1 /* $OpenBSD: ts.c,v 1.3 2014/10/22 13:54:03 jsing Exp $ */ 2 /* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL 3 * project 2002. 4 */ 5 /* ==================================================================== 6 * Copyright (c) 2001 The OpenSSL Project. All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in 17 * the documentation and/or other materials provided with the 18 * distribution. 19 * 20 * 3. All advertising materials mentioning features or use of this 21 * software must display the following acknowledgment: 22 * "This product includes software developed by the OpenSSL Project 23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" 24 * 25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 26 * endorse or promote products derived from this software without 27 * prior written permission. For written permission, please contact 28 * licensing@OpenSSL.org. 29 * 30 * 5. Products derived from this software may not be called "OpenSSL" 31 * nor may "OpenSSL" appear in their names without prior written 32 * permission of the OpenSSL Project. 33 * 34 * 6. Redistributions of any form whatsoever must retain the following 35 * acknowledgment: 36 * "This product includes software developed by the OpenSSL Project 37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" 38 * 39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 50 * OF THE POSSIBILITY OF SUCH DAMAGE. 51 * ==================================================================== 52 * 53 * This product includes cryptographic software written by Eric Young 54 * (eay@cryptsoft.com). This product includes software written by Tim 55 * Hudson (tjh@cryptsoft.com). 56 * 57 */ 58 59 #include <stdio.h> 60 #include <stdlib.h> 61 #include <string.h> 62 63 #include "apps.h" 64 65 #include <openssl/bio.h> 66 #include <openssl/bn.h> 67 #include <openssl/err.h> 68 #include <openssl/pem.h> 69 #include <openssl/ts.h> 70 71 /* Length of the nonce of the request in bits (must be a multiple of 8). */ 72 #define NONCE_LENGTH 64 73 74 /* Macro definitions for the configuration file. */ 75 #define ENV_OID_FILE "oid_file" 76 77 /* Local function declarations. */ 78 79 static ASN1_OBJECT *txt2obj(const char *oid); 80 static CONF *load_config_file(const char *configfile); 81 82 /* Query related functions. */ 83 static int query_command(const char *data, char *digest, 84 const EVP_MD * md, const char *policy, int no_nonce, 85 int cert, const char *in, const char *out, int text); 86 static BIO *BIO_open_with_default(const char *file, const char *mode, 87 FILE * default_fp); 88 static TS_REQ *create_query(BIO * data_bio, char *digest, const EVP_MD * md, 89 const char *policy, int no_nonce, int cert); 90 static int create_digest(BIO * input, char *digest, 91 const EVP_MD * md, unsigned char **md_value); 92 static ASN1_INTEGER *create_nonce(int bits); 93 94 /* Reply related functions. */ 95 static int reply_command(CONF * conf, char *section, char *engine, 96 char *queryfile, char *passin, char *inkey, 97 char *signer, char *chain, const char *policy, 98 char *in, int token_in, char *out, int token_out, 99 int text); 100 static TS_RESP *read_PKCS7(BIO * in_bio); 101 static TS_RESP *create_response(CONF * conf, const char *section, char *engine, 102 char *queryfile, char *passin, char *inkey, 103 char *signer, char *chain, const char *policy); 104 static ASN1_INTEGER *serial_cb(TS_RESP_CTX * ctx, void *data); 105 static ASN1_INTEGER *next_serial(const char *serialfile); 106 static int save_ts_serial(const char *serialfile, ASN1_INTEGER * serial); 107 108 /* Verify related functions. */ 109 static int verify_command(char *data, char *digest, char *queryfile, 110 char *in, int token_in, 111 char *ca_path, char *ca_file, char *untrusted); 112 static TS_VERIFY_CTX *create_verify_ctx(char *data, char *digest, 113 char *queryfile, 114 char *ca_path, char *ca_file, 115 char *untrusted); 116 static X509_STORE *create_cert_store(char *ca_path, char *ca_file); 117 static int verify_cb(int ok, X509_STORE_CTX * ctx); 118 119 /* Main function definition. */ 120 int ts_main(int, char **); 121 122 int 123 ts_main(int argc, char **argv) 124 { 125 int ret = 1; 126 char *configfile = NULL; 127 char *section = NULL; 128 CONF *conf = NULL; 129 enum mode { 130 CMD_NONE, CMD_QUERY, CMD_REPLY, CMD_VERIFY 131 } mode = CMD_NONE; 132 char *data = NULL; 133 char *digest = NULL; 134 const EVP_MD *md = NULL; 135 char *policy = NULL; 136 int no_nonce = 0; 137 int cert = 0; 138 char *in = NULL; 139 char *out = NULL; 140 int text = 0; 141 char *queryfile = NULL; 142 char *passin = NULL; /* Password source. */ 143 char *password = NULL; /* Password itself. */ 144 char *inkey = NULL; 145 char *signer = NULL; 146 char *chain = NULL; 147 char *ca_path = NULL; 148 char *ca_file = NULL; 149 char *untrusted = NULL; 150 char *engine = NULL; 151 /* Input is ContentInfo instead of TimeStampResp. */ 152 int token_in = 0; 153 /* Output is ContentInfo instead of TimeStampResp. */ 154 int token_out = 0; 155 156 for (argc--, argv++; argc > 0; argc--, argv++) { 157 if (strcmp(*argv, "-config") == 0) { 158 if (argc-- < 1) 159 goto usage; 160 configfile = *++argv; 161 } else if (strcmp(*argv, "-section") == 0) { 162 if (argc-- < 1) 163 goto usage; 164 section = *++argv; 165 } else if (strcmp(*argv, "-query") == 0) { 166 if (mode != CMD_NONE) 167 goto usage; 168 mode = CMD_QUERY; 169 } else if (strcmp(*argv, "-data") == 0) { 170 if (argc-- < 1) 171 goto usage; 172 data = *++argv; 173 } else if (strcmp(*argv, "-digest") == 0) { 174 if (argc-- < 1) 175 goto usage; 176 digest = *++argv; 177 } else if (strcmp(*argv, "-policy") == 0) { 178 if (argc-- < 1) 179 goto usage; 180 policy = *++argv; 181 } else if (strcmp(*argv, "-no_nonce") == 0) { 182 no_nonce = 1; 183 } else if (strcmp(*argv, "-cert") == 0) { 184 cert = 1; 185 } else if (strcmp(*argv, "-in") == 0) { 186 if (argc-- < 1) 187 goto usage; 188 in = *++argv; 189 } else if (strcmp(*argv, "-token_in") == 0) { 190 token_in = 1; 191 } else if (strcmp(*argv, "-out") == 0) { 192 if (argc-- < 1) 193 goto usage; 194 out = *++argv; 195 } else if (strcmp(*argv, "-token_out") == 0) { 196 token_out = 1; 197 } else if (strcmp(*argv, "-text") == 0) { 198 text = 1; 199 } else if (strcmp(*argv, "-reply") == 0) { 200 if (mode != CMD_NONE) 201 goto usage; 202 mode = CMD_REPLY; 203 } else if (strcmp(*argv, "-queryfile") == 0) { 204 if (argc-- < 1) 205 goto usage; 206 queryfile = *++argv; 207 } else if (strcmp(*argv, "-passin") == 0) { 208 if (argc-- < 1) 209 goto usage; 210 passin = *++argv; 211 } else if (strcmp(*argv, "-inkey") == 0) { 212 if (argc-- < 1) 213 goto usage; 214 inkey = *++argv; 215 } else if (strcmp(*argv, "-signer") == 0) { 216 if (argc-- < 1) 217 goto usage; 218 signer = *++argv; 219 } else if (strcmp(*argv, "-chain") == 0) { 220 if (argc-- < 1) 221 goto usage; 222 chain = *++argv; 223 } else if (strcmp(*argv, "-verify") == 0) { 224 if (mode != CMD_NONE) 225 goto usage; 226 mode = CMD_VERIFY; 227 } else if (strcmp(*argv, "-CApath") == 0) { 228 if (argc-- < 1) 229 goto usage; 230 ca_path = *++argv; 231 } else if (strcmp(*argv, "-CAfile") == 0) { 232 if (argc-- < 1) 233 goto usage; 234 ca_file = *++argv; 235 } else if (strcmp(*argv, "-untrusted") == 0) { 236 if (argc-- < 1) 237 goto usage; 238 untrusted = *++argv; 239 } else if (strcmp(*argv, "-engine") == 0) { 240 if (argc-- < 1) 241 goto usage; 242 engine = *++argv; 243 } else if ((md = EVP_get_digestbyname(*argv + 1)) != NULL) { 244 /* empty. */ 245 } else 246 goto usage; 247 } 248 249 /* Get the password if required. */ 250 if (mode == CMD_REPLY && passin && 251 !app_passwd(bio_err, passin, NULL, &password, NULL)) { 252 BIO_printf(bio_err, "Error getting password.\n"); 253 goto cleanup; 254 } 255 /* 256 * Check consistency of parameters and execute the appropriate 257 * function. 258 */ 259 switch (mode) { 260 case CMD_NONE: 261 goto usage; 262 case CMD_QUERY: 263 /* 264 * Data file and message imprint cannot be specified at the 265 * same time. 266 */ 267 ret = data != NULL && digest != NULL; 268 if (ret) 269 goto usage; 270 /* Load the config file for possible policy OIDs. */ 271 conf = load_config_file(configfile); 272 ret = !query_command(data, digest, md, policy, no_nonce, cert, 273 in, out, text); 274 break; 275 case CMD_REPLY: 276 conf = load_config_file(configfile); 277 if (in == NULL) { 278 ret = !(queryfile != NULL && conf != NULL && !token_in); 279 if (ret) 280 goto usage; 281 } else { 282 /* 'in' and 'queryfile' are exclusive. */ 283 ret = !(queryfile == NULL); 284 if (ret) 285 goto usage; 286 } 287 288 ret = !reply_command(conf, section, engine, queryfile, 289 password, inkey, signer, chain, policy, 290 in, token_in, out, token_out, text); 291 break; 292 case CMD_VERIFY: 293 ret = !(((queryfile && !data && !digest) || 294 (!queryfile && data && !digest) || 295 (!queryfile && !data && digest)) && in != NULL); 296 if (ret) 297 goto usage; 298 299 ret = !verify_command(data, digest, queryfile, in, token_in, 300 ca_path, ca_file, untrusted); 301 } 302 303 goto cleanup; 304 305 usage: 306 BIO_printf(bio_err, "usage:\n" 307 "ts -query [-config configfile] " 308 "[-data file_to_hash] [-digest digest_bytes]" 309 "[-md2|-md4|-md5|-sha|-sha1|-mdc2|-ripemd160] " 310 "[-policy object_id] [-no_nonce] [-cert] " 311 "[-in request.tsq] [-out request.tsq] [-text]\n"); 312 BIO_printf(bio_err, "or\n" 313 "ts -reply [-config configfile] [-section tsa_section] " 314 "[-queryfile request.tsq] [-passin password] " 315 "[-signer tsa_cert.pem] [-inkey private_key.pem] " 316 "[-chain certs_file.pem] [-policy object_id] " 317 "[-in response.tsr] [-token_in] " 318 "[-out response.tsr] [-token_out] [-text] [-engine id]\n"); 319 BIO_printf(bio_err, "or\n" 320 "ts -verify [-data file_to_hash] [-digest digest_bytes] " 321 "[-queryfile request.tsq] " 322 "-in response.tsr [-token_in] " 323 "-CApath ca_path -CAfile ca_file.pem " 324 "-untrusted cert_file.pem\n"); 325 326 cleanup: 327 /* Clean up. */ 328 NCONF_free(conf); 329 free(password); 330 OBJ_cleanup(); 331 332 return (ret); 333 } 334 335 /* 336 * Configuration file-related function definitions. 337 */ 338 339 static ASN1_OBJECT * 340 txt2obj(const char *oid) 341 { 342 ASN1_OBJECT *oid_obj = NULL; 343 344 if (!(oid_obj = OBJ_txt2obj(oid, 0))) 345 BIO_printf(bio_err, "cannot convert %s to OID\n", oid); 346 347 return oid_obj; 348 } 349 350 static CONF * 351 load_config_file(const char *configfile) 352 { 353 CONF *conf = NULL; 354 long errorline = -1; 355 356 if (!configfile) 357 configfile = getenv("OPENSSL_CONF"); 358 if (!configfile) 359 configfile = getenv("SSLEAY_CONF"); 360 361 if (configfile && 362 (!(conf = NCONF_new(NULL)) || 363 NCONF_load(conf, configfile, &errorline) <= 0)) { 364 if (errorline <= 0) 365 BIO_printf(bio_err, "error loading the config file " 366 "'%s'\n", configfile); 367 else 368 BIO_printf(bio_err, "error on line %ld of config file " 369 "'%s'\n", errorline, configfile); 370 } 371 if (conf != NULL) { 372 const char *p; 373 374 BIO_printf(bio_err, "Using configuration from %s\n", 375 configfile); 376 p = NCONF_get_string(conf, NULL, ENV_OID_FILE); 377 if (p != NULL) { 378 BIO *oid_bio = BIO_new_file(p, "r"); 379 if (!oid_bio) 380 ERR_print_errors(bio_err); 381 else { 382 OBJ_create_objects(oid_bio); 383 BIO_free_all(oid_bio); 384 } 385 } else 386 ERR_clear_error(); 387 if (!add_oid_section(bio_err, conf)) 388 ERR_print_errors(bio_err); 389 } 390 return conf; 391 } 392 393 /* 394 * Query-related method definitions. 395 */ 396 397 static int 398 query_command(const char *data, char *digest, const EVP_MD * md, 399 const char *policy, int no_nonce, int cert, const char *in, 400 const char *out, int text) 401 { 402 int ret = 0; 403 TS_REQ *query = NULL; 404 BIO *in_bio = NULL; 405 BIO *data_bio = NULL; 406 BIO *out_bio = NULL; 407 408 /* Build query object either from file or from scratch. */ 409 if (in != NULL) { 410 if ((in_bio = BIO_new_file(in, "rb")) == NULL) 411 goto end; 412 query = d2i_TS_REQ_bio(in_bio, NULL); 413 } else { 414 /* Open the file if no explicit digest bytes were specified. */ 415 if (!digest && 416 !(data_bio = BIO_open_with_default(data, "rb", stdin))) 417 goto end; 418 /* Creating the query object. */ 419 query = create_query(data_bio, digest, md, 420 policy, no_nonce, cert); 421 /* Saving the random number generator state. */ 422 } 423 if (query == NULL) 424 goto end; 425 426 /* Write query either in ASN.1 or in text format. */ 427 if ((out_bio = BIO_open_with_default(out, "wb", stdout)) == NULL) 428 goto end; 429 if (text) { 430 /* Text output. */ 431 if (!TS_REQ_print_bio(out_bio, query)) 432 goto end; 433 } else { 434 /* ASN.1 output. */ 435 if (!i2d_TS_REQ_bio(out_bio, query)) 436 goto end; 437 } 438 439 ret = 1; 440 441 end: 442 ERR_print_errors(bio_err); 443 444 /* Clean up. */ 445 BIO_free_all(in_bio); 446 BIO_free_all(data_bio); 447 BIO_free_all(out_bio); 448 TS_REQ_free(query); 449 450 return ret; 451 } 452 453 static BIO * 454 BIO_open_with_default(const char *file, const char *mode, FILE * default_fp) 455 { 456 return file == NULL ? BIO_new_fp(default_fp, BIO_NOCLOSE) : 457 BIO_new_file(file, mode); 458 } 459 460 static TS_REQ * 461 create_query(BIO * data_bio, char *digest, const EVP_MD * md, 462 const char *policy, int no_nonce, int cert) 463 { 464 int ret = 0; 465 TS_REQ *ts_req = NULL; 466 int len; 467 TS_MSG_IMPRINT *msg_imprint = NULL; 468 X509_ALGOR *algo = NULL; 469 unsigned char *data = NULL; 470 ASN1_OBJECT *policy_obj = NULL; 471 ASN1_INTEGER *nonce_asn1 = NULL; 472 473 /* Setting default message digest. */ 474 if (!md && !(md = EVP_get_digestbyname("sha1"))) 475 goto err; 476 477 /* Creating request object. */ 478 if (!(ts_req = TS_REQ_new())) 479 goto err; 480 481 /* Setting version. */ 482 if (!TS_REQ_set_version(ts_req, 1)) 483 goto err; 484 485 /* Creating and adding MSG_IMPRINT object. */ 486 if (!(msg_imprint = TS_MSG_IMPRINT_new())) 487 goto err; 488 489 /* Adding algorithm. */ 490 if (!(algo = X509_ALGOR_new())) 491 goto err; 492 if (!(algo->algorithm = OBJ_nid2obj(EVP_MD_type(md)))) 493 goto err; 494 if (!(algo->parameter = ASN1_TYPE_new())) 495 goto err; 496 algo->parameter->type = V_ASN1_NULL; 497 if (!TS_MSG_IMPRINT_set_algo(msg_imprint, algo)) 498 goto err; 499 500 /* Adding message digest. */ 501 if ((len = create_digest(data_bio, digest, md, &data)) == 0) 502 goto err; 503 if (!TS_MSG_IMPRINT_set_msg(msg_imprint, data, len)) 504 goto err; 505 506 if (!TS_REQ_set_msg_imprint(ts_req, msg_imprint)) 507 goto err; 508 509 /* Setting policy if requested. */ 510 if (policy && !(policy_obj = txt2obj(policy))) 511 goto err; 512 if (policy_obj && !TS_REQ_set_policy_id(ts_req, policy_obj)) 513 goto err; 514 515 /* Setting nonce if requested. */ 516 if (!no_nonce && !(nonce_asn1 = create_nonce(NONCE_LENGTH))) 517 goto err; 518 if (nonce_asn1 && !TS_REQ_set_nonce(ts_req, nonce_asn1)) 519 goto err; 520 521 /* Setting certificate request flag if requested. */ 522 if (!TS_REQ_set_cert_req(ts_req, cert)) 523 goto err; 524 525 ret = 1; 526 527 err: 528 if (!ret) { 529 TS_REQ_free(ts_req); 530 ts_req = NULL; 531 BIO_printf(bio_err, "could not create query\n"); 532 } 533 TS_MSG_IMPRINT_free(msg_imprint); 534 X509_ALGOR_free(algo); 535 free(data); 536 ASN1_OBJECT_free(policy_obj); 537 ASN1_INTEGER_free(nonce_asn1); 538 539 return ts_req; 540 } 541 542 static int 543 create_digest(BIO * input, char *digest, const EVP_MD * md, 544 unsigned char **md_value) 545 { 546 int md_value_len; 547 548 md_value_len = EVP_MD_size(md); 549 if (md_value_len < 0) 550 goto err; 551 if (input) { 552 /* Digest must be computed from an input file. */ 553 EVP_MD_CTX md_ctx; 554 unsigned char buffer[4096]; 555 int length; 556 557 *md_value = malloc(md_value_len); 558 if (*md_value == 0) 559 goto err; 560 561 EVP_DigestInit(&md_ctx, md); 562 while ((length = BIO_read(input, buffer, sizeof(buffer))) > 0) { 563 EVP_DigestUpdate(&md_ctx, buffer, length); 564 } 565 EVP_DigestFinal(&md_ctx, *md_value, NULL); 566 } else { 567 /* Digest bytes are specified with digest. */ 568 long digest_len; 569 *md_value = string_to_hex(digest, &digest_len); 570 if (!*md_value || md_value_len != digest_len) { 571 free(*md_value); 572 *md_value = NULL; 573 BIO_printf(bio_err, "bad digest, %d bytes " 574 "must be specified\n", md_value_len); 575 goto err; 576 } 577 } 578 579 return md_value_len; 580 err: 581 return 0; 582 } 583 584 static ASN1_INTEGER * 585 create_nonce(int bits) 586 { 587 unsigned char buf[20]; 588 ASN1_INTEGER *nonce = NULL; 589 int len = (bits - 1) / 8 + 1; 590 int i; 591 592 /* Generating random byte sequence. */ 593 if (len > (int) sizeof(buf)) 594 goto err; 595 arc4random_buf(buf, len); 596 597 /* Find the first non-zero byte and creating ASN1_INTEGER object. */ 598 for (i = 0; i < len && !buf[i]; ++i) 599 ; 600 if (!(nonce = ASN1_INTEGER_new())) 601 goto err; 602 free(nonce->data); 603 /* Allocate at least one byte. */ 604 nonce->length = len - i; 605 if (!(nonce->data = malloc(nonce->length + 1))) 606 goto err; 607 memcpy(nonce->data, buf + i, nonce->length); 608 609 return nonce; 610 611 err: 612 BIO_printf(bio_err, "could not create nonce\n"); 613 ASN1_INTEGER_free(nonce); 614 return NULL; 615 } 616 /* 617 * Reply-related method definitions. 618 */ 619 620 static int 621 reply_command(CONF * conf, char *section, char *engine, char *queryfile, 622 char *passin, char *inkey, char *signer, char *chain, const char *policy, 623 char *in, int token_in, char *out, int token_out, int text) 624 { 625 int ret = 0; 626 TS_RESP *response = NULL; 627 BIO *in_bio = NULL; 628 BIO *query_bio = NULL; 629 BIO *inkey_bio = NULL; 630 BIO *signer_bio = NULL; 631 BIO *out_bio = NULL; 632 633 /* Build response object either from response or query. */ 634 if (in != NULL) { 635 if ((in_bio = BIO_new_file(in, "rb")) == NULL) 636 goto end; 637 if (token_in) { 638 /* 639 * We have a ContentInfo (PKCS7) object, add 640 * 'granted' status info around it. 641 */ 642 response = read_PKCS7(in_bio); 643 } else { 644 /* We have a ready-made TS_RESP object. */ 645 response = d2i_TS_RESP_bio(in_bio, NULL); 646 } 647 } else { 648 response = create_response(conf, section, engine, queryfile, 649 passin, inkey, signer, chain, 650 policy); 651 if (response) 652 BIO_printf(bio_err, "Response has been generated.\n"); 653 else 654 BIO_printf(bio_err, "Response is not generated.\n"); 655 } 656 if (response == NULL) 657 goto end; 658 659 /* Write response either in ASN.1 or text format. */ 660 if ((out_bio = BIO_open_with_default(out, "wb", stdout)) == NULL) 661 goto end; 662 if (text) { 663 /* Text output. */ 664 if (token_out) { 665 TS_TST_INFO *tst_info = TS_RESP_get_tst_info(response); 666 if (!TS_TST_INFO_print_bio(out_bio, tst_info)) 667 goto end; 668 } else { 669 if (!TS_RESP_print_bio(out_bio, response)) 670 goto end; 671 } 672 } else { 673 /* ASN.1 DER output. */ 674 if (token_out) { 675 PKCS7 *token = TS_RESP_get_token(response); 676 if (!i2d_PKCS7_bio(out_bio, token)) 677 goto end; 678 } else { 679 if (!i2d_TS_RESP_bio(out_bio, response)) 680 goto end; 681 } 682 } 683 684 ret = 1; 685 686 end: 687 ERR_print_errors(bio_err); 688 689 /* Clean up. */ 690 BIO_free_all(in_bio); 691 BIO_free_all(query_bio); 692 BIO_free_all(inkey_bio); 693 BIO_free_all(signer_bio); 694 BIO_free_all(out_bio); 695 TS_RESP_free(response); 696 697 return ret; 698 } 699 700 /* Reads a PKCS7 token and adds default 'granted' status info to it. */ 701 static TS_RESP * 702 read_PKCS7(BIO * in_bio) 703 { 704 int ret = 0; 705 PKCS7 *token = NULL; 706 TS_TST_INFO *tst_info = NULL; 707 TS_RESP *resp = NULL; 708 TS_STATUS_INFO *si = NULL; 709 710 /* Read PKCS7 object and extract the signed time stamp info. */ 711 if (!(token = d2i_PKCS7_bio(in_bio, NULL))) 712 goto end; 713 if (!(tst_info = PKCS7_to_TS_TST_INFO(token))) 714 goto end; 715 716 /* Creating response object. */ 717 if (!(resp = TS_RESP_new())) 718 goto end; 719 720 /* Create granted status info. */ 721 if (!(si = TS_STATUS_INFO_new())) 722 goto end; 723 if (!(ASN1_INTEGER_set(si->status, TS_STATUS_GRANTED))) 724 goto end; 725 if (!TS_RESP_set_status_info(resp, si)) 726 goto end; 727 728 /* Setting encapsulated token. */ 729 TS_RESP_set_tst_info(resp, token, tst_info); 730 token = NULL; /* Ownership is lost. */ 731 tst_info = NULL; /* Ownership is lost. */ 732 733 ret = 1; 734 end: 735 PKCS7_free(token); 736 TS_TST_INFO_free(tst_info); 737 if (!ret) { 738 TS_RESP_free(resp); 739 resp = NULL; 740 } 741 TS_STATUS_INFO_free(si); 742 return resp; 743 } 744 745 static TS_RESP * 746 create_response(CONF * conf, const char *section, char *engine, 747 char *queryfile, char *passin, char *inkey, 748 char *signer, char *chain, const char *policy) 749 { 750 int ret = 0; 751 TS_RESP *response = NULL; 752 BIO *query_bio = NULL; 753 TS_RESP_CTX *resp_ctx = NULL; 754 755 if (!(query_bio = BIO_new_file(queryfile, "rb"))) 756 goto end; 757 758 /* Getting TSA configuration section. */ 759 if (!(section = TS_CONF_get_tsa_section(conf, section))) 760 goto end; 761 762 /* Setting up response generation context. */ 763 if (!(resp_ctx = TS_RESP_CTX_new())) 764 goto end; 765 766 /* Setting serial number provider callback. */ 767 if (!TS_CONF_set_serial(conf, section, serial_cb, resp_ctx)) 768 goto end; 769 #ifndef OPENSSL_NO_ENGINE 770 /* Setting default OpenSSL engine. */ 771 if (!TS_CONF_set_crypto_device(conf, section, engine)) 772 goto end; 773 #endif 774 775 /* Setting TSA signer certificate. */ 776 if (!TS_CONF_set_signer_cert(conf, section, signer, resp_ctx)) 777 goto end; 778 779 /* Setting TSA signer certificate chain. */ 780 if (!TS_CONF_set_certs(conf, section, chain, resp_ctx)) 781 goto end; 782 783 /* Setting TSA signer private key. */ 784 if (!TS_CONF_set_signer_key(conf, section, inkey, passin, resp_ctx)) 785 goto end; 786 787 /* Setting default policy OID. */ 788 if (!TS_CONF_set_def_policy(conf, section, policy, resp_ctx)) 789 goto end; 790 791 /* Setting acceptable policy OIDs. */ 792 if (!TS_CONF_set_policies(conf, section, resp_ctx)) 793 goto end; 794 795 /* Setting the acceptable one-way hash algorithms. */ 796 if (!TS_CONF_set_digests(conf, section, resp_ctx)) 797 goto end; 798 799 /* Setting guaranteed time stamp accuracy. */ 800 if (!TS_CONF_set_accuracy(conf, section, resp_ctx)) 801 goto end; 802 803 /* Setting the precision of the time. */ 804 if (!TS_CONF_set_clock_precision_digits(conf, section, resp_ctx)) 805 goto end; 806 807 /* Setting the ordering flaf if requested. */ 808 if (!TS_CONF_set_ordering(conf, section, resp_ctx)) 809 goto end; 810 811 /* Setting the TSA name required flag if requested. */ 812 if (!TS_CONF_set_tsa_name(conf, section, resp_ctx)) 813 goto end; 814 815 /* Setting the ESS cert id chain flag if requested. */ 816 if (!TS_CONF_set_ess_cert_id_chain(conf, section, resp_ctx)) 817 goto end; 818 819 /* Creating the response. */ 820 if (!(response = TS_RESP_create_response(resp_ctx, query_bio))) 821 goto end; 822 823 ret = 1; 824 end: 825 if (!ret) { 826 TS_RESP_free(response); 827 response = NULL; 828 } 829 TS_RESP_CTX_free(resp_ctx); 830 BIO_free_all(query_bio); 831 832 return response; 833 } 834 835 static ASN1_INTEGER * 836 serial_cb(TS_RESP_CTX * ctx, void *data) 837 { 838 const char *serial_file = (const char *) data; 839 ASN1_INTEGER *serial = next_serial(serial_file); 840 841 if (!serial) { 842 TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, 843 "Error during serial number " 844 "generation."); 845 TS_RESP_CTX_add_failure_info(ctx, 846 TS_INFO_ADD_INFO_NOT_AVAILABLE); 847 } else 848 save_ts_serial(serial_file, serial); 849 850 return serial; 851 } 852 853 static ASN1_INTEGER * 854 next_serial(const char *serialfile) 855 { 856 int ret = 0; 857 BIO *in = NULL; 858 ASN1_INTEGER *serial = NULL; 859 BIGNUM *bn = NULL; 860 861 if (!(serial = ASN1_INTEGER_new())) 862 goto err; 863 864 if (!(in = BIO_new_file(serialfile, "r"))) { 865 ERR_clear_error(); 866 BIO_printf(bio_err, "Warning: could not open file %s for " 867 "reading, using serial number: 1\n", serialfile); 868 if (!ASN1_INTEGER_set(serial, 1)) 869 goto err; 870 } else { 871 char buf[1024]; 872 if (!a2i_ASN1_INTEGER(in, serial, buf, sizeof(buf))) { 873 BIO_printf(bio_err, "unable to load number from %s\n", 874 serialfile); 875 goto err; 876 } 877 if (!(bn = ASN1_INTEGER_to_BN(serial, NULL))) 878 goto err; 879 ASN1_INTEGER_free(serial); 880 serial = NULL; 881 if (!BN_add_word(bn, 1)) 882 goto err; 883 if (!(serial = BN_to_ASN1_INTEGER(bn, NULL))) 884 goto err; 885 } 886 ret = 1; 887 err: 888 if (!ret) { 889 ASN1_INTEGER_free(serial); 890 serial = NULL; 891 } 892 BIO_free_all(in); 893 BN_free(bn); 894 return serial; 895 } 896 897 static int 898 save_ts_serial(const char *serialfile, ASN1_INTEGER * serial) 899 { 900 int ret = 0; 901 BIO *out = NULL; 902 903 if (!(out = BIO_new_file(serialfile, "w"))) 904 goto err; 905 if (i2a_ASN1_INTEGER(out, serial) <= 0) 906 goto err; 907 if (BIO_puts(out, "\n") <= 0) 908 goto err; 909 ret = 1; 910 err: 911 if (!ret) 912 BIO_printf(bio_err, "could not save serial number to %s\n", 913 serialfile); 914 BIO_free_all(out); 915 return ret; 916 } 917 918 /* 919 * Verify-related method definitions. 920 */ 921 922 static int 923 verify_command(char *data, char *digest, char *queryfile, char *in, 924 int token_in, char *ca_path, char *ca_file, char *untrusted) 925 { 926 BIO *in_bio = NULL; 927 PKCS7 *token = NULL; 928 TS_RESP *response = NULL; 929 TS_VERIFY_CTX *verify_ctx = NULL; 930 int ret = 0; 931 932 /* Decode the token (PKCS7) or response (TS_RESP) files. */ 933 if (!(in_bio = BIO_new_file(in, "rb"))) 934 goto end; 935 if (token_in) { 936 if (!(token = d2i_PKCS7_bio(in_bio, NULL))) 937 goto end; 938 } else { 939 if (!(response = d2i_TS_RESP_bio(in_bio, NULL))) 940 goto end; 941 } 942 943 if (!(verify_ctx = create_verify_ctx(data, digest, queryfile, 944 ca_path, ca_file, untrusted))) 945 goto end; 946 947 /* Checking the token or response against the request. */ 948 ret = token_in ? 949 TS_RESP_verify_token(verify_ctx, token) : 950 TS_RESP_verify_response(verify_ctx, response); 951 952 end: 953 printf("Verification: "); 954 if (ret) 955 printf("OK\n"); 956 else { 957 printf("FAILED\n"); 958 /* Print errors, if there are any. */ 959 ERR_print_errors(bio_err); 960 } 961 962 /* Clean up. */ 963 BIO_free_all(in_bio); 964 PKCS7_free(token); 965 TS_RESP_free(response); 966 TS_VERIFY_CTX_free(verify_ctx); 967 return ret; 968 } 969 970 static TS_VERIFY_CTX * 971 create_verify_ctx(char *data, char *digest, char *queryfile, char *ca_path, 972 char *ca_file, char *untrusted) 973 { 974 TS_VERIFY_CTX *ctx = NULL; 975 BIO *input = NULL; 976 TS_REQ *request = NULL; 977 int ret = 0; 978 979 if (data != NULL || digest != NULL) { 980 if (!(ctx = TS_VERIFY_CTX_new())) 981 goto err; 982 ctx->flags = TS_VFY_VERSION | TS_VFY_SIGNER; 983 if (data != NULL) { 984 ctx->flags |= TS_VFY_DATA; 985 if (!(ctx->data = BIO_new_file(data, "rb"))) 986 goto err; 987 } else if (digest != NULL) { 988 long imprint_len; 989 ctx->flags |= TS_VFY_IMPRINT; 990 if (!(ctx->imprint = string_to_hex(digest, 991 &imprint_len))) { 992 BIO_printf(bio_err, "invalid digest string\n"); 993 goto err; 994 } 995 ctx->imprint_len = imprint_len; 996 } 997 } else if (queryfile != NULL) { 998 /* 999 * The request has just to be read, decoded and converted to 1000 * a verify context object. 1001 */ 1002 if (!(input = BIO_new_file(queryfile, "rb"))) 1003 goto err; 1004 if (!(request = d2i_TS_REQ_bio(input, NULL))) 1005 goto err; 1006 if (!(ctx = TS_REQ_to_TS_VERIFY_CTX(request, NULL))) 1007 goto err; 1008 } else 1009 return NULL; 1010 1011 /* Add the signature verification flag and arguments. */ 1012 ctx->flags |= TS_VFY_SIGNATURE; 1013 1014 /* Initialising the X509_STORE object. */ 1015 if (!(ctx->store = create_cert_store(ca_path, ca_file))) 1016 goto err; 1017 1018 /* Loading untrusted certificates. */ 1019 if (untrusted && !(ctx->certs = TS_CONF_load_certs(untrusted))) 1020 goto err; 1021 1022 ret = 1; 1023 err: 1024 if (!ret) { 1025 TS_VERIFY_CTX_free(ctx); 1026 ctx = NULL; 1027 } 1028 BIO_free_all(input); 1029 TS_REQ_free(request); 1030 return ctx; 1031 } 1032 1033 static X509_STORE * 1034 create_cert_store(char *ca_path, char *ca_file) 1035 { 1036 X509_STORE *cert_ctx = NULL; 1037 X509_LOOKUP *lookup = NULL; 1038 int i; 1039 1040 /* Creating the X509_STORE object. */ 1041 cert_ctx = X509_STORE_new(); 1042 1043 /* Setting the callback for certificate chain verification. */ 1044 X509_STORE_set_verify_cb(cert_ctx, verify_cb); 1045 1046 /* Adding a trusted certificate directory source. */ 1047 if (ca_path) { 1048 lookup = X509_STORE_add_lookup(cert_ctx, 1049 X509_LOOKUP_hash_dir()); 1050 if (lookup == NULL) { 1051 BIO_printf(bio_err, "memory allocation failure\n"); 1052 goto err; 1053 } 1054 i = X509_LOOKUP_add_dir(lookup, ca_path, X509_FILETYPE_PEM); 1055 if (!i) { 1056 BIO_printf(bio_err, "Error loading directory %s\n", 1057 ca_path); 1058 goto err; 1059 } 1060 } 1061 /* Adding a trusted certificate file source. */ 1062 if (ca_file) { 1063 lookup = X509_STORE_add_lookup(cert_ctx, X509_LOOKUP_file()); 1064 if (lookup == NULL) { 1065 BIO_printf(bio_err, "memory allocation failure\n"); 1066 goto err; 1067 } 1068 i = X509_LOOKUP_load_file(lookup, ca_file, X509_FILETYPE_PEM); 1069 if (!i) { 1070 BIO_printf(bio_err, "Error loading file %s\n", ca_file); 1071 goto err; 1072 } 1073 } 1074 return cert_ctx; 1075 err: 1076 X509_STORE_free(cert_ctx); 1077 return NULL; 1078 } 1079 1080 static int 1081 verify_cb(int ok, X509_STORE_CTX * ctx) 1082 { 1083 /* 1084 char buf[256]; 1085 1086 if (!ok) 1087 { 1088 X509_NAME_oneline(X509_get_subject_name(ctx->current_cert), 1089 buf, sizeof(buf)); 1090 printf("%s\n", buf); 1091 printf("error %d at %d depth lookup: %s\n", 1092 ctx->error, ctx->error_depth, 1093 X509_verify_cert_error_string(ctx->error)); 1094 } 1095 */ 1096 1097 return ok; 1098 } 1099