From ec7cdc12a48d39fce634ee983af92ae80d9e7ce6 Mon Sep 17 00:00:00 2001 From: jsing Date: Mon, 21 Apr 2014 16:32:06 +0000 Subject: [PATCH] KNF. --- lib/libcrypto/ts/ts.h | 139 ++-- lib/libcrypto/ts/ts_asn1.c | 164 +++-- lib/libcrypto/ts/ts_conf.c | 422 ++++++------ lib/libcrypto/ts/ts_err.c | 205 +++--- lib/libcrypto/ts/ts_lib.c | 59 +- lib/libcrypto/ts/ts_req_print.c | 18 +- lib/libcrypto/ts/ts_req_utils.c | 204 +++--- lib/libcrypto/ts/ts_rsp_print.c | 140 ++-- lib/libcrypto/ts/ts_rsp_sign.c | 789 ++++++++++++----------- lib/libcrypto/ts/ts_rsp_utils.c | 358 +++++----- lib/libcrypto/ts/ts_rsp_verify.c | 507 ++++++++------- lib/libcrypto/ts/ts_verify_ctx.c | 80 +-- lib/libssl/src/crypto/ts/ts.h | 139 ++-- lib/libssl/src/crypto/ts/ts_asn1.c | 164 +++-- lib/libssl/src/crypto/ts/ts_conf.c | 422 ++++++------ lib/libssl/src/crypto/ts/ts_err.c | 205 +++--- lib/libssl/src/crypto/ts/ts_lib.c | 59 +- lib/libssl/src/crypto/ts/ts_req_print.c | 18 +- lib/libssl/src/crypto/ts/ts_req_utils.c | 204 +++--- lib/libssl/src/crypto/ts/ts_rsp_print.c | 140 ++-- lib/libssl/src/crypto/ts/ts_rsp_sign.c | 789 ++++++++++++----------- lib/libssl/src/crypto/ts/ts_rsp_utils.c | 358 +++++----- lib/libssl/src/crypto/ts/ts_rsp_verify.c | 507 ++++++++------- lib/libssl/src/crypto/ts/ts_verify_ctx.c | 80 +-- 24 files changed, 3236 insertions(+), 2934 deletions(-) diff --git a/lib/libcrypto/ts/ts.h b/lib/libcrypto/ts/ts.h index 88e0111453f..3c5ab727db5 100644 --- a/lib/libcrypto/ts/ts.h +++ b/lib/libcrypto/ts/ts.h @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -103,11 +103,10 @@ MessageImprint ::= SEQUENCE { hashedMessage OCTET STRING } */ -typedef struct TS_msg_imprint_st - { +typedef struct TS_msg_imprint_st { X509_ALGOR *hash_algo; ASN1_OCTET_STRING *hashed_msg; - } TS_MSG_IMPRINT; +} TS_MSG_IMPRINT; /* TimeStampReq ::= SEQUENCE { @@ -121,15 +120,14 @@ TimeStampReq ::= SEQUENCE { extensions [0] IMPLICIT Extensions OPTIONAL } */ -typedef struct TS_req_st - { +typedef struct TS_req_st { ASN1_INTEGER *version; TS_MSG_IMPRINT *msg_imprint; ASN1_OBJECT *policy_id; /* OPTIONAL */ ASN1_INTEGER *nonce; /* OPTIONAL */ ASN1_BOOLEAN cert_req; /* DEFAULT FALSE */ STACK_OF(X509_EXTENSION) *extensions; /* [0] OPTIONAL */ - } TS_REQ; +} TS_REQ; /* Accuracy ::= SEQUENCE { @@ -138,12 +136,11 @@ Accuracy ::= SEQUENCE { micros [1] INTEGER (1..999) OPTIONAL } */ -typedef struct TS_accuracy_st - { +typedef struct TS_accuracy_st { ASN1_INTEGER *seconds; ASN1_INTEGER *millis; ASN1_INTEGER *micros; - } TS_ACCURACY; +} TS_ACCURACY; /* TSTInfo ::= SEQUENCE { @@ -165,8 +162,7 @@ TSTInfo ::= SEQUENCE { extensions [1] IMPLICIT Extensions OPTIONAL } */ -typedef struct TS_tst_info_st - { +typedef struct TS_tst_info_st { ASN1_INTEGER *version; ASN1_OBJECT *policy_id; TS_MSG_IMPRINT *msg_imprint; @@ -177,7 +173,7 @@ typedef struct TS_tst_info_st ASN1_INTEGER *nonce; GENERAL_NAME *tsa; STACK_OF(X509_EXTENSION) *extensions; - } TS_TST_INFO; +} TS_TST_INFO; /* PKIStatusInfo ::= SEQUENCE { @@ -212,12 +208,11 @@ PKIFreeText ::= SEQUENCE SIZE (1..MAX) OF UTF8String #define TS_INFO_ADD_INFO_NOT_AVAILABLE 17 #define TS_INFO_SYSTEM_FAILURE 25 -typedef struct TS_status_info_st - { +typedef struct TS_status_info_st { ASN1_INTEGER *status; STACK_OF(ASN1_UTF8STRING) *text; ASN1_BIT_STRING *failure_info; - } TS_STATUS_INFO; +} TS_STATUS_INFO; DECLARE_STACK_OF(ASN1_UTF8STRING) DECLARE_ASN1_SET_OF(ASN1_UTF8STRING) @@ -228,12 +223,11 @@ TimeStampResp ::= SEQUENCE { timeStampToken TimeStampToken OPTIONAL } */ -typedef struct TS_resp_st - { +typedef struct TS_resp_st { TS_STATUS_INFO *status_info; PKCS7 *token; TS_TST_INFO *tst_info; - } TS_RESP; +} TS_RESP; /* The structure below would belong to the ESS component. */ @@ -244,11 +238,10 @@ IssuerSerial ::= SEQUENCE { } */ -typedef struct ESS_issuer_serial - { +typedef struct ESS_issuer_serial { STACK_OF(GENERAL_NAME) *issuer; ASN1_INTEGER *serial; - } ESS_ISSUER_SERIAL; +} ESS_ISSUER_SERIAL; /* ESSCertID ::= SEQUENCE { @@ -257,11 +250,10 @@ ESSCertID ::= SEQUENCE { } */ -typedef struct ESS_cert_id - { +typedef struct ESS_cert_id { ASN1_OCTET_STRING *hash; /* Always SHA-1 digest. */ ESS_ISSUER_SERIAL *issuer_serial; - } ESS_CERT_ID; +} ESS_CERT_ID; DECLARE_STACK_OF(ESS_CERT_ID) DECLARE_ASN1_SET_OF(ESS_CERT_ID) @@ -273,11 +265,10 @@ SigningCertificate ::= SEQUENCE { } */ -typedef struct ESS_signing_cert - { +typedef struct ESS_signing_cert { STACK_OF(ESS_CERT_ID) *cert_ids; STACK_OF(POLICYINFO) *policy_info; - } ESS_SIGNING_CERT; +} ESS_SIGNING_CERT; TS_REQ *TS_REQ_new(void); @@ -296,7 +287,7 @@ TS_MSG_IMPRINT *TS_MSG_IMPRINT_new(void); void TS_MSG_IMPRINT_free(TS_MSG_IMPRINT *a); int i2d_TS_MSG_IMPRINT(const TS_MSG_IMPRINT *a, unsigned char **pp); TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT(TS_MSG_IMPRINT **a, - const unsigned char **pp, long length); + const unsigned char **pp, long length); TS_MSG_IMPRINT *TS_MSG_IMPRINT_dup(TS_MSG_IMPRINT *a); @@ -320,15 +311,15 @@ int i2d_TS_RESP_bio(BIO *fp, TS_RESP *a); TS_STATUS_INFO *TS_STATUS_INFO_new(void); void TS_STATUS_INFO_free(TS_STATUS_INFO *a); int i2d_TS_STATUS_INFO(const TS_STATUS_INFO *a, unsigned char **pp); -TS_STATUS_INFO *d2i_TS_STATUS_INFO(TS_STATUS_INFO **a, - const unsigned char **pp, long length); +TS_STATUS_INFO *d2i_TS_STATUS_INFO(TS_STATUS_INFO **a, + const unsigned char **pp, long length); TS_STATUS_INFO *TS_STATUS_INFO_dup(TS_STATUS_INFO *a); TS_TST_INFO *TS_TST_INFO_new(void); void TS_TST_INFO_free(TS_TST_INFO *a); int i2d_TS_TST_INFO(const TS_TST_INFO *a, unsigned char **pp); TS_TST_INFO *d2i_TS_TST_INFO(TS_TST_INFO **a, const unsigned char **pp, - long length); + long length); TS_TST_INFO *TS_TST_INFO_dup(TS_TST_INFO *a); TS_TST_INFO *d2i_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO **a); @@ -340,30 +331,30 @@ TS_ACCURACY *TS_ACCURACY_new(void); void TS_ACCURACY_free(TS_ACCURACY *a); int i2d_TS_ACCURACY(const TS_ACCURACY *a, unsigned char **pp); TS_ACCURACY *d2i_TS_ACCURACY(TS_ACCURACY **a, const unsigned char **pp, - long length); + long length); TS_ACCURACY *TS_ACCURACY_dup(TS_ACCURACY *a); ESS_ISSUER_SERIAL *ESS_ISSUER_SERIAL_new(void); void ESS_ISSUER_SERIAL_free(ESS_ISSUER_SERIAL *a); int i2d_ESS_ISSUER_SERIAL(const ESS_ISSUER_SERIAL *a, - unsigned char **pp); + unsigned char **pp); ESS_ISSUER_SERIAL *d2i_ESS_ISSUER_SERIAL(ESS_ISSUER_SERIAL **a, - const unsigned char **pp, long length); + const unsigned char **pp, long length); ESS_ISSUER_SERIAL *ESS_ISSUER_SERIAL_dup(ESS_ISSUER_SERIAL *a); ESS_CERT_ID *ESS_CERT_ID_new(void); void ESS_CERT_ID_free(ESS_CERT_ID *a); int i2d_ESS_CERT_ID(const ESS_CERT_ID *a, unsigned char **pp); ESS_CERT_ID *d2i_ESS_CERT_ID(ESS_CERT_ID **a, const unsigned char **pp, - long length); + long length); ESS_CERT_ID *ESS_CERT_ID_dup(ESS_CERT_ID *a); ESS_SIGNING_CERT *ESS_SIGNING_CERT_new(void); void ESS_SIGNING_CERT_free(ESS_SIGNING_CERT *a); -int i2d_ESS_SIGNING_CERT(const ESS_SIGNING_CERT *a, - unsigned char **pp); +int i2d_ESS_SIGNING_CERT(const ESS_SIGNING_CERT *a, + unsigned char **pp); ESS_SIGNING_CERT *d2i_ESS_SIGNING_CERT(ESS_SIGNING_CERT **a, - const unsigned char **pp, long length); + const unsigned char **pp, long length); ESS_SIGNING_CERT *ESS_SIGNING_CERT_dup(ESS_SIGNING_CERT *a); void ERR_load_TS_strings(void); @@ -485,19 +476,18 @@ struct TS_resp_ctx; typedef ASN1_INTEGER *(*TS_serial_cb)(struct TS_resp_ctx *, void *); /* This must return the seconds and microseconds since Jan 1, 1970 in - the sec and usec variables allocated by the caller. + the sec and usec variables allocated by the caller. Return non-zero for success and zero for failure. */ typedef int (*TS_time_cb)(struct TS_resp_ctx *, void *, long *sec, long *usec); /* This must process the given extension. * It can modify the TS_TST_INFO object of the context. - * Return values: !0 (processed), 0 (error, it must set the + * Return values: !0 (processed), 0 (error, it must set the * status info/failure info of the response). */ typedef int (*TS_extension_cb)(struct TS_resp_ctx *, X509_EXTENSION *, void *); -typedef struct TS_resp_ctx - { +typedef struct TS_resp_ctx { X509 *signer_cert; EVP_PKEY *signer_key; STACK_OF(X509) *certs; /* Certs to include in signed data. */ @@ -514,10 +504,10 @@ typedef struct TS_resp_ctx /* Callback functions. */ TS_serial_cb serial_cb; void *serial_cb_data; /* User data for serial_cb. */ - + TS_time_cb time_cb; void *time_cb_data; /* User data for time_cb. */ - + TS_extension_cb extension_cb; void *extension_cb_data; /* User data for extension_cb. */ @@ -525,7 +515,7 @@ typedef struct TS_resp_ctx TS_REQ *request; TS_RESP *response; TS_TST_INFO *tst_info; - } TS_RESP_CTX; +} TS_RESP_CTX; DECLARE_STACK_OF(EVP_MD) DECLARE_ASN1_SET_OF(EVP_MD) @@ -546,23 +536,23 @@ int TS_RESP_CTX_set_def_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *def_policy); /* No additional certs are included in the response by default. */ int TS_RESP_CTX_set_certs(TS_RESP_CTX *ctx, STACK_OF(X509) *certs); -/* Adds a new acceptable policy, only the default policy +/* Adds a new acceptable policy, only the default policy is accepted by default. */ int TS_RESP_CTX_add_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *policy); -/* Adds a new acceptable message digest. Note that no message digests +/* Adds a new acceptable message digest. Note that no message digests are accepted by default. The md argument is shared with the caller. */ int TS_RESP_CTX_add_md(TS_RESP_CTX *ctx, const EVP_MD *md); /* Accuracy is not included by default. */ int TS_RESP_CTX_set_accuracy(TS_RESP_CTX *ctx, - int secs, int millis, int micros); + int secs, int millis, int micros); -/* Clock precision digits, i.e. the number of decimal digits: - '0' means sec, '3' msec, '6' usec, and so on. Default is 0. */ +/* Clock precision digits, i.e. the number of decimal digits: + '0' means sec, '3' msec, '6' usec, and so on. Default is 0. */ int TS_RESP_CTX_set_clock_precision_digits(TS_RESP_CTX *ctx, - unsigned clock_precision_digits); -/* At most we accept usec precision. */ + unsigned clock_precision_digits); +/* At most we accept usec precision. */ #define TS_MAX_CLOCK_PRECISION_DIGITS 6 /* No flags are set by default. */ @@ -574,19 +564,19 @@ void TS_RESP_CTX_set_serial_cb(TS_RESP_CTX *ctx, TS_serial_cb cb, void *data); /* Default callback uses the gettimeofday() and gmtime() system calls. */ void TS_RESP_CTX_set_time_cb(TS_RESP_CTX *ctx, TS_time_cb cb, void *data); -/* Default callback rejects all extensions. The extension callback is called +/* Default callback rejects all extensions. The extension callback is called * when the TS_TST_INFO object is already set up and not signed yet. */ /* FIXME: extension handling is not tested yet. */ -void TS_RESP_CTX_set_extension_cb(TS_RESP_CTX *ctx, - TS_extension_cb cb, void *data); +void TS_RESP_CTX_set_extension_cb(TS_RESP_CTX *ctx, + TS_extension_cb cb, void *data); /* The following methods can be used in the callbacks. */ -int TS_RESP_CTX_set_status_info(TS_RESP_CTX *ctx, - int status, const char *text); +int TS_RESP_CTX_set_status_info(TS_RESP_CTX *ctx, + int status, const char *text); /* Sets the status info only if it is still TS_STATUS_GRANTED. */ -int TS_RESP_CTX_set_status_info_cond(TS_RESP_CTX *ctx, - int status, const char *text); +int TS_RESP_CTX_set_status_info_cond(TS_RESP_CTX *ctx, + int status, const char *text); int TS_RESP_CTX_add_failure_info(TS_RESP_CTX *ctx, int failure); @@ -595,7 +585,7 @@ TS_REQ *TS_RESP_CTX_get_request(TS_RESP_CTX *ctx); TS_TST_INFO *TS_RESP_CTX_get_tst_info(TS_RESP_CTX *ctx); -/* +/* * Creates the signed TS_TST_INFO and puts it in TS_RESP. * In case of errors it sets the status info properly. * Returns NULL only in case of memory allocation/fatal error. @@ -608,7 +598,7 @@ TS_RESP *TS_RESP_create_response(TS_RESP_CTX *ctx, BIO *req_bio); */ int TS_RESP_verify_signature(PKCS7 *token, STACK_OF(X509) *certs, - X509_STORE *store, X509 **signer_out); + X509_STORE *store, X509 **signer_out); /* Context structure for the generic verify method. */ @@ -648,8 +638,7 @@ int TS_RESP_verify_signature(PKCS7 *token, STACK_OF(X509) *certs, | TS_VFY_SIGNER \ | TS_VFY_TSA_NAME) -typedef struct TS_verify_ctx - { +typedef struct TS_verify_ctx { /* Set this to the union of TS_VFY_... flags you want to carry out. */ unsigned flags; @@ -660,7 +649,7 @@ typedef struct TS_verify_ctx /* Must be set only with TS_VFY_POLICY. */ ASN1_OBJECT *policy; - /* Must be set only with TS_VFY_IMPRINT. If md_alg is NULL, + /* Must be set only with TS_VFY_IMPRINT. If md_alg is NULL, the algorithm from the response is used. */ X509_ALGOR *md_alg; unsigned char *imprint; @@ -674,7 +663,7 @@ typedef struct TS_verify_ctx /* Must be set only with TS_VFY_TSA_NAME. */ GENERAL_NAME *tsa_name; - } TS_VERIFY_CTX; +} TS_VERIFY_CTX; int TS_RESP_verify_response(TS_VERIFY_CTX *ctx, TS_RESP *response); int TS_RESP_verify_token(TS_VERIFY_CTX *ctx, PKCS7 *token); @@ -690,7 +679,7 @@ void TS_VERIFY_CTX_init(TS_VERIFY_CTX *ctx); void TS_VERIFY_CTX_free(TS_VERIFY_CTX *ctx); void TS_VERIFY_CTX_cleanup(TS_VERIFY_CTX *ctx); -/* +/* * If ctx is NULL, it allocates and returns a new object, otherwise * it returns ctx. It initialises all the members as follows: * flags = TS_VFY_ALL_IMPRINT & ~(TS_VFY_TSA_NAME | TS_VFY_SIGNATURE) @@ -730,27 +719,27 @@ STACK_OF(X509) *TS_CONF_load_certs(const char *file); EVP_PKEY *TS_CONF_load_key(const char *file, const char *pass); const char *TS_CONF_get_tsa_section(CONF *conf, const char *section); int TS_CONF_set_serial(CONF *conf, const char *section, TS_serial_cb cb, - TS_RESP_CTX *ctx); + TS_RESP_CTX *ctx); int TS_CONF_set_crypto_device(CONF *conf, const char *section, - const char *device); + const char *device); int TS_CONF_set_default_engine(const char *name); int TS_CONF_set_signer_cert(CONF *conf, const char *section, - const char *cert, TS_RESP_CTX *ctx); + const char *cert, TS_RESP_CTX *ctx); int TS_CONF_set_certs(CONF *conf, const char *section, const char *certs, - TS_RESP_CTX *ctx); + TS_RESP_CTX *ctx); int TS_CONF_set_signer_key(CONF *conf, const char *section, - const char *key, const char *pass, TS_RESP_CTX *ctx); + const char *key, const char *pass, TS_RESP_CTX *ctx); int TS_CONF_set_def_policy(CONF *conf, const char *section, - const char *policy, TS_RESP_CTX *ctx); + const char *policy, TS_RESP_CTX *ctx); int TS_CONF_set_policies(CONF *conf, const char *section, TS_RESP_CTX *ctx); int TS_CONF_set_digests(CONF *conf, const char *section, TS_RESP_CTX *ctx); int TS_CONF_set_accuracy(CONF *conf, const char *section, TS_RESP_CTX *ctx); int TS_CONF_set_clock_precision_digits(CONF *conf, const char *section, - TS_RESP_CTX *ctx); + TS_RESP_CTX *ctx); int TS_CONF_set_ordering(CONF *conf, const char *section, TS_RESP_CTX *ctx); int TS_CONF_set_tsa_name(CONF *conf, const char *section, TS_RESP_CTX *ctx); int TS_CONF_set_ess_cert_id_chain(CONF *conf, const char *section, - TS_RESP_CTX *ctx); + TS_RESP_CTX *ctx); /* -------------------------------------------------- */ /* BEGIN ERROR CODES */ diff --git a/lib/libcrypto/ts/ts_asn1.c b/lib/libcrypto/ts/ts_asn1.c index 40b730c5e2e..9e16b01f937 100644 --- a/lib/libcrypto/ts/ts_asn1.c +++ b/lib/libcrypto/ts/ts_asn1.c @@ -9,7 +9,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -66,27 +66,35 @@ ASN1_SEQUENCE(TS_MSG_IMPRINT) = { IMPLEMENT_ASN1_FUNCTIONS_const(TS_MSG_IMPRINT) IMPLEMENT_ASN1_DUP_FUNCTION(TS_MSG_IMPRINT) + #ifndef OPENSSL_NO_BIO -TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_bio(BIO *bp, TS_MSG_IMPRINT **a) - { - return ASN1_d2i_bio_of(TS_MSG_IMPRINT, TS_MSG_IMPRINT_new, d2i_TS_MSG_IMPRINT, bp, a); - } +TS_MSG_IMPRINT * +d2i_TS_MSG_IMPRINT_bio(BIO *bp, TS_MSG_IMPRINT **a) +{ + return ASN1_d2i_bio_of(TS_MSG_IMPRINT, TS_MSG_IMPRINT_new, + d2i_TS_MSG_IMPRINT, bp, a); +} -int i2d_TS_MSG_IMPRINT_bio(BIO *bp, TS_MSG_IMPRINT *a) +int +i2d_TS_MSG_IMPRINT_bio(BIO *bp, TS_MSG_IMPRINT *a) { return ASN1_i2d_bio_of_const(TS_MSG_IMPRINT, i2d_TS_MSG_IMPRINT, bp, a); } #endif + #ifndef OPENSSL_NO_FP_API -TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT **a) - { - return ASN1_d2i_fp_of(TS_MSG_IMPRINT, TS_MSG_IMPRINT_new, d2i_TS_MSG_IMPRINT, fp, a); - } +TS_MSG_IMPRINT * +d2i_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT **a) +{ + return ASN1_d2i_fp_of(TS_MSG_IMPRINT, TS_MSG_IMPRINT_new, + d2i_TS_MSG_IMPRINT, fp, a); +} -int i2d_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT *a) - { +int +i2d_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT *a) +{ return ASN1_i2d_fp_of_const(TS_MSG_IMPRINT, i2d_TS_MSG_IMPRINT, fp, a); - } +} #endif ASN1_SEQUENCE(TS_REQ) = { @@ -100,27 +108,33 @@ ASN1_SEQUENCE(TS_REQ) = { IMPLEMENT_ASN1_FUNCTIONS_const(TS_REQ) IMPLEMENT_ASN1_DUP_FUNCTION(TS_REQ) + #ifndef OPENSSL_NO_BIO -TS_REQ *d2i_TS_REQ_bio(BIO *bp, TS_REQ **a) - { +TS_REQ * +d2i_TS_REQ_bio(BIO *bp, TS_REQ **a) +{ return ASN1_d2i_bio_of(TS_REQ, TS_REQ_new, d2i_TS_REQ, bp, a); - } +} -int i2d_TS_REQ_bio(BIO *bp, TS_REQ *a) - { +int +i2d_TS_REQ_bio(BIO *bp, TS_REQ *a) +{ return ASN1_i2d_bio_of_const(TS_REQ, i2d_TS_REQ, bp, a); - } +} #endif + #ifndef OPENSSL_NO_FP_API -TS_REQ *d2i_TS_REQ_fp(FILE *fp, TS_REQ **a) - { +TS_REQ * +d2i_TS_REQ_fp(FILE *fp, TS_REQ **a) +{ return ASN1_d2i_fp_of(TS_REQ, TS_REQ_new, d2i_TS_REQ, fp, a); - } +} -int i2d_TS_REQ_fp(FILE *fp, TS_REQ *a) - { +int +i2d_TS_REQ_fp(FILE *fp, TS_REQ *a) +{ return ASN1_i2d_fp_of_const(TS_REQ, i2d_TS_REQ, fp, a); - } +} #endif ASN1_SEQUENCE(TS_ACCURACY) = { @@ -147,27 +161,35 @@ ASN1_SEQUENCE(TS_TST_INFO) = { IMPLEMENT_ASN1_FUNCTIONS_const(TS_TST_INFO) IMPLEMENT_ASN1_DUP_FUNCTION(TS_TST_INFO) + #ifndef OPENSSL_NO_BIO -TS_TST_INFO *d2i_TS_TST_INFO_bio(BIO *bp, TS_TST_INFO **a) - { - return ASN1_d2i_bio_of(TS_TST_INFO, TS_TST_INFO_new, d2i_TS_TST_INFO, bp, a); - } +TS_TST_INFO * +d2i_TS_TST_INFO_bio(BIO *bp, TS_TST_INFO **a) +{ + return ASN1_d2i_bio_of(TS_TST_INFO, TS_TST_INFO_new, d2i_TS_TST_INFO, + bp, a); +} -int i2d_TS_TST_INFO_bio(BIO *bp, TS_TST_INFO *a) - { +int +i2d_TS_TST_INFO_bio(BIO *bp, TS_TST_INFO *a) +{ return ASN1_i2d_bio_of_const(TS_TST_INFO, i2d_TS_TST_INFO, bp, a); - } +} #endif + #ifndef OPENSSL_NO_FP_API -TS_TST_INFO *d2i_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO **a) - { - return ASN1_d2i_fp_of(TS_TST_INFO, TS_TST_INFO_new, d2i_TS_TST_INFO, fp, a); - } +TS_TST_INFO * +d2i_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO **a) +{ + return ASN1_d2i_fp_of(TS_TST_INFO, TS_TST_INFO_new, d2i_TS_TST_INFO, + fp, a); +} -int i2d_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO *a) - { +int +i2d_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO *a) +{ return ASN1_i2d_fp_of_const(TS_TST_INFO, i2d_TS_TST_INFO, fp, a); - } +} #endif ASN1_SEQUENCE(TS_STATUS_INFO) = { @@ -179,7 +201,8 @@ ASN1_SEQUENCE(TS_STATUS_INFO) = { IMPLEMENT_ASN1_FUNCTIONS_const(TS_STATUS_INFO) IMPLEMENT_ASN1_DUP_FUNCTION(TS_STATUS_INFO) -static int ts_resp_set_tst_info(TS_RESP *a) +static int +ts_resp_set_tst_info(TS_RESP *a) { long status; @@ -194,7 +217,8 @@ static int ts_resp_set_tst_info(TS_RESP *a) TS_TST_INFO_free(a->tst_info); a->tst_info = PKCS7_to_TS_TST_INFO(a->token); if (!a->tst_info) { - TSerr(TS_F_TS_RESP_SET_TST_INFO, TS_R_PKCS7_TO_TS_TST_INFO_FAILED); + TSerr(TS_F_TS_RESP_SET_TST_INFO, + TS_R_PKCS7_TO_TS_TST_INFO_FAILED); return 0; } } else if (status == 0 || status == 1) { @@ -205,10 +229,11 @@ static int ts_resp_set_tst_info(TS_RESP *a) return 1; } -static int ts_resp_cb(int op, ASN1_VALUE **pval, const ASN1_ITEM *it, - void *exarg) +static int +ts_resp_cb(int op, ASN1_VALUE **pval, const ASN1_ITEM *it, void *exarg) { TS_RESP *ts_resp = (TS_RESP *)*pval; + if (op == ASN1_OP_NEW_POST) { ts_resp->tst_info = NULL; } else if (op == ASN1_OP_FREE_POST) { @@ -228,27 +253,33 @@ ASN1_SEQUENCE_cb(TS_RESP, ts_resp_cb) = { IMPLEMENT_ASN1_FUNCTIONS_const(TS_RESP) IMPLEMENT_ASN1_DUP_FUNCTION(TS_RESP) + #ifndef OPENSSL_NO_BIO -TS_RESP *d2i_TS_RESP_bio(BIO *bp, TS_RESP **a) - { +TS_RESP * +d2i_TS_RESP_bio(BIO *bp, TS_RESP **a) +{ return ASN1_d2i_bio_of(TS_RESP, TS_RESP_new, d2i_TS_RESP, bp, a); - } +} -int i2d_TS_RESP_bio(BIO *bp, TS_RESP *a) - { +int +i2d_TS_RESP_bio(BIO *bp, TS_RESP *a) +{ return ASN1_i2d_bio_of_const(TS_RESP, i2d_TS_RESP, bp, a); - } +} #endif + #ifndef OPENSSL_NO_FP_API -TS_RESP *d2i_TS_RESP_fp(FILE *fp, TS_RESP **a) - { +TS_RESP * +d2i_TS_RESP_fp(FILE *fp, TS_RESP **a) +{ return ASN1_d2i_fp_of(TS_RESP, TS_RESP_new, d2i_TS_RESP, fp, a); - } +} -int i2d_TS_RESP_fp(FILE *fp, TS_RESP *a) - { +int +i2d_TS_RESP_fp(FILE *fp, TS_RESP *a) +{ return ASN1_i2d_fp_of_const(TS_RESP, i2d_TS_RESP, fp, a); - } +} #endif ASN1_SEQUENCE(ESS_ISSUER_SERIAL) = { @@ -276,7 +307,8 @@ IMPLEMENT_ASN1_FUNCTIONS_const(ESS_SIGNING_CERT) IMPLEMENT_ASN1_DUP_FUNCTION(ESS_SIGNING_CERT) /* Getting encapsulated TS_TST_INFO object from PKCS7. */ -TS_TST_INFO *PKCS7_to_TS_TST_INFO(PKCS7 *token) +TS_TST_INFO * +PKCS7_to_TS_TST_INFO(PKCS7 *token) { PKCS7_SIGNED *pkcs7_signed; PKCS7 *enveloped; @@ -284,35 +316,31 @@ TS_TST_INFO *PKCS7_to_TS_TST_INFO(PKCS7 *token) ASN1_OCTET_STRING *tst_info_der; const unsigned char *p; - if (!PKCS7_type_is_signed(token)) - { + if (!PKCS7_type_is_signed(token)) { TSerr(TS_F_PKCS7_TO_TS_TST_INFO, TS_R_BAD_PKCS7_TYPE); return NULL; - } + } /* Content must be present. */ - if (PKCS7_get_detached(token)) - { + if (PKCS7_get_detached(token)) { TSerr(TS_F_PKCS7_TO_TS_TST_INFO, TS_R_DETACHED_CONTENT); return NULL; - } + } /* We have a signed data with content. */ pkcs7_signed = token->d.sign; enveloped = pkcs7_signed->contents; - if (OBJ_obj2nid(enveloped->type) != NID_id_smime_ct_TSTInfo) - { + if (OBJ_obj2nid(enveloped->type) != NID_id_smime_ct_TSTInfo) { TSerr(TS_F_PKCS7_TO_TS_TST_INFO, TS_R_BAD_PKCS7_TYPE); return NULL; - } + } /* We have a DER encoded TST_INFO as the signed data. */ tst_info_wrapper = enveloped->d.other; - if (tst_info_wrapper->type != V_ASN1_OCTET_STRING) - { + if (tst_info_wrapper->type != V_ASN1_OCTET_STRING) { TSerr(TS_F_PKCS7_TO_TS_TST_INFO, TS_R_BAD_TYPE); return NULL; - } + } /* We have the correct ASN1_OCTET_STRING type. */ tst_info_der = tst_info_wrapper->value.octet_string; diff --git a/lib/libcrypto/ts/ts_conf.c b/lib/libcrypto/ts/ts_conf.c index 212f8bf702c..f8cf3b514ce 100644 --- a/lib/libcrypto/ts/ts_conf.c +++ b/lib/libcrypto/ts/ts_conf.c @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -85,420 +85,440 @@ #define ENV_VALUE_SECS "secs" #define ENV_VALUE_MILLISECS "millisecs" #define ENV_VALUE_MICROSECS "microsecs" -#define ENV_CLOCK_PRECISION_DIGITS "clock_precision_digits" +#define ENV_CLOCK_PRECISION_DIGITS "clock_precision_digits" #define ENV_VALUE_YES "yes" #define ENV_VALUE_NO "no" /* Function definitions for certificate and key loading. */ -X509 *TS_CONF_load_cert(const char *file) - { +X509 * +TS_CONF_load_cert(const char *file) +{ BIO *cert = NULL; X509 *x = NULL; - if ((cert = BIO_new_file(file, "r")) == NULL) goto end; + if ((cert = BIO_new_file(file, "r")) == NULL) + goto end; x = PEM_read_bio_X509_AUX(cert, NULL, NULL, NULL); + end: if (x == NULL) fprintf(stderr, "unable to load certificate: %s\n", file); BIO_free(cert); return x; - } +} STACK_OF(X509) *TS_CONF_load_certs(const char *file) - { +{ BIO *certs = NULL; STACK_OF(X509) *othercerts = NULL; STACK_OF(X509_INFO) *allcerts = NULL; int i; - if (!(certs = BIO_new_file(file, "r"))) goto end; + if (!(certs = BIO_new_file(file, "r"))) + goto end; - if (!(othercerts = sk_X509_new_null())) goto end; + if (!(othercerts = sk_X509_new_null())) + goto end; allcerts = PEM_X509_INFO_read_bio(certs, NULL, NULL, NULL); - for(i = 0; i < sk_X509_INFO_num(allcerts); i++) - { + for (i = 0; i < sk_X509_INFO_num(allcerts); i++) { X509_INFO *xi = sk_X509_INFO_value(allcerts, i); - if (xi->x509) - { + if (xi->x509) { sk_X509_push(othercerts, xi->x509); xi->x509 = NULL; - } } + } + end: if (othercerts == NULL) fprintf(stderr, "unable to load certificates: %s\n", file); sk_X509_INFO_pop_free(allcerts, X509_INFO_free); BIO_free(certs); return othercerts; - } +} -EVP_PKEY *TS_CONF_load_key(const char *file, const char *pass) - { +EVP_PKEY * +TS_CONF_load_key(const char *file, const char *pass) +{ BIO *key = NULL; EVP_PKEY *pkey = NULL; - if (!(key = BIO_new_file(file, "r"))) goto end; + if (!(key = BIO_new_file(file, "r"))) + goto end; pkey = PEM_read_bio_PrivateKey(key, NULL, NULL, (char *) pass); - end: + +end: if (pkey == NULL) fprintf(stderr, "unable to load private key: %s\n", file); BIO_free(key); return pkey; - } +} /* Function definitions for handling configuration options. */ -static void TS_CONF_lookup_fail(const char *name, const char *tag) - { +static void +TS_CONF_lookup_fail(const char *name, const char *tag) +{ fprintf(stderr, "variable lookup failed for %s::%s\n", name, tag); - } +} -static void TS_CONF_invalid(const char *name, const char *tag) - { +static void +TS_CONF_invalid(const char *name, const char *tag) +{ fprintf(stderr, "invalid variable value for %s::%s\n", name, tag); - } +} -const char *TS_CONF_get_tsa_section(CONF *conf, const char *section) - { - if (!section) - { +const char * +TS_CONF_get_tsa_section(CONF *conf, const char *section) +{ + if (!section) { section = NCONF_get_string(conf, BASE_SECTION, ENV_DEFAULT_TSA); if (!section) TS_CONF_lookup_fail(BASE_SECTION, ENV_DEFAULT_TSA); - } - return section; } + return section; +} -int TS_CONF_set_serial(CONF *conf, const char *section, TS_serial_cb cb, - TS_RESP_CTX *ctx) - { +int +TS_CONF_set_serial(CONF *conf, const char *section, TS_serial_cb cb, + TS_RESP_CTX *ctx) +{ int ret = 0; char *serial = NCONF_get_string(conf, section, ENV_SERIAL); - if (!serial) - { + + if (!serial) { TS_CONF_lookup_fail(section, ENV_SERIAL); goto err; - } + } TS_RESP_CTX_set_serial_cb(ctx, cb, serial); ret = 1; - err: + +err: return ret; - } +} #ifndef OPENSSL_NO_ENGINE -int TS_CONF_set_crypto_device(CONF *conf, const char *section, - const char *device) - { +int +TS_CONF_set_crypto_device(CONF *conf, const char *section, const char *device) +{ int ret = 0; - + if (!device) - device = NCONF_get_string(conf, section, - ENV_CRYPTO_DEVICE); + device = NCONF_get_string(conf, section, ENV_CRYPTO_DEVICE); - if (device && !TS_CONF_set_default_engine(device)) - { + if (device && !TS_CONF_set_default_engine(device)) { TS_CONF_invalid(section, ENV_CRYPTO_DEVICE); goto err; - } + } ret = 1; - err: + +err: return ret; - } +} -int TS_CONF_set_default_engine(const char *name) - { +int +TS_CONF_set_default_engine(const char *name) +{ ENGINE *e = NULL; int ret = 0; /* Leave the default if builtin specified. */ - if (strcmp(name, "builtin") == 0) return 1; + if (strcmp(name, "builtin") == 0) + return 1; - if (!(e = ENGINE_by_id(name))) goto err; + if (!(e = ENGINE_by_id(name))) + goto err; /* All the operations are going to be carried out by the engine. */ - if (!ENGINE_set_default(e, ENGINE_METHOD_ALL)) goto err; + if (!ENGINE_set_default(e, ENGINE_METHOD_ALL)) + goto err; ret = 1; - err: - if (!ret) - { - TSerr(TS_F_TS_CONF_SET_DEFAULT_ENGINE, - TS_R_COULD_NOT_SET_ENGINE); + +err: + if (!ret) { + TSerr(TS_F_TS_CONF_SET_DEFAULT_ENGINE, + TS_R_COULD_NOT_SET_ENGINE); ERR_add_error_data(2, "engine:", name); - } - if (e) ENGINE_free(e); - return ret; } + if (e) + ENGINE_free(e); + return ret; +} #endif -int TS_CONF_set_signer_cert(CONF *conf, const char *section, - const char *cert, TS_RESP_CTX *ctx) - { +int +TS_CONF_set_signer_cert(CONF *conf, const char *section, const char *cert, + TS_RESP_CTX *ctx) +{ int ret = 0; X509 *cert_obj = NULL; - if (!cert) - cert = NCONF_get_string(conf, section, ENV_SIGNER_CERT); + if (!cert) - { + cert = NCONF_get_string(conf, section, ENV_SIGNER_CERT); + if (!cert) { TS_CONF_lookup_fail(section, ENV_SIGNER_CERT); goto err; - } + } if (!(cert_obj = TS_CONF_load_cert(cert))) goto err; if (!TS_RESP_CTX_set_signer_cert(ctx, cert_obj)) goto err; ret = 1; - err: + +err: X509_free(cert_obj); return ret; - } +} -int TS_CONF_set_certs(CONF *conf, const char *section, const char *certs, - TS_RESP_CTX *ctx) - { +int +TS_CONF_set_certs(CONF *conf, const char *section, const char *certs, + TS_RESP_CTX *ctx) +{ int ret = 0; STACK_OF(X509) *certs_obj = NULL; - if (!certs) + + if (!certs) certs = NCONF_get_string(conf, section, ENV_CERTS); /* Certificate chain is optional. */ - if (!certs) goto end; - if (!(certs_obj = TS_CONF_load_certs(certs))) goto err; - if (!TS_RESP_CTX_set_certs(ctx, certs_obj)) goto err; - end: + if (!certs) + goto end; + if (!(certs_obj = TS_CONF_load_certs(certs))) + goto err; + if (!TS_RESP_CTX_set_certs(ctx, certs_obj)) + goto err; + +end: ret = 1; - err: +err: sk_X509_pop_free(certs_obj, X509_free); return ret; - } +} -int TS_CONF_set_signer_key(CONF *conf, const char *section, - const char *key, const char *pass, - TS_RESP_CTX *ctx) - { +int +TS_CONF_set_signer_key(CONF *conf, const char *section, const char *key, + const char *pass, TS_RESP_CTX *ctx) +{ int ret = 0; EVP_PKEY *key_obj = NULL; - if (!key) - key = NCONF_get_string(conf, section, ENV_SIGNER_KEY); + if (!key) - { + key = NCONF_get_string(conf, section, ENV_SIGNER_KEY); + if (!key) { TS_CONF_lookup_fail(section, ENV_SIGNER_KEY); goto err; - } - if (!(key_obj = TS_CONF_load_key(key, pass))) goto err; - if (!TS_RESP_CTX_set_signer_key(ctx, key_obj)) goto err; + } + if (!(key_obj = TS_CONF_load_key(key, pass))) + goto err; + if (!TS_RESP_CTX_set_signer_key(ctx, key_obj)) + goto err; ret = 1; - err: + +err: EVP_PKEY_free(key_obj); return ret; - } +} -int TS_CONF_set_def_policy(CONF *conf, const char *section, - const char *policy, TS_RESP_CTX *ctx) - { +int +TS_CONF_set_def_policy(CONF *conf, const char *section, const char *policy, + TS_RESP_CTX *ctx) +{ int ret = 0; ASN1_OBJECT *policy_obj = NULL; - if (!policy) - policy = NCONF_get_string(conf, section, - ENV_DEFAULT_POLICY); - if (!policy) - { + + if (!policy) + policy = NCONF_get_string(conf, section, ENV_DEFAULT_POLICY); + if (!policy) { TS_CONF_lookup_fail(section, ENV_DEFAULT_POLICY); goto err; - } - if (!(policy_obj = OBJ_txt2obj(policy, 0))) - { + } + if (!(policy_obj = OBJ_txt2obj(policy, 0))) { TS_CONF_invalid(section, ENV_DEFAULT_POLICY); goto err; - } + } if (!TS_RESP_CTX_set_def_policy(ctx, policy_obj)) goto err; ret = 1; - err: + +err: ASN1_OBJECT_free(policy_obj); return ret; - } +} -int TS_CONF_set_policies(CONF *conf, const char *section, - TS_RESP_CTX *ctx) - { +int +TS_CONF_set_policies(CONF *conf, const char *section, TS_RESP_CTX *ctx) +{ int ret = 0; int i; STACK_OF(CONF_VALUE) *list = NULL; - char *policies = NCONF_get_string(conf, section, - ENV_OTHER_POLICIES); + char *policies = NCONF_get_string(conf, section, ENV_OTHER_POLICIES); + /* If no other policy is specified, that's fine. */ - if (policies && !(list = X509V3_parse_list(policies))) - { + if (policies && !(list = X509V3_parse_list(policies))) { TS_CONF_invalid(section, ENV_OTHER_POLICIES); goto err; - } - for (i = 0; i < sk_CONF_VALUE_num(list); ++i) - { + } + for (i = 0; i < sk_CONF_VALUE_num(list); ++i) { CONF_VALUE *val = sk_CONF_VALUE_value(list, i); const char *extval = val->value ? val->value : val->name; ASN1_OBJECT *objtmp; - if (!(objtmp = OBJ_txt2obj(extval, 0))) - { + if (!(objtmp = OBJ_txt2obj(extval, 0))) { TS_CONF_invalid(section, ENV_OTHER_POLICIES); goto err; - } + } if (!TS_RESP_CTX_add_policy(ctx, objtmp)) goto err; ASN1_OBJECT_free(objtmp); - } + } ret = 1; - err: + +err: sk_CONF_VALUE_pop_free(list, X509V3_conf_free); return ret; - } +} -int TS_CONF_set_digests(CONF *conf, const char *section, - TS_RESP_CTX *ctx) - { +int +TS_CONF_set_digests(CONF *conf, const char *section, TS_RESP_CTX *ctx) +{ int ret = 0; int i; STACK_OF(CONF_VALUE) *list = NULL; char *digests = NCONF_get_string(conf, section, ENV_DIGESTS); - if (!digests) - { + + if (!digests) { TS_CONF_lookup_fail(section, ENV_DIGESTS); goto err; - } - if (!(list = X509V3_parse_list(digests))) - { + } + if (!(list = X509V3_parse_list(digests))) { TS_CONF_invalid(section, ENV_DIGESTS); goto err; - } - if (sk_CONF_VALUE_num(list) == 0) - { + } + if (sk_CONF_VALUE_num(list) == 0) { TS_CONF_invalid(section, ENV_DIGESTS); goto err; - } - for (i = 0; i < sk_CONF_VALUE_num(list); ++i) - { + } + for (i = 0; i < sk_CONF_VALUE_num(list); ++i) { CONF_VALUE *val = sk_CONF_VALUE_value(list, i); const char *extval = val->value ? val->value : val->name; const EVP_MD *md; - if (!(md = EVP_get_digestbyname(extval))) - { + if (!(md = EVP_get_digestbyname(extval))) { TS_CONF_invalid(section, ENV_DIGESTS); goto err; - } + } if (!TS_RESP_CTX_add_md(ctx, md)) goto err; - } + } ret = 1; - err: + +err: sk_CONF_VALUE_pop_free(list, X509V3_conf_free); return ret; - } +} -int TS_CONF_set_accuracy(CONF *conf, const char *section, TS_RESP_CTX *ctx) - { +int +TS_CONF_set_accuracy(CONF *conf, const char *section, TS_RESP_CTX *ctx) +{ int ret = 0; int i; int secs = 0, millis = 0, micros = 0; STACK_OF(CONF_VALUE) *list = NULL; char *accuracy = NCONF_get_string(conf, section, ENV_ACCURACY); - if (accuracy && !(list = X509V3_parse_list(accuracy))) - { + if (accuracy && !(list = X509V3_parse_list(accuracy))) { TS_CONF_invalid(section, ENV_ACCURACY); goto err; - } - for (i = 0; i < sk_CONF_VALUE_num(list); ++i) - { + } + for (i = 0; i < sk_CONF_VALUE_num(list); ++i) { CONF_VALUE *val = sk_CONF_VALUE_value(list, i); - if (strcmp(val->name, ENV_VALUE_SECS) == 0) - { - if (val->value) secs = atoi(val->value); - } - else if (strcmp(val->name, ENV_VALUE_MILLISECS) == 0) - { - if (val->value) millis = atoi(val->value); - } - else if (strcmp(val->name, ENV_VALUE_MICROSECS) == 0) - { - if (val->value) micros = atoi(val->value); - } - else - { + if (strcmp(val->name, ENV_VALUE_SECS) == 0) { + if (val->value) + secs = atoi(val->value); + } else if (strcmp(val->name, ENV_VALUE_MILLISECS) == 0) { + if (val->value) + millis = atoi(val->value); + } else if (strcmp(val->name, ENV_VALUE_MICROSECS) == 0) { + if (val->value) + micros = atoi(val->value); + } else { TS_CONF_invalid(section, ENV_ACCURACY); goto err; - } } + } if (!TS_RESP_CTX_set_accuracy(ctx, secs, millis, micros)) goto err; ret = 1; - err: + +err: sk_CONF_VALUE_pop_free(list, X509V3_conf_free); return ret; - } +} -int TS_CONF_set_clock_precision_digits(CONF *conf, const char *section, - TS_RESP_CTX *ctx) - { +int +TS_CONF_set_clock_precision_digits(CONF *conf, const char *section, + TS_RESP_CTX *ctx) +{ int ret = 0; long digits = 0; - + /* If not specified, set the default value to 0, i.e. sec precision */ if (!NCONF_get_number_e(conf, section, ENV_CLOCK_PRECISION_DIGITS, - &digits)) + &digits)) digits = 0; - if (digits < 0 || digits > TS_MAX_CLOCK_PRECISION_DIGITS) - { + if (digits < 0 || digits > TS_MAX_CLOCK_PRECISION_DIGITS) { TS_CONF_invalid(section, ENV_CLOCK_PRECISION_DIGITS); goto err; - } + } if (!TS_RESP_CTX_set_clock_precision_digits(ctx, digits)) goto err; return 1; - err: + +err: return ret; - } +} -static int TS_CONF_add_flag(CONF *conf, const char *section, const char *field, - int flag, TS_RESP_CTX *ctx) - { +static int +TS_CONF_add_flag(CONF *conf, const char *section, const char *field, int flag, + TS_RESP_CTX *ctx) +{ /* Default is false. */ const char *value = NCONF_get_string(conf, section, field); - if (value) - { + + if (value) { if (strcmp(value, ENV_VALUE_YES) == 0) TS_RESP_CTX_add_flags(ctx, flag); - else if (strcmp(value, ENV_VALUE_NO) != 0) - { + else if (strcmp(value, ENV_VALUE_NO) != 0) { TS_CONF_invalid(section, field); return 0; - } } + } return 1; - } +} -int TS_CONF_set_ordering(CONF *conf, const char *section, TS_RESP_CTX *ctx) - { +int +TS_CONF_set_ordering(CONF *conf, const char *section, TS_RESP_CTX *ctx) +{ return TS_CONF_add_flag(conf, section, ENV_ORDERING, TS_ORDERING, ctx); - } +} -int TS_CONF_set_tsa_name(CONF *conf, const char *section, TS_RESP_CTX *ctx) - { +int +TS_CONF_set_tsa_name(CONF *conf, const char *section, TS_RESP_CTX *ctx) +{ return TS_CONF_add_flag(conf, section, ENV_TSA_NAME, TS_TSA_NAME, ctx); - } - -int TS_CONF_set_ess_cert_id_chain(CONF *conf, const char *section, - TS_RESP_CTX *ctx) - { - return TS_CONF_add_flag(conf, section, ENV_ESS_CERT_ID_CHAIN, - TS_ESS_CERT_ID_CHAIN, ctx); - } +} + +int +TS_CONF_set_ess_cert_id_chain(CONF *conf, const char *section, TS_RESP_CTX *ctx) +{ + return TS_CONF_add_flag(conf, section, ENV_ESS_CERT_ID_CHAIN, + TS_ESS_CERT_ID_CHAIN, ctx); +} diff --git a/lib/libcrypto/ts/ts_err.c b/lib/libcrypto/ts/ts_err.c index a08b0ffa234..1185d22fd7a 100644 --- a/lib/libcrypto/ts/ts_err.c +++ b/lib/libcrypto/ts/ts_err.c @@ -7,7 +7,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -68,112 +68,109 @@ #define ERR_FUNC(func) ERR_PACK(ERR_LIB_TS,func,0) #define ERR_REASON(reason) ERR_PACK(ERR_LIB_TS,0,reason) -static ERR_STRING_DATA TS_str_functs[]= - { -{ERR_FUNC(TS_F_D2I_TS_RESP), "d2i_TS_RESP"}, -{ERR_FUNC(TS_F_DEF_SERIAL_CB), "DEF_SERIAL_CB"}, -{ERR_FUNC(TS_F_DEF_TIME_CB), "DEF_TIME_CB"}, -{ERR_FUNC(TS_F_ESS_ADD_SIGNING_CERT), "ESS_ADD_SIGNING_CERT"}, -{ERR_FUNC(TS_F_ESS_CERT_ID_NEW_INIT), "ESS_CERT_ID_NEW_INIT"}, -{ERR_FUNC(TS_F_ESS_SIGNING_CERT_NEW_INIT), "ESS_SIGNING_CERT_NEW_INIT"}, -{ERR_FUNC(TS_F_INT_TS_RESP_VERIFY_TOKEN), "INT_TS_RESP_VERIFY_TOKEN"}, -{ERR_FUNC(TS_F_PKCS7_TO_TS_TST_INFO), "PKCS7_to_TS_TST_INFO"}, -{ERR_FUNC(TS_F_TS_ACCURACY_SET_MICROS), "TS_ACCURACY_set_micros"}, -{ERR_FUNC(TS_F_TS_ACCURACY_SET_MILLIS), "TS_ACCURACY_set_millis"}, -{ERR_FUNC(TS_F_TS_ACCURACY_SET_SECONDS), "TS_ACCURACY_set_seconds"}, -{ERR_FUNC(TS_F_TS_CHECK_IMPRINTS), "TS_CHECK_IMPRINTS"}, -{ERR_FUNC(TS_F_TS_CHECK_NONCES), "TS_CHECK_NONCES"}, -{ERR_FUNC(TS_F_TS_CHECK_POLICY), "TS_CHECK_POLICY"}, -{ERR_FUNC(TS_F_TS_CHECK_SIGNING_CERTS), "TS_CHECK_SIGNING_CERTS"}, -{ERR_FUNC(TS_F_TS_CHECK_STATUS_INFO), "TS_CHECK_STATUS_INFO"}, -{ERR_FUNC(TS_F_TS_COMPUTE_IMPRINT), "TS_COMPUTE_IMPRINT"}, -{ERR_FUNC(TS_F_TS_CONF_SET_DEFAULT_ENGINE), "TS_CONF_set_default_engine"}, -{ERR_FUNC(TS_F_TS_GET_STATUS_TEXT), "TS_GET_STATUS_TEXT"}, -{ERR_FUNC(TS_F_TS_MSG_IMPRINT_SET_ALGO), "TS_MSG_IMPRINT_set_algo"}, -{ERR_FUNC(TS_F_TS_REQ_SET_MSG_IMPRINT), "TS_REQ_set_msg_imprint"}, -{ERR_FUNC(TS_F_TS_REQ_SET_NONCE), "TS_REQ_set_nonce"}, -{ERR_FUNC(TS_F_TS_REQ_SET_POLICY_ID), "TS_REQ_set_policy_id"}, -{ERR_FUNC(TS_F_TS_RESP_CREATE_RESPONSE), "TS_RESP_create_response"}, -{ERR_FUNC(TS_F_TS_RESP_CREATE_TST_INFO), "TS_RESP_CREATE_TST_INFO"}, -{ERR_FUNC(TS_F_TS_RESP_CTX_ADD_FAILURE_INFO), "TS_RESP_CTX_add_failure_info"}, -{ERR_FUNC(TS_F_TS_RESP_CTX_ADD_MD), "TS_RESP_CTX_add_md"}, -{ERR_FUNC(TS_F_TS_RESP_CTX_ADD_POLICY), "TS_RESP_CTX_add_policy"}, -{ERR_FUNC(TS_F_TS_RESP_CTX_NEW), "TS_RESP_CTX_new"}, -{ERR_FUNC(TS_F_TS_RESP_CTX_SET_ACCURACY), "TS_RESP_CTX_set_accuracy"}, -{ERR_FUNC(TS_F_TS_RESP_CTX_SET_CERTS), "TS_RESP_CTX_set_certs"}, -{ERR_FUNC(TS_F_TS_RESP_CTX_SET_DEF_POLICY), "TS_RESP_CTX_set_def_policy"}, -{ERR_FUNC(TS_F_TS_RESP_CTX_SET_SIGNER_CERT), "TS_RESP_CTX_set_signer_cert"}, -{ERR_FUNC(TS_F_TS_RESP_CTX_SET_STATUS_INFO), "TS_RESP_CTX_set_status_info"}, -{ERR_FUNC(TS_F_TS_RESP_GET_POLICY), "TS_RESP_GET_POLICY"}, -{ERR_FUNC(TS_F_TS_RESP_SET_GENTIME_WITH_PRECISION), "TS_RESP_SET_GENTIME_WITH_PRECISION"}, -{ERR_FUNC(TS_F_TS_RESP_SET_STATUS_INFO), "TS_RESP_set_status_info"}, -{ERR_FUNC(TS_F_TS_RESP_SET_TST_INFO), "TS_RESP_set_tst_info"}, -{ERR_FUNC(TS_F_TS_RESP_SIGN), "TS_RESP_SIGN"}, -{ERR_FUNC(TS_F_TS_RESP_VERIFY_SIGNATURE), "TS_RESP_verify_signature"}, -{ERR_FUNC(TS_F_TS_RESP_VERIFY_TOKEN), "TS_RESP_verify_token"}, -{ERR_FUNC(TS_F_TS_TST_INFO_SET_ACCURACY), "TS_TST_INFO_set_accuracy"}, -{ERR_FUNC(TS_F_TS_TST_INFO_SET_MSG_IMPRINT), "TS_TST_INFO_set_msg_imprint"}, -{ERR_FUNC(TS_F_TS_TST_INFO_SET_NONCE), "TS_TST_INFO_set_nonce"}, -{ERR_FUNC(TS_F_TS_TST_INFO_SET_POLICY_ID), "TS_TST_INFO_set_policy_id"}, -{ERR_FUNC(TS_F_TS_TST_INFO_SET_SERIAL), "TS_TST_INFO_set_serial"}, -{ERR_FUNC(TS_F_TS_TST_INFO_SET_TIME), "TS_TST_INFO_set_time"}, -{ERR_FUNC(TS_F_TS_TST_INFO_SET_TSA), "TS_TST_INFO_set_tsa"}, -{ERR_FUNC(TS_F_TS_VERIFY), "TS_VERIFY"}, -{ERR_FUNC(TS_F_TS_VERIFY_CERT), "TS_VERIFY_CERT"}, -{ERR_FUNC(TS_F_TS_VERIFY_CTX_NEW), "TS_VERIFY_CTX_new"}, -{0,NULL} - }; +static ERR_STRING_DATA TS_str_functs[] = { + {ERR_FUNC(TS_F_D2I_TS_RESP), "d2i_TS_RESP"}, + {ERR_FUNC(TS_F_DEF_SERIAL_CB), "DEF_SERIAL_CB"}, + {ERR_FUNC(TS_F_DEF_TIME_CB), "DEF_TIME_CB"}, + {ERR_FUNC(TS_F_ESS_ADD_SIGNING_CERT), "ESS_ADD_SIGNING_CERT"}, + {ERR_FUNC(TS_F_ESS_CERT_ID_NEW_INIT), "ESS_CERT_ID_NEW_INIT"}, + {ERR_FUNC(TS_F_ESS_SIGNING_CERT_NEW_INIT), "ESS_SIGNING_CERT_NEW_INIT"}, + {ERR_FUNC(TS_F_INT_TS_RESP_VERIFY_TOKEN), "INT_TS_RESP_VERIFY_TOKEN"}, + {ERR_FUNC(TS_F_PKCS7_TO_TS_TST_INFO), "PKCS7_to_TS_TST_INFO"}, + {ERR_FUNC(TS_F_TS_ACCURACY_SET_MICROS), "TS_ACCURACY_set_micros"}, + {ERR_FUNC(TS_F_TS_ACCURACY_SET_MILLIS), "TS_ACCURACY_set_millis"}, + {ERR_FUNC(TS_F_TS_ACCURACY_SET_SECONDS), "TS_ACCURACY_set_seconds"}, + {ERR_FUNC(TS_F_TS_CHECK_IMPRINTS), "TS_CHECK_IMPRINTS"}, + {ERR_FUNC(TS_F_TS_CHECK_NONCES), "TS_CHECK_NONCES"}, + {ERR_FUNC(TS_F_TS_CHECK_POLICY), "TS_CHECK_POLICY"}, + {ERR_FUNC(TS_F_TS_CHECK_SIGNING_CERTS), "TS_CHECK_SIGNING_CERTS"}, + {ERR_FUNC(TS_F_TS_CHECK_STATUS_INFO), "TS_CHECK_STATUS_INFO"}, + {ERR_FUNC(TS_F_TS_COMPUTE_IMPRINT), "TS_COMPUTE_IMPRINT"}, + {ERR_FUNC(TS_F_TS_CONF_SET_DEFAULT_ENGINE), "TS_CONF_set_default_engine"}, + {ERR_FUNC(TS_F_TS_GET_STATUS_TEXT), "TS_GET_STATUS_TEXT"}, + {ERR_FUNC(TS_F_TS_MSG_IMPRINT_SET_ALGO), "TS_MSG_IMPRINT_set_algo"}, + {ERR_FUNC(TS_F_TS_REQ_SET_MSG_IMPRINT), "TS_REQ_set_msg_imprint"}, + {ERR_FUNC(TS_F_TS_REQ_SET_NONCE), "TS_REQ_set_nonce"}, + {ERR_FUNC(TS_F_TS_REQ_SET_POLICY_ID), "TS_REQ_set_policy_id"}, + {ERR_FUNC(TS_F_TS_RESP_CREATE_RESPONSE), "TS_RESP_create_response"}, + {ERR_FUNC(TS_F_TS_RESP_CREATE_TST_INFO), "TS_RESP_CREATE_TST_INFO"}, + {ERR_FUNC(TS_F_TS_RESP_CTX_ADD_FAILURE_INFO), "TS_RESP_CTX_add_failure_info"}, + {ERR_FUNC(TS_F_TS_RESP_CTX_ADD_MD), "TS_RESP_CTX_add_md"}, + {ERR_FUNC(TS_F_TS_RESP_CTX_ADD_POLICY), "TS_RESP_CTX_add_policy"}, + {ERR_FUNC(TS_F_TS_RESP_CTX_NEW), "TS_RESP_CTX_new"}, + {ERR_FUNC(TS_F_TS_RESP_CTX_SET_ACCURACY), "TS_RESP_CTX_set_accuracy"}, + {ERR_FUNC(TS_F_TS_RESP_CTX_SET_CERTS), "TS_RESP_CTX_set_certs"}, + {ERR_FUNC(TS_F_TS_RESP_CTX_SET_DEF_POLICY), "TS_RESP_CTX_set_def_policy"}, + {ERR_FUNC(TS_F_TS_RESP_CTX_SET_SIGNER_CERT), "TS_RESP_CTX_set_signer_cert"}, + {ERR_FUNC(TS_F_TS_RESP_CTX_SET_STATUS_INFO), "TS_RESP_CTX_set_status_info"}, + {ERR_FUNC(TS_F_TS_RESP_GET_POLICY), "TS_RESP_GET_POLICY"}, + {ERR_FUNC(TS_F_TS_RESP_SET_GENTIME_WITH_PRECISION), "TS_RESP_SET_GENTIME_WITH_PRECISION"}, + {ERR_FUNC(TS_F_TS_RESP_SET_STATUS_INFO), "TS_RESP_set_status_info"}, + {ERR_FUNC(TS_F_TS_RESP_SET_TST_INFO), "TS_RESP_set_tst_info"}, + {ERR_FUNC(TS_F_TS_RESP_SIGN), "TS_RESP_SIGN"}, + {ERR_FUNC(TS_F_TS_RESP_VERIFY_SIGNATURE), "TS_RESP_verify_signature"}, + {ERR_FUNC(TS_F_TS_RESP_VERIFY_TOKEN), "TS_RESP_verify_token"}, + {ERR_FUNC(TS_F_TS_TST_INFO_SET_ACCURACY), "TS_TST_INFO_set_accuracy"}, + {ERR_FUNC(TS_F_TS_TST_INFO_SET_MSG_IMPRINT), "TS_TST_INFO_set_msg_imprint"}, + {ERR_FUNC(TS_F_TS_TST_INFO_SET_NONCE), "TS_TST_INFO_set_nonce"}, + {ERR_FUNC(TS_F_TS_TST_INFO_SET_POLICY_ID), "TS_TST_INFO_set_policy_id"}, + {ERR_FUNC(TS_F_TS_TST_INFO_SET_SERIAL), "TS_TST_INFO_set_serial"}, + {ERR_FUNC(TS_F_TS_TST_INFO_SET_TIME), "TS_TST_INFO_set_time"}, + {ERR_FUNC(TS_F_TS_TST_INFO_SET_TSA), "TS_TST_INFO_set_tsa"}, + {ERR_FUNC(TS_F_TS_VERIFY), "TS_VERIFY"}, + {ERR_FUNC(TS_F_TS_VERIFY_CERT), "TS_VERIFY_CERT"}, + {ERR_FUNC(TS_F_TS_VERIFY_CTX_NEW), "TS_VERIFY_CTX_new"}, + {0, NULL} +}; -static ERR_STRING_DATA TS_str_reasons[]= - { -{ERR_REASON(TS_R_BAD_PKCS7_TYPE) ,"bad pkcs7 type"}, -{ERR_REASON(TS_R_BAD_TYPE) ,"bad type"}, -{ERR_REASON(TS_R_CERTIFICATE_VERIFY_ERROR),"certificate verify error"}, -{ERR_REASON(TS_R_COULD_NOT_SET_ENGINE) ,"could not set engine"}, -{ERR_REASON(TS_R_COULD_NOT_SET_TIME) ,"could not set time"}, -{ERR_REASON(TS_R_D2I_TS_RESP_INT_FAILED) ,"d2i ts resp int failed"}, -{ERR_REASON(TS_R_DETACHED_CONTENT) ,"detached content"}, -{ERR_REASON(TS_R_ESS_ADD_SIGNING_CERT_ERROR),"ess add signing cert error"}, -{ERR_REASON(TS_R_ESS_SIGNING_CERTIFICATE_ERROR),"ess signing certificate error"}, -{ERR_REASON(TS_R_INVALID_NULL_POINTER) ,"invalid null pointer"}, -{ERR_REASON(TS_R_INVALID_SIGNER_CERTIFICATE_PURPOSE),"invalid signer certificate purpose"}, -{ERR_REASON(TS_R_MESSAGE_IMPRINT_MISMATCH),"message imprint mismatch"}, -{ERR_REASON(TS_R_NONCE_MISMATCH) ,"nonce mismatch"}, -{ERR_REASON(TS_R_NONCE_NOT_RETURNED) ,"nonce not returned"}, -{ERR_REASON(TS_R_NO_CONTENT) ,"no content"}, -{ERR_REASON(TS_R_NO_TIME_STAMP_TOKEN) ,"no time stamp token"}, -{ERR_REASON(TS_R_PKCS7_ADD_SIGNATURE_ERROR),"pkcs7 add signature error"}, -{ERR_REASON(TS_R_PKCS7_ADD_SIGNED_ATTR_ERROR),"pkcs7 add signed attr error"}, -{ERR_REASON(TS_R_PKCS7_TO_TS_TST_INFO_FAILED),"pkcs7 to ts tst info failed"}, -{ERR_REASON(TS_R_POLICY_MISMATCH) ,"policy mismatch"}, -{ERR_REASON(TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE),"private key does not match certificate"}, -{ERR_REASON(TS_R_RESPONSE_SETUP_ERROR) ,"response setup error"}, -{ERR_REASON(TS_R_SIGNATURE_FAILURE) ,"signature failure"}, -{ERR_REASON(TS_R_THERE_MUST_BE_ONE_SIGNER),"there must be one signer"}, -{ERR_REASON(TS_R_TIME_SYSCALL_ERROR) ,"time syscall error"}, -{ERR_REASON(TS_R_TOKEN_NOT_PRESENT) ,"token not present"}, -{ERR_REASON(TS_R_TOKEN_PRESENT) ,"token present"}, -{ERR_REASON(TS_R_TSA_NAME_MISMATCH) ,"tsa name mismatch"}, -{ERR_REASON(TS_R_TSA_UNTRUSTED) ,"tsa untrusted"}, -{ERR_REASON(TS_R_TST_INFO_SETUP_ERROR) ,"tst info setup error"}, -{ERR_REASON(TS_R_TS_DATASIGN) ,"ts datasign"}, -{ERR_REASON(TS_R_UNACCEPTABLE_POLICY) ,"unacceptable policy"}, -{ERR_REASON(TS_R_UNSUPPORTED_MD_ALGORITHM),"unsupported md algorithm"}, -{ERR_REASON(TS_R_UNSUPPORTED_VERSION) ,"unsupported version"}, -{ERR_REASON(TS_R_WRONG_CONTENT_TYPE) ,"wrong content type"}, -{0,NULL} - }; +static ERR_STRING_DATA TS_str_reasons[]= { + {ERR_REASON(TS_R_BAD_PKCS7_TYPE) , "bad pkcs7 type"}, + {ERR_REASON(TS_R_BAD_TYPE) , "bad type"}, + {ERR_REASON(TS_R_CERTIFICATE_VERIFY_ERROR), "certificate verify error"}, + {ERR_REASON(TS_R_COULD_NOT_SET_ENGINE) , "could not set engine"}, + {ERR_REASON(TS_R_COULD_NOT_SET_TIME) , "could not set time"}, + {ERR_REASON(TS_R_D2I_TS_RESP_INT_FAILED) , "d2i ts resp int failed"}, + {ERR_REASON(TS_R_DETACHED_CONTENT) , "detached content"}, + {ERR_REASON(TS_R_ESS_ADD_SIGNING_CERT_ERROR), "ess add signing cert error"}, + {ERR_REASON(TS_R_ESS_SIGNING_CERTIFICATE_ERROR), "ess signing certificate error"}, + {ERR_REASON(TS_R_INVALID_NULL_POINTER) , "invalid null pointer"}, + {ERR_REASON(TS_R_INVALID_SIGNER_CERTIFICATE_PURPOSE), "invalid signer certificate purpose"}, + {ERR_REASON(TS_R_MESSAGE_IMPRINT_MISMATCH), "message imprint mismatch"}, + {ERR_REASON(TS_R_NONCE_MISMATCH) , "nonce mismatch"}, + {ERR_REASON(TS_R_NONCE_NOT_RETURNED) , "nonce not returned"}, + {ERR_REASON(TS_R_NO_CONTENT) , "no content"}, + {ERR_REASON(TS_R_NO_TIME_STAMP_TOKEN) , "no time stamp token"}, + {ERR_REASON(TS_R_PKCS7_ADD_SIGNATURE_ERROR), "pkcs7 add signature error"}, + {ERR_REASON(TS_R_PKCS7_ADD_SIGNED_ATTR_ERROR), "pkcs7 add signed attr error"}, + {ERR_REASON(TS_R_PKCS7_TO_TS_TST_INFO_FAILED), "pkcs7 to ts tst info failed"}, + {ERR_REASON(TS_R_POLICY_MISMATCH) , "policy mismatch"}, + {ERR_REASON(TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE), "private key does not match certificate"}, + {ERR_REASON(TS_R_RESPONSE_SETUP_ERROR) , "response setup error"}, + {ERR_REASON(TS_R_SIGNATURE_FAILURE) , "signature failure"}, + {ERR_REASON(TS_R_THERE_MUST_BE_ONE_SIGNER), "there must be one signer"}, + {ERR_REASON(TS_R_TIME_SYSCALL_ERROR) , "time syscall error"}, + {ERR_REASON(TS_R_TOKEN_NOT_PRESENT) , "token not present"}, + {ERR_REASON(TS_R_TOKEN_PRESENT) , "token present"}, + {ERR_REASON(TS_R_TSA_NAME_MISMATCH) , "tsa name mismatch"}, + {ERR_REASON(TS_R_TSA_UNTRUSTED) , "tsa untrusted"}, + {ERR_REASON(TS_R_TST_INFO_SETUP_ERROR) , "tst info setup error"}, + {ERR_REASON(TS_R_TS_DATASIGN) , "ts datasign"}, + {ERR_REASON(TS_R_UNACCEPTABLE_POLICY) , "unacceptable policy"}, + {ERR_REASON(TS_R_UNSUPPORTED_MD_ALGORITHM), "unsupported md algorithm"}, + {ERR_REASON(TS_R_UNSUPPORTED_VERSION) , "unsupported version"}, + {ERR_REASON(TS_R_WRONG_CONTENT_TYPE) , "wrong content type"}, + {0, NULL} +}; #endif -void ERR_load_TS_strings(void) - { +void +ERR_load_TS_strings(void) +{ #ifndef OPENSSL_NO_ERR - - if (ERR_func_error_string(TS_str_functs[0].error) == NULL) - { - ERR_load_strings(0,TS_str_functs); - ERR_load_strings(0,TS_str_reasons); - } -#endif + if (ERR_func_error_string(TS_str_functs[0].error) == NULL) { + ERR_load_strings(0, TS_str_functs); + ERR_load_strings(0, TS_str_reasons); } +#endif +} diff --git a/lib/libcrypto/ts/ts_lib.c b/lib/libcrypto/ts/ts_lib.c index a8de801e28f..81a5f23cd53 100644 --- a/lib/libcrypto/ts/ts_lib.c +++ b/lib/libcrypto/ts/ts_lib.c @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -67,27 +67,28 @@ /* Function definitions. */ -int TS_ASN1_INTEGER_print_bio(BIO *bio, const ASN1_INTEGER *num) - { +int +TS_ASN1_INTEGER_print_bio(BIO *bio, const ASN1_INTEGER *num) +{ BIGNUM num_bn; int result = 0; char *hex; BN_init(&num_bn); ASN1_INTEGER_to_BN(num, &num_bn); - if ((hex = BN_bn2hex(&num_bn))) - { + if ((hex = BN_bn2hex(&num_bn))) { result = BIO_write(bio, "0x", 2) > 0; result = result && BIO_write(bio, hex, strlen(hex)) > 0; free(hex); - } + } BN_free(&num_bn); return result; - } +} -int TS_OBJ_print_bio(BIO *bio, const ASN1_OBJECT *obj) - { +int +TS_OBJ_print_bio(BIO *bio, const ASN1_OBJECT *obj) +{ char obj_txt[128]; int len = OBJ_obj2txt(obj_txt, sizeof(obj_txt), obj, 0); @@ -95,51 +96,53 @@ int TS_OBJ_print_bio(BIO *bio, const ASN1_OBJECT *obj) BIO_write(bio, "\n", 1); return 1; - } +} -int TS_ext_print_bio(BIO *bio, const STACK_OF(X509_EXTENSION) *extensions) - { +int +TS_ext_print_bio(BIO *bio, const STACK_OF(X509_EXTENSION) *extensions) +{ int i, critical, n; X509_EXTENSION *ex; ASN1_OBJECT *obj; BIO_printf(bio, "Extensions:\n"); n = X509v3_get_ext_count(extensions); - for (i = 0; i < n; i++) - { + for (i = 0; i < n; i++) { ex = X509v3_get_ext(extensions, i); obj = X509_EXTENSION_get_object(ex); i2a_ASN1_OBJECT(bio, obj); critical = X509_EXTENSION_get_critical(ex); BIO_printf(bio, ": %s\n", critical ? "critical" : ""); - if (!X509V3_EXT_print(bio, ex, 0, 4)) - { + if (!X509V3_EXT_print(bio, ex, 0, 4)) { BIO_printf(bio, "%4s", ""); M_ASN1_OCTET_STRING_print(bio, ex->value); - } - BIO_write(bio, "\n", 1); } + BIO_write(bio, "\n", 1); + } return 1; - } +} -int TS_X509_ALGOR_print_bio(BIO *bio, const X509_ALGOR *alg) - { +int +TS_X509_ALGOR_print_bio(BIO *bio, const X509_ALGOR *alg) +{ int i = OBJ_obj2nid(alg->algorithm); + return BIO_printf(bio, "Hash Algorithm: %s\n", - (i == NID_undef) ? "UNKNOWN" : OBJ_nid2ln(i)); - } + (i == NID_undef) ? "UNKNOWN" : OBJ_nid2ln(i)); +} -int TS_MSG_IMPRINT_print_bio(BIO *bio, TS_MSG_IMPRINT *a) - { +int +TS_MSG_IMPRINT_print_bio(BIO *bio, TS_MSG_IMPRINT *a) +{ const ASN1_OCTET_STRING *msg; TS_X509_ALGOR_print_bio(bio, TS_MSG_IMPRINT_get_algo(a)); BIO_printf(bio, "Message data:\n"); msg = TS_MSG_IMPRINT_get_msg(a); - BIO_dump_indent(bio, (const char *)M_ASN1_STRING_data(msg), - M_ASN1_STRING_length(msg), 4); + BIO_dump_indent(bio, (const char *)M_ASN1_STRING_data(msg), + M_ASN1_STRING_length(msg), 4); return 1; - } +} diff --git a/lib/libcrypto/ts/ts_req_print.c b/lib/libcrypto/ts/ts_req_print.c index eba12c38240..53bf0c8eb8d 100644 --- a/lib/libcrypto/ts/ts_req_print.c +++ b/lib/libcrypto/ts/ts_req_print.c @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -65,13 +65,15 @@ /* Function definitions. */ -int TS_REQ_print_bio(BIO *bio, TS_REQ *a) - { +int +TS_REQ_print_bio(BIO *bio, TS_REQ *a) +{ int v; ASN1_OBJECT *policy_id; const ASN1_INTEGER *nonce; - if (a == NULL) return 0; + if (a == NULL) + return 0; v = TS_REQ_get_version(a); BIO_printf(bio, "Version: %d\n", v); @@ -82,7 +84,7 @@ int TS_REQ_print_bio(BIO *bio, TS_REQ *a) policy_id = TS_REQ_get_policy_id(a); if (policy_id == NULL) BIO_printf(bio, "unspecified\n"); - else + else TS_OBJ_print_bio(bio, policy_id); BIO_printf(bio, "Nonce: "); @@ -93,10 +95,10 @@ int TS_REQ_print_bio(BIO *bio, TS_REQ *a) TS_ASN1_INTEGER_print_bio(bio, nonce); BIO_write(bio, "\n", 1); - BIO_printf(bio, "Certificate required: %s\n", - TS_REQ_get_cert_req(a) ? "yes" : "no"); + BIO_printf(bio, "Certificate required: %s\n", + TS_REQ_get_cert_req(a) ? "yes" : "no"); TS_ext_print_bio(bio, TS_REQ_get_exts(a)); return 1; - } +} diff --git a/lib/libcrypto/ts/ts_req_utils.c b/lib/libcrypto/ts/ts_req_utils.c index 43280c15874..7518d7ab785 100644 --- a/lib/libcrypto/ts/ts_req_utils.c +++ b/lib/libcrypto/ts/ts_req_utils.c @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -62,173 +62,193 @@ #include #include -int TS_REQ_set_version(TS_REQ *a, long version) - { +int +TS_REQ_set_version(TS_REQ *a, long version) +{ return ASN1_INTEGER_set(a->version, version); - } +} -long TS_REQ_get_version(const TS_REQ *a) - { +long +TS_REQ_get_version(const TS_REQ *a) +{ return ASN1_INTEGER_get(a->version); - } +} -int TS_REQ_set_msg_imprint(TS_REQ *a, TS_MSG_IMPRINT *msg_imprint) - { +int +TS_REQ_set_msg_imprint(TS_REQ *a, TS_MSG_IMPRINT *msg_imprint) +{ TS_MSG_IMPRINT *new_msg_imprint; if (a->msg_imprint == msg_imprint) return 1; new_msg_imprint = TS_MSG_IMPRINT_dup(msg_imprint); - if (new_msg_imprint == NULL) - { + if (new_msg_imprint == NULL) { TSerr(TS_F_TS_REQ_SET_MSG_IMPRINT, ERR_R_MALLOC_FAILURE); return 0; - } + } TS_MSG_IMPRINT_free(a->msg_imprint); a->msg_imprint = new_msg_imprint; return 1; - } +} -TS_MSG_IMPRINT *TS_REQ_get_msg_imprint(TS_REQ *a) - { +TS_MSG_IMPRINT * +TS_REQ_get_msg_imprint(TS_REQ *a) +{ return a->msg_imprint; - } +} -int TS_MSG_IMPRINT_set_algo(TS_MSG_IMPRINT *a, X509_ALGOR *alg) - { +int +TS_MSG_IMPRINT_set_algo(TS_MSG_IMPRINT *a, X509_ALGOR *alg) +{ X509_ALGOR *new_alg; if (a->hash_algo == alg) return 1; new_alg = X509_ALGOR_dup(alg); - if (new_alg == NULL) - { + if (new_alg == NULL) { TSerr(TS_F_TS_MSG_IMPRINT_SET_ALGO, ERR_R_MALLOC_FAILURE); return 0; - } + } X509_ALGOR_free(a->hash_algo); a->hash_algo = new_alg; return 1; - } +} -X509_ALGOR *TS_MSG_IMPRINT_get_algo(TS_MSG_IMPRINT *a) - { +X509_ALGOR * +TS_MSG_IMPRINT_get_algo(TS_MSG_IMPRINT *a) +{ return a->hash_algo; - } +} -int TS_MSG_IMPRINT_set_msg(TS_MSG_IMPRINT *a, unsigned char *d, int len) - { +int +TS_MSG_IMPRINT_set_msg(TS_MSG_IMPRINT *a, unsigned char *d, int len) +{ return ASN1_OCTET_STRING_set(a->hashed_msg, d, len); - } +} -ASN1_OCTET_STRING *TS_MSG_IMPRINT_get_msg(TS_MSG_IMPRINT *a) - { +ASN1_OCTET_STRING * +TS_MSG_IMPRINT_get_msg(TS_MSG_IMPRINT *a) +{ return a->hashed_msg; - } +} -int TS_REQ_set_policy_id(TS_REQ *a, ASN1_OBJECT *policy) - { +int +TS_REQ_set_policy_id(TS_REQ *a, ASN1_OBJECT *policy) +{ ASN1_OBJECT *new_policy; if (a->policy_id == policy) return 1; new_policy = OBJ_dup(policy); - if (new_policy == NULL) - { + if (new_policy == NULL) { TSerr(TS_F_TS_REQ_SET_POLICY_ID, ERR_R_MALLOC_FAILURE); return 0; - } + } ASN1_OBJECT_free(a->policy_id); a->policy_id = new_policy; return 1; - } +} -ASN1_OBJECT *TS_REQ_get_policy_id(TS_REQ *a) - { +ASN1_OBJECT * +TS_REQ_get_policy_id(TS_REQ *a) +{ return a->policy_id; - } +} -int TS_REQ_set_nonce(TS_REQ *a, const ASN1_INTEGER *nonce) - { +int +TS_REQ_set_nonce(TS_REQ *a, const ASN1_INTEGER *nonce) +{ ASN1_INTEGER *new_nonce; if (a->nonce == nonce) return 1; new_nonce = ASN1_INTEGER_dup(nonce); - if (new_nonce == NULL) - { + if (new_nonce == NULL) { TSerr(TS_F_TS_REQ_SET_NONCE, ERR_R_MALLOC_FAILURE); return 0; - } + } ASN1_INTEGER_free(a->nonce); a->nonce = new_nonce; return 1; - } +} -const ASN1_INTEGER *TS_REQ_get_nonce(const TS_REQ *a) - { +const ASN1_INTEGER * +TS_REQ_get_nonce(const TS_REQ *a) +{ return a->nonce; - } +} -int TS_REQ_set_cert_req(TS_REQ *a, int cert_req) - { +int +TS_REQ_set_cert_req(TS_REQ *a, int cert_req) +{ a->cert_req = cert_req ? 0xFF : 0x00; return 1; - } +} -int TS_REQ_get_cert_req(const TS_REQ *a) - { +int +TS_REQ_get_cert_req(const TS_REQ *a) +{ return a->cert_req ? 1 : 0; - } +} STACK_OF(X509_EXTENSION) *TS_REQ_get_exts(TS_REQ *a) - { +{ return a->extensions; - } +} -void TS_REQ_ext_free(TS_REQ *a) - { - if (!a) return; +void +TS_REQ_ext_free(TS_REQ *a) +{ + if (!a) + return; sk_X509_EXTENSION_pop_free(a->extensions, X509_EXTENSION_free); a->extensions = NULL; - } +} -int TS_REQ_get_ext_count(TS_REQ *a) - { +int +TS_REQ_get_ext_count(TS_REQ *a) +{ return X509v3_get_ext_count(a->extensions); - } +} -int TS_REQ_get_ext_by_NID(TS_REQ *a, int nid, int lastpos) - { +int +TS_REQ_get_ext_by_NID(TS_REQ *a, int nid, int lastpos) +{ return X509v3_get_ext_by_NID(a->extensions, nid, lastpos); - } +} -int TS_REQ_get_ext_by_OBJ(TS_REQ *a, ASN1_OBJECT *obj, int lastpos) - { +int +TS_REQ_get_ext_by_OBJ(TS_REQ *a, ASN1_OBJECT *obj, int lastpos) +{ return X509v3_get_ext_by_OBJ(a->extensions, obj, lastpos); - } +} -int TS_REQ_get_ext_by_critical(TS_REQ *a, int crit, int lastpos) - { +int +TS_REQ_get_ext_by_critical(TS_REQ *a, int crit, int lastpos) +{ return X509v3_get_ext_by_critical(a->extensions, crit, lastpos); - } - -X509_EXTENSION *TS_REQ_get_ext(TS_REQ *a, int loc) - { - return X509v3_get_ext(a->extensions,loc); - } - -X509_EXTENSION *TS_REQ_delete_ext(TS_REQ *a, int loc) - { - return X509v3_delete_ext(a->extensions,loc); - } - -int TS_REQ_add_ext(TS_REQ *a, X509_EXTENSION *ex, int loc) - { - return X509v3_add_ext(&a->extensions,ex,loc) != NULL; - } - -void *TS_REQ_get_ext_d2i(TS_REQ *a, int nid, int *crit, int *idx) - { +} + +X509_EXTENSION * +TS_REQ_get_ext(TS_REQ *a, int loc) +{ + return X509v3_get_ext(a->extensions, loc); +} + +X509_EXTENSION * +TS_REQ_delete_ext(TS_REQ *a, int loc) +{ + return X509v3_delete_ext(a->extensions, loc); +} + +int +TS_REQ_add_ext(TS_REQ *a, X509_EXTENSION *ex, int loc) +{ + return X509v3_add_ext(&a->extensions, ex, loc) != NULL; +} + +void * +TS_REQ_get_ext_d2i(TS_REQ *a, int nid, int *crit, int *idx) +{ return X509V3_get_d2i(a->extensions, nid, crit, idx); - } +} diff --git a/lib/libcrypto/ts/ts_rsp_print.c b/lib/libcrypto/ts/ts_rsp_print.c index 21062517ba9..248674f4e56 100644 --- a/lib/libcrypto/ts/ts_rsp_print.c +++ b/lib/libcrypto/ts/ts_rsp_print.c @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -63,22 +63,22 @@ #include #include "ts.h" -struct status_map_st - { +struct status_map_st { int bit; const char *text; - }; +}; /* Local function declarations. */ static int TS_status_map_print(BIO *bio, struct status_map_st *a, - ASN1_BIT_STRING *v); + ASN1_BIT_STRING *v); static int TS_ACCURACY_print_bio(BIO *bio, const TS_ACCURACY *accuracy); /* Function definitions. */ -int TS_RESP_print_bio(BIO *bio, TS_RESP *a) - { +int +TS_RESP_print_bio(BIO *bio, TS_RESP *a) +{ TS_TST_INFO *tst_info; BIO_printf(bio, "Status info:\n"); @@ -90,98 +90,111 @@ int TS_RESP_print_bio(BIO *bio, TS_RESP *a) TS_TST_INFO_print_bio(bio, TS_RESP_get_tst_info(a)); else BIO_printf(bio, "Not included.\n"); - + return 1; - } +} -int TS_STATUS_INFO_print_bio(BIO *bio, TS_STATUS_INFO *a) - { - static const char *status_map[] = - { +int +TS_STATUS_INFO_print_bio(BIO *bio, TS_STATUS_INFO *a) +{ + static const char *status_map[] = { "Granted.", "Granted with modifications.", "Rejected.", "Waiting.", "Revocation warning.", "Revoked." - }; - static struct status_map_st failure_map[] = + }; + static struct status_map_st failure_map[] = { + { + TS_INFO_BAD_ALG, + "unrecognized or unsupported algorithm identifier" + }, + { + TS_INFO_BAD_REQUEST, + "transaction not permitted or supported" + }, { - { TS_INFO_BAD_ALG, - "unrecognized or unsupported algorithm identifier" }, - { TS_INFO_BAD_REQUEST, - "transaction not permitted or supported" }, - { TS_INFO_BAD_DATA_FORMAT, - "the data submitted has the wrong format" }, - { TS_INFO_TIME_NOT_AVAILABLE, - "the TSA's time source is not available" }, - { TS_INFO_UNACCEPTED_POLICY, - "the requested TSA policy is not supported by the TSA" }, - { TS_INFO_UNACCEPTED_EXTENSION, - "the requested extension is not supported by the TSA" }, - { TS_INFO_ADD_INFO_NOT_AVAILABLE, - "the additional information requested could not be understood " - "or is not available" }, - { TS_INFO_SYSTEM_FAILURE, - "the request cannot be handled due to system failure" }, + TS_INFO_BAD_DATA_FORMAT, + "the data submitted has the wrong format" + }, + { + TS_INFO_TIME_NOT_AVAILABLE, + "the TSA's time source is not available" + }, + { + TS_INFO_UNACCEPTED_POLICY, + "the requested TSA policy is not supported by the TSA" + }, + { + TS_INFO_UNACCEPTED_EXTENSION, + "the requested extension is not supported by the TSA" + }, + { + TS_INFO_ADD_INFO_NOT_AVAILABLE, + "the additional information requested could not be understood " + "or is not available" + }, + { + TS_INFO_SYSTEM_FAILURE, + "the request cannot be handled due to system failure" + }, { -1, NULL } - }; + }; long status; int i, lines = 0; /* Printing status code. */ BIO_printf(bio, "Status: "); status = ASN1_INTEGER_get(a->status); - if (0 <= status && status < (long)(sizeof(status_map)/sizeof(status_map[0]))) + if (0 <= status && + status < (long)(sizeof(status_map) / sizeof(status_map[0]))) BIO_printf(bio, "%s\n", status_map[status]); else BIO_printf(bio, "out of bounds\n"); - + /* Printing status description. */ BIO_printf(bio, "Status description: "); - for (i = 0; i < sk_ASN1_UTF8STRING_num(a->text); ++i) - { + for (i = 0; i < sk_ASN1_UTF8STRING_num(a->text); ++i) { if (i > 0) BIO_puts(bio, "\t"); ASN1_STRING_print_ex(bio, sk_ASN1_UTF8STRING_value(a->text, i), - 0); + 0); BIO_puts(bio, "\n"); - } + } if (i == 0) BIO_printf(bio, "unspecified\n"); /* Printing failure information. */ BIO_printf(bio, "Failure info: "); if (a->failure_info != NULL) - lines = TS_status_map_print(bio, failure_map, - a->failure_info); + lines = TS_status_map_print(bio, failure_map, a->failure_info); if (lines == 0) BIO_printf(bio, "unspecified"); BIO_printf(bio, "\n"); return 1; - } +} -static int TS_status_map_print(BIO *bio, struct status_map_st *a, - ASN1_BIT_STRING *v) - { +static int +TS_status_map_print(BIO *bio, struct status_map_st *a, ASN1_BIT_STRING *v) +{ int lines = 0; - for (; a->bit >= 0; ++a) - { - if (ASN1_BIT_STRING_get_bit(v, a->bit)) - { + for (; a->bit >= 0; ++a) { + if (ASN1_BIT_STRING_get_bit(v, a->bit)) { if (++lines > 1) BIO_printf(bio, ", "); BIO_printf(bio, "%s", a->text); - } } + } return lines; - } +} -int TS_TST_INFO_print_bio(BIO *bio, TS_TST_INFO *a) - { +int +TS_TST_INFO_print_bio(BIO *bio, TS_TST_INFO *a) +{ int v; ASN1_OBJECT *policy_id; const ASN1_INTEGER *serial; @@ -190,7 +203,8 @@ int TS_TST_INFO_print_bio(BIO *bio, TS_TST_INFO *a) const ASN1_INTEGER *nonce; GENERAL_NAME *tsa_name; - if (a == NULL) return 0; + if (a == NULL) + return 0; /* Print version. */ v = TS_TST_INFO_get_version(a); @@ -229,8 +243,8 @@ int TS_TST_INFO_print_bio(BIO *bio, TS_TST_INFO *a) BIO_write(bio, "\n", 1); /* Print ordering. */ - BIO_printf(bio, "Ordering: %s\n", - TS_TST_INFO_get_ordering(a) ? "yes" : "no"); + BIO_printf(bio, "Ordering: %s\n", + TS_TST_INFO_get_ordering(a) ? "yes" : "no"); /* Print nonce. */ BIO_printf(bio, "Nonce: "); @@ -246,23 +260,23 @@ int TS_TST_INFO_print_bio(BIO *bio, TS_TST_INFO *a) tsa_name = TS_TST_INFO_get_tsa(a); if (tsa_name == NULL) BIO_printf(bio, "unspecified"); - else - { + else { STACK_OF(CONF_VALUE) *nval; if ((nval = i2v_GENERAL_NAME(NULL, tsa_name, NULL))) X509V3_EXT_val_prn(bio, nval, 0, 0); sk_CONF_VALUE_pop_free(nval, X509V3_conf_free); - } + } BIO_write(bio, "\n", 1); /* Print extensions. */ TS_ext_print_bio(bio, TS_TST_INFO_get_exts(a)); return 1; - } +} -static int TS_ACCURACY_print_bio(BIO *bio, const TS_ACCURACY *accuracy) - { +static int +TS_ACCURACY_print_bio(BIO *bio, const TS_ACCURACY *accuracy) +{ const ASN1_INTEGER *seconds = TS_ACCURACY_get_seconds(accuracy); const ASN1_INTEGER *millis = TS_ACCURACY_get_millis(accuracy); const ASN1_INTEGER *micros = TS_ACCURACY_get_micros(accuracy); @@ -284,4 +298,4 @@ static int TS_ACCURACY_print_bio(BIO *bio, const TS_ACCURACY *accuracy) BIO_printf(bio, " micros"); return 1; - } +} diff --git a/lib/libcrypto/ts/ts_rsp_sign.c b/lib/libcrypto/ts/ts_rsp_sign.c index 17f81b4a35d..71530d7f242 100644 --- a/lib/libcrypto/ts/ts_rsp_sign.c +++ b/lib/libcrypto/ts/ts_rsp_sign.c @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -76,102 +76,107 @@ static void TS_RESP_CTX_init(TS_RESP_CTX *ctx); static void TS_RESP_CTX_cleanup(TS_RESP_CTX *ctx); static int TS_RESP_check_request(TS_RESP_CTX *ctx); static ASN1_OBJECT *TS_RESP_get_policy(TS_RESP_CTX *ctx); -static TS_TST_INFO *TS_RESP_create_tst_info(TS_RESP_CTX *ctx, - ASN1_OBJECT *policy); +static TS_TST_INFO *TS_RESP_create_tst_info(TS_RESP_CTX *ctx, + ASN1_OBJECT *policy); static int TS_RESP_process_extensions(TS_RESP_CTX *ctx); static int TS_RESP_sign(TS_RESP_CTX *ctx); -static ESS_SIGNING_CERT *ESS_SIGNING_CERT_new_init(X509 *signcert, - STACK_OF(X509) *certs); +static ESS_SIGNING_CERT *ESS_SIGNING_CERT_new_init(X509 *signcert, + STACK_OF(X509) *certs); static ESS_CERT_ID *ESS_CERT_ID_new_init(X509 *cert, int issuer_needed); static int TS_TST_INFO_content_new(PKCS7 *p7); static int ESS_add_signing_cert(PKCS7_SIGNER_INFO *si, ESS_SIGNING_CERT *sc); static ASN1_GENERALIZEDTIME *TS_RESP_set_genTime_with_precision( - ASN1_GENERALIZEDTIME *, long, long, unsigned); + ASN1_GENERALIZEDTIME *, long, long, unsigned); /* Default callbacks for response generation. */ -static ASN1_INTEGER *def_serial_cb(struct TS_resp_ctx *ctx, void *data) - { +static ASN1_INTEGER * +def_serial_cb(struct TS_resp_ctx *ctx, void *data) +{ ASN1_INTEGER *serial = ASN1_INTEGER_new(); - if (!serial) goto err; - if (!ASN1_INTEGER_set(serial, 1)) goto err; + + if (!serial) + goto err; + if (!ASN1_INTEGER_set(serial, 1)) + goto err; return serial; - err: + +err: TSerr(TS_F_DEF_SERIAL_CB, ERR_R_MALLOC_FAILURE); TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, - "Error during serial number generation."); + "Error during serial number generation."); return NULL; - } +} #if defined(OPENSSL_SYS_UNIX) /* Use the gettimeofday function call. */ -static int def_time_cb(struct TS_resp_ctx *ctx, void *data, - long *sec, long *usec) - { +static int +def_time_cb(struct TS_resp_ctx *ctx, void *data, long *sec, long *usec) +{ struct timeval tv; - if (gettimeofday(&tv, NULL) != 0) - { + + if (gettimeofday(&tv, NULL) != 0) { TSerr(TS_F_DEF_TIME_CB, TS_R_TIME_SYSCALL_ERROR); TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, - "Time is not available."); + "Time is not available."); TS_RESP_CTX_add_failure_info(ctx, TS_INFO_TIME_NOT_AVAILABLE); return 0; - } + } /* Return time to caller. */ *sec = tv.tv_sec; *usec = tv.tv_usec; return 1; - } +} #else /* Use the time function call that provides only seconds precision. */ -static int def_time_cb(struct TS_resp_ctx *ctx, void *data, - long *sec, long *usec) - { +static int +def_time_cb(struct TS_resp_ctx *ctx, void *data, long *sec, long *usec) +{ time_t t; - if (time(&t) == (time_t) -1) - { + + if (time(&t) == (time_t) - 1) { TSerr(TS_F_DEF_TIME_CB, TS_R_TIME_SYSCALL_ERROR); TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, - "Time is not available."); + "Time is not available."); TS_RESP_CTX_add_failure_info(ctx, TS_INFO_TIME_NOT_AVAILABLE); return 0; - } + } /* Return time to caller, only second precision. */ *sec = (long) t; *usec = 0; return 1; - } +} #endif -static int def_extension_cb(struct TS_resp_ctx *ctx, X509_EXTENSION *ext, - void *data) - { +static int +def_extension_cb(struct TS_resp_ctx *ctx, X509_EXTENSION *ext, void *data) +{ /* No extensions are processed here. */ TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, - "Unsupported extension."); + "Unsupported extension."); TS_RESP_CTX_add_failure_info(ctx, TS_INFO_UNACCEPTED_EXTENSION); return 0; - } +} /* TS_RESP_CTX management functions. */ -TS_RESP_CTX *TS_RESP_CTX_new() - { +TS_RESP_CTX * +TS_RESP_CTX_new() +{ TS_RESP_CTX *ctx; - if (!(ctx = (TS_RESP_CTX *) malloc(sizeof(TS_RESP_CTX)))) - { + if (!(ctx = (TS_RESP_CTX *) malloc(sizeof(TS_RESP_CTX)))) { TSerr(TS_F_TS_RESP_CTX_NEW, ERR_R_MALLOC_FAILURE); return NULL; - } + } memset(ctx, 0, sizeof(TS_RESP_CTX)); /* Setting default callbacks. */ @@ -180,11 +185,13 @@ TS_RESP_CTX *TS_RESP_CTX_new() ctx->extension_cb = def_extension_cb; return ctx; - } +} -void TS_RESP_CTX_free(TS_RESP_CTX *ctx) - { - if (!ctx) return; +void +TS_RESP_CTX_free(TS_RESP_CTX *ctx) +{ + if (!ctx) + return; X509_free(ctx->signer_cert); EVP_PKEY_free(ctx->signer_key); @@ -196,95 +203,108 @@ void TS_RESP_CTX_free(TS_RESP_CTX *ctx) ASN1_INTEGER_free(ctx->millis); ASN1_INTEGER_free(ctx->micros); free(ctx); - } - -int TS_RESP_CTX_set_signer_cert(TS_RESP_CTX *ctx, X509 *signer) - { - if (X509_check_purpose(signer, X509_PURPOSE_TIMESTAMP_SIGN, 0) != 1) - { - TSerr(TS_F_TS_RESP_CTX_SET_SIGNER_CERT, - TS_R_INVALID_SIGNER_CERTIFICATE_PURPOSE); +} + +int +TS_RESP_CTX_set_signer_cert(TS_RESP_CTX *ctx, X509 *signer) +{ + if (X509_check_purpose(signer, X509_PURPOSE_TIMESTAMP_SIGN, 0) != 1) { + TSerr(TS_F_TS_RESP_CTX_SET_SIGNER_CERT, + TS_R_INVALID_SIGNER_CERTIFICATE_PURPOSE); return 0; - } - if (ctx->signer_cert) X509_free(ctx->signer_cert); + } + if (ctx->signer_cert) + X509_free(ctx->signer_cert); ctx->signer_cert = signer; CRYPTO_add(&ctx->signer_cert->references, +1, CRYPTO_LOCK_X509); return 1; - } +} -int TS_RESP_CTX_set_signer_key(TS_RESP_CTX *ctx, EVP_PKEY *key) - { - if (ctx->signer_key) EVP_PKEY_free(ctx->signer_key); +int +TS_RESP_CTX_set_signer_key(TS_RESP_CTX *ctx, EVP_PKEY *key) +{ + if (ctx->signer_key) + EVP_PKEY_free(ctx->signer_key); ctx->signer_key = key; CRYPTO_add(&ctx->signer_key->references, +1, CRYPTO_LOCK_EVP_PKEY); return 1; - } - -int TS_RESP_CTX_set_def_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *def_policy) - { - if (ctx->default_policy) ASN1_OBJECT_free(ctx->default_policy); - if (!(ctx->default_policy = OBJ_dup(def_policy))) goto err; +} + +int +TS_RESP_CTX_set_def_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *def_policy) +{ + if (ctx->default_policy) + ASN1_OBJECT_free(ctx->default_policy); + if (!(ctx->default_policy = OBJ_dup(def_policy))) + goto err; return 1; - err: + +err: TSerr(TS_F_TS_RESP_CTX_SET_DEF_POLICY, ERR_R_MALLOC_FAILURE); return 0; - } +} -int TS_RESP_CTX_set_certs(TS_RESP_CTX *ctx, STACK_OF(X509) *certs) - { +int +TS_RESP_CTX_set_certs(TS_RESP_CTX *ctx, STACK_OF(X509) *certs) +{ int i; - if (ctx->certs) - { + if (ctx->certs) { sk_X509_pop_free(ctx->certs, X509_free); ctx->certs = NULL; - } - if (!certs) return 1; - if (!(ctx->certs = sk_X509_dup(certs))) - { + } + if (!certs) + return 1; + if (!(ctx->certs = sk_X509_dup(certs))) { TSerr(TS_F_TS_RESP_CTX_SET_CERTS, ERR_R_MALLOC_FAILURE); return 0; - } - for (i = 0; i < sk_X509_num(ctx->certs); ++i) - { + } + for (i = 0; i < sk_X509_num(ctx->certs); ++i) { X509 *cert = sk_X509_value(ctx->certs, i); CRYPTO_add(&cert->references, +1, CRYPTO_LOCK_X509); - } + } return 1; - } +} -int TS_RESP_CTX_add_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *policy) - { +int +TS_RESP_CTX_add_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *policy) +{ ASN1_OBJECT *copy = NULL; /* Create new policy stack if necessary. */ - if (!ctx->policies && !(ctx->policies = sk_ASN1_OBJECT_new_null())) + if (!ctx->policies && !(ctx->policies = sk_ASN1_OBJECT_new_null())) + goto err; + if (!(copy = OBJ_dup(policy))) + goto err; + if (!sk_ASN1_OBJECT_push(ctx->policies, copy)) goto err; - if (!(copy = OBJ_dup(policy))) goto err; - if (!sk_ASN1_OBJECT_push(ctx->policies, copy)) goto err; return 1; - err: + +err: TSerr(TS_F_TS_RESP_CTX_ADD_POLICY, ERR_R_MALLOC_FAILURE); ASN1_OBJECT_free(copy); return 0; - } +} -int TS_RESP_CTX_add_md(TS_RESP_CTX *ctx, const EVP_MD *md) - { +int +TS_RESP_CTX_add_md(TS_RESP_CTX *ctx, const EVP_MD *md) +{ /* Create new md stack if necessary. */ - if (!ctx->mds && !(ctx->mds = sk_EVP_MD_new_null())) + if (!ctx->mds && !(ctx->mds = sk_EVP_MD_new_null())) goto err; /* Add the shared md, no copy needed. */ - if (!sk_EVP_MD_push(ctx->mds, (EVP_MD *)md)) goto err; + if (!sk_EVP_MD_push(ctx->mds, (EVP_MD *)md)) + goto err; return 1; - err: + +err: TSerr(TS_F_TS_RESP_CTX_ADD_MD, ERR_R_MALLOC_FAILURE); return 0; - } +} #define TS_RESP_CTX_accuracy_free(ctx) \ ASN1_INTEGER_free(ctx->seconds); \ @@ -294,129 +314,142 @@ int TS_RESP_CTX_add_md(TS_RESP_CTX *ctx, const EVP_MD *md) ASN1_INTEGER_free(ctx->micros); \ ctx->micros = NULL; -int TS_RESP_CTX_set_accuracy(TS_RESP_CTX *ctx, - int secs, int millis, int micros) - { - +int +TS_RESP_CTX_set_accuracy(TS_RESP_CTX *ctx, int secs, int millis, int micros) +{ TS_RESP_CTX_accuracy_free(ctx); - if (secs && (!(ctx->seconds = ASN1_INTEGER_new()) - || !ASN1_INTEGER_set(ctx->seconds, secs))) + if (secs && (!(ctx->seconds = ASN1_INTEGER_new()) || + !ASN1_INTEGER_set(ctx->seconds, secs))) goto err; - if (millis && (!(ctx->millis = ASN1_INTEGER_new()) - || !ASN1_INTEGER_set(ctx->millis, millis))) + if (millis && (!(ctx->millis = ASN1_INTEGER_new()) || + !ASN1_INTEGER_set(ctx->millis, millis))) goto err; - if (micros && (!(ctx->micros = ASN1_INTEGER_new()) - || !ASN1_INTEGER_set(ctx->micros, micros))) + if (micros && (!(ctx->micros = ASN1_INTEGER_new()) || + !ASN1_INTEGER_set(ctx->micros, micros))) goto err; return 1; - err: + +err: TS_RESP_CTX_accuracy_free(ctx); TSerr(TS_F_TS_RESP_CTX_SET_ACCURACY, ERR_R_MALLOC_FAILURE); return 0; - } +} -void TS_RESP_CTX_add_flags(TS_RESP_CTX *ctx, int flags) - { +void +TS_RESP_CTX_add_flags(TS_RESP_CTX *ctx, int flags) +{ ctx->flags |= flags; - } +} -void TS_RESP_CTX_set_serial_cb(TS_RESP_CTX *ctx, TS_serial_cb cb, void *data) - { +void +TS_RESP_CTX_set_serial_cb(TS_RESP_CTX *ctx, TS_serial_cb cb, void *data) +{ ctx->serial_cb = cb; ctx->serial_cb_data = data; - } +} -void TS_RESP_CTX_set_time_cb(TS_RESP_CTX *ctx, TS_time_cb cb, void *data) - { +void +TS_RESP_CTX_set_time_cb(TS_RESP_CTX *ctx, TS_time_cb cb, void *data) +{ ctx->time_cb = cb; ctx->time_cb_data = data; - } +} -void TS_RESP_CTX_set_extension_cb(TS_RESP_CTX *ctx, - TS_extension_cb cb, void *data) - { +void +TS_RESP_CTX_set_extension_cb(TS_RESP_CTX *ctx, TS_extension_cb cb, void *data) +{ ctx->extension_cb = cb; ctx->extension_cb_data = data; - } +} -int TS_RESP_CTX_set_status_info(TS_RESP_CTX *ctx, - int status, const char *text) - { +int +TS_RESP_CTX_set_status_info(TS_RESP_CTX *ctx, int status, const char *text) +{ TS_STATUS_INFO *si = NULL; ASN1_UTF8STRING *utf8_text = NULL; int ret = 0; - if (!(si = TS_STATUS_INFO_new())) goto err; - if (!ASN1_INTEGER_set(si->status, status)) goto err; - if (text) - { - if (!(utf8_text = ASN1_UTF8STRING_new()) - || !ASN1_STRING_set(utf8_text, text, strlen(text))) + if (!(si = TS_STATUS_INFO_new())) + goto err; + if (!ASN1_INTEGER_set(si->status, status)) + goto err; + if (text) { + if (!(utf8_text = ASN1_UTF8STRING_new()) || + !ASN1_STRING_set(utf8_text, text, strlen(text))) goto err; if (!si->text && !(si->text = sk_ASN1_UTF8STRING_new_null())) goto err; - if (!sk_ASN1_UTF8STRING_push(si->text, utf8_text)) goto err; + if (!sk_ASN1_UTF8STRING_push(si->text, utf8_text)) + goto err; utf8_text = NULL; /* Ownership is lost. */ - } - if (!TS_RESP_set_status_info(ctx->response, si)) goto err; + } + if (!TS_RESP_set_status_info(ctx->response, si)) + goto err; ret = 1; - err: + +err: if (!ret) TSerr(TS_F_TS_RESP_CTX_SET_STATUS_INFO, ERR_R_MALLOC_FAILURE); TS_STATUS_INFO_free(si); ASN1_UTF8STRING_free(utf8_text); return ret; - } +} -int TS_RESP_CTX_set_status_info_cond(TS_RESP_CTX *ctx, - int status, const char *text) - { +int +TS_RESP_CTX_set_status_info_cond(TS_RESP_CTX *ctx, int status, const char *text) +{ int ret = 1; TS_STATUS_INFO *si = TS_RESP_get_status_info(ctx->response); - if (ASN1_INTEGER_get(si->status) == TS_STATUS_GRANTED) - { + if (ASN1_INTEGER_get(si->status) == TS_STATUS_GRANTED) { /* Status has not been set, set it now. */ ret = TS_RESP_CTX_set_status_info(ctx, status, text); - } - return ret; } + return ret; +} -int TS_RESP_CTX_add_failure_info(TS_RESP_CTX *ctx, int failure) - { +int +TS_RESP_CTX_add_failure_info(TS_RESP_CTX *ctx, int failure) +{ TS_STATUS_INFO *si = TS_RESP_get_status_info(ctx->response); + if (!si->failure_info && !(si->failure_info = ASN1_BIT_STRING_new())) goto err; if (!ASN1_BIT_STRING_set_bit(si->failure_info, failure, 1)) goto err; return 1; - err: + +err: TSerr(TS_F_TS_RESP_CTX_ADD_FAILURE_INFO, ERR_R_MALLOC_FAILURE); return 0; - } +} -TS_REQ *TS_RESP_CTX_get_request(TS_RESP_CTX *ctx) - { +TS_REQ * +TS_RESP_CTX_get_request(TS_RESP_CTX *ctx) +{ return ctx->request; - } +} -TS_TST_INFO *TS_RESP_CTX_get_tst_info(TS_RESP_CTX *ctx) - { +TS_TST_INFO * +TS_RESP_CTX_get_tst_info(TS_RESP_CTX *ctx) +{ return ctx->tst_info; - } +} -int TS_RESP_CTX_set_clock_precision_digits(TS_RESP_CTX *ctx, unsigned precision) - { - if (precision > TS_MAX_CLOCK_PRECISION_DIGITS) - return 0; - ctx->clock_precision_digits = precision; - return 1; - } +int +TS_RESP_CTX_set_clock_precision_digits(TS_RESP_CTX *ctx, unsigned precision) +{ + if (precision > TS_MAX_CLOCK_PRECISION_DIGITS) + return 0; + ctx->clock_precision_digits = precision; + return 1; +} /* Main entry method of the response generation. */ -TS_RESP *TS_RESP_create_response(TS_RESP_CTX *ctx, BIO *req_bio) - { +TS_RESP * +TS_RESP_create_response(TS_RESP_CTX *ctx, BIO *req_bio) +{ ASN1_OBJECT *policy; TS_RESP *response; int result = 0; @@ -424,87 +457,90 @@ TS_RESP *TS_RESP_create_response(TS_RESP_CTX *ctx, BIO *req_bio) TS_RESP_CTX_init(ctx); /* Creating the response object. */ - if (!(ctx->response = TS_RESP_new())) - { + if (!(ctx->response = TS_RESP_new())) { TSerr(TS_F_TS_RESP_CREATE_RESPONSE, ERR_R_MALLOC_FAILURE); goto end; - } + } /* Parsing DER request. */ - if (!(ctx->request = d2i_TS_REQ_bio(req_bio, NULL))) - { + if (!(ctx->request = d2i_TS_REQ_bio(req_bio, NULL))) { TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, - "Bad request format or " - "system error."); + "Bad request format or " + "system error."); TS_RESP_CTX_add_failure_info(ctx, TS_INFO_BAD_DATA_FORMAT); goto end; - } + } /* Setting default status info. */ if (!TS_RESP_CTX_set_status_info(ctx, TS_STATUS_GRANTED, NULL)) goto end; /* Checking the request format. */ - if (!TS_RESP_check_request(ctx)) goto end; + if (!TS_RESP_check_request(ctx)) + goto end; /* Checking acceptable policies. */ - if (!(policy = TS_RESP_get_policy(ctx))) goto end; + if (!(policy = TS_RESP_get_policy(ctx))) + goto end; /* Creating the TS_TST_INFO object. */ if (!(ctx->tst_info = TS_RESP_create_tst_info(ctx, policy))) goto end; /* Processing extensions. */ - if (!TS_RESP_process_extensions(ctx)) goto end; + if (!TS_RESP_process_extensions(ctx)) + goto end; /* Generating the signature. */ - if (!TS_RESP_sign(ctx)) goto end; + if (!TS_RESP_sign(ctx)) + goto end; /* Everything was successful. */ result = 1; - end: - if (!result) - { + +end: + if (!result) { TSerr(TS_F_TS_RESP_CREATE_RESPONSE, TS_R_RESPONSE_SETUP_ERROR); - if (ctx->response != NULL) - { + if (ctx->response != NULL) { if (TS_RESP_CTX_set_status_info_cond(ctx, - TS_STATUS_REJECTION, "Error during response " - "generation.") == 0) - { + TS_STATUS_REJECTION, "Error during response " + "generation.") == 0) { TS_RESP_free(ctx->response); ctx->response = NULL; - } } } + } response = ctx->response; ctx->response = NULL; /* Ownership will be returned to caller. */ TS_RESP_CTX_cleanup(ctx); return response; - } +} /* Initializes the variable part of the context. */ -static void TS_RESP_CTX_init(TS_RESP_CTX *ctx) - { +static void +TS_RESP_CTX_init(TS_RESP_CTX *ctx) +{ ctx->request = NULL; ctx->response = NULL; ctx->tst_info = NULL; - } +} /* Cleans up the variable part of the context. */ -static void TS_RESP_CTX_cleanup(TS_RESP_CTX *ctx) - { +static void +TS_RESP_CTX_cleanup(TS_RESP_CTX *ctx) +{ TS_REQ_free(ctx->request); ctx->request = NULL; TS_RESP_free(ctx->response); ctx->response = NULL; TS_TST_INFO_free(ctx->tst_info); ctx->tst_info = NULL; - } +} /* Checks the format and content of the request. */ -static int TS_RESP_check_request(TS_RESP_CTX *ctx) - { +static int +TS_RESP_check_request(TS_RESP_CTX *ctx) +{ TS_REQ *request = ctx->request; TS_MSG_IMPRINT *msg_imprint; X509_ALGOR *md_alg; @@ -514,95 +550,88 @@ static int TS_RESP_check_request(TS_RESP_CTX *ctx) int i; /* Checking request version. */ - if (TS_REQ_get_version(request) != 1) - { + if (TS_REQ_get_version(request) != 1) { TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, - "Bad request version."); + "Bad request version."); TS_RESP_CTX_add_failure_info(ctx, TS_INFO_BAD_REQUEST); return 0; - } + } /* Checking message digest algorithm. */ msg_imprint = TS_REQ_get_msg_imprint(request); md_alg = TS_MSG_IMPRINT_get_algo(msg_imprint); md_alg_id = OBJ_obj2nid(md_alg->algorithm); - for (i = 0; !md && i < sk_EVP_MD_num(ctx->mds); ++i) - { + for (i = 0; !md && i < sk_EVP_MD_num(ctx->mds); ++i) { EVP_MD *current_md = sk_EVP_MD_value(ctx->mds, i); if (md_alg_id == EVP_MD_type(current_md)) md = current_md; - } - if (!md) - { + } + if (!md) { TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, - "Message digest algorithm is " - "not supported."); + "Message digest algorithm is " + "not supported."); TS_RESP_CTX_add_failure_info(ctx, TS_INFO_BAD_ALG); return 0; - } + } /* No message digest takes parameter. */ - if (md_alg->parameter - && ASN1_TYPE_get(md_alg->parameter) != V_ASN1_NULL) - { + if (md_alg->parameter && + ASN1_TYPE_get(md_alg->parameter) != V_ASN1_NULL) { TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, - "Superfluous message digest " - "parameter."); + "Superfluous message digest " + "parameter."); TS_RESP_CTX_add_failure_info(ctx, TS_INFO_BAD_ALG); return 0; - } + } /* Checking message digest size. */ digest = TS_MSG_IMPRINT_get_msg(msg_imprint); - if (digest->length != EVP_MD_size(md)) - { + if (digest->length != EVP_MD_size(md)) { TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, - "Bad message digest."); + "Bad message digest."); TS_RESP_CTX_add_failure_info(ctx, TS_INFO_BAD_DATA_FORMAT); return 0; - } + } return 1; - } +} /* Returns the TSA policy based on the requested and acceptable policies. */ -static ASN1_OBJECT *TS_RESP_get_policy(TS_RESP_CTX *ctx) - { +static ASN1_OBJECT * +TS_RESP_get_policy(TS_RESP_CTX *ctx) +{ ASN1_OBJECT *requested = TS_REQ_get_policy_id(ctx->request); ASN1_OBJECT *policy = NULL; int i; - if (ctx->default_policy == NULL) - { + if (ctx->default_policy == NULL) { TSerr(TS_F_TS_RESP_GET_POLICY, TS_R_INVALID_NULL_POINTER); return NULL; - } + } /* Return the default policy if none is requested or the default is requested. */ if (!requested || !OBJ_cmp(requested, ctx->default_policy)) policy = ctx->default_policy; /* Check if the policy is acceptable. */ - for (i = 0; !policy && i < sk_ASN1_OBJECT_num(ctx->policies); ++i) - { + for (i = 0; !policy && i < sk_ASN1_OBJECT_num(ctx->policies); ++i) { ASN1_OBJECT *current = sk_ASN1_OBJECT_value(ctx->policies, i); if (!OBJ_cmp(requested, current)) policy = current; - } - if (!policy) - { + } + if (!policy) { TSerr(TS_F_TS_RESP_GET_POLICY, TS_R_UNACCEPTABLE_POLICY); TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, - "Requested policy is not " - "supported."); + "Requested policy is not " + "supported."); TS_RESP_CTX_add_failure_info(ctx, TS_INFO_UNACCEPTED_POLICY); - } - return policy; } + return policy; +} /* Creates the TS_TST_INFO object based on the settings of the context. */ -static TS_TST_INFO *TS_RESP_create_tst_info(TS_RESP_CTX *ctx, - ASN1_OBJECT *policy) - { +static TS_TST_INFO * +TS_RESP_create_tst_info(TS_RESP_CTX *ctx, ASN1_OBJECT *policy) +{ int result = 0; TS_TST_INFO *tst_info = NULL; ASN1_INTEGER *serial = NULL; @@ -612,24 +641,26 @@ static TS_TST_INFO *TS_RESP_create_tst_info(TS_RESP_CTX *ctx, const ASN1_INTEGER *nonce; GENERAL_NAME *tsa_name = NULL; - if (!(tst_info = TS_TST_INFO_new())) goto end; - if (!TS_TST_INFO_set_version(tst_info, 1)) goto end; - if (!TS_TST_INFO_set_policy_id(tst_info, policy)) goto end; + if (!(tst_info = TS_TST_INFO_new())) + goto end; + if (!TS_TST_INFO_set_version(tst_info, 1)) + goto end; + if (!TS_TST_INFO_set_policy_id(tst_info, policy)) + goto end; if (!TS_TST_INFO_set_msg_imprint(tst_info, ctx->request->msg_imprint)) goto end; - if (!(serial = (*ctx->serial_cb)(ctx, ctx->serial_cb_data)) - || !TS_TST_INFO_set_serial(tst_info, serial)) + if (!(serial = (*ctx->serial_cb)(ctx, ctx->serial_cb_data)) || + !TS_TST_INFO_set_serial(tst_info, serial)) goto end; - if (!(*ctx->time_cb)(ctx, ctx->time_cb_data, &sec, &usec) - || !(asn1_time = TS_RESP_set_genTime_with_precision(NULL, - sec, usec, - ctx->clock_precision_digits)) - || !TS_TST_INFO_set_time(tst_info, asn1_time)) + if (!(*ctx->time_cb)(ctx, ctx->time_cb_data, &sec, &usec) || + !(asn1_time = TS_RESP_set_genTime_with_precision(NULL, sec, usec, + ctx->clock_precision_digits)) || + !TS_TST_INFO_set_time(tst_info, asn1_time)) goto end; /* Setting accuracy if needed. */ - if ((ctx->seconds || ctx->millis || ctx->micros) - && !(accuracy = TS_ACCURACY_new())) + if ((ctx->seconds || ctx->millis || ctx->micros) && + !(accuracy = TS_ACCURACY_new())) goto end; if (ctx->seconds && !TS_ACCURACY_set_seconds(accuracy, ctx->seconds)) @@ -638,58 +669,60 @@ static TS_TST_INFO *TS_RESP_create_tst_info(TS_RESP_CTX *ctx, goto end; if (ctx->micros && !TS_ACCURACY_set_micros(accuracy, ctx->micros)) goto end; - if (accuracy && !TS_TST_INFO_set_accuracy(tst_info, accuracy)) + if (accuracy && !TS_TST_INFO_set_accuracy(tst_info, accuracy)) goto end; /* Setting ordering. */ - if ((ctx->flags & TS_ORDERING) - && !TS_TST_INFO_set_ordering(tst_info, 1)) + if ((ctx->flags & TS_ORDERING) && + !TS_TST_INFO_set_ordering(tst_info, 1)) goto end; - + /* Setting nonce if needed. */ - if ((nonce = TS_REQ_get_nonce(ctx->request)) != NULL - && !TS_TST_INFO_set_nonce(tst_info, nonce)) + if ((nonce = TS_REQ_get_nonce(ctx->request)) != NULL && + !TS_TST_INFO_set_nonce(tst_info, nonce)) goto end; /* Setting TSA name to subject of signer certificate. */ - if (ctx->flags & TS_TSA_NAME) - { - if (!(tsa_name = GENERAL_NAME_new())) goto end; + if (ctx->flags & TS_TSA_NAME) { + if (!(tsa_name = GENERAL_NAME_new())) + goto end; tsa_name->type = GEN_DIRNAME; - tsa_name->d.dirn = - X509_NAME_dup(ctx->signer_cert->cert_info->subject); - if (!tsa_name->d.dirn) goto end; - if (!TS_TST_INFO_set_tsa(tst_info, tsa_name)) goto end; - } + tsa_name->d.dirn = + X509_NAME_dup(ctx->signer_cert->cert_info->subject); + if (!tsa_name->d.dirn) + goto end; + if (!TS_TST_INFO_set_tsa(tst_info, tsa_name)) + goto end; + } result = 1; - end: - if (!result) - { + +end: + if (!result) { TS_TST_INFO_free(tst_info); tst_info = NULL; TSerr(TS_F_TS_RESP_CREATE_TST_INFO, TS_R_TST_INFO_SETUP_ERROR); TS_RESP_CTX_set_status_info_cond(ctx, TS_STATUS_REJECTION, - "Error during TSTInfo " - "generation."); - } + "Error during TSTInfo " + "generation."); + } GENERAL_NAME_free(tsa_name); TS_ACCURACY_free(accuracy); ASN1_GENERALIZEDTIME_free(asn1_time); ASN1_INTEGER_free(serial); - + return tst_info; - } +} /* Processing the extensions of the request. */ -static int TS_RESP_process_extensions(TS_RESP_CTX *ctx) - { +static int +TS_RESP_process_extensions(TS_RESP_CTX *ctx) +{ STACK_OF(X509_EXTENSION) *exts = TS_REQ_get_exts(ctx->request); int i; int ok = 1; - for (i = 0; ok && i < sk_X509_EXTENSION_num(exts); ++i) - { + for (i = 0; ok && i < sk_X509_EXTENSION_num(exts); ++i) { X509_EXTENSION *ext = sk_X509_EXTENSION_value(exts, i); /* XXXXX The last argument was previously (void *)ctx->extension_cb, but ISO C doesn't permit @@ -699,14 +732,15 @@ static int TS_RESP_process_extensions(TS_RESP_CTX *ctx) anyway... */ ok = (*ctx->extension_cb)(ctx, ext, NULL); - } + } return ok; - } +} /* Functions for signing the TS_TST_INFO structure of the context. */ -static int TS_RESP_sign(TS_RESP_CTX *ctx) - { +static int +TS_RESP_sign(TS_RESP_CTX *ctx) +{ int ret = 0; PKCS7 *p7 = NULL; PKCS7_SIGNER_INFO *si; @@ -718,9 +752,9 @@ static int TS_RESP_sign(TS_RESP_CTX *ctx) /* Check if signcert and pkey match. */ if (!X509_check_private_key(ctx->signer_cert, ctx->signer_key)) { - TSerr(TS_F_TS_RESP_SIGN, - TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE); - goto err; + TSerr(TS_F_TS_RESP_SIGN, + TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE); + goto err; } /* Create a new PKCS7 signed object. */ @@ -728,57 +762,54 @@ static int TS_RESP_sign(TS_RESP_CTX *ctx) TSerr(TS_F_TS_RESP_SIGN, ERR_R_MALLOC_FAILURE); goto err; } - if (!PKCS7_set_type(p7, NID_pkcs7_signed)) goto err; + if (!PKCS7_set_type(p7, NID_pkcs7_signed)) + goto err; /* Force SignedData version to be 3 instead of the default 1. */ - if (!ASN1_INTEGER_set(p7->d.sign->version, 3)) goto err; + if (!ASN1_INTEGER_set(p7->d.sign->version, 3)) + goto err; /* Add signer certificate and optional certificate chain. */ - if (TS_REQ_get_cert_req(ctx->request)) - { + if (TS_REQ_get_cert_req(ctx->request)) { PKCS7_add_certificate(p7, ctx->signer_cert); - if (ctx->certs) - { - for(i = 0; i < sk_X509_num(ctx->certs); ++i) - { + if (ctx->certs) { + for (i = 0; i < sk_X509_num(ctx->certs); ++i) { X509 *cert = sk_X509_value(ctx->certs, i); PKCS7_add_certificate(p7, cert); - } } } + } /* Add a new signer info. */ - if (!(si = PKCS7_add_signature(p7, ctx->signer_cert, - ctx->signer_key, EVP_sha1()))) - { + if (!(si = PKCS7_add_signature(p7, ctx->signer_cert, + ctx->signer_key, EVP_sha1()))) { TSerr(TS_F_TS_RESP_SIGN, TS_R_PKCS7_ADD_SIGNATURE_ERROR); goto err; - } + } /* Add content type signed attribute to the signer info. */ oid = OBJ_nid2obj(NID_id_smime_ct_TSTInfo); if (!PKCS7_add_signed_attribute(si, NID_pkcs9_contentType, - V_ASN1_OBJECT, oid)) - { + V_ASN1_OBJECT, oid)) { TSerr(TS_F_TS_RESP_SIGN, TS_R_PKCS7_ADD_SIGNED_ATTR_ERROR); goto err; - } + } - /* Create the ESS SigningCertificate attribute which contains + /* Create the ESS SigningCertificate attribute which contains the signer certificate id and optionally the certificate chain. */ certs = ctx->flags & TS_ESS_CERT_ID_CHAIN ? ctx->certs : NULL; if (!(sc = ESS_SIGNING_CERT_new_init(ctx->signer_cert, certs))) goto err; /* Add SigningCertificate signed attribute to the signer info. */ - if (!ESS_add_signing_cert(si, sc)) - { + if (!ESS_add_signing_cert(si, sc)) { TSerr(TS_F_TS_RESP_SIGN, TS_R_ESS_ADD_SIGNING_CERT_ERROR); goto err; - } + } /* Add a new empty NID_id_smime_ct_TSTInfo encapsulated content. */ - if (!TS_TST_INFO_content_new(p7)) goto err; + if (!TS_TST_INFO_content_new(p7)) + goto err; /* Add the DER encoded tst_info to the PKCS7 structure. */ if (!(p7bio = PKCS7_dataInit(p7, NULL))) { @@ -787,18 +818,16 @@ static int TS_RESP_sign(TS_RESP_CTX *ctx) } /* Convert tst_info to DER. */ - if (!i2d_TS_TST_INFO_bio(p7bio, ctx->tst_info)) - { + if (!i2d_TS_TST_INFO_bio(p7bio, ctx->tst_info)) { TSerr(TS_F_TS_RESP_SIGN, TS_R_TS_DATASIGN); goto err; - } + } /* Create the signature and add it to the signer info. */ - if (!PKCS7_dataFinal(p7, p7bio)) - { + if (!PKCS7_dataFinal(p7, p7bio)) { TSerr(TS_F_TS_RESP_SIGN, TS_R_TS_DATASIGN); goto err; - } + } /* Set new PKCS7 and TST_INFO objects. */ TS_RESP_set_tst_info(ctx->response, p7, ctx->tst_info); @@ -806,152 +835,163 @@ static int TS_RESP_sign(TS_RESP_CTX *ctx) ctx->tst_info = NULL; /* Ownership is lost. */ ret = 1; - err: + +err: if (!ret) TS_RESP_CTX_set_status_info_cond(ctx, TS_STATUS_REJECTION, - "Error during signature " - "generation."); + "Error during signature " + "generation."); BIO_free_all(p7bio); ESS_SIGNING_CERT_free(sc); PKCS7_free(p7); return ret; - } +} -static ESS_SIGNING_CERT *ESS_SIGNING_CERT_new_init(X509 *signcert, - STACK_OF(X509) *certs) - { +static ESS_SIGNING_CERT * +ESS_SIGNING_CERT_new_init(X509 *signcert, STACK_OF(X509) *certs) +{ ESS_CERT_ID *cid; ESS_SIGNING_CERT *sc = NULL; int i; /* Creating the ESS_CERT_ID stack. */ - if (!(sc = ESS_SIGNING_CERT_new())) goto err; + if (!(sc = ESS_SIGNING_CERT_new())) + goto err; if (!sc->cert_ids && !(sc->cert_ids = sk_ESS_CERT_ID_new_null())) goto err; /* Adding the signing certificate id. */ - if (!(cid = ESS_CERT_ID_new_init(signcert, 0)) - || !sk_ESS_CERT_ID_push(sc->cert_ids, cid)) + if (!(cid = ESS_CERT_ID_new_init(signcert, 0)) || + !sk_ESS_CERT_ID_push(sc->cert_ids, cid)) goto err; /* Adding the certificate chain ids. */ - for (i = 0; i < sk_X509_num(certs); ++i) - { + for (i = 0; i < sk_X509_num(certs); ++i) { X509 *cert = sk_X509_value(certs, i); - if (!(cid = ESS_CERT_ID_new_init(cert, 1)) - || !sk_ESS_CERT_ID_push(sc->cert_ids, cid)) + if (!(cid = ESS_CERT_ID_new_init(cert, 1)) || + !sk_ESS_CERT_ID_push(sc->cert_ids, cid)) goto err; - } + } return sc; + err: ESS_SIGNING_CERT_free(sc); TSerr(TS_F_ESS_SIGNING_CERT_NEW_INIT, ERR_R_MALLOC_FAILURE); return NULL; - } +} -static ESS_CERT_ID *ESS_CERT_ID_new_init(X509 *cert, int issuer_needed) - { +static ESS_CERT_ID * +ESS_CERT_ID_new_init(X509 *cert, int issuer_needed) +{ ESS_CERT_ID *cid = NULL; GENERAL_NAME *name = NULL; - + /* Recompute SHA1 hash of certificate if necessary (side effect). */ X509_check_purpose(cert, -1, 0); - if (!(cid = ESS_CERT_ID_new())) goto err; + if (!(cid = ESS_CERT_ID_new())) + goto err; if (!ASN1_OCTET_STRING_set(cid->hash, cert->sha1_hash, - sizeof(cert->sha1_hash))) + sizeof(cert->sha1_hash))) goto err; /* Setting the issuer/serial if requested. */ - if (issuer_needed) - { + if (issuer_needed) { /* Creating issuer/serial structure. */ - if (!cid->issuer_serial - && !(cid->issuer_serial = ESS_ISSUER_SERIAL_new())) + if (!cid->issuer_serial && + !(cid->issuer_serial = ESS_ISSUER_SERIAL_new())) goto err; /* Creating general name from the certificate issuer. */ - if (!(name = GENERAL_NAME_new())) goto err; + if (!(name = GENERAL_NAME_new())) + goto err; name->type = GEN_DIRNAME; - if (!(name->d.dirn = X509_NAME_dup(cert->cert_info->issuer))) + if (!(name->d.dirn = X509_NAME_dup(cert->cert_info->issuer))) goto err; - if (!sk_GENERAL_NAME_push(cid->issuer_serial->issuer, name)) + if (!sk_GENERAL_NAME_push(cid->issuer_serial->issuer, name)) goto err; name = NULL; /* Ownership is lost. */ /* Setting the serial number. */ ASN1_INTEGER_free(cid->issuer_serial->serial); - if (!(cid->issuer_serial->serial = - ASN1_INTEGER_dup(cert->cert_info->serialNumber))) + if (!(cid->issuer_serial->serial = + ASN1_INTEGER_dup(cert->cert_info->serialNumber))) goto err; - } + } return cid; + err: GENERAL_NAME_free(name); ESS_CERT_ID_free(cid); TSerr(TS_F_ESS_CERT_ID_NEW_INIT, ERR_R_MALLOC_FAILURE); return NULL; - } +} -static int TS_TST_INFO_content_new(PKCS7 *p7) - { +static int +TS_TST_INFO_content_new(PKCS7 *p7) +{ PKCS7 *ret = NULL; ASN1_OCTET_STRING *octet_string = NULL; /* Create new encapsulated NID_id_smime_ct_TSTInfo content. */ - if (!(ret = PKCS7_new())) goto err; - if (!(ret->d.other = ASN1_TYPE_new())) goto err; + if (!(ret = PKCS7_new())) + goto err; + if (!(ret->d.other = ASN1_TYPE_new())) + goto err; ret->type = OBJ_nid2obj(NID_id_smime_ct_TSTInfo); - if (!(octet_string = ASN1_OCTET_STRING_new())) goto err; + if (!(octet_string = ASN1_OCTET_STRING_new())) + goto err; ASN1_TYPE_set(ret->d.other, V_ASN1_OCTET_STRING, octet_string); octet_string = NULL; /* Add encapsulated content to signed PKCS7 structure. */ - if (!PKCS7_set_content(p7, ret)) goto err; + if (!PKCS7_set_content(p7, ret)) + goto err; return 1; - err: + +err: ASN1_OCTET_STRING_free(octet_string); PKCS7_free(ret); return 0; - } +} -static int ESS_add_signing_cert(PKCS7_SIGNER_INFO *si, ESS_SIGNING_CERT *sc) - { +static int +ESS_add_signing_cert(PKCS7_SIGNER_INFO *si, ESS_SIGNING_CERT *sc) +{ ASN1_STRING *seq = NULL; unsigned char *p, *pp = NULL; int len; len = i2d_ESS_SIGNING_CERT(sc, NULL); - if (!(pp = (unsigned char *) malloc(len))) - { + if (!(pp = (unsigned char *) malloc(len))) { TSerr(TS_F_ESS_ADD_SIGNING_CERT, ERR_R_MALLOC_FAILURE); goto err; - } + } p = pp; i2d_ESS_SIGNING_CERT(sc, &p); - if (!(seq = ASN1_STRING_new()) || !ASN1_STRING_set(seq, pp, len)) - { + if (!(seq = ASN1_STRING_new()) || !ASN1_STRING_set(seq, pp, len)) { TSerr(TS_F_ESS_ADD_SIGNING_CERT, ERR_R_MALLOC_FAILURE); goto err; - } - free(pp); pp = NULL; - return PKCS7_add_signed_attribute(si, - NID_id_smime_aa_signingCertificate, - V_ASN1_SEQUENCE, seq); - err: + } + free(pp); + pp = NULL; + return PKCS7_add_signed_attribute(si, + NID_id_smime_aa_signingCertificate, V_ASN1_SEQUENCE, seq); + +err: ASN1_STRING_free(seq); free(pp); return 0; - } +} static ASN1_GENERALIZEDTIME * -TS_RESP_set_genTime_with_precision(ASN1_GENERALIZEDTIME *asn1_time, - long sec, long usec, unsigned precision) - { +TS_RESP_set_genTime_with_precision(ASN1_GENERALIZEDTIME *asn1_time, + long sec, long usec, unsigned precision) +{ time_t time_sec = (time_t) sec; - struct tm *tm = NULL; + struct tm *tm = NULL; char genTime_str[17 + TS_MAX_CLOCK_PRECISION_DIGITS]; char usecstr[TS_MAX_CLOCK_PRECISION_DIGITS + 2]; char *p; @@ -960,26 +1000,25 @@ TS_RESP_set_genTime_with_precision(ASN1_GENERALIZEDTIME *asn1_time, if (precision > TS_MAX_CLOCK_PRECISION_DIGITS) goto err; - if (!(tm = gmtime(&time_sec))) goto err; - /* - * Put "genTime_str" in GeneralizedTime format. We work around the - * restrictions imposed by rfc3280 (i.e. "GeneralizedTime values MUST - * NOT include fractional seconds") and OpenSSL related functions to - * meet the rfc3161 requirement: "GeneralizedTime syntax can include - * fraction-of-second details". - */ + /* + * Put "genTime_str" in GeneralizedTime format. We work around the + * restrictions imposed by rfc3280 (i.e. "GeneralizedTime values MUST + * NOT include fractional seconds") and OpenSSL related functions to + * meet the rfc3161 requirement: "GeneralizedTime syntax can include + * fraction-of-second details". + */ if (precision > 0) { /* To make things a bit harder, X.690 | ISO/IEC 8825-1 provides the following restrictions for a DER-encoding, which OpenSSL - (specifically ASN1_GENERALIZEDTIME_check() function) doesn't + (specifically ASN1_GENERALIZEDTIME_check() function) doesn't support: - "The encoding MUST terminate with a "Z" (which means "Zulu" - time). The decimal point element, if present, MUST be the - point option ".". The fractional-seconds elements, - if present, MUST omit all trailing 0's; + "The encoding MUST terminate with a "Z" (which means "Zulu" + time). The decimal point element, if present, MUST be the + point option ".". The fractional-seconds elements, + if present, MUST omit all trailing 0's; if the elements correspond to 0, they MUST be wholly omitted, and the decimal point element also MUST be omitted." */ @@ -999,7 +1038,7 @@ TS_RESP_set_genTime_with_precision(ASN1_GENERALIZEDTIME *asn1_time, } rv = snprintf(genTime_str, sizeof(genTime_str), "%04d%02d%02d%02d%02d%02d%sZ", - tm->tm_year + 1900, tm->tm_mon + 1, tm->tm_mday, + tm->tm_year + 1900, tm->tm_mon + 1, tm->tm_mday, tm->tm_hour, tm->tm_min, tm->tm_sec, usecstr); if (rv == -1 || rv >= sizeof(genTime_str)) goto err; @@ -1007,14 +1046,14 @@ TS_RESP_set_genTime_with_precision(ASN1_GENERALIZEDTIME *asn1_time, /* Now call OpenSSL to check and set our genTime value */ if (!asn1_time && !(asn1_time = M_ASN1_GENERALIZEDTIME_new())) goto err; - if (!ASN1_GENERALIZEDTIME_set_string(asn1_time, genTime_str)) - { + if (!ASN1_GENERALIZEDTIME_set_string(asn1_time, genTime_str)) { ASN1_GENERALIZEDTIME_free(asn1_time); goto err; - } + } return asn1_time; - err: + +err: TSerr(TS_F_TS_RESP_SET_GENTIME_WITH_PRECISION, TS_R_COULD_NOT_SET_TIME); return NULL; - } +} diff --git a/lib/libcrypto/ts/ts_rsp_utils.c b/lib/libcrypto/ts/ts_rsp_utils.c index 401c1fdc51d..89c3e8f63ca 100644 --- a/lib/libcrypto/ts/ts_rsp_utils.c +++ b/lib/libcrypto/ts/ts_rsp_utils.c @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -64,346 +64,372 @@ /* Function definitions. */ -int TS_RESP_set_status_info(TS_RESP *a, TS_STATUS_INFO *status_info) - { +int +TS_RESP_set_status_info(TS_RESP *a, TS_STATUS_INFO *status_info) +{ TS_STATUS_INFO *new_status_info; if (a->status_info == status_info) return 1; new_status_info = TS_STATUS_INFO_dup(status_info); - if (new_status_info == NULL) - { + if (new_status_info == NULL) { TSerr(TS_F_TS_RESP_SET_STATUS_INFO, ERR_R_MALLOC_FAILURE); return 0; - } + } TS_STATUS_INFO_free(a->status_info); a->status_info = new_status_info; return 1; - } +} -TS_STATUS_INFO *TS_RESP_get_status_info(TS_RESP *a) - { +TS_STATUS_INFO * +TS_RESP_get_status_info(TS_RESP *a) +{ return a->status_info; - } +} /* Caller loses ownership of PKCS7 and TS_TST_INFO objects. */ -void TS_RESP_set_tst_info(TS_RESP *a, PKCS7 *p7, TS_TST_INFO *tst_info) - { +void +TS_RESP_set_tst_info(TS_RESP *a, PKCS7 *p7, TS_TST_INFO *tst_info) +{ /* Set new PKCS7 and TST_INFO objects. */ PKCS7_free(a->token); a->token = p7; TS_TST_INFO_free(a->tst_info); a->tst_info = tst_info; - } +} -PKCS7 *TS_RESP_get_token(TS_RESP *a) - { +PKCS7 * +TS_RESP_get_token(TS_RESP *a) +{ return a->token; - } +} -TS_TST_INFO *TS_RESP_get_tst_info(TS_RESP *a) - { +TS_TST_INFO * +TS_RESP_get_tst_info(TS_RESP *a) +{ return a->tst_info; - } +} -int TS_TST_INFO_set_version(TS_TST_INFO *a, long version) - { +int +TS_TST_INFO_set_version(TS_TST_INFO *a, long version) +{ return ASN1_INTEGER_set(a->version, version); - } +} -long TS_TST_INFO_get_version(const TS_TST_INFO *a) - { +long +TS_TST_INFO_get_version(const TS_TST_INFO *a) +{ return ASN1_INTEGER_get(a->version); - } +} -int TS_TST_INFO_set_policy_id(TS_TST_INFO *a, ASN1_OBJECT *policy) - { +int +TS_TST_INFO_set_policy_id(TS_TST_INFO *a, ASN1_OBJECT *policy) +{ ASN1_OBJECT *new_policy; if (a->policy_id == policy) return 1; new_policy = OBJ_dup(policy); - if (new_policy == NULL) - { + if (new_policy == NULL) { TSerr(TS_F_TS_TST_INFO_SET_POLICY_ID, ERR_R_MALLOC_FAILURE); return 0; - } + } ASN1_OBJECT_free(a->policy_id); a->policy_id = new_policy; return 1; - } +} -ASN1_OBJECT *TS_TST_INFO_get_policy_id(TS_TST_INFO *a) - { +ASN1_OBJECT * +TS_TST_INFO_get_policy_id(TS_TST_INFO *a) +{ return a->policy_id; - } +} -int TS_TST_INFO_set_msg_imprint(TS_TST_INFO *a, TS_MSG_IMPRINT *msg_imprint) - { +int +TS_TST_INFO_set_msg_imprint(TS_TST_INFO *a, TS_MSG_IMPRINT *msg_imprint) +{ TS_MSG_IMPRINT *new_msg_imprint; if (a->msg_imprint == msg_imprint) return 1; new_msg_imprint = TS_MSG_IMPRINT_dup(msg_imprint); - if (new_msg_imprint == NULL) - { + if (new_msg_imprint == NULL) { TSerr(TS_F_TS_TST_INFO_SET_MSG_IMPRINT, ERR_R_MALLOC_FAILURE); return 0; - } + } TS_MSG_IMPRINT_free(a->msg_imprint); a->msg_imprint = new_msg_imprint; return 1; - } +} -TS_MSG_IMPRINT *TS_TST_INFO_get_msg_imprint(TS_TST_INFO *a) - { +TS_MSG_IMPRINT * +TS_TST_INFO_get_msg_imprint(TS_TST_INFO *a) +{ return a->msg_imprint; - } +} -int TS_TST_INFO_set_serial(TS_TST_INFO *a, const ASN1_INTEGER *serial) - { +int +TS_TST_INFO_set_serial(TS_TST_INFO *a, const ASN1_INTEGER *serial) +{ ASN1_INTEGER *new_serial; if (a->serial == serial) return 1; new_serial = ASN1_INTEGER_dup(serial); - if (new_serial == NULL) - { + if (new_serial == NULL) { TSerr(TS_F_TS_TST_INFO_SET_SERIAL, ERR_R_MALLOC_FAILURE); return 0; - } + } ASN1_INTEGER_free(a->serial); a->serial = new_serial; return 1; - } +} -const ASN1_INTEGER *TS_TST_INFO_get_serial(const TS_TST_INFO *a) - { +const ASN1_INTEGER * +TS_TST_INFO_get_serial(const TS_TST_INFO *a) +{ return a->serial; - } +} -int TS_TST_INFO_set_time(TS_TST_INFO *a, const ASN1_GENERALIZEDTIME *gtime) - { +int +TS_TST_INFO_set_time(TS_TST_INFO *a, const ASN1_GENERALIZEDTIME *gtime) +{ ASN1_GENERALIZEDTIME *new_time; if (a->time == gtime) return 1; new_time = M_ASN1_GENERALIZEDTIME_dup(gtime); - if (new_time == NULL) - { + if (new_time == NULL) { TSerr(TS_F_TS_TST_INFO_SET_TIME, ERR_R_MALLOC_FAILURE); return 0; - } + } ASN1_GENERALIZEDTIME_free(a->time); a->time = new_time; return 1; - } +} -const ASN1_GENERALIZEDTIME *TS_TST_INFO_get_time(const TS_TST_INFO *a) - { +const ASN1_GENERALIZEDTIME * +TS_TST_INFO_get_time(const TS_TST_INFO *a) +{ return a->time; - } +} -int TS_TST_INFO_set_accuracy(TS_TST_INFO *a, TS_ACCURACY *accuracy) - { +int +TS_TST_INFO_set_accuracy(TS_TST_INFO *a, TS_ACCURACY *accuracy) +{ TS_ACCURACY *new_accuracy; if (a->accuracy == accuracy) return 1; new_accuracy = TS_ACCURACY_dup(accuracy); - if (new_accuracy == NULL) - { + if (new_accuracy == NULL) { TSerr(TS_F_TS_TST_INFO_SET_ACCURACY, ERR_R_MALLOC_FAILURE); return 0; - } + } TS_ACCURACY_free(a->accuracy); a->accuracy = new_accuracy; return 1; - } +} -TS_ACCURACY *TS_TST_INFO_get_accuracy(TS_TST_INFO *a) - { +TS_ACCURACY * +TS_TST_INFO_get_accuracy(TS_TST_INFO *a) +{ return a->accuracy; - } +} -int TS_ACCURACY_set_seconds(TS_ACCURACY *a, const ASN1_INTEGER *seconds) - { +int +TS_ACCURACY_set_seconds(TS_ACCURACY *a, const ASN1_INTEGER *seconds) +{ ASN1_INTEGER *new_seconds; if (a->seconds == seconds) return 1; new_seconds = ASN1_INTEGER_dup(seconds); - if (new_seconds == NULL) - { + if (new_seconds == NULL) { TSerr(TS_F_TS_ACCURACY_SET_SECONDS, ERR_R_MALLOC_FAILURE); return 0; - } + } ASN1_INTEGER_free(a->seconds); a->seconds = new_seconds; return 1; - } +} -const ASN1_INTEGER *TS_ACCURACY_get_seconds(const TS_ACCURACY *a) - { +const ASN1_INTEGER * +TS_ACCURACY_get_seconds(const TS_ACCURACY *a) +{ return a->seconds; - } +} -int TS_ACCURACY_set_millis(TS_ACCURACY *a, const ASN1_INTEGER *millis) - { +int +TS_ACCURACY_set_millis(TS_ACCURACY *a, const ASN1_INTEGER *millis) +{ ASN1_INTEGER *new_millis = NULL; if (a->millis == millis) return 1; - if (millis != NULL) - { + if (millis != NULL) { new_millis = ASN1_INTEGER_dup(millis); - if (new_millis == NULL) - { - TSerr(TS_F_TS_ACCURACY_SET_MILLIS, - ERR_R_MALLOC_FAILURE); + if (new_millis == NULL) { + TSerr(TS_F_TS_ACCURACY_SET_MILLIS, + ERR_R_MALLOC_FAILURE); return 0; - } } + } ASN1_INTEGER_free(a->millis); a->millis = new_millis; return 1; - } +} -const ASN1_INTEGER *TS_ACCURACY_get_millis(const TS_ACCURACY *a) - { +const ASN1_INTEGER * +TS_ACCURACY_get_millis(const TS_ACCURACY *a) +{ return a->millis; - } +} -int TS_ACCURACY_set_micros(TS_ACCURACY *a, const ASN1_INTEGER *micros) - { +int +TS_ACCURACY_set_micros(TS_ACCURACY *a, const ASN1_INTEGER *micros) +{ ASN1_INTEGER *new_micros = NULL; if (a->micros == micros) return 1; - if (micros != NULL) - { + if (micros != NULL) { new_micros = ASN1_INTEGER_dup(micros); - if (new_micros == NULL) - { - TSerr(TS_F_TS_ACCURACY_SET_MICROS, - ERR_R_MALLOC_FAILURE); + if (new_micros == NULL) { + TSerr(TS_F_TS_ACCURACY_SET_MICROS, + ERR_R_MALLOC_FAILURE); return 0; - } } + } ASN1_INTEGER_free(a->micros); a->micros = new_micros; return 1; - } +} -const ASN1_INTEGER *TS_ACCURACY_get_micros(const TS_ACCURACY *a) - { +const ASN1_INTEGER * +TS_ACCURACY_get_micros(const TS_ACCURACY *a) +{ return a->micros; - } +} -int TS_TST_INFO_set_ordering(TS_TST_INFO *a, int ordering) - { +int +TS_TST_INFO_set_ordering(TS_TST_INFO *a, int ordering) +{ a->ordering = ordering ? 0xFF : 0x00; return 1; - } +} -int TS_TST_INFO_get_ordering(const TS_TST_INFO *a) - { +int +TS_TST_INFO_get_ordering(const TS_TST_INFO *a) +{ return a->ordering ? 1 : 0; - } +} -int TS_TST_INFO_set_nonce(TS_TST_INFO *a, const ASN1_INTEGER *nonce) - { +int +TS_TST_INFO_set_nonce(TS_TST_INFO *a, const ASN1_INTEGER *nonce) +{ ASN1_INTEGER *new_nonce; if (a->nonce == nonce) return 1; new_nonce = ASN1_INTEGER_dup(nonce); - if (new_nonce == NULL) - { + if (new_nonce == NULL) { TSerr(TS_F_TS_TST_INFO_SET_NONCE, ERR_R_MALLOC_FAILURE); return 0; - } + } ASN1_INTEGER_free(a->nonce); a->nonce = new_nonce; return 1; - } +} -const ASN1_INTEGER *TS_TST_INFO_get_nonce(const TS_TST_INFO *a) - { +const ASN1_INTEGER * +TS_TST_INFO_get_nonce(const TS_TST_INFO *a) +{ return a->nonce; - } +} -int TS_TST_INFO_set_tsa(TS_TST_INFO *a, GENERAL_NAME *tsa) - { +int +TS_TST_INFO_set_tsa(TS_TST_INFO *a, GENERAL_NAME *tsa) +{ GENERAL_NAME *new_tsa; if (a->tsa == tsa) return 1; new_tsa = GENERAL_NAME_dup(tsa); - if (new_tsa == NULL) - { + if (new_tsa == NULL) { TSerr(TS_F_TS_TST_INFO_SET_TSA, ERR_R_MALLOC_FAILURE); return 0; - } + } GENERAL_NAME_free(a->tsa); a->tsa = new_tsa; return 1; - } +} -GENERAL_NAME *TS_TST_INFO_get_tsa(TS_TST_INFO *a) - { +GENERAL_NAME * +TS_TST_INFO_get_tsa(TS_TST_INFO *a) +{ return a->tsa; - } +} STACK_OF(X509_EXTENSION) *TS_TST_INFO_get_exts(TS_TST_INFO *a) - { +{ return a->extensions; - } +} -void TS_TST_INFO_ext_free(TS_TST_INFO *a) - { - if (!a) return; +void +TS_TST_INFO_ext_free(TS_TST_INFO *a) +{ + if (!a) + return; sk_X509_EXTENSION_pop_free(a->extensions, X509_EXTENSION_free); a->extensions = NULL; - } +} -int TS_TST_INFO_get_ext_count(TS_TST_INFO *a) - { +int +TS_TST_INFO_get_ext_count(TS_TST_INFO *a) +{ return X509v3_get_ext_count(a->extensions); - } +} -int TS_TST_INFO_get_ext_by_NID(TS_TST_INFO *a, int nid, int lastpos) - { +int +TS_TST_INFO_get_ext_by_NID(TS_TST_INFO *a, int nid, int lastpos) +{ return X509v3_get_ext_by_NID(a->extensions, nid, lastpos); - } +} -int TS_TST_INFO_get_ext_by_OBJ(TS_TST_INFO *a, ASN1_OBJECT *obj, int lastpos) - { +int +TS_TST_INFO_get_ext_by_OBJ(TS_TST_INFO *a, ASN1_OBJECT *obj, int lastpos) +{ return X509v3_get_ext_by_OBJ(a->extensions, obj, lastpos); - } +} -int TS_TST_INFO_get_ext_by_critical(TS_TST_INFO *a, int crit, int lastpos) - { +int +TS_TST_INFO_get_ext_by_critical(TS_TST_INFO *a, int crit, int lastpos) +{ return X509v3_get_ext_by_critical(a->extensions, crit, lastpos); - } - -X509_EXTENSION *TS_TST_INFO_get_ext(TS_TST_INFO *a, int loc) - { - return X509v3_get_ext(a->extensions,loc); - } - -X509_EXTENSION *TS_TST_INFO_delete_ext(TS_TST_INFO *a, int loc) - { - return X509v3_delete_ext(a->extensions,loc); - } - -int TS_TST_INFO_add_ext(TS_TST_INFO *a, X509_EXTENSION *ex, int loc) - { - return X509v3_add_ext(&a->extensions,ex,loc) != NULL; - } - -void *TS_TST_INFO_get_ext_d2i(TS_TST_INFO *a, int nid, int *crit, int *idx) - { +} + +X509_EXTENSION * +TS_TST_INFO_get_ext(TS_TST_INFO *a, int loc) +{ + return X509v3_get_ext(a->extensions, loc); +} + +X509_EXTENSION * +TS_TST_INFO_delete_ext(TS_TST_INFO *a, int loc) +{ + return X509v3_delete_ext(a->extensions, loc); +} + +int +TS_TST_INFO_add_ext(TS_TST_INFO *a, X509_EXTENSION *ex, int loc) +{ + return X509v3_add_ext(&a->extensions, ex, loc) != NULL; +} + +void * +TS_TST_INFO_get_ext_d2i(TS_TST_INFO *a, int nid, int *crit, int *idx) +{ return X509V3_get_d2i(a->extensions, nid, crit, idx); - } +} diff --git a/lib/libcrypto/ts/ts_rsp_verify.c b/lib/libcrypto/ts/ts_rsp_verify.c index 7484b10d608..66e35dab3ac 100644 --- a/lib/libcrypto/ts/ts_rsp_verify.c +++ b/lib/libcrypto/ts/ts_rsp_verify.c @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -65,38 +65,39 @@ /* Private function declarations. */ static int TS_verify_cert(X509_STORE *store, STACK_OF(X509) *untrusted, - X509 *signer, STACK_OF(X509) **chain); + X509 *signer, STACK_OF(X509) **chain); static int TS_check_signing_certs(PKCS7_SIGNER_INFO *si, STACK_OF(X509) *chain); static ESS_SIGNING_CERT *ESS_get_signing_cert(PKCS7_SIGNER_INFO *si); static int TS_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert); static int TS_issuer_serial_cmp(ESS_ISSUER_SERIAL *is, X509_CINF *cinfo); -static int int_TS_RESP_verify_token(TS_VERIFY_CTX *ctx, - PKCS7 *token, TS_TST_INFO *tst_info); +static int int_TS_RESP_verify_token(TS_VERIFY_CTX *ctx, + PKCS7 *token, TS_TST_INFO *tst_info); static int TS_check_status_info(TS_RESP *response); static char *TS_get_status_text(STACK_OF(ASN1_UTF8STRING) *text); static int TS_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info); static int TS_compute_imprint(BIO *data, TS_TST_INFO *tst_info, - X509_ALGOR **md_alg, - unsigned char **imprint, unsigned *imprint_len); -static int TS_check_imprints(X509_ALGOR *algor_a, - unsigned char *imprint_a, unsigned len_a, - TS_TST_INFO *tst_info); + X509_ALGOR **md_alg, + unsigned char **imprint, unsigned *imprint_len); +static int TS_check_imprints(X509_ALGOR *algor_a, + unsigned char *imprint_a, unsigned len_a, + TS_TST_INFO *tst_info); static int TS_check_nonces(const ASN1_INTEGER *a, TS_TST_INFO *tst_info); static int TS_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer); static int TS_find_name(STACK_OF(GENERAL_NAME) *gen_names, GENERAL_NAME *name); /* * Local mapping between response codes and descriptions. - * Don't forget to change TS_STATUS_BUF_SIZE when modifying + * Don't forget to change TS_STATUS_BUF_SIZE when modifying * the elements of this array. */ -static const char *TS_status_text[] = - { "granted", - "grantedWithMods", - "rejection", - "waiting", - "revocationWarning", - "revocationNotification" }; +static const char *TS_status_text[] = { + "granted", + "grantedWithMods", + "rejection", + "waiting", + "revocationWarning", + "revocationNotification" +}; #define TS_STATUS_TEXT_SIZE (sizeof(TS_status_text)/sizeof(*TS_status_text)) @@ -106,19 +107,19 @@ static const char *TS_status_text[] = */ #define TS_STATUS_BUF_SIZE 256 -static struct - { +static struct { int code; const char *text; - } TS_failure_info[] = - { { TS_INFO_BAD_ALG, "badAlg" }, - { TS_INFO_BAD_REQUEST, "badRequest" }, - { TS_INFO_BAD_DATA_FORMAT, "badDataFormat" }, - { TS_INFO_TIME_NOT_AVAILABLE, "timeNotAvailable" }, - { TS_INFO_UNACCEPTED_POLICY, "unacceptedPolicy" }, - { TS_INFO_UNACCEPTED_EXTENSION, "unacceptedExtension" }, - { TS_INFO_ADD_INFO_NOT_AVAILABLE, "addInfoNotAvailable" }, - { TS_INFO_SYSTEM_FAILURE, "systemFailure" } }; +} TS_failure_info[] = { + { TS_INFO_BAD_ALG, "badAlg" }, + { TS_INFO_BAD_REQUEST, "badRequest" }, + { TS_INFO_BAD_DATA_FORMAT, "badDataFormat" }, + { TS_INFO_TIME_NOT_AVAILABLE, "timeNotAvailable" }, + { TS_INFO_UNACCEPTED_POLICY, "unacceptedPolicy" }, + { TS_INFO_UNACCEPTED_EXTENSION, "unacceptedExtension" }, + { TS_INFO_ADD_INFO_NOT_AVAILABLE, "addInfoNotAvailable" }, + { TS_INFO_SYSTEM_FAILURE, "systemFailure" } +}; #define TS_FAILURE_INFO_SIZE (sizeof(TS_failure_info) / \ sizeof(*TS_failure_info)) @@ -137,9 +138,10 @@ static struct * - Verify the signature value. * - Returns the signer certificate in 'signer', if 'signer' is not NULL. */ -int TS_RESP_verify_signature(PKCS7 *token, STACK_OF(X509) *certs, - X509_STORE *store, X509 **signer_out) - { +int +TS_RESP_verify_signature(PKCS7 *token, STACK_OF(X509) *certs, + X509_STORE *store, X509 **signer_out) +{ STACK_OF(PKCS7_SIGNER_INFO) *sinfos = NULL; PKCS7_SIGNER_INFO *si; STACK_OF(X509) *signers = NULL; @@ -150,87 +152,86 @@ int TS_RESP_verify_signature(PKCS7 *token, STACK_OF(X509) *certs, BIO *p7bio = NULL; /* Some sanity checks first. */ - if (!token) - { + if (!token) { TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_INVALID_NULL_POINTER); goto err; - } + } /* Check for the correct content type */ - if(!PKCS7_type_is_signed(token)) - { + if (!PKCS7_type_is_signed(token)) { TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_WRONG_CONTENT_TYPE); goto err; - } + } /* Check if there is one and only one signer. */ sinfos = PKCS7_get_signer_info(token); - if (!sinfos || sk_PKCS7_SIGNER_INFO_num(sinfos) != 1) - { + if (!sinfos || sk_PKCS7_SIGNER_INFO_num(sinfos) != 1) { TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, - TS_R_THERE_MUST_BE_ONE_SIGNER); + TS_R_THERE_MUST_BE_ONE_SIGNER); goto err; - } + } si = sk_PKCS7_SIGNER_INFO_value(sinfos, 0); /* Check for no content: no data to verify signature. */ - if (PKCS7_get_detached(token)) - { + if (PKCS7_get_detached(token)) { TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_NO_CONTENT); goto err; - } - + } + /* Get hold of the signer certificate, search only internal certificates if it was requested. */ signers = PKCS7_get0_signers(token, certs, 0); - if (!signers || sk_X509_num(signers) != 1) goto err; + if (!signers || sk_X509_num(signers) != 1) + goto err; signer = sk_X509_value(signers, 0); /* Now verify the certificate. */ - if (!TS_verify_cert(store, certs, signer, &chain)) goto err; + if (!TS_verify_cert(store, certs, signer, &chain)) + goto err; /* Check if the signer certificate is consistent with the ESS extension. */ - if (!TS_check_signing_certs(si, chain)) goto err; + if (!TS_check_signing_certs(si, chain)) + goto err; /* Creating the message digest. */ p7bio = PKCS7_dataInit(token, NULL); /* We now have to 'read' from p7bio to calculate digests etc. */ - while ((i = BIO_read(p7bio,buf,sizeof(buf))) > 0); + while ((i = BIO_read(p7bio, buf, sizeof(buf))) > 0) + ; /* Verifying the signature. */ j = PKCS7_signatureVerify(p7bio, token, si, signer); - if (j <= 0) - { + if (j <= 0) { TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_SIGNATURE_FAILURE); goto err; - } + } /* Return the signer certificate if needed. */ - if (signer_out) - { + if (signer_out) { *signer_out = signer; CRYPTO_add(&signer->references, 1, CRYPTO_LOCK_X509); - } + } ret = 1; - err: +err: BIO_free_all(p7bio); sk_X509_pop_free(chain, X509_free); sk_X509_free(signers); return ret; - } +} /* * The certificate chain is returned in chain. Caller is responsible for * freeing the vector. */ -static int TS_verify_cert(X509_STORE *store, STACK_OF(X509) *untrusted, - X509 *signer, STACK_OF(X509) **chain) - { +static int +TS_verify_cert(X509_STORE *store, STACK_OF(X509) *untrusted, X509 *signer, + STACK_OF(X509) **chain) +{ X509_STORE_CTX cert_ctx; int i; int ret = 1; @@ -240,110 +241,115 @@ static int TS_verify_cert(X509_STORE *store, STACK_OF(X509) *untrusted, X509_STORE_CTX_init(&cert_ctx, store, signer, untrusted); X509_STORE_CTX_set_purpose(&cert_ctx, X509_PURPOSE_TIMESTAMP_SIGN); i = X509_verify_cert(&cert_ctx); - if (i <= 0) - { + if (i <= 0) { int j = X509_STORE_CTX_get_error(&cert_ctx); TSerr(TS_F_TS_VERIFY_CERT, TS_R_CERTIFICATE_VERIFY_ERROR); ERR_add_error_data(2, "Verify error:", - X509_verify_cert_error_string(j)); + X509_verify_cert_error_string(j)); ret = 0; - } - else - { + } else { /* Get a copy of the certificate chain. */ *chain = X509_STORE_CTX_get1_chain(&cert_ctx); - } + } X509_STORE_CTX_cleanup(&cert_ctx); return ret; - } +} -static int TS_check_signing_certs(PKCS7_SIGNER_INFO *si, STACK_OF(X509) *chain) - { +static int +TS_check_signing_certs(PKCS7_SIGNER_INFO *si, STACK_OF(X509) *chain) +{ ESS_SIGNING_CERT *ss = ESS_get_signing_cert(si); STACK_OF(ESS_CERT_ID) *cert_ids = NULL; X509 *cert; int i = 0; int ret = 0; - if (!ss) goto err; + if (!ss) + goto err; cert_ids = ss->cert_ids; /* The signer certificate must be the first in cert_ids. */ cert = sk_X509_value(chain, 0); - if (TS_find_cert(cert_ids, cert) != 0) goto err; - + if (TS_find_cert(cert_ids, cert) != 0) + goto err; + /* Check the other certificates of the chain if there are more than one certificate ids in cert_ids. */ - if (sk_ESS_CERT_ID_num(cert_ids) > 1) - { + if (sk_ESS_CERT_ID_num(cert_ids) > 1) { /* All the certificates of the chain must be in cert_ids. */ - for (i = 1; i < sk_X509_num(chain); ++i) - { + for (i = 1; i < sk_X509_num(chain); ++i) { cert = sk_X509_value(chain, i); - if (TS_find_cert(cert_ids, cert) < 0) goto err; - } + if (TS_find_cert(cert_ids, cert) < 0) + goto err; } + } ret = 1; - err: + +err: if (!ret) - TSerr(TS_F_TS_CHECK_SIGNING_CERTS, - TS_R_ESS_SIGNING_CERTIFICATE_ERROR); + TSerr(TS_F_TS_CHECK_SIGNING_CERTS, + TS_R_ESS_SIGNING_CERTIFICATE_ERROR); ESS_SIGNING_CERT_free(ss); return ret; - } +} -static ESS_SIGNING_CERT *ESS_get_signing_cert(PKCS7_SIGNER_INFO *si) - { +static ESS_SIGNING_CERT * +ESS_get_signing_cert(PKCS7_SIGNER_INFO *si) +{ ASN1_TYPE *attr; const unsigned char *p; - attr = PKCS7_get_signed_attribute(si, - NID_id_smime_aa_signingCertificate); - if (!attr) return NULL; + + attr = PKCS7_get_signed_attribute(si, + NID_id_smime_aa_signingCertificate); + if (!attr) + return NULL; p = attr->value.sequence->data; return d2i_ESS_SIGNING_CERT(NULL, &p, attr->value.sequence->length); - } +} /* Returns < 0 if certificate is not found, certificate index otherwise. */ -static int TS_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert) - { +static int +TS_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert) +{ int i; - if (!cert_ids || !cert) return -1; + if (!cert_ids || !cert) + return -1; /* Recompute SHA1 hash of certificate if necessary (side effect). */ X509_check_purpose(cert, -1, 0); /* Look for cert in the cert_ids vector. */ - for (i = 0; i < sk_ESS_CERT_ID_num(cert_ids); ++i) - { + for (i = 0; i < sk_ESS_CERT_ID_num(cert_ids); ++i) { ESS_CERT_ID *cid = sk_ESS_CERT_ID_value(cert_ids, i); /* Check the SHA-1 hash first. */ - if (cid->hash->length == sizeof(cert->sha1_hash) - && !memcmp(cid->hash->data, cert->sha1_hash, - sizeof(cert->sha1_hash))) - { + if (cid->hash->length == sizeof(cert->sha1_hash) && + !memcmp(cid->hash->data, cert->sha1_hash, + sizeof(cert->sha1_hash))) { /* Check the issuer/serial as well if specified. */ ESS_ISSUER_SERIAL *is = cid->issuer_serial; if (!is || !TS_issuer_serial_cmp(is, cert->cert_info)) return i; - } } - - return -1; } -static int TS_issuer_serial_cmp(ESS_ISSUER_SERIAL *is, X509_CINF *cinfo) - { + return -1; +} + +static int +TS_issuer_serial_cmp(ESS_ISSUER_SERIAL *is, X509_CINF *cinfo) +{ GENERAL_NAME *issuer; - if (!is || !cinfo || sk_GENERAL_NAME_num(is->issuer) != 1) return -1; + if (!is || !cinfo || sk_GENERAL_NAME_num(is->issuer) != 1) + return -1; /* Check the issuer first. It must be a directory name. */ issuer = sk_GENERAL_NAME_value(is->issuer, 0); - if (issuer->type != GEN_DIRNAME - || X509_NAME_cmp(issuer->d.dirn, cinfo->issuer)) + if (issuer->type != GEN_DIRNAME || + X509_NAME_cmp(issuer->d.dirn, cinfo->issuer)) return -1; /* Check the serial number, too. */ @@ -351,50 +357,54 @@ static int TS_issuer_serial_cmp(ESS_ISSUER_SERIAL *is, X509_CINF *cinfo) return -1; return 0; - } +} /* - * Verifies whether 'response' contains a valid response with regards + * Verifies whether 'response' contains a valid response with regards * to the settings of the context: * - Gives an error message if the TS_TST_INFO is not present. * - Calls _TS_RESP_verify_token to verify the token content. */ -int TS_RESP_verify_response(TS_VERIFY_CTX *ctx, TS_RESP *response) - { +int +TS_RESP_verify_response(TS_VERIFY_CTX *ctx, TS_RESP *response) +{ PKCS7 *token = TS_RESP_get_token(response); TS_TST_INFO *tst_info = TS_RESP_get_tst_info(response); int ret = 0; /* Check if we have a successful TS_TST_INFO object in place. */ - if (!TS_check_status_info(response)) goto err; + if (!TS_check_status_info(response)) + goto err; /* Check the contents of the time stamp token. */ if (!int_TS_RESP_verify_token(ctx, token, tst_info)) goto err; ret = 1; - err: + +err: return ret; - } +} /* * Tries to extract a TS_TST_INFO structure from the PKCS7 token and * calls the internal int_TS_RESP_verify_token function for verifying it. */ -int TS_RESP_verify_token(TS_VERIFY_CTX *ctx, PKCS7 *token) - { +int +TS_RESP_verify_token(TS_VERIFY_CTX *ctx, PKCS7 *token) +{ TS_TST_INFO *tst_info = PKCS7_to_TS_TST_INFO(token); int ret = 0; - if (tst_info) - { + + if (tst_info) { ret = int_TS_RESP_verify_token(ctx, token, tst_info); TS_TST_INFO_free(tst_info); - } - return ret; } + return ret; +} /* - * Verifies whether the 'token' contains a valid time stamp token + * Verifies whether the 'token' contains a valid time stamp token * with regards to the settings of the context. Only those checks are * carried out that are specified in the context: * - Verifies the signature of the TS_TST_INFO. @@ -405,9 +415,10 @@ int TS_RESP_verify_token(TS_VERIFY_CTX *ctx, PKCS7 *token) * - Check if the TSA name matches the signer. * - Check if the TSA name is the expected TSA. */ -static int int_TS_RESP_verify_token(TS_VERIFY_CTX *ctx, - PKCS7 *token, TS_TST_INFO *tst_info) - { +static int +int_TS_RESP_verify_token(TS_VERIFY_CTX *ctx, PKCS7 *token, + TS_TST_INFO *tst_info) +{ X509 *signer = NULL; GENERAL_NAME *tsa_name = TS_TST_INFO_get_tsa(tst_info); X509_ALGOR *md_alg = NULL; @@ -416,68 +427,66 @@ static int int_TS_RESP_verify_token(TS_VERIFY_CTX *ctx, int ret = 0; /* Verify the signature. */ - if ((ctx->flags & TS_VFY_SIGNATURE) - && !TS_RESP_verify_signature(token, ctx->certs, ctx->store, - &signer)) + if ((ctx->flags & TS_VFY_SIGNATURE) && + !TS_RESP_verify_signature(token, ctx->certs, ctx->store, &signer)) goto err; - + /* Check version number of response. */ - if ((ctx->flags & TS_VFY_VERSION) - && TS_TST_INFO_get_version(tst_info) != 1) - { + if ((ctx->flags & TS_VFY_VERSION) && + TS_TST_INFO_get_version(tst_info) != 1) { TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_UNSUPPORTED_VERSION); goto err; - } + } /* Check policies. */ - if ((ctx->flags & TS_VFY_POLICY) - && !TS_check_policy(ctx->policy, tst_info)) + if ((ctx->flags & TS_VFY_POLICY) && + !TS_check_policy(ctx->policy, tst_info)) goto err; - + /* Check message imprints. */ - if ((ctx->flags & TS_VFY_IMPRINT) - && !TS_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len, - tst_info)) + if ((ctx->flags & TS_VFY_IMPRINT) && + !TS_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len, + tst_info)) goto err; /* Compute and check message imprints. */ - if ((ctx->flags & TS_VFY_DATA) - && (!TS_compute_imprint(ctx->data, tst_info, - &md_alg, &imprint, &imprint_len) - || !TS_check_imprints(md_alg, imprint, imprint_len, tst_info))) + if ((ctx->flags & TS_VFY_DATA) && + (!TS_compute_imprint(ctx->data, tst_info, + &md_alg, &imprint, &imprint_len) || + !TS_check_imprints(md_alg, imprint, imprint_len, tst_info))) goto err; /* Check nonces. */ - if ((ctx->flags & TS_VFY_NONCE) - && !TS_check_nonces(ctx->nonce, tst_info)) + if ((ctx->flags & TS_VFY_NONCE) && + !TS_check_nonces(ctx->nonce, tst_info)) goto err; /* Check whether TSA name and signer certificate match. */ - if ((ctx->flags & TS_VFY_SIGNER) - && tsa_name && !TS_check_signer_name(tsa_name, signer)) - { + if ((ctx->flags & TS_VFY_SIGNER) && + tsa_name && !TS_check_signer_name(tsa_name, signer)) { TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_NAME_MISMATCH); goto err; - } + } /* Check whether the TSA is the expected one. */ - if ((ctx->flags & TS_VFY_TSA_NAME) - && !TS_check_signer_name(ctx->tsa_name, signer)) - { + if ((ctx->flags & TS_VFY_TSA_NAME) && + !TS_check_signer_name(ctx->tsa_name, signer)) { TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_UNTRUSTED); goto err; - } + } ret = 1; - err: + +err: X509_free(signer); X509_ALGOR_free(md_alg); free(imprint); return ret; - } +} -static int TS_check_status_info(TS_RESP *response) - { +static int +TS_check_status_info(TS_RESP *response) +{ TS_STATUS_INFO *info = TS_RESP_get_status_info(response); long status = ASN1_INTEGER_get(info->status); const char *status_text = NULL; @@ -485,7 +494,8 @@ static int TS_check_status_info(TS_RESP *response) char failure_text[TS_STATUS_BUF_SIZE] = ""; /* Check if everything went fine. */ - if (status == 0 || status == 1) return 1; + if (status == 0 || status == 1) + return 1; /* There was an error, get the description in status_text. */ if (0 <= status && status < (long)TS_STATUS_TEXT_SIZE) @@ -494,93 +504,88 @@ static int TS_check_status_info(TS_RESP *response) status_text = "unknown code"; /* Set the embedded_status_text to the returned description. */ - if (sk_ASN1_UTF8STRING_num(info->text) > 0 - && !(embedded_status_text = TS_get_status_text(info->text))) + if (sk_ASN1_UTF8STRING_num(info->text) > 0 && + !(embedded_status_text = TS_get_status_text(info->text))) return 0; - + /* Filling in failure_text with the failure information. */ - if (info->failure_info) - { + if (info->failure_info) { int i; int first = 1; - for (i = 0; i < (int)TS_FAILURE_INFO_SIZE; ++i) - { + for (i = 0; i < (int)TS_FAILURE_INFO_SIZE; ++i) { if (ASN1_BIT_STRING_get_bit(info->failure_info, - TS_failure_info[i].code)) - { + TS_failure_info[i].code)) { if (!first) strlcat(failure_text, ",", - TS_STATUS_BUF_SIZE); + TS_STATUS_BUF_SIZE); else first = 0; strlcat(failure_text, TS_failure_info[i].text, - TS_STATUS_BUF_SIZE); - } + TS_STATUS_BUF_SIZE); } } + } if (failure_text[0] == '\0') strlcpy(failure_text, "unspecified", TS_STATUS_BUF_SIZE); /* Making up the error string. */ TSerr(TS_F_TS_CHECK_STATUS_INFO, TS_R_NO_TIME_STAMP_TOKEN); ERR_add_error_data(6, - "status code: ", status_text, - ", status text: ", embedded_status_text ? - embedded_status_text : "unspecified", - ", failure codes: ", failure_text); + "status code: ", status_text, + ", status text: ", embedded_status_text ? + embedded_status_text : "unspecified", + ", failure codes: ", failure_text); free(embedded_status_text); return 0; - } +} -static char *TS_get_status_text(STACK_OF(ASN1_UTF8STRING) *text) - { +static char * +TS_get_status_text(STACK_OF(ASN1_UTF8STRING) *text) +{ int i; unsigned int length = 0; char *result = NULL; /* Determine length first. */ - for (i = 0; i < sk_ASN1_UTF8STRING_num(text); ++i) - { + for (i = 0; i < sk_ASN1_UTF8STRING_num(text); ++i) { ASN1_UTF8STRING *current = sk_ASN1_UTF8STRING_value(text, i); length += ASN1_STRING_length(current); length += 1; /* separator character */ - } + } /* Allocate memory (closing '\0' included). */ - if (!(result = malloc(length))) - { + if (!(result = malloc(length))) { TSerr(TS_F_TS_GET_STATUS_TEXT, ERR_R_MALLOC_FAILURE); return NULL; - } + } /* Concatenate the descriptions. */ result[0] = '\0'; - for (i = 0; i < sk_ASN1_UTF8STRING_num(text); ++i) - { + for (i = 0; i < sk_ASN1_UTF8STRING_num(text); ++i) { ASN1_UTF8STRING *current = sk_ASN1_UTF8STRING_value(text, i); if (i > 0) strlcat(result, "/", length); strlcat(result, ASN1_STRING_data(current), length); - } - return result; } + return result; +} -static int TS_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info) - { +static int +TS_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info) +{ ASN1_OBJECT *resp_oid = TS_TST_INFO_get_policy_id(tst_info); - if (OBJ_cmp(req_oid, resp_oid) != 0) - { + if (OBJ_cmp(req_oid, resp_oid) != 0) { TSerr(TS_F_TS_CHECK_POLICY, TS_R_POLICY_MISMATCH); return 0; - } + } return 1; - } +} -static int TS_compute_imprint(BIO *data, TS_TST_INFO *tst_info, - X509_ALGOR **md_alg, - unsigned char **imprint, unsigned *imprint_len) - { +static int +TS_compute_imprint(BIO *data, TS_TST_INFO *tst_info, X509_ALGOR **md_alg, + unsigned char **imprint, unsigned *imprint_len) +{ TS_MSG_IMPRINT *msg_imprint = TS_TST_INFO_get_msg_imprint(tst_info); X509_ALGOR *md_alg_resp = TS_MSG_IMPRINT_get_algo(msg_imprint); const EVP_MD *md; @@ -592,136 +597,136 @@ static int TS_compute_imprint(BIO *data, TS_TST_INFO *tst_info, *imprint = NULL; /* Return the MD algorithm of the response. */ - if (!(*md_alg = X509_ALGOR_dup(md_alg_resp))) goto err; + if (!(*md_alg = X509_ALGOR_dup(md_alg_resp))) + goto err; /* Getting the MD object. */ - if (!(md = EVP_get_digestbyobj((*md_alg)->algorithm))) - { + if (!(md = EVP_get_digestbyobj((*md_alg)->algorithm))) { TSerr(TS_F_TS_COMPUTE_IMPRINT, TS_R_UNSUPPORTED_MD_ALGORITHM); goto err; - } + } /* Compute message digest. */ length = EVP_MD_size(md); if (length < 0) - goto err; + goto err; *imprint_len = length; - if (!(*imprint = malloc(*imprint_len))) - { + if (!(*imprint = malloc(*imprint_len))) { TSerr(TS_F_TS_COMPUTE_IMPRINT, ERR_R_MALLOC_FAILURE); goto err; - } + } if (!EVP_DigestInit(&md_ctx, md)) goto err; - while ((length = BIO_read(data, buffer, sizeof(buffer))) > 0) - { + while ((length = BIO_read(data, buffer, sizeof(buffer))) > 0) { if (!EVP_DigestUpdate(&md_ctx, buffer, length)) goto err; - } + } if (!EVP_DigestFinal(&md_ctx, *imprint, NULL)) goto err; return 1; - err: + +err: X509_ALGOR_free(*md_alg); free(*imprint); *imprint = NULL; *imprint_len = 0; return 0; - } +} -static int TS_check_imprints(X509_ALGOR *algor_a, - unsigned char *imprint_a, unsigned len_a, - TS_TST_INFO *tst_info) - { +static int +TS_check_imprints(X509_ALGOR *algor_a, unsigned char *imprint_a, unsigned len_a, + TS_TST_INFO *tst_info) +{ TS_MSG_IMPRINT *b = TS_TST_INFO_get_msg_imprint(tst_info); X509_ALGOR *algor_b = TS_MSG_IMPRINT_get_algo(b); int ret = 0; /* algor_a is optional. */ - if (algor_a) - { + if (algor_a) { /* Compare algorithm OIDs. */ - if (OBJ_cmp(algor_a->algorithm, algor_b->algorithm)) goto err; + if (OBJ_cmp(algor_a->algorithm, algor_b->algorithm)) + goto err; /* The parameter must be NULL in both. */ - if ((algor_a->parameter - && ASN1_TYPE_get(algor_a->parameter) != V_ASN1_NULL) - || (algor_b->parameter - && ASN1_TYPE_get(algor_b->parameter) != V_ASN1_NULL)) + if ((algor_a->parameter && + ASN1_TYPE_get(algor_a->parameter) != V_ASN1_NULL) || + (algor_b->parameter && + ASN1_TYPE_get(algor_b->parameter) != V_ASN1_NULL)) goto err; - } + } /* Compare octet strings. */ ret = len_a == (unsigned) ASN1_STRING_length(b->hashed_msg) && - memcmp(imprint_a, ASN1_STRING_data(b->hashed_msg), len_a) == 0; - err: + memcmp(imprint_a, ASN1_STRING_data(b->hashed_msg), len_a) == 0; + +err: if (!ret) TSerr(TS_F_TS_CHECK_IMPRINTS, TS_R_MESSAGE_IMPRINT_MISMATCH); return ret; - } +} -static int TS_check_nonces(const ASN1_INTEGER *a, TS_TST_INFO *tst_info) - { +static int +TS_check_nonces(const ASN1_INTEGER *a, TS_TST_INFO *tst_info) +{ const ASN1_INTEGER *b = TS_TST_INFO_get_nonce(tst_info); /* Error if nonce is missing. */ - if (!b) - { + if (!b) { TSerr(TS_F_TS_CHECK_NONCES, TS_R_NONCE_NOT_RETURNED); return 0; - } + } /* No error if a nonce is returned without being requested. */ - if (ASN1_INTEGER_cmp(a, b) != 0) - { + if (ASN1_INTEGER_cmp(a, b) != 0) { TSerr(TS_F_TS_CHECK_NONCES, TS_R_NONCE_MISMATCH); return 0; - } + } return 1; - } +} /* Check if the specified TSA name matches either the subject or one of the subject alternative names of the TSA certificate. */ -static int TS_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer) - { +static int +TS_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer) +{ STACK_OF(GENERAL_NAME) *gen_names = NULL; int idx = -1; int found = 0; /* Check the subject name first. */ - if (tsa_name->type == GEN_DIRNAME - && X509_name_cmp(tsa_name->d.dirn, signer->cert_info->subject) == 0) + if (tsa_name->type == GEN_DIRNAME && + X509_name_cmp(tsa_name->d.dirn, signer->cert_info->subject) == 0) return 1; /* Check all the alternative names. */ gen_names = X509_get_ext_d2i(signer, NID_subject_alt_name, - NULL, &idx); - while (gen_names != NULL - && !(found = TS_find_name(gen_names, tsa_name) >= 0)) - { + NULL, &idx); + while (gen_names != NULL && + !(found = TS_find_name(gen_names, tsa_name) >= 0)) { /* Get the next subject alternative name, although there should be no more than one. */ GENERAL_NAMES_free(gen_names); gen_names = X509_get_ext_d2i(signer, NID_subject_alt_name, - NULL, &idx); - } - if (gen_names) GENERAL_NAMES_free(gen_names); - - return found; + NULL, &idx); } + if (gen_names) + GENERAL_NAMES_free(gen_names); + + return found; +} /* Returns 1 if name is in gen_names, 0 otherwise. */ -static int TS_find_name(STACK_OF(GENERAL_NAME) *gen_names, GENERAL_NAME *name) - { +static int +TS_find_name(STACK_OF(GENERAL_NAME) *gen_names, GENERAL_NAME *name) +{ int i, found; for (i = 0, found = 0; !found && i < sk_GENERAL_NAME_num(gen_names); - ++i) - { + ++i) { GENERAL_NAME *current = sk_GENERAL_NAME_value(gen_names, i); found = GENERAL_NAME_cmp(current, name) == 0; - } - return found ? i - 1 : -1; } + return found ? i - 1 : -1; +} diff --git a/lib/libcrypto/ts/ts_verify_ctx.c b/lib/libcrypto/ts/ts_verify_ctx.c index 629107aeec2..3fc772678cc 100644 --- a/lib/libcrypto/ts/ts_verify_ctx.c +++ b/lib/libcrypto/ts/ts_verify_ctx.c @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -60,34 +60,40 @@ #include #include -TS_VERIFY_CTX *TS_VERIFY_CTX_new(void) - { - TS_VERIFY_CTX *ctx = - (TS_VERIFY_CTX *) malloc(sizeof(TS_VERIFY_CTX)); +TS_VERIFY_CTX * +TS_VERIFY_CTX_new(void) +{ + TS_VERIFY_CTX *ctx = (TS_VERIFY_CTX *) malloc(sizeof(TS_VERIFY_CTX)); + if (ctx) memset(ctx, 0, sizeof(TS_VERIFY_CTX)); else TSerr(TS_F_TS_VERIFY_CTX_NEW, ERR_R_MALLOC_FAILURE); return ctx; - } +} -void TS_VERIFY_CTX_init(TS_VERIFY_CTX *ctx) - { +void +TS_VERIFY_CTX_init(TS_VERIFY_CTX *ctx) +{ OPENSSL_assert(ctx != NULL); memset(ctx, 0, sizeof(TS_VERIFY_CTX)); - } +} -void TS_VERIFY_CTX_free(TS_VERIFY_CTX *ctx) - { - if (!ctx) return; +void +TS_VERIFY_CTX_free(TS_VERIFY_CTX *ctx) +{ + if (!ctx) + return; TS_VERIFY_CTX_cleanup(ctx); free(ctx); - } +} -void TS_VERIFY_CTX_cleanup(TS_VERIFY_CTX *ctx) - { - if (!ctx) return; +void +TS_VERIFY_CTX_cleanup(TS_VERIFY_CTX *ctx) +{ + if (!ctx) + return; X509_STORE_free(ctx->store); sk_X509_pop_free(ctx->certs, X509_free); @@ -96,7 +102,7 @@ void TS_VERIFY_CTX_cleanup(TS_VERIFY_CTX *ctx) X509_ALGOR_free(ctx->md_alg); free(ctx->imprint); - + BIO_free_all(ctx->data); ASN1_INTEGER_free(ctx->nonce); @@ -104,10 +110,11 @@ void TS_VERIFY_CTX_cleanup(TS_VERIFY_CTX *ctx) GENERAL_NAME_free(ctx->tsa_name); TS_VERIFY_CTX_init(ctx); - } +} -TS_VERIFY_CTX *TS_REQ_to_TS_VERIFY_CTX(TS_REQ *req, TS_VERIFY_CTX *ctx) - { +TS_VERIFY_CTX * +TS_REQ_to_TS_VERIFY_CTX(TS_REQ *req, TS_VERIFY_CTX *ctx) +{ TS_VERIFY_CTX *ret = ctx; ASN1_OBJECT *policy; TS_MSG_IMPRINT *imprint; @@ -118,42 +125,43 @@ TS_VERIFY_CTX *TS_REQ_to_TS_VERIFY_CTX(TS_REQ *req, TS_VERIFY_CTX *ctx) OPENSSL_assert(req != NULL); if (ret) TS_VERIFY_CTX_cleanup(ret); - else - if (!(ret = TS_VERIFY_CTX_new())) return NULL; + else if (!(ret = TS_VERIFY_CTX_new())) + return NULL; /* Setting flags. */ ret->flags = TS_VFY_ALL_IMPRINT & ~(TS_VFY_TSA_NAME | TS_VFY_SIGNATURE); /* Setting policy. */ - if ((policy = TS_REQ_get_policy_id(req)) != NULL) - { - if (!(ret->policy = OBJ_dup(policy))) goto err; - } - else + if ((policy = TS_REQ_get_policy_id(req)) != NULL) { + if (!(ret->policy = OBJ_dup(policy))) + goto err; + } else ret->flags &= ~TS_VFY_POLICY; /* Setting md_alg, imprint and imprint_len. */ imprint = TS_REQ_get_msg_imprint(req); md_alg = TS_MSG_IMPRINT_get_algo(imprint); - if (!(ret->md_alg = X509_ALGOR_dup(md_alg))) goto err; + if (!(ret->md_alg = X509_ALGOR_dup(md_alg))) + goto err; msg = TS_MSG_IMPRINT_get_msg(imprint); ret->imprint_len = ASN1_STRING_length(msg); - if (!(ret->imprint = malloc(ret->imprint_len))) goto err; + if (!(ret->imprint = malloc(ret->imprint_len))) + goto err; memcpy(ret->imprint, ASN1_STRING_data(msg), ret->imprint_len); /* Setting nonce. */ - if ((nonce = TS_REQ_get_nonce(req)) != NULL) - { - if (!(ret->nonce = ASN1_INTEGER_dup(nonce))) goto err; - } - else + if ((nonce = TS_REQ_get_nonce(req)) != NULL) { + if (!(ret->nonce = ASN1_INTEGER_dup(nonce))) + goto err; + } else ret->flags &= ~TS_VFY_NONCE; return ret; - err: + +err: if (ctx) TS_VERIFY_CTX_cleanup(ctx); else TS_VERIFY_CTX_free(ret); return NULL; - } +} diff --git a/lib/libssl/src/crypto/ts/ts.h b/lib/libssl/src/crypto/ts/ts.h index 88e0111453f..3c5ab727db5 100644 --- a/lib/libssl/src/crypto/ts/ts.h +++ b/lib/libssl/src/crypto/ts/ts.h @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -103,11 +103,10 @@ MessageImprint ::= SEQUENCE { hashedMessage OCTET STRING } */ -typedef struct TS_msg_imprint_st - { +typedef struct TS_msg_imprint_st { X509_ALGOR *hash_algo; ASN1_OCTET_STRING *hashed_msg; - } TS_MSG_IMPRINT; +} TS_MSG_IMPRINT; /* TimeStampReq ::= SEQUENCE { @@ -121,15 +120,14 @@ TimeStampReq ::= SEQUENCE { extensions [0] IMPLICIT Extensions OPTIONAL } */ -typedef struct TS_req_st - { +typedef struct TS_req_st { ASN1_INTEGER *version; TS_MSG_IMPRINT *msg_imprint; ASN1_OBJECT *policy_id; /* OPTIONAL */ ASN1_INTEGER *nonce; /* OPTIONAL */ ASN1_BOOLEAN cert_req; /* DEFAULT FALSE */ STACK_OF(X509_EXTENSION) *extensions; /* [0] OPTIONAL */ - } TS_REQ; +} TS_REQ; /* Accuracy ::= SEQUENCE { @@ -138,12 +136,11 @@ Accuracy ::= SEQUENCE { micros [1] INTEGER (1..999) OPTIONAL } */ -typedef struct TS_accuracy_st - { +typedef struct TS_accuracy_st { ASN1_INTEGER *seconds; ASN1_INTEGER *millis; ASN1_INTEGER *micros; - } TS_ACCURACY; +} TS_ACCURACY; /* TSTInfo ::= SEQUENCE { @@ -165,8 +162,7 @@ TSTInfo ::= SEQUENCE { extensions [1] IMPLICIT Extensions OPTIONAL } */ -typedef struct TS_tst_info_st - { +typedef struct TS_tst_info_st { ASN1_INTEGER *version; ASN1_OBJECT *policy_id; TS_MSG_IMPRINT *msg_imprint; @@ -177,7 +173,7 @@ typedef struct TS_tst_info_st ASN1_INTEGER *nonce; GENERAL_NAME *tsa; STACK_OF(X509_EXTENSION) *extensions; - } TS_TST_INFO; +} TS_TST_INFO; /* PKIStatusInfo ::= SEQUENCE { @@ -212,12 +208,11 @@ PKIFreeText ::= SEQUENCE SIZE (1..MAX) OF UTF8String #define TS_INFO_ADD_INFO_NOT_AVAILABLE 17 #define TS_INFO_SYSTEM_FAILURE 25 -typedef struct TS_status_info_st - { +typedef struct TS_status_info_st { ASN1_INTEGER *status; STACK_OF(ASN1_UTF8STRING) *text; ASN1_BIT_STRING *failure_info; - } TS_STATUS_INFO; +} TS_STATUS_INFO; DECLARE_STACK_OF(ASN1_UTF8STRING) DECLARE_ASN1_SET_OF(ASN1_UTF8STRING) @@ -228,12 +223,11 @@ TimeStampResp ::= SEQUENCE { timeStampToken TimeStampToken OPTIONAL } */ -typedef struct TS_resp_st - { +typedef struct TS_resp_st { TS_STATUS_INFO *status_info; PKCS7 *token; TS_TST_INFO *tst_info; - } TS_RESP; +} TS_RESP; /* The structure below would belong to the ESS component. */ @@ -244,11 +238,10 @@ IssuerSerial ::= SEQUENCE { } */ -typedef struct ESS_issuer_serial - { +typedef struct ESS_issuer_serial { STACK_OF(GENERAL_NAME) *issuer; ASN1_INTEGER *serial; - } ESS_ISSUER_SERIAL; +} ESS_ISSUER_SERIAL; /* ESSCertID ::= SEQUENCE { @@ -257,11 +250,10 @@ ESSCertID ::= SEQUENCE { } */ -typedef struct ESS_cert_id - { +typedef struct ESS_cert_id { ASN1_OCTET_STRING *hash; /* Always SHA-1 digest. */ ESS_ISSUER_SERIAL *issuer_serial; - } ESS_CERT_ID; +} ESS_CERT_ID; DECLARE_STACK_OF(ESS_CERT_ID) DECLARE_ASN1_SET_OF(ESS_CERT_ID) @@ -273,11 +265,10 @@ SigningCertificate ::= SEQUENCE { } */ -typedef struct ESS_signing_cert - { +typedef struct ESS_signing_cert { STACK_OF(ESS_CERT_ID) *cert_ids; STACK_OF(POLICYINFO) *policy_info; - } ESS_SIGNING_CERT; +} ESS_SIGNING_CERT; TS_REQ *TS_REQ_new(void); @@ -296,7 +287,7 @@ TS_MSG_IMPRINT *TS_MSG_IMPRINT_new(void); void TS_MSG_IMPRINT_free(TS_MSG_IMPRINT *a); int i2d_TS_MSG_IMPRINT(const TS_MSG_IMPRINT *a, unsigned char **pp); TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT(TS_MSG_IMPRINT **a, - const unsigned char **pp, long length); + const unsigned char **pp, long length); TS_MSG_IMPRINT *TS_MSG_IMPRINT_dup(TS_MSG_IMPRINT *a); @@ -320,15 +311,15 @@ int i2d_TS_RESP_bio(BIO *fp, TS_RESP *a); TS_STATUS_INFO *TS_STATUS_INFO_new(void); void TS_STATUS_INFO_free(TS_STATUS_INFO *a); int i2d_TS_STATUS_INFO(const TS_STATUS_INFO *a, unsigned char **pp); -TS_STATUS_INFO *d2i_TS_STATUS_INFO(TS_STATUS_INFO **a, - const unsigned char **pp, long length); +TS_STATUS_INFO *d2i_TS_STATUS_INFO(TS_STATUS_INFO **a, + const unsigned char **pp, long length); TS_STATUS_INFO *TS_STATUS_INFO_dup(TS_STATUS_INFO *a); TS_TST_INFO *TS_TST_INFO_new(void); void TS_TST_INFO_free(TS_TST_INFO *a); int i2d_TS_TST_INFO(const TS_TST_INFO *a, unsigned char **pp); TS_TST_INFO *d2i_TS_TST_INFO(TS_TST_INFO **a, const unsigned char **pp, - long length); + long length); TS_TST_INFO *TS_TST_INFO_dup(TS_TST_INFO *a); TS_TST_INFO *d2i_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO **a); @@ -340,30 +331,30 @@ TS_ACCURACY *TS_ACCURACY_new(void); void TS_ACCURACY_free(TS_ACCURACY *a); int i2d_TS_ACCURACY(const TS_ACCURACY *a, unsigned char **pp); TS_ACCURACY *d2i_TS_ACCURACY(TS_ACCURACY **a, const unsigned char **pp, - long length); + long length); TS_ACCURACY *TS_ACCURACY_dup(TS_ACCURACY *a); ESS_ISSUER_SERIAL *ESS_ISSUER_SERIAL_new(void); void ESS_ISSUER_SERIAL_free(ESS_ISSUER_SERIAL *a); int i2d_ESS_ISSUER_SERIAL(const ESS_ISSUER_SERIAL *a, - unsigned char **pp); + unsigned char **pp); ESS_ISSUER_SERIAL *d2i_ESS_ISSUER_SERIAL(ESS_ISSUER_SERIAL **a, - const unsigned char **pp, long length); + const unsigned char **pp, long length); ESS_ISSUER_SERIAL *ESS_ISSUER_SERIAL_dup(ESS_ISSUER_SERIAL *a); ESS_CERT_ID *ESS_CERT_ID_new(void); void ESS_CERT_ID_free(ESS_CERT_ID *a); int i2d_ESS_CERT_ID(const ESS_CERT_ID *a, unsigned char **pp); ESS_CERT_ID *d2i_ESS_CERT_ID(ESS_CERT_ID **a, const unsigned char **pp, - long length); + long length); ESS_CERT_ID *ESS_CERT_ID_dup(ESS_CERT_ID *a); ESS_SIGNING_CERT *ESS_SIGNING_CERT_new(void); void ESS_SIGNING_CERT_free(ESS_SIGNING_CERT *a); -int i2d_ESS_SIGNING_CERT(const ESS_SIGNING_CERT *a, - unsigned char **pp); +int i2d_ESS_SIGNING_CERT(const ESS_SIGNING_CERT *a, + unsigned char **pp); ESS_SIGNING_CERT *d2i_ESS_SIGNING_CERT(ESS_SIGNING_CERT **a, - const unsigned char **pp, long length); + const unsigned char **pp, long length); ESS_SIGNING_CERT *ESS_SIGNING_CERT_dup(ESS_SIGNING_CERT *a); void ERR_load_TS_strings(void); @@ -485,19 +476,18 @@ struct TS_resp_ctx; typedef ASN1_INTEGER *(*TS_serial_cb)(struct TS_resp_ctx *, void *); /* This must return the seconds and microseconds since Jan 1, 1970 in - the sec and usec variables allocated by the caller. + the sec and usec variables allocated by the caller. Return non-zero for success and zero for failure. */ typedef int (*TS_time_cb)(struct TS_resp_ctx *, void *, long *sec, long *usec); /* This must process the given extension. * It can modify the TS_TST_INFO object of the context. - * Return values: !0 (processed), 0 (error, it must set the + * Return values: !0 (processed), 0 (error, it must set the * status info/failure info of the response). */ typedef int (*TS_extension_cb)(struct TS_resp_ctx *, X509_EXTENSION *, void *); -typedef struct TS_resp_ctx - { +typedef struct TS_resp_ctx { X509 *signer_cert; EVP_PKEY *signer_key; STACK_OF(X509) *certs; /* Certs to include in signed data. */ @@ -514,10 +504,10 @@ typedef struct TS_resp_ctx /* Callback functions. */ TS_serial_cb serial_cb; void *serial_cb_data; /* User data for serial_cb. */ - + TS_time_cb time_cb; void *time_cb_data; /* User data for time_cb. */ - + TS_extension_cb extension_cb; void *extension_cb_data; /* User data for extension_cb. */ @@ -525,7 +515,7 @@ typedef struct TS_resp_ctx TS_REQ *request; TS_RESP *response; TS_TST_INFO *tst_info; - } TS_RESP_CTX; +} TS_RESP_CTX; DECLARE_STACK_OF(EVP_MD) DECLARE_ASN1_SET_OF(EVP_MD) @@ -546,23 +536,23 @@ int TS_RESP_CTX_set_def_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *def_policy); /* No additional certs are included in the response by default. */ int TS_RESP_CTX_set_certs(TS_RESP_CTX *ctx, STACK_OF(X509) *certs); -/* Adds a new acceptable policy, only the default policy +/* Adds a new acceptable policy, only the default policy is accepted by default. */ int TS_RESP_CTX_add_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *policy); -/* Adds a new acceptable message digest. Note that no message digests +/* Adds a new acceptable message digest. Note that no message digests are accepted by default. The md argument is shared with the caller. */ int TS_RESP_CTX_add_md(TS_RESP_CTX *ctx, const EVP_MD *md); /* Accuracy is not included by default. */ int TS_RESP_CTX_set_accuracy(TS_RESP_CTX *ctx, - int secs, int millis, int micros); + int secs, int millis, int micros); -/* Clock precision digits, i.e. the number of decimal digits: - '0' means sec, '3' msec, '6' usec, and so on. Default is 0. */ +/* Clock precision digits, i.e. the number of decimal digits: + '0' means sec, '3' msec, '6' usec, and so on. Default is 0. */ int TS_RESP_CTX_set_clock_precision_digits(TS_RESP_CTX *ctx, - unsigned clock_precision_digits); -/* At most we accept usec precision. */ + unsigned clock_precision_digits); +/* At most we accept usec precision. */ #define TS_MAX_CLOCK_PRECISION_DIGITS 6 /* No flags are set by default. */ @@ -574,19 +564,19 @@ void TS_RESP_CTX_set_serial_cb(TS_RESP_CTX *ctx, TS_serial_cb cb, void *data); /* Default callback uses the gettimeofday() and gmtime() system calls. */ void TS_RESP_CTX_set_time_cb(TS_RESP_CTX *ctx, TS_time_cb cb, void *data); -/* Default callback rejects all extensions. The extension callback is called +/* Default callback rejects all extensions. The extension callback is called * when the TS_TST_INFO object is already set up and not signed yet. */ /* FIXME: extension handling is not tested yet. */ -void TS_RESP_CTX_set_extension_cb(TS_RESP_CTX *ctx, - TS_extension_cb cb, void *data); +void TS_RESP_CTX_set_extension_cb(TS_RESP_CTX *ctx, + TS_extension_cb cb, void *data); /* The following methods can be used in the callbacks. */ -int TS_RESP_CTX_set_status_info(TS_RESP_CTX *ctx, - int status, const char *text); +int TS_RESP_CTX_set_status_info(TS_RESP_CTX *ctx, + int status, const char *text); /* Sets the status info only if it is still TS_STATUS_GRANTED. */ -int TS_RESP_CTX_set_status_info_cond(TS_RESP_CTX *ctx, - int status, const char *text); +int TS_RESP_CTX_set_status_info_cond(TS_RESP_CTX *ctx, + int status, const char *text); int TS_RESP_CTX_add_failure_info(TS_RESP_CTX *ctx, int failure); @@ -595,7 +585,7 @@ TS_REQ *TS_RESP_CTX_get_request(TS_RESP_CTX *ctx); TS_TST_INFO *TS_RESP_CTX_get_tst_info(TS_RESP_CTX *ctx); -/* +/* * Creates the signed TS_TST_INFO and puts it in TS_RESP. * In case of errors it sets the status info properly. * Returns NULL only in case of memory allocation/fatal error. @@ -608,7 +598,7 @@ TS_RESP *TS_RESP_create_response(TS_RESP_CTX *ctx, BIO *req_bio); */ int TS_RESP_verify_signature(PKCS7 *token, STACK_OF(X509) *certs, - X509_STORE *store, X509 **signer_out); + X509_STORE *store, X509 **signer_out); /* Context structure for the generic verify method. */ @@ -648,8 +638,7 @@ int TS_RESP_verify_signature(PKCS7 *token, STACK_OF(X509) *certs, | TS_VFY_SIGNER \ | TS_VFY_TSA_NAME) -typedef struct TS_verify_ctx - { +typedef struct TS_verify_ctx { /* Set this to the union of TS_VFY_... flags you want to carry out. */ unsigned flags; @@ -660,7 +649,7 @@ typedef struct TS_verify_ctx /* Must be set only with TS_VFY_POLICY. */ ASN1_OBJECT *policy; - /* Must be set only with TS_VFY_IMPRINT. If md_alg is NULL, + /* Must be set only with TS_VFY_IMPRINT. If md_alg is NULL, the algorithm from the response is used. */ X509_ALGOR *md_alg; unsigned char *imprint; @@ -674,7 +663,7 @@ typedef struct TS_verify_ctx /* Must be set only with TS_VFY_TSA_NAME. */ GENERAL_NAME *tsa_name; - } TS_VERIFY_CTX; +} TS_VERIFY_CTX; int TS_RESP_verify_response(TS_VERIFY_CTX *ctx, TS_RESP *response); int TS_RESP_verify_token(TS_VERIFY_CTX *ctx, PKCS7 *token); @@ -690,7 +679,7 @@ void TS_VERIFY_CTX_init(TS_VERIFY_CTX *ctx); void TS_VERIFY_CTX_free(TS_VERIFY_CTX *ctx); void TS_VERIFY_CTX_cleanup(TS_VERIFY_CTX *ctx); -/* +/* * If ctx is NULL, it allocates and returns a new object, otherwise * it returns ctx. It initialises all the members as follows: * flags = TS_VFY_ALL_IMPRINT & ~(TS_VFY_TSA_NAME | TS_VFY_SIGNATURE) @@ -730,27 +719,27 @@ STACK_OF(X509) *TS_CONF_load_certs(const char *file); EVP_PKEY *TS_CONF_load_key(const char *file, const char *pass); const char *TS_CONF_get_tsa_section(CONF *conf, const char *section); int TS_CONF_set_serial(CONF *conf, const char *section, TS_serial_cb cb, - TS_RESP_CTX *ctx); + TS_RESP_CTX *ctx); int TS_CONF_set_crypto_device(CONF *conf, const char *section, - const char *device); + const char *device); int TS_CONF_set_default_engine(const char *name); int TS_CONF_set_signer_cert(CONF *conf, const char *section, - const char *cert, TS_RESP_CTX *ctx); + const char *cert, TS_RESP_CTX *ctx); int TS_CONF_set_certs(CONF *conf, const char *section, const char *certs, - TS_RESP_CTX *ctx); + TS_RESP_CTX *ctx); int TS_CONF_set_signer_key(CONF *conf, const char *section, - const char *key, const char *pass, TS_RESP_CTX *ctx); + const char *key, const char *pass, TS_RESP_CTX *ctx); int TS_CONF_set_def_policy(CONF *conf, const char *section, - const char *policy, TS_RESP_CTX *ctx); + const char *policy, TS_RESP_CTX *ctx); int TS_CONF_set_policies(CONF *conf, const char *section, TS_RESP_CTX *ctx); int TS_CONF_set_digests(CONF *conf, const char *section, TS_RESP_CTX *ctx); int TS_CONF_set_accuracy(CONF *conf, const char *section, TS_RESP_CTX *ctx); int TS_CONF_set_clock_precision_digits(CONF *conf, const char *section, - TS_RESP_CTX *ctx); + TS_RESP_CTX *ctx); int TS_CONF_set_ordering(CONF *conf, const char *section, TS_RESP_CTX *ctx); int TS_CONF_set_tsa_name(CONF *conf, const char *section, TS_RESP_CTX *ctx); int TS_CONF_set_ess_cert_id_chain(CONF *conf, const char *section, - TS_RESP_CTX *ctx); + TS_RESP_CTX *ctx); /* -------------------------------------------------- */ /* BEGIN ERROR CODES */ diff --git a/lib/libssl/src/crypto/ts/ts_asn1.c b/lib/libssl/src/crypto/ts/ts_asn1.c index 40b730c5e2e..9e16b01f937 100644 --- a/lib/libssl/src/crypto/ts/ts_asn1.c +++ b/lib/libssl/src/crypto/ts/ts_asn1.c @@ -9,7 +9,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -66,27 +66,35 @@ ASN1_SEQUENCE(TS_MSG_IMPRINT) = { IMPLEMENT_ASN1_FUNCTIONS_const(TS_MSG_IMPRINT) IMPLEMENT_ASN1_DUP_FUNCTION(TS_MSG_IMPRINT) + #ifndef OPENSSL_NO_BIO -TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_bio(BIO *bp, TS_MSG_IMPRINT **a) - { - return ASN1_d2i_bio_of(TS_MSG_IMPRINT, TS_MSG_IMPRINT_new, d2i_TS_MSG_IMPRINT, bp, a); - } +TS_MSG_IMPRINT * +d2i_TS_MSG_IMPRINT_bio(BIO *bp, TS_MSG_IMPRINT **a) +{ + return ASN1_d2i_bio_of(TS_MSG_IMPRINT, TS_MSG_IMPRINT_new, + d2i_TS_MSG_IMPRINT, bp, a); +} -int i2d_TS_MSG_IMPRINT_bio(BIO *bp, TS_MSG_IMPRINT *a) +int +i2d_TS_MSG_IMPRINT_bio(BIO *bp, TS_MSG_IMPRINT *a) { return ASN1_i2d_bio_of_const(TS_MSG_IMPRINT, i2d_TS_MSG_IMPRINT, bp, a); } #endif + #ifndef OPENSSL_NO_FP_API -TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT **a) - { - return ASN1_d2i_fp_of(TS_MSG_IMPRINT, TS_MSG_IMPRINT_new, d2i_TS_MSG_IMPRINT, fp, a); - } +TS_MSG_IMPRINT * +d2i_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT **a) +{ + return ASN1_d2i_fp_of(TS_MSG_IMPRINT, TS_MSG_IMPRINT_new, + d2i_TS_MSG_IMPRINT, fp, a); +} -int i2d_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT *a) - { +int +i2d_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT *a) +{ return ASN1_i2d_fp_of_const(TS_MSG_IMPRINT, i2d_TS_MSG_IMPRINT, fp, a); - } +} #endif ASN1_SEQUENCE(TS_REQ) = { @@ -100,27 +108,33 @@ ASN1_SEQUENCE(TS_REQ) = { IMPLEMENT_ASN1_FUNCTIONS_const(TS_REQ) IMPLEMENT_ASN1_DUP_FUNCTION(TS_REQ) + #ifndef OPENSSL_NO_BIO -TS_REQ *d2i_TS_REQ_bio(BIO *bp, TS_REQ **a) - { +TS_REQ * +d2i_TS_REQ_bio(BIO *bp, TS_REQ **a) +{ return ASN1_d2i_bio_of(TS_REQ, TS_REQ_new, d2i_TS_REQ, bp, a); - } +} -int i2d_TS_REQ_bio(BIO *bp, TS_REQ *a) - { +int +i2d_TS_REQ_bio(BIO *bp, TS_REQ *a) +{ return ASN1_i2d_bio_of_const(TS_REQ, i2d_TS_REQ, bp, a); - } +} #endif + #ifndef OPENSSL_NO_FP_API -TS_REQ *d2i_TS_REQ_fp(FILE *fp, TS_REQ **a) - { +TS_REQ * +d2i_TS_REQ_fp(FILE *fp, TS_REQ **a) +{ return ASN1_d2i_fp_of(TS_REQ, TS_REQ_new, d2i_TS_REQ, fp, a); - } +} -int i2d_TS_REQ_fp(FILE *fp, TS_REQ *a) - { +int +i2d_TS_REQ_fp(FILE *fp, TS_REQ *a) +{ return ASN1_i2d_fp_of_const(TS_REQ, i2d_TS_REQ, fp, a); - } +} #endif ASN1_SEQUENCE(TS_ACCURACY) = { @@ -147,27 +161,35 @@ ASN1_SEQUENCE(TS_TST_INFO) = { IMPLEMENT_ASN1_FUNCTIONS_const(TS_TST_INFO) IMPLEMENT_ASN1_DUP_FUNCTION(TS_TST_INFO) + #ifndef OPENSSL_NO_BIO -TS_TST_INFO *d2i_TS_TST_INFO_bio(BIO *bp, TS_TST_INFO **a) - { - return ASN1_d2i_bio_of(TS_TST_INFO, TS_TST_INFO_new, d2i_TS_TST_INFO, bp, a); - } +TS_TST_INFO * +d2i_TS_TST_INFO_bio(BIO *bp, TS_TST_INFO **a) +{ + return ASN1_d2i_bio_of(TS_TST_INFO, TS_TST_INFO_new, d2i_TS_TST_INFO, + bp, a); +} -int i2d_TS_TST_INFO_bio(BIO *bp, TS_TST_INFO *a) - { +int +i2d_TS_TST_INFO_bio(BIO *bp, TS_TST_INFO *a) +{ return ASN1_i2d_bio_of_const(TS_TST_INFO, i2d_TS_TST_INFO, bp, a); - } +} #endif + #ifndef OPENSSL_NO_FP_API -TS_TST_INFO *d2i_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO **a) - { - return ASN1_d2i_fp_of(TS_TST_INFO, TS_TST_INFO_new, d2i_TS_TST_INFO, fp, a); - } +TS_TST_INFO * +d2i_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO **a) +{ + return ASN1_d2i_fp_of(TS_TST_INFO, TS_TST_INFO_new, d2i_TS_TST_INFO, + fp, a); +} -int i2d_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO *a) - { +int +i2d_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO *a) +{ return ASN1_i2d_fp_of_const(TS_TST_INFO, i2d_TS_TST_INFO, fp, a); - } +} #endif ASN1_SEQUENCE(TS_STATUS_INFO) = { @@ -179,7 +201,8 @@ ASN1_SEQUENCE(TS_STATUS_INFO) = { IMPLEMENT_ASN1_FUNCTIONS_const(TS_STATUS_INFO) IMPLEMENT_ASN1_DUP_FUNCTION(TS_STATUS_INFO) -static int ts_resp_set_tst_info(TS_RESP *a) +static int +ts_resp_set_tst_info(TS_RESP *a) { long status; @@ -194,7 +217,8 @@ static int ts_resp_set_tst_info(TS_RESP *a) TS_TST_INFO_free(a->tst_info); a->tst_info = PKCS7_to_TS_TST_INFO(a->token); if (!a->tst_info) { - TSerr(TS_F_TS_RESP_SET_TST_INFO, TS_R_PKCS7_TO_TS_TST_INFO_FAILED); + TSerr(TS_F_TS_RESP_SET_TST_INFO, + TS_R_PKCS7_TO_TS_TST_INFO_FAILED); return 0; } } else if (status == 0 || status == 1) { @@ -205,10 +229,11 @@ static int ts_resp_set_tst_info(TS_RESP *a) return 1; } -static int ts_resp_cb(int op, ASN1_VALUE **pval, const ASN1_ITEM *it, - void *exarg) +static int +ts_resp_cb(int op, ASN1_VALUE **pval, const ASN1_ITEM *it, void *exarg) { TS_RESP *ts_resp = (TS_RESP *)*pval; + if (op == ASN1_OP_NEW_POST) { ts_resp->tst_info = NULL; } else if (op == ASN1_OP_FREE_POST) { @@ -228,27 +253,33 @@ ASN1_SEQUENCE_cb(TS_RESP, ts_resp_cb) = { IMPLEMENT_ASN1_FUNCTIONS_const(TS_RESP) IMPLEMENT_ASN1_DUP_FUNCTION(TS_RESP) + #ifndef OPENSSL_NO_BIO -TS_RESP *d2i_TS_RESP_bio(BIO *bp, TS_RESP **a) - { +TS_RESP * +d2i_TS_RESP_bio(BIO *bp, TS_RESP **a) +{ return ASN1_d2i_bio_of(TS_RESP, TS_RESP_new, d2i_TS_RESP, bp, a); - } +} -int i2d_TS_RESP_bio(BIO *bp, TS_RESP *a) - { +int +i2d_TS_RESP_bio(BIO *bp, TS_RESP *a) +{ return ASN1_i2d_bio_of_const(TS_RESP, i2d_TS_RESP, bp, a); - } +} #endif + #ifndef OPENSSL_NO_FP_API -TS_RESP *d2i_TS_RESP_fp(FILE *fp, TS_RESP **a) - { +TS_RESP * +d2i_TS_RESP_fp(FILE *fp, TS_RESP **a) +{ return ASN1_d2i_fp_of(TS_RESP, TS_RESP_new, d2i_TS_RESP, fp, a); - } +} -int i2d_TS_RESP_fp(FILE *fp, TS_RESP *a) - { +int +i2d_TS_RESP_fp(FILE *fp, TS_RESP *a) +{ return ASN1_i2d_fp_of_const(TS_RESP, i2d_TS_RESP, fp, a); - } +} #endif ASN1_SEQUENCE(ESS_ISSUER_SERIAL) = { @@ -276,7 +307,8 @@ IMPLEMENT_ASN1_FUNCTIONS_const(ESS_SIGNING_CERT) IMPLEMENT_ASN1_DUP_FUNCTION(ESS_SIGNING_CERT) /* Getting encapsulated TS_TST_INFO object from PKCS7. */ -TS_TST_INFO *PKCS7_to_TS_TST_INFO(PKCS7 *token) +TS_TST_INFO * +PKCS7_to_TS_TST_INFO(PKCS7 *token) { PKCS7_SIGNED *pkcs7_signed; PKCS7 *enveloped; @@ -284,35 +316,31 @@ TS_TST_INFO *PKCS7_to_TS_TST_INFO(PKCS7 *token) ASN1_OCTET_STRING *tst_info_der; const unsigned char *p; - if (!PKCS7_type_is_signed(token)) - { + if (!PKCS7_type_is_signed(token)) { TSerr(TS_F_PKCS7_TO_TS_TST_INFO, TS_R_BAD_PKCS7_TYPE); return NULL; - } + } /* Content must be present. */ - if (PKCS7_get_detached(token)) - { + if (PKCS7_get_detached(token)) { TSerr(TS_F_PKCS7_TO_TS_TST_INFO, TS_R_DETACHED_CONTENT); return NULL; - } + } /* We have a signed data with content. */ pkcs7_signed = token->d.sign; enveloped = pkcs7_signed->contents; - if (OBJ_obj2nid(enveloped->type) != NID_id_smime_ct_TSTInfo) - { + if (OBJ_obj2nid(enveloped->type) != NID_id_smime_ct_TSTInfo) { TSerr(TS_F_PKCS7_TO_TS_TST_INFO, TS_R_BAD_PKCS7_TYPE); return NULL; - } + } /* We have a DER encoded TST_INFO as the signed data. */ tst_info_wrapper = enveloped->d.other; - if (tst_info_wrapper->type != V_ASN1_OCTET_STRING) - { + if (tst_info_wrapper->type != V_ASN1_OCTET_STRING) { TSerr(TS_F_PKCS7_TO_TS_TST_INFO, TS_R_BAD_TYPE); return NULL; - } + } /* We have the correct ASN1_OCTET_STRING type. */ tst_info_der = tst_info_wrapper->value.octet_string; diff --git a/lib/libssl/src/crypto/ts/ts_conf.c b/lib/libssl/src/crypto/ts/ts_conf.c index 212f8bf702c..f8cf3b514ce 100644 --- a/lib/libssl/src/crypto/ts/ts_conf.c +++ b/lib/libssl/src/crypto/ts/ts_conf.c @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -85,420 +85,440 @@ #define ENV_VALUE_SECS "secs" #define ENV_VALUE_MILLISECS "millisecs" #define ENV_VALUE_MICROSECS "microsecs" -#define ENV_CLOCK_PRECISION_DIGITS "clock_precision_digits" +#define ENV_CLOCK_PRECISION_DIGITS "clock_precision_digits" #define ENV_VALUE_YES "yes" #define ENV_VALUE_NO "no" /* Function definitions for certificate and key loading. */ -X509 *TS_CONF_load_cert(const char *file) - { +X509 * +TS_CONF_load_cert(const char *file) +{ BIO *cert = NULL; X509 *x = NULL; - if ((cert = BIO_new_file(file, "r")) == NULL) goto end; + if ((cert = BIO_new_file(file, "r")) == NULL) + goto end; x = PEM_read_bio_X509_AUX(cert, NULL, NULL, NULL); + end: if (x == NULL) fprintf(stderr, "unable to load certificate: %s\n", file); BIO_free(cert); return x; - } +} STACK_OF(X509) *TS_CONF_load_certs(const char *file) - { +{ BIO *certs = NULL; STACK_OF(X509) *othercerts = NULL; STACK_OF(X509_INFO) *allcerts = NULL; int i; - if (!(certs = BIO_new_file(file, "r"))) goto end; + if (!(certs = BIO_new_file(file, "r"))) + goto end; - if (!(othercerts = sk_X509_new_null())) goto end; + if (!(othercerts = sk_X509_new_null())) + goto end; allcerts = PEM_X509_INFO_read_bio(certs, NULL, NULL, NULL); - for(i = 0; i < sk_X509_INFO_num(allcerts); i++) - { + for (i = 0; i < sk_X509_INFO_num(allcerts); i++) { X509_INFO *xi = sk_X509_INFO_value(allcerts, i); - if (xi->x509) - { + if (xi->x509) { sk_X509_push(othercerts, xi->x509); xi->x509 = NULL; - } } + } + end: if (othercerts == NULL) fprintf(stderr, "unable to load certificates: %s\n", file); sk_X509_INFO_pop_free(allcerts, X509_INFO_free); BIO_free(certs); return othercerts; - } +} -EVP_PKEY *TS_CONF_load_key(const char *file, const char *pass) - { +EVP_PKEY * +TS_CONF_load_key(const char *file, const char *pass) +{ BIO *key = NULL; EVP_PKEY *pkey = NULL; - if (!(key = BIO_new_file(file, "r"))) goto end; + if (!(key = BIO_new_file(file, "r"))) + goto end; pkey = PEM_read_bio_PrivateKey(key, NULL, NULL, (char *) pass); - end: + +end: if (pkey == NULL) fprintf(stderr, "unable to load private key: %s\n", file); BIO_free(key); return pkey; - } +} /* Function definitions for handling configuration options. */ -static void TS_CONF_lookup_fail(const char *name, const char *tag) - { +static void +TS_CONF_lookup_fail(const char *name, const char *tag) +{ fprintf(stderr, "variable lookup failed for %s::%s\n", name, tag); - } +} -static void TS_CONF_invalid(const char *name, const char *tag) - { +static void +TS_CONF_invalid(const char *name, const char *tag) +{ fprintf(stderr, "invalid variable value for %s::%s\n", name, tag); - } +} -const char *TS_CONF_get_tsa_section(CONF *conf, const char *section) - { - if (!section) - { +const char * +TS_CONF_get_tsa_section(CONF *conf, const char *section) +{ + if (!section) { section = NCONF_get_string(conf, BASE_SECTION, ENV_DEFAULT_TSA); if (!section) TS_CONF_lookup_fail(BASE_SECTION, ENV_DEFAULT_TSA); - } - return section; } + return section; +} -int TS_CONF_set_serial(CONF *conf, const char *section, TS_serial_cb cb, - TS_RESP_CTX *ctx) - { +int +TS_CONF_set_serial(CONF *conf, const char *section, TS_serial_cb cb, + TS_RESP_CTX *ctx) +{ int ret = 0; char *serial = NCONF_get_string(conf, section, ENV_SERIAL); - if (!serial) - { + + if (!serial) { TS_CONF_lookup_fail(section, ENV_SERIAL); goto err; - } + } TS_RESP_CTX_set_serial_cb(ctx, cb, serial); ret = 1; - err: + +err: return ret; - } +} #ifndef OPENSSL_NO_ENGINE -int TS_CONF_set_crypto_device(CONF *conf, const char *section, - const char *device) - { +int +TS_CONF_set_crypto_device(CONF *conf, const char *section, const char *device) +{ int ret = 0; - + if (!device) - device = NCONF_get_string(conf, section, - ENV_CRYPTO_DEVICE); + device = NCONF_get_string(conf, section, ENV_CRYPTO_DEVICE); - if (device && !TS_CONF_set_default_engine(device)) - { + if (device && !TS_CONF_set_default_engine(device)) { TS_CONF_invalid(section, ENV_CRYPTO_DEVICE); goto err; - } + } ret = 1; - err: + +err: return ret; - } +} -int TS_CONF_set_default_engine(const char *name) - { +int +TS_CONF_set_default_engine(const char *name) +{ ENGINE *e = NULL; int ret = 0; /* Leave the default if builtin specified. */ - if (strcmp(name, "builtin") == 0) return 1; + if (strcmp(name, "builtin") == 0) + return 1; - if (!(e = ENGINE_by_id(name))) goto err; + if (!(e = ENGINE_by_id(name))) + goto err; /* All the operations are going to be carried out by the engine. */ - if (!ENGINE_set_default(e, ENGINE_METHOD_ALL)) goto err; + if (!ENGINE_set_default(e, ENGINE_METHOD_ALL)) + goto err; ret = 1; - err: - if (!ret) - { - TSerr(TS_F_TS_CONF_SET_DEFAULT_ENGINE, - TS_R_COULD_NOT_SET_ENGINE); + +err: + if (!ret) { + TSerr(TS_F_TS_CONF_SET_DEFAULT_ENGINE, + TS_R_COULD_NOT_SET_ENGINE); ERR_add_error_data(2, "engine:", name); - } - if (e) ENGINE_free(e); - return ret; } + if (e) + ENGINE_free(e); + return ret; +} #endif -int TS_CONF_set_signer_cert(CONF *conf, const char *section, - const char *cert, TS_RESP_CTX *ctx) - { +int +TS_CONF_set_signer_cert(CONF *conf, const char *section, const char *cert, + TS_RESP_CTX *ctx) +{ int ret = 0; X509 *cert_obj = NULL; - if (!cert) - cert = NCONF_get_string(conf, section, ENV_SIGNER_CERT); + if (!cert) - { + cert = NCONF_get_string(conf, section, ENV_SIGNER_CERT); + if (!cert) { TS_CONF_lookup_fail(section, ENV_SIGNER_CERT); goto err; - } + } if (!(cert_obj = TS_CONF_load_cert(cert))) goto err; if (!TS_RESP_CTX_set_signer_cert(ctx, cert_obj)) goto err; ret = 1; - err: + +err: X509_free(cert_obj); return ret; - } +} -int TS_CONF_set_certs(CONF *conf, const char *section, const char *certs, - TS_RESP_CTX *ctx) - { +int +TS_CONF_set_certs(CONF *conf, const char *section, const char *certs, + TS_RESP_CTX *ctx) +{ int ret = 0; STACK_OF(X509) *certs_obj = NULL; - if (!certs) + + if (!certs) certs = NCONF_get_string(conf, section, ENV_CERTS); /* Certificate chain is optional. */ - if (!certs) goto end; - if (!(certs_obj = TS_CONF_load_certs(certs))) goto err; - if (!TS_RESP_CTX_set_certs(ctx, certs_obj)) goto err; - end: + if (!certs) + goto end; + if (!(certs_obj = TS_CONF_load_certs(certs))) + goto err; + if (!TS_RESP_CTX_set_certs(ctx, certs_obj)) + goto err; + +end: ret = 1; - err: +err: sk_X509_pop_free(certs_obj, X509_free); return ret; - } +} -int TS_CONF_set_signer_key(CONF *conf, const char *section, - const char *key, const char *pass, - TS_RESP_CTX *ctx) - { +int +TS_CONF_set_signer_key(CONF *conf, const char *section, const char *key, + const char *pass, TS_RESP_CTX *ctx) +{ int ret = 0; EVP_PKEY *key_obj = NULL; - if (!key) - key = NCONF_get_string(conf, section, ENV_SIGNER_KEY); + if (!key) - { + key = NCONF_get_string(conf, section, ENV_SIGNER_KEY); + if (!key) { TS_CONF_lookup_fail(section, ENV_SIGNER_KEY); goto err; - } - if (!(key_obj = TS_CONF_load_key(key, pass))) goto err; - if (!TS_RESP_CTX_set_signer_key(ctx, key_obj)) goto err; + } + if (!(key_obj = TS_CONF_load_key(key, pass))) + goto err; + if (!TS_RESP_CTX_set_signer_key(ctx, key_obj)) + goto err; ret = 1; - err: + +err: EVP_PKEY_free(key_obj); return ret; - } +} -int TS_CONF_set_def_policy(CONF *conf, const char *section, - const char *policy, TS_RESP_CTX *ctx) - { +int +TS_CONF_set_def_policy(CONF *conf, const char *section, const char *policy, + TS_RESP_CTX *ctx) +{ int ret = 0; ASN1_OBJECT *policy_obj = NULL; - if (!policy) - policy = NCONF_get_string(conf, section, - ENV_DEFAULT_POLICY); - if (!policy) - { + + if (!policy) + policy = NCONF_get_string(conf, section, ENV_DEFAULT_POLICY); + if (!policy) { TS_CONF_lookup_fail(section, ENV_DEFAULT_POLICY); goto err; - } - if (!(policy_obj = OBJ_txt2obj(policy, 0))) - { + } + if (!(policy_obj = OBJ_txt2obj(policy, 0))) { TS_CONF_invalid(section, ENV_DEFAULT_POLICY); goto err; - } + } if (!TS_RESP_CTX_set_def_policy(ctx, policy_obj)) goto err; ret = 1; - err: + +err: ASN1_OBJECT_free(policy_obj); return ret; - } +} -int TS_CONF_set_policies(CONF *conf, const char *section, - TS_RESP_CTX *ctx) - { +int +TS_CONF_set_policies(CONF *conf, const char *section, TS_RESP_CTX *ctx) +{ int ret = 0; int i; STACK_OF(CONF_VALUE) *list = NULL; - char *policies = NCONF_get_string(conf, section, - ENV_OTHER_POLICIES); + char *policies = NCONF_get_string(conf, section, ENV_OTHER_POLICIES); + /* If no other policy is specified, that's fine. */ - if (policies && !(list = X509V3_parse_list(policies))) - { + if (policies && !(list = X509V3_parse_list(policies))) { TS_CONF_invalid(section, ENV_OTHER_POLICIES); goto err; - } - for (i = 0; i < sk_CONF_VALUE_num(list); ++i) - { + } + for (i = 0; i < sk_CONF_VALUE_num(list); ++i) { CONF_VALUE *val = sk_CONF_VALUE_value(list, i); const char *extval = val->value ? val->value : val->name; ASN1_OBJECT *objtmp; - if (!(objtmp = OBJ_txt2obj(extval, 0))) - { + if (!(objtmp = OBJ_txt2obj(extval, 0))) { TS_CONF_invalid(section, ENV_OTHER_POLICIES); goto err; - } + } if (!TS_RESP_CTX_add_policy(ctx, objtmp)) goto err; ASN1_OBJECT_free(objtmp); - } + } ret = 1; - err: + +err: sk_CONF_VALUE_pop_free(list, X509V3_conf_free); return ret; - } +} -int TS_CONF_set_digests(CONF *conf, const char *section, - TS_RESP_CTX *ctx) - { +int +TS_CONF_set_digests(CONF *conf, const char *section, TS_RESP_CTX *ctx) +{ int ret = 0; int i; STACK_OF(CONF_VALUE) *list = NULL; char *digests = NCONF_get_string(conf, section, ENV_DIGESTS); - if (!digests) - { + + if (!digests) { TS_CONF_lookup_fail(section, ENV_DIGESTS); goto err; - } - if (!(list = X509V3_parse_list(digests))) - { + } + if (!(list = X509V3_parse_list(digests))) { TS_CONF_invalid(section, ENV_DIGESTS); goto err; - } - if (sk_CONF_VALUE_num(list) == 0) - { + } + if (sk_CONF_VALUE_num(list) == 0) { TS_CONF_invalid(section, ENV_DIGESTS); goto err; - } - for (i = 0; i < sk_CONF_VALUE_num(list); ++i) - { + } + for (i = 0; i < sk_CONF_VALUE_num(list); ++i) { CONF_VALUE *val = sk_CONF_VALUE_value(list, i); const char *extval = val->value ? val->value : val->name; const EVP_MD *md; - if (!(md = EVP_get_digestbyname(extval))) - { + if (!(md = EVP_get_digestbyname(extval))) { TS_CONF_invalid(section, ENV_DIGESTS); goto err; - } + } if (!TS_RESP_CTX_add_md(ctx, md)) goto err; - } + } ret = 1; - err: + +err: sk_CONF_VALUE_pop_free(list, X509V3_conf_free); return ret; - } +} -int TS_CONF_set_accuracy(CONF *conf, const char *section, TS_RESP_CTX *ctx) - { +int +TS_CONF_set_accuracy(CONF *conf, const char *section, TS_RESP_CTX *ctx) +{ int ret = 0; int i; int secs = 0, millis = 0, micros = 0; STACK_OF(CONF_VALUE) *list = NULL; char *accuracy = NCONF_get_string(conf, section, ENV_ACCURACY); - if (accuracy && !(list = X509V3_parse_list(accuracy))) - { + if (accuracy && !(list = X509V3_parse_list(accuracy))) { TS_CONF_invalid(section, ENV_ACCURACY); goto err; - } - for (i = 0; i < sk_CONF_VALUE_num(list); ++i) - { + } + for (i = 0; i < sk_CONF_VALUE_num(list); ++i) { CONF_VALUE *val = sk_CONF_VALUE_value(list, i); - if (strcmp(val->name, ENV_VALUE_SECS) == 0) - { - if (val->value) secs = atoi(val->value); - } - else if (strcmp(val->name, ENV_VALUE_MILLISECS) == 0) - { - if (val->value) millis = atoi(val->value); - } - else if (strcmp(val->name, ENV_VALUE_MICROSECS) == 0) - { - if (val->value) micros = atoi(val->value); - } - else - { + if (strcmp(val->name, ENV_VALUE_SECS) == 0) { + if (val->value) + secs = atoi(val->value); + } else if (strcmp(val->name, ENV_VALUE_MILLISECS) == 0) { + if (val->value) + millis = atoi(val->value); + } else if (strcmp(val->name, ENV_VALUE_MICROSECS) == 0) { + if (val->value) + micros = atoi(val->value); + } else { TS_CONF_invalid(section, ENV_ACCURACY); goto err; - } } + } if (!TS_RESP_CTX_set_accuracy(ctx, secs, millis, micros)) goto err; ret = 1; - err: + +err: sk_CONF_VALUE_pop_free(list, X509V3_conf_free); return ret; - } +} -int TS_CONF_set_clock_precision_digits(CONF *conf, const char *section, - TS_RESP_CTX *ctx) - { +int +TS_CONF_set_clock_precision_digits(CONF *conf, const char *section, + TS_RESP_CTX *ctx) +{ int ret = 0; long digits = 0; - + /* If not specified, set the default value to 0, i.e. sec precision */ if (!NCONF_get_number_e(conf, section, ENV_CLOCK_PRECISION_DIGITS, - &digits)) + &digits)) digits = 0; - if (digits < 0 || digits > TS_MAX_CLOCK_PRECISION_DIGITS) - { + if (digits < 0 || digits > TS_MAX_CLOCK_PRECISION_DIGITS) { TS_CONF_invalid(section, ENV_CLOCK_PRECISION_DIGITS); goto err; - } + } if (!TS_RESP_CTX_set_clock_precision_digits(ctx, digits)) goto err; return 1; - err: + +err: return ret; - } +} -static int TS_CONF_add_flag(CONF *conf, const char *section, const char *field, - int flag, TS_RESP_CTX *ctx) - { +static int +TS_CONF_add_flag(CONF *conf, const char *section, const char *field, int flag, + TS_RESP_CTX *ctx) +{ /* Default is false. */ const char *value = NCONF_get_string(conf, section, field); - if (value) - { + + if (value) { if (strcmp(value, ENV_VALUE_YES) == 0) TS_RESP_CTX_add_flags(ctx, flag); - else if (strcmp(value, ENV_VALUE_NO) != 0) - { + else if (strcmp(value, ENV_VALUE_NO) != 0) { TS_CONF_invalid(section, field); return 0; - } } + } return 1; - } +} -int TS_CONF_set_ordering(CONF *conf, const char *section, TS_RESP_CTX *ctx) - { +int +TS_CONF_set_ordering(CONF *conf, const char *section, TS_RESP_CTX *ctx) +{ return TS_CONF_add_flag(conf, section, ENV_ORDERING, TS_ORDERING, ctx); - } +} -int TS_CONF_set_tsa_name(CONF *conf, const char *section, TS_RESP_CTX *ctx) - { +int +TS_CONF_set_tsa_name(CONF *conf, const char *section, TS_RESP_CTX *ctx) +{ return TS_CONF_add_flag(conf, section, ENV_TSA_NAME, TS_TSA_NAME, ctx); - } - -int TS_CONF_set_ess_cert_id_chain(CONF *conf, const char *section, - TS_RESP_CTX *ctx) - { - return TS_CONF_add_flag(conf, section, ENV_ESS_CERT_ID_CHAIN, - TS_ESS_CERT_ID_CHAIN, ctx); - } +} + +int +TS_CONF_set_ess_cert_id_chain(CONF *conf, const char *section, TS_RESP_CTX *ctx) +{ + return TS_CONF_add_flag(conf, section, ENV_ESS_CERT_ID_CHAIN, + TS_ESS_CERT_ID_CHAIN, ctx); +} diff --git a/lib/libssl/src/crypto/ts/ts_err.c b/lib/libssl/src/crypto/ts/ts_err.c index a08b0ffa234..1185d22fd7a 100644 --- a/lib/libssl/src/crypto/ts/ts_err.c +++ b/lib/libssl/src/crypto/ts/ts_err.c @@ -7,7 +7,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -68,112 +68,109 @@ #define ERR_FUNC(func) ERR_PACK(ERR_LIB_TS,func,0) #define ERR_REASON(reason) ERR_PACK(ERR_LIB_TS,0,reason) -static ERR_STRING_DATA TS_str_functs[]= - { -{ERR_FUNC(TS_F_D2I_TS_RESP), "d2i_TS_RESP"}, -{ERR_FUNC(TS_F_DEF_SERIAL_CB), "DEF_SERIAL_CB"}, -{ERR_FUNC(TS_F_DEF_TIME_CB), "DEF_TIME_CB"}, -{ERR_FUNC(TS_F_ESS_ADD_SIGNING_CERT), "ESS_ADD_SIGNING_CERT"}, -{ERR_FUNC(TS_F_ESS_CERT_ID_NEW_INIT), "ESS_CERT_ID_NEW_INIT"}, -{ERR_FUNC(TS_F_ESS_SIGNING_CERT_NEW_INIT), "ESS_SIGNING_CERT_NEW_INIT"}, -{ERR_FUNC(TS_F_INT_TS_RESP_VERIFY_TOKEN), "INT_TS_RESP_VERIFY_TOKEN"}, -{ERR_FUNC(TS_F_PKCS7_TO_TS_TST_INFO), "PKCS7_to_TS_TST_INFO"}, -{ERR_FUNC(TS_F_TS_ACCURACY_SET_MICROS), "TS_ACCURACY_set_micros"}, -{ERR_FUNC(TS_F_TS_ACCURACY_SET_MILLIS), "TS_ACCURACY_set_millis"}, -{ERR_FUNC(TS_F_TS_ACCURACY_SET_SECONDS), "TS_ACCURACY_set_seconds"}, -{ERR_FUNC(TS_F_TS_CHECK_IMPRINTS), "TS_CHECK_IMPRINTS"}, -{ERR_FUNC(TS_F_TS_CHECK_NONCES), "TS_CHECK_NONCES"}, -{ERR_FUNC(TS_F_TS_CHECK_POLICY), "TS_CHECK_POLICY"}, -{ERR_FUNC(TS_F_TS_CHECK_SIGNING_CERTS), "TS_CHECK_SIGNING_CERTS"}, -{ERR_FUNC(TS_F_TS_CHECK_STATUS_INFO), "TS_CHECK_STATUS_INFO"}, -{ERR_FUNC(TS_F_TS_COMPUTE_IMPRINT), "TS_COMPUTE_IMPRINT"}, -{ERR_FUNC(TS_F_TS_CONF_SET_DEFAULT_ENGINE), "TS_CONF_set_default_engine"}, -{ERR_FUNC(TS_F_TS_GET_STATUS_TEXT), "TS_GET_STATUS_TEXT"}, -{ERR_FUNC(TS_F_TS_MSG_IMPRINT_SET_ALGO), "TS_MSG_IMPRINT_set_algo"}, -{ERR_FUNC(TS_F_TS_REQ_SET_MSG_IMPRINT), "TS_REQ_set_msg_imprint"}, -{ERR_FUNC(TS_F_TS_REQ_SET_NONCE), "TS_REQ_set_nonce"}, -{ERR_FUNC(TS_F_TS_REQ_SET_POLICY_ID), "TS_REQ_set_policy_id"}, -{ERR_FUNC(TS_F_TS_RESP_CREATE_RESPONSE), "TS_RESP_create_response"}, -{ERR_FUNC(TS_F_TS_RESP_CREATE_TST_INFO), "TS_RESP_CREATE_TST_INFO"}, -{ERR_FUNC(TS_F_TS_RESP_CTX_ADD_FAILURE_INFO), "TS_RESP_CTX_add_failure_info"}, -{ERR_FUNC(TS_F_TS_RESP_CTX_ADD_MD), "TS_RESP_CTX_add_md"}, -{ERR_FUNC(TS_F_TS_RESP_CTX_ADD_POLICY), "TS_RESP_CTX_add_policy"}, -{ERR_FUNC(TS_F_TS_RESP_CTX_NEW), "TS_RESP_CTX_new"}, -{ERR_FUNC(TS_F_TS_RESP_CTX_SET_ACCURACY), "TS_RESP_CTX_set_accuracy"}, -{ERR_FUNC(TS_F_TS_RESP_CTX_SET_CERTS), "TS_RESP_CTX_set_certs"}, -{ERR_FUNC(TS_F_TS_RESP_CTX_SET_DEF_POLICY), "TS_RESP_CTX_set_def_policy"}, -{ERR_FUNC(TS_F_TS_RESP_CTX_SET_SIGNER_CERT), "TS_RESP_CTX_set_signer_cert"}, -{ERR_FUNC(TS_F_TS_RESP_CTX_SET_STATUS_INFO), "TS_RESP_CTX_set_status_info"}, -{ERR_FUNC(TS_F_TS_RESP_GET_POLICY), "TS_RESP_GET_POLICY"}, -{ERR_FUNC(TS_F_TS_RESP_SET_GENTIME_WITH_PRECISION), "TS_RESP_SET_GENTIME_WITH_PRECISION"}, -{ERR_FUNC(TS_F_TS_RESP_SET_STATUS_INFO), "TS_RESP_set_status_info"}, -{ERR_FUNC(TS_F_TS_RESP_SET_TST_INFO), "TS_RESP_set_tst_info"}, -{ERR_FUNC(TS_F_TS_RESP_SIGN), "TS_RESP_SIGN"}, -{ERR_FUNC(TS_F_TS_RESP_VERIFY_SIGNATURE), "TS_RESP_verify_signature"}, -{ERR_FUNC(TS_F_TS_RESP_VERIFY_TOKEN), "TS_RESP_verify_token"}, -{ERR_FUNC(TS_F_TS_TST_INFO_SET_ACCURACY), "TS_TST_INFO_set_accuracy"}, -{ERR_FUNC(TS_F_TS_TST_INFO_SET_MSG_IMPRINT), "TS_TST_INFO_set_msg_imprint"}, -{ERR_FUNC(TS_F_TS_TST_INFO_SET_NONCE), "TS_TST_INFO_set_nonce"}, -{ERR_FUNC(TS_F_TS_TST_INFO_SET_POLICY_ID), "TS_TST_INFO_set_policy_id"}, -{ERR_FUNC(TS_F_TS_TST_INFO_SET_SERIAL), "TS_TST_INFO_set_serial"}, -{ERR_FUNC(TS_F_TS_TST_INFO_SET_TIME), "TS_TST_INFO_set_time"}, -{ERR_FUNC(TS_F_TS_TST_INFO_SET_TSA), "TS_TST_INFO_set_tsa"}, -{ERR_FUNC(TS_F_TS_VERIFY), "TS_VERIFY"}, -{ERR_FUNC(TS_F_TS_VERIFY_CERT), "TS_VERIFY_CERT"}, -{ERR_FUNC(TS_F_TS_VERIFY_CTX_NEW), "TS_VERIFY_CTX_new"}, -{0,NULL} - }; +static ERR_STRING_DATA TS_str_functs[] = { + {ERR_FUNC(TS_F_D2I_TS_RESP), "d2i_TS_RESP"}, + {ERR_FUNC(TS_F_DEF_SERIAL_CB), "DEF_SERIAL_CB"}, + {ERR_FUNC(TS_F_DEF_TIME_CB), "DEF_TIME_CB"}, + {ERR_FUNC(TS_F_ESS_ADD_SIGNING_CERT), "ESS_ADD_SIGNING_CERT"}, + {ERR_FUNC(TS_F_ESS_CERT_ID_NEW_INIT), "ESS_CERT_ID_NEW_INIT"}, + {ERR_FUNC(TS_F_ESS_SIGNING_CERT_NEW_INIT), "ESS_SIGNING_CERT_NEW_INIT"}, + {ERR_FUNC(TS_F_INT_TS_RESP_VERIFY_TOKEN), "INT_TS_RESP_VERIFY_TOKEN"}, + {ERR_FUNC(TS_F_PKCS7_TO_TS_TST_INFO), "PKCS7_to_TS_TST_INFO"}, + {ERR_FUNC(TS_F_TS_ACCURACY_SET_MICROS), "TS_ACCURACY_set_micros"}, + {ERR_FUNC(TS_F_TS_ACCURACY_SET_MILLIS), "TS_ACCURACY_set_millis"}, + {ERR_FUNC(TS_F_TS_ACCURACY_SET_SECONDS), "TS_ACCURACY_set_seconds"}, + {ERR_FUNC(TS_F_TS_CHECK_IMPRINTS), "TS_CHECK_IMPRINTS"}, + {ERR_FUNC(TS_F_TS_CHECK_NONCES), "TS_CHECK_NONCES"}, + {ERR_FUNC(TS_F_TS_CHECK_POLICY), "TS_CHECK_POLICY"}, + {ERR_FUNC(TS_F_TS_CHECK_SIGNING_CERTS), "TS_CHECK_SIGNING_CERTS"}, + {ERR_FUNC(TS_F_TS_CHECK_STATUS_INFO), "TS_CHECK_STATUS_INFO"}, + {ERR_FUNC(TS_F_TS_COMPUTE_IMPRINT), "TS_COMPUTE_IMPRINT"}, + {ERR_FUNC(TS_F_TS_CONF_SET_DEFAULT_ENGINE), "TS_CONF_set_default_engine"}, + {ERR_FUNC(TS_F_TS_GET_STATUS_TEXT), "TS_GET_STATUS_TEXT"}, + {ERR_FUNC(TS_F_TS_MSG_IMPRINT_SET_ALGO), "TS_MSG_IMPRINT_set_algo"}, + {ERR_FUNC(TS_F_TS_REQ_SET_MSG_IMPRINT), "TS_REQ_set_msg_imprint"}, + {ERR_FUNC(TS_F_TS_REQ_SET_NONCE), "TS_REQ_set_nonce"}, + {ERR_FUNC(TS_F_TS_REQ_SET_POLICY_ID), "TS_REQ_set_policy_id"}, + {ERR_FUNC(TS_F_TS_RESP_CREATE_RESPONSE), "TS_RESP_create_response"}, + {ERR_FUNC(TS_F_TS_RESP_CREATE_TST_INFO), "TS_RESP_CREATE_TST_INFO"}, + {ERR_FUNC(TS_F_TS_RESP_CTX_ADD_FAILURE_INFO), "TS_RESP_CTX_add_failure_info"}, + {ERR_FUNC(TS_F_TS_RESP_CTX_ADD_MD), "TS_RESP_CTX_add_md"}, + {ERR_FUNC(TS_F_TS_RESP_CTX_ADD_POLICY), "TS_RESP_CTX_add_policy"}, + {ERR_FUNC(TS_F_TS_RESP_CTX_NEW), "TS_RESP_CTX_new"}, + {ERR_FUNC(TS_F_TS_RESP_CTX_SET_ACCURACY), "TS_RESP_CTX_set_accuracy"}, + {ERR_FUNC(TS_F_TS_RESP_CTX_SET_CERTS), "TS_RESP_CTX_set_certs"}, + {ERR_FUNC(TS_F_TS_RESP_CTX_SET_DEF_POLICY), "TS_RESP_CTX_set_def_policy"}, + {ERR_FUNC(TS_F_TS_RESP_CTX_SET_SIGNER_CERT), "TS_RESP_CTX_set_signer_cert"}, + {ERR_FUNC(TS_F_TS_RESP_CTX_SET_STATUS_INFO), "TS_RESP_CTX_set_status_info"}, + {ERR_FUNC(TS_F_TS_RESP_GET_POLICY), "TS_RESP_GET_POLICY"}, + {ERR_FUNC(TS_F_TS_RESP_SET_GENTIME_WITH_PRECISION), "TS_RESP_SET_GENTIME_WITH_PRECISION"}, + {ERR_FUNC(TS_F_TS_RESP_SET_STATUS_INFO), "TS_RESP_set_status_info"}, + {ERR_FUNC(TS_F_TS_RESP_SET_TST_INFO), "TS_RESP_set_tst_info"}, + {ERR_FUNC(TS_F_TS_RESP_SIGN), "TS_RESP_SIGN"}, + {ERR_FUNC(TS_F_TS_RESP_VERIFY_SIGNATURE), "TS_RESP_verify_signature"}, + {ERR_FUNC(TS_F_TS_RESP_VERIFY_TOKEN), "TS_RESP_verify_token"}, + {ERR_FUNC(TS_F_TS_TST_INFO_SET_ACCURACY), "TS_TST_INFO_set_accuracy"}, + {ERR_FUNC(TS_F_TS_TST_INFO_SET_MSG_IMPRINT), "TS_TST_INFO_set_msg_imprint"}, + {ERR_FUNC(TS_F_TS_TST_INFO_SET_NONCE), "TS_TST_INFO_set_nonce"}, + {ERR_FUNC(TS_F_TS_TST_INFO_SET_POLICY_ID), "TS_TST_INFO_set_policy_id"}, + {ERR_FUNC(TS_F_TS_TST_INFO_SET_SERIAL), "TS_TST_INFO_set_serial"}, + {ERR_FUNC(TS_F_TS_TST_INFO_SET_TIME), "TS_TST_INFO_set_time"}, + {ERR_FUNC(TS_F_TS_TST_INFO_SET_TSA), "TS_TST_INFO_set_tsa"}, + {ERR_FUNC(TS_F_TS_VERIFY), "TS_VERIFY"}, + {ERR_FUNC(TS_F_TS_VERIFY_CERT), "TS_VERIFY_CERT"}, + {ERR_FUNC(TS_F_TS_VERIFY_CTX_NEW), "TS_VERIFY_CTX_new"}, + {0, NULL} +}; -static ERR_STRING_DATA TS_str_reasons[]= - { -{ERR_REASON(TS_R_BAD_PKCS7_TYPE) ,"bad pkcs7 type"}, -{ERR_REASON(TS_R_BAD_TYPE) ,"bad type"}, -{ERR_REASON(TS_R_CERTIFICATE_VERIFY_ERROR),"certificate verify error"}, -{ERR_REASON(TS_R_COULD_NOT_SET_ENGINE) ,"could not set engine"}, -{ERR_REASON(TS_R_COULD_NOT_SET_TIME) ,"could not set time"}, -{ERR_REASON(TS_R_D2I_TS_RESP_INT_FAILED) ,"d2i ts resp int failed"}, -{ERR_REASON(TS_R_DETACHED_CONTENT) ,"detached content"}, -{ERR_REASON(TS_R_ESS_ADD_SIGNING_CERT_ERROR),"ess add signing cert error"}, -{ERR_REASON(TS_R_ESS_SIGNING_CERTIFICATE_ERROR),"ess signing certificate error"}, -{ERR_REASON(TS_R_INVALID_NULL_POINTER) ,"invalid null pointer"}, -{ERR_REASON(TS_R_INVALID_SIGNER_CERTIFICATE_PURPOSE),"invalid signer certificate purpose"}, -{ERR_REASON(TS_R_MESSAGE_IMPRINT_MISMATCH),"message imprint mismatch"}, -{ERR_REASON(TS_R_NONCE_MISMATCH) ,"nonce mismatch"}, -{ERR_REASON(TS_R_NONCE_NOT_RETURNED) ,"nonce not returned"}, -{ERR_REASON(TS_R_NO_CONTENT) ,"no content"}, -{ERR_REASON(TS_R_NO_TIME_STAMP_TOKEN) ,"no time stamp token"}, -{ERR_REASON(TS_R_PKCS7_ADD_SIGNATURE_ERROR),"pkcs7 add signature error"}, -{ERR_REASON(TS_R_PKCS7_ADD_SIGNED_ATTR_ERROR),"pkcs7 add signed attr error"}, -{ERR_REASON(TS_R_PKCS7_TO_TS_TST_INFO_FAILED),"pkcs7 to ts tst info failed"}, -{ERR_REASON(TS_R_POLICY_MISMATCH) ,"policy mismatch"}, -{ERR_REASON(TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE),"private key does not match certificate"}, -{ERR_REASON(TS_R_RESPONSE_SETUP_ERROR) ,"response setup error"}, -{ERR_REASON(TS_R_SIGNATURE_FAILURE) ,"signature failure"}, -{ERR_REASON(TS_R_THERE_MUST_BE_ONE_SIGNER),"there must be one signer"}, -{ERR_REASON(TS_R_TIME_SYSCALL_ERROR) ,"time syscall error"}, -{ERR_REASON(TS_R_TOKEN_NOT_PRESENT) ,"token not present"}, -{ERR_REASON(TS_R_TOKEN_PRESENT) ,"token present"}, -{ERR_REASON(TS_R_TSA_NAME_MISMATCH) ,"tsa name mismatch"}, -{ERR_REASON(TS_R_TSA_UNTRUSTED) ,"tsa untrusted"}, -{ERR_REASON(TS_R_TST_INFO_SETUP_ERROR) ,"tst info setup error"}, -{ERR_REASON(TS_R_TS_DATASIGN) ,"ts datasign"}, -{ERR_REASON(TS_R_UNACCEPTABLE_POLICY) ,"unacceptable policy"}, -{ERR_REASON(TS_R_UNSUPPORTED_MD_ALGORITHM),"unsupported md algorithm"}, -{ERR_REASON(TS_R_UNSUPPORTED_VERSION) ,"unsupported version"}, -{ERR_REASON(TS_R_WRONG_CONTENT_TYPE) ,"wrong content type"}, -{0,NULL} - }; +static ERR_STRING_DATA TS_str_reasons[]= { + {ERR_REASON(TS_R_BAD_PKCS7_TYPE) , "bad pkcs7 type"}, + {ERR_REASON(TS_R_BAD_TYPE) , "bad type"}, + {ERR_REASON(TS_R_CERTIFICATE_VERIFY_ERROR), "certificate verify error"}, + {ERR_REASON(TS_R_COULD_NOT_SET_ENGINE) , "could not set engine"}, + {ERR_REASON(TS_R_COULD_NOT_SET_TIME) , "could not set time"}, + {ERR_REASON(TS_R_D2I_TS_RESP_INT_FAILED) , "d2i ts resp int failed"}, + {ERR_REASON(TS_R_DETACHED_CONTENT) , "detached content"}, + {ERR_REASON(TS_R_ESS_ADD_SIGNING_CERT_ERROR), "ess add signing cert error"}, + {ERR_REASON(TS_R_ESS_SIGNING_CERTIFICATE_ERROR), "ess signing certificate error"}, + {ERR_REASON(TS_R_INVALID_NULL_POINTER) , "invalid null pointer"}, + {ERR_REASON(TS_R_INVALID_SIGNER_CERTIFICATE_PURPOSE), "invalid signer certificate purpose"}, + {ERR_REASON(TS_R_MESSAGE_IMPRINT_MISMATCH), "message imprint mismatch"}, + {ERR_REASON(TS_R_NONCE_MISMATCH) , "nonce mismatch"}, + {ERR_REASON(TS_R_NONCE_NOT_RETURNED) , "nonce not returned"}, + {ERR_REASON(TS_R_NO_CONTENT) , "no content"}, + {ERR_REASON(TS_R_NO_TIME_STAMP_TOKEN) , "no time stamp token"}, + {ERR_REASON(TS_R_PKCS7_ADD_SIGNATURE_ERROR), "pkcs7 add signature error"}, + {ERR_REASON(TS_R_PKCS7_ADD_SIGNED_ATTR_ERROR), "pkcs7 add signed attr error"}, + {ERR_REASON(TS_R_PKCS7_TO_TS_TST_INFO_FAILED), "pkcs7 to ts tst info failed"}, + {ERR_REASON(TS_R_POLICY_MISMATCH) , "policy mismatch"}, + {ERR_REASON(TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE), "private key does not match certificate"}, + {ERR_REASON(TS_R_RESPONSE_SETUP_ERROR) , "response setup error"}, + {ERR_REASON(TS_R_SIGNATURE_FAILURE) , "signature failure"}, + {ERR_REASON(TS_R_THERE_MUST_BE_ONE_SIGNER), "there must be one signer"}, + {ERR_REASON(TS_R_TIME_SYSCALL_ERROR) , "time syscall error"}, + {ERR_REASON(TS_R_TOKEN_NOT_PRESENT) , "token not present"}, + {ERR_REASON(TS_R_TOKEN_PRESENT) , "token present"}, + {ERR_REASON(TS_R_TSA_NAME_MISMATCH) , "tsa name mismatch"}, + {ERR_REASON(TS_R_TSA_UNTRUSTED) , "tsa untrusted"}, + {ERR_REASON(TS_R_TST_INFO_SETUP_ERROR) , "tst info setup error"}, + {ERR_REASON(TS_R_TS_DATASIGN) , "ts datasign"}, + {ERR_REASON(TS_R_UNACCEPTABLE_POLICY) , "unacceptable policy"}, + {ERR_REASON(TS_R_UNSUPPORTED_MD_ALGORITHM), "unsupported md algorithm"}, + {ERR_REASON(TS_R_UNSUPPORTED_VERSION) , "unsupported version"}, + {ERR_REASON(TS_R_WRONG_CONTENT_TYPE) , "wrong content type"}, + {0, NULL} +}; #endif -void ERR_load_TS_strings(void) - { +void +ERR_load_TS_strings(void) +{ #ifndef OPENSSL_NO_ERR - - if (ERR_func_error_string(TS_str_functs[0].error) == NULL) - { - ERR_load_strings(0,TS_str_functs); - ERR_load_strings(0,TS_str_reasons); - } -#endif + if (ERR_func_error_string(TS_str_functs[0].error) == NULL) { + ERR_load_strings(0, TS_str_functs); + ERR_load_strings(0, TS_str_reasons); } +#endif +} diff --git a/lib/libssl/src/crypto/ts/ts_lib.c b/lib/libssl/src/crypto/ts/ts_lib.c index a8de801e28f..81a5f23cd53 100644 --- a/lib/libssl/src/crypto/ts/ts_lib.c +++ b/lib/libssl/src/crypto/ts/ts_lib.c @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -67,27 +67,28 @@ /* Function definitions. */ -int TS_ASN1_INTEGER_print_bio(BIO *bio, const ASN1_INTEGER *num) - { +int +TS_ASN1_INTEGER_print_bio(BIO *bio, const ASN1_INTEGER *num) +{ BIGNUM num_bn; int result = 0; char *hex; BN_init(&num_bn); ASN1_INTEGER_to_BN(num, &num_bn); - if ((hex = BN_bn2hex(&num_bn))) - { + if ((hex = BN_bn2hex(&num_bn))) { result = BIO_write(bio, "0x", 2) > 0; result = result && BIO_write(bio, hex, strlen(hex)) > 0; free(hex); - } + } BN_free(&num_bn); return result; - } +} -int TS_OBJ_print_bio(BIO *bio, const ASN1_OBJECT *obj) - { +int +TS_OBJ_print_bio(BIO *bio, const ASN1_OBJECT *obj) +{ char obj_txt[128]; int len = OBJ_obj2txt(obj_txt, sizeof(obj_txt), obj, 0); @@ -95,51 +96,53 @@ int TS_OBJ_print_bio(BIO *bio, const ASN1_OBJECT *obj) BIO_write(bio, "\n", 1); return 1; - } +} -int TS_ext_print_bio(BIO *bio, const STACK_OF(X509_EXTENSION) *extensions) - { +int +TS_ext_print_bio(BIO *bio, const STACK_OF(X509_EXTENSION) *extensions) +{ int i, critical, n; X509_EXTENSION *ex; ASN1_OBJECT *obj; BIO_printf(bio, "Extensions:\n"); n = X509v3_get_ext_count(extensions); - for (i = 0; i < n; i++) - { + for (i = 0; i < n; i++) { ex = X509v3_get_ext(extensions, i); obj = X509_EXTENSION_get_object(ex); i2a_ASN1_OBJECT(bio, obj); critical = X509_EXTENSION_get_critical(ex); BIO_printf(bio, ": %s\n", critical ? "critical" : ""); - if (!X509V3_EXT_print(bio, ex, 0, 4)) - { + if (!X509V3_EXT_print(bio, ex, 0, 4)) { BIO_printf(bio, "%4s", ""); M_ASN1_OCTET_STRING_print(bio, ex->value); - } - BIO_write(bio, "\n", 1); } + BIO_write(bio, "\n", 1); + } return 1; - } +} -int TS_X509_ALGOR_print_bio(BIO *bio, const X509_ALGOR *alg) - { +int +TS_X509_ALGOR_print_bio(BIO *bio, const X509_ALGOR *alg) +{ int i = OBJ_obj2nid(alg->algorithm); + return BIO_printf(bio, "Hash Algorithm: %s\n", - (i == NID_undef) ? "UNKNOWN" : OBJ_nid2ln(i)); - } + (i == NID_undef) ? "UNKNOWN" : OBJ_nid2ln(i)); +} -int TS_MSG_IMPRINT_print_bio(BIO *bio, TS_MSG_IMPRINT *a) - { +int +TS_MSG_IMPRINT_print_bio(BIO *bio, TS_MSG_IMPRINT *a) +{ const ASN1_OCTET_STRING *msg; TS_X509_ALGOR_print_bio(bio, TS_MSG_IMPRINT_get_algo(a)); BIO_printf(bio, "Message data:\n"); msg = TS_MSG_IMPRINT_get_msg(a); - BIO_dump_indent(bio, (const char *)M_ASN1_STRING_data(msg), - M_ASN1_STRING_length(msg), 4); + BIO_dump_indent(bio, (const char *)M_ASN1_STRING_data(msg), + M_ASN1_STRING_length(msg), 4); return 1; - } +} diff --git a/lib/libssl/src/crypto/ts/ts_req_print.c b/lib/libssl/src/crypto/ts/ts_req_print.c index eba12c38240..53bf0c8eb8d 100644 --- a/lib/libssl/src/crypto/ts/ts_req_print.c +++ b/lib/libssl/src/crypto/ts/ts_req_print.c @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -65,13 +65,15 @@ /* Function definitions. */ -int TS_REQ_print_bio(BIO *bio, TS_REQ *a) - { +int +TS_REQ_print_bio(BIO *bio, TS_REQ *a) +{ int v; ASN1_OBJECT *policy_id; const ASN1_INTEGER *nonce; - if (a == NULL) return 0; + if (a == NULL) + return 0; v = TS_REQ_get_version(a); BIO_printf(bio, "Version: %d\n", v); @@ -82,7 +84,7 @@ int TS_REQ_print_bio(BIO *bio, TS_REQ *a) policy_id = TS_REQ_get_policy_id(a); if (policy_id == NULL) BIO_printf(bio, "unspecified\n"); - else + else TS_OBJ_print_bio(bio, policy_id); BIO_printf(bio, "Nonce: "); @@ -93,10 +95,10 @@ int TS_REQ_print_bio(BIO *bio, TS_REQ *a) TS_ASN1_INTEGER_print_bio(bio, nonce); BIO_write(bio, "\n", 1); - BIO_printf(bio, "Certificate required: %s\n", - TS_REQ_get_cert_req(a) ? "yes" : "no"); + BIO_printf(bio, "Certificate required: %s\n", + TS_REQ_get_cert_req(a) ? "yes" : "no"); TS_ext_print_bio(bio, TS_REQ_get_exts(a)); return 1; - } +} diff --git a/lib/libssl/src/crypto/ts/ts_req_utils.c b/lib/libssl/src/crypto/ts/ts_req_utils.c index 43280c15874..7518d7ab785 100644 --- a/lib/libssl/src/crypto/ts/ts_req_utils.c +++ b/lib/libssl/src/crypto/ts/ts_req_utils.c @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -62,173 +62,193 @@ #include #include -int TS_REQ_set_version(TS_REQ *a, long version) - { +int +TS_REQ_set_version(TS_REQ *a, long version) +{ return ASN1_INTEGER_set(a->version, version); - } +} -long TS_REQ_get_version(const TS_REQ *a) - { +long +TS_REQ_get_version(const TS_REQ *a) +{ return ASN1_INTEGER_get(a->version); - } +} -int TS_REQ_set_msg_imprint(TS_REQ *a, TS_MSG_IMPRINT *msg_imprint) - { +int +TS_REQ_set_msg_imprint(TS_REQ *a, TS_MSG_IMPRINT *msg_imprint) +{ TS_MSG_IMPRINT *new_msg_imprint; if (a->msg_imprint == msg_imprint) return 1; new_msg_imprint = TS_MSG_IMPRINT_dup(msg_imprint); - if (new_msg_imprint == NULL) - { + if (new_msg_imprint == NULL) { TSerr(TS_F_TS_REQ_SET_MSG_IMPRINT, ERR_R_MALLOC_FAILURE); return 0; - } + } TS_MSG_IMPRINT_free(a->msg_imprint); a->msg_imprint = new_msg_imprint; return 1; - } +} -TS_MSG_IMPRINT *TS_REQ_get_msg_imprint(TS_REQ *a) - { +TS_MSG_IMPRINT * +TS_REQ_get_msg_imprint(TS_REQ *a) +{ return a->msg_imprint; - } +} -int TS_MSG_IMPRINT_set_algo(TS_MSG_IMPRINT *a, X509_ALGOR *alg) - { +int +TS_MSG_IMPRINT_set_algo(TS_MSG_IMPRINT *a, X509_ALGOR *alg) +{ X509_ALGOR *new_alg; if (a->hash_algo == alg) return 1; new_alg = X509_ALGOR_dup(alg); - if (new_alg == NULL) - { + if (new_alg == NULL) { TSerr(TS_F_TS_MSG_IMPRINT_SET_ALGO, ERR_R_MALLOC_FAILURE); return 0; - } + } X509_ALGOR_free(a->hash_algo); a->hash_algo = new_alg; return 1; - } +} -X509_ALGOR *TS_MSG_IMPRINT_get_algo(TS_MSG_IMPRINT *a) - { +X509_ALGOR * +TS_MSG_IMPRINT_get_algo(TS_MSG_IMPRINT *a) +{ return a->hash_algo; - } +} -int TS_MSG_IMPRINT_set_msg(TS_MSG_IMPRINT *a, unsigned char *d, int len) - { +int +TS_MSG_IMPRINT_set_msg(TS_MSG_IMPRINT *a, unsigned char *d, int len) +{ return ASN1_OCTET_STRING_set(a->hashed_msg, d, len); - } +} -ASN1_OCTET_STRING *TS_MSG_IMPRINT_get_msg(TS_MSG_IMPRINT *a) - { +ASN1_OCTET_STRING * +TS_MSG_IMPRINT_get_msg(TS_MSG_IMPRINT *a) +{ return a->hashed_msg; - } +} -int TS_REQ_set_policy_id(TS_REQ *a, ASN1_OBJECT *policy) - { +int +TS_REQ_set_policy_id(TS_REQ *a, ASN1_OBJECT *policy) +{ ASN1_OBJECT *new_policy; if (a->policy_id == policy) return 1; new_policy = OBJ_dup(policy); - if (new_policy == NULL) - { + if (new_policy == NULL) { TSerr(TS_F_TS_REQ_SET_POLICY_ID, ERR_R_MALLOC_FAILURE); return 0; - } + } ASN1_OBJECT_free(a->policy_id); a->policy_id = new_policy; return 1; - } +} -ASN1_OBJECT *TS_REQ_get_policy_id(TS_REQ *a) - { +ASN1_OBJECT * +TS_REQ_get_policy_id(TS_REQ *a) +{ return a->policy_id; - } +} -int TS_REQ_set_nonce(TS_REQ *a, const ASN1_INTEGER *nonce) - { +int +TS_REQ_set_nonce(TS_REQ *a, const ASN1_INTEGER *nonce) +{ ASN1_INTEGER *new_nonce; if (a->nonce == nonce) return 1; new_nonce = ASN1_INTEGER_dup(nonce); - if (new_nonce == NULL) - { + if (new_nonce == NULL) { TSerr(TS_F_TS_REQ_SET_NONCE, ERR_R_MALLOC_FAILURE); return 0; - } + } ASN1_INTEGER_free(a->nonce); a->nonce = new_nonce; return 1; - } +} -const ASN1_INTEGER *TS_REQ_get_nonce(const TS_REQ *a) - { +const ASN1_INTEGER * +TS_REQ_get_nonce(const TS_REQ *a) +{ return a->nonce; - } +} -int TS_REQ_set_cert_req(TS_REQ *a, int cert_req) - { +int +TS_REQ_set_cert_req(TS_REQ *a, int cert_req) +{ a->cert_req = cert_req ? 0xFF : 0x00; return 1; - } +} -int TS_REQ_get_cert_req(const TS_REQ *a) - { +int +TS_REQ_get_cert_req(const TS_REQ *a) +{ return a->cert_req ? 1 : 0; - } +} STACK_OF(X509_EXTENSION) *TS_REQ_get_exts(TS_REQ *a) - { +{ return a->extensions; - } +} -void TS_REQ_ext_free(TS_REQ *a) - { - if (!a) return; +void +TS_REQ_ext_free(TS_REQ *a) +{ + if (!a) + return; sk_X509_EXTENSION_pop_free(a->extensions, X509_EXTENSION_free); a->extensions = NULL; - } +} -int TS_REQ_get_ext_count(TS_REQ *a) - { +int +TS_REQ_get_ext_count(TS_REQ *a) +{ return X509v3_get_ext_count(a->extensions); - } +} -int TS_REQ_get_ext_by_NID(TS_REQ *a, int nid, int lastpos) - { +int +TS_REQ_get_ext_by_NID(TS_REQ *a, int nid, int lastpos) +{ return X509v3_get_ext_by_NID(a->extensions, nid, lastpos); - } +} -int TS_REQ_get_ext_by_OBJ(TS_REQ *a, ASN1_OBJECT *obj, int lastpos) - { +int +TS_REQ_get_ext_by_OBJ(TS_REQ *a, ASN1_OBJECT *obj, int lastpos) +{ return X509v3_get_ext_by_OBJ(a->extensions, obj, lastpos); - } +} -int TS_REQ_get_ext_by_critical(TS_REQ *a, int crit, int lastpos) - { +int +TS_REQ_get_ext_by_critical(TS_REQ *a, int crit, int lastpos) +{ return X509v3_get_ext_by_critical(a->extensions, crit, lastpos); - } - -X509_EXTENSION *TS_REQ_get_ext(TS_REQ *a, int loc) - { - return X509v3_get_ext(a->extensions,loc); - } - -X509_EXTENSION *TS_REQ_delete_ext(TS_REQ *a, int loc) - { - return X509v3_delete_ext(a->extensions,loc); - } - -int TS_REQ_add_ext(TS_REQ *a, X509_EXTENSION *ex, int loc) - { - return X509v3_add_ext(&a->extensions,ex,loc) != NULL; - } - -void *TS_REQ_get_ext_d2i(TS_REQ *a, int nid, int *crit, int *idx) - { +} + +X509_EXTENSION * +TS_REQ_get_ext(TS_REQ *a, int loc) +{ + return X509v3_get_ext(a->extensions, loc); +} + +X509_EXTENSION * +TS_REQ_delete_ext(TS_REQ *a, int loc) +{ + return X509v3_delete_ext(a->extensions, loc); +} + +int +TS_REQ_add_ext(TS_REQ *a, X509_EXTENSION *ex, int loc) +{ + return X509v3_add_ext(&a->extensions, ex, loc) != NULL; +} + +void * +TS_REQ_get_ext_d2i(TS_REQ *a, int nid, int *crit, int *idx) +{ return X509V3_get_d2i(a->extensions, nid, crit, idx); - } +} diff --git a/lib/libssl/src/crypto/ts/ts_rsp_print.c b/lib/libssl/src/crypto/ts/ts_rsp_print.c index 21062517ba9..248674f4e56 100644 --- a/lib/libssl/src/crypto/ts/ts_rsp_print.c +++ b/lib/libssl/src/crypto/ts/ts_rsp_print.c @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -63,22 +63,22 @@ #include #include "ts.h" -struct status_map_st - { +struct status_map_st { int bit; const char *text; - }; +}; /* Local function declarations. */ static int TS_status_map_print(BIO *bio, struct status_map_st *a, - ASN1_BIT_STRING *v); + ASN1_BIT_STRING *v); static int TS_ACCURACY_print_bio(BIO *bio, const TS_ACCURACY *accuracy); /* Function definitions. */ -int TS_RESP_print_bio(BIO *bio, TS_RESP *a) - { +int +TS_RESP_print_bio(BIO *bio, TS_RESP *a) +{ TS_TST_INFO *tst_info; BIO_printf(bio, "Status info:\n"); @@ -90,98 +90,111 @@ int TS_RESP_print_bio(BIO *bio, TS_RESP *a) TS_TST_INFO_print_bio(bio, TS_RESP_get_tst_info(a)); else BIO_printf(bio, "Not included.\n"); - + return 1; - } +} -int TS_STATUS_INFO_print_bio(BIO *bio, TS_STATUS_INFO *a) - { - static const char *status_map[] = - { +int +TS_STATUS_INFO_print_bio(BIO *bio, TS_STATUS_INFO *a) +{ + static const char *status_map[] = { "Granted.", "Granted with modifications.", "Rejected.", "Waiting.", "Revocation warning.", "Revoked." - }; - static struct status_map_st failure_map[] = + }; + static struct status_map_st failure_map[] = { + { + TS_INFO_BAD_ALG, + "unrecognized or unsupported algorithm identifier" + }, + { + TS_INFO_BAD_REQUEST, + "transaction not permitted or supported" + }, { - { TS_INFO_BAD_ALG, - "unrecognized or unsupported algorithm identifier" }, - { TS_INFO_BAD_REQUEST, - "transaction not permitted or supported" }, - { TS_INFO_BAD_DATA_FORMAT, - "the data submitted has the wrong format" }, - { TS_INFO_TIME_NOT_AVAILABLE, - "the TSA's time source is not available" }, - { TS_INFO_UNACCEPTED_POLICY, - "the requested TSA policy is not supported by the TSA" }, - { TS_INFO_UNACCEPTED_EXTENSION, - "the requested extension is not supported by the TSA" }, - { TS_INFO_ADD_INFO_NOT_AVAILABLE, - "the additional information requested could not be understood " - "or is not available" }, - { TS_INFO_SYSTEM_FAILURE, - "the request cannot be handled due to system failure" }, + TS_INFO_BAD_DATA_FORMAT, + "the data submitted has the wrong format" + }, + { + TS_INFO_TIME_NOT_AVAILABLE, + "the TSA's time source is not available" + }, + { + TS_INFO_UNACCEPTED_POLICY, + "the requested TSA policy is not supported by the TSA" + }, + { + TS_INFO_UNACCEPTED_EXTENSION, + "the requested extension is not supported by the TSA" + }, + { + TS_INFO_ADD_INFO_NOT_AVAILABLE, + "the additional information requested could not be understood " + "or is not available" + }, + { + TS_INFO_SYSTEM_FAILURE, + "the request cannot be handled due to system failure" + }, { -1, NULL } - }; + }; long status; int i, lines = 0; /* Printing status code. */ BIO_printf(bio, "Status: "); status = ASN1_INTEGER_get(a->status); - if (0 <= status && status < (long)(sizeof(status_map)/sizeof(status_map[0]))) + if (0 <= status && + status < (long)(sizeof(status_map) / sizeof(status_map[0]))) BIO_printf(bio, "%s\n", status_map[status]); else BIO_printf(bio, "out of bounds\n"); - + /* Printing status description. */ BIO_printf(bio, "Status description: "); - for (i = 0; i < sk_ASN1_UTF8STRING_num(a->text); ++i) - { + for (i = 0; i < sk_ASN1_UTF8STRING_num(a->text); ++i) { if (i > 0) BIO_puts(bio, "\t"); ASN1_STRING_print_ex(bio, sk_ASN1_UTF8STRING_value(a->text, i), - 0); + 0); BIO_puts(bio, "\n"); - } + } if (i == 0) BIO_printf(bio, "unspecified\n"); /* Printing failure information. */ BIO_printf(bio, "Failure info: "); if (a->failure_info != NULL) - lines = TS_status_map_print(bio, failure_map, - a->failure_info); + lines = TS_status_map_print(bio, failure_map, a->failure_info); if (lines == 0) BIO_printf(bio, "unspecified"); BIO_printf(bio, "\n"); return 1; - } +} -static int TS_status_map_print(BIO *bio, struct status_map_st *a, - ASN1_BIT_STRING *v) - { +static int +TS_status_map_print(BIO *bio, struct status_map_st *a, ASN1_BIT_STRING *v) +{ int lines = 0; - for (; a->bit >= 0; ++a) - { - if (ASN1_BIT_STRING_get_bit(v, a->bit)) - { + for (; a->bit >= 0; ++a) { + if (ASN1_BIT_STRING_get_bit(v, a->bit)) { if (++lines > 1) BIO_printf(bio, ", "); BIO_printf(bio, "%s", a->text); - } } + } return lines; - } +} -int TS_TST_INFO_print_bio(BIO *bio, TS_TST_INFO *a) - { +int +TS_TST_INFO_print_bio(BIO *bio, TS_TST_INFO *a) +{ int v; ASN1_OBJECT *policy_id; const ASN1_INTEGER *serial; @@ -190,7 +203,8 @@ int TS_TST_INFO_print_bio(BIO *bio, TS_TST_INFO *a) const ASN1_INTEGER *nonce; GENERAL_NAME *tsa_name; - if (a == NULL) return 0; + if (a == NULL) + return 0; /* Print version. */ v = TS_TST_INFO_get_version(a); @@ -229,8 +243,8 @@ int TS_TST_INFO_print_bio(BIO *bio, TS_TST_INFO *a) BIO_write(bio, "\n", 1); /* Print ordering. */ - BIO_printf(bio, "Ordering: %s\n", - TS_TST_INFO_get_ordering(a) ? "yes" : "no"); + BIO_printf(bio, "Ordering: %s\n", + TS_TST_INFO_get_ordering(a) ? "yes" : "no"); /* Print nonce. */ BIO_printf(bio, "Nonce: "); @@ -246,23 +260,23 @@ int TS_TST_INFO_print_bio(BIO *bio, TS_TST_INFO *a) tsa_name = TS_TST_INFO_get_tsa(a); if (tsa_name == NULL) BIO_printf(bio, "unspecified"); - else - { + else { STACK_OF(CONF_VALUE) *nval; if ((nval = i2v_GENERAL_NAME(NULL, tsa_name, NULL))) X509V3_EXT_val_prn(bio, nval, 0, 0); sk_CONF_VALUE_pop_free(nval, X509V3_conf_free); - } + } BIO_write(bio, "\n", 1); /* Print extensions. */ TS_ext_print_bio(bio, TS_TST_INFO_get_exts(a)); return 1; - } +} -static int TS_ACCURACY_print_bio(BIO *bio, const TS_ACCURACY *accuracy) - { +static int +TS_ACCURACY_print_bio(BIO *bio, const TS_ACCURACY *accuracy) +{ const ASN1_INTEGER *seconds = TS_ACCURACY_get_seconds(accuracy); const ASN1_INTEGER *millis = TS_ACCURACY_get_millis(accuracy); const ASN1_INTEGER *micros = TS_ACCURACY_get_micros(accuracy); @@ -284,4 +298,4 @@ static int TS_ACCURACY_print_bio(BIO *bio, const TS_ACCURACY *accuracy) BIO_printf(bio, " micros"); return 1; - } +} diff --git a/lib/libssl/src/crypto/ts/ts_rsp_sign.c b/lib/libssl/src/crypto/ts/ts_rsp_sign.c index 17f81b4a35d..71530d7f242 100644 --- a/lib/libssl/src/crypto/ts/ts_rsp_sign.c +++ b/lib/libssl/src/crypto/ts/ts_rsp_sign.c @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -76,102 +76,107 @@ static void TS_RESP_CTX_init(TS_RESP_CTX *ctx); static void TS_RESP_CTX_cleanup(TS_RESP_CTX *ctx); static int TS_RESP_check_request(TS_RESP_CTX *ctx); static ASN1_OBJECT *TS_RESP_get_policy(TS_RESP_CTX *ctx); -static TS_TST_INFO *TS_RESP_create_tst_info(TS_RESP_CTX *ctx, - ASN1_OBJECT *policy); +static TS_TST_INFO *TS_RESP_create_tst_info(TS_RESP_CTX *ctx, + ASN1_OBJECT *policy); static int TS_RESP_process_extensions(TS_RESP_CTX *ctx); static int TS_RESP_sign(TS_RESP_CTX *ctx); -static ESS_SIGNING_CERT *ESS_SIGNING_CERT_new_init(X509 *signcert, - STACK_OF(X509) *certs); +static ESS_SIGNING_CERT *ESS_SIGNING_CERT_new_init(X509 *signcert, + STACK_OF(X509) *certs); static ESS_CERT_ID *ESS_CERT_ID_new_init(X509 *cert, int issuer_needed); static int TS_TST_INFO_content_new(PKCS7 *p7); static int ESS_add_signing_cert(PKCS7_SIGNER_INFO *si, ESS_SIGNING_CERT *sc); static ASN1_GENERALIZEDTIME *TS_RESP_set_genTime_with_precision( - ASN1_GENERALIZEDTIME *, long, long, unsigned); + ASN1_GENERALIZEDTIME *, long, long, unsigned); /* Default callbacks for response generation. */ -static ASN1_INTEGER *def_serial_cb(struct TS_resp_ctx *ctx, void *data) - { +static ASN1_INTEGER * +def_serial_cb(struct TS_resp_ctx *ctx, void *data) +{ ASN1_INTEGER *serial = ASN1_INTEGER_new(); - if (!serial) goto err; - if (!ASN1_INTEGER_set(serial, 1)) goto err; + + if (!serial) + goto err; + if (!ASN1_INTEGER_set(serial, 1)) + goto err; return serial; - err: + +err: TSerr(TS_F_DEF_SERIAL_CB, ERR_R_MALLOC_FAILURE); TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, - "Error during serial number generation."); + "Error during serial number generation."); return NULL; - } +} #if defined(OPENSSL_SYS_UNIX) /* Use the gettimeofday function call. */ -static int def_time_cb(struct TS_resp_ctx *ctx, void *data, - long *sec, long *usec) - { +static int +def_time_cb(struct TS_resp_ctx *ctx, void *data, long *sec, long *usec) +{ struct timeval tv; - if (gettimeofday(&tv, NULL) != 0) - { + + if (gettimeofday(&tv, NULL) != 0) { TSerr(TS_F_DEF_TIME_CB, TS_R_TIME_SYSCALL_ERROR); TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, - "Time is not available."); + "Time is not available."); TS_RESP_CTX_add_failure_info(ctx, TS_INFO_TIME_NOT_AVAILABLE); return 0; - } + } /* Return time to caller. */ *sec = tv.tv_sec; *usec = tv.tv_usec; return 1; - } +} #else /* Use the time function call that provides only seconds precision. */ -static int def_time_cb(struct TS_resp_ctx *ctx, void *data, - long *sec, long *usec) - { +static int +def_time_cb(struct TS_resp_ctx *ctx, void *data, long *sec, long *usec) +{ time_t t; - if (time(&t) == (time_t) -1) - { + + if (time(&t) == (time_t) - 1) { TSerr(TS_F_DEF_TIME_CB, TS_R_TIME_SYSCALL_ERROR); TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, - "Time is not available."); + "Time is not available."); TS_RESP_CTX_add_failure_info(ctx, TS_INFO_TIME_NOT_AVAILABLE); return 0; - } + } /* Return time to caller, only second precision. */ *sec = (long) t; *usec = 0; return 1; - } +} #endif -static int def_extension_cb(struct TS_resp_ctx *ctx, X509_EXTENSION *ext, - void *data) - { +static int +def_extension_cb(struct TS_resp_ctx *ctx, X509_EXTENSION *ext, void *data) +{ /* No extensions are processed here. */ TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, - "Unsupported extension."); + "Unsupported extension."); TS_RESP_CTX_add_failure_info(ctx, TS_INFO_UNACCEPTED_EXTENSION); return 0; - } +} /* TS_RESP_CTX management functions. */ -TS_RESP_CTX *TS_RESP_CTX_new() - { +TS_RESP_CTX * +TS_RESP_CTX_new() +{ TS_RESP_CTX *ctx; - if (!(ctx = (TS_RESP_CTX *) malloc(sizeof(TS_RESP_CTX)))) - { + if (!(ctx = (TS_RESP_CTX *) malloc(sizeof(TS_RESP_CTX)))) { TSerr(TS_F_TS_RESP_CTX_NEW, ERR_R_MALLOC_FAILURE); return NULL; - } + } memset(ctx, 0, sizeof(TS_RESP_CTX)); /* Setting default callbacks. */ @@ -180,11 +185,13 @@ TS_RESP_CTX *TS_RESP_CTX_new() ctx->extension_cb = def_extension_cb; return ctx; - } +} -void TS_RESP_CTX_free(TS_RESP_CTX *ctx) - { - if (!ctx) return; +void +TS_RESP_CTX_free(TS_RESP_CTX *ctx) +{ + if (!ctx) + return; X509_free(ctx->signer_cert); EVP_PKEY_free(ctx->signer_key); @@ -196,95 +203,108 @@ void TS_RESP_CTX_free(TS_RESP_CTX *ctx) ASN1_INTEGER_free(ctx->millis); ASN1_INTEGER_free(ctx->micros); free(ctx); - } - -int TS_RESP_CTX_set_signer_cert(TS_RESP_CTX *ctx, X509 *signer) - { - if (X509_check_purpose(signer, X509_PURPOSE_TIMESTAMP_SIGN, 0) != 1) - { - TSerr(TS_F_TS_RESP_CTX_SET_SIGNER_CERT, - TS_R_INVALID_SIGNER_CERTIFICATE_PURPOSE); +} + +int +TS_RESP_CTX_set_signer_cert(TS_RESP_CTX *ctx, X509 *signer) +{ + if (X509_check_purpose(signer, X509_PURPOSE_TIMESTAMP_SIGN, 0) != 1) { + TSerr(TS_F_TS_RESP_CTX_SET_SIGNER_CERT, + TS_R_INVALID_SIGNER_CERTIFICATE_PURPOSE); return 0; - } - if (ctx->signer_cert) X509_free(ctx->signer_cert); + } + if (ctx->signer_cert) + X509_free(ctx->signer_cert); ctx->signer_cert = signer; CRYPTO_add(&ctx->signer_cert->references, +1, CRYPTO_LOCK_X509); return 1; - } +} -int TS_RESP_CTX_set_signer_key(TS_RESP_CTX *ctx, EVP_PKEY *key) - { - if (ctx->signer_key) EVP_PKEY_free(ctx->signer_key); +int +TS_RESP_CTX_set_signer_key(TS_RESP_CTX *ctx, EVP_PKEY *key) +{ + if (ctx->signer_key) + EVP_PKEY_free(ctx->signer_key); ctx->signer_key = key; CRYPTO_add(&ctx->signer_key->references, +1, CRYPTO_LOCK_EVP_PKEY); return 1; - } - -int TS_RESP_CTX_set_def_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *def_policy) - { - if (ctx->default_policy) ASN1_OBJECT_free(ctx->default_policy); - if (!(ctx->default_policy = OBJ_dup(def_policy))) goto err; +} + +int +TS_RESP_CTX_set_def_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *def_policy) +{ + if (ctx->default_policy) + ASN1_OBJECT_free(ctx->default_policy); + if (!(ctx->default_policy = OBJ_dup(def_policy))) + goto err; return 1; - err: + +err: TSerr(TS_F_TS_RESP_CTX_SET_DEF_POLICY, ERR_R_MALLOC_FAILURE); return 0; - } +} -int TS_RESP_CTX_set_certs(TS_RESP_CTX *ctx, STACK_OF(X509) *certs) - { +int +TS_RESP_CTX_set_certs(TS_RESP_CTX *ctx, STACK_OF(X509) *certs) +{ int i; - if (ctx->certs) - { + if (ctx->certs) { sk_X509_pop_free(ctx->certs, X509_free); ctx->certs = NULL; - } - if (!certs) return 1; - if (!(ctx->certs = sk_X509_dup(certs))) - { + } + if (!certs) + return 1; + if (!(ctx->certs = sk_X509_dup(certs))) { TSerr(TS_F_TS_RESP_CTX_SET_CERTS, ERR_R_MALLOC_FAILURE); return 0; - } - for (i = 0; i < sk_X509_num(ctx->certs); ++i) - { + } + for (i = 0; i < sk_X509_num(ctx->certs); ++i) { X509 *cert = sk_X509_value(ctx->certs, i); CRYPTO_add(&cert->references, +1, CRYPTO_LOCK_X509); - } + } return 1; - } +} -int TS_RESP_CTX_add_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *policy) - { +int +TS_RESP_CTX_add_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *policy) +{ ASN1_OBJECT *copy = NULL; /* Create new policy stack if necessary. */ - if (!ctx->policies && !(ctx->policies = sk_ASN1_OBJECT_new_null())) + if (!ctx->policies && !(ctx->policies = sk_ASN1_OBJECT_new_null())) + goto err; + if (!(copy = OBJ_dup(policy))) + goto err; + if (!sk_ASN1_OBJECT_push(ctx->policies, copy)) goto err; - if (!(copy = OBJ_dup(policy))) goto err; - if (!sk_ASN1_OBJECT_push(ctx->policies, copy)) goto err; return 1; - err: + +err: TSerr(TS_F_TS_RESP_CTX_ADD_POLICY, ERR_R_MALLOC_FAILURE); ASN1_OBJECT_free(copy); return 0; - } +} -int TS_RESP_CTX_add_md(TS_RESP_CTX *ctx, const EVP_MD *md) - { +int +TS_RESP_CTX_add_md(TS_RESP_CTX *ctx, const EVP_MD *md) +{ /* Create new md stack if necessary. */ - if (!ctx->mds && !(ctx->mds = sk_EVP_MD_new_null())) + if (!ctx->mds && !(ctx->mds = sk_EVP_MD_new_null())) goto err; /* Add the shared md, no copy needed. */ - if (!sk_EVP_MD_push(ctx->mds, (EVP_MD *)md)) goto err; + if (!sk_EVP_MD_push(ctx->mds, (EVP_MD *)md)) + goto err; return 1; - err: + +err: TSerr(TS_F_TS_RESP_CTX_ADD_MD, ERR_R_MALLOC_FAILURE); return 0; - } +} #define TS_RESP_CTX_accuracy_free(ctx) \ ASN1_INTEGER_free(ctx->seconds); \ @@ -294,129 +314,142 @@ int TS_RESP_CTX_add_md(TS_RESP_CTX *ctx, const EVP_MD *md) ASN1_INTEGER_free(ctx->micros); \ ctx->micros = NULL; -int TS_RESP_CTX_set_accuracy(TS_RESP_CTX *ctx, - int secs, int millis, int micros) - { - +int +TS_RESP_CTX_set_accuracy(TS_RESP_CTX *ctx, int secs, int millis, int micros) +{ TS_RESP_CTX_accuracy_free(ctx); - if (secs && (!(ctx->seconds = ASN1_INTEGER_new()) - || !ASN1_INTEGER_set(ctx->seconds, secs))) + if (secs && (!(ctx->seconds = ASN1_INTEGER_new()) || + !ASN1_INTEGER_set(ctx->seconds, secs))) goto err; - if (millis && (!(ctx->millis = ASN1_INTEGER_new()) - || !ASN1_INTEGER_set(ctx->millis, millis))) + if (millis && (!(ctx->millis = ASN1_INTEGER_new()) || + !ASN1_INTEGER_set(ctx->millis, millis))) goto err; - if (micros && (!(ctx->micros = ASN1_INTEGER_new()) - || !ASN1_INTEGER_set(ctx->micros, micros))) + if (micros && (!(ctx->micros = ASN1_INTEGER_new()) || + !ASN1_INTEGER_set(ctx->micros, micros))) goto err; return 1; - err: + +err: TS_RESP_CTX_accuracy_free(ctx); TSerr(TS_F_TS_RESP_CTX_SET_ACCURACY, ERR_R_MALLOC_FAILURE); return 0; - } +} -void TS_RESP_CTX_add_flags(TS_RESP_CTX *ctx, int flags) - { +void +TS_RESP_CTX_add_flags(TS_RESP_CTX *ctx, int flags) +{ ctx->flags |= flags; - } +} -void TS_RESP_CTX_set_serial_cb(TS_RESP_CTX *ctx, TS_serial_cb cb, void *data) - { +void +TS_RESP_CTX_set_serial_cb(TS_RESP_CTX *ctx, TS_serial_cb cb, void *data) +{ ctx->serial_cb = cb; ctx->serial_cb_data = data; - } +} -void TS_RESP_CTX_set_time_cb(TS_RESP_CTX *ctx, TS_time_cb cb, void *data) - { +void +TS_RESP_CTX_set_time_cb(TS_RESP_CTX *ctx, TS_time_cb cb, void *data) +{ ctx->time_cb = cb; ctx->time_cb_data = data; - } +} -void TS_RESP_CTX_set_extension_cb(TS_RESP_CTX *ctx, - TS_extension_cb cb, void *data) - { +void +TS_RESP_CTX_set_extension_cb(TS_RESP_CTX *ctx, TS_extension_cb cb, void *data) +{ ctx->extension_cb = cb; ctx->extension_cb_data = data; - } +} -int TS_RESP_CTX_set_status_info(TS_RESP_CTX *ctx, - int status, const char *text) - { +int +TS_RESP_CTX_set_status_info(TS_RESP_CTX *ctx, int status, const char *text) +{ TS_STATUS_INFO *si = NULL; ASN1_UTF8STRING *utf8_text = NULL; int ret = 0; - if (!(si = TS_STATUS_INFO_new())) goto err; - if (!ASN1_INTEGER_set(si->status, status)) goto err; - if (text) - { - if (!(utf8_text = ASN1_UTF8STRING_new()) - || !ASN1_STRING_set(utf8_text, text, strlen(text))) + if (!(si = TS_STATUS_INFO_new())) + goto err; + if (!ASN1_INTEGER_set(si->status, status)) + goto err; + if (text) { + if (!(utf8_text = ASN1_UTF8STRING_new()) || + !ASN1_STRING_set(utf8_text, text, strlen(text))) goto err; if (!si->text && !(si->text = sk_ASN1_UTF8STRING_new_null())) goto err; - if (!sk_ASN1_UTF8STRING_push(si->text, utf8_text)) goto err; + if (!sk_ASN1_UTF8STRING_push(si->text, utf8_text)) + goto err; utf8_text = NULL; /* Ownership is lost. */ - } - if (!TS_RESP_set_status_info(ctx->response, si)) goto err; + } + if (!TS_RESP_set_status_info(ctx->response, si)) + goto err; ret = 1; - err: + +err: if (!ret) TSerr(TS_F_TS_RESP_CTX_SET_STATUS_INFO, ERR_R_MALLOC_FAILURE); TS_STATUS_INFO_free(si); ASN1_UTF8STRING_free(utf8_text); return ret; - } +} -int TS_RESP_CTX_set_status_info_cond(TS_RESP_CTX *ctx, - int status, const char *text) - { +int +TS_RESP_CTX_set_status_info_cond(TS_RESP_CTX *ctx, int status, const char *text) +{ int ret = 1; TS_STATUS_INFO *si = TS_RESP_get_status_info(ctx->response); - if (ASN1_INTEGER_get(si->status) == TS_STATUS_GRANTED) - { + if (ASN1_INTEGER_get(si->status) == TS_STATUS_GRANTED) { /* Status has not been set, set it now. */ ret = TS_RESP_CTX_set_status_info(ctx, status, text); - } - return ret; } + return ret; +} -int TS_RESP_CTX_add_failure_info(TS_RESP_CTX *ctx, int failure) - { +int +TS_RESP_CTX_add_failure_info(TS_RESP_CTX *ctx, int failure) +{ TS_STATUS_INFO *si = TS_RESP_get_status_info(ctx->response); + if (!si->failure_info && !(si->failure_info = ASN1_BIT_STRING_new())) goto err; if (!ASN1_BIT_STRING_set_bit(si->failure_info, failure, 1)) goto err; return 1; - err: + +err: TSerr(TS_F_TS_RESP_CTX_ADD_FAILURE_INFO, ERR_R_MALLOC_FAILURE); return 0; - } +} -TS_REQ *TS_RESP_CTX_get_request(TS_RESP_CTX *ctx) - { +TS_REQ * +TS_RESP_CTX_get_request(TS_RESP_CTX *ctx) +{ return ctx->request; - } +} -TS_TST_INFO *TS_RESP_CTX_get_tst_info(TS_RESP_CTX *ctx) - { +TS_TST_INFO * +TS_RESP_CTX_get_tst_info(TS_RESP_CTX *ctx) +{ return ctx->tst_info; - } +} -int TS_RESP_CTX_set_clock_precision_digits(TS_RESP_CTX *ctx, unsigned precision) - { - if (precision > TS_MAX_CLOCK_PRECISION_DIGITS) - return 0; - ctx->clock_precision_digits = precision; - return 1; - } +int +TS_RESP_CTX_set_clock_precision_digits(TS_RESP_CTX *ctx, unsigned precision) +{ + if (precision > TS_MAX_CLOCK_PRECISION_DIGITS) + return 0; + ctx->clock_precision_digits = precision; + return 1; +} /* Main entry method of the response generation. */ -TS_RESP *TS_RESP_create_response(TS_RESP_CTX *ctx, BIO *req_bio) - { +TS_RESP * +TS_RESP_create_response(TS_RESP_CTX *ctx, BIO *req_bio) +{ ASN1_OBJECT *policy; TS_RESP *response; int result = 0; @@ -424,87 +457,90 @@ TS_RESP *TS_RESP_create_response(TS_RESP_CTX *ctx, BIO *req_bio) TS_RESP_CTX_init(ctx); /* Creating the response object. */ - if (!(ctx->response = TS_RESP_new())) - { + if (!(ctx->response = TS_RESP_new())) { TSerr(TS_F_TS_RESP_CREATE_RESPONSE, ERR_R_MALLOC_FAILURE); goto end; - } + } /* Parsing DER request. */ - if (!(ctx->request = d2i_TS_REQ_bio(req_bio, NULL))) - { + if (!(ctx->request = d2i_TS_REQ_bio(req_bio, NULL))) { TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, - "Bad request format or " - "system error."); + "Bad request format or " + "system error."); TS_RESP_CTX_add_failure_info(ctx, TS_INFO_BAD_DATA_FORMAT); goto end; - } + } /* Setting default status info. */ if (!TS_RESP_CTX_set_status_info(ctx, TS_STATUS_GRANTED, NULL)) goto end; /* Checking the request format. */ - if (!TS_RESP_check_request(ctx)) goto end; + if (!TS_RESP_check_request(ctx)) + goto end; /* Checking acceptable policies. */ - if (!(policy = TS_RESP_get_policy(ctx))) goto end; + if (!(policy = TS_RESP_get_policy(ctx))) + goto end; /* Creating the TS_TST_INFO object. */ if (!(ctx->tst_info = TS_RESP_create_tst_info(ctx, policy))) goto end; /* Processing extensions. */ - if (!TS_RESP_process_extensions(ctx)) goto end; + if (!TS_RESP_process_extensions(ctx)) + goto end; /* Generating the signature. */ - if (!TS_RESP_sign(ctx)) goto end; + if (!TS_RESP_sign(ctx)) + goto end; /* Everything was successful. */ result = 1; - end: - if (!result) - { + +end: + if (!result) { TSerr(TS_F_TS_RESP_CREATE_RESPONSE, TS_R_RESPONSE_SETUP_ERROR); - if (ctx->response != NULL) - { + if (ctx->response != NULL) { if (TS_RESP_CTX_set_status_info_cond(ctx, - TS_STATUS_REJECTION, "Error during response " - "generation.") == 0) - { + TS_STATUS_REJECTION, "Error during response " + "generation.") == 0) { TS_RESP_free(ctx->response); ctx->response = NULL; - } } } + } response = ctx->response; ctx->response = NULL; /* Ownership will be returned to caller. */ TS_RESP_CTX_cleanup(ctx); return response; - } +} /* Initializes the variable part of the context. */ -static void TS_RESP_CTX_init(TS_RESP_CTX *ctx) - { +static void +TS_RESP_CTX_init(TS_RESP_CTX *ctx) +{ ctx->request = NULL; ctx->response = NULL; ctx->tst_info = NULL; - } +} /* Cleans up the variable part of the context. */ -static void TS_RESP_CTX_cleanup(TS_RESP_CTX *ctx) - { +static void +TS_RESP_CTX_cleanup(TS_RESP_CTX *ctx) +{ TS_REQ_free(ctx->request); ctx->request = NULL; TS_RESP_free(ctx->response); ctx->response = NULL; TS_TST_INFO_free(ctx->tst_info); ctx->tst_info = NULL; - } +} /* Checks the format and content of the request. */ -static int TS_RESP_check_request(TS_RESP_CTX *ctx) - { +static int +TS_RESP_check_request(TS_RESP_CTX *ctx) +{ TS_REQ *request = ctx->request; TS_MSG_IMPRINT *msg_imprint; X509_ALGOR *md_alg; @@ -514,95 +550,88 @@ static int TS_RESP_check_request(TS_RESP_CTX *ctx) int i; /* Checking request version. */ - if (TS_REQ_get_version(request) != 1) - { + if (TS_REQ_get_version(request) != 1) { TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, - "Bad request version."); + "Bad request version."); TS_RESP_CTX_add_failure_info(ctx, TS_INFO_BAD_REQUEST); return 0; - } + } /* Checking message digest algorithm. */ msg_imprint = TS_REQ_get_msg_imprint(request); md_alg = TS_MSG_IMPRINT_get_algo(msg_imprint); md_alg_id = OBJ_obj2nid(md_alg->algorithm); - for (i = 0; !md && i < sk_EVP_MD_num(ctx->mds); ++i) - { + for (i = 0; !md && i < sk_EVP_MD_num(ctx->mds); ++i) { EVP_MD *current_md = sk_EVP_MD_value(ctx->mds, i); if (md_alg_id == EVP_MD_type(current_md)) md = current_md; - } - if (!md) - { + } + if (!md) { TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, - "Message digest algorithm is " - "not supported."); + "Message digest algorithm is " + "not supported."); TS_RESP_CTX_add_failure_info(ctx, TS_INFO_BAD_ALG); return 0; - } + } /* No message digest takes parameter. */ - if (md_alg->parameter - && ASN1_TYPE_get(md_alg->parameter) != V_ASN1_NULL) - { + if (md_alg->parameter && + ASN1_TYPE_get(md_alg->parameter) != V_ASN1_NULL) { TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, - "Superfluous message digest " - "parameter."); + "Superfluous message digest " + "parameter."); TS_RESP_CTX_add_failure_info(ctx, TS_INFO_BAD_ALG); return 0; - } + } /* Checking message digest size. */ digest = TS_MSG_IMPRINT_get_msg(msg_imprint); - if (digest->length != EVP_MD_size(md)) - { + if (digest->length != EVP_MD_size(md)) { TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, - "Bad message digest."); + "Bad message digest."); TS_RESP_CTX_add_failure_info(ctx, TS_INFO_BAD_DATA_FORMAT); return 0; - } + } return 1; - } +} /* Returns the TSA policy based on the requested and acceptable policies. */ -static ASN1_OBJECT *TS_RESP_get_policy(TS_RESP_CTX *ctx) - { +static ASN1_OBJECT * +TS_RESP_get_policy(TS_RESP_CTX *ctx) +{ ASN1_OBJECT *requested = TS_REQ_get_policy_id(ctx->request); ASN1_OBJECT *policy = NULL; int i; - if (ctx->default_policy == NULL) - { + if (ctx->default_policy == NULL) { TSerr(TS_F_TS_RESP_GET_POLICY, TS_R_INVALID_NULL_POINTER); return NULL; - } + } /* Return the default policy if none is requested or the default is requested. */ if (!requested || !OBJ_cmp(requested, ctx->default_policy)) policy = ctx->default_policy; /* Check if the policy is acceptable. */ - for (i = 0; !policy && i < sk_ASN1_OBJECT_num(ctx->policies); ++i) - { + for (i = 0; !policy && i < sk_ASN1_OBJECT_num(ctx->policies); ++i) { ASN1_OBJECT *current = sk_ASN1_OBJECT_value(ctx->policies, i); if (!OBJ_cmp(requested, current)) policy = current; - } - if (!policy) - { + } + if (!policy) { TSerr(TS_F_TS_RESP_GET_POLICY, TS_R_UNACCEPTABLE_POLICY); TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, - "Requested policy is not " - "supported."); + "Requested policy is not " + "supported."); TS_RESP_CTX_add_failure_info(ctx, TS_INFO_UNACCEPTED_POLICY); - } - return policy; } + return policy; +} /* Creates the TS_TST_INFO object based on the settings of the context. */ -static TS_TST_INFO *TS_RESP_create_tst_info(TS_RESP_CTX *ctx, - ASN1_OBJECT *policy) - { +static TS_TST_INFO * +TS_RESP_create_tst_info(TS_RESP_CTX *ctx, ASN1_OBJECT *policy) +{ int result = 0; TS_TST_INFO *tst_info = NULL; ASN1_INTEGER *serial = NULL; @@ -612,24 +641,26 @@ static TS_TST_INFO *TS_RESP_create_tst_info(TS_RESP_CTX *ctx, const ASN1_INTEGER *nonce; GENERAL_NAME *tsa_name = NULL; - if (!(tst_info = TS_TST_INFO_new())) goto end; - if (!TS_TST_INFO_set_version(tst_info, 1)) goto end; - if (!TS_TST_INFO_set_policy_id(tst_info, policy)) goto end; + if (!(tst_info = TS_TST_INFO_new())) + goto end; + if (!TS_TST_INFO_set_version(tst_info, 1)) + goto end; + if (!TS_TST_INFO_set_policy_id(tst_info, policy)) + goto end; if (!TS_TST_INFO_set_msg_imprint(tst_info, ctx->request->msg_imprint)) goto end; - if (!(serial = (*ctx->serial_cb)(ctx, ctx->serial_cb_data)) - || !TS_TST_INFO_set_serial(tst_info, serial)) + if (!(serial = (*ctx->serial_cb)(ctx, ctx->serial_cb_data)) || + !TS_TST_INFO_set_serial(tst_info, serial)) goto end; - if (!(*ctx->time_cb)(ctx, ctx->time_cb_data, &sec, &usec) - || !(asn1_time = TS_RESP_set_genTime_with_precision(NULL, - sec, usec, - ctx->clock_precision_digits)) - || !TS_TST_INFO_set_time(tst_info, asn1_time)) + if (!(*ctx->time_cb)(ctx, ctx->time_cb_data, &sec, &usec) || + !(asn1_time = TS_RESP_set_genTime_with_precision(NULL, sec, usec, + ctx->clock_precision_digits)) || + !TS_TST_INFO_set_time(tst_info, asn1_time)) goto end; /* Setting accuracy if needed. */ - if ((ctx->seconds || ctx->millis || ctx->micros) - && !(accuracy = TS_ACCURACY_new())) + if ((ctx->seconds || ctx->millis || ctx->micros) && + !(accuracy = TS_ACCURACY_new())) goto end; if (ctx->seconds && !TS_ACCURACY_set_seconds(accuracy, ctx->seconds)) @@ -638,58 +669,60 @@ static TS_TST_INFO *TS_RESP_create_tst_info(TS_RESP_CTX *ctx, goto end; if (ctx->micros && !TS_ACCURACY_set_micros(accuracy, ctx->micros)) goto end; - if (accuracy && !TS_TST_INFO_set_accuracy(tst_info, accuracy)) + if (accuracy && !TS_TST_INFO_set_accuracy(tst_info, accuracy)) goto end; /* Setting ordering. */ - if ((ctx->flags & TS_ORDERING) - && !TS_TST_INFO_set_ordering(tst_info, 1)) + if ((ctx->flags & TS_ORDERING) && + !TS_TST_INFO_set_ordering(tst_info, 1)) goto end; - + /* Setting nonce if needed. */ - if ((nonce = TS_REQ_get_nonce(ctx->request)) != NULL - && !TS_TST_INFO_set_nonce(tst_info, nonce)) + if ((nonce = TS_REQ_get_nonce(ctx->request)) != NULL && + !TS_TST_INFO_set_nonce(tst_info, nonce)) goto end; /* Setting TSA name to subject of signer certificate. */ - if (ctx->flags & TS_TSA_NAME) - { - if (!(tsa_name = GENERAL_NAME_new())) goto end; + if (ctx->flags & TS_TSA_NAME) { + if (!(tsa_name = GENERAL_NAME_new())) + goto end; tsa_name->type = GEN_DIRNAME; - tsa_name->d.dirn = - X509_NAME_dup(ctx->signer_cert->cert_info->subject); - if (!tsa_name->d.dirn) goto end; - if (!TS_TST_INFO_set_tsa(tst_info, tsa_name)) goto end; - } + tsa_name->d.dirn = + X509_NAME_dup(ctx->signer_cert->cert_info->subject); + if (!tsa_name->d.dirn) + goto end; + if (!TS_TST_INFO_set_tsa(tst_info, tsa_name)) + goto end; + } result = 1; - end: - if (!result) - { + +end: + if (!result) { TS_TST_INFO_free(tst_info); tst_info = NULL; TSerr(TS_F_TS_RESP_CREATE_TST_INFO, TS_R_TST_INFO_SETUP_ERROR); TS_RESP_CTX_set_status_info_cond(ctx, TS_STATUS_REJECTION, - "Error during TSTInfo " - "generation."); - } + "Error during TSTInfo " + "generation."); + } GENERAL_NAME_free(tsa_name); TS_ACCURACY_free(accuracy); ASN1_GENERALIZEDTIME_free(asn1_time); ASN1_INTEGER_free(serial); - + return tst_info; - } +} /* Processing the extensions of the request. */ -static int TS_RESP_process_extensions(TS_RESP_CTX *ctx) - { +static int +TS_RESP_process_extensions(TS_RESP_CTX *ctx) +{ STACK_OF(X509_EXTENSION) *exts = TS_REQ_get_exts(ctx->request); int i; int ok = 1; - for (i = 0; ok && i < sk_X509_EXTENSION_num(exts); ++i) - { + for (i = 0; ok && i < sk_X509_EXTENSION_num(exts); ++i) { X509_EXTENSION *ext = sk_X509_EXTENSION_value(exts, i); /* XXXXX The last argument was previously (void *)ctx->extension_cb, but ISO C doesn't permit @@ -699,14 +732,15 @@ static int TS_RESP_process_extensions(TS_RESP_CTX *ctx) anyway... */ ok = (*ctx->extension_cb)(ctx, ext, NULL); - } + } return ok; - } +} /* Functions for signing the TS_TST_INFO structure of the context. */ -static int TS_RESP_sign(TS_RESP_CTX *ctx) - { +static int +TS_RESP_sign(TS_RESP_CTX *ctx) +{ int ret = 0; PKCS7 *p7 = NULL; PKCS7_SIGNER_INFO *si; @@ -718,9 +752,9 @@ static int TS_RESP_sign(TS_RESP_CTX *ctx) /* Check if signcert and pkey match. */ if (!X509_check_private_key(ctx->signer_cert, ctx->signer_key)) { - TSerr(TS_F_TS_RESP_SIGN, - TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE); - goto err; + TSerr(TS_F_TS_RESP_SIGN, + TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE); + goto err; } /* Create a new PKCS7 signed object. */ @@ -728,57 +762,54 @@ static int TS_RESP_sign(TS_RESP_CTX *ctx) TSerr(TS_F_TS_RESP_SIGN, ERR_R_MALLOC_FAILURE); goto err; } - if (!PKCS7_set_type(p7, NID_pkcs7_signed)) goto err; + if (!PKCS7_set_type(p7, NID_pkcs7_signed)) + goto err; /* Force SignedData version to be 3 instead of the default 1. */ - if (!ASN1_INTEGER_set(p7->d.sign->version, 3)) goto err; + if (!ASN1_INTEGER_set(p7->d.sign->version, 3)) + goto err; /* Add signer certificate and optional certificate chain. */ - if (TS_REQ_get_cert_req(ctx->request)) - { + if (TS_REQ_get_cert_req(ctx->request)) { PKCS7_add_certificate(p7, ctx->signer_cert); - if (ctx->certs) - { - for(i = 0; i < sk_X509_num(ctx->certs); ++i) - { + if (ctx->certs) { + for (i = 0; i < sk_X509_num(ctx->certs); ++i) { X509 *cert = sk_X509_value(ctx->certs, i); PKCS7_add_certificate(p7, cert); - } } } + } /* Add a new signer info. */ - if (!(si = PKCS7_add_signature(p7, ctx->signer_cert, - ctx->signer_key, EVP_sha1()))) - { + if (!(si = PKCS7_add_signature(p7, ctx->signer_cert, + ctx->signer_key, EVP_sha1()))) { TSerr(TS_F_TS_RESP_SIGN, TS_R_PKCS7_ADD_SIGNATURE_ERROR); goto err; - } + } /* Add content type signed attribute to the signer info. */ oid = OBJ_nid2obj(NID_id_smime_ct_TSTInfo); if (!PKCS7_add_signed_attribute(si, NID_pkcs9_contentType, - V_ASN1_OBJECT, oid)) - { + V_ASN1_OBJECT, oid)) { TSerr(TS_F_TS_RESP_SIGN, TS_R_PKCS7_ADD_SIGNED_ATTR_ERROR); goto err; - } + } - /* Create the ESS SigningCertificate attribute which contains + /* Create the ESS SigningCertificate attribute which contains the signer certificate id and optionally the certificate chain. */ certs = ctx->flags & TS_ESS_CERT_ID_CHAIN ? ctx->certs : NULL; if (!(sc = ESS_SIGNING_CERT_new_init(ctx->signer_cert, certs))) goto err; /* Add SigningCertificate signed attribute to the signer info. */ - if (!ESS_add_signing_cert(si, sc)) - { + if (!ESS_add_signing_cert(si, sc)) { TSerr(TS_F_TS_RESP_SIGN, TS_R_ESS_ADD_SIGNING_CERT_ERROR); goto err; - } + } /* Add a new empty NID_id_smime_ct_TSTInfo encapsulated content. */ - if (!TS_TST_INFO_content_new(p7)) goto err; + if (!TS_TST_INFO_content_new(p7)) + goto err; /* Add the DER encoded tst_info to the PKCS7 structure. */ if (!(p7bio = PKCS7_dataInit(p7, NULL))) { @@ -787,18 +818,16 @@ static int TS_RESP_sign(TS_RESP_CTX *ctx) } /* Convert tst_info to DER. */ - if (!i2d_TS_TST_INFO_bio(p7bio, ctx->tst_info)) - { + if (!i2d_TS_TST_INFO_bio(p7bio, ctx->tst_info)) { TSerr(TS_F_TS_RESP_SIGN, TS_R_TS_DATASIGN); goto err; - } + } /* Create the signature and add it to the signer info. */ - if (!PKCS7_dataFinal(p7, p7bio)) - { + if (!PKCS7_dataFinal(p7, p7bio)) { TSerr(TS_F_TS_RESP_SIGN, TS_R_TS_DATASIGN); goto err; - } + } /* Set new PKCS7 and TST_INFO objects. */ TS_RESP_set_tst_info(ctx->response, p7, ctx->tst_info); @@ -806,152 +835,163 @@ static int TS_RESP_sign(TS_RESP_CTX *ctx) ctx->tst_info = NULL; /* Ownership is lost. */ ret = 1; - err: + +err: if (!ret) TS_RESP_CTX_set_status_info_cond(ctx, TS_STATUS_REJECTION, - "Error during signature " - "generation."); + "Error during signature " + "generation."); BIO_free_all(p7bio); ESS_SIGNING_CERT_free(sc); PKCS7_free(p7); return ret; - } +} -static ESS_SIGNING_CERT *ESS_SIGNING_CERT_new_init(X509 *signcert, - STACK_OF(X509) *certs) - { +static ESS_SIGNING_CERT * +ESS_SIGNING_CERT_new_init(X509 *signcert, STACK_OF(X509) *certs) +{ ESS_CERT_ID *cid; ESS_SIGNING_CERT *sc = NULL; int i; /* Creating the ESS_CERT_ID stack. */ - if (!(sc = ESS_SIGNING_CERT_new())) goto err; + if (!(sc = ESS_SIGNING_CERT_new())) + goto err; if (!sc->cert_ids && !(sc->cert_ids = sk_ESS_CERT_ID_new_null())) goto err; /* Adding the signing certificate id. */ - if (!(cid = ESS_CERT_ID_new_init(signcert, 0)) - || !sk_ESS_CERT_ID_push(sc->cert_ids, cid)) + if (!(cid = ESS_CERT_ID_new_init(signcert, 0)) || + !sk_ESS_CERT_ID_push(sc->cert_ids, cid)) goto err; /* Adding the certificate chain ids. */ - for (i = 0; i < sk_X509_num(certs); ++i) - { + for (i = 0; i < sk_X509_num(certs); ++i) { X509 *cert = sk_X509_value(certs, i); - if (!(cid = ESS_CERT_ID_new_init(cert, 1)) - || !sk_ESS_CERT_ID_push(sc->cert_ids, cid)) + if (!(cid = ESS_CERT_ID_new_init(cert, 1)) || + !sk_ESS_CERT_ID_push(sc->cert_ids, cid)) goto err; - } + } return sc; + err: ESS_SIGNING_CERT_free(sc); TSerr(TS_F_ESS_SIGNING_CERT_NEW_INIT, ERR_R_MALLOC_FAILURE); return NULL; - } +} -static ESS_CERT_ID *ESS_CERT_ID_new_init(X509 *cert, int issuer_needed) - { +static ESS_CERT_ID * +ESS_CERT_ID_new_init(X509 *cert, int issuer_needed) +{ ESS_CERT_ID *cid = NULL; GENERAL_NAME *name = NULL; - + /* Recompute SHA1 hash of certificate if necessary (side effect). */ X509_check_purpose(cert, -1, 0); - if (!(cid = ESS_CERT_ID_new())) goto err; + if (!(cid = ESS_CERT_ID_new())) + goto err; if (!ASN1_OCTET_STRING_set(cid->hash, cert->sha1_hash, - sizeof(cert->sha1_hash))) + sizeof(cert->sha1_hash))) goto err; /* Setting the issuer/serial if requested. */ - if (issuer_needed) - { + if (issuer_needed) { /* Creating issuer/serial structure. */ - if (!cid->issuer_serial - && !(cid->issuer_serial = ESS_ISSUER_SERIAL_new())) + if (!cid->issuer_serial && + !(cid->issuer_serial = ESS_ISSUER_SERIAL_new())) goto err; /* Creating general name from the certificate issuer. */ - if (!(name = GENERAL_NAME_new())) goto err; + if (!(name = GENERAL_NAME_new())) + goto err; name->type = GEN_DIRNAME; - if (!(name->d.dirn = X509_NAME_dup(cert->cert_info->issuer))) + if (!(name->d.dirn = X509_NAME_dup(cert->cert_info->issuer))) goto err; - if (!sk_GENERAL_NAME_push(cid->issuer_serial->issuer, name)) + if (!sk_GENERAL_NAME_push(cid->issuer_serial->issuer, name)) goto err; name = NULL; /* Ownership is lost. */ /* Setting the serial number. */ ASN1_INTEGER_free(cid->issuer_serial->serial); - if (!(cid->issuer_serial->serial = - ASN1_INTEGER_dup(cert->cert_info->serialNumber))) + if (!(cid->issuer_serial->serial = + ASN1_INTEGER_dup(cert->cert_info->serialNumber))) goto err; - } + } return cid; + err: GENERAL_NAME_free(name); ESS_CERT_ID_free(cid); TSerr(TS_F_ESS_CERT_ID_NEW_INIT, ERR_R_MALLOC_FAILURE); return NULL; - } +} -static int TS_TST_INFO_content_new(PKCS7 *p7) - { +static int +TS_TST_INFO_content_new(PKCS7 *p7) +{ PKCS7 *ret = NULL; ASN1_OCTET_STRING *octet_string = NULL; /* Create new encapsulated NID_id_smime_ct_TSTInfo content. */ - if (!(ret = PKCS7_new())) goto err; - if (!(ret->d.other = ASN1_TYPE_new())) goto err; + if (!(ret = PKCS7_new())) + goto err; + if (!(ret->d.other = ASN1_TYPE_new())) + goto err; ret->type = OBJ_nid2obj(NID_id_smime_ct_TSTInfo); - if (!(octet_string = ASN1_OCTET_STRING_new())) goto err; + if (!(octet_string = ASN1_OCTET_STRING_new())) + goto err; ASN1_TYPE_set(ret->d.other, V_ASN1_OCTET_STRING, octet_string); octet_string = NULL; /* Add encapsulated content to signed PKCS7 structure. */ - if (!PKCS7_set_content(p7, ret)) goto err; + if (!PKCS7_set_content(p7, ret)) + goto err; return 1; - err: + +err: ASN1_OCTET_STRING_free(octet_string); PKCS7_free(ret); return 0; - } +} -static int ESS_add_signing_cert(PKCS7_SIGNER_INFO *si, ESS_SIGNING_CERT *sc) - { +static int +ESS_add_signing_cert(PKCS7_SIGNER_INFO *si, ESS_SIGNING_CERT *sc) +{ ASN1_STRING *seq = NULL; unsigned char *p, *pp = NULL; int len; len = i2d_ESS_SIGNING_CERT(sc, NULL); - if (!(pp = (unsigned char *) malloc(len))) - { + if (!(pp = (unsigned char *) malloc(len))) { TSerr(TS_F_ESS_ADD_SIGNING_CERT, ERR_R_MALLOC_FAILURE); goto err; - } + } p = pp; i2d_ESS_SIGNING_CERT(sc, &p); - if (!(seq = ASN1_STRING_new()) || !ASN1_STRING_set(seq, pp, len)) - { + if (!(seq = ASN1_STRING_new()) || !ASN1_STRING_set(seq, pp, len)) { TSerr(TS_F_ESS_ADD_SIGNING_CERT, ERR_R_MALLOC_FAILURE); goto err; - } - free(pp); pp = NULL; - return PKCS7_add_signed_attribute(si, - NID_id_smime_aa_signingCertificate, - V_ASN1_SEQUENCE, seq); - err: + } + free(pp); + pp = NULL; + return PKCS7_add_signed_attribute(si, + NID_id_smime_aa_signingCertificate, V_ASN1_SEQUENCE, seq); + +err: ASN1_STRING_free(seq); free(pp); return 0; - } +} static ASN1_GENERALIZEDTIME * -TS_RESP_set_genTime_with_precision(ASN1_GENERALIZEDTIME *asn1_time, - long sec, long usec, unsigned precision) - { +TS_RESP_set_genTime_with_precision(ASN1_GENERALIZEDTIME *asn1_time, + long sec, long usec, unsigned precision) +{ time_t time_sec = (time_t) sec; - struct tm *tm = NULL; + struct tm *tm = NULL; char genTime_str[17 + TS_MAX_CLOCK_PRECISION_DIGITS]; char usecstr[TS_MAX_CLOCK_PRECISION_DIGITS + 2]; char *p; @@ -960,26 +1000,25 @@ TS_RESP_set_genTime_with_precision(ASN1_GENERALIZEDTIME *asn1_time, if (precision > TS_MAX_CLOCK_PRECISION_DIGITS) goto err; - if (!(tm = gmtime(&time_sec))) goto err; - /* - * Put "genTime_str" in GeneralizedTime format. We work around the - * restrictions imposed by rfc3280 (i.e. "GeneralizedTime values MUST - * NOT include fractional seconds") and OpenSSL related functions to - * meet the rfc3161 requirement: "GeneralizedTime syntax can include - * fraction-of-second details". - */ + /* + * Put "genTime_str" in GeneralizedTime format. We work around the + * restrictions imposed by rfc3280 (i.e. "GeneralizedTime values MUST + * NOT include fractional seconds") and OpenSSL related functions to + * meet the rfc3161 requirement: "GeneralizedTime syntax can include + * fraction-of-second details". + */ if (precision > 0) { /* To make things a bit harder, X.690 | ISO/IEC 8825-1 provides the following restrictions for a DER-encoding, which OpenSSL - (specifically ASN1_GENERALIZEDTIME_check() function) doesn't + (specifically ASN1_GENERALIZEDTIME_check() function) doesn't support: - "The encoding MUST terminate with a "Z" (which means "Zulu" - time). The decimal point element, if present, MUST be the - point option ".". The fractional-seconds elements, - if present, MUST omit all trailing 0's; + "The encoding MUST terminate with a "Z" (which means "Zulu" + time). The decimal point element, if present, MUST be the + point option ".". The fractional-seconds elements, + if present, MUST omit all trailing 0's; if the elements correspond to 0, they MUST be wholly omitted, and the decimal point element also MUST be omitted." */ @@ -999,7 +1038,7 @@ TS_RESP_set_genTime_with_precision(ASN1_GENERALIZEDTIME *asn1_time, } rv = snprintf(genTime_str, sizeof(genTime_str), "%04d%02d%02d%02d%02d%02d%sZ", - tm->tm_year + 1900, tm->tm_mon + 1, tm->tm_mday, + tm->tm_year + 1900, tm->tm_mon + 1, tm->tm_mday, tm->tm_hour, tm->tm_min, tm->tm_sec, usecstr); if (rv == -1 || rv >= sizeof(genTime_str)) goto err; @@ -1007,14 +1046,14 @@ TS_RESP_set_genTime_with_precision(ASN1_GENERALIZEDTIME *asn1_time, /* Now call OpenSSL to check and set our genTime value */ if (!asn1_time && !(asn1_time = M_ASN1_GENERALIZEDTIME_new())) goto err; - if (!ASN1_GENERALIZEDTIME_set_string(asn1_time, genTime_str)) - { + if (!ASN1_GENERALIZEDTIME_set_string(asn1_time, genTime_str)) { ASN1_GENERALIZEDTIME_free(asn1_time); goto err; - } + } return asn1_time; - err: + +err: TSerr(TS_F_TS_RESP_SET_GENTIME_WITH_PRECISION, TS_R_COULD_NOT_SET_TIME); return NULL; - } +} diff --git a/lib/libssl/src/crypto/ts/ts_rsp_utils.c b/lib/libssl/src/crypto/ts/ts_rsp_utils.c index 401c1fdc51d..89c3e8f63ca 100644 --- a/lib/libssl/src/crypto/ts/ts_rsp_utils.c +++ b/lib/libssl/src/crypto/ts/ts_rsp_utils.c @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -64,346 +64,372 @@ /* Function definitions. */ -int TS_RESP_set_status_info(TS_RESP *a, TS_STATUS_INFO *status_info) - { +int +TS_RESP_set_status_info(TS_RESP *a, TS_STATUS_INFO *status_info) +{ TS_STATUS_INFO *new_status_info; if (a->status_info == status_info) return 1; new_status_info = TS_STATUS_INFO_dup(status_info); - if (new_status_info == NULL) - { + if (new_status_info == NULL) { TSerr(TS_F_TS_RESP_SET_STATUS_INFO, ERR_R_MALLOC_FAILURE); return 0; - } + } TS_STATUS_INFO_free(a->status_info); a->status_info = new_status_info; return 1; - } +} -TS_STATUS_INFO *TS_RESP_get_status_info(TS_RESP *a) - { +TS_STATUS_INFO * +TS_RESP_get_status_info(TS_RESP *a) +{ return a->status_info; - } +} /* Caller loses ownership of PKCS7 and TS_TST_INFO objects. */ -void TS_RESP_set_tst_info(TS_RESP *a, PKCS7 *p7, TS_TST_INFO *tst_info) - { +void +TS_RESP_set_tst_info(TS_RESP *a, PKCS7 *p7, TS_TST_INFO *tst_info) +{ /* Set new PKCS7 and TST_INFO objects. */ PKCS7_free(a->token); a->token = p7; TS_TST_INFO_free(a->tst_info); a->tst_info = tst_info; - } +} -PKCS7 *TS_RESP_get_token(TS_RESP *a) - { +PKCS7 * +TS_RESP_get_token(TS_RESP *a) +{ return a->token; - } +} -TS_TST_INFO *TS_RESP_get_tst_info(TS_RESP *a) - { +TS_TST_INFO * +TS_RESP_get_tst_info(TS_RESP *a) +{ return a->tst_info; - } +} -int TS_TST_INFO_set_version(TS_TST_INFO *a, long version) - { +int +TS_TST_INFO_set_version(TS_TST_INFO *a, long version) +{ return ASN1_INTEGER_set(a->version, version); - } +} -long TS_TST_INFO_get_version(const TS_TST_INFO *a) - { +long +TS_TST_INFO_get_version(const TS_TST_INFO *a) +{ return ASN1_INTEGER_get(a->version); - } +} -int TS_TST_INFO_set_policy_id(TS_TST_INFO *a, ASN1_OBJECT *policy) - { +int +TS_TST_INFO_set_policy_id(TS_TST_INFO *a, ASN1_OBJECT *policy) +{ ASN1_OBJECT *new_policy; if (a->policy_id == policy) return 1; new_policy = OBJ_dup(policy); - if (new_policy == NULL) - { + if (new_policy == NULL) { TSerr(TS_F_TS_TST_INFO_SET_POLICY_ID, ERR_R_MALLOC_FAILURE); return 0; - } + } ASN1_OBJECT_free(a->policy_id); a->policy_id = new_policy; return 1; - } +} -ASN1_OBJECT *TS_TST_INFO_get_policy_id(TS_TST_INFO *a) - { +ASN1_OBJECT * +TS_TST_INFO_get_policy_id(TS_TST_INFO *a) +{ return a->policy_id; - } +} -int TS_TST_INFO_set_msg_imprint(TS_TST_INFO *a, TS_MSG_IMPRINT *msg_imprint) - { +int +TS_TST_INFO_set_msg_imprint(TS_TST_INFO *a, TS_MSG_IMPRINT *msg_imprint) +{ TS_MSG_IMPRINT *new_msg_imprint; if (a->msg_imprint == msg_imprint) return 1; new_msg_imprint = TS_MSG_IMPRINT_dup(msg_imprint); - if (new_msg_imprint == NULL) - { + if (new_msg_imprint == NULL) { TSerr(TS_F_TS_TST_INFO_SET_MSG_IMPRINT, ERR_R_MALLOC_FAILURE); return 0; - } + } TS_MSG_IMPRINT_free(a->msg_imprint); a->msg_imprint = new_msg_imprint; return 1; - } +} -TS_MSG_IMPRINT *TS_TST_INFO_get_msg_imprint(TS_TST_INFO *a) - { +TS_MSG_IMPRINT * +TS_TST_INFO_get_msg_imprint(TS_TST_INFO *a) +{ return a->msg_imprint; - } +} -int TS_TST_INFO_set_serial(TS_TST_INFO *a, const ASN1_INTEGER *serial) - { +int +TS_TST_INFO_set_serial(TS_TST_INFO *a, const ASN1_INTEGER *serial) +{ ASN1_INTEGER *new_serial; if (a->serial == serial) return 1; new_serial = ASN1_INTEGER_dup(serial); - if (new_serial == NULL) - { + if (new_serial == NULL) { TSerr(TS_F_TS_TST_INFO_SET_SERIAL, ERR_R_MALLOC_FAILURE); return 0; - } + } ASN1_INTEGER_free(a->serial); a->serial = new_serial; return 1; - } +} -const ASN1_INTEGER *TS_TST_INFO_get_serial(const TS_TST_INFO *a) - { +const ASN1_INTEGER * +TS_TST_INFO_get_serial(const TS_TST_INFO *a) +{ return a->serial; - } +} -int TS_TST_INFO_set_time(TS_TST_INFO *a, const ASN1_GENERALIZEDTIME *gtime) - { +int +TS_TST_INFO_set_time(TS_TST_INFO *a, const ASN1_GENERALIZEDTIME *gtime) +{ ASN1_GENERALIZEDTIME *new_time; if (a->time == gtime) return 1; new_time = M_ASN1_GENERALIZEDTIME_dup(gtime); - if (new_time == NULL) - { + if (new_time == NULL) { TSerr(TS_F_TS_TST_INFO_SET_TIME, ERR_R_MALLOC_FAILURE); return 0; - } + } ASN1_GENERALIZEDTIME_free(a->time); a->time = new_time; return 1; - } +} -const ASN1_GENERALIZEDTIME *TS_TST_INFO_get_time(const TS_TST_INFO *a) - { +const ASN1_GENERALIZEDTIME * +TS_TST_INFO_get_time(const TS_TST_INFO *a) +{ return a->time; - } +} -int TS_TST_INFO_set_accuracy(TS_TST_INFO *a, TS_ACCURACY *accuracy) - { +int +TS_TST_INFO_set_accuracy(TS_TST_INFO *a, TS_ACCURACY *accuracy) +{ TS_ACCURACY *new_accuracy; if (a->accuracy == accuracy) return 1; new_accuracy = TS_ACCURACY_dup(accuracy); - if (new_accuracy == NULL) - { + if (new_accuracy == NULL) { TSerr(TS_F_TS_TST_INFO_SET_ACCURACY, ERR_R_MALLOC_FAILURE); return 0; - } + } TS_ACCURACY_free(a->accuracy); a->accuracy = new_accuracy; return 1; - } +} -TS_ACCURACY *TS_TST_INFO_get_accuracy(TS_TST_INFO *a) - { +TS_ACCURACY * +TS_TST_INFO_get_accuracy(TS_TST_INFO *a) +{ return a->accuracy; - } +} -int TS_ACCURACY_set_seconds(TS_ACCURACY *a, const ASN1_INTEGER *seconds) - { +int +TS_ACCURACY_set_seconds(TS_ACCURACY *a, const ASN1_INTEGER *seconds) +{ ASN1_INTEGER *new_seconds; if (a->seconds == seconds) return 1; new_seconds = ASN1_INTEGER_dup(seconds); - if (new_seconds == NULL) - { + if (new_seconds == NULL) { TSerr(TS_F_TS_ACCURACY_SET_SECONDS, ERR_R_MALLOC_FAILURE); return 0; - } + } ASN1_INTEGER_free(a->seconds); a->seconds = new_seconds; return 1; - } +} -const ASN1_INTEGER *TS_ACCURACY_get_seconds(const TS_ACCURACY *a) - { +const ASN1_INTEGER * +TS_ACCURACY_get_seconds(const TS_ACCURACY *a) +{ return a->seconds; - } +} -int TS_ACCURACY_set_millis(TS_ACCURACY *a, const ASN1_INTEGER *millis) - { +int +TS_ACCURACY_set_millis(TS_ACCURACY *a, const ASN1_INTEGER *millis) +{ ASN1_INTEGER *new_millis = NULL; if (a->millis == millis) return 1; - if (millis != NULL) - { + if (millis != NULL) { new_millis = ASN1_INTEGER_dup(millis); - if (new_millis == NULL) - { - TSerr(TS_F_TS_ACCURACY_SET_MILLIS, - ERR_R_MALLOC_FAILURE); + if (new_millis == NULL) { + TSerr(TS_F_TS_ACCURACY_SET_MILLIS, + ERR_R_MALLOC_FAILURE); return 0; - } } + } ASN1_INTEGER_free(a->millis); a->millis = new_millis; return 1; - } +} -const ASN1_INTEGER *TS_ACCURACY_get_millis(const TS_ACCURACY *a) - { +const ASN1_INTEGER * +TS_ACCURACY_get_millis(const TS_ACCURACY *a) +{ return a->millis; - } +} -int TS_ACCURACY_set_micros(TS_ACCURACY *a, const ASN1_INTEGER *micros) - { +int +TS_ACCURACY_set_micros(TS_ACCURACY *a, const ASN1_INTEGER *micros) +{ ASN1_INTEGER *new_micros = NULL; if (a->micros == micros) return 1; - if (micros != NULL) - { + if (micros != NULL) { new_micros = ASN1_INTEGER_dup(micros); - if (new_micros == NULL) - { - TSerr(TS_F_TS_ACCURACY_SET_MICROS, - ERR_R_MALLOC_FAILURE); + if (new_micros == NULL) { + TSerr(TS_F_TS_ACCURACY_SET_MICROS, + ERR_R_MALLOC_FAILURE); return 0; - } } + } ASN1_INTEGER_free(a->micros); a->micros = new_micros; return 1; - } +} -const ASN1_INTEGER *TS_ACCURACY_get_micros(const TS_ACCURACY *a) - { +const ASN1_INTEGER * +TS_ACCURACY_get_micros(const TS_ACCURACY *a) +{ return a->micros; - } +} -int TS_TST_INFO_set_ordering(TS_TST_INFO *a, int ordering) - { +int +TS_TST_INFO_set_ordering(TS_TST_INFO *a, int ordering) +{ a->ordering = ordering ? 0xFF : 0x00; return 1; - } +} -int TS_TST_INFO_get_ordering(const TS_TST_INFO *a) - { +int +TS_TST_INFO_get_ordering(const TS_TST_INFO *a) +{ return a->ordering ? 1 : 0; - } +} -int TS_TST_INFO_set_nonce(TS_TST_INFO *a, const ASN1_INTEGER *nonce) - { +int +TS_TST_INFO_set_nonce(TS_TST_INFO *a, const ASN1_INTEGER *nonce) +{ ASN1_INTEGER *new_nonce; if (a->nonce == nonce) return 1; new_nonce = ASN1_INTEGER_dup(nonce); - if (new_nonce == NULL) - { + if (new_nonce == NULL) { TSerr(TS_F_TS_TST_INFO_SET_NONCE, ERR_R_MALLOC_FAILURE); return 0; - } + } ASN1_INTEGER_free(a->nonce); a->nonce = new_nonce; return 1; - } +} -const ASN1_INTEGER *TS_TST_INFO_get_nonce(const TS_TST_INFO *a) - { +const ASN1_INTEGER * +TS_TST_INFO_get_nonce(const TS_TST_INFO *a) +{ return a->nonce; - } +} -int TS_TST_INFO_set_tsa(TS_TST_INFO *a, GENERAL_NAME *tsa) - { +int +TS_TST_INFO_set_tsa(TS_TST_INFO *a, GENERAL_NAME *tsa) +{ GENERAL_NAME *new_tsa; if (a->tsa == tsa) return 1; new_tsa = GENERAL_NAME_dup(tsa); - if (new_tsa == NULL) - { + if (new_tsa == NULL) { TSerr(TS_F_TS_TST_INFO_SET_TSA, ERR_R_MALLOC_FAILURE); return 0; - } + } GENERAL_NAME_free(a->tsa); a->tsa = new_tsa; return 1; - } +} -GENERAL_NAME *TS_TST_INFO_get_tsa(TS_TST_INFO *a) - { +GENERAL_NAME * +TS_TST_INFO_get_tsa(TS_TST_INFO *a) +{ return a->tsa; - } +} STACK_OF(X509_EXTENSION) *TS_TST_INFO_get_exts(TS_TST_INFO *a) - { +{ return a->extensions; - } +} -void TS_TST_INFO_ext_free(TS_TST_INFO *a) - { - if (!a) return; +void +TS_TST_INFO_ext_free(TS_TST_INFO *a) +{ + if (!a) + return; sk_X509_EXTENSION_pop_free(a->extensions, X509_EXTENSION_free); a->extensions = NULL; - } +} -int TS_TST_INFO_get_ext_count(TS_TST_INFO *a) - { +int +TS_TST_INFO_get_ext_count(TS_TST_INFO *a) +{ return X509v3_get_ext_count(a->extensions); - } +} -int TS_TST_INFO_get_ext_by_NID(TS_TST_INFO *a, int nid, int lastpos) - { +int +TS_TST_INFO_get_ext_by_NID(TS_TST_INFO *a, int nid, int lastpos) +{ return X509v3_get_ext_by_NID(a->extensions, nid, lastpos); - } +} -int TS_TST_INFO_get_ext_by_OBJ(TS_TST_INFO *a, ASN1_OBJECT *obj, int lastpos) - { +int +TS_TST_INFO_get_ext_by_OBJ(TS_TST_INFO *a, ASN1_OBJECT *obj, int lastpos) +{ return X509v3_get_ext_by_OBJ(a->extensions, obj, lastpos); - } +} -int TS_TST_INFO_get_ext_by_critical(TS_TST_INFO *a, int crit, int lastpos) - { +int +TS_TST_INFO_get_ext_by_critical(TS_TST_INFO *a, int crit, int lastpos) +{ return X509v3_get_ext_by_critical(a->extensions, crit, lastpos); - } - -X509_EXTENSION *TS_TST_INFO_get_ext(TS_TST_INFO *a, int loc) - { - return X509v3_get_ext(a->extensions,loc); - } - -X509_EXTENSION *TS_TST_INFO_delete_ext(TS_TST_INFO *a, int loc) - { - return X509v3_delete_ext(a->extensions,loc); - } - -int TS_TST_INFO_add_ext(TS_TST_INFO *a, X509_EXTENSION *ex, int loc) - { - return X509v3_add_ext(&a->extensions,ex,loc) != NULL; - } - -void *TS_TST_INFO_get_ext_d2i(TS_TST_INFO *a, int nid, int *crit, int *idx) - { +} + +X509_EXTENSION * +TS_TST_INFO_get_ext(TS_TST_INFO *a, int loc) +{ + return X509v3_get_ext(a->extensions, loc); +} + +X509_EXTENSION * +TS_TST_INFO_delete_ext(TS_TST_INFO *a, int loc) +{ + return X509v3_delete_ext(a->extensions, loc); +} + +int +TS_TST_INFO_add_ext(TS_TST_INFO *a, X509_EXTENSION *ex, int loc) +{ + return X509v3_add_ext(&a->extensions, ex, loc) != NULL; +} + +void * +TS_TST_INFO_get_ext_d2i(TS_TST_INFO *a, int nid, int *crit, int *idx) +{ return X509V3_get_d2i(a->extensions, nid, crit, idx); - } +} diff --git a/lib/libssl/src/crypto/ts/ts_rsp_verify.c b/lib/libssl/src/crypto/ts/ts_rsp_verify.c index 7484b10d608..66e35dab3ac 100644 --- a/lib/libssl/src/crypto/ts/ts_rsp_verify.c +++ b/lib/libssl/src/crypto/ts/ts_rsp_verify.c @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -65,38 +65,39 @@ /* Private function declarations. */ static int TS_verify_cert(X509_STORE *store, STACK_OF(X509) *untrusted, - X509 *signer, STACK_OF(X509) **chain); + X509 *signer, STACK_OF(X509) **chain); static int TS_check_signing_certs(PKCS7_SIGNER_INFO *si, STACK_OF(X509) *chain); static ESS_SIGNING_CERT *ESS_get_signing_cert(PKCS7_SIGNER_INFO *si); static int TS_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert); static int TS_issuer_serial_cmp(ESS_ISSUER_SERIAL *is, X509_CINF *cinfo); -static int int_TS_RESP_verify_token(TS_VERIFY_CTX *ctx, - PKCS7 *token, TS_TST_INFO *tst_info); +static int int_TS_RESP_verify_token(TS_VERIFY_CTX *ctx, + PKCS7 *token, TS_TST_INFO *tst_info); static int TS_check_status_info(TS_RESP *response); static char *TS_get_status_text(STACK_OF(ASN1_UTF8STRING) *text); static int TS_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info); static int TS_compute_imprint(BIO *data, TS_TST_INFO *tst_info, - X509_ALGOR **md_alg, - unsigned char **imprint, unsigned *imprint_len); -static int TS_check_imprints(X509_ALGOR *algor_a, - unsigned char *imprint_a, unsigned len_a, - TS_TST_INFO *tst_info); + X509_ALGOR **md_alg, + unsigned char **imprint, unsigned *imprint_len); +static int TS_check_imprints(X509_ALGOR *algor_a, + unsigned char *imprint_a, unsigned len_a, + TS_TST_INFO *tst_info); static int TS_check_nonces(const ASN1_INTEGER *a, TS_TST_INFO *tst_info); static int TS_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer); static int TS_find_name(STACK_OF(GENERAL_NAME) *gen_names, GENERAL_NAME *name); /* * Local mapping between response codes and descriptions. - * Don't forget to change TS_STATUS_BUF_SIZE when modifying + * Don't forget to change TS_STATUS_BUF_SIZE when modifying * the elements of this array. */ -static const char *TS_status_text[] = - { "granted", - "grantedWithMods", - "rejection", - "waiting", - "revocationWarning", - "revocationNotification" }; +static const char *TS_status_text[] = { + "granted", + "grantedWithMods", + "rejection", + "waiting", + "revocationWarning", + "revocationNotification" +}; #define TS_STATUS_TEXT_SIZE (sizeof(TS_status_text)/sizeof(*TS_status_text)) @@ -106,19 +107,19 @@ static const char *TS_status_text[] = */ #define TS_STATUS_BUF_SIZE 256 -static struct - { +static struct { int code; const char *text; - } TS_failure_info[] = - { { TS_INFO_BAD_ALG, "badAlg" }, - { TS_INFO_BAD_REQUEST, "badRequest" }, - { TS_INFO_BAD_DATA_FORMAT, "badDataFormat" }, - { TS_INFO_TIME_NOT_AVAILABLE, "timeNotAvailable" }, - { TS_INFO_UNACCEPTED_POLICY, "unacceptedPolicy" }, - { TS_INFO_UNACCEPTED_EXTENSION, "unacceptedExtension" }, - { TS_INFO_ADD_INFO_NOT_AVAILABLE, "addInfoNotAvailable" }, - { TS_INFO_SYSTEM_FAILURE, "systemFailure" } }; +} TS_failure_info[] = { + { TS_INFO_BAD_ALG, "badAlg" }, + { TS_INFO_BAD_REQUEST, "badRequest" }, + { TS_INFO_BAD_DATA_FORMAT, "badDataFormat" }, + { TS_INFO_TIME_NOT_AVAILABLE, "timeNotAvailable" }, + { TS_INFO_UNACCEPTED_POLICY, "unacceptedPolicy" }, + { TS_INFO_UNACCEPTED_EXTENSION, "unacceptedExtension" }, + { TS_INFO_ADD_INFO_NOT_AVAILABLE, "addInfoNotAvailable" }, + { TS_INFO_SYSTEM_FAILURE, "systemFailure" } +}; #define TS_FAILURE_INFO_SIZE (sizeof(TS_failure_info) / \ sizeof(*TS_failure_info)) @@ -137,9 +138,10 @@ static struct * - Verify the signature value. * - Returns the signer certificate in 'signer', if 'signer' is not NULL. */ -int TS_RESP_verify_signature(PKCS7 *token, STACK_OF(X509) *certs, - X509_STORE *store, X509 **signer_out) - { +int +TS_RESP_verify_signature(PKCS7 *token, STACK_OF(X509) *certs, + X509_STORE *store, X509 **signer_out) +{ STACK_OF(PKCS7_SIGNER_INFO) *sinfos = NULL; PKCS7_SIGNER_INFO *si; STACK_OF(X509) *signers = NULL; @@ -150,87 +152,86 @@ int TS_RESP_verify_signature(PKCS7 *token, STACK_OF(X509) *certs, BIO *p7bio = NULL; /* Some sanity checks first. */ - if (!token) - { + if (!token) { TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_INVALID_NULL_POINTER); goto err; - } + } /* Check for the correct content type */ - if(!PKCS7_type_is_signed(token)) - { + if (!PKCS7_type_is_signed(token)) { TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_WRONG_CONTENT_TYPE); goto err; - } + } /* Check if there is one and only one signer. */ sinfos = PKCS7_get_signer_info(token); - if (!sinfos || sk_PKCS7_SIGNER_INFO_num(sinfos) != 1) - { + if (!sinfos || sk_PKCS7_SIGNER_INFO_num(sinfos) != 1) { TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, - TS_R_THERE_MUST_BE_ONE_SIGNER); + TS_R_THERE_MUST_BE_ONE_SIGNER); goto err; - } + } si = sk_PKCS7_SIGNER_INFO_value(sinfos, 0); /* Check for no content: no data to verify signature. */ - if (PKCS7_get_detached(token)) - { + if (PKCS7_get_detached(token)) { TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_NO_CONTENT); goto err; - } - + } + /* Get hold of the signer certificate, search only internal certificates if it was requested. */ signers = PKCS7_get0_signers(token, certs, 0); - if (!signers || sk_X509_num(signers) != 1) goto err; + if (!signers || sk_X509_num(signers) != 1) + goto err; signer = sk_X509_value(signers, 0); /* Now verify the certificate. */ - if (!TS_verify_cert(store, certs, signer, &chain)) goto err; + if (!TS_verify_cert(store, certs, signer, &chain)) + goto err; /* Check if the signer certificate is consistent with the ESS extension. */ - if (!TS_check_signing_certs(si, chain)) goto err; + if (!TS_check_signing_certs(si, chain)) + goto err; /* Creating the message digest. */ p7bio = PKCS7_dataInit(token, NULL); /* We now have to 'read' from p7bio to calculate digests etc. */ - while ((i = BIO_read(p7bio,buf,sizeof(buf))) > 0); + while ((i = BIO_read(p7bio, buf, sizeof(buf))) > 0) + ; /* Verifying the signature. */ j = PKCS7_signatureVerify(p7bio, token, si, signer); - if (j <= 0) - { + if (j <= 0) { TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_SIGNATURE_FAILURE); goto err; - } + } /* Return the signer certificate if needed. */ - if (signer_out) - { + if (signer_out) { *signer_out = signer; CRYPTO_add(&signer->references, 1, CRYPTO_LOCK_X509); - } + } ret = 1; - err: +err: BIO_free_all(p7bio); sk_X509_pop_free(chain, X509_free); sk_X509_free(signers); return ret; - } +} /* * The certificate chain is returned in chain. Caller is responsible for * freeing the vector. */ -static int TS_verify_cert(X509_STORE *store, STACK_OF(X509) *untrusted, - X509 *signer, STACK_OF(X509) **chain) - { +static int +TS_verify_cert(X509_STORE *store, STACK_OF(X509) *untrusted, X509 *signer, + STACK_OF(X509) **chain) +{ X509_STORE_CTX cert_ctx; int i; int ret = 1; @@ -240,110 +241,115 @@ static int TS_verify_cert(X509_STORE *store, STACK_OF(X509) *untrusted, X509_STORE_CTX_init(&cert_ctx, store, signer, untrusted); X509_STORE_CTX_set_purpose(&cert_ctx, X509_PURPOSE_TIMESTAMP_SIGN); i = X509_verify_cert(&cert_ctx); - if (i <= 0) - { + if (i <= 0) { int j = X509_STORE_CTX_get_error(&cert_ctx); TSerr(TS_F_TS_VERIFY_CERT, TS_R_CERTIFICATE_VERIFY_ERROR); ERR_add_error_data(2, "Verify error:", - X509_verify_cert_error_string(j)); + X509_verify_cert_error_string(j)); ret = 0; - } - else - { + } else { /* Get a copy of the certificate chain. */ *chain = X509_STORE_CTX_get1_chain(&cert_ctx); - } + } X509_STORE_CTX_cleanup(&cert_ctx); return ret; - } +} -static int TS_check_signing_certs(PKCS7_SIGNER_INFO *si, STACK_OF(X509) *chain) - { +static int +TS_check_signing_certs(PKCS7_SIGNER_INFO *si, STACK_OF(X509) *chain) +{ ESS_SIGNING_CERT *ss = ESS_get_signing_cert(si); STACK_OF(ESS_CERT_ID) *cert_ids = NULL; X509 *cert; int i = 0; int ret = 0; - if (!ss) goto err; + if (!ss) + goto err; cert_ids = ss->cert_ids; /* The signer certificate must be the first in cert_ids. */ cert = sk_X509_value(chain, 0); - if (TS_find_cert(cert_ids, cert) != 0) goto err; - + if (TS_find_cert(cert_ids, cert) != 0) + goto err; + /* Check the other certificates of the chain if there are more than one certificate ids in cert_ids. */ - if (sk_ESS_CERT_ID_num(cert_ids) > 1) - { + if (sk_ESS_CERT_ID_num(cert_ids) > 1) { /* All the certificates of the chain must be in cert_ids. */ - for (i = 1; i < sk_X509_num(chain); ++i) - { + for (i = 1; i < sk_X509_num(chain); ++i) { cert = sk_X509_value(chain, i); - if (TS_find_cert(cert_ids, cert) < 0) goto err; - } + if (TS_find_cert(cert_ids, cert) < 0) + goto err; } + } ret = 1; - err: + +err: if (!ret) - TSerr(TS_F_TS_CHECK_SIGNING_CERTS, - TS_R_ESS_SIGNING_CERTIFICATE_ERROR); + TSerr(TS_F_TS_CHECK_SIGNING_CERTS, + TS_R_ESS_SIGNING_CERTIFICATE_ERROR); ESS_SIGNING_CERT_free(ss); return ret; - } +} -static ESS_SIGNING_CERT *ESS_get_signing_cert(PKCS7_SIGNER_INFO *si) - { +static ESS_SIGNING_CERT * +ESS_get_signing_cert(PKCS7_SIGNER_INFO *si) +{ ASN1_TYPE *attr; const unsigned char *p; - attr = PKCS7_get_signed_attribute(si, - NID_id_smime_aa_signingCertificate); - if (!attr) return NULL; + + attr = PKCS7_get_signed_attribute(si, + NID_id_smime_aa_signingCertificate); + if (!attr) + return NULL; p = attr->value.sequence->data; return d2i_ESS_SIGNING_CERT(NULL, &p, attr->value.sequence->length); - } +} /* Returns < 0 if certificate is not found, certificate index otherwise. */ -static int TS_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert) - { +static int +TS_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert) +{ int i; - if (!cert_ids || !cert) return -1; + if (!cert_ids || !cert) + return -1; /* Recompute SHA1 hash of certificate if necessary (side effect). */ X509_check_purpose(cert, -1, 0); /* Look for cert in the cert_ids vector. */ - for (i = 0; i < sk_ESS_CERT_ID_num(cert_ids); ++i) - { + for (i = 0; i < sk_ESS_CERT_ID_num(cert_ids); ++i) { ESS_CERT_ID *cid = sk_ESS_CERT_ID_value(cert_ids, i); /* Check the SHA-1 hash first. */ - if (cid->hash->length == sizeof(cert->sha1_hash) - && !memcmp(cid->hash->data, cert->sha1_hash, - sizeof(cert->sha1_hash))) - { + if (cid->hash->length == sizeof(cert->sha1_hash) && + !memcmp(cid->hash->data, cert->sha1_hash, + sizeof(cert->sha1_hash))) { /* Check the issuer/serial as well if specified. */ ESS_ISSUER_SERIAL *is = cid->issuer_serial; if (!is || !TS_issuer_serial_cmp(is, cert->cert_info)) return i; - } } - - return -1; } -static int TS_issuer_serial_cmp(ESS_ISSUER_SERIAL *is, X509_CINF *cinfo) - { + return -1; +} + +static int +TS_issuer_serial_cmp(ESS_ISSUER_SERIAL *is, X509_CINF *cinfo) +{ GENERAL_NAME *issuer; - if (!is || !cinfo || sk_GENERAL_NAME_num(is->issuer) != 1) return -1; + if (!is || !cinfo || sk_GENERAL_NAME_num(is->issuer) != 1) + return -1; /* Check the issuer first. It must be a directory name. */ issuer = sk_GENERAL_NAME_value(is->issuer, 0); - if (issuer->type != GEN_DIRNAME - || X509_NAME_cmp(issuer->d.dirn, cinfo->issuer)) + if (issuer->type != GEN_DIRNAME || + X509_NAME_cmp(issuer->d.dirn, cinfo->issuer)) return -1; /* Check the serial number, too. */ @@ -351,50 +357,54 @@ static int TS_issuer_serial_cmp(ESS_ISSUER_SERIAL *is, X509_CINF *cinfo) return -1; return 0; - } +} /* - * Verifies whether 'response' contains a valid response with regards + * Verifies whether 'response' contains a valid response with regards * to the settings of the context: * - Gives an error message if the TS_TST_INFO is not present. * - Calls _TS_RESP_verify_token to verify the token content. */ -int TS_RESP_verify_response(TS_VERIFY_CTX *ctx, TS_RESP *response) - { +int +TS_RESP_verify_response(TS_VERIFY_CTX *ctx, TS_RESP *response) +{ PKCS7 *token = TS_RESP_get_token(response); TS_TST_INFO *tst_info = TS_RESP_get_tst_info(response); int ret = 0; /* Check if we have a successful TS_TST_INFO object in place. */ - if (!TS_check_status_info(response)) goto err; + if (!TS_check_status_info(response)) + goto err; /* Check the contents of the time stamp token. */ if (!int_TS_RESP_verify_token(ctx, token, tst_info)) goto err; ret = 1; - err: + +err: return ret; - } +} /* * Tries to extract a TS_TST_INFO structure from the PKCS7 token and * calls the internal int_TS_RESP_verify_token function for verifying it. */ -int TS_RESP_verify_token(TS_VERIFY_CTX *ctx, PKCS7 *token) - { +int +TS_RESP_verify_token(TS_VERIFY_CTX *ctx, PKCS7 *token) +{ TS_TST_INFO *tst_info = PKCS7_to_TS_TST_INFO(token); int ret = 0; - if (tst_info) - { + + if (tst_info) { ret = int_TS_RESP_verify_token(ctx, token, tst_info); TS_TST_INFO_free(tst_info); - } - return ret; } + return ret; +} /* - * Verifies whether the 'token' contains a valid time stamp token + * Verifies whether the 'token' contains a valid time stamp token * with regards to the settings of the context. Only those checks are * carried out that are specified in the context: * - Verifies the signature of the TS_TST_INFO. @@ -405,9 +415,10 @@ int TS_RESP_verify_token(TS_VERIFY_CTX *ctx, PKCS7 *token) * - Check if the TSA name matches the signer. * - Check if the TSA name is the expected TSA. */ -static int int_TS_RESP_verify_token(TS_VERIFY_CTX *ctx, - PKCS7 *token, TS_TST_INFO *tst_info) - { +static int +int_TS_RESP_verify_token(TS_VERIFY_CTX *ctx, PKCS7 *token, + TS_TST_INFO *tst_info) +{ X509 *signer = NULL; GENERAL_NAME *tsa_name = TS_TST_INFO_get_tsa(tst_info); X509_ALGOR *md_alg = NULL; @@ -416,68 +427,66 @@ static int int_TS_RESP_verify_token(TS_VERIFY_CTX *ctx, int ret = 0; /* Verify the signature. */ - if ((ctx->flags & TS_VFY_SIGNATURE) - && !TS_RESP_verify_signature(token, ctx->certs, ctx->store, - &signer)) + if ((ctx->flags & TS_VFY_SIGNATURE) && + !TS_RESP_verify_signature(token, ctx->certs, ctx->store, &signer)) goto err; - + /* Check version number of response. */ - if ((ctx->flags & TS_VFY_VERSION) - && TS_TST_INFO_get_version(tst_info) != 1) - { + if ((ctx->flags & TS_VFY_VERSION) && + TS_TST_INFO_get_version(tst_info) != 1) { TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_UNSUPPORTED_VERSION); goto err; - } + } /* Check policies. */ - if ((ctx->flags & TS_VFY_POLICY) - && !TS_check_policy(ctx->policy, tst_info)) + if ((ctx->flags & TS_VFY_POLICY) && + !TS_check_policy(ctx->policy, tst_info)) goto err; - + /* Check message imprints. */ - if ((ctx->flags & TS_VFY_IMPRINT) - && !TS_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len, - tst_info)) + if ((ctx->flags & TS_VFY_IMPRINT) && + !TS_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len, + tst_info)) goto err; /* Compute and check message imprints. */ - if ((ctx->flags & TS_VFY_DATA) - && (!TS_compute_imprint(ctx->data, tst_info, - &md_alg, &imprint, &imprint_len) - || !TS_check_imprints(md_alg, imprint, imprint_len, tst_info))) + if ((ctx->flags & TS_VFY_DATA) && + (!TS_compute_imprint(ctx->data, tst_info, + &md_alg, &imprint, &imprint_len) || + !TS_check_imprints(md_alg, imprint, imprint_len, tst_info))) goto err; /* Check nonces. */ - if ((ctx->flags & TS_VFY_NONCE) - && !TS_check_nonces(ctx->nonce, tst_info)) + if ((ctx->flags & TS_VFY_NONCE) && + !TS_check_nonces(ctx->nonce, tst_info)) goto err; /* Check whether TSA name and signer certificate match. */ - if ((ctx->flags & TS_VFY_SIGNER) - && tsa_name && !TS_check_signer_name(tsa_name, signer)) - { + if ((ctx->flags & TS_VFY_SIGNER) && + tsa_name && !TS_check_signer_name(tsa_name, signer)) { TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_NAME_MISMATCH); goto err; - } + } /* Check whether the TSA is the expected one. */ - if ((ctx->flags & TS_VFY_TSA_NAME) - && !TS_check_signer_name(ctx->tsa_name, signer)) - { + if ((ctx->flags & TS_VFY_TSA_NAME) && + !TS_check_signer_name(ctx->tsa_name, signer)) { TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_UNTRUSTED); goto err; - } + } ret = 1; - err: + +err: X509_free(signer); X509_ALGOR_free(md_alg); free(imprint); return ret; - } +} -static int TS_check_status_info(TS_RESP *response) - { +static int +TS_check_status_info(TS_RESP *response) +{ TS_STATUS_INFO *info = TS_RESP_get_status_info(response); long status = ASN1_INTEGER_get(info->status); const char *status_text = NULL; @@ -485,7 +494,8 @@ static int TS_check_status_info(TS_RESP *response) char failure_text[TS_STATUS_BUF_SIZE] = ""; /* Check if everything went fine. */ - if (status == 0 || status == 1) return 1; + if (status == 0 || status == 1) + return 1; /* There was an error, get the description in status_text. */ if (0 <= status && status < (long)TS_STATUS_TEXT_SIZE) @@ -494,93 +504,88 @@ static int TS_check_status_info(TS_RESP *response) status_text = "unknown code"; /* Set the embedded_status_text to the returned description. */ - if (sk_ASN1_UTF8STRING_num(info->text) > 0 - && !(embedded_status_text = TS_get_status_text(info->text))) + if (sk_ASN1_UTF8STRING_num(info->text) > 0 && + !(embedded_status_text = TS_get_status_text(info->text))) return 0; - + /* Filling in failure_text with the failure information. */ - if (info->failure_info) - { + if (info->failure_info) { int i; int first = 1; - for (i = 0; i < (int)TS_FAILURE_INFO_SIZE; ++i) - { + for (i = 0; i < (int)TS_FAILURE_INFO_SIZE; ++i) { if (ASN1_BIT_STRING_get_bit(info->failure_info, - TS_failure_info[i].code)) - { + TS_failure_info[i].code)) { if (!first) strlcat(failure_text, ",", - TS_STATUS_BUF_SIZE); + TS_STATUS_BUF_SIZE); else first = 0; strlcat(failure_text, TS_failure_info[i].text, - TS_STATUS_BUF_SIZE); - } + TS_STATUS_BUF_SIZE); } } + } if (failure_text[0] == '\0') strlcpy(failure_text, "unspecified", TS_STATUS_BUF_SIZE); /* Making up the error string. */ TSerr(TS_F_TS_CHECK_STATUS_INFO, TS_R_NO_TIME_STAMP_TOKEN); ERR_add_error_data(6, - "status code: ", status_text, - ", status text: ", embedded_status_text ? - embedded_status_text : "unspecified", - ", failure codes: ", failure_text); + "status code: ", status_text, + ", status text: ", embedded_status_text ? + embedded_status_text : "unspecified", + ", failure codes: ", failure_text); free(embedded_status_text); return 0; - } +} -static char *TS_get_status_text(STACK_OF(ASN1_UTF8STRING) *text) - { +static char * +TS_get_status_text(STACK_OF(ASN1_UTF8STRING) *text) +{ int i; unsigned int length = 0; char *result = NULL; /* Determine length first. */ - for (i = 0; i < sk_ASN1_UTF8STRING_num(text); ++i) - { + for (i = 0; i < sk_ASN1_UTF8STRING_num(text); ++i) { ASN1_UTF8STRING *current = sk_ASN1_UTF8STRING_value(text, i); length += ASN1_STRING_length(current); length += 1; /* separator character */ - } + } /* Allocate memory (closing '\0' included). */ - if (!(result = malloc(length))) - { + if (!(result = malloc(length))) { TSerr(TS_F_TS_GET_STATUS_TEXT, ERR_R_MALLOC_FAILURE); return NULL; - } + } /* Concatenate the descriptions. */ result[0] = '\0'; - for (i = 0; i < sk_ASN1_UTF8STRING_num(text); ++i) - { + for (i = 0; i < sk_ASN1_UTF8STRING_num(text); ++i) { ASN1_UTF8STRING *current = sk_ASN1_UTF8STRING_value(text, i); if (i > 0) strlcat(result, "/", length); strlcat(result, ASN1_STRING_data(current), length); - } - return result; } + return result; +} -static int TS_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info) - { +static int +TS_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info) +{ ASN1_OBJECT *resp_oid = TS_TST_INFO_get_policy_id(tst_info); - if (OBJ_cmp(req_oid, resp_oid) != 0) - { + if (OBJ_cmp(req_oid, resp_oid) != 0) { TSerr(TS_F_TS_CHECK_POLICY, TS_R_POLICY_MISMATCH); return 0; - } + } return 1; - } +} -static int TS_compute_imprint(BIO *data, TS_TST_INFO *tst_info, - X509_ALGOR **md_alg, - unsigned char **imprint, unsigned *imprint_len) - { +static int +TS_compute_imprint(BIO *data, TS_TST_INFO *tst_info, X509_ALGOR **md_alg, + unsigned char **imprint, unsigned *imprint_len) +{ TS_MSG_IMPRINT *msg_imprint = TS_TST_INFO_get_msg_imprint(tst_info); X509_ALGOR *md_alg_resp = TS_MSG_IMPRINT_get_algo(msg_imprint); const EVP_MD *md; @@ -592,136 +597,136 @@ static int TS_compute_imprint(BIO *data, TS_TST_INFO *tst_info, *imprint = NULL; /* Return the MD algorithm of the response. */ - if (!(*md_alg = X509_ALGOR_dup(md_alg_resp))) goto err; + if (!(*md_alg = X509_ALGOR_dup(md_alg_resp))) + goto err; /* Getting the MD object. */ - if (!(md = EVP_get_digestbyobj((*md_alg)->algorithm))) - { + if (!(md = EVP_get_digestbyobj((*md_alg)->algorithm))) { TSerr(TS_F_TS_COMPUTE_IMPRINT, TS_R_UNSUPPORTED_MD_ALGORITHM); goto err; - } + } /* Compute message digest. */ length = EVP_MD_size(md); if (length < 0) - goto err; + goto err; *imprint_len = length; - if (!(*imprint = malloc(*imprint_len))) - { + if (!(*imprint = malloc(*imprint_len))) { TSerr(TS_F_TS_COMPUTE_IMPRINT, ERR_R_MALLOC_FAILURE); goto err; - } + } if (!EVP_DigestInit(&md_ctx, md)) goto err; - while ((length = BIO_read(data, buffer, sizeof(buffer))) > 0) - { + while ((length = BIO_read(data, buffer, sizeof(buffer))) > 0) { if (!EVP_DigestUpdate(&md_ctx, buffer, length)) goto err; - } + } if (!EVP_DigestFinal(&md_ctx, *imprint, NULL)) goto err; return 1; - err: + +err: X509_ALGOR_free(*md_alg); free(*imprint); *imprint = NULL; *imprint_len = 0; return 0; - } +} -static int TS_check_imprints(X509_ALGOR *algor_a, - unsigned char *imprint_a, unsigned len_a, - TS_TST_INFO *tst_info) - { +static int +TS_check_imprints(X509_ALGOR *algor_a, unsigned char *imprint_a, unsigned len_a, + TS_TST_INFO *tst_info) +{ TS_MSG_IMPRINT *b = TS_TST_INFO_get_msg_imprint(tst_info); X509_ALGOR *algor_b = TS_MSG_IMPRINT_get_algo(b); int ret = 0; /* algor_a is optional. */ - if (algor_a) - { + if (algor_a) { /* Compare algorithm OIDs. */ - if (OBJ_cmp(algor_a->algorithm, algor_b->algorithm)) goto err; + if (OBJ_cmp(algor_a->algorithm, algor_b->algorithm)) + goto err; /* The parameter must be NULL in both. */ - if ((algor_a->parameter - && ASN1_TYPE_get(algor_a->parameter) != V_ASN1_NULL) - || (algor_b->parameter - && ASN1_TYPE_get(algor_b->parameter) != V_ASN1_NULL)) + if ((algor_a->parameter && + ASN1_TYPE_get(algor_a->parameter) != V_ASN1_NULL) || + (algor_b->parameter && + ASN1_TYPE_get(algor_b->parameter) != V_ASN1_NULL)) goto err; - } + } /* Compare octet strings. */ ret = len_a == (unsigned) ASN1_STRING_length(b->hashed_msg) && - memcmp(imprint_a, ASN1_STRING_data(b->hashed_msg), len_a) == 0; - err: + memcmp(imprint_a, ASN1_STRING_data(b->hashed_msg), len_a) == 0; + +err: if (!ret) TSerr(TS_F_TS_CHECK_IMPRINTS, TS_R_MESSAGE_IMPRINT_MISMATCH); return ret; - } +} -static int TS_check_nonces(const ASN1_INTEGER *a, TS_TST_INFO *tst_info) - { +static int +TS_check_nonces(const ASN1_INTEGER *a, TS_TST_INFO *tst_info) +{ const ASN1_INTEGER *b = TS_TST_INFO_get_nonce(tst_info); /* Error if nonce is missing. */ - if (!b) - { + if (!b) { TSerr(TS_F_TS_CHECK_NONCES, TS_R_NONCE_NOT_RETURNED); return 0; - } + } /* No error if a nonce is returned without being requested. */ - if (ASN1_INTEGER_cmp(a, b) != 0) - { + if (ASN1_INTEGER_cmp(a, b) != 0) { TSerr(TS_F_TS_CHECK_NONCES, TS_R_NONCE_MISMATCH); return 0; - } + } return 1; - } +} /* Check if the specified TSA name matches either the subject or one of the subject alternative names of the TSA certificate. */ -static int TS_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer) - { +static int +TS_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer) +{ STACK_OF(GENERAL_NAME) *gen_names = NULL; int idx = -1; int found = 0; /* Check the subject name first. */ - if (tsa_name->type == GEN_DIRNAME - && X509_name_cmp(tsa_name->d.dirn, signer->cert_info->subject) == 0) + if (tsa_name->type == GEN_DIRNAME && + X509_name_cmp(tsa_name->d.dirn, signer->cert_info->subject) == 0) return 1; /* Check all the alternative names. */ gen_names = X509_get_ext_d2i(signer, NID_subject_alt_name, - NULL, &idx); - while (gen_names != NULL - && !(found = TS_find_name(gen_names, tsa_name) >= 0)) - { + NULL, &idx); + while (gen_names != NULL && + !(found = TS_find_name(gen_names, tsa_name) >= 0)) { /* Get the next subject alternative name, although there should be no more than one. */ GENERAL_NAMES_free(gen_names); gen_names = X509_get_ext_d2i(signer, NID_subject_alt_name, - NULL, &idx); - } - if (gen_names) GENERAL_NAMES_free(gen_names); - - return found; + NULL, &idx); } + if (gen_names) + GENERAL_NAMES_free(gen_names); + + return found; +} /* Returns 1 if name is in gen_names, 0 otherwise. */ -static int TS_find_name(STACK_OF(GENERAL_NAME) *gen_names, GENERAL_NAME *name) - { +static int +TS_find_name(STACK_OF(GENERAL_NAME) *gen_names, GENERAL_NAME *name) +{ int i, found; for (i = 0, found = 0; !found && i < sk_GENERAL_NAME_num(gen_names); - ++i) - { + ++i) { GENERAL_NAME *current = sk_GENERAL_NAME_value(gen_names, i); found = GENERAL_NAME_cmp(current, name) == 0; - } - return found ? i - 1 : -1; } + return found ? i - 1 : -1; +} diff --git a/lib/libssl/src/crypto/ts/ts_verify_ctx.c b/lib/libssl/src/crypto/ts/ts_verify_ctx.c index 629107aeec2..3fc772678cc 100644 --- a/lib/libssl/src/crypto/ts/ts_verify_ctx.c +++ b/lib/libssl/src/crypto/ts/ts_verify_ctx.c @@ -10,7 +10,7 @@ * are met: * * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in @@ -60,34 +60,40 @@ #include #include -TS_VERIFY_CTX *TS_VERIFY_CTX_new(void) - { - TS_VERIFY_CTX *ctx = - (TS_VERIFY_CTX *) malloc(sizeof(TS_VERIFY_CTX)); +TS_VERIFY_CTX * +TS_VERIFY_CTX_new(void) +{ + TS_VERIFY_CTX *ctx = (TS_VERIFY_CTX *) malloc(sizeof(TS_VERIFY_CTX)); + if (ctx) memset(ctx, 0, sizeof(TS_VERIFY_CTX)); else TSerr(TS_F_TS_VERIFY_CTX_NEW, ERR_R_MALLOC_FAILURE); return ctx; - } +} -void TS_VERIFY_CTX_init(TS_VERIFY_CTX *ctx) - { +void +TS_VERIFY_CTX_init(TS_VERIFY_CTX *ctx) +{ OPENSSL_assert(ctx != NULL); memset(ctx, 0, sizeof(TS_VERIFY_CTX)); - } +} -void TS_VERIFY_CTX_free(TS_VERIFY_CTX *ctx) - { - if (!ctx) return; +void +TS_VERIFY_CTX_free(TS_VERIFY_CTX *ctx) +{ + if (!ctx) + return; TS_VERIFY_CTX_cleanup(ctx); free(ctx); - } +} -void TS_VERIFY_CTX_cleanup(TS_VERIFY_CTX *ctx) - { - if (!ctx) return; +void +TS_VERIFY_CTX_cleanup(TS_VERIFY_CTX *ctx) +{ + if (!ctx) + return; X509_STORE_free(ctx->store); sk_X509_pop_free(ctx->certs, X509_free); @@ -96,7 +102,7 @@ void TS_VERIFY_CTX_cleanup(TS_VERIFY_CTX *ctx) X509_ALGOR_free(ctx->md_alg); free(ctx->imprint); - + BIO_free_all(ctx->data); ASN1_INTEGER_free(ctx->nonce); @@ -104,10 +110,11 @@ void TS_VERIFY_CTX_cleanup(TS_VERIFY_CTX *ctx) GENERAL_NAME_free(ctx->tsa_name); TS_VERIFY_CTX_init(ctx); - } +} -TS_VERIFY_CTX *TS_REQ_to_TS_VERIFY_CTX(TS_REQ *req, TS_VERIFY_CTX *ctx) - { +TS_VERIFY_CTX * +TS_REQ_to_TS_VERIFY_CTX(TS_REQ *req, TS_VERIFY_CTX *ctx) +{ TS_VERIFY_CTX *ret = ctx; ASN1_OBJECT *policy; TS_MSG_IMPRINT *imprint; @@ -118,42 +125,43 @@ TS_VERIFY_CTX *TS_REQ_to_TS_VERIFY_CTX(TS_REQ *req, TS_VERIFY_CTX *ctx) OPENSSL_assert(req != NULL); if (ret) TS_VERIFY_CTX_cleanup(ret); - else - if (!(ret = TS_VERIFY_CTX_new())) return NULL; + else if (!(ret = TS_VERIFY_CTX_new())) + return NULL; /* Setting flags. */ ret->flags = TS_VFY_ALL_IMPRINT & ~(TS_VFY_TSA_NAME | TS_VFY_SIGNATURE); /* Setting policy. */ - if ((policy = TS_REQ_get_policy_id(req)) != NULL) - { - if (!(ret->policy = OBJ_dup(policy))) goto err; - } - else + if ((policy = TS_REQ_get_policy_id(req)) != NULL) { + if (!(ret->policy = OBJ_dup(policy))) + goto err; + } else ret->flags &= ~TS_VFY_POLICY; /* Setting md_alg, imprint and imprint_len. */ imprint = TS_REQ_get_msg_imprint(req); md_alg = TS_MSG_IMPRINT_get_algo(imprint); - if (!(ret->md_alg = X509_ALGOR_dup(md_alg))) goto err; + if (!(ret->md_alg = X509_ALGOR_dup(md_alg))) + goto err; msg = TS_MSG_IMPRINT_get_msg(imprint); ret->imprint_len = ASN1_STRING_length(msg); - if (!(ret->imprint = malloc(ret->imprint_len))) goto err; + if (!(ret->imprint = malloc(ret->imprint_len))) + goto err; memcpy(ret->imprint, ASN1_STRING_data(msg), ret->imprint_len); /* Setting nonce. */ - if ((nonce = TS_REQ_get_nonce(req)) != NULL) - { - if (!(ret->nonce = ASN1_INTEGER_dup(nonce))) goto err; - } - else + if ((nonce = TS_REQ_get_nonce(req)) != NULL) { + if (!(ret->nonce = ASN1_INTEGER_dup(nonce))) + goto err; + } else ret->flags &= ~TS_VFY_NONCE; return ret; - err: + +err: if (ctx) TS_VERIFY_CTX_cleanup(ctx); else TS_VERIFY_CTX_free(ret); return NULL; - } +} -- 2.20.1