]>
Commit | Line | Data |
---|---|---|
0f113f3e | 1 | /* |
4f22f405 | 2 | * Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved. |
c7235be6 | 3 | * |
4f22f405 RS |
4 | * Licensed under the OpenSSL license (the "License"). You may not use |
5 | * this file except in compliance with the License. You can obtain a copy | |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
c7235be6 UM |
8 | */ |
9 | ||
10 | #include <string.h> | |
11 | ||
1e26a8ba | 12 | #include <openssl/crypto.h> |
b39fc560 | 13 | #include "internal/cryptlib.h" |
c7235be6 | 14 | #include <openssl/pem.h> |
3c27208f | 15 | #include <openssl/engine.h> |
c7235be6 UM |
16 | #include <openssl/ts.h> |
17 | ||
18 | /* Macro definitions for the configuration file. */ | |
0f113f3e MC |
19 | #define BASE_SECTION "tsa" |
20 | #define ENV_DEFAULT_TSA "default_tsa" | |
21 | #define ENV_SERIAL "serial" | |
22 | #define ENV_CRYPTO_DEVICE "crypto_device" | |
23 | #define ENV_SIGNER_CERT "signer_cert" | |
24 | #define ENV_CERTS "certs" | |
25 | #define ENV_SIGNER_KEY "signer_key" | |
e20b4727 | 26 | #define ENV_SIGNER_DIGEST "signer_digest" |
0f113f3e MC |
27 | #define ENV_DEFAULT_POLICY "default_policy" |
28 | #define ENV_OTHER_POLICIES "other_policies" | |
29 | #define ENV_DIGESTS "digests" | |
30 | #define ENV_ACCURACY "accuracy" | |
31 | #define ENV_ORDERING "ordering" | |
32 | #define ENV_TSA_NAME "tsa_name" | |
33 | #define ENV_ESS_CERT_ID_CHAIN "ess_cert_id_chain" | |
34 | #define ENV_VALUE_SECS "secs" | |
35 | #define ENV_VALUE_MILLISECS "millisecs" | |
36 | #define ENV_VALUE_MICROSECS "microsecs" | |
37 | #define ENV_CLOCK_PRECISION_DIGITS "clock_precision_digits" | |
38 | #define ENV_VALUE_YES "yes" | |
39 | #define ENV_VALUE_NO "no" | |
c7235be6 UM |
40 | |
41 | /* Function definitions for certificate and key loading. */ | |
42 | ||
43 | X509 *TS_CONF_load_cert(const char *file) | |
0f113f3e MC |
44 | { |
45 | BIO *cert = NULL; | |
46 | X509 *x = NULL; | |
47 | ||
48 | if ((cert = BIO_new_file(file, "r")) == NULL) | |
49 | goto end; | |
50 | x = PEM_read_bio_X509_AUX(cert, NULL, NULL, NULL); | |
51 | end: | |
52 | if (x == NULL) | |
c0cf5b84 | 53 | TSerr(TS_F_TS_CONF_LOAD_CERT, TS_R_CANNOT_LOAD_CERT); |
0f113f3e MC |
54 | BIO_free(cert); |
55 | return x; | |
56 | } | |
c7235be6 UM |
57 | |
58 | STACK_OF(X509) *TS_CONF_load_certs(const char *file) | |
0f113f3e MC |
59 | { |
60 | BIO *certs = NULL; | |
61 | STACK_OF(X509) *othercerts = NULL; | |
62 | STACK_OF(X509_INFO) *allcerts = NULL; | |
63 | int i; | |
64 | ||
75ebbd9a | 65 | if ((certs = BIO_new_file(file, "r")) == NULL) |
0f113f3e | 66 | goto end; |
75ebbd9a | 67 | if ((othercerts = sk_X509_new_null()) == NULL) |
0f113f3e | 68 | goto end; |
75ebbd9a | 69 | |
0f113f3e MC |
70 | allcerts = PEM_X509_INFO_read_bio(certs, NULL, NULL, NULL); |
71 | for (i = 0; i < sk_X509_INFO_num(allcerts); i++) { | |
72 | X509_INFO *xi = sk_X509_INFO_value(allcerts, i); | |
73 | if (xi->x509) { | |
74 | sk_X509_push(othercerts, xi->x509); | |
75 | xi->x509 = NULL; | |
76 | } | |
77 | } | |
78 | end: | |
79 | if (othercerts == NULL) | |
c0cf5b84 | 80 | TSerr(TS_F_TS_CONF_LOAD_CERTS, TS_R_CANNOT_LOAD_CERT); |
0f113f3e MC |
81 | sk_X509_INFO_pop_free(allcerts, X509_INFO_free); |
82 | BIO_free(certs); | |
83 | return othercerts; | |
84 | } | |
c7235be6 UM |
85 | |
86 | EVP_PKEY *TS_CONF_load_key(const char *file, const char *pass) | |
0f113f3e MC |
87 | { |
88 | BIO *key = NULL; | |
89 | EVP_PKEY *pkey = NULL; | |
c7235be6 | 90 | |
75ebbd9a | 91 | if ((key = BIO_new_file(file, "r")) == NULL) |
0f113f3e MC |
92 | goto end; |
93 | pkey = PEM_read_bio_PrivateKey(key, NULL, NULL, (char *)pass); | |
c7235be6 | 94 | end: |
0f113f3e | 95 | if (pkey == NULL) |
c0cf5b84 | 96 | TSerr(TS_F_TS_CONF_LOAD_KEY, TS_R_CANNOT_LOAD_KEY); |
0f113f3e MC |
97 | BIO_free(key); |
98 | return pkey; | |
99 | } | |
c7235be6 UM |
100 | |
101 | /* Function definitions for handling configuration options. */ | |
102 | ||
9c422b5b | 103 | static void ts_CONF_lookup_fail(const char *name, const char *tag) |
0f113f3e | 104 | { |
c0cf5b84 RS |
105 | TSerr(TS_F_TS_CONF_LOOKUP_FAIL, TS_R_VAR_LOOKUP_FAILURE); |
106 | ERR_add_error_data(3, name, "::", tag); | |
0f113f3e | 107 | } |
c7235be6 | 108 | |
9c422b5b | 109 | static void ts_CONF_invalid(const char *name, const char *tag) |
0f113f3e | 110 | { |
c0cf5b84 RS |
111 | TSerr(TS_F_TS_CONF_INVALID, TS_R_VAR_BAD_VALUE); |
112 | ERR_add_error_data(3, name, "::", tag); | |
0f113f3e | 113 | } |
c7235be6 UM |
114 | |
115 | const char *TS_CONF_get_tsa_section(CONF *conf, const char *section) | |
0f113f3e MC |
116 | { |
117 | if (!section) { | |
118 | section = NCONF_get_string(conf, BASE_SECTION, ENV_DEFAULT_TSA); | |
119 | if (!section) | |
9c422b5b | 120 | ts_CONF_lookup_fail(BASE_SECTION, ENV_DEFAULT_TSA); |
0f113f3e MC |
121 | } |
122 | return section; | |
123 | } | |
c7235be6 UM |
124 | |
125 | int TS_CONF_set_serial(CONF *conf, const char *section, TS_serial_cb cb, | |
0f113f3e MC |
126 | TS_RESP_CTX *ctx) |
127 | { | |
128 | int ret = 0; | |
129 | char *serial = NCONF_get_string(conf, section, ENV_SERIAL); | |
130 | if (!serial) { | |
9c422b5b | 131 | ts_CONF_lookup_fail(section, ENV_SERIAL); |
0f113f3e MC |
132 | goto err; |
133 | } | |
134 | TS_RESP_CTX_set_serial_cb(ctx, cb, serial); | |
135 | ||
136 | ret = 1; | |
c7235be6 | 137 | err: |
0f113f3e MC |
138 | return ret; |
139 | } | |
c7235be6 | 140 | |
70531c14 DSH |
141 | #ifndef OPENSSL_NO_ENGINE |
142 | ||
c7235be6 | 143 | int TS_CONF_set_crypto_device(CONF *conf, const char *section, |
0f113f3e MC |
144 | const char *device) |
145 | { | |
146 | int ret = 0; | |
147 | ||
75ebbd9a | 148 | if (device == NULL) |
0f113f3e MC |
149 | device = NCONF_get_string(conf, section, ENV_CRYPTO_DEVICE); |
150 | ||
151 | if (device && !TS_CONF_set_default_engine(device)) { | |
9c422b5b | 152 | ts_CONF_invalid(section, ENV_CRYPTO_DEVICE); |
0f113f3e MC |
153 | goto err; |
154 | } | |
155 | ret = 1; | |
c7235be6 | 156 | err: |
0f113f3e MC |
157 | return ret; |
158 | } | |
c7235be6 UM |
159 | |
160 | int TS_CONF_set_default_engine(const char *name) | |
0f113f3e MC |
161 | { |
162 | ENGINE *e = NULL; | |
163 | int ret = 0; | |
164 | ||
0f113f3e MC |
165 | if (strcmp(name, "builtin") == 0) |
166 | return 1; | |
167 | ||
75ebbd9a | 168 | if ((e = ENGINE_by_id(name)) == NULL) |
0f113f3e | 169 | goto err; |
0f113f3e MC |
170 | if (strcmp(name, "chil") == 0) |
171 | ENGINE_ctrl(e, ENGINE_CTRL_CHIL_SET_FORKCHECK, 1, 0, 0); | |
0f113f3e MC |
172 | if (!ENGINE_set_default(e, ENGINE_METHOD_ALL)) |
173 | goto err; | |
174 | ret = 1; | |
18cd23df | 175 | |
c7235be6 | 176 | err: |
0f113f3e MC |
177 | if (!ret) { |
178 | TSerr(TS_F_TS_CONF_SET_DEFAULT_ENGINE, TS_R_COULD_NOT_SET_ENGINE); | |
179 | ERR_add_error_data(2, "engine:", name); | |
180 | } | |
efa7dd64 | 181 | ENGINE_free(e); |
0f113f3e MC |
182 | return ret; |
183 | } | |
c7235be6 | 184 | |
70531c14 DSH |
185 | #endif |
186 | ||
c7235be6 | 187 | int TS_CONF_set_signer_cert(CONF *conf, const char *section, |
0f113f3e MC |
188 | const char *cert, TS_RESP_CTX *ctx) |
189 | { | |
190 | int ret = 0; | |
191 | X509 *cert_obj = NULL; | |
75ebbd9a RS |
192 | |
193 | if (cert == NULL) { | |
0f113f3e | 194 | cert = NCONF_get_string(conf, section, ENV_SIGNER_CERT); |
75ebbd9a | 195 | if (cert == NULL) { |
9c422b5b | 196 | ts_CONF_lookup_fail(section, ENV_SIGNER_CERT); |
75ebbd9a RS |
197 | goto err; |
198 | } | |
0f113f3e | 199 | } |
75ebbd9a | 200 | if ((cert_obj = TS_CONF_load_cert(cert)) == NULL) |
0f113f3e MC |
201 | goto err; |
202 | if (!TS_RESP_CTX_set_signer_cert(ctx, cert_obj)) | |
203 | goto err; | |
204 | ||
205 | ret = 1; | |
c7235be6 | 206 | err: |
0f113f3e MC |
207 | X509_free(cert_obj); |
208 | return ret; | |
209 | } | |
c7235be6 UM |
210 | |
211 | int TS_CONF_set_certs(CONF *conf, const char *section, const char *certs, | |
0f113f3e MC |
212 | TS_RESP_CTX *ctx) |
213 | { | |
214 | int ret = 0; | |
215 | STACK_OF(X509) *certs_obj = NULL; | |
75ebbd9a RS |
216 | |
217 | if (certs == NULL) { | |
218 | /* Certificate chain is optional. */ | |
219 | if ((certs = NCONF_get_string(conf, section, ENV_CERTS)) == NULL) | |
220 | goto end; | |
221 | } | |
222 | if ((certs_obj = TS_CONF_load_certs(certs)) == NULL) | |
0f113f3e MC |
223 | goto err; |
224 | if (!TS_RESP_CTX_set_certs(ctx, certs_obj)) | |
225 | goto err; | |
c7235be6 | 226 | end: |
0f113f3e | 227 | ret = 1; |
c7235be6 | 228 | err: |
0f113f3e MC |
229 | sk_X509_pop_free(certs_obj, X509_free); |
230 | return ret; | |
231 | } | |
c7235be6 UM |
232 | |
233 | int TS_CONF_set_signer_key(CONF *conf, const char *section, | |
0f113f3e MC |
234 | const char *key, const char *pass, |
235 | TS_RESP_CTX *ctx) | |
236 | { | |
237 | int ret = 0; | |
238 | EVP_PKEY *key_obj = NULL; | |
239 | if (!key) | |
240 | key = NCONF_get_string(conf, section, ENV_SIGNER_KEY); | |
241 | if (!key) { | |
9c422b5b | 242 | ts_CONF_lookup_fail(section, ENV_SIGNER_KEY); |
0f113f3e MC |
243 | goto err; |
244 | } | |
75ebbd9a | 245 | if ((key_obj = TS_CONF_load_key(key, pass)) == NULL) |
0f113f3e MC |
246 | goto err; |
247 | if (!TS_RESP_CTX_set_signer_key(ctx, key_obj)) | |
248 | goto err; | |
249 | ||
250 | ret = 1; | |
c7235be6 | 251 | err: |
0f113f3e MC |
252 | EVP_PKEY_free(key_obj); |
253 | return ret; | |
254 | } | |
c7235be6 | 255 | |
e20b4727 DSH |
256 | int TS_CONF_set_signer_digest(CONF *conf, const char *section, |
257 | const char *md, TS_RESP_CTX *ctx) | |
258 | { | |
259 | int ret = 0; | |
260 | const EVP_MD *sign_md = NULL; | |
261 | if (md == NULL) | |
262 | md = NCONF_get_string(conf, section, ENV_SIGNER_DIGEST); | |
263 | if (md == NULL) { | |
264 | ts_CONF_lookup_fail(section, ENV_SIGNER_DIGEST); | |
265 | goto err; | |
266 | } | |
267 | sign_md = EVP_get_digestbyname(md); | |
268 | if (sign_md == NULL) { | |
269 | ts_CONF_invalid(section, ENV_SIGNER_DIGEST); | |
270 | goto err; | |
271 | } | |
272 | if (!TS_RESP_CTX_set_signer_digest(ctx, sign_md)) | |
273 | goto err; | |
274 | ||
275 | ret = 1; | |
276 | err: | |
277 | return ret; | |
278 | } | |
279 | ||
c7235be6 | 280 | int TS_CONF_set_def_policy(CONF *conf, const char *section, |
0f113f3e MC |
281 | const char *policy, TS_RESP_CTX *ctx) |
282 | { | |
283 | int ret = 0; | |
284 | ASN1_OBJECT *policy_obj = NULL; | |
285 | if (!policy) | |
286 | policy = NCONF_get_string(conf, section, ENV_DEFAULT_POLICY); | |
287 | if (!policy) { | |
9c422b5b | 288 | ts_CONF_lookup_fail(section, ENV_DEFAULT_POLICY); |
0f113f3e MC |
289 | goto err; |
290 | } | |
75ebbd9a | 291 | if ((policy_obj = OBJ_txt2obj(policy, 0)) == NULL) { |
9c422b5b | 292 | ts_CONF_invalid(section, ENV_DEFAULT_POLICY); |
0f113f3e MC |
293 | goto err; |
294 | } | |
295 | if (!TS_RESP_CTX_set_def_policy(ctx, policy_obj)) | |
296 | goto err; | |
297 | ||
298 | ret = 1; | |
c7235be6 | 299 | err: |
0f113f3e MC |
300 | ASN1_OBJECT_free(policy_obj); |
301 | return ret; | |
302 | } | |
303 | ||
304 | int TS_CONF_set_policies(CONF *conf, const char *section, TS_RESP_CTX *ctx) | |
305 | { | |
306 | int ret = 0; | |
307 | int i; | |
308 | STACK_OF(CONF_VALUE) *list = NULL; | |
75ebbd9a RS |
309 | char *policies = NCONF_get_string(conf, section, ENV_OTHER_POLICIES); |
310 | ||
0f113f3e | 311 | /* If no other policy is specified, that's fine. */ |
75ebbd9a | 312 | if (policies && (list = X509V3_parse_list(policies)) == NULL) { |
9c422b5b | 313 | ts_CONF_invalid(section, ENV_OTHER_POLICIES); |
0f113f3e MC |
314 | goto err; |
315 | } | |
316 | for (i = 0; i < sk_CONF_VALUE_num(list); ++i) { | |
317 | CONF_VALUE *val = sk_CONF_VALUE_value(list, i); | |
318 | const char *extval = val->value ? val->value : val->name; | |
319 | ASN1_OBJECT *objtmp; | |
75ebbd9a RS |
320 | |
321 | if ((objtmp = OBJ_txt2obj(extval, 0)) == NULL) { | |
9c422b5b | 322 | ts_CONF_invalid(section, ENV_OTHER_POLICIES); |
0f113f3e MC |
323 | goto err; |
324 | } | |
325 | if (!TS_RESP_CTX_add_policy(ctx, objtmp)) | |
326 | goto err; | |
327 | ASN1_OBJECT_free(objtmp); | |
328 | } | |
329 | ||
330 | ret = 1; | |
c7235be6 | 331 | err: |
0f113f3e MC |
332 | sk_CONF_VALUE_pop_free(list, X509V3_conf_free); |
333 | return ret; | |
334 | } | |
335 | ||
336 | int TS_CONF_set_digests(CONF *conf, const char *section, TS_RESP_CTX *ctx) | |
337 | { | |
338 | int ret = 0; | |
339 | int i; | |
340 | STACK_OF(CONF_VALUE) *list = NULL; | |
341 | char *digests = NCONF_get_string(conf, section, ENV_DIGESTS); | |
75ebbd9a RS |
342 | |
343 | if (digests == NULL) { | |
9c422b5b | 344 | ts_CONF_lookup_fail(section, ENV_DIGESTS); |
0f113f3e MC |
345 | goto err; |
346 | } | |
75ebbd9a | 347 | if ((list = X509V3_parse_list(digests)) == NULL) { |
9c422b5b | 348 | ts_CONF_invalid(section, ENV_DIGESTS); |
0f113f3e MC |
349 | goto err; |
350 | } | |
351 | if (sk_CONF_VALUE_num(list) == 0) { | |
9c422b5b | 352 | ts_CONF_invalid(section, ENV_DIGESTS); |
0f113f3e MC |
353 | goto err; |
354 | } | |
355 | for (i = 0; i < sk_CONF_VALUE_num(list); ++i) { | |
356 | CONF_VALUE *val = sk_CONF_VALUE_value(list, i); | |
357 | const char *extval = val->value ? val->value : val->name; | |
358 | const EVP_MD *md; | |
75ebbd9a RS |
359 | |
360 | if ((md = EVP_get_digestbyname(extval)) == NULL) { | |
9c422b5b | 361 | ts_CONF_invalid(section, ENV_DIGESTS); |
0f113f3e MC |
362 | goto err; |
363 | } | |
364 | if (!TS_RESP_CTX_add_md(ctx, md)) | |
365 | goto err; | |
366 | } | |
367 | ||
368 | ret = 1; | |
c7235be6 | 369 | err: |
0f113f3e MC |
370 | sk_CONF_VALUE_pop_free(list, X509V3_conf_free); |
371 | return ret; | |
372 | } | |
c7235be6 UM |
373 | |
374 | int TS_CONF_set_accuracy(CONF *conf, const char *section, TS_RESP_CTX *ctx) | |
0f113f3e MC |
375 | { |
376 | int ret = 0; | |
377 | int i; | |
378 | int secs = 0, millis = 0, micros = 0; | |
379 | STACK_OF(CONF_VALUE) *list = NULL; | |
380 | char *accuracy = NCONF_get_string(conf, section, ENV_ACCURACY); | |
381 | ||
75ebbd9a | 382 | if (accuracy && (list = X509V3_parse_list(accuracy)) == NULL) { |
9c422b5b | 383 | ts_CONF_invalid(section, ENV_ACCURACY); |
0f113f3e MC |
384 | goto err; |
385 | } | |
386 | for (i = 0; i < sk_CONF_VALUE_num(list); ++i) { | |
387 | CONF_VALUE *val = sk_CONF_VALUE_value(list, i); | |
388 | if (strcmp(val->name, ENV_VALUE_SECS) == 0) { | |
389 | if (val->value) | |
390 | secs = atoi(val->value); | |
391 | } else if (strcmp(val->name, ENV_VALUE_MILLISECS) == 0) { | |
392 | if (val->value) | |
393 | millis = atoi(val->value); | |
394 | } else if (strcmp(val->name, ENV_VALUE_MICROSECS) == 0) { | |
395 | if (val->value) | |
396 | micros = atoi(val->value); | |
397 | } else { | |
9c422b5b | 398 | ts_CONF_invalid(section, ENV_ACCURACY); |
0f113f3e MC |
399 | goto err; |
400 | } | |
401 | } | |
402 | if (!TS_RESP_CTX_set_accuracy(ctx, secs, millis, micros)) | |
403 | goto err; | |
404 | ||
405 | ret = 1; | |
c7235be6 | 406 | err: |
0f113f3e MC |
407 | sk_CONF_VALUE_pop_free(list, X509V3_conf_free); |
408 | return ret; | |
409 | } | |
c7235be6 UM |
410 | |
411 | int TS_CONF_set_clock_precision_digits(CONF *conf, const char *section, | |
0f113f3e MC |
412 | TS_RESP_CTX *ctx) |
413 | { | |
414 | int ret = 0; | |
415 | long digits = 0; | |
416 | ||
417 | /* | |
418 | * If not specified, set the default value to 0, i.e. sec precision | |
419 | */ | |
420 | if (!NCONF_get_number_e(conf, section, ENV_CLOCK_PRECISION_DIGITS, | |
421 | &digits)) | |
422 | digits = 0; | |
423 | if (digits < 0 || digits > TS_MAX_CLOCK_PRECISION_DIGITS) { | |
9c422b5b | 424 | ts_CONF_invalid(section, ENV_CLOCK_PRECISION_DIGITS); |
0f113f3e MC |
425 | goto err; |
426 | } | |
427 | ||
428 | if (!TS_RESP_CTX_set_clock_precision_digits(ctx, digits)) | |
429 | goto err; | |
430 | ||
431 | return 1; | |
c7235be6 | 432 | err: |
0f113f3e MC |
433 | return ret; |
434 | } | |
435 | ||
9c422b5b | 436 | static int ts_CONF_add_flag(CONF *conf, const char *section, |
0f113f3e MC |
437 | const char *field, int flag, TS_RESP_CTX *ctx) |
438 | { | |
0f113f3e | 439 | const char *value = NCONF_get_string(conf, section, field); |
18cd23df | 440 | |
0f113f3e MC |
441 | if (value) { |
442 | if (strcmp(value, ENV_VALUE_YES) == 0) | |
443 | TS_RESP_CTX_add_flags(ctx, flag); | |
444 | else if (strcmp(value, ENV_VALUE_NO) != 0) { | |
9c422b5b | 445 | ts_CONF_invalid(section, field); |
0f113f3e MC |
446 | return 0; |
447 | } | |
448 | } | |
449 | ||
450 | return 1; | |
451 | } | |
c7235be6 UM |
452 | |
453 | int TS_CONF_set_ordering(CONF *conf, const char *section, TS_RESP_CTX *ctx) | |
0f113f3e | 454 | { |
9c422b5b | 455 | return ts_CONF_add_flag(conf, section, ENV_ORDERING, TS_ORDERING, ctx); |
0f113f3e | 456 | } |
c7235be6 UM |
457 | |
458 | int TS_CONF_set_tsa_name(CONF *conf, const char *section, TS_RESP_CTX *ctx) | |
0f113f3e | 459 | { |
9c422b5b | 460 | return ts_CONF_add_flag(conf, section, ENV_TSA_NAME, TS_TSA_NAME, ctx); |
0f113f3e | 461 | } |
c7235be6 UM |
462 | |
463 | int TS_CONF_set_ess_cert_id_chain(CONF *conf, const char *section, | |
0f113f3e MC |
464 | TS_RESP_CTX *ctx) |
465 | { | |
9c422b5b | 466 | return ts_CONF_add_flag(conf, section, ENV_ESS_CERT_ID_CHAIN, |
0f113f3e MC |
467 | TS_ESS_CERT_ID_CHAIN, ctx); |
468 | } |