1 /* $OpenBSD: ts.h,v 1.19 2022/09/11 17:31:19 tb Exp $ */ 2 /* Written by Zoltan Glozik (zglozik@opentsa.org) for the OpenSSL 3 * project 2002, 2003, 2004. 4 */ 5 /* ==================================================================== 6 * Copyright (c) 2006 The OpenSSL Project. All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in 17 * the documentation and/or other materials provided with the 18 * distribution. 19 * 20 * 3. All advertising materials mentioning features or use of this 21 * software must display the following acknowledgment: 22 * "This product includes software developed by the OpenSSL Project 23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" 24 * 25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 26 * endorse or promote products derived from this software without 27 * prior written permission. For written permission, please contact 28 * licensing@OpenSSL.org. 29 * 30 * 5. Products derived from this software may not be called "OpenSSL" 31 * nor may "OpenSSL" appear in their names without prior written 32 * permission of the OpenSSL Project. 33 * 34 * 6. Redistributions of any form whatsoever must retain the following 35 * acknowledgment: 36 * "This product includes software developed by the OpenSSL Project 37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" 38 * 39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 50 * OF THE POSSIBILITY OF SUCH DAMAGE. 51 * ==================================================================== 52 * 53 * This product includes cryptographic software written by Eric Young 54 * (eay@cryptsoft.com). This product includes software written by Tim 55 * Hudson (tjh@cryptsoft.com). 56 * 57 */ 58 59 #ifndef HEADER_TS_H 60 #define HEADER_TS_H 61 62 #include <openssl/opensslconf.h> 63 64 #ifndef OPENSSL_NO_BUFFER 65 #include <openssl/buffer.h> 66 #endif 67 #ifndef OPENSSL_NO_EVP 68 #include <openssl/evp.h> 69 #endif 70 #ifndef OPENSSL_NO_BIO 71 #include <openssl/bio.h> 72 #endif 73 #include <openssl/stack.h> 74 #include <openssl/asn1.h> 75 #include <openssl/safestack.h> 76 77 #ifndef OPENSSL_NO_RSA 78 #include <openssl/rsa.h> 79 #endif 80 81 #ifndef OPENSSL_NO_DSA 82 #include <openssl/dsa.h> 83 #endif 84 85 #ifndef OPENSSL_NO_DH 86 #include <openssl/dh.h> 87 #endif 88 89 #ifdef __cplusplus 90 extern "C" { 91 #endif 92 93 #include <openssl/x509.h> 94 #include <openssl/x509v3.h> 95 96 typedef struct TS_msg_imprint_st TS_MSG_IMPRINT; 97 typedef struct TS_req_st TS_REQ; 98 typedef struct TS_accuracy_st TS_ACCURACY; 99 typedef struct TS_tst_info_st TS_TST_INFO; 100 101 /* Possible values for status. */ 102 #define TS_STATUS_GRANTED 0 103 #define TS_STATUS_GRANTED_WITH_MODS 1 104 #define TS_STATUS_REJECTION 2 105 #define TS_STATUS_WAITING 3 106 #define TS_STATUS_REVOCATION_WARNING 4 107 #define TS_STATUS_REVOCATION_NOTIFICATION 5 108 109 /* Possible values for failure_info. */ 110 #define TS_INFO_BAD_ALG 0 111 #define TS_INFO_BAD_REQUEST 2 112 #define TS_INFO_BAD_DATA_FORMAT 5 113 #define TS_INFO_TIME_NOT_AVAILABLE 14 114 #define TS_INFO_UNACCEPTED_POLICY 15 115 #define TS_INFO_UNACCEPTED_EXTENSION 16 116 #define TS_INFO_ADD_INFO_NOT_AVAILABLE 17 117 #define TS_INFO_SYSTEM_FAILURE 25 118 119 typedef struct TS_status_info_st TS_STATUS_INFO; 120 121 DECLARE_STACK_OF(ASN1_UTF8STRING) 122 123 typedef struct ESS_issuer_serial ESS_ISSUER_SERIAL; 124 typedef struct ESS_cert_id ESS_CERT_ID; 125 DECLARE_STACK_OF(ESS_CERT_ID) 126 typedef struct ESS_signing_cert ESS_SIGNING_CERT; 127 128 typedef struct ESS_cert_id_v2 ESS_CERT_ID_V2; 129 DECLARE_STACK_OF(ESS_CERT_ID_V2) 130 131 typedef struct ESS_signing_cert_v2 ESS_SIGNING_CERT_V2; 132 133 typedef struct TS_resp_st TS_RESP; 134 135 TS_REQ *TS_REQ_new(void); 136 void TS_REQ_free(TS_REQ *a); 137 int i2d_TS_REQ(const TS_REQ *a, unsigned char **pp); 138 TS_REQ *d2i_TS_REQ(TS_REQ **a, const unsigned char **pp, long length); 139 140 TS_REQ *TS_REQ_dup(TS_REQ *a); 141 142 TS_REQ *d2i_TS_REQ_fp(FILE *fp, TS_REQ **a); 143 int i2d_TS_REQ_fp(FILE *fp, TS_REQ *a); 144 TS_REQ *d2i_TS_REQ_bio(BIO *fp, TS_REQ **a); 145 int i2d_TS_REQ_bio(BIO *fp, TS_REQ *a); 146 147 TS_MSG_IMPRINT *TS_MSG_IMPRINT_new(void); 148 void TS_MSG_IMPRINT_free(TS_MSG_IMPRINT *a); 149 int i2d_TS_MSG_IMPRINT(const TS_MSG_IMPRINT *a, unsigned char **pp); 150 TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT(TS_MSG_IMPRINT **a, 151 const unsigned char **pp, long length); 152 153 TS_MSG_IMPRINT *TS_MSG_IMPRINT_dup(TS_MSG_IMPRINT *a); 154 155 TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT **a); 156 int i2d_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT *a); 157 TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_bio(BIO *fp, TS_MSG_IMPRINT **a); 158 int i2d_TS_MSG_IMPRINT_bio(BIO *fp, TS_MSG_IMPRINT *a); 159 160 TS_RESP *TS_RESP_new(void); 161 void TS_RESP_free(TS_RESP *a); 162 int i2d_TS_RESP(const TS_RESP *a, unsigned char **pp); 163 TS_RESP *d2i_TS_RESP(TS_RESP **a, const unsigned char **pp, long length); 164 TS_TST_INFO *PKCS7_to_TS_TST_INFO(PKCS7 *token); 165 TS_RESP *TS_RESP_dup(TS_RESP *a); 166 167 TS_RESP *d2i_TS_RESP_fp(FILE *fp, TS_RESP **a); 168 int i2d_TS_RESP_fp(FILE *fp, TS_RESP *a); 169 TS_RESP *d2i_TS_RESP_bio(BIO *fp, TS_RESP **a); 170 int i2d_TS_RESP_bio(BIO *fp, TS_RESP *a); 171 172 TS_STATUS_INFO *TS_STATUS_INFO_new(void); 173 void TS_STATUS_INFO_free(TS_STATUS_INFO *a); 174 int i2d_TS_STATUS_INFO(const TS_STATUS_INFO *a, unsigned char **pp); 175 TS_STATUS_INFO *d2i_TS_STATUS_INFO(TS_STATUS_INFO **a, 176 const unsigned char **pp, long length); 177 TS_STATUS_INFO *TS_STATUS_INFO_dup(TS_STATUS_INFO *a); 178 179 TS_TST_INFO *TS_TST_INFO_new(void); 180 void TS_TST_INFO_free(TS_TST_INFO *a); 181 int i2d_TS_TST_INFO(const TS_TST_INFO *a, unsigned char **pp); 182 TS_TST_INFO *d2i_TS_TST_INFO(TS_TST_INFO **a, const unsigned char **pp, 183 long length); 184 TS_TST_INFO *TS_TST_INFO_dup(TS_TST_INFO *a); 185 186 TS_TST_INFO *d2i_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO **a); 187 int i2d_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO *a); 188 TS_TST_INFO *d2i_TS_TST_INFO_bio(BIO *fp, TS_TST_INFO **a); 189 int i2d_TS_TST_INFO_bio(BIO *fp, TS_TST_INFO *a); 190 191 TS_ACCURACY *TS_ACCURACY_new(void); 192 void TS_ACCURACY_free(TS_ACCURACY *a); 193 int i2d_TS_ACCURACY(const TS_ACCURACY *a, unsigned char **pp); 194 TS_ACCURACY *d2i_TS_ACCURACY(TS_ACCURACY **a, const unsigned char **pp, 195 long length); 196 TS_ACCURACY *TS_ACCURACY_dup(TS_ACCURACY *a); 197 198 ESS_ISSUER_SERIAL *ESS_ISSUER_SERIAL_new(void); 199 void ESS_ISSUER_SERIAL_free(ESS_ISSUER_SERIAL *a); 200 int i2d_ESS_ISSUER_SERIAL(const ESS_ISSUER_SERIAL *a, 201 unsigned char **pp); 202 ESS_ISSUER_SERIAL *d2i_ESS_ISSUER_SERIAL(ESS_ISSUER_SERIAL **a, 203 const unsigned char **pp, long length); 204 ESS_ISSUER_SERIAL *ESS_ISSUER_SERIAL_dup(ESS_ISSUER_SERIAL *a); 205 206 ESS_CERT_ID *ESS_CERT_ID_new(void); 207 void ESS_CERT_ID_free(ESS_CERT_ID *a); 208 int i2d_ESS_CERT_ID(const ESS_CERT_ID *a, unsigned char **pp); 209 ESS_CERT_ID *d2i_ESS_CERT_ID(ESS_CERT_ID **a, const unsigned char **pp, 210 long length); 211 ESS_CERT_ID *ESS_CERT_ID_dup(ESS_CERT_ID *a); 212 213 ESS_SIGNING_CERT *ESS_SIGNING_CERT_new(void); 214 void ESS_SIGNING_CERT_free(ESS_SIGNING_CERT *a); 215 int i2d_ESS_SIGNING_CERT(const ESS_SIGNING_CERT *a, 216 unsigned char **pp); 217 ESS_SIGNING_CERT *d2i_ESS_SIGNING_CERT(ESS_SIGNING_CERT **a, 218 const unsigned char **pp, long length); 219 ESS_SIGNING_CERT *ESS_SIGNING_CERT_dup(ESS_SIGNING_CERT *a); 220 221 int TS_REQ_set_version(TS_REQ *a, long version); 222 long TS_REQ_get_version(const TS_REQ *a); 223 224 int TS_REQ_set_msg_imprint(TS_REQ *a, TS_MSG_IMPRINT *msg_imprint); 225 TS_MSG_IMPRINT *TS_REQ_get_msg_imprint(TS_REQ *a); 226 227 int TS_MSG_IMPRINT_set_algo(TS_MSG_IMPRINT *a, X509_ALGOR *alg); 228 X509_ALGOR *TS_MSG_IMPRINT_get_algo(TS_MSG_IMPRINT *a); 229 230 int TS_MSG_IMPRINT_set_msg(TS_MSG_IMPRINT *a, unsigned char *d, int len); 231 ASN1_OCTET_STRING *TS_MSG_IMPRINT_get_msg(TS_MSG_IMPRINT *a); 232 233 int TS_REQ_set_policy_id(TS_REQ *a, const ASN1_OBJECT *policy); 234 ASN1_OBJECT *TS_REQ_get_policy_id(TS_REQ *a); 235 236 int TS_REQ_set_nonce(TS_REQ *a, const ASN1_INTEGER *nonce); 237 const ASN1_INTEGER *TS_REQ_get_nonce(const TS_REQ *a); 238 239 int TS_REQ_set_cert_req(TS_REQ *a, int cert_req); 240 int TS_REQ_get_cert_req(const TS_REQ *a); 241 242 STACK_OF(X509_EXTENSION) *TS_REQ_get_exts(TS_REQ *a); 243 void TS_REQ_ext_free(TS_REQ *a); 244 int TS_REQ_get_ext_count(TS_REQ *a); 245 int TS_REQ_get_ext_by_NID(TS_REQ *a, int nid, int lastpos); 246 int TS_REQ_get_ext_by_OBJ(TS_REQ *a, const ASN1_OBJECT *obj, int lastpos); 247 int TS_REQ_get_ext_by_critical(TS_REQ *a, int crit, int lastpos); 248 X509_EXTENSION *TS_REQ_get_ext(TS_REQ *a, int loc); 249 X509_EXTENSION *TS_REQ_delete_ext(TS_REQ *a, int loc); 250 int TS_REQ_add_ext(TS_REQ *a, X509_EXTENSION *ex, int loc); 251 void *TS_REQ_get_ext_d2i(TS_REQ *a, int nid, int *crit, int *idx); 252 253 /* Function declarations for TS_REQ defined in ts/ts_req_print.c */ 254 255 int TS_REQ_print_bio(BIO *bio, TS_REQ *a); 256 257 /* Function declarations for TS_RESP defined in ts/ts_rsp_utils.c */ 258 259 int TS_RESP_set_status_info(TS_RESP *a, TS_STATUS_INFO *info); 260 TS_STATUS_INFO *TS_RESP_get_status_info(TS_RESP *a); 261 262 const ASN1_UTF8STRING *TS_STATUS_INFO_get0_failure_info(const TS_STATUS_INFO *si); 263 const STACK_OF(ASN1_UTF8STRING) * 264 TS_STATUS_INFO_get0_text(const TS_STATUS_INFO *si); 265 const ASN1_INTEGER *TS_STATUS_INFO_get0_status(const TS_STATUS_INFO *si); 266 int TS_STATUS_INFO_set_status(TS_STATUS_INFO *si, int i); 267 268 /* Caller loses ownership of PKCS7 and TS_TST_INFO objects. */ 269 void TS_RESP_set_tst_info(TS_RESP *a, PKCS7 *p7, TS_TST_INFO *tst_info); 270 PKCS7 *TS_RESP_get_token(TS_RESP *a); 271 TS_TST_INFO *TS_RESP_get_tst_info(TS_RESP *a); 272 273 int TS_TST_INFO_set_version(TS_TST_INFO *a, long version); 274 long TS_TST_INFO_get_version(const TS_TST_INFO *a); 275 276 int TS_TST_INFO_set_policy_id(TS_TST_INFO *a, ASN1_OBJECT *policy_id); 277 ASN1_OBJECT *TS_TST_INFO_get_policy_id(TS_TST_INFO *a); 278 279 int TS_TST_INFO_set_msg_imprint(TS_TST_INFO *a, TS_MSG_IMPRINT *msg_imprint); 280 TS_MSG_IMPRINT *TS_TST_INFO_get_msg_imprint(TS_TST_INFO *a); 281 282 int TS_TST_INFO_set_serial(TS_TST_INFO *a, const ASN1_INTEGER *serial); 283 const ASN1_INTEGER *TS_TST_INFO_get_serial(const TS_TST_INFO *a); 284 285 int TS_TST_INFO_set_time(TS_TST_INFO *a, const ASN1_GENERALIZEDTIME *gtime); 286 const ASN1_GENERALIZEDTIME *TS_TST_INFO_get_time(const TS_TST_INFO *a); 287 288 int TS_TST_INFO_set_accuracy(TS_TST_INFO *a, TS_ACCURACY *accuracy); 289 TS_ACCURACY *TS_TST_INFO_get_accuracy(TS_TST_INFO *a); 290 291 int TS_ACCURACY_set_seconds(TS_ACCURACY *a, const ASN1_INTEGER *seconds); 292 const ASN1_INTEGER *TS_ACCURACY_get_seconds(const TS_ACCURACY *a); 293 294 int TS_ACCURACY_set_millis(TS_ACCURACY *a, const ASN1_INTEGER *millis); 295 const ASN1_INTEGER *TS_ACCURACY_get_millis(const TS_ACCURACY *a); 296 297 int TS_ACCURACY_set_micros(TS_ACCURACY *a, const ASN1_INTEGER *micros); 298 const ASN1_INTEGER *TS_ACCURACY_get_micros(const TS_ACCURACY *a); 299 300 int TS_TST_INFO_set_ordering(TS_TST_INFO *a, int ordering); 301 int TS_TST_INFO_get_ordering(const TS_TST_INFO *a); 302 303 int TS_TST_INFO_set_nonce(TS_TST_INFO *a, const ASN1_INTEGER *nonce); 304 const ASN1_INTEGER *TS_TST_INFO_get_nonce(const TS_TST_INFO *a); 305 306 int TS_TST_INFO_set_tsa(TS_TST_INFO *a, GENERAL_NAME *tsa); 307 GENERAL_NAME *TS_TST_INFO_get_tsa(TS_TST_INFO *a); 308 309 STACK_OF(X509_EXTENSION) *TS_TST_INFO_get_exts(TS_TST_INFO *a); 310 void TS_TST_INFO_ext_free(TS_TST_INFO *a); 311 int TS_TST_INFO_get_ext_count(TS_TST_INFO *a); 312 int TS_TST_INFO_get_ext_by_NID(TS_TST_INFO *a, int nid, int lastpos); 313 int TS_TST_INFO_get_ext_by_OBJ(TS_TST_INFO *a, const ASN1_OBJECT *obj, 314 int lastpos); 315 int TS_TST_INFO_get_ext_by_critical(TS_TST_INFO *a, int crit, int lastpos); 316 X509_EXTENSION *TS_TST_INFO_get_ext(TS_TST_INFO *a, int loc); 317 X509_EXTENSION *TS_TST_INFO_delete_ext(TS_TST_INFO *a, int loc); 318 int TS_TST_INFO_add_ext(TS_TST_INFO *a, X509_EXTENSION *ex, int loc); 319 void *TS_TST_INFO_get_ext_d2i(TS_TST_INFO *a, int nid, int *crit, int *idx); 320 321 /* Declarations related to response generation, defined in ts/ts_rsp_sign.c. */ 322 323 /* Optional flags for response generation. */ 324 325 /* Don't include the TSA name in response. */ 326 #define TS_TSA_NAME 0x01 327 328 /* Set ordering to true in response. */ 329 #define TS_ORDERING 0x02 330 331 /* 332 * Include the signer certificate and the other specified certificates in 333 * the ESS signing certificate attribute beside the PKCS7 signed data. 334 * Only the signer certificates is included by default. 335 */ 336 #define TS_ESS_CERT_ID_CHAIN 0x04 337 338 /* Forward declaration. */ 339 struct TS_resp_ctx; 340 341 /* This must return a unique number less than 160 bits long. */ 342 typedef ASN1_INTEGER *(*TS_serial_cb)(struct TS_resp_ctx *, void *); 343 344 /* This must return the seconds and microseconds since Jan 1, 1970 in 345 the sec and usec variables allocated by the caller. 346 Return non-zero for success and zero for failure. */ 347 typedef int (*TS_time_cb)(struct TS_resp_ctx *, void *, time_t *sec, long *usec); 348 349 /* This must process the given extension. 350 * It can modify the TS_TST_INFO object of the context. 351 * Return values: !0 (processed), 0 (error, it must set the 352 * status info/failure info of the response). 353 */ 354 typedef int (*TS_extension_cb)(struct TS_resp_ctx *, X509_EXTENSION *, void *); 355 356 typedef struct TS_resp_ctx TS_RESP_CTX; 357 358 DECLARE_STACK_OF(EVP_MD) 359 360 /* Creates a response context that can be used for generating responses. */ 361 TS_RESP_CTX *TS_RESP_CTX_new(void); 362 void TS_RESP_CTX_free(TS_RESP_CTX *ctx); 363 364 /* This parameter must be set. */ 365 int TS_RESP_CTX_set_signer_cert(TS_RESP_CTX *ctx, X509 *signer); 366 367 /* This parameter must be set. */ 368 int TS_RESP_CTX_set_signer_key(TS_RESP_CTX *ctx, EVP_PKEY *key); 369 370 /* This parameter must be set. */ 371 int TS_RESP_CTX_set_def_policy(TS_RESP_CTX *ctx, const ASN1_OBJECT *def_policy); 372 373 /* No additional certs are included in the response by default. */ 374 int TS_RESP_CTX_set_certs(TS_RESP_CTX *ctx, STACK_OF(X509) *certs); 375 376 /* Adds a new acceptable policy, only the default policy 377 is accepted by default. */ 378 int TS_RESP_CTX_add_policy(TS_RESP_CTX *ctx, const ASN1_OBJECT *policy); 379 380 /* Adds a new acceptable message digest. Note that no message digests 381 are accepted by default. The md argument is shared with the caller. */ 382 int TS_RESP_CTX_add_md(TS_RESP_CTX *ctx, const EVP_MD *md); 383 384 /* Accuracy is not included by default. */ 385 int TS_RESP_CTX_set_accuracy(TS_RESP_CTX *ctx, 386 int secs, int millis, int micros); 387 388 /* Clock precision digits, i.e. the number of decimal digits: 389 '0' means sec, '3' msec, '6' usec, and so on. Default is 0. */ 390 int TS_RESP_CTX_set_clock_precision_digits(TS_RESP_CTX *ctx, 391 unsigned clock_precision_digits); 392 /* At most we accept usec precision. */ 393 #define TS_MAX_CLOCK_PRECISION_DIGITS 6 394 395 /* No flags are set by default. */ 396 void TS_RESP_CTX_add_flags(TS_RESP_CTX *ctx, int flags); 397 398 /* Default callback always returns a constant. */ 399 void TS_RESP_CTX_set_serial_cb(TS_RESP_CTX *ctx, TS_serial_cb cb, void *data); 400 401 /* Default callback uses gettimeofday() and gmtime(). */ 402 void TS_RESP_CTX_set_time_cb(TS_RESP_CTX *ctx, TS_time_cb cb, void *data); 403 404 /* Default callback rejects all extensions. The extension callback is called 405 * when the TS_TST_INFO object is already set up and not signed yet. */ 406 /* FIXME: extension handling is not tested yet. */ 407 void TS_RESP_CTX_set_extension_cb(TS_RESP_CTX *ctx, 408 TS_extension_cb cb, void *data); 409 410 /* The following methods can be used in the callbacks. */ 411 int TS_RESP_CTX_set_status_info(TS_RESP_CTX *ctx, 412 int status, const char *text); 413 414 /* Sets the status info only if it is still TS_STATUS_GRANTED. */ 415 int TS_RESP_CTX_set_status_info_cond(TS_RESP_CTX *ctx, 416 int status, const char *text); 417 418 int TS_RESP_CTX_add_failure_info(TS_RESP_CTX *ctx, int failure); 419 420 /* The get methods below can be used in the extension callback. */ 421 TS_REQ *TS_RESP_CTX_get_request(TS_RESP_CTX *ctx); 422 423 TS_TST_INFO *TS_RESP_CTX_get_tst_info(TS_RESP_CTX *ctx); 424 425 /* 426 * Creates the signed TS_TST_INFO and puts it in TS_RESP. 427 * In case of errors it sets the status info properly. 428 * Returns NULL only in case of memory allocation/fatal error. 429 */ 430 TS_RESP *TS_RESP_create_response(TS_RESP_CTX *ctx, BIO *req_bio); 431 432 /* 433 * Declarations related to response verification, 434 * they are defined in ts/ts_rsp_verify.c. 435 */ 436 437 int TS_RESP_verify_signature(PKCS7 *token, STACK_OF(X509) *certs, 438 X509_STORE *store, X509 **signer_out); 439 440 /* Context structure for the generic verify method. */ 441 442 /* Verify the signer's certificate and the signature of the response. */ 443 #define TS_VFY_SIGNATURE (1u << 0) 444 /* Verify the version number of the response. */ 445 #define TS_VFY_VERSION (1u << 1) 446 /* Verify if the policy supplied by the user matches the policy of the TSA. */ 447 #define TS_VFY_POLICY (1u << 2) 448 /* Verify the message imprint provided by the user. This flag should not be 449 specified with TS_VFY_DATA. */ 450 #define TS_VFY_IMPRINT (1u << 3) 451 /* Verify the message imprint computed by the verify method from the user 452 provided data and the MD algorithm of the response. This flag should not be 453 specified with TS_VFY_IMPRINT. */ 454 #define TS_VFY_DATA (1u << 4) 455 /* Verify the nonce value. */ 456 #define TS_VFY_NONCE (1u << 5) 457 /* Verify if the TSA name field matches the signer certificate. */ 458 #define TS_VFY_SIGNER (1u << 6) 459 /* Verify if the TSA name field equals to the user provided name. */ 460 #define TS_VFY_TSA_NAME (1u << 7) 461 462 /* You can use the following convenience constants. */ 463 #define TS_VFY_ALL_IMPRINT (TS_VFY_SIGNATURE \ 464 | TS_VFY_VERSION \ 465 | TS_VFY_POLICY \ 466 | TS_VFY_IMPRINT \ 467 | TS_VFY_NONCE \ 468 | TS_VFY_SIGNER \ 469 | TS_VFY_TSA_NAME) 470 #define TS_VFY_ALL_DATA (TS_VFY_SIGNATURE \ 471 | TS_VFY_VERSION \ 472 | TS_VFY_POLICY \ 473 | TS_VFY_DATA \ 474 | TS_VFY_NONCE \ 475 | TS_VFY_SIGNER \ 476 | TS_VFY_TSA_NAME) 477 478 typedef struct TS_verify_ctx TS_VERIFY_CTX; 479 480 int TS_RESP_verify_response(TS_VERIFY_CTX *ctx, TS_RESP *response); 481 int TS_RESP_verify_token(TS_VERIFY_CTX *ctx, PKCS7 *token); 482 483 /* 484 * Declarations related to response verification context, 485 * they are defined in ts/ts_verify_ctx.c. 486 */ 487 488 /* Set all fields to zero. */ 489 TS_VERIFY_CTX *TS_VERIFY_CTX_new(void); 490 void TS_VERIFY_CTX_init(TS_VERIFY_CTX *ctx); 491 void TS_VERIFY_CTX_free(TS_VERIFY_CTX *ctx); 492 void TS_VERIFY_CTX_cleanup(TS_VERIFY_CTX *ctx); 493 494 int TS_VERIFY_CTX_add_flags(TS_VERIFY_CTX *ctx, int flags); 495 int TS_VERIFY_CTX_set_flags(TS_VERIFY_CTX *ctx, int flags); 496 BIO *TS_VERIFY_CTX_set_data(TS_VERIFY_CTX *ctx, BIO *bio); 497 X509_STORE *TS_VERIFY_CTX_set_store(TS_VERIFY_CTX *ctx, X509_STORE *store); 498 /* R$ special */ 499 #define TS_VERIFY_CTS_set_certs TS_VERIFY_CTX_set_certs 500 STACK_OF(X509) *TS_VERIFY_CTX_set_certs(TS_VERIFY_CTX *ctx, 501 STACK_OF(X509) *certs); 502 unsigned char *TS_VERIFY_CTX_set_imprint(TS_VERIFY_CTX *ctx, 503 unsigned char *imprint, long imprint_len); 504 505 /* 506 * If ctx is NULL, it allocates and returns a new object, otherwise 507 * it returns ctx. It initialises all the members as follows: 508 * flags = TS_VFY_ALL_IMPRINT & ~(TS_VFY_TSA_NAME | TS_VFY_SIGNATURE) 509 * certs = NULL 510 * store = NULL 511 * policy = policy from the request or NULL if absent (in this case 512 * TS_VFY_POLICY is cleared from flags as well) 513 * md_alg = MD algorithm from request 514 * imprint, imprint_len = imprint from request 515 * data = NULL 516 * nonce, nonce_len = nonce from the request or NULL if absent (in this case 517 * TS_VFY_NONCE is cleared from flags as well) 518 * tsa_name = NULL 519 * Important: after calling this method TS_VFY_SIGNATURE should be added! 520 */ 521 TS_VERIFY_CTX *TS_REQ_to_TS_VERIFY_CTX(TS_REQ *req, TS_VERIFY_CTX *ctx); 522 523 /* Function declarations for TS_RESP defined in ts/ts_rsp_print.c */ 524 525 int TS_RESP_print_bio(BIO *bio, TS_RESP *a); 526 int TS_STATUS_INFO_print_bio(BIO *bio, TS_STATUS_INFO *a); 527 int TS_TST_INFO_print_bio(BIO *bio, TS_TST_INFO *a); 528 529 /* Common utility functions defined in ts/ts_lib.c */ 530 531 int TS_ASN1_INTEGER_print_bio(BIO *bio, const ASN1_INTEGER *num); 532 int TS_OBJ_print_bio(BIO *bio, const ASN1_OBJECT *obj); 533 int TS_ext_print_bio(BIO *bio, const STACK_OF(X509_EXTENSION) *extensions); 534 int TS_X509_ALGOR_print_bio(BIO *bio, const X509_ALGOR *alg); 535 int TS_MSG_IMPRINT_print_bio(BIO *bio, TS_MSG_IMPRINT *msg); 536 537 /* Function declarations for handling configuration options, 538 defined in ts/ts_conf.c */ 539 540 X509 *TS_CONF_load_cert(const char *file); 541 STACK_OF(X509) *TS_CONF_load_certs(const char *file); 542 EVP_PKEY *TS_CONF_load_key(const char *file, const char *pass); 543 const char *TS_CONF_get_tsa_section(CONF *conf, const char *section); 544 int TS_CONF_set_serial(CONF *conf, const char *section, TS_serial_cb cb, 545 TS_RESP_CTX *ctx); 546 int TS_CONF_set_crypto_device(CONF *conf, const char *section, 547 const char *device); 548 int TS_CONF_set_default_engine(const char *name); 549 int TS_CONF_set_signer_cert(CONF *conf, const char *section, 550 const char *cert, TS_RESP_CTX *ctx); 551 int TS_CONF_set_certs(CONF *conf, const char *section, const char *certs, 552 TS_RESP_CTX *ctx); 553 int TS_CONF_set_signer_key(CONF *conf, const char *section, 554 const char *key, const char *pass, TS_RESP_CTX *ctx); 555 int TS_CONF_set_def_policy(CONF *conf, const char *section, 556 const char *policy, TS_RESP_CTX *ctx); 557 int TS_CONF_set_policies(CONF *conf, const char *section, TS_RESP_CTX *ctx); 558 int TS_CONF_set_digests(CONF *conf, const char *section, TS_RESP_CTX *ctx); 559 int TS_CONF_set_accuracy(CONF *conf, const char *section, TS_RESP_CTX *ctx); 560 int TS_CONF_set_clock_precision_digits(CONF *conf, const char *section, 561 TS_RESP_CTX *ctx); 562 int TS_CONF_set_ordering(CONF *conf, const char *section, TS_RESP_CTX *ctx); 563 int TS_CONF_set_tsa_name(CONF *conf, const char *section, TS_RESP_CTX *ctx); 564 int TS_CONF_set_ess_cert_id_chain(CONF *conf, const char *section, 565 TS_RESP_CTX *ctx); 566 567 void ERR_load_TS_strings(void); 568 569 /* Error codes for the TS functions. */ 570 571 /* Function codes. */ 572 #define TS_F_D2I_TS_RESP 147 573 #define TS_F_DEF_SERIAL_CB 110 574 #define TS_F_DEF_TIME_CB 111 575 #define TS_F_ESS_ADD_SIGNING_CERT 112 576 #define TS_F_ESS_CERT_ID_NEW_INIT 113 577 #define TS_F_ESS_SIGNING_CERT_NEW_INIT 114 578 #define TS_F_INT_TS_RESP_VERIFY_TOKEN 149 579 #define TS_F_PKCS7_TO_TS_TST_INFO 148 580 #define TS_F_TS_ACCURACY_SET_MICROS 115 581 #define TS_F_TS_ACCURACY_SET_MILLIS 116 582 #define TS_F_TS_ACCURACY_SET_SECONDS 117 583 #define TS_F_TS_CHECK_IMPRINTS 100 584 #define TS_F_TS_CHECK_NONCES 101 585 #define TS_F_TS_CHECK_POLICY 102 586 #define TS_F_TS_CHECK_SIGNING_CERTS 103 587 #define TS_F_TS_CHECK_STATUS_INFO 104 588 #define TS_F_TS_COMPUTE_IMPRINT 145 589 #define TS_F_TS_CONF_SET_DEFAULT_ENGINE 146 590 #define TS_F_TS_GET_STATUS_TEXT 105 591 #define TS_F_TS_MSG_IMPRINT_SET_ALGO 118 592 #define TS_F_TS_REQ_SET_MSG_IMPRINT 119 593 #define TS_F_TS_REQ_SET_NONCE 120 594 #define TS_F_TS_REQ_SET_POLICY_ID 121 595 #define TS_F_TS_RESP_CREATE_RESPONSE 122 596 #define TS_F_TS_RESP_CREATE_TST_INFO 123 597 #define TS_F_TS_RESP_CTX_ADD_FAILURE_INFO 124 598 #define TS_F_TS_RESP_CTX_ADD_MD 125 599 #define TS_F_TS_RESP_CTX_ADD_POLICY 126 600 #define TS_F_TS_RESP_CTX_NEW 127 601 #define TS_F_TS_RESP_CTX_SET_ACCURACY 128 602 #define TS_F_TS_RESP_CTX_SET_CERTS 129 603 #define TS_F_TS_RESP_CTX_SET_DEF_POLICY 130 604 #define TS_F_TS_RESP_CTX_SET_SIGNER_CERT 131 605 #define TS_F_TS_RESP_CTX_SET_STATUS_INFO 132 606 #define TS_F_TS_RESP_GET_POLICY 133 607 #define TS_F_TS_RESP_SET_GENTIME_WITH_PRECISION 134 608 #define TS_F_TS_RESP_SET_STATUS_INFO 135 609 #define TS_F_TS_RESP_SET_TST_INFO 150 610 #define TS_F_TS_RESP_SIGN 136 611 #define TS_F_TS_RESP_VERIFY_SIGNATURE 106 612 #define TS_F_TS_RESP_VERIFY_TOKEN 107 613 #define TS_F_TS_TST_INFO_SET_ACCURACY 137 614 #define TS_F_TS_TST_INFO_SET_MSG_IMPRINT 138 615 #define TS_F_TS_TST_INFO_SET_NONCE 139 616 #define TS_F_TS_TST_INFO_SET_POLICY_ID 140 617 #define TS_F_TS_TST_INFO_SET_SERIAL 141 618 #define TS_F_TS_TST_INFO_SET_TIME 142 619 #define TS_F_TS_TST_INFO_SET_TSA 143 620 #define TS_F_TS_VERIFY 108 621 #define TS_F_TS_VERIFY_CERT 109 622 #define TS_F_TS_VERIFY_CTX_NEW 144 623 624 /* Reason codes. */ 625 #define TS_R_BAD_PKCS7_TYPE 132 626 #define TS_R_BAD_TYPE 133 627 #define TS_R_CERTIFICATE_VERIFY_ERROR 100 628 #define TS_R_COULD_NOT_SET_ENGINE 127 629 #define TS_R_COULD_NOT_SET_TIME 115 630 #define TS_R_D2I_TS_RESP_INT_FAILED 128 631 #define TS_R_DETACHED_CONTENT 134 632 #define TS_R_ESS_ADD_SIGNING_CERT_ERROR 116 633 #define TS_R_ESS_SIGNING_CERTIFICATE_ERROR 101 634 #define TS_R_INVALID_NULL_POINTER 102 635 #define TS_R_INVALID_SIGNER_CERTIFICATE_PURPOSE 117 636 #define TS_R_MESSAGE_IMPRINT_MISMATCH 103 637 #define TS_R_NONCE_MISMATCH 104 638 #define TS_R_NONCE_NOT_RETURNED 105 639 #define TS_R_NO_CONTENT 106 640 #define TS_R_NO_TIME_STAMP_TOKEN 107 641 #define TS_R_PKCS7_ADD_SIGNATURE_ERROR 118 642 #define TS_R_PKCS7_ADD_SIGNED_ATTR_ERROR 119 643 #define TS_R_PKCS7_TO_TS_TST_INFO_FAILED 129 644 #define TS_R_POLICY_MISMATCH 108 645 #define TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE 120 646 #define TS_R_RESPONSE_SETUP_ERROR 121 647 #define TS_R_SIGNATURE_FAILURE 109 648 #define TS_R_THERE_MUST_BE_ONE_SIGNER 110 649 #define TS_R_TIME_SYSCALL_ERROR 122 650 #define TS_R_TOKEN_NOT_PRESENT 130 651 #define TS_R_TOKEN_PRESENT 131 652 #define TS_R_TSA_NAME_MISMATCH 111 653 #define TS_R_TSA_UNTRUSTED 112 654 #define TS_R_TST_INFO_SETUP_ERROR 123 655 #define TS_R_TS_DATASIGN 124 656 #define TS_R_UNACCEPTABLE_POLICY 125 657 #define TS_R_UNSUPPORTED_MD_ALGORITHM 126 658 #define TS_R_UNSUPPORTED_VERSION 113 659 #define TS_R_WRONG_CONTENT_TYPE 114 660 661 #ifdef __cplusplus 662 } 663 #endif 664 #endif 665