS_VERIFY_CTX *ctx,
PKCS7 *token, TS_TST_INFO *tst_info);
static int TS_check_status_info(TS_RESP *response);
static char *TS_get_status_text(STACK_OF(ASN1_UTF8STRING) *text);
static int TS_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info);
static int TS_compute_imprint(BIO *data, TS_TST_INFO *tst_info,
static int ts_check_status_info(TS_RESP *response);
static char *ts_get_status_text(STACK_OF(ASN1_UTF8STRING) *text);
static int ts_check_policy(const ASN1_OBJECT *req_oid,
const TS_TST_INFO *tst_info);
static int ts_compute_imprint(BIO *data, TS_TST_INFO *tst_info,
X509_ALGOR **md_alg,
unsigned char **imprint, unsigned *imprint_len);
static int TS_check_imprints(X509_ALGOR *algor_a,
unsigned char *imprint_a, unsigned len_a,
static int ts_check_imprints(X509_ALGOR *algor_a,
const unsigned char *imprint_a, unsigned len_a,
TS_TST_INFO *tst_info);
static int TS_check_nonces(const ASN1_INTEGER *a, TS_TST_INFO *tst_info);
static int TS_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer);
static int TS_find_name(STACK_OF(GENERAL_NAME) *gen_names,
static int ts_check_nonces(const ASN1_INTEGER *a, TS_TST_INFO *tst_info);
static int ts_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer);
static int ts_find_name(STACK_OF(GENERAL_NAME) *gen_names,
GENERAL_NAME *name);
/*
* Local mapping between response codes and descriptions.
* Don't forget to change TS_STATUS_BUF_SIZE when modifying
* the elements of this array.
* This must be large enough to hold all values in ts_status_text (with
* comma separator) or all text fields in ts_failure_info (also with comma).
*/
static const char *TS_status_text[] = { "granted",
#define TS_STATUS_BUF_SIZE 256
/*
* Local mapping between response codes and descriptions.
*/
static const char *ts_status_text[] = {
"granted",
"grantedWithMods",
"rejection",
"waiting",
@@ -101,48 +56,22 @@ static const char *TS_status_text[] = { "granted",
"revocationNotification"
};
#define TS_STATUS_TEXT_SIZE (sizeof(TS_status_text)/sizeof(*TS_status_text))
/*
* This must be greater or equal to the sum of the strings in TS_status_text
* plus the number of its elements.
*/
#define TS_STATUS_BUF_SIZE 256
#define TS_STATUS_TEXT_SIZE OSSL_NELEM(ts_status_text)
static struct {
int code;
const char *text;
} TS_failure_info[] = {
{
TS_INFO_BAD_ALG, "badAlg"
},
{
TS_INFO_BAD_REQUEST, "badRequest"
},
{
TS_INFO_BAD_DATA_FORMAT, "badDataFormat"
},
{
TS_INFO_TIME_NOT_AVAILABLE, "timeNotAvailable"
},
{
TS_INFO_UNACCEPTED_POLICY, "unacceptedPolicy"
},
{
TS_INFO_UNACCEPTED_EXTENSION, "unacceptedExtension"
},
{
TS_INFO_ADD_INFO_NOT_AVAILABLE, "addInfoNotAvailable"
},
{
TS_INFO_SYSTEM_FAILURE, "systemFailure"
}
} ts_failure_info[] = {
{TS_INFO_BAD_ALG, "badAlg"},
{TS_INFO_BAD_REQUEST, "badRequest"},
{TS_INFO_BAD_DATA_FORMAT, "badDataFormat"},
{TS_INFO_TIME_NOT_AVAILABLE, "timeNotAvailable"},
{TS_INFO_UNACCEPTED_POLICY, "unacceptedPolicy"},
{TS_INFO_UNACCEPTED_EXTENSION, "unacceptedExtension"},
{TS_INFO_ADD_INFO_NOT_AVAILABLE, "addInfoNotAvailable"},
{TS_INFO_SYSTEM_FAILURE, "systemFailure"}
};
#define TS_FAILURE_INFO_SIZE (sizeof(TS_failure_info) / \
sizeof(*TS_failure_info))
/* Functions for verifying a signed TS_TST_INFO structure. */
/*-
* This function carries out the following tasks:
@@ -173,22 +102,16 @@ int TS_RESP_verify_signature(PKCS7 *token, STACK_OF(X509) *certs,
TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_INVALID_NULL_POINTER);
goto err;
}
/* Check for the correct content type */
if (!PKCS7_type_is_signed(token)) {
TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_WRONG_CONTENT_TYPE);
goto err;
}
/* Check if there is one and only one signer. */
sinfos = PKCS7_get_signer_info(token);
if (!sinfos || sk_PKCS7_SIGNER_INFO_num(sinfos) != 1) {
TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_THERE_MUST_BE_ONE_SIGNER);
goto err;
}
si = sk_PKCS7_SIGNER_INFO_value(sinfos, 0);
/* Check for no content: no data to verify signature. */
if (PKCS7_get_detached(token)) {
TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_NO_CONTENT);
goto err;
@@ -203,35 +126,26 @@ int TS_RESP_verify_signature(PKCS7 *token, STACK_OF(X509) *certs,
goto err;
signer = sk_X509_value(signers, 0);
/* Now verify the certificate. */
if (!TS_verify_cert(store, certs, signer, &chain))
if (!ts_verify_cert(store, certs, signer, &chain))
goto err;
/*
* Check if the signer certificate is consistent with the ESS extension.
*/
if (!TS_check_signing_certs(si, chain))
if (!ts_check_signing_certs(si, chain))
goto err;
/* Creating the message digest. */
p7bio = PKCS7_dataInit(token, NULL);
/* We now have to 'read' from p7bio to calculate digests etc. */
while ((i = BIO_read(p7bio, buf, sizeof(buf))) > 0) ;
while ((i = BIO_read(p7bio, buf, sizeof(buf))) > 0)
continue;
/* Verifying the signature. */
j = PKCS7_signatureVerify(p7bio, token, si, signer);
if (j <= 0) {
TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_SIGNATURE_FAILURE);
goto err;
}
/* Return the signer certificate if needed. */
if (signer_out) {
*signer_out = signer;
CRYPTO_add(&signer->references, 1, CRYPTO_LOCK_X509);
X509_up_ref(signer);
}
ret = 1;
err:
@@ -246,38 +160,46 @@ int TS_RESP_verify_signature(PKCS7 *token, STACK_OF(X509) *certs,
* The certificate chain is returned in chain. Caller is responsible for
* freeing the vector.
*/
static int TS_verify_cert(X509_STORE *store, STACK_OF(X509) *untrusted,
static int ts_verify_cert(X509_STORE *store, STACK_OF(X509) *untrusted,
X509 *signer, STACK_OF(X509) **chain)
{
X509_STORE_CTX cert_ctx;
X509_STORE_CTX *cert_ctx = NULL;
int i;
int ret = 1;
int ret = 0;
/* chain is an out argument. */
*chain = NULL;
X509_STORE_CTX_init(&cert_ctx, store, signer, untrusted);
X509_STORE_CTX_set_purpose(&cert_ctx, X509_PURPOSE_TIMESTAMP_SIGN);
i = X509_verify_cert(&cert_ctx);
cert_ctx = X509_STORE_CTX_new();
if (cert_ctx == NULL) {
TSerr(TS_F_TS_VERIFY_CERT, ERR_R_MALLOC_FAILURE);
goto err;
}
if (!X509_STORE_CTX_init(cert_ctx, store, signer, untrusted))
goto end;
X509_STORE_CTX_set_purpose(cert_ctx, X509_PURPOSE_TIMESTAMP_SIGN);
i = X509_verify_cert(cert_ctx);
if (i <= 0) {
int j = X509_STORE_CTX_get_error(&cert_ctx);
int j = X509_STORE_CTX_get_error(cert_ctx);
TSerr(TS_F_TS_VERIFY_CERT, TS_R_CERTIFICATE_VERIFY_ERROR);
ERR_add_error_data(2, "Verify error:",
X509_verify_cert_error_string(j));
ret = 0;
} else {
/* Get a copy of the certificate chain. */
*chain = X509_STORE_CTX_get1_chain(&cert_ctx);
goto err;
}
*chain = X509_STORE_CTX_get1_chain(cert_ctx);
ret = 1;
goto end;
X509_STORE_CTX_cleanup(&cert_ctx);
err:
ret = 0;
end:
X509_STORE_CTX_free(cert_ctx);
return ret;
}
static int TS_check_signing_certs(PKCS7_SIGNER_INFO *si,
static int ts_check_signing_certs(PKCS7_SIGNER_INFO *si,
STACK_OF(X509) *chain)
{
ESS_SIGNING_CERT *ss = ESS_get_signing_cert(si);
ESS_SIGNING_CERT *ss = ess_get_signing_cert(si);
STACK_OF(ESS_CERT_ID) *cert_ids = NULL;
X509 *cert;
int i = 0;
@@ -286,9 +208,8 @@ static int TS_check_signing_certs(PKCS7_SIGNER_INFO *si,
if (!ss)
goto err;
cert_ids = ss->cert_ids;
/* The signer certificate must be the first in cert_ids. */
cert = sk_X509_value(chain, 0);
if (TS_find_cert(cert_ids, cert) != 0)
if (ts_find_cert(cert_ids, cert) != 0)
goto err;
/*
@@ -296,10 +217,9 @@ static int TS_check_signing_certs(PKCS7_SIGNER_INFO *si,
* certificate ids in cert_ids.
*/
if (sk_ESS_CERT_ID_num(cert_ids) > 1) {
/* All the certificates of the chain must be in cert_ids. */
for (i = 1; i < sk_X509_num(chain); ++i) {
cert = sk_X509_value(chain, i);
if (TS_find_cert(cert_ids, cert) < 0)
if (ts_find_cert(cert_ids, cert) < 0)
goto err;
}
}
@@ -312,7 +232,7 @@ static int TS_check_signing_certs(PKCS7_SIGNER_INFO *si,
return ret;
}
static ESS_SIGNING_CERT *ESS_get_signing_cert(PKCS7_SIGNER_INFO *si)
static ESS_SIGNING_CERT *ess_get_signing_cert(PKCS7_SIGNER_INFO *si)
{
ASN1_TYPE *attr;
const unsigned char *p;
@@ -324,13 +244,16 @@ static ESS_SIGNING_CERT *ESS_get_signing_cert(PKCS7_SIGNER_INFO *si)
}
/* Returns < 0 if certificate is not found, certificate index otherwise. */
static int TS_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert)
static int ts_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert)
{
int i;
unsigned char cert_sha1[SHA_DIGEST_LENGTH];
if (!cert_ids || !cert)
return -1;
X509_digest(cert, EVP_sha1(), cert_sha1, NULL);
/* Recompute SHA1 hash of certificate if necessary (side effect). */
X509_check_purpose(cert, -1, 0);
@@ -338,13 +261,10 @@ static int TS_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert)
for (i = 0; i < sk_ESS_CERT_ID_num(cert_ids); ++i) {
ESS_CERT_ID *cid = sk_ESS_CERT_ID_value(cert_ids, i);
/* Check the SHA-1 hash first. */
if (cid->hash->length == sizeof(cert->sha1_hash)
&& !memcmp(cid->hash->data, cert->sha1_hash,
sizeof(cert->sha1_hash))) {
/* Check the issuer/serial as well if specified. */
if (cid->hash->length == SHA_DIGEST_LENGTH
&& memcmp(cid->hash->data, cert_sha1, SHA_DIGEST_LENGTH) == 0) {
ESS_ISSUER_SERIAL *is = cid->issuer_serial;
if (!is || !TS_issuer_serial_cmp(is, cert->cert_info))
if (!is || !ts_issuer_serial_cmp(is, cert))
return i;
}
}
@@ -352,21 +272,19 @@ static int TS_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert)
return -1;
}
static int TS_issuer_serial_cmp(ESS_ISSUER_SERIAL *is, X509_CINF *cinfo)
static int ts_issuer_serial_cmp(ESS_ISSUER_SERIAL *is, X509 *cert)
{
GENERAL_NAME *issuer;
if (!is || !cinfo || sk_GENERAL_NAME_num(is->issuer) != 1)
if (!is || !cert || sk_GENERAL_NAME_num(is->issuer) != 1)
return -1;
/* Check the issuer first. It must be a directory name. */
issuer = sk_GENERAL_NAME_value(is->issuer, 0);
if (issuer->type != GEN_DIRNAME
|| X509_NAME_cmp(issuer->d.dirn, cinfo->issuer))
|| X509_NAME_cmp(issuer->d.dirn, X509_get_issuer_name(cert)))
return -1;
/* Check the serial number, too. */
if (ASN1_INTEGER_cmp(is->serial, cinfo->serialNumber))
if (ASN1_INTEGER_cmp(is->serial, X509_get_serialNumber(cert)))
return -1;
return 0;
@@ -380,19 +298,16 @@ static int TS_issuer_serial_cmp(ESS_ISSUER_SERIAL *is, X509_CINF *cinfo)
*/
int TS_RESP_verify_response(TS_VERIFY_CTX *ctx, TS_RESP *response)
{
PKCS7 *token = TS_RESP_get_token(response);
TS_TST_INFO *tst_info = TS_RESP_get_tst_info(response);
PKCS7 *token = response->token;
TS_TST_INFO *tst_info = response->tst_info;
int ret = 0;
/* Check if we have a successful TS_TST_INFO object in place. */
if (!TS_check_status_info(response))
if (!ts_check_status_info(response))
goto err;
/* Check the contents of the time stamp token. */
if (!int_TS_RESP_verify_token(ctx, token, tst_info))
if (!int_ts_RESP_verify_token(ctx, token, tst_info))
goto err;
ret = 1;
err:
return ret;
}
@@ -406,7 +321,7 @@ int TS_RESP_verify_token(TS_VERIFY_CTX *ctx, PKCS7 *token)
TS_TST_INFO *tst_info = PKCS7_to_TS_TST_INFO(token);
int ret = 0;
if (tst_info) {
ret = int_TS_RESP_verify_token(ctx, token, tst_info);
ret = int_ts_RESP_verify_token(ctx, token, tst_info);
TS_TST_INFO_free(tst_info);
}
return ret;
@@ -424,66 +339,58 @@ int TS_RESP_verify_token(TS_VERIFY_CTX *ctx, PKCS7 *token)
* - Check if the TSA name matches the signer.
* - Check if the TSA name is the expected TSA.
*/
static int int_TS_RESP_verify_token(TS_VERIFY_CTX *ctx,
static int int_ts_RESP_verify_token(TS_VERIFY_CTX *ctx,
PKCS7 *token, TS_TST_INFO *tst_info)
{
X509 *signer = NULL;
GENERAL_NAME *tsa_name = TS_TST_INFO_get_tsa(tst_info);
GENERAL_NAME *tsa_name = tst_info->tsa;
X509_ALGOR *md_alg = NULL;
unsigned char *imprint = NULL;
unsigned imprint_len = 0;
int ret = 0;
int flags = ctx->flags;
/* Verify the signature. */
if ((ctx->flags & TS_VFY_SIGNATURE)
/* Some options require us to also check the signature */
if (((flags & TS_VFY_SIGNER) && tsa_name != NULL)
|| (flags & TS_VFY_TSA_NAME)) {
flags |= TS_VFY_SIGNATURE;
}
if ((flags & TS_VFY_SIGNATURE)
&& !TS_RESP_verify_signature(token, ctx->certs, ctx->store, &signer))
goto err;
/* Check version number of response. */
if ((ctx->flags & TS_VFY_VERSION)
if ((flags & TS_VFY_VERSION)
&& TS_TST_INFO_get_version(tst_info) != 1) {
TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_UNSUPPORTED_VERSION);
goto err;
}
/* Check policies. */
if ((ctx->flags & TS_VFY_POLICY)
&& !TS_check_policy(ctx->policy, tst_info))
if ((flags & TS_VFY_POLICY)
&& !ts_check_policy(ctx->policy, tst_info))
goto err;
/* Check message imprints. */
if ((ctx->flags & TS_VFY_IMPRINT)
&& !TS_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len,
if ((flags & TS_VFY_IMPRINT)
&& !ts_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len,
tst_info))
goto err;
/* Compute and check message imprints. */
if ((ctx->flags & TS_VFY_DATA)
&& (!TS_compute_imprint(ctx->data, tst_info,
if ((flags & TS_VFY_DATA)
&& (!ts_compute_imprint(ctx->data, tst_info,
&md_alg, &imprint, &imprint_len)
|| !TS_check_imprints(md_alg, imprint, imprint_len, tst_info)))
|| !ts_check_imprints(md_alg, imprint, imprint_len, tst_info)))
goto err;
/* Check nonces. */
if ((ctx->flags & TS_VFY_NONCE)
&& !TS_check_nonces(ctx->nonce, tst_info))
if ((flags & TS_VFY_NONCE)
&& !ts_check_nonces(ctx->nonce, tst_info))
goto err;
/* Check whether TSA name and signer certificate match. */
if ((ctx->flags & TS_VFY_SIGNER)
&& tsa_name && !TS_check_signer_name(tsa_name, signer)) {
if ((flags & TS_VFY_SIGNER)
&& tsa_name && !ts_check_signer_name(tsa_name, signer)) {
TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_NAME_MISMATCH);
goto err;
}
/* Check whether the TSA is the expected one. */
if ((ctx->flags & TS_VFY_TSA_NAME)
&& !TS_check_signer_name(ctx->tsa_name, signer)) {
if ((flags & TS_VFY_TSA_NAME)
&& !ts_check_signer_name(ctx->tsa_name, signer)) {
TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_UNTRUSTED);
goto err;
}
ret = 1;
err:
X509_free(signer);
X509_ALGOR_free(md_alg);
@@ -491,48 +398,45 @@ static int int_TS_RESP_verify_token(TS_VERIFY_CTX *ctx,
return ret;
}
static int TS_check_status_info(TS_RESP *response)
static int ts_check_status_info(TS_RESP *response)
{
TS_STATUS_INFO *info = TS_RESP_get_status_info(response);
TS_STATUS_INFO *info = response->status_info;
long status = ASN1_INTEGER_get(info->status);
const char *status_text = NULL;
char *embedded_status_text = NULL;
char failure_text[TS_STATUS_BUF_SIZE] = "";
/* Check if everything went fine. */
if (status == 0 || status == 1)
return 1;
/* There was an error, get the description in status_text. */
if (0 <= status && status < (long)TS_STATUS_TEXT_SIZE)
status_text = TS_status_text[status];
if (0 <= status && status < (long) OSSL_NELEM(ts_status_text))
status_text = ts_status_text[status];
else
status_text = "unknown code";
/* Set the embedded_status_text to the returned description. */
if (sk_ASN1_UTF8STRING_num(info->text) > 0
&& !(embedded_status_text = TS_get_status_text(info->text)))
&& (embedded_status_text = ts_get_status_text(info->text)) == NULL)
return 0;
/* Filling in failure_text with the failure information. */
/* Fill in failure_text with the failure information. */
if (info->failure_info) {
int i;
int first = 1;
for (i = 0; i < (int)TS_FAILURE_INFO_SIZE; ++i) {
for (i = 0; i < (int)OSSL_NELEM(ts_failure_info); ++i) {
if (ASN1_BIT_STRING_get_bit(info->failure_info,
TS_failure_info[i].code)) {
ts_failure_info[i].code)) {
if (!first)
strcpy(failure_text, ",");
strcat(failure_text, ",");
else
first = 0;
strcat(failure_text, TS_failure_info[i].text);
strcat(failure_text, ts_failure_info[i].text);
}
}
}
if (failure_text[0] == '\0')
strcpy(failure_text, "unspecified");
/* Making up the error string. */
TSerr(TS_F_TS_CHECK_STATUS_INFO, TS_R_NO_TIME_STAMP_TOKEN);
ERR_add_error_data(6,
"status code: ", status_text,
@@ -544,42 +448,42 @@ static int TS_check_status_info(TS_RESP *response)
return 0;
}
static char *TS_get_status_text(STACK_OF(ASN1_UTF8STRING) *text)
static char *ts_get_status_text(STACK_OF(ASN1_UTF8STRING) *text)
{
int i;
unsigned int length = 0;
int length = 0;
char *result = NULL;
char *p;
/* Determine length first. */
for (i = 0; i < sk_ASN1_UTF8STRING_num(text); ++i) {
ASN1_UTF8STRING *current = sk_ASN1_UTF8STRING_value(text, i);
if (ASN1_STRING_length(current) > TS_MAX_STATUS_LENGTH - length - 1)
return NULL;
length += ASN1_STRING_length(current);
length += 1; /* separator character */
}
/* Allocate memory (closing '\0' included). */
if (!(result = OPENSSL_malloc(length))) {
if ((result = OPENSSL_malloc(length)) == NULL) {
TSerr(TS_F_TS_GET_STATUS_TEXT, ERR_R_MALLOC_FAILURE);
return NULL;
}
/* Concatenate the descriptions. */
for (i = 0, p = result; i < sk_ASN1_UTF8STRING_num(text); ++i) {
ASN1_UTF8STRING *current = sk_ASN1_UTF8STRING_value(text, i);
length = ASN1_STRING_length(current);
if (i > 0)
*p++ = '/';
strncpy(p, (const char *)ASN1_STRING_data(current), length);
strncpy(p, (const char *)ASN1_STRING_get0_data(current), length);
p += length;
}
/* We do have space for this, too. */
*p = '\0';
return result;
}
static int TS_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info)
static int ts_check_policy(const ASN1_OBJECT *req_oid,
const TS_TST_INFO *tst_info)
{
ASN1_OBJECT *resp_oid = TS_TST_INFO_get_policy_id(tst_info);
const ASN1_OBJECT *resp_oid = tst_info->policy_id;
if (OBJ_cmp(req_oid, resp_oid) != 0) {
TSerr(TS_F_TS_CHECK_POLICY, TS_R_POLICY_MISMATCH);
@@ -589,51 +493,53 @@ static int TS_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info)
return 1;
}
static int TS_compute_imprint(BIO *data, TS_TST_INFO *tst_info,
static int ts_compute_imprint(BIO *data, TS_TST_INFO *tst_info,
X509_ALGOR **md_alg,
unsigned char **imprint, unsigned *imprint_len)
{
TS_MSG_IMPRINT *msg_imprint = TS_TST_INFO_get_msg_imprint(tst_info);
X509_ALGOR *md_alg_resp = TS_MSG_IMPRINT_get_algo(msg_imprint);
TS_MSG_IMPRINT *msg_imprint = tst_info->msg_imprint;
X509_ALGOR *md_alg_resp = msg_imprint->hash_algo;
const EVP_MD *md;
EVP_MD_CTX md_ctx;
EVP_MD_CTX *md_ctx = NULL;
unsigned char buffer[4096];
int length;
*md_alg = NULL;
*imprint = NULL;
/* Return the MD algorithm of the response. */
if (!(*md_alg = X509_ALGOR_dup(md_alg_resp)))
if ((*md_alg = X509_ALGOR_dup(md_alg_resp)) == NULL)
goto err;
/* Getting the MD object. */
if (!(md = EVP_get_digestbyobj((*md_alg)->algorithm))) {
if ((md = EVP_get_digestbyobj((*md_alg)->algorithm)) == NULL) {
TSerr(TS_F_TS_COMPUTE_IMPRINT, TS_R_UNSUPPORTED_MD_ALGORITHM);
goto err;
}
/* Compute message digest. */
length = EVP_MD_size(md);
if (length < 0)
goto err;
*imprint_len = length;
if (!(*imprint = OPENSSL_malloc(*imprint_len))) {
if ((*imprint = OPENSSL_malloc(*imprint_len)) == NULL) {
TSerr(TS_F_TS_COMPUTE_IMPRINT, ERR_R_MALLOC_FAILURE);
goto err;
}
if (!EVP_DigestInit(&md_ctx, md))
md_ctx = EVP_MD_CTX_new();
if (md_ctx == NULL) {
TSerr(TS_F_TS_COMPUTE_IMPRINT, ERR_R_MALLOC_FAILURE);
goto err;
}
if (!EVP_DigestInit(md_ctx, md))
goto err;
while ((length = BIO_read(data, buffer, sizeof(buffer))) > 0) {
if (!EVP_DigestUpdate(&md_ctx, buffer, length))
if (!EVP_DigestUpdate(md_ctx, buffer, length))
goto err;
}
if (!EVP_DigestFinal(&md_ctx, *imprint, NULL))
if (!EVP_DigestFinal(md_ctx, *imprint, NULL))
goto err;
EVP_MD_CTX_free(md_ctx);
return 1;
err:
EVP_MD_CTX_free(md_ctx);
X509_ALGOR_free(*md_alg);
OPENSSL_free(*imprint);
*imprint_len = 0;
@@ -641,17 +547,15 @@ static int TS_compute_imprint(BIO *data, TS_TST_INFO *tst_info,
return 0;
}
static int TS_check_imprints(X509_ALGOR *algor_a,
unsigned char *imprint_a, unsigned len_a,
static int ts_check_imprints(X509_ALGOR *algor_a,
const unsigned char *imprint_a, unsigned len_a,
TS_TST_INFO *tst_info)
{
TS_MSG_IMPRINT *b = TS_TST_INFO_get_msg_imprint(tst_info);
X509_ALGOR *algor_b = TS_MSG_IMPRINT_get_algo(b);
TS_MSG_IMPRINT *b = tst_info->msg_imprint;
X509_ALGOR *algor_b = b->hash_algo;
int ret = 0;
/* algor_a is optional. */
if (algor_a) {
/* Compare algorithm OIDs. */
if (OBJ_cmp(algor_a->algorithm, algor_b->algorithm))
goto err;
@@ -663,20 +567,18 @@ static int TS_check_imprints(X509_ALGOR *algor_a,
goto err;
}
/* Compare octet strings. */
ret = len_a == (unsigned)ASN1_STRING_length(b->hashed_msg) &&
memcmp(imprint_a, ASN1_STRING_data(b->hashed_msg), len_a) == 0;
memcmp(imprint_a, ASN1_STRING_get0_data(b->hashed_msg), len_a) == 0;
err:
if (!ret)
TSerr(TS_F_TS_CHECK_IMPRINTS, TS_R_MESSAGE_IMPRINT_MISMATCH);
return ret;
}
static int TS_check_nonces(const ASN1_INTEGER *a, TS_TST_INFO *tst_info)
static int ts_check_nonces(const ASN1_INTEGER *a, TS_TST_INFO *tst_info)
{
const ASN1_INTEGER *b = TS_TST_INFO_get_nonce(tst_info);
const ASN1_INTEGER *b = tst_info->nonce;
/* Error if nonce is missing. */
if (!b) {
TSerr(TS_F_TS_CHECK_NONCES, TS_R_NONCE_NOT_RETURNED);
return 0;
@@ -695,37 +597,34 @@ static int TS_check_nonces(const ASN1_INTEGER *a, TS_TST_INFO *tst_info)
* Check if the specified TSA name matches either the subject or one of the
* subject alternative names of the TSA certificate.
*/
static int TS_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer)
static int ts_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer)
{
STACK_OF(GENERAL_NAME) *gen_names = NULL;
int idx = -1;
int found = 0;
/* Check the subject name first. */
if (tsa_name->type == GEN_DIRNAME
&& X509_name_cmp(tsa_name->d.dirn, signer->cert_info->subject) == 0)
&& X509_name_cmp(tsa_name->d.dirn, X509_get_subject_name(signer)) == 0)
return 1;
/* Check all the alternative names. */
gen_names = X509_get_ext_d2i(signer, NID_subject_alt_name, NULL, &idx);
while (gen_names != NULL
&& !(found = TS_find_name(gen_names, tsa_name) >= 0)) {
while (gen_names != NULL) {
found = ts_find_name(gen_names, tsa_name) >= 0;
if (found)
break;
/*
* Get the next subject alternative name, although there should be no
* more than one.
*/
GENERAL_NAMES_free(gen_names);
gen_names = X509_get_ext_d2i(signer, NID_subject_alt_name,
NULL, &idx);
gen_names = X509_get_ext_d2i(signer, NID_subject_alt_name, NULL, &idx);
}
if (gen_names)
GENERAL_NAMES_free(gen_names);
GENERAL_NAMES_free(gen_names);
return found;
}
/* Returns 1 if name is in gen_names, 0 otherwise. */
static int TS_find_name(STACK_OF(GENERAL_NAME) *gen_names, GENERAL_NAME *name)
static int ts_find_name(STACK_OF(GENERAL_NAME) *gen_names, GENERAL_NAME *name)
{
int i, found;
for (i = 0, found = 0; !found && i < sk_GENERAL_NAME_num(gen_names); ++i) {

138
crypto/ts/ts_verify_ctx.c
View File

@@ -1,73 +1,22 @@
/* crypto/ts/ts_verify_ctx.c */
/*
* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL project
* 2003.
*/
/* ====================================================================
* Copyright (c) 2006 The OpenSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. All advertising materials mentioning features or use of this
* software must display the following acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
*
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
* endorse or promote products derived from this software without
* prior written permission. For written permission, please contact
* licensing@OpenSSL.org.
*
* 5. Products derived from this software may not be called "OpenSSL"
* nor may "OpenSSL" appear in their names without prior written
* permission of the OpenSSL Project.
*
* 6. Redistributions of any form whatsoever must retain the following
* acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
*
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
* ====================================================================
*
* This product includes cryptographic software written by Eric Young
* (eay@cryptsoft.com). This product includes software written by Tim
* Hudson (tjh@cryptsoft.com).
* Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include "cryptlib.h"
#include "internal/cryptlib.h"
#include <openssl/objects.h>
#include <openssl/ts.h>
#include "ts_lcl.h"
TS_VERIFY_CTX *TS_VERIFY_CTX_new(void)
{
TS_VERIFY_CTX *ctx =
(TS_VERIFY_CTX *)OPENSSL_malloc(sizeof(TS_VERIFY_CTX));
if (ctx)
memset(ctx, 0, sizeof(TS_VERIFY_CTX));
else
TS_VERIFY_CTX *ctx = OPENSSL_zalloc(sizeof(*ctx));
if (ctx == NULL)
TSerr(TS_F_TS_VERIFY_CTX_NEW, ERR_R_MALLOC_FAILURE);
return ctx;
}
@@ -75,7 +24,7 @@ TS_VERIFY_CTX *TS_VERIFY_CTX_new(void)
void TS_VERIFY_CTX_init(TS_VERIFY_CTX *ctx)
{
OPENSSL_assert(ctx != NULL);
memset(ctx, 0, sizeof(TS_VERIFY_CTX));
memset(ctx, 0, sizeof(*ctx));
}
void TS_VERIFY_CTX_free(TS_VERIFY_CTX *ctx)
@@ -87,6 +36,45 @@ void TS_VERIFY_CTX_free(TS_VERIFY_CTX *ctx)
OPENSSL_free(ctx);
}
int TS_VERIFY_CTX_add_flags(TS_VERIFY_CTX *ctx, int f)
{
ctx->flags |= f;
return ctx->flags;
}
int TS_VERIFY_CTX_set_flags(TS_VERIFY_CTX *ctx, int f)
{
ctx->flags = f;
return ctx->flags;
}
BIO *TS_VERIFY_CTX_set_data(TS_VERIFY_CTX *ctx, BIO *b)
{
ctx->data = b;
return ctx->data;
}
X509_STORE *TS_VERIFY_CTX_set_store(TS_VERIFY_CTX *ctx, X509_STORE *s)
{
ctx->store = s;
return ctx->store;
}
STACK_OF(X509) *TS_VERIFY_CTS_set_certs(TS_VERIFY_CTX *ctx,
STACK_OF(X509) *certs)
{
ctx->certs = certs;
return ctx->certs;
}
unsigned char *TS_VERIFY_CTX_set_imprint(TS_VERIFY_CTX *ctx,
unsigned char *hexstr, long len)
{
ctx->imprint = hexstr;
ctx->imprint_len = len;
return ctx->imprint;
}
void TS_VERIFY_CTX_cleanup(TS_VERIFY_CTX *ctx)
{
if (!ctx)
@@ -121,33 +109,29 @@ TS_VERIFY_CTX *TS_REQ_to_TS_VERIFY_CTX(TS_REQ *req, TS_VERIFY_CTX *ctx)
OPENSSL_assert(req != NULL);
if (ret)
TS_VERIFY_CTX_cleanup(ret);
else if (!(ret = TS_VERIFY_CTX_new()))
else if ((ret = TS_VERIFY_CTX_new()) == NULL)
return NULL;
/* Setting flags. */
ret->flags = TS_VFY_ALL_IMPRINT & ~(TS_VFY_TSA_NAME | TS_VFY_SIGNATURE);
/* Setting policy. */
if ((policy = TS_REQ_get_policy_id(req)) != NULL) {
if (!(ret->policy = OBJ_dup(policy)))
if ((policy = req->policy_id) != NULL) {
if ((ret->policy = OBJ_dup(policy)) == NULL)
goto err;
} else
ret->flags &= ~TS_VFY_POLICY;
/* Setting md_alg, imprint and imprint_len. */
imprint = TS_REQ_get_msg_imprint(req);
md_alg = TS_MSG_IMPRINT_get_algo(imprint);
if (!(ret->md_alg = X509_ALGOR_dup(md_alg)))
imprint = req->msg_imprint;
md_alg = imprint->hash_algo;
if ((ret->md_alg = X509_ALGOR_dup(md_alg)) == NULL)
goto err;
msg = TS_MSG_IMPRINT_get_msg(imprint);
msg = imprint->hashed_msg;
ret->imprint_len = ASN1_STRING_length(msg);
if (!(ret->imprint = OPENSSL_malloc(ret->imprint_len)))
if ((ret->imprint = OPENSSL_malloc(ret->imprint_len)) == NULL)
goto err;
memcpy(ret->imprint, ASN1_STRING_data(msg), ret->imprint_len);
memcpy(ret->imprint, ASN1_STRING_get0_data(msg), ret->imprint_len);
/* Setting nonce. */
if ((nonce = TS_REQ_get_nonce(req)) != NULL) {
if (!(ret->nonce = ASN1_INTEGER_dup(nonce)))
if ((nonce = req->nonce) != NULL) {
if ((ret->nonce = ASN1_INTEGER_dup(nonce)) == NULL)
goto err;
} else
ret->flags &= ~TS_VFY_NONCE;