ts.h revision 1.5
1/* crypto/ts/ts.h */ 2/* Written by Zoltan Glozik (zglozik@opentsa.org) for the OpenSSL 3 * project 2002, 2003, 2004. 4 */ 5/* ==================================================================== 6 * Copyright (c) 2006 The OpenSSL Project. All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in 17 * the documentation and/or other materials provided with the 18 * distribution. 19 * 20 * 3. All advertising materials mentioning features or use of this 21 * software must display the following acknowledgment: 22 * "This product includes software developed by the OpenSSL Project 23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" 24 * 25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 26 * endorse or promote products derived from this software without 27 * prior written permission. For written permission, please contact 28 * licensing@OpenSSL.org. 29 * 30 * 5. Products derived from this software may not be called "OpenSSL" 31 * nor may "OpenSSL" appear in their names without prior written 32 * permission of the OpenSSL Project. 33 * 34 * 6. Redistributions of any form whatsoever must retain the following 35 * acknowledgment: 36 * "This product includes software developed by the OpenSSL Project 37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" 38 * 39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 50 * OF THE POSSIBILITY OF SUCH DAMAGE. 51 * ==================================================================== 52 * 53 * This product includes cryptographic software written by Eric Young 54 * (eay@cryptsoft.com). This product includes software written by Tim 55 * Hudson (tjh@cryptsoft.com). 56 * 57 */ 58 59#ifndef HEADER_TS_H 60#define HEADER_TS_H 61 62#include <openssl/opensslconf.h> 63#ifndef OPENSSL_NO_BUFFER 64#include <openssl/buffer.h> 65#endif 66#ifndef OPENSSL_NO_EVP 67#include <openssl/evp.h> 68#endif 69#ifndef OPENSSL_NO_BIO 70#include <openssl/bio.h> 71#endif 72#include <openssl/stack.h> 73#include <openssl/asn1.h> 74#include <openssl/safestack.h> 75 76#ifndef OPENSSL_NO_RSA 77#include <openssl/rsa.h> 78#endif 79 80#ifndef OPENSSL_NO_DSA 81#include <openssl/dsa.h> 82#endif 83 84#ifndef OPENSSL_NO_DH 85#include <openssl/dh.h> 86#endif 87 88#ifdef __cplusplus 89extern "C" { 90#endif 91 92#include <openssl/x509.h> 93#include <openssl/x509v3.h> 94 95/* 96MessageImprint ::= SEQUENCE { 97 hashAlgorithm AlgorithmIdentifier, 98 hashedMessage OCTET STRING } 99*/ 100 101typedef struct TS_msg_imprint_st { 102 X509_ALGOR *hash_algo; 103 ASN1_OCTET_STRING *hashed_msg; 104} TS_MSG_IMPRINT; 105 106/* 107TimeStampReq ::= SEQUENCE { 108 version INTEGER { v1(1) }, 109 messageImprint MessageImprint, 110 --a hash algorithm OID and the hash value of the data to be 111 --time-stamped 112 reqPolicy TSAPolicyId OPTIONAL, 113 nonce INTEGER OPTIONAL, 114 certReq BOOLEAN DEFAULT FALSE, 115 extensions [0] IMPLICIT Extensions OPTIONAL } 116*/ 117 118typedef struct TS_req_st { 119 ASN1_INTEGER *version; 120 TS_MSG_IMPRINT *msg_imprint; 121 ASN1_OBJECT *policy_id; /* OPTIONAL */ 122 ASN1_INTEGER *nonce; /* OPTIONAL */ 123 ASN1_BOOLEAN cert_req; /* DEFAULT FALSE */ 124 STACK_OF(X509_EXTENSION) *extensions; /* [0] OPTIONAL */ 125} TS_REQ; 126 127/* 128Accuracy ::= SEQUENCE { 129 seconds INTEGER OPTIONAL, 130 millis [0] INTEGER (1..999) OPTIONAL, 131 micros [1] INTEGER (1..999) OPTIONAL } 132*/ 133 134typedef struct TS_accuracy_st { 135 ASN1_INTEGER *seconds; 136 ASN1_INTEGER *millis; 137 ASN1_INTEGER *micros; 138} TS_ACCURACY; 139 140/* 141TSTInfo ::= SEQUENCE { 142 version INTEGER { v1(1) }, 143 policy TSAPolicyId, 144 messageImprint MessageImprint, 145 -- MUST have the same value as the similar field in 146 -- TimeStampReq 147 serialNumber INTEGER, 148 -- Time-Stamping users MUST be ready to accommodate integers 149 -- up to 160 bits. 150 genTime GeneralizedTime, 151 accuracy Accuracy OPTIONAL, 152 ordering BOOLEAN DEFAULT FALSE, 153 nonce INTEGER OPTIONAL, 154 -- MUST be present if the similar field was present 155 -- in TimeStampReq. In that case it MUST have the same value. 156 tsa [0] GeneralName OPTIONAL, 157 extensions [1] IMPLICIT Extensions OPTIONAL } 158*/ 159 160typedef struct TS_tst_info_st { 161 ASN1_INTEGER *version; 162 ASN1_OBJECT *policy_id; 163 TS_MSG_IMPRINT *msg_imprint; 164 ASN1_INTEGER *serial; 165 ASN1_GENERALIZEDTIME *time; 166 TS_ACCURACY *accuracy; 167 ASN1_BOOLEAN ordering; 168 ASN1_INTEGER *nonce; 169 GENERAL_NAME *tsa; 170 STACK_OF(X509_EXTENSION) *extensions; 171} TS_TST_INFO; 172 173/* 174PKIStatusInfo ::= SEQUENCE { 175 status PKIStatus, 176 statusString PKIFreeText OPTIONAL, 177 failInfo PKIFailureInfo OPTIONAL } 178 179From RFC 1510 - section 3.1.1: 180PKIFreeText ::= SEQUENCE SIZE (1..MAX) OF UTF8String 181 -- text encoded as UTF-8 String (note: each UTF8String SHOULD 182 -- include an RFC 1766 language tag to indicate the language 183 -- of the contained text) 184*/ 185 186/* Possible values for status. See ts_resp_print.c && ts_resp_verify.c. */ 187 188#define TS_STATUS_GRANTED 0 189#define TS_STATUS_GRANTED_WITH_MODS 1 190#define TS_STATUS_REJECTION 2 191#define TS_STATUS_WAITING 3 192#define TS_STATUS_REVOCATION_WARNING 4 193#define TS_STATUS_REVOCATION_NOTIFICATION 5 194 195/* Possible values for failure_info. See ts_resp_print.c && ts_resp_verify.c */ 196 197#define TS_INFO_BAD_ALG 0 198#define TS_INFO_BAD_REQUEST 2 199#define TS_INFO_BAD_DATA_FORMAT 5 200#define TS_INFO_TIME_NOT_AVAILABLE 14 201#define TS_INFO_UNACCEPTED_POLICY 15 202#define TS_INFO_UNACCEPTED_EXTENSION 16 203#define TS_INFO_ADD_INFO_NOT_AVAILABLE 17 204#define TS_INFO_SYSTEM_FAILURE 25 205 206typedef struct TS_status_info_st { 207 ASN1_INTEGER *status; 208 STACK_OF(ASN1_UTF8STRING) *text; 209 ASN1_BIT_STRING *failure_info; 210} TS_STATUS_INFO; 211 212DECLARE_STACK_OF(ASN1_UTF8STRING) 213DECLARE_ASN1_SET_OF(ASN1_UTF8STRING) 214 215/* 216TimeStampResp ::= SEQUENCE { 217 status PKIStatusInfo, 218 timeStampToken TimeStampToken OPTIONAL } 219*/ 220 221typedef struct TS_resp_st { 222 TS_STATUS_INFO *status_info; 223 PKCS7 *token; 224 TS_TST_INFO *tst_info; 225} TS_RESP; 226 227/* The structure below would belong to the ESS component. */ 228 229/* 230IssuerSerial ::= SEQUENCE { 231 issuer GeneralNames, 232 serialNumber CertificateSerialNumber 233 } 234*/ 235 236typedef struct ESS_issuer_serial { 237 STACK_OF(GENERAL_NAME) *issuer; 238 ASN1_INTEGER *serial; 239} ESS_ISSUER_SERIAL; 240 241/* 242ESSCertID ::= SEQUENCE { 243 certHash Hash, 244 issuerSerial IssuerSerial OPTIONAL 245} 246*/ 247 248typedef struct ESS_cert_id { 249 ASN1_OCTET_STRING *hash; /* Always SHA-1 digest. */ 250 ESS_ISSUER_SERIAL *issuer_serial; 251} ESS_CERT_ID; 252 253DECLARE_STACK_OF(ESS_CERT_ID) 254DECLARE_ASN1_SET_OF(ESS_CERT_ID) 255 256/* 257SigningCertificate ::= SEQUENCE { 258 certs SEQUENCE OF ESSCertID, 259 policies SEQUENCE OF PolicyInformation OPTIONAL 260} 261*/ 262 263typedef struct ESS_signing_cert { 264 STACK_OF(ESS_CERT_ID) *cert_ids; 265 STACK_OF(POLICYINFO) *policy_info; 266} ESS_SIGNING_CERT; 267 268 269TS_REQ *TS_REQ_new(void); 270void TS_REQ_free(TS_REQ *a); 271int i2d_TS_REQ(const TS_REQ *a, unsigned char **pp); 272TS_REQ *d2i_TS_REQ(TS_REQ **a, const unsigned char **pp, long length); 273 274TS_REQ *TS_REQ_dup(TS_REQ *a); 275 276TS_REQ *d2i_TS_REQ_fp(FILE *fp, TS_REQ **a); 277int i2d_TS_REQ_fp(FILE *fp, TS_REQ *a); 278TS_REQ *d2i_TS_REQ_bio(BIO *fp, TS_REQ **a); 279int i2d_TS_REQ_bio(BIO *fp, TS_REQ *a); 280 281TS_MSG_IMPRINT *TS_MSG_IMPRINT_new(void); 282void TS_MSG_IMPRINT_free(TS_MSG_IMPRINT *a); 283int i2d_TS_MSG_IMPRINT(const TS_MSG_IMPRINT *a, unsigned char **pp); 284TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT(TS_MSG_IMPRINT **a, 285 const unsigned char **pp, long length); 286 287TS_MSG_IMPRINT *TS_MSG_IMPRINT_dup(TS_MSG_IMPRINT *a); 288 289TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT **a); 290int i2d_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT *a); 291TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_bio(BIO *fp, TS_MSG_IMPRINT **a); 292int i2d_TS_MSG_IMPRINT_bio(BIO *fp, TS_MSG_IMPRINT *a); 293 294TS_RESP *TS_RESP_new(void); 295void TS_RESP_free(TS_RESP *a); 296int i2d_TS_RESP(const TS_RESP *a, unsigned char **pp); 297TS_RESP *d2i_TS_RESP(TS_RESP **a, const unsigned char **pp, long length); 298TS_TST_INFO *PKCS7_to_TS_TST_INFO(PKCS7 *token); 299TS_RESP *TS_RESP_dup(TS_RESP *a); 300 301TS_RESP *d2i_TS_RESP_fp(FILE *fp, TS_RESP **a); 302int i2d_TS_RESP_fp(FILE *fp, TS_RESP *a); 303TS_RESP *d2i_TS_RESP_bio(BIO *fp, TS_RESP **a); 304int i2d_TS_RESP_bio(BIO *fp, TS_RESP *a); 305 306TS_STATUS_INFO *TS_STATUS_INFO_new(void); 307void TS_STATUS_INFO_free(TS_STATUS_INFO *a); 308int i2d_TS_STATUS_INFO(const TS_STATUS_INFO *a, unsigned char **pp); 309TS_STATUS_INFO *d2i_TS_STATUS_INFO(TS_STATUS_INFO **a, 310 const unsigned char **pp, long length); 311TS_STATUS_INFO *TS_STATUS_INFO_dup(TS_STATUS_INFO *a); 312 313TS_TST_INFO *TS_TST_INFO_new(void); 314void TS_TST_INFO_free(TS_TST_INFO *a); 315int i2d_TS_TST_INFO(const TS_TST_INFO *a, unsigned char **pp); 316TS_TST_INFO *d2i_TS_TST_INFO(TS_TST_INFO **a, const unsigned char **pp, 317 long length); 318TS_TST_INFO *TS_TST_INFO_dup(TS_TST_INFO *a); 319 320TS_TST_INFO *d2i_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO **a); 321int i2d_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO *a); 322TS_TST_INFO *d2i_TS_TST_INFO_bio(BIO *fp, TS_TST_INFO **a); 323int i2d_TS_TST_INFO_bio(BIO *fp, TS_TST_INFO *a); 324 325TS_ACCURACY *TS_ACCURACY_new(void); 326void TS_ACCURACY_free(TS_ACCURACY *a); 327int i2d_TS_ACCURACY(const TS_ACCURACY *a, unsigned char **pp); 328TS_ACCURACY *d2i_TS_ACCURACY(TS_ACCURACY **a, const unsigned char **pp, 329 long length); 330TS_ACCURACY *TS_ACCURACY_dup(TS_ACCURACY *a); 331 332ESS_ISSUER_SERIAL *ESS_ISSUER_SERIAL_new(void); 333void ESS_ISSUER_SERIAL_free(ESS_ISSUER_SERIAL *a); 334int i2d_ESS_ISSUER_SERIAL(const ESS_ISSUER_SERIAL *a, 335 unsigned char **pp); 336ESS_ISSUER_SERIAL *d2i_ESS_ISSUER_SERIAL(ESS_ISSUER_SERIAL **a, 337 const unsigned char **pp, long length); 338ESS_ISSUER_SERIAL *ESS_ISSUER_SERIAL_dup(ESS_ISSUER_SERIAL *a); 339 340ESS_CERT_ID *ESS_CERT_ID_new(void); 341void ESS_CERT_ID_free(ESS_CERT_ID *a); 342int i2d_ESS_CERT_ID(const ESS_CERT_ID *a, unsigned char **pp); 343ESS_CERT_ID *d2i_ESS_CERT_ID(ESS_CERT_ID **a, const unsigned char **pp, 344 long length); 345ESS_CERT_ID *ESS_CERT_ID_dup(ESS_CERT_ID *a); 346 347ESS_SIGNING_CERT *ESS_SIGNING_CERT_new(void); 348void ESS_SIGNING_CERT_free(ESS_SIGNING_CERT *a); 349int i2d_ESS_SIGNING_CERT(const ESS_SIGNING_CERT *a, 350 unsigned char **pp); 351ESS_SIGNING_CERT *d2i_ESS_SIGNING_CERT(ESS_SIGNING_CERT **a, 352 const unsigned char **pp, long length); 353ESS_SIGNING_CERT *ESS_SIGNING_CERT_dup(ESS_SIGNING_CERT *a); 354 355void ERR_load_TS_strings(void); 356 357int TS_REQ_set_version(TS_REQ *a, long version); 358long TS_REQ_get_version(const TS_REQ *a); 359 360int TS_REQ_set_msg_imprint(TS_REQ *a, TS_MSG_IMPRINT *msg_imprint); 361TS_MSG_IMPRINT *TS_REQ_get_msg_imprint(TS_REQ *a); 362 363int TS_MSG_IMPRINT_set_algo(TS_MSG_IMPRINT *a, X509_ALGOR *alg); 364X509_ALGOR *TS_MSG_IMPRINT_get_algo(TS_MSG_IMPRINT *a); 365 366int TS_MSG_IMPRINT_set_msg(TS_MSG_IMPRINT *a, unsigned char *d, int len); 367ASN1_OCTET_STRING *TS_MSG_IMPRINT_get_msg(TS_MSG_IMPRINT *a); 368 369int TS_REQ_set_policy_id(TS_REQ *a, ASN1_OBJECT *policy); 370ASN1_OBJECT *TS_REQ_get_policy_id(TS_REQ *a); 371 372int TS_REQ_set_nonce(TS_REQ *a, const ASN1_INTEGER *nonce); 373const ASN1_INTEGER *TS_REQ_get_nonce(const TS_REQ *a); 374 375int TS_REQ_set_cert_req(TS_REQ *a, int cert_req); 376int TS_REQ_get_cert_req(const TS_REQ *a); 377 378STACK_OF(X509_EXTENSION) *TS_REQ_get_exts(TS_REQ *a); 379void TS_REQ_ext_free(TS_REQ *a); 380int TS_REQ_get_ext_count(TS_REQ *a); 381int TS_REQ_get_ext_by_NID(TS_REQ *a, int nid, int lastpos); 382int TS_REQ_get_ext_by_OBJ(TS_REQ *a, ASN1_OBJECT *obj, int lastpos); 383int TS_REQ_get_ext_by_critical(TS_REQ *a, int crit, int lastpos); 384X509_EXTENSION *TS_REQ_get_ext(TS_REQ *a, int loc); 385X509_EXTENSION *TS_REQ_delete_ext(TS_REQ *a, int loc); 386int TS_REQ_add_ext(TS_REQ *a, X509_EXTENSION *ex, int loc); 387void *TS_REQ_get_ext_d2i(TS_REQ *a, int nid, int *crit, int *idx); 388 389/* Function declarations for TS_REQ defined in ts/ts_req_print.c */ 390 391int TS_REQ_print_bio(BIO *bio, TS_REQ *a); 392 393/* Function declarations for TS_RESP defined in ts/ts_resp_utils.c */ 394 395int TS_RESP_set_status_info(TS_RESP *a, TS_STATUS_INFO *info); 396TS_STATUS_INFO *TS_RESP_get_status_info(TS_RESP *a); 397 398/* Caller loses ownership of PKCS7 and TS_TST_INFO objects. */ 399void TS_RESP_set_tst_info(TS_RESP *a, PKCS7 *p7, TS_TST_INFO *tst_info); 400PKCS7 *TS_RESP_get_token(TS_RESP *a); 401TS_TST_INFO *TS_RESP_get_tst_info(TS_RESP *a); 402 403int TS_TST_INFO_set_version(TS_TST_INFO *a, long version); 404long TS_TST_INFO_get_version(const TS_TST_INFO *a); 405 406int TS_TST_INFO_set_policy_id(TS_TST_INFO *a, ASN1_OBJECT *policy_id); 407ASN1_OBJECT *TS_TST_INFO_get_policy_id(TS_TST_INFO *a); 408 409int TS_TST_INFO_set_msg_imprint(TS_TST_INFO *a, TS_MSG_IMPRINT *msg_imprint); 410TS_MSG_IMPRINT *TS_TST_INFO_get_msg_imprint(TS_TST_INFO *a); 411 412int TS_TST_INFO_set_serial(TS_TST_INFO *a, const ASN1_INTEGER *serial); 413const ASN1_INTEGER *TS_TST_INFO_get_serial(const TS_TST_INFO *a); 414 415int TS_TST_INFO_set_time(TS_TST_INFO *a, const ASN1_GENERALIZEDTIME *gtime); 416const ASN1_GENERALIZEDTIME *TS_TST_INFO_get_time(const TS_TST_INFO *a); 417 418int TS_TST_INFO_set_accuracy(TS_TST_INFO *a, TS_ACCURACY *accuracy); 419TS_ACCURACY *TS_TST_INFO_get_accuracy(TS_TST_INFO *a); 420 421int TS_ACCURACY_set_seconds(TS_ACCURACY *a, const ASN1_INTEGER *seconds); 422const ASN1_INTEGER *TS_ACCURACY_get_seconds(const TS_ACCURACY *a); 423 424int TS_ACCURACY_set_millis(TS_ACCURACY *a, const ASN1_INTEGER *millis); 425const ASN1_INTEGER *TS_ACCURACY_get_millis(const TS_ACCURACY *a); 426 427int TS_ACCURACY_set_micros(TS_ACCURACY *a, const ASN1_INTEGER *micros); 428const ASN1_INTEGER *TS_ACCURACY_get_micros(const TS_ACCURACY *a); 429 430int TS_TST_INFO_set_ordering(TS_TST_INFO *a, int ordering); 431int TS_TST_INFO_get_ordering(const TS_TST_INFO *a); 432 433int TS_TST_INFO_set_nonce(TS_TST_INFO *a, const ASN1_INTEGER *nonce); 434const ASN1_INTEGER *TS_TST_INFO_get_nonce(const TS_TST_INFO *a); 435 436int TS_TST_INFO_set_tsa(TS_TST_INFO *a, GENERAL_NAME *tsa); 437GENERAL_NAME *TS_TST_INFO_get_tsa(TS_TST_INFO *a); 438 439STACK_OF(X509_EXTENSION) *TS_TST_INFO_get_exts(TS_TST_INFO *a); 440void TS_TST_INFO_ext_free(TS_TST_INFO *a); 441int TS_TST_INFO_get_ext_count(TS_TST_INFO *a); 442int TS_TST_INFO_get_ext_by_NID(TS_TST_INFO *a, int nid, int lastpos); 443int TS_TST_INFO_get_ext_by_OBJ(TS_TST_INFO *a, ASN1_OBJECT *obj, int lastpos); 444int TS_TST_INFO_get_ext_by_critical(TS_TST_INFO *a, int crit, int lastpos); 445X509_EXTENSION *TS_TST_INFO_get_ext(TS_TST_INFO *a, int loc); 446X509_EXTENSION *TS_TST_INFO_delete_ext(TS_TST_INFO *a, int loc); 447int TS_TST_INFO_add_ext(TS_TST_INFO *a, X509_EXTENSION *ex, int loc); 448void *TS_TST_INFO_get_ext_d2i(TS_TST_INFO *a, int nid, int *crit, int *idx); 449 450/* Declarations related to response generation, defined in ts/ts_resp_sign.c. */ 451 452/* Optional flags for response generation. */ 453 454/* Don't include the TSA name in response. */ 455#define TS_TSA_NAME 0x01 456 457/* Set ordering to true in response. */ 458#define TS_ORDERING 0x02 459 460/* 461 * Include the signer certificate and the other specified certificates in 462 * the ESS signing certificate attribute beside the PKCS7 signed data. 463 * Only the signer certificates is included by default. 464 */ 465#define TS_ESS_CERT_ID_CHAIN 0x04 466 467/* Forward declaration. */ 468struct TS_resp_ctx; 469 470/* This must return a unique number less than 160 bits long. */ 471typedef ASN1_INTEGER *(*TS_serial_cb)(struct TS_resp_ctx *, void *); 472 473/* This must return the seconds and microseconds since Jan 1, 1970 in 474 the sec and usec variables allocated by the caller. 475 Return non-zero for success and zero for failure. */ 476typedef int (*TS_time_cb)(struct TS_resp_ctx *, void *, time_t *sec, long *usec); 477 478/* This must process the given extension. 479 * It can modify the TS_TST_INFO object of the context. 480 * Return values: !0 (processed), 0 (error, it must set the 481 * status info/failure info of the response). 482 */ 483typedef int (*TS_extension_cb)(struct TS_resp_ctx *, X509_EXTENSION *, void *); 484 485typedef struct TS_resp_ctx { 486 X509 *signer_cert; 487 EVP_PKEY *signer_key; 488 STACK_OF(X509) *certs; /* Certs to include in signed data. */ 489 STACK_OF(ASN1_OBJECT) *policies; /* Acceptable policies. */ 490 ASN1_OBJECT *default_policy; /* It may appear in policies, too. */ 491 STACK_OF(EVP_MD) *mds; /* Acceptable message digests. */ 492 ASN1_INTEGER *seconds; /* accuracy, 0 means not specified. */ 493 ASN1_INTEGER *millis; /* accuracy, 0 means not specified. */ 494 ASN1_INTEGER *micros; /* accuracy, 0 means not specified. */ 495 unsigned clock_precision_digits; /* fraction of seconds in 496 time stamp token. */ 497 unsigned flags; /* Optional info, see values above. */ 498 499 /* Callback functions. */ 500 TS_serial_cb serial_cb; 501 void *serial_cb_data; /* User data for serial_cb. */ 502 503 TS_time_cb time_cb; 504 void *time_cb_data; /* User data for time_cb. */ 505 506 TS_extension_cb extension_cb; 507 void *extension_cb_data; /* User data for extension_cb. */ 508 509 /* These members are used only while creating the response. */ 510 TS_REQ *request; 511 TS_RESP *response; 512 TS_TST_INFO *tst_info; 513} TS_RESP_CTX; 514 515DECLARE_STACK_OF(EVP_MD) 516DECLARE_ASN1_SET_OF(EVP_MD) 517 518/* Creates a response context that can be used for generating responses. */ 519TS_RESP_CTX *TS_RESP_CTX_new(void); 520void TS_RESP_CTX_free(TS_RESP_CTX *ctx); 521 522/* This parameter must be set. */ 523int TS_RESP_CTX_set_signer_cert(TS_RESP_CTX *ctx, X509 *signer); 524 525/* This parameter must be set. */ 526int TS_RESP_CTX_set_signer_key(TS_RESP_CTX *ctx, EVP_PKEY *key); 527 528/* This parameter must be set. */ 529int TS_RESP_CTX_set_def_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *def_policy); 530 531/* No additional certs are included in the response by default. */ 532int TS_RESP_CTX_set_certs(TS_RESP_CTX *ctx, STACK_OF(X509) *certs); 533 534/* Adds a new acceptable policy, only the default policy 535 is accepted by default. */ 536int TS_RESP_CTX_add_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *policy); 537 538/* Adds a new acceptable message digest. Note that no message digests 539 are accepted by default. The md argument is shared with the caller. */ 540int TS_RESP_CTX_add_md(TS_RESP_CTX *ctx, const EVP_MD *md); 541 542/* Accuracy is not included by default. */ 543int TS_RESP_CTX_set_accuracy(TS_RESP_CTX *ctx, 544 int secs, int millis, int micros); 545 546/* Clock precision digits, i.e. the number of decimal digits: 547 '0' means sec, '3' msec, '6' usec, and so on. Default is 0. */ 548int TS_RESP_CTX_set_clock_precision_digits(TS_RESP_CTX *ctx, 549 unsigned clock_precision_digits); 550/* At most we accept usec precision. */ 551#define TS_MAX_CLOCK_PRECISION_DIGITS 6 552 553/* No flags are set by default. */ 554void TS_RESP_CTX_add_flags(TS_RESP_CTX *ctx, int flags); 555 556/* Default callback always returns a constant. */ 557void TS_RESP_CTX_set_serial_cb(TS_RESP_CTX *ctx, TS_serial_cb cb, void *data); 558 559/* Default callback rejects all extensions. The extension callback is called 560 * when the TS_TST_INFO object is already set up and not signed yet. */ 561/* FIXME: extension handling is not tested yet. */ 562void TS_RESP_CTX_set_extension_cb(TS_RESP_CTX *ctx, 563 TS_extension_cb cb, void *data); 564 565/* The following methods can be used in the callbacks. */ 566int TS_RESP_CTX_set_status_info(TS_RESP_CTX *ctx, 567 int status, const char *text); 568 569/* Sets the status info only if it is still TS_STATUS_GRANTED. */ 570int TS_RESP_CTX_set_status_info_cond(TS_RESP_CTX *ctx, 571 int status, const char *text); 572 573int TS_RESP_CTX_add_failure_info(TS_RESP_CTX *ctx, int failure); 574 575/* The get methods below can be used in the extension callback. */ 576TS_REQ *TS_RESP_CTX_get_request(TS_RESP_CTX *ctx); 577 578TS_TST_INFO *TS_RESP_CTX_get_tst_info(TS_RESP_CTX *ctx); 579 580/* 581 * Creates the signed TS_TST_INFO and puts it in TS_RESP. 582 * In case of errors it sets the status info properly. 583 * Returns NULL only in case of memory allocation/fatal error. 584 */ 585TS_RESP *TS_RESP_create_response(TS_RESP_CTX *ctx, BIO *req_bio); 586 587/* 588 * Declarations related to response verification, 589 * they are defined in ts/ts_resp_verify.c. 590 */ 591 592int TS_RESP_verify_signature(PKCS7 *token, STACK_OF(X509) *certs, 593 X509_STORE *store, X509 **signer_out); 594 595/* Context structure for the generic verify method. */ 596 597/* Verify the signer's certificate and the signature of the response. */ 598#define TS_VFY_SIGNATURE (1u << 0) 599/* Verify the version number of the response. */ 600#define TS_VFY_VERSION (1u << 1) 601/* Verify if the policy supplied by the user matches the policy of the TSA. */ 602#define TS_VFY_POLICY (1u << 2) 603/* Verify the message imprint provided by the user. This flag should not be 604 specified with TS_VFY_DATA. */ 605#define TS_VFY_IMPRINT (1u << 3) 606/* Verify the message imprint computed by the verify method from the user 607 provided data and the MD algorithm of the response. This flag should not be 608 specified with TS_VFY_IMPRINT. */ 609#define TS_VFY_DATA (1u << 4) 610/* Verify the nonce value. */ 611#define TS_VFY_NONCE (1u << 5) 612/* Verify if the TSA name field matches the signer certificate. */ 613#define TS_VFY_SIGNER (1u << 6) 614/* Verify if the TSA name field equals to the user provided name. */ 615#define TS_VFY_TSA_NAME (1u << 7) 616 617/* You can use the following convenience constants. */ 618#define TS_VFY_ALL_IMPRINT (TS_VFY_SIGNATURE \ 619 | TS_VFY_VERSION \ 620 | TS_VFY_POLICY \ 621 | TS_VFY_IMPRINT \ 622 | TS_VFY_NONCE \ 623 | TS_VFY_SIGNER \ 624 | TS_VFY_TSA_NAME) 625#define TS_VFY_ALL_DATA (TS_VFY_SIGNATURE \ 626 | TS_VFY_VERSION \ 627 | TS_VFY_POLICY \ 628 | TS_VFY_DATA \ 629 | TS_VFY_NONCE \ 630 | TS_VFY_SIGNER \ 631 | TS_VFY_TSA_NAME) 632 633typedef struct TS_verify_ctx { 634 /* Set this to the union of TS_VFY_... flags you want to carry out. */ 635 unsigned flags; 636 637 /* Must be set only with TS_VFY_SIGNATURE. certs is optional. */ 638 X509_STORE *store; 639 STACK_OF(X509) *certs; 640 641 /* Must be set only with TS_VFY_POLICY. */ 642 ASN1_OBJECT *policy; 643 644 /* Must be set only with TS_VFY_IMPRINT. If md_alg is NULL, 645 the algorithm from the response is used. */ 646 X509_ALGOR *md_alg; 647 unsigned char *imprint; 648 unsigned imprint_len; 649 650 /* Must be set only with TS_VFY_DATA. */ 651 BIO *data; 652 653 /* Must be set only with TS_VFY_TSA_NAME. */ 654 ASN1_INTEGER *nonce; 655 656 /* Must be set only with TS_VFY_TSA_NAME. */ 657 GENERAL_NAME *tsa_name; 658} TS_VERIFY_CTX; 659 660int TS_RESP_verify_response(TS_VERIFY_CTX *ctx, TS_RESP *response); 661int TS_RESP_verify_token(TS_VERIFY_CTX *ctx, PKCS7 *token); 662 663/* 664 * Declarations related to response verification context, 665 * they are defined in ts/ts_verify_ctx.c. 666 */ 667 668/* Set all fields to zero. */ 669TS_VERIFY_CTX *TS_VERIFY_CTX_new(void); 670void TS_VERIFY_CTX_init(TS_VERIFY_CTX *ctx); 671void TS_VERIFY_CTX_free(TS_VERIFY_CTX *ctx); 672void TS_VERIFY_CTX_cleanup(TS_VERIFY_CTX *ctx); 673 674/* 675 * If ctx is NULL, it allocates and returns a new object, otherwise 676 * it returns ctx. It initialises all the members as follows: 677 * flags = TS_VFY_ALL_IMPRINT & ~(TS_VFY_TSA_NAME | TS_VFY_SIGNATURE) 678 * certs = NULL 679 * store = NULL 680 * policy = policy from the request or NULL if absent (in this case 681 * TS_VFY_POLICY is cleared from flags as well) 682 * md_alg = MD algorithm from request 683 * imprint, imprint_len = imprint from request 684 * data = NULL 685 * nonce, nonce_len = nonce from the request or NULL if absent (in this case 686 * TS_VFY_NONCE is cleared from flags as well) 687 * tsa_name = NULL 688 * Important: after calling this method TS_VFY_SIGNATURE should be added! 689 */ 690TS_VERIFY_CTX *TS_REQ_to_TS_VERIFY_CTX(TS_REQ *req, TS_VERIFY_CTX *ctx); 691 692/* Function declarations for TS_RESP defined in ts/ts_resp_print.c */ 693 694int TS_RESP_print_bio(BIO *bio, TS_RESP *a); 695int TS_STATUS_INFO_print_bio(BIO *bio, TS_STATUS_INFO *a); 696int TS_TST_INFO_print_bio(BIO *bio, TS_TST_INFO *a); 697 698/* Common utility functions defined in ts/ts_lib.c */ 699 700int TS_ASN1_INTEGER_print_bio(BIO *bio, const ASN1_INTEGER *num); 701int TS_OBJ_print_bio(BIO *bio, const ASN1_OBJECT *obj); 702int TS_ext_print_bio(BIO *bio, const STACK_OF(X509_EXTENSION) *extensions); 703int TS_X509_ALGOR_print_bio(BIO *bio, const X509_ALGOR *alg); 704int TS_MSG_IMPRINT_print_bio(BIO *bio, TS_MSG_IMPRINT *msg); 705 706/* Function declarations for handling configuration options, 707 defined in ts/ts_conf.c */ 708 709X509 *TS_CONF_load_cert(const char *file); 710STACK_OF(X509) *TS_CONF_load_certs(const char *file); 711EVP_PKEY *TS_CONF_load_key(const char *file, const char *pass); 712const char *TS_CONF_get_tsa_section(CONF *conf, const char *section); 713int TS_CONF_set_serial(CONF *conf, const char *section, TS_serial_cb cb, 714 TS_RESP_CTX *ctx); 715int TS_CONF_set_crypto_device(CONF *conf, const char *section, 716 const char *device); 717int TS_CONF_set_default_engine(const char *name); 718int TS_CONF_set_signer_cert(CONF *conf, const char *section, 719 const char *cert, TS_RESP_CTX *ctx); 720int TS_CONF_set_certs(CONF *conf, const char *section, const char *certs, 721 TS_RESP_CTX *ctx); 722int TS_CONF_set_signer_key(CONF *conf, const char *section, 723 const char *key, const char *pass, TS_RESP_CTX *ctx); 724int TS_CONF_set_def_policy(CONF *conf, const char *section, 725 const char *policy, TS_RESP_CTX *ctx); 726int TS_CONF_set_policies(CONF *conf, const char *section, TS_RESP_CTX *ctx); 727int TS_CONF_set_digests(CONF *conf, const char *section, TS_RESP_CTX *ctx); 728int TS_CONF_set_accuracy(CONF *conf, const char *section, TS_RESP_CTX *ctx); 729int TS_CONF_set_clock_precision_digits(CONF *conf, const char *section, 730 TS_RESP_CTX *ctx); 731int TS_CONF_set_ordering(CONF *conf, const char *section, TS_RESP_CTX *ctx); 732int TS_CONF_set_tsa_name(CONF *conf, const char *section, TS_RESP_CTX *ctx); 733int TS_CONF_set_ess_cert_id_chain(CONF *conf, const char *section, 734 TS_RESP_CTX *ctx); 735 736/* -------------------------------------------------- */ 737/* BEGIN ERROR CODES */ 738/* The following lines are auto generated by the script mkerr.pl. Any changes 739 * made after this point may be overwritten when the script is next run. 740 */ 741void ERR_load_TS_strings(void); 742 743/* Error codes for the TS functions. */ 744 745/* Function codes. */ 746#define TS_F_D2I_TS_RESP 147 747#define TS_F_DEF_SERIAL_CB 110 748#define TS_F_DEF_TIME_CB 111 749#define TS_F_ESS_ADD_SIGNING_CERT 112 750#define TS_F_ESS_CERT_ID_NEW_INIT 113 751#define TS_F_ESS_SIGNING_CERT_NEW_INIT 114 752#define TS_F_INT_TS_RESP_VERIFY_TOKEN 149 753#define TS_F_PKCS7_TO_TS_TST_INFO 148 754#define TS_F_TS_ACCURACY_SET_MICROS 115 755#define TS_F_TS_ACCURACY_SET_MILLIS 116 756#define TS_F_TS_ACCURACY_SET_SECONDS 117 757#define TS_F_TS_CHECK_IMPRINTS 100 758#define TS_F_TS_CHECK_NONCES 101 759#define TS_F_TS_CHECK_POLICY 102 760#define TS_F_TS_CHECK_SIGNING_CERTS 103 761#define TS_F_TS_CHECK_STATUS_INFO 104 762#define TS_F_TS_COMPUTE_IMPRINT 145 763#define TS_F_TS_CONF_SET_DEFAULT_ENGINE 146 764#define TS_F_TS_GET_STATUS_TEXT 105 765#define TS_F_TS_MSG_IMPRINT_SET_ALGO 118 766#define TS_F_TS_REQ_SET_MSG_IMPRINT 119 767#define TS_F_TS_REQ_SET_NONCE 120 768#define TS_F_TS_REQ_SET_POLICY_ID 121 769#define TS_F_TS_RESP_CREATE_RESPONSE 122 770#define TS_F_TS_RESP_CREATE_TST_INFO 123 771#define TS_F_TS_RESP_CTX_ADD_FAILURE_INFO 124 772#define TS_F_TS_RESP_CTX_ADD_MD 125 773#define TS_F_TS_RESP_CTX_ADD_POLICY 126 774#define TS_F_TS_RESP_CTX_NEW 127 775#define TS_F_TS_RESP_CTX_SET_ACCURACY 128 776#define TS_F_TS_RESP_CTX_SET_CERTS 129 777#define TS_F_TS_RESP_CTX_SET_DEF_POLICY 130 778#define TS_F_TS_RESP_CTX_SET_SIGNER_CERT 131 779#define TS_F_TS_RESP_CTX_SET_STATUS_INFO 132 780#define TS_F_TS_RESP_GET_POLICY 133 781#define TS_F_TS_RESP_SET_GENTIME_WITH_PRECISION 134 782#define TS_F_TS_RESP_SET_STATUS_INFO 135 783#define TS_F_TS_RESP_SET_TST_INFO 150 784#define TS_F_TS_RESP_SIGN 136 785#define TS_F_TS_RESP_VERIFY_SIGNATURE 106 786#define TS_F_TS_RESP_VERIFY_TOKEN 107 787#define TS_F_TS_TST_INFO_SET_ACCURACY 137 788#define TS_F_TS_TST_INFO_SET_MSG_IMPRINT 138 789#define TS_F_TS_TST_INFO_SET_NONCE 139 790#define TS_F_TS_TST_INFO_SET_POLICY_ID 140 791#define TS_F_TS_TST_INFO_SET_SERIAL 141 792#define TS_F_TS_TST_INFO_SET_TIME 142 793#define TS_F_TS_TST_INFO_SET_TSA 143 794#define TS_F_TS_VERIFY 108 795#define TS_F_TS_VERIFY_CERT 109 796#define TS_F_TS_VERIFY_CTX_NEW 144 797 798/* Reason codes. */ 799#define TS_R_BAD_PKCS7_TYPE 132 800#define TS_R_BAD_TYPE 133 801#define TS_R_CERTIFICATE_VERIFY_ERROR 100 802#define TS_R_COULD_NOT_SET_ENGINE 127 803#define TS_R_COULD_NOT_SET_TIME 115 804#define TS_R_D2I_TS_RESP_INT_FAILED 128 805#define TS_R_DETACHED_CONTENT 134 806#define TS_R_ESS_ADD_SIGNING_CERT_ERROR 116 807#define TS_R_ESS_SIGNING_CERTIFICATE_ERROR 101 808#define TS_R_INVALID_NULL_POINTER 102 809#define TS_R_INVALID_SIGNER_CERTIFICATE_PURPOSE 117 810#define TS_R_MESSAGE_IMPRINT_MISMATCH 103 811#define TS_R_NONCE_MISMATCH 104 812#define TS_R_NONCE_NOT_RETURNED 105 813#define TS_R_NO_CONTENT 106 814#define TS_R_NO_TIME_STAMP_TOKEN 107 815#define TS_R_PKCS7_ADD_SIGNATURE_ERROR 118 816#define TS_R_PKCS7_ADD_SIGNED_ATTR_ERROR 119 817#define TS_R_PKCS7_TO_TS_TST_INFO_FAILED 129 818#define TS_R_POLICY_MISMATCH 108 819#define TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE 120 820#define TS_R_RESPONSE_SETUP_ERROR 121 821#define TS_R_SIGNATURE_FAILURE 109 822#define TS_R_THERE_MUST_BE_ONE_SIGNER 110 823#define TS_R_TIME_SYSCALL_ERROR 122 824#define TS_R_TOKEN_NOT_PRESENT 130 825#define TS_R_TOKEN_PRESENT 131 826#define TS_R_TSA_NAME_MISMATCH 111 827#define TS_R_TSA_UNTRUSTED 112 828#define TS_R_TST_INFO_SETUP_ERROR 123 829#define TS_R_TS_DATASIGN 124 830#define TS_R_UNACCEPTABLE_POLICY 125 831#define TS_R_UNSUPPORTED_MD_ALGORITHM 126 832#define TS_R_UNSUPPORTED_VERSION 113 833#define TS_R_WRONG_CONTENT_TYPE 114 834 835#ifdef __cplusplus 836} 837#endif 838#endif 839