X-Git-Url: https://git.openssl.org/gitweb/?a=blobdiff_plain;f=crypto%2Fts%2Fts_conf.c;h=6adea58840f0a551bcf67ff3f2c5cec33f56ee89;hb=985c3146967633707f7c165df82bb0fd8f279758;hp=1e511bee75061c58cfe031ea48bacdb8a4faa4b8;hpb=b39fc560612984e65ec30d7f37487303bf514fb3;p=openssl.git

diff --git a/crypto/ts/ts_conf.c b/crypto/ts/ts_conf.c
index 1e511bee75..6adea58840 100644
--- a/crypto/ts/ts_conf.c
+++ b/crypto/ts/ts_conf.c
@@ -1,4 +1,3 @@
-/* crypto/ts/ts_conf.c */
 /*
  * Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL project
  * 2002.
@@ -68,7 +67,6 @@
 #include <openssl/ts.h>
 
 /* Macro definitions for the configuration file. */
-
 #define BASE_SECTION                    "tsa"
 #define ENV_DEFAULT_TSA                 "default_tsa"
 #define ENV_SERIAL                      "serial"
@@ -76,6 +74,7 @@
 #define ENV_SIGNER_CERT                 "signer_cert"
 #define ENV_CERTS                       "certs"
 #define ENV_SIGNER_KEY                  "signer_key"
+#define ENV_SIGNER_DIGEST               "signer_digest"
 #define ENV_DEFAULT_POLICY              "default_policy"
 #define ENV_OTHER_POLICIES              "other_policies"
 #define ENV_DIGESTS                     "digests"
@@ -102,7 +101,7 @@ X509 *TS_CONF_load_cert(const char *file)
     x = PEM_read_bio_X509_AUX(cert, NULL, NULL, NULL);
  end:
     if (x == NULL)
-        fprintf(stderr, "unable to load certificate: %s\n", file);
+        TSerr(TS_F_TS_CONF_LOAD_CERT, TS_R_CANNOT_LOAD_CERT);
     BIO_free(cert);
     return x;
 }
@@ -129,7 +128,7 @@ STACK_OF(X509) *TS_CONF_load_certs(const char *file)
     }
  end:
     if (othercerts == NULL)
-        fprintf(stderr, "unable to load certificates: %s\n", file);
+        TSerr(TS_F_TS_CONF_LOAD_CERTS, TS_R_CANNOT_LOAD_CERT);
     sk_X509_INFO_pop_free(allcerts, X509_INFO_free);
     BIO_free(certs);
     return othercerts;
@@ -145,21 +144,23 @@ EVP_PKEY *TS_CONF_load_key(const char *file, const char *pass)
     pkey = PEM_read_bio_PrivateKey(key, NULL, NULL, (char *)pass);
  end:
     if (pkey == NULL)
-        fprintf(stderr, "unable to load private key: %s\n", file);
+        TSerr(TS_F_TS_CONF_LOAD_KEY, TS_R_CANNOT_LOAD_KEY);
     BIO_free(key);
     return pkey;
 }
 
 /* Function definitions for handling configuration options. */
 
-static void TS_CONF_lookup_fail(const char *name, const char *tag)
+static void ts_CONF_lookup_fail(const char *name, const char *tag)
 {
-    fprintf(stderr, "variable lookup failed for %s::%s\n", name, tag);
+    TSerr(TS_F_TS_CONF_LOOKUP_FAIL, TS_R_VAR_LOOKUP_FAILURE);
+    ERR_add_error_data(3, name, "::", tag);
 }
 
-static void TS_CONF_invalid(const char *name, const char *tag)
+static void ts_CONF_invalid(const char *name, const char *tag)
 {
-    fprintf(stderr, "invalid variable value for %s::%s\n", name, tag);
+    TSerr(TS_F_TS_CONF_INVALID, TS_R_VAR_BAD_VALUE);
+    ERR_add_error_data(3, name, "::", tag);
 }
 
 const char *TS_CONF_get_tsa_section(CONF *conf, const char *section)
@@ -167,7 +168,7 @@ const char *TS_CONF_get_tsa_section(CONF *conf, const char *section)
     if (!section) {
         section = NCONF_get_string(conf, BASE_SECTION, ENV_DEFAULT_TSA);
         if (!section)
-            TS_CONF_lookup_fail(BASE_SECTION, ENV_DEFAULT_TSA);
+            ts_CONF_lookup_fail(BASE_SECTION, ENV_DEFAULT_TSA);
     }
     return section;
 }
@@ -178,7 +179,7 @@ int TS_CONF_set_serial(CONF *conf, const char *section, TS_serial_cb cb,
     int ret = 0;
     char *serial = NCONF_get_string(conf, section, ENV_SERIAL);
     if (!serial) {
-        TS_CONF_lookup_fail(section, ENV_SERIAL);
+        ts_CONF_lookup_fail(section, ENV_SERIAL);
         goto err;
     }
     TS_RESP_CTX_set_serial_cb(ctx, cb, serial);
@@ -199,7 +200,7 @@ int TS_CONF_set_crypto_device(CONF *conf, const char *section,
         device = NCONF_get_string(conf, section, ENV_CRYPTO_DEVICE);
 
     if (device && !TS_CONF_set_default_engine(device)) {
-        TS_CONF_invalid(section, ENV_CRYPTO_DEVICE);
+        ts_CONF_invalid(section, ENV_CRYPTO_DEVICE);
         goto err;
     }
     ret = 1;
@@ -212,20 +213,17 @@ int TS_CONF_set_default_engine(const char *name)
     ENGINE *e = NULL;
     int ret = 0;
 
-    /* Leave the default if builtin specified. */
     if (strcmp(name, "builtin") == 0)
         return 1;
 
     if ((e = ENGINE_by_id(name)) == NULL)
         goto err;
-
-    /* Enable the use of the NCipher HSM for forked children. */
     if (strcmp(name, "chil") == 0)
         ENGINE_ctrl(e, ENGINE_CTRL_CHIL_SET_FORKCHECK, 1, 0, 0);
-    /* All the operations are going to be carried out by the engine. */
     if (!ENGINE_set_default(e, ENGINE_METHOD_ALL))
         goto err;
     ret = 1;
+
  err:
     if (!ret) {
         TSerr(TS_F_TS_CONF_SET_DEFAULT_ENGINE, TS_R_COULD_NOT_SET_ENGINE);
@@ -246,7 +244,7 @@ int TS_CONF_set_signer_cert(CONF *conf, const char *section,
     if (cert == NULL) {
         cert = NCONF_get_string(conf, section, ENV_SIGNER_CERT);
         if (cert == NULL) {
-            TS_CONF_lookup_fail(section, ENV_SIGNER_CERT);
+            ts_CONF_lookup_fail(section, ENV_SIGNER_CERT);
             goto err;
         }
     }
@@ -292,7 +290,7 @@ int TS_CONF_set_signer_key(CONF *conf, const char *section,
     if (!key)
         key = NCONF_get_string(conf, section, ENV_SIGNER_KEY);
     if (!key) {
-        TS_CONF_lookup_fail(section, ENV_SIGNER_KEY);
+        ts_CONF_lookup_fail(section, ENV_SIGNER_KEY);
         goto err;
     }
     if ((key_obj = TS_CONF_load_key(key, pass)) == NULL)
@@ -306,6 +304,30 @@ int TS_CONF_set_signer_key(CONF *conf, const char *section,
     return ret;
 }
 
+int TS_CONF_set_signer_digest(CONF *conf, const char *section,
+                              const char *md, TS_RESP_CTX *ctx)
+{
+    int ret = 0;
+    const EVP_MD *sign_md = NULL;
+    if (md == NULL)
+        md = NCONF_get_string(conf, section, ENV_SIGNER_DIGEST);
+    if (md == NULL) {
+        ts_CONF_lookup_fail(section, ENV_SIGNER_DIGEST);
+        goto err;
+    }
+    sign_md = EVP_get_digestbyname(md);
+    if (sign_md == NULL) {
+        ts_CONF_invalid(section, ENV_SIGNER_DIGEST);
+        goto err;
+    }
+    if (!TS_RESP_CTX_set_signer_digest(ctx, sign_md))
+        goto err;
+
+    ret = 1;
+ err:
+    return ret;
+}
+
 int TS_CONF_set_def_policy(CONF *conf, const char *section,
                            const char *policy, TS_RESP_CTX *ctx)
 {
@@ -314,11 +336,11 @@ int TS_CONF_set_def_policy(CONF *conf, const char *section,
     if (!policy)
         policy = NCONF_get_string(conf, section, ENV_DEFAULT_POLICY);
     if (!policy) {
-        TS_CONF_lookup_fail(section, ENV_DEFAULT_POLICY);
+        ts_CONF_lookup_fail(section, ENV_DEFAULT_POLICY);
         goto err;
     }
     if ((policy_obj = OBJ_txt2obj(policy, 0)) == NULL) {
-        TS_CONF_invalid(section, ENV_DEFAULT_POLICY);
+        ts_CONF_invalid(section, ENV_DEFAULT_POLICY);
         goto err;
     }
     if (!TS_RESP_CTX_set_def_policy(ctx, policy_obj))
@@ -339,7 +361,7 @@ int TS_CONF_set_policies(CONF *conf, const char *section, TS_RESP_CTX *ctx)
 
     /* If no other policy is specified, that's fine. */
     if (policies && (list = X509V3_parse_list(policies)) == NULL) {
-        TS_CONF_invalid(section, ENV_OTHER_POLICIES);
+        ts_CONF_invalid(section, ENV_OTHER_POLICIES);
         goto err;
     }
     for (i = 0; i < sk_CONF_VALUE_num(list); ++i) {
@@ -348,7 +370,7 @@ int TS_CONF_set_policies(CONF *conf, const char *section, TS_RESP_CTX *ctx)
         ASN1_OBJECT *objtmp;
 
         if ((objtmp = OBJ_txt2obj(extval, 0)) == NULL) {
-            TS_CONF_invalid(section, ENV_OTHER_POLICIES);
+            ts_CONF_invalid(section, ENV_OTHER_POLICIES);
             goto err;
         }
         if (!TS_RESP_CTX_add_policy(ctx, objtmp))
@@ -370,15 +392,15 @@ int TS_CONF_set_digests(CONF *conf, const char *section, TS_RESP_CTX *ctx)
     char *digests = NCONF_get_string(conf, section, ENV_DIGESTS);
 
     if (digests == NULL) {
-        TS_CONF_lookup_fail(section, ENV_DIGESTS);
+        ts_CONF_lookup_fail(section, ENV_DIGESTS);
         goto err;
     }
     if ((list = X509V3_parse_list(digests)) == NULL) {
-        TS_CONF_invalid(section, ENV_DIGESTS);
+        ts_CONF_invalid(section, ENV_DIGESTS);
         goto err;
     }
     if (sk_CONF_VALUE_num(list) == 0) {
-        TS_CONF_invalid(section, ENV_DIGESTS);
+        ts_CONF_invalid(section, ENV_DIGESTS);
         goto err;
     }
     for (i = 0; i < sk_CONF_VALUE_num(list); ++i) {
@@ -387,7 +409,7 @@ int TS_CONF_set_digests(CONF *conf, const char *section, TS_RESP_CTX *ctx)
         const EVP_MD *md;
 
         if ((md = EVP_get_digestbyname(extval)) == NULL) {
-            TS_CONF_invalid(section, ENV_DIGESTS);
+            ts_CONF_invalid(section, ENV_DIGESTS);
             goto err;
         }
         if (!TS_RESP_CTX_add_md(ctx, md))
@@ -409,7 +431,7 @@ int TS_CONF_set_accuracy(CONF *conf, const char *section, TS_RESP_CTX *ctx)
     char *accuracy = NCONF_get_string(conf, section, ENV_ACCURACY);
 
     if (accuracy && (list = X509V3_parse_list(accuracy)) == NULL) {
-        TS_CONF_invalid(section, ENV_ACCURACY);
+        ts_CONF_invalid(section, ENV_ACCURACY);
         goto err;
     }
     for (i = 0; i < sk_CONF_VALUE_num(list); ++i) {
@@ -424,7 +446,7 @@ int TS_CONF_set_accuracy(CONF *conf, const char *section, TS_RESP_CTX *ctx)
             if (val->value)
                 micros = atoi(val->value);
         } else {
-            TS_CONF_invalid(section, ENV_ACCURACY);
+            ts_CONF_invalid(section, ENV_ACCURACY);
             goto err;
         }
     }
@@ -450,7 +472,7 @@ int TS_CONF_set_clock_precision_digits(CONF *conf, const char *section,
                             &digits))
         digits = 0;
     if (digits < 0 || digits > TS_MAX_CLOCK_PRECISION_DIGITS) {
-        TS_CONF_invalid(section, ENV_CLOCK_PRECISION_DIGITS);
+        ts_CONF_invalid(section, ENV_CLOCK_PRECISION_DIGITS);
         goto err;
     }
 
@@ -462,16 +484,16 @@ int TS_CONF_set_clock_precision_digits(CONF *conf, const char *section,
     return ret;
 }
 
-static int TS_CONF_add_flag(CONF *conf, const char *section,
+static int ts_CONF_add_flag(CONF *conf, const char *section,
                             const char *field, int flag, TS_RESP_CTX *ctx)
 {
-    /* Default is false. */
     const char *value = NCONF_get_string(conf, section, field);
+
     if (value) {
         if (strcmp(value, ENV_VALUE_YES) == 0)
             TS_RESP_CTX_add_flags(ctx, flag);
         else if (strcmp(value, ENV_VALUE_NO) != 0) {
-            TS_CONF_invalid(section, field);
+            ts_CONF_invalid(section, field);
             return 0;
         }
     }
@@ -481,17 +503,17 @@ static int TS_CONF_add_flag(CONF *conf, const char *section,
 
 int TS_CONF_set_ordering(CONF *conf, const char *section, TS_RESP_CTX *ctx)
 {
-    return TS_CONF_add_flag(conf, section, ENV_ORDERING, TS_ORDERING, ctx);
+    return ts_CONF_add_flag(conf, section, ENV_ORDERING, TS_ORDERING, ctx);
 }
 
 int TS_CONF_set_tsa_name(CONF *conf, const char *section, TS_RESP_CTX *ctx)
 {
-    return TS_CONF_add_flag(conf, section, ENV_TSA_NAME, TS_TSA_NAME, ctx);
+    return ts_CONF_add_flag(conf, section, ENV_TSA_NAME, TS_TSA_NAME, ctx);
 }
 
 int TS_CONF_set_ess_cert_id_chain(CONF *conf, const char *section,
                                   TS_RESP_CTX *ctx)
 {
-    return TS_CONF_add_flag(conf, section, ENV_ESS_CERT_ID_CHAIN,
+    return ts_CONF_add_flag(conf, section, ENV_ESS_CERT_ID_CHAIN,
                             TS_ESS_CERT_ID_CHAIN, ctx);
 }