1 /* $OpenBSD: ts.h,v 1.13 2022/07/16 18:36:36 kn Exp $ */ 2 /* Written by Zoltan Glozik (zglozik@opentsa.org) for the OpenSSL 3 * project 2002, 2003, 2004. 4 */ 5 /* ==================================================================== 6 * Copyright (c) 2006 The OpenSSL Project. All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in 17 * the documentation and/or other materials provided with the 18 * distribution. 19 * 20 * 3. All advertising materials mentioning features or use of this 21 * software must display the following acknowledgment: 22 * "This product includes software developed by the OpenSSL Project 23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" 24 * 25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 26 * endorse or promote products derived from this software without 27 * prior written permission. For written permission, please contact 28 * licensing@OpenSSL.org. 29 * 30 * 5. Products derived from this software may not be called "OpenSSL" 31 * nor may "OpenSSL" appear in their names without prior written 32 * permission of the OpenSSL Project. 33 * 34 * 6. Redistributions of any form whatsoever must retain the following 35 * acknowledgment: 36 * "This product includes software developed by the OpenSSL Project 37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" 38 * 39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 50 * OF THE POSSIBILITY OF SUCH DAMAGE. 51 * ==================================================================== 52 * 53 * This product includes cryptographic software written by Eric Young 54 * (eay@cryptsoft.com). This product includes software written by Tim 55 * Hudson (tjh@cryptsoft.com). 56 * 57 */ 58 59 #ifndef HEADER_TS_H 60 #define HEADER_TS_H 61 62 #include <openssl/opensslconf.h> 63 64 #ifndef OPENSSL_NO_BUFFER 65 #include <openssl/buffer.h> 66 #endif 67 #ifndef OPENSSL_NO_EVP 68 #include <openssl/evp.h> 69 #endif 70 #ifndef OPENSSL_NO_BIO 71 #include <openssl/bio.h> 72 #endif 73 #include <openssl/stack.h> 74 #include <openssl/asn1.h> 75 #include <openssl/safestack.h> 76 77 #ifndef OPENSSL_NO_RSA 78 #include <openssl/rsa.h> 79 #endif 80 81 #ifndef OPENSSL_NO_DSA 82 #include <openssl/dsa.h> 83 #endif 84 85 #ifndef OPENSSL_NO_DH 86 #include <openssl/dh.h> 87 #endif 88 89 #ifdef __cplusplus 90 extern "C" { 91 #endif 92 93 #include <openssl/x509.h> 94 #include <openssl/x509v3.h> 95 96 /* 97 MessageImprint ::= SEQUENCE { 98 hashAlgorithm AlgorithmIdentifier, 99 hashedMessage OCTET STRING } 100 */ 101 102 typedef struct TS_msg_imprint_st { 103 X509_ALGOR *hash_algo; 104 ASN1_OCTET_STRING *hashed_msg; 105 } TS_MSG_IMPRINT; 106 107 /* 108 TimeStampReq ::= SEQUENCE { 109 version INTEGER { v1(1) }, 110 messageImprint MessageImprint, 111 --a hash algorithm OID and the hash value of the data to be 112 --time-stamped 113 reqPolicy TSAPolicyId OPTIONAL, 114 nonce INTEGER OPTIONAL, 115 certReq BOOLEAN DEFAULT FALSE, 116 extensions [0] IMPLICIT Extensions OPTIONAL } 117 */ 118 119 typedef struct TS_req_st { 120 ASN1_INTEGER *version; 121 TS_MSG_IMPRINT *msg_imprint; 122 ASN1_OBJECT *policy_id; /* OPTIONAL */ 123 ASN1_INTEGER *nonce; /* OPTIONAL */ 124 ASN1_BOOLEAN cert_req; /* DEFAULT FALSE */ 125 STACK_OF(X509_EXTENSION) *extensions; /* [0] OPTIONAL */ 126 } TS_REQ; 127 128 /* 129 Accuracy ::= SEQUENCE { 130 seconds INTEGER OPTIONAL, 131 millis [0] INTEGER (1..999) OPTIONAL, 132 micros [1] INTEGER (1..999) OPTIONAL } 133 */ 134 135 typedef struct TS_accuracy_st { 136 ASN1_INTEGER *seconds; 137 ASN1_INTEGER *millis; 138 ASN1_INTEGER *micros; 139 } TS_ACCURACY; 140 141 /* 142 TSTInfo ::= SEQUENCE { 143 version INTEGER { v1(1) }, 144 policy TSAPolicyId, 145 messageImprint MessageImprint, 146 -- MUST have the same value as the similar field in 147 -- TimeStampReq 148 serialNumber INTEGER, 149 -- Time-Stamping users MUST be ready to accommodate integers 150 -- up to 160 bits. 151 genTime GeneralizedTime, 152 accuracy Accuracy OPTIONAL, 153 ordering BOOLEAN DEFAULT FALSE, 154 nonce INTEGER OPTIONAL, 155 -- MUST be present if the similar field was present 156 -- in TimeStampReq. In that case it MUST have the same value. 157 tsa [0] GeneralName OPTIONAL, 158 extensions [1] IMPLICIT Extensions OPTIONAL } 159 */ 160 161 typedef struct TS_tst_info_st { 162 ASN1_INTEGER *version; 163 ASN1_OBJECT *policy_id; 164 TS_MSG_IMPRINT *msg_imprint; 165 ASN1_INTEGER *serial; 166 ASN1_GENERALIZEDTIME *time; 167 TS_ACCURACY *accuracy; 168 ASN1_BOOLEAN ordering; 169 ASN1_INTEGER *nonce; 170 GENERAL_NAME *tsa; 171 STACK_OF(X509_EXTENSION) *extensions; 172 } TS_TST_INFO; 173 174 /* 175 PKIStatusInfo ::= SEQUENCE { 176 status PKIStatus, 177 statusString PKIFreeText OPTIONAL, 178 failInfo PKIFailureInfo OPTIONAL } 179 180 From RFC 1510 - section 3.1.1: 181 PKIFreeText ::= SEQUENCE SIZE (1..MAX) OF UTF8String 182 -- text encoded as UTF-8 String (note: each UTF8String SHOULD 183 -- include an RFC 1766 language tag to indicate the language 184 -- of the contained text) 185 */ 186 187 /* Possible values for status. See ts_resp_print.c && ts_resp_verify.c. */ 188 189 #define TS_STATUS_GRANTED 0 190 #define TS_STATUS_GRANTED_WITH_MODS 1 191 #define TS_STATUS_REJECTION 2 192 #define TS_STATUS_WAITING 3 193 #define TS_STATUS_REVOCATION_WARNING 4 194 #define TS_STATUS_REVOCATION_NOTIFICATION 5 195 196 /* Possible values for failure_info. See ts_resp_print.c && ts_resp_verify.c */ 197 198 #define TS_INFO_BAD_ALG 0 199 #define TS_INFO_BAD_REQUEST 2 200 #define TS_INFO_BAD_DATA_FORMAT 5 201 #define TS_INFO_TIME_NOT_AVAILABLE 14 202 #define TS_INFO_UNACCEPTED_POLICY 15 203 #define TS_INFO_UNACCEPTED_EXTENSION 16 204 #define TS_INFO_ADD_INFO_NOT_AVAILABLE 17 205 #define TS_INFO_SYSTEM_FAILURE 25 206 207 typedef struct TS_status_info_st { 208 ASN1_INTEGER *status; 209 STACK_OF(ASN1_UTF8STRING) *text; 210 ASN1_BIT_STRING *failure_info; 211 } TS_STATUS_INFO; 212 213 DECLARE_STACK_OF(ASN1_UTF8STRING) 214 215 /* 216 TimeStampResp ::= SEQUENCE { 217 status PKIStatusInfo, 218 timeStampToken TimeStampToken OPTIONAL } 219 */ 220 221 typedef struct TS_resp_st { 222 TS_STATUS_INFO *status_info; 223 PKCS7 *token; 224 TS_TST_INFO *tst_info; 225 } TS_RESP; 226 227 /* The structure below would belong to the ESS component. */ 228 229 /* 230 IssuerSerial ::= SEQUENCE { 231 issuer GeneralNames, 232 serialNumber CertificateSerialNumber 233 } 234 */ 235 236 typedef struct ESS_issuer_serial { 237 STACK_OF(GENERAL_NAME) *issuer; 238 ASN1_INTEGER *serial; 239 } ESS_ISSUER_SERIAL; 240 241 /* 242 ESSCertID ::= SEQUENCE { 243 certHash Hash, 244 issuerSerial IssuerSerial OPTIONAL 245 } 246 */ 247 248 typedef struct ESS_cert_id { 249 ASN1_OCTET_STRING *hash; /* Always SHA-1 digest. */ 250 ESS_ISSUER_SERIAL *issuer_serial; 251 } ESS_CERT_ID; 252 253 DECLARE_STACK_OF(ESS_CERT_ID) 254 255 /* 256 SigningCertificate ::= SEQUENCE { 257 certs SEQUENCE OF ESSCertID, 258 policies SEQUENCE OF PolicyInformation OPTIONAL 259 } 260 */ 261 262 typedef struct ESS_signing_cert { 263 STACK_OF(ESS_CERT_ID) *cert_ids; 264 STACK_OF(POLICYINFO) *policy_info; 265 } ESS_SIGNING_CERT; 266 267 #ifdef LIBRESSL_INTERNAL 268 /* 269 * ESSCertIDv2 ::= SEQUENCE { 270 * hashAlgorithm AlgorithmIdentifier 271 * DEFAULT {algorithm id-sha256}, 272 * certHash Hash, 273 * issuerSerial IssuerSerial OPTIONAL } 274 */ 275 276 typedef struct ESS_cert_id_v2 { 277 X509_ALGOR *hash_alg; /* Default SHA-256. */ 278 ASN1_OCTET_STRING *hash; 279 ESS_ISSUER_SERIAL *issuer_serial; 280 } ESS_CERT_ID_V2; 281 282 DECLARE_STACK_OF(ESS_CERT_ID_V2) 283 284 /* 285 * SigningCertificateV2 ::= SEQUENCE { 286 * certs SEQUENCE OF ESSCertIDv2, 287 * policies SEQUENCE OF PolicyInformation OPTIONAL } 288 */ 289 290 typedef struct ESS_signing_cert_v2 { 291 STACK_OF(ESS_CERT_ID_V2) *cert_ids; 292 STACK_OF(POLICYINFO) *policy_info; 293 } ESS_SIGNING_CERT_V2; 294 #endif /* LIBRESSL_INTERNAL */ 295 296 TS_REQ *TS_REQ_new(void); 297 void TS_REQ_free(TS_REQ *a); 298 int i2d_TS_REQ(const TS_REQ *a, unsigned char **pp); 299 TS_REQ *d2i_TS_REQ(TS_REQ **a, const unsigned char **pp, long length); 300 301 TS_REQ *TS_REQ_dup(TS_REQ *a); 302 303 TS_REQ *d2i_TS_REQ_fp(FILE *fp, TS_REQ **a); 304 int i2d_TS_REQ_fp(FILE *fp, TS_REQ *a); 305 TS_REQ *d2i_TS_REQ_bio(BIO *fp, TS_REQ **a); 306 int i2d_TS_REQ_bio(BIO *fp, TS_REQ *a); 307 308 TS_MSG_IMPRINT *TS_MSG_IMPRINT_new(void); 309 void TS_MSG_IMPRINT_free(TS_MSG_IMPRINT *a); 310 int i2d_TS_MSG_IMPRINT(const TS_MSG_IMPRINT *a, unsigned char **pp); 311 TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT(TS_MSG_IMPRINT **a, 312 const unsigned char **pp, long length); 313 314 TS_MSG_IMPRINT *TS_MSG_IMPRINT_dup(TS_MSG_IMPRINT *a); 315 316 TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT **a); 317 int i2d_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT *a); 318 TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_bio(BIO *fp, TS_MSG_IMPRINT **a); 319 int i2d_TS_MSG_IMPRINT_bio(BIO *fp, TS_MSG_IMPRINT *a); 320 321 TS_RESP *TS_RESP_new(void); 322 void TS_RESP_free(TS_RESP *a); 323 int i2d_TS_RESP(const TS_RESP *a, unsigned char **pp); 324 TS_RESP *d2i_TS_RESP(TS_RESP **a, const unsigned char **pp, long length); 325 TS_TST_INFO *PKCS7_to_TS_TST_INFO(PKCS7 *token); 326 TS_RESP *TS_RESP_dup(TS_RESP *a); 327 328 TS_RESP *d2i_TS_RESP_fp(FILE *fp, TS_RESP **a); 329 int i2d_TS_RESP_fp(FILE *fp, TS_RESP *a); 330 TS_RESP *d2i_TS_RESP_bio(BIO *fp, TS_RESP **a); 331 int i2d_TS_RESP_bio(BIO *fp, TS_RESP *a); 332 333 TS_STATUS_INFO *TS_STATUS_INFO_new(void); 334 void TS_STATUS_INFO_free(TS_STATUS_INFO *a); 335 int i2d_TS_STATUS_INFO(const TS_STATUS_INFO *a, unsigned char **pp); 336 TS_STATUS_INFO *d2i_TS_STATUS_INFO(TS_STATUS_INFO **a, 337 const unsigned char **pp, long length); 338 TS_STATUS_INFO *TS_STATUS_INFO_dup(TS_STATUS_INFO *a); 339 340 TS_TST_INFO *TS_TST_INFO_new(void); 341 void TS_TST_INFO_free(TS_TST_INFO *a); 342 int i2d_TS_TST_INFO(const TS_TST_INFO *a, unsigned char **pp); 343 TS_TST_INFO *d2i_TS_TST_INFO(TS_TST_INFO **a, const unsigned char **pp, 344 long length); 345 TS_TST_INFO *TS_TST_INFO_dup(TS_TST_INFO *a); 346 347 TS_TST_INFO *d2i_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO **a); 348 int i2d_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO *a); 349 TS_TST_INFO *d2i_TS_TST_INFO_bio(BIO *fp, TS_TST_INFO **a); 350 int i2d_TS_TST_INFO_bio(BIO *fp, TS_TST_INFO *a); 351 352 TS_ACCURACY *TS_ACCURACY_new(void); 353 void TS_ACCURACY_free(TS_ACCURACY *a); 354 int i2d_TS_ACCURACY(const TS_ACCURACY *a, unsigned char **pp); 355 TS_ACCURACY *d2i_TS_ACCURACY(TS_ACCURACY **a, const unsigned char **pp, 356 long length); 357 TS_ACCURACY *TS_ACCURACY_dup(TS_ACCURACY *a); 358 359 ESS_ISSUER_SERIAL *ESS_ISSUER_SERIAL_new(void); 360 void ESS_ISSUER_SERIAL_free(ESS_ISSUER_SERIAL *a); 361 int i2d_ESS_ISSUER_SERIAL(const ESS_ISSUER_SERIAL *a, 362 unsigned char **pp); 363 ESS_ISSUER_SERIAL *d2i_ESS_ISSUER_SERIAL(ESS_ISSUER_SERIAL **a, 364 const unsigned char **pp, long length); 365 ESS_ISSUER_SERIAL *ESS_ISSUER_SERIAL_dup(ESS_ISSUER_SERIAL *a); 366 367 ESS_CERT_ID *ESS_CERT_ID_new(void); 368 void ESS_CERT_ID_free(ESS_CERT_ID *a); 369 int i2d_ESS_CERT_ID(const ESS_CERT_ID *a, unsigned char **pp); 370 ESS_CERT_ID *d2i_ESS_CERT_ID(ESS_CERT_ID **a, const unsigned char **pp, 371 long length); 372 ESS_CERT_ID *ESS_CERT_ID_dup(ESS_CERT_ID *a); 373 374 ESS_SIGNING_CERT *ESS_SIGNING_CERT_new(void); 375 void ESS_SIGNING_CERT_free(ESS_SIGNING_CERT *a); 376 int i2d_ESS_SIGNING_CERT(const ESS_SIGNING_CERT *a, 377 unsigned char **pp); 378 ESS_SIGNING_CERT *d2i_ESS_SIGNING_CERT(ESS_SIGNING_CERT **a, 379 const unsigned char **pp, long length); 380 ESS_SIGNING_CERT *ESS_SIGNING_CERT_dup(ESS_SIGNING_CERT *a); 381 382 #ifdef LIBRESSL_INTERNAL 383 ESS_CERT_ID_V2 *ESS_CERT_ID_V2_new(void); 384 void ESS_CERT_ID_V2_free(ESS_CERT_ID_V2 *a); 385 int i2d_ESS_CERT_ID_V2(const ESS_CERT_ID_V2 *a, unsigned char **pp); 386 ESS_CERT_ID_V2 *d2i_ESS_CERT_ID_V2(ESS_CERT_ID_V2 **a, const unsigned char **pp, 387 long length); 388 ESS_CERT_ID_V2 *ESS_CERT_ID_V2_dup(ESS_CERT_ID_V2 *a); 389 390 ESS_SIGNING_CERT_V2 *ESS_SIGNING_CERT_V2_new(void); 391 void ESS_SIGNING_CERT_V2_free(ESS_SIGNING_CERT_V2 *a); 392 int i2d_ESS_SIGNING_CERT_V2(const ESS_SIGNING_CERT_V2 *a, 393 unsigned char **pp); 394 ESS_SIGNING_CERT_V2 *d2i_ESS_SIGNING_CERT_V2(ESS_SIGNING_CERT_V2 **a, 395 const unsigned char **pp, long length); 396 ESS_SIGNING_CERT_V2 *ESS_SIGNING_CERT_V2_dup(ESS_SIGNING_CERT_V2 *a); 397 #endif /* LIBRESSL_INTERNAL */ 398 399 int TS_REQ_set_version(TS_REQ *a, long version); 400 long TS_REQ_get_version(const TS_REQ *a); 401 402 int TS_REQ_set_msg_imprint(TS_REQ *a, TS_MSG_IMPRINT *msg_imprint); 403 TS_MSG_IMPRINT *TS_REQ_get_msg_imprint(TS_REQ *a); 404 405 int TS_MSG_IMPRINT_set_algo(TS_MSG_IMPRINT *a, X509_ALGOR *alg); 406 X509_ALGOR *TS_MSG_IMPRINT_get_algo(TS_MSG_IMPRINT *a); 407 408 int TS_MSG_IMPRINT_set_msg(TS_MSG_IMPRINT *a, unsigned char *d, int len); 409 ASN1_OCTET_STRING *TS_MSG_IMPRINT_get_msg(TS_MSG_IMPRINT *a); 410 411 int TS_REQ_set_policy_id(TS_REQ *a, const ASN1_OBJECT *policy); 412 ASN1_OBJECT *TS_REQ_get_policy_id(TS_REQ *a); 413 414 int TS_REQ_set_nonce(TS_REQ *a, const ASN1_INTEGER *nonce); 415 const ASN1_INTEGER *TS_REQ_get_nonce(const TS_REQ *a); 416 417 int TS_REQ_set_cert_req(TS_REQ *a, int cert_req); 418 int TS_REQ_get_cert_req(const TS_REQ *a); 419 420 STACK_OF(X509_EXTENSION) *TS_REQ_get_exts(TS_REQ *a); 421 void TS_REQ_ext_free(TS_REQ *a); 422 int TS_REQ_get_ext_count(TS_REQ *a); 423 int TS_REQ_get_ext_by_NID(TS_REQ *a, int nid, int lastpos); 424 int TS_REQ_get_ext_by_OBJ(TS_REQ *a, const ASN1_OBJECT *obj, int lastpos); 425 int TS_REQ_get_ext_by_critical(TS_REQ *a, int crit, int lastpos); 426 X509_EXTENSION *TS_REQ_get_ext(TS_REQ *a, int loc); 427 X509_EXTENSION *TS_REQ_delete_ext(TS_REQ *a, int loc); 428 int TS_REQ_add_ext(TS_REQ *a, X509_EXTENSION *ex, int loc); 429 void *TS_REQ_get_ext_d2i(TS_REQ *a, int nid, int *crit, int *idx); 430 431 /* Function declarations for TS_REQ defined in ts/ts_req_print.c */ 432 433 int TS_REQ_print_bio(BIO *bio, TS_REQ *a); 434 435 /* Function declarations for TS_RESP defined in ts/ts_resp_utils.c */ 436 437 int TS_RESP_set_status_info(TS_RESP *a, TS_STATUS_INFO *info); 438 TS_STATUS_INFO *TS_RESP_get_status_info(TS_RESP *a); 439 440 /* Caller loses ownership of PKCS7 and TS_TST_INFO objects. */ 441 void TS_RESP_set_tst_info(TS_RESP *a, PKCS7 *p7, TS_TST_INFO *tst_info); 442 PKCS7 *TS_RESP_get_token(TS_RESP *a); 443 TS_TST_INFO *TS_RESP_get_tst_info(TS_RESP *a); 444 445 int TS_TST_INFO_set_version(TS_TST_INFO *a, long version); 446 long TS_TST_INFO_get_version(const TS_TST_INFO *a); 447 448 int TS_TST_INFO_set_policy_id(TS_TST_INFO *a, ASN1_OBJECT *policy_id); 449 ASN1_OBJECT *TS_TST_INFO_get_policy_id(TS_TST_INFO *a); 450 451 int TS_TST_INFO_set_msg_imprint(TS_TST_INFO *a, TS_MSG_IMPRINT *msg_imprint); 452 TS_MSG_IMPRINT *TS_TST_INFO_get_msg_imprint(TS_TST_INFO *a); 453 454 int TS_TST_INFO_set_serial(TS_TST_INFO *a, const ASN1_INTEGER *serial); 455 const ASN1_INTEGER *TS_TST_INFO_get_serial(const TS_TST_INFO *a); 456 457 int TS_TST_INFO_set_time(TS_TST_INFO *a, const ASN1_GENERALIZEDTIME *gtime); 458 const ASN1_GENERALIZEDTIME *TS_TST_INFO_get_time(const TS_TST_INFO *a); 459 460 int TS_TST_INFO_set_accuracy(TS_TST_INFO *a, TS_ACCURACY *accuracy); 461 TS_ACCURACY *TS_TST_INFO_get_accuracy(TS_TST_INFO *a); 462 463 int TS_ACCURACY_set_seconds(TS_ACCURACY *a, const ASN1_INTEGER *seconds); 464 const ASN1_INTEGER *TS_ACCURACY_get_seconds(const TS_ACCURACY *a); 465 466 int TS_ACCURACY_set_millis(TS_ACCURACY *a, const ASN1_INTEGER *millis); 467 const ASN1_INTEGER *TS_ACCURACY_get_millis(const TS_ACCURACY *a); 468 469 int TS_ACCURACY_set_micros(TS_ACCURACY *a, const ASN1_INTEGER *micros); 470 const ASN1_INTEGER *TS_ACCURACY_get_micros(const TS_ACCURACY *a); 471 472 int TS_TST_INFO_set_ordering(TS_TST_INFO *a, int ordering); 473 int TS_TST_INFO_get_ordering(const TS_TST_INFO *a); 474 475 int TS_TST_INFO_set_nonce(TS_TST_INFO *a, const ASN1_INTEGER *nonce); 476 const ASN1_INTEGER *TS_TST_INFO_get_nonce(const TS_TST_INFO *a); 477 478 int TS_TST_INFO_set_tsa(TS_TST_INFO *a, GENERAL_NAME *tsa); 479 GENERAL_NAME *TS_TST_INFO_get_tsa(TS_TST_INFO *a); 480 481 STACK_OF(X509_EXTENSION) *TS_TST_INFO_get_exts(TS_TST_INFO *a); 482 void TS_TST_INFO_ext_free(TS_TST_INFO *a); 483 int TS_TST_INFO_get_ext_count(TS_TST_INFO *a); 484 int TS_TST_INFO_get_ext_by_NID(TS_TST_INFO *a, int nid, int lastpos); 485 int TS_TST_INFO_get_ext_by_OBJ(TS_TST_INFO *a, const ASN1_OBJECT *obj, 486 int lastpos); 487 int TS_TST_INFO_get_ext_by_critical(TS_TST_INFO *a, int crit, int lastpos); 488 X509_EXTENSION *TS_TST_INFO_get_ext(TS_TST_INFO *a, int loc); 489 X509_EXTENSION *TS_TST_INFO_delete_ext(TS_TST_INFO *a, int loc); 490 int TS_TST_INFO_add_ext(TS_TST_INFO *a, X509_EXTENSION *ex, int loc); 491 void *TS_TST_INFO_get_ext_d2i(TS_TST_INFO *a, int nid, int *crit, int *idx); 492 493 /* Declarations related to response generation, defined in ts/ts_resp_sign.c. */ 494 495 /* Optional flags for response generation. */ 496 497 /* Don't include the TSA name in response. */ 498 #define TS_TSA_NAME 0x01 499 500 /* Set ordering to true in response. */ 501 #define TS_ORDERING 0x02 502 503 /* 504 * Include the signer certificate and the other specified certificates in 505 * the ESS signing certificate attribute beside the PKCS7 signed data. 506 * Only the signer certificates is included by default. 507 */ 508 #define TS_ESS_CERT_ID_CHAIN 0x04 509 510 /* Forward declaration. */ 511 struct TS_resp_ctx; 512 513 /* This must return a unique number less than 160 bits long. */ 514 typedef ASN1_INTEGER *(*TS_serial_cb)(struct TS_resp_ctx *, void *); 515 516 /* This must return the seconds and microseconds since Jan 1, 1970 in 517 the sec and usec variables allocated by the caller. 518 Return non-zero for success and zero for failure. */ 519 typedef int (*TS_time_cb)(struct TS_resp_ctx *, void *, time_t *sec, long *usec); 520 521 /* This must process the given extension. 522 * It can modify the TS_TST_INFO object of the context. 523 * Return values: !0 (processed), 0 (error, it must set the 524 * status info/failure info of the response). 525 */ 526 typedef int (*TS_extension_cb)(struct TS_resp_ctx *, X509_EXTENSION *, void *); 527 528 typedef struct TS_resp_ctx { 529 X509 *signer_cert; 530 EVP_PKEY *signer_key; 531 STACK_OF(X509) *certs; /* Certs to include in signed data. */ 532 STACK_OF(ASN1_OBJECT) *policies; /* Acceptable policies. */ 533 ASN1_OBJECT *default_policy; /* It may appear in policies, too. */ 534 STACK_OF(EVP_MD) *mds; /* Acceptable message digests. */ 535 ASN1_INTEGER *seconds; /* accuracy, 0 means not specified. */ 536 ASN1_INTEGER *millis; /* accuracy, 0 means not specified. */ 537 ASN1_INTEGER *micros; /* accuracy, 0 means not specified. */ 538 unsigned clock_precision_digits; /* fraction of seconds in 539 time stamp token. */ 540 unsigned flags; /* Optional info, see values above. */ 541 542 /* Callback functions. */ 543 TS_serial_cb serial_cb; 544 void *serial_cb_data; /* User data for serial_cb. */ 545 546 TS_time_cb time_cb; 547 void *time_cb_data; /* User data for time_cb. */ 548 549 TS_extension_cb extension_cb; 550 void *extension_cb_data; /* User data for extension_cb. */ 551 552 /* These members are used only while creating the response. */ 553 TS_REQ *request; 554 TS_RESP *response; 555 TS_TST_INFO *tst_info; 556 } TS_RESP_CTX; 557 558 DECLARE_STACK_OF(EVP_MD) 559 560 /* Creates a response context that can be used for generating responses. */ 561 TS_RESP_CTX *TS_RESP_CTX_new(void); 562 void TS_RESP_CTX_free(TS_RESP_CTX *ctx); 563 564 /* This parameter must be set. */ 565 int TS_RESP_CTX_set_signer_cert(TS_RESP_CTX *ctx, X509 *signer); 566 567 /* This parameter must be set. */ 568 int TS_RESP_CTX_set_signer_key(TS_RESP_CTX *ctx, EVP_PKEY *key); 569 570 /* This parameter must be set. */ 571 int TS_RESP_CTX_set_def_policy(TS_RESP_CTX *ctx, const ASN1_OBJECT *def_policy); 572 573 /* No additional certs are included in the response by default. */ 574 int TS_RESP_CTX_set_certs(TS_RESP_CTX *ctx, STACK_OF(X509) *certs); 575 576 /* Adds a new acceptable policy, only the default policy 577 is accepted by default. */ 578 int TS_RESP_CTX_add_policy(TS_RESP_CTX *ctx, const ASN1_OBJECT *policy); 579 580 /* Adds a new acceptable message digest. Note that no message digests 581 are accepted by default. The md argument is shared with the caller. */ 582 int TS_RESP_CTX_add_md(TS_RESP_CTX *ctx, const EVP_MD *md); 583 584 /* Accuracy is not included by default. */ 585 int TS_RESP_CTX_set_accuracy(TS_RESP_CTX *ctx, 586 int secs, int millis, int micros); 587 588 /* Clock precision digits, i.e. the number of decimal digits: 589 '0' means sec, '3' msec, '6' usec, and so on. Default is 0. */ 590 int TS_RESP_CTX_set_clock_precision_digits(TS_RESP_CTX *ctx, 591 unsigned clock_precision_digits); 592 /* At most we accept usec precision. */ 593 #define TS_MAX_CLOCK_PRECISION_DIGITS 6 594 595 /* No flags are set by default. */ 596 void TS_RESP_CTX_add_flags(TS_RESP_CTX *ctx, int flags); 597 598 /* Default callback always returns a constant. */ 599 void TS_RESP_CTX_set_serial_cb(TS_RESP_CTX *ctx, TS_serial_cb cb, void *data); 600 601 /* Default callback rejects all extensions. The extension callback is called 602 * when the TS_TST_INFO object is already set up and not signed yet. */ 603 /* FIXME: extension handling is not tested yet. */ 604 void TS_RESP_CTX_set_extension_cb(TS_RESP_CTX *ctx, 605 TS_extension_cb cb, void *data); 606 607 /* The following methods can be used in the callbacks. */ 608 int TS_RESP_CTX_set_status_info(TS_RESP_CTX *ctx, 609 int status, const char *text); 610 611 /* Sets the status info only if it is still TS_STATUS_GRANTED. */ 612 int TS_RESP_CTX_set_status_info_cond(TS_RESP_CTX *ctx, 613 int status, const char *text); 614 615 int TS_RESP_CTX_add_failure_info(TS_RESP_CTX *ctx, int failure); 616 617 /* The get methods below can be used in the extension callback. */ 618 TS_REQ *TS_RESP_CTX_get_request(TS_RESP_CTX *ctx); 619 620 TS_TST_INFO *TS_RESP_CTX_get_tst_info(TS_RESP_CTX *ctx); 621 622 /* 623 * Creates the signed TS_TST_INFO and puts it in TS_RESP. 624 * In case of errors it sets the status info properly. 625 * Returns NULL only in case of memory allocation/fatal error. 626 */ 627 TS_RESP *TS_RESP_create_response(TS_RESP_CTX *ctx, BIO *req_bio); 628 629 /* 630 * Declarations related to response verification, 631 * they are defined in ts/ts_resp_verify.c. 632 */ 633 634 int TS_RESP_verify_signature(PKCS7 *token, STACK_OF(X509) *certs, 635 X509_STORE *store, X509 **signer_out); 636 637 /* Context structure for the generic verify method. */ 638 639 /* Verify the signer's certificate and the signature of the response. */ 640 #define TS_VFY_SIGNATURE (1u << 0) 641 /* Verify the version number of the response. */ 642 #define TS_VFY_VERSION (1u << 1) 643 /* Verify if the policy supplied by the user matches the policy of the TSA. */ 644 #define TS_VFY_POLICY (1u << 2) 645 /* Verify the message imprint provided by the user. This flag should not be 646 specified with TS_VFY_DATA. */ 647 #define TS_VFY_IMPRINT (1u << 3) 648 /* Verify the message imprint computed by the verify method from the user 649 provided data and the MD algorithm of the response. This flag should not be 650 specified with TS_VFY_IMPRINT. */ 651 #define TS_VFY_DATA (1u << 4) 652 /* Verify the nonce value. */ 653 #define TS_VFY_NONCE (1u << 5) 654 /* Verify if the TSA name field matches the signer certificate. */ 655 #define TS_VFY_SIGNER (1u << 6) 656 /* Verify if the TSA name field equals to the user provided name. */ 657 #define TS_VFY_TSA_NAME (1u << 7) 658 659 /* You can use the following convenience constants. */ 660 #define TS_VFY_ALL_IMPRINT (TS_VFY_SIGNATURE \ 661 | TS_VFY_VERSION \ 662 | TS_VFY_POLICY \ 663 | TS_VFY_IMPRINT \ 664 | TS_VFY_NONCE \ 665 | TS_VFY_SIGNER \ 666 | TS_VFY_TSA_NAME) 667 #define TS_VFY_ALL_DATA (TS_VFY_SIGNATURE \ 668 | TS_VFY_VERSION \ 669 | TS_VFY_POLICY \ 670 | TS_VFY_DATA \ 671 | TS_VFY_NONCE \ 672 | TS_VFY_SIGNER \ 673 | TS_VFY_TSA_NAME) 674 675 typedef struct TS_verify_ctx { 676 /* Set this to the union of TS_VFY_... flags you want to carry out. */ 677 unsigned flags; 678 679 /* Must be set only with TS_VFY_SIGNATURE. certs is optional. */ 680 X509_STORE *store; 681 STACK_OF(X509) *certs; 682 683 /* Must be set only with TS_VFY_POLICY. */ 684 ASN1_OBJECT *policy; 685 686 /* Must be set only with TS_VFY_IMPRINT. If md_alg is NULL, 687 the algorithm from the response is used. */ 688 X509_ALGOR *md_alg; 689 unsigned char *imprint; 690 unsigned imprint_len; 691 692 /* Must be set only with TS_VFY_DATA. */ 693 BIO *data; 694 695 /* Must be set only with TS_VFY_TSA_NAME. */ 696 ASN1_INTEGER *nonce; 697 698 /* Must be set only with TS_VFY_TSA_NAME. */ 699 GENERAL_NAME *tsa_name; 700 } TS_VERIFY_CTX; 701 702 int TS_RESP_verify_response(TS_VERIFY_CTX *ctx, TS_RESP *response); 703 int TS_RESP_verify_token(TS_VERIFY_CTX *ctx, PKCS7 *token); 704 705 /* 706 * Declarations related to response verification context, 707 * they are defined in ts/ts_verify_ctx.c. 708 */ 709 710 /* Set all fields to zero. */ 711 TS_VERIFY_CTX *TS_VERIFY_CTX_new(void); 712 void TS_VERIFY_CTX_init(TS_VERIFY_CTX *ctx); 713 void TS_VERIFY_CTX_free(TS_VERIFY_CTX *ctx); 714 void TS_VERIFY_CTX_cleanup(TS_VERIFY_CTX *ctx); 715 716 /* 717 * If ctx is NULL, it allocates and returns a new object, otherwise 718 * it returns ctx. It initialises all the members as follows: 719 * flags = TS_VFY_ALL_IMPRINT & ~(TS_VFY_TSA_NAME | TS_VFY_SIGNATURE) 720 * certs = NULL 721 * store = NULL 722 * policy = policy from the request or NULL if absent (in this case 723 * TS_VFY_POLICY is cleared from flags as well) 724 * md_alg = MD algorithm from request 725 * imprint, imprint_len = imprint from request 726 * data = NULL 727 * nonce, nonce_len = nonce from the request or NULL if absent (in this case 728 * TS_VFY_NONCE is cleared from flags as well) 729 * tsa_name = NULL 730 * Important: after calling this method TS_VFY_SIGNATURE should be added! 731 */ 732 TS_VERIFY_CTX *TS_REQ_to_TS_VERIFY_CTX(TS_REQ *req, TS_VERIFY_CTX *ctx); 733 734 /* Function declarations for TS_RESP defined in ts/ts_resp_print.c */ 735 736 int TS_RESP_print_bio(BIO *bio, TS_RESP *a); 737 int TS_STATUS_INFO_print_bio(BIO *bio, TS_STATUS_INFO *a); 738 int TS_TST_INFO_print_bio(BIO *bio, TS_TST_INFO *a); 739 740 /* Common utility functions defined in ts/ts_lib.c */ 741 742 int TS_ASN1_INTEGER_print_bio(BIO *bio, const ASN1_INTEGER *num); 743 int TS_OBJ_print_bio(BIO *bio, const ASN1_OBJECT *obj); 744 int TS_ext_print_bio(BIO *bio, const STACK_OF(X509_EXTENSION) *extensions); 745 int TS_X509_ALGOR_print_bio(BIO *bio, const X509_ALGOR *alg); 746 int TS_MSG_IMPRINT_print_bio(BIO *bio, TS_MSG_IMPRINT *msg); 747 748 /* Function declarations for handling configuration options, 749 defined in ts/ts_conf.c */ 750 751 X509 *TS_CONF_load_cert(const char *file); 752 STACK_OF(X509) *TS_CONF_load_certs(const char *file); 753 EVP_PKEY *TS_CONF_load_key(const char *file, const char *pass); 754 const char *TS_CONF_get_tsa_section(CONF *conf, const char *section); 755 int TS_CONF_set_serial(CONF *conf, const char *section, TS_serial_cb cb, 756 TS_RESP_CTX *ctx); 757 int TS_CONF_set_crypto_device(CONF *conf, const char *section, 758 const char *device); 759 int TS_CONF_set_default_engine(const char *name); 760 int TS_CONF_set_signer_cert(CONF *conf, const char *section, 761 const char *cert, TS_RESP_CTX *ctx); 762 int TS_CONF_set_certs(CONF *conf, const char *section, const char *certs, 763 TS_RESP_CTX *ctx); 764 int TS_CONF_set_signer_key(CONF *conf, const char *section, 765 const char *key, const char *pass, TS_RESP_CTX *ctx); 766 int TS_CONF_set_def_policy(CONF *conf, const char *section, 767 const char *policy, TS_RESP_CTX *ctx); 768 int TS_CONF_set_policies(CONF *conf, const char *section, TS_RESP_CTX *ctx); 769 int TS_CONF_set_digests(CONF *conf, const char *section, TS_RESP_CTX *ctx); 770 int TS_CONF_set_accuracy(CONF *conf, const char *section, TS_RESP_CTX *ctx); 771 int TS_CONF_set_clock_precision_digits(CONF *conf, const char *section, 772 TS_RESP_CTX *ctx); 773 int TS_CONF_set_ordering(CONF *conf, const char *section, TS_RESP_CTX *ctx); 774 int TS_CONF_set_tsa_name(CONF *conf, const char *section, TS_RESP_CTX *ctx); 775 int TS_CONF_set_ess_cert_id_chain(CONF *conf, const char *section, 776 TS_RESP_CTX *ctx); 777 778 void ERR_load_TS_strings(void); 779 780 /* Error codes for the TS functions. */ 781 782 /* Function codes. */ 783 #define TS_F_D2I_TS_RESP 147 784 #define TS_F_DEF_SERIAL_CB 110 785 #define TS_F_DEF_TIME_CB 111 786 #define TS_F_ESS_ADD_SIGNING_CERT 112 787 #define TS_F_ESS_CERT_ID_NEW_INIT 113 788 #define TS_F_ESS_SIGNING_CERT_NEW_INIT 114 789 #define TS_F_INT_TS_RESP_VERIFY_TOKEN 149 790 #define TS_F_PKCS7_TO_TS_TST_INFO 148 791 #define TS_F_TS_ACCURACY_SET_MICROS 115 792 #define TS_F_TS_ACCURACY_SET_MILLIS 116 793 #define TS_F_TS_ACCURACY_SET_SECONDS 117 794 #define TS_F_TS_CHECK_IMPRINTS 100 795 #define TS_F_TS_CHECK_NONCES 101 796 #define TS_F_TS_CHECK_POLICY 102 797 #define TS_F_TS_CHECK_SIGNING_CERTS 103 798 #define TS_F_TS_CHECK_STATUS_INFO 104 799 #define TS_F_TS_COMPUTE_IMPRINT 145 800 #define TS_F_TS_CONF_SET_DEFAULT_ENGINE 146 801 #define TS_F_TS_GET_STATUS_TEXT 105 802 #define TS_F_TS_MSG_IMPRINT_SET_ALGO 118 803 #define TS_F_TS_REQ_SET_MSG_IMPRINT 119 804 #define TS_F_TS_REQ_SET_NONCE 120 805 #define TS_F_TS_REQ_SET_POLICY_ID 121 806 #define TS_F_TS_RESP_CREATE_RESPONSE 122 807 #define TS_F_TS_RESP_CREATE_TST_INFO 123 808 #define TS_F_TS_RESP_CTX_ADD_FAILURE_INFO 124 809 #define TS_F_TS_RESP_CTX_ADD_MD 125 810 #define TS_F_TS_RESP_CTX_ADD_POLICY 126 811 #define TS_F_TS_RESP_CTX_NEW 127 812 #define TS_F_TS_RESP_CTX_SET_ACCURACY 128 813 #define TS_F_TS_RESP_CTX_SET_CERTS 129 814 #define TS_F_TS_RESP_CTX_SET_DEF_POLICY 130 815 #define TS_F_TS_RESP_CTX_SET_SIGNER_CERT 131 816 #define TS_F_TS_RESP_CTX_SET_STATUS_INFO 132 817 #define TS_F_TS_RESP_GET_POLICY 133 818 #define TS_F_TS_RESP_SET_GENTIME_WITH_PRECISION 134 819 #define TS_F_TS_RESP_SET_STATUS_INFO 135 820 #define TS_F_TS_RESP_SET_TST_INFO 150 821 #define TS_F_TS_RESP_SIGN 136 822 #define TS_F_TS_RESP_VERIFY_SIGNATURE 106 823 #define TS_F_TS_RESP_VERIFY_TOKEN 107 824 #define TS_F_TS_TST_INFO_SET_ACCURACY 137 825 #define TS_F_TS_TST_INFO_SET_MSG_IMPRINT 138 826 #define TS_F_TS_TST_INFO_SET_NONCE 139 827 #define TS_F_TS_TST_INFO_SET_POLICY_ID 140 828 #define TS_F_TS_TST_INFO_SET_SERIAL 141 829 #define TS_F_TS_TST_INFO_SET_TIME 142 830 #define TS_F_TS_TST_INFO_SET_TSA 143 831 #define TS_F_TS_VERIFY 108 832 #define TS_F_TS_VERIFY_CERT 109 833 #define TS_F_TS_VERIFY_CTX_NEW 144 834 835 /* Reason codes. */ 836 #define TS_R_BAD_PKCS7_TYPE 132 837 #define TS_R_BAD_TYPE 133 838 #define TS_R_CERTIFICATE_VERIFY_ERROR 100 839 #define TS_R_COULD_NOT_SET_ENGINE 127 840 #define TS_R_COULD_NOT_SET_TIME 115 841 #define TS_R_D2I_TS_RESP_INT_FAILED 128 842 #define TS_R_DETACHED_CONTENT 134 843 #define TS_R_ESS_ADD_SIGNING_CERT_ERROR 116 844 #define TS_R_ESS_SIGNING_CERTIFICATE_ERROR 101 845 #define TS_R_INVALID_NULL_POINTER 102 846 #define TS_R_INVALID_SIGNER_CERTIFICATE_PURPOSE 117 847 #define TS_R_MESSAGE_IMPRINT_MISMATCH 103 848 #define TS_R_NONCE_MISMATCH 104 849 #define TS_R_NONCE_NOT_RETURNED 105 850 #define TS_R_NO_CONTENT 106 851 #define TS_R_NO_TIME_STAMP_TOKEN 107 852 #define TS_R_PKCS7_ADD_SIGNATURE_ERROR 118 853 #define TS_R_PKCS7_ADD_SIGNED_ATTR_ERROR 119 854 #define TS_R_PKCS7_TO_TS_TST_INFO_FAILED 129 855 #define TS_R_POLICY_MISMATCH 108 856 #define TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE 120 857 #define TS_R_RESPONSE_SETUP_ERROR 121 858 #define TS_R_SIGNATURE_FAILURE 109 859 #define TS_R_THERE_MUST_BE_ONE_SIGNER 110 860 #define TS_R_TIME_SYSCALL_ERROR 122 861 #define TS_R_TOKEN_NOT_PRESENT 130 862 #define TS_R_TOKEN_PRESENT 131 863 #define TS_R_TSA_NAME_MISMATCH 111 864 #define TS_R_TSA_UNTRUSTED 112 865 #define TS_R_TST_INFO_SETUP_ERROR 123 866 #define TS_R_TS_DATASIGN 124 867 #define TS_R_UNACCEPTABLE_POLICY 125 868 #define TS_R_UNSUPPORTED_MD_ALGORITHM 126 869 #define TS_R_UNSUPPORTED_VERSION 113 870 #define TS_R_WRONG_CONTENT_TYPE 114 871 872 #ifdef __cplusplus 873 } 874 #endif 875 #endif 876