lib/libcrypto/ts/ts.h

   1 /* $OpenBSD: ts.h,v 1.8 2016/12/27 16:05:57 jsing Exp $ */
   2 /* Written by Zoltan Glozik (zglozik@opentsa.org) for the OpenSSL
   3  * project 2002, 2003, 2004.
   4  */
   5 /* ====================================================================
   6  * Copyright (c) 2006 The OpenSSL Project.  All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in
  17  *    the documentation and/or other materials provided with the
  18  *    distribution.
  19  *
  20  * 3. All advertising materials mentioning features or use of this
  21  *    software must display the following acknowledgment:
  22  *    "This product includes software developed by the OpenSSL Project
  23  *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
  24  *
  25  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  26  *    endorse or promote products derived from this software without
  27  *    prior written permission. For written permission, please contact
  28  *    licensing@OpenSSL.org.
  29  *
  30  * 5. Products derived from this software may not be called "OpenSSL"
  31  *    nor may "OpenSSL" appear in their names without prior written
  32  *    permission of the OpenSSL Project.
  33  *
  34  * 6. Redistributions of any form whatsoever must retain the following
  35  *    acknowledgment:
  36  *    "This product includes software developed by the OpenSSL Project
  37  *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
  38  *
  39  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  40  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  41  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  42  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  43  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  44  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  45  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  46  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  47  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  48  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  49  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  50  * OF THE POSSIBILITY OF SUCH DAMAGE.
  51  * ====================================================================
  52  *
  53  * This product includes cryptographic software written by Eric Young
  54  * (eay@cryptsoft.com).  This product includes software written by Tim
  55  * Hudson (tjh@cryptsoft.com).
  56  *
  57  */
  58
  59 #ifndef HEADER_TS_H
  60 #define HEADER_TS_H
  61
  62 #include <openssl/opensslconf.h>
  63
  64 #ifndef OPENSSL_NO_BUFFER
  65 #include <openssl/buffer.h>
  66 #endif
  67 #ifndef OPENSSL_NO_EVP
  68 #include <openssl/evp.h>
  69 #endif
  70 #ifndef OPENSSL_NO_BIO
  71 #include <openssl/bio.h>
  72 #endif
  73 #include <openssl/stack.h>
  74 #include <openssl/asn1.h>
  75 #include <openssl/safestack.h>
  76
  77 #ifndef OPENSSL_NO_RSA
  78 #include <openssl/rsa.h>
  79 #endif
  80
  81 #ifndef OPENSSL_NO_DSA
  82 #include <openssl/dsa.h>
  83 #endif
  84
  85 #ifndef OPENSSL_NO_DH
  86 #include <openssl/dh.h>
  87 #endif
  88
  89 #ifdef  __cplusplus
  90 extern "C" {
  91 #endif
  92
  93 #include <openssl/x509.h>
  94 #include <openssl/x509v3.h>
  95
  96 /*
  97 MessageImprint ::= SEQUENCE  {
  98      hashAlgorithm                AlgorithmIdentifier,
  99      hashedMessage                OCTET STRING  }
 100 */
 101
 102 typedef struct TS_msg_imprint_st {
 103         X509_ALGOR *hash_algo;
 104         ASN1_OCTET_STRING *hashed_msg;
 105 } TS_MSG_IMPRINT;
 106
 107 /*
 108 TimeStampReq ::= SEQUENCE  {
 109    version                  INTEGER  { v1(1) },
 110    messageImprint           MessageImprint,
 111      --a hash algorithm OID and the hash value of the data to be
 112      --time-stamped
 113    reqPolicy                TSAPolicyId                OPTIONAL,
 114    nonce                    INTEGER                    OPTIONAL,
 115    certReq                  BOOLEAN                    DEFAULT FALSE,
 116    extensions               [0] IMPLICIT Extensions    OPTIONAL  }
 117 */
 118
 119 typedef struct TS_req_st {
 120         ASN1_INTEGER *version;
 121         TS_MSG_IMPRINT *msg_imprint;
 122         ASN1_OBJECT *policy_id;         /* OPTIONAL */
 123         ASN1_INTEGER *nonce;            /* OPTIONAL */
 124         ASN1_BOOLEAN cert_req;          /* DEFAULT FALSE */
 125         STACK_OF(X509_EXTENSION) *extensions;   /* [0] OPTIONAL */
 126 } TS_REQ;
 127
 128 /*
 129 Accuracy ::= SEQUENCE {
 130                 seconds        INTEGER           OPTIONAL,
 131                 millis     [0] INTEGER  (1..999) OPTIONAL,
 132                 micros     [1] INTEGER  (1..999) OPTIONAL  }
 133 */
 134
 135 typedef struct TS_accuracy_st {
 136         ASN1_INTEGER *seconds;
 137         ASN1_INTEGER *millis;
 138         ASN1_INTEGER *micros;
 139 } TS_ACCURACY;
 140
 141 /*
 142 TSTInfo ::= SEQUENCE  {
 143     version                      INTEGER  { v1(1) },
 144     policy                       TSAPolicyId,
 145     messageImprint               MessageImprint,
 146       -- MUST have the same value as the similar field in
 147       -- TimeStampReq
 148     serialNumber                 INTEGER,
 149      -- Time-Stamping users MUST be ready to accommodate integers
 150      -- up to 160 bits.
 151     genTime                      GeneralizedTime,
 152     accuracy                     Accuracy                 OPTIONAL,
 153     ordering                     BOOLEAN             DEFAULT FALSE,
 154     nonce                        INTEGER                  OPTIONAL,
 155       -- MUST be present if the similar field was present
 156       -- in TimeStampReq.  In that case it MUST have the same value.
 157     tsa                          [0] GeneralName          OPTIONAL,
 158     extensions                   [1] IMPLICIT Extensions  OPTIONAL   }
 159 */
 160
 161 typedef struct TS_tst_info_st {
 162         ASN1_INTEGER *version;
 163         ASN1_OBJECT *policy_id;
 164         TS_MSG_IMPRINT *msg_imprint;
 165         ASN1_INTEGER *serial;
 166         ASN1_GENERALIZEDTIME *time;
 167         TS_ACCURACY *accuracy;
 168         ASN1_BOOLEAN ordering;
 169         ASN1_INTEGER *nonce;
 170         GENERAL_NAME *tsa;
 171         STACK_OF(X509_EXTENSION) *extensions;
 172 } TS_TST_INFO;
 173
 174 /*
 175 PKIStatusInfo ::= SEQUENCE {
 176     status        PKIStatus,
 177     statusString  PKIFreeText     OPTIONAL,
 178     failInfo      PKIFailureInfo  OPTIONAL  }
 179
 180 From RFC 1510 - section 3.1.1:
 181 PKIFreeText ::= SEQUENCE SIZE (1..MAX) OF UTF8String
 182         -- text encoded as UTF-8 String (note:  each UTF8String SHOULD
 183         -- include an RFC 1766 language tag to indicate the language
 184         -- of the contained text)
 185 */
 186
 187 /* Possible values for status. See ts_resp_print.c && ts_resp_verify.c. */
 188
 189 #define TS_STATUS_GRANTED                       0
 190 #define TS_STATUS_GRANTED_WITH_MODS             1
 191 #define TS_STATUS_REJECTION                     2
 192 #define TS_STATUS_WAITING                       3
 193 #define TS_STATUS_REVOCATION_WARNING            4
 194 #define TS_STATUS_REVOCATION_NOTIFICATION       5
 195
 196 /* Possible values for failure_info. See ts_resp_print.c && ts_resp_verify.c */
 197
 198 #define TS_INFO_BAD_ALG                 0
 199 #define TS_INFO_BAD_REQUEST             2
 200 #define TS_INFO_BAD_DATA_FORMAT         5
 201 #define TS_INFO_TIME_NOT_AVAILABLE      14
 202 #define TS_INFO_UNACCEPTED_POLICY       15
 203 #define TS_INFO_UNACCEPTED_EXTENSION    16
 204 #define TS_INFO_ADD_INFO_NOT_AVAILABLE  17
 205 #define TS_INFO_SYSTEM_FAILURE          25
 206
 207 typedef struct TS_status_info_st {
 208         ASN1_INTEGER *status;
 209         STACK_OF(ASN1_UTF8STRING) *text;
 210         ASN1_BIT_STRING *failure_info;
 211 } TS_STATUS_INFO;
 212
 213 DECLARE_STACK_OF(ASN1_UTF8STRING)
 214
 215 /*
 216 TimeStampResp ::= SEQUENCE  {
 217      status                  PKIStatusInfo,
 218      timeStampToken          TimeStampToken     OPTIONAL }
 219 */
 220
 221 typedef struct TS_resp_st {
 222         TS_STATUS_INFO *status_info;
 223         PKCS7 *token;
 224         TS_TST_INFO *tst_info;
 225 } TS_RESP;
 226
 227 /* The structure below would belong to the ESS component. */
 228
 229 /*
 230 IssuerSerial ::= SEQUENCE {
 231         issuer                   GeneralNames,
 232         serialNumber             CertificateSerialNumber
 233         }
 234 */
 235
 236 typedef struct ESS_issuer_serial {
 237         STACK_OF(GENERAL_NAME)  *issuer;
 238         ASN1_INTEGER            *serial;
 239 } ESS_ISSUER_SERIAL;
 240
 241 /*
 242 ESSCertID ::=  SEQUENCE {
 243         certHash                 Hash,
 244         issuerSerial             IssuerSerial OPTIONAL
 245 }
 246 */
 247
 248 typedef struct ESS_cert_id {
 249         ASN1_OCTET_STRING *hash;        /* Always SHA-1 digest. */
 250         ESS_ISSUER_SERIAL *issuer_serial;
 251 } ESS_CERT_ID;
 252
 253 DECLARE_STACK_OF(ESS_CERT_ID)
 254
 255 /*
 256 SigningCertificate ::=  SEQUENCE {
 257        certs        SEQUENCE OF ESSCertID,
 258        policies     SEQUENCE OF PolicyInformation OPTIONAL
 259 }
 260 */
 261
 262 typedef struct ESS_signing_cert {
 263         STACK_OF(ESS_CERT_ID) *cert_ids;
 264         STACK_OF(POLICYINFO) *policy_info;
 265 } ESS_SIGNING_CERT;
 266
 267
 268 TS_REQ  *TS_REQ_new(void);
 269 void    TS_REQ_free(TS_REQ *a);
 270 int     i2d_TS_REQ(const TS_REQ *a, unsigned char **pp);
 271 TS_REQ  *d2i_TS_REQ(TS_REQ **a, const unsigned char **pp, long length);
 272
 273 TS_REQ  *TS_REQ_dup(TS_REQ *a);
 274
 275 TS_REQ  *d2i_TS_REQ_fp(FILE *fp, TS_REQ **a);
 276 int     i2d_TS_REQ_fp(FILE *fp, TS_REQ *a);
 277 TS_REQ  *d2i_TS_REQ_bio(BIO *fp, TS_REQ **a);
 278 int     i2d_TS_REQ_bio(BIO *fp, TS_REQ *a);
 279
 280 TS_MSG_IMPRINT  *TS_MSG_IMPRINT_new(void);
 281 void            TS_MSG_IMPRINT_free(TS_MSG_IMPRINT *a);
 282 int             i2d_TS_MSG_IMPRINT(const TS_MSG_IMPRINT *a, unsigned char **pp);
 283 TS_MSG_IMPRINT  *d2i_TS_MSG_IMPRINT(TS_MSG_IMPRINT **a,
 284                     const unsigned char **pp, long length);
 285
 286 TS_MSG_IMPRINT  *TS_MSG_IMPRINT_dup(TS_MSG_IMPRINT *a);
 287
 288 TS_MSG_IMPRINT  *d2i_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT **a);
 289 int             i2d_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT *a);
 290 TS_MSG_IMPRINT  *d2i_TS_MSG_IMPRINT_bio(BIO *fp, TS_MSG_IMPRINT **a);
 291 int             i2d_TS_MSG_IMPRINT_bio(BIO *fp, TS_MSG_IMPRINT *a);
 292
 293 TS_RESP *TS_RESP_new(void);
 294 void    TS_RESP_free(TS_RESP *a);
 295 int     i2d_TS_RESP(const TS_RESP *a, unsigned char **pp);
 296 TS_RESP *d2i_TS_RESP(TS_RESP **a, const unsigned char **pp, long length);
 297 TS_TST_INFO *PKCS7_to_TS_TST_INFO(PKCS7 *token);
 298 TS_RESP *TS_RESP_dup(TS_RESP *a);
 299
 300 TS_RESP *d2i_TS_RESP_fp(FILE *fp, TS_RESP **a);
 301 int     i2d_TS_RESP_fp(FILE *fp, TS_RESP *a);
 302 TS_RESP *d2i_TS_RESP_bio(BIO *fp, TS_RESP **a);
 303 int     i2d_TS_RESP_bio(BIO *fp, TS_RESP *a);
 304
 305 TS_STATUS_INFO  *TS_STATUS_INFO_new(void);
 306 void            TS_STATUS_INFO_free(TS_STATUS_INFO *a);
 307 int             i2d_TS_STATUS_INFO(const TS_STATUS_INFO *a, unsigned char **pp);
 308 TS_STATUS_INFO  *d2i_TS_STATUS_INFO(TS_STATUS_INFO **a,
 309                     const unsigned char **pp, long length);
 310 TS_STATUS_INFO  *TS_STATUS_INFO_dup(TS_STATUS_INFO *a);
 311
 312 TS_TST_INFO     *TS_TST_INFO_new(void);
 313 void            TS_TST_INFO_free(TS_TST_INFO *a);
 314 int             i2d_TS_TST_INFO(const TS_TST_INFO *a, unsigned char **pp);
 315 TS_TST_INFO     *d2i_TS_TST_INFO(TS_TST_INFO **a, const unsigned char **pp,
 316                     long length);
 317 TS_TST_INFO     *TS_TST_INFO_dup(TS_TST_INFO *a);
 318
 319 TS_TST_INFO     *d2i_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO **a);
 320 int             i2d_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO *a);
 321 TS_TST_INFO     *d2i_TS_TST_INFO_bio(BIO *fp, TS_TST_INFO **a);
 322 int             i2d_TS_TST_INFO_bio(BIO *fp, TS_TST_INFO *a);
 323
 324 TS_ACCURACY     *TS_ACCURACY_new(void);
 325 void            TS_ACCURACY_free(TS_ACCURACY *a);
 326 int             i2d_TS_ACCURACY(const TS_ACCURACY *a, unsigned char **pp);
 327 TS_ACCURACY     *d2i_TS_ACCURACY(TS_ACCURACY **a, const unsigned char **pp,
 328                     long length);
 329 TS_ACCURACY     *TS_ACCURACY_dup(TS_ACCURACY *a);
 330
 331 ESS_ISSUER_SERIAL *ESS_ISSUER_SERIAL_new(void);
 332 void              ESS_ISSUER_SERIAL_free(ESS_ISSUER_SERIAL *a);
 333 int               i2d_ESS_ISSUER_SERIAL(const ESS_ISSUER_SERIAL *a,
 334                     unsigned char **pp);
 335 ESS_ISSUER_SERIAL *d2i_ESS_ISSUER_SERIAL(ESS_ISSUER_SERIAL **a,
 336                     const unsigned char **pp, long length);
 337 ESS_ISSUER_SERIAL *ESS_ISSUER_SERIAL_dup(ESS_ISSUER_SERIAL *a);
 338
 339 ESS_CERT_ID     *ESS_CERT_ID_new(void);
 340 void            ESS_CERT_ID_free(ESS_CERT_ID *a);
 341 int             i2d_ESS_CERT_ID(const ESS_CERT_ID *a, unsigned char **pp);
 342 ESS_CERT_ID     *d2i_ESS_CERT_ID(ESS_CERT_ID **a, const unsigned char **pp,
 343                     long length);
 344 ESS_CERT_ID     *ESS_CERT_ID_dup(ESS_CERT_ID *a);
 345
 346 ESS_SIGNING_CERT *ESS_SIGNING_CERT_new(void);
 347 void             ESS_SIGNING_CERT_free(ESS_SIGNING_CERT *a);
 348 int              i2d_ESS_SIGNING_CERT(const ESS_SIGNING_CERT *a,
 349                     unsigned char **pp);
 350 ESS_SIGNING_CERT *d2i_ESS_SIGNING_CERT(ESS_SIGNING_CERT **a,
 351                     const unsigned char **pp, long length);
 352 ESS_SIGNING_CERT *ESS_SIGNING_CERT_dup(ESS_SIGNING_CERT *a);
 353
 354 void ERR_load_TS_strings(void);
 355
 356 int TS_REQ_set_version(TS_REQ *a, long version);
 357 long TS_REQ_get_version(const TS_REQ *a);
 358
 359 int TS_REQ_set_msg_imprint(TS_REQ *a, TS_MSG_IMPRINT *msg_imprint);
 360 TS_MSG_IMPRINT *TS_REQ_get_msg_imprint(TS_REQ *a);
 361
 362 int TS_MSG_IMPRINT_set_algo(TS_MSG_IMPRINT *a, X509_ALGOR *alg);
 363 X509_ALGOR *TS_MSG_IMPRINT_get_algo(TS_MSG_IMPRINT *a);
 364
 365 int TS_MSG_IMPRINT_set_msg(TS_MSG_IMPRINT *a, unsigned char *d, int len);
 366 ASN1_OCTET_STRING *TS_MSG_IMPRINT_get_msg(TS_MSG_IMPRINT *a);
 367
 368 int TS_REQ_set_policy_id(TS_REQ *a, ASN1_OBJECT *policy);
 369 ASN1_OBJECT *TS_REQ_get_policy_id(TS_REQ *a);
 370
 371 int TS_REQ_set_nonce(TS_REQ *a, const ASN1_INTEGER *nonce);
 372 const ASN1_INTEGER *TS_REQ_get_nonce(const TS_REQ *a);
 373
 374 int TS_REQ_set_cert_req(TS_REQ *a, int cert_req);
 375 int TS_REQ_get_cert_req(const TS_REQ *a);
 376
 377 STACK_OF(X509_EXTENSION) *TS_REQ_get_exts(TS_REQ *a);
 378 void TS_REQ_ext_free(TS_REQ *a);
 379 int TS_REQ_get_ext_count(TS_REQ *a);
 380 int TS_REQ_get_ext_by_NID(TS_REQ *a, int nid, int lastpos);
 381 int TS_REQ_get_ext_by_OBJ(TS_REQ *a, ASN1_OBJECT *obj, int lastpos);
 382 int TS_REQ_get_ext_by_critical(TS_REQ *a, int crit, int lastpos);
 383 X509_EXTENSION *TS_REQ_get_ext(TS_REQ *a, int loc);
 384 X509_EXTENSION *TS_REQ_delete_ext(TS_REQ *a, int loc);
 385 int TS_REQ_add_ext(TS_REQ *a, X509_EXTENSION *ex, int loc);
 386 void *TS_REQ_get_ext_d2i(TS_REQ *a, int nid, int *crit, int *idx);
 387
 388 /* Function declarations for TS_REQ defined in ts/ts_req_print.c */
 389
 390 int TS_REQ_print_bio(BIO *bio, TS_REQ *a);
 391
 392 /* Function declarations for TS_RESP defined in ts/ts_resp_utils.c */
 393
 394 int TS_RESP_set_status_info(TS_RESP *a, TS_STATUS_INFO *info);
 395 TS_STATUS_INFO *TS_RESP_get_status_info(TS_RESP *a);
 396
 397 /* Caller loses ownership of PKCS7 and TS_TST_INFO objects. */
 398 void TS_RESP_set_tst_info(TS_RESP *a, PKCS7 *p7, TS_TST_INFO *tst_info);
 399 PKCS7 *TS_RESP_get_token(TS_RESP *a);
 400 TS_TST_INFO *TS_RESP_get_tst_info(TS_RESP *a);
 401
 402 int TS_TST_INFO_set_version(TS_TST_INFO *a, long version);
 403 long TS_TST_INFO_get_version(const TS_TST_INFO *a);
 404
 405 int TS_TST_INFO_set_policy_id(TS_TST_INFO *a, ASN1_OBJECT *policy_id);
 406 ASN1_OBJECT *TS_TST_INFO_get_policy_id(TS_TST_INFO *a);
 407
 408 int TS_TST_INFO_set_msg_imprint(TS_TST_INFO *a, TS_MSG_IMPRINT *msg_imprint);
 409 TS_MSG_IMPRINT *TS_TST_INFO_get_msg_imprint(TS_TST_INFO *a);
 410
 411 int TS_TST_INFO_set_serial(TS_TST_INFO *a, const ASN1_INTEGER *serial);
 412 const ASN1_INTEGER *TS_TST_INFO_get_serial(const TS_TST_INFO *a);
 413
 414 int TS_TST_INFO_set_time(TS_TST_INFO *a, const ASN1_GENERALIZEDTIME *gtime);
 415 const ASN1_GENERALIZEDTIME *TS_TST_INFO_get_time(const TS_TST_INFO *a);
 416
 417 int TS_TST_INFO_set_accuracy(TS_TST_INFO *a, TS_ACCURACY *accuracy);
 418 TS_ACCURACY *TS_TST_INFO_get_accuracy(TS_TST_INFO *a);
 419
 420 int TS_ACCURACY_set_seconds(TS_ACCURACY *a, const ASN1_INTEGER *seconds);
 421 const ASN1_INTEGER *TS_ACCURACY_get_seconds(const TS_ACCURACY *a);
 422
 423 int TS_ACCURACY_set_millis(TS_ACCURACY *a, const ASN1_INTEGER *millis);
 424 const ASN1_INTEGER *TS_ACCURACY_get_millis(const TS_ACCURACY *a);
 425
 426 int TS_ACCURACY_set_micros(TS_ACCURACY *a, const ASN1_INTEGER *micros);
 427 const ASN1_INTEGER *TS_ACCURACY_get_micros(const TS_ACCURACY *a);
 428
 429 int TS_TST_INFO_set_ordering(TS_TST_INFO *a, int ordering);
 430 int TS_TST_INFO_get_ordering(const TS_TST_INFO *a);
 431
 432 int TS_TST_INFO_set_nonce(TS_TST_INFO *a, const ASN1_INTEGER *nonce);
 433 const ASN1_INTEGER *TS_TST_INFO_get_nonce(const TS_TST_INFO *a);
 434
 435 int TS_TST_INFO_set_tsa(TS_TST_INFO *a, GENERAL_NAME *tsa);
 436 GENERAL_NAME *TS_TST_INFO_get_tsa(TS_TST_INFO *a);
 437
 438 STACK_OF(X509_EXTENSION) *TS_TST_INFO_get_exts(TS_TST_INFO *a);
 439 void TS_TST_INFO_ext_free(TS_TST_INFO *a);
 440 int TS_TST_INFO_get_ext_count(TS_TST_INFO *a);
 441 int TS_TST_INFO_get_ext_by_NID(TS_TST_INFO *a, int nid, int lastpos);
 442 int TS_TST_INFO_get_ext_by_OBJ(TS_TST_INFO *a, ASN1_OBJECT *obj, int lastpos);
 443 int TS_TST_INFO_get_ext_by_critical(TS_TST_INFO *a, int crit, int lastpos);
 444 X509_EXTENSION *TS_TST_INFO_get_ext(TS_TST_INFO *a, int loc);
 445 X509_EXTENSION *TS_TST_INFO_delete_ext(TS_TST_INFO *a, int loc);
 446 int TS_TST_INFO_add_ext(TS_TST_INFO *a, X509_EXTENSION *ex, int loc);
 447 void *TS_TST_INFO_get_ext_d2i(TS_TST_INFO *a, int nid, int *crit, int *idx);
 448
 449 /* Declarations related to response generation, defined in ts/ts_resp_sign.c. */
 450
 451 /* Optional flags for response generation. */
 452
 453 /* Don't include the TSA name in response. */
 454 #define TS_TSA_NAME             0x01
 455
 456 /* Set ordering to true in response. */
 457 #define TS_ORDERING             0x02
 458
 459 /*
 460  * Include the signer certificate and the other specified certificates in
 461  * the ESS signing certificate attribute beside the PKCS7 signed data.
 462  * Only the signer certificates is included by default.
 463  */
 464 #define TS_ESS_CERT_ID_CHAIN    0x04
 465
 466 /* Forward declaration. */
 467 struct TS_resp_ctx;
 468
 469 /* This must return a unique number less than 160 bits long. */
 470 typedef ASN1_INTEGER *(*TS_serial_cb)(struct TS_resp_ctx *, void *);
 471
 472 /* This must return the seconds and microseconds since Jan 1, 1970 in
 473    the sec and usec variables allocated by the caller.
 474    Return non-zero for success and zero for failure. */
 475 typedef int (*TS_time_cb)(struct TS_resp_ctx *, void *, time_t *sec, long *usec);
 476
 477 /* This must process the given extension.
 478  * It can modify the TS_TST_INFO object of the context.
 479  * Return values: !0 (processed), 0 (error, it must set the
 480  * status info/failure info of the response).
 481  */
 482 typedef int (*TS_extension_cb)(struct TS_resp_ctx *, X509_EXTENSION *, void *);
 483
 484 typedef struct TS_resp_ctx {
 485         X509            *signer_cert;
 486         EVP_PKEY        *signer_key;
 487         STACK_OF(X509)  *certs; /* Certs to include in signed data. */
 488         STACK_OF(ASN1_OBJECT)   *policies;      /* Acceptable policies. */
 489         ASN1_OBJECT     *default_policy; /* It may appear in policies, too. */
 490         STACK_OF(EVP_MD)        *mds;   /* Acceptable message digests. */
 491         ASN1_INTEGER    *seconds;       /* accuracy, 0 means not specified. */
 492         ASN1_INTEGER    *millis;        /* accuracy, 0 means not specified. */
 493         ASN1_INTEGER    *micros;        /* accuracy, 0 means not specified. */
 494         unsigned        clock_precision_digits; /* fraction of seconds in
 495                                                    time stamp token. */
 496         unsigned        flags;          /* Optional info, see values above. */
 497
 498         /* Callback functions. */
 499         TS_serial_cb serial_cb;
 500         void *serial_cb_data;   /* User data for serial_cb. */
 501
 502         TS_time_cb time_cb;
 503         void *time_cb_data;     /* User data for time_cb. */
 504
 505         TS_extension_cb extension_cb;
 506         void *extension_cb_data;        /* User data for extension_cb. */
 507
 508         /* These members are used only while creating the response. */
 509         TS_REQ          *request;
 510         TS_RESP         *response;
 511         TS_TST_INFO     *tst_info;
 512 } TS_RESP_CTX;
 513
 514 DECLARE_STACK_OF(EVP_MD)
 515
 516 /* Creates a response context that can be used for generating responses. */
 517 TS_RESP_CTX *TS_RESP_CTX_new(void);
 518 void TS_RESP_CTX_free(TS_RESP_CTX *ctx);
 519
 520 /* This parameter must be set. */
 521 int TS_RESP_CTX_set_signer_cert(TS_RESP_CTX *ctx, X509 *signer);
 522
 523 /* This parameter must be set. */
 524 int TS_RESP_CTX_set_signer_key(TS_RESP_CTX *ctx, EVP_PKEY *key);
 525
 526 /* This parameter must be set. */
 527 int TS_RESP_CTX_set_def_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *def_policy);
 528
 529 /* No additional certs are included in the response by default. */
 530 int TS_RESP_CTX_set_certs(TS_RESP_CTX *ctx, STACK_OF(X509) *certs);
 531
 532 /* Adds a new acceptable policy, only the default policy
 533    is accepted by default. */
 534 int TS_RESP_CTX_add_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *policy);
 535
 536 /* Adds a new acceptable message digest. Note that no message digests
 537    are accepted by default. The md argument is shared with the caller. */
 538 int TS_RESP_CTX_add_md(TS_RESP_CTX *ctx, const EVP_MD *md);
 539
 540 /* Accuracy is not included by default. */
 541 int TS_RESP_CTX_set_accuracy(TS_RESP_CTX *ctx,
 542     int secs, int millis, int micros);
 543
 544 /* Clock precision digits, i.e. the number of decimal digits:
 545    '0' means sec, '3' msec, '6' usec, and so on. Default is 0. */
 546 int TS_RESP_CTX_set_clock_precision_digits(TS_RESP_CTX *ctx,
 547     unsigned clock_precision_digits);
 548 /* At most we accept usec precision. */
 549 #define TS_MAX_CLOCK_PRECISION_DIGITS   6
 550
 551 /* No flags are set by default. */
 552 void TS_RESP_CTX_add_flags(TS_RESP_CTX *ctx, int flags);
 553
 554 /* Default callback always returns a constant. */
 555 void TS_RESP_CTX_set_serial_cb(TS_RESP_CTX *ctx, TS_serial_cb cb, void *data);
 556
 557 /* Default callback rejects all extensions. The extension callback is called
 558  * when the TS_TST_INFO object is already set up and not signed yet. */
 559 /* FIXME: extension handling is not tested yet. */
 560 void TS_RESP_CTX_set_extension_cb(TS_RESP_CTX *ctx,
 561     TS_extension_cb cb, void *data);
 562
 563 /* The following methods can be used in the callbacks. */
 564 int TS_RESP_CTX_set_status_info(TS_RESP_CTX *ctx,
 565     int status, const char *text);
 566
 567 /* Sets the status info only if it is still TS_STATUS_GRANTED. */
 568 int TS_RESP_CTX_set_status_info_cond(TS_RESP_CTX *ctx,
 569     int status, const char *text);
 570
 571 int TS_RESP_CTX_add_failure_info(TS_RESP_CTX *ctx, int failure);
 572
 573 /* The get methods below can be used in the extension callback. */
 574 TS_REQ *TS_RESP_CTX_get_request(TS_RESP_CTX *ctx);
 575
 576 TS_TST_INFO *TS_RESP_CTX_get_tst_info(TS_RESP_CTX *ctx);
 577
 578 /*
 579  * Creates the signed TS_TST_INFO and puts it in TS_RESP.
 580  * In case of errors it sets the status info properly.
 581  * Returns NULL only in case of memory allocation/fatal error.
 582  */
 583 TS_RESP *TS_RESP_create_response(TS_RESP_CTX *ctx, BIO *req_bio);
 584
 585 /*
 586  * Declarations related to response verification,
 587  * they are defined in ts/ts_resp_verify.c.
 588  */
 589
 590 int TS_RESP_verify_signature(PKCS7 *token, STACK_OF(X509) *certs,
 591     X509_STORE *store, X509 **signer_out);
 592
 593 /* Context structure for the generic verify method. */
 594
 595 /* Verify the signer's certificate and the signature of the response. */
 596 #define TS_VFY_SIGNATURE        (1u << 0)
 597 /* Verify the version number of the response. */
 598 #define TS_VFY_VERSION          (1u << 1)
 599 /* Verify if the policy supplied by the user matches the policy of the TSA. */
 600 #define TS_VFY_POLICY           (1u << 2)
 601 /* Verify the message imprint provided by the user. This flag should not be
 602    specified with TS_VFY_DATA. */
 603 #define TS_VFY_IMPRINT          (1u << 3)
 604 /* Verify the message imprint computed by the verify method from the user
 605    provided data and the MD algorithm of the response. This flag should not be
 606    specified with TS_VFY_IMPRINT. */
 607 #define TS_VFY_DATA             (1u << 4)
 608 /* Verify the nonce value. */
 609 #define TS_VFY_NONCE            (1u << 5)
 610 /* Verify if the TSA name field matches the signer certificate. */
 611 #define TS_VFY_SIGNER           (1u << 6)
 612 /* Verify if the TSA name field equals to the user provided name. */
 613 #define TS_VFY_TSA_NAME         (1u << 7)
 614
 615 /* You can use the following convenience constants. */
 616 #define TS_VFY_ALL_IMPRINT      (TS_VFY_SIGNATURE       \
 617                                  | TS_VFY_VERSION       \
 618                                  | TS_VFY_POLICY        \
 619                                  | TS_VFY_IMPRINT       \
 620                                  | TS_VFY_NONCE         \
 621                                  | TS_VFY_SIGNER        \
 622                                  | TS_VFY_TSA_NAME)
 623 #define TS_VFY_ALL_DATA         (TS_VFY_SIGNATURE       \
 624                                  | TS_VFY_VERSION       \
 625                                  | TS_VFY_POLICY        \
 626                                  | TS_VFY_DATA          \
 627                                  | TS_VFY_NONCE         \
 628                                  | TS_VFY_SIGNER        \
 629                                  | TS_VFY_TSA_NAME)
 630
 631 typedef struct TS_verify_ctx {
 632         /* Set this to the union of TS_VFY_... flags you want to carry out. */
 633         unsigned        flags;
 634
 635         /* Must be set only with TS_VFY_SIGNATURE. certs is optional. */
 636         X509_STORE      *store;
 637         STACK_OF(X509)  *certs;
 638
 639         /* Must be set only with TS_VFY_POLICY. */
 640         ASN1_OBJECT     *policy;
 641
 642         /* Must be set only with TS_VFY_IMPRINT. If md_alg is NULL,
 643            the algorithm from the response is used. */
 644         X509_ALGOR      *md_alg;
 645         unsigned char   *imprint;
 646         unsigned        imprint_len;
 647
 648         /* Must be set only with TS_VFY_DATA. */
 649         BIO             *data;
 650
 651         /* Must be set only with TS_VFY_TSA_NAME. */
 652         ASN1_INTEGER    *nonce;
 653
 654         /* Must be set only with TS_VFY_TSA_NAME. */
 655         GENERAL_NAME    *tsa_name;
 656 } TS_VERIFY_CTX;
 657
 658 int TS_RESP_verify_response(TS_VERIFY_CTX *ctx, TS_RESP *response);
 659 int TS_RESP_verify_token(TS_VERIFY_CTX *ctx, PKCS7 *token);
 660
 661 /*
 662  * Declarations related to response verification context,
 663  * they are defined in ts/ts_verify_ctx.c.
 664  */
 665
 666 /* Set all fields to zero. */
 667 TS_VERIFY_CTX *TS_VERIFY_CTX_new(void);
 668 void TS_VERIFY_CTX_init(TS_VERIFY_CTX *ctx);
 669 void TS_VERIFY_CTX_free(TS_VERIFY_CTX *ctx);
 670 void TS_VERIFY_CTX_cleanup(TS_VERIFY_CTX *ctx);
 671
 672 /*
 673  * If ctx is NULL, it allocates and returns a new object, otherwise
 674  * it returns ctx. It initialises all the members as follows:
 675  * flags = TS_VFY_ALL_IMPRINT & ~(TS_VFY_TSA_NAME | TS_VFY_SIGNATURE)
 676  * certs = NULL
 677  * store = NULL
 678  * policy = policy from the request or NULL if absent (in this case
 679  *      TS_VFY_POLICY is cleared from flags as well)
 680  * md_alg = MD algorithm from request
 681  * imprint, imprint_len = imprint from request
 682  * data = NULL
 683  * nonce, nonce_len = nonce from the request or NULL if absent (in this case
 684  *      TS_VFY_NONCE is cleared from flags as well)
 685  * tsa_name = NULL
 686  * Important: after calling this method TS_VFY_SIGNATURE should be added!
 687  */
 688 TS_VERIFY_CTX *TS_REQ_to_TS_VERIFY_CTX(TS_REQ *req, TS_VERIFY_CTX *ctx);
 689
 690 /* Function declarations for TS_RESP defined in ts/ts_resp_print.c */
 691
 692 int TS_RESP_print_bio(BIO *bio, TS_RESP *a);
 693 int TS_STATUS_INFO_print_bio(BIO *bio, TS_STATUS_INFO *a);
 694 int TS_TST_INFO_print_bio(BIO *bio, TS_TST_INFO *a);
 695
 696 /* Common utility functions defined in ts/ts_lib.c */
 697
 698 int TS_ASN1_INTEGER_print_bio(BIO *bio, const ASN1_INTEGER *num);
 699 int TS_OBJ_print_bio(BIO *bio, const ASN1_OBJECT *obj);
 700 int TS_ext_print_bio(BIO *bio, const STACK_OF(X509_EXTENSION) *extensions);
 701 int TS_X509_ALGOR_print_bio(BIO *bio, const X509_ALGOR *alg);
 702 int TS_MSG_IMPRINT_print_bio(BIO *bio, TS_MSG_IMPRINT *msg);
 703
 704 /* Function declarations for handling configuration options,
 705    defined in ts/ts_conf.c */
 706
 707 X509 *TS_CONF_load_cert(const char *file);
 708 STACK_OF(X509) *TS_CONF_load_certs(const char *file);
 709 EVP_PKEY *TS_CONF_load_key(const char *file, const char *pass);
 710 const char *TS_CONF_get_tsa_section(CONF *conf, const char *section);
 711 int TS_CONF_set_serial(CONF *conf, const char *section, TS_serial_cb cb,
 712     TS_RESP_CTX *ctx);
 713 int TS_CONF_set_crypto_device(CONF *conf, const char *section,
 714     const char *device);
 715 int TS_CONF_set_default_engine(const char *name);
 716 int TS_CONF_set_signer_cert(CONF *conf, const char *section,
 717     const char *cert, TS_RESP_CTX *ctx);
 718 int TS_CONF_set_certs(CONF *conf, const char *section, const char *certs,
 719     TS_RESP_CTX *ctx);
 720 int TS_CONF_set_signer_key(CONF *conf, const char *section,
 721     const char *key, const char *pass, TS_RESP_CTX *ctx);
 722 int TS_CONF_set_def_policy(CONF *conf, const char *section,
 723     const char *policy, TS_RESP_CTX *ctx);
 724 int TS_CONF_set_policies(CONF *conf, const char *section, TS_RESP_CTX *ctx);
 725 int TS_CONF_set_digests(CONF *conf, const char *section, TS_RESP_CTX *ctx);
 726 int TS_CONF_set_accuracy(CONF *conf, const char *section, TS_RESP_CTX *ctx);
 727 int TS_CONF_set_clock_precision_digits(CONF *conf, const char *section,
 728     TS_RESP_CTX *ctx);
 729 int TS_CONF_set_ordering(CONF *conf, const char *section, TS_RESP_CTX *ctx);
 730 int TS_CONF_set_tsa_name(CONF *conf, const char *section, TS_RESP_CTX *ctx);
 731 int TS_CONF_set_ess_cert_id_chain(CONF *conf, const char *section,
 732     TS_RESP_CTX *ctx);
 733
 734 /* -------------------------------------------------- */
 735 /* BEGIN ERROR CODES */
 736 /* The following lines are auto generated by the script mkerr.pl. Any changes
 737  * made after this point may be overwritten when the script is next run.
 738  */
 739 void ERR_load_TS_strings(void);
 740
 741 /* Error codes for the TS functions. */
 742
 743 /* Function codes. */
 744 #define TS_F_D2I_TS_RESP                                 147
 745 #define TS_F_DEF_SERIAL_CB                               110
 746 #define TS_F_DEF_TIME_CB                                 111
 747 #define TS_F_ESS_ADD_SIGNING_CERT                        112
 748 #define TS_F_ESS_CERT_ID_NEW_INIT                        113
 749 #define TS_F_ESS_SIGNING_CERT_NEW_INIT                   114
 750 #define TS_F_INT_TS_RESP_VERIFY_TOKEN                    149
 751 #define TS_F_PKCS7_TO_TS_TST_INFO                        148
 752 #define TS_F_TS_ACCURACY_SET_MICROS                      115
 753 #define TS_F_TS_ACCURACY_SET_MILLIS                      116
 754 #define TS_F_TS_ACCURACY_SET_SECONDS                     117
 755 #define TS_F_TS_CHECK_IMPRINTS                           100
 756 #define TS_F_TS_CHECK_NONCES                             101
 757 #define TS_F_TS_CHECK_POLICY                             102
 758 #define TS_F_TS_CHECK_SIGNING_CERTS                      103
 759 #define TS_F_TS_CHECK_STATUS_INFO                        104
 760 #define TS_F_TS_COMPUTE_IMPRINT                          145
 761 #define TS_F_TS_CONF_SET_DEFAULT_ENGINE                  146
 762 #define TS_F_TS_GET_STATUS_TEXT                          105
 763 #define TS_F_TS_MSG_IMPRINT_SET_ALGO                     118
 764 #define TS_F_TS_REQ_SET_MSG_IMPRINT                      119
 765 #define TS_F_TS_REQ_SET_NONCE                            120
 766 #define TS_F_TS_REQ_SET_POLICY_ID                        121
 767 #define TS_F_TS_RESP_CREATE_RESPONSE                     122
 768 #define TS_F_TS_RESP_CREATE_TST_INFO                     123
 769 #define TS_F_TS_RESP_CTX_ADD_FAILURE_INFO                124
 770 #define TS_F_TS_RESP_CTX_ADD_MD                          125
 771 #define TS_F_TS_RESP_CTX_ADD_POLICY                      126
 772 #define TS_F_TS_RESP_CTX_NEW                             127
 773 #define TS_F_TS_RESP_CTX_SET_ACCURACY                    128
 774 #define TS_F_TS_RESP_CTX_SET_CERTS                       129
 775 #define TS_F_TS_RESP_CTX_SET_DEF_POLICY                  130
 776 #define TS_F_TS_RESP_CTX_SET_SIGNER_CERT                 131
 777 #define TS_F_TS_RESP_CTX_SET_STATUS_INFO                 132
 778 #define TS_F_TS_RESP_GET_POLICY                          133
 779 #define TS_F_TS_RESP_SET_GENTIME_WITH_PRECISION          134
 780 #define TS_F_TS_RESP_SET_STATUS_INFO                     135
 781 #define TS_F_TS_RESP_SET_TST_INFO                        150
 782 #define TS_F_TS_RESP_SIGN                                136
 783 #define TS_F_TS_RESP_VERIFY_SIGNATURE                    106
 784 #define TS_F_TS_RESP_VERIFY_TOKEN                        107
 785 #define TS_F_TS_TST_INFO_SET_ACCURACY                    137
 786 #define TS_F_TS_TST_INFO_SET_MSG_IMPRINT                 138
 787 #define TS_F_TS_TST_INFO_SET_NONCE                       139
 788 #define TS_F_TS_TST_INFO_SET_POLICY_ID                   140
 789 #define TS_F_TS_TST_INFO_SET_SERIAL                      141
 790 #define TS_F_TS_TST_INFO_SET_TIME                        142
 791 #define TS_F_TS_TST_INFO_SET_TSA                         143
 792 #define TS_F_TS_VERIFY                                   108
 793 #define TS_F_TS_VERIFY_CERT                              109
 794 #define TS_F_TS_VERIFY_CTX_NEW                           144
 795
 796 /* Reason codes. */
 797 #define TS_R_BAD_PKCS7_TYPE                              132
 798 #define TS_R_BAD_TYPE                                    133
 799 #define TS_R_CERTIFICATE_VERIFY_ERROR                    100
 800 #define TS_R_COULD_NOT_SET_ENGINE                        127
 801 #define TS_R_COULD_NOT_SET_TIME                          115
 802 #define TS_R_D2I_TS_RESP_INT_FAILED                      128
 803 #define TS_R_DETACHED_CONTENT                            134
 804 #define TS_R_ESS_ADD_SIGNING_CERT_ERROR                  116
 805 #define TS_R_ESS_SIGNING_CERTIFICATE_ERROR               101
 806 #define TS_R_INVALID_NULL_POINTER                        102
 807 #define TS_R_INVALID_SIGNER_CERTIFICATE_PURPOSE          117
 808 #define TS_R_MESSAGE_IMPRINT_MISMATCH                    103
 809 #define TS_R_NONCE_MISMATCH                              104
 810 #define TS_R_NONCE_NOT_RETURNED                          105
 811 #define TS_R_NO_CONTENT                                  106
 812 #define TS_R_NO_TIME_STAMP_TOKEN                         107
 813 #define TS_R_PKCS7_ADD_SIGNATURE_ERROR                   118
 814 #define TS_R_PKCS7_ADD_SIGNED_ATTR_ERROR                 119
 815 #define TS_R_PKCS7_TO_TS_TST_INFO_FAILED                 129
 816 #define TS_R_POLICY_MISMATCH                             108
 817 #define TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE      120
 818 #define TS_R_RESPONSE_SETUP_ERROR                        121
 819 #define TS_R_SIGNATURE_FAILURE                           109
 820 #define TS_R_THERE_MUST_BE_ONE_SIGNER                    110
 821 #define TS_R_TIME_SYSCALL_ERROR                          122
 822 #define TS_R_TOKEN_NOT_PRESENT                           130
 823 #define TS_R_TOKEN_PRESENT                               131
 824 #define TS_R_TSA_NAME_MISMATCH                           111
 825 #define TS_R_TSA_UNTRUSTED                               112
 826 #define TS_R_TST_INFO_SETUP_ERROR                        123
 827 #define TS_R_TS_DATASIGN                                 124
 828 #define TS_R_UNACCEPTABLE_POLICY                         125
 829 #define TS_R_UNSUPPORTED_MD_ALGORITHM                    126
 830 #define TS_R_UNSUPPORTED_VERSION                         113
 831 #define TS_R_WRONG_CONTENT_TYPE                          114
 832
 833 #ifdef  __cplusplus
 834 }
 835 #endif
 836 #endif