summaryrefslogtreecommitdiff
path: root/libressl/include/openssl/ts.h
blob: fa8eb949a4ea5d8ab2566fdc72266e79302a72a5 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
/* $OpenBSD: ts.h,v 1.10 2018/05/13 15:35:46 tb Exp $ */
/* Written by Zoltan Glozik (zglozik@opentsa.org) for the OpenSSL
 * project 2002, 2003, 2004.
 */
/* ====================================================================
 * Copyright (c) 2006 The OpenSSL Project.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 *
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in
 *    the documentation and/or other materials provided with the
 *    distribution.
 *
 * 3. All advertising materials mentioning features or use of this
 *    software must display the following acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
 *
 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
 *    endorse or promote products derived from this software without
 *    prior written permission. For written permission, please contact
 *    licensing@OpenSSL.org.
 *
 * 5. Products derived from this software may not be called "OpenSSL"
 *    nor may "OpenSSL" appear in their names without prior written
 *    permission of the OpenSSL Project.
 *
 * 6. Redistributions of any form whatsoever must retain the following
 *    acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
 *
 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 * OF THE POSSIBILITY OF SUCH DAMAGE.
 * ====================================================================
 *
 * This product includes cryptographic software written by Eric Young
 * (eay@cryptsoft.com).  This product includes software written by Tim
 * Hudson (tjh@cryptsoft.com).
 *
 */

#ifndef HEADER_TS_H
#define HEADER_TS_H

#include <openssl/opensslconf.h>

#ifndef OPENSSL_NO_BUFFER
#include <openssl/buffer.h>
#endif
#ifndef OPENSSL_NO_EVP
#include <openssl/evp.h>
#endif
#ifndef OPENSSL_NO_BIO
#include <openssl/bio.h>
#endif
#include <openssl/stack.h>
#include <openssl/asn1.h>
#include <openssl/safestack.h>

#ifndef OPENSSL_NO_RSA
#include <openssl/rsa.h>
#endif

#ifndef OPENSSL_NO_DSA
#include <openssl/dsa.h>
#endif

#ifndef OPENSSL_NO_DH
#include <openssl/dh.h>
#endif

#ifdef  __cplusplus
extern "C" {
#endif

#include <openssl/x509.h>
#include <openssl/x509v3.h>

/*
MessageImprint ::= SEQUENCE  {
     hashAlgorithm                AlgorithmIdentifier,
     hashedMessage                OCTET STRING  }
*/

typedef struct TS_msg_imprint_st {
	X509_ALGOR *hash_algo;
	ASN1_OCTET_STRING *hashed_msg;
} TS_MSG_IMPRINT;

/*
TimeStampReq ::= SEQUENCE  {
   version                  INTEGER  { v1(1) },
   messageImprint           MessageImprint,
     --a hash algorithm OID and the hash value of the data to be
     --time-stamped
   reqPolicy                TSAPolicyId                OPTIONAL,
   nonce                    INTEGER                    OPTIONAL,
   certReq                  BOOLEAN                    DEFAULT FALSE,
   extensions               [0] IMPLICIT Extensions    OPTIONAL  }
*/

typedef struct TS_req_st {
	ASN1_INTEGER *version;
	TS_MSG_IMPRINT *msg_imprint;
	ASN1_OBJECT *policy_id;		/* OPTIONAL */
	ASN1_INTEGER *nonce;		/* OPTIONAL */
	ASN1_BOOLEAN cert_req;		/* DEFAULT FALSE */
	STACK_OF(X509_EXTENSION) *extensions;	/* [0] OPTIONAL */
} TS_REQ;

/*
Accuracy ::= SEQUENCE {
                seconds        INTEGER           OPTIONAL,
                millis     [0] INTEGER  (1..999) OPTIONAL,
                micros     [1] INTEGER  (1..999) OPTIONAL  }
*/

typedef struct TS_accuracy_st {
	ASN1_INTEGER *seconds;
	ASN1_INTEGER *millis;
	ASN1_INTEGER *micros;
} TS_ACCURACY;

/*
TSTInfo ::= SEQUENCE  {
    version                      INTEGER  { v1(1) },
    policy                       TSAPolicyId,
    messageImprint               MessageImprint,
      -- MUST have the same value as the similar field in
      -- TimeStampReq
    serialNumber                 INTEGER,
     -- Time-Stamping users MUST be ready to accommodate integers
     -- up to 160 bits.
    genTime                      GeneralizedTime,
    accuracy                     Accuracy                 OPTIONAL,
    ordering                     BOOLEAN             DEFAULT FALSE,
    nonce                        INTEGER                  OPTIONAL,
      -- MUST be present if the similar field was present
      -- in TimeStampReq.  In that case it MUST have the same value.
    tsa                          [0] GeneralName          OPTIONAL,
    extensions                   [1] IMPLICIT Extensions  OPTIONAL   }
*/

typedef struct TS_tst_info_st {
	ASN1_INTEGER *version;
	ASN1_OBJECT *policy_id;
	TS_MSG_IMPRINT *msg_imprint;
	ASN1_INTEGER *serial;
	ASN1_GENERALIZEDTIME *time;
	TS_ACCURACY *accuracy;
	ASN1_BOOLEAN ordering;
	ASN1_INTEGER *nonce;
	GENERAL_NAME *tsa;
	STACK_OF(X509_EXTENSION) *extensions;
} TS_TST_INFO;

/*
PKIStatusInfo ::= SEQUENCE {
    status        PKIStatus,
    statusString  PKIFreeText     OPTIONAL,
    failInfo      PKIFailureInfo  OPTIONAL  }

From RFC 1510 - section 3.1.1:
PKIFreeText ::= SEQUENCE SIZE (1..MAX) OF UTF8String
	-- text encoded as UTF-8 String (note:  each UTF8String SHOULD
	-- include an RFC 1766 language tag to indicate the language
	-- of the contained text)
*/

/* Possible values for status. See ts_resp_print.c && ts_resp_verify.c. */

#define	TS_STATUS_GRANTED			0
#define	TS_STATUS_GRANTED_WITH_MODS		1
#define	TS_STATUS_REJECTION			2
#define	TS_STATUS_WAITING			3
#define	TS_STATUS_REVOCATION_WARNING		4
#define	TS_STATUS_REVOCATION_NOTIFICATION	5

/* Possible values for failure_info. See ts_resp_print.c && ts_resp_verify.c */

#define	TS_INFO_BAD_ALG			0
#define	TS_INFO_BAD_REQUEST		2
#define	TS_INFO_BAD_DATA_FORMAT		5
#define	TS_INFO_TIME_NOT_AVAILABLE	14
#define	TS_INFO_UNACCEPTED_POLICY	15
#define	TS_INFO_UNACCEPTED_EXTENSION	16
#define	TS_INFO_ADD_INFO_NOT_AVAILABLE	17
#define	TS_INFO_SYSTEM_FAILURE		25

typedef struct TS_status_info_st {
	ASN1_INTEGER *status;
	STACK_OF(ASN1_UTF8STRING) *text;
	ASN1_BIT_STRING *failure_info;
} TS_STATUS_INFO;

DECLARE_STACK_OF(ASN1_UTF8STRING)

/*
TimeStampResp ::= SEQUENCE  {
     status                  PKIStatusInfo,
     timeStampToken          TimeStampToken     OPTIONAL }
*/

typedef struct TS_resp_st {
	TS_STATUS_INFO *status_info;
	PKCS7 *token;
	TS_TST_INFO *tst_info;
} TS_RESP;

/* The structure below would belong to the ESS component. */

/*
IssuerSerial ::= SEQUENCE {
	issuer                   GeneralNames,
	serialNumber             CertificateSerialNumber
	}
*/

typedef struct ESS_issuer_serial {
	STACK_OF(GENERAL_NAME)	*issuer;
	ASN1_INTEGER		*serial;
} ESS_ISSUER_SERIAL;

/*
ESSCertID ::=  SEQUENCE {
        certHash                 Hash,
        issuerSerial             IssuerSerial OPTIONAL
}
*/

typedef struct ESS_cert_id {
	ASN1_OCTET_STRING *hash;	/* Always SHA-1 digest. */
	ESS_ISSUER_SERIAL *issuer_serial;
} ESS_CERT_ID;

DECLARE_STACK_OF(ESS_CERT_ID)

/*
SigningCertificate ::=  SEQUENCE {
       certs        SEQUENCE OF ESSCertID,
       policies     SEQUENCE OF PolicyInformation OPTIONAL
}
*/

typedef struct ESS_signing_cert {
	STACK_OF(ESS_CERT_ID) *cert_ids;
	STACK_OF(POLICYINFO) *policy_info;
} ESS_SIGNING_CERT;


TS_REQ	*TS_REQ_new(void);
void	TS_REQ_free(TS_REQ *a);
int	i2d_TS_REQ(const TS_REQ *a, unsigned char **pp);
TS_REQ	*d2i_TS_REQ(TS_REQ **a, const unsigned char **pp, long length);

TS_REQ	*TS_REQ_dup(TS_REQ *a);

TS_REQ	*d2i_TS_REQ_fp(FILE *fp, TS_REQ **a);
int	i2d_TS_REQ_fp(FILE *fp, TS_REQ *a);
TS_REQ	*d2i_TS_REQ_bio(BIO *fp, TS_REQ **a);
int	i2d_TS_REQ_bio(BIO *fp, TS_REQ *a);

TS_MSG_IMPRINT	*TS_MSG_IMPRINT_new(void);
void		TS_MSG_IMPRINT_free(TS_MSG_IMPRINT *a);
int		i2d_TS_MSG_IMPRINT(const TS_MSG_IMPRINT *a, unsigned char **pp);
TS_MSG_IMPRINT	*d2i_TS_MSG_IMPRINT(TS_MSG_IMPRINT **a,
		    const unsigned char **pp, long length);

TS_MSG_IMPRINT	*TS_MSG_IMPRINT_dup(TS_MSG_IMPRINT *a);

TS_MSG_IMPRINT	*d2i_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT **a);
int		i2d_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT *a);
TS_MSG_IMPRINT	*d2i_TS_MSG_IMPRINT_bio(BIO *fp, TS_MSG_IMPRINT **a);
int		i2d_TS_MSG_IMPRINT_bio(BIO *fp, TS_MSG_IMPRINT *a);

TS_RESP	*TS_RESP_new(void);
void	TS_RESP_free(TS_RESP *a);
int	i2d_TS_RESP(const TS_RESP *a, unsigned char **pp);
TS_RESP	*d2i_TS_RESP(TS_RESP **a, const unsigned char **pp, long length);
TS_TST_INFO *PKCS7_to_TS_TST_INFO(PKCS7 *token);
TS_RESP	*TS_RESP_dup(TS_RESP *a);

TS_RESP	*d2i_TS_RESP_fp(FILE *fp, TS_RESP **a);
int	i2d_TS_RESP_fp(FILE *fp, TS_RESP *a);
TS_RESP	*d2i_TS_RESP_bio(BIO *fp, TS_RESP **a);
int	i2d_TS_RESP_bio(BIO *fp, TS_RESP *a);

TS_STATUS_INFO	*TS_STATUS_INFO_new(void);
void		TS_STATUS_INFO_free(TS_STATUS_INFO *a);
int		i2d_TS_STATUS_INFO(const TS_STATUS_INFO *a, unsigned char **pp);
TS_STATUS_INFO	*d2i_TS_STATUS_INFO(TS_STATUS_INFO **a,
		    const unsigned char **pp, long length);
TS_STATUS_INFO	*TS_STATUS_INFO_dup(TS_STATUS_INFO *a);

TS_TST_INFO	*TS_TST_INFO_new(void);
void		TS_TST_INFO_free(TS_TST_INFO *a);
int		i2d_TS_TST_INFO(const TS_TST_INFO *a, unsigned char **pp);
TS_TST_INFO	*d2i_TS_TST_INFO(TS_TST_INFO **a, const unsigned char **pp,
		    long length);
TS_TST_INFO	*TS_TST_INFO_dup(TS_TST_INFO *a);

TS_TST_INFO	*d2i_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO **a);
int		i2d_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO *a);
TS_TST_INFO	*d2i_TS_TST_INFO_bio(BIO *fp, TS_TST_INFO **a);
int		i2d_TS_TST_INFO_bio(BIO *fp, TS_TST_INFO *a);

TS_ACCURACY	*TS_ACCURACY_new(void);
void		TS_ACCURACY_free(TS_ACCURACY *a);
int		i2d_TS_ACCURACY(const TS_ACCURACY *a, unsigned char **pp);
TS_ACCURACY	*d2i_TS_ACCURACY(TS_ACCURACY **a, const unsigned char **pp,
		    long length);
TS_ACCURACY	*TS_ACCURACY_dup(TS_ACCURACY *a);

ESS_ISSUER_SERIAL *ESS_ISSUER_SERIAL_new(void);
void		  ESS_ISSUER_SERIAL_free(ESS_ISSUER_SERIAL *a);
int		  i2d_ESS_ISSUER_SERIAL(const ESS_ISSUER_SERIAL *a,
		    unsigned char **pp);
ESS_ISSUER_SERIAL *d2i_ESS_ISSUER_SERIAL(ESS_ISSUER_SERIAL **a,
		    const unsigned char **pp, long length);
ESS_ISSUER_SERIAL *ESS_ISSUER_SERIAL_dup(ESS_ISSUER_SERIAL *a);

ESS_CERT_ID	*ESS_CERT_ID_new(void);
void		ESS_CERT_ID_free(ESS_CERT_ID *a);
int		i2d_ESS_CERT_ID(const ESS_CERT_ID *a, unsigned char **pp);
ESS_CERT_ID	*d2i_ESS_CERT_ID(ESS_CERT_ID **a, const unsigned char **pp,
		    long length);
ESS_CERT_ID	*ESS_CERT_ID_dup(ESS_CERT_ID *a);

ESS_SIGNING_CERT *ESS_SIGNING_CERT_new(void);
void		 ESS_SIGNING_CERT_free(ESS_SIGNING_CERT *a);
int		 i2d_ESS_SIGNING_CERT(const ESS_SIGNING_CERT *a,
		    unsigned char **pp);
ESS_SIGNING_CERT *d2i_ESS_SIGNING_CERT(ESS_SIGNING_CERT **a,
		    const unsigned char **pp, long length);
ESS_SIGNING_CERT *ESS_SIGNING_CERT_dup(ESS_SIGNING_CERT *a);

void ERR_load_TS_strings(void);

int TS_REQ_set_version(TS_REQ *a, long version);
long TS_REQ_get_version(const TS_REQ *a);

int TS_REQ_set_msg_imprint(TS_REQ *a, TS_MSG_IMPRINT *msg_imprint);
TS_MSG_IMPRINT *TS_REQ_get_msg_imprint(TS_REQ *a);

int TS_MSG_IMPRINT_set_algo(TS_MSG_IMPRINT *a, X509_ALGOR *alg);
X509_ALGOR *TS_MSG_IMPRINT_get_algo(TS_MSG_IMPRINT *a);

int TS_MSG_IMPRINT_set_msg(TS_MSG_IMPRINT *a, unsigned char *d, int len);
ASN1_OCTET_STRING *TS_MSG_IMPRINT_get_msg(TS_MSG_IMPRINT *a);

int TS_REQ_set_policy_id(TS_REQ *a, const ASN1_OBJECT *policy);
ASN1_OBJECT *TS_REQ_get_policy_id(TS_REQ *a);

int TS_REQ_set_nonce(TS_REQ *a, const ASN1_INTEGER *nonce);
const ASN1_INTEGER *TS_REQ_get_nonce(const TS_REQ *a);

int TS_REQ_set_cert_req(TS_REQ *a, int cert_req);
int TS_REQ_get_cert_req(const TS_REQ *a);

STACK_OF(X509_EXTENSION) *TS_REQ_get_exts(TS_REQ *a);
void TS_REQ_ext_free(TS_REQ *a);
int TS_REQ_get_ext_count(TS_REQ *a);
int TS_REQ_get_ext_by_NID(TS_REQ *a, int nid, int lastpos);
int TS_REQ_get_ext_by_OBJ(TS_REQ *a, const ASN1_OBJECT *obj, int lastpos);
int TS_REQ_get_ext_by_critical(TS_REQ *a, int crit, int lastpos);
X509_EXTENSION *TS_REQ_get_ext(TS_REQ *a, int loc);
X509_EXTENSION *TS_REQ_delete_ext(TS_REQ *a, int loc);
int TS_REQ_add_ext(TS_REQ *a, X509_EXTENSION *ex, int loc);
void *TS_REQ_get_ext_d2i(TS_REQ *a, int nid, int *crit, int *idx);

/* Function declarations for TS_REQ defined in ts/ts_req_print.c */

int TS_REQ_print_bio(BIO *bio, TS_REQ *a);

/* Function declarations for TS_RESP defined in ts/ts_resp_utils.c */

int TS_RESP_set_status_info(TS_RESP *a, TS_STATUS_INFO *info);
TS_STATUS_INFO *TS_RESP_get_status_info(TS_RESP *a);

/* Caller loses ownership of PKCS7 and TS_TST_INFO objects. */
void TS_RESP_set_tst_info(TS_RESP *a, PKCS7 *p7, TS_TST_INFO *tst_info);
PKCS7 *TS_RESP_get_token(TS_RESP *a);
TS_TST_INFO *TS_RESP_get_tst_info(TS_RESP *a);

int TS_TST_INFO_set_version(TS_TST_INFO *a, long version);
long TS_TST_INFO_get_version(const TS_TST_INFO *a);

int TS_TST_INFO_set_policy_id(TS_TST_INFO *a, ASN1_OBJECT *policy_id);
ASN1_OBJECT *TS_TST_INFO_get_policy_id(TS_TST_INFO *a);

int TS_TST_INFO_set_msg_imprint(TS_TST_INFO *a, TS_MSG_IMPRINT *msg_imprint);
TS_MSG_IMPRINT *TS_TST_INFO_get_msg_imprint(TS_TST_INFO *a);

int TS_TST_INFO_set_serial(TS_TST_INFO *a, const ASN1_INTEGER *serial);
const ASN1_INTEGER *TS_TST_INFO_get_serial(const TS_TST_INFO *a);

int TS_TST_INFO_set_time(TS_TST_INFO *a, const ASN1_GENERALIZEDTIME *gtime);
const ASN1_GENERALIZEDTIME *TS_TST_INFO_get_time(const TS_TST_INFO *a);

int TS_TST_INFO_set_accuracy(TS_TST_INFO *a, TS_ACCURACY *accuracy);
TS_ACCURACY *TS_TST_INFO_get_accuracy(TS_TST_INFO *a);

int TS_ACCURACY_set_seconds(TS_ACCURACY *a, const ASN1_INTEGER *seconds);
const ASN1_INTEGER *TS_ACCURACY_get_seconds(const TS_ACCURACY *a);

int TS_ACCURACY_set_millis(TS_ACCURACY *a, const ASN1_INTEGER *millis);
const ASN1_INTEGER *TS_ACCURACY_get_millis(const TS_ACCURACY *a);

int TS_ACCURACY_set_micros(TS_ACCURACY *a, const ASN1_INTEGER *micros);
const ASN1_INTEGER *TS_ACCURACY_get_micros(const TS_ACCURACY *a);

int TS_TST_INFO_set_ordering(TS_TST_INFO *a, int ordering);
int TS_TST_INFO_get_ordering(const TS_TST_INFO *a);

int TS_TST_INFO_set_nonce(TS_TST_INFO *a, const ASN1_INTEGER *nonce);
const ASN1_INTEGER *TS_TST_INFO_get_nonce(const TS_TST_INFO *a);

int TS_TST_INFO_set_tsa(TS_TST_INFO *a, GENERAL_NAME *tsa);
GENERAL_NAME *TS_TST_INFO_get_tsa(TS_TST_INFO *a);

STACK_OF(X509_EXTENSION) *TS_TST_INFO_get_exts(TS_TST_INFO *a);
void TS_TST_INFO_ext_free(TS_TST_INFO *a);
int TS_TST_INFO_get_ext_count(TS_TST_INFO *a);
int TS_TST_INFO_get_ext_by_NID(TS_TST_INFO *a, int nid, int lastpos);
int TS_TST_INFO_get_ext_by_OBJ(TS_TST_INFO *a, const ASN1_OBJECT *obj,
    int lastpos);
int TS_TST_INFO_get_ext_by_critical(TS_TST_INFO *a, int crit, int lastpos);
X509_EXTENSION *TS_TST_INFO_get_ext(TS_TST_INFO *a, int loc);
X509_EXTENSION *TS_TST_INFO_delete_ext(TS_TST_INFO *a, int loc);
int TS_TST_INFO_add_ext(TS_TST_INFO *a, X509_EXTENSION *ex, int loc);
void *TS_TST_INFO_get_ext_d2i(TS_TST_INFO *a, int nid, int *crit, int *idx);

/* Declarations related to response generation, defined in ts/ts_resp_sign.c. */

/* Optional flags for response generation. */

/* Don't include the TSA name in response. */
#define	TS_TSA_NAME		0x01

/* Set ordering to true in response. */
#define	TS_ORDERING		0x02

/*
 * Include the signer certificate and the other specified certificates in
 * the ESS signing certificate attribute beside the PKCS7 signed data.
 * Only the signer certificates is included by default.
 */
#define	TS_ESS_CERT_ID_CHAIN	0x04

/* Forward declaration. */
struct TS_resp_ctx;

/* This must return a unique number less than 160 bits long. */
typedef ASN1_INTEGER *(*TS_serial_cb)(struct TS_resp_ctx *, void *);

/* This must return the seconds and microseconds since Jan 1, 1970 in
   the sec and usec variables allocated by the caller.
   Return non-zero for success and zero for failure. */
typedef	int (*TS_time_cb)(struct TS_resp_ctx *, void *, time_t *sec, long *usec);

/* This must process the given extension.
 * It can modify the TS_TST_INFO object of the context.
 * Return values: !0 (processed), 0 (error, it must set the
 * status info/failure info of the response).
 */
typedef	int (*TS_extension_cb)(struct TS_resp_ctx *, X509_EXTENSION *, void *);

typedef struct TS_resp_ctx {
	X509		*signer_cert;
	EVP_PKEY	*signer_key;
	STACK_OF(X509)	*certs;	/* Certs to include in signed data. */
	STACK_OF(ASN1_OBJECT)	*policies;	/* Acceptable policies. */
	ASN1_OBJECT	*default_policy; /* It may appear in policies, too. */
	STACK_OF(EVP_MD)	*mds;	/* Acceptable message digests. */
	ASN1_INTEGER	*seconds;	/* accuracy, 0 means not specified. */
	ASN1_INTEGER	*millis;	/* accuracy, 0 means not specified. */
	ASN1_INTEGER	*micros;	/* accuracy, 0 means not specified. */
	unsigned	clock_precision_digits; /* fraction of seconds in
						   time stamp token. */
	unsigned	flags;		/* Optional info, see values above. */

	/* Callback functions. */
	TS_serial_cb serial_cb;
	void *serial_cb_data;	/* User data for serial_cb. */

	TS_time_cb time_cb;
	void *time_cb_data;	/* User data for time_cb. */

	TS_extension_cb extension_cb;
	void *extension_cb_data;	/* User data for extension_cb. */

	/* These members are used only while creating the response. */
	TS_REQ		*request;
	TS_RESP		*response;
	TS_TST_INFO	*tst_info;
} TS_RESP_CTX;

DECLARE_STACK_OF(EVP_MD)

/* Creates a response context that can be used for generating responses. */
TS_RESP_CTX *TS_RESP_CTX_new(void);
void TS_RESP_CTX_free(TS_RESP_CTX *ctx);

/* This parameter must be set. */
int TS_RESP_CTX_set_signer_cert(TS_RESP_CTX *ctx, X509 *signer);

/* This parameter must be set. */
int TS_RESP_CTX_set_signer_key(TS_RESP_CTX *ctx, EVP_PKEY *key);

/* This parameter must be set. */
int TS_RESP_CTX_set_def_policy(TS_RESP_CTX *ctx, const ASN1_OBJECT *def_policy);

/* No additional certs are included in the response by default. */
int TS_RESP_CTX_set_certs(TS_RESP_CTX *ctx, STACK_OF(X509) *certs);

/* Adds a new acceptable policy, only the default policy
   is accepted by default. */
int TS_RESP_CTX_add_policy(TS_RESP_CTX *ctx, const ASN1_OBJECT *policy);

/* Adds a new acceptable message digest. Note that no message digests
   are accepted by default. The md argument is shared with the caller. */
int TS_RESP_CTX_add_md(TS_RESP_CTX *ctx, const EVP_MD *md);

/* Accuracy is not included by default. */
int TS_RESP_CTX_set_accuracy(TS_RESP_CTX *ctx,
    int secs, int millis, int micros);

/* Clock precision digits, i.e. the number of decimal digits:
   '0' means sec, '3' msec, '6' usec, and so on. Default is 0. */
int TS_RESP_CTX_set_clock_precision_digits(TS_RESP_CTX *ctx,
    unsigned clock_precision_digits);
/* At most we accept usec precision. */
#define TS_MAX_CLOCK_PRECISION_DIGITS	6

/* No flags are set by default. */
void TS_RESP_CTX_add_flags(TS_RESP_CTX *ctx, int flags);

/* Default callback always returns a constant. */
void TS_RESP_CTX_set_serial_cb(TS_RESP_CTX *ctx, TS_serial_cb cb, void *data);

/* Default callback rejects all extensions. The extension callback is called
 * when the TS_TST_INFO object is already set up and not signed yet. */
/* FIXME: extension handling is not tested yet. */
void TS_RESP_CTX_set_extension_cb(TS_RESP_CTX *ctx,
    TS_extension_cb cb, void *data);

/* The following methods can be used in the callbacks. */
int TS_RESP_CTX_set_status_info(TS_RESP_CTX *ctx,
    int status, const char *text);

/* Sets the status info only if it is still TS_STATUS_GRANTED. */
int TS_RESP_CTX_set_status_info_cond(TS_RESP_CTX *ctx,
    int status, const char *text);

int TS_RESP_CTX_add_failure_info(TS_RESP_CTX *ctx, int failure);

/* The get methods below can be used in the extension callback. */
TS_REQ *TS_RESP_CTX_get_request(TS_RESP_CTX *ctx);

TS_TST_INFO *TS_RESP_CTX_get_tst_info(TS_RESP_CTX *ctx);

/*
 * Creates the signed TS_TST_INFO and puts it in TS_RESP.
 * In case of errors it sets the status info properly.
 * Returns NULL only in case of memory allocation/fatal error.
 */
TS_RESP *TS_RESP_create_response(TS_RESP_CTX *ctx, BIO *req_bio);

/*
 * Declarations related to response verification,
 * they are defined in ts/ts_resp_verify.c.
 */

int TS_RESP_verify_signature(PKCS7 *token, STACK_OF(X509) *certs,
    X509_STORE *store, X509 **signer_out);

/* Context structure for the generic verify method. */

/* Verify the signer's certificate and the signature of the response. */
#define	TS_VFY_SIGNATURE	(1u << 0)
/* Verify the version number of the response. */
#define	TS_VFY_VERSION		(1u << 1)
/* Verify if the policy supplied by the user matches the policy of the TSA. */
#define	TS_VFY_POLICY		(1u << 2)
/* Verify the message imprint provided by the user. This flag should not be
   specified with TS_VFY_DATA. */
#define	TS_VFY_IMPRINT		(1u << 3)
/* Verify the message imprint computed by the verify method from the user
   provided data and the MD algorithm of the response. This flag should not be
   specified with TS_VFY_IMPRINT. */
#define	TS_VFY_DATA		(1u << 4)
/* Verify the nonce value. */
#define	TS_VFY_NONCE		(1u << 5)
/* Verify if the TSA name field matches the signer certificate. */
#define	TS_VFY_SIGNER		(1u << 6)
/* Verify if the TSA name field equals to the user provided name. */
#define	TS_VFY_TSA_NAME		(1u << 7)

/* You can use the following convenience constants. */
#define	TS_VFY_ALL_IMPRINT	(TS_VFY_SIGNATURE	\
				 | TS_VFY_VERSION	\
				 | TS_VFY_POLICY	\
				 | TS_VFY_IMPRINT	\
				 | TS_VFY_NONCE		\
				 | TS_VFY_SIGNER	\
				 | TS_VFY_TSA_NAME)
#define	TS_VFY_ALL_DATA		(TS_VFY_SIGNATURE	\
				 | TS_VFY_VERSION	\
				 | TS_VFY_POLICY	\
				 | TS_VFY_DATA		\
				 | TS_VFY_NONCE		\
				 | TS_VFY_SIGNER	\
				 | TS_VFY_TSA_NAME)

typedef struct TS_verify_ctx {
	/* Set this to the union of TS_VFY_... flags you want to carry out. */
	unsigned	flags;

	/* Must be set only with TS_VFY_SIGNATURE. certs is optional. */
	X509_STORE	*store;
	STACK_OF(X509)	*certs;

	/* Must be set only with TS_VFY_POLICY. */
	ASN1_OBJECT	*policy;

	/* Must be set only with TS_VFY_IMPRINT. If md_alg is NULL,
	   the algorithm from the response is used. */
	X509_ALGOR	*md_alg;
	unsigned char	*imprint;
	unsigned	imprint_len;

	/* Must be set only with TS_VFY_DATA. */
	BIO		*data;

	/* Must be set only with TS_VFY_TSA_NAME. */
	ASN1_INTEGER	*nonce;

	/* Must be set only with TS_VFY_TSA_NAME. */
	GENERAL_NAME	*tsa_name;
} TS_VERIFY_CTX;

int TS_RESP_verify_response(TS_VERIFY_CTX *ctx, TS_RESP *response);
int TS_RESP_verify_token(TS_VERIFY_CTX *ctx, PKCS7 *token);

/*
 * Declarations related to response verification context,
 * they are defined in ts/ts_verify_ctx.c.
 */

/* Set all fields to zero. */
TS_VERIFY_CTX *TS_VERIFY_CTX_new(void);
void TS_VERIFY_CTX_init(TS_VERIFY_CTX *ctx);
void TS_VERIFY_CTX_free(TS_VERIFY_CTX *ctx);
void TS_VERIFY_CTX_cleanup(TS_VERIFY_CTX *ctx);

/*
 * If ctx is NULL, it allocates and returns a new object, otherwise
 * it returns ctx. It initialises all the members as follows:
 * flags = TS_VFY_ALL_IMPRINT & ~(TS_VFY_TSA_NAME | TS_VFY_SIGNATURE)
 * certs = NULL
 * store = NULL
 * policy = policy from the request or NULL if absent (in this case
 *	TS_VFY_POLICY is cleared from flags as well)
 * md_alg = MD algorithm from request
 * imprint, imprint_len = imprint from request
 * data = NULL
 * nonce, nonce_len = nonce from the request or NULL if absent (in this case
 * 	TS_VFY_NONCE is cleared from flags as well)
 * tsa_name = NULL
 * Important: after calling this method TS_VFY_SIGNATURE should be added!
 */
TS_VERIFY_CTX *TS_REQ_to_TS_VERIFY_CTX(TS_REQ *req, TS_VERIFY_CTX *ctx);

/* Function declarations for TS_RESP defined in ts/ts_resp_print.c */

int TS_RESP_print_bio(BIO *bio, TS_RESP *a);
int TS_STATUS_INFO_print_bio(BIO *bio, TS_STATUS_INFO *a);
int TS_TST_INFO_print_bio(BIO *bio, TS_TST_INFO *a);

/* Common utility functions defined in ts/ts_lib.c */

int TS_ASN1_INTEGER_print_bio(BIO *bio, const ASN1_INTEGER *num);
int TS_OBJ_print_bio(BIO *bio, const ASN1_OBJECT *obj);
int TS_ext_print_bio(BIO *bio, const STACK_OF(X509_EXTENSION) *extensions);
int TS_X509_ALGOR_print_bio(BIO *bio, const X509_ALGOR *alg);
int TS_MSG_IMPRINT_print_bio(BIO *bio, TS_MSG_IMPRINT *msg);

/* Function declarations for handling configuration options,
   defined in ts/ts_conf.c */

X509 *TS_CONF_load_cert(const char *file);
STACK_OF(X509) *TS_CONF_load_certs(const char *file);
EVP_PKEY *TS_CONF_load_key(const char *file, const char *pass);
const char *TS_CONF_get_tsa_section(CONF *conf, const char *section);
int TS_CONF_set_serial(CONF *conf, const char *section, TS_serial_cb cb,
    TS_RESP_CTX *ctx);
int TS_CONF_set_crypto_device(CONF *conf, const char *section,
    const char *device);
int TS_CONF_set_default_engine(const char *name);
int TS_CONF_set_signer_cert(CONF *conf, const char *section,
    const char *cert, TS_RESP_CTX *ctx);
int TS_CONF_set_certs(CONF *conf, const char *section, const char *certs,
    TS_RESP_CTX *ctx);
int TS_CONF_set_signer_key(CONF *conf, const char *section,
    const char *key, const char *pass, TS_RESP_CTX *ctx);
int TS_CONF_set_def_policy(CONF *conf, const char *section,
    const char *policy, TS_RESP_CTX *ctx);
int TS_CONF_set_policies(CONF *conf, const char *section, TS_RESP_CTX *ctx);
int TS_CONF_set_digests(CONF *conf, const char *section, TS_RESP_CTX *ctx);
int TS_CONF_set_accuracy(CONF *conf, const char *section, TS_RESP_CTX *ctx);
int TS_CONF_set_clock_precision_digits(CONF *conf, const char *section,
    TS_RESP_CTX *ctx);
int TS_CONF_set_ordering(CONF *conf, const char *section, TS_RESP_CTX *ctx);
int TS_CONF_set_tsa_name(CONF *conf, const char *section, TS_RESP_CTX *ctx);
int TS_CONF_set_ess_cert_id_chain(CONF *conf, const char *section,
    TS_RESP_CTX *ctx);

/* -------------------------------------------------- */
/* BEGIN ERROR CODES */
/* The following lines are auto generated by the script mkerr.pl. Any changes
 * made after this point may be overwritten when the script is next run.
 */
void ERR_load_TS_strings(void);

/* Error codes for the TS functions. */

/* Function codes. */
#define TS_F_D2I_TS_RESP				 147
#define TS_F_DEF_SERIAL_CB				 110
#define TS_F_DEF_TIME_CB				 111
#define TS_F_ESS_ADD_SIGNING_CERT			 112
#define TS_F_ESS_CERT_ID_NEW_INIT			 113
#define TS_F_ESS_SIGNING_CERT_NEW_INIT			 114
#define TS_F_INT_TS_RESP_VERIFY_TOKEN			 149
#define TS_F_PKCS7_TO_TS_TST_INFO			 148
#define TS_F_TS_ACCURACY_SET_MICROS			 115
#define TS_F_TS_ACCURACY_SET_MILLIS			 116
#define TS_F_TS_ACCURACY_SET_SECONDS			 117
#define TS_F_TS_CHECK_IMPRINTS				 100
#define TS_F_TS_CHECK_NONCES				 101
#define TS_F_TS_CHECK_POLICY				 102
#define TS_F_TS_CHECK_SIGNING_CERTS			 103
#define TS_F_TS_CHECK_STATUS_INFO			 104
#define TS_F_TS_COMPUTE_IMPRINT				 145
#define TS_F_TS_CONF_SET_DEFAULT_ENGINE			 146
#define TS_F_TS_GET_STATUS_TEXT				 105
#define TS_F_TS_MSG_IMPRINT_SET_ALGO			 118
#define TS_F_TS_REQ_SET_MSG_IMPRINT			 119
#define TS_F_TS_REQ_SET_NONCE				 120
#define TS_F_TS_REQ_SET_POLICY_ID			 121
#define TS_F_TS_RESP_CREATE_RESPONSE			 122
#define TS_F_TS_RESP_CREATE_TST_INFO			 123
#define TS_F_TS_RESP_CTX_ADD_FAILURE_INFO		 124
#define TS_F_TS_RESP_CTX_ADD_MD				 125
#define TS_F_TS_RESP_CTX_ADD_POLICY			 126
#define TS_F_TS_RESP_CTX_NEW				 127
#define TS_F_TS_RESP_CTX_SET_ACCURACY			 128
#define TS_F_TS_RESP_CTX_SET_CERTS			 129
#define TS_F_TS_RESP_CTX_SET_DEF_POLICY			 130
#define TS_F_TS_RESP_CTX_SET_SIGNER_CERT		 131
#define TS_F_TS_RESP_CTX_SET_STATUS_INFO		 132
#define TS_F_TS_RESP_GET_POLICY				 133
#define TS_F_TS_RESP_SET_GENTIME_WITH_PRECISION		 134
#define TS_F_TS_RESP_SET_STATUS_INFO			 135
#define TS_F_TS_RESP_SET_TST_INFO			 150
#define TS_F_TS_RESP_SIGN				 136
#define TS_F_TS_RESP_VERIFY_SIGNATURE			 106
#define TS_F_TS_RESP_VERIFY_TOKEN			 107
#define TS_F_TS_TST_INFO_SET_ACCURACY			 137
#define TS_F_TS_TST_INFO_SET_MSG_IMPRINT		 138
#define TS_F_TS_TST_INFO_SET_NONCE			 139
#define TS_F_TS_TST_INFO_SET_POLICY_ID			 140
#define TS_F_TS_TST_INFO_SET_SERIAL			 141
#define TS_F_TS_TST_INFO_SET_TIME			 142
#define TS_F_TS_TST_INFO_SET_TSA			 143
#define TS_F_TS_VERIFY					 108
#define TS_F_TS_VERIFY_CERT				 109
#define TS_F_TS_VERIFY_CTX_NEW				 144

/* Reason codes. */
#define TS_R_BAD_PKCS7_TYPE				 132
#define TS_R_BAD_TYPE					 133
#define TS_R_CERTIFICATE_VERIFY_ERROR			 100
#define TS_R_COULD_NOT_SET_ENGINE			 127
#define TS_R_COULD_NOT_SET_TIME				 115
#define TS_R_D2I_TS_RESP_INT_FAILED			 128
#define TS_R_DETACHED_CONTENT				 134
#define TS_R_ESS_ADD_SIGNING_CERT_ERROR			 116
#define TS_R_ESS_SIGNING_CERTIFICATE_ERROR		 101
#define TS_R_INVALID_NULL_POINTER			 102
#define TS_R_INVALID_SIGNER_CERTIFICATE_PURPOSE		 117
#define TS_R_MESSAGE_IMPRINT_MISMATCH			 103
#define TS_R_NONCE_MISMATCH				 104
#define TS_R_NONCE_NOT_RETURNED				 105
#define TS_R_NO_CONTENT					 106
#define TS_R_NO_TIME_STAMP_TOKEN			 107
#define TS_R_PKCS7_ADD_SIGNATURE_ERROR			 118
#define TS_R_PKCS7_ADD_SIGNED_ATTR_ERROR		 119
#define TS_R_PKCS7_TO_TS_TST_INFO_FAILED		 129
#define TS_R_POLICY_MISMATCH				 108
#define TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE	 120
#define TS_R_RESPONSE_SETUP_ERROR			 121
#define TS_R_SIGNATURE_FAILURE				 109
#define TS_R_THERE_MUST_BE_ONE_SIGNER			 110
#define TS_R_TIME_SYSCALL_ERROR				 122
#define TS_R_TOKEN_NOT_PRESENT				 130
#define TS_R_TOKEN_PRESENT				 131
#define TS_R_TSA_NAME_MISMATCH				 111
#define TS_R_TSA_UNTRUSTED				 112
#define TS_R_TST_INFO_SETUP_ERROR			 123
#define TS_R_TS_DATASIGN				 124
#define TS_R_UNACCEPTABLE_POLICY			 125
#define TS_R_UNSUPPORTED_MD_ALGORITHM			 126
#define TS_R_UNSUPPORTED_VERSION			 113
#define TS_R_WRONG_CONTENT_TYPE				 114

#ifdef  __cplusplus
}
#endif
#endif