ESS: Export three core functions, clean up TS and CMS CAdES-BES usage

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14601)

diff --git a/crypto/cms/cms_ess.c b/crypto/cms/cms_ess.c
index ba78b6ebad4fb5c78bf127da11eeeb6373b75d02..fd9903eee84132af18534bb773e30edf10d86ba8 100644 (file)
--- a/crypto/cms/cms_ess.c
+++ b/crypto/cms/cms_ess.c
@@ -53,7 +53,7 @@ int ossl_cms_check_signing_certs(const CMS_SignerInfo *si,
     ESS_SIGNING_CERT_V2 *ssv2 = NULL;
     int ret = ossl_cms_signerinfo_get_signing_cert(si, &ss) >= 0
         && ossl_cms_signerinfo_get_signing_cert_v2(si, &ssv2) >= 0
-        && ossl_ess_check_signing_certs(ss, ssv2, chain, 1);
+        && OSSL_ESS_check_signing_certs(ss, ssv2, chain, 1) > 0;
 
     ESS_SIGNING_CERT_free(ss);
     ESS_SIGNING_CERT_V2_free(ssv2);

diff --git a/crypto/cms/cms_sd.c b/crypto/cms/cms_sd.c
index 898916d548337e6bc6f40605bea59c0ccb383107..43dbec60044aef1c14fa4f66d8944dde074a5eb2 100644 (file)
--- a/crypto/cms/cms_sd.c
+++ b/crypto/cms/cms_sd.c
@@ -377,13 +377,13 @@ CMS_SignerInfo *CMS_add1_signer(CMS_ContentInfo *cms,
             int add_sc;
 
             if (md == NULL || EVP_MD_is_a(md, SN_sha1)) {
-                if ((sc = ossl_ess_signing_cert_new_init(signer,
+                if ((sc = OSSL_ESS_signing_cert_new_init(signer,
                                                          NULL, 1)) == NULL)
                     goto err;
                 add_sc = ossl_cms_add1_signing_cert(si, sc);
                 ESS_SIGNING_CERT_free(sc);
             } else {
-                if ((sc2 = ossl_ess_signing_cert_v2_new_init(md, signer,
+                if ((sc2 = OSSL_ESS_signing_cert_v2_new_init(md, signer,
                                                              NULL, 1)) == NULL)
                     goto err;
                 add_sc = ossl_cms_add1_signing_cert_v2(si, sc2);

diff --git a/crypto/ess/ess_asn1.c b/crypto/ess/ess_asn1.c
index 08a0be8cc4528959cbfbeb4312186718e7e5e0e1..681ac4e72732974d3ddc4d5f6b8e2a5384522c7f 100644 (file)
--- a/crypto/ess/ess_asn1.c
+++ b/crypto/ess/ess_asn1.c
@@ -58,12 +58,13 @@ ASN1_SEQUENCE(ESS_SIGNING_CERT_V2) = {
 IMPLEMENT_ASN1_FUNCTIONS(ESS_SIGNING_CERT_V2)
 IMPLEMENT_ASN1_DUP_FUNCTION(ESS_SIGNING_CERT_V2)
 
+/* TODO the following two functions should be moved to ../cms/ */
 /* No cms support means no CMS_SignerInfo* definitions */
 #ifndef OPENSSL_NO_CMS
 
 /*
- * Returns < 0 if attribute is not found, 1 if found, or 
- * -1 on attribute parsing failure.
+ * Returns 0 if attribute is not found, 1 if found,
+ * or -1 on attribute parsing failure.
  */
 int ossl_cms_signerinfo_get_signing_cert_v2(const CMS_SignerInfo *si,
                                             ESS_SIGNING_CERT_V2 **psc)
@@ -89,8 +90,8 @@ int ossl_cms_signerinfo_get_signing_cert_v2(const CMS_SignerInfo *si,
 }
 
 /*
- * Returns < 0 if attribute is not found, 1 if found, or 
- * -1 on attribute parsing failure.
+ * Returns 0 if attribute is not found, 1 if found,
+ * or -1 on attribute parsing failure.
  */
 int ossl_cms_signerinfo_get_signing_cert(const CMS_SignerInfo *si,
                                          ESS_SIGNING_CERT **psc)

diff --git a/crypto/ess/ess_lib.c b/crypto/ess/ess_lib.c
index 6ded9f6328f2d41e54fbcd87d4adf387bcb09b96..beda9c4c16e4feb07457091b0df5c6bed11512e0 100644 (file)
--- a/crypto/ess/ess_lib.c
+++ b/crypto/ess/ess_lib.c
@@ -15,13 +15,15 @@
 #include "crypto/ess.h"
 #include "crypto/x509.h"
 
-static ESS_CERT_ID *ESS_CERT_ID_new_init(X509 *cert, int issuer_needed);
+static ESS_CERT_ID *ESS_CERT_ID_new_init(const X509 *cert,
+                                         int set_issuer_serial);
 static ESS_CERT_ID_V2 *ESS_CERT_ID_V2_new_init(const EVP_MD *hash_alg,
-                                               X509 *cert, int issuer_needed);
+                                               const X509 *cert,
+                                               int set_issuer_serial);
 
-ESS_SIGNING_CERT *ossl_ess_signing_cert_new_init(X509 *signcert,
-                                                 STACK_OF(X509) *certs,
-                                                 int issuer_needed)
+ESS_SIGNING_CERT *OSSL_ESS_signing_cert_new_init(const X509 *signcert,
+                                                 const STACK_OF(X509) *certs,
+                                                 int set_issuer_serial)
 {
     ESS_CERT_ID *cid = NULL;
     ESS_SIGNING_CERT *sc;
@@ -33,11 +35,12 @@ ESS_SIGNING_CERT *ossl_ess_signing_cert_new_init(X509 *signcert,
         && (sc->cert_ids = sk_ESS_CERT_ID_new_null()) == NULL)
         goto err;
 
-    if ((cid = ESS_CERT_ID_new_init(signcert, issuer_needed)) == NULL
+    if ((cid = ESS_CERT_ID_new_init(signcert, set_issuer_serial)) == NULL
         || !sk_ESS_CERT_ID_push(sc->cert_ids, cid))
         goto err;
     for (i = 0; i < sk_X509_num(certs); ++i) {
         X509 *cert = sk_X509_value(certs, i);
+
         if ((cid = ESS_CERT_ID_new_init(cert, 1)) == NULL
             || !sk_ESS_CERT_ID_push(sc->cert_ids, cid))
             goto err;
@@ -51,26 +54,22 @@ ESS_SIGNING_CERT *ossl_ess_signing_cert_new_init(X509 *signcert,
     return NULL;
 }
 
-static ESS_CERT_ID *ESS_CERT_ID_new_init(X509 *cert, int issuer_needed)
+static ESS_CERT_ID *ESS_CERT_ID_new_init(const X509 *cert,
+                                         int set_issuer_serial)
 {
     ESS_CERT_ID *cid = NULL;
     GENERAL_NAME *name = NULL;
     unsigned char cert_sha1[SHA_DIGEST_LENGTH];
 
-    /* Call for side-effect of computing hash and caching extensions */
-    if (!ossl_x509v3_cache_extensions(cert))
-        return NULL;
-
     if ((cid = ESS_CERT_ID_new()) == NULL)
         goto err;
-    /* TODO(3.0): fetch sha1 algorithm from providers */
     if (!X509_digest(cert, EVP_sha1(), cert_sha1, NULL))
         goto err;
     if (!ASN1_OCTET_STRING_set(cid->hash, cert_sha1, SHA_DIGEST_LENGTH))
         goto err;
 
     /* Setting the issuer/serial if requested. */
-    if (!issuer_needed)
+    if (!set_issuer_serial)
         return cid;
 
     if (cid->issuer_serial == NULL
@@ -97,10 +96,11 @@ static ESS_CERT_ID *ESS_CERT_ID_new_init(X509 *cert, int issuer_needed)
     return NULL;
 }
 
-ESS_SIGNING_CERT_V2 *ossl_ess_signing_cert_v2_new_init(const EVP_MD *hash_alg,
-                                                       X509 *signcert,
+ESS_SIGNING_CERT_V2 *OSSL_ESS_signing_cert_v2_new_init(const EVP_MD *hash_alg,
+                                                       const X509 *signcert,
+                                                       const
                                                        STACK_OF(X509) *certs,
-                                                       int issuer_needed)
+                                                       int set_issuer_serial)
 {
     ESS_CERT_ID_V2 *cid = NULL;
     ESS_SIGNING_CERT_V2 *sc;
@@ -108,7 +108,8 @@ ESS_SIGNING_CERT_V2 *ossl_ess_signing_cert_v2_new_init(const EVP_MD *hash_alg,
 
     if ((sc = ESS_SIGNING_CERT_V2_new()) == NULL)
         goto err;
-    if ((cid = ESS_CERT_ID_V2_new_init(hash_alg, signcert, issuer_needed)) == NULL)
+    cid = ESS_CERT_ID_V2_new_init(hash_alg, signcert, set_issuer_serial);
+    if (cid == NULL)
         goto err;
     if (!sk_ESS_CERT_ID_V2_push(sc->cert_ids, cid))
         goto err;
@@ -133,7 +134,8 @@ ESS_SIGNING_CERT_V2 *ossl_ess_signing_cert_v2_new_init(const EVP_MD *hash_alg,
 }
 
 static ESS_CERT_ID_V2 *ESS_CERT_ID_V2_new_init(const EVP_MD *hash_alg,
-                                               X509 *cert, int issuer_needed)
+                                               const X509 *cert,
+                                               int set_issuer_serial)
 {
     ESS_CERT_ID_V2 *cid;
     GENERAL_NAME *name = NULL;
@@ -159,14 +161,13 @@ static ESS_CERT_ID_V2 *ESS_CERT_ID_V2_new_init(const EVP_MD *hash_alg,
         cid->hash_alg = NULL;
     }
 
-    /* TODO(3.0): fetch sha1 algorithm from providers */
     if (!X509_digest(cert, hash_alg, hash, &hash_len))
         goto err;
 
     if (!ASN1_OCTET_STRING_set(cid->hash, hash, hash_len))
         goto err;
 
-    if (!issuer_needed)
+    if (!set_issuer_serial)
         return cid;
 
     if ((cid->issuer_serial = ESS_ISSUER_SERIAL_new()) == NULL)
@@ -193,6 +194,7 @@ static ESS_CERT_ID_V2 *ESS_CERT_ID_V2_new_init(const EVP_MD *hash_alg,
     return NULL;
 }
 
+/* TODO the following four functions should be moved to ../ts/ */
 ESS_SIGNING_CERT *ossl_ess_get_signing_cert(const PKCS7_SIGNER_INFO *si)
 {
     ASN1_TYPE *attr;
@@ -295,8 +297,8 @@ static int ess_issuer_serial_cmp(const ESS_ISSUER_SERIAL *is, const X509 *cert)
 }
 
 /*
- * Find cert referenced by |cid| (if not NULL, else |cidv2|) in |certs|.
- * If the cid{,v2} index is 0, the cert must be in the first in |certs| list.
+ * Find the cert in |certs| referenced by |cid| if not NULL, else by |cid_v2|.
+ * The cert must be the first one in |certs| if and only if |index| is 0.
  * Return 0 on not found, -1 on error, else 1 + the position in |certs|.
  */
 static int find(const ESS_CERT_ID *cid, const ESS_CERT_ID_V2 *cid_v2,
@@ -336,7 +338,6 @@ static int find(const ESS_CERT_ID *cid, const ESS_CERT_ID_V2 *cid_v2,
     }
     (void)ERR_pop_to_mark();
 
-    /* Look for cert with cid in the certs. */
     for (i = 0; i < sk_X509_num(certs); ++i) {
         cert = sk_X509_value(certs, i);
 
@@ -369,34 +370,33 @@ end:
     return ret;
 }
 
-/*
- * If ESSCertID and/or ESSCertIDv2 exist, which must be non-empty if given,
- * check if their first ID entry matches the signer cert first in chain
- * and each further ID entry matches any further cert in the chain.
- */
-int ossl_ess_check_signing_certs(const ESS_SIGNING_CERT *ss,
+int OSSL_ESS_check_signing_certs(const ESS_SIGNING_CERT *ss,
                                  const ESS_SIGNING_CERT_V2 *ssv2,
                                  const STACK_OF(X509) *chain,
                                  int require_signing_cert)
 {
     int n_v1 = ss == NULL ? -1 : sk_ESS_CERT_ID_num(ss->cert_ids);
     int n_v2 = ssv2 == NULL ? -1 : sk_ESS_CERT_ID_V2_num(ssv2->cert_ids);
-    int i;
+    int i, ret;
 
     if (require_signing_cert && ss == NULL && ssv2 == NULL) {
         ERR_raise(ERR_LIB_CMS, ESS_R_MISSING_SIGNING_CERTIFICATE_ATTRIBUTE);
-        return 0;
+        return -1;
     }
     if (n_v1 == 0 || n_v2 == 0) {
         ERR_raise(ERR_LIB_ESS, ESS_R_EMPTY_ESS_CERT_ID_LIST);
-        return 0;
+        return -1;
     }
     /* If both ss and ssv2 exist, as required evaluate them independently. */
-    for (i = 0; i < n_v1; i++)
-        if (find(sk_ESS_CERT_ID_value(ss->cert_ids, i), NULL, i, chain) <= 0)
-            return 0;
-    for (i = 0; i < n_v2; i++)
-        if (find(NULL, sk_ESS_CERT_ID_V2_value(ssv2->cert_ids, i), i, chain) <= 0)
-            return 0;
+    for (i = 0; i < n_v1; i++) {
+        ret = find(sk_ESS_CERT_ID_value(ss->cert_ids, i), NULL, i, chain);
+        if (ret <= 0)
+            return ret;
+    }
+    for (i = 0; i < n_v2; i++) {
+        ret = find(NULL, sk_ESS_CERT_ID_V2_value(ssv2->cert_ids, i), i, chain);
+        if (ret <= 0)
+            return ret;
+    }
     return 1;
 }

diff --git a/crypto/ts/ts_rsp_sign.c b/crypto/ts/ts_rsp_sign.c
index 6d00a471a20f1939465097fc30cfaf600a0a6962..8f0653c5d30df82d98b807bf63aa8430ffc73497 100644 (file)
--- a/crypto/ts/ts_rsp_sign.c
+++ b/crypto/ts/ts_rsp_sign.c
@@ -687,7 +687,7 @@ static int ts_RESP_sign(TS_RESP_CTX *ctx)
     certs = ctx->flags & TS_ESS_CERT_ID_CHAIN ? ctx->certs : NULL;
     if (ctx->ess_cert_id_digest == NULL
         || EVP_MD_is_a(ctx->ess_cert_id_digest, SN_sha1)) {
-        if ((sc = ossl_ess_signing_cert_new_init(ctx->signer_cert,
+        if ((sc = OSSL_ESS_signing_cert_new_init(ctx->signer_cert,
                                                  certs, 0)) == NULL)
             goto err;
 
@@ -696,7 +696,7 @@ static int ts_RESP_sign(TS_RESP_CTX *ctx)
             goto err;
         }
     } else {
-        sc2 = ossl_ess_signing_cert_v2_new_init(ctx->ess_cert_id_digest,
+        sc2 = OSSL_ESS_signing_cert_v2_new_init(ctx->ess_cert_id_digest,
                                                 ctx->signer_cert, certs, 0);
         if (sc2 == NULL)
             goto err;

diff --git a/crypto/ts/ts_rsp_verify.c b/crypto/ts/ts_rsp_verify.c
index 09daa2a449c97d53d3a14dc0185e02e9b107eb96..56f40b11528bc62f0c3741400ff84783d965c565 100644 (file)
--- a/crypto/ts/ts_rsp_verify.c
+++ b/crypto/ts/ts_rsp_verify.c
@@ -208,7 +208,7 @@ static int ts_check_signing_certs(const PKCS7_SIGNER_INFO *si,
 {
     ESS_SIGNING_CERT *ss = ossl_ess_get_signing_cert(si);
     ESS_SIGNING_CERT_V2 *ssv2 = ossl_ess_get_signing_cert_v2(si);
-    int ret = ossl_ess_check_signing_certs(ss, ssv2, chain, 1);
+    int ret = OSSL_ESS_check_signing_certs(ss, ssv2, chain, 1) > 0;
 
     ESS_SIGNING_CERT_free(ss);
     ESS_SIGNING_CERT_V2_free(ssv2);

diff --git a/doc/build.info b/doc/build.info
index d9c5d8d4fca0506815c5131fabcd79b34dee94eb..86daf403d7e661b435acdd6b4efc4cac5f087de1 100644 (file)
--- a/doc/build.info
+++ b/doc/build.info
@@ -1602,6 +1602,10 @@ DEPEND[html/man3/OSSL_ENCODER_to_bio.html]=man3/OSSL_ENCODER_to_bio.pod
 GENERATE[html/man3/OSSL_ENCODER_to_bio.html]=man3/OSSL_ENCODER_to_bio.pod
 DEPEND[man/man3/OSSL_ENCODER_to_bio.3]=man3/OSSL_ENCODER_to_bio.pod
 GENERATE[man/man3/OSSL_ENCODER_to_bio.3]=man3/OSSL_ENCODER_to_bio.pod
+DEPEND[html/man3/OSSL_ESS_check_signing_certs.html]=man3/OSSL_ESS_check_signing_certs.pod
+GENERATE[html/man3/OSSL_ESS_check_signing_certs.html]=man3/OSSL_ESS_check_signing_certs.pod
+DEPEND[man/man3/OSSL_ESS_check_signing_certs.3]=man3/OSSL_ESS_check_signing_certs.pod
+GENERATE[man/man3/OSSL_ESS_check_signing_certs.3]=man3/OSSL_ESS_check_signing_certs.pod
 DEPEND[html/man3/OSSL_HTTP_REQ_CTX.html]=man3/OSSL_HTTP_REQ_CTX.pod
 GENERATE[html/man3/OSSL_HTTP_REQ_CTX.html]=man3/OSSL_HTTP_REQ_CTX.pod
 DEPEND[man/man3/OSSL_HTTP_REQ_CTX.3]=man3/OSSL_HTTP_REQ_CTX.pod
@@ -3050,6 +3054,7 @@ html/man3/OSSL_ENCODER.html \
 html/man3/OSSL_ENCODER_CTX.html \
 html/man3/OSSL_ENCODER_CTX_new_for_pkey.html \
 html/man3/OSSL_ENCODER_to_bio.html \
+html/man3/OSSL_ESS_check_signing_certs.html \
 html/man3/OSSL_HTTP_REQ_CTX.html \
 html/man3/OSSL_HTTP_parse_url.html \
 html/man3/OSSL_HTTP_transfer.html \
@@ -3625,6 +3630,7 @@ man/man3/OSSL_ENCODER.3 \
 man/man3/OSSL_ENCODER_CTX.3 \
 man/man3/OSSL_ENCODER_CTX_new_for_pkey.3 \
 man/man3/OSSL_ENCODER_to_bio.3 \
+man/man3/OSSL_ESS_check_signing_certs.3 \
 man/man3/OSSL_HTTP_REQ_CTX.3 \
 man/man3/OSSL_HTTP_parse_url.3 \
 man/man3/OSSL_HTTP_transfer.3 \

diff --git a/doc/man3/CMS_verify.pod b/doc/man3/CMS_verify.pod
index 0331f7cf7eb48aaf8e52a5ec8e62d18361cbd08f..33130bc9f27104c7da2748ae5705ac01f309315a 100644 (file)
--- a/doc/man3/CMS_verify.pod
+++ b/doc/man3/CMS_verify.pod
@@ -122,6 +122,7 @@ be held in memory if it is not detached.
 
 =head1 SEE ALSO
 
+L<OSSL_ESS_check_signing_certs(3)>,
 L<ERR_get_error(3)>, L<CMS_sign(3)>
 
 =head1 COPYRIGHT

diff --git a/doc/man3/OSSL_ESS_check_signing_certs.pod b/doc/man3/OSSL_ESS_check_signing_certs.pod
new file mode 100644 (file)
index 0000000..bff2619
--- /dev/null
+++ b/doc/man3/OSSL_ESS_check_signing_certs.pod
@@ -0,0 +1,88 @@
+=pod
+
+=head1 NAME
+
+OSSL_ESS_signing_cert_new_init,
+OSSL_ESS_signing_cert_v2_new_init,
+OSSL_ESS_check_signing_certs
+- Enhanced Security Services (ESS) functions
+
+=head1 SYNOPSIS
+
+ #include <openssl/ess.h>
+
+ ESS_SIGNING_CERT *OSSL_ESS_signing_cert_new_init(const X509 *signcert,
+                                                  const STACK_OF(X509) *certs,
+                                                  int set_issuer_serial);
+ ESS_SIGNING_CERT_V2 *OSSL_ESS_signing_cert_v2_new_init(const EVP_MD *hash_alg,
+                                                        const X509 *signcert,
+                                                        const
+                                                        STACK_OF(X509) *certs,
+                                                        int set_issuer_serial);
+ int OSSL_ESS_check_signing_certs(const ESS_SIGNING_CERT *ss,
+                                  const ESS_SIGNING_CERT_V2 *ssv2,
+                                  const STACK_OF(X509) *chain,
+                                  int require_signing_cert);
+
+=head1 DESCRIPTION
+
+OSSL_ESS_signing_cert_new_init() generates a new B<ESS_SIGNING_CERT> structure
+referencing the given I<signcert> and any given further I<certs>
+using their SHA-1 fingerprints.
+If I<set_issuer_serial> is nonzero then also the issuer and serial number
+of I<signcert> are included in the B<ESS_CERT_ID> as the B<issuerSerial> field.
+For all members of I<certs> the  B<issuerSerial> field is always included.
+
+OSSL_ESS_signing_cert_v2_new_init() is the same as
+OSSL_ESS_signing_cert_new_init() except that it uses the given I<hash_alg> and
+generates a B<ESS_SIGNING_CERT_V2> structure with B<ESS_CERT_ID_V2> elements.
+
+OSSL_ESS_check_signing_certs() checks if the validation chain I<chain> contains
+the certificates required by the identifiers given in I<ss> and/or I<ssv2>.
+If I<require_signing_cert> is nonzero, I<ss> or I<ssv2> must not be NULL.
+If both I<ss> and I<ssv2> are not NULL, they are evaluated independently.
+The list of certificate identifiers in I<ss> is of type B<ESS_CERT_ID>,
+while the list contained in I<ssv2> is of type B<ESS_CERT_ID_V2>.
+As far as these lists are present, they must be nonempty.
+The certificate identified by their first entry must be the first element of
+I<chain>, i.e. the signer certificate.
+Any further certficates referenced in the list must also be found in I<chain>.
+The matching is done using the given certificate hash algorithm and value.
+In addition to the checks required by RFCs 2624 and 5035,
+if the B<issuerSerial> field is included in an B<ESSCertID> or B<ESSCertIDv2>
+it must match the certificate issuer and serial number attributes.
+
+=head1 NOTES
+
+ESS has been defined in RFC 2634, which has been updated in RFC 5035
+(ESS version 2) to support hash algorithms other than SHA-1.
+This is used for TSP (RFC 3161) and CAdES-BES (informational RFC 5126).
+
+=head1 RETURN VALUES
+
+OSSL_ESS_signing_cert_new_init() and OSSL_ESS_signing_cert_v2_new_init()
+return a pointer to the new structure or NULL on malloc failure.
+
+OSSL_ESS_check_signing_certs() returns 1 on success,
+0 if a required certificate cannot be found, -1 on other error.
+
+=head1 SEE ALSO
+
+L<TS_VERIFY_CTX_set_certs(3)>,
+L<CMS_verify(3)>
+
+=head1 HISTORY
+
+OSSL_ESS_signing_cert_new_init(), OSSL_ESS_signing_cert_v2_new_init(), and
+OSSL_ESS_check_signing_certs() were added in OpenSSL 3.0.
+
+=head1 COPYRIGHT
+
+Copyright 2021 The OpenSSL Project Authors. All Rights Reserved.
+
+Licensed under the Apache License 2.0 (the "License").  You may not use
+this file except in compliance with the License.  You can obtain a copy
+in the file LICENSE in the source distribution or at
+L<https://www.openssl.org/source/license.html>.
+
+=cut

diff --git a/doc/man3/TS_VERIFY_CTX_set_certs.pod b/doc/man3/TS_VERIFY_CTX_set_certs.pod
index 26c9a66abc195050c6d711985452082165c5a599..cf6aee192112de9cb2c07a4b8208865a07b90114 100644 (file)
--- a/doc/man3/TS_VERIFY_CTX_set_certs.pod
+++ b/doc/man3/TS_VERIFY_CTX_set_certs.pod
@@ -39,6 +39,10 @@ which takes the same parameters and returns the same result.
 TS_VERIFY_CTX_set_certs() returns the stack of B<X509> certificates the user
 passes in via parameter B<certs>.
 
+=head1 SEE ALSO
+
+L<OSSL_ESS_check_signing_certs(3)>
+
 =head1 HISTORY
 
 The spelling of TS_VERIFY_CTX_set_certs() was corrected in OpenSSL 3.0.0.

diff --git a/include/crypto/ess.h b/include/crypto/ess.h
index 1961e39067b7be968b033b57b00ec38cd37e9093..7a687d47ccc984a1aab526a761bb5f51fc8ea9df 100644 (file)
--- a/include/crypto/ess.h
+++ b/include/crypto/ess.h
@@ -11,27 +11,16 @@
 # define OSSL_CRYPTO_ESS_H
 # pragma once
 
-/* internal ESS related stuff */
+/* internal ESS related functions used for TS */
+/* TODO move these four decls to a new include/crypto/ts.h */
 
 ESS_SIGNING_CERT *ossl_ess_get_signing_cert(const PKCS7_SIGNER_INFO *si);
 int ossl_ess_signing_cert_add(PKCS7_SIGNER_INFO *si, ESS_SIGNING_CERT *sc);
 
-ESS_SIGNING_CERT *ossl_ess_signing_cert_new_init(X509 *signcert,
-                                                 STACK_OF(X509) *certs,
-                                                 int issuer_needed);
-
 ESS_SIGNING_CERT_V2 *ossl_ess_get_signing_cert_v2(const PKCS7_SIGNER_INFO *si);
 int ossl_ess_signing_cert_v2_add(PKCS7_SIGNER_INFO *si, ESS_SIGNING_CERT_V2 *sc);
 
-ESS_SIGNING_CERT_V2 *ossl_ess_signing_cert_v2_new_init(const EVP_MD *hash_alg,
-                                                       X509 *signcert,
-                                                       STACK_OF(X509) *certs,
-                                                       int issuer_needed);
-
-int ossl_ess_check_signing_certs(const ESS_SIGNING_CERT *ss,
-                                 const ESS_SIGNING_CERT_V2 *ssv2,
-                                 const STACK_OF(X509) *chain,
-                                 int require_signing_cert);
+/* internal ESS stuff */
 
 /*-
  * IssuerSerial ::= SEQUENCE {

diff --git a/include/openssl/ess.h.in b/include/openssl/ess.h.in
index 6dd686ba7785b7dca90f676cf98ef1c8415af2d5..c35d8ef82d6a3b5d9ed40bbd464313d7fb773000 100644 (file)
--- a/include/openssl/ess.h.in
+++ b/include/openssl/ess.h.in
@@ -44,7 +44,6 @@ typedef struct ESS_cert_id_v2_st ESS_CERT_ID_V2;
     generate_stack_macros("ESS_CERT_ID_V2");
 -}
 
-
 DECLARE_ASN1_ALLOC_FUNCTIONS(ESS_ISSUER_SERIAL)
 DECLARE_ASN1_ENCODE_FUNCTIONS_only(ESS_ISSUER_SERIAL, ESS_ISSUER_SERIAL)
 DECLARE_ASN1_DUP_FUNCTION(ESS_ISSUER_SERIAL)
@@ -65,6 +64,19 @@ DECLARE_ASN1_ALLOC_FUNCTIONS(ESS_SIGNING_CERT_V2)
 DECLARE_ASN1_ENCODE_FUNCTIONS_only(ESS_SIGNING_CERT_V2, ESS_SIGNING_CERT_V2)
 DECLARE_ASN1_DUP_FUNCTION(ESS_SIGNING_CERT_V2)
 
+ESS_SIGNING_CERT *OSSL_ESS_signing_cert_new_init(const X509 *signcert,
+                                                 const STACK_OF(X509) *certs,
+                                                 int set_issuer_serial);
+ESS_SIGNING_CERT_V2 *OSSL_ESS_signing_cert_v2_new_init(const EVP_MD *hash_alg,
+                                                       const X509 *signcert,
+                                                       const
+                                                       STACK_OF(X509) *certs,
+                                                       int set_issuer_serial);
+int OSSL_ESS_check_signing_certs(const ESS_SIGNING_CERT *ss,
+                                 const ESS_SIGNING_CERT_V2 *ssv2,
+                                 const STACK_OF(X509) *chain,
+                                 int require_signing_cert);
+
 # ifdef  __cplusplus
 }
 # endif

diff --git a/include/openssl/esserr.h b/include/openssl/esserr.h
index 0b9e89e4cb73cac184147787ebc518aa28847416..165ce7c437517080c10f9058b6ab6be947b2eaee 100644 (file)
--- a/include/openssl/esserr.h
+++ b/include/openssl/esserr.h
@@ -16,8 +16,6 @@
 # include <openssl/symhacks.h>
 # include <openssl/cryptoerr_legacy.h>
 
-
-
 /*
  * ESS reason codes.
  */

diff --git a/test/recipes/80-test_cms.t b/test/recipes/80-test_cms.t
index 1837a51bbed33c32d4da82ad8d33c48dbcc33d06..a371f21ad8ee10eed405bb3d25335dc9399a0bd4 100644 (file)
--- a/test/recipes/80-test_cms.t
+++ b/test/recipes/80-test_cms.t
@@ -455,7 +455,7 @@ my @smime_cms_cades_ko_tests = (
       [ @prov, "-sign", "-in", $smcont, "-outform", "DER", "-nodetach",
         "-certfile", catfile($smdir, "smroot.pem"),
         "-signer", catfile($smdir, "smrsa1.pem"), "-out", "{output}.cms" ],
-      "fail to verify token because requiring CAdES-BES compatibility",
+      "fail to verify token since requiring CAdES-BES compatibility",
       [ @prov, "-verify", "-cades", "-in", "{output}.cms", "-inform", "DER",
         "-CAfile", catfile($smdir, "smroot.pem"), "-out", "{output}.txt" ],
       \&final_compare

diff --git a/util/libcrypto.num b/util/libcrypto.num
index f49ebeef45cbc5838b271cc81d37533e07547a9c..dcfc71b13da8869561f11cb3895fcf0a0f6d8870 100644 (file)
--- a/util/libcrypto.num
+++ b/util/libcrypto.num
@@ -5315,6 +5315,9 @@ RAND_set_DRBG_type                      ? 3_0_0   EXIST::FUNCTION:
 RAND_set_seed_source_type               ?      3_0_0   EXIST::FUNCTION:
 BN_mod_exp_mont_consttime_x2            ?      3_0_0   EXIST::FUNCTION:
 BIO_f_readbuffer                        ?      3_0_0   EXIST::FUNCTION:
+OSSL_ESS_check_signing_certs            ?      3_0_0   EXIST::FUNCTION:
+OSSL_ESS_signing_cert_new_init          ?      3_0_0   EXIST::FUNCTION:
+OSSL_ESS_signing_cert_v2_new_init       ?      3_0_0   EXIST::FUNCTION:
 EVP_DigestInit_ex2                      ?      3_0_0   EXIST::FUNCTION:
 EVP_EncryptInit_ex2                     ?      3_0_0   EXIST::FUNCTION:
 EVP_DecryptInit_ex2                     ?      3_0_0   EXIST::FUNCTION: