ts.h revision 1.7
1/* $OpenBSD: ts.h,v 1.7 2014/07/10 22:45:58 jsing Exp $ */ 2/* Written by Zoltan Glozik (zglozik@opentsa.org) for the OpenSSL 3 * project 2002, 2003, 2004. 4 */ 5/* ==================================================================== 6 * Copyright (c) 2006 The OpenSSL Project. All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in 17 * the documentation and/or other materials provided with the 18 * distribution. 19 * 20 * 3. All advertising materials mentioning features or use of this 21 * software must display the following acknowledgment: 22 * "This product includes software developed by the OpenSSL Project 23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" 24 * 25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 26 * endorse or promote products derived from this software without 27 * prior written permission. For written permission, please contact 28 * licensing@OpenSSL.org. 29 * 30 * 5. Products derived from this software may not be called "OpenSSL" 31 * nor may "OpenSSL" appear in their names without prior written 32 * permission of the OpenSSL Project. 33 * 34 * 6. Redistributions of any form whatsoever must retain the following 35 * acknowledgment: 36 * "This product includes software developed by the OpenSSL Project 37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" 38 * 39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 50 * OF THE POSSIBILITY OF SUCH DAMAGE. 51 * ==================================================================== 52 * 53 * This product includes cryptographic software written by Eric Young 54 * (eay@cryptsoft.com). This product includes software written by Tim 55 * Hudson (tjh@cryptsoft.com). 56 * 57 */ 58 59#ifndef HEADER_TS_H 60#define HEADER_TS_H 61 62#include <openssl/opensslconf.h> 63 64#ifndef OPENSSL_NO_BUFFER 65#include <openssl/buffer.h> 66#endif 67#ifndef OPENSSL_NO_EVP 68#include <openssl/evp.h> 69#endif 70#ifndef OPENSSL_NO_BIO 71#include <openssl/bio.h> 72#endif 73#include <openssl/stack.h> 74#include <openssl/asn1.h> 75#include <openssl/safestack.h> 76 77#ifndef OPENSSL_NO_RSA 78#include <openssl/rsa.h> 79#endif 80 81#ifndef OPENSSL_NO_DSA 82#include <openssl/dsa.h> 83#endif 84 85#ifndef OPENSSL_NO_DH 86#include <openssl/dh.h> 87#endif 88 89#ifdef __cplusplus 90extern "C" { 91#endif 92 93#include <openssl/x509.h> 94#include <openssl/x509v3.h> 95 96/* 97MessageImprint ::= SEQUENCE { 98 hashAlgorithm AlgorithmIdentifier, 99 hashedMessage OCTET STRING } 100*/ 101 102typedef struct TS_msg_imprint_st { 103 X509_ALGOR *hash_algo; 104 ASN1_OCTET_STRING *hashed_msg; 105} TS_MSG_IMPRINT; 106 107/* 108TimeStampReq ::= SEQUENCE { 109 version INTEGER { v1(1) }, 110 messageImprint MessageImprint, 111 --a hash algorithm OID and the hash value of the data to be 112 --time-stamped 113 reqPolicy TSAPolicyId OPTIONAL, 114 nonce INTEGER OPTIONAL, 115 certReq BOOLEAN DEFAULT FALSE, 116 extensions [0] IMPLICIT Extensions OPTIONAL } 117*/ 118 119typedef struct TS_req_st { 120 ASN1_INTEGER *version; 121 TS_MSG_IMPRINT *msg_imprint; 122 ASN1_OBJECT *policy_id; /* OPTIONAL */ 123 ASN1_INTEGER *nonce; /* OPTIONAL */ 124 ASN1_BOOLEAN cert_req; /* DEFAULT FALSE */ 125 STACK_OF(X509_EXTENSION) *extensions; /* [0] OPTIONAL */ 126} TS_REQ; 127 128/* 129Accuracy ::= SEQUENCE { 130 seconds INTEGER OPTIONAL, 131 millis [0] INTEGER (1..999) OPTIONAL, 132 micros [1] INTEGER (1..999) OPTIONAL } 133*/ 134 135typedef struct TS_accuracy_st { 136 ASN1_INTEGER *seconds; 137 ASN1_INTEGER *millis; 138 ASN1_INTEGER *micros; 139} TS_ACCURACY; 140 141/* 142TSTInfo ::= SEQUENCE { 143 version INTEGER { v1(1) }, 144 policy TSAPolicyId, 145 messageImprint MessageImprint, 146 -- MUST have the same value as the similar field in 147 -- TimeStampReq 148 serialNumber INTEGER, 149 -- Time-Stamping users MUST be ready to accommodate integers 150 -- up to 160 bits. 151 genTime GeneralizedTime, 152 accuracy Accuracy OPTIONAL, 153 ordering BOOLEAN DEFAULT FALSE, 154 nonce INTEGER OPTIONAL, 155 -- MUST be present if the similar field was present 156 -- in TimeStampReq. In that case it MUST have the same value. 157 tsa [0] GeneralName OPTIONAL, 158 extensions [1] IMPLICIT Extensions OPTIONAL } 159*/ 160 161typedef struct TS_tst_info_st { 162 ASN1_INTEGER *version; 163 ASN1_OBJECT *policy_id; 164 TS_MSG_IMPRINT *msg_imprint; 165 ASN1_INTEGER *serial; 166 ASN1_GENERALIZEDTIME *time; 167 TS_ACCURACY *accuracy; 168 ASN1_BOOLEAN ordering; 169 ASN1_INTEGER *nonce; 170 GENERAL_NAME *tsa; 171 STACK_OF(X509_EXTENSION) *extensions; 172} TS_TST_INFO; 173 174/* 175PKIStatusInfo ::= SEQUENCE { 176 status PKIStatus, 177 statusString PKIFreeText OPTIONAL, 178 failInfo PKIFailureInfo OPTIONAL } 179 180From RFC 1510 - section 3.1.1: 181PKIFreeText ::= SEQUENCE SIZE (1..MAX) OF UTF8String 182 -- text encoded as UTF-8 String (note: each UTF8String SHOULD 183 -- include an RFC 1766 language tag to indicate the language 184 -- of the contained text) 185*/ 186 187/* Possible values for status. See ts_resp_print.c && ts_resp_verify.c. */ 188 189#define TS_STATUS_GRANTED 0 190#define TS_STATUS_GRANTED_WITH_MODS 1 191#define TS_STATUS_REJECTION 2 192#define TS_STATUS_WAITING 3 193#define TS_STATUS_REVOCATION_WARNING 4 194#define TS_STATUS_REVOCATION_NOTIFICATION 5 195 196/* Possible values for failure_info. See ts_resp_print.c && ts_resp_verify.c */ 197 198#define TS_INFO_BAD_ALG 0 199#define TS_INFO_BAD_REQUEST 2 200#define TS_INFO_BAD_DATA_FORMAT 5 201#define TS_INFO_TIME_NOT_AVAILABLE 14 202#define TS_INFO_UNACCEPTED_POLICY 15 203#define TS_INFO_UNACCEPTED_EXTENSION 16 204#define TS_INFO_ADD_INFO_NOT_AVAILABLE 17 205#define TS_INFO_SYSTEM_FAILURE 25 206 207typedef struct TS_status_info_st { 208 ASN1_INTEGER *status; 209 STACK_OF(ASN1_UTF8STRING) *text; 210 ASN1_BIT_STRING *failure_info; 211} TS_STATUS_INFO; 212 213DECLARE_STACK_OF(ASN1_UTF8STRING) 214DECLARE_ASN1_SET_OF(ASN1_UTF8STRING) 215 216/* 217TimeStampResp ::= SEQUENCE { 218 status PKIStatusInfo, 219 timeStampToken TimeStampToken OPTIONAL } 220*/ 221 222typedef struct TS_resp_st { 223 TS_STATUS_INFO *status_info; 224 PKCS7 *token; 225 TS_TST_INFO *tst_info; 226} TS_RESP; 227 228/* The structure below would belong to the ESS component. */ 229 230/* 231IssuerSerial ::= SEQUENCE { 232 issuer GeneralNames, 233 serialNumber CertificateSerialNumber 234 } 235*/ 236 237typedef struct ESS_issuer_serial { 238 STACK_OF(GENERAL_NAME) *issuer; 239 ASN1_INTEGER *serial; 240} ESS_ISSUER_SERIAL; 241 242/* 243ESSCertID ::= SEQUENCE { 244 certHash Hash, 245 issuerSerial IssuerSerial OPTIONAL 246} 247*/ 248 249typedef struct ESS_cert_id { 250 ASN1_OCTET_STRING *hash; /* Always SHA-1 digest. */ 251 ESS_ISSUER_SERIAL *issuer_serial; 252} ESS_CERT_ID; 253 254DECLARE_STACK_OF(ESS_CERT_ID) 255DECLARE_ASN1_SET_OF(ESS_CERT_ID) 256 257/* 258SigningCertificate ::= SEQUENCE { 259 certs SEQUENCE OF ESSCertID, 260 policies SEQUENCE OF PolicyInformation OPTIONAL 261} 262*/ 263 264typedef struct ESS_signing_cert { 265 STACK_OF(ESS_CERT_ID) *cert_ids; 266 STACK_OF(POLICYINFO) *policy_info; 267} ESS_SIGNING_CERT; 268 269 270TS_REQ *TS_REQ_new(void); 271void TS_REQ_free(TS_REQ *a); 272int i2d_TS_REQ(const TS_REQ *a, unsigned char **pp); 273TS_REQ *d2i_TS_REQ(TS_REQ **a, const unsigned char **pp, long length); 274 275TS_REQ *TS_REQ_dup(TS_REQ *a); 276 277TS_REQ *d2i_TS_REQ_fp(FILE *fp, TS_REQ **a); 278int i2d_TS_REQ_fp(FILE *fp, TS_REQ *a); 279TS_REQ *d2i_TS_REQ_bio(BIO *fp, TS_REQ **a); 280int i2d_TS_REQ_bio(BIO *fp, TS_REQ *a); 281 282TS_MSG_IMPRINT *TS_MSG_IMPRINT_new(void); 283void TS_MSG_IMPRINT_free(TS_MSG_IMPRINT *a); 284int i2d_TS_MSG_IMPRINT(const TS_MSG_IMPRINT *a, unsigned char **pp); 285TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT(TS_MSG_IMPRINT **a, 286 const unsigned char **pp, long length); 287 288TS_MSG_IMPRINT *TS_MSG_IMPRINT_dup(TS_MSG_IMPRINT *a); 289 290TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT **a); 291int i2d_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT *a); 292TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_bio(BIO *fp, TS_MSG_IMPRINT **a); 293int i2d_TS_MSG_IMPRINT_bio(BIO *fp, TS_MSG_IMPRINT *a); 294 295TS_RESP *TS_RESP_new(void); 296void TS_RESP_free(TS_RESP *a); 297int i2d_TS_RESP(const TS_RESP *a, unsigned char **pp); 298TS_RESP *d2i_TS_RESP(TS_RESP **a, const unsigned char **pp, long length); 299TS_TST_INFO *PKCS7_to_TS_TST_INFO(PKCS7 *token); 300TS_RESP *TS_RESP_dup(TS_RESP *a); 301 302TS_RESP *d2i_TS_RESP_fp(FILE *fp, TS_RESP **a); 303int i2d_TS_RESP_fp(FILE *fp, TS_RESP *a); 304TS_RESP *d2i_TS_RESP_bio(BIO *fp, TS_RESP **a); 305int i2d_TS_RESP_bio(BIO *fp, TS_RESP *a); 306 307TS_STATUS_INFO *TS_STATUS_INFO_new(void); 308void TS_STATUS_INFO_free(TS_STATUS_INFO *a); 309int i2d_TS_STATUS_INFO(const TS_STATUS_INFO *a, unsigned char **pp); 310TS_STATUS_INFO *d2i_TS_STATUS_INFO(TS_STATUS_INFO **a, 311 const unsigned char **pp, long length); 312TS_STATUS_INFO *TS_STATUS_INFO_dup(TS_STATUS_INFO *a); 313 314TS_TST_INFO *TS_TST_INFO_new(void); 315void TS_TST_INFO_free(TS_TST_INFO *a); 316int i2d_TS_TST_INFO(const TS_TST_INFO *a, unsigned char **pp); 317TS_TST_INFO *d2i_TS_TST_INFO(TS_TST_INFO **a, const unsigned char **pp, 318 long length); 319TS_TST_INFO *TS_TST_INFO_dup(TS_TST_INFO *a); 320 321TS_TST_INFO *d2i_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO **a); 322int i2d_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO *a); 323TS_TST_INFO *d2i_TS_TST_INFO_bio(BIO *fp, TS_TST_INFO **a); 324int i2d_TS_TST_INFO_bio(BIO *fp, TS_TST_INFO *a); 325 326TS_ACCURACY *TS_ACCURACY_new(void); 327void TS_ACCURACY_free(TS_ACCURACY *a); 328int i2d_TS_ACCURACY(const TS_ACCURACY *a, unsigned char **pp); 329TS_ACCURACY *d2i_TS_ACCURACY(TS_ACCURACY **a, const unsigned char **pp, 330 long length); 331TS_ACCURACY *TS_ACCURACY_dup(TS_ACCURACY *a); 332 333ESS_ISSUER_SERIAL *ESS_ISSUER_SERIAL_new(void); 334void ESS_ISSUER_SERIAL_free(ESS_ISSUER_SERIAL *a); 335int i2d_ESS_ISSUER_SERIAL(const ESS_ISSUER_SERIAL *a, 336 unsigned char **pp); 337ESS_ISSUER_SERIAL *d2i_ESS_ISSUER_SERIAL(ESS_ISSUER_SERIAL **a, 338 const unsigned char **pp, long length); 339ESS_ISSUER_SERIAL *ESS_ISSUER_SERIAL_dup(ESS_ISSUER_SERIAL *a); 340 341ESS_CERT_ID *ESS_CERT_ID_new(void); 342void ESS_CERT_ID_free(ESS_CERT_ID *a); 343int i2d_ESS_CERT_ID(const ESS_CERT_ID *a, unsigned char **pp); 344ESS_CERT_ID *d2i_ESS_CERT_ID(ESS_CERT_ID **a, const unsigned char **pp, 345 long length); 346ESS_CERT_ID *ESS_CERT_ID_dup(ESS_CERT_ID *a); 347 348ESS_SIGNING_CERT *ESS_SIGNING_CERT_new(void); 349void ESS_SIGNING_CERT_free(ESS_SIGNING_CERT *a); 350int i2d_ESS_SIGNING_CERT(const ESS_SIGNING_CERT *a, 351 unsigned char **pp); 352ESS_SIGNING_CERT *d2i_ESS_SIGNING_CERT(ESS_SIGNING_CERT **a, 353 const unsigned char **pp, long length); 354ESS_SIGNING_CERT *ESS_SIGNING_CERT_dup(ESS_SIGNING_CERT *a); 355 356void ERR_load_TS_strings(void); 357 358int TS_REQ_set_version(TS_REQ *a, long version); 359long TS_REQ_get_version(const TS_REQ *a); 360 361int TS_REQ_set_msg_imprint(TS_REQ *a, TS_MSG_IMPRINT *msg_imprint); 362TS_MSG_IMPRINT *TS_REQ_get_msg_imprint(TS_REQ *a); 363 364int TS_MSG_IMPRINT_set_algo(TS_MSG_IMPRINT *a, X509_ALGOR *alg); 365X509_ALGOR *TS_MSG_IMPRINT_get_algo(TS_MSG_IMPRINT *a); 366 367int TS_MSG_IMPRINT_set_msg(TS_MSG_IMPRINT *a, unsigned char *d, int len); 368ASN1_OCTET_STRING *TS_MSG_IMPRINT_get_msg(TS_MSG_IMPRINT *a); 369 370int TS_REQ_set_policy_id(TS_REQ *a, ASN1_OBJECT *policy); 371ASN1_OBJECT *TS_REQ_get_policy_id(TS_REQ *a); 372 373int TS_REQ_set_nonce(TS_REQ *a, const ASN1_INTEGER *nonce); 374const ASN1_INTEGER *TS_REQ_get_nonce(const TS_REQ *a); 375 376int TS_REQ_set_cert_req(TS_REQ *a, int cert_req); 377int TS_REQ_get_cert_req(const TS_REQ *a); 378 379STACK_OF(X509_EXTENSION) *TS_REQ_get_exts(TS_REQ *a); 380void TS_REQ_ext_free(TS_REQ *a); 381int TS_REQ_get_ext_count(TS_REQ *a); 382int TS_REQ_get_ext_by_NID(TS_REQ *a, int nid, int lastpos); 383int TS_REQ_get_ext_by_OBJ(TS_REQ *a, ASN1_OBJECT *obj, int lastpos); 384int TS_REQ_get_ext_by_critical(TS_REQ *a, int crit, int lastpos); 385X509_EXTENSION *TS_REQ_get_ext(TS_REQ *a, int loc); 386X509_EXTENSION *TS_REQ_delete_ext(TS_REQ *a, int loc); 387int TS_REQ_add_ext(TS_REQ *a, X509_EXTENSION *ex, int loc); 388void *TS_REQ_get_ext_d2i(TS_REQ *a, int nid, int *crit, int *idx); 389 390/* Function declarations for TS_REQ defined in ts/ts_req_print.c */ 391 392int TS_REQ_print_bio(BIO *bio, TS_REQ *a); 393 394/* Function declarations for TS_RESP defined in ts/ts_resp_utils.c */ 395 396int TS_RESP_set_status_info(TS_RESP *a, TS_STATUS_INFO *info); 397TS_STATUS_INFO *TS_RESP_get_status_info(TS_RESP *a); 398 399/* Caller loses ownership of PKCS7 and TS_TST_INFO objects. */ 400void TS_RESP_set_tst_info(TS_RESP *a, PKCS7 *p7, TS_TST_INFO *tst_info); 401PKCS7 *TS_RESP_get_token(TS_RESP *a); 402TS_TST_INFO *TS_RESP_get_tst_info(TS_RESP *a); 403 404int TS_TST_INFO_set_version(TS_TST_INFO *a, long version); 405long TS_TST_INFO_get_version(const TS_TST_INFO *a); 406 407int TS_TST_INFO_set_policy_id(TS_TST_INFO *a, ASN1_OBJECT *policy_id); 408ASN1_OBJECT *TS_TST_INFO_get_policy_id(TS_TST_INFO *a); 409 410int TS_TST_INFO_set_msg_imprint(TS_TST_INFO *a, TS_MSG_IMPRINT *msg_imprint); 411TS_MSG_IMPRINT *TS_TST_INFO_get_msg_imprint(TS_TST_INFO *a); 412 413int TS_TST_INFO_set_serial(TS_TST_INFO *a, const ASN1_INTEGER *serial); 414const ASN1_INTEGER *TS_TST_INFO_get_serial(const TS_TST_INFO *a); 415 416int TS_TST_INFO_set_time(TS_TST_INFO *a, const ASN1_GENERALIZEDTIME *gtime); 417const ASN1_GENERALIZEDTIME *TS_TST_INFO_get_time(const TS_TST_INFO *a); 418 419int TS_TST_INFO_set_accuracy(TS_TST_INFO *a, TS_ACCURACY *accuracy); 420TS_ACCURACY *TS_TST_INFO_get_accuracy(TS_TST_INFO *a); 421 422int TS_ACCURACY_set_seconds(TS_ACCURACY *a, const ASN1_INTEGER *seconds); 423const ASN1_INTEGER *TS_ACCURACY_get_seconds(const TS_ACCURACY *a); 424 425int TS_ACCURACY_set_millis(TS_ACCURACY *a, const ASN1_INTEGER *millis); 426const ASN1_INTEGER *TS_ACCURACY_get_millis(const TS_ACCURACY *a); 427 428int TS_ACCURACY_set_micros(TS_ACCURACY *a, const ASN1_INTEGER *micros); 429const ASN1_INTEGER *TS_ACCURACY_get_micros(const TS_ACCURACY *a); 430 431int TS_TST_INFO_set_ordering(TS_TST_INFO *a, int ordering); 432int TS_TST_INFO_get_ordering(const TS_TST_INFO *a); 433 434int TS_TST_INFO_set_nonce(TS_TST_INFO *a, const ASN1_INTEGER *nonce); 435const ASN1_INTEGER *TS_TST_INFO_get_nonce(const TS_TST_INFO *a); 436 437int TS_TST_INFO_set_tsa(TS_TST_INFO *a, GENERAL_NAME *tsa); 438GENERAL_NAME *TS_TST_INFO_get_tsa(TS_TST_INFO *a); 439 440STACK_OF(X509_EXTENSION) *TS_TST_INFO_get_exts(TS_TST_INFO *a); 441void TS_TST_INFO_ext_free(TS_TST_INFO *a); 442int TS_TST_INFO_get_ext_count(TS_TST_INFO *a); 443int TS_TST_INFO_get_ext_by_NID(TS_TST_INFO *a, int nid, int lastpos); 444int TS_TST_INFO_get_ext_by_OBJ(TS_TST_INFO *a, ASN1_OBJECT *obj, int lastpos); 445int TS_TST_INFO_get_ext_by_critical(TS_TST_INFO *a, int crit, int lastpos); 446X509_EXTENSION *TS_TST_INFO_get_ext(TS_TST_INFO *a, int loc); 447X509_EXTENSION *TS_TST_INFO_delete_ext(TS_TST_INFO *a, int loc); 448int TS_TST_INFO_add_ext(TS_TST_INFO *a, X509_EXTENSION *ex, int loc); 449void *TS_TST_INFO_get_ext_d2i(TS_TST_INFO *a, int nid, int *crit, int *idx); 450 451/* Declarations related to response generation, defined in ts/ts_resp_sign.c. */ 452 453/* Optional flags for response generation. */ 454 455/* Don't include the TSA name in response. */ 456#define TS_TSA_NAME 0x01 457 458/* Set ordering to true in response. */ 459#define TS_ORDERING 0x02 460 461/* 462 * Include the signer certificate and the other specified certificates in 463 * the ESS signing certificate attribute beside the PKCS7 signed data. 464 * Only the signer certificates is included by default. 465 */ 466#define TS_ESS_CERT_ID_CHAIN 0x04 467 468/* Forward declaration. */ 469struct TS_resp_ctx; 470 471/* This must return a unique number less than 160 bits long. */ 472typedef ASN1_INTEGER *(*TS_serial_cb)(struct TS_resp_ctx *, void *); 473 474/* This must return the seconds and microseconds since Jan 1, 1970 in 475 the sec and usec variables allocated by the caller. 476 Return non-zero for success and zero for failure. */ 477typedef int (*TS_time_cb)(struct TS_resp_ctx *, void *, time_t *sec, long *usec); 478 479/* This must process the given extension. 480 * It can modify the TS_TST_INFO object of the context. 481 * Return values: !0 (processed), 0 (error, it must set the 482 * status info/failure info of the response). 483 */ 484typedef int (*TS_extension_cb)(struct TS_resp_ctx *, X509_EXTENSION *, void *); 485 486typedef struct TS_resp_ctx { 487 X509 *signer_cert; 488 EVP_PKEY *signer_key; 489 STACK_OF(X509) *certs; /* Certs to include in signed data. */ 490 STACK_OF(ASN1_OBJECT) *policies; /* Acceptable policies. */ 491 ASN1_OBJECT *default_policy; /* It may appear in policies, too. */ 492 STACK_OF(EVP_MD) *mds; /* Acceptable message digests. */ 493 ASN1_INTEGER *seconds; /* accuracy, 0 means not specified. */ 494 ASN1_INTEGER *millis; /* accuracy, 0 means not specified. */ 495 ASN1_INTEGER *micros; /* accuracy, 0 means not specified. */ 496 unsigned clock_precision_digits; /* fraction of seconds in 497 time stamp token. */ 498 unsigned flags; /* Optional info, see values above. */ 499 500 /* Callback functions. */ 501 TS_serial_cb serial_cb; 502 void *serial_cb_data; /* User data for serial_cb. */ 503 504 TS_time_cb time_cb; 505 void *time_cb_data; /* User data for time_cb. */ 506 507 TS_extension_cb extension_cb; 508 void *extension_cb_data; /* User data for extension_cb. */ 509 510 /* These members are used only while creating the response. */ 511 TS_REQ *request; 512 TS_RESP *response; 513 TS_TST_INFO *tst_info; 514} TS_RESP_CTX; 515 516DECLARE_STACK_OF(EVP_MD) 517DECLARE_ASN1_SET_OF(EVP_MD) 518 519/* Creates a response context that can be used for generating responses. */ 520TS_RESP_CTX *TS_RESP_CTX_new(void); 521void TS_RESP_CTX_free(TS_RESP_CTX *ctx); 522 523/* This parameter must be set. */ 524int TS_RESP_CTX_set_signer_cert(TS_RESP_CTX *ctx, X509 *signer); 525 526/* This parameter must be set. */ 527int TS_RESP_CTX_set_signer_key(TS_RESP_CTX *ctx, EVP_PKEY *key); 528 529/* This parameter must be set. */ 530int TS_RESP_CTX_set_def_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *def_policy); 531 532/* No additional certs are included in the response by default. */ 533int TS_RESP_CTX_set_certs(TS_RESP_CTX *ctx, STACK_OF(X509) *certs); 534 535/* Adds a new acceptable policy, only the default policy 536 is accepted by default. */ 537int TS_RESP_CTX_add_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *policy); 538 539/* Adds a new acceptable message digest. Note that no message digests 540 are accepted by default. The md argument is shared with the caller. */ 541int TS_RESP_CTX_add_md(TS_RESP_CTX *ctx, const EVP_MD *md); 542 543/* Accuracy is not included by default. */ 544int TS_RESP_CTX_set_accuracy(TS_RESP_CTX *ctx, 545 int secs, int millis, int micros); 546 547/* Clock precision digits, i.e. the number of decimal digits: 548 '0' means sec, '3' msec, '6' usec, and so on. Default is 0. */ 549int TS_RESP_CTX_set_clock_precision_digits(TS_RESP_CTX *ctx, 550 unsigned clock_precision_digits); 551/* At most we accept usec precision. */ 552#define TS_MAX_CLOCK_PRECISION_DIGITS 6 553 554/* No flags are set by default. */ 555void TS_RESP_CTX_add_flags(TS_RESP_CTX *ctx, int flags); 556 557/* Default callback always returns a constant. */ 558void TS_RESP_CTX_set_serial_cb(TS_RESP_CTX *ctx, TS_serial_cb cb, void *data); 559 560/* Default callback rejects all extensions. The extension callback is called 561 * when the TS_TST_INFO object is already set up and not signed yet. */ 562/* FIXME: extension handling is not tested yet. */ 563void TS_RESP_CTX_set_extension_cb(TS_RESP_CTX *ctx, 564 TS_extension_cb cb, void *data); 565 566/* The following methods can be used in the callbacks. */ 567int TS_RESP_CTX_set_status_info(TS_RESP_CTX *ctx, 568 int status, const char *text); 569 570/* Sets the status info only if it is still TS_STATUS_GRANTED. */ 571int TS_RESP_CTX_set_status_info_cond(TS_RESP_CTX *ctx, 572 int status, const char *text); 573 574int TS_RESP_CTX_add_failure_info(TS_RESP_CTX *ctx, int failure); 575 576/* The get methods below can be used in the extension callback. */ 577TS_REQ *TS_RESP_CTX_get_request(TS_RESP_CTX *ctx); 578 579TS_TST_INFO *TS_RESP_CTX_get_tst_info(TS_RESP_CTX *ctx); 580 581/* 582 * Creates the signed TS_TST_INFO and puts it in TS_RESP. 583 * In case of errors it sets the status info properly. 584 * Returns NULL only in case of memory allocation/fatal error. 585 */ 586TS_RESP *TS_RESP_create_response(TS_RESP_CTX *ctx, BIO *req_bio); 587 588/* 589 * Declarations related to response verification, 590 * they are defined in ts/ts_resp_verify.c. 591 */ 592 593int TS_RESP_verify_signature(PKCS7 *token, STACK_OF(X509) *certs, 594 X509_STORE *store, X509 **signer_out); 595 596/* Context structure for the generic verify method. */ 597 598/* Verify the signer's certificate and the signature of the response. */ 599#define TS_VFY_SIGNATURE (1u << 0) 600/* Verify the version number of the response. */ 601#define TS_VFY_VERSION (1u << 1) 602/* Verify if the policy supplied by the user matches the policy of the TSA. */ 603#define TS_VFY_POLICY (1u << 2) 604/* Verify the message imprint provided by the user. This flag should not be 605 specified with TS_VFY_DATA. */ 606#define TS_VFY_IMPRINT (1u << 3) 607/* Verify the message imprint computed by the verify method from the user 608 provided data and the MD algorithm of the response. This flag should not be 609 specified with TS_VFY_IMPRINT. */ 610#define TS_VFY_DATA (1u << 4) 611/* Verify the nonce value. */ 612#define TS_VFY_NONCE (1u << 5) 613/* Verify if the TSA name field matches the signer certificate. */ 614#define TS_VFY_SIGNER (1u << 6) 615/* Verify if the TSA name field equals to the user provided name. */ 616#define TS_VFY_TSA_NAME (1u << 7) 617 618/* You can use the following convenience constants. */ 619#define TS_VFY_ALL_IMPRINT (TS_VFY_SIGNATURE \ 620 | TS_VFY_VERSION \ 621 | TS_VFY_POLICY \ 622 | TS_VFY_IMPRINT \ 623 | TS_VFY_NONCE \ 624 | TS_VFY_SIGNER \ 625 | TS_VFY_TSA_NAME) 626#define TS_VFY_ALL_DATA (TS_VFY_SIGNATURE \ 627 | TS_VFY_VERSION \ 628 | TS_VFY_POLICY \ 629 | TS_VFY_DATA \ 630 | TS_VFY_NONCE \ 631 | TS_VFY_SIGNER \ 632 | TS_VFY_TSA_NAME) 633 634typedef struct TS_verify_ctx { 635 /* Set this to the union of TS_VFY_... flags you want to carry out. */ 636 unsigned flags; 637 638 /* Must be set only with TS_VFY_SIGNATURE. certs is optional. */ 639 X509_STORE *store; 640 STACK_OF(X509) *certs; 641 642 /* Must be set only with TS_VFY_POLICY. */ 643 ASN1_OBJECT *policy; 644 645 /* Must be set only with TS_VFY_IMPRINT. If md_alg is NULL, 646 the algorithm from the response is used. */ 647 X509_ALGOR *md_alg; 648 unsigned char *imprint; 649 unsigned imprint_len; 650 651 /* Must be set only with TS_VFY_DATA. */ 652 BIO *data; 653 654 /* Must be set only with TS_VFY_TSA_NAME. */ 655 ASN1_INTEGER *nonce; 656 657 /* Must be set only with TS_VFY_TSA_NAME. */ 658 GENERAL_NAME *tsa_name; 659} TS_VERIFY_CTX; 660 661int TS_RESP_verify_response(TS_VERIFY_CTX *ctx, TS_RESP *response); 662int TS_RESP_verify_token(TS_VERIFY_CTX *ctx, PKCS7 *token); 663 664/* 665 * Declarations related to response verification context, 666 * they are defined in ts/ts_verify_ctx.c. 667 */ 668 669/* Set all fields to zero. */ 670TS_VERIFY_CTX *TS_VERIFY_CTX_new(void); 671void TS_VERIFY_CTX_init(TS_VERIFY_CTX *ctx); 672void TS_VERIFY_CTX_free(TS_VERIFY_CTX *ctx); 673void TS_VERIFY_CTX_cleanup(TS_VERIFY_CTX *ctx); 674 675/* 676 * If ctx is NULL, it allocates and returns a new object, otherwise 677 * it returns ctx. It initialises all the members as follows: 678 * flags = TS_VFY_ALL_IMPRINT & ~(TS_VFY_TSA_NAME | TS_VFY_SIGNATURE) 679 * certs = NULL 680 * store = NULL 681 * policy = policy from the request or NULL if absent (in this case 682 * TS_VFY_POLICY is cleared from flags as well) 683 * md_alg = MD algorithm from request 684 * imprint, imprint_len = imprint from request 685 * data = NULL 686 * nonce, nonce_len = nonce from the request or NULL if absent (in this case 687 * TS_VFY_NONCE is cleared from flags as well) 688 * tsa_name = NULL 689 * Important: after calling this method TS_VFY_SIGNATURE should be added! 690 */ 691TS_VERIFY_CTX *TS_REQ_to_TS_VERIFY_CTX(TS_REQ *req, TS_VERIFY_CTX *ctx); 692 693/* Function declarations for TS_RESP defined in ts/ts_resp_print.c */ 694 695int TS_RESP_print_bio(BIO *bio, TS_RESP *a); 696int TS_STATUS_INFO_print_bio(BIO *bio, TS_STATUS_INFO *a); 697int TS_TST_INFO_print_bio(BIO *bio, TS_TST_INFO *a); 698 699/* Common utility functions defined in ts/ts_lib.c */ 700 701int TS_ASN1_INTEGER_print_bio(BIO *bio, const ASN1_INTEGER *num); 702int TS_OBJ_print_bio(BIO *bio, const ASN1_OBJECT *obj); 703int TS_ext_print_bio(BIO *bio, const STACK_OF(X509_EXTENSION) *extensions); 704int TS_X509_ALGOR_print_bio(BIO *bio, const X509_ALGOR *alg); 705int TS_MSG_IMPRINT_print_bio(BIO *bio, TS_MSG_IMPRINT *msg); 706 707/* Function declarations for handling configuration options, 708 defined in ts/ts_conf.c */ 709 710X509 *TS_CONF_load_cert(const char *file); 711STACK_OF(X509) *TS_CONF_load_certs(const char *file); 712EVP_PKEY *TS_CONF_load_key(const char *file, const char *pass); 713const char *TS_CONF_get_tsa_section(CONF *conf, const char *section); 714int TS_CONF_set_serial(CONF *conf, const char *section, TS_serial_cb cb, 715 TS_RESP_CTX *ctx); 716int TS_CONF_set_crypto_device(CONF *conf, const char *section, 717 const char *device); 718int TS_CONF_set_default_engine(const char *name); 719int TS_CONF_set_signer_cert(CONF *conf, const char *section, 720 const char *cert, TS_RESP_CTX *ctx); 721int TS_CONF_set_certs(CONF *conf, const char *section, const char *certs, 722 TS_RESP_CTX *ctx); 723int TS_CONF_set_signer_key(CONF *conf, const char *section, 724 const char *key, const char *pass, TS_RESP_CTX *ctx); 725int TS_CONF_set_def_policy(CONF *conf, const char *section, 726 const char *policy, TS_RESP_CTX *ctx); 727int TS_CONF_set_policies(CONF *conf, const char *section, TS_RESP_CTX *ctx); 728int TS_CONF_set_digests(CONF *conf, const char *section, TS_RESP_CTX *ctx); 729int TS_CONF_set_accuracy(CONF *conf, const char *section, TS_RESP_CTX *ctx); 730int TS_CONF_set_clock_precision_digits(CONF *conf, const char *section, 731 TS_RESP_CTX *ctx); 732int TS_CONF_set_ordering(CONF *conf, const char *section, TS_RESP_CTX *ctx); 733int TS_CONF_set_tsa_name(CONF *conf, const char *section, TS_RESP_CTX *ctx); 734int TS_CONF_set_ess_cert_id_chain(CONF *conf, const char *section, 735 TS_RESP_CTX *ctx); 736 737/* -------------------------------------------------- */ 738/* BEGIN ERROR CODES */ 739/* The following lines are auto generated by the script mkerr.pl. Any changes 740 * made after this point may be overwritten when the script is next run. 741 */ 742void ERR_load_TS_strings(void); 743 744/* Error codes for the TS functions. */ 745 746/* Function codes. */ 747#define TS_F_D2I_TS_RESP 147 748#define TS_F_DEF_SERIAL_CB 110 749#define TS_F_DEF_TIME_CB 111 750#define TS_F_ESS_ADD_SIGNING_CERT 112 751#define TS_F_ESS_CERT_ID_NEW_INIT 113 752#define TS_F_ESS_SIGNING_CERT_NEW_INIT 114 753#define TS_F_INT_TS_RESP_VERIFY_TOKEN 149 754#define TS_F_PKCS7_TO_TS_TST_INFO 148 755#define TS_F_TS_ACCURACY_SET_MICROS 115 756#define TS_F_TS_ACCURACY_SET_MILLIS 116 757#define TS_F_TS_ACCURACY_SET_SECONDS 117 758#define TS_F_TS_CHECK_IMPRINTS 100 759#define TS_F_TS_CHECK_NONCES 101 760#define TS_F_TS_CHECK_POLICY 102 761#define TS_F_TS_CHECK_SIGNING_CERTS 103 762#define TS_F_TS_CHECK_STATUS_INFO 104 763#define TS_F_TS_COMPUTE_IMPRINT 145 764#define TS_F_TS_CONF_SET_DEFAULT_ENGINE 146 765#define TS_F_TS_GET_STATUS_TEXT 105 766#define TS_F_TS_MSG_IMPRINT_SET_ALGO 118 767#define TS_F_TS_REQ_SET_MSG_IMPRINT 119 768#define TS_F_TS_REQ_SET_NONCE 120 769#define TS_F_TS_REQ_SET_POLICY_ID 121 770#define TS_F_TS_RESP_CREATE_RESPONSE 122 771#define TS_F_TS_RESP_CREATE_TST_INFO 123 772#define TS_F_TS_RESP_CTX_ADD_FAILURE_INFO 124 773#define TS_F_TS_RESP_CTX_ADD_MD 125 774#define TS_F_TS_RESP_CTX_ADD_POLICY 126 775#define TS_F_TS_RESP_CTX_NEW 127 776#define TS_F_TS_RESP_CTX_SET_ACCURACY 128 777#define TS_F_TS_RESP_CTX_SET_CERTS 129 778#define TS_F_TS_RESP_CTX_SET_DEF_POLICY 130 779#define TS_F_TS_RESP_CTX_SET_SIGNER_CERT 131 780#define TS_F_TS_RESP_CTX_SET_STATUS_INFO 132 781#define TS_F_TS_RESP_GET_POLICY 133 782#define TS_F_TS_RESP_SET_GENTIME_WITH_PRECISION 134 783#define TS_F_TS_RESP_SET_STATUS_INFO 135 784#define TS_F_TS_RESP_SET_TST_INFO 150 785#define TS_F_TS_RESP_SIGN 136 786#define TS_F_TS_RESP_VERIFY_SIGNATURE 106 787#define TS_F_TS_RESP_VERIFY_TOKEN 107 788#define TS_F_TS_TST_INFO_SET_ACCURACY 137 789#define TS_F_TS_TST_INFO_SET_MSG_IMPRINT 138 790#define TS_F_TS_TST_INFO_SET_NONCE 139 791#define TS_F_TS_TST_INFO_SET_POLICY_ID 140 792#define TS_F_TS_TST_INFO_SET_SERIAL 141 793#define TS_F_TS_TST_INFO_SET_TIME 142 794#define TS_F_TS_TST_INFO_SET_TSA 143 795#define TS_F_TS_VERIFY 108 796#define TS_F_TS_VERIFY_CERT 109 797#define TS_F_TS_VERIFY_CTX_NEW 144 798 799/* Reason codes. */ 800#define TS_R_BAD_PKCS7_TYPE 132 801#define TS_R_BAD_TYPE 133 802#define TS_R_CERTIFICATE_VERIFY_ERROR 100 803#define TS_R_COULD_NOT_SET_ENGINE 127 804#define TS_R_COULD_NOT_SET_TIME 115 805#define TS_R_D2I_TS_RESP_INT_FAILED 128 806#define TS_R_DETACHED_CONTENT 134 807#define TS_R_ESS_ADD_SIGNING_CERT_ERROR 116 808#define TS_R_ESS_SIGNING_CERTIFICATE_ERROR 101 809#define TS_R_INVALID_NULL_POINTER 102 810#define TS_R_INVALID_SIGNER_CERTIFICATE_PURPOSE 117 811#define TS_R_MESSAGE_IMPRINT_MISMATCH 103 812#define TS_R_NONCE_MISMATCH 104 813#define TS_R_NONCE_NOT_RETURNED 105 814#define TS_R_NO_CONTENT 106 815#define TS_R_NO_TIME_STAMP_TOKEN 107 816#define TS_R_PKCS7_ADD_SIGNATURE_ERROR 118 817#define TS_R_PKCS7_ADD_SIGNED_ATTR_ERROR 119 818#define TS_R_PKCS7_TO_TS_TST_INFO_FAILED 129 819#define TS_R_POLICY_MISMATCH 108 820#define TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE 120 821#define TS_R_RESPONSE_SETUP_ERROR 121 822#define TS_R_SIGNATURE_FAILURE 109 823#define TS_R_THERE_MUST_BE_ONE_SIGNER 110 824#define TS_R_TIME_SYSCALL_ERROR 122 825#define TS_R_TOKEN_NOT_PRESENT 130 826#define TS_R_TOKEN_PRESENT 131 827#define TS_R_TSA_NAME_MISMATCH 111 828#define TS_R_TSA_UNTRUSTED 112 829#define TS_R_TST_INFO_SETUP_ERROR 123 830#define TS_R_TS_DATASIGN 124 831#define TS_R_UNACCEPTABLE_POLICY 125 832#define TS_R_UNSUPPORTED_MD_ALGORITHM 126 833#define TS_R_UNSUPPORTED_VERSION 113 834#define TS_R_WRONG_CONTENT_TYPE 114 835 836#ifdef __cplusplus 837} 838#endif 839#endif 840