1 /* $OpenBSD: ts.h,v 1.6 2014/06/12 15:49:30 deraadt Exp $ */
2 /* Written by Zoltan Glozik (zglozik@opentsa.org) for the OpenSSL
3 * project 2002, 2003, 2004.
5 /* ====================================================================
6 * Copyright (c) 2006 The OpenSSL Project. All rights reserved.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
34 * 6. Redistributions of any form whatsoever must retain the following
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
62 #include <openssl/opensslconf.h>
64 #ifndef OPENSSL_NO_BUFFER
65 #include <openssl/buffer.h>
67 #ifndef OPENSSL_NO_EVP
68 #include <openssl/evp.h>
70 #ifndef OPENSSL_NO_BIO
71 #include <openssl/bio.h>
73 #include <openssl/stack.h>
74 #include <openssl/asn1.h>
75 #include <openssl/safestack.h>
77 #ifndef OPENSSL_NO_RSA
78 #include <openssl/rsa.h>
81 #ifndef OPENSSL_NO_DSA
82 #include <openssl/dsa.h>
86 #include <openssl/dh.h>
93 #include <openssl/x509.h>
94 #include <openssl/x509v3.h>
97 MessageImprint ::= SEQUENCE {
98 hashAlgorithm AlgorithmIdentifier,
99 hashedMessage OCTET STRING }
102 typedef struct TS_msg_imprint_st {
103 X509_ALGOR *hash_algo;
104 ASN1_OCTET_STRING *hashed_msg;
108 TimeStampReq ::= SEQUENCE {
109 version INTEGER { v1(1) },
110 messageImprint MessageImprint,
111 --a hash algorithm OID and the hash value of the data to be
113 reqPolicy TSAPolicyId OPTIONAL,
114 nonce INTEGER OPTIONAL,
115 certReq BOOLEAN DEFAULT FALSE,
116 extensions [0] IMPLICIT Extensions OPTIONAL }
119 typedef struct TS_req_st {
120 ASN1_INTEGER *version;
121 TS_MSG_IMPRINT *msg_imprint;
122 ASN1_OBJECT *policy_id; /* OPTIONAL */
123 ASN1_INTEGER *nonce; /* OPTIONAL */
124 ASN1_BOOLEAN cert_req; /* DEFAULT FALSE */
125 STACK_OF(X509_EXTENSION) *extensions; /* [0] OPTIONAL */
129 Accuracy ::= SEQUENCE {
130 seconds INTEGER OPTIONAL,
131 millis [0] INTEGER (1..999) OPTIONAL,
132 micros [1] INTEGER (1..999) OPTIONAL }
135 typedef struct TS_accuracy_st {
136 ASN1_INTEGER *seconds;
137 ASN1_INTEGER *millis;
138 ASN1_INTEGER *micros;
142 TSTInfo ::= SEQUENCE {
143 version INTEGER { v1(1) },
145 messageImprint MessageImprint,
146 -- MUST have the same value as the similar field in
148 serialNumber INTEGER,
149 -- Time-Stamping users MUST be ready to accommodate integers
151 genTime GeneralizedTime,
152 accuracy Accuracy OPTIONAL,
153 ordering BOOLEAN DEFAULT FALSE,
154 nonce INTEGER OPTIONAL,
155 -- MUST be present if the similar field was present
156 -- in TimeStampReq. In that case it MUST have the same value.
157 tsa [0] GeneralName OPTIONAL,
158 extensions [1] IMPLICIT Extensions OPTIONAL }
161 typedef struct TS_tst_info_st {
162 ASN1_INTEGER *version;
163 ASN1_OBJECT *policy_id;
164 TS_MSG_IMPRINT *msg_imprint;
165 ASN1_INTEGER *serial;
166 ASN1_GENERALIZEDTIME *time;
167 TS_ACCURACY *accuracy;
168 ASN1_BOOLEAN ordering;
171 STACK_OF(X509_EXTENSION) *extensions;
175 PKIStatusInfo ::= SEQUENCE {
177 statusString PKIFreeText OPTIONAL,
178 failInfo PKIFailureInfo OPTIONAL }
180 From RFC 1510 - section 3.1.1:
181 PKIFreeText ::= SEQUENCE SIZE (1..MAX) OF UTF8String
182 -- text encoded as UTF-8 String (note: each UTF8String SHOULD
183 -- include an RFC 1766 language tag to indicate the language
184 -- of the contained text)
187 /* Possible values for status. See ts_resp_print.c && ts_resp_verify.c. */
189 #define TS_STATUS_GRANTED 0
190 #define TS_STATUS_GRANTED_WITH_MODS 1
191 #define TS_STATUS_REJECTION 2
192 #define TS_STATUS_WAITING 3
193 #define TS_STATUS_REVOCATION_WARNING 4
194 #define TS_STATUS_REVOCATION_NOTIFICATION 5
196 /* Possible values for failure_info. See ts_resp_print.c && ts_resp_verify.c */
198 #define TS_INFO_BAD_ALG 0
199 #define TS_INFO_BAD_REQUEST 2
200 #define TS_INFO_BAD_DATA_FORMAT 5
201 #define TS_INFO_TIME_NOT_AVAILABLE 14
202 #define TS_INFO_UNACCEPTED_POLICY 15
203 #define TS_INFO_UNACCEPTED_EXTENSION 16
204 #define TS_INFO_ADD_INFO_NOT_AVAILABLE 17
205 #define TS_INFO_SYSTEM_FAILURE 25
207 typedef struct TS_status_info_st {
208 ASN1_INTEGER *status;
209 STACK_OF(ASN1_UTF8STRING) *text;
210 ASN1_BIT_STRING *failure_info;
213 DECLARE_STACK_OF(ASN1_UTF8STRING)
214 DECLARE_ASN1_SET_OF(ASN1_UTF8STRING)
217 TimeStampResp ::= SEQUENCE {
218 status PKIStatusInfo,
219 timeStampToken TimeStampToken OPTIONAL }
222 typedef struct TS_resp_st {
223 TS_STATUS_INFO *status_info;
225 TS_TST_INFO *tst_info;
228 /* The structure below would belong to the ESS component. */
231 IssuerSerial ::= SEQUENCE {
233 serialNumber CertificateSerialNumber
237 typedef struct ESS_issuer_serial {
238 STACK_OF(GENERAL_NAME) *issuer;
239 ASN1_INTEGER *serial;
243 ESSCertID ::= SEQUENCE {
245 issuerSerial IssuerSerial OPTIONAL
249 typedef struct ESS_cert_id {
250 ASN1_OCTET_STRING *hash; /* Always SHA-1 digest. */
251 ESS_ISSUER_SERIAL *issuer_serial;
254 DECLARE_STACK_OF(ESS_CERT_ID)
255 DECLARE_ASN1_SET_OF(ESS_CERT_ID)
258 SigningCertificate ::= SEQUENCE {
259 certs SEQUENCE OF ESSCertID,
260 policies SEQUENCE OF PolicyInformation OPTIONAL
264 typedef struct ESS_signing_cert {
265 STACK_OF(ESS_CERT_ID) *cert_ids;
266 STACK_OF(POLICYINFO) *policy_info;
270 TS_REQ *TS_REQ_new(void);
271 void TS_REQ_free(TS_REQ *a);
272 int i2d_TS_REQ(const TS_REQ *a, unsigned char **pp);
273 TS_REQ *d2i_TS_REQ(TS_REQ **a, const unsigned char **pp, long length);
275 TS_REQ *TS_REQ_dup(TS_REQ *a);
277 TS_REQ *d2i_TS_REQ_fp(FILE *fp, TS_REQ **a);
278 int i2d_TS_REQ_fp(FILE *fp, TS_REQ *a);
279 TS_REQ *d2i_TS_REQ_bio(BIO *fp, TS_REQ **a);
280 int i2d_TS_REQ_bio(BIO *fp, TS_REQ *a);
282 TS_MSG_IMPRINT *TS_MSG_IMPRINT_new(void);
283 void TS_MSG_IMPRINT_free(TS_MSG_IMPRINT *a);
284 int i2d_TS_MSG_IMPRINT(const TS_MSG_IMPRINT *a, unsigned char **pp);
285 TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT(TS_MSG_IMPRINT **a,
286 const unsigned char **pp, long length);
288 TS_MSG_IMPRINT *TS_MSG_IMPRINT_dup(TS_MSG_IMPRINT *a);
290 TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT **a);
291 int i2d_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT *a);
292 TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_bio(BIO *fp, TS_MSG_IMPRINT **a);
293 int i2d_TS_MSG_IMPRINT_bio(BIO *fp, TS_MSG_IMPRINT *a);
295 TS_RESP *TS_RESP_new(void);
296 void TS_RESP_free(TS_RESP *a);
297 int i2d_TS_RESP(const TS_RESP *a, unsigned char **pp);
298 TS_RESP *d2i_TS_RESP(TS_RESP **a, const unsigned char **pp, long length);
299 TS_TST_INFO *PKCS7_to_TS_TST_INFO(PKCS7 *token);
300 TS_RESP *TS_RESP_dup(TS_RESP *a);
302 TS_RESP *d2i_TS_RESP_fp(FILE *fp, TS_RESP **a);
303 int i2d_TS_RESP_fp(FILE *fp, TS_RESP *a);
304 TS_RESP *d2i_TS_RESP_bio(BIO *fp, TS_RESP **a);
305 int i2d_TS_RESP_bio(BIO *fp, TS_RESP *a);
307 TS_STATUS_INFO *TS_STATUS_INFO_new(void);
308 void TS_STATUS_INFO_free(TS_STATUS_INFO *a);
309 int i2d_TS_STATUS_INFO(const TS_STATUS_INFO *a, unsigned char **pp);
310 TS_STATUS_INFO *d2i_TS_STATUS_INFO(TS_STATUS_INFO **a,
311 const unsigned char **pp, long length);
312 TS_STATUS_INFO *TS_STATUS_INFO_dup(TS_STATUS_INFO *a);
314 TS_TST_INFO *TS_TST_INFO_new(void);
315 void TS_TST_INFO_free(TS_TST_INFO *a);
316 int i2d_TS_TST_INFO(const TS_TST_INFO *a, unsigned char **pp);
317 TS_TST_INFO *d2i_TS_TST_INFO(TS_TST_INFO **a, const unsigned char **pp,
319 TS_TST_INFO *TS_TST_INFO_dup(TS_TST_INFO *a);
321 TS_TST_INFO *d2i_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO **a);
322 int i2d_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO *a);
323 TS_TST_INFO *d2i_TS_TST_INFO_bio(BIO *fp, TS_TST_INFO **a);
324 int i2d_TS_TST_INFO_bio(BIO *fp, TS_TST_INFO *a);
326 TS_ACCURACY *TS_ACCURACY_new(void);
327 void TS_ACCURACY_free(TS_ACCURACY *a);
328 int i2d_TS_ACCURACY(const TS_ACCURACY *a, unsigned char **pp);
329 TS_ACCURACY *d2i_TS_ACCURACY(TS_ACCURACY **a, const unsigned char **pp,
331 TS_ACCURACY *TS_ACCURACY_dup(TS_ACCURACY *a);
333 ESS_ISSUER_SERIAL *ESS_ISSUER_SERIAL_new(void);
334 void ESS_ISSUER_SERIAL_free(ESS_ISSUER_SERIAL *a);
335 int i2d_ESS_ISSUER_SERIAL(const ESS_ISSUER_SERIAL *a,
337 ESS_ISSUER_SERIAL *d2i_ESS_ISSUER_SERIAL(ESS_ISSUER_SERIAL **a,
338 const unsigned char **pp, long length);
339 ESS_ISSUER_SERIAL *ESS_ISSUER_SERIAL_dup(ESS_ISSUER_SERIAL *a);
341 ESS_CERT_ID *ESS_CERT_ID_new(void);
342 void ESS_CERT_ID_free(ESS_CERT_ID *a);
343 int i2d_ESS_CERT_ID(const ESS_CERT_ID *a, unsigned char **pp);
344 ESS_CERT_ID *d2i_ESS_CERT_ID(ESS_CERT_ID **a, const unsigned char **pp,
346 ESS_CERT_ID *ESS_CERT_ID_dup(ESS_CERT_ID *a);
348 ESS_SIGNING_CERT *ESS_SIGNING_CERT_new(void);
349 void ESS_SIGNING_CERT_free(ESS_SIGNING_CERT *a);
350 int i2d_ESS_SIGNING_CERT(const ESS_SIGNING_CERT *a,
352 ESS_SIGNING_CERT *d2i_ESS_SIGNING_CERT(ESS_SIGNING_CERT **a,
353 const unsigned char **pp, long length);
354 ESS_SIGNING_CERT *ESS_SIGNING_CERT_dup(ESS_SIGNING_CERT *a);
356 void ERR_load_TS_strings(void);
358 int TS_REQ_set_version(TS_REQ *a, long version);
359 long TS_REQ_get_version(const TS_REQ *a);
361 int TS_REQ_set_msg_imprint(TS_REQ *a, TS_MSG_IMPRINT *msg_imprint);
362 TS_MSG_IMPRINT *TS_REQ_get_msg_imprint(TS_REQ *a);
364 int TS_MSG_IMPRINT_set_algo(TS_MSG_IMPRINT *a, X509_ALGOR *alg);
365 X509_ALGOR *TS_MSG_IMPRINT_get_algo(TS_MSG_IMPRINT *a);
367 int TS_MSG_IMPRINT_set_msg(TS_MSG_IMPRINT *a, unsigned char *d, int len);
368 ASN1_OCTET_STRING *TS_MSG_IMPRINT_get_msg(TS_MSG_IMPRINT *a);
370 int TS_REQ_set_policy_id(TS_REQ *a, ASN1_OBJECT *policy);
371 ASN1_OBJECT *TS_REQ_get_policy_id(TS_REQ *a);
373 int TS_REQ_set_nonce(TS_REQ *a, const ASN1_INTEGER *nonce);
374 const ASN1_INTEGER *TS_REQ_get_nonce(const TS_REQ *a);
376 int TS_REQ_set_cert_req(TS_REQ *a, int cert_req);
377 int TS_REQ_get_cert_req(const TS_REQ *a);
379 STACK_OF(X509_EXTENSION) *TS_REQ_get_exts(TS_REQ *a);
380 void TS_REQ_ext_free(TS_REQ *a);
381 int TS_REQ_get_ext_count(TS_REQ *a);
382 int TS_REQ_get_ext_by_NID(TS_REQ *a, int nid, int lastpos);
383 int TS_REQ_get_ext_by_OBJ(TS_REQ *a, ASN1_OBJECT *obj, int lastpos);
384 int TS_REQ_get_ext_by_critical(TS_REQ *a, int crit, int lastpos);
385 X509_EXTENSION *TS_REQ_get_ext(TS_REQ *a, int loc);
386 X509_EXTENSION *TS_REQ_delete_ext(TS_REQ *a, int loc);
387 int TS_REQ_add_ext(TS_REQ *a, X509_EXTENSION *ex, int loc);
388 void *TS_REQ_get_ext_d2i(TS_REQ *a, int nid, int *crit, int *idx);
390 /* Function declarations for TS_REQ defined in ts/ts_req_print.c */
392 int TS_REQ_print_bio(BIO *bio, TS_REQ *a);
394 /* Function declarations for TS_RESP defined in ts/ts_resp_utils.c */
396 int TS_RESP_set_status_info(TS_RESP *a, TS_STATUS_INFO *info);
397 TS_STATUS_INFO *TS_RESP_get_status_info(TS_RESP *a);
399 /* Caller loses ownership of PKCS7 and TS_TST_INFO objects. */
400 void TS_RESP_set_tst_info(TS_RESP *a, PKCS7 *p7, TS_TST_INFO *tst_info);
401 PKCS7 *TS_RESP_get_token(TS_RESP *a);
402 TS_TST_INFO *TS_RESP_get_tst_info(TS_RESP *a);
404 int TS_TST_INFO_set_version(TS_TST_INFO *a, long version);
405 long TS_TST_INFO_get_version(const TS_TST_INFO *a);
407 int TS_TST_INFO_set_policy_id(TS_TST_INFO *a, ASN1_OBJECT *policy_id);
408 ASN1_OBJECT *TS_TST_INFO_get_policy_id(TS_TST_INFO *a);
410 int TS_TST_INFO_set_msg_imprint(TS_TST_INFO *a, TS_MSG_IMPRINT *msg_imprint);
411 TS_MSG_IMPRINT *TS_TST_INFO_get_msg_imprint(TS_TST_INFO *a);
413 int TS_TST_INFO_set_serial(TS_TST_INFO *a, const ASN1_INTEGER *serial);
414 const ASN1_INTEGER *TS_TST_INFO_get_serial(const TS_TST_INFO *a);
416 int TS_TST_INFO_set_time(TS_TST_INFO *a, const ASN1_GENERALIZEDTIME *gtime);
417 const ASN1_GENERALIZEDTIME *TS_TST_INFO_get_time(const TS_TST_INFO *a);
419 int TS_TST_INFO_set_accuracy(TS_TST_INFO *a, TS_ACCURACY *accuracy);
420 TS_ACCURACY *TS_TST_INFO_get_accuracy(TS_TST_INFO *a);
422 int TS_ACCURACY_set_seconds(TS_ACCURACY *a, const ASN1_INTEGER *seconds);
423 const ASN1_INTEGER *TS_ACCURACY_get_seconds(const TS_ACCURACY *a);
425 int TS_ACCURACY_set_millis(TS_ACCURACY *a, const ASN1_INTEGER *millis);
426 const ASN1_INTEGER *TS_ACCURACY_get_millis(const TS_ACCURACY *a);
428 int TS_ACCURACY_set_micros(TS_ACCURACY *a, const ASN1_INTEGER *micros);
429 const ASN1_INTEGER *TS_ACCURACY_get_micros(const TS_ACCURACY *a);
431 int TS_TST_INFO_set_ordering(TS_TST_INFO *a, int ordering);
432 int TS_TST_INFO_get_ordering(const TS_TST_INFO *a);
434 int TS_TST_INFO_set_nonce(TS_TST_INFO *a, const ASN1_INTEGER *nonce);
435 const ASN1_INTEGER *TS_TST_INFO_get_nonce(const TS_TST_INFO *a);
437 int TS_TST_INFO_set_tsa(TS_TST_INFO *a, GENERAL_NAME *tsa);
438 GENERAL_NAME *TS_TST_INFO_get_tsa(TS_TST_INFO *a);
440 STACK_OF(X509_EXTENSION) *TS_TST_INFO_get_exts(TS_TST_INFO *a);
441 void TS_TST_INFO_ext_free(TS_TST_INFO *a);
442 int TS_TST_INFO_get_ext_count(TS_TST_INFO *a);
443 int TS_TST_INFO_get_ext_by_NID(TS_TST_INFO *a, int nid, int lastpos);
444 int TS_TST_INFO_get_ext_by_OBJ(TS_TST_INFO *a, ASN1_OBJECT *obj, int lastpos);
445 int TS_TST_INFO_get_ext_by_critical(TS_TST_INFO *a, int crit, int lastpos);
446 X509_EXTENSION *TS_TST_INFO_get_ext(TS_TST_INFO *a, int loc);
447 X509_EXTENSION *TS_TST_INFO_delete_ext(TS_TST_INFO *a, int loc);
448 int TS_TST_INFO_add_ext(TS_TST_INFO *a, X509_EXTENSION *ex, int loc);
449 void *TS_TST_INFO_get_ext_d2i(TS_TST_INFO *a, int nid, int *crit, int *idx);
451 /* Declarations related to response generation, defined in ts/ts_resp_sign.c. */
453 /* Optional flags for response generation. */
455 /* Don't include the TSA name in response. */
456 #define TS_TSA_NAME 0x01
458 /* Set ordering to true in response. */
459 #define TS_ORDERING 0x02
462 * Include the signer certificate and the other specified certificates in
463 * the ESS signing certificate attribute beside the PKCS7 signed data.
464 * Only the signer certificates is included by default.
466 #define TS_ESS_CERT_ID_CHAIN 0x04
468 /* Forward declaration. */
471 /* This must return a unique number less than 160 bits long. */
472 typedef ASN1_INTEGER *(*TS_serial_cb)(struct TS_resp_ctx *, void *);
474 /* This must return the seconds and microseconds since Jan 1, 1970 in
475 the sec and usec variables allocated by the caller.
476 Return non-zero for success and zero for failure. */
477 typedef int (*TS_time_cb)(struct TS_resp_ctx *, void *, time_t *sec, long *usec);
479 /* This must process the given extension.
480 * It can modify the TS_TST_INFO object of the context.
481 * Return values: !0 (processed), 0 (error, it must set the
482 * status info/failure info of the response).
484 typedef int (*TS_extension_cb)(struct TS_resp_ctx *, X509_EXTENSION *, void *);
486 typedef struct TS_resp_ctx {
488 EVP_PKEY *signer_key;
489 STACK_OF(X509) *certs; /* Certs to include in signed data. */
490 STACK_OF(ASN1_OBJECT) *policies; /* Acceptable policies. */
491 ASN1_OBJECT *default_policy; /* It may appear in policies, too. */
492 STACK_OF(EVP_MD) *mds; /* Acceptable message digests. */
493 ASN1_INTEGER *seconds; /* accuracy, 0 means not specified. */
494 ASN1_INTEGER *millis; /* accuracy, 0 means not specified. */
495 ASN1_INTEGER *micros; /* accuracy, 0 means not specified. */
496 unsigned clock_precision_digits; /* fraction of seconds in
498 unsigned flags; /* Optional info, see values above. */
500 /* Callback functions. */
501 TS_serial_cb serial_cb;
502 void *serial_cb_data; /* User data for serial_cb. */
505 void *time_cb_data; /* User data for time_cb. */
507 TS_extension_cb extension_cb;
508 void *extension_cb_data; /* User data for extension_cb. */
510 /* These members are used only while creating the response. */
513 TS_TST_INFO *tst_info;
516 DECLARE_STACK_OF(EVP_MD)
517 DECLARE_ASN1_SET_OF(EVP_MD)
519 /* Creates a response context that can be used for generating responses. */
520 TS_RESP_CTX *TS_RESP_CTX_new(void);
521 void TS_RESP_CTX_free(TS_RESP_CTX *ctx);
523 /* This parameter must be set. */
524 int TS_RESP_CTX_set_signer_cert(TS_RESP_CTX *ctx, X509 *signer);
526 /* This parameter must be set. */
527 int TS_RESP_CTX_set_signer_key(TS_RESP_CTX *ctx, EVP_PKEY *key);
529 /* This parameter must be set. */
530 int TS_RESP_CTX_set_def_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *def_policy);
532 /* No additional certs are included in the response by default. */
533 int TS_RESP_CTX_set_certs(TS_RESP_CTX *ctx, STACK_OF(X509) *certs);
535 /* Adds a new acceptable policy, only the default policy
536 is accepted by default. */
537 int TS_RESP_CTX_add_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *policy);
539 /* Adds a new acceptable message digest. Note that no message digests
540 are accepted by default. The md argument is shared with the caller. */
541 int TS_RESP_CTX_add_md(TS_RESP_CTX *ctx, const EVP_MD *md);
543 /* Accuracy is not included by default. */
544 int TS_RESP_CTX_set_accuracy(TS_RESP_CTX *ctx,
545 int secs, int millis, int micros);
547 /* Clock precision digits, i.e. the number of decimal digits:
548 '0' means sec, '3' msec, '6' usec, and so on. Default is 0. */
549 int TS_RESP_CTX_set_clock_precision_digits(TS_RESP_CTX *ctx,
550 unsigned clock_precision_digits);
551 /* At most we accept usec precision. */
552 #define TS_MAX_CLOCK_PRECISION_DIGITS 6
554 /* No flags are set by default. */
555 void TS_RESP_CTX_add_flags(TS_RESP_CTX *ctx, int flags);
557 /* Default callback always returns a constant. */
558 void TS_RESP_CTX_set_serial_cb(TS_RESP_CTX *ctx, TS_serial_cb cb, void *data);
560 /* Default callback rejects all extensions. The extension callback is called
561 * when the TS_TST_INFO object is already set up and not signed yet. */
562 /* FIXME: extension handling is not tested yet. */
563 void TS_RESP_CTX_set_extension_cb(TS_RESP_CTX *ctx,
564 TS_extension_cb cb, void *data);
566 /* The following methods can be used in the callbacks. */
567 int TS_RESP_CTX_set_status_info(TS_RESP_CTX *ctx,
568 int status, const char *text);
570 /* Sets the status info only if it is still TS_STATUS_GRANTED. */
571 int TS_RESP_CTX_set_status_info_cond(TS_RESP_CTX *ctx,
572 int status, const char *text);
574 int TS_RESP_CTX_add_failure_info(TS_RESP_CTX *ctx, int failure);
576 /* The get methods below can be used in the extension callback. */
577 TS_REQ *TS_RESP_CTX_get_request(TS_RESP_CTX *ctx);
579 TS_TST_INFO *TS_RESP_CTX_get_tst_info(TS_RESP_CTX *ctx);
582 * Creates the signed TS_TST_INFO and puts it in TS_RESP.
583 * In case of errors it sets the status info properly.
584 * Returns NULL only in case of memory allocation/fatal error.
586 TS_RESP *TS_RESP_create_response(TS_RESP_CTX *ctx, BIO *req_bio);
589 * Declarations related to response verification,
590 * they are defined in ts/ts_resp_verify.c.
593 int TS_RESP_verify_signature(PKCS7 *token, STACK_OF(X509) *certs,
594 X509_STORE *store, X509 **signer_out);
596 /* Context structure for the generic verify method. */
598 /* Verify the signer's certificate and the signature of the response. */
599 #define TS_VFY_SIGNATURE (1u << 0)
600 /* Verify the version number of the response. */
601 #define TS_VFY_VERSION (1u << 1)
602 /* Verify if the policy supplied by the user matches the policy of the TSA. */
603 #define TS_VFY_POLICY (1u << 2)
604 /* Verify the message imprint provided by the user. This flag should not be
605 specified with TS_VFY_DATA. */
606 #define TS_VFY_IMPRINT (1u << 3)
607 /* Verify the message imprint computed by the verify method from the user
608 provided data and the MD algorithm of the response. This flag should not be
609 specified with TS_VFY_IMPRINT. */
610 #define TS_VFY_DATA (1u << 4)
611 /* Verify the nonce value. */
612 #define TS_VFY_NONCE (1u << 5)
613 /* Verify if the TSA name field matches the signer certificate. */
614 #define TS_VFY_SIGNER (1u << 6)
615 /* Verify if the TSA name field equals to the user provided name. */
616 #define TS_VFY_TSA_NAME (1u << 7)
618 /* You can use the following convenience constants. */
619 #define TS_VFY_ALL_IMPRINT (TS_VFY_SIGNATURE \
626 #define TS_VFY_ALL_DATA (TS_VFY_SIGNATURE \
634 typedef struct TS_verify_ctx {
635 /* Set this to the union of TS_VFY_... flags you want to carry out. */
638 /* Must be set only with TS_VFY_SIGNATURE. certs is optional. */
640 STACK_OF(X509) *certs;
642 /* Must be set only with TS_VFY_POLICY. */
645 /* Must be set only with TS_VFY_IMPRINT. If md_alg is NULL,
646 the algorithm from the response is used. */
648 unsigned char *imprint;
649 unsigned imprint_len;
651 /* Must be set only with TS_VFY_DATA. */
654 /* Must be set only with TS_VFY_TSA_NAME. */
657 /* Must be set only with TS_VFY_TSA_NAME. */
658 GENERAL_NAME *tsa_name;
661 int TS_RESP_verify_response(TS_VERIFY_CTX *ctx, TS_RESP *response);
662 int TS_RESP_verify_token(TS_VERIFY_CTX *ctx, PKCS7 *token);
665 * Declarations related to response verification context,
666 * they are defined in ts/ts_verify_ctx.c.
669 /* Set all fields to zero. */
670 TS_VERIFY_CTX *TS_VERIFY_CTX_new(void);
671 void TS_VERIFY_CTX_init(TS_VERIFY_CTX *ctx);
672 void TS_VERIFY_CTX_free(TS_VERIFY_CTX *ctx);
673 void TS_VERIFY_CTX_cleanup(TS_VERIFY_CTX *ctx);
676 * If ctx is NULL, it allocates and returns a new object, otherwise
677 * it returns ctx. It initialises all the members as follows:
678 * flags = TS_VFY_ALL_IMPRINT & ~(TS_VFY_TSA_NAME | TS_VFY_SIGNATURE)
681 * policy = policy from the request or NULL if absent (in this case
682 * TS_VFY_POLICY is cleared from flags as well)
683 * md_alg = MD algorithm from request
684 * imprint, imprint_len = imprint from request
686 * nonce, nonce_len = nonce from the request or NULL if absent (in this case
687 * TS_VFY_NONCE is cleared from flags as well)
689 * Important: after calling this method TS_VFY_SIGNATURE should be added!
691 TS_VERIFY_CTX *TS_REQ_to_TS_VERIFY_CTX(TS_REQ *req, TS_VERIFY_CTX *ctx);
693 /* Function declarations for TS_RESP defined in ts/ts_resp_print.c */
695 int TS_RESP_print_bio(BIO *bio, TS_RESP *a);
696 int TS_STATUS_INFO_print_bio(BIO *bio, TS_STATUS_INFO *a);
697 int TS_TST_INFO_print_bio(BIO *bio, TS_TST_INFO *a);
699 /* Common utility functions defined in ts/ts_lib.c */
701 int TS_ASN1_INTEGER_print_bio(BIO *bio, const ASN1_INTEGER *num);
702 int TS_OBJ_print_bio(BIO *bio, const ASN1_OBJECT *obj);
703 int TS_ext_print_bio(BIO *bio, const STACK_OF(X509_EXTENSION) *extensions);
704 int TS_X509_ALGOR_print_bio(BIO *bio, const X509_ALGOR *alg);
705 int TS_MSG_IMPRINT_print_bio(BIO *bio, TS_MSG_IMPRINT *msg);
707 /* Function declarations for handling configuration options,
708 defined in ts/ts_conf.c */
710 X509 *TS_CONF_load_cert(const char *file);
711 STACK_OF(X509) *TS_CONF_load_certs(const char *file);
712 EVP_PKEY *TS_CONF_load_key(const char *file, const char *pass);
713 const char *TS_CONF_get_tsa_section(CONF *conf, const char *section);
714 int TS_CONF_set_serial(CONF *conf, const char *section, TS_serial_cb cb,
716 int TS_CONF_set_crypto_device(CONF *conf, const char *section,
718 int TS_CONF_set_default_engine(const char *name);
719 int TS_CONF_set_signer_cert(CONF *conf, const char *section,
720 const char *cert, TS_RESP_CTX *ctx);
721 int TS_CONF_set_certs(CONF *conf, const char *section, const char *certs,
723 int TS_CONF_set_signer_key(CONF *conf, const char *section,
724 const char *key, const char *pass, TS_RESP_CTX *ctx);
725 int TS_CONF_set_def_policy(CONF *conf, const char *section,
726 const char *policy, TS_RESP_CTX *ctx);
727 int TS_CONF_set_policies(CONF *conf, const char *section, TS_RESP_CTX *ctx);
728 int TS_CONF_set_digests(CONF *conf, const char *section, TS_RESP_CTX *ctx);
729 int TS_CONF_set_accuracy(CONF *conf, const char *section, TS_RESP_CTX *ctx);
730 int TS_CONF_set_clock_precision_digits(CONF *conf, const char *section,
732 int TS_CONF_set_ordering(CONF *conf, const char *section, TS_RESP_CTX *ctx);
733 int TS_CONF_set_tsa_name(CONF *conf, const char *section, TS_RESP_CTX *ctx);
734 int TS_CONF_set_ess_cert_id_chain(CONF *conf, const char *section,
737 /* -------------------------------------------------- */
738 /* BEGIN ERROR CODES */
739 /* The following lines are auto generated by the script mkerr.pl. Any changes
740 * made after this point may be overwritten when the script is next run.
742 void ERR_load_TS_strings(void);
744 /* Error codes for the TS functions. */
746 /* Function codes. */
747 #define TS_F_D2I_TS_RESP 147
748 #define TS_F_DEF_SERIAL_CB 110
749 #define TS_F_DEF_TIME_CB 111
750 #define TS_F_ESS_ADD_SIGNING_CERT 112
751 #define TS_F_ESS_CERT_ID_NEW_INIT 113
752 #define TS_F_ESS_SIGNING_CERT_NEW_INIT 114
753 #define TS_F_INT_TS_RESP_VERIFY_TOKEN 149
754 #define TS_F_PKCS7_TO_TS_TST_INFO 148
755 #define TS_F_TS_ACCURACY_SET_MICROS 115
756 #define TS_F_TS_ACCURACY_SET_MILLIS 116
757 #define TS_F_TS_ACCURACY_SET_SECONDS 117
758 #define TS_F_TS_CHECK_IMPRINTS 100
759 #define TS_F_TS_CHECK_NONCES 101
760 #define TS_F_TS_CHECK_POLICY 102
761 #define TS_F_TS_CHECK_SIGNING_CERTS 103
762 #define TS_F_TS_CHECK_STATUS_INFO 104
763 #define TS_F_TS_COMPUTE_IMPRINT 145
764 #define TS_F_TS_CONF_SET_DEFAULT_ENGINE 146
765 #define TS_F_TS_GET_STATUS_TEXT 105
766 #define TS_F_TS_MSG_IMPRINT_SET_ALGO 118
767 #define TS_F_TS_REQ_SET_MSG_IMPRINT 119
768 #define TS_F_TS_REQ_SET_NONCE 120
769 #define TS_F_TS_REQ_SET_POLICY_ID 121
770 #define TS_F_TS_RESP_CREATE_RESPONSE 122
771 #define TS_F_TS_RESP_CREATE_TST_INFO 123
772 #define TS_F_TS_RESP_CTX_ADD_FAILURE_INFO 124
773 #define TS_F_TS_RESP_CTX_ADD_MD 125
774 #define TS_F_TS_RESP_CTX_ADD_POLICY 126
775 #define TS_F_TS_RESP_CTX_NEW 127
776 #define TS_F_TS_RESP_CTX_SET_ACCURACY 128
777 #define TS_F_TS_RESP_CTX_SET_CERTS 129
778 #define TS_F_TS_RESP_CTX_SET_DEF_POLICY 130
779 #define TS_F_TS_RESP_CTX_SET_SIGNER_CERT 131
780 #define TS_F_TS_RESP_CTX_SET_STATUS_INFO 132
781 #define TS_F_TS_RESP_GET_POLICY 133
782 #define TS_F_TS_RESP_SET_GENTIME_WITH_PRECISION 134
783 #define TS_F_TS_RESP_SET_STATUS_INFO 135
784 #define TS_F_TS_RESP_SET_TST_INFO 150
785 #define TS_F_TS_RESP_SIGN 136
786 #define TS_F_TS_RESP_VERIFY_SIGNATURE 106
787 #define TS_F_TS_RESP_VERIFY_TOKEN 107
788 #define TS_F_TS_TST_INFO_SET_ACCURACY 137
789 #define TS_F_TS_TST_INFO_SET_MSG_IMPRINT 138
790 #define TS_F_TS_TST_INFO_SET_NONCE 139
791 #define TS_F_TS_TST_INFO_SET_POLICY_ID 140
792 #define TS_F_TS_TST_INFO_SET_SERIAL 141
793 #define TS_F_TS_TST_INFO_SET_TIME 142
794 #define TS_F_TS_TST_INFO_SET_TSA 143
795 #define TS_F_TS_VERIFY 108
796 #define TS_F_TS_VERIFY_CERT 109
797 #define TS_F_TS_VERIFY_CTX_NEW 144
800 #define TS_R_BAD_PKCS7_TYPE 132
801 #define TS_R_BAD_TYPE 133
802 #define TS_R_CERTIFICATE_VERIFY_ERROR 100
803 #define TS_R_COULD_NOT_SET_ENGINE 127
804 #define TS_R_COULD_NOT_SET_TIME 115
805 #define TS_R_D2I_TS_RESP_INT_FAILED 128
806 #define TS_R_DETACHED_CONTENT 134
807 #define TS_R_ESS_ADD_SIGNING_CERT_ERROR 116
808 #define TS_R_ESS_SIGNING_CERTIFICATE_ERROR 101
809 #define TS_R_INVALID_NULL_POINTER 102
810 #define TS_R_INVALID_SIGNER_CERTIFICATE_PURPOSE 117
811 #define TS_R_MESSAGE_IMPRINT_MISMATCH 103
812 #define TS_R_NONCE_MISMATCH 104
813 #define TS_R_NONCE_NOT_RETURNED 105
814 #define TS_R_NO_CONTENT 106
815 #define TS_R_NO_TIME_STAMP_TOKEN 107
816 #define TS_R_PKCS7_ADD_SIGNATURE_ERROR 118
817 #define TS_R_PKCS7_ADD_SIGNED_ATTR_ERROR 119
818 #define TS_R_PKCS7_TO_TS_TST_INFO_FAILED 129
819 #define TS_R_POLICY_MISMATCH 108
820 #define TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE 120
821 #define TS_R_RESPONSE_SETUP_ERROR 121
822 #define TS_R_SIGNATURE_FAILURE 109
823 #define TS_R_THERE_MUST_BE_ONE_SIGNER 110
824 #define TS_R_TIME_SYSCALL_ERROR 122
825 #define TS_R_TOKEN_NOT_PRESENT 130
826 #define TS_R_TOKEN_PRESENT 131
827 #define TS_R_TSA_NAME_MISMATCH 111
828 #define TS_R_TSA_UNTRUSTED 112
829 #define TS_R_TST_INFO_SETUP_ERROR 123
830 #define TS_R_TS_DATASIGN 124
831 #define TS_R_UNACCEPTABLE_POLICY 125
832 #define TS_R_UNSUPPORTED_MD_ALGORITHM 126
833 #define TS_R_UNSUPPORTED_VERSION 113
834 #define TS_R_WRONG_CONTENT_TYPE 114