ts.h 22 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559
  1. /*
  2. * Copyright 2006-2018 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the OpenSSL license (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #ifndef HEADER_TS_H
  10. # define HEADER_TS_H
  11. # include <openssl/opensslconf.h>
  12. # ifndef OPENSSL_NO_TS
  13. # include <openssl/symhacks.h>
  14. # include <openssl/buffer.h>
  15. # include <openssl/evp.h>
  16. # include <openssl/bio.h>
  17. # include <openssl/asn1.h>
  18. # include <openssl/safestack.h>
  19. # include <openssl/rsa.h>
  20. # include <openssl/dsa.h>
  21. # include <openssl/dh.h>
  22. # include <openssl/tserr.h>
  23. # ifdef __cplusplus
  24. extern "C" {
  25. # endif
  26. # include <openssl/x509.h>
  27. # include <openssl/x509v3.h>
  28. typedef struct TS_msg_imprint_st TS_MSG_IMPRINT;
  29. typedef struct TS_req_st TS_REQ;
  30. typedef struct TS_accuracy_st TS_ACCURACY;
  31. typedef struct TS_tst_info_st TS_TST_INFO;
  32. /* Possible values for status. */
  33. # define TS_STATUS_GRANTED 0
  34. # define TS_STATUS_GRANTED_WITH_MODS 1
  35. # define TS_STATUS_REJECTION 2
  36. # define TS_STATUS_WAITING 3
  37. # define TS_STATUS_REVOCATION_WARNING 4
  38. # define TS_STATUS_REVOCATION_NOTIFICATION 5
  39. /* Possible values for failure_info. */
  40. # define TS_INFO_BAD_ALG 0
  41. # define TS_INFO_BAD_REQUEST 2
  42. # define TS_INFO_BAD_DATA_FORMAT 5
  43. # define TS_INFO_TIME_NOT_AVAILABLE 14
  44. # define TS_INFO_UNACCEPTED_POLICY 15
  45. # define TS_INFO_UNACCEPTED_EXTENSION 16
  46. # define TS_INFO_ADD_INFO_NOT_AVAILABLE 17
  47. # define TS_INFO_SYSTEM_FAILURE 25
  48. typedef struct TS_status_info_st TS_STATUS_INFO;
  49. typedef struct ESS_issuer_serial ESS_ISSUER_SERIAL;
  50. typedef struct ESS_cert_id ESS_CERT_ID;
  51. typedef struct ESS_signing_cert ESS_SIGNING_CERT;
  52. DEFINE_STACK_OF(ESS_CERT_ID)
  53. typedef struct ESS_cert_id_v2_st ESS_CERT_ID_V2;
  54. typedef struct ESS_signing_cert_v2_st ESS_SIGNING_CERT_V2;
  55. DEFINE_STACK_OF(ESS_CERT_ID_V2)
  56. typedef struct TS_resp_st TS_RESP;
  57. TS_REQ *TS_REQ_new(void);
  58. void TS_REQ_free(TS_REQ *a);
  59. int i2d_TS_REQ(const TS_REQ *a, unsigned char **pp);
  60. TS_REQ *d2i_TS_REQ(TS_REQ **a, const unsigned char **pp, long length);
  61. TS_REQ *TS_REQ_dup(TS_REQ *a);
  62. #ifndef OPENSSL_NO_STDIO
  63. TS_REQ *d2i_TS_REQ_fp(FILE *fp, TS_REQ **a);
  64. int i2d_TS_REQ_fp(FILE *fp, TS_REQ *a);
  65. #endif
  66. TS_REQ *d2i_TS_REQ_bio(BIO *fp, TS_REQ **a);
  67. int i2d_TS_REQ_bio(BIO *fp, TS_REQ *a);
  68. TS_MSG_IMPRINT *TS_MSG_IMPRINT_new(void);
  69. void TS_MSG_IMPRINT_free(TS_MSG_IMPRINT *a);
  70. int i2d_TS_MSG_IMPRINT(const TS_MSG_IMPRINT *a, unsigned char **pp);
  71. TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT(TS_MSG_IMPRINT **a,
  72. const unsigned char **pp, long length);
  73. TS_MSG_IMPRINT *TS_MSG_IMPRINT_dup(TS_MSG_IMPRINT *a);
  74. #ifndef OPENSSL_NO_STDIO
  75. TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT **a);
  76. int i2d_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT *a);
  77. #endif
  78. TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_bio(BIO *bio, TS_MSG_IMPRINT **a);
  79. int i2d_TS_MSG_IMPRINT_bio(BIO *bio, TS_MSG_IMPRINT *a);
  80. TS_RESP *TS_RESP_new(void);
  81. void TS_RESP_free(TS_RESP *a);
  82. int i2d_TS_RESP(const TS_RESP *a, unsigned char **pp);
  83. TS_RESP *d2i_TS_RESP(TS_RESP **a, const unsigned char **pp, long length);
  84. TS_TST_INFO *PKCS7_to_TS_TST_INFO(PKCS7 *token);
  85. TS_RESP *TS_RESP_dup(TS_RESP *a);
  86. #ifndef OPENSSL_NO_STDIO
  87. TS_RESP *d2i_TS_RESP_fp(FILE *fp, TS_RESP **a);
  88. int i2d_TS_RESP_fp(FILE *fp, TS_RESP *a);
  89. #endif
  90. TS_RESP *d2i_TS_RESP_bio(BIO *bio, TS_RESP **a);
  91. int i2d_TS_RESP_bio(BIO *bio, TS_RESP *a);
  92. TS_STATUS_INFO *TS_STATUS_INFO_new(void);
  93. void TS_STATUS_INFO_free(TS_STATUS_INFO *a);
  94. int i2d_TS_STATUS_INFO(const TS_STATUS_INFO *a, unsigned char **pp);
  95. TS_STATUS_INFO *d2i_TS_STATUS_INFO(TS_STATUS_INFO **a,
  96. const unsigned char **pp, long length);
  97. TS_STATUS_INFO *TS_STATUS_INFO_dup(TS_STATUS_INFO *a);
  98. TS_TST_INFO *TS_TST_INFO_new(void);
  99. void TS_TST_INFO_free(TS_TST_INFO *a);
  100. int i2d_TS_TST_INFO(const TS_TST_INFO *a, unsigned char **pp);
  101. TS_TST_INFO *d2i_TS_TST_INFO(TS_TST_INFO **a, const unsigned char **pp,
  102. long length);
  103. TS_TST_INFO *TS_TST_INFO_dup(TS_TST_INFO *a);
  104. #ifndef OPENSSL_NO_STDIO
  105. TS_TST_INFO *d2i_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO **a);
  106. int i2d_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO *a);
  107. #endif
  108. TS_TST_INFO *d2i_TS_TST_INFO_bio(BIO *bio, TS_TST_INFO **a);
  109. int i2d_TS_TST_INFO_bio(BIO *bio, TS_TST_INFO *a);
  110. TS_ACCURACY *TS_ACCURACY_new(void);
  111. void TS_ACCURACY_free(TS_ACCURACY *a);
  112. int i2d_TS_ACCURACY(const TS_ACCURACY *a, unsigned char **pp);
  113. TS_ACCURACY *d2i_TS_ACCURACY(TS_ACCURACY **a, const unsigned char **pp,
  114. long length);
  115. TS_ACCURACY *TS_ACCURACY_dup(TS_ACCURACY *a);
  116. ESS_ISSUER_SERIAL *ESS_ISSUER_SERIAL_new(void);
  117. void ESS_ISSUER_SERIAL_free(ESS_ISSUER_SERIAL *a);
  118. int i2d_ESS_ISSUER_SERIAL(const ESS_ISSUER_SERIAL *a, unsigned char **pp);
  119. ESS_ISSUER_SERIAL *d2i_ESS_ISSUER_SERIAL(ESS_ISSUER_SERIAL **a,
  120. const unsigned char **pp,
  121. long length);
  122. ESS_ISSUER_SERIAL *ESS_ISSUER_SERIAL_dup(ESS_ISSUER_SERIAL *a);
  123. ESS_CERT_ID *ESS_CERT_ID_new(void);
  124. void ESS_CERT_ID_free(ESS_CERT_ID *a);
  125. int i2d_ESS_CERT_ID(const ESS_CERT_ID *a, unsigned char **pp);
  126. ESS_CERT_ID *d2i_ESS_CERT_ID(ESS_CERT_ID **a, const unsigned char **pp,
  127. long length);
  128. ESS_CERT_ID *ESS_CERT_ID_dup(ESS_CERT_ID *a);
  129. ESS_SIGNING_CERT *ESS_SIGNING_CERT_new(void);
  130. void ESS_SIGNING_CERT_free(ESS_SIGNING_CERT *a);
  131. int i2d_ESS_SIGNING_CERT(const ESS_SIGNING_CERT *a, unsigned char **pp);
  132. ESS_SIGNING_CERT *d2i_ESS_SIGNING_CERT(ESS_SIGNING_CERT **a,
  133. const unsigned char **pp, long length);
  134. ESS_SIGNING_CERT *ESS_SIGNING_CERT_dup(ESS_SIGNING_CERT *a);
  135. ESS_CERT_ID_V2 *ESS_CERT_ID_V2_new(void);
  136. void ESS_CERT_ID_V2_free(ESS_CERT_ID_V2 *a);
  137. int i2d_ESS_CERT_ID_V2(const ESS_CERT_ID_V2 *a, unsigned char **pp);
  138. ESS_CERT_ID_V2 *d2i_ESS_CERT_ID_V2(ESS_CERT_ID_V2 **a,
  139. const unsigned char **pp, long length);
  140. ESS_CERT_ID_V2 *ESS_CERT_ID_V2_dup(ESS_CERT_ID_V2 *a);
  141. ESS_SIGNING_CERT_V2 *ESS_SIGNING_CERT_V2_new(void);
  142. void ESS_SIGNING_CERT_V2_free(ESS_SIGNING_CERT_V2 *a);
  143. int i2d_ESS_SIGNING_CERT_V2(const ESS_SIGNING_CERT_V2 *a, unsigned char **pp);
  144. ESS_SIGNING_CERT_V2 *d2i_ESS_SIGNING_CERT_V2(ESS_SIGNING_CERT_V2 **a,
  145. const unsigned char **pp,
  146. long length);
  147. ESS_SIGNING_CERT_V2 *ESS_SIGNING_CERT_V2_dup(ESS_SIGNING_CERT_V2 *a);
  148. int TS_REQ_set_version(TS_REQ *a, long version);
  149. long TS_REQ_get_version(const TS_REQ *a);
  150. int TS_STATUS_INFO_set_status(TS_STATUS_INFO *a, int i);
  151. const ASN1_INTEGER *TS_STATUS_INFO_get0_status(const TS_STATUS_INFO *a);
  152. const STACK_OF(ASN1_UTF8STRING) *
  153. TS_STATUS_INFO_get0_text(const TS_STATUS_INFO *a);
  154. const ASN1_BIT_STRING *
  155. TS_STATUS_INFO_get0_failure_info(const TS_STATUS_INFO *a);
  156. int TS_REQ_set_msg_imprint(TS_REQ *a, TS_MSG_IMPRINT *msg_imprint);
  157. TS_MSG_IMPRINT *TS_REQ_get_msg_imprint(TS_REQ *a);
  158. int TS_MSG_IMPRINT_set_algo(TS_MSG_IMPRINT *a, X509_ALGOR *alg);
  159. X509_ALGOR *TS_MSG_IMPRINT_get_algo(TS_MSG_IMPRINT *a);
  160. int TS_MSG_IMPRINT_set_msg(TS_MSG_IMPRINT *a, unsigned char *d, int len);
  161. ASN1_OCTET_STRING *TS_MSG_IMPRINT_get_msg(TS_MSG_IMPRINT *a);
  162. int TS_REQ_set_policy_id(TS_REQ *a, const ASN1_OBJECT *policy);
  163. ASN1_OBJECT *TS_REQ_get_policy_id(TS_REQ *a);
  164. int TS_REQ_set_nonce(TS_REQ *a, const ASN1_INTEGER *nonce);
  165. const ASN1_INTEGER *TS_REQ_get_nonce(const TS_REQ *a);
  166. int TS_REQ_set_cert_req(TS_REQ *a, int cert_req);
  167. int TS_REQ_get_cert_req(const TS_REQ *a);
  168. STACK_OF(X509_EXTENSION) *TS_REQ_get_exts(TS_REQ *a);
  169. void TS_REQ_ext_free(TS_REQ *a);
  170. int TS_REQ_get_ext_count(TS_REQ *a);
  171. int TS_REQ_get_ext_by_NID(TS_REQ *a, int nid, int lastpos);
  172. int TS_REQ_get_ext_by_OBJ(TS_REQ *a, const ASN1_OBJECT *obj, int lastpos);
  173. int TS_REQ_get_ext_by_critical(TS_REQ *a, int crit, int lastpos);
  174. X509_EXTENSION *TS_REQ_get_ext(TS_REQ *a, int loc);
  175. X509_EXTENSION *TS_REQ_delete_ext(TS_REQ *a, int loc);
  176. int TS_REQ_add_ext(TS_REQ *a, X509_EXTENSION *ex, int loc);
  177. void *TS_REQ_get_ext_d2i(TS_REQ *a, int nid, int *crit, int *idx);
  178. /* Function declarations for TS_REQ defined in ts/ts_req_print.c */
  179. int TS_REQ_print_bio(BIO *bio, TS_REQ *a);
  180. /* Function declarations for TS_RESP defined in ts/ts_resp_utils.c */
  181. int TS_RESP_set_status_info(TS_RESP *a, TS_STATUS_INFO *info);
  182. TS_STATUS_INFO *TS_RESP_get_status_info(TS_RESP *a);
  183. /* Caller loses ownership of PKCS7 and TS_TST_INFO objects. */
  184. void TS_RESP_set_tst_info(TS_RESP *a, PKCS7 *p7, TS_TST_INFO *tst_info);
  185. PKCS7 *TS_RESP_get_token(TS_RESP *a);
  186. TS_TST_INFO *TS_RESP_get_tst_info(TS_RESP *a);
  187. int TS_TST_INFO_set_version(TS_TST_INFO *a, long version);
  188. long TS_TST_INFO_get_version(const TS_TST_INFO *a);
  189. int TS_TST_INFO_set_policy_id(TS_TST_INFO *a, ASN1_OBJECT *policy_id);
  190. ASN1_OBJECT *TS_TST_INFO_get_policy_id(TS_TST_INFO *a);
  191. int TS_TST_INFO_set_msg_imprint(TS_TST_INFO *a, TS_MSG_IMPRINT *msg_imprint);
  192. TS_MSG_IMPRINT *TS_TST_INFO_get_msg_imprint(TS_TST_INFO *a);
  193. int TS_TST_INFO_set_serial(TS_TST_INFO *a, const ASN1_INTEGER *serial);
  194. const ASN1_INTEGER *TS_TST_INFO_get_serial(const TS_TST_INFO *a);
  195. int TS_TST_INFO_set_time(TS_TST_INFO *a, const ASN1_GENERALIZEDTIME *gtime);
  196. const ASN1_GENERALIZEDTIME *TS_TST_INFO_get_time(const TS_TST_INFO *a);
  197. int TS_TST_INFO_set_accuracy(TS_TST_INFO *a, TS_ACCURACY *accuracy);
  198. TS_ACCURACY *TS_TST_INFO_get_accuracy(TS_TST_INFO *a);
  199. int TS_ACCURACY_set_seconds(TS_ACCURACY *a, const ASN1_INTEGER *seconds);
  200. const ASN1_INTEGER *TS_ACCURACY_get_seconds(const TS_ACCURACY *a);
  201. int TS_ACCURACY_set_millis(TS_ACCURACY *a, const ASN1_INTEGER *millis);
  202. const ASN1_INTEGER *TS_ACCURACY_get_millis(const TS_ACCURACY *a);
  203. int TS_ACCURACY_set_micros(TS_ACCURACY *a, const ASN1_INTEGER *micros);
  204. const ASN1_INTEGER *TS_ACCURACY_get_micros(const TS_ACCURACY *a);
  205. int TS_TST_INFO_set_ordering(TS_TST_INFO *a, int ordering);
  206. int TS_TST_INFO_get_ordering(const TS_TST_INFO *a);
  207. int TS_TST_INFO_set_nonce(TS_TST_INFO *a, const ASN1_INTEGER *nonce);
  208. const ASN1_INTEGER *TS_TST_INFO_get_nonce(const TS_TST_INFO *a);
  209. int TS_TST_INFO_set_tsa(TS_TST_INFO *a, GENERAL_NAME *tsa);
  210. GENERAL_NAME *TS_TST_INFO_get_tsa(TS_TST_INFO *a);
  211. STACK_OF(X509_EXTENSION) *TS_TST_INFO_get_exts(TS_TST_INFO *a);
  212. void TS_TST_INFO_ext_free(TS_TST_INFO *a);
  213. int TS_TST_INFO_get_ext_count(TS_TST_INFO *a);
  214. int TS_TST_INFO_get_ext_by_NID(TS_TST_INFO *a, int nid, int lastpos);
  215. int TS_TST_INFO_get_ext_by_OBJ(TS_TST_INFO *a, const ASN1_OBJECT *obj,
  216. int lastpos);
  217. int TS_TST_INFO_get_ext_by_critical(TS_TST_INFO *a, int crit, int lastpos);
  218. X509_EXTENSION *TS_TST_INFO_get_ext(TS_TST_INFO *a, int loc);
  219. X509_EXTENSION *TS_TST_INFO_delete_ext(TS_TST_INFO *a, int loc);
  220. int TS_TST_INFO_add_ext(TS_TST_INFO *a, X509_EXTENSION *ex, int loc);
  221. void *TS_TST_INFO_get_ext_d2i(TS_TST_INFO *a, int nid, int *crit, int *idx);
  222. /*
  223. * Declarations related to response generation, defined in ts/ts_resp_sign.c.
  224. */
  225. /* Optional flags for response generation. */
  226. /* Don't include the TSA name in response. */
  227. # define TS_TSA_NAME 0x01
  228. /* Set ordering to true in response. */
  229. # define TS_ORDERING 0x02
  230. /*
  231. * Include the signer certificate and the other specified certificates in
  232. * the ESS signing certificate attribute beside the PKCS7 signed data.
  233. * Only the signer certificates is included by default.
  234. */
  235. # define TS_ESS_CERT_ID_CHAIN 0x04
  236. /* Forward declaration. */
  237. struct TS_resp_ctx;
  238. /* This must return a unique number less than 160 bits long. */
  239. typedef ASN1_INTEGER *(*TS_serial_cb) (struct TS_resp_ctx *, void *);
  240. /*
  241. * This must return the seconds and microseconds since Jan 1, 1970 in the sec
  242. * and usec variables allocated by the caller. Return non-zero for success
  243. * and zero for failure.
  244. */
  245. typedef int (*TS_time_cb) (struct TS_resp_ctx *, void *, long *sec,
  246. long *usec);
  247. /*
  248. * This must process the given extension. It can modify the TS_TST_INFO
  249. * object of the context. Return values: !0 (processed), 0 (error, it must
  250. * set the status info/failure info of the response).
  251. */
  252. typedef int (*TS_extension_cb) (struct TS_resp_ctx *, X509_EXTENSION *,
  253. void *);
  254. typedef struct TS_resp_ctx TS_RESP_CTX;
  255. DEFINE_STACK_OF_CONST(EVP_MD)
  256. /* Creates a response context that can be used for generating responses. */
  257. TS_RESP_CTX *TS_RESP_CTX_new(void);
  258. void TS_RESP_CTX_free(TS_RESP_CTX *ctx);
  259. /* This parameter must be set. */
  260. int TS_RESP_CTX_set_signer_cert(TS_RESP_CTX *ctx, X509 *signer);
  261. /* This parameter must be set. */
  262. int TS_RESP_CTX_set_signer_key(TS_RESP_CTX *ctx, EVP_PKEY *key);
  263. int TS_RESP_CTX_set_signer_digest(TS_RESP_CTX *ctx,
  264. const EVP_MD *signer_digest);
  265. int TS_RESP_CTX_set_ess_cert_id_digest(TS_RESP_CTX *ctx, const EVP_MD *md);
  266. /* This parameter must be set. */
  267. int TS_RESP_CTX_set_def_policy(TS_RESP_CTX *ctx, const ASN1_OBJECT *def_policy);
  268. /* No additional certs are included in the response by default. */
  269. int TS_RESP_CTX_set_certs(TS_RESP_CTX *ctx, STACK_OF(X509) *certs);
  270. /*
  271. * Adds a new acceptable policy, only the default policy is accepted by
  272. * default.
  273. */
  274. int TS_RESP_CTX_add_policy(TS_RESP_CTX *ctx, const ASN1_OBJECT *policy);
  275. /*
  276. * Adds a new acceptable message digest. Note that no message digests are
  277. * accepted by default. The md argument is shared with the caller.
  278. */
  279. int TS_RESP_CTX_add_md(TS_RESP_CTX *ctx, const EVP_MD *md);
  280. /* Accuracy is not included by default. */
  281. int TS_RESP_CTX_set_accuracy(TS_RESP_CTX *ctx,
  282. int secs, int millis, int micros);
  283. /*
  284. * Clock precision digits, i.e. the number of decimal digits: '0' means sec,
  285. * '3' msec, '6' usec, and so on. Default is 0.
  286. */
  287. int TS_RESP_CTX_set_clock_precision_digits(TS_RESP_CTX *ctx,
  288. unsigned clock_precision_digits);
  289. /* At most we accept usec precision. */
  290. # define TS_MAX_CLOCK_PRECISION_DIGITS 6
  291. /* Maximum status message length */
  292. # define TS_MAX_STATUS_LENGTH (1024 * 1024)
  293. /* No flags are set by default. */
  294. void TS_RESP_CTX_add_flags(TS_RESP_CTX *ctx, int flags);
  295. /* Default callback always returns a constant. */
  296. void TS_RESP_CTX_set_serial_cb(TS_RESP_CTX *ctx, TS_serial_cb cb, void *data);
  297. /* Default callback uses the gettimeofday() and gmtime() system calls. */
  298. void TS_RESP_CTX_set_time_cb(TS_RESP_CTX *ctx, TS_time_cb cb, void *data);
  299. /*
  300. * Default callback rejects all extensions. The extension callback is called
  301. * when the TS_TST_INFO object is already set up and not signed yet.
  302. */
  303. /* FIXME: extension handling is not tested yet. */
  304. void TS_RESP_CTX_set_extension_cb(TS_RESP_CTX *ctx,
  305. TS_extension_cb cb, void *data);
  306. /* The following methods can be used in the callbacks. */
  307. int TS_RESP_CTX_set_status_info(TS_RESP_CTX *ctx,
  308. int status, const char *text);
  309. /* Sets the status info only if it is still TS_STATUS_GRANTED. */
  310. int TS_RESP_CTX_set_status_info_cond(TS_RESP_CTX *ctx,
  311. int status, const char *text);
  312. int TS_RESP_CTX_add_failure_info(TS_RESP_CTX *ctx, int failure);
  313. /* The get methods below can be used in the extension callback. */
  314. TS_REQ *TS_RESP_CTX_get_request(TS_RESP_CTX *ctx);
  315. TS_TST_INFO *TS_RESP_CTX_get_tst_info(TS_RESP_CTX *ctx);
  316. /*
  317. * Creates the signed TS_TST_INFO and puts it in TS_RESP.
  318. * In case of errors it sets the status info properly.
  319. * Returns NULL only in case of memory allocation/fatal error.
  320. */
  321. TS_RESP *TS_RESP_create_response(TS_RESP_CTX *ctx, BIO *req_bio);
  322. /*
  323. * Declarations related to response verification,
  324. * they are defined in ts/ts_resp_verify.c.
  325. */
  326. int TS_RESP_verify_signature(PKCS7 *token, STACK_OF(X509) *certs,
  327. X509_STORE *store, X509 **signer_out);
  328. /* Context structure for the generic verify method. */
  329. /* Verify the signer's certificate and the signature of the response. */
  330. # define TS_VFY_SIGNATURE (1u << 0)
  331. /* Verify the version number of the response. */
  332. # define TS_VFY_VERSION (1u << 1)
  333. /* Verify if the policy supplied by the user matches the policy of the TSA. */
  334. # define TS_VFY_POLICY (1u << 2)
  335. /*
  336. * Verify the message imprint provided by the user. This flag should not be
  337. * specified with TS_VFY_DATA.
  338. */
  339. # define TS_VFY_IMPRINT (1u << 3)
  340. /*
  341. * Verify the message imprint computed by the verify method from the user
  342. * provided data and the MD algorithm of the response. This flag should not
  343. * be specified with TS_VFY_IMPRINT.
  344. */
  345. # define TS_VFY_DATA (1u << 4)
  346. /* Verify the nonce value. */
  347. # define TS_VFY_NONCE (1u << 5)
  348. /* Verify if the TSA name field matches the signer certificate. */
  349. # define TS_VFY_SIGNER (1u << 6)
  350. /* Verify if the TSA name field equals to the user provided name. */
  351. # define TS_VFY_TSA_NAME (1u << 7)
  352. /* You can use the following convenience constants. */
  353. # define TS_VFY_ALL_IMPRINT (TS_VFY_SIGNATURE \
  354. | TS_VFY_VERSION \
  355. | TS_VFY_POLICY \
  356. | TS_VFY_IMPRINT \
  357. | TS_VFY_NONCE \
  358. | TS_VFY_SIGNER \
  359. | TS_VFY_TSA_NAME)
  360. # define TS_VFY_ALL_DATA (TS_VFY_SIGNATURE \
  361. | TS_VFY_VERSION \
  362. | TS_VFY_POLICY \
  363. | TS_VFY_DATA \
  364. | TS_VFY_NONCE \
  365. | TS_VFY_SIGNER \
  366. | TS_VFY_TSA_NAME)
  367. typedef struct TS_verify_ctx TS_VERIFY_CTX;
  368. int TS_RESP_verify_response(TS_VERIFY_CTX *ctx, TS_RESP *response);
  369. int TS_RESP_verify_token(TS_VERIFY_CTX *ctx, PKCS7 *token);
  370. /*
  371. * Declarations related to response verification context,
  372. */
  373. TS_VERIFY_CTX *TS_VERIFY_CTX_new(void);
  374. void TS_VERIFY_CTX_init(TS_VERIFY_CTX *ctx);
  375. void TS_VERIFY_CTX_free(TS_VERIFY_CTX *ctx);
  376. void TS_VERIFY_CTX_cleanup(TS_VERIFY_CTX *ctx);
  377. int TS_VERIFY_CTX_set_flags(TS_VERIFY_CTX *ctx, int f);
  378. int TS_VERIFY_CTX_add_flags(TS_VERIFY_CTX *ctx, int f);
  379. BIO *TS_VERIFY_CTX_set_data(TS_VERIFY_CTX *ctx, BIO *b);
  380. unsigned char *TS_VERIFY_CTX_set_imprint(TS_VERIFY_CTX *ctx,
  381. unsigned char *hexstr, long len);
  382. X509_STORE *TS_VERIFY_CTX_set_store(TS_VERIFY_CTX *ctx, X509_STORE *s);
  383. STACK_OF(X509) *TS_VERIFY_CTS_set_certs(TS_VERIFY_CTX *ctx, STACK_OF(X509) *certs);
  384. /*-
  385. * If ctx is NULL, it allocates and returns a new object, otherwise
  386. * it returns ctx. It initialises all the members as follows:
  387. * flags = TS_VFY_ALL_IMPRINT & ~(TS_VFY_TSA_NAME | TS_VFY_SIGNATURE)
  388. * certs = NULL
  389. * store = NULL
  390. * policy = policy from the request or NULL if absent (in this case
  391. * TS_VFY_POLICY is cleared from flags as well)
  392. * md_alg = MD algorithm from request
  393. * imprint, imprint_len = imprint from request
  394. * data = NULL
  395. * nonce, nonce_len = nonce from the request or NULL if absent (in this case
  396. * TS_VFY_NONCE is cleared from flags as well)
  397. * tsa_name = NULL
  398. * Important: after calling this method TS_VFY_SIGNATURE should be added!
  399. */
  400. TS_VERIFY_CTX *TS_REQ_to_TS_VERIFY_CTX(TS_REQ *req, TS_VERIFY_CTX *ctx);
  401. /* Function declarations for TS_RESP defined in ts/ts_resp_print.c */
  402. int TS_RESP_print_bio(BIO *bio, TS_RESP *a);
  403. int TS_STATUS_INFO_print_bio(BIO *bio, TS_STATUS_INFO *a);
  404. int TS_TST_INFO_print_bio(BIO *bio, TS_TST_INFO *a);
  405. /* Common utility functions defined in ts/ts_lib.c */
  406. int TS_ASN1_INTEGER_print_bio(BIO *bio, const ASN1_INTEGER *num);
  407. int TS_OBJ_print_bio(BIO *bio, const ASN1_OBJECT *obj);
  408. int TS_ext_print_bio(BIO *bio, const STACK_OF(X509_EXTENSION) *extensions);
  409. int TS_X509_ALGOR_print_bio(BIO *bio, const X509_ALGOR *alg);
  410. int TS_MSG_IMPRINT_print_bio(BIO *bio, TS_MSG_IMPRINT *msg);
  411. /*
  412. * Function declarations for handling configuration options, defined in
  413. * ts/ts_conf.c
  414. */
  415. X509 *TS_CONF_load_cert(const char *file);
  416. STACK_OF(X509) *TS_CONF_load_certs(const char *file);
  417. EVP_PKEY *TS_CONF_load_key(const char *file, const char *pass);
  418. const char *TS_CONF_get_tsa_section(CONF *conf, const char *section);
  419. int TS_CONF_set_serial(CONF *conf, const char *section, TS_serial_cb cb,
  420. TS_RESP_CTX *ctx);
  421. #ifndef OPENSSL_NO_ENGINE
  422. int TS_CONF_set_crypto_device(CONF *conf, const char *section,
  423. const char *device);
  424. int TS_CONF_set_default_engine(const char *name);
  425. #endif
  426. int TS_CONF_set_signer_cert(CONF *conf, const char *section,
  427. const char *cert, TS_RESP_CTX *ctx);
  428. int TS_CONF_set_certs(CONF *conf, const char *section, const char *certs,
  429. TS_RESP_CTX *ctx);
  430. int TS_CONF_set_signer_key(CONF *conf, const char *section,
  431. const char *key, const char *pass,
  432. TS_RESP_CTX *ctx);
  433. int TS_CONF_set_signer_digest(CONF *conf, const char *section,
  434. const char *md, TS_RESP_CTX *ctx);
  435. int TS_CONF_set_def_policy(CONF *conf, const char *section,
  436. const char *policy, TS_RESP_CTX *ctx);
  437. int TS_CONF_set_policies(CONF *conf, const char *section, TS_RESP_CTX *ctx);
  438. int TS_CONF_set_digests(CONF *conf, const char *section, TS_RESP_CTX *ctx);
  439. int TS_CONF_set_accuracy(CONF *conf, const char *section, TS_RESP_CTX *ctx);
  440. int TS_CONF_set_clock_precision_digits(CONF *conf, const char *section,
  441. TS_RESP_CTX *ctx);
  442. int TS_CONF_set_ordering(CONF *conf, const char *section, TS_RESP_CTX *ctx);
  443. int TS_CONF_set_tsa_name(CONF *conf, const char *section, TS_RESP_CTX *ctx);
  444. int TS_CONF_set_ess_cert_id_chain(CONF *conf, const char *section,
  445. TS_RESP_CTX *ctx);
  446. int TS_CONF_set_ess_cert_id_digest(CONF *conf, const char *section,
  447. TS_RESP_CTX *ctx);
  448. # ifdef __cplusplus
  449. }
  450. # endif
  451. # endif
  452. #endif