Commit ca4a494c authored by Rich Salz's avatar Rich Salz Committed by Rich Salz
Browse files

Make TS structures opaque. 



Most of the accessors existed and were already used so it was easy.
TS_VERIFY_CTX didn't have accessors/settors so I added the simple and
obvious ones, and changed the app to use them.  Also, within crypto/ts,
replaced the functions with direct access to the structure members
since we generally aren't opaque within a directory.

Also fix RT3901.

Reviewed-by: default avatarTim Hudson <tjh@openssl.org>
parent 8e704858

apps/ts.c

+13 −10
Original line number Diff line number Diff line
@@ -724,7 +724,7 @@ static TS_RESP *read_PKCS7(BIO *in_bio) 
    /* Create granted status info. */

    if ((si = TS_STATUS_INFO_new()) == NULL)

        goto end;

    if (!(ASN1_INTEGER_set(si->status, TS_STATUS_GRANTED)))

    if (!TS_STATUS_INFO_set_status(si, TS_STATUS_GRANTED))

        goto end;

    if (!TS_RESP_set_status_info(resp, si))

        goto end;
@@ -976,23 +976,24 @@ static TS_VERIFY_CTX *create_verify_ctx(char *data, char *digest, 
    BIO *input = NULL;

    TS_REQ *request = NULL;

    int ret = 0;

    int f = 0;



    if (data != NULL || digest != NULL) {

        if ((ctx = TS_VERIFY_CTX_new()) == NULL)

            goto err;

        ctx->flags = TS_VFY_VERSION | TS_VFY_SIGNER;

        f = TS_VFY_VERSION | TS_VFY_SIGNER;

        if (data != NULL) {

            ctx->flags |= TS_VFY_DATA;

            if ((ctx->data = BIO_new_file(data, "rb")) == NULL)

            f |= TS_VFY_DATA;

            if (TS_VERIFY_CTX_set_data(ctx, BIO_new_file(data, "rb")) == NULL)

                goto err;

        } else if (digest != NULL) {

            long imprint_len;

            ctx->flags |= TS_VFY_IMPRINT;

            if ((ctx->imprint = string_to_hex(digest, &imprint_len)) == NULL) {

            unsigned char *hexstr = string_to_hex(digest, &imprint_len);

            f |= TS_VFY_IMPRINT;

            if (TS_VERIFY_CTX_set_imprint(ctx, hexstr, imprint_len) == NULL) {

                BIO_printf(bio_err, "invalid digest string\n");

                goto err;

            }

            ctx->imprint_len = imprint_len;

        }



    } else if (queryfile != NULL) {
@@ -1010,14 +1011,16 @@ static TS_VERIFY_CTX *create_verify_ctx(char *data, char *digest, 
        return NULL;



    /* Add the signature verification flag and arguments. */

    ctx->flags |= TS_VFY_SIGNATURE;

    TS_VERIFY_CTX_add_flags(ctx, f | TS_VFY_SIGNATURE);



    /* Initialising the X509_STORE object. */

    if ((ctx->store = create_cert_store(CApath, CAfile)) == NULL)

    if (TS_VERIFY_CTX_set_store(ctx, create_cert_store(CApath, CAfile))

            == NULL)

        goto err;



    /* Loading untrusted certificates. */

    if (untrusted && (ctx->certs = TS_CONF_load_certs(untrusted)) == NULL)

    if (untrusted

        && TS_VERIFY_CTS_set_certs(ctx, TS_CONF_load_certs(untrusted)) == NULL)

        goto err;



    ret = 1;

crypto/ts/Makefile

+9 −9
Original line number Diff line number Diff line
@@ -86,7 +86,7 @@ ts_asn1.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h 
ts_asn1.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h

ts_asn1.o: ../../include/openssl/ts.h ../../include/openssl/x509.h

ts_asn1.o: ../../include/openssl/x509_vfy.h ../../include/openssl/x509v3.h

ts_asn1.o: ts_asn1.c

ts_asn1.o: ts_asn1.c ts_lcl.h

ts_conf.o: ../../e_os.h ../../include/openssl/asn1.h

ts_conf.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h

ts_conf.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
@@ -135,7 +135,7 @@ ts_lib.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h 
ts_lib.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h

ts_lib.o: ../../include/openssl/ts.h ../../include/openssl/x509.h

ts_lib.o: ../../include/openssl/x509_vfy.h ../../include/openssl/x509v3.h

ts_lib.o: ../include/internal/cryptlib.h ts_lib.c

ts_lib.o: ../include/internal/cryptlib.h ts_lcl.h ts_lib.c

ts_req_print.o: ../../e_os.h ../../include/openssl/asn1.h

ts_req_print.o: ../../include/openssl/bio.h ../../include/openssl/bn.h

ts_req_print.o: ../../include/openssl/buffer.h ../../include/openssl/conf.h
@@ -153,7 +153,7 @@ ts_req_print.o: ../../include/openssl/sha.h ../../include/openssl/stack.h 
ts_req_print.o: ../../include/openssl/symhacks.h ../../include/openssl/ts.h

ts_req_print.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h

ts_req_print.o: ../../include/openssl/x509v3.h ../include/internal/cryptlib.h

ts_req_print.o: ts_req_print.c

ts_req_print.o: ts_lcl.h ts_req_print.c

ts_req_utils.o: ../../e_os.h ../../include/openssl/asn1.h

ts_req_utils.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h

ts_req_utils.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
@@ -171,7 +171,7 @@ ts_req_utils.o: ../../include/openssl/sha.h ../../include/openssl/stack.h 
ts_req_utils.o: ../../include/openssl/symhacks.h ../../include/openssl/ts.h

ts_req_utils.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h

ts_req_utils.o: ../../include/openssl/x509v3.h ../include/internal/cryptlib.h

ts_req_utils.o: ts_req_utils.c

ts_req_utils.o: ts_lcl.h ts_req_utils.c

ts_rsp_print.o: ../../e_os.h ../../include/openssl/asn1.h

ts_rsp_print.o: ../../include/openssl/bio.h ../../include/openssl/bn.h

ts_rsp_print.o: ../../include/openssl/buffer.h ../../include/openssl/conf.h
@@ -189,7 +189,7 @@ ts_rsp_print.o: ../../include/openssl/sha.h ../../include/openssl/stack.h 
ts_rsp_print.o: ../../include/openssl/symhacks.h ../../include/openssl/ts.h

ts_rsp_print.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h

ts_rsp_print.o: ../../include/openssl/x509v3.h ../include/internal/cryptlib.h

ts_rsp_print.o: ts_rsp_print.c

ts_rsp_print.o: ts_lcl.h ts_rsp_print.c

ts_rsp_sign.o: ../../e_os.h ../../include/openssl/asn1.h

ts_rsp_sign.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h

ts_rsp_sign.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
@@ -207,7 +207,7 @@ ts_rsp_sign.o: ../../include/openssl/sha.h ../../include/openssl/stack.h 
ts_rsp_sign.o: ../../include/openssl/symhacks.h ../../include/openssl/ts.h

ts_rsp_sign.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h

ts_rsp_sign.o: ../../include/openssl/x509v3.h ../include/internal/cryptlib.h

ts_rsp_sign.o: ts_rsp_sign.c

ts_rsp_sign.o: ts_lcl.h ts_rsp_sign.c

ts_rsp_utils.o: ../../e_os.h ../../include/openssl/asn1.h

ts_rsp_utils.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h

ts_rsp_utils.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
@@ -225,7 +225,7 @@ ts_rsp_utils.o: ../../include/openssl/sha.h ../../include/openssl/stack.h 
ts_rsp_utils.o: ../../include/openssl/symhacks.h ../../include/openssl/ts.h

ts_rsp_utils.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h

ts_rsp_utils.o: ../../include/openssl/x509v3.h ../include/internal/cryptlib.h

ts_rsp_utils.o: ts_rsp_utils.c

ts_rsp_utils.o: ts_lcl.h ts_rsp_utils.c

ts_rsp_verify.o: ../../e_os.h ../../include/openssl/asn1.h

ts_rsp_verify.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h

ts_rsp_verify.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
@@ -243,7 +243,7 @@ ts_rsp_verify.o: ../../include/openssl/sha.h ../../include/openssl/stack.h 
ts_rsp_verify.o: ../../include/openssl/symhacks.h ../../include/openssl/ts.h

ts_rsp_verify.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h

ts_rsp_verify.o: ../../include/openssl/x509v3.h ../include/internal/cryptlib.h

ts_rsp_verify.o: ts_rsp_verify.c

ts_rsp_verify.o: ts_lcl.h ts_rsp_verify.c

ts_verify_ctx.o: ../../e_os.h ../../include/openssl/asn1.h

ts_verify_ctx.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h

ts_verify_ctx.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
@@ -261,4 +261,4 @@ ts_verify_ctx.o: ../../include/openssl/sha.h ../../include/openssl/stack.h 
ts_verify_ctx.o: ../../include/openssl/symhacks.h ../../include/openssl/ts.h

ts_verify_ctx.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h

ts_verify_ctx.o: ../../include/openssl/x509v3.h ../include/internal/cryptlib.h

ts_verify_ctx.o: ts_verify_ctx.c
 
ts_verify_ctx.o: ts_lcl.h ts_verify_ctx.c

crypto/ts/ts_asn1.c

+1 −0
Original line number Diff line number Diff line
@@ -59,6 +59,7 @@ 
#include <openssl/ts.h>

#include <openssl/err.h>

#include <openssl/asn1t.h>

#include "ts_lcl.h"



ASN1_SEQUENCE(TS_MSG_IMPRINT) = {

        ASN1_SIMPLE(TS_MSG_IMPRINT, hash_algo, X509_ALGOR),

crypto/ts/ts_lcl.h

0 → 100644
+230 −0
Original line number Diff line number Diff line 
/* ====================================================================

 * Copyright (c) 2015 The OpenSSL Project.  All rights reserved.

 *

 * Redistribution and use in source and binary forms, with or without

 * modification, are permitted provided that the following conditions

 * are met:

 *

 * 1. Redistributions of source code must retain the above copyright

 *    notice, this list of conditions and the following disclaimer.

 *

 * 2. Redistributions in binary form must reproduce the above copyright

 *    notice, this list of conditions and the following disclaimer in

 *    the documentation and/or other materials provided with the

 *    distribution.

 *

 * 3. All advertising materials mentioning features or use of this

 *    software must display the following acknowledgment:

 *    "This product includes software developed by the OpenSSL Project

 *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"

 *

 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to

 *    endorse or promote products derived from this software without

 *    prior written permission. For written permission, please contact

 *    licensing@OpenSSL.org.

 *

 * 5. Products derived from this software may not be called "OpenSSL"

 *    nor may "OpenSSL" appear in their names without prior written

 *    permission of the OpenSSL Project.

 *

 * 6. Redistributions of any form whatsoever must retain the following

 *    acknowledgment:

 *    "This product includes software developed by the OpenSSL Project

 *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"

 *

 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY

 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR

 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

 * OF THE POSSIBILITY OF SUCH DAMAGE.

 * ====================================================================

 *

 * This product includes cryptographic software written by Eric Young

 * (eay@cryptsoft.com).  This product includes software written by Tim

 * Hudson (tjh@cryptsoft.com).

 *

 */





/*-

 * MessageImprint ::= SEQUENCE  {

 *      hashAlgorithm                AlgorithmIdentifier,

 *      hashedMessage                OCTET STRING  }

 */

struct TS_msg_imprint_st {

    X509_ALGOR *hash_algo;

    ASN1_OCTET_STRING *hashed_msg;

};



/*-

 * TimeStampResp ::= SEQUENCE  {

 *     status                  PKIStatusInfo,

 *     timeStampToken          TimeStampToken     OPTIONAL }

 */

struct TS_resp_st {

    TS_STATUS_INFO *status_info;

    PKCS7 *token;

    TS_TST_INFO *tst_info;

};



/*-

 * TimeStampReq ::= SEQUENCE  {

 *    version                  INTEGER  { v1(1) },

 *    messageImprint           MessageImprint,

 *      --a hash algorithm OID and the hash value of the data to be

 *      --time-stamped

 *    reqPolicy                TSAPolicyId                OPTIONAL,

 *    nonce                    INTEGER                    OPTIONAL,

 *    certReq                  BOOLEAN                    DEFAULT FALSE,

 *    extensions               [0] IMPLICIT Extensions    OPTIONAL  }

 */

struct TS_req_st {

    ASN1_INTEGER *version;

    TS_MSG_IMPRINT *msg_imprint;

    ASN1_OBJECT *policy_id;

    ASN1_INTEGER *nonce;

    ASN1_BOOLEAN cert_req;

    STACK_OF(X509_EXTENSION) *extensions;

};



/*-

 * Accuracy ::= SEQUENCE {

 *                 seconds        INTEGER           OPTIONAL,

 *                 millis     [0] INTEGER  (1..999) OPTIONAL,

 *                 micros     [1] INTEGER  (1..999) OPTIONAL  }

 */

struct TS_accuracy_st {

    ASN1_INTEGER *seconds;

    ASN1_INTEGER *millis;

    ASN1_INTEGER *micros;

};



/*-

 * TSTInfo ::= SEQUENCE  {

 *     version                      INTEGER  { v1(1) },

 *     policy                       TSAPolicyId,

 *     messageImprint               MessageImprint,

 *       -- MUST have the same value as the similar field in

 *       -- TimeStampReq

 *     serialNumber                 INTEGER,

 *      -- Time-Stamping users MUST be ready to accommodate integers

 *      -- up to 160 bits.

 *     genTime                      GeneralizedTime,

 *     accuracy                     Accuracy                 OPTIONAL,

 *     ordering                     BOOLEAN             DEFAULT FALSE,

 *     nonce                        INTEGER                  OPTIONAL,

 *       -- MUST be present if the similar field was present

 *       -- in TimeStampReq.  In that case it MUST have the same value.

 *     tsa                          [0] GeneralName          OPTIONAL,

 *     extensions                   [1] IMPLICIT Extensions  OPTIONAL   }

 */

struct TS_tst_info_st {

    ASN1_INTEGER *version;

    ASN1_OBJECT *policy_id;

    TS_MSG_IMPRINT *msg_imprint;

    ASN1_INTEGER *serial;

    ASN1_GENERALIZEDTIME *time;

    TS_ACCURACY *accuracy;

    ASN1_BOOLEAN ordering;

    ASN1_INTEGER *nonce;

    GENERAL_NAME *tsa;

    STACK_OF(X509_EXTENSION) *extensions;

};



struct TS_status_info_st {

    ASN1_INTEGER *status;

    STACK_OF(ASN1_UTF8STRING) *text;

    ASN1_BIT_STRING *failure_info;

};



DECLARE_STACK_OF(ASN1_UTF8STRING)



/*-

 * IssuerSerial ::= SEQUENCE {

 *         issuer                   GeneralNames,

 *         serialNumber             CertificateSerialNumber

 *         }

 */

struct ESS_issuer_serial {

    STACK_OF(GENERAL_NAME) *issuer;

    ASN1_INTEGER *serial;

};



/*-

 * ESSCertID ::=  SEQUENCE {

 *         certHash                 Hash,

 *         issuerSerial             IssuerSerial OPTIONAL

 * }

 */

struct ESS_cert_id {

    ASN1_OCTET_STRING *hash;    /* Always SHA-1 digest. */

    ESS_ISSUER_SERIAL *issuer_serial;

};



/*-

 * SigningCertificate ::=  SEQUENCE {

 *        certs        SEQUENCE OF ESSCertID,

 *        policies     SEQUENCE OF PolicyInformation OPTIONAL

 * }

 */

struct ESS_signing_cert {

    STACK_OF(ESS_CERT_ID) *cert_ids;

    STACK_OF(POLICYINFO) *policy_info;

};





struct TS_resp_ctx {

    X509 *signer_cert;

    EVP_PKEY *signer_key;

    STACK_OF(X509) *certs;      /* Certs to include in signed data. */

    STACK_OF(ASN1_OBJECT) *policies; /* Acceptable policies. */

    ASN1_OBJECT *default_policy; /* It may appear in policies, too. */

    STACK_OF(EVP_MD) *mds;      /* Acceptable message digests. */

    ASN1_INTEGER *seconds;      /* accuracy, 0 means not specified. */

    ASN1_INTEGER *millis;       /* accuracy, 0 means not specified. */

    ASN1_INTEGER *micros;       /* accuracy, 0 means not specified. */

    unsigned clock_precision_digits; /* fraction of seconds in time stamp

                                      * token. */

    unsigned flags;             /* Optional info, see values above. */

    /* Callback functions. */

    TS_serial_cb serial_cb;

    void *serial_cb_data;       /* User data for serial_cb. */

    TS_time_cb time_cb;

    void *time_cb_data;         /* User data for time_cb. */

    TS_extension_cb extension_cb;

    void *extension_cb_data;    /* User data for extension_cb. */

    /* These members are used only while creating the response. */

    TS_REQ *request;

    TS_RESP *response;

    TS_TST_INFO *tst_info;

};



struct TS_verify_ctx {

    /* Set this to the union of TS_VFY_... flags you want to carry out. */

    unsigned flags;

    /* Must be set only with TS_VFY_SIGNATURE. certs is optional. */

    X509_STORE *store;

    STACK_OF(X509) *certs;

    /* Must be set only with TS_VFY_POLICY. */

    ASN1_OBJECT *policy;

    /*

     * Must be set only with TS_VFY_IMPRINT. If md_alg is NULL, the

     * algorithm from the response is used.

     */

    X509_ALGOR *md_alg;

    unsigned char *imprint;

    unsigned imprint_len;

    /* Must be set only with TS_VFY_DATA. */

    BIO *data;

    /* Must be set only with TS_VFY_TSA_NAME. */

    ASN1_INTEGER *nonce;

    /* Must be set only with TS_VFY_TSA_NAME. */

    GENERAL_NAME *tsa_name;

};

crypto/ts/ts_lib.c

+3 −2
Original line number Diff line number Diff line
@@ -64,6 +64,7 @@ 
#include <openssl/x509.h>

#include <openssl/x509v3.h>

#include <openssl/ts.h>

#include "ts_lcl.h"



/* Local function declarations. */
@@ -135,10 +136,10 @@ int TS_MSG_IMPRINT_print_bio(BIO *bio, TS_MSG_IMPRINT *a) 
{

    ASN1_OCTET_STRING *msg;



    TS_X509_ALGOR_print_bio(bio, TS_MSG_IMPRINT_get_algo(a));

    TS_X509_ALGOR_print_bio(bio, a->hash_algo);



    BIO_printf(bio, "Message data:\n");

    msg = TS_MSG_IMPRINT_get_msg(a);

    msg = a->hashed_msg;

    BIO_dump_indent(bio, (const char *)ASN1_STRING_data(msg),

                    ASN1_STRING_length(msg), 4);