172c33676SMaxim Ag /* $OpenBSD: ts_conf.c,v 1.11 2018/04/14 07:18:37 tb Exp $ */
2f5b1c8a1SJohn Marino /* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL
3f5b1c8a1SJohn Marino * project 2002.
4f5b1c8a1SJohn Marino */
5f5b1c8a1SJohn Marino /* ====================================================================
6f5b1c8a1SJohn Marino * Copyright (c) 2006 The OpenSSL Project. All rights reserved.
7f5b1c8a1SJohn Marino *
8f5b1c8a1SJohn Marino * Redistribution and use in source and binary forms, with or without
9f5b1c8a1SJohn Marino * modification, are permitted provided that the following conditions
10f5b1c8a1SJohn Marino * are met:
11f5b1c8a1SJohn Marino *
12f5b1c8a1SJohn Marino * 1. Redistributions of source code must retain the above copyright
13f5b1c8a1SJohn Marino * notice, this list of conditions and the following disclaimer.
14f5b1c8a1SJohn Marino *
15f5b1c8a1SJohn Marino * 2. Redistributions in binary form must reproduce the above copyright
16f5b1c8a1SJohn Marino * notice, this list of conditions and the following disclaimer in
17f5b1c8a1SJohn Marino * the documentation and/or other materials provided with the
18f5b1c8a1SJohn Marino * distribution.
19f5b1c8a1SJohn Marino *
20f5b1c8a1SJohn Marino * 3. All advertising materials mentioning features or use of this
21f5b1c8a1SJohn Marino * software must display the following acknowledgment:
22f5b1c8a1SJohn Marino * "This product includes software developed by the OpenSSL Project
23f5b1c8a1SJohn Marino * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24f5b1c8a1SJohn Marino *
25f5b1c8a1SJohn Marino * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26f5b1c8a1SJohn Marino * endorse or promote products derived from this software without
27f5b1c8a1SJohn Marino * prior written permission. For written permission, please contact
28f5b1c8a1SJohn Marino * licensing@OpenSSL.org.
29f5b1c8a1SJohn Marino *
30f5b1c8a1SJohn Marino * 5. Products derived from this software may not be called "OpenSSL"
31f5b1c8a1SJohn Marino * nor may "OpenSSL" appear in their names without prior written
32f5b1c8a1SJohn Marino * permission of the OpenSSL Project.
33f5b1c8a1SJohn Marino *
34f5b1c8a1SJohn Marino * 6. Redistributions of any form whatsoever must retain the following
35f5b1c8a1SJohn Marino * acknowledgment:
36f5b1c8a1SJohn Marino * "This product includes software developed by the OpenSSL Project
37f5b1c8a1SJohn Marino * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38f5b1c8a1SJohn Marino *
39f5b1c8a1SJohn Marino * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40f5b1c8a1SJohn Marino * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41f5b1c8a1SJohn Marino * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42f5b1c8a1SJohn Marino * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43f5b1c8a1SJohn Marino * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44f5b1c8a1SJohn Marino * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45f5b1c8a1SJohn Marino * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46f5b1c8a1SJohn Marino * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47f5b1c8a1SJohn Marino * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48f5b1c8a1SJohn Marino * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49f5b1c8a1SJohn Marino * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50f5b1c8a1SJohn Marino * OF THE POSSIBILITY OF SUCH DAMAGE.
51f5b1c8a1SJohn Marino * ====================================================================
52f5b1c8a1SJohn Marino *
53f5b1c8a1SJohn Marino * This product includes cryptographic software written by Eric Young
54f5b1c8a1SJohn Marino * (eay@cryptsoft.com). This product includes software written by Tim
55f5b1c8a1SJohn Marino * Hudson (tjh@cryptsoft.com).
56f5b1c8a1SJohn Marino *
57f5b1c8a1SJohn Marino */
58f5b1c8a1SJohn Marino
59f5b1c8a1SJohn Marino #include <string.h>
60f5b1c8a1SJohn Marino
61f5b1c8a1SJohn Marino #include <openssl/opensslconf.h>
62f5b1c8a1SJohn Marino
63f5b1c8a1SJohn Marino #include <openssl/crypto.h>
64f5b1c8a1SJohn Marino #include <openssl/err.h>
65f5b1c8a1SJohn Marino #include <openssl/pem.h>
66f5b1c8a1SJohn Marino #include <openssl/ts.h>
67f5b1c8a1SJohn Marino
68f5b1c8a1SJohn Marino #ifndef OPENSSL_NO_ENGINE
69f5b1c8a1SJohn Marino #include <openssl/engine.h>
70f5b1c8a1SJohn Marino #endif
71f5b1c8a1SJohn Marino
72f5b1c8a1SJohn Marino /* Macro definitions for the configuration file. */
73f5b1c8a1SJohn Marino
74f5b1c8a1SJohn Marino #define BASE_SECTION "tsa"
75f5b1c8a1SJohn Marino #define ENV_DEFAULT_TSA "default_tsa"
76f5b1c8a1SJohn Marino #define ENV_SERIAL "serial"
77f5b1c8a1SJohn Marino #define ENV_CRYPTO_DEVICE "crypto_device"
78f5b1c8a1SJohn Marino #define ENV_SIGNER_CERT "signer_cert"
79f5b1c8a1SJohn Marino #define ENV_CERTS "certs"
80f5b1c8a1SJohn Marino #define ENV_SIGNER_KEY "signer_key"
81f5b1c8a1SJohn Marino #define ENV_DEFAULT_POLICY "default_policy"
82f5b1c8a1SJohn Marino #define ENV_OTHER_POLICIES "other_policies"
83f5b1c8a1SJohn Marino #define ENV_DIGESTS "digests"
84f5b1c8a1SJohn Marino #define ENV_ACCURACY "accuracy"
85f5b1c8a1SJohn Marino #define ENV_ORDERING "ordering"
86f5b1c8a1SJohn Marino #define ENV_TSA_NAME "tsa_name"
87f5b1c8a1SJohn Marino #define ENV_ESS_CERT_ID_CHAIN "ess_cert_id_chain"
88f5b1c8a1SJohn Marino #define ENV_VALUE_SECS "secs"
89f5b1c8a1SJohn Marino #define ENV_VALUE_MILLISECS "millisecs"
90f5b1c8a1SJohn Marino #define ENV_VALUE_MICROSECS "microsecs"
91f5b1c8a1SJohn Marino #define ENV_CLOCK_PRECISION_DIGITS "clock_precision_digits"
92f5b1c8a1SJohn Marino #define ENV_VALUE_YES "yes"
93f5b1c8a1SJohn Marino #define ENV_VALUE_NO "no"
94f5b1c8a1SJohn Marino
95f5b1c8a1SJohn Marino /* Function definitions for certificate and key loading. */
96f5b1c8a1SJohn Marino
97f5b1c8a1SJohn Marino X509 *
TS_CONF_load_cert(const char * file)98f5b1c8a1SJohn Marino TS_CONF_load_cert(const char *file)
99f5b1c8a1SJohn Marino {
100f5b1c8a1SJohn Marino BIO *cert = NULL;
101f5b1c8a1SJohn Marino X509 *x = NULL;
102f5b1c8a1SJohn Marino
103f5b1c8a1SJohn Marino if ((cert = BIO_new_file(file, "r")) == NULL)
104f5b1c8a1SJohn Marino goto end;
105f5b1c8a1SJohn Marino x = PEM_read_bio_X509_AUX(cert, NULL, NULL, NULL);
106f5b1c8a1SJohn Marino
107f5b1c8a1SJohn Marino end:
108f5b1c8a1SJohn Marino if (x == NULL)
109f5b1c8a1SJohn Marino fprintf(stderr, "unable to load certificate: %s\n", file);
110f5b1c8a1SJohn Marino BIO_free(cert);
111f5b1c8a1SJohn Marino return x;
112f5b1c8a1SJohn Marino }
113f5b1c8a1SJohn Marino
STACK_OF(X509)114f5b1c8a1SJohn Marino STACK_OF(X509) *
115f5b1c8a1SJohn Marino TS_CONF_load_certs(const char *file)
116f5b1c8a1SJohn Marino {
117f5b1c8a1SJohn Marino BIO *certs = NULL;
118f5b1c8a1SJohn Marino STACK_OF(X509) *othercerts = NULL;
119f5b1c8a1SJohn Marino STACK_OF(X509_INFO) *allcerts = NULL;
120f5b1c8a1SJohn Marino int i;
121f5b1c8a1SJohn Marino
122f5b1c8a1SJohn Marino if (!(certs = BIO_new_file(file, "r")))
123f5b1c8a1SJohn Marino goto end;
124f5b1c8a1SJohn Marino
125f5b1c8a1SJohn Marino if (!(othercerts = sk_X509_new_null()))
126f5b1c8a1SJohn Marino goto end;
127f5b1c8a1SJohn Marino allcerts = PEM_X509_INFO_read_bio(certs, NULL, NULL, NULL);
128f5b1c8a1SJohn Marino for (i = 0; i < sk_X509_INFO_num(allcerts); i++) {
129f5b1c8a1SJohn Marino X509_INFO *xi = sk_X509_INFO_value(allcerts, i);
130f5b1c8a1SJohn Marino if (xi->x509) {
131f5b1c8a1SJohn Marino if (sk_X509_push(othercerts, xi->x509) == 0) {
132f5b1c8a1SJohn Marino sk_X509_pop_free(othercerts, X509_free);
133f5b1c8a1SJohn Marino othercerts = NULL;
134f5b1c8a1SJohn Marino goto end;
135f5b1c8a1SJohn Marino }
136f5b1c8a1SJohn Marino xi->x509 = NULL;
137f5b1c8a1SJohn Marino }
138f5b1c8a1SJohn Marino }
139f5b1c8a1SJohn Marino
140f5b1c8a1SJohn Marino end:
141f5b1c8a1SJohn Marino if (othercerts == NULL)
142f5b1c8a1SJohn Marino fprintf(stderr, "unable to load certificates: %s\n", file);
143f5b1c8a1SJohn Marino sk_X509_INFO_pop_free(allcerts, X509_INFO_free);
144f5b1c8a1SJohn Marino BIO_free(certs);
145f5b1c8a1SJohn Marino return othercerts;
146f5b1c8a1SJohn Marino }
147f5b1c8a1SJohn Marino
148f5b1c8a1SJohn Marino EVP_PKEY *
TS_CONF_load_key(const char * file,const char * pass)149f5b1c8a1SJohn Marino TS_CONF_load_key(const char *file, const char *pass)
150f5b1c8a1SJohn Marino {
151f5b1c8a1SJohn Marino BIO *key = NULL;
152f5b1c8a1SJohn Marino EVP_PKEY *pkey = NULL;
153f5b1c8a1SJohn Marino
154f5b1c8a1SJohn Marino if (!(key = BIO_new_file(file, "r")))
155f5b1c8a1SJohn Marino goto end;
156f5b1c8a1SJohn Marino pkey = PEM_read_bio_PrivateKey(key, NULL, NULL, (char *) pass);
157f5b1c8a1SJohn Marino
158f5b1c8a1SJohn Marino end:
159f5b1c8a1SJohn Marino if (pkey == NULL)
160f5b1c8a1SJohn Marino fprintf(stderr, "unable to load private key: %s\n", file);
161f5b1c8a1SJohn Marino BIO_free(key);
162f5b1c8a1SJohn Marino return pkey;
163f5b1c8a1SJohn Marino }
164f5b1c8a1SJohn Marino
165f5b1c8a1SJohn Marino /* Function definitions for handling configuration options. */
166f5b1c8a1SJohn Marino
167f5b1c8a1SJohn Marino static void
TS_CONF_lookup_fail(const char * name,const char * tag)168f5b1c8a1SJohn Marino TS_CONF_lookup_fail(const char *name, const char *tag)
169f5b1c8a1SJohn Marino {
170f5b1c8a1SJohn Marino fprintf(stderr, "variable lookup failed for %s::%s\n", name, tag);
171f5b1c8a1SJohn Marino }
172f5b1c8a1SJohn Marino
173f5b1c8a1SJohn Marino static void
TS_CONF_invalid(const char * name,const char * tag)174f5b1c8a1SJohn Marino TS_CONF_invalid(const char *name, const char *tag)
175f5b1c8a1SJohn Marino {
176f5b1c8a1SJohn Marino fprintf(stderr, "invalid variable value for %s::%s\n", name, tag);
177f5b1c8a1SJohn Marino }
178f5b1c8a1SJohn Marino
179f5b1c8a1SJohn Marino const char *
TS_CONF_get_tsa_section(CONF * conf,const char * section)180f5b1c8a1SJohn Marino TS_CONF_get_tsa_section(CONF *conf, const char *section)
181f5b1c8a1SJohn Marino {
182f5b1c8a1SJohn Marino if (!section) {
183f5b1c8a1SJohn Marino section = NCONF_get_string(conf, BASE_SECTION, ENV_DEFAULT_TSA);
184f5b1c8a1SJohn Marino if (!section)
185f5b1c8a1SJohn Marino TS_CONF_lookup_fail(BASE_SECTION, ENV_DEFAULT_TSA);
186f5b1c8a1SJohn Marino }
187f5b1c8a1SJohn Marino return section;
188f5b1c8a1SJohn Marino }
189f5b1c8a1SJohn Marino
190f5b1c8a1SJohn Marino int
TS_CONF_set_serial(CONF * conf,const char * section,TS_serial_cb cb,TS_RESP_CTX * ctx)191f5b1c8a1SJohn Marino TS_CONF_set_serial(CONF *conf, const char *section, TS_serial_cb cb,
192f5b1c8a1SJohn Marino TS_RESP_CTX *ctx)
193f5b1c8a1SJohn Marino {
194f5b1c8a1SJohn Marino int ret = 0;
195f5b1c8a1SJohn Marino char *serial = NCONF_get_string(conf, section, ENV_SERIAL);
196f5b1c8a1SJohn Marino
197f5b1c8a1SJohn Marino if (!serial) {
198f5b1c8a1SJohn Marino TS_CONF_lookup_fail(section, ENV_SERIAL);
199f5b1c8a1SJohn Marino goto err;
200f5b1c8a1SJohn Marino }
201f5b1c8a1SJohn Marino TS_RESP_CTX_set_serial_cb(ctx, cb, serial);
202f5b1c8a1SJohn Marino
203f5b1c8a1SJohn Marino ret = 1;
204f5b1c8a1SJohn Marino
205f5b1c8a1SJohn Marino err:
206f5b1c8a1SJohn Marino return ret;
207f5b1c8a1SJohn Marino }
208f5b1c8a1SJohn Marino
209f5b1c8a1SJohn Marino #ifndef OPENSSL_NO_ENGINE
210f5b1c8a1SJohn Marino
211f5b1c8a1SJohn Marino int
TS_CONF_set_crypto_device(CONF * conf,const char * section,const char * device)212f5b1c8a1SJohn Marino TS_CONF_set_crypto_device(CONF *conf, const char *section, const char *device)
213f5b1c8a1SJohn Marino {
214f5b1c8a1SJohn Marino int ret = 0;
215f5b1c8a1SJohn Marino
216f5b1c8a1SJohn Marino if (!device)
217f5b1c8a1SJohn Marino device = NCONF_get_string(conf, section, ENV_CRYPTO_DEVICE);
218f5b1c8a1SJohn Marino
219f5b1c8a1SJohn Marino if (device && !TS_CONF_set_default_engine(device)) {
220f5b1c8a1SJohn Marino TS_CONF_invalid(section, ENV_CRYPTO_DEVICE);
221f5b1c8a1SJohn Marino goto err;
222f5b1c8a1SJohn Marino }
223f5b1c8a1SJohn Marino ret = 1;
224f5b1c8a1SJohn Marino
225f5b1c8a1SJohn Marino err:
226f5b1c8a1SJohn Marino return ret;
227f5b1c8a1SJohn Marino }
228f5b1c8a1SJohn Marino
229f5b1c8a1SJohn Marino int
TS_CONF_set_default_engine(const char * name)230f5b1c8a1SJohn Marino TS_CONF_set_default_engine(const char *name)
231f5b1c8a1SJohn Marino {
232f5b1c8a1SJohn Marino ENGINE *e = NULL;
233f5b1c8a1SJohn Marino int ret = 0;
234f5b1c8a1SJohn Marino
235f5b1c8a1SJohn Marino /* Leave the default if builtin specified. */
236f5b1c8a1SJohn Marino if (strcmp(name, "builtin") == 0)
237f5b1c8a1SJohn Marino return 1;
238f5b1c8a1SJohn Marino
239f5b1c8a1SJohn Marino if (!(e = ENGINE_by_id(name)))
240f5b1c8a1SJohn Marino goto err;
241f5b1c8a1SJohn Marino /* All the operations are going to be carried out by the engine. */
242f5b1c8a1SJohn Marino if (!ENGINE_set_default(e, ENGINE_METHOD_ALL))
243f5b1c8a1SJohn Marino goto err;
244f5b1c8a1SJohn Marino ret = 1;
245f5b1c8a1SJohn Marino
246f5b1c8a1SJohn Marino err:
247f5b1c8a1SJohn Marino if (!ret) {
24872c33676SMaxim Ag TSerror(TS_R_COULD_NOT_SET_ENGINE);
249f5b1c8a1SJohn Marino ERR_asprintf_error_data("engine:%s", name);
250f5b1c8a1SJohn Marino }
251f5b1c8a1SJohn Marino ENGINE_free(e);
252f5b1c8a1SJohn Marino return ret;
253f5b1c8a1SJohn Marino }
254f5b1c8a1SJohn Marino
255f5b1c8a1SJohn Marino #endif
256f5b1c8a1SJohn Marino
257f5b1c8a1SJohn Marino int
TS_CONF_set_signer_cert(CONF * conf,const char * section,const char * cert,TS_RESP_CTX * ctx)258f5b1c8a1SJohn Marino TS_CONF_set_signer_cert(CONF *conf, const char *section, const char *cert,
259f5b1c8a1SJohn Marino TS_RESP_CTX *ctx)
260f5b1c8a1SJohn Marino {
261f5b1c8a1SJohn Marino int ret = 0;
262f5b1c8a1SJohn Marino X509 *cert_obj = NULL;
263f5b1c8a1SJohn Marino
264f5b1c8a1SJohn Marino if (!cert)
265f5b1c8a1SJohn Marino cert = NCONF_get_string(conf, section, ENV_SIGNER_CERT);
266f5b1c8a1SJohn Marino if (!cert) {
267f5b1c8a1SJohn Marino TS_CONF_lookup_fail(section, ENV_SIGNER_CERT);
268f5b1c8a1SJohn Marino goto err;
269f5b1c8a1SJohn Marino }
270f5b1c8a1SJohn Marino if (!(cert_obj = TS_CONF_load_cert(cert)))
271f5b1c8a1SJohn Marino goto err;
272f5b1c8a1SJohn Marino if (!TS_RESP_CTX_set_signer_cert(ctx, cert_obj))
273f5b1c8a1SJohn Marino goto err;
274f5b1c8a1SJohn Marino
275f5b1c8a1SJohn Marino ret = 1;
276f5b1c8a1SJohn Marino
277f5b1c8a1SJohn Marino err:
278f5b1c8a1SJohn Marino X509_free(cert_obj);
279f5b1c8a1SJohn Marino return ret;
280f5b1c8a1SJohn Marino }
281f5b1c8a1SJohn Marino
282f5b1c8a1SJohn Marino int
TS_CONF_set_certs(CONF * conf,const char * section,const char * certs,TS_RESP_CTX * ctx)283f5b1c8a1SJohn Marino TS_CONF_set_certs(CONF *conf, const char *section, const char *certs,
284f5b1c8a1SJohn Marino TS_RESP_CTX *ctx)
285f5b1c8a1SJohn Marino {
286f5b1c8a1SJohn Marino int ret = 0;
287f5b1c8a1SJohn Marino STACK_OF(X509) *certs_obj = NULL;
288f5b1c8a1SJohn Marino
289f5b1c8a1SJohn Marino if (!certs)
290f5b1c8a1SJohn Marino certs = NCONF_get_string(conf, section, ENV_CERTS);
291f5b1c8a1SJohn Marino /* Certificate chain is optional. */
292f5b1c8a1SJohn Marino if (!certs)
293f5b1c8a1SJohn Marino goto end;
294f5b1c8a1SJohn Marino if (!(certs_obj = TS_CONF_load_certs(certs)))
295f5b1c8a1SJohn Marino goto err;
296f5b1c8a1SJohn Marino if (!TS_RESP_CTX_set_certs(ctx, certs_obj))
297f5b1c8a1SJohn Marino goto err;
298f5b1c8a1SJohn Marino
299f5b1c8a1SJohn Marino end:
300f5b1c8a1SJohn Marino ret = 1;
301f5b1c8a1SJohn Marino err:
302f5b1c8a1SJohn Marino sk_X509_pop_free(certs_obj, X509_free);
303f5b1c8a1SJohn Marino return ret;
304f5b1c8a1SJohn Marino }
305f5b1c8a1SJohn Marino
306f5b1c8a1SJohn Marino int
TS_CONF_set_signer_key(CONF * conf,const char * section,const char * key,const char * pass,TS_RESP_CTX * ctx)307f5b1c8a1SJohn Marino TS_CONF_set_signer_key(CONF *conf, const char *section, const char *key,
308f5b1c8a1SJohn Marino const char *pass, TS_RESP_CTX *ctx)
309f5b1c8a1SJohn Marino {
310f5b1c8a1SJohn Marino int ret = 0;
311f5b1c8a1SJohn Marino EVP_PKEY *key_obj = NULL;
312f5b1c8a1SJohn Marino
313f5b1c8a1SJohn Marino if (!key)
314f5b1c8a1SJohn Marino key = NCONF_get_string(conf, section, ENV_SIGNER_KEY);
315f5b1c8a1SJohn Marino if (!key) {
316f5b1c8a1SJohn Marino TS_CONF_lookup_fail(section, ENV_SIGNER_KEY);
317f5b1c8a1SJohn Marino goto err;
318f5b1c8a1SJohn Marino }
319f5b1c8a1SJohn Marino if (!(key_obj = TS_CONF_load_key(key, pass)))
320f5b1c8a1SJohn Marino goto err;
321f5b1c8a1SJohn Marino if (!TS_RESP_CTX_set_signer_key(ctx, key_obj))
322f5b1c8a1SJohn Marino goto err;
323f5b1c8a1SJohn Marino
324f5b1c8a1SJohn Marino ret = 1;
325f5b1c8a1SJohn Marino
326f5b1c8a1SJohn Marino err:
327f5b1c8a1SJohn Marino EVP_PKEY_free(key_obj);
328f5b1c8a1SJohn Marino return ret;
329f5b1c8a1SJohn Marino }
330f5b1c8a1SJohn Marino
331f5b1c8a1SJohn Marino int
TS_CONF_set_def_policy(CONF * conf,const char * section,const char * policy,TS_RESP_CTX * ctx)332f5b1c8a1SJohn Marino TS_CONF_set_def_policy(CONF *conf, const char *section, const char *policy,
333f5b1c8a1SJohn Marino TS_RESP_CTX *ctx)
334f5b1c8a1SJohn Marino {
335f5b1c8a1SJohn Marino int ret = 0;
336f5b1c8a1SJohn Marino ASN1_OBJECT *policy_obj = NULL;
337f5b1c8a1SJohn Marino
338f5b1c8a1SJohn Marino if (!policy)
339f5b1c8a1SJohn Marino policy = NCONF_get_string(conf, section, ENV_DEFAULT_POLICY);
340f5b1c8a1SJohn Marino if (!policy) {
341f5b1c8a1SJohn Marino TS_CONF_lookup_fail(section, ENV_DEFAULT_POLICY);
342f5b1c8a1SJohn Marino goto err;
343f5b1c8a1SJohn Marino }
344f5b1c8a1SJohn Marino if (!(policy_obj = OBJ_txt2obj(policy, 0))) {
345f5b1c8a1SJohn Marino TS_CONF_invalid(section, ENV_DEFAULT_POLICY);
346f5b1c8a1SJohn Marino goto err;
347f5b1c8a1SJohn Marino }
348f5b1c8a1SJohn Marino if (!TS_RESP_CTX_set_def_policy(ctx, policy_obj))
349f5b1c8a1SJohn Marino goto err;
350f5b1c8a1SJohn Marino
351f5b1c8a1SJohn Marino ret = 1;
352f5b1c8a1SJohn Marino
353f5b1c8a1SJohn Marino err:
354f5b1c8a1SJohn Marino ASN1_OBJECT_free(policy_obj);
355f5b1c8a1SJohn Marino return ret;
356f5b1c8a1SJohn Marino }
357f5b1c8a1SJohn Marino
358f5b1c8a1SJohn Marino int
TS_CONF_set_policies(CONF * conf,const char * section,TS_RESP_CTX * ctx)359f5b1c8a1SJohn Marino TS_CONF_set_policies(CONF *conf, const char *section, TS_RESP_CTX *ctx)
360f5b1c8a1SJohn Marino {
361f5b1c8a1SJohn Marino int ret = 0;
362f5b1c8a1SJohn Marino int i;
363f5b1c8a1SJohn Marino STACK_OF(CONF_VALUE) *list = NULL;
364f5b1c8a1SJohn Marino char *policies = NCONF_get_string(conf, section, ENV_OTHER_POLICIES);
365f5b1c8a1SJohn Marino
366f5b1c8a1SJohn Marino /* If no other policy is specified, that's fine. */
367f5b1c8a1SJohn Marino if (policies && !(list = X509V3_parse_list(policies))) {
368f5b1c8a1SJohn Marino TS_CONF_invalid(section, ENV_OTHER_POLICIES);
369f5b1c8a1SJohn Marino goto err;
370f5b1c8a1SJohn Marino }
371f5b1c8a1SJohn Marino for (i = 0; i < sk_CONF_VALUE_num(list); ++i) {
372f5b1c8a1SJohn Marino CONF_VALUE *val = sk_CONF_VALUE_value(list, i);
373f5b1c8a1SJohn Marino const char *extval = val->value ? val->value : val->name;
374f5b1c8a1SJohn Marino ASN1_OBJECT *objtmp;
375f5b1c8a1SJohn Marino if (!(objtmp = OBJ_txt2obj(extval, 0))) {
376f5b1c8a1SJohn Marino TS_CONF_invalid(section, ENV_OTHER_POLICIES);
377f5b1c8a1SJohn Marino goto err;
378f5b1c8a1SJohn Marino }
379f5b1c8a1SJohn Marino if (!TS_RESP_CTX_add_policy(ctx, objtmp))
380f5b1c8a1SJohn Marino goto err;
381f5b1c8a1SJohn Marino ASN1_OBJECT_free(objtmp);
382f5b1c8a1SJohn Marino }
383f5b1c8a1SJohn Marino
384f5b1c8a1SJohn Marino ret = 1;
385f5b1c8a1SJohn Marino
386f5b1c8a1SJohn Marino err:
387f5b1c8a1SJohn Marino sk_CONF_VALUE_pop_free(list, X509V3_conf_free);
388f5b1c8a1SJohn Marino return ret;
389f5b1c8a1SJohn Marino }
390f5b1c8a1SJohn Marino
391f5b1c8a1SJohn Marino int
TS_CONF_set_digests(CONF * conf,const char * section,TS_RESP_CTX * ctx)392f5b1c8a1SJohn Marino TS_CONF_set_digests(CONF *conf, const char *section, TS_RESP_CTX *ctx)
393f5b1c8a1SJohn Marino {
394f5b1c8a1SJohn Marino int ret = 0;
395f5b1c8a1SJohn Marino int i;
396f5b1c8a1SJohn Marino STACK_OF(CONF_VALUE) *list = NULL;
397f5b1c8a1SJohn Marino char *digests = NCONF_get_string(conf, section, ENV_DIGESTS);
398f5b1c8a1SJohn Marino
399f5b1c8a1SJohn Marino if (!digests) {
400f5b1c8a1SJohn Marino TS_CONF_lookup_fail(section, ENV_DIGESTS);
401f5b1c8a1SJohn Marino goto err;
402f5b1c8a1SJohn Marino }
403f5b1c8a1SJohn Marino if (!(list = X509V3_parse_list(digests))) {
404f5b1c8a1SJohn Marino TS_CONF_invalid(section, ENV_DIGESTS);
405f5b1c8a1SJohn Marino goto err;
406f5b1c8a1SJohn Marino }
407f5b1c8a1SJohn Marino if (sk_CONF_VALUE_num(list) == 0) {
408f5b1c8a1SJohn Marino TS_CONF_invalid(section, ENV_DIGESTS);
409f5b1c8a1SJohn Marino goto err;
410f5b1c8a1SJohn Marino }
411f5b1c8a1SJohn Marino for (i = 0; i < sk_CONF_VALUE_num(list); ++i) {
412f5b1c8a1SJohn Marino CONF_VALUE *val = sk_CONF_VALUE_value(list, i);
413f5b1c8a1SJohn Marino const char *extval = val->value ? val->value : val->name;
414f5b1c8a1SJohn Marino const EVP_MD *md;
415f5b1c8a1SJohn Marino if (!(md = EVP_get_digestbyname(extval))) {
416f5b1c8a1SJohn Marino TS_CONF_invalid(section, ENV_DIGESTS);
417f5b1c8a1SJohn Marino goto err;
418f5b1c8a1SJohn Marino }
419f5b1c8a1SJohn Marino if (!TS_RESP_CTX_add_md(ctx, md))
420f5b1c8a1SJohn Marino goto err;
421f5b1c8a1SJohn Marino }
422f5b1c8a1SJohn Marino
423f5b1c8a1SJohn Marino ret = 1;
424f5b1c8a1SJohn Marino
425f5b1c8a1SJohn Marino err:
426f5b1c8a1SJohn Marino sk_CONF_VALUE_pop_free(list, X509V3_conf_free);
427f5b1c8a1SJohn Marino return ret;
428f5b1c8a1SJohn Marino }
429f5b1c8a1SJohn Marino
430f5b1c8a1SJohn Marino int
TS_CONF_set_accuracy(CONF * conf,const char * section,TS_RESP_CTX * ctx)431f5b1c8a1SJohn Marino TS_CONF_set_accuracy(CONF *conf, const char *section, TS_RESP_CTX *ctx)
432f5b1c8a1SJohn Marino {
433f5b1c8a1SJohn Marino int ret = 0;
434f5b1c8a1SJohn Marino int i;
435f5b1c8a1SJohn Marino int secs = 0, millis = 0, micros = 0;
436f5b1c8a1SJohn Marino STACK_OF(CONF_VALUE) *list = NULL;
437f5b1c8a1SJohn Marino char *accuracy = NCONF_get_string(conf, section, ENV_ACCURACY);
438f5b1c8a1SJohn Marino
439f5b1c8a1SJohn Marino if (accuracy && !(list = X509V3_parse_list(accuracy))) {
440f5b1c8a1SJohn Marino TS_CONF_invalid(section, ENV_ACCURACY);
441f5b1c8a1SJohn Marino goto err;
442f5b1c8a1SJohn Marino }
443f5b1c8a1SJohn Marino for (i = 0; i < sk_CONF_VALUE_num(list); ++i) {
444f5b1c8a1SJohn Marino CONF_VALUE *val = sk_CONF_VALUE_value(list, i);
445f5b1c8a1SJohn Marino if (strcmp(val->name, ENV_VALUE_SECS) == 0) {
446f5b1c8a1SJohn Marino if (val->value)
447f5b1c8a1SJohn Marino secs = atoi(val->value);
448f5b1c8a1SJohn Marino } else if (strcmp(val->name, ENV_VALUE_MILLISECS) == 0) {
449f5b1c8a1SJohn Marino if (val->value)
450f5b1c8a1SJohn Marino millis = atoi(val->value);
451f5b1c8a1SJohn Marino } else if (strcmp(val->name, ENV_VALUE_MICROSECS) == 0) {
452f5b1c8a1SJohn Marino if (val->value)
453f5b1c8a1SJohn Marino micros = atoi(val->value);
454f5b1c8a1SJohn Marino } else {
455f5b1c8a1SJohn Marino TS_CONF_invalid(section, ENV_ACCURACY);
456f5b1c8a1SJohn Marino goto err;
457f5b1c8a1SJohn Marino }
458f5b1c8a1SJohn Marino }
459f5b1c8a1SJohn Marino if (!TS_RESP_CTX_set_accuracy(ctx, secs, millis, micros))
460f5b1c8a1SJohn Marino goto err;
461f5b1c8a1SJohn Marino
462f5b1c8a1SJohn Marino ret = 1;
463f5b1c8a1SJohn Marino
464f5b1c8a1SJohn Marino err:
465f5b1c8a1SJohn Marino sk_CONF_VALUE_pop_free(list, X509V3_conf_free);
466f5b1c8a1SJohn Marino return ret;
467f5b1c8a1SJohn Marino }
468f5b1c8a1SJohn Marino
469f5b1c8a1SJohn Marino int
TS_CONF_set_clock_precision_digits(CONF * conf,const char * section,TS_RESP_CTX * ctx)470f5b1c8a1SJohn Marino TS_CONF_set_clock_precision_digits(CONF *conf, const char *section,
471f5b1c8a1SJohn Marino TS_RESP_CTX *ctx)
472f5b1c8a1SJohn Marino {
473f5b1c8a1SJohn Marino int ret = 0;
474f5b1c8a1SJohn Marino long digits = 0;
475f5b1c8a1SJohn Marino
476f5b1c8a1SJohn Marino /* If not specified, set the default value to 0, i.e. sec precision */
477f5b1c8a1SJohn Marino if (!NCONF_get_number_e(conf, section, ENV_CLOCK_PRECISION_DIGITS,
478f5b1c8a1SJohn Marino &digits))
479f5b1c8a1SJohn Marino digits = 0;
480f5b1c8a1SJohn Marino if (digits < 0 || digits > TS_MAX_CLOCK_PRECISION_DIGITS) {
481f5b1c8a1SJohn Marino TS_CONF_invalid(section, ENV_CLOCK_PRECISION_DIGITS);
482f5b1c8a1SJohn Marino goto err;
483f5b1c8a1SJohn Marino }
484f5b1c8a1SJohn Marino
485f5b1c8a1SJohn Marino if (!TS_RESP_CTX_set_clock_precision_digits(ctx, digits))
486f5b1c8a1SJohn Marino goto err;
487f5b1c8a1SJohn Marino
488f5b1c8a1SJohn Marino return 1;
489f5b1c8a1SJohn Marino
490f5b1c8a1SJohn Marino err:
491f5b1c8a1SJohn Marino return ret;
492f5b1c8a1SJohn Marino }
493f5b1c8a1SJohn Marino
494f5b1c8a1SJohn Marino static int
TS_CONF_add_flag(CONF * conf,const char * section,const char * field,int flag,TS_RESP_CTX * ctx)495f5b1c8a1SJohn Marino TS_CONF_add_flag(CONF *conf, const char *section, const char *field, int flag,
496f5b1c8a1SJohn Marino TS_RESP_CTX *ctx)
497f5b1c8a1SJohn Marino {
498f5b1c8a1SJohn Marino /* Default is false. */
499f5b1c8a1SJohn Marino const char *value = NCONF_get_string(conf, section, field);
500f5b1c8a1SJohn Marino
501f5b1c8a1SJohn Marino if (value) {
502f5b1c8a1SJohn Marino if (strcmp(value, ENV_VALUE_YES) == 0)
503f5b1c8a1SJohn Marino TS_RESP_CTX_add_flags(ctx, flag);
504f5b1c8a1SJohn Marino else if (strcmp(value, ENV_VALUE_NO) != 0) {
505f5b1c8a1SJohn Marino TS_CONF_invalid(section, field);
506f5b1c8a1SJohn Marino return 0;
507f5b1c8a1SJohn Marino }
508f5b1c8a1SJohn Marino }
509f5b1c8a1SJohn Marino
510f5b1c8a1SJohn Marino return 1;
511f5b1c8a1SJohn Marino }
512f5b1c8a1SJohn Marino
513f5b1c8a1SJohn Marino int
TS_CONF_set_ordering(CONF * conf,const char * section,TS_RESP_CTX * ctx)514f5b1c8a1SJohn Marino TS_CONF_set_ordering(CONF *conf, const char *section, TS_RESP_CTX *ctx)
515f5b1c8a1SJohn Marino {
516f5b1c8a1SJohn Marino return TS_CONF_add_flag(conf, section, ENV_ORDERING, TS_ORDERING, ctx);
517f5b1c8a1SJohn Marino }
518f5b1c8a1SJohn Marino
519f5b1c8a1SJohn Marino int
TS_CONF_set_tsa_name(CONF * conf,const char * section,TS_RESP_CTX * ctx)520f5b1c8a1SJohn Marino TS_CONF_set_tsa_name(CONF *conf, const char *section, TS_RESP_CTX *ctx)
521f5b1c8a1SJohn Marino {
522f5b1c8a1SJohn Marino return TS_CONF_add_flag(conf, section, ENV_TSA_NAME, TS_TSA_NAME, ctx);
523f5b1c8a1SJohn Marino }
524f5b1c8a1SJohn Marino
525f5b1c8a1SJohn Marino int
TS_CONF_set_ess_cert_id_chain(CONF * conf,const char * section,TS_RESP_CTX * ctx)526f5b1c8a1SJohn Marino TS_CONF_set_ess_cert_id_chain(CONF *conf, const char *section, TS_RESP_CTX *ctx)
527f5b1c8a1SJohn Marino {
528f5b1c8a1SJohn Marino return TS_CONF_add_flag(conf, section, ENV_ESS_CERT_ID_CHAIN,
529f5b1c8a1SJohn Marino TS_ESS_CERT_ID_CHAIN, ctx);
530f5b1c8a1SJohn Marino }
531