ts.h revision 1.2
1/* crypto/ts/ts.h */ 2/* Written by Zoltan Glozik (zglozik@opentsa.org) for the OpenSSL 3 * project 2002, 2003, 2004. 4 */ 5/* ==================================================================== 6 * Copyright (c) 2006 The OpenSSL Project. All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in 17 * the documentation and/or other materials provided with the 18 * distribution. 19 * 20 * 3. All advertising materials mentioning features or use of this 21 * software must display the following acknowledgment: 22 * "This product includes software developed by the OpenSSL Project 23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" 24 * 25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 26 * endorse or promote products derived from this software without 27 * prior written permission. For written permission, please contact 28 * licensing@OpenSSL.org. 29 * 30 * 5. Products derived from this software may not be called "OpenSSL" 31 * nor may "OpenSSL" appear in their names without prior written 32 * permission of the OpenSSL Project. 33 * 34 * 6. Redistributions of any form whatsoever must retain the following 35 * acknowledgment: 36 * "This product includes software developed by the OpenSSL Project 37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" 38 * 39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 50 * OF THE POSSIBILITY OF SUCH DAMAGE. 51 * ==================================================================== 52 * 53 * This product includes cryptographic software written by Eric Young 54 * (eay@cryptsoft.com). This product includes software written by Tim 55 * Hudson (tjh@cryptsoft.com). 56 * 57 */ 58 59#ifndef HEADER_TS_H 60#define HEADER_TS_H 61 62#include <openssl/opensslconf.h> 63#ifndef OPENSSL_NO_BUFFER 64#include <openssl/buffer.h> 65#endif 66#ifndef OPENSSL_NO_EVP 67#include <openssl/evp.h> 68#endif 69#ifndef OPENSSL_NO_BIO 70#include <openssl/bio.h> 71#endif 72#include <openssl/stack.h> 73#include <openssl/asn1.h> 74#include <openssl/safestack.h> 75 76#ifndef OPENSSL_NO_RSA 77#include <openssl/rsa.h> 78#endif 79 80#ifndef OPENSSL_NO_DSA 81#include <openssl/dsa.h> 82#endif 83 84#ifndef OPENSSL_NO_DH 85#include <openssl/dh.h> 86#endif 87 88#ifdef __cplusplus 89extern "C" { 90#endif 91 92#ifdef WIN32 93/* Under Win32 this is defined in wincrypt.h */ 94#undef X509_NAME 95#endif 96 97#include <openssl/x509.h> 98#include <openssl/x509v3.h> 99 100/* 101MessageImprint ::= SEQUENCE { 102 hashAlgorithm AlgorithmIdentifier, 103 hashedMessage OCTET STRING } 104*/ 105 106typedef struct TS_msg_imprint_st 107 { 108 X509_ALGOR *hash_algo; 109 ASN1_OCTET_STRING *hashed_msg; 110 } TS_MSG_IMPRINT; 111 112/* 113TimeStampReq ::= SEQUENCE { 114 version INTEGER { v1(1) }, 115 messageImprint MessageImprint, 116 --a hash algorithm OID and the hash value of the data to be 117 --time-stamped 118 reqPolicy TSAPolicyId OPTIONAL, 119 nonce INTEGER OPTIONAL, 120 certReq BOOLEAN DEFAULT FALSE, 121 extensions [0] IMPLICIT Extensions OPTIONAL } 122*/ 123 124typedef struct TS_req_st 125 { 126 ASN1_INTEGER *version; 127 TS_MSG_IMPRINT *msg_imprint; 128 ASN1_OBJECT *policy_id; /* OPTIONAL */ 129 ASN1_INTEGER *nonce; /* OPTIONAL */ 130 ASN1_BOOLEAN cert_req; /* DEFAULT FALSE */ 131 STACK_OF(X509_EXTENSION) *extensions; /* [0] OPTIONAL */ 132 } TS_REQ; 133 134/* 135Accuracy ::= SEQUENCE { 136 seconds INTEGER OPTIONAL, 137 millis [0] INTEGER (1..999) OPTIONAL, 138 micros [1] INTEGER (1..999) OPTIONAL } 139*/ 140 141typedef struct TS_accuracy_st 142 { 143 ASN1_INTEGER *seconds; 144 ASN1_INTEGER *millis; 145 ASN1_INTEGER *micros; 146 } TS_ACCURACY; 147 148/* 149TSTInfo ::= SEQUENCE { 150 version INTEGER { v1(1) }, 151 policy TSAPolicyId, 152 messageImprint MessageImprint, 153 -- MUST have the same value as the similar field in 154 -- TimeStampReq 155 serialNumber INTEGER, 156 -- Time-Stamping users MUST be ready to accommodate integers 157 -- up to 160 bits. 158 genTime GeneralizedTime, 159 accuracy Accuracy OPTIONAL, 160 ordering BOOLEAN DEFAULT FALSE, 161 nonce INTEGER OPTIONAL, 162 -- MUST be present if the similar field was present 163 -- in TimeStampReq. In that case it MUST have the same value. 164 tsa [0] GeneralName OPTIONAL, 165 extensions [1] IMPLICIT Extensions OPTIONAL } 166*/ 167 168typedef struct TS_tst_info_st 169 { 170 ASN1_INTEGER *version; 171 ASN1_OBJECT *policy_id; 172 TS_MSG_IMPRINT *msg_imprint; 173 ASN1_INTEGER *serial; 174 ASN1_GENERALIZEDTIME *time; 175 TS_ACCURACY *accuracy; 176 ASN1_BOOLEAN ordering; 177 ASN1_INTEGER *nonce; 178 GENERAL_NAME *tsa; 179 STACK_OF(X509_EXTENSION) *extensions; 180 } TS_TST_INFO; 181 182/* 183PKIStatusInfo ::= SEQUENCE { 184 status PKIStatus, 185 statusString PKIFreeText OPTIONAL, 186 failInfo PKIFailureInfo OPTIONAL } 187 188From RFC 1510 - section 3.1.1: 189PKIFreeText ::= SEQUENCE SIZE (1..MAX) OF UTF8String 190 -- text encoded as UTF-8 String (note: each UTF8String SHOULD 191 -- include an RFC 1766 language tag to indicate the language 192 -- of the contained text) 193*/ 194 195/* Possible values for status. See ts_resp_print.c && ts_resp_verify.c. */ 196 197#define TS_STATUS_GRANTED 0 198#define TS_STATUS_GRANTED_WITH_MODS 1 199#define TS_STATUS_REJECTION 2 200#define TS_STATUS_WAITING 3 201#define TS_STATUS_REVOCATION_WARNING 4 202#define TS_STATUS_REVOCATION_NOTIFICATION 5 203 204/* Possible values for failure_info. See ts_resp_print.c && ts_resp_verify.c */ 205 206#define TS_INFO_BAD_ALG 0 207#define TS_INFO_BAD_REQUEST 2 208#define TS_INFO_BAD_DATA_FORMAT 5 209#define TS_INFO_TIME_NOT_AVAILABLE 14 210#define TS_INFO_UNACCEPTED_POLICY 15 211#define TS_INFO_UNACCEPTED_EXTENSION 16 212#define TS_INFO_ADD_INFO_NOT_AVAILABLE 17 213#define TS_INFO_SYSTEM_FAILURE 25 214 215typedef struct TS_status_info_st 216 { 217 ASN1_INTEGER *status; 218 STACK_OF(ASN1_UTF8STRING) *text; 219 ASN1_BIT_STRING *failure_info; 220 } TS_STATUS_INFO; 221 222DECLARE_STACK_OF(ASN1_UTF8STRING) 223DECLARE_ASN1_SET_OF(ASN1_UTF8STRING) 224 225/* 226TimeStampResp ::= SEQUENCE { 227 status PKIStatusInfo, 228 timeStampToken TimeStampToken OPTIONAL } 229*/ 230 231typedef struct TS_resp_st 232 { 233 TS_STATUS_INFO *status_info; 234 PKCS7 *token; 235 TS_TST_INFO *tst_info; 236 } TS_RESP; 237 238/* The structure below would belong to the ESS component. */ 239 240/* 241IssuerSerial ::= SEQUENCE { 242 issuer GeneralNames, 243 serialNumber CertificateSerialNumber 244 } 245*/ 246 247typedef struct ESS_issuer_serial 248 { 249 STACK_OF(GENERAL_NAME) *issuer; 250 ASN1_INTEGER *serial; 251 } ESS_ISSUER_SERIAL; 252 253/* 254ESSCertID ::= SEQUENCE { 255 certHash Hash, 256 issuerSerial IssuerSerial OPTIONAL 257} 258*/ 259 260typedef struct ESS_cert_id 261 { 262 ASN1_OCTET_STRING *hash; /* Always SHA-1 digest. */ 263 ESS_ISSUER_SERIAL *issuer_serial; 264 } ESS_CERT_ID; 265 266DECLARE_STACK_OF(ESS_CERT_ID) 267DECLARE_ASN1_SET_OF(ESS_CERT_ID) 268 269/* 270SigningCertificate ::= SEQUENCE { 271 certs SEQUENCE OF ESSCertID, 272 policies SEQUENCE OF PolicyInformation OPTIONAL 273} 274*/ 275 276typedef struct ESS_signing_cert 277 { 278 STACK_OF(ESS_CERT_ID) *cert_ids; 279 STACK_OF(POLICYINFO) *policy_info; 280 } ESS_SIGNING_CERT; 281 282 283TS_REQ *TS_REQ_new(void); 284void TS_REQ_free(TS_REQ *a); 285int i2d_TS_REQ(const TS_REQ *a, unsigned char **pp); 286TS_REQ *d2i_TS_REQ(TS_REQ **a, const unsigned char **pp, long length); 287 288TS_REQ *TS_REQ_dup(TS_REQ *a); 289 290TS_REQ *d2i_TS_REQ_fp(FILE *fp, TS_REQ **a); 291int i2d_TS_REQ_fp(FILE *fp, TS_REQ *a); 292TS_REQ *d2i_TS_REQ_bio(BIO *fp, TS_REQ **a); 293int i2d_TS_REQ_bio(BIO *fp, TS_REQ *a); 294 295TS_MSG_IMPRINT *TS_MSG_IMPRINT_new(void); 296void TS_MSG_IMPRINT_free(TS_MSG_IMPRINT *a); 297int i2d_TS_MSG_IMPRINT(const TS_MSG_IMPRINT *a, unsigned char **pp); 298TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT(TS_MSG_IMPRINT **a, 299 const unsigned char **pp, long length); 300 301TS_MSG_IMPRINT *TS_MSG_IMPRINT_dup(TS_MSG_IMPRINT *a); 302 303TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT **a); 304int i2d_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT *a); 305TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_bio(BIO *fp, TS_MSG_IMPRINT **a); 306int i2d_TS_MSG_IMPRINT_bio(BIO *fp, TS_MSG_IMPRINT *a); 307 308TS_RESP *TS_RESP_new(void); 309void TS_RESP_free(TS_RESP *a); 310int i2d_TS_RESP(const TS_RESP *a, unsigned char **pp); 311TS_RESP *d2i_TS_RESP(TS_RESP **a, const unsigned char **pp, long length); 312TS_TST_INFO *PKCS7_to_TS_TST_INFO(PKCS7 *token); 313TS_RESP *TS_RESP_dup(TS_RESP *a); 314 315TS_RESP *d2i_TS_RESP_fp(FILE *fp, TS_RESP **a); 316int i2d_TS_RESP_fp(FILE *fp, TS_RESP *a); 317TS_RESP *d2i_TS_RESP_bio(BIO *fp, TS_RESP **a); 318int i2d_TS_RESP_bio(BIO *fp, TS_RESP *a); 319 320TS_STATUS_INFO *TS_STATUS_INFO_new(void); 321void TS_STATUS_INFO_free(TS_STATUS_INFO *a); 322int i2d_TS_STATUS_INFO(const TS_STATUS_INFO *a, unsigned char **pp); 323TS_STATUS_INFO *d2i_TS_STATUS_INFO(TS_STATUS_INFO **a, 324 const unsigned char **pp, long length); 325TS_STATUS_INFO *TS_STATUS_INFO_dup(TS_STATUS_INFO *a); 326 327TS_TST_INFO *TS_TST_INFO_new(void); 328void TS_TST_INFO_free(TS_TST_INFO *a); 329int i2d_TS_TST_INFO(const TS_TST_INFO *a, unsigned char **pp); 330TS_TST_INFO *d2i_TS_TST_INFO(TS_TST_INFO **a, const unsigned char **pp, 331 long length); 332TS_TST_INFO *TS_TST_INFO_dup(TS_TST_INFO *a); 333 334TS_TST_INFO *d2i_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO **a); 335int i2d_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO *a); 336TS_TST_INFO *d2i_TS_TST_INFO_bio(BIO *fp, TS_TST_INFO **a); 337int i2d_TS_TST_INFO_bio(BIO *fp, TS_TST_INFO *a); 338 339TS_ACCURACY *TS_ACCURACY_new(void); 340void TS_ACCURACY_free(TS_ACCURACY *a); 341int i2d_TS_ACCURACY(const TS_ACCURACY *a, unsigned char **pp); 342TS_ACCURACY *d2i_TS_ACCURACY(TS_ACCURACY **a, const unsigned char **pp, 343 long length); 344TS_ACCURACY *TS_ACCURACY_dup(TS_ACCURACY *a); 345 346ESS_ISSUER_SERIAL *ESS_ISSUER_SERIAL_new(void); 347void ESS_ISSUER_SERIAL_free(ESS_ISSUER_SERIAL *a); 348int i2d_ESS_ISSUER_SERIAL(const ESS_ISSUER_SERIAL *a, 349 unsigned char **pp); 350ESS_ISSUER_SERIAL *d2i_ESS_ISSUER_SERIAL(ESS_ISSUER_SERIAL **a, 351 const unsigned char **pp, long length); 352ESS_ISSUER_SERIAL *ESS_ISSUER_SERIAL_dup(ESS_ISSUER_SERIAL *a); 353 354ESS_CERT_ID *ESS_CERT_ID_new(void); 355void ESS_CERT_ID_free(ESS_CERT_ID *a); 356int i2d_ESS_CERT_ID(const ESS_CERT_ID *a, unsigned char **pp); 357ESS_CERT_ID *d2i_ESS_CERT_ID(ESS_CERT_ID **a, const unsigned char **pp, 358 long length); 359ESS_CERT_ID *ESS_CERT_ID_dup(ESS_CERT_ID *a); 360 361ESS_SIGNING_CERT *ESS_SIGNING_CERT_new(void); 362void ESS_SIGNING_CERT_free(ESS_SIGNING_CERT *a); 363int i2d_ESS_SIGNING_CERT(const ESS_SIGNING_CERT *a, 364 unsigned char **pp); 365ESS_SIGNING_CERT *d2i_ESS_SIGNING_CERT(ESS_SIGNING_CERT **a, 366 const unsigned char **pp, long length); 367ESS_SIGNING_CERT *ESS_SIGNING_CERT_dup(ESS_SIGNING_CERT *a); 368 369void ERR_load_TS_strings(void); 370 371int TS_REQ_set_version(TS_REQ *a, long version); 372long TS_REQ_get_version(const TS_REQ *a); 373 374int TS_REQ_set_msg_imprint(TS_REQ *a, TS_MSG_IMPRINT *msg_imprint); 375TS_MSG_IMPRINT *TS_REQ_get_msg_imprint(TS_REQ *a); 376 377int TS_MSG_IMPRINT_set_algo(TS_MSG_IMPRINT *a, X509_ALGOR *alg); 378X509_ALGOR *TS_MSG_IMPRINT_get_algo(TS_MSG_IMPRINT *a); 379 380int TS_MSG_IMPRINT_set_msg(TS_MSG_IMPRINT *a, unsigned char *d, int len); 381ASN1_OCTET_STRING *TS_MSG_IMPRINT_get_msg(TS_MSG_IMPRINT *a); 382 383int TS_REQ_set_policy_id(TS_REQ *a, ASN1_OBJECT *policy); 384ASN1_OBJECT *TS_REQ_get_policy_id(TS_REQ *a); 385 386int TS_REQ_set_nonce(TS_REQ *a, const ASN1_INTEGER *nonce); 387const ASN1_INTEGER *TS_REQ_get_nonce(const TS_REQ *a); 388 389int TS_REQ_set_cert_req(TS_REQ *a, int cert_req); 390int TS_REQ_get_cert_req(const TS_REQ *a); 391 392STACK_OF(X509_EXTENSION) *TS_REQ_get_exts(TS_REQ *a); 393void TS_REQ_ext_free(TS_REQ *a); 394int TS_REQ_get_ext_count(TS_REQ *a); 395int TS_REQ_get_ext_by_NID(TS_REQ *a, int nid, int lastpos); 396int TS_REQ_get_ext_by_OBJ(TS_REQ *a, ASN1_OBJECT *obj, int lastpos); 397int TS_REQ_get_ext_by_critical(TS_REQ *a, int crit, int lastpos); 398X509_EXTENSION *TS_REQ_get_ext(TS_REQ *a, int loc); 399X509_EXTENSION *TS_REQ_delete_ext(TS_REQ *a, int loc); 400int TS_REQ_add_ext(TS_REQ *a, X509_EXTENSION *ex, int loc); 401void *TS_REQ_get_ext_d2i(TS_REQ *a, int nid, int *crit, int *idx); 402 403/* Function declarations for TS_REQ defined in ts/ts_req_print.c */ 404 405int TS_REQ_print_bio(BIO *bio, TS_REQ *a); 406 407/* Function declarations for TS_RESP defined in ts/ts_resp_utils.c */ 408 409int TS_RESP_set_status_info(TS_RESP *a, TS_STATUS_INFO *info); 410TS_STATUS_INFO *TS_RESP_get_status_info(TS_RESP *a); 411 412/* Caller loses ownership of PKCS7 and TS_TST_INFO objects. */ 413void TS_RESP_set_tst_info(TS_RESP *a, PKCS7 *p7, TS_TST_INFO *tst_info); 414PKCS7 *TS_RESP_get_token(TS_RESP *a); 415TS_TST_INFO *TS_RESP_get_tst_info(TS_RESP *a); 416 417int TS_TST_INFO_set_version(TS_TST_INFO *a, long version); 418long TS_TST_INFO_get_version(const TS_TST_INFO *a); 419 420int TS_TST_INFO_set_policy_id(TS_TST_INFO *a, ASN1_OBJECT *policy_id); 421ASN1_OBJECT *TS_TST_INFO_get_policy_id(TS_TST_INFO *a); 422 423int TS_TST_INFO_set_msg_imprint(TS_TST_INFO *a, TS_MSG_IMPRINT *msg_imprint); 424TS_MSG_IMPRINT *TS_TST_INFO_get_msg_imprint(TS_TST_INFO *a); 425 426int TS_TST_INFO_set_serial(TS_TST_INFO *a, const ASN1_INTEGER *serial); 427const ASN1_INTEGER *TS_TST_INFO_get_serial(const TS_TST_INFO *a); 428 429int TS_TST_INFO_set_time(TS_TST_INFO *a, const ASN1_GENERALIZEDTIME *gtime); 430const ASN1_GENERALIZEDTIME *TS_TST_INFO_get_time(const TS_TST_INFO *a); 431 432int TS_TST_INFO_set_accuracy(TS_TST_INFO *a, TS_ACCURACY *accuracy); 433TS_ACCURACY *TS_TST_INFO_get_accuracy(TS_TST_INFO *a); 434 435int TS_ACCURACY_set_seconds(TS_ACCURACY *a, const ASN1_INTEGER *seconds); 436const ASN1_INTEGER *TS_ACCURACY_get_seconds(const TS_ACCURACY *a); 437 438int TS_ACCURACY_set_millis(TS_ACCURACY *a, const ASN1_INTEGER *millis); 439const ASN1_INTEGER *TS_ACCURACY_get_millis(const TS_ACCURACY *a); 440 441int TS_ACCURACY_set_micros(TS_ACCURACY *a, const ASN1_INTEGER *micros); 442const ASN1_INTEGER *TS_ACCURACY_get_micros(const TS_ACCURACY *a); 443 444int TS_TST_INFO_set_ordering(TS_TST_INFO *a, int ordering); 445int TS_TST_INFO_get_ordering(const TS_TST_INFO *a); 446 447int TS_TST_INFO_set_nonce(TS_TST_INFO *a, const ASN1_INTEGER *nonce); 448const ASN1_INTEGER *TS_TST_INFO_get_nonce(const TS_TST_INFO *a); 449 450int TS_TST_INFO_set_tsa(TS_TST_INFO *a, GENERAL_NAME *tsa); 451GENERAL_NAME *TS_TST_INFO_get_tsa(TS_TST_INFO *a); 452 453STACK_OF(X509_EXTENSION) *TS_TST_INFO_get_exts(TS_TST_INFO *a); 454void TS_TST_INFO_ext_free(TS_TST_INFO *a); 455int TS_TST_INFO_get_ext_count(TS_TST_INFO *a); 456int TS_TST_INFO_get_ext_by_NID(TS_TST_INFO *a, int nid, int lastpos); 457int TS_TST_INFO_get_ext_by_OBJ(TS_TST_INFO *a, ASN1_OBJECT *obj, int lastpos); 458int TS_TST_INFO_get_ext_by_critical(TS_TST_INFO *a, int crit, int lastpos); 459X509_EXTENSION *TS_TST_INFO_get_ext(TS_TST_INFO *a, int loc); 460X509_EXTENSION *TS_TST_INFO_delete_ext(TS_TST_INFO *a, int loc); 461int TS_TST_INFO_add_ext(TS_TST_INFO *a, X509_EXTENSION *ex, int loc); 462void *TS_TST_INFO_get_ext_d2i(TS_TST_INFO *a, int nid, int *crit, int *idx); 463 464/* Declarations related to response generation, defined in ts/ts_resp_sign.c. */ 465 466/* Optional flags for response generation. */ 467 468/* Don't include the TSA name in response. */ 469#define TS_TSA_NAME 0x01 470 471/* Set ordering to true in response. */ 472#define TS_ORDERING 0x02 473 474/* 475 * Include the signer certificate and the other specified certificates in 476 * the ESS signing certificate attribute beside the PKCS7 signed data. 477 * Only the signer certificates is included by default. 478 */ 479#define TS_ESS_CERT_ID_CHAIN 0x04 480 481/* Forward declaration. */ 482struct TS_resp_ctx; 483 484/* This must return a unique number less than 160 bits long. */ 485typedef ASN1_INTEGER *(*TS_serial_cb)(struct TS_resp_ctx *, void *); 486 487/* This must return the seconds and microseconds since Jan 1, 1970 in 488 the sec and usec variables allocated by the caller. 489 Return non-zero for success and zero for failure. */ 490typedef int (*TS_time_cb)(struct TS_resp_ctx *, void *, long *sec, long *usec); 491 492/* This must process the given extension. 493 * It can modify the TS_TST_INFO object of the context. 494 * Return values: !0 (processed), 0 (error, it must set the 495 * status info/failure info of the response). 496 */ 497typedef int (*TS_extension_cb)(struct TS_resp_ctx *, X509_EXTENSION *, void *); 498 499typedef struct TS_resp_ctx 500 { 501 X509 *signer_cert; 502 EVP_PKEY *signer_key; 503 STACK_OF(X509) *certs; /* Certs to include in signed data. */ 504 STACK_OF(ASN1_OBJECT) *policies; /* Acceptable policies. */ 505 ASN1_OBJECT *default_policy; /* It may appear in policies, too. */ 506 STACK_OF(EVP_MD) *mds; /* Acceptable message digests. */ 507 ASN1_INTEGER *seconds; /* accuracy, 0 means not specified. */ 508 ASN1_INTEGER *millis; /* accuracy, 0 means not specified. */ 509 ASN1_INTEGER *micros; /* accuracy, 0 means not specified. */ 510 unsigned clock_precision_digits; /* fraction of seconds in 511 time stamp token. */ 512 unsigned flags; /* Optional info, see values above. */ 513 514 /* Callback functions. */ 515 TS_serial_cb serial_cb; 516 void *serial_cb_data; /* User data for serial_cb. */ 517 518 TS_time_cb time_cb; 519 void *time_cb_data; /* User data for time_cb. */ 520 521 TS_extension_cb extension_cb; 522 void *extension_cb_data; /* User data for extension_cb. */ 523 524 /* These members are used only while creating the response. */ 525 TS_REQ *request; 526 TS_RESP *response; 527 TS_TST_INFO *tst_info; 528 } TS_RESP_CTX; 529 530DECLARE_STACK_OF(EVP_MD) 531DECLARE_ASN1_SET_OF(EVP_MD) 532 533/* Creates a response context that can be used for generating responses. */ 534TS_RESP_CTX *TS_RESP_CTX_new(void); 535void TS_RESP_CTX_free(TS_RESP_CTX *ctx); 536 537/* This parameter must be set. */ 538int TS_RESP_CTX_set_signer_cert(TS_RESP_CTX *ctx, X509 *signer); 539 540/* This parameter must be set. */ 541int TS_RESP_CTX_set_signer_key(TS_RESP_CTX *ctx, EVP_PKEY *key); 542 543/* This parameter must be set. */ 544int TS_RESP_CTX_set_def_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *def_policy); 545 546/* No additional certs are included in the response by default. */ 547int TS_RESP_CTX_set_certs(TS_RESP_CTX *ctx, STACK_OF(X509) *certs); 548 549/* Adds a new acceptable policy, only the default policy 550 is accepted by default. */ 551int TS_RESP_CTX_add_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *policy); 552 553/* Adds a new acceptable message digest. Note that no message digests 554 are accepted by default. The md argument is shared with the caller. */ 555int TS_RESP_CTX_add_md(TS_RESP_CTX *ctx, const EVP_MD *md); 556 557/* Accuracy is not included by default. */ 558int TS_RESP_CTX_set_accuracy(TS_RESP_CTX *ctx, 559 int secs, int millis, int micros); 560 561/* Clock precision digits, i.e. the number of decimal digits: 562 '0' means sec, '3' msec, '6' usec, and so on. Default is 0. */ 563int TS_RESP_CTX_set_clock_precision_digits(TS_RESP_CTX *ctx, 564 unsigned clock_precision_digits); 565/* At most we accept usec precision. */ 566#define TS_MAX_CLOCK_PRECISION_DIGITS 6 567 568/* No flags are set by default. */ 569void TS_RESP_CTX_add_flags(TS_RESP_CTX *ctx, int flags); 570 571/* Default callback always returns a constant. */ 572void TS_RESP_CTX_set_serial_cb(TS_RESP_CTX *ctx, TS_serial_cb cb, void *data); 573 574/* Default callback uses the gettimeofday() and gmtime() system calls. */ 575void TS_RESP_CTX_set_time_cb(TS_RESP_CTX *ctx, TS_time_cb cb, void *data); 576 577/* Default callback rejects all extensions. The extension callback is called 578 * when the TS_TST_INFO object is already set up and not signed yet. */ 579/* FIXME: extension handling is not tested yet. */ 580void TS_RESP_CTX_set_extension_cb(TS_RESP_CTX *ctx, 581 TS_extension_cb cb, void *data); 582 583/* The following methods can be used in the callbacks. */ 584int TS_RESP_CTX_set_status_info(TS_RESP_CTX *ctx, 585 int status, const char *text); 586 587/* Sets the status info only if it is still TS_STATUS_GRANTED. */ 588int TS_RESP_CTX_set_status_info_cond(TS_RESP_CTX *ctx, 589 int status, const char *text); 590 591int TS_RESP_CTX_add_failure_info(TS_RESP_CTX *ctx, int failure); 592 593/* The get methods below can be used in the extension callback. */ 594TS_REQ *TS_RESP_CTX_get_request(TS_RESP_CTX *ctx); 595 596TS_TST_INFO *TS_RESP_CTX_get_tst_info(TS_RESP_CTX *ctx); 597 598/* 599 * Creates the signed TS_TST_INFO and puts it in TS_RESP. 600 * In case of errors it sets the status info properly. 601 * Returns NULL only in case of memory allocation/fatal error. 602 */ 603TS_RESP *TS_RESP_create_response(TS_RESP_CTX *ctx, BIO *req_bio); 604 605/* 606 * Declarations related to response verification, 607 * they are defined in ts/ts_resp_verify.c. 608 */ 609 610int TS_RESP_verify_signature(PKCS7 *token, STACK_OF(X509) *certs, 611 X509_STORE *store, X509 **signer_out); 612 613/* Context structure for the generic verify method. */ 614 615/* Verify the signer's certificate and the signature of the response. */ 616#define TS_VFY_SIGNATURE (1u << 0) 617/* Verify the version number of the response. */ 618#define TS_VFY_VERSION (1u << 1) 619/* Verify if the policy supplied by the user matches the policy of the TSA. */ 620#define TS_VFY_POLICY (1u << 2) 621/* Verify the message imprint provided by the user. This flag should not be 622 specified with TS_VFY_DATA. */ 623#define TS_VFY_IMPRINT (1u << 3) 624/* Verify the message imprint computed by the verify method from the user 625 provided data and the MD algorithm of the response. This flag should not be 626 specified with TS_VFY_IMPRINT. */ 627#define TS_VFY_DATA (1u << 4) 628/* Verify the nonce value. */ 629#define TS_VFY_NONCE (1u << 5) 630/* Verify if the TSA name field matches the signer certificate. */ 631#define TS_VFY_SIGNER (1u << 6) 632/* Verify if the TSA name field equals to the user provided name. */ 633#define TS_VFY_TSA_NAME (1u << 7) 634 635/* You can use the following convenience constants. */ 636#define TS_VFY_ALL_IMPRINT (TS_VFY_SIGNATURE \ 637 | TS_VFY_VERSION \ 638 | TS_VFY_POLICY \ 639 | TS_VFY_IMPRINT \ 640 | TS_VFY_NONCE \ 641 | TS_VFY_SIGNER \ 642 | TS_VFY_TSA_NAME) 643#define TS_VFY_ALL_DATA (TS_VFY_SIGNATURE \ 644 | TS_VFY_VERSION \ 645 | TS_VFY_POLICY \ 646 | TS_VFY_DATA \ 647 | TS_VFY_NONCE \ 648 | TS_VFY_SIGNER \ 649 | TS_VFY_TSA_NAME) 650 651typedef struct TS_verify_ctx 652 { 653 /* Set this to the union of TS_VFY_... flags you want to carry out. */ 654 unsigned flags; 655 656 /* Must be set only with TS_VFY_SIGNATURE. certs is optional. */ 657 X509_STORE *store; 658 STACK_OF(X509) *certs; 659 660 /* Must be set only with TS_VFY_POLICY. */ 661 ASN1_OBJECT *policy; 662 663 /* Must be set only with TS_VFY_IMPRINT. If md_alg is NULL, 664 the algorithm from the response is used. */ 665 X509_ALGOR *md_alg; 666 unsigned char *imprint; 667 unsigned imprint_len; 668 669 /* Must be set only with TS_VFY_DATA. */ 670 BIO *data; 671 672 /* Must be set only with TS_VFY_TSA_NAME. */ 673 ASN1_INTEGER *nonce; 674 675 /* Must be set only with TS_VFY_TSA_NAME. */ 676 GENERAL_NAME *tsa_name; 677 } TS_VERIFY_CTX; 678 679int TS_RESP_verify_response(TS_VERIFY_CTX *ctx, TS_RESP *response); 680int TS_RESP_verify_token(TS_VERIFY_CTX *ctx, PKCS7 *token); 681 682/* 683 * Declarations related to response verification context, 684 * they are defined in ts/ts_verify_ctx.c. 685 */ 686 687/* Set all fields to zero. */ 688TS_VERIFY_CTX *TS_VERIFY_CTX_new(void); 689void TS_VERIFY_CTX_init(TS_VERIFY_CTX *ctx); 690void TS_VERIFY_CTX_free(TS_VERIFY_CTX *ctx); 691void TS_VERIFY_CTX_cleanup(TS_VERIFY_CTX *ctx); 692 693/* 694 * If ctx is NULL, it allocates and returns a new object, otherwise 695 * it returns ctx. It initialises all the members as follows: 696 * flags = TS_VFY_ALL_IMPRINT & ~(TS_VFY_TSA_NAME | TS_VFY_SIGNATURE) 697 * certs = NULL 698 * store = NULL 699 * policy = policy from the request or NULL if absent (in this case 700 * TS_VFY_POLICY is cleared from flags as well) 701 * md_alg = MD algorithm from request 702 * imprint, imprint_len = imprint from request 703 * data = NULL 704 * nonce, nonce_len = nonce from the request or NULL if absent (in this case 705 * TS_VFY_NONCE is cleared from flags as well) 706 * tsa_name = NULL 707 * Important: after calling this method TS_VFY_SIGNATURE should be added! 708 */ 709TS_VERIFY_CTX *TS_REQ_to_TS_VERIFY_CTX(TS_REQ *req, TS_VERIFY_CTX *ctx); 710 711/* Function declarations for TS_RESP defined in ts/ts_resp_print.c */ 712 713int TS_RESP_print_bio(BIO *bio, TS_RESP *a); 714int TS_STATUS_INFO_print_bio(BIO *bio, TS_STATUS_INFO *a); 715int TS_TST_INFO_print_bio(BIO *bio, TS_TST_INFO *a); 716 717/* Common utility functions defined in ts/ts_lib.c */ 718 719int TS_ASN1_INTEGER_print_bio(BIO *bio, const ASN1_INTEGER *num); 720int TS_OBJ_print_bio(BIO *bio, const ASN1_OBJECT *obj); 721int TS_ext_print_bio(BIO *bio, const STACK_OF(X509_EXTENSION) *extensions); 722int TS_X509_ALGOR_print_bio(BIO *bio, const X509_ALGOR *alg); 723int TS_MSG_IMPRINT_print_bio(BIO *bio, TS_MSG_IMPRINT *msg); 724 725/* Function declarations for handling configuration options, 726 defined in ts/ts_conf.c */ 727 728X509 *TS_CONF_load_cert(const char *file); 729STACK_OF(X509) *TS_CONF_load_certs(const char *file); 730EVP_PKEY *TS_CONF_load_key(const char *file, const char *pass); 731const char *TS_CONF_get_tsa_section(CONF *conf, const char *section); 732int TS_CONF_set_serial(CONF *conf, const char *section, TS_serial_cb cb, 733 TS_RESP_CTX *ctx); 734int TS_CONF_set_crypto_device(CONF *conf, const char *section, 735 const char *device); 736int TS_CONF_set_default_engine(const char *name); 737int TS_CONF_set_signer_cert(CONF *conf, const char *section, 738 const char *cert, TS_RESP_CTX *ctx); 739int TS_CONF_set_certs(CONF *conf, const char *section, const char *certs, 740 TS_RESP_CTX *ctx); 741int TS_CONF_set_signer_key(CONF *conf, const char *section, 742 const char *key, const char *pass, TS_RESP_CTX *ctx); 743int TS_CONF_set_def_policy(CONF *conf, const char *section, 744 const char *policy, TS_RESP_CTX *ctx); 745int TS_CONF_set_policies(CONF *conf, const char *section, TS_RESP_CTX *ctx); 746int TS_CONF_set_digests(CONF *conf, const char *section, TS_RESP_CTX *ctx); 747int TS_CONF_set_accuracy(CONF *conf, const char *section, TS_RESP_CTX *ctx); 748int TS_CONF_set_clock_precision_digits(CONF *conf, const char *section, 749 TS_RESP_CTX *ctx); 750int TS_CONF_set_ordering(CONF *conf, const char *section, TS_RESP_CTX *ctx); 751int TS_CONF_set_tsa_name(CONF *conf, const char *section, TS_RESP_CTX *ctx); 752int TS_CONF_set_ess_cert_id_chain(CONF *conf, const char *section, 753 TS_RESP_CTX *ctx); 754 755/* -------------------------------------------------- */ 756/* BEGIN ERROR CODES */ 757/* The following lines are auto generated by the script mkerr.pl. Any changes 758 * made after this point may be overwritten when the script is next run. 759 */ 760void ERR_load_TS_strings(void); 761 762/* Error codes for the TS functions. */ 763 764/* Function codes. */ 765#define TS_F_D2I_TS_RESP 147 766#define TS_F_DEF_SERIAL_CB 110 767#define TS_F_DEF_TIME_CB 111 768#define TS_F_ESS_ADD_SIGNING_CERT 112 769#define TS_F_ESS_CERT_ID_NEW_INIT 113 770#define TS_F_ESS_SIGNING_CERT_NEW_INIT 114 771#define TS_F_INT_TS_RESP_VERIFY_TOKEN 149 772#define TS_F_PKCS7_TO_TS_TST_INFO 148 773#define TS_F_TS_ACCURACY_SET_MICROS 115 774#define TS_F_TS_ACCURACY_SET_MILLIS 116 775#define TS_F_TS_ACCURACY_SET_SECONDS 117 776#define TS_F_TS_CHECK_IMPRINTS 100 777#define TS_F_TS_CHECK_NONCES 101 778#define TS_F_TS_CHECK_POLICY 102 779#define TS_F_TS_CHECK_SIGNING_CERTS 103 780#define TS_F_TS_CHECK_STATUS_INFO 104 781#define TS_F_TS_COMPUTE_IMPRINT 145 782#define TS_F_TS_CONF_SET_DEFAULT_ENGINE 146 783#define TS_F_TS_GET_STATUS_TEXT 105 784#define TS_F_TS_MSG_IMPRINT_SET_ALGO 118 785#define TS_F_TS_REQ_SET_MSG_IMPRINT 119 786#define TS_F_TS_REQ_SET_NONCE 120 787#define TS_F_TS_REQ_SET_POLICY_ID 121 788#define TS_F_TS_RESP_CREATE_RESPONSE 122 789#define TS_F_TS_RESP_CREATE_TST_INFO 123 790#define TS_F_TS_RESP_CTX_ADD_FAILURE_INFO 124 791#define TS_F_TS_RESP_CTX_ADD_MD 125 792#define TS_F_TS_RESP_CTX_ADD_POLICY 126 793#define TS_F_TS_RESP_CTX_NEW 127 794#define TS_F_TS_RESP_CTX_SET_ACCURACY 128 795#define TS_F_TS_RESP_CTX_SET_CERTS 129 796#define TS_F_TS_RESP_CTX_SET_DEF_POLICY 130 797#define TS_F_TS_RESP_CTX_SET_SIGNER_CERT 131 798#define TS_F_TS_RESP_CTX_SET_STATUS_INFO 132 799#define TS_F_TS_RESP_GET_POLICY 133 800#define TS_F_TS_RESP_SET_GENTIME_WITH_PRECISION 134 801#define TS_F_TS_RESP_SET_STATUS_INFO 135 802#define TS_F_TS_RESP_SET_TST_INFO 150 803#define TS_F_TS_RESP_SIGN 136 804#define TS_F_TS_RESP_VERIFY_SIGNATURE 106 805#define TS_F_TS_RESP_VERIFY_TOKEN 107 806#define TS_F_TS_TST_INFO_SET_ACCURACY 137 807#define TS_F_TS_TST_INFO_SET_MSG_IMPRINT 138 808#define TS_F_TS_TST_INFO_SET_NONCE 139 809#define TS_F_TS_TST_INFO_SET_POLICY_ID 140 810#define TS_F_TS_TST_INFO_SET_SERIAL 141 811#define TS_F_TS_TST_INFO_SET_TIME 142 812#define TS_F_TS_TST_INFO_SET_TSA 143 813#define TS_F_TS_VERIFY 108 814#define TS_F_TS_VERIFY_CERT 109 815#define TS_F_TS_VERIFY_CTX_NEW 144 816 817/* Reason codes. */ 818#define TS_R_BAD_PKCS7_TYPE 132 819#define TS_R_BAD_TYPE 133 820#define TS_R_CERTIFICATE_VERIFY_ERROR 100 821#define TS_R_COULD_NOT_SET_ENGINE 127 822#define TS_R_COULD_NOT_SET_TIME 115 823#define TS_R_D2I_TS_RESP_INT_FAILED 128 824#define TS_R_DETACHED_CONTENT 134 825#define TS_R_ESS_ADD_SIGNING_CERT_ERROR 116 826#define TS_R_ESS_SIGNING_CERTIFICATE_ERROR 101 827#define TS_R_INVALID_NULL_POINTER 102 828#define TS_R_INVALID_SIGNER_CERTIFICATE_PURPOSE 117 829#define TS_R_MESSAGE_IMPRINT_MISMATCH 103 830#define TS_R_NONCE_MISMATCH 104 831#define TS_R_NONCE_NOT_RETURNED 105 832#define TS_R_NO_CONTENT 106 833#define TS_R_NO_TIME_STAMP_TOKEN 107 834#define TS_R_PKCS7_ADD_SIGNATURE_ERROR 118 835#define TS_R_PKCS7_ADD_SIGNED_ATTR_ERROR 119 836#define TS_R_PKCS7_TO_TS_TST_INFO_FAILED 129 837#define TS_R_POLICY_MISMATCH 108 838#define TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE 120 839#define TS_R_RESPONSE_SETUP_ERROR 121 840#define TS_R_SIGNATURE_FAILURE 109 841#define TS_R_THERE_MUST_BE_ONE_SIGNER 110 842#define TS_R_TIME_SYSCALL_ERROR 122 843#define TS_R_TOKEN_NOT_PRESENT 130 844#define TS_R_TOKEN_PRESENT 131 845#define TS_R_TSA_NAME_MISMATCH 111 846#define TS_R_TSA_UNTRUSTED 112 847#define TS_R_TST_INFO_SETUP_ERROR 123 848#define TS_R_TS_DATASIGN 124 849#define TS_R_UNACCEPTABLE_POLICY 125 850#define TS_R_UNSUPPORTED_MD_ALGORITHM 126 851#define TS_R_UNSUPPORTED_VERSION 113 852#define TS_R_WRONG_CONTENT_TYPE 114 853 854#ifdef __cplusplus 855} 856#endif 857#endif 858