2 /* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL
5 /* ====================================================================
6 * Copyright (c) 2001 The OpenSSL Project. All rights reserved.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
34 * 6. Redistributions of any form whatsoever must retain the following
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
63 #include <openssl/bio.h>
64 #include <openssl/err.h>
65 #include <openssl/pem.h>
66 #include <openssl/rand.h>
67 #include <openssl/ts.h>
68 #include <openssl/bn.h>
73 /* Length of the nonce of the request in bits (must be a multiple of 8). */
74 #define NONCE_LENGTH 64
76 /* Macro definitions for the configuration file. */
77 #define ENV_OID_FILE "oid_file"
79 /* Local function declarations. */
81 static ASN1_OBJECT
*txt2obj(const char *oid
);
82 static CONF
*load_config_file(const char *configfile
);
84 /* Query related functions. */
85 static int query_command(const char *data
, char *digest
,
86 const EVP_MD
*md
, const char *policy
, int no_nonce
,
87 int cert
, const char *in
, const char *out
, int text
);
88 static BIO
*BIO_open_with_default(const char *file
, const char *mode
,
90 static TS_REQ
*create_query(BIO
*data_bio
, char *digest
, const EVP_MD
*md
,
91 const char *policy
, int no_nonce
, int cert
);
92 static int create_digest(BIO
*input
, char *digest
,
93 const EVP_MD
*md
, unsigned char **md_value
);
94 static ASN1_INTEGER
*create_nonce(int bits
);
96 /* Reply related functions. */
97 static int reply_command(CONF
*conf
, char *section
, char *engine
,
98 char *queryfile
, char *passin
, char *inkey
,
99 char *signer
, char *chain
, const char *policy
,
100 char *in
, int token_in
, char *out
, int token_out
,
102 static TS_RESP
*read_PKCS7(BIO
*in_bio
);
103 static TS_RESP
*create_response(CONF
*conf
, const char *section
, char *engine
,
104 char *queryfile
, char *passin
, char *inkey
,
105 char *signer
, char *chain
, const char *policy
);
106 static ASN1_INTEGER
* serial_cb(TS_RESP_CTX
*ctx
, void *data
);
107 static ASN1_INTEGER
*next_serial(const char *serialfile
);
108 static int save_ts_serial(const char *serialfile
, ASN1_INTEGER
*serial
);
110 /* Verify related functions. */
111 static int verify_command(char *data
, char *digest
, char *queryfile
,
112 char *in
, int token_in
,
113 char *ca_path
, char *ca_file
, char *untrusted
);
114 static TS_VERIFY_CTX
*create_verify_ctx(char *data
, char *digest
,
116 char *ca_path
, char *ca_file
,
118 static X509_STORE
*create_cert_store(char *ca_path
, char *ca_file
);
119 static int verify_cb(int ok
, X509_STORE_CTX
*ctx
);
121 /* Main function definition. */
122 int MAIN(int, char **);
124 int MAIN(int argc
, char **argv
)
127 char *configfile
= NULL
;
128 char *section
= NULL
;
131 CMD_NONE
, CMD_QUERY
, CMD_REPLY
, CMD_VERIFY
135 const EVP_MD
*md
= NULL
;
143 char *queryfile
= NULL
;
144 char *passin
= NULL
; /* Password source. */
145 char *password
=NULL
; /* Password itself. */
149 char *ca_path
= NULL
;
150 char *ca_file
= NULL
;
151 char *untrusted
= NULL
;
153 /* Input is ContentInfo instead of TimeStampResp. */
155 /* Output is ContentInfo instead of TimeStampResp. */
157 int free_bio_err
= 0;
159 ERR_load_crypto_strings();
162 if (bio_err
== NULL
&& (bio_err
= BIO_new(BIO_s_file())) != NULL
)
165 BIO_set_fp(bio_err
, stderr
, BIO_NOCLOSE
| BIO_FP_TEXT
);
168 if (!load_config(bio_err
, NULL
))
171 for (argc
--, argv
++; argc
> 0; argc
--, argv
++)
173 if (strcmp(*argv
, "-config") == 0)
175 if (argc
-- < 1) goto usage
;
176 configfile
= *++argv
;
178 else if (strcmp(*argv
, "-section") == 0)
180 if (argc
-- < 1) goto usage
;
183 else if (strcmp(*argv
, "-query") == 0)
185 if (mode
!= CMD_NONE
) goto usage
;
188 else if (strcmp(*argv
, "-data") == 0)
190 if (argc
-- < 1) goto usage
;
193 else if (strcmp(*argv
, "-digest") == 0)
195 if (argc
-- < 1) goto usage
;
198 else if (strcmp(*argv
, "-rand") == 0)
200 if (argc
-- < 1) goto usage
;
203 else if (strcmp(*argv
, "-policy") == 0)
205 if (argc
-- < 1) goto usage
;
208 else if (strcmp(*argv
, "-no_nonce") == 0)
212 else if (strcmp(*argv
, "-cert") == 0)
216 else if (strcmp(*argv
, "-in") == 0)
218 if (argc
-- < 1) goto usage
;
221 else if (strcmp(*argv
, "-token_in") == 0)
225 else if (strcmp(*argv
, "-out") == 0)
227 if (argc
-- < 1) goto usage
;
230 else if (strcmp(*argv
, "-token_out") == 0)
234 else if (strcmp(*argv
, "-text") == 0)
238 else if (strcmp(*argv
, "-reply") == 0)
240 if (mode
!= CMD_NONE
) goto usage
;
243 else if (strcmp(*argv
, "-queryfile") == 0)
245 if (argc
-- < 1) goto usage
;
248 else if (strcmp(*argv
, "-passin") == 0)
250 if (argc
-- < 1) goto usage
;
253 else if (strcmp(*argv
, "-inkey") == 0)
255 if (argc
-- < 1) goto usage
;
258 else if (strcmp(*argv
, "-signer") == 0)
260 if (argc
-- < 1) goto usage
;
263 else if (strcmp(*argv
, "-chain") == 0)
265 if (argc
-- < 1) goto usage
;
268 else if (strcmp(*argv
, "-verify") == 0)
270 if (mode
!= CMD_NONE
) goto usage
;
273 else if (strcmp(*argv
, "-CApath") == 0)
275 if (argc
-- < 1) goto usage
;
278 else if (strcmp(*argv
, "-CAfile") == 0)
280 if (argc
-- < 1) goto usage
;
283 else if (strcmp(*argv
, "-untrusted") == 0)
285 if (argc
-- < 1) goto usage
;
288 else if (strcmp(*argv
, "-engine") == 0)
290 if (argc
-- < 1) goto usage
;
293 else if ((md
= EVP_get_digestbyname(*argv
+ 1)) != NULL
)
301 /* Seed the random number generator if it is going to be used. */
302 if (mode
== CMD_QUERY
&& !no_nonce
)
304 if (!app_RAND_load_file(NULL
, bio_err
, 1) && rnd
== NULL
)
305 BIO_printf(bio_err
, "warning, not much extra random "
306 "data, consider using the -rand option\n");
308 BIO_printf(bio_err
,"%ld semi-random bytes loaded\n",
309 app_RAND_load_files(rnd
));
312 /* Get the password if required. */
313 if(mode
== CMD_REPLY
&& passin
&&
314 !app_passwd(bio_err
, passin
, NULL
, &password
, NULL
))
316 BIO_printf(bio_err
,"Error getting password.\n");
320 /* Check consistency of parameters and execute
321 the appropriate function. */
327 /* Data file and message imprint cannot be specified
329 ret
= data
!= NULL
&& digest
!= NULL
;
331 /* Load the config file for possible policy OIDs. */
332 conf
= load_config_file(configfile
);
333 ret
= !query_command(data
, digest
, md
, policy
, no_nonce
, cert
,
337 conf
= load_config_file(configfile
);
340 ret
= !(queryfile
!= NULL
&& conf
!= NULL
&& !token_in
);
345 /* 'in' and 'queryfile' are exclusive. */
346 ret
= !(queryfile
== NULL
);
350 ret
= !reply_command(conf
, section
, engine
, queryfile
,
351 password
, inkey
, signer
, chain
, policy
,
352 in
, token_in
, out
, token_out
, text
);
355 ret
= !(((queryfile
&& !data
&& !digest
)
356 || (!queryfile
&& data
&& !digest
)
357 || (!queryfile
&& !data
&& digest
))
361 ret
= !verify_command(data
, digest
, queryfile
, in
, token_in
,
362 ca_path
, ca_file
, untrusted
);
368 BIO_printf(bio_err
, "usage:\n"
369 "ts -query [-rand file%cfile%c...] [-config configfile] "
370 "[-data file_to_hash] [-digest digest_bytes]"
371 "[-md2|-md4|-md5|-sha|-sha1|-mdc2|-ripemd160] "
372 "[-policy object_id] [-no_nonce] [-cert] "
373 "[-in request.tsq] [-out request.tsq] [-text]\n",
374 LIST_SEPARATOR_CHAR
, LIST_SEPARATOR_CHAR
);
375 BIO_printf(bio_err
, "or\n"
376 "ts -reply [-config configfile] [-section tsa_section] "
377 "[-queryfile request.tsq] [-passin password] "
378 "[-signer tsa_cert.pem] [-inkey private_key.pem] "
379 "[-chain certs_file.pem] [-policy object_id] "
380 "[-in response.tsr] [-token_in] "
381 "[-out response.tsr] [-token_out] [-text] [-engine id]\n");
382 BIO_printf(bio_err
, "or\n"
383 "ts -verify [-data file_to_hash] [-digest digest_bytes] "
384 "[-queryfile request.tsq] "
385 "-in response.tsr [-token_in] "
386 "-CApath ca_path -CAfile ca_file.pem "
387 "-untrusted cert_file.pem\n");
390 app_RAND_write_file(NULL
, bio_err
);
392 OPENSSL_free(password
);
396 BIO_free_all(bio_err
);
404 * Configuration file-related function definitions.
407 static ASN1_OBJECT
*txt2obj(const char *oid
)
409 ASN1_OBJECT
*oid_obj
= NULL
;
411 if (!(oid_obj
= OBJ_txt2obj(oid
, 0)))
412 BIO_printf(bio_err
, "cannot convert %s to OID\n", oid
);
417 static CONF
*load_config_file(const char *configfile
)
422 if (!configfile
) configfile
= getenv("OPENSSL_CONF");
423 if (!configfile
) configfile
= getenv("SSLEAY_CONF");
426 (!(conf
= NCONF_new(NULL
)) ||
427 NCONF_load(conf
, configfile
, &errorline
) <= 0))
430 BIO_printf(bio_err
, "error loading the config file "
431 "'%s'\n", configfile
);
433 BIO_printf(bio_err
, "error on line %ld of config file "
434 "'%s'\n", errorline
, configfile
);
441 BIO_printf(bio_err
,"Using configuration from %s\n", configfile
);
442 p
= NCONF_get_string(conf
, NULL
, ENV_OID_FILE
);
445 BIO
*oid_bio
= BIO_new_file(p
, "r");
447 ERR_print_errors(bio_err
);
450 OBJ_create_objects(oid_bio
);
451 BIO_free_all(oid_bio
);
456 if(!add_oid_section(bio_err
, conf
))
457 ERR_print_errors(bio_err
);
463 * Query-related method definitions.
466 static int query_command(const char *data
, char *digest
, const EVP_MD
*md
,
467 const char *policy
, int no_nonce
,
468 int cert
, const char *in
, const char *out
, int text
)
471 TS_REQ
*query
= NULL
;
473 BIO
*data_bio
= NULL
;
476 /* Build query object either from file or from scratch. */
479 if ((in_bio
= BIO_new_file(in
, "rb")) == NULL
) goto end
;
480 query
= d2i_TS_REQ_bio(in_bio
, NULL
);
484 /* Open the file if no explicit digest bytes were specified. */
486 && !(data_bio
= BIO_open_with_default(data
, "rb", stdin
)))
488 /* Creating the query object. */
489 query
= create_query(data_bio
, digest
, md
,
490 policy
, no_nonce
, cert
);
491 /* Saving the random number generator state. */
493 if (query
== NULL
) goto end
;
495 /* Write query either in ASN.1 or in text format. */
496 if ((out_bio
= BIO_open_with_default(out
, "wb", stdout
)) == NULL
)
501 if (!TS_REQ_print_bio(out_bio
, query
))
507 if (!i2d_TS_REQ_bio(out_bio
, query
))
514 ERR_print_errors(bio_err
);
517 BIO_free_all(in_bio
);
518 BIO_free_all(data_bio
);
519 BIO_free_all(out_bio
);
525 static BIO
*BIO_open_with_default(const char *file
, const char *mode
,
528 return file
== NULL
?
529 BIO_new_fp(default_fp
, BIO_NOCLOSE
)
530 : BIO_new_file(file
, mode
);
533 static TS_REQ
*create_query(BIO
*data_bio
, char *digest
, const EVP_MD
*md
,
534 const char *policy
, int no_nonce
, int cert
)
537 TS_REQ
*ts_req
= NULL
;
539 TS_MSG_IMPRINT
*msg_imprint
= NULL
;
540 X509_ALGOR
*algo
= NULL
;
541 unsigned char *data
= NULL
;
542 ASN1_OBJECT
*policy_obj
= NULL
;
543 ASN1_INTEGER
*nonce_asn1
= NULL
;
545 /* Setting default message digest. */
546 if (!md
&& !(md
= EVP_get_digestbyname("sha1"))) goto err
;
548 /* Creating request object. */
549 if (!(ts_req
= TS_REQ_new())) goto err
;
551 /* Setting version. */
552 if (!TS_REQ_set_version(ts_req
, 1)) goto err
;
554 /* Creating and adding MSG_IMPRINT object. */
555 if (!(msg_imprint
= TS_MSG_IMPRINT_new())) goto err
;
557 /* Adding algorithm. */
558 if (!(algo
= X509_ALGOR_new())) goto err
;
559 if (!(algo
->algorithm
= OBJ_nid2obj(EVP_MD_type(md
)))) goto err
;
560 if (!(algo
->parameter
= ASN1_TYPE_new())) goto err
;
561 algo
->parameter
->type
= V_ASN1_NULL
;
562 if (!TS_MSG_IMPRINT_set_algo(msg_imprint
, algo
)) goto err
;
564 /* Adding message digest. */
565 if ((len
= create_digest(data_bio
, digest
, md
, &data
)) == 0)
567 if (!TS_MSG_IMPRINT_set_msg(msg_imprint
, data
, len
)) goto err
;
569 if (!TS_REQ_set_msg_imprint(ts_req
, msg_imprint
)) goto err
;
571 /* Setting policy if requested. */
572 if (policy
&& !(policy_obj
= txt2obj(policy
))) goto err
;
573 if (policy_obj
&& !TS_REQ_set_policy_id(ts_req
, policy_obj
)) goto err
;
575 /* Setting nonce if requested. */
576 if (!no_nonce
&& !(nonce_asn1
= create_nonce(NONCE_LENGTH
))) goto err
;
577 if (nonce_asn1
&& !TS_REQ_set_nonce(ts_req
, nonce_asn1
)) goto err
;
579 /* Setting certificate request flag if requested. */
580 if (!TS_REQ_set_cert_req(ts_req
, cert
)) goto err
;
588 BIO_printf(bio_err
, "could not create query\n");
590 TS_MSG_IMPRINT_free(msg_imprint
);
591 X509_ALGOR_free(algo
);
593 ASN1_OBJECT_free(policy_obj
);
594 ASN1_INTEGER_free(nonce_asn1
);
598 static int create_digest(BIO
*input
, char *digest
, const EVP_MD
*md
,
599 unsigned char **md_value
)
603 md_value_len
= EVP_MD_size(md
);
604 if (md_value_len
< 0)
608 /* Digest must be computed from an input file. */
610 unsigned char buffer
[4096];
613 *md_value
= OPENSSL_malloc(md_value_len
);
614 if (*md_value
== 0) goto err
;
616 EVP_DigestInit(&md_ctx
, md
);
617 while ((length
= BIO_read(input
, buffer
, sizeof(buffer
))) > 0)
619 EVP_DigestUpdate(&md_ctx
, buffer
, length
);
621 if (!EVP_DigestFinal(&md_ctx
, *md_value
, NULL
))
626 /* Digest bytes are specified with digest. */
628 *md_value
= string_to_hex(digest
, &digest_len
);
629 if (!*md_value
|| md_value_len
!= digest_len
)
631 OPENSSL_free(*md_value
);
633 BIO_printf(bio_err
, "bad digest, %d bytes "
634 "must be specified\n", md_value_len
);
644 static ASN1_INTEGER
*create_nonce(int bits
)
646 unsigned char buf
[20];
647 ASN1_INTEGER
*nonce
= NULL
;
648 int len
= (bits
- 1) / 8 + 1;
651 /* Generating random byte sequence. */
652 if (len
> (int)sizeof(buf
)) goto err
;
653 if (RAND_bytes(buf
, len
) <= 0) goto err
;
655 /* Find the first non-zero byte and creating ASN1_INTEGER object. */
656 for (i
= 0; i
< len
&& !buf
[i
]; ++i
);
657 if (!(nonce
= ASN1_INTEGER_new())) goto err
;
658 OPENSSL_free(nonce
->data
);
659 /* Allocate at least one byte. */
660 nonce
->length
= len
- i
;
661 if (!(nonce
->data
= OPENSSL_malloc(nonce
->length
+ 1))) goto err
;
662 memcpy(nonce
->data
, buf
+ i
, nonce
->length
);
666 BIO_printf(bio_err
, "could not create nonce\n");
667 ASN1_INTEGER_free(nonce
);
671 * Reply-related method definitions.
674 static int reply_command(CONF
*conf
, char *section
, char *engine
,
675 char *queryfile
, char *passin
, char *inkey
,
676 char *signer
, char *chain
, const char *policy
,
677 char *in
, int token_in
,
678 char *out
, int token_out
, int text
)
681 TS_RESP
*response
= NULL
;
683 BIO
*query_bio
= NULL
;
684 BIO
*inkey_bio
= NULL
;
685 BIO
*signer_bio
= NULL
;
688 /* Build response object either from response or query. */
691 if ((in_bio
= BIO_new_file(in
, "rb")) == NULL
) goto end
;
694 /* We have a ContentInfo (PKCS7) object, add
695 'granted' status info around it. */
696 response
= read_PKCS7(in_bio
);
700 /* We have a ready-made TS_RESP object. */
701 response
= d2i_TS_RESP_bio(in_bio
, NULL
);
706 response
= create_response(conf
, section
, engine
, queryfile
,
707 passin
, inkey
, signer
, chain
,
710 BIO_printf(bio_err
, "Response has been generated.\n");
712 BIO_printf(bio_err
, "Response is not generated.\n");
714 if (response
== NULL
) goto end
;
716 /* Write response either in ASN.1 or text format. */
717 if ((out_bio
= BIO_open_with_default(out
, "wb", stdout
)) == NULL
)
724 TS_TST_INFO
*tst_info
= TS_RESP_get_tst_info(response
);
725 if (!TS_TST_INFO_print_bio(out_bio
, tst_info
)) goto end
;
729 if (!TS_RESP_print_bio(out_bio
, response
)) goto end
;
734 /* ASN.1 DER output. */
737 PKCS7
*token
= TS_RESP_get_token(response
);
738 if (!i2d_PKCS7_bio(out_bio
, token
)) goto end
;
742 if (!i2d_TS_RESP_bio(out_bio
, response
)) goto end
;
749 ERR_print_errors(bio_err
);
752 BIO_free_all(in_bio
);
753 BIO_free_all(query_bio
);
754 BIO_free_all(inkey_bio
);
755 BIO_free_all(signer_bio
);
756 BIO_free_all(out_bio
);
757 TS_RESP_free(response
);
762 /* Reads a PKCS7 token and adds default 'granted' status info to it. */
763 static TS_RESP
*read_PKCS7(BIO
*in_bio
)
767 TS_TST_INFO
*tst_info
= NULL
;
768 TS_RESP
*resp
= NULL
;
769 TS_STATUS_INFO
*si
= NULL
;
771 /* Read PKCS7 object and extract the signed time stamp info. */
772 if (!(token
= d2i_PKCS7_bio(in_bio
, NULL
))) goto end
;
773 if (!(tst_info
= PKCS7_to_TS_TST_INFO(token
))) goto end
;
775 /* Creating response object. */
776 if (!(resp
= TS_RESP_new())) goto end
;
778 /* Create granted status info. */
779 if (!(si
= TS_STATUS_INFO_new())) goto end
;
780 if (!(ASN1_INTEGER_set(si
->status
, TS_STATUS_GRANTED
))) goto end
;
781 if (!TS_RESP_set_status_info(resp
, si
)) goto end
;
783 /* Setting encapsulated token. */
784 TS_RESP_set_tst_info(resp
, token
, tst_info
);
785 token
= NULL
; /* Ownership is lost. */
786 tst_info
= NULL
; /* Ownership is lost. */
791 TS_TST_INFO_free(tst_info
);
797 TS_STATUS_INFO_free(si
);
801 static TS_RESP
*create_response(CONF
*conf
, const char *section
, char *engine
,
802 char *queryfile
, char *passin
, char *inkey
,
803 char *signer
, char *chain
, const char *policy
)
806 TS_RESP
*response
= NULL
;
807 BIO
*query_bio
= NULL
;
808 TS_RESP_CTX
*resp_ctx
= NULL
;
810 if (!(query_bio
= BIO_new_file(queryfile
, "rb")))
813 /* Getting TSA configuration section. */
814 if (!(section
= TS_CONF_get_tsa_section(conf
, section
)))
817 /* Setting up response generation context. */
818 if (!(resp_ctx
= TS_RESP_CTX_new())) goto end
;
820 /* Setting serial number provider callback. */
821 if (!TS_CONF_set_serial(conf
, section
, serial_cb
, resp_ctx
)) goto end
;
822 #ifndef OPENSSL_NO_ENGINE
823 /* Setting default OpenSSL engine. */
824 if (!TS_CONF_set_crypto_device(conf
, section
, engine
)) goto end
;
827 /* Setting TSA signer certificate. */
828 if (!TS_CONF_set_signer_cert(conf
, section
, signer
, resp_ctx
)) goto end
;
830 /* Setting TSA signer certificate chain. */
831 if (!TS_CONF_set_certs(conf
, section
, chain
, resp_ctx
)) goto end
;
833 /* Setting TSA signer private key. */
834 if (!TS_CONF_set_signer_key(conf
, section
, inkey
, passin
, resp_ctx
))
837 /* Setting default policy OID. */
838 if (!TS_CONF_set_def_policy(conf
, section
, policy
, resp_ctx
)) goto end
;
840 /* Setting acceptable policy OIDs. */
841 if (!TS_CONF_set_policies(conf
, section
, resp_ctx
)) goto end
;
843 /* Setting the acceptable one-way hash algorithms. */
844 if (!TS_CONF_set_digests(conf
, section
, resp_ctx
)) goto end
;
846 /* Setting guaranteed time stamp accuracy. */
847 if (!TS_CONF_set_accuracy(conf
, section
, resp_ctx
)) goto end
;
849 /* Setting the precision of the time. */
850 if (!TS_CONF_set_clock_precision_digits(conf
, section
, resp_ctx
))
853 /* Setting the ordering flaf if requested. */
854 if (!TS_CONF_set_ordering(conf
, section
, resp_ctx
)) goto end
;
856 /* Setting the TSA name required flag if requested. */
857 if (!TS_CONF_set_tsa_name(conf
, section
, resp_ctx
)) goto end
;
859 /* Setting the ESS cert id chain flag if requested. */
860 if (!TS_CONF_set_ess_cert_id_chain(conf
, section
, resp_ctx
)) goto end
;
862 /* Creating the response. */
863 if (!(response
= TS_RESP_create_response(resp_ctx
, query_bio
)))
870 TS_RESP_free(response
);
873 TS_RESP_CTX_free(resp_ctx
);
874 BIO_free_all(query_bio
);
879 static ASN1_INTEGER
* serial_cb(TS_RESP_CTX
*ctx
, void *data
)
881 const char *serial_file
= (const char *) data
;
882 ASN1_INTEGER
*serial
= next_serial(serial_file
);
886 TS_RESP_CTX_set_status_info(ctx
, TS_STATUS_REJECTION
,
887 "Error during serial number "
889 TS_RESP_CTX_add_failure_info(ctx
,
890 TS_INFO_ADD_INFO_NOT_AVAILABLE
);
893 save_ts_serial(serial_file
, serial
);
898 static ASN1_INTEGER
*next_serial(const char *serialfile
)
902 ASN1_INTEGER
*serial
= NULL
;
905 if (!(serial
= ASN1_INTEGER_new())) goto err
;
907 if (!(in
= BIO_new_file(serialfile
, "r")))
910 BIO_printf(bio_err
, "Warning: could not open file %s for "
911 "reading, using serial number: 1\n", serialfile
);
912 if (!ASN1_INTEGER_set(serial
, 1)) goto err
;
917 if (!a2i_ASN1_INTEGER(in
, serial
, buf
, sizeof(buf
)))
919 BIO_printf(bio_err
, "unable to load number from %s\n",
923 if (!(bn
= ASN1_INTEGER_to_BN(serial
, NULL
))) goto err
;
924 ASN1_INTEGER_free(serial
);
926 if (!BN_add_word(bn
, 1)) goto err
;
927 if (!(serial
= BN_to_ASN1_INTEGER(bn
, NULL
))) goto err
;
933 ASN1_INTEGER_free(serial
);
941 static int save_ts_serial(const char *serialfile
, ASN1_INTEGER
*serial
)
946 if (!(out
= BIO_new_file(serialfile
, "w"))) goto err
;
947 if (i2a_ASN1_INTEGER(out
, serial
) <= 0) goto err
;
948 if (BIO_puts(out
, "\n") <= 0) goto err
;
952 BIO_printf(bio_err
, "could not save serial number to %s\n",
959 * Verify-related method definitions.
962 static int verify_command(char *data
, char *digest
, char *queryfile
,
963 char *in
, int token_in
,
964 char *ca_path
, char *ca_file
, char *untrusted
)
968 TS_RESP
*response
= NULL
;
969 TS_VERIFY_CTX
*verify_ctx
= NULL
;
972 /* Decode the token (PKCS7) or response (TS_RESP) files. */
973 if (!(in_bio
= BIO_new_file(in
, "rb"))) goto end
;
976 if (!(token
= d2i_PKCS7_bio(in_bio
, NULL
))) goto end
;
980 if (!(response
= d2i_TS_RESP_bio(in_bio
, NULL
))) goto end
;
983 if (!(verify_ctx
= create_verify_ctx(data
, digest
, queryfile
,
984 ca_path
, ca_file
, untrusted
)))
987 /* Checking the token or response against the request. */
989 TS_RESP_verify_token(verify_ctx
, token
) :
990 TS_RESP_verify_response(verify_ctx
, response
);
993 printf("Verification: ");
999 /* Print errors, if there are any. */
1000 ERR_print_errors(bio_err
);
1004 BIO_free_all(in_bio
);
1006 TS_RESP_free(response
);
1007 TS_VERIFY_CTX_free(verify_ctx
);
1011 static TS_VERIFY_CTX
*create_verify_ctx(char *data
, char *digest
,
1013 char *ca_path
, char *ca_file
,
1016 TS_VERIFY_CTX
*ctx
= NULL
;
1018 TS_REQ
*request
= NULL
;
1021 if (data
!= NULL
|| digest
!= NULL
)
1023 if (!(ctx
= TS_VERIFY_CTX_new())) goto err
;
1024 ctx
->flags
= TS_VFY_VERSION
| TS_VFY_SIGNER
;
1027 ctx
->flags
|= TS_VFY_DATA
;
1028 if (!(ctx
->data
= BIO_new_file(data
, "rb"))) goto err
;
1030 else if (digest
!= NULL
)
1033 ctx
->flags
|= TS_VFY_IMPRINT
;
1034 if (!(ctx
->imprint
= string_to_hex(digest
,
1037 BIO_printf(bio_err
, "invalid digest string\n");
1040 ctx
->imprint_len
= imprint_len
;
1044 else if (queryfile
!= NULL
)
1046 /* The request has just to be read, decoded and converted to
1047 a verify context object. */
1048 if (!(input
= BIO_new_file(queryfile
, "rb"))) goto err
;
1049 if (!(request
= d2i_TS_REQ_bio(input
, NULL
))) goto err
;
1050 if (!(ctx
= TS_REQ_to_TS_VERIFY_CTX(request
, NULL
))) goto err
;
1055 /* Add the signature verification flag and arguments. */
1056 ctx
->flags
|= TS_VFY_SIGNATURE
;
1058 /* Initialising the X509_STORE object. */
1059 if (!(ctx
->store
= create_cert_store(ca_path
, ca_file
))) goto err
;
1061 /* Loading untrusted certificates. */
1062 if (untrusted
&& !(ctx
->certs
= TS_CONF_load_certs(untrusted
)))
1069 TS_VERIFY_CTX_free(ctx
);
1072 BIO_free_all(input
);
1073 TS_REQ_free(request
);
1077 static X509_STORE
*create_cert_store(char *ca_path
, char *ca_file
)
1079 X509_STORE
*cert_ctx
= NULL
;
1080 X509_LOOKUP
*lookup
= NULL
;
1083 /* Creating the X509_STORE object. */
1084 cert_ctx
= X509_STORE_new();
1086 /* Setting the callback for certificate chain verification. */
1087 X509_STORE_set_verify_cb(cert_ctx
, verify_cb
);
1089 /* Adding a trusted certificate directory source. */
1092 lookup
= X509_STORE_add_lookup(cert_ctx
,
1093 X509_LOOKUP_hash_dir());
1096 BIO_printf(bio_err
, "memory allocation failure\n");
1099 i
= X509_LOOKUP_add_dir(lookup
, ca_path
, X509_FILETYPE_PEM
);
1102 BIO_printf(bio_err
, "Error loading directory %s\n",
1108 /* Adding a trusted certificate file source. */
1111 lookup
= X509_STORE_add_lookup(cert_ctx
, X509_LOOKUP_file());
1114 BIO_printf(bio_err
, "memory allocation failure\n");
1117 i
= X509_LOOKUP_load_file(lookup
, ca_file
, X509_FILETYPE_PEM
);
1120 BIO_printf(bio_err
, "Error loading file %s\n", ca_file
);
1127 X509_STORE_free(cert_ctx
);
1131 static int verify_cb(int ok
, X509_STORE_CTX
*ctx
)
1138 X509_NAME_oneline(X509_get_subject_name(ctx->current_cert),
1140 printf("%s\n", buf);
1141 printf("error %d at %d depth lookup: %s\n",
1142 ctx->error, ctx->error_depth,
1143 X509_verify_cert_error_string(ctx->error));