1 /* crypto/ts/ts.h */
2 /* Written by Zoltan Glozik (zglozik@opentsa.org) for the OpenSSL
3 * project 2002, 2003, 2004.
4 */
5 /* ====================================================================
6 * Copyright (c) 2006 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59 module deimos.openssl.ts;
60
61 import deimos.openssl._d_util;
62
63 public import deimos.openssl.opensslconf;
64 public import deimos.openssl.symhacks;
65 version(OPENSSL_NO_BUFFER) {} else {
66 public import deimos.openssl.buffer;
67 }
68 version(OPENSSL_NO_EVP) {} else {
69 public import deimos.openssl.evp;
70 }
71 version(OPENSSL_NO_BIO) {} else {
72 public import deimos.openssl.bio;
73 }
74 public import deimos.openssl.stack;
75 public import deimos.openssl.asn1;
76 public import deimos.openssl.safestack;
77 public import deimos.openssl.pkcs7;
78
79 version(OPENSSL_NO_RSA) {} else {
80 public import deimos.openssl.rsa;
81 }
82
83 version(OPENSSL_NO_DSA) {} else {
84 public import deimos.openssl.dsa;
85 }
86
87 version(OPENSSL_NO_DH) {} else {
88 public import deimos.openssl.dh;
89 }
90
91 extern (C):
92 nothrow:
93
94 // #ifdef WIN32
95 // /* Under Win32 this is defined in wincrypt.h */
96 // #undef X509_NAME
97 // #endif
98
99 public import deimos.openssl.x509;
100 public import deimos.openssl.x509v3;
101
102 /*
103 MessageImprint ::= SEQUENCE {
104 hashAlgorithm AlgorithmIdentifier,
105 hashedMessage OCTET STRING }
106 */
107
108 struct TS_msg_imprint_st {
109 X509_ALGOR* hash_algo;
110 ASN1_OCTET_STRING* hashed_msg;
111 }
112 alias TS_msg_imprint_st TS_MSG_IMPRINT;
113
114 /*
115 TimeStampReq ::= SEQUENCE {
116 version INTEGER { v1(1) },
117 messageImprint MessageImprint,
118 --a hash algorithm OID and the hash value of the data to be
119 --time-stamped
120 reqPolicy TSAPolicyId OPTIONAL,
121 nonce INTEGER OPTIONAL,
122 certReq BOOLEAN DEFAULT FALSE,
123 extensions [0] IMPLICIT Extensions OPTIONAL }
124 */
125
126 struct TS_req_st {
127 ASN1_INTEGER* version_;
128 TS_MSG_IMPRINT* msg_imprint;
129 ASN1_OBJECT* policy_id; /* OPTIONAL */
130 ASN1_INTEGER* nonce; /* OPTIONAL */
131 ASN1_BOOLEAN cert_req; /* DEFAULT FALSE */
132 STACK_OF!(X509_EXTENSION) *extensions; /* [0] OPTIONAL */
133 }
134 alias TS_req_st TS_REQ;
135
136 /*
137 Accuracy ::= SEQUENCE {
138 seconds INTEGER OPTIONAL,
139 millis [0] INTEGER (1..999) OPTIONAL,
140 micros [1] INTEGER (1..999) OPTIONAL }
141 */
142
143 struct TS_accuracy_st {
144 ASN1_INTEGER* seconds;
145 ASN1_INTEGER* millis;
146 ASN1_INTEGER* micros;
147 }
148 alias TS_accuracy_st TS_ACCURACY;
149
150 /*
151 TSTInfo ::= SEQUENCE {
152 version INTEGER { v1(1) },
153 policy TSAPolicyId,
154 messageImprint MessageImprint,
155 -- MUST have the same value as the similar field in
156 -- TimeStampReq
157 serialNumber INTEGER,
158 -- Time-Stamping users MUST be ready to accommodate integers
159 -- up to 160 bits.
160 genTime GeneralizedTime,
161 accuracy Accuracy OPTIONAL,
162 ordering BOOLEAN DEFAULT FALSE,
163 nonce INTEGER OPTIONAL,
164 -- MUST be present if the similar field was present
165 -- in TimeStampReq. In that case it MUST have the same value.
166 tsa [0] GeneralName OPTIONAL,
167 extensions [1] IMPLICIT Extensions OPTIONAL }
168 */
169
170 struct TS_tst_info_st {
171 ASN1_INTEGER* version_;
172 ASN1_OBJECT* policy_id;
173 TS_MSG_IMPRINT* msg_imprint;
174 ASN1_INTEGER* serial;
175 ASN1_GENERALIZEDTIME* time;
176 TS_ACCURACY* accuracy;
177 ASN1_BOOLEAN ordering;
178 ASN1_INTEGER* nonce;
179 GENERAL_NAME* tsa;
180 STACK_OF!(X509_EXTENSION) *extensions;
181 }
182 alias TS_tst_info_st TS_TST_INFO;
183
184 /*
185 PKIStatusInfo ::= SEQUENCE {
186 status PKIStatus,
187 statusString PKIFreeText OPTIONAL,
188 failInfo PKIFailureInfo OPTIONAL }
189
190 From RFC 1510 - section 3.1.1:
191 PKIFreeText ::= SEQUENCE SIZE (1..MAX) OF UTF8String
192 -- text encoded as UTF-8 String (note: each UTF8String SHOULD
193 -- include an RFC 1766 language tag to indicate the language
194 -- of the contained text)
195 */
196
197 /* Possible values for status. See ts_resp_print.c && ts_resp_verify.c. */
198
199 enum TS_STATUS_GRANTED = 0;
200 enum TS_STATUS_GRANTED_WITH_MODS = 1;
201 enum TS_STATUS_REJECTION = 2;
202 enum TS_STATUS_WAITING = 3;
203 enum TS_STATUS_REVOCATION_WARNING = 4;
204 enum TS_STATUS_REVOCATION_NOTIFICATION = 5;
205
206 /* Possible values for failure_info. See ts_resp_print.c && ts_resp_verify.c */
207
208 enum TS_INFO_BAD_ALG = 0;
209 enum TS_INFO_BAD_REQUEST = 2;
210 enum TS_INFO_BAD_DATA_FORMAT = 5;
211 enum TS_INFO_TIME_NOT_AVAILABLE = 14;
212 enum TS_INFO_UNACCEPTED_POLICY = 15;
213 enum TS_INFO_UNACCEPTED_EXTENSION = 16;
214 enum TS_INFO_ADD_INFO_NOT_AVAILABLE = 17;
215 enum TS_INFO_SYSTEM_FAILURE = 25;
216
217 struct TS_status_info_st {
218 ASN1_INTEGER* status;
219 STACK_OF!(ASN1_UTF8STRING) *text;
220 ASN1_BIT_STRING* failure_info;
221 }
222 alias TS_status_info_st TS_STATUS_INFO;
223
224 /+mixin DECLARE_STACK_OF!(ASN1_UTF8STRING);+/
225 mixin DECLARE_ASN1_SET_OF!(ASN1_UTF8STRING);
226
227 /*
228 TimeStampResp ::= SEQUENCE {
229 status PKIStatusInfo,
230 timeStampToken TimeStampToken OPTIONAL }
231 */
232
233 struct TS_resp_st {
234 TS_STATUS_INFO* status_info;
235 PKCS7* token;
236 TS_TST_INFO* tst_info;
237 }
238 alias TS_resp_st TS_RESP;
239
240 /* The structure below would belong to the ESS component. */
241
242 /*
243 IssuerSerial ::= SEQUENCE {
244 issuer GeneralNames,
245 serialNumber CertificateSerialNumber
246 }
247 */
248
249 struct ESS_issuer_serial {
250 STACK_OF!(GENERAL_NAME) *issuer;
251 ASN1_INTEGER* serial;
252 }
253 alias ESS_issuer_serial ESS_ISSUER_SERIAL;
254
255 /*
256 ESSCertID ::= SEQUENCE {
257 certHash Hash,
258 issuerSerial IssuerSerial OPTIONAL
259 }
260 */
261
262 struct ESS_cert_id {
263 ASN1_OCTET_STRING* hash; /* Always SHA-1 digest. */
264 ESS_ISSUER_SERIAL* issuer_serial;
265 }
266 alias ESS_cert_id ESS_CERT_ID;
267
268 /+mixin DECLARE_STACK_OF!(ESS_CERT_ID);+/
269 mixin DECLARE_ASN1_SET_OF!(ESS_CERT_ID);
270
271 /*
272 SigningCertificate ::= SEQUENCE {
273 certs SEQUENCE OF ESSCertID,
274 policies SEQUENCE OF PolicyInformation OPTIONAL
275 }
276 */
277
278 struct ESS_signing_cert {
279 STACK_OF!(ESS_CERT_ID) *cert_ids;
280 STACK_OF!(POLICYINFO) *policy_info;
281 }
282 alias ESS_signing_cert ESS_SIGNING_CERT;
283
284
285 TS_REQ* TS_REQ_new();
286 void TS_REQ_free(TS_REQ* a);
287 int i2d_TS_REQ(const(TS_REQ)* a, ubyte** pp);
288 TS_REQ* d2i_TS_REQ(TS_REQ** a, const(ubyte)** pp, c_long length);
289
290 TS_REQ* TS_REQ_dup(TS_REQ* a);
291
292 TS_REQ* d2i_TS_REQ_fp(FILE* fp, TS_REQ** a);
293 int i2d_TS_REQ_fp(FILE* fp, TS_REQ* a);
294 TS_REQ* d2i_TS_REQ_bio(BIO* fp, TS_REQ** a);
295 int i2d_TS_REQ_bio(BIO* fp, TS_REQ* a);
296
297 TS_MSG_IMPRINT* TS_MSG_IMPRINT_new();
298 void TS_MSG_IMPRINT_free(TS_MSG_IMPRINT* a);
299 int i2d_TS_MSG_IMPRINT(const(TS_MSG_IMPRINT)* a, ubyte** pp);
300 TS_MSG_IMPRINT* d2i_TS_MSG_IMPRINT(TS_MSG_IMPRINT** a,
301 const(ubyte)** pp, c_long length);
302
303 TS_MSG_IMPRINT* TS_MSG_IMPRINT_dup(TS_MSG_IMPRINT* a);
304
305 TS_MSG_IMPRINT* d2i_TS_MSG_IMPRINT_fp(FILE* fp, TS_MSG_IMPRINT** a);
306 int i2d_TS_MSG_IMPRINT_fp(FILE* fp, TS_MSG_IMPRINT* a);
307 TS_MSG_IMPRINT* d2i_TS_MSG_IMPRINT_bio(BIO* fp, TS_MSG_IMPRINT** a);
308 int i2d_TS_MSG_IMPRINT_bio(BIO* fp, TS_MSG_IMPRINT* a);
309
310 TS_RESP* TS_RESP_new();
311 void TS_RESP_free(TS_RESP* a);
312 int i2d_TS_RESP(const(TS_RESP)* a, ubyte** pp);
313 TS_RESP* d2i_TS_RESP(TS_RESP** a, const(ubyte)** pp, c_long length);
314 TS_TST_INFO* PKCS7_to_TS_TST_INFO(PKCS7* token);
315 TS_RESP* TS_RESP_dup(TS_RESP* a);
316
317 TS_RESP* d2i_TS_RESP_fp(FILE* fp, TS_RESP** a);
318 int i2d_TS_RESP_fp(FILE* fp, TS_RESP* a);
319 TS_RESP* d2i_TS_RESP_bio(BIO* fp, TS_RESP** a);
320 int i2d_TS_RESP_bio(BIO* fp, TS_RESP* a);
321
322 TS_STATUS_INFO* TS_STATUS_INFO_new();
323 void TS_STATUS_INFO_free(TS_STATUS_INFO* a);
324 int i2d_TS_STATUS_INFO(const(TS_STATUS_INFO)* a, ubyte** pp);
325 TS_STATUS_INFO* d2i_TS_STATUS_INFO(TS_STATUS_INFO** a,
326 const(ubyte)** pp, c_long length);
327 TS_STATUS_INFO* TS_STATUS_INFO_dup(TS_STATUS_INFO* a);
328
329 TS_TST_INFO* TS_TST_INFO_new();
330 void TS_TST_INFO_free(TS_TST_INFO* a);
331 int i2d_TS_TST_INFO(const(TS_TST_INFO)* a, ubyte** pp);
332 TS_TST_INFO* d2i_TS_TST_INFO(TS_TST_INFO** a, const(ubyte)** pp,
333 c_long length);
334 TS_TST_INFO* TS_TST_INFO_dup(TS_TST_INFO* a);
335
336 TS_TST_INFO* d2i_TS_TST_INFO_fp(FILE* fp, TS_TST_INFO** a);
337 int i2d_TS_TST_INFO_fp(FILE* fp, TS_TST_INFO* a);
338 TS_TST_INFO* d2i_TS_TST_INFO_bio(BIO* fp, TS_TST_INFO** a);
339 int i2d_TS_TST_INFO_bio(BIO* fp, TS_TST_INFO* a);
340
341 TS_ACCURACY* TS_ACCURACY_new();
342 void TS_ACCURACY_free(TS_ACCURACY* a);
343 int i2d_TS_ACCURACY(const(TS_ACCURACY)* a, ubyte** pp);
344 TS_ACCURACY* d2i_TS_ACCURACY(TS_ACCURACY** a, const(ubyte)** pp,
345 c_long length);
346 TS_ACCURACY* TS_ACCURACY_dup(TS_ACCURACY* a);
347
348 ESS_ISSUER_SERIAL* ESS_ISSUER_SERIAL_new();
349 void ESS_ISSUER_SERIAL_free(ESS_ISSUER_SERIAL* a);
350 int i2d_ESS_ISSUER_SERIAL(const(ESS_ISSUER_SERIAL)* a,
351 ubyte** pp);
352 ESS_ISSUER_SERIAL* d2i_ESS_ISSUER_SERIAL(ESS_ISSUER_SERIAL** a,
353 const(ubyte)** pp, c_long length);
354 ESS_ISSUER_SERIAL* ESS_ISSUER_SERIAL_dup(ESS_ISSUER_SERIAL* a);
355
356 ESS_CERT_ID* ESS_CERT_ID_new();
357 void ESS_CERT_ID_free(ESS_CERT_ID* a);
358 int i2d_ESS_CERT_ID(const(ESS_CERT_ID)* a, ubyte** pp);
359 ESS_CERT_ID* d2i_ESS_CERT_ID(ESS_CERT_ID** a, const(ubyte)** pp,
360 c_long length);
361 ESS_CERT_ID* ESS_CERT_ID_dup(ESS_CERT_ID* a);
362
363 ESS_SIGNING_CERT* ESS_SIGNING_CERT_new();
364 void ESS_SIGNING_CERT_free(ESS_SIGNING_CERT* a);
365 int i2d_ESS_SIGNING_CERT(const(ESS_SIGNING_CERT)* a,
366 ubyte** pp);
367 ESS_SIGNING_CERT* d2i_ESS_SIGNING_CERT(ESS_SIGNING_CERT** a,
368 const(ubyte)** pp, c_long length);
369 ESS_SIGNING_CERT* ESS_SIGNING_CERT_dup(ESS_SIGNING_CERT* a);
370
371 void ERR_load_TS_strings();
372
373 int TS_REQ_set_version(TS_REQ* a, c_long version_);
374 c_long TS_REQ_get_version(const(TS_REQ)* a);
375
376 int TS_REQ_set_msg_imprint(TS_REQ* a, TS_MSG_IMPRINT* msg_imprint);
377 TS_MSG_IMPRINT* TS_REQ_get_msg_imprint(TS_REQ* a);
378
379 int TS_MSG_IMPRINT_set_algo(TS_MSG_IMPRINT* a, X509_ALGOR* alg);
380 X509_ALGOR* TS_MSG_IMPRINT_get_algo(TS_MSG_IMPRINT* a);
381
382 int TS_MSG_IMPRINT_set_msg(TS_MSG_IMPRINT* a, ubyte* d, int len);
383 ASN1_OCTET_STRING* TS_MSG_IMPRINT_get_msg(TS_MSG_IMPRINT* a);
384
385 int TS_REQ_set_policy_id(TS_REQ* a, ASN1_OBJECT* policy);
386 ASN1_OBJECT* TS_REQ_get_policy_id(TS_REQ* a);
387
388 int TS_REQ_set_nonce(TS_REQ* a, const(ASN1_INTEGER)* nonce);
389 const(ASN1_INTEGER)* TS_REQ_get_nonce(const(TS_REQ)* a);
390
391 int TS_REQ_set_cert_req(TS_REQ* a, int cert_req);
392 int TS_REQ_get_cert_req(const(TS_REQ)* a);
393
394 STACK_OF!(X509_EXTENSION) *TS_REQ_get_exts(TS_REQ* a);
395 void TS_REQ_ext_free(TS_REQ* a);
396 int TS_REQ_get_ext_count(TS_REQ* a);
397 int TS_REQ_get_ext_by_NID(TS_REQ* a, int nid, int lastpos);
398 int TS_REQ_get_ext_by_OBJ(TS_REQ* a, ASN1_OBJECT* obj, int lastpos);
399 int TS_REQ_get_ext_by_critical(TS_REQ* a, int crit, int lastpos);
400 X509_EXTENSION* TS_REQ_get_ext(TS_REQ* a, int loc);
401 X509_EXTENSION* TS_REQ_delete_ext(TS_REQ* a, int loc);
402 int TS_REQ_add_ext(TS_REQ* a, X509_EXTENSION* ex, int loc);
403 void* TS_REQ_get_ext_d2i(TS_REQ* a, int nid, int* crit, int* idx);
404
405 /* Function declarations for TS_REQ defined in ts/ts_req_print.c */
406
407 int TS_REQ_print_bio(BIO* bio, TS_REQ* a);
408
409 /* Function declarations for TS_RESP defined in ts/ts_resp_utils.c */
410
411 int TS_RESP_set_status_info(TS_RESP* a, TS_STATUS_INFO* info);
412 TS_STATUS_INFO* TS_RESP_get_status_info(TS_RESP* a);
413
414 /* Caller loses ownership of PKCS7 and TS_TST_INFO objects. */
415 void TS_RESP_set_tst_info(TS_RESP* a, PKCS7* p7, TS_TST_INFO* tst_info);
416 PKCS7* TS_RESP_get_token(TS_RESP* a);
417 TS_TST_INFO* TS_RESP_get_tst_info(TS_RESP* a);
418
419 int TS_TST_INFO_set_version(TS_TST_INFO* a, c_long version_);
420 c_long TS_TST_INFO_get_version(const(TS_TST_INFO)* a);
421
422 int TS_TST_INFO_set_policy_id(TS_TST_INFO* a, ASN1_OBJECT* policy_id);
423 ASN1_OBJECT* TS_TST_INFO_get_policy_id(TS_TST_INFO* a);
424
425 int TS_TST_INFO_set_msg_imprint(TS_TST_INFO* a, TS_MSG_IMPRINT* msg_imprint);
426 TS_MSG_IMPRINT* TS_TST_INFO_get_msg_imprint(TS_TST_INFO* a);
427
428 int TS_TST_INFO_set_serial(TS_TST_INFO* a, const(ASN1_INTEGER)* serial);
429 const(ASN1_INTEGER)* TS_TST_INFO_get_serial(const(TS_TST_INFO)* a);
430
431 int TS_TST_INFO_set_time(TS_TST_INFO* a, const(ASN1_GENERALIZEDTIME)* gtime);
432 const(ASN1_GENERALIZEDTIME)* TS_TST_INFO_get_time(const(TS_TST_INFO)* a);
433
434 int TS_TST_INFO_set_accuracy(TS_TST_INFO* a, TS_ACCURACY* accuracy);
435 TS_ACCURACY* TS_TST_INFO_get_accuracy(TS_TST_INFO* a);
436
437 int TS_ACCURACY_set_seconds(TS_ACCURACY* a, const(ASN1_INTEGER)* seconds);
438 const(ASN1_INTEGER)* TS_ACCURACY_get_seconds(const(TS_ACCURACY)* a);
439
440 int TS_ACCURACY_set_millis(TS_ACCURACY* a, const(ASN1_INTEGER)* millis);
441 const(ASN1_INTEGER)* TS_ACCURACY_get_millis(const(TS_ACCURACY)* a);
442
443 int TS_ACCURACY_set_micros(TS_ACCURACY* a, const(ASN1_INTEGER)* micros);
444 const(ASN1_INTEGER)* TS_ACCURACY_get_micros(const(TS_ACCURACY)* a);
445
446 int TS_TST_INFO_set_ordering(TS_TST_INFO* a, int ordering);
447 int TS_TST_INFO_get_ordering(const(TS_TST_INFO)* a);
448
449 int TS_TST_INFO_set_nonce(TS_TST_INFO* a, const(ASN1_INTEGER)* nonce);
450 const(ASN1_INTEGER)* TS_TST_INFO_get_nonce(const(TS_TST_INFO)* a);
451
452 int TS_TST_INFO_set_tsa(TS_TST_INFO* a, GENERAL_NAME* tsa);
453 GENERAL_NAME* TS_TST_INFO_get_tsa(TS_TST_INFO* a);
454
455 STACK_OF!(X509_EXTENSION) *TS_TST_INFO_get_exts(TS_TST_INFO* a);
456 void TS_TST_INFO_ext_free(TS_TST_INFO* a);
457 int TS_TST_INFO_get_ext_count(TS_TST_INFO* a);
458 int TS_TST_INFO_get_ext_by_NID(TS_TST_INFO* a, int nid, int lastpos);
459 int TS_TST_INFO_get_ext_by_OBJ(TS_TST_INFO* a, ASN1_OBJECT* obj, int lastpos);
460 int TS_TST_INFO_get_ext_by_critical(TS_TST_INFO* a, int crit, int lastpos);
461 X509_EXTENSION* TS_TST_INFO_get_ext(TS_TST_INFO* a, int loc);
462 X509_EXTENSION* TS_TST_INFO_delete_ext(TS_TST_INFO* a, int loc);
463 int TS_TST_INFO_add_ext(TS_TST_INFO* a, X509_EXTENSION* ex, int loc);
464 void* TS_TST_INFO_get_ext_d2i(TS_TST_INFO* a, int nid, int* crit, int* idx);
465
466 /* Declarations related to response generation, defined in ts/ts_resp_sign.c. */
467
468 /* Optional flags for response generation. */
469
470 /* Don't include the TSA name in response. */
471 enum TS_TSA_NAME = 0x01;
472
473 /* Set ordering to true in response. */
474 enum TS_ORDERING = 0x02;
475
476 /*
477 * Include the signer certificate and the other specified certificates in
478 * the ESS signing certificate attribute beside the PKCS7 signed data.
479 * Only the signer certificates is included by default.
480 */
481 enum TS_ESS_CERT_ID_CHAIN = 0x04;
482
483 // /* Forward declaration. */
484 // struct TS_resp_ctx;
485
486 /* This must return a unique number less than 160 bits long. */
487 alias ExternC!(ASN1_INTEGER* function(TS_resp_ctx*, void*)) TS_serial_cb;
488
489 /* This must return the seconds and microseconds since Jan 1, 1970 in
490 the sec and usec variables allocated by the caller.
491 Return non-zero for success and zero for failure. */
492 alias ExternC!(int function(TS_resp_ctx*, void*, c_long* sec, c_long* usec)) TS_time_cb;
493
494 /* This must process the given extension.
495 * It can modify the TS_TST_INFO object of the context.
496 * Return values: !0 (processed), 0 (error, it must set the
497 * status info/failure info of the response).
498 */
499 alias ExternC!(int function(TS_resp_ctx*, X509_EXTENSION*, void*)) TS_extension_cb;
500
501 struct TS_resp_ctx {
502 X509* signer_cert;
503 EVP_PKEY* signer_key;
504 STACK_OF!(X509) *certs; /* Certs to include in signed data. */
505 STACK_OF!(ASN1_OBJECT) *policies; /* Acceptable policies. */
506 ASN1_OBJECT* default_policy; /* It may appear in policies, too. */
507 STACK_OF!(EVP_MD) *mds; /* Acceptable message digests. */
508 ASN1_INTEGER* seconds; /* accuracy, 0 means not specified. */
509 ASN1_INTEGER* millis; /* accuracy, 0 means not specified. */
510 ASN1_INTEGER* micros; /* accuracy, 0 means not specified. */
511 uint clock_precision_digits; /* fraction of seconds in
512 time stamp token. */
513 uint flags; /* Optional info, see values above. */
514
515 /* Callback functions. */
516 TS_serial_cb serial_cb;
517 void* serial_cb_data; /* User data for serial_cb. */
518
519 TS_time_cb time_cb;
520 void* time_cb_data; /* User data for time_cb. */
521
522 TS_extension_cb extension_cb;
523 void* extension_cb_data; /* User data for extension_cb. */
524
525 /* These members are used only while creating the response. */
526 TS_REQ* request;
527 TS_RESP* response;
528 TS_TST_INFO* tst_info;
529 }
530 alias TS_resp_ctx TS_RESP_CTX;
531
532 /+mixin DECLARE_STACK_OF!(EVP_MD);+/
533 mixin DECLARE_ASN1_SET_OF!(EVP_MD);
534
535 /* Creates a response context that can be used for generating responses. */
536 TS_RESP_CTX* TS_RESP_CTX_new();
537 void TS_RESP_CTX_free(TS_RESP_CTX* ctx);
538
539 /* This parameter must be set. */
540 int TS_RESP_CTX_set_signer_cert(TS_RESP_CTX* ctx, X509* signer);
541
542 /* This parameter must be set. */
543 int TS_RESP_CTX_set_signer_key(TS_RESP_CTX* ctx, EVP_PKEY* key);
544
545 /* This parameter must be set. */
546 int TS_RESP_CTX_set_def_policy(TS_RESP_CTX* ctx, ASN1_OBJECT* def_policy);
547
548 /* No additional certs are included in the response by default. */
549 int TS_RESP_CTX_set_certs(TS_RESP_CTX* ctx, STACK_OF!(X509) *certs);
550
551 /* Adds a new acceptable policy, only the default policy
552 is accepted by default. */
553 int TS_RESP_CTX_add_policy(TS_RESP_CTX* ctx, ASN1_OBJECT* policy);
554
555 /* Adds a new acceptable message digest. Note that no message digests
556 are accepted by default. The md argument is shared with the caller. */
557 int TS_RESP_CTX_add_md(TS_RESP_CTX* ctx, const(EVP_MD)* md);
558
559 /* Accuracy is not included by default. */
560 int TS_RESP_CTX_set_accuracy(TS_RESP_CTX* ctx,
561 int secs, int millis, int micros);
562
563 /* Clock precision digits, i.e. the number of decimal digits:
564 '0' means sec, '3' msec, '6' usec, and so on. Default is 0. */
565 int TS_RESP_CTX_set_clock_precision_digits(TS_RESP_CTX* ctx,
566 uint clock_precision_digits);
567 /* At most we accept usec precision. */
568 enum TS_MAX_CLOCK_PRECISION_DIGITS = 6;
569
570 /* No flags are set by default. */
571 void TS_RESP_CTX_add_flags(TS_RESP_CTX* ctx, int flags);
572
573 /* Default callback always returns a constant. */
574 void TS_RESP_CTX_set_serial_cb(TS_RESP_CTX* ctx, TS_serial_cb cb, void* data);
575
576 /* Default callback uses the gettimeofday() and gmtime() system calls. */
577 void TS_RESP_CTX_set_time_cb(TS_RESP_CTX* ctx, TS_time_cb cb, void* data);
578
579 /* Default callback rejects all extensions. The extension callback is called
580 * when the TS_TST_INFO object is already set up and not signed yet. */
581 /* FIXME: extension handling is not tested yet. */
582 void TS_RESP_CTX_set_extension_cb(TS_RESP_CTX* ctx,
583 TS_extension_cb cb, void* data);
584
585 /* The following methods can be used in the callbacks. */
586 int TS_RESP_CTX_set_status_info(TS_RESP_CTX* ctx,
587 int status, const(char)* text);
588
589 /* Sets the status info only if it is still TS_STATUS_GRANTED. */
590 int TS_RESP_CTX_set_status_info_cond(TS_RESP_CTX* ctx,
591 int status, const(char)* text);
592
593 int TS_RESP_CTX_add_failure_info(TS_RESP_CTX* ctx, int failure);
594
595 /* The get methods below can be used in the extension callback. */
596 TS_REQ* TS_RESP_CTX_get_request(TS_RESP_CTX* ctx);
597
598 TS_TST_INFO* TS_RESP_CTX_get_tst_info(TS_RESP_CTX* ctx);
599
600 /*
601 * Creates the signed TS_TST_INFO and puts it in TS_RESP.
602 * In case of errors it sets the status info properly.
603 * Returns NULL only in case of memory allocation/fatal error.
604 */
605 TS_RESP* TS_RESP_create_response(TS_RESP_CTX* ctx, BIO* req_bio);
606
607 /*
608 * Declarations related to response verification,
609 * they are defined in ts/ts_resp_verify.c.
610 */
611
612 int TS_RESP_verify_signature(PKCS7* token, STACK_OF!(X509) *certs,
613 X509_STORE* store, X509** signer_out);
614
615 /* Context structure for the generic verify method. */
616
617 /* Verify the signer's certificate and the signature of the response. */
618 enum TS_VFY_SIGNATURE = (1u << 0);
619 /* Verify the version number of the response. */
620 enum TS_VFY_VERSION = (1u << 1);
621 /* Verify if the policy supplied by the user matches the policy of the TSA. */
622 enum TS_VFY_POLICY = (1u << 2);
623 /* Verify the message imprint provided by the user. This flag should not be
624 specified with TS_VFY_DATA. */
625 enum TS_VFY_IMPRINT = (1u << 3);
626 /* Verify the message imprint computed by the verify method from the user
627 provided data and the MD algorithm of the response. This flag should not be
628 specified with TS_VFY_IMPRINT. */
629 enum TS_VFY_DATA = (1u << 4);
630 /* Verify the nonce value. */
631 enum TS_VFY_NONCE = (1u << 5);
632 /* Verify if the TSA name field matches the signer certificate. */
633 enum TS_VFY_SIGNER = (1u << 6);
634 /* Verify if the TSA name field equals to the user provided name. */
635 enum TS_VFY_TSA_NAME = (1u << 7);
636
637 /* You can use the following convenience constants. */
638 enum TS_VFY_ALL_IMPRINT = (TS_VFY_SIGNATURE
639 | TS_VFY_VERSION
640 | TS_VFY_POLICY
641 | TS_VFY_IMPRINT
642 | TS_VFY_NONCE
643 | TS_VFY_SIGNER
644 | TS_VFY_TSA_NAME);
645 enum TS_VFY_ALL_DATA = (TS_VFY_SIGNATURE
646 | TS_VFY_VERSION
647 | TS_VFY_POLICY
648 | TS_VFY_DATA
649 | TS_VFY_NONCE
650 | TS_VFY_SIGNER
651 | TS_VFY_TSA_NAME);
652
653 struct TS_verify_ctx {
654 /* Set this to the union of TS_VFY_... flags you want to carry out. */
655 uint flags;
656
657 /* Must be set only with TS_VFY_SIGNATURE. certs is optional. */
658 X509_STORE* store;
659 STACK_OF!(X509) *certs;
660
661 /* Must be set only with TS_VFY_POLICY. */
662 ASN1_OBJECT* policy;
663
664 /* Must be set only with TS_VFY_IMPRINT. If md_alg is NULL,
665 the algorithm from the response is used. */
666 X509_ALGOR* md_alg;
667 ubyte* imprint;
668 uint imprint_len;
669
670 /* Must be set only with TS_VFY_DATA. */
671 BIO* data;
672
673 /* Must be set only with TS_VFY_TSA_NAME. */
674 ASN1_INTEGER* nonce;
675
676 /* Must be set only with TS_VFY_TSA_NAME. */
677 GENERAL_NAME* tsa_name;
678 }
679 alias TS_verify_ctx TS_VERIFY_CTX;
680
681 int TS_RESP_verify_response(TS_VERIFY_CTX* ctx, TS_RESP* response);
682 int TS_RESP_verify_token(TS_VERIFY_CTX* ctx, PKCS7* token);
683
684 /*
685 * Declarations related to response verification context,
686 * they are defined in ts/ts_verify_ctx.c.
687 */
688
689 /* Set all fields to zero. */
690 TS_VERIFY_CTX* TS_VERIFY_CTX_new();
691 void TS_VERIFY_CTX_init(TS_VERIFY_CTX* ctx);
692 void TS_VERIFY_CTX_free(TS_VERIFY_CTX* ctx);
693 void TS_VERIFY_CTX_cleanup(TS_VERIFY_CTX* ctx);
694
695 /*
696 * If ctx is NULL, it allocates and returns a new object, otherwise
697 * it returns ctx. It initialises all the members as follows:
698 * flags = TS_VFY_ALL_IMPRINT & ~(TS_VFY_TSA_NAME | TS_VFY_SIGNATURE)
699 * certs = NULL
700 * store = NULL
701 * policy = policy from the request or NULL if absent (in this case
702 * TS_VFY_POLICY is cleared from flags as well)
703 * md_alg = MD algorithm from request
704 * imprint, imprint_len = imprint from request
705 * data = NULL
706 * nonce, nonce_len = nonce from the request or NULL if absent (in this case
707 * TS_VFY_NONCE is cleared from flags as well)
708 * tsa_name = NULL
709 * Important: after calling this method TS_VFY_SIGNATURE should be added!
710 */
711 TS_VERIFY_CTX* TS_REQ_to_TS_VERIFY_CTX(TS_REQ* req, TS_VERIFY_CTX* ctx);
712
713 /* Function declarations for TS_RESP defined in ts/ts_resp_print.c */
714
715 int TS_RESP_print_bio(BIO* bio, TS_RESP* a);
716 int TS_STATUS_INFO_print_bio(BIO* bio, TS_STATUS_INFO* a);
717 int TS_TST_INFO_print_bio(BIO* bio, TS_TST_INFO* a);
718
719 /* Common utility functions defined in ts/ts_lib.c */
720
721 int TS_ASN1_INTEGER_print_bio(BIO* bio, const(ASN1_INTEGER)* num);
722 int TS_OBJ_print_bio(BIO* bio, const(ASN1_OBJECT)* obj);
723 int TS_ext_print_bio(BIO* bio, const STACK_OF!(X509_EXTENSION) *extensions);
724 int TS_X509_ALGOR_print_bio(BIO* bio, const(X509_ALGOR)* alg);
725 int TS_MSG_IMPRINT_print_bio(BIO* bio, TS_MSG_IMPRINT* msg);
726
727 /* Function declarations for handling configuration options,
728 defined in ts/ts_conf.c */
729
730 X509* TS_CONF_load_cert(const(char)* file);
731 STACK_OF!(X509) *TS_CONF_load_certs(const(char)* file);
732 EVP_PKEY* TS_CONF_load_key(const(char)* file, const(char)* pass);
733 const(char)* TS_CONF_get_tsa_section(CONF* conf, const(char)* section);
734 int TS_CONF_set_serial(CONF* conf, const(char)* section, TS_serial_cb cb,
735 TS_RESP_CTX* ctx);
736 int TS_CONF_set_crypto_device(CONF* conf, const(char)* section,
737 const(char)* device);
738 int TS_CONF_set_default_engine(const(char)* name);
739 int TS_CONF_set_signer_cert(CONF* conf, const(char)* section,
740 const(char)* cert, TS_RESP_CTX* ctx);
741 int TS_CONF_set_certs(CONF* conf, const(char)* section, const(char)* certs,
742 TS_RESP_CTX* ctx);
743 int TS_CONF_set_signer_key(CONF* conf, const(char)* section,
744 const(char)* key, const(char)* pass, TS_RESP_CTX* ctx);
745 int TS_CONF_set_def_policy(CONF* conf, const(char)* section,
746 const(char)* policy, TS_RESP_CTX* ctx);
747 int TS_CONF_set_policies(CONF* conf, const(char)* section, TS_RESP_CTX* ctx);
748 int TS_CONF_set_digests(CONF* conf, const(char)* section, TS_RESP_CTX* ctx);
749 int TS_CONF_set_accuracy(CONF* conf, const(char)* section, TS_RESP_CTX* ctx);
750 int TS_CONF_set_clock_precision_digits(CONF* conf, const(char)* section,
751 TS_RESP_CTX* ctx);
752 int TS_CONF_set_ordering(CONF* conf, const(char)* section, TS_RESP_CTX* ctx);
753 int TS_CONF_set_tsa_name(CONF* conf, const(char)* section, TS_RESP_CTX* ctx);
754 int TS_CONF_set_ess_cert_id_chain(CONF* conf, const(char)* section,
755 TS_RESP_CTX* ctx);
756
757 /* -------------------------------------------------- */
758 /* BEGIN ERROR CODES */
759 /* The following lines are auto generated by the script mkerr.pl. Any changes
760 * made after this point may be overwritten when the script is next run.
761 */
762 void ERR_load_TS_strings();
763
764 /* Error codes for the TS functions. */
765
766 /* Function codes. */
767 enum TS_F_D2I_TS_RESP = 147;
768 enum TS_F_DEF_SERIAL_CB = 110;
769 enum TS_F_DEF_TIME_CB = 111;
770 enum TS_F_ESS_ADD_SIGNING_CERT = 112;
771 enum TS_F_ESS_CERT_ID_NEW_INIT = 113;
772 enum TS_F_ESS_SIGNING_CERT_NEW_INIT = 114;
773 enum TS_F_INT_TS_RESP_VERIFY_TOKEN = 149;
774 enum TS_F_PKCS7_TO_TS_TST_INFO = 148;
775 enum TS_F_TS_ACCURACY_SET_MICROS = 115;
776 enum TS_F_TS_ACCURACY_SET_MILLIS = 116;
777 enum TS_F_TS_ACCURACY_SET_SECONDS = 117;
778 enum TS_F_TS_CHECK_IMPRINTS = 100;
779 enum TS_F_TS_CHECK_NONCES = 101;
780 enum TS_F_TS_CHECK_POLICY = 102;
781 enum TS_F_TS_CHECK_SIGNING_CERTS = 103;
782 enum TS_F_TS_CHECK_STATUS_INFO = 104;
783 enum TS_F_TS_COMPUTE_IMPRINT = 145;
784 enum TS_F_TS_CONF_SET_DEFAULT_ENGINE = 146;
785 enum TS_F_TS_GET_STATUS_TEXT = 105;
786 enum TS_F_TS_MSG_IMPRINT_SET_ALGO = 118;
787 enum TS_F_TS_REQ_SET_MSG_IMPRINT = 119;
788 enum TS_F_TS_REQ_SET_NONCE = 120;
789 enum TS_F_TS_REQ_SET_POLICY_ID = 121;
790 enum TS_F_TS_RESP_CREATE_RESPONSE = 122;
791 enum TS_F_TS_RESP_CREATE_TST_INFO = 123;
792 enum TS_F_TS_RESP_CTX_ADD_FAILURE_INFO = 124;
793 enum TS_F_TS_RESP_CTX_ADD_MD = 125;
794 enum TS_F_TS_RESP_CTX_ADD_POLICY = 126;
795 enum TS_F_TS_RESP_CTX_NEW = 127;
796 enum TS_F_TS_RESP_CTX_SET_ACCURACY = 128;
797 enum TS_F_TS_RESP_CTX_SET_CERTS = 129;
798 enum TS_F_TS_RESP_CTX_SET_DEF_POLICY = 130;
799 enum TS_F_TS_RESP_CTX_SET_SIGNER_CERT = 131;
800 enum TS_F_TS_RESP_CTX_SET_STATUS_INFO = 132;
801 enum TS_F_TS_RESP_GET_POLICY = 133;
802 enum TS_F_TS_RESP_SET_GENTIME_WITH_PRECISION = 134;
803 enum TS_F_TS_RESP_SET_STATUS_INFO = 135;
804 enum TS_F_TS_RESP_SET_TST_INFO = 150;
805 enum TS_F_TS_RESP_SIGN = 136;
806 enum TS_F_TS_RESP_VERIFY_SIGNATURE = 106;
807 enum TS_F_TS_RESP_VERIFY_TOKEN = 107;
808 enum TS_F_TS_TST_INFO_SET_ACCURACY = 137;
809 enum TS_F_TS_TST_INFO_SET_MSG_IMPRINT = 138;
810 enum TS_F_TS_TST_INFO_SET_NONCE = 139;
811 enum TS_F_TS_TST_INFO_SET_POLICY_ID = 140;
812 enum TS_F_TS_TST_INFO_SET_SERIAL = 141;
813 enum TS_F_TS_TST_INFO_SET_TIME = 142;
814 enum TS_F_TS_TST_INFO_SET_TSA = 143;
815 enum TS_F_TS_VERIFY = 108;
816 enum TS_F_TS_VERIFY_CERT = 109;
817 enum TS_F_TS_VERIFY_CTX_NEW = 144;
818
819 /* Reason codes. */
820 enum TS_R_BAD_PKCS7_TYPE = 132;
821 enum TS_R_BAD_TYPE = 133;
822 enum TS_R_CERTIFICATE_VERIFY_ERROR = 100;
823 enum TS_R_COULD_NOT_SET_ENGINE = 127;
824 enum TS_R_COULD_NOT_SET_TIME = 115;
825 enum TS_R_D2I_TS_RESP_INT_FAILED = 128;
826 enum TS_R_DETACHED_CONTENT = 134;
827 enum TS_R_ESS_ADD_SIGNING_CERT_ERROR = 116;
828 enum TS_R_ESS_SIGNING_CERTIFICATE_ERROR = 101;
829 enum TS_R_INVALID_NULL_POINTER = 102;
830 enum TS_R_INVALID_SIGNER_CERTIFICATE_PURPOSE = 117;
831 enum TS_R_MESSAGE_IMPRINT_MISMATCH = 103;
832 enum TS_R_NONCE_MISMATCH = 104;
833 enum TS_R_NONCE_NOT_RETURNED = 105;
834 enum TS_R_NO_CONTENT = 106;
835 enum TS_R_NO_TIME_STAMP_TOKEN = 107;
836 enum TS_R_PKCS7_ADD_SIGNATURE_ERROR = 118;
837 enum TS_R_PKCS7_ADD_SIGNED_ATTR_ERROR = 119;
838 enum TS_R_PKCS7_TO_TS_TST_INFO_FAILED = 129;
839 enum TS_R_POLICY_MISMATCH = 108;
840 enum TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE = 120;
841 enum TS_R_RESPONSE_SETUP_ERROR = 121;
842 enum TS_R_SIGNATURE_FAILURE = 109;
843 enum TS_R_THERE_MUST_BE_ONE_SIGNER = 110;
844 enum TS_R_TIME_SYSCALL_ERROR = 122;
845 enum TS_R_TOKEN_NOT_PRESENT = 130;
846 enum TS_R_TOKEN_PRESENT = 131;
847 enum TS_R_TSA_NAME_MISMATCH = 111;
848 enum TS_R_TSA_UNTRUSTED = 112;
849 enum TS_R_TST_INFO_SETUP_ERROR = 123;
850 enum TS_R_TS_DATASIGN = 124;
851 enum TS_R_UNACCEPTABLE_POLICY = 125;
852 enum TS_R_UNSUPPORTED_MD_ALGORITHM = 126;
853 enum TS_R_UNSUPPORTED_VERSION = 113;
854 enum TS_R_WRONG_CONTENT_TYPE = 114;