Index: openssl/Configure
diff -u openssl/Configure:1.1.1.10 openssl/Configure:1.1.1.10.2.1
--- openssl/Configure:1.1.1.10	Sun May  8 13:19:54 2005
+++ openssl/Configure	Sun May  8 14:23:46 2005
@@ -1153,6 +1153,7 @@
 		{
 		$cflags = "$shared_cflag $cflags";
 		}
+	$shared_mark = "\$(SHARED_LIBS)";
 	}
 
 if ($sys_id ne "")
Index: openssl/Makefile
diff -u openssl/Makefile:1.1.1.2 openssl/Makefile:1.1.1.2.2.1
--- openssl/Makefile:1.1.1.2	Sun May  8 13:19:53 2005
+++ openssl/Makefile	Sun May  8 14:23:46 2005
@@ -11,11 +11,11 @@
 SHLIB_VERSION_HISTORY=
 SHLIB_MAJOR=0
 SHLIB_MINOR=9.7
-SHLIB_EXT=
-PLATFORM=dist
-OPTIONS= no-krb5
-CONFIGURE_ARGS=dist
-SHLIB_TARGET=
+SHLIB_EXT=.so.$(SHLIB_MAJOR).$(SHLIB_MINOR)
+PLATFORM=linux-pentium
+OPTIONS=shared no-krb5
+CONFIGURE_ARGS=linux-pentium shared
+SHLIB_TARGET=linux-shared
 
 # HERE indicates where this Makefile lives.  This can be used to indicate
 # where sub-Makefiles are expected to be.  Currently has very limited usage,
@@ -59,12 +59,12 @@
 # equal 4.
 # PKCS1_CHECK - pkcs1 tests.
 
-CC= cc
+CC= gcc
 #CFLAG= -DL_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -m486 -Wall -Wuninitialized -DSHA1_ASM -DMD5_ASM -DRMD160_ASM
-CFLAG= -DOPENSSL_NO_KRB5 -O
+CFLAG= -fPIC -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DOPENSSL_NO_KRB5 -DL_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -mcpu=pentium -Wall -DSHA1_ASM -DMD5_ASM -DRMD160_ASM
 DEPFLAG= 
 PEX_LIBS= 
-EX_LIBS= 
+EX_LIBS= -ldl
 EXE_EXT= 
 ARFLAGS= 
 AR=ar $(ARFLAGS) r
@@ -72,7 +72,7 @@
 PERL= /usr/bin/perl
 TAR= tar
 TARFLAGS= --no-recursion
-MAKEDEPPROG=makedepend
+MAKEDEPPROG= gcc
 
 # We let the C compiler driver to take care of .s files. This is done in
 # order to be excused from maintaining a separate set of architecture
@@ -83,7 +83,7 @@
 ASFLAG=$(CFLAG)
 
 # Set BN_ASM to bn_asm.o if you want to use the C version
-BN_ASM= bn_asm.o
+BN_ASM= asm/bn86-elf.o asm/co86-elf.o
 #BN_ASM= bn_asm.o
 #BN_ASM= asm/bn86-elf.o	# elf, linux-elf
 #BN_ASM= asm/bn86-sol.o # solaris
@@ -104,7 +104,7 @@
 # Set DES_ENC to des_enc.o if you want to use the C version
 #There are 4 x86 assember options.
 FIPS_DES_ENC= 
-DES_ENC= des_enc.o fcrypt_b.o
+DES_ENC= asm/dx86-elf.o asm/yx86-elf.o
 #DES_ENC= des_enc.o fcrypt_b.o          # C
 #DES_ENC= asm/dx86-elf.o asm/yx86-elf.o # elf
 #DES_ENC= asm/dx86-sol.o asm/yx86-sol.o # solaris
@@ -113,7 +113,7 @@
 
 # Set BF_ENC to bf_enc.o if you want to use the C version
 #There are 4 x86 assember options.
-BF_ENC= bf_enc.o
+BF_ENC= asm/bx86-elf.o
 #BF_ENC= bf_enc.o
 #BF_ENC= asm/bx86-elf.o # elf
 #BF_ENC= asm/bx86-sol.o # solaris
@@ -131,7 +131,7 @@
 
 # Set RC4_ENC to rc4_enc.o if you want to use the C version
 #There are 4 x86 assember options.
-RC4_ENC= rc4_enc.o
+RC4_ENC= asm/rx86-elf.o
 #RC4_ENC= rc4_enc.o
 #RC4_ENC= asm/rx86-elf.o # elf
 #RC4_ENC= asm/rx86-sol.o # solaris
@@ -140,7 +140,7 @@
 
 # Set RC5_ENC to rc5_enc.o if you want to use the C version
 #There are 4 x86 assember options.
-RC5_ENC= rc5_enc.o
+RC5_ENC= asm/r586-elf.o
 #RC5_ENC= rc5_enc.o
 #RC5_ENC= asm/r586-elf.o # elf
 #RC5_ENC= asm/r586-sol.o # solaris
@@ -148,14 +148,14 @@
 #RC5_ENC= asm/r586bsdi.o # bsdi
 
 # Also need MD5_ASM defined
-MD5_ASM_OBJ= 
+MD5_ASM_OBJ= asm/mx86-elf.o
 #MD5_ASM_OBJ= asm/mx86-elf.o        # elf
 #MD5_ASM_OBJ= asm/mx86-sol.o        # solaris
 #MD5_ASM_OBJ= asm/mx86-out.o        # a.out, FreeBSD
 #MD5_ASM_OBJ= asm/mx86bsdi.o        # bsdi
 
 # Also need SHA1_ASM defined
-SHA1_ASM_OBJ= 
+SHA1_ASM_OBJ= asm/sx86-elf.o
 FIPS_SHA1_ASM_OBJ= 
 #SHA1_ASM_OBJ= asm/sx86-elf.o       # elf
 #SHA1_ASM_OBJ= asm/sx86-sol.o       # solaris
@@ -163,7 +163,7 @@
 #SHA1_ASM_OBJ= asm/sx86bsdi.o       # bsdi
 
 # Also need RMD160_ASM defined
-RMD160_ASM_OBJ= 
+RMD160_ASM_OBJ= asm/rm86-elf.o
 #RMD160_ASM_OBJ= asm/rm86-elf.o       # elf
 #RMD160_ASM_OBJ= asm/rm86-sol.o       # solaris
 #RMD160_ASM_OBJ= asm/rm86-out.o       # a.out, FreeBSD
@@ -175,7 +175,7 @@
 
 # When we're prepared to use shared libraries in the programs we link here
 # we might set SHLIB_MARK to '$(SHARED_LIBS)'.
-SHLIB_MARK=
+SHLIB_MARK=$(SHARED_LIBS)
 
 DIRS=   crypto fips ssl $(SHLIB_MARK) sigs apps test tools
 SHLIBDIRS= crypto ssl
@@ -186,7 +186,8 @@
 	des rc2 rc4 rc5 idea bf cast \
 	bn ec rsa dsa dh dso engine aes \
 	buffer bio stack lhash rand err \
-	evp asn1 pem x509 x509v3 conf txt_db pkcs7 pkcs12 comp ocsp ui krb5
+	evp asn1 pem x509 x509v3 conf txt_db pkcs7 pkcs12 comp ocsp ui krb5 \
+	ts
 
 FDIRS=	sha1 rand des aes dsa rsa dh
 
@@ -210,8 +211,8 @@
 SIGS=	libcrypto.a.sha1
 SHARED_CRYPTO=libcrypto$(SHLIB_EXT)
 SHARED_SSL=libssl$(SHLIB_EXT)
-SHARED_LIBS=
-SHARED_LIBS_LINK_EXTS=
+SHARED_LIBS=$(SHARED_CRYPTO) $(SHARED_SSL)
+SHARED_LIBS_LINK_EXTS=.so.$(SHLIB_MAJOR) .so
 SHARED_LDFLAGS=
 
 GENERAL=        Makefile
Index: openssl/Makefile.org
diff -u openssl/Makefile.org:1.1.1.10 openssl/Makefile.org:1.1.1.10.2.1
--- openssl/Makefile.org:1.1.1.10	Sun May  8 13:19:54 2005
+++ openssl/Makefile.org	Sun May  8 14:23:46 2005
@@ -184,7 +184,8 @@
 	des rc2 rc4 rc5 idea bf cast \
 	bn ec rsa dsa dh dso engine aes \
 	buffer bio stack lhash rand err \
-	evp asn1 pem x509 x509v3 conf txt_db pkcs7 pkcs12 comp ocsp ui krb5
+	evp asn1 pem x509 x509v3 conf txt_db pkcs7 pkcs12 comp ocsp ui krb5 \
+	ts
 
 FDIRS=	sha1 rand des aes dsa rsa dh
 
Index: openssl/apps/Makefile
diff -u openssl/apps/Makefile:1.1.1.2 openssl/apps/Makefile:1.1.1.2.2.1
--- openssl/apps/Makefile:1.1.1.2	Sun May  8 13:19:56 2005
+++ openssl/apps/Makefile	Sun May  8 14:23:52 2005
@@ -36,7 +36,7 @@
 
 PROGRAM= openssl
 
-SCRIPTS=CA.sh CA.pl
+SCRIPTS=CA.sh CA.pl tsget
 
 EXE= $(PROGRAM)$(EXE_EXT)
 
@@ -44,7 +44,7 @@
 	ca crl rsa rsautl dsa dsaparam \
 	x509 genrsa gendsa s_server s_client speed \
 	s_time version pkcs7 crl2pkcs7 sess_id ciphers nseq pkcs12 \
-	pkcs8 spkac smime rand engine ocsp prime
+	pkcs8 spkac smime rand engine ocsp prime ts
 
 PROGS= $(PROGRAM).c
 
@@ -60,14 +60,14 @@
 	rsa.o rsautl.o dsa.o dsaparam.o \
 	x509.o genrsa.o gendsa.o s_server.o s_client.o speed.o \
 	s_time.o $(A_OBJ) $(S_OBJ) $(RAND_OBJ) version.o sess_id.o \
-	ciphers.o nseq.o pkcs12.o pkcs8.o spkac.o smime.o rand.o engine.o ocsp.o prime.o
+	ciphers.o nseq.o pkcs12.o pkcs8.o spkac.o smime.o rand.o engine.o ocsp.o prime.o ts.o
 
 E_SRC=	verify.c asn1pars.c req.c dgst.c dh.c enc.c passwd.c gendh.c errstr.c ca.c \
 	pkcs7.c crl2p7.c crl.c \
 	rsa.c rsautl.c dsa.c dsaparam.c \
 	x509.c genrsa.c gendsa.c s_server.c s_client.c speed.c \
 	s_time.c $(A_SRC) $(S_SRC) $(RAND_SRC) version.c sess_id.c \
-	ciphers.c nseq.c pkcs12.c pkcs8.c spkac.c smime.c rand.c engine.c ocsp.c prime.c
+	ciphers.c nseq.c pkcs12.c pkcs8.c spkac.c smime.c rand.c engine.c ocsp.c prime.c ts.c
 
 SRC=$(E_SRC)
 
@@ -1095,6 +1095,30 @@
 spkac.o: ../include/openssl/symhacks.h ../include/openssl/txt_db.h
 spkac.o: ../include/openssl/ui.h ../include/openssl/ui_compat.h
 spkac.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h apps.h spkac.c
+ts.o: ../e_os.h ../include/openssl/aes.h ../include/openssl/asn1.h
+ts.o: ../include/openssl/bio.h ../include/openssl/blowfish.h
+ts.o: ../include/openssl/bn.h ../include/openssl/buffer.h
+ts.o: ../include/openssl/cast.h ../include/openssl/conf.h
+ts.o: ../include/openssl/crypto.h ../include/openssl/des.h
+ts.o: ../include/openssl/des_old.h ../include/openssl/dh.h
+ts.o: ../include/openssl/dsa.h ../include/openssl/e_os2.h
+ts.o: ../include/openssl/engine.h ../include/openssl/err.h
+ts.o: ../include/openssl/evp.h ../include/openssl/idea.h
+ts.o: ../include/openssl/lhash.h ../include/openssl/md2.h
+ts.o: ../include/openssl/md4.h ../include/openssl/md5.h
+ts.o: ../include/openssl/mdc2.h ../include/openssl/obj_mac.h
+ts.o: ../include/openssl/objects.h ../include/openssl/opensslconf.h
+ts.o: ../include/openssl/opensslv.h ../include/openssl/ossl_typ.h
+ts.o: ../include/openssl/pem.h ../include/openssl/pem2.h
+ts.o: ../include/openssl/pkcs7.h ../include/openssl/rand.h
+ts.o: ../include/openssl/rc2.h ../include/openssl/rc4.h
+ts.o: ../include/openssl/rc5.h ../include/openssl/ripemd.h
+ts.o: ../include/openssl/rsa.h ../include/openssl/safestack.h
+ts.o: ../include/openssl/sha.h ../include/openssl/stack.h
+ts.o: ../include/openssl/symhacks.h ../include/openssl/ts.h
+ts.o: ../include/openssl/txt_db.h ../include/openssl/ui.h
+ts.o: ../include/openssl/ui_compat.h ../include/openssl/x509.h
+ts.o: ../include/openssl/x509_vfy.h ../include/openssl/x509v3.h apps.h ts.c
 verify.o: ../e_os.h ../include/openssl/aes.h ../include/openssl/asn1.h
 verify.o: ../include/openssl/bio.h ../include/openssl/blowfish.h
 verify.o: ../include/openssl/bn.h ../include/openssl/buffer.h
Index: openssl/apps/openssl.cnf
diff -u openssl/apps/openssl.cnf:1.1.1.5 openssl/apps/openssl.cnf:1.1.1.5.2.1
--- openssl/apps/openssl.cnf:1.1.1.5	Sun May  8 13:19:56 2005
+++ openssl/apps/openssl.cnf	Sun May  8 14:23:52 2005
@@ -21,12 +21,17 @@
 
 [ new_oids ]
 
-# We can add new OIDs in here for use by 'ca' and 'req'.
+# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
 # Add a simple OID like this:
 # testoid1=1.2.3.4
 # Or use config file substitution like this:
 # testoid2=${testoid1}.5.6
 
+# Policies used by the TSA examples.
+tsa_policy1 = 1.2.3.4.1
+tsa_policy2 = 1.2.3.4.5.6
+tsa_policy3 = 1.2.3.4.5.7
+
 ####################################################################
 [ ca ]
 default_ca	= CA_default		# The default ca section
@@ -207,6 +212,9 @@
 #nsCaPolicyUrl
 #nsSslServerName
 
+# This is required for TSA certificates.
+extendedKeyUsage = critical,timeStamping
+
 [ v3_req ]
 
 # Extensions to add to a certificate request
@@ -311,3 +319,33 @@
 
 # This really needs to be in place for it to be a proxy certificate.
 proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
+
+####################################################################
+[ tsa ]
+
+default_tsa = tsa_config1	# the default TSA section
+
+[ tsa_config1 ]
+
+# These are used by the TSA reply generation only.
+dir		= ./demoCA		# TSA root directory
+serial		= $dir/tsaserial	# The current serial number (mandatory)
+crypto_device	= builtin		# OpenSSL engine to use for signing
+signer_cert	= $dir/tsacert.pem 	# The TSA signing certificate
+					# (optional)
+certs		= $dir/cacert.pem	# Certificate chain to include in reply
+					# (optional)
+signer_key	= $dir/private/tsakey.pem # The TSA private key (optional)
+
+default_policy	= tsa_policy1		# Policy if request did not specify it
+					# (optional)
+other_policies	= tsa_policy2, tsa_policy3	# acceptable policies (optional)
+digests		= md5, sha1		# Acceptable message digests (mandatory)
+accuracy	= secs:1, millisecs:500, microsecs:100	# (optional)
+clock_precision_digits  = 0	# number of digits after dot. (optional)
+ordering		= yes	# Is ordering defined for timestamps?
+				# (optional, default: no)
+tsa_name		= yes	# Must the TSA name be included in the reply?
+				# (optional, default: no)
+ess_cert_id_chain	= no	# Must the ESS cert id chain be included?
+				# (optional, default: no)
Index: openssl/apps/progs.h
diff -u openssl/apps/progs.h:1.1.1.4 openssl/apps/progs.h:1.1.1.4.4.1
--- openssl/apps/progs.h:1.1.1.4	Mon Nov  8 16:32:19 2004
+++ openssl/apps/progs.h	Sun May  8 14:23:52 2005
@@ -40,6 +40,7 @@
 extern int engine_main(int argc,char *argv[]);
 #endif
 extern int ocsp_main(int argc,char *argv[]);
+extern int ts_main(int argc,char *argv[]);
 
 #define FUNC_TYPE_GENERAL	1
 #define FUNC_TYPE_MD		2
@@ -121,6 +122,7 @@
 	{FUNC_TYPE_GENERAL,"engine",engine_main},
 #endif
 	{FUNC_TYPE_GENERAL,"ocsp",ocsp_main},
+	{FUNC_TYPE_GENERAL,"ts",ts_main},
 #ifndef OPENSSL_NO_MD2
 	{FUNC_TYPE_MD,"md2",dgst_main},
 #endif
Index: openssl/apps/ts.c
diff -u /dev/null openssl/apps/ts.c:1.1.20.1
--- /dev/null	Sun May  8 14:38:23 2005
+++ openssl/apps/ts.c	Sun May  8 14:23:52 2005
@@ -0,0 +1,1143 @@
+/* apps/ts.c */
+/* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL
+ * project 2002.
+ */
+/* ====================================================================
+ * Copyright (c) 2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include "apps.h"
+#include <openssl/bio.h>
+#include <openssl/err.h>
+#include <openssl/pem.h>
+#include <openssl/rand.h>
+#include <openssl/ts.h>
+
+#undef PROG
+#define PROG	ts_main
+
+/* Length of the nonce of the request in bits (must be a multiple of 8). */
+#define	NONCE_LENGTH		64
+
+/* Macro definitions for the configuration file. */
+#define	ENV_OID_FILE		"oid_file"
+
+/* Local function declarations. */
+
+static ASN1_OBJECT *txt2obj(const char *oid);
+static CONF *load_config_file(const char *configfile);
+
+/* Query related functions. */
+static int query_command(const char *data, char *digest,
+			 const EVP_MD *md, const char *policy, int no_nonce, 
+			 int cert, const char *in, const char *out, int text);
+static BIO *BIO_open_with_default(const char *file, const char *mode, 
+				  FILE *default_fp);
+static TS_REQ *create_query(BIO *data_bio, char *digest, const EVP_MD *md,
+			    const char *policy, int no_nonce, int cert);
+static int create_digest(BIO *input, char *digest,
+			 const EVP_MD *md, unsigned char **md_value);
+static ASN1_INTEGER *create_nonce(int bits);
+
+/* Reply related functions. */
+static int reply_command(CONF *conf, char *section, char *engine, 
+			 char *queryfile, char *passin, char *inkey, 
+			 char *signer, char *chain, const char *policy, 
+			 char *in, int token_in, char *out, int token_out,
+			 int text);
+static TS_RESP *read_PKCS7(BIO *in_bio);
+static TS_RESP *create_response(CONF *conf, const char *section, char *engine,
+				char *queryfile, char *passin, char *inkey,
+				char *signer, char *chain, const char *policy);
+static ASN1_INTEGER * MS_CALLBACK serial_cb(TS_RESP_CTX *ctx, void *data);
+static ASN1_INTEGER *next_serial(const char *serialfile);
+static int save_ts_serial(const char *serialfile, ASN1_INTEGER *serial);
+
+/* Verify related functions. */
+static int verify_command(char *data, char *digest, char *queryfile,
+			  char *in, int token_in,
+			  char *ca_path, char *ca_file, char *untrusted);
+static TS_VERIFY_CTX *create_verify_ctx(char *data, char *digest, 
+					char *queryfile, 
+					char *ca_path, char *ca_file,
+					char *untrusted);
+static X509_STORE *create_cert_store(char *ca_path, char *ca_file);
+static int MS_CALLBACK verify_cb(int ok, X509_STORE_CTX *ctx);
+
+/* Main function definition. */
+
+int MAIN(int argc, char **argv)
+	{
+	int ret = 1;
+	char *configfile = NULL;
+	char *section = NULL;
+	CONF *conf = NULL;
+	enum mode {
+	CMD_NONE, CMD_QUERY, CMD_REPLY, CMD_VERIFY 
+	} mode = CMD_NONE;
+	char *data = NULL;
+	char *digest = NULL;
+	const EVP_MD *md = NULL;
+	char *rnd = NULL;
+	char *policy = NULL;
+	int no_nonce = 0;
+	int cert = 0;
+	char *in = NULL;
+	char *out = NULL;
+	int text = 0;
+	char *queryfile = NULL;
+	char *passin = NULL;	/* Password source. */
+	char *password =NULL;	/* Password itself. */
+	char *inkey = NULL;
+	char *signer = NULL;
+	char *chain = NULL;
+	char *ca_path = NULL;
+	char *ca_file = NULL;
+	char *untrusted = NULL;
+	char *engine = NULL;
+	/* Input is ContentInfo instead of TimeStampResp. */
+	int token_in = 0;	
+	/* Output is ContentInfo instead of TimeStampResp. */
+	int token_out = 0;
+	int free_bio_err = 0;
+
+	ERR_load_crypto_strings();
+	apps_startup();
+
+	if (bio_err == NULL && (bio_err = BIO_new(BIO_s_file())) != NULL)
+		{
+		free_bio_err = 1;
+		BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
+		}
+
+	for (argc--, argv++; argc > 0; argc--, argv++)
+		{
+		if (strcmp(*argv, "-config") == 0)
+			{
+			if (argc-- < 1) goto usage;
+			configfile = *++argv;
+			}
+		else if (strcmp(*argv, "-section") == 0)
+			{
+			if (argc-- < 1) goto usage;
+			section = *++argv;
+			}
+		else if (strcmp(*argv, "-query") == 0)
+			{
+			if (mode != CMD_NONE) goto usage;
+			mode = CMD_QUERY;
+			}
+		else if (strcmp(*argv, "-data") == 0)
+			{
+			if (argc-- < 1) goto usage;
+			data = *++argv;
+			}
+		else if (strcmp(*argv, "-digest") == 0)
+			{
+			if (argc-- < 1) goto usage;
+			digest = *++argv;
+			}
+		else if (strcmp(*argv, "-md2") == 0
+			|| strcmp(*argv, "-md4") == 0
+			|| strcmp(*argv, "-md5") == 0
+			|| strcmp(*argv, "-sha") == 0
+			|| strcmp(*argv, "-sha1") == 0
+			|| strcmp(*argv, "-mdc2") == 0
+			|| strcmp(*argv, "-ripemd160") == 0)
+			{
+			md = EVP_get_digestbyname(*argv + 1);
+			}
+		else if (strcmp(*argv, "-rand") == 0)
+			{
+			if (argc-- < 1) goto usage;
+			rnd = *++argv;
+			}
+		else if (strcmp(*argv, "-policy") == 0)
+			{
+			if (argc-- < 1) goto usage;
+			policy = *++argv;
+			}
+		else if (strcmp(*argv, "-no_nonce") == 0)
+			{
+			no_nonce = 1;
+			}
+		else if (strcmp(*argv, "-cert") == 0)
+			{
+			cert = 1;
+			}
+		else if (strcmp(*argv, "-in") == 0)
+			{
+			if (argc-- < 1) goto usage;
+			in = *++argv;
+			}
+		else if (strcmp(*argv, "-token_in") == 0)
+			{
+			token_in = 1;
+			}
+		else if (strcmp(*argv, "-out") == 0)
+			{
+			if (argc-- < 1) goto usage;
+			out = *++argv;
+			}
+		else if (strcmp(*argv, "-token_out") == 0)
+			{
+			token_out = 1;
+			}
+		else if (strcmp(*argv, "-text") == 0)
+			{
+			text = 1;
+			}
+		else if (strcmp(*argv, "-reply") == 0)
+			{
+			if (mode != CMD_NONE) goto usage;
+			mode = CMD_REPLY;
+			}
+		else if (strcmp(*argv, "-queryfile") == 0)
+			{
+			if (argc-- < 1) goto usage;
+			queryfile = *++argv;
+			}
+		else if (strcmp(*argv, "-passin") == 0)
+			{
+			if (argc-- < 1) goto usage;
+			passin = *++argv;
+			}
+		else if (strcmp(*argv, "-inkey") == 0)
+			{
+			if (argc-- < 1) goto usage;
+			inkey = *++argv;
+			}
+		else if (strcmp(*argv, "-signer") == 0)
+			{
+			if (argc-- < 1) goto usage;
+			signer = *++argv;
+			}
+		else if (strcmp(*argv, "-chain") == 0)
+			{
+			if (argc-- < 1) goto usage;
+			chain = *++argv;
+			}
+		else if (strcmp(*argv, "-verify") == 0)
+			{
+			if (mode != CMD_NONE) goto usage;
+			mode = CMD_VERIFY;
+			}
+		else if (strcmp(*argv, "-CApath") == 0)
+			{
+			if (argc-- < 1) goto usage;
+			ca_path = *++argv;
+			}
+		else if (strcmp(*argv, "-CAfile") == 0)
+			{
+			if (argc-- < 1) goto usage;
+			ca_file = *++argv;
+			}
+		else if (strcmp(*argv, "-untrusted") == 0)
+			{
+			if (argc-- < 1) goto usage;
+			untrusted = *++argv;
+			}
+		else if (strcmp(*argv, "-engine") == 0)
+			{
+			if (argc-- < 1) goto usage;
+			engine = *++argv;
+			}
+		else
+			goto usage;
+		}
+	
+	/* Seed the random number generator if it is going to be used. */
+	if (mode == CMD_QUERY && !no_nonce)
+		{
+		if (!app_RAND_load_file(NULL, bio_err, 1) && rnd == NULL)
+			BIO_printf(bio_err, "warning, not much extra random "
+				   "data, consider using the -rand option\n");
+		if (rnd != NULL)
+			BIO_printf(bio_err,"%ld semi-random bytes loaded\n",
+				   app_RAND_load_files(rnd));
+		}
+
+	/* Get the password if required. */
+	if(mode == CMD_REPLY && passin &&
+	   !app_passwd(bio_err, passin, NULL, &password, NULL))
+		{
+		BIO_printf(bio_err,"Error getting password.\n");
+		goto cleanup;
+		}
+
+	/* Check consistency of parameters and execute 
+	   the appropriate function. */
+	switch (mode)
+		{
+	case CMD_NONE:
+		goto usage;
+	case CMD_QUERY:
+		/* Data file and message imprint cannot be specified
+		   at the same time. */
+		ret = data != NULL && digest != NULL;
+		if (ret) goto usage;
+		/* Load the config file for possible policy OIDs. */
+		conf = load_config_file(configfile);
+		ret = !query_command(data, digest, md, policy, no_nonce, cert,
+				     in, out, text);
+		break;
+	case CMD_REPLY:
+		conf = load_config_file(configfile);
+		if (in == NULL)
+			{
+			ret = !(queryfile != NULL && conf != NULL && !token_in);
+			if (ret) goto usage;
+			}
+		else
+			{
+			/* 'in' and 'queryfile' are exclusive. */
+			ret = !(queryfile == NULL);
+			if (ret) goto usage;
+			}
+
+		ret = !reply_command(conf, section, engine, queryfile, 
+				     password, inkey, signer, chain, policy, 
+				     in, token_in, out, token_out, text);
+		break;
+	case CMD_VERIFY:
+		ret = !(((queryfile && !data && !digest)
+			 || (!queryfile && data && !digest)
+			 || (!queryfile && !data && digest))
+			&& in != NULL);
+		if (ret) goto usage;
+
+		ret = !verify_command(data, digest, queryfile, in, token_in,
+				      ca_path, ca_file, untrusted);
+		}
+
+	goto cleanup;
+
+ usage:
+	BIO_printf(bio_err, "usage:\n"
+		   "ts -query [-rand file%cfile%c...] [-config configfile] "
+		   "[-data file_to_hash] [-digest digest_bytes]"
+		   "[-md2|-md4|-md5|-sha|-sha1|-mdc2|-ripemd160] "
+		   "[-policy object_id] [-no_nonce] [-cert] "
+		   "[-in request.tsq] [-out request.tsq] [-text]\n",
+		   LIST_SEPARATOR_CHAR, LIST_SEPARATOR_CHAR);
+	BIO_printf(bio_err, "or\n"
+		   "ts -reply [-config configfile] [-section tsa_section] "
+		   "[-queryfile request.tsq] [-passin password] "
+		   "[-signer tsa_cert.pem] [-inkey private_key.pem] "
+		   "[-chain certs_file.pem] [-policy object_id] "
+		   "[-in response.tsr] [-token_in] "
+		   "[-out response.tsr] [-token_out] [-text] [-engine id]\n");
+	BIO_printf(bio_err, "or\n"
+		   "ts -verify [-data file_to_hash] [-digest digest_bytes] "
+		   "[-queryfile request.tsq] "
+		   "-in response.tsr [-token_in] "
+		   "-CApath ca_path -CAfile ca_file.pem "
+		   "-untrusted cert_file.pem\n");
+ cleanup:
+	/* Clean up. */
+	app_RAND_write_file(NULL, bio_err);
+	NCONF_free(conf);
+	OPENSSL_free(password);
+	OBJ_cleanup();
+	if (free_bio_err)
+		{
+		BIO_free_all(bio_err);
+		bio_err = NULL;
+		}
+
+	OPENSSL_EXIT(ret);
+	}
+
+/*
+ * Configuration file-related function definitions.
+ */
+
+static ASN1_OBJECT *txt2obj(const char *oid)
+	{
+	ASN1_OBJECT *oid_obj = NULL;
+
+	if (!(oid_obj = OBJ_txt2obj(oid, 0)))
+		BIO_printf(bio_err, "cannot convert %s to OID\n", oid);
+
+	return oid_obj;
+	}
+
+static CONF *load_config_file(const char *configfile)
+	{
+	CONF *conf = NULL;
+	long errorline = -1;
+
+	if (!configfile) configfile = getenv("OPENSSL_CONF");
+	if (!configfile) configfile = getenv("SSLEAY_CONF");
+
+	if (configfile &&
+	    (!(conf = NCONF_new(NULL)) ||
+	     NCONF_load(conf, configfile, &errorline) <= 0))
+		{
+		if (errorline <= 0)
+			BIO_printf(bio_err, "error loading the config file "
+				   "'%s'\n", configfile);
+		else
+			BIO_printf(bio_err, "error on line %ld of config file "
+				   "'%s'\n", errorline, configfile);
+		}
+
+	if (conf != NULL)
+		{
+		const char *p;
+
+		BIO_printf(bio_err,"Using configuration from %s\n", configfile);
+		p = NCONF_get_string(conf, NULL, ENV_OID_FILE);
+		if (p != NULL)
+			{
+			BIO *oid_bio = BIO_new_file(p, "r");
+			if (!oid_bio) 
+				ERR_print_errors(bio_err);
+			else
+				{
+				OBJ_create_objects(oid_bio);
+				BIO_free_all(oid_bio);
+				}
+			}
+		else
+			ERR_clear_error();
+		if(!add_oid_section(bio_err, conf)) 
+			ERR_print_errors(bio_err);
+		}
+	return conf;
+	}
+
+/*
+ * Query-related method definitions.
+ */
+
+static int query_command(const char *data, char *digest, const EVP_MD *md,
+			 const char *policy, int no_nonce, 
+			 int cert, const char *in, const char *out, int text)
+	{
+	int ret = 0;
+	TS_REQ *query = NULL;
+	BIO *in_bio = NULL;
+	BIO *data_bio = NULL;
+	BIO *out_bio = NULL;
+
+	/* Build query object either from file or from scratch. */
+	if (in != NULL)
+		{
+		if ((in_bio = BIO_new_file(in, "rb")) == NULL) goto end;
+		query = d2i_TS_REQ_bio(in_bio, NULL);
+		}
+	else
+		{
+		/* Open the file if no explicit digest bytes were specified. */
+		if (!digest 
+		    && !(data_bio = BIO_open_with_default(data, "rb", stdin)))
+			goto end;
+		/* Creating the query object. */
+		query = create_query(data_bio, digest, md,
+				     policy, no_nonce, cert);
+		/* Saving the random number generator state. */
+		}
+	if (query == NULL) goto end;
+
+	/* Write query either in ASN.1 or in text format. */
+	if ((out_bio = BIO_open_with_default(out, "wb", stdout)) == NULL)
+		goto end;
+	if (text)
+		{
+		/* Text output. */
+		if (!TS_REQ_print_bio(out_bio, query))
+			goto end;
+		}
+	else
+		{
+		/* ASN.1 output. */
+		if (!i2d_TS_REQ_bio(out_bio, query))
+			goto end;
+		}
+
+	ret = 1;
+
+ end:
+	ERR_print_errors(bio_err);
+
+	/* Clean up. */
+	BIO_free_all(in_bio);
+	BIO_free_all(data_bio);
+	BIO_free_all(out_bio);
+	TS_REQ_free(query);
+
+	return ret;
+	}
+
+static BIO *BIO_open_with_default(const char *file, const char *mode, 
+				  FILE *default_fp)
+	{
+	return file == NULL ? 
+		BIO_new_fp(default_fp, BIO_NOCLOSE) 
+		: BIO_new_file(file, mode);
+	}
+
+static TS_REQ *create_query(BIO *data_bio, char *digest, const EVP_MD *md,
+			    const char *policy, int no_nonce, int cert)
+	{
+	int ret = 0;
+	TS_REQ *ts_req = NULL;
+	int len;
+	TS_MSG_IMPRINT *msg_imprint = NULL;
+	X509_ALGOR *algo = NULL;
+	unsigned char *data = NULL;
+	ASN1_OBJECT *policy_obj = NULL;
+	ASN1_INTEGER *nonce_asn1 = NULL;
+
+	/* Setting default message digest. */
+	if (!md && !(md = EVP_get_digestbyname("sha1"))) goto err;
+
+	/* Creating request object. */
+	if (!(ts_req = TS_REQ_new())) goto err;
+
+	/* Setting version. */
+	if (!TS_REQ_set_version(ts_req, 1)) goto err;
+
+	/* Creating and adding MSG_IMPRINT object. */
+	if (!(msg_imprint = TS_MSG_IMPRINT_new())) goto err;
+
+	/* Adding algorithm. */
+	if (!(algo = X509_ALGOR_new())) goto err;
+	if (!(algo->algorithm = OBJ_nid2obj(EVP_MD_type(md)))) goto err;
+	if (!(algo->parameter = ASN1_TYPE_new())) goto err;
+	algo->parameter->type = V_ASN1_NULL;
+	if (!TS_MSG_IMPRINT_set_algo(msg_imprint, algo)) goto err;
+
+	/* Adding message digest. */
+	if ((len = create_digest(data_bio, digest, md, &data)) == 0)
+		goto err;
+	if (!TS_MSG_IMPRINT_set_msg(msg_imprint, data, len)) goto err;
+
+	if (!TS_REQ_set_msg_imprint(ts_req, msg_imprint)) goto err;
+	
+	/* Setting policy if requested. */
+	if (policy && !(policy_obj = txt2obj(policy))) goto err;
+	if (policy_obj && !TS_REQ_set_policy_id(ts_req, policy_obj)) goto err;
+
+	/* Setting nonce if requested. */
+	if (!no_nonce && !(nonce_asn1 = create_nonce(NONCE_LENGTH))) goto err;
+	if (nonce_asn1 && !TS_REQ_set_nonce(ts_req, nonce_asn1)) goto err;
+
+	/* Setting certificate request flag if requested. */
+	if (!TS_REQ_set_cert_req(ts_req, cert)) goto err;
+
+	ret = 1;
+ err:
+	if (!ret)
+		{
+		TS_REQ_free(ts_req);
+		ts_req = NULL;
+		BIO_printf(bio_err, "could not create query\n");
+		}
+	TS_MSG_IMPRINT_free(msg_imprint);
+	X509_ALGOR_free(algo);
+	OPENSSL_free(data);
+	ASN1_OBJECT_free(policy_obj);
+	ASN1_INTEGER_free(nonce_asn1);
+	return ts_req;
+	}
+
+static int create_digest(BIO *input, char *digest, const EVP_MD *md,
+			 unsigned char **md_value)
+	{
+	int md_value_len;
+
+	md_value_len = EVP_MD_size(md);
+	if (input)
+		{
+		/* Digest must be computed from an input file. */
+		EVP_MD_CTX md_ctx;
+		unsigned char buffer[4096];
+		int length;
+
+		*md_value = OPENSSL_malloc(md_value_len);
+		if (*md_value == 0) goto err;
+
+		EVP_DigestInit(&md_ctx, md);
+		while ((length = BIO_read(input, buffer, sizeof(buffer))) > 0)
+			{
+			EVP_DigestUpdate(&md_ctx, buffer, length);
+			}
+		EVP_DigestFinal(&md_ctx, *md_value, NULL);
+		}
+	else
+		{
+		/* Digest bytes are specified with digest. */
+		long digest_len;
+		*md_value = string_to_hex(digest, &digest_len);
+		if (!*md_value || md_value_len != digest_len)
+			{
+			OPENSSL_free(*md_value);
+			*md_value = NULL;
+			BIO_printf(bio_err, "bad digest, %d bytes "
+				   "must be specified\n", md_value_len);
+			goto err;
+			}
+		}
+
+	return md_value_len;
+ err:
+	return 0;
+	}
+
+static ASN1_INTEGER *create_nonce(int bits)
+	{
+	unsigned char buf[20];
+	ASN1_INTEGER *nonce = NULL;
+	int len = (bits - 1) / 8 + 1;
+	int i;
+
+	/* Generating random byte sequence. */
+	if (len > (int)sizeof(buf)) goto err;
+	if (!RAND_bytes(buf, len)) goto err;
+
+	/* Find the first non-zero byte and creating ASN1_INTEGER object. */
+	for (i = 0; i < len && !buf[i]; ++i);
+	if (!(nonce = ASN1_INTEGER_new())) goto err;
+	OPENSSL_free(nonce->data);
+	/* Allocate at least one byte. */
+	nonce->length = len - i;
+	if (!(nonce->data = OPENSSL_malloc(nonce->length + 1))) goto err;
+	memcpy(nonce->data, buf + i, nonce->length);
+
+	return nonce;
+ err:
+	BIO_printf(bio_err, "could not create nonce\n");
+	ASN1_INTEGER_free(nonce);
+	return NULL;
+	}
+/*
+ * Reply-related method definitions.
+ */
+
+static int reply_command(CONF *conf, char *section, char *engine, 
+			 char *queryfile, char *passin, char *inkey,
+			 char *signer, char *chain, const char *policy, 
+			 char *in, int token_in,
+			 char *out, int token_out, int text)
+	{
+	int ret = 0;
+	TS_RESP *response = NULL;
+	BIO *in_bio = NULL;
+	BIO *query_bio = NULL;
+	BIO *inkey_bio = NULL;
+	BIO *signer_bio = NULL;
+	BIO *out_bio = NULL;
+
+	/* Build response object either from response or query. */
+	if (in != NULL)
+		{
+		if ((in_bio = BIO_new_file(in, "rb")) == NULL) goto end;
+		if (token_in)
+			{
+			/* We have a ContentInfo (PKCS7) object, add
+			   'granted' status info around it. */
+			response = read_PKCS7(in_bio);
+			}
+		else
+			{
+			/* We have a ready-made TS_RESP object. */
+			response = d2i_TS_RESP_bio(in_bio, NULL);
+			}
+		}
+	else
+		{
+		response = create_response(conf, section, engine, queryfile,
+					   passin, inkey, signer, chain,
+					   policy);
+		if (response)
+			BIO_printf(bio_err, "Response has been generated.\n");
+		else
+			BIO_printf(bio_err, "Response is not generated.\n");
+		}
+	if (response == NULL) goto end;
+
+	/* Write response either in ASN.1 or text format. */
+	if ((out_bio = BIO_open_with_default(out, "wb", stdout)) == NULL)
+		goto end;
+	if (text)
+		{
+		/* Text output. */
+		if (token_out)
+			{
+			TS_TST_INFO *tst_info = TS_RESP_get_tst_info(response);
+			if (!TS_TST_INFO_print_bio(out_bio, tst_info)) goto end;
+			}
+		else
+			{
+			if (!TS_RESP_print_bio(out_bio, response)) goto end;
+			}
+		}
+	else
+		{
+		/* ASN.1 DER output. */
+		if (token_out)
+			{
+			PKCS7 *token = TS_RESP_get_token(response);
+			if (!i2d_PKCS7_bio(out_bio, token)) goto end;
+			}
+		else
+			{
+			if (!i2d_TS_RESP_bio(out_bio, response)) goto end;
+			}
+		}
+
+	ret = 1;
+
+ end:
+	ERR_print_errors(bio_err);
+
+	/* Clean up. */
+	BIO_free_all(in_bio);
+	BIO_free_all(query_bio);
+	BIO_free_all(inkey_bio);
+	BIO_free_all(signer_bio);
+	BIO_free_all(out_bio);
+	TS_RESP_free(response);
+
+	return ret;
+	}
+
+/* Reads a PKCS7 token and adds default 'granted' status info to it. */
+static TS_RESP *read_PKCS7(BIO *in_bio)
+	{
+	int ret = 0;
+	PKCS7 *token = NULL;
+	TS_TST_INFO *tst_info = NULL;
+	TS_RESP *resp = NULL;
+	TS_STATUS_INFO *si = NULL;
+
+	/* Read PKCS7 object and extract the signed time stamp info. */
+	if (!(token = d2i_PKCS7_bio(in_bio, NULL))) goto end;
+	if (!(tst_info = PKCS7_to_TS_TST_INFO(token))) goto end;
+
+	/* Creating response object. */
+	if (!(resp = TS_RESP_new())) goto end;
+
+	/* Create granted status info. */
+	if (!(si = TS_STATUS_INFO_new())) goto end;
+	if (!(ASN1_INTEGER_set(si->status, TS_STATUS_GRANTED))) goto end;
+	if (!TS_RESP_set_status_info(resp, si)) goto end;
+
+	/* Setting encapsulated token. */
+	TS_RESP_set_tst_info(resp, token, tst_info);
+	token = NULL;		/* Ownership is lost. */
+	tst_info = NULL;	/* Ownership is lost. */
+
+	ret = 1;
+ end:
+	PKCS7_free(token);
+	TS_TST_INFO_free(tst_info);
+	if (!ret)
+		{
+		TS_RESP_free(resp);
+		resp = NULL;
+		}
+	TS_STATUS_INFO_free(si);
+	return resp;
+	}
+
+static TS_RESP *create_response(CONF *conf, const char *section, char *engine, 
+				char *queryfile, char *passin, char *inkey,
+				char *signer, char *chain, const char *policy)
+	{
+	int ret = 0;
+	TS_RESP *response = NULL;
+	BIO *query_bio = NULL;
+	TS_RESP_CTX *resp_ctx = NULL;
+
+	if (!(query_bio = BIO_new_file(queryfile, "rb")))
+		goto end;
+
+	/* Getting TSA configuration section. */
+	if (!(section = TS_CONF_get_tsa_section(conf, section)))
+		goto end;
+
+	/* Setting up response generation context. */
+	if (!(resp_ctx = TS_RESP_CTX_new())) goto end;
+
+	/* Setting serial number provider callback. */
+	if (!TS_CONF_set_serial(conf, section, serial_cb, resp_ctx)) goto end;
+
+	/* Setting default OpenSSL engine. */
+	if (!TS_CONF_set_crypto_device(conf, section, engine)) goto end;
+
+	/* Setting TSA signer certificate. */
+	if (!TS_CONF_set_signer_cert(conf, section, signer, resp_ctx)) goto end;
+
+	/* Setting TSA signer certificate chain. */
+	if (!TS_CONF_set_certs(conf, section, chain, resp_ctx)) goto end;
+
+	/* Setting TSA signer private key. */
+	if (!TS_CONF_set_signer_key(conf, section, inkey, passin, resp_ctx))
+		goto end;
+
+	/* Setting default policy OID. */
+	if (!TS_CONF_set_def_policy(conf, section, policy, resp_ctx)) goto end;
+
+	/* Setting acceptable policy OIDs. */
+	if (!TS_CONF_set_policies(conf, section, resp_ctx)) goto end;
+
+	/* Setting the acceptable one-way hash algorithms. */
+	if (!TS_CONF_set_digests(conf, section, resp_ctx)) goto end;
+
+	/* Setting guaranteed time stamp accuracy. */
+	if (!TS_CONF_set_accuracy(conf, section, resp_ctx)) goto end;
+
+	/* Setting the precision of the time. */
+	if (!TS_CONF_set_clock_precision_digits(conf, section, resp_ctx))
+		goto end;
+
+	/* Setting the ordering flaf if requested. */
+	if (!TS_CONF_set_ordering(conf, section, resp_ctx)) goto end;
+
+	/* Setting the TSA name required flag if requested. */
+	if (!TS_CONF_set_tsa_name(conf, section, resp_ctx)) goto end;
+
+	/* Setting the ESS cert id chain flag if requested. */
+	if (!TS_CONF_set_ess_cert_id_chain(conf, section, resp_ctx)) goto end;
+
+	/* Creating the response. */
+	if (!(response = TS_RESP_create_response(resp_ctx, query_bio)))
+		goto end;
+
+	ret = 1;
+ end:
+	if (!ret) 
+		{
+		TS_RESP_free(response);
+		response = NULL;
+		}
+	TS_RESP_CTX_free(resp_ctx);
+	BIO_free_all(query_bio);
+
+	return response;
+	}
+
+static ASN1_INTEGER * MS_CALLBACK serial_cb(TS_RESP_CTX *ctx, void *data)
+	{
+	const char *serial_file = (const char *) data;
+	ASN1_INTEGER *serial = next_serial(serial_file);
+
+	if (!serial)
+		{
+		TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
+					    "Error during serial number "
+					    "generation.");
+		TS_RESP_CTX_add_failure_info(ctx,
+					     TS_INFO_ADD_INFO_NOT_AVAILABLE);
+		}
+	else
+		save_ts_serial(serial_file, serial);
+
+	return serial;
+	}
+
+static ASN1_INTEGER *next_serial(const char *serialfile)
+	{
+	int ret = 0;
+	BIO *in = NULL;
+	ASN1_INTEGER *serial = NULL;
+	BIGNUM *bn = NULL;
+
+	if (!(serial = ASN1_INTEGER_new())) goto err;
+
+	if (!(in = BIO_new_file(serialfile, "r"))) 
+		{
+		ERR_clear_error();
+		BIO_printf(bio_err, "Warning: could not open file %s for "
+			   "reading, using serial number: 1\n", serialfile);
+		if (!ASN1_INTEGER_set(serial, 1)) goto err;
+		}
+	else
+		{
+		char buf[1024];
+		if (!a2i_ASN1_INTEGER(in, serial, buf, sizeof(buf)))
+			{
+			BIO_printf(bio_err, "unable to load number from %s\n",
+				   serialfile);
+			goto err;
+			}
+		if (!(bn = ASN1_INTEGER_to_BN(serial, NULL))) goto err;
+		ASN1_INTEGER_free(serial);
+		serial = NULL;
+		if (!BN_add_word(bn, 1)) goto err;
+		if (!(serial = BN_to_ASN1_INTEGER(bn, NULL))) goto err;
+		}
+	ret = 1;
+ err:
+	if (!ret)
+		{
+		ASN1_INTEGER_free(serial);
+		serial = NULL;
+		}
+	BIO_free_all(in);
+	BN_free(bn);
+	return serial;
+	}
+
+static int save_ts_serial(const char *serialfile, ASN1_INTEGER *serial)
+	{
+	int ret = 0;
+	BIO *out = NULL;
+
+	if (!(out = BIO_new_file(serialfile, "w"))) goto err;
+	if (i2a_ASN1_INTEGER(out, serial) <= 0) goto err;
+	if (BIO_puts(out, "\n") <= 0) goto err;
+	ret = 1;
+ err:
+	if (!ret)
+		BIO_printf(bio_err, "could not save serial number to %s\n",
+			   serialfile);
+	BIO_free_all(out);
+	return ret;
+	}
+
+/*
+ * Verify-related method definitions.
+ */
+
+static int verify_command(char *data, char *digest, char *queryfile,
+			  char *in, int token_in,
+			  char *ca_path, char *ca_file, char *untrusted)
+	{
+	BIO *in_bio = NULL;
+	PKCS7 *token = NULL;
+	TS_RESP *response = NULL;
+	TS_VERIFY_CTX *verify_ctx = NULL;
+	int ret = 0;
+
+	/* Decode the token (PKCS7) or response (TS_RESP) files. */
+	if (!(in_bio = BIO_new_file(in, "rb"))) goto end;
+	if (token_in)
+		{
+		if (!(token = d2i_PKCS7_bio(in_bio, NULL))) goto end;
+		}
+	else
+		{
+		if (!(response = d2i_TS_RESP_bio(in_bio, NULL))) goto end;
+		}
+
+	if (!(verify_ctx = create_verify_ctx(data, digest, queryfile, 
+					     ca_path, ca_file, untrusted)))
+		goto end;
+
+	/* Checking the token or response against the request. */
+	ret = token_in ?
+		TS_RESP_verify_token(verify_ctx, token) :
+		TS_RESP_verify_response(verify_ctx, response);
+
+ end:
+	printf("Verification: ");
+	if (ret)
+		printf("OK\n");
+	else
+		{
+		printf("FAILED\n");
+		/* Print errors, if there are any. */
+		ERR_print_errors(bio_err);
+		}
+	
+	/* Clean up. */
+	BIO_free_all(in_bio);
+	PKCS7_free(token);
+	TS_RESP_free(response);
+	TS_VERIFY_CTX_free(verify_ctx);
+	return ret;
+	}
+
+static TS_VERIFY_CTX *create_verify_ctx(char *data, char *digest, 
+					char *queryfile, 
+					char *ca_path, char *ca_file,
+					char *untrusted)
+	{
+	TS_VERIFY_CTX *ctx = NULL;
+	BIO *input = NULL;
+	TS_REQ *request = NULL;
+	int ret = 0;
+
+	if (data != NULL || digest != NULL)
+		{
+		if (!(ctx = TS_VERIFY_CTX_new())) goto err;
+		ctx->flags = TS_VFY_VERSION | TS_VFY_SIGNER;
+		if (data != NULL)
+			{
+			ctx->flags |= TS_VFY_DATA;
+			if (!(ctx->data = BIO_new_file(data, "rb"))) goto err;
+			}
+		else if (digest != NULL)
+			{
+			long imprint_len;
+			ctx->flags |= TS_VFY_IMPRINT;
+			if (!(ctx->imprint = string_to_hex(digest,
+							   &imprint_len)))
+				{
+				BIO_printf(bio_err, "invalid digest string\n");
+				goto err;
+				}
+			ctx->imprint_len = imprint_len;
+			}
+		
+		}
+	else if (queryfile != NULL)
+		{
+		/* The request has just to be read, decoded and converted to
+		   a verify context object. */
+		if (!(input = BIO_new_file(queryfile, "rb"))) goto err;
+		if (!(request = d2i_TS_REQ_bio(input, NULL))) goto err;
+		if (!(ctx = TS_REQ_to_TS_VERIFY_CTX(request, NULL))) goto err;
+		}
+
+	/* Add the signature verification flag and arguments. */
+	ctx->flags |= TS_VFY_SIGNATURE;
+
+	/* Initialising the X509_STORE object. */
+	if (!(ctx->store = create_cert_store(ca_path, ca_file))) goto err;
+
+	/* Loading untrusted certificates. */
+	if (untrusted && !(ctx->certs = TS_CONF_load_certs(untrusted))) 
+		goto err;
+
+	ret = 1;
+ err:
+	if (!ret)
+		{
+		TS_VERIFY_CTX_free(ctx);
+		ctx = NULL;
+		}
+	BIO_free_all(input);
+	TS_REQ_free(request);
+	return ctx;
+	}
+
+static X509_STORE *create_cert_store(char *ca_path, char *ca_file)
+	{
+	X509_STORE *cert_ctx = NULL;
+	X509_LOOKUP *lookup = NULL;
+	int i;
+
+	/* Creating the X509_STORE object. */
+	cert_ctx = X509_STORE_new();
+
+	/* Setting the callback for certificate chain verification. */
+	X509_STORE_set_verify_cb_func(cert_ctx, verify_cb);
+
+	/* Adding a trusted certificate directory source. */
+	if (ca_path)
+		{
+		lookup = X509_STORE_add_lookup(cert_ctx,
+					       X509_LOOKUP_hash_dir());
+		if (lookup == NULL)
+			{
+			BIO_printf(bio_err, "memory allocation failure\n");
+			goto err;
+			}
+		i = X509_LOOKUP_add_dir(lookup, ca_path, X509_FILETYPE_PEM);
+		if (!i)
+			{
+			BIO_printf(bio_err, "Error loading directory %s\n",
+				   ca_path);
+			goto err;
+			}
+		}
+
+	/* Adding a trusted certificate file source. */
+	if (ca_file)
+		{
+		lookup = X509_STORE_add_lookup(cert_ctx, X509_LOOKUP_file());
+		if (lookup == NULL)
+			{
+			BIO_printf(bio_err, "memory allocation failure\n");
+			goto err;
+			}
+		i = X509_LOOKUP_load_file(lookup, ca_file, X509_FILETYPE_PEM);
+		if (!i)
+			{
+			BIO_printf(bio_err, "Error loading file %s\n", ca_file);
+			goto err;
+			}
+		}
+
+	return cert_ctx;
+ err:
+	X509_STORE_free(cert_ctx);
+	return NULL;
+	}
+
+static int MS_CALLBACK verify_cb(int ok, X509_STORE_CTX *ctx)
+	{
+	/*
+	char buf[256];
+
+	if (!ok)
+		{
+		X509_NAME_oneline(X509_get_subject_name(ctx->current_cert),
+				  buf, sizeof(buf));
+		printf("%s\n", buf);
+		printf("error %d at %d depth lookup: %s\n",
+		       ctx->error, ctx->error_depth,
+			X509_verify_cert_error_string(ctx->error));
+		}
+	*/
+
+	return ok;
+	}
Index: openssl/apps/tsget
diff -u /dev/null openssl/apps/tsget:1.1.16.1
--- /dev/null	Sun May  8 14:38:23 2005
+++ openssl/apps/tsget	Sun May  8 14:23:53 2005
@@ -0,0 +1,195 @@
+#!/usr/bin/perl -w
+# Written by Zoltan Glozik <zglozik@stones.com>.
+# Copyright (c) 2002 The OpenTSA Project.  All rights reserved.
+$::version = '$Id: tsget,v 1.1.16.1 2005/05/08 12:23:53 zglozik Exp $';
+
+use strict;
+use IO::Handle;
+use Getopt::Std;
+use File::Basename;
+use WWW::Curl::easy;
+
+use vars qw(%options);
+
+# Callback for reading the body.
+sub read_body {
+    my ($maxlength, $state) = @_;
+    my $return_data = "";
+    my $data_len = length ${$state->{data}};
+    if ($state->{bytes} < $data_len) {
+	$data_len = $data_len - $state->{bytes};
+	$data_len = $maxlength if $data_len > $maxlength;
+	$return_data = substr ${$state->{data}}, $state->{bytes}, $data_len;
+	$state->{bytes} += $data_len;
+    }
+    return $return_data;
+}
+
+# Callback for writing the body into a variable.
+sub write_body {
+    my ($data, $pointer) = @_;
+    ${$pointer} .= $data;
+    return length($data);
+}
+
+# Initialise a new Curl object.
+sub create_curl {
+    my $url = shift;
+
+    # Create Curl object.
+    my $curl = WWW::Curl::easy::new();
+
+    # Error-handling related options.
+    $curl->setopt(CURLOPT_VERBOSE, 1) if $options{d};
+    $curl->setopt(CURLOPT_FAILONERROR, 1);
+    $curl->setopt(CURLOPT_USERAGENT, "OpenTSA tsget.pl/" . (split / /, $::version)[2]);
+
+    # Options for POST method.
+    $curl->setopt(CURLOPT_UPLOAD, 1);
+    $curl->setopt(CURLOPT_CUSTOMREQUEST, "POST");
+    $curl->setopt(CURLOPT_HTTPHEADER,
+		["Content-Type: application/timestamp-query",
+		"Accept: application/timestamp-reply"]);
+    $curl->setopt(CURLOPT_READFUNCTION, \&read_body);
+    $curl->setopt(CURLOPT_HEADERFUNCTION, sub { return length($_[0]); });
+
+    # Options for getting the result.
+    $curl->setopt(CURLOPT_WRITEFUNCTION, \&write_body);
+
+    # SSL related options.
+    $curl->setopt(CURLOPT_SSLKEYTYPE, "PEM");
+    $curl->setopt(CURLOPT_SSL_VERIFYPEER, 1);	# Verify server's certificate.
+    $curl->setopt(CURLOPT_SSL_VERIFYHOST, 2);	# Check server's CN.
+    $curl->setopt(CURLOPT_SSLKEY, $options{k}) if defined($options{k});
+    $curl->setopt(CURLOPT_SSLKEYPASSWD, $options{p}) if defined($options{p});
+    $curl->setopt(CURLOPT_SSLCERT, $options{c}) if defined($options{c});
+    $curl->setopt(CURLOPT_CAINFO, $options{C}) if defined($options{C});
+    $curl->setopt(CURLOPT_CAPATH, $options{P}) if defined($options{P});
+    $curl->setopt(CURLOPT_RANDOM_FILE, $options{r}) if defined($options{r});
+    $curl->setopt(CURLOPT_EGDSOCKET, $options{g}) if defined($options{g});
+
+    # Setting destination.
+    $curl->setopt(CURLOPT_URL, $url);
+
+    return $curl;
+}
+
+# Send a request and returns the body back.
+sub get_timestamp {
+    my $curl = shift;
+    my $body = shift;
+    my $ts_body;
+    local $::error_buf;
+
+    # Error-handling related options.
+    $curl->setopt(CURLOPT_ERRORBUFFER, "::error_buf");
+
+    # Options for POST method.
+    $curl->setopt(CURLOPT_INFILE, {data => $body, bytes => 0});
+    $curl->setopt(CURLOPT_INFILESIZE, length(${$body}));
+
+    # Options for getting the result.
+    $curl->setopt(CURLOPT_FILE, \$ts_body);
+
+    # Send the request...
+    my $error_code = $curl->perform();
+    my $error_string;
+    if ($error_code != 0) {
+        my $http_code = $curl->getinfo(CURLINFO_HTTP_CODE);
+	$error_string = "could not get timestamp";
+	$error_string .= ", http code: $http_code" unless $http_code == 0;
+	$error_string .= ", curl code: $error_code";
+	$error_string .= " ($::error_buf)" if defined($::error_buf);
+    } else {
+        my $ct = $curl->getinfo(CURLINFO_CONTENT_TYPE);
+	if (lc($ct) ne "application/timestamp-reply") {
+	    $error_string = "unexpected content type returned: $ct";
+        }
+    }
+    return ($ts_body, $error_string);
+
+}
+
+# Print usage information and exists.
+sub usage {
+
+    print STDERR "usage: $0 -h <server_url> [-e <extension>] [-o <output>] ";
+    print STDERR "[-v] [-d] [-k <private_key.pem>] [-p <key_password>] ";
+    print STDERR "[-c <client_cert.pem>] [-C <CA_certs.pem>] [-P <CA_path>] ";
+    print STDERR "[-r <file:file...>] [-g <EGD_socket>] [<request>]...\n";
+    exit 1;
+}
+
+# ----------------------------------------------------------------------
+#   Main program
+# ----------------------------------------------------------------------
+
+# Getting command-line options (default comes from TSGET environment variable).
+my $getopt_arg =  "h:e:o:vdk:p:c:C:P:r:g:";
+if (exists $ENV{TSGET}) {
+    my @old_argv = @ARGV;
+    @ARGV = split /\s+/, $ENV{TSGET};
+    getopts($getopt_arg, \%options) or usage;
+    @ARGV = @old_argv;
+}
+getopts($getopt_arg, \%options) or usage;
+
+# Checking argument consistency.
+if (!exists($options{h}) || (@ARGV == 0 && !exists($options{o}))
+    || (@ARGV > 1 && exists($options{o}))) {
+    print STDERR "Inconsistent command line options.\n";
+    usage;
+}
+# Setting defaults.
+@ARGV = ("-") unless @ARGV != 0;
+$options{e} = ".tsr" unless defined($options{e});
+
+# Processing requests.
+my $curl = create_curl $options{h};
+undef $/;   # For reading whole files.
+REQUEST: foreach (@ARGV) {
+    my $input = $_;
+    my ($base, $path) = fileparse($input, '\.[^.]*');
+    my $output_base = $base . $options{e};
+    my $output = defined($options{o}) ? $options{o} : $path . $output_base;
+
+    STDERR->printflush("$input: ") if $options{v};
+    # Read request.
+    my $body;
+    if ($input eq "-") {
+	# Read the request from STDIN;
+	$body = <STDIN>;
+    } else {
+	# Read the request from file.
+        open INPUT, "<" . $input
+	    or warn("$input: could not open input file: $!\n"), next REQUEST;
+        $body = <INPUT>;
+        close INPUT
+	    or warn("$input: could not close input file: $!\n"), next REQUEST;
+    }
+
+    # Send request.
+    STDERR->printflush("sending request") if $options{v};
+
+    my ($ts_body, $error) = get_timestamp $curl, \$body;
+    if (defined($error)) {
+	die "$input: fatal error: $error\n";
+    }
+    STDERR->printflush(", reply received") if $options{v};
+
+    # Write response.
+    if ($output eq "-") {
+	# Write to STDOUT.
+        print $ts_body;
+    } else {
+	# Write to file.
+        open OUTPUT, ">", $output
+	    or warn("$output: could not open output file: $!\n"), next REQUEST;
+        print OUTPUT $ts_body;
+        close OUTPUT
+	    or warn("$output: could not close output file: $!\n"), next REQUEST;
+    }
+    STDERR->printflush(", $output written.\n") if $options{v};
+}
+$curl->cleanup();
+WWW::Curl::easy::global_cleanup();
Index: openssl/crypto/cpt_err.c
diff -u openssl/crypto/cpt_err.c:1.1.1.2 openssl/crypto/cpt_err.c:1.1.1.2.14.1
--- openssl/crypto/cpt_err.c:1.1.1.2	Fri Jan 17 23:07:36 2003
+++ openssl/crypto/cpt_err.c	Sun May  8 14:23:54 2005
@@ -1,6 +1,6 @@
 /* crypto/cpt_err.c */
 /* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -66,7 +66,6 @@
 #ifndef OPENSSL_NO_ERR
 static ERR_STRING_DATA CRYPTO_str_functs[]=
 	{
-{ERR_PACK(0,CRYPTO_F_CRYPTO_GET_EX_NEW_INDEX,0),	"CRYPTO_get_ex_new_index"},
 {ERR_PACK(0,CRYPTO_F_CRYPTO_GET_NEW_DYNLOCKID,0),	"CRYPTO_get_new_dynlockid"},
 {ERR_PACK(0,CRYPTO_F_CRYPTO_GET_NEW_LOCKID,0),	"CRYPTO_get_new_lockid"},
 {ERR_PACK(0,CRYPTO_F_CRYPTO_SET_EX_DATA,0),	"CRYPTO_set_ex_data"},
Index: openssl/crypto/crypto.h
diff -u openssl/crypto/crypto.h:1.1.1.5 openssl/crypto/crypto.h:1.1.1.5.2.1
--- openssl/crypto/crypto.h:1.1.1.5	Sun May  8 13:19:58 2005
+++ openssl/crypto/crypto.h	Sun May  8 14:23:54 2005
@@ -502,15 +502,14 @@
 /* Error codes for the CRYPTO functions. */
 
 /* Function codes. */
-#define CRYPTO_F_CRYPTO_GET_EX_NEW_INDEX		 100
-#define CRYPTO_F_CRYPTO_GET_NEW_DYNLOCKID		 103
+#define CRYPTO_F_CRYPTO_GET_NEW_DYNLOCKID		 100
 #define CRYPTO_F_CRYPTO_GET_NEW_LOCKID			 101
 #define CRYPTO_F_CRYPTO_SET_EX_DATA			 102
-#define CRYPTO_F_DEF_ADD_INDEX				 104
-#define CRYPTO_F_DEF_GET_CLASS				 105
-#define CRYPTO_F_INT_DUP_EX_DATA			 106
-#define CRYPTO_F_INT_FREE_EX_DATA			 107
-#define CRYPTO_F_INT_NEW_EX_DATA			 108
+#define CRYPTO_F_DEF_ADD_INDEX				 103
+#define CRYPTO_F_DEF_GET_CLASS				 104
+#define CRYPTO_F_INT_DUP_EX_DATA			 105
+#define CRYPTO_F_INT_FREE_EX_DATA			 106
+#define CRYPTO_F_INT_NEW_EX_DATA			 107
 
 /* Reason codes. */
 #define CRYPTO_R_NO_DYNLOCK_CREATE_CALLBACK		 100
Index: openssl/crypto/opensslconf.h
diff -u openssl/crypto/opensslconf.h:1.1.1.2 openssl/crypto/opensslconf.h:1.1.1.2.14.1
--- openssl/crypto/opensslconf.h:1.1.1.2	Fri Jan 17 23:07:36 2003
+++ openssl/crypto/opensslconf.h	Sun May  8 14:23:54 2005
@@ -9,6 +9,9 @@
 #endif
 
 #endif /* OPENSSL_DOING_MAKEDEPEND */
+#ifndef OPENSSL_THREADS
+# define OPENSSL_THREADS
+#endif
 
 /* The OPENSSL_NO_* macros are also defined as NO_* if the application
    asks for it.  This is a transient feature that is provided for those
@@ -79,7 +82,7 @@
 
 #if defined(HEADER_BN_H) && !defined(CONFIG_HEADER_BN_H)
 #define CONFIG_HEADER_BN_H
-#undef BN_LLONG
+#define BN_LLONG
 
 /* Should we define BN_DIV2W here? */
 
@@ -98,7 +101,7 @@
 #define CONFIG_HEADER_RC4_LOCL_H
 /* if this is defined data[i] is used instead of *data, this is a %20
  * speedup on x86 */
-#undef RC4_INDEX
+#define RC4_INDEX
 #endif
 
 #if defined(HEADER_BF_LOCL_H) && !defined(CONFIG_HEADER_BF_LOCL_H)
@@ -112,14 +115,14 @@
 /* the following is tweaked from a config script, that is why it is a
  * protected undef/define */
 #ifndef DES_PTR
-#undef DES_PTR
+#define DES_PTR
 #endif
 
 /* This helps C compiler generate the correct code for multiple functional
  * units.  It reduces register dependancies at the expense of 2 more
  * registers */
 #ifndef DES_RISC1
-#undef DES_RISC1
+#define DES_RISC1
 #endif
 
 #ifndef DES_RISC2
@@ -133,7 +136,7 @@
 /* Unroll the inner loop, this sometimes helps, sometimes hinders.
  * Very mucy CPU dependant */
 #ifndef DES_UNROLL
-#undef DES_UNROLL
+#define DES_UNROLL
 #endif
 
 /* These default values were supplied by
Index: openssl/crypto/asn1/Makefile
diff -u openssl/crypto/asn1/Makefile:1.1.1.2 openssl/crypto/asn1/Makefile:1.1.1.2.2.1
--- openssl/crypto/asn1/Makefile:1.1.1.2	Sun May  8 13:20:03 2005
+++ openssl/crypto/asn1/Makefile	Sun May  8 14:23:55 2005
@@ -328,6 +328,7 @@
 a_type.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
 a_type.o: ../../include/openssl/crypto.h ../../include/openssl/e_os2.h
 a_type.o: ../../include/openssl/err.h ../../include/openssl/lhash.h
+a_type.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
 a_type.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
 a_type.o: ../../include/openssl/ossl_typ.h ../../include/openssl/safestack.h
 a_type.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
Index: openssl/crypto/asn1/a_bitstr.c
diff -u openssl/crypto/asn1/a_bitstr.c:1.1.1.4 openssl/crypto/asn1/a_bitstr.c:1.1.1.4.2.1
--- openssl/crypto/asn1/a_bitstr.c:1.1.1.4	Sun May  8 13:20:03 2005
+++ openssl/crypto/asn1/a_bitstr.c	Sun May  8 14:23:55 2005
@@ -220,3 +220,26 @@
 	return((a->data[w]&v) != 0);
 	}
 
+/*
+ * Checks if the given bit string contains only bits specified by 
+ * the flags vector. Returns 0 if there is at least one bit set in 'a'
+ * which is not specified in 'flags', 1 otherwise.
+ * 'len' is the length of 'flags'.
+ */
+int ASN1_BIT_STRING_check(ASN1_BIT_STRING *a,
+			  unsigned char *flags, int flags_len)
+	{
+	int i, ok;
+	/* Check if there is one bit set at all. */
+	if (!a || !a->data) return 1;
+
+	/* Check each byte of the internal representation of the bit string. */
+	ok = 1;
+	for (i = 0; i < a->length && ok; ++i)
+		{
+		unsigned char mask = i < flags_len ? ~flags[i] : 0xff;
+		/* We are done if there is an unneeded bit set. */
+		ok = (a->data[i] & mask) == 0;
+		}
+	return ok;
+	}
Index: openssl/crypto/asn1/a_gentm.c
diff -u openssl/crypto/asn1/a_gentm.c:1.1.1.4 openssl/crypto/asn1/a_gentm.c:1.1.1.4.2.1
--- openssl/crypto/asn1/a_gentm.c:1.1.1.4	Sun May  8 13:20:03 2005
+++ openssl/crypto/asn1/a_gentm.c	Sun May  8 14:23:55 2005
@@ -176,6 +176,11 @@
 			o++;
 			}
 		}
+	else
+		{
+		/* Missing time zone information. */
+		goto err;
+		}
 	return(o == l);
 err:
 	return(0);
Index: openssl/crypto/asn1/a_type.c
diff -u openssl/crypto/asn1/a_type.c:1.1.1.3 openssl/crypto/asn1/a_type.c:1.1.1.3.2.1
--- openssl/crypto/asn1/a_type.c:1.1.1.3	Sun May  8 13:20:03 2005
+++ openssl/crypto/asn1/a_type.c	Sun May  8 14:23:55 2005
@@ -58,6 +58,7 @@
 
 #include <stdio.h>
 #include <openssl/asn1t.h>
+#include <openssl/objects.h>
 #include "cryptlib.h"
 
 int ASN1_TYPE_get(ASN1_TYPE *a)
@@ -82,3 +83,49 @@
 
 IMPLEMENT_STACK_OF(ASN1_TYPE)
 IMPLEMENT_ASN1_SET_OF(ASN1_TYPE)
+
+/* Returns 0 if they are equal, != 0 otherwise. */
+int ASN1_TYPE_cmp(ASN1_TYPE *a, ASN1_TYPE *b)
+	{
+	int result = -1;
+
+	if (!a || !b || a->type != b->type) return -1;
+
+	switch (a->type)
+		{
+	case V_ASN1_OBJECT:
+		result = OBJ_cmp(a->value.object, b->value.object);
+		break;
+	case V_ASN1_NULL:
+		result = 0;	/* They do not have content. */
+		break;
+	case V_ASN1_INTEGER:
+	case V_ASN1_NEG_INTEGER:
+	case V_ASN1_ENUMERATED:
+	case V_ASN1_NEG_ENUMERATED:
+	case V_ASN1_BIT_STRING:
+	case V_ASN1_OCTET_STRING:
+	case V_ASN1_SEQUENCE:
+	case V_ASN1_SET:
+	case V_ASN1_NUMERICSTRING:
+	case V_ASN1_PRINTABLESTRING:
+	case V_ASN1_T61STRING:
+	case V_ASN1_VIDEOTEXSTRING:
+	case V_ASN1_IA5STRING:
+	case V_ASN1_UTCTIME:
+	case V_ASN1_GENERALIZEDTIME:
+	case V_ASN1_GRAPHICSTRING:
+	case V_ASN1_VISIBLESTRING:
+	case V_ASN1_GENERALSTRING:
+	case V_ASN1_UNIVERSALSTRING:
+	case V_ASN1_BMPSTRING:
+	case V_ASN1_UTF8STRING:
+	case V_ASN1_OTHER:
+	default:
+		result = ASN1_STRING_cmp((ASN1_STRING *) a->value.ptr,
+					 (ASN1_STRING *) b->value.ptr);
+		break;
+		}
+
+	return result;
+	}
Index: openssl/crypto/asn1/asn1.h
diff -u openssl/crypto/asn1/asn1.h:1.1.1.5 openssl/crypto/asn1/asn1.h:1.1.1.5.2.1
--- openssl/crypto/asn1/asn1.h:1.1.1.5	Sun May  8 13:20:03 2005
+++ openssl/crypto/asn1/asn1.h	Sun May  8 14:23:55 2005
@@ -696,6 +696,7 @@
 
 int ASN1_TYPE_get(ASN1_TYPE *a);
 void ASN1_TYPE_set(ASN1_TYPE *a, int type, void *value);
+int		ASN1_TYPE_cmp(ASN1_TYPE *a, ASN1_TYPE *b);
 
 ASN1_OBJECT *	ASN1_OBJECT_new(void );
 void		ASN1_OBJECT_free(ASN1_OBJECT *a);
@@ -731,6 +732,10 @@
 			int length );
 int		ASN1_BIT_STRING_set_bit(ASN1_BIT_STRING *a, int n, int value);
 int		ASN1_BIT_STRING_get_bit(ASN1_BIT_STRING *a, int n);
+int		ASN1_BIT_STRING_check(ASN1_BIT_STRING *a,
+				      unsigned char *flags, int flags_len);
+/* The following macro helps you create the flag vector for bit string check. */
+#define ASN1_BIT(bit, byte)	((bit)/8 == (byte) ? 1<<(7 - ((bit)&0x07)) : 0)
 
 #ifndef OPENSSL_NO_BIO
 int ASN1_BIT_STRING_name_print(BIO *out, ASN1_BIT_STRING *bs,
@@ -950,160 +955,158 @@
 #define ASN1_F_A2I_ASN1_ENUMERATED			 101
 #define ASN1_F_A2I_ASN1_INTEGER				 102
 #define ASN1_F_A2I_ASN1_STRING				 103
-#define ASN1_F_ASN1_BIT_STRING_SET_BIT			 176
-#define ASN1_F_ASN1_CHECK_TLEN				 104
-#define ASN1_F_ASN1_COLLATE_PRIMITIVE			 105
-#define ASN1_F_ASN1_COLLECT				 106
-#define ASN1_F_ASN1_D2I_BIO				 107
-#define ASN1_F_ASN1_D2I_EX_PRIMITIVE			 108
-#define ASN1_F_ASN1_D2I_FP				 109
-#define ASN1_F_ASN1_DIGEST				 177
-#define ASN1_F_ASN1_DO_ADB				 110
-#define ASN1_F_ASN1_DUP					 111
-#define ASN1_F_ASN1_ENUMERATED_SET			 112
-#define ASN1_F_ASN1_ENUMERATED_TO_BN			 113
-#define ASN1_F_ASN1_GENERALIZEDTIME_SET			 178
-#define ASN1_F_ASN1_GET_OBJECT				 114
-#define ASN1_F_ASN1_HEADER_NEW				 115
-#define ASN1_F_ASN1_I2D_BIO				 116
-#define ASN1_F_ASN1_I2D_FP				 117
-#define ASN1_F_ASN1_INTEGER_SET				 118
-#define ASN1_F_ASN1_INTEGER_TO_BN			 119
-#define ASN1_F_ASN1_ITEM_EX_D2I				 120
-#define ASN1_F_ASN1_ITEM_NEW				 121
-#define ASN1_F_ASN1_MBSTRING_COPY			 122
-#define ASN1_F_ASN1_OBJECT_NEW				 123
-#define ASN1_F_ASN1_PACK_STRING				 124
-#define ASN1_F_ASN1_PBE_SET				 125
-#define ASN1_F_ASN1_SEQ_PACK				 126
-#define ASN1_F_ASN1_SEQ_UNPACK				 127
-#define ASN1_F_ASN1_SIGN				 128
-#define ASN1_F_ASN1_STRING_SET				 179
-#define ASN1_F_ASN1_STRING_TABLE_ADD			 129
-#define ASN1_F_ASN1_STRING_TYPE_NEW			 130
-#define ASN1_F_ASN1_TEMPLATE_D2I			 131
-#define ASN1_F_ASN1_TEMPLATE_EX_D2I			 132
-#define ASN1_F_ASN1_TEMPLATE_NEW			 133
-#define ASN1_F_ASN1_TIME_SET				 175
-#define ASN1_F_ASN1_TYPE_GET_INT_OCTETSTRING		 134
-#define ASN1_F_ASN1_TYPE_GET_OCTETSTRING		 135
-#define ASN1_F_ASN1_UNPACK_STRING			 136
-#define ASN1_F_ASN1_UTCTIME_SET				 180
-#define ASN1_F_ASN1_VERIFY				 137
-#define ASN1_F_BN_TO_ASN1_ENUMERATED			 138
-#define ASN1_F_BN_TO_ASN1_INTEGER			 139
-#define ASN1_F_COLLECT_DATA				 140
-#define ASN1_F_D2I_ASN1_BIT_STRING			 141
-#define ASN1_F_D2I_ASN1_BOOLEAN				 142
-#define ASN1_F_D2I_ASN1_BYTES				 143
-#define ASN1_F_D2I_ASN1_GENERALIZEDTIME			 144
-#define ASN1_F_D2I_ASN1_HEADER				 145
-#define ASN1_F_D2I_ASN1_INTEGER				 146
-#define ASN1_F_D2I_ASN1_OBJECT				 147
-#define ASN1_F_D2I_ASN1_SET				 148
-#define ASN1_F_D2I_ASN1_TYPE_BYTES			 149
-#define ASN1_F_D2I_ASN1_UINTEGER			 150
-#define ASN1_F_D2I_ASN1_UTCTIME				 151
-#define ASN1_F_D2I_NETSCAPE_RSA				 152
-#define ASN1_F_D2I_NETSCAPE_RSA_2			 153
-#define ASN1_F_D2I_PRIVATEKEY				 154
-#define ASN1_F_D2I_PUBLICKEY				 155
-#define ASN1_F_D2I_X509					 156
-#define ASN1_F_D2I_X509_CINF				 157
-#define ASN1_F_D2I_X509_NAME				 158
-#define ASN1_F_D2I_X509_PKEY				 159
-#define ASN1_F_I2D_ASN1_SET				 181
-#define ASN1_F_I2D_ASN1_TIME				 160
-#define ASN1_F_I2D_DSA_PUBKEY				 161
-#define ASN1_F_I2D_NETSCAPE_RSA				 162
-#define ASN1_F_I2D_PRIVATEKEY				 163
-#define ASN1_F_I2D_PUBLICKEY				 164
-#define ASN1_F_I2D_RSA_PUBKEY				 165
-#define ASN1_F_LONG_C2I					 166
-#define ASN1_F_OID_MODULE_INIT				 174
-#define ASN1_F_PKCS5_PBE2_SET				 167
-#define ASN1_F_X509_CINF_NEW				 168
-#define ASN1_F_X509_CRL_ADD0_REVOKED			 169
-#define ASN1_F_X509_INFO_NEW				 170
-#define ASN1_F_X509_NAME_NEW				 171
-#define ASN1_F_X509_NEW					 172
-#define ASN1_F_X509_PKEY_NEW				 173
+#define ASN1_F_ASN1_BIT_STRING_SET_BIT			 104
+#define ASN1_F_ASN1_CHECK_TLEN				 105
+#define ASN1_F_ASN1_COLLATE_PRIMITIVE			 106
+#define ASN1_F_ASN1_COLLECT				 107
+#define ASN1_F_ASN1_D2I_BIO				 108
+#define ASN1_F_ASN1_D2I_EX_PRIMITIVE			 109
+#define ASN1_F_ASN1_D2I_FP				 110
+#define ASN1_F_ASN1_DIGEST				 111
+#define ASN1_F_ASN1_DO_ADB				 112
+#define ASN1_F_ASN1_DUP					 113
+#define ASN1_F_ASN1_ENUMERATED_SET			 114
+#define ASN1_F_ASN1_ENUMERATED_TO_BN			 115
+#define ASN1_F_ASN1_GENERALIZEDTIME_SET			 116
+#define ASN1_F_ASN1_GET_OBJECT				 117
+#define ASN1_F_ASN1_HEADER_NEW				 118
+#define ASN1_F_ASN1_I2D_BIO				 119
+#define ASN1_F_ASN1_I2D_FP				 120
+#define ASN1_F_ASN1_INTEGER_SET				 121
+#define ASN1_F_ASN1_INTEGER_TO_BN			 122
+#define ASN1_F_ASN1_ITEM_EX_D2I				 123
+#define ASN1_F_ASN1_ITEM_NEW				 124
+#define ASN1_F_ASN1_MBSTRING_COPY			 125
+#define ASN1_F_ASN1_OBJECT_NEW				 126
+#define ASN1_F_ASN1_PACK_STRING				 127
+#define ASN1_F_ASN1_PBE_SET				 128
+#define ASN1_F_ASN1_SEQ_PACK				 129
+#define ASN1_F_ASN1_SEQ_UNPACK				 130
+#define ASN1_F_ASN1_SIGN				 131
+#define ASN1_F_ASN1_STRING_SET				 132
+#define ASN1_F_ASN1_STRING_TABLE_ADD			 133
+#define ASN1_F_ASN1_STRING_TYPE_NEW			 134
+#define ASN1_F_ASN1_TEMPLATE_D2I			 135
+#define ASN1_F_ASN1_TEMPLATE_EX_D2I			 136
+#define ASN1_F_ASN1_TEMPLATE_NEW			 137
+#define ASN1_F_ASN1_TIME_SET				 138
+#define ASN1_F_ASN1_TYPE_GET_INT_OCTETSTRING		 139
+#define ASN1_F_ASN1_TYPE_GET_OCTETSTRING		 140
+#define ASN1_F_ASN1_UNPACK_STRING			 141
+#define ASN1_F_ASN1_UTCTIME_SET				 142
+#define ASN1_F_ASN1_VERIFY				 143
+#define ASN1_F_BN_TO_ASN1_ENUMERATED			 144
+#define ASN1_F_BN_TO_ASN1_INTEGER			 145
+#define ASN1_F_COLLECT_DATA				 146
+#define ASN1_F_D2I_ASN1_BIT_STRING			 147
+#define ASN1_F_D2I_ASN1_BOOLEAN				 148
+#define ASN1_F_D2I_ASN1_BYTES				 149
+#define ASN1_F_D2I_ASN1_GENERALIZEDTIME			 150
+#define ASN1_F_D2I_ASN1_HEADER				 151
+#define ASN1_F_D2I_ASN1_INTEGER				 152
+#define ASN1_F_D2I_ASN1_OBJECT				 153
+#define ASN1_F_D2I_ASN1_SET				 154
+#define ASN1_F_D2I_ASN1_TYPE_BYTES			 155
+#define ASN1_F_D2I_ASN1_UINTEGER			 156
+#define ASN1_F_D2I_ASN1_UTCTIME				 157
+#define ASN1_F_D2I_NETSCAPE_RSA				 158
+#define ASN1_F_D2I_NETSCAPE_RSA_2			 159
+#define ASN1_F_D2I_PRIVATEKEY				 160
+#define ASN1_F_D2I_PUBLICKEY				 161
+#define ASN1_F_D2I_X509					 162
+#define ASN1_F_D2I_X509_NAME				 163
+#define ASN1_F_D2I_X509_PKEY				 164
+#define ASN1_F_I2D_ASN1_SET				 165
+#define ASN1_F_I2D_ASN1_TIME				 166
+#define ASN1_F_I2D_DSA_PUBKEY				 167
+#define ASN1_F_I2D_NETSCAPE_RSA				 168
+#define ASN1_F_I2D_PRIVATEKEY				 169
+#define ASN1_F_I2D_PUBLICKEY				 170
+#define ASN1_F_I2D_RSA_PUBKEY				 171
+#define ASN1_F_LONG_C2I					 172
+#define ASN1_F_OID_MODULE_INIT				 173
+#define ASN1_F_PKCS5_PBE2_SET				 174
+#define ASN1_F_X509_CRL_ADD0_REVOKED			 175
+#define ASN1_F_X509_INFO_NEW				 176
+#define ASN1_F_X509_NAME_NEW				 177
+#define ASN1_F_X509_NEW					 178
+#define ASN1_F_X509_PKEY_NEW				 179
 
 /* Reason codes. */
-#define ASN1_R_ADDING_OBJECT				 171
-#define ASN1_R_AUX_ERROR				 100
-#define ASN1_R_BAD_CLASS				 101
-#define ASN1_R_BAD_OBJECT_HEADER			 102
-#define ASN1_R_BAD_PASSWORD_READ			 103
-#define ASN1_R_BAD_TAG					 104
-#define ASN1_R_BN_LIB					 105
-#define ASN1_R_BOOLEAN_IS_WRONG_LENGTH			 106
-#define ASN1_R_BUFFER_TOO_SMALL				 107
-#define ASN1_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER		 108
-#define ASN1_R_DATA_IS_WRONG				 109
-#define ASN1_R_DECODE_ERROR				 110
-#define ASN1_R_DECODING_ERROR				 111
-#define ASN1_R_ENCODE_ERROR				 112
-#define ASN1_R_ERROR_GETTING_TIME			 173
-#define ASN1_R_ERROR_LOADING_SECTION			 172
-#define ASN1_R_ERROR_PARSING_SET_ELEMENT		 113
-#define ASN1_R_ERROR_SETTING_CIPHER_PARAMS		 114
-#define ASN1_R_EXPECTING_AN_INTEGER			 115
-#define ASN1_R_EXPECTING_AN_OBJECT			 116
-#define ASN1_R_EXPECTING_A_BOOLEAN			 117
-#define ASN1_R_EXPECTING_A_TIME				 118
-#define ASN1_R_EXPLICIT_LENGTH_MISMATCH			 119
-#define ASN1_R_EXPLICIT_TAG_NOT_CONSTRUCTED		 120
-#define ASN1_R_FIELD_MISSING				 121
-#define ASN1_R_FIRST_NUM_TOO_LARGE			 122
-#define ASN1_R_HEADER_TOO_LONG				 123
-#define ASN1_R_ILLEGAL_CHARACTERS			 124
-#define ASN1_R_ILLEGAL_NULL				 125
-#define ASN1_R_ILLEGAL_OPTIONAL_ANY			 126
-#define ASN1_R_ILLEGAL_OPTIONS_ON_ITEM_TEMPLATE		 170
-#define ASN1_R_ILLEGAL_TAGGED_ANY			 127
-#define ASN1_R_INTEGER_TOO_LARGE_FOR_LONG		 128
-#define ASN1_R_INVALID_BMPSTRING_LENGTH			 129
-#define ASN1_R_INVALID_DIGIT				 130
-#define ASN1_R_INVALID_SEPARATOR			 131
-#define ASN1_R_INVALID_TIME_FORMAT			 132
-#define ASN1_R_INVALID_UNIVERSALSTRING_LENGTH		 133
-#define ASN1_R_INVALID_UTF8STRING			 134
-#define ASN1_R_IV_TOO_LARGE				 135
-#define ASN1_R_LENGTH_ERROR				 136
-#define ASN1_R_MISSING_EOC				 137
-#define ASN1_R_MISSING_SECOND_NUMBER			 138
-#define ASN1_R_MSTRING_NOT_UNIVERSAL			 139
-#define ASN1_R_MSTRING_WRONG_TAG			 140
-#define ASN1_R_NON_HEX_CHARACTERS			 141
-#define ASN1_R_NOT_ENOUGH_DATA				 142
-#define ASN1_R_NO_MATCHING_CHOICE_TYPE			 143
-#define ASN1_R_NULL_IS_WRONG_LENGTH			 144
-#define ASN1_R_ODD_NUMBER_OF_CHARS			 145
-#define ASN1_R_PRIVATE_KEY_HEADER_MISSING		 146
-#define ASN1_R_SECOND_NUMBER_TOO_LARGE			 147
-#define ASN1_R_SEQUENCE_LENGTH_MISMATCH			 148
-#define ASN1_R_SEQUENCE_NOT_CONSTRUCTED			 149
-#define ASN1_R_SHORT_LINE				 150
-#define ASN1_R_STRING_TOO_LONG				 151
-#define ASN1_R_STRING_TOO_SHORT				 152
-#define ASN1_R_TAG_VALUE_TOO_HIGH			 153
-#define ASN1_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD 154
-#define ASN1_R_TOO_LONG					 155
-#define ASN1_R_TYPE_NOT_CONSTRUCTED			 156
-#define ASN1_R_UNABLE_TO_DECODE_RSA_KEY			 157
-#define ASN1_R_UNABLE_TO_DECODE_RSA_PRIVATE_KEY		 158
-#define ASN1_R_UNEXPECTED_EOC				 159
-#define ASN1_R_UNKNOWN_FORMAT				 160
-#define ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM		 161
-#define ASN1_R_UNKNOWN_OBJECT_TYPE			 162
-#define ASN1_R_UNKNOWN_PUBLIC_KEY_TYPE			 163
-#define ASN1_R_UNSUPPORTED_ANY_DEFINED_BY_TYPE		 164
-#define ASN1_R_UNSUPPORTED_CIPHER			 165
-#define ASN1_R_UNSUPPORTED_ENCRYPTION_ALGORITHM		 166
-#define ASN1_R_UNSUPPORTED_PUBLIC_KEY_TYPE		 167
-#define ASN1_R_WRONG_TAG				 168
-#define ASN1_R_WRONG_TYPE				 169
+#define ASN1_R_ADDING_OBJECT				 100
+#define ASN1_R_AUX_ERROR				 101
+#define ASN1_R_BAD_CLASS				 102
+#define ASN1_R_BAD_OBJECT_HEADER			 103
+#define ASN1_R_BAD_PASSWORD_READ			 104
+#define ASN1_R_BAD_TAG					 105
+#define ASN1_R_BN_LIB					 106
+#define ASN1_R_BOOLEAN_IS_WRONG_LENGTH			 107
+#define ASN1_R_BUFFER_TOO_SMALL				 108
+#define ASN1_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER		 109
+#define ASN1_R_DATA_IS_WRONG				 110
+#define ASN1_R_DECODE_ERROR				 111
+#define ASN1_R_DECODING_ERROR				 112
+#define ASN1_R_ENCODE_ERROR				 113
+#define ASN1_R_ERROR_GETTING_TIME			 114
+#define ASN1_R_ERROR_LOADING_SECTION			 115
+#define ASN1_R_ERROR_PARSING_SET_ELEMENT		 116
+#define ASN1_R_ERROR_SETTING_CIPHER_PARAMS		 117
+#define ASN1_R_EXPECTING_AN_INTEGER			 118
+#define ASN1_R_EXPECTING_AN_OBJECT			 119
+#define ASN1_R_EXPECTING_A_BOOLEAN			 120
+#define ASN1_R_EXPECTING_A_TIME				 121
+#define ASN1_R_EXPLICIT_LENGTH_MISMATCH			 122
+#define ASN1_R_EXPLICIT_TAG_NOT_CONSTRUCTED		 123
+#define ASN1_R_FIELD_MISSING				 124
+#define ASN1_R_FIRST_NUM_TOO_LARGE			 125
+#define ASN1_R_HEADER_TOO_LONG				 126
+#define ASN1_R_ILLEGAL_CHARACTERS			 127
+#define ASN1_R_ILLEGAL_NULL				 128
+#define ASN1_R_ILLEGAL_OPTIONAL_ANY			 129
+#define ASN1_R_ILLEGAL_OPTIONS_ON_ITEM_TEMPLATE		 130
+#define ASN1_R_ILLEGAL_TAGGED_ANY			 131
+#define ASN1_R_INTEGER_TOO_LARGE_FOR_LONG		 132
+#define ASN1_R_INVALID_BMPSTRING_LENGTH			 133
+#define ASN1_R_INVALID_DIGIT				 134
+#define ASN1_R_INVALID_SEPARATOR			 135
+#define ASN1_R_INVALID_TIME_FORMAT			 136
+#define ASN1_R_INVALID_UNIVERSALSTRING_LENGTH		 137
+#define ASN1_R_INVALID_UTF8STRING			 138
+#define ASN1_R_IV_TOO_LARGE				 139
+#define ASN1_R_LENGTH_ERROR				 140
+#define ASN1_R_MISSING_EOC				 141
+#define ASN1_R_MISSING_SECOND_NUMBER			 142
+#define ASN1_R_MSTRING_NOT_UNIVERSAL			 143
+#define ASN1_R_MSTRING_WRONG_TAG			 144
+#define ASN1_R_NON_HEX_CHARACTERS			 145
+#define ASN1_R_NOT_ENOUGH_DATA				 146
+#define ASN1_R_NO_MATCHING_CHOICE_TYPE			 147
+#define ASN1_R_NULL_IS_WRONG_LENGTH			 148
+#define ASN1_R_ODD_NUMBER_OF_CHARS			 149
+#define ASN1_R_PRIVATE_KEY_HEADER_MISSING		 150
+#define ASN1_R_SECOND_NUMBER_TOO_LARGE			 151
+#define ASN1_R_SEQUENCE_LENGTH_MISMATCH			 152
+#define ASN1_R_SEQUENCE_NOT_CONSTRUCTED			 153
+#define ASN1_R_SHORT_LINE				 154
+#define ASN1_R_STRING_TOO_LONG				 155
+#define ASN1_R_STRING_TOO_SHORT				 156
+#define ASN1_R_TAG_VALUE_TOO_HIGH			 157
+#define ASN1_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD 158
+#define ASN1_R_TOO_LONG					 159
+#define ASN1_R_TYPE_NOT_CONSTRUCTED			 160
+#define ASN1_R_UNABLE_TO_DECODE_RSA_KEY			 161
+#define ASN1_R_UNABLE_TO_DECODE_RSA_PRIVATE_KEY		 162
+#define ASN1_R_UNEXPECTED_EOC				 163
+#define ASN1_R_UNKNOWN_FORMAT				 164
+#define ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM		 165
+#define ASN1_R_UNKNOWN_OBJECT_TYPE			 166
+#define ASN1_R_UNKNOWN_PUBLIC_KEY_TYPE			 167
+#define ASN1_R_UNSUPPORTED_ANY_DEFINED_BY_TYPE		 168
+#define ASN1_R_UNSUPPORTED_CIPHER			 169
+#define ASN1_R_UNSUPPORTED_ENCRYPTION_ALGORITHM		 170
+#define ASN1_R_UNSUPPORTED_PUBLIC_KEY_TYPE		 171
+#define ASN1_R_WRONG_TAG				 172
+#define ASN1_R_WRONG_TYPE				 173
 
 #ifdef  __cplusplus
 }
Index: openssl/crypto/asn1/asn1_err.c
diff -u openssl/crypto/asn1/asn1_err.c:1.1.1.4 openssl/crypto/asn1/asn1_err.c:1.1.1.4.2.1
--- openssl/crypto/asn1/asn1_err.c:1.1.1.4	Sun May  8 13:20:03 2005
+++ openssl/crypto/asn1/asn1_err.c	Sun May  8 14:23:55 2005
@@ -1,6 +1,6 @@
 /* crypto/asn1/asn1_err.c */
 /* ====================================================================
- * Copyright (c) 1999-2004 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -129,7 +129,6 @@
 {ERR_PACK(0,ASN1_F_D2I_PRIVATEKEY,0),	"d2i_PrivateKey"},
 {ERR_PACK(0,ASN1_F_D2I_PUBLICKEY,0),	"d2i_PublicKey"},
 {ERR_PACK(0,ASN1_F_D2I_X509,0),	"D2I_X509"},
-{ERR_PACK(0,ASN1_F_D2I_X509_CINF,0),	"D2I_X509_CINF"},
 {ERR_PACK(0,ASN1_F_D2I_X509_NAME,0),	"D2I_X509_NAME"},
 {ERR_PACK(0,ASN1_F_D2I_X509_PKEY,0),	"d2i_X509_PKEY"},
 {ERR_PACK(0,ASN1_F_I2D_ASN1_SET,0),	"i2d_ASN1_SET"},
@@ -142,7 +141,6 @@
 {ERR_PACK(0,ASN1_F_LONG_C2I,0),	"LONG_C2I"},
 {ERR_PACK(0,ASN1_F_OID_MODULE_INIT,0),	"OID_MODULE_INIT"},
 {ERR_PACK(0,ASN1_F_PKCS5_PBE2_SET,0),	"PKCS5_pbe2_set"},
-{ERR_PACK(0,ASN1_F_X509_CINF_NEW,0),	"X509_CINF_NEW"},
 {ERR_PACK(0,ASN1_F_X509_CRL_ADD0_REVOKED,0),	"X509_CRL_add0_revoked"},
 {ERR_PACK(0,ASN1_F_X509_INFO_NEW,0),	"X509_INFO_new"},
 {ERR_PACK(0,ASN1_F_X509_NAME_NEW,0),	"X509_NAME_NEW"},
Index: openssl/crypto/asn1/asn1_mac.h
diff -u openssl/crypto/asn1/asn1_mac.h:1.1.1.2 openssl/crypto/asn1/asn1_mac.h:1.1.1.2.14.1
--- openssl/crypto/asn1/asn1_mac.h:1.1.1.2	Fri Jan 17 23:07:41 2003
+++ openssl/crypto/asn1/asn1_mac.h	Sun May  8 14:23:55 2005
@@ -146,6 +146,13 @@
 		M_ASN1_D2I_get(b,func); \
 		}
 
+#define M_ASN1_D2I_get_int_opt(b,func,type) \
+	if ((c.slen != 0) && ((M_ASN1_next & (~V_ASN1_CONSTRUCTED)) \
+		== (V_ASN1_UNIVERSAL|(type)))) \
+		{ \
+		M_ASN1_D2I_get_int(b,func); \
+		}
+
 #define M_ASN1_D2I_get_imp(b,func, type) \
 	M_ASN1_next=(_tmp& V_ASN1_CONSTRUCTED)|type; \
 	c.q=c.p; \
Index: openssl/crypto/asn1/t_x509.c
diff -u openssl/crypto/asn1/t_x509.c:1.1.1.2 openssl/crypto/asn1/t_x509.c:1.1.1.2.14.1
--- openssl/crypto/asn1/t_x509.c:1.1.1.2	Fri Jan 17 23:07:44 2003
+++ openssl/crypto/asn1/t_x509.c	Sun May  8 14:23:55 2005
@@ -368,6 +368,8 @@
 	int gmt=0;
 	int i;
 	int y=0,M=0,d=0,h=0,m=0,s=0;
+	char *f = NULL;
+	int f_len = 0;
 
 	i=tm->length;
 	v=(char *)tm->data;
@@ -384,10 +386,21 @@
 	m=  (v[10]-'0')*10+(v[11]-'0');
 	if (	(v[12] >= '0') && (v[12] <= '9') &&
 		(v[13] >= '0') && (v[13] <= '9'))
+		{
 		s=  (v[12]-'0')*10+(v[13]-'0');
+		/* Check for fractions of seconds. */
+		if (v[14] == '.')
+			{
+			int l = tm->length;
+			f = &v[14];	/* The decimal point. */
+			f_len = 1;
+			while (14 + f_len < l && f[f_len] >= '0' && f[f_len] <= '9')
+				++f_len;
+			}
+		}
 
-	if (BIO_printf(bp,"%s %2d %02d:%02d:%02d %d%s",
-		mon[M-1],d,h,m,s,y,(gmt)?" GMT":"") <= 0)
+	if (BIO_printf(bp,"%s %2d %02d:%02d:%02d%.*s %d%s",
+		mon[M-1],d,h,m,s,f_len,f,y,(gmt)?" GMT":"") <= 0)
 		return(0);
 	else
 		return(1);
Index: openssl/crypto/bio/bio.h
diff -u openssl/crypto/bio/bio.h:1.1.1.4 openssl/crypto/bio/bio.h:1.1.1.4.4.1
--- openssl/crypto/bio/bio.h:1.1.1.4	Mon Nov  8 16:32:23 2004
+++ openssl/crypto/bio/bio.h	Sun May  8 14:23:56 2005
@@ -630,64 +630,61 @@
 #define BIO_F_BIO_ACCEPT				 101
 #define BIO_F_BIO_BER_GET_HEADER			 102
 #define BIO_F_BIO_CTRL					 103
-#define BIO_F_BIO_GETHOSTBYNAME				 120
-#define BIO_F_BIO_GETS					 104
-#define BIO_F_BIO_GET_ACCEPT_SOCKET			 105
-#define BIO_F_BIO_GET_HOST_IP				 106
-#define BIO_F_BIO_GET_PORT				 107
-#define BIO_F_BIO_MAKE_PAIR				 121
-#define BIO_F_BIO_NEW					 108
-#define BIO_F_BIO_NEW_FILE				 109
-#define BIO_F_BIO_NEW_MEM_BUF				 126
-#define BIO_F_BIO_NREAD					 123
-#define BIO_F_BIO_NREAD0				 124
-#define BIO_F_BIO_NWRITE				 125
-#define BIO_F_BIO_NWRITE0				 122
-#define BIO_F_BIO_PUTS					 110
-#define BIO_F_BIO_READ					 111
-#define BIO_F_BIO_SOCK_INIT				 112
-#define BIO_F_BIO_WRITE					 113
-#define BIO_F_BUFFER_CTRL				 114
-#define BIO_F_CONN_CTRL					 127
-#define BIO_F_CONN_STATE				 115
-#define BIO_F_FILE_CTRL					 116
-#define BIO_F_FILE_READ					 130
-#define BIO_F_LINEBUFFER_CTRL				 129
-#define BIO_F_MEM_READ					 128
-#define BIO_F_MEM_WRITE					 117
-#define BIO_F_SSL_NEW					 118
-#define BIO_F_WSASTARTUP				 119
+#define BIO_F_BIO_GETHOSTBYNAME				 104
+#define BIO_F_BIO_GETS					 105
+#define BIO_F_BIO_GET_ACCEPT_SOCKET			 106
+#define BIO_F_BIO_GET_HOST_IP				 107
+#define BIO_F_BIO_GET_PORT				 108
+#define BIO_F_BIO_MAKE_PAIR				 109
+#define BIO_F_BIO_NEW					 110
+#define BIO_F_BIO_NEW_FILE				 111
+#define BIO_F_BIO_NEW_MEM_BUF				 112
+#define BIO_F_BIO_NREAD					 113
+#define BIO_F_BIO_NREAD0				 114
+#define BIO_F_BIO_NWRITE				 115
+#define BIO_F_BIO_NWRITE0				 116
+#define BIO_F_BIO_PUTS					 117
+#define BIO_F_BIO_READ					 118
+#define BIO_F_BIO_SOCK_INIT				 119
+#define BIO_F_BIO_WRITE					 120
+#define BIO_F_BUFFER_CTRL				 121
+#define BIO_F_CONN_CTRL					 122
+#define BIO_F_CONN_STATE				 123
+#define BIO_F_FILE_CTRL					 124
+#define BIO_F_FILE_READ					 125
+#define BIO_F_LINEBUFFER_CTRL				 126
+#define BIO_F_MEM_WRITE					 127
+#define BIO_F_SSL_NEW					 128
 
 /* Reason codes. */
 #define BIO_R_ACCEPT_ERROR				 100
 #define BIO_R_BAD_FOPEN_MODE				 101
 #define BIO_R_BAD_HOSTNAME_LOOKUP			 102
-#define BIO_R_BROKEN_PIPE				 124
-#define BIO_R_CONNECT_ERROR				 103
-#define BIO_R_EOF_ON_MEMORY_BIO				 127
-#define BIO_R_ERROR_SETTING_NBIO			 104
-#define BIO_R_ERROR_SETTING_NBIO_ON_ACCEPTED_SOCKET	 105
-#define BIO_R_ERROR_SETTING_NBIO_ON_ACCEPT_SOCKET	 106
-#define BIO_R_GETHOSTBYNAME_ADDR_IS_NOT_AF_INET		 107
-#define BIO_R_INVALID_ARGUMENT				 125
-#define BIO_R_INVALID_IP_ADDRESS			 108
-#define BIO_R_IN_USE					 123
-#define BIO_R_KEEPALIVE					 109
-#define BIO_R_NBIO_CONNECT_ERROR			 110
-#define BIO_R_NO_ACCEPT_PORT_SPECIFIED			 111
-#define BIO_R_NO_HOSTNAME_SPECIFIED			 112
-#define BIO_R_NO_PORT_DEFINED				 113
-#define BIO_R_NO_PORT_SPECIFIED				 114
-#define BIO_R_NO_SUCH_FILE				 128
-#define BIO_R_NULL_PARAMETER				 115
-#define BIO_R_TAG_MISMATCH				 116
-#define BIO_R_UNABLE_TO_BIND_SOCKET			 117
-#define BIO_R_UNABLE_TO_CREATE_SOCKET			 118
-#define BIO_R_UNABLE_TO_LISTEN_SOCKET			 119
-#define BIO_R_UNINITIALIZED				 120
-#define BIO_R_UNSUPPORTED_METHOD			 121
+#define BIO_R_BROKEN_PIPE				 103
+#define BIO_R_CONNECT_ERROR				 104
+#define BIO_R_ERROR_SETTING_NBIO			 105
+#define BIO_R_ERROR_SETTING_NBIO_ON_ACCEPTED_SOCKET	 106
+#define BIO_R_ERROR_SETTING_NBIO_ON_ACCEPT_SOCKET	 107
+#define BIO_R_GETHOSTBYNAME_ADDR_IS_NOT_AF_INET		 108
+#define BIO_R_INVALID_ARGUMENT				 109
+#define BIO_R_INVALID_IP_ADDRESS			 110
+#define BIO_R_IN_USE					 111
+#define BIO_R_KEEPALIVE					 112
+#define BIO_R_NBIO_CONNECT_ERROR			 113
+#define BIO_R_NO_ACCEPT_PORT_SPECIFIED			 114
+#define BIO_R_NO_HOSTNAME_SPECIFIED			 115
+#define BIO_R_NO_PORT_DEFINED				 116
+#define BIO_R_NO_PORT_SPECIFIED				 117
+#define BIO_R_NO_SUCH_FILE				 118
+#define BIO_R_NULL_PARAMETER				 119
+#define BIO_R_TAG_MISMATCH				 120
+#define BIO_R_UNABLE_TO_BIND_SOCKET			 121
+#define BIO_R_UNABLE_TO_CREATE_SOCKET			 122
+#define BIO_R_UNABLE_TO_LISTEN_SOCKET			 123
+#define BIO_R_UNINITIALIZED				 124
+#define BIO_R_UNSUPPORTED_METHOD			 125
 #define BIO_R_WRITE_TO_READ_ONLY_BIO			 126
-#define BIO_R_WSASTARTUP				 122
+#define BIO_R_WSASTARTUP				 127
 
 #ifdef  __cplusplus
 }
Index: openssl/crypto/bio/bio_err.c
diff -u openssl/crypto/bio/bio_err.c:1.1.1.2 openssl/crypto/bio/bio_err.c:1.1.1.2.14.1
--- openssl/crypto/bio/bio_err.c:1.1.1.2	Fri Jan 17 23:07:45 2003
+++ openssl/crypto/bio/bio_err.c	Sun May  8 14:23:56 2005
@@ -1,6 +1,6 @@
 /* crypto/bio/bio_err.c */
 /* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -93,10 +93,8 @@
 {ERR_PACK(0,BIO_F_FILE_CTRL,0),	"FILE_CTRL"},
 {ERR_PACK(0,BIO_F_FILE_READ,0),	"FILE_READ"},
 {ERR_PACK(0,BIO_F_LINEBUFFER_CTRL,0),	"LINEBUFFER_CTRL"},
-{ERR_PACK(0,BIO_F_MEM_READ,0),	"MEM_READ"},
 {ERR_PACK(0,BIO_F_MEM_WRITE,0),	"MEM_WRITE"},
 {ERR_PACK(0,BIO_F_SSL_NEW,0),	"SSL_new"},
-{ERR_PACK(0,BIO_F_WSASTARTUP,0),	"WSASTARTUP"},
 {0,NULL}
 	};
 
@@ -107,7 +105,6 @@
 {BIO_R_BAD_HOSTNAME_LOOKUP               ,"bad hostname lookup"},
 {BIO_R_BROKEN_PIPE                       ,"broken pipe"},
 {BIO_R_CONNECT_ERROR                     ,"connect error"},
-{BIO_R_EOF_ON_MEMORY_BIO                 ,"EOF on memory BIO"},
 {BIO_R_ERROR_SETTING_NBIO                ,"error setting nbio"},
 {BIO_R_ERROR_SETTING_NBIO_ON_ACCEPTED_SOCKET,"error setting nbio on accepted socket"},
 {BIO_R_ERROR_SETTING_NBIO_ON_ACCEPT_SOCKET,"error setting nbio on accept socket"},
@@ -129,8 +126,8 @@
 {BIO_R_UNABLE_TO_LISTEN_SOCKET           ,"unable to listen socket"},
 {BIO_R_UNINITIALIZED                     ,"uninitialized"},
 {BIO_R_UNSUPPORTED_METHOD                ,"unsupported method"},
-{BIO_R_WRITE_TO_READ_ONLY_BIO            ,"write to read only BIO"},
-{BIO_R_WSASTARTUP                        ,"WSAStartup"},
+{BIO_R_WRITE_TO_READ_ONLY_BIO            ,"write to read only bio"},
+{BIO_R_WSASTARTUP                        ,"wsastartup"},
 {0,NULL}
 	};
 
Index: openssl/crypto/bn/bn.h
diff -u openssl/crypto/bn/bn.h:1.1.1.4 openssl/crypto/bn/bn.h:1.1.1.4.10.1
--- openssl/crypto/bn/bn.h:1.1.1.4	Tue May  6 22:29:13 2003
+++ openssl/crypto/bn/bn.h	Sun May  8 14:23:57 2005
@@ -507,41 +507,40 @@
 #define BN_F_BN_BLINDING_UPDATE				 103
 #define BN_F_BN_BN2DEC					 104
 #define BN_F_BN_BN2HEX					 105
-#define BN_F_BN_CTX_GET					 116
-#define BN_F_BN_CTX_NEW					 106
-#define BN_F_BN_DIV					 107
-#define BN_F_BN_EXPAND2					 108
-#define BN_F_BN_EXPAND_INTERNAL				 120
-#define BN_F_BN_MOD_EXP2_MONT				 118
-#define BN_F_BN_MOD_EXP_MONT				 109
-#define BN_F_BN_MOD_EXP_MONT_WORD			 117
-#define BN_F_BN_MOD_INVERSE				 110
-#define BN_F_BN_MOD_LSHIFT_QUICK			 119
-#define BN_F_BN_MOD_MUL_RECIPROCAL			 111
-#define BN_F_BN_MOD_SQRT				 121
-#define BN_F_BN_MPI2BN					 112
-#define BN_F_BN_NEW					 113
-#define BN_F_BN_RAND					 114
-#define BN_F_BN_RAND_RANGE				 122
-#define BN_F_BN_USUB					 115
+#define BN_F_BN_CTX_GET					 106
+#define BN_F_BN_CTX_NEW					 107
+#define BN_F_BN_DIV					 108
+#define BN_F_BN_EXPAND_INTERNAL				 109
+#define BN_F_BN_MOD_EXP2_MONT				 110
+#define BN_F_BN_MOD_EXP_MONT				 111
+#define BN_F_BN_MOD_EXP_MONT_WORD			 112
+#define BN_F_BN_MOD_INVERSE				 113
+#define BN_F_BN_MOD_LSHIFT_QUICK			 114
+#define BN_F_BN_MOD_MUL_RECIPROCAL			 115
+#define BN_F_BN_MOD_SQRT				 116
+#define BN_F_BN_MPI2BN					 117
+#define BN_F_BN_NEW					 118
+#define BN_F_BN_RAND					 119
+#define BN_F_BN_RAND_RANGE				 120
+#define BN_F_BN_USUB					 121
 
 /* Reason codes. */
 #define BN_R_ARG2_LT_ARG3				 100
 #define BN_R_BAD_RECIPROCAL				 101
-#define BN_R_BIGNUM_TOO_LONG				 114
-#define BN_R_CALLED_WITH_EVEN_MODULUS			 102
-#define BN_R_DIV_BY_ZERO				 103
-#define BN_R_ENCODING_ERROR				 104
-#define BN_R_EXPAND_ON_STATIC_BIGNUM_DATA		 105
-#define BN_R_INPUT_NOT_REDUCED				 110
-#define BN_R_INVALID_LENGTH				 106
-#define BN_R_INVALID_RANGE				 115
-#define BN_R_NOT_A_SQUARE				 111
-#define BN_R_NOT_INITIALIZED				 107
-#define BN_R_NO_INVERSE					 108
-#define BN_R_P_IS_NOT_PRIME				 112
-#define BN_R_TOO_MANY_ITERATIONS			 113
-#define BN_R_TOO_MANY_TEMPORARY_VARIABLES		 109
+#define BN_R_BIGNUM_TOO_LONG				 102
+#define BN_R_CALLED_WITH_EVEN_MODULUS			 103
+#define BN_R_DIV_BY_ZERO				 104
+#define BN_R_ENCODING_ERROR				 105
+#define BN_R_EXPAND_ON_STATIC_BIGNUM_DATA		 106
+#define BN_R_INPUT_NOT_REDUCED				 107
+#define BN_R_INVALID_LENGTH				 108
+#define BN_R_INVALID_RANGE				 109
+#define BN_R_NOT_A_SQUARE				 110
+#define BN_R_NOT_INITIALIZED				 111
+#define BN_R_NO_INVERSE					 112
+#define BN_R_P_IS_NOT_PRIME				 113
+#define BN_R_TOO_MANY_ITERATIONS			 114
+#define BN_R_TOO_MANY_TEMPORARY_VARIABLES		 115
 
 #ifdef  __cplusplus
 }
Index: openssl/crypto/bn/bn_err.c
diff -u openssl/crypto/bn/bn_err.c:1.1.1.2 openssl/crypto/bn/bn_err.c:1.1.1.2.14.1
--- openssl/crypto/bn/bn_err.c:1.1.1.2	Fri Jan 17 23:07:47 2003
+++ openssl/crypto/bn/bn_err.c	Sun May  8 14:23:57 2005
@@ -1,6 +1,6 @@
 /* crypto/bn/bn_err.c */
 /* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -75,7 +75,6 @@
 {ERR_PACK(0,BN_F_BN_CTX_GET,0),	"BN_CTX_get"},
 {ERR_PACK(0,BN_F_BN_CTX_NEW,0),	"BN_CTX_new"},
 {ERR_PACK(0,BN_F_BN_DIV,0),	"BN_div"},
-{ERR_PACK(0,BN_F_BN_EXPAND2,0),	"bn_expand2"},
 {ERR_PACK(0,BN_F_BN_EXPAND_INTERNAL,0),	"BN_EXPAND_INTERNAL"},
 {ERR_PACK(0,BN_F_BN_MOD_EXP2_MONT,0),	"BN_mod_exp2_mont"},
 {ERR_PACK(0,BN_F_BN_MOD_EXP_MONT,0),	"BN_mod_exp_mont"},
Index: openssl/crypto/buffer/buf_err.c
diff -u openssl/crypto/buffer/buf_err.c:1.1.1.2 openssl/crypto/buffer/buf_err.c:1.1.1.2.14.1
--- openssl/crypto/buffer/buf_err.c:1.1.1.2	Fri Jan 17 23:07:52 2003
+++ openssl/crypto/buffer/buf_err.c	Sun May  8 14:23:58 2005
@@ -1,6 +1,6 @@
 /* crypto/buffer/buf_err.c */
 /* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
Index: openssl/crypto/conf/conf.h
diff -u openssl/crypto/conf/conf.h:1.1.1.2 openssl/crypto/conf/conf.h:1.1.1.2.14.1
--- openssl/crypto/conf/conf.h:1.1.1.2	Fri Jan 17 23:07:52 2003
+++ openssl/crypto/conf/conf.h	Sun May  8 14:23:59 2005
@@ -207,42 +207,40 @@
 /* Error codes for the CONF functions. */
 
 /* Function codes. */
-#define CONF_F_CONF_DUMP_FP				 104
-#define CONF_F_CONF_LOAD				 100
+#define CONF_F_CONF_DUMP_FP				 100
+#define CONF_F_CONF_LOAD				 101
 #define CONF_F_CONF_LOAD_BIO				 102
 #define CONF_F_CONF_LOAD_FP				 103
-#define CONF_F_CONF_MODULES_LOAD			 116
-#define CONF_F_MODULE_INIT				 115
-#define CONF_F_MODULE_LOAD_DSO				 117
-#define CONF_F_MODULE_RUN				 118
-#define CONF_F_NCONF_DUMP_BIO				 105
-#define CONF_F_NCONF_DUMP_FP				 106
-#define CONF_F_NCONF_GET_NUMBER				 107
-#define CONF_F_NCONF_GET_NUMBER_E			 112
-#define CONF_F_NCONF_GET_SECTION			 108
-#define CONF_F_NCONF_GET_STRING				 109
+#define CONF_F_CONF_MODULES_LOAD			 104
+#define CONF_F_MODULE_INIT				 105
+#define CONF_F_MODULE_LOAD_DSO				 106
+#define CONF_F_MODULE_RUN				 107
+#define CONF_F_NCONF_DUMP_BIO				 108
+#define CONF_F_NCONF_DUMP_FP				 109
+#define CONF_F_NCONF_GET_NUMBER_E			 110
+#define CONF_F_NCONF_GET_SECTION			 111
+#define CONF_F_NCONF_GET_STRING				 112
 #define CONF_F_NCONF_LOAD				 113
-#define CONF_F_NCONF_LOAD_BIO				 110
-#define CONF_F_NCONF_LOAD_FP				 114
-#define CONF_F_NCONF_NEW				 111
-#define CONF_F_STR_COPY					 101
+#define CONF_F_NCONF_LOAD_BIO				 114
+#define CONF_F_NCONF_LOAD_FP				 115
+#define CONF_F_NCONF_NEW				 116
+#define CONF_F_STR_COPY					 117
 
 /* Reason codes. */
-#define CONF_R_ERROR_LOADING_DSO			 110
-#define CONF_R_MISSING_CLOSE_SQUARE_BRACKET		 100
-#define CONF_R_MISSING_EQUAL_SIGN			 101
-#define CONF_R_MISSING_FINISH_FUNCTION			 111
-#define CONF_R_MISSING_INIT_FUNCTION			 112
-#define CONF_R_MODULE_INITIALIZATION_ERROR		 109
-#define CONF_R_NO_CLOSE_BRACE				 102
-#define CONF_R_NO_CONF					 105
-#define CONF_R_NO_CONF_OR_ENVIRONMENT_VARIABLE		 106
-#define CONF_R_NO_SECTION				 107
-#define CONF_R_NO_SUCH_FILE				 114
-#define CONF_R_NO_VALUE					 108
-#define CONF_R_UNABLE_TO_CREATE_NEW_SECTION		 103
-#define CONF_R_UNKNOWN_MODULE_NAME			 113
-#define CONF_R_VARIABLE_HAS_NO_VALUE			 104
+#define CONF_R_ERROR_LOADING_DSO			 100
+#define CONF_R_MISSING_CLOSE_SQUARE_BRACKET		 101
+#define CONF_R_MISSING_EQUAL_SIGN			 102
+#define CONF_R_MISSING_INIT_FUNCTION			 103
+#define CONF_R_MODULE_INITIALIZATION_ERROR		 104
+#define CONF_R_NO_CLOSE_BRACE				 105
+#define CONF_R_NO_CONF					 106
+#define CONF_R_NO_CONF_OR_ENVIRONMENT_VARIABLE		 107
+#define CONF_R_NO_SECTION				 108
+#define CONF_R_NO_SUCH_FILE				 109
+#define CONF_R_NO_VALUE					 110
+#define CONF_R_UNABLE_TO_CREATE_NEW_SECTION		 111
+#define CONF_R_UNKNOWN_MODULE_NAME			 112
+#define CONF_R_VARIABLE_HAS_NO_VALUE			 113
 
 #ifdef  __cplusplus
 }
Index: openssl/crypto/conf/conf_err.c
diff -u openssl/crypto/conf/conf_err.c:1.1.1.2 openssl/crypto/conf/conf_err.c:1.1.1.2.14.1
--- openssl/crypto/conf/conf_err.c:1.1.1.2	Fri Jan 17 23:07:52 2003
+++ openssl/crypto/conf/conf_err.c	Sun May  8 14:23:59 2005
@@ -1,6 +1,6 @@
 /* crypto/conf/conf_err.c */
 /* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -76,7 +76,6 @@
 {ERR_PACK(0,CONF_F_MODULE_RUN,0),	"MODULE_RUN"},
 {ERR_PACK(0,CONF_F_NCONF_DUMP_BIO,0),	"NCONF_dump_bio"},
 {ERR_PACK(0,CONF_F_NCONF_DUMP_FP,0),	"NCONF_dump_fp"},
-{ERR_PACK(0,CONF_F_NCONF_GET_NUMBER,0),	"NCONF_get_number"},
 {ERR_PACK(0,CONF_F_NCONF_GET_NUMBER_E,0),	"NCONF_get_number_e"},
 {ERR_PACK(0,CONF_F_NCONF_GET_SECTION,0),	"NCONF_get_section"},
 {ERR_PACK(0,CONF_F_NCONF_GET_STRING,0),	"NCONF_get_string"},
@@ -93,7 +92,6 @@
 {CONF_R_ERROR_LOADING_DSO                ,"error loading dso"},
 {CONF_R_MISSING_CLOSE_SQUARE_BRACKET     ,"missing close square bracket"},
 {CONF_R_MISSING_EQUAL_SIGN               ,"missing equal sign"},
-{CONF_R_MISSING_FINISH_FUNCTION          ,"missing finish function"},
 {CONF_R_MISSING_INIT_FUNCTION            ,"missing init function"},
 {CONF_R_MODULE_INITIALIZATION_ERROR      ,"module initialization error"},
 {CONF_R_NO_CLOSE_BRACE                   ,"no close brace"},
Index: openssl/crypto/dh/dh.h
diff -u openssl/crypto/dh/dh.h:1.1.1.3 openssl/crypto/dh/dh.h:1.1.1.3.14.1
--- openssl/crypto/dh/dh.h:1.1.1.3	Fri Jan 17 23:07:53 2003
+++ openssl/crypto/dh/dh.h	Sun May  8 14:24:00 2005
@@ -198,8 +198,8 @@
 #define DH_F_DH_NEW_METHOD				 105
 
 /* Reason codes. */
-#define DH_R_BAD_GENERATOR				 101
-#define DH_R_NO_PRIVATE_VALUE				 100
+#define DH_R_BAD_GENERATOR				 100
+#define DH_R_NO_PRIVATE_VALUE				 101
 
 #ifdef  __cplusplus
 }
Index: openssl/crypto/dh/dh_err.c
diff -u openssl/crypto/dh/dh_err.c:1.1.1.3 openssl/crypto/dh/dh_err.c:1.1.1.3.4.1
--- openssl/crypto/dh/dh_err.c:1.1.1.3	Mon Nov  8 16:32:27 2004
+++ openssl/crypto/dh/dh_err.c	Sun May  8 14:24:00 2005
@@ -1,6 +1,6 @@
 /* crypto/dh/dh_err.c */
 /* ====================================================================
- * Copyright (c) 1999-2003 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
Index: openssl/crypto/dsa/dsa.h
diff -u openssl/crypto/dsa/dsa.h:1.1.1.4 openssl/crypto/dsa/dsa.h:1.1.1.4.4.1
--- openssl/crypto/dsa/dsa.h:1.1.1.4	Mon Nov  8 16:32:27 2004
+++ openssl/crypto/dsa/dsa.h	Sun May  8 14:24:01 2005
@@ -229,20 +229,15 @@
 /* Error codes for the DSA functions. */
 
 /* Function codes. */
-#define DSA_F_D2I_DSA_SIG				 110
 #define DSA_F_DSAPARAMS_PRINT				 100
 #define DSA_F_DSAPARAMS_PRINT_FP			 101
-#define DSA_F_DSA_DO_SIGN				 112
-#define DSA_F_DSA_DO_VERIFY				 113
-#define DSA_F_DSA_NEW_METHOD				 103
-#define DSA_F_DSA_PRINT					 104
-#define DSA_F_DSA_PRINT_FP				 105
-#define DSA_F_DSA_SIGN					 106
+#define DSA_F_DSA_DO_SIGN				 102
+#define DSA_F_DSA_DO_VERIFY				 103
+#define DSA_F_DSA_NEW_METHOD				 104
+#define DSA_F_DSA_PRINT					 105
+#define DSA_F_DSA_PRINT_FP				 106
 #define DSA_F_DSA_SIGN_SETUP				 107
-#define DSA_F_DSA_SIG_NEW				 109
-#define DSA_F_DSA_VERIFY				 108
-#define DSA_F_I2D_DSA_SIG				 111
-#define DSA_F_SIG_CB					 114
+#define DSA_F_SIG_CB					 108
 
 /* Reason codes. */
 #define DSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE		 100
Index: openssl/crypto/dsa/dsa_err.c
diff -u openssl/crypto/dsa/dsa_err.c:1.1.1.2 openssl/crypto/dsa/dsa_err.c:1.1.1.2.14.1
--- openssl/crypto/dsa/dsa_err.c:1.1.1.2	Fri Jan 17 23:07:53 2003
+++ openssl/crypto/dsa/dsa_err.c	Sun May  8 14:24:01 2005
@@ -1,6 +1,6 @@
 /* crypto/dsa/dsa_err.c */
 /* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -66,7 +66,6 @@
 #ifndef OPENSSL_NO_ERR
 static ERR_STRING_DATA DSA_str_functs[]=
 	{
-{ERR_PACK(0,DSA_F_D2I_DSA_SIG,0),	"d2i_DSA_SIG"},
 {ERR_PACK(0,DSA_F_DSAPARAMS_PRINT,0),	"DSAparams_print"},
 {ERR_PACK(0,DSA_F_DSAPARAMS_PRINT_FP,0),	"DSAparams_print_fp"},
 {ERR_PACK(0,DSA_F_DSA_DO_SIGN,0),	"DSA_do_sign"},
@@ -74,11 +73,7 @@
 {ERR_PACK(0,DSA_F_DSA_NEW_METHOD,0),	"DSA_new_method"},
 {ERR_PACK(0,DSA_F_DSA_PRINT,0),	"DSA_print"},
 {ERR_PACK(0,DSA_F_DSA_PRINT_FP,0),	"DSA_print_fp"},
-{ERR_PACK(0,DSA_F_DSA_SIGN,0),	"DSA_sign"},
 {ERR_PACK(0,DSA_F_DSA_SIGN_SETUP,0),	"DSA_sign_setup"},
-{ERR_PACK(0,DSA_F_DSA_SIG_NEW,0),	"DSA_SIG_new"},
-{ERR_PACK(0,DSA_F_DSA_VERIFY,0),	"DSA_verify"},
-{ERR_PACK(0,DSA_F_I2D_DSA_SIG,0),	"i2d_DSA_SIG"},
 {ERR_PACK(0,DSA_F_SIG_CB,0),	"SIG_CB"},
 {0,NULL}
 	};
Index: openssl/crypto/dso/dso.h
diff -u openssl/crypto/dso/dso.h:1.1.1.2 openssl/crypto/dso/dso.h:1.1.1.2.14.1
--- openssl/crypto/dso/dso.h:1.1.1.2	Fri Jan 17 23:07:54 2003
+++ openssl/crypto/dso/dso.h	Sun May  8 14:24:02 2005
@@ -273,48 +273,48 @@
 #define DSO_F_DLFCN_BIND_FUNC				 100
 #define DSO_F_DLFCN_BIND_VAR				 101
 #define DSO_F_DLFCN_LOAD				 102
-#define DSO_F_DLFCN_NAME_CONVERTER			 123
-#define DSO_F_DLFCN_UNLOAD				 103
-#define DSO_F_DL_BIND_FUNC				 104
-#define DSO_F_DL_BIND_VAR				 105
-#define DSO_F_DL_LOAD					 106
-#define DSO_F_DL_NAME_CONVERTER				 124
-#define DSO_F_DL_UNLOAD					 107
-#define DSO_F_DSO_BIND_FUNC				 108
-#define DSO_F_DSO_BIND_VAR				 109
-#define DSO_F_DSO_CONVERT_FILENAME			 126
-#define DSO_F_DSO_CTRL					 110
-#define DSO_F_DSO_FREE					 111
-#define DSO_F_DSO_GET_FILENAME				 127
-#define DSO_F_DSO_GET_LOADED_FILENAME			 128
-#define DSO_F_DSO_LOAD					 112
-#define DSO_F_DSO_NEW_METHOD				 113
-#define DSO_F_DSO_SET_FILENAME				 129
-#define DSO_F_DSO_SET_NAME_CONVERTER			 122
-#define DSO_F_DSO_UP_REF				 114
-#define DSO_F_VMS_BIND_VAR				 115
-#define DSO_F_VMS_LOAD					 116
-#define DSO_F_VMS_UNLOAD				 117
-#define DSO_F_WIN32_BIND_FUNC				 118
-#define DSO_F_WIN32_BIND_VAR				 119
-#define DSO_F_WIN32_LOAD				 120
-#define DSO_F_WIN32_NAME_CONVERTER			 125
-#define DSO_F_WIN32_UNLOAD				 121
+#define DSO_F_DLFCN_NAME_CONVERTER			 103
+#define DSO_F_DLFCN_UNLOAD				 104
+#define DSO_F_DL_BIND_FUNC				 105
+#define DSO_F_DL_BIND_VAR				 106
+#define DSO_F_DL_LOAD					 107
+#define DSO_F_DL_NAME_CONVERTER				 108
+#define DSO_F_DL_UNLOAD					 109
+#define DSO_F_DSO_BIND_FUNC				 110
+#define DSO_F_DSO_BIND_VAR				 111
+#define DSO_F_DSO_CONVERT_FILENAME			 112
+#define DSO_F_DSO_CTRL					 113
+#define DSO_F_DSO_FREE					 114
+#define DSO_F_DSO_GET_FILENAME				 115
+#define DSO_F_DSO_GET_LOADED_FILENAME			 116
+#define DSO_F_DSO_LOAD					 117
+#define DSO_F_DSO_NEW_METHOD				 118
+#define DSO_F_DSO_SET_FILENAME				 119
+#define DSO_F_DSO_SET_NAME_CONVERTER			 120
+#define DSO_F_DSO_UP_REF				 121
+#define DSO_F_VMS_BIND_VAR				 122
+#define DSO_F_VMS_LOAD					 123
+#define DSO_F_VMS_UNLOAD				 124
+#define DSO_F_WIN32_BIND_FUNC				 125
+#define DSO_F_WIN32_BIND_VAR				 126
+#define DSO_F_WIN32_LOAD				 127
+#define DSO_F_WIN32_NAME_CONVERTER			 128
+#define DSO_F_WIN32_UNLOAD				 129
 
 /* Reason codes. */
 #define DSO_R_CTRL_FAILED				 100
-#define DSO_R_DSO_ALREADY_LOADED			 110
-#define DSO_R_FILENAME_TOO_BIG				 101
-#define DSO_R_FINISH_FAILED				 102
-#define DSO_R_LOAD_FAILED				 103
-#define DSO_R_NAME_TRANSLATION_FAILED			 109
-#define DSO_R_NO_FILENAME				 111
-#define DSO_R_NULL_HANDLE				 104
-#define DSO_R_SET_FILENAME_FAILED			 112
-#define DSO_R_STACK_ERROR				 105
-#define DSO_R_SYM_FAILURE				 106
-#define DSO_R_UNLOAD_FAILED				 107
-#define DSO_R_UNSUPPORTED				 108
+#define DSO_R_DSO_ALREADY_LOADED			 101
+#define DSO_R_FILENAME_TOO_BIG				 102
+#define DSO_R_FINISH_FAILED				 103
+#define DSO_R_LOAD_FAILED				 104
+#define DSO_R_NAME_TRANSLATION_FAILED			 105
+#define DSO_R_NO_FILENAME				 106
+#define DSO_R_NULL_HANDLE				 107
+#define DSO_R_SET_FILENAME_FAILED			 108
+#define DSO_R_STACK_ERROR				 109
+#define DSO_R_SYM_FAILURE				 110
+#define DSO_R_UNLOAD_FAILED				 111
+#define DSO_R_UNSUPPORTED				 112
 
 #ifdef  __cplusplus
 }
Index: openssl/crypto/dso/dso_err.c
diff -u openssl/crypto/dso/dso_err.c:1.1.1.2 openssl/crypto/dso/dso_err.c:1.1.1.2.14.1
--- openssl/crypto/dso/dso_err.c:1.1.1.2	Fri Jan 17 23:07:54 2003
+++ openssl/crypto/dso/dso_err.c	Sun May  8 14:24:02 2005
@@ -1,6 +1,6 @@
 /* crypto/dso/dso_err.c */
 /* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -101,19 +101,19 @@
 
 static ERR_STRING_DATA DSO_str_reasons[]=
 	{
-{DSO_R_CTRL_FAILED                       ,"control command failed"},
+{DSO_R_CTRL_FAILED                       ,"ctrl failed"},
 {DSO_R_DSO_ALREADY_LOADED                ,"dso already loaded"},
 {DSO_R_FILENAME_TOO_BIG                  ,"filename too big"},
-{DSO_R_FINISH_FAILED                     ,"cleanup method function failed"},
-{DSO_R_LOAD_FAILED                       ,"could not load the shared library"},
+{DSO_R_FINISH_FAILED                     ,"finish failed"},
+{DSO_R_LOAD_FAILED                       ,"load failed"},
 {DSO_R_NAME_TRANSLATION_FAILED           ,"name translation failed"},
 {DSO_R_NO_FILENAME                       ,"no filename"},
-{DSO_R_NULL_HANDLE                       ,"a null shared library handle was used"},
+{DSO_R_NULL_HANDLE                       ,"null handle"},
 {DSO_R_SET_FILENAME_FAILED               ,"set filename failed"},
-{DSO_R_STACK_ERROR                       ,"the meth_data stack is corrupt"},
-{DSO_R_SYM_FAILURE                       ,"could not bind to the requested symbol name"},
-{DSO_R_UNLOAD_FAILED                     ,"could not unload the shared library"},
-{DSO_R_UNSUPPORTED                       ,"functionality not supported"},
+{DSO_R_STACK_ERROR                       ,"stack error"},
+{DSO_R_SYM_FAILURE                       ,"sym failure"},
+{DSO_R_UNLOAD_FAILED                     ,"unload failed"},
+{DSO_R_UNSUPPORTED                       ,"unsupported"},
 {0,NULL}
 	};
 
Index: openssl/crypto/ec/ec.h
diff -u openssl/crypto/ec/ec.h:1.1.1.2 openssl/crypto/ec/ec.h:1.1.1.2.12.1
--- openssl/crypto/ec/ec.h:1.1.1.2	Sat Feb 22 14:28:09 2003
+++ openssl/crypto/ec/ec.h	Sun May  8 14:24:07 2005
@@ -177,65 +177,64 @@
 /* Error codes for the EC functions. */
 
 /* Function codes. */
-#define EC_F_COMPUTE_WNAF				 143
-#define EC_F_EC_GFP_MONT_FIELD_DECODE			 133
-#define EC_F_EC_GFP_MONT_FIELD_ENCODE			 134
-#define EC_F_EC_GFP_MONT_FIELD_MUL			 131
-#define EC_F_EC_GFP_MONT_FIELD_SQR			 132
-#define EC_F_EC_GFP_SIMPLE_GROUP_SET_CURVE_GFP		 100
-#define EC_F_EC_GFP_SIMPLE_GROUP_SET_GENERATOR		 101
-#define EC_F_EC_GFP_SIMPLE_MAKE_AFFINE			 102
-#define EC_F_EC_GFP_SIMPLE_OCT2POINT			 103
-#define EC_F_EC_GFP_SIMPLE_POINT2OCT			 104
-#define EC_F_EC_GFP_SIMPLE_POINTS_MAKE_AFFINE		 137
-#define EC_F_EC_GFP_SIMPLE_POINT_GET_AFFINE_COORDINATES_GFP 105
-#define EC_F_EC_GFP_SIMPLE_POINT_SET_AFFINE_COORDINATES_GFP 128
-#define EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES_GFP 129
-#define EC_F_EC_GROUP_COPY				 106
-#define EC_F_EC_GROUP_GET0_GENERATOR			 139
-#define EC_F_EC_GROUP_GET_COFACTOR			 140
-#define EC_F_EC_GROUP_GET_CURVE_GFP			 130
-#define EC_F_EC_GROUP_GET_ORDER				 141
-#define EC_F_EC_GROUP_NEW				 108
-#define EC_F_EC_GROUP_PRECOMPUTE_MULT			 142
-#define EC_F_EC_GROUP_SET_CURVE_GFP			 109
-#define EC_F_EC_GROUP_SET_EXTRA_DATA			 110
-#define EC_F_EC_GROUP_SET_GENERATOR			 111
-#define EC_F_EC_POINTS_MAKE_AFFINE			 136
-#define EC_F_EC_POINTS_MUL				 138
-#define EC_F_EC_POINT_ADD				 112
-#define EC_F_EC_POINT_CMP				 113
-#define EC_F_EC_POINT_COPY				 114
-#define EC_F_EC_POINT_DBL				 115
-#define EC_F_EC_POINT_GET_AFFINE_COORDINATES_GFP	 116
-#define EC_F_EC_POINT_GET_JPROJECTIVE_COORDINATES_GFP	 117
-#define EC_F_EC_POINT_IS_AT_INFINITY			 118
-#define EC_F_EC_POINT_IS_ON_CURVE			 119
-#define EC_F_EC_POINT_MAKE_AFFINE			 120
-#define EC_F_EC_POINT_NEW				 121
-#define EC_F_EC_POINT_OCT2POINT				 122
-#define EC_F_EC_POINT_POINT2OCT				 123
-#define EC_F_EC_POINT_SET_AFFINE_COORDINATES_GFP	 124
-#define EC_F_EC_POINT_SET_COMPRESSED_COORDINATES_GFP	 125
-#define EC_F_EC_POINT_SET_JPROJECTIVE_COORDINATES_GFP	 126
-#define EC_F_EC_POINT_SET_TO_INFINITY			 127
-#define EC_F_GFP_MONT_GROUP_SET_CURVE_GFP		 135
+#define EC_F_COMPUTE_WNAF				 100
+#define EC_F_EC_GFP_MONT_FIELD_DECODE			 101
+#define EC_F_EC_GFP_MONT_FIELD_ENCODE			 102
+#define EC_F_EC_GFP_MONT_FIELD_MUL			 103
+#define EC_F_EC_GFP_MONT_FIELD_SQR			 104
+#define EC_F_EC_GFP_SIMPLE_GROUP_SET_CURVE_GFP		 105
+#define EC_F_EC_GFP_SIMPLE_GROUP_SET_GENERATOR		 106
+#define EC_F_EC_GFP_SIMPLE_MAKE_AFFINE			 107
+#define EC_F_EC_GFP_SIMPLE_OCT2POINT			 108
+#define EC_F_EC_GFP_SIMPLE_POINT2OCT			 109
+#define EC_F_EC_GFP_SIMPLE_POINTS_MAKE_AFFINE		 110
+#define EC_F_EC_GFP_SIMPLE_POINT_GET_AFFINE_COORDINATES_GFP 111
+#define EC_F_EC_GFP_SIMPLE_POINT_SET_AFFINE_COORDINATES_GFP 112
+#define EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES_GFP 113
+#define EC_F_EC_GROUP_COPY				 114
+#define EC_F_EC_GROUP_GET0_GENERATOR			 115
+#define EC_F_EC_GROUP_GET_COFACTOR			 116
+#define EC_F_EC_GROUP_GET_CURVE_GFP			 117
+#define EC_F_EC_GROUP_GET_ORDER				 118
+#define EC_F_EC_GROUP_NEW				 119
+#define EC_F_EC_GROUP_PRECOMPUTE_MULT			 120
+#define EC_F_EC_GROUP_SET_CURVE_GFP			 121
+#define EC_F_EC_GROUP_SET_EXTRA_DATA			 122
+#define EC_F_EC_GROUP_SET_GENERATOR			 123
+#define EC_F_EC_POINTS_MAKE_AFFINE			 124
+#define EC_F_EC_POINTS_MUL				 125
+#define EC_F_EC_POINT_ADD				 126
+#define EC_F_EC_POINT_CMP				 127
+#define EC_F_EC_POINT_COPY				 128
+#define EC_F_EC_POINT_DBL				 129
+#define EC_F_EC_POINT_GET_AFFINE_COORDINATES_GFP	 130
+#define EC_F_EC_POINT_GET_JPROJECTIVE_COORDINATES_GFP	 131
+#define EC_F_EC_POINT_IS_AT_INFINITY			 132
+#define EC_F_EC_POINT_IS_ON_CURVE			 133
+#define EC_F_EC_POINT_MAKE_AFFINE			 134
+#define EC_F_EC_POINT_NEW				 135
+#define EC_F_EC_POINT_OCT2POINT				 136
+#define EC_F_EC_POINT_POINT2OCT				 137
+#define EC_F_EC_POINT_SET_AFFINE_COORDINATES_GFP	 138
+#define EC_F_EC_POINT_SET_COMPRESSED_COORDINATES_GFP	 139
+#define EC_F_EC_POINT_SET_JPROJECTIVE_COORDINATES_GFP	 140
+#define EC_F_EC_POINT_SET_TO_INFINITY			 141
+#define EC_F_GFP_MONT_GROUP_SET_CURVE_GFP		 142
 
 /* Reason codes. */
 #define EC_R_BUFFER_TOO_SMALL				 100
 #define EC_R_INCOMPATIBLE_OBJECTS			 101
-#define EC_R_INVALID_ARGUMENT				 112
-#define EC_R_INVALID_COMPRESSED_POINT			 110
-#define EC_R_INVALID_COMPRESSION_BIT			 109
-#define EC_R_INVALID_ENCODING				 102
-#define EC_R_INVALID_FIELD				 103
-#define EC_R_INVALID_FORM				 104
-#define EC_R_NOT_INITIALIZED				 111
-#define EC_R_POINT_AT_INFINITY				 106
-#define EC_R_POINT_IS_NOT_ON_CURVE			 107
-#define EC_R_SLOT_FULL					 108
-#define EC_R_UNDEFINED_GENERATOR			 113
-#define EC_R_UNKNOWN_ORDER				 114
+#define EC_R_INVALID_COMPRESSED_POINT			 102
+#define EC_R_INVALID_COMPRESSION_BIT			 103
+#define EC_R_INVALID_ENCODING				 104
+#define EC_R_INVALID_FIELD				 105
+#define EC_R_INVALID_FORM				 106
+#define EC_R_NOT_INITIALIZED				 107
+#define EC_R_POINT_AT_INFINITY				 108
+#define EC_R_POINT_IS_NOT_ON_CURVE			 109
+#define EC_R_SLOT_FULL					 110
+#define EC_R_UNDEFINED_GENERATOR			 111
+#define EC_R_UNKNOWN_ORDER				 112
 
 #ifdef  __cplusplus
 }
Index: openssl/crypto/ec/ec_err.c
diff -u openssl/crypto/ec/ec_err.c:1.1.1.2 openssl/crypto/ec/ec_err.c:1.1.1.2.12.1
--- openssl/crypto/ec/ec_err.c:1.1.1.2	Sat Feb 22 14:28:09 2003
+++ openssl/crypto/ec/ec_err.c	Sun May  8 14:24:07 2005
@@ -1,6 +1,6 @@
 /* crypto/ec/ec_err.c */
 /* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -116,7 +116,6 @@
 	{
 {EC_R_BUFFER_TOO_SMALL                   ,"buffer too small"},
 {EC_R_INCOMPATIBLE_OBJECTS               ,"incompatible objects"},
-{EC_R_INVALID_ARGUMENT                   ,"invalid argument"},
 {EC_R_INVALID_COMPRESSED_POINT           ,"invalid compressed point"},
 {EC_R_INVALID_COMPRESSION_BIT            ,"invalid compression bit"},
 {EC_R_INVALID_ENCODING                   ,"invalid encoding"},
Index: openssl/crypto/engine/eng_err.c
diff -u openssl/crypto/engine/eng_err.c:1.1.1.1 openssl/crypto/engine/eng_err.c:1.1.1.1.14.1
--- openssl/crypto/engine/eng_err.c:1.1.1.1	Fri Jan 17 23:07:54 2003
+++ openssl/crypto/engine/eng_err.c	Sun May  8 14:24:07 2005
@@ -1,6 +1,6 @@
 /* crypto/engine/eng_err.c */
 /* ====================================================================
- * Copyright (c) 1999-2002 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -78,7 +78,6 @@
 {ERR_PACK(0,ENGINE_F_ENGINE_FINISH,0),	"ENGINE_finish"},
 {ERR_PACK(0,ENGINE_F_ENGINE_FREE,0),	"ENGINE_free"},
 {ERR_PACK(0,ENGINE_F_ENGINE_GET_CIPHER,0),	"ENGINE_get_cipher"},
-{ERR_PACK(0,ENGINE_F_ENGINE_GET_DEFAULT_TYPE,0),	"ENGINE_GET_DEFAULT_TYPE"},
 {ERR_PACK(0,ENGINE_F_ENGINE_GET_DIGEST,0),	"ENGINE_get_digest"},
 {ERR_PACK(0,ENGINE_F_ENGINE_GET_NEXT,0),	"ENGINE_get_next"},
 {ERR_PACK(0,ENGINE_F_ENGINE_GET_PREV,0),	"ENGINE_get_prev"},
@@ -91,15 +90,12 @@
 {ERR_PACK(0,ENGINE_F_ENGINE_NEW,0),	"ENGINE_new"},
 {ERR_PACK(0,ENGINE_F_ENGINE_REMOVE,0),	"ENGINE_remove"},
 {ERR_PACK(0,ENGINE_F_ENGINE_SET_DEFAULT_STRING,0),	"ENGINE_set_default_string"},
-{ERR_PACK(0,ENGINE_F_ENGINE_SET_DEFAULT_TYPE,0),	"ENGINE_SET_DEFAULT_TYPE"},
 {ERR_PACK(0,ENGINE_F_ENGINE_SET_ID,0),	"ENGINE_set_id"},
 {ERR_PACK(0,ENGINE_F_ENGINE_SET_NAME,0),	"ENGINE_set_name"},
 {ERR_PACK(0,ENGINE_F_ENGINE_TABLE_REGISTER,0),	"ENGINE_TABLE_REGISTER"},
-{ERR_PACK(0,ENGINE_F_ENGINE_UNLOAD_KEY,0),	"ENGINE_UNLOAD_KEY"},
 {ERR_PACK(0,ENGINE_F_ENGINE_UP_REF,0),	"ENGINE_up_ref"},
 {ERR_PACK(0,ENGINE_F_INT_CTRL_HELPER,0),	"INT_CTRL_HELPER"},
 {ERR_PACK(0,ENGINE_F_INT_ENGINE_CONFIGURE,0),	"INT_ENGINE_CONFIGURE"},
-{ERR_PACK(0,ENGINE_F_LOG_MESSAGE,0),	"LOG_MESSAGE"},
 {ERR_PACK(0,ENGINE_F_SET_DATA_CTX,0),	"SET_DATA_CTX"},
 {0,NULL}
 	};
@@ -113,18 +109,15 @@
 {ENGINE_R_COMMAND_TAKES_NO_INPUT         ,"command takes no input"},
 {ENGINE_R_CONFLICTING_ENGINE_ID          ,"conflicting engine id"},
 {ENGINE_R_CTRL_COMMAND_NOT_IMPLEMENTED   ,"ctrl command not implemented"},
-{ENGINE_R_DH_NOT_IMPLEMENTED             ,"dh not implemented"},
-{ENGINE_R_DSA_NOT_IMPLEMENTED            ,"dsa not implemented"},
-{ENGINE_R_DSO_FAILURE                    ,"DSO failure"},
+{ENGINE_R_DSO_FAILURE                    ,"dso failure"},
 {ENGINE_R_DSO_NOT_FOUND                  ,"dso not found"},
 {ENGINE_R_ENGINES_SECTION_ERROR          ,"engines section error"},
-{ENGINE_R_ENGINE_IS_NOT_IN_LIST          ,"engine is not in the list"},
+{ENGINE_R_ENGINE_IS_NOT_IN_LIST          ,"engine is not in list"},
 {ENGINE_R_ENGINE_SECTION_ERROR           ,"engine section error"},
 {ENGINE_R_FAILED_LOADING_PRIVATE_KEY     ,"failed loading private key"},
 {ENGINE_R_FAILED_LOADING_PUBLIC_KEY      ,"failed loading public key"},
 {ENGINE_R_FINISH_FAILED                  ,"finish failed"},
-{ENGINE_R_GET_HANDLE_FAILED              ,"could not obtain hardware handle"},
-{ENGINE_R_ID_OR_NAME_MISSING             ,"'id' or 'name' missing"},
+{ENGINE_R_ID_OR_NAME_MISSING             ,"id or name missing"},
 {ENGINE_R_INIT_FAILED                    ,"init failed"},
 {ENGINE_R_INTERNAL_LIST_ERROR            ,"internal list error"},
 {ENGINE_R_INVALID_ARGUMENT               ,"invalid argument"},
@@ -139,9 +132,6 @@
 {ENGINE_R_NO_LOAD_FUNCTION               ,"no load function"},
 {ENGINE_R_NO_REFERENCE                   ,"no reference"},
 {ENGINE_R_NO_SUCH_ENGINE                 ,"no such engine"},
-{ENGINE_R_NO_UNLOAD_FUNCTION             ,"no unload function"},
-{ENGINE_R_PROVIDE_PARAMETERS             ,"provide parameters"},
-{ENGINE_R_RSA_NOT_IMPLEMENTED            ,"rsa not implemented"},
 {ENGINE_R_UNIMPLEMENTED_CIPHER           ,"unimplemented cipher"},
 {ENGINE_R_UNIMPLEMENTED_DIGEST           ,"unimplemented digest"},
 {ENGINE_R_VERSION_INCOMPATIBILITY        ,"version incompatibility"},
Index: openssl/crypto/engine/engine.h
diff -u openssl/crypto/engine/engine.h:1.1.1.5 openssl/crypto/engine/engine.h:1.1.1.5.6.1
--- openssl/crypto/engine/engine.h:1.1.1.5	Sat Mar 20 18:03:43 2004
+++ openssl/crypto/engine/engine.h	Sun May  8 14:24:07 2005
@@ -646,82 +646,72 @@
 /* Error codes for the ENGINE functions. */
 
 /* Function codes. */
-#define ENGINE_F_DYNAMIC_CTRL				 180
-#define ENGINE_F_DYNAMIC_GET_DATA_CTX			 181
-#define ENGINE_F_DYNAMIC_LOAD				 182
-#define ENGINE_F_ENGINE_ADD				 105
-#define ENGINE_F_ENGINE_BY_ID				 106
-#define ENGINE_F_ENGINE_CMD_IS_EXECUTABLE		 170
-#define ENGINE_F_ENGINE_CTRL				 142
-#define ENGINE_F_ENGINE_CTRL_CMD			 178
-#define ENGINE_F_ENGINE_CTRL_CMD_STRING			 171
-#define ENGINE_F_ENGINE_FINISH				 107
-#define ENGINE_F_ENGINE_FREE				 108
-#define ENGINE_F_ENGINE_GET_CIPHER			 185
-#define ENGINE_F_ENGINE_GET_DEFAULT_TYPE		 177
-#define ENGINE_F_ENGINE_GET_DIGEST			 186
-#define ENGINE_F_ENGINE_GET_NEXT			 115
-#define ENGINE_F_ENGINE_GET_PREV			 116
-#define ENGINE_F_ENGINE_INIT				 119
-#define ENGINE_F_ENGINE_LIST_ADD			 120
-#define ENGINE_F_ENGINE_LIST_REMOVE			 121
-#define ENGINE_F_ENGINE_LOAD_PRIVATE_KEY		 150
-#define ENGINE_F_ENGINE_LOAD_PUBLIC_KEY			 151
-#define ENGINE_F_ENGINE_MODULE_INIT			 187
-#define ENGINE_F_ENGINE_NEW				 122
-#define ENGINE_F_ENGINE_REMOVE				 123
-#define ENGINE_F_ENGINE_SET_DEFAULT_STRING		 189
-#define ENGINE_F_ENGINE_SET_DEFAULT_TYPE		 126
-#define ENGINE_F_ENGINE_SET_ID				 129
-#define ENGINE_F_ENGINE_SET_NAME			 130
-#define ENGINE_F_ENGINE_TABLE_REGISTER			 184
-#define ENGINE_F_ENGINE_UNLOAD_KEY			 152
-#define ENGINE_F_ENGINE_UP_REF				 190
-#define ENGINE_F_INT_CTRL_HELPER			 172
-#define ENGINE_F_INT_ENGINE_CONFIGURE			 188
-#define ENGINE_F_LOG_MESSAGE				 141
-#define ENGINE_F_SET_DATA_CTX				 183
+#define ENGINE_F_DYNAMIC_CTRL				 100
+#define ENGINE_F_DYNAMIC_GET_DATA_CTX			 101
+#define ENGINE_F_DYNAMIC_LOAD				 102
+#define ENGINE_F_ENGINE_ADD				 103
+#define ENGINE_F_ENGINE_BY_ID				 104
+#define ENGINE_F_ENGINE_CMD_IS_EXECUTABLE		 105
+#define ENGINE_F_ENGINE_CTRL				 106
+#define ENGINE_F_ENGINE_CTRL_CMD			 107
+#define ENGINE_F_ENGINE_CTRL_CMD_STRING			 108
+#define ENGINE_F_ENGINE_FINISH				 109
+#define ENGINE_F_ENGINE_FREE				 110
+#define ENGINE_F_ENGINE_GET_CIPHER			 111
+#define ENGINE_F_ENGINE_GET_DIGEST			 112
+#define ENGINE_F_ENGINE_GET_NEXT			 113
+#define ENGINE_F_ENGINE_GET_PREV			 114
+#define ENGINE_F_ENGINE_INIT				 115
+#define ENGINE_F_ENGINE_LIST_ADD			 116
+#define ENGINE_F_ENGINE_LIST_REMOVE			 117
+#define ENGINE_F_ENGINE_LOAD_PRIVATE_KEY		 118
+#define ENGINE_F_ENGINE_LOAD_PUBLIC_KEY			 119
+#define ENGINE_F_ENGINE_MODULE_INIT			 120
+#define ENGINE_F_ENGINE_NEW				 121
+#define ENGINE_F_ENGINE_REMOVE				 122
+#define ENGINE_F_ENGINE_SET_DEFAULT_STRING		 123
+#define ENGINE_F_ENGINE_SET_ID				 124
+#define ENGINE_F_ENGINE_SET_NAME			 125
+#define ENGINE_F_ENGINE_TABLE_REGISTER			 126
+#define ENGINE_F_ENGINE_UP_REF				 127
+#define ENGINE_F_INT_CTRL_HELPER			 128
+#define ENGINE_F_INT_ENGINE_CONFIGURE			 129
+#define ENGINE_F_SET_DATA_CTX				 130
 
 /* Reason codes. */
 #define ENGINE_R_ALREADY_LOADED				 100
-#define ENGINE_R_ARGUMENT_IS_NOT_A_NUMBER		 133
-#define ENGINE_R_CMD_NOT_EXECUTABLE			 134
-#define ENGINE_R_COMMAND_TAKES_INPUT			 135
-#define ENGINE_R_COMMAND_TAKES_NO_INPUT			 136
-#define ENGINE_R_CONFLICTING_ENGINE_ID			 103
-#define ENGINE_R_CTRL_COMMAND_NOT_IMPLEMENTED		 119
-#define ENGINE_R_DH_NOT_IMPLEMENTED			 139
-#define ENGINE_R_DSA_NOT_IMPLEMENTED			 140
-#define ENGINE_R_DSO_FAILURE				 104
-#define ENGINE_R_DSO_NOT_FOUND				 132
-#define ENGINE_R_ENGINES_SECTION_ERROR			 148
-#define ENGINE_R_ENGINE_IS_NOT_IN_LIST			 105
-#define ENGINE_R_ENGINE_SECTION_ERROR			 149
-#define ENGINE_R_FAILED_LOADING_PRIVATE_KEY		 128
-#define ENGINE_R_FAILED_LOADING_PUBLIC_KEY		 129
-#define ENGINE_R_FINISH_FAILED				 106
-#define ENGINE_R_GET_HANDLE_FAILED			 107
-#define ENGINE_R_ID_OR_NAME_MISSING			 108
-#define ENGINE_R_INIT_FAILED				 109
-#define ENGINE_R_INTERNAL_LIST_ERROR			 110
-#define ENGINE_R_INVALID_ARGUMENT			 143
-#define ENGINE_R_INVALID_CMD_NAME			 137
-#define ENGINE_R_INVALID_CMD_NUMBER			 138
-#define ENGINE_R_INVALID_INIT_VALUE			 151
-#define ENGINE_R_INVALID_STRING				 150
-#define ENGINE_R_NOT_INITIALISED			 117
-#define ENGINE_R_NOT_LOADED				 112
-#define ENGINE_R_NO_CONTROL_FUNCTION			 120
-#define ENGINE_R_NO_INDEX				 144
-#define ENGINE_R_NO_LOAD_FUNCTION			 125
-#define ENGINE_R_NO_REFERENCE				 130
-#define ENGINE_R_NO_SUCH_ENGINE				 116
-#define ENGINE_R_NO_UNLOAD_FUNCTION			 126
-#define ENGINE_R_PROVIDE_PARAMETERS			 113
-#define ENGINE_R_RSA_NOT_IMPLEMENTED			 141
-#define ENGINE_R_UNIMPLEMENTED_CIPHER			 146
-#define ENGINE_R_UNIMPLEMENTED_DIGEST			 147
-#define ENGINE_R_VERSION_INCOMPATIBILITY		 145
+#define ENGINE_R_ARGUMENT_IS_NOT_A_NUMBER		 101
+#define ENGINE_R_CMD_NOT_EXECUTABLE			 102
+#define ENGINE_R_COMMAND_TAKES_INPUT			 103
+#define ENGINE_R_COMMAND_TAKES_NO_INPUT			 104
+#define ENGINE_R_CONFLICTING_ENGINE_ID			 105
+#define ENGINE_R_CTRL_COMMAND_NOT_IMPLEMENTED		 106
+#define ENGINE_R_DSO_FAILURE				 107
+#define ENGINE_R_DSO_NOT_FOUND				 108
+#define ENGINE_R_ENGINES_SECTION_ERROR			 109
+#define ENGINE_R_ENGINE_IS_NOT_IN_LIST			 110
+#define ENGINE_R_ENGINE_SECTION_ERROR			 111
+#define ENGINE_R_FAILED_LOADING_PRIVATE_KEY		 112
+#define ENGINE_R_FAILED_LOADING_PUBLIC_KEY		 113
+#define ENGINE_R_FINISH_FAILED				 114
+#define ENGINE_R_ID_OR_NAME_MISSING			 115
+#define ENGINE_R_INIT_FAILED				 116
+#define ENGINE_R_INTERNAL_LIST_ERROR			 117
+#define ENGINE_R_INVALID_ARGUMENT			 118
+#define ENGINE_R_INVALID_CMD_NAME			 119
+#define ENGINE_R_INVALID_CMD_NUMBER			 120
+#define ENGINE_R_INVALID_INIT_VALUE			 121
+#define ENGINE_R_INVALID_STRING				 122
+#define ENGINE_R_NOT_INITIALISED			 123
+#define ENGINE_R_NOT_LOADED				 124
+#define ENGINE_R_NO_CONTROL_FUNCTION			 125
+#define ENGINE_R_NO_INDEX				 126
+#define ENGINE_R_NO_LOAD_FUNCTION			 127
+#define ENGINE_R_NO_REFERENCE				 128
+#define ENGINE_R_NO_SUCH_ENGINE				 129
+#define ENGINE_R_UNIMPLEMENTED_CIPHER			 130
+#define ENGINE_R_UNIMPLEMENTED_DIGEST			 131
+#define ENGINE_R_VERSION_INCOMPATIBILITY		 132
 
 #ifdef  __cplusplus
 }
Index: openssl/crypto/err/Makefile
diff -u openssl/crypto/err/Makefile:1.1.1.2 openssl/crypto/err/Makefile:1.1.1.2.2.1
--- openssl/crypto/err/Makefile:1.1.1.2	Sun May  8 13:20:00 2005
+++ openssl/crypto/err/Makefile	Sun May  8 14:24:07 2005
@@ -105,10 +105,10 @@
 err_all.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
 err_all.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 err_all.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
-err_all.o: ../../include/openssl/symhacks.h ../../include/openssl/ui.h
-err_all.o: ../../include/openssl/ui_compat.h ../../include/openssl/x509.h
-err_all.o: ../../include/openssl/x509_vfy.h ../../include/openssl/x509v3.h
-err_all.o: err_all.c
+err_all.o: ../../include/openssl/symhacks.h ../../include/openssl/ts.h
+err_all.o: ../../include/openssl/ui.h ../../include/openssl/ui_compat.h
+err_all.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+err_all.o: ../../include/openssl/x509v3.h err_all.c
 err_prn.o: ../../e_os.h ../../include/openssl/bio.h
 err_prn.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 err_prn.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
Index: openssl/crypto/err/err.c
diff -u openssl/crypto/err/err.c:1.1.1.8 openssl/crypto/err/err.c:1.1.1.8.2.1
--- openssl/crypto/err/err.c:1.1.1.8	Sun May  8 13:20:00 2005
+++ openssl/crypto/err/err.c	Sun May  8 14:24:07 2005
@@ -147,6 +147,7 @@
 {ERR_PACK(ERR_LIB_PKCS12,0,0)		,"PKCS12 routines"},
 {ERR_PACK(ERR_LIB_RAND,0,0)		,"random number generator"},
 {ERR_PACK(ERR_LIB_DSO,0,0)		,"DSO support routines"},
+{ERR_PACK(ERR_LIB_TS,0,0)		,"time stamp routines"},
 {ERR_PACK(ERR_LIB_ENGINE,0,0)		,"engine routines"},
 {ERR_PACK(ERR_LIB_OCSP,0,0)		,"OCSP routines"},
 {ERR_PACK(ERR_LIB_FIPS,0,0)		,"FIPS routines"},
@@ -197,6 +198,7 @@
 {ERR_R_DSO_LIB				,"DSO lib"},
 {ERR_R_ENGINE_LIB			,"ENGINE lib"},
 {ERR_R_OCSP_LIB				,"OCSP lib"},
+{ERR_R_TS_LIB				,"TS lib"},
 
 {ERR_R_NESTED_ASN1_ERROR		,"nested asn1 error"},
 {ERR_R_BAD_ASN1_OBJECT_HEADER		,"bad asn1 object header"},
Index: openssl/crypto/err/err.h
diff -u openssl/crypto/err/err.h:1.1.1.6 openssl/crypto/err/err.h:1.1.1.6.2.1
--- openssl/crypto/err/err.h:1.1.1.6	Sun May  8 13:20:00 2005
+++ openssl/crypto/err/err.h	Sun May  8 14:24:07 2005
@@ -132,6 +132,7 @@
 #define ERR_LIB_UI              40
 #define ERR_LIB_COMP            41
 #define ERR_LIB_FIPS		42
+#define ERR_LIB_TS		43
 
 #define ERR_LIB_USER		128
 
@@ -161,6 +162,7 @@
 #define UIerr(f,r) ERR_PUT_error(ERR_LIB_UI,(f),(r),__FILE__,__LINE__)
 #define COMPerr(f,r) ERR_PUT_error(ERR_LIB_COMP,(f),(r),__FILE__,__LINE__)
 #define FIPSerr(f,r) ERR_PUT_error(ERR_LIB_FIPS,(f),(r),__FILE__,__LINE__)
+#define TSerr(f,r) ERR_PUT_error(ERR_LIB_TS,(f),(r),__FILE__,__LINE__)
 
 /* Borland C seems too stupid to be able to shift and do longs in
  * the pre-processor :-( */
@@ -214,6 +216,7 @@
 #define ERR_R_OCSP_LIB  ERR_LIB_OCSP     /* 39 */
 #define ERR_R_UI_LIB    ERR_LIB_UI       /* 40 */
 #define ERR_R_COMP_LIB	ERR_LIB_COMP     /* 41 */
+#define ERR_R_TS_LIB	ERR_LIB_TS       /* 42 */
 
 #define ERR_R_NESTED_ASN1_ERROR			58
 #define ERR_R_BAD_ASN1_OBJECT_HEADER		59
Index: openssl/crypto/err/err_all.c
diff -u openssl/crypto/err/err_all.c:1.1.1.5 openssl/crypto/err/err_all.c:1.1.1.5.4.1
--- openssl/crypto/err/err_all.c:1.1.1.5	Mon Nov  8 16:32:34 2004
+++ openssl/crypto/err/err_all.c	Sun May  8 14:24:07 2005
@@ -88,6 +88,7 @@
 #include <openssl/ocsp.h>
 #include <openssl/err.h>
 #include <openssl/fips.h>
+#include <openssl/ts.h>
 
 void ERR_load_crypto_strings(void)
 	{
@@ -125,6 +126,7 @@
 	ERR_load_PKCS12_strings();
 	ERR_load_RAND_strings();
 	ERR_load_DSO_strings();
+	ERR_load_TS_strings();
 #ifndef OPENSSL_NO_ENGINE
 	ERR_load_ENGINE_strings();
 #endif
Index: openssl/crypto/err/openssl.ec
diff -u openssl/crypto/err/openssl.ec:1.1.1.4 openssl/crypto/err/openssl.ec:1.1.1.4.4.1
--- openssl/crypto/err/openssl.ec:1.1.1.4	Mon Nov  8 16:32:34 2004
+++ openssl/crypto/err/openssl.ec	Sun May  8 14:24:07 2005
@@ -27,6 +27,7 @@
 L ENGINE	crypto/engine/engine.h		crypto/engine/eng_err.c
 L OCSP		crypto/ocsp/ocsp.h		crypto/ocsp/ocsp_err.c
 L UI		crypto/ui/ui.h			crypto/ui/ui_err.c
+L TS		crypto/ts/ts.h			crypto/ts/ts_err.c
 L FIPS		fips/fips.h			fips/fips_err.h
 
 # additional header files to be scanned for function names
Index: openssl/crypto/objects/obj_err.c
diff -u openssl/crypto/objects/obj_err.c:1.1.1.3 openssl/crypto/objects/obj_err.c:1.1.1.3.2.1
--- openssl/crypto/objects/obj_err.c:1.1.1.3	Sun May  8 13:20:04 2005
+++ openssl/crypto/objects/obj_err.c	Sun May  8 14:24:07 2005
@@ -1,6 +1,6 @@
 /* crypto/objects/obj_err.c */
 /* ====================================================================
- * Copyright (c) 1999-2004 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
Index: openssl/crypto/ocsp/ocsp.h
diff -u openssl/crypto/ocsp/ocsp.h:1.1.1.1 openssl/crypto/ocsp/ocsp.h:1.1.1.1.14.1
--- openssl/crypto/ocsp/ocsp.h:1.1.1.1	Fri Jan 17 23:07:57 2003
+++ openssl/crypto/ocsp/ocsp.h	Sun May  8 14:24:07 2005
@@ -572,46 +572,44 @@
 #define OCSP_F_OCSP_CHECK_DELEGATED			 106
 #define OCSP_F_OCSP_CHECK_IDS				 107
 #define OCSP_F_OCSP_CHECK_ISSUER			 108
-#define OCSP_F_OCSP_CHECK_VALIDITY			 115
-#define OCSP_F_OCSP_MATCH_ISSUERID			 109
-#define OCSP_F_OCSP_PARSE_URL				 114
-#define OCSP_F_OCSP_REQUEST_SIGN			 110
-#define OCSP_F_OCSP_REQUEST_VERIFY			 116
-#define OCSP_F_OCSP_RESPONSE_GET1_BASIC			 111
-#define OCSP_F_OCSP_SENDREQ_BIO				 112
-#define OCSP_F_REQUEST_VERIFY				 113
+#define OCSP_F_OCSP_CHECK_VALIDITY			 109
+#define OCSP_F_OCSP_MATCH_ISSUERID			 110
+#define OCSP_F_OCSP_PARSE_URL				 111
+#define OCSP_F_OCSP_REQUEST_SIGN			 112
+#define OCSP_F_OCSP_REQUEST_VERIFY			 113
+#define OCSP_F_OCSP_RESPONSE_GET1_BASIC			 114
+#define OCSP_F_OCSP_SENDREQ_BIO				 115
 
 /* Reason codes. */
 #define OCSP_R_BAD_DATA					 100
 #define OCSP_R_CERTIFICATE_VERIFY_ERROR			 101
 #define OCSP_R_DIGEST_ERR				 102
-#define OCSP_R_ERROR_IN_NEXTUPDATE_FIELD		 122
-#define OCSP_R_ERROR_IN_THISUPDATE_FIELD		 123
-#define OCSP_R_ERROR_PARSING_URL			 121
-#define OCSP_R_MISSING_OCSPSIGNING_USAGE		 103
-#define OCSP_R_NEXTUPDATE_BEFORE_THISUPDATE		 124
-#define OCSP_R_NOT_BASIC_RESPONSE			 104
-#define OCSP_R_NO_CERTIFICATES_IN_CHAIN			 105
-#define OCSP_R_NO_CONTENT				 106
-#define OCSP_R_NO_PUBLIC_KEY				 107
-#define OCSP_R_NO_RESPONSE_DATA				 108
-#define OCSP_R_NO_REVOKED_TIME				 109
-#define OCSP_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE	 110
-#define OCSP_R_REQUEST_NOT_SIGNED			 128
-#define OCSP_R_RESPONSE_CONTAINS_NO_REVOCATION_DATA	 111
-#define OCSP_R_ROOT_CA_NOT_TRUSTED			 112
-#define OCSP_R_SERVER_READ_ERROR			 113
-#define OCSP_R_SERVER_RESPONSE_ERROR			 114
-#define OCSP_R_SERVER_RESPONSE_PARSE_ERROR		 115
-#define OCSP_R_SERVER_WRITE_ERROR			 116
-#define OCSP_R_SIGNATURE_FAILURE			 117
-#define OCSP_R_SIGNER_CERTIFICATE_NOT_FOUND		 118
-#define OCSP_R_STATUS_EXPIRED				 125
-#define OCSP_R_STATUS_NOT_YET_VALID			 126
-#define OCSP_R_STATUS_TOO_OLD				 127
-#define OCSP_R_UNKNOWN_MESSAGE_DIGEST			 119
-#define OCSP_R_UNKNOWN_NID				 120
-#define OCSP_R_UNSUPPORTED_REQUESTORNAME_TYPE		 129
+#define OCSP_R_ERROR_IN_NEXTUPDATE_FIELD		 103
+#define OCSP_R_ERROR_IN_THISUPDATE_FIELD		 104
+#define OCSP_R_ERROR_PARSING_URL			 105
+#define OCSP_R_MISSING_OCSPSIGNING_USAGE		 106
+#define OCSP_R_NEXTUPDATE_BEFORE_THISUPDATE		 107
+#define OCSP_R_NOT_BASIC_RESPONSE			 108
+#define OCSP_R_NO_CERTIFICATES_IN_CHAIN			 109
+#define OCSP_R_NO_CONTENT				 110
+#define OCSP_R_NO_RESPONSE_DATA				 111
+#define OCSP_R_NO_REVOKED_TIME				 112
+#define OCSP_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE	 113
+#define OCSP_R_REQUEST_NOT_SIGNED			 114
+#define OCSP_R_RESPONSE_CONTAINS_NO_REVOCATION_DATA	 115
+#define OCSP_R_ROOT_CA_NOT_TRUSTED			 116
+#define OCSP_R_SERVER_READ_ERROR			 117
+#define OCSP_R_SERVER_RESPONSE_ERROR			 118
+#define OCSP_R_SERVER_RESPONSE_PARSE_ERROR		 119
+#define OCSP_R_SERVER_WRITE_ERROR			 120
+#define OCSP_R_SIGNATURE_FAILURE			 121
+#define OCSP_R_SIGNER_CERTIFICATE_NOT_FOUND		 122
+#define OCSP_R_STATUS_EXPIRED				 123
+#define OCSP_R_STATUS_NOT_YET_VALID			 124
+#define OCSP_R_STATUS_TOO_OLD				 125
+#define OCSP_R_UNKNOWN_MESSAGE_DIGEST			 126
+#define OCSP_R_UNKNOWN_NID				 127
+#define OCSP_R_UNSUPPORTED_REQUESTORNAME_TYPE		 128
 
 #ifdef  __cplusplus
 }
Index: openssl/crypto/ocsp/ocsp_err.c
diff -u openssl/crypto/ocsp/ocsp_err.c:1.1.1.1 openssl/crypto/ocsp/ocsp_err.c:1.1.1.1.14.1
--- openssl/crypto/ocsp/ocsp_err.c:1.1.1.1	Fri Jan 17 23:07:57 2003
+++ openssl/crypto/ocsp/ocsp_err.c	Sun May  8 14:24:07 2005
@@ -1,6 +1,6 @@
 /* crypto/ocsp/ocsp_err.c */
 /* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -82,7 +82,6 @@
 {ERR_PACK(0,OCSP_F_OCSP_REQUEST_VERIFY,0),	"OCSP_request_verify"},
 {ERR_PACK(0,OCSP_F_OCSP_RESPONSE_GET1_BASIC,0),	"OCSP_response_get1_basic"},
 {ERR_PACK(0,OCSP_F_OCSP_SENDREQ_BIO,0),	"OCSP_sendreq_bio"},
-{ERR_PACK(0,OCSP_F_REQUEST_VERIFY,0),	"REQUEST_VERIFY"},
 {0,NULL}
 	};
 
@@ -99,7 +98,6 @@
 {OCSP_R_NOT_BASIC_RESPONSE               ,"not basic response"},
 {OCSP_R_NO_CERTIFICATES_IN_CHAIN         ,"no certificates in chain"},
 {OCSP_R_NO_CONTENT                       ,"no content"},
-{OCSP_R_NO_PUBLIC_KEY                    ,"no public key"},
 {OCSP_R_NO_RESPONSE_DATA                 ,"no response data"},
 {OCSP_R_NO_REVOKED_TIME                  ,"no revoked time"},
 {OCSP_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE,"private key does not match certificate"},
Index: openssl/crypto/pem/pem.h
diff -u openssl/crypto/pem/pem.h:1.1.1.2 openssl/crypto/pem/pem.h:1.1.1.2.14.1
--- openssl/crypto/pem/pem.h:1.1.1.2	Fri Jan 17 23:07:57 2003
+++ openssl/crypto/pem/pem.h	Sun May  8 14:24:07 2005
@@ -624,29 +624,28 @@
 /* Error codes for the PEM functions. */
 
 /* Function codes. */
-#define PEM_F_D2I_PKCS8PRIVATEKEY_BIO			 120
-#define PEM_F_D2I_PKCS8PRIVATEKEY_FP			 121
-#define PEM_F_DEF_CALLBACK				 100
-#define PEM_F_LOAD_IV					 101
-#define PEM_F_PEM_ASN1_READ				 102
-#define PEM_F_PEM_ASN1_READ_BIO				 103
-#define PEM_F_PEM_ASN1_WRITE				 104
-#define PEM_F_PEM_ASN1_WRITE_BIO			 105
-#define PEM_F_PEM_DO_HEADER				 106
-#define PEM_F_PEM_F_DO_PK8KEY_FP			 122
-#define PEM_F_PEM_F_PEM_WRITE_PKCS8PRIVATEKEY		 118
-#define PEM_F_PEM_GET_EVP_CIPHER_INFO			 107
-#define PEM_F_PEM_READ					 108
-#define PEM_F_PEM_READ_BIO				 109
-#define PEM_F_PEM_SEALFINAL				 110
-#define PEM_F_PEM_SEALINIT				 111
-#define PEM_F_PEM_SIGNFINAL				 112
-#define PEM_F_PEM_WRITE					 113
-#define PEM_F_PEM_WRITE_BIO				 114
-#define PEM_F_PEM_WRITE_BIO_PKCS8PRIVATEKEY		 119
-#define PEM_F_PEM_X509_INFO_READ			 115
-#define PEM_F_PEM_X509_INFO_READ_BIO			 116
-#define PEM_F_PEM_X509_INFO_WRITE_BIO			 117
+#define PEM_F_D2I_PKCS8PRIVATEKEY_BIO			 100
+#define PEM_F_D2I_PKCS8PRIVATEKEY_FP			 101
+#define PEM_F_DEF_CALLBACK				 102
+#define PEM_F_LOAD_IV					 103
+#define PEM_F_PEM_ASN1_READ				 104
+#define PEM_F_PEM_ASN1_READ_BIO				 105
+#define PEM_F_PEM_ASN1_WRITE				 106
+#define PEM_F_PEM_ASN1_WRITE_BIO			 107
+#define PEM_F_PEM_DO_HEADER				 108
+#define PEM_F_PEM_F_DO_PK8KEY_FP			 109
+#define PEM_F_PEM_GET_EVP_CIPHER_INFO			 110
+#define PEM_F_PEM_READ					 111
+#define PEM_F_PEM_READ_BIO				 112
+#define PEM_F_PEM_SEALFINAL				 113
+#define PEM_F_PEM_SEALINIT				 114
+#define PEM_F_PEM_SIGNFINAL				 115
+#define PEM_F_PEM_WRITE					 116
+#define PEM_F_PEM_WRITE_BIO				 117
+#define PEM_F_PEM_WRITE_BIO_PKCS8PRIVATEKEY		 118
+#define PEM_F_PEM_X509_INFO_READ			 119
+#define PEM_F_PEM_X509_INFO_READ_BIO			 120
+#define PEM_F_PEM_X509_INFO_WRITE_BIO			 121
 
 /* Reason codes. */
 #define PEM_R_BAD_BASE64_DECODE				 100
@@ -654,17 +653,17 @@
 #define PEM_R_BAD_END_LINE				 102
 #define PEM_R_BAD_IV_CHARS				 103
 #define PEM_R_BAD_PASSWORD_READ				 104
-#define PEM_R_ERROR_CONVERTING_PRIVATE_KEY		 115
-#define PEM_R_NOT_DEK_INFO				 105
-#define PEM_R_NOT_ENCRYPTED				 106
-#define PEM_R_NOT_PROC_TYPE				 107
-#define PEM_R_NO_START_LINE				 108
-#define PEM_R_PROBLEMS_GETTING_PASSWORD			 109
-#define PEM_R_PUBLIC_KEY_NO_RSA				 110
-#define PEM_R_READ_KEY					 111
-#define PEM_R_SHORT_HEADER				 112
-#define PEM_R_UNSUPPORTED_CIPHER			 113
-#define PEM_R_UNSUPPORTED_ENCRYPTION			 114
+#define PEM_R_ERROR_CONVERTING_PRIVATE_KEY		 105
+#define PEM_R_NOT_DEK_INFO				 106
+#define PEM_R_NOT_ENCRYPTED				 107
+#define PEM_R_NOT_PROC_TYPE				 108
+#define PEM_R_NO_START_LINE				 109
+#define PEM_R_PROBLEMS_GETTING_PASSWORD			 110
+#define PEM_R_PUBLIC_KEY_NO_RSA				 111
+#define PEM_R_READ_KEY					 112
+#define PEM_R_SHORT_HEADER				 113
+#define PEM_R_UNSUPPORTED_CIPHER			 114
+#define PEM_R_UNSUPPORTED_ENCRYPTION			 115
 
 #ifdef  __cplusplus
 }
Index: openssl/crypto/pem/pem_err.c
diff -u openssl/crypto/pem/pem_err.c:1.1.1.2 openssl/crypto/pem/pem_err.c:1.1.1.2.14.1
--- openssl/crypto/pem/pem_err.c:1.1.1.2	Fri Jan 17 23:07:57 2003
+++ openssl/crypto/pem/pem_err.c	Sun May  8 14:24:07 2005
@@ -1,6 +1,6 @@
 /* crypto/pem/pem_err.c */
 /* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -76,7 +76,6 @@
 {ERR_PACK(0,PEM_F_PEM_ASN1_WRITE_BIO,0),	"PEM_ASN1_write_bio"},
 {ERR_PACK(0,PEM_F_PEM_DO_HEADER,0),	"PEM_do_header"},
 {ERR_PACK(0,PEM_F_PEM_F_DO_PK8KEY_FP,0),	"PEM_F_DO_PK8KEY_FP"},
-{ERR_PACK(0,PEM_F_PEM_F_PEM_WRITE_PKCS8PRIVATEKEY,0),	"PEM_F_PEM_WRITE_PKCS8PRIVATEKEY"},
 {ERR_PACK(0,PEM_F_PEM_GET_EVP_CIPHER_INFO,0),	"PEM_get_EVP_CIPHER_INFO"},
 {ERR_PACK(0,PEM_F_PEM_READ,0),	"PEM_read"},
 {ERR_PACK(0,PEM_F_PEM_READ_BIO,0),	"PEM_read_bio"},
Index: openssl/crypto/pkcs12/pk12err.c
diff -u openssl/crypto/pkcs12/pk12err.c:1.1.1.2 openssl/crypto/pkcs12/pk12err.c:1.1.1.2.14.1
--- openssl/crypto/pkcs12/pk12err.c:1.1.1.2	Fri Jan 17 23:07:58 2003
+++ openssl/crypto/pkcs12/pk12err.c	Sun May  8 14:24:07 2005
@@ -1,6 +1,6 @@
 /* crypto/pkcs12/pk12err.c */
 /* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -67,14 +67,10 @@
 static ERR_STRING_DATA PKCS12_str_functs[]=
 	{
 {ERR_PACK(0,PKCS12_F_PARSE_BAGS,0),	"PARSE_BAGS"},
-{ERR_PACK(0,PKCS12_F_PKCS12_ADD_FRIENDLYNAME,0),	"PKCS12_ADD_FRIENDLYNAME"},
-{ERR_PACK(0,PKCS12_F_PKCS12_ADD_FRIENDLYNAME_ASC,0),	"PKCS12_add_friendlyname_asc"},
-{ERR_PACK(0,PKCS12_F_PKCS12_ADD_FRIENDLYNAME_UNI,0),	"PKCS12_add_friendlyname_uni"},
-{ERR_PACK(0,PKCS12_F_PKCS12_ADD_LOCALKEYID,0),	"PKCS12_add_localkeyid"},
 {ERR_PACK(0,PKCS12_F_PKCS12_CREATE,0),	"PKCS12_create"},
-{ERR_PACK(0,PKCS12_F_PKCS12_DECRYPT_D2I,0),	"PKCS12_decrypt_d2i"},
+{ERR_PACK(0,PKCS12_F_PKCS12_DECRYPT_D2I,0),	"PKCS12_DECRYPT_D2I"},
 {ERR_PACK(0,PKCS12_F_PKCS12_GEN_MAC,0),	"PKCS12_gen_mac"},
-{ERR_PACK(0,PKCS12_F_PKCS12_I2D_ENCRYPT,0),	"PKCS12_i2d_encrypt"},
+{ERR_PACK(0,PKCS12_F_PKCS12_I2D_ENCRYPT,0),	"PKCS12_I2D_ENCRYPT"},
 {ERR_PACK(0,PKCS12_F_PKCS12_INIT,0),	"PKCS12_init"},
 {ERR_PACK(0,PKCS12_F_PKCS12_KEY_GEN_ASC,0),	"PKCS12_key_gen_asc"},
 {ERR_PACK(0,PKCS12_F_PKCS12_KEY_GEN_UNI,0),	"PKCS12_key_gen_uni"},
@@ -83,13 +79,12 @@
 {ERR_PACK(0,PKCS12_F_PKCS12_NEWPASS,0),	"PKCS12_newpass"},
 {ERR_PACK(0,PKCS12_F_PKCS12_PACK_P7DATA,0),	"PKCS12_pack_p7data"},
 {ERR_PACK(0,PKCS12_F_PKCS12_PACK_P7ENCDATA,0),	"PKCS12_pack_p7encdata"},
-{ERR_PACK(0,PKCS12_F_PKCS12_PACK_SAFEBAG,0),	"PKCS12_pack_safebag"},
+{ERR_PACK(0,PKCS12_F_PKCS12_PACK_SAFEBAG,0),	"PKCS12_PACK_SAFEBAG"},
 {ERR_PACK(0,PKCS12_F_PKCS12_PARSE,0),	"PKCS12_parse"},
 {ERR_PACK(0,PKCS12_F_PKCS12_PBE_CRYPT,0),	"PKCS12_pbe_crypt"},
 {ERR_PACK(0,PKCS12_F_PKCS12_PBE_KEYIVGEN,0),	"PKCS12_PBE_keyivgen"},
 {ERR_PACK(0,PKCS12_F_PKCS12_SETUP_MAC,0),	"PKCS12_setup_mac"},
 {ERR_PACK(0,PKCS12_F_PKCS12_SET_MAC,0),	"PKCS12_set_mac"},
-{ERR_PACK(0,PKCS12_F_PKCS8_ADD_KEYUSAGE,0),	"PKCS8_add_keyusage"},
 {ERR_PACK(0,PKCS12_F_PKCS8_ENCRYPT,0),	"PKCS8_encrypt"},
 {ERR_PACK(0,PKCS12_F_VERIFY_MAC,0),	"VERIFY_MAC"},
 {0,NULL}
@@ -110,7 +105,6 @@
 {PKCS12_R_MAC_GENERATION_ERROR           ,"mac generation error"},
 {PKCS12_R_MAC_SETUP_ERROR                ,"mac setup error"},
 {PKCS12_R_MAC_STRING_SET_ERROR           ,"mac string set error"},
-{PKCS12_R_MAC_VERIFY_ERROR               ,"mac verify error"},
 {PKCS12_R_MAC_VERIFY_FAILURE             ,"mac verify failure"},
 {PKCS12_R_PARSE_ERROR                    ,"parse error"},
 {PKCS12_R_PKCS12_ALGOR_CIPHERINIT_ERROR  ,"pkcs12 algor cipherinit error"},
Index: openssl/crypto/pkcs12/pkcs12.h
diff -u openssl/crypto/pkcs12/pkcs12.h:1.1.1.3 openssl/crypto/pkcs12/pkcs12.h:1.1.1.3.14.1
--- openssl/crypto/pkcs12/pkcs12.h:1.1.1.3	Fri Jan 17 23:07:58 2003
+++ openssl/crypto/pkcs12/pkcs12.h	Sun May  8 14:24:07 2005
@@ -264,48 +264,42 @@
 /* Error codes for the PKCS12 functions. */
 
 /* Function codes. */
-#define PKCS12_F_PARSE_BAGS				 103
-#define PKCS12_F_PKCS12_ADD_FRIENDLYNAME		 100
-#define PKCS12_F_PKCS12_ADD_FRIENDLYNAME_ASC		 127
-#define PKCS12_F_PKCS12_ADD_FRIENDLYNAME_UNI		 102
-#define PKCS12_F_PKCS12_ADD_LOCALKEYID			 104
-#define PKCS12_F_PKCS12_CREATE				 105
-#define PKCS12_F_PKCS12_DECRYPT_D2I			 106
-#define PKCS12_F_PKCS12_GEN_MAC				 107
-#define PKCS12_F_PKCS12_I2D_ENCRYPT			 108
-#define PKCS12_F_PKCS12_INIT				 109
-#define PKCS12_F_PKCS12_KEY_GEN_ASC			 110
-#define PKCS12_F_PKCS12_KEY_GEN_UNI			 111
-#define PKCS12_F_PKCS12_MAKE_KEYBAG			 112
-#define PKCS12_F_PKCS12_MAKE_SHKEYBAG			 113
-#define PKCS12_F_PKCS12_NEWPASS				 128
-#define PKCS12_F_PKCS12_PACK_P7DATA			 114
-#define PKCS12_F_PKCS12_PACK_P7ENCDATA			 115
-#define PKCS12_F_PKCS12_PACK_SAFEBAG			 117
-#define PKCS12_F_PKCS12_PARSE				 118
-#define PKCS12_F_PKCS12_PBE_CRYPT			 119
-#define PKCS12_F_PKCS12_PBE_KEYIVGEN			 120
-#define PKCS12_F_PKCS12_SETUP_MAC			 122
-#define PKCS12_F_PKCS12_SET_MAC				 123
-#define PKCS12_F_PKCS8_ADD_KEYUSAGE			 124
-#define PKCS12_F_PKCS8_ENCRYPT				 125
-#define PKCS12_F_VERIFY_MAC				 126
+#define PKCS12_F_PARSE_BAGS				 100
+#define PKCS12_F_PKCS12_CREATE				 101
+#define PKCS12_F_PKCS12_DECRYPT_D2I			 102
+#define PKCS12_F_PKCS12_GEN_MAC				 103
+#define PKCS12_F_PKCS12_I2D_ENCRYPT			 104
+#define PKCS12_F_PKCS12_INIT				 105
+#define PKCS12_F_PKCS12_KEY_GEN_ASC			 106
+#define PKCS12_F_PKCS12_KEY_GEN_UNI			 107
+#define PKCS12_F_PKCS12_MAKE_KEYBAG			 108
+#define PKCS12_F_PKCS12_MAKE_SHKEYBAG			 109
+#define PKCS12_F_PKCS12_NEWPASS				 110
+#define PKCS12_F_PKCS12_PACK_P7DATA			 111
+#define PKCS12_F_PKCS12_PACK_P7ENCDATA			 112
+#define PKCS12_F_PKCS12_PACK_SAFEBAG			 113
+#define PKCS12_F_PKCS12_PARSE				 114
+#define PKCS12_F_PKCS12_PBE_CRYPT			 115
+#define PKCS12_F_PKCS12_PBE_KEYIVGEN			 116
+#define PKCS12_F_PKCS12_SETUP_MAC			 117
+#define PKCS12_F_PKCS12_SET_MAC				 118
+#define PKCS12_F_PKCS8_ENCRYPT				 119
+#define PKCS12_F_VERIFY_MAC				 120
 
 /* Reason codes. */
 #define PKCS12_R_CANT_PACK_STRUCTURE			 100
 #define PKCS12_R_DECODE_ERROR				 101
 #define PKCS12_R_ENCODE_ERROR				 102
 #define PKCS12_R_ENCRYPT_ERROR				 103
-#define PKCS12_R_ERROR_SETTING_ENCRYPTED_DATA_TYPE	 120
-#define PKCS12_R_INVALID_NULL_ARGUMENT			 104
-#define PKCS12_R_INVALID_NULL_PKCS12_POINTER		 105
-#define PKCS12_R_IV_GEN_ERROR				 106
-#define PKCS12_R_KEY_GEN_ERROR				 107
-#define PKCS12_R_MAC_ABSENT				 108
-#define PKCS12_R_MAC_GENERATION_ERROR			 109
-#define PKCS12_R_MAC_SETUP_ERROR			 110
-#define PKCS12_R_MAC_STRING_SET_ERROR			 111
-#define PKCS12_R_MAC_VERIFY_ERROR			 112
+#define PKCS12_R_ERROR_SETTING_ENCRYPTED_DATA_TYPE	 104
+#define PKCS12_R_INVALID_NULL_ARGUMENT			 105
+#define PKCS12_R_INVALID_NULL_PKCS12_POINTER		 106
+#define PKCS12_R_IV_GEN_ERROR				 107
+#define PKCS12_R_KEY_GEN_ERROR				 108
+#define PKCS12_R_MAC_ABSENT				 109
+#define PKCS12_R_MAC_GENERATION_ERROR			 110
+#define PKCS12_R_MAC_SETUP_ERROR			 111
+#define PKCS12_R_MAC_STRING_SET_ERROR			 112
 #define PKCS12_R_MAC_VERIFY_FAILURE			 113
 #define PKCS12_R_PARSE_ERROR				 114
 #define PKCS12_R_PKCS12_ALGOR_CIPHERINIT_ERROR		 115
Index: openssl/crypto/pkcs7/pkcs7.h
diff -u openssl/crypto/pkcs7/pkcs7.h:1.1.1.3 openssl/crypto/pkcs7/pkcs7.h:1.1.1.3.8.1
--- openssl/crypto/pkcs7/pkcs7.h:1.1.1.3	Wed Oct  8 12:35:55 2003
+++ openssl/crypto/pkcs7/pkcs7.h	Sun May  8 14:24:07 2005
@@ -232,6 +232,9 @@
 #define PKCS7_type_is_signedAndEnveloped(a) \
 		(OBJ_obj2nid((a)->type) == NID_pkcs7_signedAndEnveloped)
 #define PKCS7_type_is_data(a)   (OBJ_obj2nid((a)->type) == NID_pkcs7_data)
+#define PKCS7_type_is_digest(a)   (OBJ_obj2nid((a)->type) == NID_pkcs7_digest)
+#define PKCS7_type_is_encrypted(a) \
+		(OBJ_obj2nid((a)->type) == NID_pkcs7_encrypted)
 
 #define PKCS7_set_detached(p,v) \
 		PKCS7_ctrl(p,PKCS7_OP_SET_DETACHED_SIGNATURE,v,NULL)
@@ -374,76 +377,76 @@
 /* Error codes for the PKCS7 functions. */
 
 /* Function codes. */
-#define PKCS7_F_B64_READ_PKCS7				 120
-#define PKCS7_F_B64_WRITE_PKCS7				 121
-#define PKCS7_F_PKCS7_ADD_ATTRIB_SMIMECAP		 118
-#define PKCS7_F_PKCS7_ADD_CERTIFICATE			 100
-#define PKCS7_F_PKCS7_ADD_CRL				 101
-#define PKCS7_F_PKCS7_ADD_RECIPIENT_INFO		 102
-#define PKCS7_F_PKCS7_ADD_SIGNER			 103
-#define PKCS7_F_PKCS7_CTRL				 104
-#define PKCS7_F_PKCS7_DATADECODE			 112
-#define PKCS7_F_PKCS7_DATAINIT				 105
-#define PKCS7_F_PKCS7_DATASIGN				 106
-#define PKCS7_F_PKCS7_DATAVERIFY			 107
-#define PKCS7_F_PKCS7_DECRYPT				 114
-#define PKCS7_F_PKCS7_ENCRYPT				 115
-#define PKCS7_F_PKCS7_GET0_SIGNERS			 124
-#define PKCS7_F_PKCS7_SET_CIPHER			 108
-#define PKCS7_F_PKCS7_SET_CONTENT			 109
-#define PKCS7_F_PKCS7_SET_TYPE				 110
-#define PKCS7_F_PKCS7_SIGN				 116
-#define PKCS7_F_PKCS7_SIGNATUREVERIFY			 113
-#define PKCS7_F_PKCS7_SIMPLE_SMIMECAP			 119
-#define PKCS7_F_PKCS7_VERIFY				 117
+#define PKCS7_F_B64_READ_PKCS7				 100
+#define PKCS7_F_B64_WRITE_PKCS7				 101
+#define PKCS7_F_PKCS7_ADD_ATTRIB_SMIMECAP		 102
+#define PKCS7_F_PKCS7_ADD_CERTIFICATE			 103
+#define PKCS7_F_PKCS7_ADD_CRL				 104
+#define PKCS7_F_PKCS7_ADD_RECIPIENT_INFO		 105
+#define PKCS7_F_PKCS7_ADD_SIGNER			 106
+#define PKCS7_F_PKCS7_CTRL				 107
+#define PKCS7_F_PKCS7_DATADECODE			 108
+#define PKCS7_F_PKCS7_DATAINIT				 109
+#define PKCS7_F_PKCS7_DATASIGN				 110
+#define PKCS7_F_PKCS7_DATAVERIFY			 111
+#define PKCS7_F_PKCS7_DECRYPT				 112
+#define PKCS7_F_PKCS7_ENCRYPT				 113
+#define PKCS7_F_PKCS7_GET0_SIGNERS			 114
+#define PKCS7_F_PKCS7_SET_CIPHER			 115
+#define PKCS7_F_PKCS7_SET_CONTENT			 116
+#define PKCS7_F_PKCS7_SET_TYPE				 117
+#define PKCS7_F_PKCS7_SIGN				 118
+#define PKCS7_F_PKCS7_SIGNATUREVERIFY			 119
+#define PKCS7_F_PKCS7_SIMPLE_SMIMECAP			 120
+#define PKCS7_F_PKCS7_VERIFY				 121
 #define PKCS7_F_SMIME_READ_PKCS7			 122
 #define PKCS7_F_SMIME_TEXT				 123
 
 /* Reason codes. */
-#define PKCS7_R_CERTIFICATE_VERIFY_ERROR		 117
-#define PKCS7_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER		 144
-#define PKCS7_R_CIPHER_NOT_INITIALIZED			 116
-#define PKCS7_R_CONTENT_AND_DATA_PRESENT		 118
-#define PKCS7_R_DECODE_ERROR				 130
-#define PKCS7_R_DECRYPTED_KEY_IS_WRONG_LENGTH		 100
-#define PKCS7_R_DECRYPT_ERROR				 119
-#define PKCS7_R_DIGEST_FAILURE				 101
-#define PKCS7_R_ERROR_ADDING_RECIPIENT			 120
-#define PKCS7_R_ERROR_SETTING_CIPHER			 121
-#define PKCS7_R_INVALID_MIME_TYPE			 131
-#define PKCS7_R_INVALID_NULL_POINTER			 143
-#define PKCS7_R_MIME_NO_CONTENT_TYPE			 132
-#define PKCS7_R_MIME_PARSE_ERROR			 133
-#define PKCS7_R_MIME_SIG_PARSE_ERROR			 134
-#define PKCS7_R_MISSING_CERIPEND_INFO			 103
-#define PKCS7_R_NO_CONTENT				 122
-#define PKCS7_R_NO_CONTENT_TYPE				 135
-#define PKCS7_R_NO_MULTIPART_BODY_FAILURE		 136
-#define PKCS7_R_NO_MULTIPART_BOUNDARY			 137
-#define PKCS7_R_NO_RECIPIENT_MATCHES_CERTIFICATE	 115
-#define PKCS7_R_NO_SIGNATURES_ON_DATA			 123
-#define PKCS7_R_NO_SIGNERS				 142
-#define PKCS7_R_NO_SIG_CONTENT_TYPE			 138
-#define PKCS7_R_OPERATION_NOT_SUPPORTED_ON_THIS_TYPE	 104
-#define PKCS7_R_PKCS7_ADD_SIGNATURE_ERROR		 124
-#define PKCS7_R_PKCS7_DATAFINAL_ERROR			 125
-#define PKCS7_R_PKCS7_DATASIGN				 126
-#define PKCS7_R_PKCS7_PARSE_ERROR			 139
-#define PKCS7_R_PKCS7_SIG_PARSE_ERROR			 140
-#define PKCS7_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE	 127
-#define PKCS7_R_SIGNATURE_FAILURE			 105
-#define PKCS7_R_SIGNER_CERTIFICATE_NOT_FOUND		 128
-#define PKCS7_R_SIG_INVALID_MIME_TYPE			 141
-#define PKCS7_R_SMIME_TEXT_ERROR			 129
-#define PKCS7_R_UNABLE_TO_FIND_CERTIFICATE		 106
-#define PKCS7_R_UNABLE_TO_FIND_MEM_BIO			 107
-#define PKCS7_R_UNABLE_TO_FIND_MESSAGE_DIGEST		 108
-#define PKCS7_R_UNKNOWN_DIGEST_TYPE			 109
-#define PKCS7_R_UNKNOWN_OPERATION			 110
-#define PKCS7_R_UNSUPPORTED_CIPHER_TYPE			 111
-#define PKCS7_R_UNSUPPORTED_CONTENT_TYPE		 112
-#define PKCS7_R_WRONG_CONTENT_TYPE			 113
-#define PKCS7_R_WRONG_PKCS7_TYPE			 114
+#define PKCS7_R_CERTIFICATE_VERIFY_ERROR		 100
+#define PKCS7_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER		 101
+#define PKCS7_R_CIPHER_NOT_INITIALIZED			 102
+#define PKCS7_R_CONTENT_AND_DATA_PRESENT		 103
+#define PKCS7_R_DECODE_ERROR				 104
+#define PKCS7_R_DECRYPTED_KEY_IS_WRONG_LENGTH		 105
+#define PKCS7_R_DECRYPT_ERROR				 106
+#define PKCS7_R_DIGEST_FAILURE				 107
+#define PKCS7_R_ERROR_ADDING_RECIPIENT			 108
+#define PKCS7_R_ERROR_SETTING_CIPHER			 109
+#define PKCS7_R_INVALID_MIME_TYPE			 110
+#define PKCS7_R_INVALID_NULL_POINTER			 111
+#define PKCS7_R_MIME_NO_CONTENT_TYPE			 112
+#define PKCS7_R_MIME_PARSE_ERROR			 113
+#define PKCS7_R_MIME_SIG_PARSE_ERROR			 114
+#define PKCS7_R_MISSING_CERIPEND_INFO			 115
+#define PKCS7_R_NO_CONTENT				 116
+#define PKCS7_R_NO_CONTENT_TYPE				 117
+#define PKCS7_R_NO_MULTIPART_BODY_FAILURE		 118
+#define PKCS7_R_NO_MULTIPART_BOUNDARY			 119
+#define PKCS7_R_NO_RECIPIENT_MATCHES_CERTIFICATE	 120
+#define PKCS7_R_NO_SIGNATURES_ON_DATA			 121
+#define PKCS7_R_NO_SIGNERS				 122
+#define PKCS7_R_NO_SIG_CONTENT_TYPE			 123
+#define PKCS7_R_OPERATION_NOT_SUPPORTED_ON_THIS_TYPE	 124
+#define PKCS7_R_PKCS7_ADD_SIGNATURE_ERROR		 125
+#define PKCS7_R_PKCS7_DATAFINAL_ERROR			 126
+#define PKCS7_R_PKCS7_DATASIGN				 127
+#define PKCS7_R_PKCS7_PARSE_ERROR			 128
+#define PKCS7_R_PKCS7_SIG_PARSE_ERROR			 129
+#define PKCS7_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE	 130
+#define PKCS7_R_SIGNATURE_FAILURE			 131
+#define PKCS7_R_SIGNER_CERTIFICATE_NOT_FOUND		 132
+#define PKCS7_R_SIG_INVALID_MIME_TYPE			 133
+#define PKCS7_R_SMIME_TEXT_ERROR			 134
+#define PKCS7_R_UNABLE_TO_FIND_CERTIFICATE		 135
+#define PKCS7_R_UNABLE_TO_FIND_MEM_BIO			 136
+#define PKCS7_R_UNABLE_TO_FIND_MESSAGE_DIGEST		 137
+#define PKCS7_R_UNKNOWN_DIGEST_TYPE			 138
+#define PKCS7_R_UNKNOWN_OPERATION			 139
+#define PKCS7_R_UNSUPPORTED_CIPHER_TYPE			 140
+#define PKCS7_R_UNSUPPORTED_CONTENT_TYPE		 141
+#define PKCS7_R_WRONG_CONTENT_TYPE			 142
+#define PKCS7_R_WRONG_PKCS7_TYPE			 143
 
 #ifdef  __cplusplus
 }
Index: openssl/crypto/pkcs7/pkcs7err.c
diff -u openssl/crypto/pkcs7/pkcs7err.c:1.1.1.2 openssl/crypto/pkcs7/pkcs7err.c:1.1.1.2.14.1
--- openssl/crypto/pkcs7/pkcs7err.c:1.1.1.2	Fri Jan 17 23:07:59 2003
+++ openssl/crypto/pkcs7/pkcs7err.c	Sun May  8 14:24:07 2005
@@ -1,6 +1,6 @@
 /* crypto/pkcs7/pkcs7err.c */
 /* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
Index: openssl/crypto/rand/rand_err.c
diff -u openssl/crypto/rand/rand_err.c:1.1.1.3 openssl/crypto/rand/rand_err.c:1.1.1.3.4.1
--- openssl/crypto/rand/rand_err.c:1.1.1.3	Mon Nov  8 16:32:50 2004
+++ openssl/crypto/rand/rand_err.c	Sun May  8 14:24:07 2005
@@ -1,6 +1,6 @@
 /* crypto/rand/rand_err.c */
 /* ====================================================================
- * Copyright (c) 1999-2003 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
Index: openssl/crypto/rsa/rsa.h
diff -u openssl/crypto/rsa/rsa.h:1.1.1.6 openssl/crypto/rsa/rsa.h:1.1.1.6.4.1
--- openssl/crypto/rsa/rsa.h:1.1.1.6	Mon Nov  8 16:32:51 2004
+++ openssl/crypto/rsa/rsa.h	Sun May  8 14:24:07 2005
@@ -301,30 +301,30 @@
 
 /* Function codes. */
 #define RSA_F_MEMORY_LOCK				 100
-#define RSA_F_RSA_CHECK_KEY				 123
-#define RSA_F_RSA_EAY_PRIVATE_DECRYPT			 101
-#define RSA_F_RSA_EAY_PRIVATE_ENCRYPT			 102
-#define RSA_F_RSA_EAY_PUBLIC_DECRYPT			 103
-#define RSA_F_RSA_EAY_PUBLIC_ENCRYPT			 104
-#define RSA_F_RSA_GENERATE_KEY				 105
-#define RSA_F_RSA_NEW_METHOD				 106
-#define RSA_F_RSA_NULL					 124
-#define RSA_F_RSA_PADDING_ADD_NONE			 107
-#define RSA_F_RSA_PADDING_ADD_PKCS1_OAEP		 121
-#define RSA_F_RSA_PADDING_ADD_PKCS1_TYPE_1		 108
-#define RSA_F_RSA_PADDING_ADD_PKCS1_TYPE_2		 109
-#define RSA_F_RSA_PADDING_ADD_SSLV23			 110
-#define RSA_F_RSA_PADDING_CHECK_NONE			 111
-#define RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP		 122
-#define RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_1		 112
-#define RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2		 113
-#define RSA_F_RSA_PADDING_CHECK_SSLV23			 114
-#define RSA_F_RSA_PRINT					 115
-#define RSA_F_RSA_PRINT_FP				 116
-#define RSA_F_RSA_SIGN					 117
-#define RSA_F_RSA_SIGN_ASN1_OCTET_STRING		 118
-#define RSA_F_RSA_VERIFY				 119
-#define RSA_F_RSA_VERIFY_ASN1_OCTET_STRING		 120
+#define RSA_F_RSA_CHECK_KEY				 101
+#define RSA_F_RSA_EAY_PRIVATE_DECRYPT			 102
+#define RSA_F_RSA_EAY_PRIVATE_ENCRYPT			 103
+#define RSA_F_RSA_EAY_PUBLIC_DECRYPT			 104
+#define RSA_F_RSA_EAY_PUBLIC_ENCRYPT			 105
+#define RSA_F_RSA_GENERATE_KEY				 106
+#define RSA_F_RSA_NEW_METHOD				 107
+#define RSA_F_RSA_NULL					 108
+#define RSA_F_RSA_PADDING_ADD_NONE			 109
+#define RSA_F_RSA_PADDING_ADD_PKCS1_OAEP		 110
+#define RSA_F_RSA_PADDING_ADD_PKCS1_TYPE_1		 111
+#define RSA_F_RSA_PADDING_ADD_PKCS1_TYPE_2		 112
+#define RSA_F_RSA_PADDING_ADD_SSLV23			 113
+#define RSA_F_RSA_PADDING_CHECK_NONE			 114
+#define RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP		 115
+#define RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_1		 116
+#define RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2		 117
+#define RSA_F_RSA_PADDING_CHECK_SSLV23			 118
+#define RSA_F_RSA_PRINT					 119
+#define RSA_F_RSA_PRINT_FP				 120
+#define RSA_F_RSA_SIGN					 121
+#define RSA_F_RSA_SIGN_ASN1_OCTET_STRING		 122
+#define RSA_F_RSA_VERIFY				 123
+#define RSA_F_RSA_VERIFY_ASN1_OCTET_STRING		 124
 
 /* Reason codes. */
 #define RSA_R_ALGORITHM_MISMATCH			 100
@@ -332,33 +332,33 @@
 #define RSA_R_BAD_FIXED_HEADER_DECRYPT			 102
 #define RSA_R_BAD_PAD_BYTE_COUNT			 103
 #define RSA_R_BAD_SIGNATURE				 104
-#define RSA_R_BLOCK_TYPE_IS_NOT_01			 106
-#define RSA_R_BLOCK_TYPE_IS_NOT_02			 107
-#define RSA_R_DATA_GREATER_THAN_MOD_LEN			 108
-#define RSA_R_DATA_TOO_LARGE				 109
-#define RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE		 110
-#define RSA_R_DATA_TOO_LARGE_FOR_MODULUS		 132
+#define RSA_R_BLOCK_TYPE_IS_NOT_01			 105
+#define RSA_R_BLOCK_TYPE_IS_NOT_02			 106
+#define RSA_R_DATA_GREATER_THAN_MOD_LEN			 107
+#define RSA_R_DATA_TOO_LARGE				 108
+#define RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE		 109
+#define RSA_R_DATA_TOO_LARGE_FOR_MODULUS		 110
 #define RSA_R_DATA_TOO_SMALL				 111
-#define RSA_R_DATA_TOO_SMALL_FOR_KEY_SIZE		 122
-#define RSA_R_DIGEST_TOO_BIG_FOR_RSA_KEY		 112
-#define RSA_R_DMP1_NOT_CONGRUENT_TO_D			 124
-#define RSA_R_DMQ1_NOT_CONGRUENT_TO_D			 125
-#define RSA_R_D_E_NOT_CONGRUENT_TO_1			 123
-#define RSA_R_INVALID_MESSAGE_LENGTH			 131
-#define RSA_R_IQMP_NOT_INVERSE_OF_Q			 126
-#define RSA_R_KEY_SIZE_TOO_SMALL			 120
-#define RSA_R_NULL_BEFORE_BLOCK_MISSING			 113
-#define RSA_R_N_DOES_NOT_EQUAL_P_Q			 127
-#define RSA_R_OAEP_DECODING_ERROR			 121
-#define RSA_R_PADDING_CHECK_FAILED			 114
-#define RSA_R_P_NOT_PRIME				 128
-#define RSA_R_Q_NOT_PRIME				 129
-#define RSA_R_RSA_OPERATIONS_NOT_SUPPORTED		 130
-#define RSA_R_SSLV3_ROLLBACK_ATTACK			 115
-#define RSA_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD 116
-#define RSA_R_UNKNOWN_ALGORITHM_TYPE			 117
-#define RSA_R_UNKNOWN_PADDING_TYPE			 118
-#define RSA_R_WRONG_SIGNATURE_LENGTH			 119
+#define RSA_R_DATA_TOO_SMALL_FOR_KEY_SIZE		 112
+#define RSA_R_DIGEST_TOO_BIG_FOR_RSA_KEY		 113
+#define RSA_R_DMP1_NOT_CONGRUENT_TO_D			 114
+#define RSA_R_DMQ1_NOT_CONGRUENT_TO_D			 115
+#define RSA_R_D_E_NOT_CONGRUENT_TO_1			 116
+#define RSA_R_INVALID_MESSAGE_LENGTH			 117
+#define RSA_R_IQMP_NOT_INVERSE_OF_Q			 118
+#define RSA_R_KEY_SIZE_TOO_SMALL			 119
+#define RSA_R_NULL_BEFORE_BLOCK_MISSING			 120
+#define RSA_R_N_DOES_NOT_EQUAL_P_Q			 121
+#define RSA_R_OAEP_DECODING_ERROR			 122
+#define RSA_R_PADDING_CHECK_FAILED			 123
+#define RSA_R_P_NOT_PRIME				 124
+#define RSA_R_Q_NOT_PRIME				 125
+#define RSA_R_RSA_OPERATIONS_NOT_SUPPORTED		 126
+#define RSA_R_SSLV3_ROLLBACK_ATTACK			 127
+#define RSA_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD 128
+#define RSA_R_UNKNOWN_ALGORITHM_TYPE			 129
+#define RSA_R_UNKNOWN_PADDING_TYPE			 130
+#define RSA_R_WRONG_SIGNATURE_LENGTH			 131
 
 #ifdef  __cplusplus
 }
Index: openssl/crypto/rsa/rsa_err.c
diff -u openssl/crypto/rsa/rsa_err.c:1.1.1.2 openssl/crypto/rsa/rsa_err.c:1.1.1.2.14.1
--- openssl/crypto/rsa/rsa_err.c:1.1.1.2	Fri Jan 17 23:08:02 2003
+++ openssl/crypto/rsa/rsa_err.c	Sun May  8 14:24:07 2005
@@ -1,6 +1,6 @@
 /* crypto/rsa/rsa_err.c */
 /* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
Index: openssl/crypto/stack/safestack.h
diff -u openssl/crypto/stack/safestack.h:1.1.1.3 openssl/crypto/stack/safestack.h:1.1.1.3.4.1
--- openssl/crypto/stack/safestack.h:1.1.1.3	Mon Nov  8 16:32:52 2004
+++ openssl/crypto/stack/safestack.h	Sun May  8 14:24:07 2005
@@ -334,6 +334,26 @@
 #define sk_ASN1_TYPE_sort(st) SKM_sk_sort(ASN1_TYPE, (st))
 #define sk_ASN1_TYPE_is_sorted(st) SKM_sk_is_sorted(ASN1_TYPE, (st))
 
+#define sk_ASN1_UTF8STRING_new(st) SKM_sk_new(ASN1_UTF8STRING, (st))
+#define sk_ASN1_UTF8STRING_new_null() SKM_sk_new_null(ASN1_UTF8STRING)
+#define sk_ASN1_UTF8STRING_free(st) SKM_sk_free(ASN1_UTF8STRING, (st))
+#define sk_ASN1_UTF8STRING_num(st) SKM_sk_num(ASN1_UTF8STRING, (st))
+#define sk_ASN1_UTF8STRING_value(st, i) SKM_sk_value(ASN1_UTF8STRING, (st), (i))
+#define sk_ASN1_UTF8STRING_set(st, i, val) SKM_sk_set(ASN1_UTF8STRING, (st), (i), (val))
+#define sk_ASN1_UTF8STRING_zero(st) SKM_sk_zero(ASN1_UTF8STRING, (st))
+#define sk_ASN1_UTF8STRING_push(st, val) SKM_sk_push(ASN1_UTF8STRING, (st), (val))
+#define sk_ASN1_UTF8STRING_unshift(st, val) SKM_sk_unshift(ASN1_UTF8STRING, (st), (val))
+#define sk_ASN1_UTF8STRING_find(st, val) SKM_sk_find(ASN1_UTF8STRING, (st), (val))
+#define sk_ASN1_UTF8STRING_delete(st, i) SKM_sk_delete(ASN1_UTF8STRING, (st), (i))
+#define sk_ASN1_UTF8STRING_delete_ptr(st, ptr) SKM_sk_delete_ptr(ASN1_UTF8STRING, (st), (ptr))
+#define sk_ASN1_UTF8STRING_insert(st, val, i) SKM_sk_insert(ASN1_UTF8STRING, (st), (val), (i))
+#define sk_ASN1_UTF8STRING_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(ASN1_UTF8STRING, (st), (cmp))
+#define sk_ASN1_UTF8STRING_dup(st) SKM_sk_dup(ASN1_UTF8STRING, st)
+#define sk_ASN1_UTF8STRING_pop_free(st, free_func) SKM_sk_pop_free(ASN1_UTF8STRING, (st), (free_func))
+#define sk_ASN1_UTF8STRING_shift(st) SKM_sk_shift(ASN1_UTF8STRING, (st))
+#define sk_ASN1_UTF8STRING_pop(st) SKM_sk_pop(ASN1_UTF8STRING, (st))
+#define sk_ASN1_UTF8STRING_sort(st) SKM_sk_sort(ASN1_UTF8STRING, (st))
+
 #define sk_ASN1_VALUE_new(st) SKM_sk_new(ASN1_VALUE, (st))
 #define sk_ASN1_VALUE_new_null() SKM_sk_new_null(ASN1_VALUE)
 #define sk_ASN1_VALUE_free(st) SKM_sk_free(ASN1_VALUE, (st))
@@ -544,6 +564,46 @@
 #define sk_ENGINE_CLEANUP_ITEM_sort(st) SKM_sk_sort(ENGINE_CLEANUP_ITEM, (st))
 #define sk_ENGINE_CLEANUP_ITEM_is_sorted(st) SKM_sk_is_sorted(ENGINE_CLEANUP_ITEM, (st))
 
+#define sk_ESS_CERT_ID_new(st) SKM_sk_new(ESS_CERT_ID, (st))
+#define sk_ESS_CERT_ID_new_null() SKM_sk_new_null(ESS_CERT_ID)
+#define sk_ESS_CERT_ID_free(st) SKM_sk_free(ESS_CERT_ID, (st))
+#define sk_ESS_CERT_ID_num(st) SKM_sk_num(ESS_CERT_ID, (st))
+#define sk_ESS_CERT_ID_value(st, i) SKM_sk_value(ESS_CERT_ID, (st), (i))
+#define sk_ESS_CERT_ID_set(st, i, val) SKM_sk_set(ESS_CERT_ID, (st), (i), (val))
+#define sk_ESS_CERT_ID_zero(st) SKM_sk_zero(ESS_CERT_ID, (st))
+#define sk_ESS_CERT_ID_push(st, val) SKM_sk_push(ESS_CERT_ID, (st), (val))
+#define sk_ESS_CERT_ID_unshift(st, val) SKM_sk_unshift(ESS_CERT_ID, (st), (val))
+#define sk_ESS_CERT_ID_find(st, val) SKM_sk_find(ESS_CERT_ID, (st), (val))
+#define sk_ESS_CERT_ID_delete(st, i) SKM_sk_delete(ESS_CERT_ID, (st), (i))
+#define sk_ESS_CERT_ID_delete_ptr(st, ptr) SKM_sk_delete_ptr(ESS_CERT_ID, (st), (ptr))
+#define sk_ESS_CERT_ID_insert(st, val, i) SKM_sk_insert(ESS_CERT_ID, (st), (val), (i))
+#define sk_ESS_CERT_ID_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(ESS_CERT_ID, (st), (cmp))
+#define sk_ESS_CERT_ID_dup(st) SKM_sk_dup(ESS_CERT_ID, st)
+#define sk_ESS_CERT_ID_pop_free(st, free_func) SKM_sk_pop_free(ESS_CERT_ID, (st), (free_func))
+#define sk_ESS_CERT_ID_shift(st) SKM_sk_shift(ESS_CERT_ID, (st))
+#define sk_ESS_CERT_ID_pop(st) SKM_sk_pop(ESS_CERT_ID, (st))
+#define sk_ESS_CERT_ID_sort(st) SKM_sk_sort(ESS_CERT_ID, (st))
+
+#define sk_EVP_MD_new(st) SKM_sk_new(EVP_MD, (st))
+#define sk_EVP_MD_new_null() SKM_sk_new_null(EVP_MD)
+#define sk_EVP_MD_free(st) SKM_sk_free(EVP_MD, (st))
+#define sk_EVP_MD_num(st) SKM_sk_num(EVP_MD, (st))
+#define sk_EVP_MD_value(st, i) SKM_sk_value(EVP_MD, (st), (i))
+#define sk_EVP_MD_set(st, i, val) SKM_sk_set(EVP_MD, (st), (i), (val))
+#define sk_EVP_MD_zero(st) SKM_sk_zero(EVP_MD, (st))
+#define sk_EVP_MD_push(st, val) SKM_sk_push(EVP_MD, (st), (val))
+#define sk_EVP_MD_unshift(st, val) SKM_sk_unshift(EVP_MD, (st), (val))
+#define sk_EVP_MD_find(st, val) SKM_sk_find(EVP_MD, (st), (val))
+#define sk_EVP_MD_delete(st, i) SKM_sk_delete(EVP_MD, (st), (i))
+#define sk_EVP_MD_delete_ptr(st, ptr) SKM_sk_delete_ptr(EVP_MD, (st), (ptr))
+#define sk_EVP_MD_insert(st, val, i) SKM_sk_insert(EVP_MD, (st), (val), (i))
+#define sk_EVP_MD_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(EVP_MD, (st), (cmp))
+#define sk_EVP_MD_dup(st) SKM_sk_dup(EVP_MD, st)
+#define sk_EVP_MD_pop_free(st, free_func) SKM_sk_pop_free(EVP_MD, (st), (free_func))
+#define sk_EVP_MD_shift(st) SKM_sk_shift(EVP_MD, (st))
+#define sk_EVP_MD_pop(st) SKM_sk_pop(EVP_MD, (st))
+#define sk_EVP_MD_sort(st) SKM_sk_sort(EVP_MD, (st))
+
 #define sk_GENERAL_NAME_new(st) SKM_sk_new(GENERAL_NAME, (st))
 #define sk_GENERAL_NAME_new_null() SKM_sk_new_null(GENERAL_NAME)
 #define sk_GENERAL_NAME_free(st) SKM_sk_free(GENERAL_NAME, (st))
@@ -1399,6 +1459,15 @@
 #define ASN1_seq_unpack_ASN1_TYPE(buf, len, d2i_func, free_func) \
 	SKM_ASN1_seq_unpack(ASN1_TYPE, (buf), (len), (d2i_func), (free_func))
 
+#define d2i_ASN1_SET_OF_ASN1_UTF8STRING(st, pp, length, d2i_func, free_func, ex_tag, ex_class) \
+	SKM_ASN1_SET_OF_d2i(ASN1_UTF8STRING, (st), (pp), (length), (d2i_func), (free_func), (ex_tag), (ex_class)) 
+#define i2d_ASN1_SET_OF_ASN1_UTF8STRING(st, pp, i2d_func, ex_tag, ex_class, is_set) \
+	SKM_ASN1_SET_OF_i2d(ASN1_UTF8STRING, (st), (pp), (i2d_func), (ex_tag), (ex_class), (is_set))
+#define ASN1_seq_pack_ASN1_UTF8STRING(st, i2d_func, buf, len) \
+	SKM_ASN1_seq_pack(ASN1_UTF8STRING, (st), (i2d_func), (buf), (len))
+#define ASN1_seq_unpack_ASN1_UTF8STRING(buf, len, d2i_func, free_func) \
+	SKM_ASN1_seq_unpack(ASN1_UTF8STRING, (buf), (len), (d2i_func), (free_func))
+
 #define d2i_ASN1_SET_OF_DIST_POINT(st, pp, length, d2i_func, free_func, ex_tag, ex_class) \
 	SKM_ASN1_SET_OF_d2i(DIST_POINT, (st), (pp), (length), (d2i_func), (free_func), (ex_tag), (ex_class)) 
 #define i2d_ASN1_SET_OF_DIST_POINT(st, pp, i2d_func, ex_tag, ex_class, is_set) \
@@ -1408,6 +1477,24 @@
 #define ASN1_seq_unpack_DIST_POINT(buf, len, d2i_func, free_func) \
 	SKM_ASN1_seq_unpack(DIST_POINT, (buf), (len), (d2i_func), (free_func))
 
+#define d2i_ASN1_SET_OF_ESS_CERT_ID(st, pp, length, d2i_func, free_func, ex_tag, ex_class) \
+	SKM_ASN1_SET_OF_d2i(ESS_CERT_ID, (st), (pp), (length), (d2i_func), (free_func), (ex_tag), (ex_class)) 
+#define i2d_ASN1_SET_OF_ESS_CERT_ID(st, pp, i2d_func, ex_tag, ex_class, is_set) \
+	SKM_ASN1_SET_OF_i2d(ESS_CERT_ID, (st), (pp), (i2d_func), (ex_tag), (ex_class), (is_set))
+#define ASN1_seq_pack_ESS_CERT_ID(st, i2d_func, buf, len) \
+	SKM_ASN1_seq_pack(ESS_CERT_ID, (st), (i2d_func), (buf), (len))
+#define ASN1_seq_unpack_ESS_CERT_ID(buf, len, d2i_func, free_func) \
+	SKM_ASN1_seq_unpack(ESS_CERT_ID, (buf), (len), (d2i_func), (free_func))
+
+#define d2i_ASN1_SET_OF_EVP_MD(st, pp, length, d2i_func, free_func, ex_tag, ex_class) \
+	SKM_ASN1_SET_OF_d2i(EVP_MD, (st), (pp), (length), (d2i_func), (free_func), (ex_tag), (ex_class)) 
+#define i2d_ASN1_SET_OF_EVP_MD(st, pp, i2d_func, ex_tag, ex_class, is_set) \
+	SKM_ASN1_SET_OF_i2d(EVP_MD, (st), (pp), (i2d_func), (ex_tag), (ex_class), (is_set))
+#define ASN1_seq_pack_EVP_MD(st, i2d_func, buf, len) \
+	SKM_ASN1_seq_pack(EVP_MD, (st), (i2d_func), (buf), (len))
+#define ASN1_seq_unpack_EVP_MD(buf, len, d2i_func, free_func) \
+	SKM_ASN1_seq_unpack(EVP_MD, (buf), (len), (d2i_func), (free_func))
+
 #define d2i_ASN1_SET_OF_GENERAL_NAME(st, pp, length, d2i_func, free_func, ex_tag, ex_class) \
 	SKM_ASN1_SET_OF_d2i(GENERAL_NAME, (st), (pp), (length), (d2i_func), (free_func), (ex_tag), (ex_class)) 
 #define i2d_ASN1_SET_OF_GENERAL_NAME(st, pp, i2d_func, ex_tag, ex_class, is_set) \
Index: openssl/crypto/ts/Makefile
diff -u /dev/null openssl/crypto/ts/Makefile:1.1.4.1
--- /dev/null	Sun May  8 14:38:24 2005
+++ openssl/crypto/ts/Makefile	Sun May  8 14:24:07 2005
@@ -0,0 +1,347 @@
+#
+# SSLeay/crypto/ts/Makefile
+#
+
+DIR=	ts
+TOP=	../..
+CC=	cc
+INCLUDES= -I.. -I../../include
+CFLAG = -g
+INSTALL_PREFIX=
+OPENSSLDIR=     /usr/local/ssl
+INSTALLTOP=/usr/local/ssl
+MAKEDEPPROG=	makedepend
+MAKEDEPEND=	$(TOP)/util/domd $(TOP) -MD $(MAKEDEPPROG)
+MAKEFILE=	Makefile
+AR=		ar r
+
+PEX_LIBS=
+EX_LIBS=
+ 
+CFLAGS= $(INCLUDES) $(CFLAG)
+
+GENERAL= Makefile
+TEST=
+APPS=
+
+LIB=$(TOP)/libcrypto.a
+LIBSRC=	ts_err.c ts_req_utils.c ts_req_print.c ts_resp_utils.c ts_resp_print.c \
+	ts_resp_sign.c ts_resp_verify.c ts_verify_ctx.c ts_lib.c ts_conf.c \
+	ts_asn1.c
+LIBOBJ= ts_err.o ts_req_utils.o ts_req_print.o ts_resp_utils.o ts_resp_print.o \
+	ts_resp_sign.o ts_resp_verify.o ts_verify_ctx.o ts_lib.o ts_conf.o \
+	ts_asn1.o
+
+SRC= $(LIBSRC)
+
+EXHEADER= ts.h
+HEADER=	$(EXHEADER)
+
+ALL=    $(GENERAL) $(SRC) $(HEADER)
+
+top:
+	(cd ../..; $(MAKE) DIRS=crypto SDIRS=$(DIR) sub_all)
+
+test:
+
+all:	lib
+
+lib:	$(LIBOBJ)
+	$(AR) $(LIB) $(LIBOBJ)
+	$(RANLIB) $(LIB) || echo Never mind.
+	@touch lib
+
+files:
+	$(PERL) $(TOP)/util/files.pl Makefile >> $(TOP)/MINFO
+
+links:
+	@$(PERL) $(TOP)/util/mklink.pl ../../include/openssl $(EXHEADER)
+	@$(PERL) $(TOP)/util/mklink.pl ../../test $(TEST)
+	@$(PERL) $(TOP)/util/mklink.pl ../../apps $(APPS)
+
+install:
+	@for i in $(EXHEADER) ; \
+	do  \
+	(cp $$i $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i; \
+	chmod 644 $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i ); \
+	done;
+
+tags:
+	ctags $(SRC)
+
+lint:
+	lint -DLINT $(INCLUDES) $(SRC)>fluff
+
+depend:
+	$(MAKEDEPEND) -- $(CFLAG) $(INCLUDES) $(DEPFLAG) -- $(LIBSRC)
+
+dclean:
+	$(PERL) -pe 'if (/^# DO NOT DELETE THIS LINE/) {print; exit(0);}' $(MAKEFILE) >Makefile.new
+	mv -f Makefile.new $(MAKEFILE)
+
+clean:
+	rm -f *.o *.obj lib tags core .pure .nfs* *.old *.bak fluff enc dec sign verify
+
+# DO NOT DELETE THIS LINE -- make depend depends on it.
+
+ts_asn1.o: ../../include/openssl/aes.h ../../include/openssl/asn1.h
+ts_asn1.o: ../../include/openssl/asn1t.h ../../include/openssl/bio.h
+ts_asn1.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
+ts_asn1.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
+ts_asn1.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
+ts_asn1.o: ../../include/openssl/des.h ../../include/openssl/des_old.h
+ts_asn1.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
+ts_asn1.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+ts_asn1.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+ts_asn1.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
+ts_asn1.o: ../../include/openssl/md4.h ../../include/openssl/md5.h
+ts_asn1.o: ../../include/openssl/mdc2.h ../../include/openssl/obj_mac.h
+ts_asn1.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+ts_asn1.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
+ts_asn1.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
+ts_asn1.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
+ts_asn1.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
+ts_asn1.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
+ts_asn1.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
+ts_asn1.o: ../../include/openssl/ts.h ../../include/openssl/ui.h
+ts_asn1.o: ../../include/openssl/ui_compat.h ../../include/openssl/x509.h
+ts_asn1.o: ../../include/openssl/x509_vfy.h ../../include/openssl/x509v3.h
+ts_asn1.o: ts_asn1.c
+ts_conf.o: ../../include/openssl/aes.h ../../include/openssl/asn1.h
+ts_conf.o: ../../include/openssl/bio.h ../../include/openssl/blowfish.h
+ts_conf.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
+ts_conf.o: ../../include/openssl/cast.h ../../include/openssl/conf.h
+ts_conf.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
+ts_conf.o: ../../include/openssl/des_old.h ../../include/openssl/dh.h
+ts_conf.o: ../../include/openssl/dsa.h ../../include/openssl/e_os2.h
+ts_conf.o: ../../include/openssl/engine.h ../../include/openssl/err.h
+ts_conf.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+ts_conf.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
+ts_conf.o: ../../include/openssl/md4.h ../../include/openssl/md5.h
+ts_conf.o: ../../include/openssl/mdc2.h ../../include/openssl/obj_mac.h
+ts_conf.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+ts_conf.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
+ts_conf.o: ../../include/openssl/pem.h ../../include/openssl/pem2.h
+ts_conf.o: ../../include/openssl/pkcs7.h ../../include/openssl/rand.h
+ts_conf.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
+ts_conf.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
+ts_conf.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+ts_conf.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+ts_conf.o: ../../include/openssl/symhacks.h ../../include/openssl/ts.h
+ts_conf.o: ../../include/openssl/ui.h ../../include/openssl/ui_compat.h
+ts_conf.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+ts_conf.o: ../../include/openssl/x509v3.h ts_conf.c
+ts_err.o: ../../include/openssl/aes.h ../../include/openssl/asn1.h
+ts_err.o: ../../include/openssl/bio.h ../../include/openssl/blowfish.h
+ts_err.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
+ts_err.o: ../../include/openssl/cast.h ../../include/openssl/conf.h
+ts_err.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
+ts_err.o: ../../include/openssl/des_old.h ../../include/openssl/dh.h
+ts_err.o: ../../include/openssl/dsa.h ../../include/openssl/e_os2.h
+ts_err.o: ../../include/openssl/err.h ../../include/openssl/evp.h
+ts_err.o: ../../include/openssl/idea.h ../../include/openssl/lhash.h
+ts_err.o: ../../include/openssl/md2.h ../../include/openssl/md4.h
+ts_err.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
+ts_err.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
+ts_err.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
+ts_err.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pkcs7.h
+ts_err.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
+ts_err.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
+ts_err.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+ts_err.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+ts_err.o: ../../include/openssl/symhacks.h ../../include/openssl/ts.h
+ts_err.o: ../../include/openssl/ui.h ../../include/openssl/ui_compat.h
+ts_err.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+ts_err.o: ../../include/openssl/x509v3.h ts_err.c
+ts_lib.o: ../../e_os.h ../../include/openssl/aes.h ../../include/openssl/asn1.h
+ts_lib.o: ../../include/openssl/bio.h ../../include/openssl/blowfish.h
+ts_lib.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
+ts_lib.o: ../../include/openssl/cast.h ../../include/openssl/conf.h
+ts_lib.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
+ts_lib.o: ../../include/openssl/des_old.h ../../include/openssl/dh.h
+ts_lib.o: ../../include/openssl/dsa.h ../../include/openssl/e_os2.h
+ts_lib.o: ../../include/openssl/err.h ../../include/openssl/evp.h
+ts_lib.o: ../../include/openssl/idea.h ../../include/openssl/lhash.h
+ts_lib.o: ../../include/openssl/md2.h ../../include/openssl/md4.h
+ts_lib.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
+ts_lib.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
+ts_lib.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
+ts_lib.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pkcs7.h
+ts_lib.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
+ts_lib.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
+ts_lib.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+ts_lib.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+ts_lib.o: ../../include/openssl/symhacks.h ../../include/openssl/ui.h
+ts_lib.o: ../../include/openssl/ui_compat.h ../../include/openssl/x509.h
+ts_lib.o: ../../include/openssl/x509_vfy.h ../../include/openssl/x509v3.h
+ts_lib.o: ../cryptlib.h ts.h ts_lib.c
+ts_req_print.o: ../../e_os.h ../../include/openssl/aes.h
+ts_req_print.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+ts_req_print.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
+ts_req_print.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
+ts_req_print.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
+ts_req_print.o: ../../include/openssl/des.h ../../include/openssl/des_old.h
+ts_req_print.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
+ts_req_print.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+ts_req_print.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+ts_req_print.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
+ts_req_print.o: ../../include/openssl/md4.h ../../include/openssl/md5.h
+ts_req_print.o: ../../include/openssl/mdc2.h ../../include/openssl/obj_mac.h
+ts_req_print.o: ../../include/openssl/objects.h
+ts_req_print.o: ../../include/openssl/opensslconf.h
+ts_req_print.o: ../../include/openssl/opensslv.h
+ts_req_print.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pkcs7.h
+ts_req_print.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
+ts_req_print.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
+ts_req_print.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+ts_req_print.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+ts_req_print.o: ../../include/openssl/symhacks.h ../../include/openssl/ts.h
+ts_req_print.o: ../../include/openssl/ui.h ../../include/openssl/ui_compat.h
+ts_req_print.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+ts_req_print.o: ../../include/openssl/x509v3.h ../cryptlib.h ts_req_print.c
+ts_req_utils.o: ../../e_os.h ../../include/openssl/aes.h
+ts_req_utils.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+ts_req_utils.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
+ts_req_utils.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
+ts_req_utils.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
+ts_req_utils.o: ../../include/openssl/des.h ../../include/openssl/des_old.h
+ts_req_utils.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
+ts_req_utils.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+ts_req_utils.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+ts_req_utils.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
+ts_req_utils.o: ../../include/openssl/md4.h ../../include/openssl/md5.h
+ts_req_utils.o: ../../include/openssl/mdc2.h ../../include/openssl/obj_mac.h
+ts_req_utils.o: ../../include/openssl/objects.h
+ts_req_utils.o: ../../include/openssl/opensslconf.h
+ts_req_utils.o: ../../include/openssl/opensslv.h
+ts_req_utils.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pkcs7.h
+ts_req_utils.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
+ts_req_utils.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
+ts_req_utils.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+ts_req_utils.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+ts_req_utils.o: ../../include/openssl/symhacks.h ../../include/openssl/ts.h
+ts_req_utils.o: ../../include/openssl/ui.h ../../include/openssl/ui_compat.h
+ts_req_utils.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+ts_req_utils.o: ../../include/openssl/x509v3.h ../cryptlib.h ts_req_utils.c
+ts_resp_print.o: ../../e_os.h ../../include/openssl/aes.h
+ts_resp_print.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+ts_resp_print.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
+ts_resp_print.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
+ts_resp_print.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
+ts_resp_print.o: ../../include/openssl/des.h ../../include/openssl/des_old.h
+ts_resp_print.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
+ts_resp_print.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+ts_resp_print.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+ts_resp_print.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
+ts_resp_print.o: ../../include/openssl/md4.h ../../include/openssl/md5.h
+ts_resp_print.o: ../../include/openssl/mdc2.h ../../include/openssl/obj_mac.h
+ts_resp_print.o: ../../include/openssl/objects.h
+ts_resp_print.o: ../../include/openssl/opensslconf.h
+ts_resp_print.o: ../../include/openssl/opensslv.h
+ts_resp_print.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pkcs7.h
+ts_resp_print.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
+ts_resp_print.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
+ts_resp_print.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+ts_resp_print.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+ts_resp_print.o: ../../include/openssl/symhacks.h ../../include/openssl/ui.h
+ts_resp_print.o: ../../include/openssl/ui_compat.h ../../include/openssl/x509.h
+ts_resp_print.o: ../../include/openssl/x509_vfy.h
+ts_resp_print.o: ../../include/openssl/x509v3.h ../cryptlib.h ts.h
+ts_resp_print.o: ts_resp_print.c
+ts_resp_sign.o: ../../e_os.h ../../include/openssl/aes.h
+ts_resp_sign.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+ts_resp_sign.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
+ts_resp_sign.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
+ts_resp_sign.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
+ts_resp_sign.o: ../../include/openssl/des.h ../../include/openssl/des_old.h
+ts_resp_sign.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
+ts_resp_sign.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+ts_resp_sign.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+ts_resp_sign.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
+ts_resp_sign.o: ../../include/openssl/md4.h ../../include/openssl/md5.h
+ts_resp_sign.o: ../../include/openssl/mdc2.h ../../include/openssl/obj_mac.h
+ts_resp_sign.o: ../../include/openssl/objects.h
+ts_resp_sign.o: ../../include/openssl/opensslconf.h
+ts_resp_sign.o: ../../include/openssl/opensslv.h
+ts_resp_sign.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pkcs7.h
+ts_resp_sign.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
+ts_resp_sign.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
+ts_resp_sign.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+ts_resp_sign.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+ts_resp_sign.o: ../../include/openssl/symhacks.h ../../include/openssl/ts.h
+ts_resp_sign.o: ../../include/openssl/ui.h ../../include/openssl/ui_compat.h
+ts_resp_sign.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+ts_resp_sign.o: ../../include/openssl/x509v3.h ../cryptlib.h ts_resp_sign.c
+ts_resp_utils.o: ../../e_os.h ../../include/openssl/aes.h
+ts_resp_utils.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+ts_resp_utils.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
+ts_resp_utils.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
+ts_resp_utils.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
+ts_resp_utils.o: ../../include/openssl/des.h ../../include/openssl/des_old.h
+ts_resp_utils.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
+ts_resp_utils.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+ts_resp_utils.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+ts_resp_utils.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
+ts_resp_utils.o: ../../include/openssl/md4.h ../../include/openssl/md5.h
+ts_resp_utils.o: ../../include/openssl/mdc2.h ../../include/openssl/obj_mac.h
+ts_resp_utils.o: ../../include/openssl/objects.h
+ts_resp_utils.o: ../../include/openssl/opensslconf.h
+ts_resp_utils.o: ../../include/openssl/opensslv.h
+ts_resp_utils.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pkcs7.h
+ts_resp_utils.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
+ts_resp_utils.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
+ts_resp_utils.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+ts_resp_utils.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+ts_resp_utils.o: ../../include/openssl/symhacks.h ../../include/openssl/ts.h
+ts_resp_utils.o: ../../include/openssl/ui.h ../../include/openssl/ui_compat.h
+ts_resp_utils.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+ts_resp_utils.o: ../../include/openssl/x509v3.h ../cryptlib.h ts_resp_utils.c
+ts_resp_verify.o: ../../e_os.h ../../include/openssl/aes.h
+ts_resp_verify.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+ts_resp_verify.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
+ts_resp_verify.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
+ts_resp_verify.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
+ts_resp_verify.o: ../../include/openssl/des.h ../../include/openssl/des_old.h
+ts_resp_verify.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
+ts_resp_verify.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+ts_resp_verify.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+ts_resp_verify.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
+ts_resp_verify.o: ../../include/openssl/md4.h ../../include/openssl/md5.h
+ts_resp_verify.o: ../../include/openssl/mdc2.h ../../include/openssl/obj_mac.h
+ts_resp_verify.o: ../../include/openssl/objects.h
+ts_resp_verify.o: ../../include/openssl/opensslconf.h
+ts_resp_verify.o: ../../include/openssl/opensslv.h
+ts_resp_verify.o: ../../include/openssl/ossl_typ.h
+ts_resp_verify.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
+ts_resp_verify.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
+ts_resp_verify.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
+ts_resp_verify.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
+ts_resp_verify.o: ../../include/openssl/stack.h
+ts_resp_verify.o: ../../include/openssl/symhacks.h ../../include/openssl/ts.h
+ts_resp_verify.o: ../../include/openssl/ui.h ../../include/openssl/ui_compat.h
+ts_resp_verify.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+ts_resp_verify.o: ../../include/openssl/x509v3.h ../cryptlib.h ts_resp_verify.c
+ts_verify_ctx.o: ../../e_os.h ../../include/openssl/aes.h
+ts_verify_ctx.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+ts_verify_ctx.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
+ts_verify_ctx.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
+ts_verify_ctx.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
+ts_verify_ctx.o: ../../include/openssl/des.h ../../include/openssl/des_old.h
+ts_verify_ctx.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
+ts_verify_ctx.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+ts_verify_ctx.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+ts_verify_ctx.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
+ts_verify_ctx.o: ../../include/openssl/md4.h ../../include/openssl/md5.h
+ts_verify_ctx.o: ../../include/openssl/mdc2.h ../../include/openssl/obj_mac.h
+ts_verify_ctx.o: ../../include/openssl/objects.h
+ts_verify_ctx.o: ../../include/openssl/opensslconf.h
+ts_verify_ctx.o: ../../include/openssl/opensslv.h
+ts_verify_ctx.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pkcs7.h
+ts_verify_ctx.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
+ts_verify_ctx.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
+ts_verify_ctx.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+ts_verify_ctx.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+ts_verify_ctx.o: ../../include/openssl/symhacks.h ../../include/openssl/ts.h
+ts_verify_ctx.o: ../../include/openssl/ui.h ../../include/openssl/ui_compat.h
+ts_verify_ctx.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+ts_verify_ctx.o: ../../include/openssl/x509v3.h ../cryptlib.h ts_verify_ctx.c
Index: openssl/crypto/ts/input.txt
diff -u /dev/null openssl/crypto/ts/input.txt:1.1.20.1
--- /dev/null	Sun May  8 14:38:24 2005
+++ openssl/crypto/ts/input.txt	Sun May  8 14:24:07 2005
@@ -0,0 +1 @@
+kjfsdkjkasdbnksadfksdndsflsdkjkjhhgkajsdgkjdsagkjhdaksjgkf
Index: openssl/crypto/ts/ts.h
diff -u /dev/null openssl/crypto/ts/ts.h:1.1.20.1
--- /dev/null	Sun May  8 14:38:24 2005
+++ openssl/crypto/ts/ts.h	Sun May  8 14:24:08 2005
@@ -0,0 +1,858 @@
+/* crypto/ts/ts.h */
+/* Written by Zoltan Glozik (zglozik@opentsa.org) for the OpenSSL
+ * project 2002, 2003, 2004.
+ */
+/* ====================================================================
+ * Copyright (c) 2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#ifndef HEADER_TS_H
+#define HEADER_TS_H
+
+#include <openssl/symhacks.h>
+#ifndef NO_BUFFER
+#include <openssl/buffer.h>
+#endif
+#ifndef NO_EVP
+#include <openssl/evp.h>
+#endif
+#ifndef NO_BIO
+#include <openssl/bio.h>
+#endif
+#include <openssl/stack.h>
+#include <openssl/asn1.h>
+#include <openssl/safestack.h>
+
+#ifndef NO_RSA
+#include <openssl/rsa.h>
+#endif
+
+#ifndef NO_DSA
+#include <openssl/dsa.h>
+#endif
+
+#ifndef NO_DH
+#include <openssl/dh.h>
+#endif
+
+#include <openssl/evp.h>
+
+
+#ifdef  __cplusplus
+extern "C" {
+#endif
+
+#ifdef WIN32
+/* Under Win32 this is defined in wincrypt.h */
+#undef X509_NAME
+#endif
+
+#include <openssl/x509.h>
+#include <openssl/x509v3.h>
+
+/*
+MessageImprint ::= SEQUENCE  {
+     hashAlgorithm                AlgorithmIdentifier,
+     hashedMessage                OCTET STRING  }
+*/
+
+typedef struct TS_msg_imprint_st
+	{
+	X509_ALGOR *hash_algo;
+	ASN1_OCTET_STRING *hashed_msg;
+	} TS_MSG_IMPRINT;
+
+/*
+TimeStampReq ::= SEQUENCE  {
+   version                  INTEGER  { v1(1) },
+   messageImprint           MessageImprint,
+     --a hash algorithm OID and the hash value of the data to be
+     --time-stamped
+   reqPolicy                TSAPolicyId                OPTIONAL,
+   nonce                    INTEGER                    OPTIONAL,
+   certReq                  BOOLEAN                    DEFAULT FALSE,
+   extensions               [0] IMPLICIT Extensions    OPTIONAL  }
+*/
+
+typedef struct TS_req_st
+	{
+	ASN1_INTEGER *version;
+	TS_MSG_IMPRINT *msg_imprint;
+	ASN1_OBJECT *policy_id;		/* OPTIONAL */
+	ASN1_INTEGER *nonce;		/* OPTIONAL */
+	ASN1_BOOLEAN cert_req;		/* DEFAULT FALSE */
+	STACK_OF(X509_EXTENSION) *extensions;	/* [0] OPTIONAL */
+	} TS_REQ;
+
+/*
+Accuracy ::= SEQUENCE {
+                seconds        INTEGER           OPTIONAL,
+                millis     [0] INTEGER  (1..999) OPTIONAL,
+                micros     [1] INTEGER  (1..999) OPTIONAL  }
+*/
+
+typedef struct TS_accuracy_st
+	{
+	ASN1_INTEGER *seconds;
+	ASN1_INTEGER *millis;
+	ASN1_INTEGER *micros;
+	} TS_ACCURACY;
+
+/*
+TSTInfo ::= SEQUENCE  {
+    version                      INTEGER  { v1(1) },
+    policy                       TSAPolicyId,
+    messageImprint               MessageImprint,
+      -- MUST have the same value as the similar field in
+      -- TimeStampReq
+    serialNumber                 INTEGER,
+     -- Time-Stamping users MUST be ready to accommodate integers
+     -- up to 160 bits.
+    genTime                      GeneralizedTime,
+    accuracy                     Accuracy                 OPTIONAL,
+    ordering                     BOOLEAN             DEFAULT FALSE,
+    nonce                        INTEGER                  OPTIONAL,
+      -- MUST be present if the similar field was present
+      -- in TimeStampReq.  In that case it MUST have the same value.
+    tsa                          [0] GeneralName          OPTIONAL,
+    extensions                   [1] IMPLICIT Extensions  OPTIONAL   }
+*/
+
+typedef struct TS_tst_info_st
+	{
+	ASN1_INTEGER *version;
+	ASN1_OBJECT *policy_id;
+	TS_MSG_IMPRINT *msg_imprint;
+	ASN1_INTEGER *serial;
+	ASN1_GENERALIZEDTIME *time;
+	TS_ACCURACY *accuracy;
+	ASN1_BOOLEAN ordering;
+	ASN1_INTEGER *nonce;
+	GENERAL_NAME *tsa;
+	STACK_OF(X509_EXTENSION) *extensions;
+	} TS_TST_INFO;	
+
+/*
+PKIStatusInfo ::= SEQUENCE {
+    status        PKIStatus,
+    statusString  PKIFreeText     OPTIONAL,
+    failInfo      PKIFailureInfo  OPTIONAL  }
+
+From RFC 1510 - section 3.1.1:
+PKIFreeText ::= SEQUENCE SIZE (1..MAX) OF UTF8String
+	-- text encoded as UTF-8 String (note:  each UTF8String SHOULD
+	-- include an RFC 1766 language tag to indicate the language
+	-- of the contained text)
+*/
+
+/* Possible values for status. See ts_resp_print.c && ts_resp_verify.c. */
+
+#define	TS_STATUS_GRANTED			0
+#define	TS_STATUS_GRANTED_WITH_MODS		1
+#define	TS_STATUS_REJECTION			2
+#define	TS_STATUS_WAITING			3
+#define	TS_STATUS_REVOCATION_WARNING		4
+#define	TS_STATUS_REVOCATION_NOTIFICATION	5
+
+/* Possible values for failure_info. See ts_resp_print.c && ts_resp_verify.c */
+
+#define	TS_INFO_BAD_ALG			0
+#define	TS_INFO_BAD_REQUEST		2
+#define	TS_INFO_BAD_DATA_FORMAT		5
+#define	TS_INFO_TIME_NOT_AVAILABLE	14
+#define	TS_INFO_UNACCEPTED_POLICY	15
+#define	TS_INFO_UNACCEPTED_EXTENSION	16
+#define	TS_INFO_ADD_INFO_NOT_AVAILABLE	17
+#define	TS_INFO_SYSTEM_FAILURE		25
+
+typedef struct TS_status_info_st
+	{
+	ASN1_INTEGER *status;
+	STACK_OF(ASN1_UTF8STRING) *text;
+	ASN1_BIT_STRING *failure_info;
+	} TS_STATUS_INFO;
+
+DECLARE_STACK_OF(ASN1_UTF8STRING)
+DECLARE_ASN1_SET_OF(ASN1_UTF8STRING)
+
+/*
+TimeStampResp ::= SEQUENCE  {
+     status                  PKIStatusInfo,
+     timeStampToken          TimeStampToken     OPTIONAL }
+*/
+
+typedef struct TS_resp_st
+	{
+	TS_STATUS_INFO *status_info;
+	PKCS7 *token;
+	TS_TST_INFO *tst_info;
+	} TS_RESP;
+
+/* The structure below would belong to the ESS component. */
+
+/*
+IssuerSerial ::= SEQUENCE {
+	issuer                   GeneralNames,
+	serialNumber             CertificateSerialNumber
+	}
+*/
+
+typedef struct ESS_issuer_serial
+	{
+	STACK_OF(GENERAL_NAME)	*issuer;
+	ASN1_INTEGER		*serial;
+	} ESS_ISSUER_SERIAL;
+
+/*
+ESSCertID ::=  SEQUENCE {
+        certHash                 Hash,
+        issuerSerial             IssuerSerial OPTIONAL
+}
+*/
+
+typedef struct ESS_cert_id
+	{
+	ASN1_OCTET_STRING *hash;	/* Always SHA-1 digest. */
+	ESS_ISSUER_SERIAL *issuer_serial;
+	} ESS_CERT_ID;
+
+DECLARE_STACK_OF(ESS_CERT_ID)
+DECLARE_ASN1_SET_OF(ESS_CERT_ID)
+
+/*
+SigningCertificate ::=  SEQUENCE {
+       certs        SEQUENCE OF ESSCertID,
+       policies     SEQUENCE OF PolicyInformation OPTIONAL
+}
+*/
+
+typedef struct ESS_signing_cert
+	{
+	STACK_OF(ESS_CERT_ID) *cert_ids;
+	STACK_OF(POLICYINFO) *policy_info;
+	} ESS_SIGNING_CERT;
+
+
+TS_REQ	*TS_REQ_new(void);
+void	TS_REQ_free(TS_REQ *a);
+int	i2d_TS_REQ(const TS_REQ *a, unsigned char **pp);
+TS_REQ	*d2i_TS_REQ(TS_REQ **a, const unsigned char **pp, long length);
+
+TS_REQ	*TS_REQ_dup(TS_REQ *a);
+
+TS_REQ	*d2i_TS_REQ_fp(FILE *fp, TS_REQ **a);
+int	i2d_TS_REQ_fp(FILE *fp, TS_REQ *a);
+TS_REQ	*d2i_TS_REQ_bio(BIO *fp, TS_REQ **a);
+int	i2d_TS_REQ_bio(BIO *fp, TS_REQ *a);
+
+TS_MSG_IMPRINT	*TS_MSG_IMPRINT_new(void);
+void		TS_MSG_IMPRINT_free(TS_MSG_IMPRINT *a);
+int		i2d_TS_MSG_IMPRINT(const TS_MSG_IMPRINT *a, unsigned char **pp);
+TS_MSG_IMPRINT	*d2i_TS_MSG_IMPRINT(TS_MSG_IMPRINT **a,
+				    const unsigned char **pp, long length);
+
+TS_MSG_IMPRINT	*TS_MSG_IMPRINT_dup(TS_MSG_IMPRINT *a);
+
+TS_MSG_IMPRINT	*d2i_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT **a);
+int		i2d_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT *a);
+TS_MSG_IMPRINT	*d2i_TS_MSG_IMPRINT_bio(BIO *fp, TS_MSG_IMPRINT **a);
+int		i2d_TS_MSG_IMPRINT_bio(BIO *fp, TS_MSG_IMPRINT *a);
+
+TS_RESP	*TS_RESP_new(void);
+void	TS_RESP_free(TS_RESP *a);
+int	i2d_TS_RESP(const TS_RESP *a, unsigned char **pp);
+TS_RESP	*d2i_TS_RESP(TS_RESP **a, const unsigned char **pp, long length);
+TS_TST_INFO *PKCS7_to_TS_TST_INFO(PKCS7 *token);
+TS_RESP	*TS_RESP_dup(TS_RESP *a);
+
+TS_RESP	*d2i_TS_RESP_fp(FILE *fp, TS_RESP **a);
+int	i2d_TS_RESP_fp(FILE *fp, TS_RESP *a);
+TS_RESP	*d2i_TS_RESP_bio(BIO *fp, TS_RESP **a);
+int	i2d_TS_RESP_bio(BIO *fp, TS_RESP *a);
+
+TS_STATUS_INFO	*TS_STATUS_INFO_new(void);
+void		TS_STATUS_INFO_free(TS_STATUS_INFO *a);
+int		i2d_TS_STATUS_INFO(const TS_STATUS_INFO *a, unsigned char **pp);
+TS_STATUS_INFO	*d2i_TS_STATUS_INFO(TS_STATUS_INFO **a, 
+				    const unsigned char **pp, long length);
+TS_STATUS_INFO	*TS_STATUS_INFO_dup(TS_STATUS_INFO *a);
+
+TS_TST_INFO	*TS_TST_INFO_new(void);
+void		TS_TST_INFO_free(TS_TST_INFO *a);
+int		i2d_TS_TST_INFO(const TS_TST_INFO *a, unsigned char **pp);
+TS_TST_INFO	*d2i_TS_TST_INFO(TS_TST_INFO **a, const unsigned char **pp,
+				    long length);
+TS_TST_INFO	*TS_TST_INFO_dup(TS_TST_INFO *a);
+
+TS_TST_INFO	*d2i_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO **a);
+int		i2d_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO *a);
+TS_TST_INFO	*d2i_TS_TST_INFO_bio(BIO *fp, TS_TST_INFO **a);
+int		i2d_TS_TST_INFO_bio(BIO *fp, TS_TST_INFO *a);
+
+TS_ACCURACY	*TS_ACCURACY_new(void);
+void		TS_ACCURACY_free(TS_ACCURACY *a);
+int		i2d_TS_ACCURACY(const TS_ACCURACY *a, unsigned char **pp);
+TS_ACCURACY	*d2i_TS_ACCURACY(TS_ACCURACY **a, const unsigned char **pp,
+				    long length);
+TS_ACCURACY	*TS_ACCURACY_dup(TS_ACCURACY *a);
+
+ESS_ISSUER_SERIAL *ESS_ISSUER_SERIAL_new(void);
+void		  ESS_ISSUER_SERIAL_free(ESS_ISSUER_SERIAL *a);
+int		  i2d_ESS_ISSUER_SERIAL(const ESS_ISSUER_SERIAL *a,
+					unsigned char **pp);
+ESS_ISSUER_SERIAL *d2i_ESS_ISSUER_SERIAL(ESS_ISSUER_SERIAL **a,
+					 const unsigned char **pp, long length);
+ESS_ISSUER_SERIAL *ESS_ISSUER_SERIAL_dup(ESS_ISSUER_SERIAL *a);
+
+ESS_CERT_ID	*ESS_CERT_ID_new(void);
+void		ESS_CERT_ID_free(ESS_CERT_ID *a);
+int		i2d_ESS_CERT_ID(const ESS_CERT_ID *a, unsigned char **pp);
+ESS_CERT_ID	*d2i_ESS_CERT_ID(ESS_CERT_ID **a, const unsigned char **pp,
+				 long length);
+ESS_CERT_ID	*ESS_CERT_ID_dup(ESS_CERT_ID *a);
+
+ESS_SIGNING_CERT *ESS_SIGNING_CERT_new(void);
+void		 ESS_SIGNING_CERT_free(ESS_SIGNING_CERT *a);
+int		 i2d_ESS_SIGNING_CERT(const ESS_SIGNING_CERT *a, 
+				      unsigned char **pp);
+ESS_SIGNING_CERT *d2i_ESS_SIGNING_CERT(ESS_SIGNING_CERT **a,
+				       const unsigned char **pp, long length);
+ESS_SIGNING_CERT *ESS_SIGNING_CERT_dup(ESS_SIGNING_CERT *a);
+
+void ERR_load_TS_strings(void);
+
+int TS_REQ_set_version(TS_REQ *a, long version);
+long TS_REQ_get_version(TS_REQ *a);
+
+int TS_REQ_set_msg_imprint(TS_REQ *a, TS_MSG_IMPRINT *msg_imprint);
+TS_MSG_IMPRINT *TS_REQ_get_msg_imprint(TS_REQ *a);
+
+int TS_MSG_IMPRINT_set_algo(TS_MSG_IMPRINT *a, X509_ALGOR *alg);
+X509_ALGOR *TS_MSG_IMPRINT_get_algo(TS_MSG_IMPRINT *a);
+
+int TS_MSG_IMPRINT_set_msg(TS_MSG_IMPRINT *a, unsigned char *d, int len);
+ASN1_OCTET_STRING *TS_MSG_IMPRINT_get_msg(TS_MSG_IMPRINT *a);
+
+int TS_REQ_set_policy_id(TS_REQ *a, ASN1_OBJECT *policy);
+ASN1_OBJECT *TS_REQ_get_policy_id(TS_REQ *a);
+
+int TS_REQ_set_nonce(TS_REQ *a, ASN1_INTEGER *nonce);
+ASN1_INTEGER *TS_REQ_get_nonce(TS_REQ *a);
+
+int TS_REQ_set_cert_req(TS_REQ *a, int cert_req);
+int TS_REQ_get_cert_req(TS_REQ *a);
+
+STACK_OF(X509_EXTENSION) *TS_REQ_get_exts(TS_REQ *a);
+void TS_REQ_ext_free(TS_REQ *a);
+int TS_REQ_get_ext_count(TS_REQ *a);
+int TS_REQ_get_ext_by_NID(TS_REQ *a, int nid, int lastpos);
+int TS_REQ_get_ext_by_OBJ(TS_REQ *a, ASN1_OBJECT *obj, int lastpos);
+int TS_REQ_get_ext_by_critical(TS_REQ *a, int crit, int lastpos);
+X509_EXTENSION *TS_REQ_get_ext(TS_REQ *a, int loc);
+X509_EXTENSION *TS_REQ_delete_ext(TS_REQ *a, int loc);
+int TS_REQ_add_ext(TS_REQ *a, X509_EXTENSION *ex, int loc);
+void *TS_REQ_get_ext_d2i(TS_REQ *a, int nid, int *crit, int *idx);
+
+/* Function declarations for TS_REQ defined in ts/ts_req_print.c */
+
+int TS_REQ_print_bio(BIO *bio, TS_REQ *a);
+
+/* Function declarations for TS_RESP defined in ts/ts_resp_utils.c */
+
+int TS_RESP_set_status_info(TS_RESP *a, TS_STATUS_INFO *info);
+TS_STATUS_INFO *TS_RESP_get_status_info(TS_RESP *a);
+
+/* Caller loses ownership of PKCS7 and TS_TST_INFO objects. */
+void TS_RESP_set_tst_info(TS_RESP *a, PKCS7 *p7, TS_TST_INFO *tst_info);
+PKCS7 *TS_RESP_get_token(TS_RESP *a);
+TS_TST_INFO *TS_RESP_get_tst_info(TS_RESP *a);
+
+int TS_TST_INFO_set_version(TS_TST_INFO *a, long version);
+long TS_TST_INFO_get_version(TS_TST_INFO *a);
+
+int TS_TST_INFO_set_policy_id(TS_TST_INFO *a, ASN1_OBJECT *policy_id);
+ASN1_OBJECT *TS_TST_INFO_get_policy_id(TS_TST_INFO *a);
+
+int TS_TST_INFO_set_msg_imprint(TS_TST_INFO *a, TS_MSG_IMPRINT *msg_imprint);
+TS_MSG_IMPRINT *TS_TST_INFO_get_msg_imprint(TS_TST_INFO *a);
+
+int TS_TST_INFO_set_serial(TS_TST_INFO *a, ASN1_INTEGER *serial);
+ASN1_INTEGER *TS_TST_INFO_get_serial(TS_TST_INFO *a);
+
+int TS_TST_INFO_set_time(TS_TST_INFO *a, ASN1_GENERALIZEDTIME *gtime);
+ASN1_GENERALIZEDTIME *TS_TST_INFO_get_time(TS_TST_INFO *a);
+
+int TS_TST_INFO_set_accuracy(TS_TST_INFO *a, TS_ACCURACY *accuracy);
+TS_ACCURACY *TS_TST_INFO_get_accuracy(TS_TST_INFO *a);
+
+int TS_ACCURACY_set_seconds(TS_ACCURACY *a, ASN1_INTEGER *seconds);
+ASN1_INTEGER *TS_ACCURACY_get_seconds(TS_ACCURACY *a);
+
+int TS_ACCURACY_set_millis(TS_ACCURACY *a, ASN1_INTEGER *millis);
+ASN1_INTEGER *TS_ACCURACY_get_millis(TS_ACCURACY *a);
+
+int TS_ACCURACY_set_micros(TS_ACCURACY *a, ASN1_INTEGER *micros);
+ASN1_INTEGER *TS_ACCURACY_get_micros(TS_ACCURACY *a);
+
+int TS_TST_INFO_set_ordering(TS_TST_INFO *a, int ordering);
+int TS_TST_INFO_get_ordering(TS_TST_INFO *a);
+
+int TS_TST_INFO_set_nonce(TS_TST_INFO *a, ASN1_INTEGER *nonce);
+ASN1_INTEGER *TS_TST_INFO_get_nonce(TS_TST_INFO *a);
+
+int TS_TST_INFO_set_tsa(TS_TST_INFO *a, GENERAL_NAME *tsa);
+GENERAL_NAME *TS_TST_INFO_get_tsa(TS_TST_INFO *a);
+
+STACK_OF(X509_EXTENSION) *TS_TST_INFO_get_exts(TS_TST_INFO *a);
+void TS_TST_INFO_ext_free(TS_TST_INFO *a);
+int TS_TST_INFO_get_ext_count(TS_TST_INFO *a);
+int TS_TST_INFO_get_ext_by_NID(TS_TST_INFO *a, int nid, int lastpos);
+int TS_TST_INFO_get_ext_by_OBJ(TS_TST_INFO *a, ASN1_OBJECT *obj, int lastpos);
+int TS_TST_INFO_get_ext_by_critical(TS_TST_INFO *a, int crit, int lastpos);
+X509_EXTENSION *TS_TST_INFO_get_ext(TS_TST_INFO *a, int loc);
+X509_EXTENSION *TS_TST_INFO_delete_ext(TS_TST_INFO *a, int loc);
+int TS_TST_INFO_add_ext(TS_TST_INFO *a, X509_EXTENSION *ex, int loc);
+void *TS_TST_INFO_get_ext_d2i(TS_TST_INFO *a, int nid, int *crit, int *idx);
+
+/* Declarations related to response generation, defined in ts/ts_resp_sign.c. */
+
+/* Optional flags for response generation. */
+
+/* Don't include the TSA name in response. */
+#define	TS_TSA_NAME		0x01
+
+/* Set ordering to true in response. */
+#define	TS_ORDERING		0x02
+
+/*
+ * Include the signer certificate and the other specified certificates in
+ * the ESS signing certificate attribute beside the PKCS7 signed data.
+ * Only the signer certificates is included by default.
+ */
+#define	TS_ESS_CERT_ID_CHAIN	0x04
+
+/* Forward declaration. */
+struct TS_resp_ctx;
+
+/* This must return a unique number less than 160 bits long. */
+typedef ASN1_INTEGER *(*TS_serial_cb)(struct TS_resp_ctx *, void *);
+
+/* This must return the seconds and microseconds since Jan 1, 1970 in
+   the sec and usec variables allocated by the caller. 
+   Return non-zero for success and zero for failure. */
+typedef	int (*TS_time_cb)(struct TS_resp_ctx *, void *, long *sec, long *usec);
+
+/* This must process the given extension.
+ * It can modify the TS_TST_INFO object of the context.
+ * Return values: !0 (processed), 0 (error, it must set the 
+ * status info/failure info of the response).
+ */
+typedef	int (*TS_extension_cb)(struct TS_resp_ctx *, X509_EXTENSION *, void *);
+
+typedef struct TS_resp_ctx
+	{
+	X509		*signer_cert;
+	EVP_PKEY	*signer_key;
+	STACK_OF(X509)	*certs;	/* Certs to include in signed data. */
+	STACK_OF(ASN1_OBJECT)	*policies;	/* Acceptable policies. */
+	ASN1_OBJECT	*default_policy; /* It may appear in policies, too. */
+	STACK_OF(EVP_MD)	*mds;	/* Acceptable message digests. */
+	ASN1_INTEGER	*seconds;	/* accuracy, 0 means not specified. */
+	ASN1_INTEGER	*millis;	/* accuracy, 0 means not specified. */
+	ASN1_INTEGER	*micros;	/* accuracy, 0 means not specified. */
+	unsigned	clock_precision_digits; /* fraction of seconds in
+						   time stamp token. */
+	unsigned	flags;		/* Optional info, see values above. */
+
+	/* Callback functions. */
+	TS_serial_cb serial_cb;
+	void *serial_cb_data;	/* User data for serial_cb. */
+	
+	TS_time_cb time_cb;
+	void *time_cb_data;	/* User data for time_cb. */
+	
+	TS_extension_cb extension_cb;
+	void *extension_cb_data;	/* User data for extension_cb. */
+
+	/* These members are used only while creating the response. */
+	TS_REQ		*request;
+	TS_RESP		*response;
+	TS_TST_INFO	*tst_info;
+	} TS_RESP_CTX;
+
+DECLARE_STACK_OF(EVP_MD)
+DECLARE_ASN1_SET_OF(EVP_MD)
+
+/* Creates a response context that can be used for generating responses. */
+TS_RESP_CTX *TS_RESP_CTX_new(void);
+void TS_RESP_CTX_free(TS_RESP_CTX *ctx);
+
+/* This parameter must be set. */
+int TS_RESP_CTX_set_signer_cert(TS_RESP_CTX *ctx, X509 *signer);
+
+/* This parameter must be set. */
+int TS_RESP_CTX_set_signer_key(TS_RESP_CTX *ctx, EVP_PKEY *key);
+
+/* This parameter must be set. */
+int TS_RESP_CTX_set_def_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *def_policy);
+
+/* No additional certs are included in the response by default. */
+int TS_RESP_CTX_set_certs(TS_RESP_CTX *ctx, STACK_OF(X509) *certs);
+
+/* Adds a new acceptable policy, only the default policy 
+   is accepted by default. */
+int TS_RESP_CTX_add_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *policy);
+
+/* Adds a new acceptable message digest. Note that no message digests 
+   are accepted by default. The md argument is shared with the caller. */
+int TS_RESP_CTX_add_md(TS_RESP_CTX *ctx, const EVP_MD *md);
+
+/* Accuracy is not included by default. */
+int TS_RESP_CTX_set_accuracy(TS_RESP_CTX *ctx,
+			     int secs, int millis, int micros);
+
+/* Clock precision digits, i.e. the number of decimal digits: 
+   '0' means sec, '3' msec, '6' usec, and so on. Default is 0. */ 
+int TS_RESP_CTX_set_clock_precision_digits(TS_RESP_CTX *ctx,
+					   unsigned clock_precision_digits);
+/* At most we accept usec precision. */	
+#define TS_MAX_CLOCK_PRECISION_DIGITS	6
+
+/* No flags are set by default. */
+void TS_RESP_CTX_add_flags(TS_RESP_CTX *ctx, int flags);
+
+/* Default callback always returns a constant. */
+void TS_RESP_CTX_set_serial_cb(TS_RESP_CTX *ctx, TS_serial_cb cb, void *data);
+
+/* Default callback uses the gettimeofday() and gmtime() system calls. */
+void TS_RESP_CTX_set_time_cb(TS_RESP_CTX *ctx, TS_time_cb cb, void *data);
+
+/* Default callback rejects all extensions. The extension callback is called 
+ * when the TS_TST_INFO object is already set up and not signed yet. */
+/* FIXME: extension handling is not tested yet. */
+void TS_RESP_CTX_set_extension_cb(TS_RESP_CTX *ctx, 
+				  TS_extension_cb cb, void *data);
+
+/* The following methods can be used in the callbacks. */
+int TS_RESP_CTX_set_status_info(TS_RESP_CTX *ctx, 
+				int status, const char *text);
+
+/* Sets the status info only if it is still TS_STATUS_GRANTED. */
+int TS_RESP_CTX_set_status_info_cond(TS_RESP_CTX *ctx, 
+				     int status, const char *text);
+
+int TS_RESP_CTX_add_failure_info(TS_RESP_CTX *ctx, int failure);
+
+/* The get methods below can be used in the extension callback. */
+TS_REQ *TS_RESP_CTX_get_request(TS_RESP_CTX *ctx);
+
+TS_TST_INFO *TS_RESP_CTX_get_tst_info(TS_RESP_CTX *ctx);
+
+/* 
+ * Creates the signed TS_TST_INFO and puts it in TS_RESP.
+ * In case of errors it sets the status info properly.
+ * Returns NULL only in case of memory allocation/fatal error.
+ */
+TS_RESP *TS_RESP_create_response(TS_RESP_CTX *ctx, BIO *req_bio);
+
+/*
+ * Declarations related to response verification,
+ * they are defined in ts/ts_resp_verify.c.
+ */
+
+int TS_RESP_verify_signature(PKCS7 *token, STACK_OF(X509) *certs,
+			     X509_STORE *store, X509 **signer_out);
+
+/* Context structure for the generic verify method. */
+
+/* Verify the signer's certificate and the signature of the response. */
+#define	TS_VFY_SIGNATURE	(1u << 0)
+/* Verify the version number of the response. */
+#define	TS_VFY_VERSION		(1u << 1)
+/* Verify if the policy supplied by the user matches the policy of the TSA. */
+#define	TS_VFY_POLICY		(1u << 2)
+/* Verify the message imprint provided by the user. This flag should not be
+   specified with TS_VFY_DATA. */
+#define	TS_VFY_IMPRINT		(1u << 3)
+/* Verify the message imprint computed by the verify method from the user
+   provided data and the MD algorithm of the response. This flag should not be
+   specified with TS_VFY_IMPRINT. */
+#define	TS_VFY_DATA		(1u << 4)
+/* Verify the nonce value. */
+#define	TS_VFY_NONCE		(1u << 5)
+/* Verify if the TSA name field matches the signer certificate. */
+#define	TS_VFY_SIGNER		(1u << 6)
+/* Verify if the TSA name field equals to the user provided name. */
+#define	TS_VFY_TSA_NAME		(1u << 7)
+
+/* You can use the following convenience constants. */
+#define	TS_VFY_ALL_IMPRINT	(TS_VFY_SIGNATURE	\
+				 | TS_VFY_VERSION	\
+				 | TS_VFY_POLICY	\
+				 | TS_VFY_IMPRINT	\
+				 | TS_VFY_NONCE		\
+				 | TS_VFY_SIGNER	\
+				 | TS_VFY_TSA_NAME)
+#define	TS_VFY_ALL_DATA		(TS_VFY_SIGNATURE	\
+				 | TS_VFY_VERSION	\
+				 | TS_VFY_POLICY	\
+				 | TS_VFY_DATA		\
+				 | TS_VFY_NONCE		\
+				 | TS_VFY_SIGNER	\
+				 | TS_VFY_TSA_NAME)
+
+typedef struct TS_verify_ctx
+	{
+	/* Set this to the union of TS_VFY_... flags you want to carry out. */
+	unsigned	flags;
+
+	/* Must be set only with TS_VFY_SIGNATURE. certs is optional. */
+	X509_STORE	*store;
+	STACK_OF(X509)	*certs;
+
+	/* Must be set only with TS_VFY_POLICY. */
+	ASN1_OBJECT	*policy;
+
+	/* Must be set only with TS_VFY_IMPRINT. If md_alg is NULL, 
+	   the algorithm from the response is used. */
+	X509_ALGOR	*md_alg;
+	unsigned char	*imprint;
+	unsigned	imprint_len;
+
+	/* Must be set only with TS_VFY_DATA. */
+	BIO		*data;
+
+	/* Must be set only with TS_VFY_TSA_NAME. */
+	ASN1_INTEGER	*nonce;
+
+	/* Must be set only with TS_VFY_TSA_NAME. */
+	GENERAL_NAME	*tsa_name;
+	} TS_VERIFY_CTX;
+
+int TS_RESP_verify_response(TS_VERIFY_CTX *ctx, TS_RESP *response);
+int TS_RESP_verify_token(TS_VERIFY_CTX *ctx, PKCS7 *token);
+
+/*
+ * Declarations related to response verification context,
+ * they are defined in ts/ts_verify_ctx.c.
+ */
+
+/* Set all fields to zero. */
+TS_VERIFY_CTX *TS_VERIFY_CTX_new(void);
+void TS_VERIFY_CTX_init(TS_VERIFY_CTX *ctx);
+void TS_VERIFY_CTX_free(TS_VERIFY_CTX *ctx);
+void TS_VERIFY_CTX_cleanup(TS_VERIFY_CTX *ctx);
+
+/* 
+ * If ctx is NULL, it allocates and returns a new object, otherwise
+ * it returns ctx. It initialises all the members as follows:
+ * flags = TS_VFY_ALL_IMPRINT & ~(TS_VFY_TSA_NAME | TS_VFY_SIGNATURE)
+ * certs = NULL
+ * store = NULL
+ * policy = policy from the request or NULL if absent (in this case
+ *	TS_VFY_POLICY is cleared from flags as well)
+ * md_alg = MD algorithm from request
+ * imprint, imprint_len = imprint from request
+ * data = NULL
+ * nonce, nonce_len = nonce from the request or NULL if absent (in this case
+ * 	TS_VFY_NONCE is cleared from flags as well)
+ * tsa_name = NULL
+ * Important: after calling this method TS_VFY_SIGNATURE should be added!
+ */
+TS_VERIFY_CTX *TS_REQ_to_TS_VERIFY_CTX(TS_REQ *req, TS_VERIFY_CTX *ctx);
+
+/* Function declarations for TS_RESP defined in ts/ts_resp_print.c */
+
+int TS_RESP_print_bio(BIO *bio, TS_RESP *a);
+int TS_STATUS_INFO_print_bio(BIO *bio, TS_STATUS_INFO *a);
+int TS_TST_INFO_print_bio(BIO *bio, TS_TST_INFO *a);
+
+/* Common utility functions defined in ts/ts_lib.c */
+
+int TS_ASN1_INTEGER_print_bio(BIO *bio, ASN1_INTEGER *num);
+int TS_OBJ_print_bio(BIO *bio, ASN1_OBJECT *obj);
+int TS_ext_print_bio(BIO *bio, STACK_OF(X509_EXTENSION) *extensions);
+int TS_X509_ALGOR_print_bio(BIO *bio, X509_ALGOR *alg);
+int TS_MSG_IMPRINT_print_bio(BIO *bio, TS_MSG_IMPRINT *msg);
+
+/* Function declarations for handling configuration options,
+   defined in ts/ts_conf.c */
+
+X509 *TS_CONF_load_cert(const char *file);
+STACK_OF(X509) *TS_CONF_load_certs(const char *file);
+EVP_PKEY *TS_CONF_load_key(const char *file, const char *pass);
+const char *TS_CONF_get_tsa_section(CONF *conf, const char *section);
+int TS_CONF_set_serial(CONF *conf, const char *section, TS_serial_cb cb,
+		       TS_RESP_CTX *ctx);
+int TS_CONF_set_crypto_device(CONF *conf, const char *section,
+			      const char *device);
+int TS_CONF_set_default_engine(const char *name);
+int TS_CONF_set_signer_cert(CONF *conf, const char *section,
+			    const char *cert, TS_RESP_CTX *ctx);
+int TS_CONF_set_certs(CONF *conf, const char *section, const char *certs,
+		      TS_RESP_CTX *ctx);
+int TS_CONF_set_signer_key(CONF *conf, const char *section,
+			   const char *key, const char *pass, TS_RESP_CTX *ctx);
+int TS_CONF_set_def_policy(CONF *conf, const char *section,
+			   const char *policy, TS_RESP_CTX *ctx);
+int TS_CONF_set_policies(CONF *conf, const char *section, TS_RESP_CTX *ctx);
+int TS_CONF_set_digests(CONF *conf, const char *section, TS_RESP_CTX *ctx);
+int TS_CONF_set_accuracy(CONF *conf, const char *section, TS_RESP_CTX *ctx);
+int TS_CONF_set_clock_precision_digits(CONF *conf, const char *section,
+				       TS_RESP_CTX *ctx);
+int TS_CONF_set_ordering(CONF *conf, const char *section, TS_RESP_CTX *ctx);
+int TS_CONF_set_tsa_name(CONF *conf, const char *section, TS_RESP_CTX *ctx);
+int TS_CONF_set_ess_cert_id_chain(CONF *conf, const char *section,
+				  TS_RESP_CTX *ctx);
+
+/* -------------------------------------------------- */
+/* BEGIN ERROR CODES */
+/* The following lines are auto generated by the script mkerr.pl. Any changes
+ * made after this point may be overwritten when the script is next run.
+ */
+void ERR_load_TS_strings(void);
+
+/* Error codes for the TS functions. */
+
+/* Function codes. */
+#define TS_F_D2I_TS_RESP				 147
+#define TS_F_DEF_SERIAL_CB				 110
+#define TS_F_DEF_TIME_CB				 111
+#define TS_F_ESS_ADD_SIGNING_CERT			 112
+#define TS_F_ESS_CERT_ID_NEW_INIT			 113
+#define TS_F_ESS_SIGNING_CERT_NEW_INIT			 114
+#define TS_F_PKCS7_TO_TS_TST_INFO			 148
+#define TS_F_TS_ACCURACY_SET_MICROS			 115
+#define TS_F_TS_ACCURACY_SET_MILLIS			 116
+#define TS_F_TS_ACCURACY_SET_SECONDS			 117
+#define TS_F_TS_CHECK_IMPRINTS				 100
+#define TS_F_TS_CHECK_NONCES				 101
+#define TS_F_TS_CHECK_POLICY				 102
+#define TS_F_TS_CHECK_SIGNING_CERTS			 103
+#define TS_F_TS_CHECK_STATUS_INFO			 104
+#define TS_F_TS_COMPUTE_IMPRINT				 145
+#define TS_F_TS_CONF_SET_DEFAULT_ENGINE			 146
+#define TS_F_TS_GET_STATUS_TEXT				 105
+#define TS_F_TS_MSG_IMPRINT_SET_ALGO			 118
+#define TS_F_TS_REQ_SET_MSG_IMPRINT			 119
+#define TS_F_TS_REQ_SET_NONCE				 120
+#define TS_F_TS_REQ_SET_POLICY_ID			 121
+#define TS_F_TS_RESP_CREATE_RESPONSE			 122
+#define TS_F_TS_RESP_CREATE_TST_INFO			 123
+#define TS_F_TS_RESP_CTX_ADD_FAILURE_INFO		 124
+#define TS_F_TS_RESP_CTX_ADD_MD				 125
+#define TS_F_TS_RESP_CTX_ADD_POLICY			 126
+#define TS_F_TS_RESP_CTX_NEW				 127
+#define TS_F_TS_RESP_CTX_SET_ACCURACY			 128
+#define TS_F_TS_RESP_CTX_SET_CERTS			 129
+#define TS_F_TS_RESP_CTX_SET_DEF_POLICY			 130
+#define TS_F_TS_RESP_CTX_SET_SIGNER_CERT		 131
+#define TS_F_TS_RESP_CTX_SET_STATUS_INFO		 132
+#define TS_F_TS_RESP_GET_POLICY				 133
+#define TS_F_TS_RESP_SET_GENTIME_WITH_PRECISION		 134
+#define TS_F_TS_RESP_SET_STATUS_INFO			 135
+#define TS_F_TS_RESP_SIGN				 136
+#define TS_F_TS_RESP_VERIFY_SIGNATURE			 106
+#define TS_F_TS_RESP_VERIFY_TOKEN			 107
+#define TS_F_TS_TST_INFO_SET_ACCURACY			 137
+#define TS_F_TS_TST_INFO_SET_MSG_IMPRINT		 138
+#define TS_F_TS_TST_INFO_SET_NONCE			 139
+#define TS_F_TS_TST_INFO_SET_POLICY_ID			 140
+#define TS_F_TS_TST_INFO_SET_SERIAL			 141
+#define TS_F_TS_TST_INFO_SET_TIME			 142
+#define TS_F_TS_TST_INFO_SET_TSA			 143
+#define TS_F_TS_VERIFY					 108
+#define TS_F_TS_VERIFY_CERT				 109
+#define TS_F_TS_VERIFY_CTX_NEW				 144
+
+/* Reason codes. */
+#define TS_R_BAD_PKCS7_TYPE				 132
+#define TS_R_BAD_TYPE					 133
+#define TS_R_CERTIFICATE_VERIFY_ERROR			 100
+#define TS_R_COULD_NOT_SET_ENGINE			 127
+#define TS_R_COULD_NOT_SET_TIME				 115
+#define TS_R_D2I_TS_RESP_INT_FAILED			 128
+#define TS_R_DETACHED_CONTENT				 134
+#define TS_R_ESS_ADD_SIGNING_CERT_ERROR			 116
+#define TS_R_ESS_SIGNING_CERTIFICATE_ERROR		 101
+#define TS_R_INVALID_NULL_POINTER			 102
+#define TS_R_INVALID_SIGNER_CERTIFICATE_PURPOSE		 117
+#define TS_R_MESSAGE_IMPRINT_MISMATCH			 103
+#define TS_R_NONCE_MISMATCH				 104
+#define TS_R_NONCE_NOT_RETURNED				 105
+#define TS_R_NO_CONTENT					 106
+#define TS_R_NO_TIME_STAMP_TOKEN			 107
+#define TS_R_PKCS7_ADD_SIGNATURE_ERROR			 118
+#define TS_R_PKCS7_ADD_SIGNED_ATTR_ERROR		 119
+#define TS_R_PKCS7_TO_TS_TST_INFO_FAILED		 129
+#define TS_R_POLICY_MISMATCH				 108
+#define TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE	 120
+#define TS_R_RESPONSE_SETUP_ERROR			 121
+#define TS_R_SIGNATURE_FAILURE				 109
+#define TS_R_THERE_MUST_BE_ONE_SIGNER			 110
+#define TS_R_TIME_SYSCALL_ERROR				 122
+#define TS_R_TOKEN_NOT_PRESENT				 130
+#define TS_R_TOKEN_PRESENT				 131
+#define TS_R_TSA_NAME_MISMATCH				 111
+#define TS_R_TSA_UNTRUSTED				 112
+#define TS_R_TST_INFO_SETUP_ERROR			 123
+#define TS_R_TS_DATASIGN				 124
+#define TS_R_UNACCEPTABLE_POLICY			 125
+#define TS_R_UNSUPPORTED_MD_ALGORITHM			 126
+#define TS_R_UNSUPPORTED_VERSION			 113
+#define TS_R_WRONG_CONTENT_TYPE				 114
+
+#ifdef  __cplusplus
+}
+#endif
+#endif
Index: openssl/crypto/ts/ts_asn1.c
diff -u /dev/null openssl/crypto/ts/ts_asn1.c:1.1.4.1
--- /dev/null	Sun May  8 14:38:24 2005
+++ openssl/crypto/ts/ts_asn1.c	Sun May  8 14:24:08 2005
@@ -0,0 +1,347 @@
+/* crypto/ts/ts_asn1.c */
+/* Written by Nils Larsch for the OpenSSL project 2004.
+ */
+/* ====================================================================
+ * Copyright (c) 2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <openssl/ts.h>
+#include <openssl/err.h>
+#include <openssl/asn1t.h>
+
+ASN1_SEQUENCE(TS_MSG_IMPRINT) = {
+	ASN1_SIMPLE(TS_MSG_IMPRINT, hash_algo, X509_ALGOR),
+	ASN1_SIMPLE(TS_MSG_IMPRINT, hashed_msg, ASN1_OCTET_STRING)
+} ASN1_SEQUENCE_END(TS_MSG_IMPRINT)
+
+IMPLEMENT_ASN1_FUNCTIONS_const(TS_MSG_IMPRINT)
+IMPLEMENT_ASN1_DUP_FUNCTION(TS_MSG_IMPRINT)
+#ifndef OPENSSL_NO_BIO
+int i2d_TS_MSG_IMPRINT_bio(BIO *bp, TS_MSG_IMPRINT *a)
+{
+	return ASN1_i2d_bio(i2d_TS_MSG_IMPRINT, bp, (unsigned char *) a);
+}
+#endif
+#ifndef OPENSSL_NO_FP_API
+TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT **a)
+	{
+	return (TS_MSG_IMPRINT *) ASN1_d2i_fp((char *(*)()) TS_MSG_IMPRINT_new,
+		(char *(*)()) d2i_TS_MSG_IMPRINT, fp, (unsigned char **) a);
+	}
+
+int i2d_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT *a)
+	{
+	return ASN1_i2d_fp(i2d_TS_MSG_IMPRINT, fp, (unsigned char *) a);
+	}
+#endif
+
+ASN1_SEQUENCE(TS_REQ) = {
+	ASN1_SIMPLE(TS_REQ, version, ASN1_INTEGER),
+	ASN1_SIMPLE(TS_REQ, msg_imprint, TS_MSG_IMPRINT),
+	ASN1_OPT(TS_REQ, policy_id, ASN1_OBJECT),
+	ASN1_OPT(TS_REQ, nonce, ASN1_INTEGER),
+	ASN1_OPT(TS_REQ, cert_req, ASN1_BOOLEAN),
+	ASN1_IMP_SEQUENCE_OF_OPT(TS_REQ, extensions, X509_EXTENSION, 0)
+} ASN1_SEQUENCE_END(TS_REQ)
+
+IMPLEMENT_ASN1_FUNCTIONS_const(TS_REQ)
+IMPLEMENT_ASN1_DUP_FUNCTION(TS_REQ)
+#ifndef OPENSSL_NO_BIO
+TS_REQ *d2i_TS_REQ_bio(BIO *bp, TS_REQ **a)
+	{
+	return (TS_REQ *) ASN1_d2i_bio((char *(*)()) TS_REQ_new,
+		(char *(*)()) d2i_TS_REQ, bp, (unsigned char **) a);
+	}
+
+int i2d_TS_REQ_bio(BIO *bp, TS_REQ *a)
+	{
+	return ASN1_i2d_bio(i2d_TS_REQ, bp, (unsigned char *) a);
+	}
+#endif
+#ifndef OPENSSL_NO_FP_API
+TS_REQ *d2i_TS_REQ_fp(FILE *fp, TS_REQ **a)
+	{
+	return (TS_REQ *) ASN1_d2i_fp((char *(*)()) TS_REQ_new,
+		(char *(*)()) d2i_TS_REQ, fp, (unsigned char **) a);
+	}
+
+int i2d_TS_REQ_fp(FILE *fp, TS_REQ *a)
+	{
+	return ASN1_i2d_fp(i2d_TS_REQ, fp, (unsigned char *) a);
+	}
+#endif
+
+ASN1_SEQUENCE(TS_ACCURACY) = {
+	ASN1_OPT(TS_ACCURACY, seconds, ASN1_INTEGER),
+	ASN1_IMP_OPT(TS_ACCURACY, millis, ASN1_INTEGER, 0),
+	ASN1_IMP_OPT(TS_ACCURACY, micros, ASN1_INTEGER, 1)
+} ASN1_SEQUENCE_END(TS_ACCURACY)
+
+IMPLEMENT_ASN1_FUNCTIONS_const(TS_ACCURACY)
+IMPLEMENT_ASN1_DUP_FUNCTION(TS_ACCURACY)
+
+ASN1_SEQUENCE(TS_TST_INFO) = {
+	ASN1_SIMPLE(TS_TST_INFO, version, ASN1_INTEGER),
+	ASN1_SIMPLE(TS_TST_INFO, policy_id, ASN1_OBJECT),
+	ASN1_SIMPLE(TS_TST_INFO, msg_imprint, TS_MSG_IMPRINT),
+	ASN1_SIMPLE(TS_TST_INFO, serial, ASN1_INTEGER),
+	ASN1_SIMPLE(TS_TST_INFO, time, ASN1_GENERALIZEDTIME),
+	ASN1_OPT(TS_TST_INFO, accuracy, TS_ACCURACY),
+	ASN1_OPT(TS_TST_INFO, ordering, ASN1_BOOLEAN),
+	ASN1_OPT(TS_TST_INFO, nonce, ASN1_INTEGER),
+	ASN1_EXP_OPT(TS_TST_INFO, tsa, GENERAL_NAME, 0),
+	ASN1_IMP_SEQUENCE_OF_OPT(TS_TST_INFO, extensions, X509_EXTENSION, 1)
+} ASN1_SEQUENCE_END(TS_TST_INFO)
+
+IMPLEMENT_ASN1_FUNCTIONS_const(TS_TST_INFO)
+IMPLEMENT_ASN1_DUP_FUNCTION(TS_TST_INFO)
+#ifndef OPENSSL_NO_BIO
+TS_TST_INFO *d2i_TS_TST_INFO_bio(BIO *bp, TS_TST_INFO **a)
+	{
+	return (TS_TST_INFO *) ASN1_d2i_bio((char *(*)()) TS_TST_INFO_new,
+					    (char *(*)()) d2i_TS_TST_INFO,
+					    bp, (unsigned char **) a);
+	}
+
+int i2d_TS_TST_INFO_bio(BIO *bp, TS_TST_INFO *a)
+	{
+	return ASN1_i2d_bio(i2d_TS_TST_INFO, bp, (unsigned char *) a);
+	}
+#endif
+#ifndef OPENSSL_NO_FP_API
+TS_TST_INFO *d2i_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO **a)
+	{
+	return (TS_TST_INFO *) ASN1_d2i_fp((char *(*)()) TS_TST_INFO_new,
+					   (char *(*)()) d2i_TS_TST_INFO,
+					   fp, (unsigned char **) a);
+	}
+
+int i2d_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO *a)
+	{
+	return ASN1_i2d_fp(i2d_TS_TST_INFO, fp, (unsigned char *) a);
+	}
+#endif
+
+ASN1_SEQUENCE(TS_STATUS_INFO) = {
+	ASN1_SIMPLE(TS_STATUS_INFO, status, ASN1_INTEGER),
+	ASN1_SEQUENCE_OF_OPT(TS_STATUS_INFO, text, ASN1_UTF8STRING),
+	ASN1_OPT(TS_STATUS_INFO, failure_info, ASN1_BIT_STRING)
+} ASN1_SEQUENCE_END(TS_STATUS_INFO)
+
+IMPLEMENT_ASN1_FUNCTIONS_const(TS_STATUS_INFO)
+IMPLEMENT_ASN1_DUP_FUNCTION(TS_STATUS_INFO)
+
+ASN1_SEQUENCE(TS_RESP) = {
+	ASN1_SIMPLE(TS_RESP, status_info, TS_STATUS_INFO),
+	ASN1_OPT(TS_RESP, token, PKCS7),
+} ASN1_SEQUENCE_END(TS_RESP)
+
+IMPLEMENT_ASN1_ALLOC_FUNCTIONS_fname(TS_RESP, TS_RESP, TS_RESP_int)
+IMPLEMENT_ASN1_ENCODE_FUNCTIONS_const_fname(TS_RESP, TS_RESP, TS_RESP_int)
+
+TS_RESP *TS_RESP_new(void)
+{
+	TS_RESP *ret = TS_RESP_int_new();
+	if (!ret)
+		return NULL;
+	ret->tst_info = NULL;
+	return ret;
+}
+
+void TS_RESP_free(TS_RESP *a)
+{
+	if (!a)
+		return;
+	if (a->tst_info)
+		TS_TST_INFO_free(a->tst_info);
+	TS_RESP_int_free(a);
+}
+
+int i2d_TS_RESP(const TS_RESP *a, unsigned char **pp)
+{
+	return i2d_TS_RESP_int(a, pp);
+}
+
+TS_RESP *d2i_TS_RESP(TS_RESP **a, const unsigned char **pp, long len)
+{
+	long    status;
+	TS_RESP *ret;
+
+	ret = d2i_TS_RESP_int(a, pp, len);
+	if (!ret) {
+		TSerr(TS_F_D2I_TS_RESP, TS_R_D2I_TS_RESP_INT_FAILED);
+		return NULL;
+	}
+	status = ASN1_INTEGER_get(ret->status_info->status);
+
+	if (ret->token) {
+		if (status != 0 && status != 1) {
+			TSerr(TS_F_D2I_TS_RESP, TS_R_TOKEN_PRESENT);
+			if (!*a)
+				TS_RESP_free(ret);
+			return NULL;
+		}
+		ret->tst_info = PKCS7_to_TS_TST_INFO(ret->token);
+		if (!ret->tst_info) {
+			TSerr(TS_F_D2I_TS_RESP, TS_R_PKCS7_TO_TS_TST_INFO_FAILED);
+			if (!*a)
+				TS_RESP_free(ret);
+			return NULL;
+		}
+	} else if (status == 0 || status == 1) {
+		TSerr(TS_F_D2I_TS_RESP, TS_R_TOKEN_NOT_PRESENT);
+		if (!*a)
+			TS_RESP_free(ret);
+		return NULL;
+	}
+
+	return ret;
+}
+
+IMPLEMENT_ASN1_DUP_FUNCTION(TS_RESP)
+#ifndef OPENSSL_NO_BIO
+TS_RESP *d2i_TS_RESP_bio(BIO *bp, TS_RESP **a)
+	{
+	return (TS_RESP *) ASN1_d2i_bio((char *(*)()) TS_RESP_new,
+				       (char *(*)()) d2i_TS_RESP,
+				       bp, (unsigned char **) a);
+	}
+
+int i2d_TS_RESP_bio(BIO *bp, TS_RESP *a)
+	{
+	return ASN1_i2d_bio(i2d_TS_RESP, bp, (unsigned char *) a);
+	}
+#endif
+#ifndef OPENSSL_NO_FP_API
+TS_RESP *d2i_TS_RESP_fp(FILE *fp, TS_RESP **a)
+	{
+	return (TS_RESP *) ASN1_d2i_fp((char *(*)()) TS_RESP_new,
+				       (char *(*)()) d2i_TS_RESP,
+				       fp, (unsigned char **) a);
+	}
+
+int i2d_TS_RESP_fp(FILE *fp, TS_RESP *a)
+	{
+	return ASN1_i2d_fp(i2d_TS_RESP, fp, (unsigned char *) a);
+	}
+#endif
+
+ASN1_SEQUENCE(ESS_ISSUER_SERIAL) = {
+	ASN1_SEQUENCE_OF(ESS_ISSUER_SERIAL, issuer, GENERAL_NAME),
+	ASN1_SIMPLE(ESS_ISSUER_SERIAL, serial, ASN1_INTEGER)
+} ASN1_SEQUENCE_END(ESS_ISSUER_SERIAL)
+
+IMPLEMENT_ASN1_FUNCTIONS_const(ESS_ISSUER_SERIAL)
+IMPLEMENT_ASN1_DUP_FUNCTION(ESS_ISSUER_SERIAL)
+
+ASN1_SEQUENCE(ESS_CERT_ID) = {
+	ASN1_SIMPLE(ESS_CERT_ID, hash, ASN1_OCTET_STRING),
+	ASN1_OPT(ESS_CERT_ID, issuer_serial, ESS_ISSUER_SERIAL)
+} ASN1_SEQUENCE_END(ESS_CERT_ID)
+
+IMPLEMENT_ASN1_FUNCTIONS_const(ESS_CERT_ID)
+IMPLEMENT_ASN1_DUP_FUNCTION(ESS_CERT_ID)
+
+ASN1_SEQUENCE(ESS_SIGNING_CERT) = {
+	ASN1_SEQUENCE_OF(ESS_SIGNING_CERT, cert_ids, ESS_CERT_ID),
+	ASN1_SEQUENCE_OF_OPT(ESS_SIGNING_CERT, policy_info, POLICYINFO)
+} ASN1_SEQUENCE_END(ESS_SIGNING_CERT)
+
+IMPLEMENT_ASN1_FUNCTIONS_const(ESS_SIGNING_CERT)
+IMPLEMENT_ASN1_DUP_FUNCTION(ESS_SIGNING_CERT)
+
+/* Getting encapsulated TS_TST_INFO object from PKCS7. */
+TS_TST_INFO *PKCS7_to_TS_TST_INFO(PKCS7 *token)
+{
+	PKCS7_SIGNED *pkcs7_signed;
+	PKCS7 *enveloped;
+	ASN1_TYPE *tst_info_wrapper;
+	ASN1_OCTET_STRING *tst_info_der;
+	const unsigned char *p;
+
+	if (!PKCS7_type_is_signed(token))
+		{
+		TSerr(TS_F_PKCS7_TO_TS_TST_INFO, TS_R_BAD_PKCS7_TYPE);
+		return NULL;
+		}
+
+	/* Content must be present. */
+	if (PKCS7_get_detached(token))
+		{
+		TSerr(TS_F_PKCS7_TO_TS_TST_INFO, TS_R_DETACHED_CONTENT);
+		return NULL;
+		}
+
+	/* We have a signed data with content. */
+	pkcs7_signed = token->d.sign;
+	enveloped = pkcs7_signed->contents;
+	if (OBJ_obj2nid(enveloped->type) != NID_id_smime_ct_TSTInfo)
+		{
+		TSerr(TS_F_PKCS7_TO_TS_TST_INFO, TS_R_BAD_PKCS7_TYPE);
+		return NULL;
+		}
+
+	/* We have a DER encoded TST_INFO as the signed data. */
+	tst_info_wrapper = enveloped->d.other;
+	if (tst_info_wrapper->type != V_ASN1_OCTET_STRING)
+		{
+		TSerr(TS_F_PKCS7_TO_TS_TST_INFO, TS_R_BAD_TYPE);
+		return NULL;
+		}
+
+	/* We have the correct ASN1_OCTET_STRING type. */
+	tst_info_der = tst_info_wrapper->value.octet_string;
+	/* At last, decode the TST_INFO. */
+	p = tst_info_der->data;
+	return d2i_TS_TST_INFO(NULL, &p, tst_info_der->length);
+}
Index: openssl/crypto/ts/ts_conf.c
diff -u /dev/null openssl/crypto/ts/ts_conf.c:1.1.16.1
--- /dev/null	Sun May  8 14:38:24 2005
+++ openssl/crypto/ts/ts_conf.c	Sun May  8 14:24:08 2005
@@ -0,0 +1,499 @@
+/* crypto/ts/ts_conf.c */
+/* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL
+ * project 2002.
+ */
+/* ====================================================================
+ * Copyright (c) 2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <string.h>
+
+#include <openssl/pem.h>
+#include <openssl/engine.h>
+#include <openssl/ts.h>
+
+/* Macro definitions for the configuration file. */
+
+#define	BASE_SECTION			"tsa"
+#define	ENV_DEFAULT_TSA			"default_tsa"
+#define	ENV_SERIAL			"serial"
+#define ENV_CRYPTO_DEVICE		"crypto_device"
+#define	ENV_SIGNER_CERT			"signer_cert"
+#define	ENV_CERTS			"certs"
+#define	ENV_SIGNER_KEY			"signer_key"
+#define	ENV_DEFAULT_POLICY		"default_policy"
+#define	ENV_OTHER_POLICIES		"other_policies"
+#define	ENV_DIGESTS			"digests"
+#define	ENV_ACCURACY			"accuracy"
+#define	ENV_ORDERING			"ordering"
+#define	ENV_TSA_NAME			"tsa_name"
+#define	ENV_ESS_CERT_ID_CHAIN		"ess_cert_id_chain"
+#define	ENV_VALUE_SECS			"secs"
+#define	ENV_VALUE_MILLISECS		"millisecs"
+#define	ENV_VALUE_MICROSECS		"microsecs"
+#define	ENV_CLOCK_PRECISION_DIGITS	"clock_precision_digits" 
+#define	ENV_VALUE_YES			"yes"
+#define	ENV_VALUE_NO			"no"
+
+/* Function definitions for certificate and key loading. */
+
+X509 *TS_CONF_load_cert(const char *file)
+	{
+	BIO *cert = NULL;
+	X509 *x = NULL;
+
+	if ((cert = BIO_new_file(file, "r")) == NULL) goto end;
+	x = PEM_read_bio_X509_AUX(cert, NULL, NULL, NULL);
+end:
+	if (x == NULL)
+		fprintf(stderr, "unable to load certificate: %s\n", file);
+	BIO_free(cert);
+	return x;
+	}
+
+STACK_OF(X509) *TS_CONF_load_certs(const char *file)
+	{
+	BIO *certs = NULL;
+	STACK_OF(X509) *othercerts = NULL;
+	STACK_OF(X509_INFO) *allcerts = NULL;
+	int i;
+
+	if (!(certs = BIO_new_file(file, "r"))) goto end;
+
+	if (!(othercerts = sk_X509_new_null())) goto end;
+	allcerts = PEM_X509_INFO_read_bio(certs, NULL, NULL, NULL);
+	for(i = 0; i < sk_X509_INFO_num(allcerts); i++)
+		{
+		X509_INFO *xi = sk_X509_INFO_value(allcerts, i);
+		if (xi->x509)
+			{
+			sk_X509_push(othercerts, xi->x509);
+			xi->x509 = NULL;
+			}
+		}
+end:
+	if (othercerts == NULL)
+		fprintf(stderr, "unable to load certificates: %s\n", file);
+	sk_X509_INFO_pop_free(allcerts, X509_INFO_free);
+	BIO_free(certs);
+	return othercerts;
+	}
+
+EVP_PKEY *TS_CONF_load_key(const char *file, const char *pass)
+	{
+	BIO *key = NULL;
+	EVP_PKEY *pkey = NULL;
+
+	if (!(key = BIO_new_file(file, "r"))) goto end;
+	pkey = PEM_read_bio_PrivateKey(key, NULL, NULL, (char *) pass);
+ end:
+	if (pkey == NULL)
+		fprintf(stderr, "unable to load private key: %s\n", file);
+	BIO_free(key);
+	return pkey;
+	}
+
+/* Function definitions for handling configuration options. */
+
+static void TS_CONF_lookup_fail(const char *name, const char *tag)
+	{
+	fprintf(stderr, "variable lookup failed for %s::%s\n", name, tag);
+	}
+
+static void TS_CONF_invalid(const char *name, const char *tag)
+	{
+	fprintf(stderr, "invalid variable value for %s::%s\n", name, tag);
+	}
+
+const char *TS_CONF_get_tsa_section(CONF *conf, const char *section)
+	{
+	if (!section)
+		{
+		section = NCONF_get_string(conf, BASE_SECTION, ENV_DEFAULT_TSA);
+		if (!section)
+			TS_CONF_lookup_fail(BASE_SECTION, ENV_DEFAULT_TSA);
+		}
+	return section;
+	}
+
+int TS_CONF_set_serial(CONF *conf, const char *section, TS_serial_cb cb,
+		       TS_RESP_CTX *ctx)
+	{
+	int ret = 0;
+	char *serial = NCONF_get_string(conf, section, ENV_SERIAL);
+	if (!serial)
+		{
+		TS_CONF_lookup_fail(section, ENV_SERIAL);
+		goto err;
+		}
+	TS_RESP_CTX_set_serial_cb(ctx, cb, serial);
+
+	ret = 1;
+ err:
+	return ret;
+	}
+
+int TS_CONF_set_crypto_device(CONF *conf, const char *section,
+			      const char *device)
+	{
+	int ret = 0;
+	
+	if (!device)
+		device = NCONF_get_string(conf, section,
+					  ENV_CRYPTO_DEVICE);
+
+	if (device && !TS_CONF_set_default_engine(device))
+		{
+		TS_CONF_invalid(section, ENV_CRYPTO_DEVICE);
+		goto err;
+		}
+	ret = 1;
+ err:
+	return ret;
+	}
+
+int TS_CONF_set_default_engine(const char *name)
+	{
+	ENGINE *e = NULL;
+	int ret = 0;
+
+	/* Leave the default if builtin specified. */
+	if (strcmp(name, "builtin") == 0) return 1;
+
+	if (!(e = ENGINE_by_id(name))) goto err;
+	/* Enable the use of the NCipher HSM for forked children. */
+	if (strcmp(name, "chil") == 0) 
+		ENGINE_ctrl(e, ENGINE_CTRL_CHIL_SET_FORKCHECK, 1, 0, 0);
+	/* All the operations are going to be carried out by the engine. */
+	if (!ENGINE_set_default(e, ENGINE_METHOD_ALL)) goto err;
+	ret = 1;
+ err:
+	if (!ret)
+		{
+		TSerr(TS_F_TS_CONF_SET_DEFAULT_ENGINE, 
+		      TS_R_COULD_NOT_SET_ENGINE);
+		ERR_add_error_data(2, "engine:", name);
+		}
+	if (e) ENGINE_free(e);
+	return ret;
+	}
+
+int TS_CONF_set_signer_cert(CONF *conf, const char *section,
+			    const char *cert, TS_RESP_CTX *ctx)
+	{
+	int ret = 0;
+	X509 *cert_obj = NULL;
+	if (!cert) 
+		cert = NCONF_get_string(conf, section, ENV_SIGNER_CERT);
+	if (!cert)
+		{
+		TS_CONF_lookup_fail(section, ENV_SIGNER_CERT);
+		goto err;
+		}
+	if (!(cert_obj = TS_CONF_load_cert(cert)))
+		goto err;
+	if (!TS_RESP_CTX_set_signer_cert(ctx, cert_obj))
+		goto err;
+
+	ret = 1;
+ err:
+	X509_free(cert_obj);
+	return ret;
+	}
+
+int TS_CONF_set_certs(CONF *conf, const char *section, const char *certs,
+		      TS_RESP_CTX *ctx)
+	{
+	int ret = 0;
+	STACK_OF(X509) *certs_obj = NULL;
+	if (!certs) 
+		certs = NCONF_get_string(conf, section, ENV_CERTS);
+	/* Certificate chain is optional. */
+	if (!certs) goto end;
+	if (!(certs_obj = TS_CONF_load_certs(certs))) goto err;
+	if (!TS_RESP_CTX_set_certs(ctx, certs_obj)) goto err;
+ end:
+	ret = 1;
+ err:
+	sk_X509_pop_free(certs_obj, X509_free);
+	return ret;
+	}
+
+int TS_CONF_set_signer_key(CONF *conf, const char *section,
+			   const char *key, const char *pass,
+			   TS_RESP_CTX *ctx)
+	{
+	int ret = 0;
+	EVP_PKEY *key_obj = NULL;
+	if (!key) 
+		key = NCONF_get_string(conf, section, ENV_SIGNER_KEY);
+	if (!key)
+		{
+		TS_CONF_lookup_fail(section, ENV_SIGNER_KEY);
+		goto err;
+		}
+	if (!(key_obj = TS_CONF_load_key(key, pass))) goto err;
+	if (!TS_RESP_CTX_set_signer_key(ctx, key_obj)) goto err;
+
+	ret = 1;
+ err:
+	EVP_PKEY_free(key_obj);
+	return ret;
+	}
+
+int TS_CONF_set_def_policy(CONF *conf, const char *section,
+			   const char *policy, TS_RESP_CTX *ctx)
+	{
+	int ret = 0;
+	ASN1_OBJECT *policy_obj = NULL;
+	if (!policy) 
+		policy = NCONF_get_string(conf, section, 
+					  ENV_DEFAULT_POLICY);
+	if (!policy)
+		{
+		TS_CONF_lookup_fail(section, ENV_DEFAULT_POLICY);
+		goto err;
+		}
+	if (!(policy_obj = OBJ_txt2obj(policy, 0)))
+		{
+		TS_CONF_invalid(section, ENV_DEFAULT_POLICY);
+		goto err;
+		}
+	if (!TS_RESP_CTX_set_def_policy(ctx, policy_obj))
+		goto err;
+
+	ret = 1;
+ err:
+	ASN1_OBJECT_free(policy_obj);
+	return ret;
+	}
+
+int TS_CONF_set_policies(CONF *conf, const char *section,
+			 TS_RESP_CTX *ctx)
+	{
+	int ret = 0;
+	int i;
+	STACK_OF(CONF_VALUE) *list = NULL;
+	char *policies = NCONF_get_string(conf, section, 
+					  ENV_OTHER_POLICIES);
+	/* If no other policy is specified, that's fine. */
+	if (policies && !(list = X509V3_parse_list(policies)))
+		{
+		TS_CONF_invalid(section, ENV_OTHER_POLICIES);
+		goto err;
+		}
+	for (i = 0; i < sk_CONF_VALUE_num(list); ++i)
+		{
+		CONF_VALUE *val = sk_CONF_VALUE_value(list, i);
+		const char *extval = val->value ? val->value : val->name;
+		ASN1_OBJECT *objtmp;
+		if (!(objtmp = OBJ_txt2obj(extval, 0)))
+			{
+			TS_CONF_invalid(section, ENV_OTHER_POLICIES);
+			goto err;
+			}
+		if (!TS_RESP_CTX_add_policy(ctx, objtmp))
+			goto err;
+		ASN1_OBJECT_free(objtmp);
+		}
+
+	ret = 1;
+ err:
+	sk_CONF_VALUE_pop_free(list, X509V3_conf_free);
+	return ret;
+	}
+
+int TS_CONF_set_digests(CONF *conf, const char *section,
+			TS_RESP_CTX *ctx)
+	{
+	int ret = 0;
+	int i;
+	STACK_OF(CONF_VALUE) *list = NULL;
+	char *digests = NCONF_get_string(conf, section, ENV_DIGESTS);
+	if (!digests)
+		{
+		TS_CONF_lookup_fail(section, ENV_DIGESTS);
+		goto err;
+		}
+	if (!(list = X509V3_parse_list(digests)))
+		{
+		TS_CONF_invalid(section, ENV_DIGESTS);
+		goto err;
+		}
+	if (sk_CONF_VALUE_num(list) == 0)
+		{
+		TS_CONF_invalid(section, ENV_DIGESTS);
+		goto err;
+		}
+	for (i = 0; i < sk_CONF_VALUE_num(list); ++i)
+		{
+		CONF_VALUE *val = sk_CONF_VALUE_value(list, i);
+		const char *extval = val->value ? val->value : val->name;
+		const EVP_MD *md;
+		if (!(md = EVP_get_digestbyname(extval)))
+			{
+			TS_CONF_invalid(section, ENV_DIGESTS);
+			goto err;
+			}
+		if (!TS_RESP_CTX_add_md(ctx, md))
+			goto err;
+		}
+
+	ret = 1;
+ err:
+	sk_CONF_VALUE_pop_free(list, X509V3_conf_free);
+	return ret;
+	}
+
+int TS_CONF_set_accuracy(CONF *conf, const char *section, TS_RESP_CTX *ctx)
+	{
+	int ret = 0;
+	int i;
+	int secs = 0, millis = 0, micros = 0;
+	STACK_OF(CONF_VALUE) *list = NULL;
+	char *accuracy = NCONF_get_string(conf, section, ENV_ACCURACY);
+
+	if (accuracy && !(list = X509V3_parse_list(accuracy)))
+		{
+		TS_CONF_invalid(section, ENV_ACCURACY);
+		goto err;
+		}
+	for (i = 0; i < sk_CONF_VALUE_num(list); ++i)
+		{
+		CONF_VALUE *val = sk_CONF_VALUE_value(list, i);
+		if (strcmp(val->name, ENV_VALUE_SECS) == 0) 
+			{
+			if (val->value) secs = atoi(val->value);
+			}
+		else if (strcmp(val->name, ENV_VALUE_MILLISECS) == 0)
+			{
+			if (val->value) millis = atoi(val->value);
+			}
+		else if (strcmp(val->name, ENV_VALUE_MICROSECS) == 0)
+			{
+			if (val->value) micros = atoi(val->value);
+			}
+		else
+			{
+			TS_CONF_invalid(section, ENV_ACCURACY);
+			goto err;
+			}
+		}
+	if (!TS_RESP_CTX_set_accuracy(ctx, secs, millis, micros))
+		goto err;
+
+	ret = 1;
+ err:
+	sk_CONF_VALUE_pop_free(list, X509V3_conf_free);
+	return ret;
+	}
+
+int TS_CONF_set_clock_precision_digits(CONF *conf, const char *section,
+				       TS_RESP_CTX *ctx)
+	{
+	int ret = 0;
+	long digits = 0;
+	
+	/* If not specified, set the default value to 0, i.e. sec  precision */
+	if (!NCONF_get_number_e(conf, section, ENV_CLOCK_PRECISION_DIGITS,
+				&digits))
+		digits = 0;
+	if (digits < 0 || digits > TS_MAX_CLOCK_PRECISION_DIGITS)
+		{
+		TS_CONF_invalid(section, ENV_CLOCK_PRECISION_DIGITS);
+		goto err;
+		}
+
+	if (!TS_RESP_CTX_set_clock_precision_digits(ctx, digits))
+		goto err;
+
+	return 1;
+ err:
+	return ret;
+	}
+
+static int TS_CONF_add_flag(CONF *conf, const char *section, const char *field,
+			    int flag, TS_RESP_CTX *ctx)
+	{
+	/* Default is false. */
+	const char *value = NCONF_get_string(conf, section, field);
+	if (value)
+		{
+		if (strcmp(value, ENV_VALUE_YES) == 0)
+			TS_RESP_CTX_add_flags(ctx, flag);
+		else if (strcmp(value, ENV_VALUE_NO) != 0)
+			{
+			TS_CONF_invalid(section, field);
+			return 0;
+			}
+		}
+
+	return 1;
+	}
+
+int TS_CONF_set_ordering(CONF *conf, const char *section, TS_RESP_CTX *ctx)
+	{
+	return TS_CONF_add_flag(conf, section, ENV_ORDERING, TS_ORDERING, ctx);
+	}
+
+int TS_CONF_set_tsa_name(CONF *conf, const char *section, TS_RESP_CTX *ctx)
+	{
+	return TS_CONF_add_flag(conf, section, ENV_TSA_NAME, TS_TSA_NAME, ctx);
+	}
+
+int TS_CONF_set_ess_cert_id_chain(CONF *conf, const char *section,
+				  TS_RESP_CTX *ctx)
+	{
+	return TS_CONF_add_flag(conf, section, ENV_ESS_CERT_ID_CHAIN, 
+				TS_ESS_CERT_ID_CHAIN, ctx);
+	}
Index: openssl/crypto/ts/ts_err.c
diff -u /dev/null openssl/crypto/ts/ts_err.c:1.1.20.1
--- /dev/null	Sun May  8 14:38:24 2005
+++ openssl/crypto/ts/ts_err.c	Sun May  8 14:24:08 2005
@@ -0,0 +1,176 @@
+/* crypto/ts/ts_err.c */
+/* ====================================================================
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+/* NOTE: this file was auto generated by the mkerr.pl script: any changes
+ * made to it will be overwritten when the script next updates this file,
+ * only reason strings will be preserved.
+ */
+
+#include <stdio.h>
+#include <openssl/err.h>
+#include <openssl/ts.h>
+
+/* BEGIN ERROR CODES */
+#ifndef OPENSSL_NO_ERR
+static ERR_STRING_DATA TS_str_functs[]=
+	{
+{ERR_PACK(0,TS_F_D2I_TS_RESP,0),	"d2i_TS_RESP"},
+{ERR_PACK(0,TS_F_DEF_SERIAL_CB,0),	"DEF_SERIAL_CB"},
+{ERR_PACK(0,TS_F_DEF_TIME_CB,0),	"DEF_TIME_CB"},
+{ERR_PACK(0,TS_F_ESS_ADD_SIGNING_CERT,0),	"ESS_ADD_SIGNING_CERT"},
+{ERR_PACK(0,TS_F_ESS_CERT_ID_NEW_INIT,0),	"ESS_CERT_ID_NEW_INIT"},
+{ERR_PACK(0,TS_F_ESS_SIGNING_CERT_NEW_INIT,0),	"ESS_SIGNING_CERT_NEW_INIT"},
+{ERR_PACK(0,TS_F_PKCS7_TO_TS_TST_INFO,0),	"PKCS7_to_TS_TST_INFO"},
+{ERR_PACK(0,TS_F_TS_ACCURACY_SET_MICROS,0),	"TS_ACCURACY_set_micros"},
+{ERR_PACK(0,TS_F_TS_ACCURACY_SET_MILLIS,0),	"TS_ACCURACY_set_millis"},
+{ERR_PACK(0,TS_F_TS_ACCURACY_SET_SECONDS,0),	"TS_ACCURACY_set_seconds"},
+{ERR_PACK(0,TS_F_TS_CHECK_IMPRINTS,0),	"TS_CHECK_IMPRINTS"},
+{ERR_PACK(0,TS_F_TS_CHECK_NONCES,0),	"TS_CHECK_NONCES"},
+{ERR_PACK(0,TS_F_TS_CHECK_POLICY,0),	"TS_CHECK_POLICY"},
+{ERR_PACK(0,TS_F_TS_CHECK_SIGNING_CERTS,0),	"TS_CHECK_SIGNING_CERTS"},
+{ERR_PACK(0,TS_F_TS_CHECK_STATUS_INFO,0),	"TS_CHECK_STATUS_INFO"},
+{ERR_PACK(0,TS_F_TS_COMPUTE_IMPRINT,0),	"TS_COMPUTE_IMPRINT"},
+{ERR_PACK(0,TS_F_TS_CONF_SET_DEFAULT_ENGINE,0),	"TS_CONF_set_default_engine"},
+{ERR_PACK(0,TS_F_TS_GET_STATUS_TEXT,0),	"TS_GET_STATUS_TEXT"},
+{ERR_PACK(0,TS_F_TS_MSG_IMPRINT_SET_ALGO,0),	"TS_MSG_IMPRINT_set_algo"},
+{ERR_PACK(0,TS_F_TS_REQ_SET_MSG_IMPRINT,0),	"TS_REQ_set_msg_imprint"},
+{ERR_PACK(0,TS_F_TS_REQ_SET_NONCE,0),	"TS_REQ_set_nonce"},
+{ERR_PACK(0,TS_F_TS_REQ_SET_POLICY_ID,0),	"TS_REQ_set_policy_id"},
+{ERR_PACK(0,TS_F_TS_RESP_CREATE_RESPONSE,0),	"TS_RESP_create_response"},
+{ERR_PACK(0,TS_F_TS_RESP_CREATE_TST_INFO,0),	"TS_RESP_CREATE_TST_INFO"},
+{ERR_PACK(0,TS_F_TS_RESP_CTX_ADD_FAILURE_INFO,0),	"TS_RESP_CTX_add_failure_info"},
+{ERR_PACK(0,TS_F_TS_RESP_CTX_ADD_MD,0),	"TS_RESP_CTX_add_md"},
+{ERR_PACK(0,TS_F_TS_RESP_CTX_ADD_POLICY,0),	"TS_RESP_CTX_add_policy"},
+{ERR_PACK(0,TS_F_TS_RESP_CTX_NEW,0),	"TS_RESP_CTX_new"},
+{ERR_PACK(0,TS_F_TS_RESP_CTX_SET_ACCURACY,0),	"TS_RESP_CTX_set_accuracy"},
+{ERR_PACK(0,TS_F_TS_RESP_CTX_SET_CERTS,0),	"TS_RESP_CTX_set_certs"},
+{ERR_PACK(0,TS_F_TS_RESP_CTX_SET_DEF_POLICY,0),	"TS_RESP_CTX_set_def_policy"},
+{ERR_PACK(0,TS_F_TS_RESP_CTX_SET_SIGNER_CERT,0),	"TS_RESP_CTX_set_signer_cert"},
+{ERR_PACK(0,TS_F_TS_RESP_CTX_SET_STATUS_INFO,0),	"TS_RESP_CTX_set_status_info"},
+{ERR_PACK(0,TS_F_TS_RESP_GET_POLICY,0),	"TS_RESP_GET_POLICY"},
+{ERR_PACK(0,TS_F_TS_RESP_SET_GENTIME_WITH_PRECISION,0),	"TS_RESP_SET_GENTIME_WITH_PRECISION"},
+{ERR_PACK(0,TS_F_TS_RESP_SET_STATUS_INFO,0),	"TS_RESP_set_status_info"},
+{ERR_PACK(0,TS_F_TS_RESP_SIGN,0),	"TS_RESP_SIGN"},
+{ERR_PACK(0,TS_F_TS_RESP_VERIFY_SIGNATURE,0),	"TS_RESP_verify_signature"},
+{ERR_PACK(0,TS_F_TS_RESP_VERIFY_TOKEN,0),	"TS_RESP_verify_token"},
+{ERR_PACK(0,TS_F_TS_TST_INFO_SET_ACCURACY,0),	"TS_TST_INFO_set_accuracy"},
+{ERR_PACK(0,TS_F_TS_TST_INFO_SET_MSG_IMPRINT,0),	"TS_TST_INFO_set_msg_imprint"},
+{ERR_PACK(0,TS_F_TS_TST_INFO_SET_NONCE,0),	"TS_TST_INFO_set_nonce"},
+{ERR_PACK(0,TS_F_TS_TST_INFO_SET_POLICY_ID,0),	"TS_TST_INFO_set_policy_id"},
+{ERR_PACK(0,TS_F_TS_TST_INFO_SET_SERIAL,0),	"TS_TST_INFO_set_serial"},
+{ERR_PACK(0,TS_F_TS_TST_INFO_SET_TIME,0),	"TS_TST_INFO_set_time"},
+{ERR_PACK(0,TS_F_TS_TST_INFO_SET_TSA,0),	"TS_TST_INFO_set_tsa"},
+{ERR_PACK(0,TS_F_TS_VERIFY,0),	"TS_VERIFY"},
+{ERR_PACK(0,TS_F_TS_VERIFY_CERT,0),	"TS_VERIFY_CERT"},
+{ERR_PACK(0,TS_F_TS_VERIFY_CTX_NEW,0),	"TS_VERIFY_CTX_new"},
+{0,NULL}
+	};
+
+static ERR_STRING_DATA TS_str_reasons[]=
+	{
+{TS_R_BAD_PKCS7_TYPE                     ,"bad pkcs7 type"},
+{TS_R_BAD_TYPE                           ,"bad type"},
+{TS_R_CERTIFICATE_VERIFY_ERROR           ,"certificate verify error"},
+{TS_R_COULD_NOT_SET_ENGINE               ,"could not set engine"},
+{TS_R_COULD_NOT_SET_TIME                 ,"could not set time"},
+{TS_R_D2I_TS_RESP_INT_FAILED             ,"d2i ts resp int failed"},
+{TS_R_DETACHED_CONTENT                   ,"detached content"},
+{TS_R_ESS_ADD_SIGNING_CERT_ERROR         ,"ess add signing cert error"},
+{TS_R_ESS_SIGNING_CERTIFICATE_ERROR      ,"ess signing certificate error"},
+{TS_R_INVALID_NULL_POINTER               ,"invalid null pointer"},
+{TS_R_INVALID_SIGNER_CERTIFICATE_PURPOSE ,"invalid signer certificate purpose"},
+{TS_R_MESSAGE_IMPRINT_MISMATCH           ,"message imprint mismatch"},
+{TS_R_NONCE_MISMATCH                     ,"nonce mismatch"},
+{TS_R_NONCE_NOT_RETURNED                 ,"nonce not returned"},
+{TS_R_NO_CONTENT                         ,"no content"},
+{TS_R_NO_TIME_STAMP_TOKEN                ,"no time stamp token"},
+{TS_R_PKCS7_ADD_SIGNATURE_ERROR          ,"pkcs7 add signature error"},
+{TS_R_PKCS7_ADD_SIGNED_ATTR_ERROR        ,"pkcs7 add signed attr error"},
+{TS_R_PKCS7_TO_TS_TST_INFO_FAILED        ,"pkcs7 to ts tst info failed"},
+{TS_R_POLICY_MISMATCH                    ,"policy mismatch"},
+{TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE,"private key does not match certificate"},
+{TS_R_RESPONSE_SETUP_ERROR               ,"response setup error"},
+{TS_R_SIGNATURE_FAILURE                  ,"signature failure"},
+{TS_R_THERE_MUST_BE_ONE_SIGNER           ,"there must be one signer"},
+{TS_R_TIME_SYSCALL_ERROR                 ,"time syscall error"},
+{TS_R_TOKEN_NOT_PRESENT                  ,"token not present"},
+{TS_R_TOKEN_PRESENT                      ,"token present"},
+{TS_R_TSA_NAME_MISMATCH                  ,"tsa name mismatch"},
+{TS_R_TSA_UNTRUSTED                      ,"tsa untrusted"},
+{TS_R_TST_INFO_SETUP_ERROR               ,"tst info setup error"},
+{TS_R_TS_DATASIGN                        ,"ts datasign"},
+{TS_R_UNACCEPTABLE_POLICY                ,"unacceptable policy"},
+{TS_R_UNSUPPORTED_MD_ALGORITHM           ,"unsupported md algorithm"},
+{TS_R_UNSUPPORTED_VERSION                ,"unsupported version"},
+{TS_R_WRONG_CONTENT_TYPE                 ,"wrong content type"},
+{0,NULL}
+	};
+
+#endif
+
+void ERR_load_TS_strings(void)
+	{
+	static int init=1;
+
+	if (init)
+		{
+		init=0;
+#ifndef OPENSSL_NO_ERR
+		ERR_load_strings(ERR_LIB_TS,TS_str_functs);
+		ERR_load_strings(ERR_LIB_TS,TS_str_reasons);
+#endif
+
+		}
+	}
Index: openssl/crypto/ts/ts_lib.c
diff -u /dev/null openssl/crypto/ts/ts_lib.c:1.1.20.1
--- /dev/null	Sun May  8 14:38:24 2005
+++ openssl/crypto/ts/ts_lib.c	Sun May  8 14:24:08 2005
@@ -0,0 +1,145 @@
+/* crypto/ts/ts_lib.c */
+/* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL
+ * project 2002.
+ */
+/* ====================================================================
+ * Copyright (c) 2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/objects.h>
+#include <openssl/bn.h>
+#include <openssl/x509v3.h>
+#include "ts.h"
+
+/* Local function declarations. */
+
+/* Function definitions. */
+
+int TS_ASN1_INTEGER_print_bio(BIO *bio, ASN1_INTEGER *num)
+	{
+	BIGNUM num_bn;
+	int result = 0;
+	char *hex;
+
+	BN_init(&num_bn);
+	ASN1_INTEGER_to_BN(num, &num_bn);
+	if ((hex = BN_bn2hex(&num_bn))) 
+		{
+		result = BIO_write(bio, "0x", 2) > 0;
+		result = result && BIO_write(bio, hex, strlen(hex)) > 0;
+		OPENSSL_free(hex);
+		}
+	BN_free(&num_bn);
+
+	return result;
+	}
+
+int TS_OBJ_print_bio(BIO *bio, ASN1_OBJECT *obj)
+	{
+	char obj_txt[128];
+
+	int len = OBJ_obj2txt(obj_txt, sizeof(obj_txt), obj, 0);
+	BIO_write(bio, obj_txt, len);
+	BIO_write(bio, "\n", 1);
+
+	return 1;
+	}
+
+int TS_ext_print_bio(BIO *bio, STACK_OF(X509_EXTENSION) *extensions)
+	{
+	int i, critical, n;
+	X509_EXTENSION *ex;
+	ASN1_OBJECT *obj;
+
+	BIO_printf(bio, "Extensions:\n");
+	n = X509v3_get_ext_count(extensions);
+	for (i = 0; i < n; i++)
+		{
+		ex = X509v3_get_ext(extensions, i);
+		obj = X509_EXTENSION_get_object(ex);
+		i2a_ASN1_OBJECT(bio, obj);
+		critical = X509_EXTENSION_get_critical(ex);
+		BIO_printf(bio, ": %s\n", critical ? "critical" : "");
+		if (!X509V3_EXT_print(bio, ex, 0, 4))
+			{
+			BIO_printf(bio, "%4s", "");
+			M_ASN1_OCTET_STRING_print(bio, ex->value);
+			}
+		BIO_write(bio, "\n", 1);
+		}
+
+	return 1;
+	}
+
+int TS_X509_ALGOR_print_bio(BIO *bio, X509_ALGOR *alg)
+	{
+	int i = OBJ_obj2nid(alg->algorithm);
+	return BIO_printf(bio, "Hash Algorithm: %s\n",
+		(i == NID_undef) ? "UNKNOWN" : OBJ_nid2ln(i));
+	}
+
+int TS_MSG_IMPRINT_print_bio(BIO *bio, TS_MSG_IMPRINT *a)
+	{
+	ASN1_OCTET_STRING *msg;
+
+	TS_X509_ALGOR_print_bio(bio, TS_MSG_IMPRINT_get_algo(a));
+
+	BIO_printf(bio, "Message data:\n");
+	msg = TS_MSG_IMPRINT_get_msg(a);
+	BIO_dump_indent(bio, (const char *)M_ASN1_STRING_data(msg), 
+			M_ASN1_STRING_length(msg), 4);
+
+	return 1;
+	}
Index: openssl/crypto/ts/ts_req_print.c
diff -u /dev/null openssl/crypto/ts/ts_req_print.c:1.1.20.1
--- /dev/null	Sun May  8 14:38:24 2005
+++ openssl/crypto/ts/ts_req_print.c	Sun May  8 14:24:08 2005
@@ -0,0 +1,102 @@
+/* crypto/ts/ts_req_print.c */
+/* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL
+ * project 2002.
+ */
+/* ====================================================================
+ * Copyright (c) 2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/objects.h>
+#include <openssl/bn.h>
+#include <openssl/x509v3.h>
+#include <openssl/ts.h>
+
+/* Function definitions. */
+
+int TS_REQ_print_bio(BIO *bio, TS_REQ *a)
+	{
+	int v;
+	ASN1_OBJECT *policy_id;
+	ASN1_INTEGER *nonce;
+
+	if (a == NULL) return 0;
+
+	v = TS_REQ_get_version(a);
+	BIO_printf(bio, "Version: %ld\n", v);
+
+	TS_MSG_IMPRINT_print_bio(bio, TS_REQ_get_msg_imprint(a));
+
+	BIO_printf(bio, "Policy OID: ");
+	policy_id = TS_REQ_get_policy_id(a);
+	if (policy_id == NULL)
+		BIO_printf(bio, "unspecified\n");
+	else	
+		TS_OBJ_print_bio(bio, policy_id);
+
+	BIO_printf(bio, "Nonce: ");
+	nonce = TS_REQ_get_nonce(a);
+	if (nonce == NULL)
+		BIO_printf(bio, "unspecified");
+	else
+		TS_ASN1_INTEGER_print_bio(bio, nonce);
+	BIO_write(bio, "\n", 1);
+
+	BIO_printf(bio, "Certificate required: %s\n", 
+		   TS_REQ_get_cert_req(a) ? "yes" : "no");
+
+	TS_ext_print_bio(bio, TS_REQ_get_exts(a));
+
+	return 1;
+	}
Index: openssl/crypto/ts/ts_req_utils.c
diff -u /dev/null openssl/crypto/ts/ts_req_utils.c:1.1.20.1
--- /dev/null	Sun May  8 14:38:24 2005
+++ openssl/crypto/ts/ts_req_utils.c	Sun May  8 14:24:08 2005
@@ -0,0 +1,234 @@
+/* crypto/ts/ts_req_utils.c */
+/* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL
+ * project 2002.
+ */
+/* ====================================================================
+ * Copyright (c) 2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/objects.h>
+#include <openssl/x509v3.h>
+#include <openssl/ts.h>
+
+int TS_REQ_set_version(TS_REQ *a, long version)
+	{
+	return ASN1_INTEGER_set(a->version, version);
+	}
+
+long TS_REQ_get_version(TS_REQ *a)
+	{
+	return ASN1_INTEGER_get(a->version);
+	}
+
+int TS_REQ_set_msg_imprint(TS_REQ *a, TS_MSG_IMPRINT *msg_imprint)
+	{
+	TS_MSG_IMPRINT *new_msg_imprint;
+
+	if (a->msg_imprint == msg_imprint)
+		return 1;
+	new_msg_imprint = TS_MSG_IMPRINT_dup(msg_imprint);
+	if (new_msg_imprint == NULL)
+		{
+		TSerr(TS_F_TS_REQ_SET_MSG_IMPRINT, ERR_R_MALLOC_FAILURE);
+		return 0;
+		}
+	TS_MSG_IMPRINT_free(a->msg_imprint);
+	a->msg_imprint = new_msg_imprint;
+	return 1;
+	}
+
+TS_MSG_IMPRINT *TS_REQ_get_msg_imprint(TS_REQ *a)
+	{
+	return a->msg_imprint;
+	}
+
+int TS_MSG_IMPRINT_set_algo(TS_MSG_IMPRINT *a, X509_ALGOR *alg)
+	{
+	X509_ALGOR *new_alg;
+
+	if (a->hash_algo == alg)
+		return 1;
+	new_alg = X509_ALGOR_dup(alg);
+	if (new_alg == NULL)
+		{
+		TSerr(TS_F_TS_MSG_IMPRINT_SET_ALGO, ERR_R_MALLOC_FAILURE);
+		return 0;
+		}
+	X509_ALGOR_free(a->hash_algo);
+	a->hash_algo = new_alg;
+	return 1;
+	}
+
+X509_ALGOR *TS_MSG_IMPRINT_get_algo(TS_MSG_IMPRINT *a)
+	{
+	return a->hash_algo;
+	}
+
+int TS_MSG_IMPRINT_set_msg(TS_MSG_IMPRINT *a, unsigned char *d, int len)
+	{
+	return ASN1_OCTET_STRING_set(a->hashed_msg, d, len);
+	}
+
+ASN1_OCTET_STRING *TS_MSG_IMPRINT_get_msg(TS_MSG_IMPRINT *a)
+	{
+	return a->hashed_msg;
+	}
+
+int TS_REQ_set_policy_id(TS_REQ *a, ASN1_OBJECT *policy)
+	{
+	ASN1_OBJECT *new_policy;
+
+	if (a->policy_id == policy)
+		return 1;
+	new_policy = OBJ_dup(policy);
+	if (new_policy == NULL)
+		{
+		TSerr(TS_F_TS_REQ_SET_POLICY_ID, ERR_R_MALLOC_FAILURE);
+		return 0;
+		}
+	ASN1_OBJECT_free(a->policy_id);
+	a->policy_id = new_policy;
+	return 1;
+	}
+
+ASN1_OBJECT *TS_REQ_get_policy_id(TS_REQ *a)
+	{
+	return a->policy_id;
+	}
+
+int TS_REQ_set_nonce(TS_REQ *a, ASN1_INTEGER *nonce)
+	{
+	ASN1_INTEGER *new_nonce;
+
+	if (a->nonce == nonce)
+		return 1;
+	new_nonce = ASN1_INTEGER_dup(nonce);
+	if (new_nonce == NULL)
+		{
+		TSerr(TS_F_TS_REQ_SET_NONCE, ERR_R_MALLOC_FAILURE);
+		return 0;
+		}
+	ASN1_INTEGER_free(a->nonce);
+	a->nonce = new_nonce;
+	return 1;
+	}
+
+ASN1_INTEGER *TS_REQ_get_nonce(TS_REQ *a)
+	{
+	return a->nonce;
+	}
+
+int TS_REQ_set_cert_req(TS_REQ *a, int cert_req)
+	{
+	a->cert_req = cert_req ? 0xFF : 0x00;
+	return 1;
+	}
+
+int TS_REQ_get_cert_req(TS_REQ *a)
+	{
+	return a->cert_req ? 1 : 0;
+	}
+
+STACK_OF(X509_EXTENSION) *TS_REQ_get_exts(TS_REQ *a)
+	{
+	return a->extensions;
+	}
+
+void TS_REQ_ext_free(TS_REQ *a)
+	{
+	if (!a) return;
+	sk_X509_EXTENSION_pop_free(a->extensions, X509_EXTENSION_free);
+	a->extensions = NULL;
+	}
+
+int TS_REQ_get_ext_count(TS_REQ *a)
+	{
+	return X509v3_get_ext_count(a->extensions);
+	}
+
+int TS_REQ_get_ext_by_NID(TS_REQ *a, int nid, int lastpos)
+	{
+	return X509v3_get_ext_by_NID(a->extensions, nid, lastpos);
+	}
+
+int TS_REQ_get_ext_by_OBJ(TS_REQ *a, ASN1_OBJECT *obj, int lastpos)
+	{
+	return X509v3_get_ext_by_OBJ(a->extensions, obj, lastpos);
+	}
+
+int TS_REQ_get_ext_by_critical(TS_REQ *a, int crit, int lastpos)
+	{
+	return X509v3_get_ext_by_critical(a->extensions, crit, lastpos);
+	}
+
+X509_EXTENSION *TS_REQ_get_ext(TS_REQ *a, int loc)
+	{
+	return X509v3_get_ext(a->extensions,loc);
+	}
+
+X509_EXTENSION *TS_REQ_delete_ext(TS_REQ *a, int loc)
+	{
+	return X509v3_delete_ext(a->extensions,loc);
+	}
+
+int TS_REQ_add_ext(TS_REQ *a, X509_EXTENSION *ex, int loc)
+	{
+	return X509v3_add_ext(&a->extensions,ex,loc) != NULL;
+	}
+
+void *TS_REQ_get_ext_d2i(TS_REQ *a, int nid, int *crit, int *idx)
+	{
+	return X509V3_get_d2i(a->extensions, nid, crit, idx);
+	}
Index: openssl/crypto/ts/ts_resp_print.c
diff -u /dev/null openssl/crypto/ts/ts_resp_print.c:1.1.20.1
--- /dev/null	Sun May  8 14:38:24 2005
+++ openssl/crypto/ts/ts_resp_print.c	Sun May  8 14:24:08 2005
@@ -0,0 +1,287 @@
+/* crypto/ts/ts_resp_print.c */
+/* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL
+ * project 2002.
+ */
+/* ====================================================================
+ * Copyright (c) 2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/objects.h>
+#include <openssl/bn.h>
+#include <openssl/x509v3.h>
+#include "ts.h"
+
+struct status_map_st
+	{
+	int bit;
+	const char *text;
+	};
+
+/* Local function declarations. */
+
+static int TS_status_map_print(BIO *bio, struct status_map_st *a,
+			       ASN1_BIT_STRING *v);
+static int TS_ACCURACY_print_bio(BIO *bio, TS_ACCURACY *accuracy);
+
+/* Function definitions. */
+
+int TS_RESP_print_bio(BIO *bio, TS_RESP *a)
+	{
+	TS_TST_INFO *tst_info;
+
+	BIO_printf(bio, "Status info:\n");
+	TS_STATUS_INFO_print_bio(bio, TS_RESP_get_status_info(a));
+
+	BIO_printf(bio, "\nTST info:\n");
+	tst_info = TS_RESP_get_tst_info(a);
+	if (tst_info != NULL)
+		TS_TST_INFO_print_bio(bio, TS_RESP_get_tst_info(a));
+	else
+		BIO_printf(bio, "Not included.\n");
+		
+	return 1;
+	}
+
+int TS_STATUS_INFO_print_bio(BIO *bio, TS_STATUS_INFO *a)
+	{
+	static const char *status_map[] =
+		{
+		"Granted.",
+		"Granted with modifications.",
+		"Rejected.",
+		"Waiting.",
+		"Revocation warning.",
+		"Revoked."
+		};
+	static struct status_map_st failure_map[] =
+		{
+		{ TS_INFO_BAD_ALG,
+		"unrecognized or unsupported algorithm identifier" },
+		{ TS_INFO_BAD_REQUEST,
+		"transaction not permitted or supported" },
+		{ TS_INFO_BAD_DATA_FORMAT,
+		"the data submitted has the wrong format" },
+		{ TS_INFO_TIME_NOT_AVAILABLE,
+		"the TSA's time source is not available" },
+		{ TS_INFO_UNACCEPTED_POLICY,
+		"the requested TSA policy is not supported by the TSA" },
+		{ TS_INFO_UNACCEPTED_EXTENSION,
+		"the requested extension is not supported by the TSA" },
+		{ TS_INFO_ADD_INFO_NOT_AVAILABLE,
+		"the additional information requested could not be understood "
+		"or is not available" },
+		{ TS_INFO_SYSTEM_FAILURE,
+		"the request cannot be handled due to system failure" },
+		{ -1, NULL }
+		};
+	long status;
+	int i, lines = 0;
+
+	/* Printing status code. */
+	BIO_printf(bio, "Status: ");
+	status = ASN1_INTEGER_get(a->status);
+	if (0 <= status && status < (long)(sizeof(status_map)/sizeof(status_map[0])))
+		BIO_printf(bio, "%s\n", status_map[status]);
+	else
+		BIO_printf(bio, "out of bounds\n");
+	
+	/* Printing status description. */
+	BIO_printf(bio, "Status description: ");
+	for (i = 0; i < sk_ASN1_UTF8STRING_num(a->text); ++i)
+		{
+		if (i > 0)
+			BIO_puts(bio, "\t");
+		ASN1_STRING_print_ex(bio, sk_ASN1_UTF8STRING_value(a->text, i),
+				     0);
+		BIO_puts(bio, "\n");
+		}
+	if (i == 0)
+		BIO_printf(bio, "unspecified\n");
+
+	/* Printing failure information. */
+	BIO_printf(bio, "Failure info: ");
+	if (a->failure_info != NULL)
+		lines = TS_status_map_print(bio, failure_map,
+					    a->failure_info);
+	if (lines == 0)
+		BIO_printf(bio, "unspecified");
+	BIO_printf(bio, "\n");
+
+	return 1;
+	}
+
+static int TS_status_map_print(BIO *bio, struct status_map_st *a,
+			       ASN1_BIT_STRING *v)
+	{
+	int lines = 0;
+
+	for (; a->bit >= 0; ++a)
+		{
+		if (ASN1_BIT_STRING_get_bit(v, a->bit))
+			{
+			if (++lines > 1)
+				BIO_printf(bio, ", ");
+			BIO_printf(bio, "%s", a->text);
+			}
+		}
+
+	return lines;
+	}
+
+int TS_TST_INFO_print_bio(BIO *bio, TS_TST_INFO *a)
+	{
+	int v;
+	ASN1_OBJECT *policy_id;
+	ASN1_INTEGER *serial;
+	ASN1_GENERALIZEDTIME *gtime;
+	TS_ACCURACY *accuracy;
+	ASN1_INTEGER *nonce;
+	GENERAL_NAME *tsa_name;
+
+	if (a == NULL) return 0;
+
+	/* Print version. */
+	v = TS_TST_INFO_get_version(a);
+	BIO_printf(bio, "Version: %ld\n", v);
+
+	/* Print policy id. */
+	BIO_printf(bio, "Policy OID: ");
+	policy_id = TS_TST_INFO_get_policy_id(a);
+	TS_OBJ_print_bio(bio, policy_id);
+
+	/* Print message imprint. */
+	TS_MSG_IMPRINT_print_bio(bio, TS_TST_INFO_get_msg_imprint(a));
+
+	/* Print serial number. */
+	BIO_printf(bio, "Serial number: ");
+	serial = TS_TST_INFO_get_serial(a);
+	if (serial == NULL)
+		BIO_printf(bio, "unspecified");
+	else
+		TS_ASN1_INTEGER_print_bio(bio, serial);
+	BIO_write(bio, "\n", 1);
+
+	/* Print time stamp. */
+	BIO_printf(bio, "Time stamp: ");
+	gtime = TS_TST_INFO_get_time(a);
+	ASN1_GENERALIZEDTIME_print(bio, gtime);
+	BIO_write(bio, "\n", 1);
+
+	/* Print accuracy. */
+	BIO_printf(bio, "Accuracy: ");
+	accuracy = TS_TST_INFO_get_accuracy(a);
+	if (accuracy == NULL)
+		BIO_printf(bio, "unspecified");
+	else
+		TS_ACCURACY_print_bio(bio, accuracy);
+	BIO_write(bio, "\n", 1);
+
+	/* Print ordering. */
+	BIO_printf(bio, "Ordering: %s\n", 
+		   TS_TST_INFO_get_ordering(a) ? "yes" : "no");
+
+	/* Print nonce. */
+	BIO_printf(bio, "Nonce: ");
+	nonce = TS_TST_INFO_get_nonce(a);
+	if (nonce == NULL)
+		BIO_printf(bio, "unspecified");
+	else
+		TS_ASN1_INTEGER_print_bio(bio, nonce);
+	BIO_write(bio, "\n", 1);
+
+	/* Print TSA name. */
+	BIO_printf(bio, "TSA: ");
+	tsa_name = TS_TST_INFO_get_tsa(a);
+	if (tsa_name == NULL)
+		BIO_printf(bio, "unspecified");
+	else
+		{
+		STACK_OF(CONF_VALUE) *nval;
+		if ((nval = i2v_GENERAL_NAME(NULL, tsa_name, NULL)))
+			X509V3_EXT_val_prn(bio, nval, 0, 0);
+		sk_CONF_VALUE_pop_free(nval, X509V3_conf_free);
+		}
+	BIO_write(bio, "\n", 1);
+
+	/* Print extensions. */
+	TS_ext_print_bio(bio, TS_TST_INFO_get_exts(a));
+
+	return 1;
+	}
+
+static int TS_ACCURACY_print_bio(BIO *bio, TS_ACCURACY *accuracy)
+	{
+	ASN1_INTEGER *seconds = TS_ACCURACY_get_seconds(accuracy);
+	ASN1_INTEGER *millis = TS_ACCURACY_get_millis(accuracy);
+	ASN1_INTEGER *micros = TS_ACCURACY_get_micros(accuracy);
+
+	if (seconds != NULL)
+		TS_ASN1_INTEGER_print_bio(bio, seconds);
+	else
+		BIO_printf(bio, "unspecified");
+	BIO_printf(bio, " seconds, ");
+	if (millis != NULL)
+		TS_ASN1_INTEGER_print_bio(bio, millis);
+	else
+		BIO_printf(bio, "unspecified");
+	BIO_printf(bio, " millis, ");
+	if (micros != NULL)
+		TS_ASN1_INTEGER_print_bio(bio, micros);
+	else
+		BIO_printf(bio, "unspecified");
+	BIO_printf(bio, " micros");
+
+	return 1;
+	}
Index: openssl/crypto/ts/ts_resp_sign.c
diff -u /dev/null openssl/crypto/ts/ts_resp_sign.c:1.1.20.1
--- /dev/null	Sun May  8 14:38:24 2005
+++ openssl/crypto/ts/ts_resp_sign.c	Sun May  8 14:24:08 2005
@@ -0,0 +1,1011 @@
+/* crypto/ts/ts_resp_sign.c */
+/* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL
+ * project 2002.
+ */
+/* ====================================================================
+ * Copyright (c) 2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include "cryptlib.h"
+
+#if defined(OPENSSL_SYS_UNIX)
+#include <sys/time.h>
+#endif
+
+#include <openssl/objects.h>
+#include <openssl/ts.h>
+#include <openssl/pkcs7.h>
+
+/* Private function declarations. */
+
+static ASN1_INTEGER *def_serial_cb(struct TS_resp_ctx *, void *);
+static int def_time_cb(struct TS_resp_ctx *, void *, long *sec, long *usec);
+static int def_extension_cb(struct TS_resp_ctx *, X509_EXTENSION *, void *);
+
+static void TS_RESP_CTX_init(TS_RESP_CTX *ctx);
+static void TS_RESP_CTX_cleanup(TS_RESP_CTX *ctx);
+static int TS_RESP_check_request(TS_RESP_CTX *ctx);
+static ASN1_OBJECT *TS_RESP_get_policy(TS_RESP_CTX *ctx);
+static TS_TST_INFO *TS_RESP_create_tst_info(TS_RESP_CTX *ctx, 
+					    ASN1_OBJECT *policy);
+static int TS_RESP_process_extensions(TS_RESP_CTX *ctx);
+static int TS_RESP_sign(TS_RESP_CTX *ctx);
+
+static ESS_SIGNING_CERT *ESS_SIGNING_CERT_new_init(X509 *signcert, 
+						   STACK_OF(X509) *certs);
+static ESS_CERT_ID *ESS_CERT_ID_new_init(X509 *cert, int issuer_needed);
+static int TS_TST_INFO_content_new(PKCS7 *p7);
+static int ESS_add_signing_cert(PKCS7_SIGNER_INFO *si, ESS_SIGNING_CERT *sc);
+
+static ASN1_GENERALIZEDTIME *TS_RESP_set_genTime_with_precision(
+	ASN1_GENERALIZEDTIME *, long, long, unsigned);
+
+/* Default callbacks for response generation. */
+
+static ASN1_INTEGER *def_serial_cb(struct TS_resp_ctx *ctx, void *data)
+	{
+	ASN1_INTEGER *serial = ASN1_INTEGER_new();
+	if (!serial) goto err;
+	if (!ASN1_INTEGER_set(serial, 1)) goto err;
+	return serial;
+ err:
+	TSerr(TS_F_DEF_SERIAL_CB, ERR_R_MALLOC_FAILURE);
+	TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
+				    "Error during serial number generation.");
+	return NULL;
+	}
+
+#if defined(OPENSSL_SYS_UNIX)
+
+/* Use the gettimeofday function call. */
+static int def_time_cb(struct TS_resp_ctx *ctx, void *data, 
+		       long *sec, long *usec)
+	{
+	struct timeval tv;
+	if (gettimeofday(&tv, NULL) != 0) 
+		{
+		TSerr(TS_F_DEF_TIME_CB, TS_R_TIME_SYSCALL_ERROR);
+		TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
+					    "Time is not available.");
+		TS_RESP_CTX_add_failure_info(ctx, TS_INFO_TIME_NOT_AVAILABLE);
+		return 0;
+		}
+	/* Return time to caller. */
+	*sec = tv.tv_sec;
+	*usec = tv.tv_usec;
+
+	return 1;
+	}
+
+#else
+
+/* Use the time function call that provides only seconds precision. */
+static int def_time_cb(struct TS_resp_ctx *ctx, void *data, 
+		       long *sec, long *usec)
+	{
+	time_t t;
+	if (time(&t) == (time_t) -1)
+		{
+		TSerr(TS_F_DEF_TIME_CB, TS_R_TIME_SYSCALL_ERROR);
+		TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
+					    "Time is not available.");
+		TS_RESP_CTX_add_failure_info(ctx, TS_INFO_TIME_NOT_AVAILABLE);
+		return 0;
+		}
+	/* Return time to caller, only second precision. */
+	*sec = (long) t;
+	*usec = 0;
+
+	return 1;
+	}
+
+#endif
+
+static int def_extension_cb(struct TS_resp_ctx *ctx, X509_EXTENSION *ext,
+			    void *data)
+	{
+	/* No extensions are processed here. */
+	TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
+				    "Unsupported extension.");
+	TS_RESP_CTX_add_failure_info(ctx, TS_INFO_UNACCEPTED_EXTENSION);
+	return 0;
+	}
+
+/* TS_RESP_CTX management functions. */
+
+TS_RESP_CTX *TS_RESP_CTX_new()
+	{
+	TS_RESP_CTX *ctx;
+
+	if (!(ctx = (TS_RESP_CTX *) OPENSSL_malloc(sizeof(TS_RESP_CTX))))
+		{
+		TSerr(TS_F_TS_RESP_CTX_NEW, ERR_R_MALLOC_FAILURE);
+		return NULL;
+		}
+	memset(ctx, 0, sizeof(TS_RESP_CTX));
+
+	/* Setting default callbacks. */
+	ctx->serial_cb = def_serial_cb;
+	ctx->time_cb = def_time_cb;
+	ctx->extension_cb = def_extension_cb;
+
+	return ctx;
+	}
+
+void TS_RESP_CTX_free(TS_RESP_CTX *ctx)
+	{
+	if (!ctx) return;
+
+	X509_free(ctx->signer_cert);
+	EVP_PKEY_free(ctx->signer_key);
+	sk_X509_pop_free(ctx->certs, X509_free);
+	sk_ASN1_OBJECT_pop_free(ctx->policies, ASN1_OBJECT_free);
+	ASN1_OBJECT_free(ctx->default_policy);
+	sk_EVP_MD_free(ctx->mds);	/* No EVP_MD_free method exists. */
+	ASN1_INTEGER_free(ctx->seconds);
+	ASN1_INTEGER_free(ctx->millis);
+	ASN1_INTEGER_free(ctx->micros);
+	OPENSSL_free(ctx);
+	}
+
+int TS_RESP_CTX_set_signer_cert(TS_RESP_CTX *ctx, X509 *signer)
+	{
+	if (X509_check_purpose(signer, X509_PURPOSE_TIMESTAMP_SIGN, 0) != 1)
+		{
+		TSerr(TS_F_TS_RESP_CTX_SET_SIGNER_CERT, 
+		      TS_R_INVALID_SIGNER_CERTIFICATE_PURPOSE);
+		return 0;
+		}
+	if (ctx->signer_cert) X509_free(ctx->signer_cert);
+	ctx->signer_cert = signer;
+	CRYPTO_add(&ctx->signer_cert->references, +1, CRYPTO_LOCK_X509);
+	return 1;
+	}
+
+int TS_RESP_CTX_set_signer_key(TS_RESP_CTX *ctx, EVP_PKEY *key)
+	{
+	if (ctx->signer_key) EVP_PKEY_free(ctx->signer_key);
+	ctx->signer_key = key;
+	CRYPTO_add(&ctx->signer_key->references, +1, CRYPTO_LOCK_EVP_PKEY);
+
+	return 1;
+	}
+
+int TS_RESP_CTX_set_def_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *def_policy)
+	{
+	if (ctx->default_policy) ASN1_OBJECT_free(ctx->default_policy);
+	if (!(ctx->default_policy = OBJ_dup(def_policy))) goto err;
+	return 1;
+ err:
+	TSerr(TS_F_TS_RESP_CTX_SET_DEF_POLICY, ERR_R_MALLOC_FAILURE);
+	return 0;
+	}
+
+int TS_RESP_CTX_set_certs(TS_RESP_CTX *ctx, STACK_OF(X509) *certs)
+	{
+	int i;
+
+	if (ctx->certs)
+		{
+		sk_X509_pop_free(ctx->certs, X509_free);
+		ctx->certs = NULL;
+		}
+	if (!certs) return 1;
+	if (!(ctx->certs = sk_X509_dup(certs))) 
+		{
+		TSerr(TS_F_TS_RESP_CTX_SET_CERTS, ERR_R_MALLOC_FAILURE);
+		return 0;
+		}
+	for (i = 0; i < sk_X509_num(ctx->certs); ++i)
+		{
+		X509 *cert = sk_X509_value(ctx->certs, i);
+		CRYPTO_add(&cert->references, +1, CRYPTO_LOCK_X509);
+		}
+
+	return 1;
+	}
+
+int TS_RESP_CTX_add_policy(TS_RESP_CTX *ctx, ASN1_OBJECT *policy)
+	{
+	ASN1_OBJECT *copy = NULL;
+
+	/* Create new policy stack if necessary. */
+	if (!ctx->policies && !(ctx->policies = sk_ASN1_OBJECT_new_null())) 
+		goto err;
+	if (!(copy = OBJ_dup(policy))) goto err;
+	if (!sk_ASN1_OBJECT_push(ctx->policies, copy)) goto err;
+
+	return 1;
+ err:
+	TSerr(TS_F_TS_RESP_CTX_ADD_POLICY, ERR_R_MALLOC_FAILURE);
+	ASN1_OBJECT_free(copy);
+	return 0;
+	}
+
+int TS_RESP_CTX_add_md(TS_RESP_CTX *ctx, const EVP_MD *md)
+	{
+	/* Create new md stack if necessary. */
+	if (!ctx->mds && !(ctx->mds = sk_EVP_MD_new_null())) 
+		goto err;
+	/* Add the shared md, no copy needed. */
+	if (!sk_EVP_MD_push(ctx->mds, md)) goto err;
+
+	return 1;
+ err:
+	TSerr(TS_F_TS_RESP_CTX_ADD_MD, ERR_R_MALLOC_FAILURE);
+	return 0;
+	}
+
+#define TS_RESP_CTX_accuracy_free(ctx)		\
+	ASN1_INTEGER_free(ctx->seconds);	\
+	ctx->seconds = NULL;			\
+	ASN1_INTEGER_free(ctx->millis);		\
+	ctx->millis = NULL;			\
+	ASN1_INTEGER_free(ctx->micros);		\
+	ctx->micros = NULL;
+
+int TS_RESP_CTX_set_accuracy(TS_RESP_CTX *ctx, 
+			     int secs, int millis, int micros)
+	{
+
+	TS_RESP_CTX_accuracy_free(ctx);
+	if (secs && (!(ctx->seconds = ASN1_INTEGER_new())
+		     || !ASN1_INTEGER_set(ctx->seconds, secs)))
+		goto err;
+	if (millis && (!(ctx->millis = ASN1_INTEGER_new())
+		       || !ASN1_INTEGER_set(ctx->millis, millis)))
+		goto err;
+	if (micros && (!(ctx->micros = ASN1_INTEGER_new())
+		       || !ASN1_INTEGER_set(ctx->micros, micros)))
+		goto err;
+
+	return 1;
+ err:
+	TS_RESP_CTX_accuracy_free(ctx);
+	TSerr(TS_F_TS_RESP_CTX_SET_ACCURACY, ERR_R_MALLOC_FAILURE);
+	return 0;
+	}
+
+void TS_RESP_CTX_add_flags(TS_RESP_CTX *ctx, int flags)
+	{
+	ctx->flags |= flags;
+	}
+
+void TS_RESP_CTX_set_serial_cb(TS_RESP_CTX *ctx, TS_serial_cb cb, void *data)
+	{
+	ctx->serial_cb = cb;
+	ctx->serial_cb_data = data;
+	}
+
+void TS_RESP_CTX_set_time_cb(TS_RESP_CTX *ctx, TS_time_cb cb, void *data)
+	{
+	ctx->time_cb = cb;
+	ctx->time_cb_data = data;
+	}
+
+void TS_RESP_CTX_set_extension_cb(TS_RESP_CTX *ctx, 
+				  TS_extension_cb cb, void *data)
+	{
+	ctx->extension_cb = cb;
+	ctx->extension_cb_data = data;
+	}
+
+int TS_RESP_CTX_set_status_info(TS_RESP_CTX *ctx, 
+				int status, const char *text)
+	{
+	TS_STATUS_INFO *si = NULL;
+	ASN1_UTF8STRING *utf8_text = NULL;
+	int ret = 0;
+
+	if (!(si = TS_STATUS_INFO_new())) goto err;
+	if (!ASN1_INTEGER_set(si->status, status)) goto err;
+	if (text)
+		{
+		if (!(utf8_text = ASN1_UTF8STRING_new())
+		    || !ASN1_STRING_set(utf8_text, text, strlen(text)))
+			goto err;
+		if (!si->text && !(si->text = sk_ASN1_UTF8STRING_new_null()))
+			goto err;
+		if (!sk_ASN1_UTF8STRING_push(si->text, utf8_text)) goto err;
+		utf8_text = NULL;	/* Ownership is lost. */
+		}
+	if (!TS_RESP_set_status_info(ctx->response, si)) goto err;
+	ret = 1;
+ err:
+	if (!ret)
+		TSerr(TS_F_TS_RESP_CTX_SET_STATUS_INFO, ERR_R_MALLOC_FAILURE);
+	TS_STATUS_INFO_free(si);
+	ASN1_UTF8STRING_free(utf8_text);
+	return ret;
+	}
+
+int TS_RESP_CTX_set_status_info_cond(TS_RESP_CTX *ctx, 
+				     int status, const char *text)
+	{
+	int ret = 1;
+	TS_STATUS_INFO *si = TS_RESP_get_status_info(ctx->response);
+
+	if (ASN1_INTEGER_get(si->status) == TS_STATUS_GRANTED)
+		{
+		/* Status has not been set, set it now. */
+		ret = TS_RESP_CTX_set_status_info(ctx, status, text);
+		}
+	return ret;
+	}
+
+int TS_RESP_CTX_add_failure_info(TS_RESP_CTX *ctx, int failure)
+	{
+	TS_STATUS_INFO *si = TS_RESP_get_status_info(ctx->response);
+	if (!si->failure_info && !(si->failure_info = ASN1_BIT_STRING_new()))
+		goto err;
+	if (!ASN1_BIT_STRING_set_bit(si->failure_info, failure, 1))
+		goto err;
+	return 1;
+ err:
+	TSerr(TS_F_TS_RESP_CTX_ADD_FAILURE_INFO, ERR_R_MALLOC_FAILURE);
+	return 0;
+	}
+
+TS_REQ *TS_RESP_CTX_get_request(TS_RESP_CTX *ctx)
+	{
+	return ctx->request;
+	}
+
+TS_TST_INFO *TS_RESP_CTX_get_tst_info(TS_RESP_CTX *ctx)
+	{
+	return ctx->tst_info;
+	}
+
+int TS_RESP_CTX_set_clock_precision_digits(TS_RESP_CTX *ctx, unsigned precision)
+       {
+       if (precision > TS_MAX_CLOCK_PRECISION_DIGITS)
+	       return 0;
+       ctx->clock_precision_digits = precision;
+       return 1;
+       }
+
+/* Main entry method of the response generation. */
+TS_RESP *TS_RESP_create_response(TS_RESP_CTX *ctx, BIO *req_bio)
+	{
+	ASN1_OBJECT *policy;
+	TS_RESP *response;
+	int result = 0;
+
+	TS_RESP_CTX_init(ctx);
+
+	/* Creating the response object. */
+	if (!(ctx->response = TS_RESP_new())) 
+		{
+		TSerr(TS_F_TS_RESP_CREATE_RESPONSE, ERR_R_MALLOC_FAILURE);
+		goto end;
+		}
+
+	/* Parsing DER request. */
+	if (!(ctx->request = d2i_TS_REQ_bio(req_bio, NULL)))
+		{
+		TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
+					    "Bad request format or "
+					    "system error.");
+		TS_RESP_CTX_add_failure_info(ctx, TS_INFO_BAD_DATA_FORMAT);
+		goto end;
+		}
+
+	/* Setting default status info. */
+	if (!TS_RESP_CTX_set_status_info(ctx, TS_STATUS_GRANTED, NULL))
+		goto end;
+
+	/* Checking the request format. */
+	if (!TS_RESP_check_request(ctx)) goto end;
+
+	/* Checking acceptable policies. */
+	if (!(policy = TS_RESP_get_policy(ctx))) goto end;
+
+	/* Creating the TS_TST_INFO object. */
+	if (!(ctx->tst_info = TS_RESP_create_tst_info(ctx, policy)))
+		goto end;
+
+	/* Processing extensions. */
+	if (!TS_RESP_process_extensions(ctx)) goto end;
+
+	/* Generating the signature. */
+	if (!TS_RESP_sign(ctx)) goto end;
+
+	/* Everything was successful. */
+	result = 1;
+ end:
+	if (!result)
+		{
+		TSerr(TS_F_TS_RESP_CREATE_RESPONSE, TS_R_RESPONSE_SETUP_ERROR);
+		TS_RESP_CTX_set_status_info_cond(ctx, TS_STATUS_REJECTION,
+						 "Error during response "
+						 "generation.");
+		/* Check if the status info was set. */
+		if (ctx->response
+		    && ASN1_INTEGER_get(
+			    TS_RESP_get_status_info(ctx->response)->status)
+		    == TS_STATUS_GRANTED)
+			{
+			/* Status info wasn't set, don't return a response. */
+			TS_RESP_free(ctx->response);
+			ctx->response = NULL;
+			}
+		}
+	response = ctx->response;
+	ctx->response = NULL;	/* Ownership will be returned to caller. */
+	TS_RESP_CTX_cleanup(ctx);
+	return response;
+	}
+
+/* Initializes the variable part of the context. */
+static void TS_RESP_CTX_init(TS_RESP_CTX *ctx)
+	{
+	ctx->request = NULL;
+	ctx->response = NULL;
+	ctx->tst_info = NULL;
+	}
+
+/* Cleans up the variable part of the context. */
+static void TS_RESP_CTX_cleanup(TS_RESP_CTX *ctx)
+	{
+	TS_REQ_free(ctx->request);
+	ctx->request = NULL;
+	TS_RESP_free(ctx->response);
+	ctx->response = NULL;
+	TS_TST_INFO_free(ctx->tst_info);
+	ctx->tst_info = NULL;
+	}
+
+/* Checks the format and content of the request. */
+static int TS_RESP_check_request(TS_RESP_CTX *ctx)
+	{
+	TS_REQ *request = ctx->request;
+	TS_MSG_IMPRINT *msg_imprint;
+	X509_ALGOR *md_alg;
+	int md_alg_id;
+	ASN1_OCTET_STRING *digest;
+	EVP_MD *md = NULL;
+	int i;
+
+	/* Checking request version. */
+	if (TS_REQ_get_version(request) != 1)
+		{
+		TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
+					    "Bad request version.");
+		TS_RESP_CTX_add_failure_info(ctx, TS_INFO_BAD_REQUEST);
+		return 0;
+		}
+
+	/* Checking message digest algorithm. */
+	msg_imprint = TS_REQ_get_msg_imprint(request);
+	md_alg = TS_MSG_IMPRINT_get_algo(msg_imprint);
+	md_alg_id = OBJ_obj2nid(md_alg->algorithm);
+	for (i = 0; !md && i < sk_EVP_MD_num(ctx->mds); ++i)
+		{
+		EVP_MD *current_md = sk_EVP_MD_value(ctx->mds, i);
+		if (md_alg_id == EVP_MD_type(current_md))
+			md = current_md;
+		}
+	if (!md)
+		{
+		TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
+					    "Message digest algorithm is "
+					    "not supported.");
+		TS_RESP_CTX_add_failure_info(ctx, TS_INFO_BAD_ALG);
+		return 0;
+		}
+
+	/* No message digest takes parameter. */
+	if (md_alg->parameter 
+	    && ASN1_TYPE_get(md_alg->parameter) != V_ASN1_NULL)
+		{
+		TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
+					    "Superfluous message digest "
+					    "parameter.");
+		TS_RESP_CTX_add_failure_info(ctx, TS_INFO_BAD_ALG);
+		return 0;
+		}
+	/* Checking message digest size. */
+	digest = TS_MSG_IMPRINT_get_msg(msg_imprint);
+	if (digest->length != EVP_MD_size(md))
+		{
+		TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
+					    "Bad message digest.");
+		TS_RESP_CTX_add_failure_info(ctx, TS_INFO_BAD_DATA_FORMAT);
+		return 0;
+		}
+
+	return 1;
+	}
+
+/* Returns the TSA policy based on the rqeuested and acceptable policies. */
+static ASN1_OBJECT *TS_RESP_get_policy(TS_RESP_CTX *ctx)
+	{
+	ASN1_OBJECT *requested = TS_REQ_get_policy_id(ctx->request);
+	ASN1_OBJECT *policy = NULL;
+	int i;
+
+	/* Return the default policy if none is requested or the default is
+	   requested. */
+	if (!requested || !OBJ_cmp(requested, ctx->default_policy))
+		policy = ctx->default_policy;
+
+	/* Check if the policy is acceptable. */
+	for (i = 0; !policy && i < sk_ASN1_OBJECT_num(ctx->policies); ++i)
+		{
+		ASN1_OBJECT *current = sk_ASN1_OBJECT_value(ctx->policies, i);
+		if (!OBJ_cmp(requested, current))
+			policy = current;
+		}
+	if (!policy)
+		{
+		TSerr(TS_F_TS_RESP_GET_POLICY, TS_R_UNACCEPTABLE_POLICY);
+		TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
+					    "Requested policy is not "
+					    "supported.");
+		TS_RESP_CTX_add_failure_info(ctx, TS_INFO_UNACCEPTED_POLICY);
+		}
+	return policy;
+	}
+
+/* Creates the TS_TST_INFO object based on the settings of the context. */
+static TS_TST_INFO *TS_RESP_create_tst_info(TS_RESP_CTX *ctx,
+					    ASN1_OBJECT *policy)
+	{
+	int result = 0;
+	TS_TST_INFO *tst_info = NULL;
+	ASN1_INTEGER *serial = NULL;
+	ASN1_GENERALIZEDTIME *asn1_time = NULL;
+	long sec, usec;
+	TS_ACCURACY *accuracy = NULL;
+	ASN1_INTEGER *nonce;
+	GENERAL_NAME *tsa_name = NULL;
+
+	if (!(tst_info = TS_TST_INFO_new())) goto end;
+	if (!TS_TST_INFO_set_version(tst_info, 1)) goto end;
+	if (!TS_TST_INFO_set_policy_id(tst_info, policy)) goto end;
+	if (!TS_TST_INFO_set_msg_imprint(tst_info, ctx->request->msg_imprint))
+		goto end;
+	if (!(serial = (*ctx->serial_cb)(ctx, ctx->serial_cb_data))
+	    || !TS_TST_INFO_set_serial(tst_info, serial))
+		goto end;
+	if (!(*ctx->time_cb)(ctx, ctx->time_cb_data, &sec, &usec)
+            || !(asn1_time = TS_RESP_set_genTime_with_precision(NULL, 
+					sec, usec, 
+					ctx->clock_precision_digits))
+	    || !TS_TST_INFO_set_time(tst_info, asn1_time))
+		goto end;
+
+	/* Setting accuracy if needed. */
+	if ((ctx->seconds || ctx->millis || ctx->micros) 
+	    && !(accuracy = TS_ACCURACY_new()))
+		goto end;
+
+	if (ctx->seconds && !TS_ACCURACY_set_seconds(accuracy, ctx->seconds))
+		goto end;
+	if (ctx->millis && !TS_ACCURACY_set_millis(accuracy, ctx->millis))
+		goto end;
+	if (ctx->micros && !TS_ACCURACY_set_micros(accuracy, ctx->micros))
+		goto end;
+	if (accuracy && !TS_TST_INFO_set_accuracy(tst_info, accuracy)) 
+		goto end;
+
+	/* Setting ordering. */
+	if ((ctx->flags & TS_ORDERING) 
+	    && !TS_TST_INFO_set_ordering(tst_info, 1))
+		goto end;
+	
+	/* Setting nonce if needed. */
+	if ((nonce = TS_REQ_get_nonce(ctx->request)) != NULL
+	    && !TS_TST_INFO_set_nonce(tst_info, nonce))
+		goto end;
+
+	/* Setting TSA name to subject of signer certificate. */
+	if (ctx->flags & TS_TSA_NAME)
+		{
+		if (!(tsa_name = GENERAL_NAME_new())) goto end;
+		tsa_name->type = GEN_DIRNAME;
+		tsa_name->d.dirn = 
+			X509_NAME_dup(ctx->signer_cert->cert_info->subject);
+		if (!tsa_name->d.dirn) goto end;
+		if (!TS_TST_INFO_set_tsa(tst_info, tsa_name)) goto end;
+		}
+
+	result = 1;
+ end:
+	if (!result)
+		{
+		TS_TST_INFO_free(tst_info);
+		tst_info = NULL;
+		TSerr(TS_F_TS_RESP_CREATE_TST_INFO, TS_R_TST_INFO_SETUP_ERROR);
+		TS_RESP_CTX_set_status_info_cond(ctx, TS_STATUS_REJECTION,
+						 "Error during TSTInfo "
+						 "generation.");
+		}
+	GENERAL_NAME_free(tsa_name);
+	TS_ACCURACY_free(accuracy);
+	ASN1_GENERALIZEDTIME_free(asn1_time);
+	ASN1_INTEGER_free(serial);
+	
+	return tst_info;
+	}
+
+/* Processing the extensions of the request. */
+static int TS_RESP_process_extensions(TS_RESP_CTX *ctx)
+	{
+	STACK_OF(X509_EXTENSION) *exts = TS_REQ_get_exts(ctx->request);
+	int i;
+	int ok = 1;
+
+	for (i = 0; ok && i < sk_X509_EXTENSION_num(exts); ++i)
+		{
+		X509_EXTENSION *ext = sk_X509_EXTENSION_value(exts, i);
+		ok = (*ctx->extension_cb)(ctx, ext, (void *)ctx->extension_cb);
+		}
+
+	return ok;
+	}
+
+/* Functions for signing the TS_TST_INFO structure of the context. */
+static int TS_RESP_sign(TS_RESP_CTX *ctx)
+	{
+	int ret = 0;
+	PKCS7 *p7 = NULL;
+	PKCS7_SIGNER_INFO *si;
+	STACK_OF(X509) *certs;	/* Certificates to include in sc. */
+	ESS_SIGNING_CERT *sc = NULL;
+	ASN1_OBJECT *oid;
+	BIO *p7bio = NULL;
+	int i;
+
+	/* Check if signcert and pkey match. */
+	if (!X509_check_private_key(ctx->signer_cert, ctx->signer_key)) {
+		TSerr(TS_F_TS_RESP_SIGN, 
+		      TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE);
+                goto err;
+	}
+
+	/* Create a new PKCS7 signed object. */
+	if (!(p7 = PKCS7_new())) {
+		TSerr(TS_F_TS_RESP_SIGN, ERR_R_MALLOC_FAILURE);
+		goto err;
+	}
+	if (!PKCS7_set_type(p7, NID_pkcs7_signed)) goto err;
+
+	/* Force SignedData version to be 3 instead of the default 1. */
+	if (!ASN1_INTEGER_set(p7->d.sign->version, 3)) goto err;
+
+	/* Add signer certificate and optional certificate chain. */
+	if (TS_REQ_get_cert_req(ctx->request))
+		{
+		PKCS7_add_certificate(p7, ctx->signer_cert);
+		if (ctx->certs)
+			{
+			for(i = 0; i < sk_X509_num(ctx->certs); ++i) 
+				{
+				X509 *cert = sk_X509_value(ctx->certs, i);
+				PKCS7_add_certificate(p7, cert);
+				}
+			}
+		}
+
+	/* Add a new signer info. */
+    	if (!(si = PKCS7_add_signature(p7, ctx->signer_cert, 
+				       ctx->signer_key, EVP_sha1())))
+		{
+		TSerr(TS_F_TS_RESP_SIGN, TS_R_PKCS7_ADD_SIGNATURE_ERROR);
+		goto err;
+		}
+
+	/* Add content type signed attribute to the signer info. */
+	oid = OBJ_nid2obj(NID_id_smime_ct_TSTInfo);
+	if (!PKCS7_add_signed_attribute(si, NID_pkcs9_contentType,
+					V_ASN1_OBJECT, oid))
+		{
+		TSerr(TS_F_TS_RESP_SIGN, TS_R_PKCS7_ADD_SIGNED_ATTR_ERROR);
+		goto err;
+		}
+
+	/* Create the ESS SigningCertificate attribute which contains 
+	   the signer certificate id and optionally the certificate chain. */
+	certs = ctx->flags & TS_ESS_CERT_ID_CHAIN ? ctx->certs : NULL;
+	if (!(sc = ESS_SIGNING_CERT_new_init(ctx->signer_cert, certs)))
+		goto err;
+
+	/* Add SigningCertificate signed attribute to the signer info. */
+	if (!ESS_add_signing_cert(si, sc))
+		{
+		TSerr(TS_F_TS_RESP_SIGN, TS_R_ESS_ADD_SIGNING_CERT_ERROR);
+		goto err;
+		}	
+
+	/* Add a new empty NID_id_smime_ct_TSTInfo encapsulated content. */
+	if (!TS_TST_INFO_content_new(p7)) goto err;
+
+	/* Add the DER encoded tst_info to the PKCS7 structure. */
+	if (!(p7bio = PKCS7_dataInit(p7, NULL))) {
+		TSerr(TS_F_TS_RESP_SIGN, ERR_R_MALLOC_FAILURE);
+		goto err;
+	}
+
+	/* Convert tst_info to DER. */
+	if (!i2d_TS_TST_INFO_bio(p7bio, ctx->tst_info))
+		{
+		TSerr(TS_F_TS_RESP_SIGN, TS_R_TS_DATASIGN);
+		goto err;
+		}
+
+	/* Create the signature and add it to the signer info. */
+        if (!PKCS7_dataFinal(p7, p7bio))
+		{
+		TSerr(TS_F_TS_RESP_SIGN, TS_R_TS_DATASIGN);
+		goto err;
+		}
+
+	/* Set new PKCS7 and TST_INFO objects. */
+	TS_RESP_set_tst_info(ctx->response, p7, ctx->tst_info);
+	p7 = NULL;		/* Ownership is lost. */
+	ctx->tst_info = NULL;	/* Ownership is lost. */
+
+	ret = 1;
+ err:
+	if (!ret)
+		TS_RESP_CTX_set_status_info_cond(ctx, TS_STATUS_REJECTION,
+						 "Error during signature "
+						 "generation.");
+	BIO_free_all(p7bio);
+	ESS_SIGNING_CERT_free(sc);
+	PKCS7_free(p7);
+	return ret;
+	}
+
+static ESS_SIGNING_CERT *ESS_SIGNING_CERT_new_init(X509 *signcert, 
+						   STACK_OF(X509) *certs)
+	{
+	ESS_CERT_ID *cid;
+	ESS_SIGNING_CERT *sc = NULL;
+	int i;
+
+	/* Creating the ESS_CERT_ID stack. */
+	if (!(sc = ESS_SIGNING_CERT_new())) goto err;
+	if (!sc->cert_ids && !(sc->cert_ids = sk_ESS_CERT_ID_new_null()))
+		goto err;
+
+	/* Adding the signing certificate id. */
+	if (!(cid = ESS_CERT_ID_new_init(signcert, 0))
+	    || !sk_ESS_CERT_ID_push(sc->cert_ids, cid))
+		goto err;
+	/* Adding the certificate chain ids. */
+	for (i = 0; i < sk_X509_num(certs); ++i)
+		{
+		X509 *cert = sk_X509_value(certs, i);
+		if (!(cid = ESS_CERT_ID_new_init(cert, 1))
+		    || !sk_ESS_CERT_ID_push(sc->cert_ids, cid))
+			goto err;
+		}
+
+	return sc;
+err:
+	ESS_SIGNING_CERT_free(sc);
+	TSerr(TS_F_ESS_SIGNING_CERT_NEW_INIT, ERR_R_MALLOC_FAILURE);
+	return NULL;
+	}
+
+static ESS_CERT_ID *ESS_CERT_ID_new_init(X509 *cert, int issuer_needed)
+	{
+	ESS_CERT_ID *cid = NULL;
+	GENERAL_NAME *name = NULL;
+	
+	/* Recompute SHA1 hash of certificate if necessary (side effect). */
+	X509_check_purpose(cert, -1, 0);
+
+	if (!(cid = ESS_CERT_ID_new())) goto err;
+	if (!ASN1_OCTET_STRING_set(cid->hash, cert->sha1_hash,
+				   sizeof(cert->sha1_hash)))
+		goto err;
+
+	/* Setting the issuer/serial if requested. */
+	if (issuer_needed)
+		{
+		/* Creating issuer/serial structure. */
+		if (!cid->issuer_serial
+		    && !(cid->issuer_serial = ESS_ISSUER_SERIAL_new()))
+			goto err;
+		/* Creating general name from the certificate issuer. */
+		if (!(name = GENERAL_NAME_new())) goto err;
+		name->type = GEN_DIRNAME;
+		if (!(name->d.dirn = X509_NAME_dup(cert->cert_info->issuer))) 
+			goto err;
+		if (!sk_GENERAL_NAME_push(cid->issuer_serial->issuer, name)) 
+			goto err;
+		name = NULL;	/* Ownership is lost. */
+		/* Setting the serial number. */
+		ASN1_INTEGER_free(cid->issuer_serial->serial);
+		if (!(cid->issuer_serial->serial = 
+		      ASN1_INTEGER_dup(cert->cert_info->serialNumber)))
+			goto err;
+		}
+
+	return cid;
+err:
+	GENERAL_NAME_free(name);
+	ESS_CERT_ID_free(cid);
+	TSerr(TS_F_ESS_CERT_ID_NEW_INIT, ERR_R_MALLOC_FAILURE);
+	return NULL;
+	}
+
+static int TS_TST_INFO_content_new(PKCS7 *p7)
+	{
+	PKCS7 *ret = NULL;
+	ASN1_OCTET_STRING *octet_string = NULL;
+
+	/* Create new encapsulated NID_id_smime_ct_TSTInfo content. */
+	if (!(ret = PKCS7_new())) goto err;
+	if (!(ret->d.other = ASN1_TYPE_new())) goto err;
+	ret->type = OBJ_nid2obj(NID_id_smime_ct_TSTInfo);
+	if (!(octet_string = ASN1_OCTET_STRING_new())) goto err;
+	ASN1_TYPE_set(ret->d.other, V_ASN1_OCTET_STRING, octet_string);
+	octet_string = NULL;
+
+	/* Add encapsulated content to signed PKCS7 structure. */
+	if (!PKCS7_set_content(p7, ret)) goto err;
+
+	return 1;
+ err:
+	ASN1_OCTET_STRING_free(octet_string);
+	PKCS7_free(ret);
+	return 0;
+	}
+
+static int ESS_add_signing_cert(PKCS7_SIGNER_INFO *si, ESS_SIGNING_CERT *sc)
+	{
+	ASN1_STRING *seq = NULL;
+	unsigned char *p, *pp = NULL;
+	int len;
+
+	len = i2d_ESS_SIGNING_CERT(sc, NULL);
+	if (!(pp = (unsigned char *) OPENSSL_malloc(len)))
+		{
+		TSerr(TS_F_ESS_ADD_SIGNING_CERT, ERR_R_MALLOC_FAILURE);
+		goto err;
+		}
+	p = pp;
+	i2d_ESS_SIGNING_CERT(sc, &p);
+	if (!(seq = ASN1_STRING_new()) || !ASN1_STRING_set(seq, pp, len))
+		{
+		TSerr(TS_F_ESS_ADD_SIGNING_CERT, ERR_R_MALLOC_FAILURE);
+		goto err;
+		}
+	OPENSSL_free(pp); pp = NULL;
+	return PKCS7_add_signed_attribute(si, 
+					  NID_id_smime_aa_signingCertificate,
+					  V_ASN1_SEQUENCE, seq);
+ err:
+	ASN1_STRING_free(seq);
+	OPENSSL_free(pp);
+
+	return 0;
+	}
+
+
+static ASN1_GENERALIZEDTIME *
+TS_RESP_set_genTime_with_precision(ASN1_GENERALIZEDTIME *asn1_time, 
+				   long sec, long usec, unsigned precision)
+	{
+	time_t time_sec = (time_t) sec;
+	struct tm *tm = NULL;	
+	char genTime_str[17 + TS_MAX_CLOCK_PRECISION_DIGITS];
+	char *p = genTime_str;
+	char *p_end = genTime_str + sizeof(genTime_str);
+
+	if (precision > TS_MAX_CLOCK_PRECISION_DIGITS)
+		goto err;
+
+	
+	if (!(tm = gmtime(&time_sec)))
+		goto err;
+
+	/* 
+	 * Put "genTime_str" in GeneralizedTime format.  We work around the 
+	 * restrictions imposed by rfc3280 (i.e. "GeneralizedTime values MUST 
+	 * NOT include fractional seconds") and OpenSSL related functions to 
+	 * meet the rfc3161 requirement: "GeneralizedTime syntax can include 
+	 * fraction-of-second details". 
+	 */                   
+	p += BIO_snprintf(p, p_end - p,
+			  "%04d%02d%02d%02d%02d%02d",
+			  tm->tm_year + 1900, tm->tm_mon + 1, tm->tm_mday, 
+			  tm->tm_hour, tm->tm_min, tm->tm_sec);
+	if (precision > 0)
+	{
+		/* Add fraction of seconds (leave space for dot and null). */
+		BIO_snprintf(p, 2 + precision, ".%ld", usec);
+		/* We cannot use the snprintf return value, 
+		   because it might have been truncated. */
+		p += strlen(p);
+
+		/* To make things a bit harder, X.690 | ISO/IEC 8825-1 provides
+		   the following restrictions for a DER-encoding, which OpenSSL
+		   (specifically ASN1_GENERALIZEDTIME_check() function) doesn't 
+		   support:
+		   "The encoding MUST terminate with a "Z" (which means "Zulu" 
+		   time). The decimal point element, if present, MUST be the 
+		   point option ".". The fractional-seconds elements, 
+		   if present, MUST omit all trailing 0's; 
+		   if the elements correspond to 0, they MUST be wholly
+		   omitted, and the decimal point element also MUST be
+		   omitted." */
+		/* Remove trailing zeros. The dot guarantees the exit
+		   condition of this loop even if all the digits are zero. */
+		while (*--p == '0')
+			/* empty */;
+		/* p points to either the dot or the last non-zero digit. */
+		if (*p != '.') ++p;
+		}
+	/* Add the trailing Z and the terminating null. */
+	*p++ = 'Z';
+	*p++ = '\0';
+
+	/* Now call OpenSSL to check and set our genTime value */
+	if (!asn1_time && !(asn1_time = M_ASN1_GENERALIZEDTIME_new()))
+		goto err;
+	if (!ASN1_GENERALIZEDTIME_set_string(asn1_time, genTime_str))
+		{
+		ASN1_GENERALIZEDTIME_free(asn1_time);
+		goto err;
+		}
+
+	return asn1_time;
+ err:
+	TSerr(TS_F_TS_RESP_SET_GENTIME_WITH_PRECISION, TS_R_COULD_NOT_SET_TIME);
+	return NULL;
+	}
Index: openssl/crypto/ts/ts_resp_utils.c
diff -u /dev/null openssl/crypto/ts/ts_resp_utils.c:1.1.20.1
--- /dev/null	Sun May  8 14:38:24 2005
+++ openssl/crypto/ts/ts_resp_utils.c	Sun May  8 14:24:08 2005
@@ -0,0 +1,409 @@
+/* crypto/ts/ts_resp_utils.c */
+/* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL
+ * project 2002.
+ */
+/* ====================================================================
+ * Copyright (c) 2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/objects.h>
+#include <openssl/ts.h>
+#include <openssl/pkcs7.h>
+
+/* Function definitions. */
+
+int TS_RESP_set_status_info(TS_RESP *a, TS_STATUS_INFO *status_info)
+	{
+	TS_STATUS_INFO *new_status_info;
+
+	if (a->status_info == status_info)
+		return 1;
+	new_status_info = TS_STATUS_INFO_dup(status_info);
+	if (new_status_info == NULL)
+		{
+		TSerr(TS_F_TS_RESP_SET_STATUS_INFO, ERR_R_MALLOC_FAILURE);
+		return 0;
+		}
+	TS_STATUS_INFO_free(a->status_info);
+	a->status_info = new_status_info;
+
+	return 1;
+	}
+
+TS_STATUS_INFO *TS_RESP_get_status_info(TS_RESP *a)
+	{
+	return a->status_info;
+	}
+
+/* Caller loses ownership of PKCS7 and TS_TST_INFO objects. */
+void TS_RESP_set_tst_info(TS_RESP *a, PKCS7 *p7, TS_TST_INFO *tst_info)
+	{
+	/* Set new PKCS7 and TST_INFO objects. */
+	PKCS7_free(a->token);
+	a->token = p7;
+	TS_TST_INFO_free(a->tst_info);
+	a->tst_info = tst_info;
+	}
+
+PKCS7 *TS_RESP_get_token(TS_RESP *a)
+	{
+	return a->token;
+	}
+
+TS_TST_INFO *TS_RESP_get_tst_info(TS_RESP *a)
+	{
+	return a->tst_info;
+	}
+
+int TS_TST_INFO_set_version(TS_TST_INFO *a, long version)
+	{
+	return ASN1_INTEGER_set(a->version, version);
+	}
+
+long TS_TST_INFO_get_version(TS_TST_INFO *a)
+	{
+	return ASN1_INTEGER_get(a->version);
+	}
+
+int TS_TST_INFO_set_policy_id(TS_TST_INFO *a, ASN1_OBJECT *policy)
+	{
+	ASN1_OBJECT *new_policy;
+
+	if (a->policy_id == policy)
+		return 1;
+	new_policy = OBJ_dup(policy);
+	if (new_policy == NULL)
+		{
+		TSerr(TS_F_TS_TST_INFO_SET_POLICY_ID, ERR_R_MALLOC_FAILURE);
+		return 0;
+		}
+	ASN1_OBJECT_free(a->policy_id);
+	a->policy_id = new_policy;
+	return 1;
+	}
+
+ASN1_OBJECT *TS_TST_INFO_get_policy_id(TS_TST_INFO *a)
+	{
+	return a->policy_id;
+	}
+
+int TS_TST_INFO_set_msg_imprint(TS_TST_INFO *a, TS_MSG_IMPRINT *msg_imprint)
+	{
+	TS_MSG_IMPRINT *new_msg_imprint;
+
+	if (a->msg_imprint == msg_imprint)
+		return 1;
+	new_msg_imprint = TS_MSG_IMPRINT_dup(msg_imprint);
+	if (new_msg_imprint == NULL)
+		{
+		TSerr(TS_F_TS_TST_INFO_SET_MSG_IMPRINT, ERR_R_MALLOC_FAILURE);
+		return 0;
+		}
+	TS_MSG_IMPRINT_free(a->msg_imprint);
+	a->msg_imprint = new_msg_imprint;
+	return 1;
+	}
+
+TS_MSG_IMPRINT *TS_TST_INFO_get_msg_imprint(TS_TST_INFO *a)
+	{
+	return a->msg_imprint;
+	}
+
+int TS_TST_INFO_set_serial(TS_TST_INFO *a, ASN1_INTEGER *serial)
+	{
+	ASN1_INTEGER *new_serial;
+
+	if (a->serial == serial)
+		return 1;
+	new_serial = ASN1_INTEGER_dup(serial);
+	if (new_serial == NULL)
+		{
+		TSerr(TS_F_TS_TST_INFO_SET_SERIAL, ERR_R_MALLOC_FAILURE);
+		return 0;
+		}
+	ASN1_INTEGER_free(a->serial);
+	a->serial = new_serial;
+	return 1;
+	}
+
+ASN1_INTEGER *TS_TST_INFO_get_serial(TS_TST_INFO *a)
+	{
+	return a->serial;
+	}
+
+int TS_TST_INFO_set_time(TS_TST_INFO *a, ASN1_GENERALIZEDTIME *gtime)
+	{
+	ASN1_GENERALIZEDTIME *new_time;
+
+	if (a->time == gtime)
+		return 1;
+	new_time = M_ASN1_GENERALIZEDTIME_dup(gtime);
+	if (new_time == NULL)
+		{
+		TSerr(TS_F_TS_TST_INFO_SET_TIME, ERR_R_MALLOC_FAILURE);
+		return 0;
+		}
+	ASN1_GENERALIZEDTIME_free(a->time);
+	a->time = new_time;
+	return 1;
+	}
+
+ASN1_GENERALIZEDTIME *TS_TST_INFO_get_time(TS_TST_INFO *a)
+	{
+	return a->time;
+	}
+
+int TS_TST_INFO_set_accuracy(TS_TST_INFO *a, TS_ACCURACY *accuracy)
+	{
+	TS_ACCURACY *new_accuracy;
+
+	if (a->accuracy == accuracy)
+		return 1;
+	new_accuracy = TS_ACCURACY_dup(accuracy);
+	if (new_accuracy == NULL)
+		{
+		TSerr(TS_F_TS_TST_INFO_SET_ACCURACY, ERR_R_MALLOC_FAILURE);
+		return 0;
+		}
+	TS_ACCURACY_free(a->accuracy);
+	a->accuracy = new_accuracy;
+	return 1;
+	}
+
+TS_ACCURACY *TS_TST_INFO_get_accuracy(TS_TST_INFO *a)
+	{
+	return a->accuracy;
+	}
+
+int TS_ACCURACY_set_seconds(TS_ACCURACY *a, ASN1_INTEGER *seconds)
+	{
+	ASN1_INTEGER *new_seconds;
+
+	if (a->seconds == seconds)
+		return 1;
+	new_seconds = ASN1_INTEGER_dup(seconds);
+	if (new_seconds == NULL)
+		{
+		TSerr(TS_F_TS_ACCURACY_SET_SECONDS, ERR_R_MALLOC_FAILURE);
+		return 0;
+		}
+	ASN1_INTEGER_free(a->seconds);
+	a->seconds = new_seconds;
+	return 1;
+	}
+
+ASN1_INTEGER *TS_ACCURACY_get_seconds(TS_ACCURACY *a)
+	{
+	return a->seconds;
+	}
+
+int TS_ACCURACY_set_millis(TS_ACCURACY *a, ASN1_INTEGER *millis)
+	{
+	ASN1_INTEGER *new_millis = NULL;
+
+	if (a->millis == millis)
+		return 1;
+	if (millis != NULL)
+		{
+		new_millis = ASN1_INTEGER_dup(millis);
+		if (new_millis == NULL)
+			{
+			TSerr(TS_F_TS_ACCURACY_SET_MILLIS, 
+			      ERR_R_MALLOC_FAILURE);
+			return 0;
+			}
+		}
+	ASN1_INTEGER_free(a->millis);
+	a->millis = new_millis;
+	return 1;
+	}
+
+ASN1_INTEGER *TS_ACCURACY_get_millis(TS_ACCURACY *a)
+	{
+	return a->millis;
+	}
+
+int TS_ACCURACY_set_micros(TS_ACCURACY *a, ASN1_INTEGER *micros)
+	{
+	ASN1_INTEGER *new_micros = NULL;
+
+	if (a->micros == micros)
+		return 1;
+	if (micros != NULL)
+		{
+		new_micros = ASN1_INTEGER_dup(micros);
+		if (new_micros == NULL)
+			{
+			TSerr(TS_F_TS_ACCURACY_SET_MICROS, 
+			      ERR_R_MALLOC_FAILURE);
+			return 0;
+			}
+		}
+	ASN1_INTEGER_free(a->micros);
+	a->micros = new_micros;
+	return 1;
+	}
+
+ASN1_INTEGER *TS_ACCURACY_get_micros(TS_ACCURACY *a)
+	{
+	return a->micros;
+	}
+
+int TS_TST_INFO_set_ordering(TS_TST_INFO *a, int ordering)
+	{
+	a->ordering = ordering ? 0xFF : 0x00;
+	return 1;
+	}
+
+int TS_TST_INFO_get_ordering(TS_TST_INFO *a)
+	{
+	return a->ordering ? 1 : 0;
+	}
+
+int TS_TST_INFO_set_nonce(TS_TST_INFO *a, ASN1_INTEGER *nonce)
+	{
+	ASN1_INTEGER *new_nonce;
+
+	if (a->nonce == nonce)
+		return 1;
+	new_nonce = ASN1_INTEGER_dup(nonce);
+	if (new_nonce == NULL)
+		{
+		TSerr(TS_F_TS_TST_INFO_SET_NONCE, ERR_R_MALLOC_FAILURE);
+		return 0;
+		}
+	ASN1_INTEGER_free(a->nonce);
+	a->nonce = new_nonce;
+	return 1;
+	}
+
+ASN1_INTEGER *TS_TST_INFO_get_nonce(TS_TST_INFO *a)
+	{
+	return a->nonce;
+	}
+
+int TS_TST_INFO_set_tsa(TS_TST_INFO *a, GENERAL_NAME *tsa)
+	{
+	GENERAL_NAME *new_tsa;
+
+	if (a->tsa == tsa)
+		return 1;
+	new_tsa = GENERAL_NAME_dup(tsa);
+	if (new_tsa == NULL)
+		{
+		TSerr(TS_F_TS_TST_INFO_SET_TSA, ERR_R_MALLOC_FAILURE);
+		return 0;
+		}
+	GENERAL_NAME_free(a->tsa);
+	a->tsa = new_tsa;
+	return 1;
+	}
+
+GENERAL_NAME *TS_TST_INFO_get_tsa(TS_TST_INFO *a)
+	{
+	return a->tsa;
+	}
+
+STACK_OF(X509_EXTENSION) *TS_TST_INFO_get_exts(TS_TST_INFO *a)
+	{
+	return a->extensions;
+	}
+
+void TS_TST_INFO_ext_free(TS_TST_INFO *a)
+	{
+	if (!a) return;
+	sk_X509_EXTENSION_pop_free(a->extensions, X509_EXTENSION_free);
+	a->extensions = NULL;
+	}
+
+int TS_TST_INFO_get_ext_count(TS_TST_INFO *a)
+	{
+	return X509v3_get_ext_count(a->extensions);
+	}
+
+int TS_TST_INFO_get_ext_by_NID(TS_TST_INFO *a, int nid, int lastpos)
+	{
+	return X509v3_get_ext_by_NID(a->extensions, nid, lastpos);
+	}
+
+int TS_TST_INFO_get_ext_by_OBJ(TS_TST_INFO *a, ASN1_OBJECT *obj, int lastpos)
+	{
+	return X509v3_get_ext_by_OBJ(a->extensions, obj, lastpos);
+	}
+
+int TS_TST_INFO_get_ext_by_critical(TS_TST_INFO *a, int crit, int lastpos)
+	{
+	return X509v3_get_ext_by_critical(a->extensions, crit, lastpos);
+	}
+
+X509_EXTENSION *TS_TST_INFO_get_ext(TS_TST_INFO *a, int loc)
+	{
+	return X509v3_get_ext(a->extensions,loc);
+	}
+
+X509_EXTENSION *TS_TST_INFO_delete_ext(TS_TST_INFO *a, int loc)
+	{
+	return X509v3_delete_ext(a->extensions,loc);
+	}
+
+int TS_TST_INFO_add_ext(TS_TST_INFO *a, X509_EXTENSION *ex, int loc)
+	{
+	return X509v3_add_ext(&a->extensions,ex,loc) != NULL;
+	}
+
+void *TS_TST_INFO_get_ext_d2i(TS_TST_INFO *a, int nid, int *crit, int *idx)
+	{
+	return X509V3_get_d2i(a->extensions, nid, crit, idx);
+	}
Index: openssl/crypto/ts/ts_resp_verify.c
diff -u /dev/null openssl/crypto/ts/ts_resp_verify.c:1.1.20.1
--- /dev/null	Sun May  8 14:38:24 2005
+++ openssl/crypto/ts/ts_resp_verify.c	Sun May  8 14:24:08 2005
@@ -0,0 +1,722 @@
+/* crypto/ts/ts_resp_verify.c */
+/* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL
+ * project 2002.
+ */
+/* ====================================================================
+ * Copyright (c) 2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/objects.h>
+#include <openssl/ts.h>
+#include <openssl/pkcs7.h>
+
+/* Private function declarations. */
+
+static int TS_verify_cert(X509_STORE *store, STACK_OF(X509) *untrusted,
+			  X509 *signer, STACK_OF(X509) **chain);
+static int TS_check_signing_certs(PKCS7_SIGNER_INFO *si, STACK_OF(X509) *chain);
+static ESS_SIGNING_CERT *ESS_get_signing_cert(PKCS7_SIGNER_INFO *si);
+static int TS_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert);
+static int TS_issuer_serial_cmp(ESS_ISSUER_SERIAL *is, X509_CINF *cinfo);
+static int _TS_RESP_verify_token(TS_VERIFY_CTX *ctx, 
+				 PKCS7 *token, TS_TST_INFO *tst_info);
+static int TS_check_status_info(TS_RESP *response);
+static char *TS_get_status_text(STACK_OF(ASN1_UTF8STRING) *text);
+static int TS_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info);
+static int TS_compute_imprint(BIO *data, TS_TST_INFO *tst_info,
+			      X509_ALGOR **md_alg, 
+			      unsigned char **imprint, unsigned *imprint_len);
+static int TS_check_imprints(X509_ALGOR *algor_a, 
+			     unsigned char *imprint_a, unsigned len_a,
+			     TS_TST_INFO *tst_info);
+static int TS_check_nonces(ASN1_INTEGER *a, TS_TST_INFO *tst_info);
+static int TS_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer);
+static int TS_find_name(STACK_OF(GENERAL_NAME) *gen_names, GENERAL_NAME *name);
+
+/*
+ * Local mapping between response codes and descriptions.
+ * Don't forget to change TS_STATUS_BUF_SIZE when modifying 
+ * the elements of this array.
+ */
+static const char *TS_status_text[] =
+	{ "granted",
+	  "grantedWithMods",
+	  "rejection",
+	  "waiting",
+	  "revocationWarning",
+	  "revocationNotification" };
+
+#define TS_STATUS_TEXT_SIZE	(sizeof(TS_status_text)/sizeof(*TS_status_text))
+
+/*
+ * This must be greater or equal to the sum of the strings in TS_status_text
+ * plus the number of its elements.
+ */
+#define TS_STATUS_BUF_SIZE	256
+
+static struct
+	{
+	int code;
+	const char *text;
+	} TS_failure_info[] =
+		{ { TS_INFO_BAD_ALG, "badAlg" },
+		  { TS_INFO_BAD_REQUEST, "badRequest" },
+		  { TS_INFO_BAD_DATA_FORMAT, "badDataFormat" },
+		  { TS_INFO_TIME_NOT_AVAILABLE, "timeNotAvailable" },
+		  { TS_INFO_UNACCEPTED_POLICY, "unacceptedPolicy" },
+		  { TS_INFO_UNACCEPTED_EXTENSION, "unacceptedExtension" },
+		  { TS_INFO_ADD_INFO_NOT_AVAILABLE, "addInfoNotAvailable" },
+		  { TS_INFO_SYSTEM_FAILURE, "systemFailure" } };
+
+#define TS_FAILURE_INFO_SIZE	(sizeof(TS_failure_info) / \
+				sizeof(*TS_failure_info))
+
+/* Functions for verifying a signed TS_TST_INFO structure. */
+
+/*
+ * This function carries out the following tasks:
+ *	- Checks if there is one and only one signer.
+ *	- Search for the signing certificate in 'certs' and in the response.
+ *	- Check the extended key usage and key usage fields of the signer
+ *	certificate (done by the path validation).
+ *	- Build and validate the certificate path.
+ *	- Check if the certificate path meets the requirements of the
+ *	SigningCertificate ESS signed attribute.
+ *	- Verify the signature value.
+ *	- Returns the signer certificate in 'signer', if 'signer' is not NULL.
+ */
+int TS_RESP_verify_signature(PKCS7 *token, STACK_OF(X509) *certs,
+			     X509_STORE *store, X509 **signer_out)
+	{
+	STACK_OF(PKCS7_SIGNER_INFO) *sinfos = NULL;
+	PKCS7_SIGNER_INFO *si;
+	STACK_OF(X509) *signers = NULL;
+	X509	*signer;
+	STACK_OF(X509) *chain = NULL;
+	char	buf[4096];
+	int	i, j = 0, ret = 0;
+	BIO	*p7bio = NULL;
+
+	/* Some sanity checks first. */
+	if (!token)
+		{
+		TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_INVALID_NULL_POINTER);
+		goto err;
+		}
+
+	/* Check for the correct content type */
+	if(!PKCS7_type_is_signed(token))
+		{
+		TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_WRONG_CONTENT_TYPE);
+		goto err;
+		}
+
+	/* Check if there is one and only one signer. */
+	sinfos = PKCS7_get_signer_info(token);
+	if (!sinfos || sk_PKCS7_SIGNER_INFO_num(sinfos) != 1)
+		{
+		TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE,
+		      TS_R_THERE_MUST_BE_ONE_SIGNER);
+		goto err;
+		}
+	si = sk_PKCS7_SIGNER_INFO_value(sinfos, 0);
+
+	/* Check for no content: no data to verify signature. */
+	if (PKCS7_get_detached(token))
+		{
+		TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_NO_CONTENT);
+		goto err;
+		}
+	
+	/* Get hold of the signer certificate, search only internal
+	   certificates if it was requested. */
+	signers = PKCS7_get0_signers(token, certs, 0);
+	if (!signers || sk_X509_num(signers) != 1) goto err;
+	signer = sk_X509_value(signers, 0);
+
+	/* Now verify the certificate. */
+	if (!TS_verify_cert(store, certs, signer, &chain)) goto err;
+
+	/* Check if the signer certificate is consistent with the
+	   ESS extension. */
+	if (!TS_check_signing_certs(si, chain)) goto err;
+
+	/* Creating the message digest. */
+	p7bio = PKCS7_dataInit(token, NULL);
+
+	/* We now have to 'read' from p7bio to calculate digests etc. */
+	while ((i = BIO_read(p7bio,buf,sizeof(buf))) > 0);
+
+	/* Verifying the signature. */
+	j = PKCS7_signatureVerify(p7bio, token, si, signer);
+	if (j <= 0)
+		{
+		TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_SIGNATURE_FAILURE);
+		goto err;
+		}
+
+	/* Return the signer certificate if needed. */
+	if (signer_out)
+		{
+		*signer_out = signer;
+		CRYPTO_add(&signer->references, 1, CRYPTO_LOCK_X509);
+		}
+
+	ret = 1;
+
+ err:
+	BIO_free_all(p7bio);
+	sk_X509_pop_free(chain, X509_free);
+	sk_X509_free(signers);
+
+	return ret;
+	}
+
+/*
+ * The certificate chain is returned in chain. Caller is responsible for
+ * freeing the vector.
+ */
+static int TS_verify_cert(X509_STORE *store, STACK_OF(X509) *untrusted,
+			  X509 *signer, STACK_OF(X509) **chain)
+	{
+	X509_STORE_CTX	cert_ctx;
+	int i;
+	int ret = 1;
+
+	/* chain is an out argument. */
+	*chain = NULL;
+	X509_STORE_CTX_init(&cert_ctx, store, signer, untrusted);
+	X509_STORE_CTX_set_purpose(&cert_ctx, X509_PURPOSE_TIMESTAMP_SIGN);
+	i = X509_verify_cert(&cert_ctx);
+	if (i <= 0)
+		{
+		int j = X509_STORE_CTX_get_error(&cert_ctx);
+		TSerr(TS_F_TS_VERIFY_CERT, TS_R_CERTIFICATE_VERIFY_ERROR);
+		ERR_add_error_data(2, "Verify error:",
+				   X509_verify_cert_error_string(j));
+		ret = 0;
+		}
+	else
+		{
+		/* Get a copy of the certificate chain. */
+		*chain = X509_STORE_CTX_get1_chain(&cert_ctx);
+		}
+
+	X509_STORE_CTX_cleanup(&cert_ctx);
+
+	return ret;
+	}
+
+static int TS_check_signing_certs(PKCS7_SIGNER_INFO *si, STACK_OF(X509) *chain)
+	{
+	ESS_SIGNING_CERT *ss = ESS_get_signing_cert(si);
+	STACK_OF(ESS_CERT_ID) *cert_ids = NULL;
+	X509 *cert;
+	int i = 0;
+	int ret = 0;
+
+	if (!ss) goto err;
+	cert_ids = ss->cert_ids;
+	/* The signer certificate must be the first in cert_ids. */
+	cert = sk_X509_value(chain, 0);
+	if (TS_find_cert(cert_ids, cert) != 0) goto err;
+	
+	/* Check the other certificates of the chain if there are more
+	   than one certificate ids in cert_ids. */
+	if (sk_ESS_CERT_ID_num(cert_ids) > 1)
+		{
+		/* All the certificates of the chain must be in cert_ids. */
+		for (i = 1; i < sk_X509_num(chain); ++i)
+			{
+			cert = sk_X509_value(chain, i);
+			if (TS_find_cert(cert_ids, cert) < 0) goto err;
+			}
+		}
+	ret = 1;
+ err:
+	if (!ret)
+		TSerr(TS_F_TS_CHECK_SIGNING_CERTS, 
+		      TS_R_ESS_SIGNING_CERTIFICATE_ERROR);
+	ESS_SIGNING_CERT_free(ss);
+	return ret;
+	}
+
+static ESS_SIGNING_CERT *ESS_get_signing_cert(PKCS7_SIGNER_INFO *si)
+	{
+	ASN1_TYPE *attr;
+	const unsigned char *p;
+	attr = PKCS7_get_signed_attribute(si, 
+					  NID_id_smime_aa_signingCertificate);
+	if (!attr) return NULL;
+	p = attr->value.sequence->data;
+	return d2i_ESS_SIGNING_CERT(NULL, &p, attr->value.sequence->length);
+	}
+
+/* Returns < 0 if certificate is not found, certificate index otherwise. */
+static int TS_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert)
+	{
+	int i;
+
+	if (!cert_ids || !cert) return -1;
+
+	/* Recompute SHA1 hash of certificate if necessary (side effect). */
+	X509_check_purpose(cert, -1, 0);
+
+	/* Look for cert in the cert_ids vector. */
+	for (i = 0; i < sk_ESS_CERT_ID_num(cert_ids); ++i)
+		{
+		ESS_CERT_ID *cid = sk_ESS_CERT_ID_value(cert_ids, i);
+
+		/* Check the SHA-1 hash first. */
+		if (cid->hash->length == sizeof(cert->sha1_hash)
+		    && !memcmp(cid->hash->data, cert->sha1_hash,
+			       sizeof(cert->sha1_hash)))
+			{
+			/* Check the issuer/serial as well if specified. */
+			ESS_ISSUER_SERIAL *is = cid->issuer_serial;
+			if (!is || !TS_issuer_serial_cmp(is, cert->cert_info))
+				return i;
+			}
+		}
+	
+	return -1;
+	}
+
+static int TS_issuer_serial_cmp(ESS_ISSUER_SERIAL *is, X509_CINF *cinfo)
+	{
+	GENERAL_NAME *issuer;
+
+	if (!is || !cinfo || sk_GENERAL_NAME_num(is->issuer) != 1) return -1;
+
+	/* Check the issuer first. It must be a directory name. */
+	issuer = sk_GENERAL_NAME_value(is->issuer, 0);
+	if (issuer->type != GEN_DIRNAME 
+	    || X509_NAME_cmp(issuer->d.dirn, cinfo->issuer))
+		return -1;
+
+	/* Check the serial number, too. */
+	if (ASN1_INTEGER_cmp(is->serial, cinfo->serialNumber))
+		return -1;
+
+	return 0;
+	}
+
+/*
+ * Verifies whether 'response' contains a valid response with regards 
+ * to the settings of the context:
+ *	- Gives an error message if the TS_TST_INFO is not present.
+ *	- Calls _TS_RESP_verify_token to verify the token content.
+ */
+int TS_RESP_verify_response(TS_VERIFY_CTX *ctx, TS_RESP *response)
+	{
+	PKCS7 *token = TS_RESP_get_token(response);
+	TS_TST_INFO *tst_info = TS_RESP_get_tst_info(response);
+	int ret = 0;
+
+	/* Check if we have a successful TS_TST_INFO object in place. */
+	if (!TS_check_status_info(response)) goto err;
+
+	/* Check the contents of the time stamp token. */
+	if (!_TS_RESP_verify_token(ctx, token, tst_info))
+		goto err;
+
+	ret = 1;
+ err:
+	return ret;
+	}
+
+/*
+ * Tries to extract a TS_TST_INFO structure from the PKCS7 token and
+ * calls the internal _TS_RESP_verify_token function for verifying it.
+ */
+int TS_RESP_verify_token(TS_VERIFY_CTX *ctx, PKCS7 *token)
+	{
+	TS_TST_INFO *tst_info = PKCS7_to_TS_TST_INFO(token);
+	int ret = 0;
+	if (tst_info)
+		{
+		ret = _TS_RESP_verify_token(ctx, token, tst_info);
+		TS_TST_INFO_free(tst_info);
+		}
+	return ret;
+	}
+
+/*
+ * Verifies whether the 'token' contains a valid time stamp token 
+ * with regards to the settings of the context. Only those checks are
+ * carried out that are specified in the context:
+ *	- Verifies the signature of the TS_TST_INFO.
+ *	- Checks the version number of the response.
+ *	- Check if the requested and returned policies math.
+ *	- Check if the message imprints are the same.
+ *	- Check if the nonces are the same.
+ *	- Check if the TSA name matches the signer.
+ *	- Check if the TSA name is the expected TSA.
+ */
+static int _TS_RESP_verify_token(TS_VERIFY_CTX *ctx, 
+				 PKCS7 *token, TS_TST_INFO *tst_info)
+	{
+	X509 *signer = NULL;
+	GENERAL_NAME *tsa_name = TS_TST_INFO_get_tsa(tst_info);
+	X509_ALGOR *md_alg = NULL;
+	unsigned char *imprint = NULL;
+	unsigned imprint_len = 0;
+	int ret = 0;
+
+	/* Verify the signature. */
+	if ((ctx->flags & TS_VFY_SIGNATURE)
+	    && !TS_RESP_verify_signature(token, ctx->certs, ctx->store,
+					 &signer))
+		goto err;
+	
+	/* Check version number of response. */
+	if ((ctx->flags & TS_VFY_VERSION)
+	    && TS_TST_INFO_get_version(tst_info) != 1)
+		{
+		TSerr(TS_F_TS_VERIFY, TS_R_UNSUPPORTED_VERSION);
+		goto err;
+		}
+
+	/* Check policies. */
+	if ((ctx->flags & TS_VFY_POLICY)
+	    && !TS_check_policy(ctx->policy, tst_info))
+		goto err;
+	
+	/* Check message imprints. */
+	if ((ctx->flags & TS_VFY_IMPRINT)
+	    && !TS_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len,
+				  tst_info)) 
+		goto err;
+
+	/* Compute and check message imprints. */
+	if ((ctx->flags & TS_VFY_DATA)
+	    && (!TS_compute_imprint(ctx->data, tst_info,
+				    &md_alg, &imprint, &imprint_len)
+	    || !TS_check_imprints(md_alg, imprint, imprint_len, tst_info)))
+		goto err;
+
+	/* Check nonces. */
+	if ((ctx->flags & TS_VFY_NONCE)
+	    && !TS_check_nonces(ctx->nonce, tst_info))
+		goto err;
+
+	/* Check whether TSA name and signer certificate match. */
+	if ((ctx->flags & TS_VFY_SIGNER)
+	    && tsa_name && !TS_check_signer_name(tsa_name, signer))
+		{
+		TSerr(TS_F_TS_RESP_VERIFY_TOKEN, TS_R_TSA_NAME_MISMATCH);
+		goto err;
+		}
+
+	/* Check whether the TSA is the expected one. */
+	if ((ctx->flags & TS_VFY_TSA_NAME)
+	    && !TS_check_signer_name(ctx->tsa_name, signer))
+		{
+		TSerr(TS_F_TS_RESP_VERIFY_TOKEN, TS_R_TSA_UNTRUSTED);
+		goto err;
+		}
+
+	ret = 1;
+ err:
+	X509_free(signer);
+	X509_ALGOR_free(md_alg);
+	OPENSSL_free(imprint);
+	return ret;
+	}
+
+static int TS_check_status_info(TS_RESP *response)
+	{
+	TS_STATUS_INFO *info = TS_RESP_get_status_info(response);
+	long status = ASN1_INTEGER_get(info->status);
+	const char *status_text = NULL;
+	char *embedded_status_text = NULL;
+	char failure_text[TS_STATUS_BUF_SIZE] = "";
+
+	/* Check if everything went fine. */
+	if (status == 0 || status == 1) return 1;
+
+	/* There was an error, get the description in status_text. */
+	if (0 <= status && status < (long)TS_STATUS_TEXT_SIZE)
+		status_text = TS_status_text[status];
+	else
+		status_text = "unknown code";
+
+	/* Set the embedded_status_text to the returned description. */
+	if (sk_ASN1_UTF8STRING_num(info->text) > 0
+	    && !(embedded_status_text = TS_get_status_text(info->text)))
+		return 0;
+	
+	/* Filling in failure_text with the failure information. */
+	if (info->failure_info)
+		{
+		int i;
+		int first = 1;
+		for (i = 0; i < (int)TS_FAILURE_INFO_SIZE; ++i)
+			{
+			if (ASN1_BIT_STRING_get_bit(info->failure_info,
+						    TS_failure_info[i].code))
+				{
+				if (!first)
+					strcpy(failure_text, ",");
+				else
+					first = 0;
+				strcat(failure_text, TS_failure_info[i].text);
+				}
+			}
+		}
+	if (failure_text[0] == '\0')
+		strcpy(failure_text, "unspecified");
+
+	/* Making up the error string. */
+	TSerr(TS_F_TS_CHECK_STATUS_INFO, TS_R_NO_TIME_STAMP_TOKEN);
+	ERR_add_error_data(6,
+			   "status code: ", status_text,
+			   ", status text: ", embedded_status_text ? 
+			   embedded_status_text : "unspecified",
+			   ", failure codes: ", failure_text);
+	OPENSSL_free(embedded_status_text);
+
+	return 0;
+	}
+
+static char *TS_get_status_text(STACK_OF(ASN1_UTF8STRING) *text)
+	{
+	int i;
+	unsigned int length = 0;
+	char *result = NULL;
+	char *p;
+
+	/* Determine length first. */
+	for (i = 0; i < sk_ASN1_UTF8STRING_num(text); ++i)
+		{
+		ASN1_UTF8STRING *current = sk_ASN1_UTF8STRING_value(text, i);
+		length += ASN1_STRING_length(current);
+		length += 1;	/* separator character */
+		}
+	/* Allocate memory (closing '\0' included). */
+	if (!(result = OPENSSL_malloc(length)))
+		{
+		TSerr(TS_F_TS_GET_STATUS_TEXT, ERR_R_MALLOC_FAILURE);
+		return NULL;
+		}
+	/* Concatenate the descriptions. */
+	for (i = 0, p = result; i < sk_ASN1_UTF8STRING_num(text); ++i)
+		{
+		ASN1_UTF8STRING *current = sk_ASN1_UTF8STRING_value(text, i);
+		length = ASN1_STRING_length(current);
+		if (i > 0) *p++ = '/';
+		strncpy(p, (const char *)ASN1_STRING_data(current), length);
+		p += length;
+		}
+	/* We do have space for this, too. */
+	*p = '\0';
+	
+	return result;
+	}
+
+static int TS_check_policy(ASN1_OBJECT *req_oid, TS_TST_INFO *tst_info)
+	{
+	ASN1_OBJECT *resp_oid = TS_TST_INFO_get_policy_id(tst_info);
+
+	if (OBJ_cmp(req_oid, resp_oid) != 0)
+		{
+		TSerr(TS_F_TS_CHECK_POLICY, TS_R_POLICY_MISMATCH);
+		return 0;
+		}
+
+	return 1;
+	}
+
+static int TS_compute_imprint(BIO *data, TS_TST_INFO *tst_info,
+			      X509_ALGOR **md_alg, 
+			      unsigned char **imprint, unsigned *imprint_len)
+	{
+	TS_MSG_IMPRINT *msg_imprint = TS_TST_INFO_get_msg_imprint(tst_info);
+	X509_ALGOR *md_alg_resp = TS_MSG_IMPRINT_get_algo(msg_imprint);
+	const EVP_MD *md;
+	EVP_MD_CTX md_ctx;
+	unsigned char buffer[4096];
+	int length;
+
+	*md_alg = NULL;
+	*imprint = NULL;
+
+	/* Return the MD algorithm of the response. */
+	if (!(*md_alg = X509_ALGOR_dup(md_alg_resp))) goto err;
+
+	/* Getting the MD object. */
+	if (!(md = EVP_get_digestbyobj((*md_alg)->algorithm)))
+		{
+		TSerr(TS_F_TS_COMPUTE_IMPRINT, TS_R_UNSUPPORTED_MD_ALGORITHM);
+		goto err;
+		}
+
+	/* Compute message digest. */
+	*imprint_len = EVP_MD_size(md);
+	if (!(*imprint = OPENSSL_malloc(*imprint_len))) 
+		{
+		TSerr(TS_F_TS_COMPUTE_IMPRINT, ERR_R_MALLOC_FAILURE);
+		goto err;
+		}
+
+	EVP_DigestInit(&md_ctx, md);
+	while ((length = BIO_read(data, buffer, sizeof(buffer))) > 0)
+		{
+		EVP_DigestUpdate(&md_ctx, buffer, length);
+		}
+	EVP_DigestFinal(&md_ctx, *imprint, NULL);
+
+	return 1;
+ err:
+	X509_ALGOR_free(*md_alg);
+	OPENSSL_free(*imprint);
+	*imprint_len = 0;
+	return 0;
+	}
+
+static int TS_check_imprints(X509_ALGOR *algor_a, 
+			     unsigned char *imprint_a, unsigned len_a,
+			     TS_TST_INFO *tst_info)
+	{
+	TS_MSG_IMPRINT *b = TS_TST_INFO_get_msg_imprint(tst_info);
+	X509_ALGOR *algor_b = TS_MSG_IMPRINT_get_algo(b);
+	int ret = 0;
+
+	/* algor_a is optional. */
+	if (algor_a)
+		{
+		/* Compare algorithm OIDs. */
+		if (OBJ_cmp(algor_a->algorithm, algor_b->algorithm)) goto err;
+
+		/* The parameter must be NULL in both. */
+		if ((algor_a->parameter 
+		     && ASN1_TYPE_get(algor_a->parameter) != V_ASN1_NULL)
+		    || (algor_b->parameter
+			&& ASN1_TYPE_get(algor_b->parameter) != V_ASN1_NULL))
+			goto err;
+		}
+
+	/* Compare octet strings. */
+	ret = len_a == (unsigned) ASN1_STRING_length(b->hashed_msg) &&
+		memcmp(imprint_a, ASN1_STRING_data(b->hashed_msg), len_a) == 0;
+ err:
+	if (!ret)
+		TSerr(TS_F_TS_CHECK_IMPRINTS, TS_R_MESSAGE_IMPRINT_MISMATCH);
+	return ret;
+	}
+
+static int TS_check_nonces(ASN1_INTEGER *a, TS_TST_INFO *tst_info)
+	{
+	ASN1_INTEGER *b = TS_TST_INFO_get_nonce(tst_info);
+
+	/* Error if nonce is missing. */
+	if (!b)
+		{
+		TSerr(TS_F_TS_CHECK_NONCES, TS_R_NONCE_NOT_RETURNED);
+		return 0;
+		}
+
+	/* No error if a nonce is returned without being requested. */
+	if (ASN1_INTEGER_cmp(a, b) != 0)
+		{
+		TSerr(TS_F_TS_CHECK_NONCES, TS_R_NONCE_MISMATCH);
+		return 0;
+		}
+
+	return 1;
+	}
+
+/* Check if the specified TSA name matches either the subject
+   or one of the subject alternative names of the TSA certificate. */
+static int TS_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer)
+	{
+	STACK_OF(GENERAL_NAME) *gen_names = NULL;
+	int idx = -1;
+	int found = 0;
+
+	/* Check the subject name first. */
+	if (tsa_name->type == GEN_DIRNAME 
+	    && X509_name_cmp(tsa_name->d.dirn, signer->cert_info->subject) == 0)
+		return 1;
+
+	/* Check all the alternative names. */
+	gen_names = X509_get_ext_d2i(signer, NID_subject_alt_name,
+				     NULL, &idx);
+	while (gen_names != NULL
+	       && !(found = TS_find_name(gen_names, tsa_name) >= 0))
+		{
+		/* Get the next subject alternative name,
+		   although there should be no more than one. */
+		GENERAL_NAMES_free(gen_names);
+		gen_names = X509_get_ext_d2i(signer, NID_subject_alt_name,
+					     NULL, &idx);
+		}
+	if (gen_names) GENERAL_NAMES_free(gen_names);
+	
+	return found;
+	}
+
+/* Returns 1 if name is in gen_names, 0 otherwise. */
+static int TS_find_name(STACK_OF(GENERAL_NAME) *gen_names, GENERAL_NAME *name)
+	{
+	int i, found;
+	for (i = 0, found = 0; !found && i < sk_GENERAL_NAME_num(gen_names);
+	     ++i)
+		{
+		GENERAL_NAME *current = sk_GENERAL_NAME_value(gen_names, i);
+		found = GENERAL_NAME_cmp(current, name) == 0;
+		}
+	return found ? i - 1 : -1;
+	}
Index: openssl/crypto/ts/ts_verify_ctx.c
diff -u /dev/null openssl/crypto/ts/ts_verify_ctx.c:1.1.10.1
--- /dev/null	Sun May  8 14:38:24 2005
+++ openssl/crypto/ts/ts_verify_ctx.c	Sun May  8 14:24:08 2005
@@ -0,0 +1,160 @@
+/* crypto/ts/ts_verify_ctx.c */
+/* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL
+ * project 2003.
+ */
+/* ====================================================================
+ * Copyright (c) 2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <assert.h>
+#include "cryptlib.h"
+#include <openssl/objects.h>
+#include <openssl/ts.h>
+
+TS_VERIFY_CTX *TS_VERIFY_CTX_new(void)
+	{
+	TS_VERIFY_CTX *ctx = 
+		(TS_VERIFY_CTX *) OPENSSL_malloc(sizeof(TS_VERIFY_CTX));
+	if (ctx)
+		memset(ctx, 0, sizeof(TS_VERIFY_CTX));
+	else
+		TSerr(TS_F_TS_VERIFY_CTX_NEW, ERR_R_MALLOC_FAILURE);
+	return ctx;
+	}
+
+void TS_VERIFY_CTX_init(TS_VERIFY_CTX *ctx)
+	{
+	assert(ctx != NULL);
+	memset(ctx, 0, sizeof(TS_VERIFY_CTX));
+	}
+
+void TS_VERIFY_CTX_free(TS_VERIFY_CTX *ctx)
+	{
+	if (!ctx) return;
+
+	TS_VERIFY_CTX_cleanup(ctx);
+	OPENSSL_free(ctx);
+	}
+
+void TS_VERIFY_CTX_cleanup(TS_VERIFY_CTX *ctx)
+	{
+	if (!ctx) return;
+
+	X509_STORE_free(ctx->store);
+	sk_X509_pop_free(ctx->certs, X509_free);
+
+	ASN1_OBJECT_free(ctx->policy);
+
+	X509_ALGOR_free(ctx->md_alg);
+	OPENSSL_free(ctx->imprint);
+	
+	BIO_free_all(ctx->data);
+
+	ASN1_INTEGER_free(ctx->nonce);
+
+	GENERAL_NAME_free(ctx->tsa_name);
+
+	TS_VERIFY_CTX_init(ctx);
+	}
+
+TS_VERIFY_CTX *TS_REQ_to_TS_VERIFY_CTX(TS_REQ *req, TS_VERIFY_CTX *ctx)
+	{
+	TS_VERIFY_CTX *ret = ctx;
+	ASN1_OBJECT *policy;
+	TS_MSG_IMPRINT *imprint;
+	X509_ALGOR *md_alg;
+	ASN1_OCTET_STRING *msg;
+	ASN1_INTEGER *nonce;
+
+	assert(req != NULL);
+	if (ret)
+		TS_VERIFY_CTX_cleanup(ret);
+	else
+		if (!(ret = TS_VERIFY_CTX_new())) return NULL;
+
+	/* Setting flags. */
+	ret->flags = TS_VFY_ALL_IMPRINT & ~(TS_VFY_TSA_NAME | TS_VFY_SIGNATURE);
+
+	/* Setting policy. */
+	if ((policy = TS_REQ_get_policy_id(req)) != NULL)
+		{
+		if (!(ret->policy = OBJ_dup(policy))) goto err;
+		}
+	else
+		ret->flags &= ~TS_VFY_POLICY;
+
+	/* Setting md_alg, imprint and imprint_len. */
+	imprint = TS_REQ_get_msg_imprint(req);
+	md_alg = TS_MSG_IMPRINT_get_algo(imprint);
+	if (!(ret->md_alg = X509_ALGOR_dup(md_alg))) goto err;
+	msg = TS_MSG_IMPRINT_get_msg(imprint);
+	ret->imprint_len = ASN1_STRING_length(msg);
+	if (!(ret->imprint = OPENSSL_malloc(ret->imprint_len))) goto err;
+	memcpy(ret->imprint, ASN1_STRING_data(msg), ret->imprint_len);
+
+	/* Setting nonce. */
+	if ((nonce = TS_REQ_get_nonce(req)) != NULL)
+		{
+		if (!(ret->nonce = ASN1_INTEGER_dup(nonce))) goto err;
+		}
+	else
+		ret->flags &= ~TS_VFY_NONCE;
+
+	return ret;
+ err:
+	if (ctx)
+		TS_VERIFY_CTX_cleanup(ctx);
+	else
+		TS_VERIFY_CTX_free(ret);
+	return NULL;
+	}
Index: openssl/crypto/ui/ui.h
diff -u openssl/crypto/ui/ui.h:1.1.1.1 openssl/crypto/ui/ui.h:1.1.1.1.14.1
--- openssl/crypto/ui/ui.h:1.1.1.1	Fri Jan 17 23:08:06 2003
+++ openssl/crypto/ui/ui.h	Sun May  8 14:24:08 2005
@@ -359,26 +359,25 @@
 /* Error codes for the UI functions. */
 
 /* Function codes. */
-#define UI_F_GENERAL_ALLOCATE_BOOLEAN			 108
-#define UI_F_GENERAL_ALLOCATE_PROMPT			 109
-#define UI_F_GENERAL_ALLOCATE_STRING			 100
-#define UI_F_UI_CTRL					 111
-#define UI_F_UI_DUP_ERROR_STRING			 101
-#define UI_F_UI_DUP_INFO_STRING				 102
-#define UI_F_UI_DUP_INPUT_BOOLEAN			 110
-#define UI_F_UI_DUP_INPUT_STRING			 103
-#define UI_F_UI_DUP_VERIFY_STRING			 106
-#define UI_F_UI_GET0_RESULT				 107
-#define UI_F_UI_NEW_METHOD				 104
-#define UI_F_UI_SET_RESULT				 105
+#define UI_F_GENERAL_ALLOCATE_BOOLEAN			 100
+#define UI_F_GENERAL_ALLOCATE_PROMPT			 101
+#define UI_F_UI_CTRL					 102
+#define UI_F_UI_DUP_ERROR_STRING			 103
+#define UI_F_UI_DUP_INFO_STRING				 104
+#define UI_F_UI_DUP_INPUT_BOOLEAN			 105
+#define UI_F_UI_DUP_INPUT_STRING			 106
+#define UI_F_UI_DUP_VERIFY_STRING			 107
+#define UI_F_UI_GET0_RESULT				 108
+#define UI_F_UI_NEW_METHOD				 109
+#define UI_F_UI_SET_RESULT				 110
 
 /* Reason codes. */
-#define UI_R_COMMON_OK_AND_CANCEL_CHARACTERS		 104
-#define UI_R_INDEX_TOO_LARGE				 102
-#define UI_R_INDEX_TOO_SMALL				 103
-#define UI_R_NO_RESULT_BUFFER				 105
-#define UI_R_RESULT_TOO_LARGE				 100
-#define UI_R_RESULT_TOO_SMALL				 101
+#define UI_R_COMMON_OK_AND_CANCEL_CHARACTERS		 100
+#define UI_R_INDEX_TOO_LARGE				 101
+#define UI_R_INDEX_TOO_SMALL				 102
+#define UI_R_NO_RESULT_BUFFER				 103
+#define UI_R_RESULT_TOO_LARGE				 104
+#define UI_R_RESULT_TOO_SMALL				 105
 #define UI_R_UNKNOWN_CONTROL_COMMAND			 106
 
 #ifdef  __cplusplus
Index: openssl/crypto/ui/ui_err.c
diff -u openssl/crypto/ui/ui_err.c:1.1.1.1 openssl/crypto/ui/ui_err.c:1.1.1.1.14.1
--- openssl/crypto/ui/ui_err.c:1.1.1.1	Fri Jan 17 23:08:06 2003
+++ openssl/crypto/ui/ui_err.c	Sun May  8 14:24:08 2005
@@ -1,6 +1,6 @@
 /* crypto/ui/ui_err.c */
 /* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -68,7 +68,6 @@
 	{
 {ERR_PACK(0,UI_F_GENERAL_ALLOCATE_BOOLEAN,0),	"GENERAL_ALLOCATE_BOOLEAN"},
 {ERR_PACK(0,UI_F_GENERAL_ALLOCATE_PROMPT,0),	"GENERAL_ALLOCATE_PROMPT"},
-{ERR_PACK(0,UI_F_GENERAL_ALLOCATE_STRING,0),	"GENERAL_ALLOCATE_STRING"},
 {ERR_PACK(0,UI_F_UI_CTRL,0),	"UI_ctrl"},
 {ERR_PACK(0,UI_F_UI_DUP_ERROR_STRING,0),	"UI_dup_error_string"},
 {ERR_PACK(0,UI_F_UI_DUP_INFO_STRING,0),	"UI_dup_info_string"},
Index: openssl/crypto/x509/x509.h
diff -u openssl/crypto/x509/x509.h:1.1.1.5 openssl/crypto/x509/x509.h:1.1.1.5.2.1
--- openssl/crypto/x509/x509.h:1.1.1.5	Sun May  8 13:20:03 2005
+++ openssl/crypto/x509/x509.h	Sun May  8 14:24:08 2005
@@ -300,10 +300,11 @@
 #define X509_TRUST_OBJECT_SIGN	5
 #define X509_TRUST_OCSP_SIGN	6
 #define X509_TRUST_OCSP_REQUEST	7
+#define X509_TRUST_TSA		8
 
 /* Keep these up to date! */
 #define X509_TRUST_MIN		1
-#define X509_TRUST_MAX		7
+#define X509_TRUST_MAX		8
 
 
 /* trust_flags values */
@@ -1190,67 +1191,67 @@
 #define X509_F_BY_FILE_CTRL				 101
 #define X509_F_DIR_CTRL					 102
 #define X509_F_GET_CERT_BY_SUBJECT			 103
-#define X509_F_NETSCAPE_SPKI_B64_DECODE			 129
-#define X509_F_NETSCAPE_SPKI_B64_ENCODE			 130
-#define X509_F_X509V3_ADD_EXT				 104
-#define X509_F_X509_ADD_ATTR				 135
-#define X509_F_X509_ATTRIBUTE_CREATE_BY_NID		 136
-#define X509_F_X509_ATTRIBUTE_CREATE_BY_OBJ		 137
-#define X509_F_X509_ATTRIBUTE_CREATE_BY_TXT		 140
-#define X509_F_X509_ATTRIBUTE_GET0_DATA			 139
-#define X509_F_X509_ATTRIBUTE_SET1_DATA			 138
-#define X509_F_X509_CHECK_PRIVATE_KEY			 128
-#define X509_F_X509_EXTENSION_CREATE_BY_NID		 108
-#define X509_F_X509_EXTENSION_CREATE_BY_OBJ		 109
-#define X509_F_X509_GET_PUBKEY_PARAMETERS		 110
-#define X509_F_X509_LOAD_CERT_CRL_FILE			 132
-#define X509_F_X509_LOAD_CERT_FILE			 111
-#define X509_F_X509_LOAD_CRL_FILE			 112
-#define X509_F_X509_NAME_ADD_ENTRY			 113
-#define X509_F_X509_NAME_ENTRY_CREATE_BY_NID		 114
-#define X509_F_X509_NAME_ENTRY_CREATE_BY_TXT		 131
-#define X509_F_X509_NAME_ENTRY_SET_OBJECT		 115
-#define X509_F_X509_NAME_ONELINE			 116
-#define X509_F_X509_NAME_PRINT				 117
-#define X509_F_X509_PRINT_FP				 118
-#define X509_F_X509_PUBKEY_GET				 119
-#define X509_F_X509_PUBKEY_SET				 120
-#define X509_F_X509_REQ_PRINT				 121
-#define X509_F_X509_REQ_PRINT_FP			 122
-#define X509_F_X509_REQ_TO_X509				 123
-#define X509_F_X509_STORE_ADD_CERT			 124
-#define X509_F_X509_STORE_ADD_CRL			 125
-#define X509_F_X509_STORE_CTX_INIT			 143
-#define X509_F_X509_STORE_CTX_NEW			 142
-#define X509_F_X509_STORE_CTX_PURPOSE_INHERIT		 134
-#define X509_F_X509_TO_X509_REQ				 126
-#define X509_F_X509_TRUST_ADD				 133
-#define X509_F_X509_TRUST_SET				 141
-#define X509_F_X509_VERIFY_CERT				 127
+#define X509_F_NETSCAPE_SPKI_B64_DECODE			 104
+#define X509_F_NETSCAPE_SPKI_B64_ENCODE			 105
+#define X509_F_X509V3_ADD_EXT				 106
+#define X509_F_X509_ADD_ATTR				 107
+#define X509_F_X509_ATTRIBUTE_CREATE_BY_NID		 108
+#define X509_F_X509_ATTRIBUTE_CREATE_BY_OBJ		 109
+#define X509_F_X509_ATTRIBUTE_CREATE_BY_TXT		 110
+#define X509_F_X509_ATTRIBUTE_GET0_DATA			 111
+#define X509_F_X509_ATTRIBUTE_SET1_DATA			 112
+#define X509_F_X509_CHECK_PRIVATE_KEY			 113
+#define X509_F_X509_EXTENSION_CREATE_BY_NID		 114
+#define X509_F_X509_EXTENSION_CREATE_BY_OBJ		 115
+#define X509_F_X509_GET_PUBKEY_PARAMETERS		 116
+#define X509_F_X509_LOAD_CERT_CRL_FILE			 117
+#define X509_F_X509_LOAD_CERT_FILE			 118
+#define X509_F_X509_LOAD_CRL_FILE			 119
+#define X509_F_X509_NAME_ADD_ENTRY			 120
+#define X509_F_X509_NAME_ENTRY_CREATE_BY_NID		 121
+#define X509_F_X509_NAME_ENTRY_CREATE_BY_TXT		 122
+#define X509_F_X509_NAME_ENTRY_SET_OBJECT		 123
+#define X509_F_X509_NAME_ONELINE			 124
+#define X509_F_X509_NAME_PRINT				 125
+#define X509_F_X509_PRINT_FP				 126
+#define X509_F_X509_PUBKEY_GET				 127
+#define X509_F_X509_PUBKEY_SET				 128
+#define X509_F_X509_REQ_PRINT				 129
+#define X509_F_X509_REQ_PRINT_FP			 130
+#define X509_F_X509_REQ_TO_X509				 131
+#define X509_F_X509_STORE_ADD_CERT			 132
+#define X509_F_X509_STORE_ADD_CRL			 133
+#define X509_F_X509_STORE_CTX_INIT			 134
+#define X509_F_X509_STORE_CTX_NEW			 135
+#define X509_F_X509_STORE_CTX_PURPOSE_INHERIT		 136
+#define X509_F_X509_TO_X509_REQ				 137
+#define X509_F_X509_TRUST_ADD				 138
+#define X509_F_X509_TRUST_SET				 139
+#define X509_F_X509_VERIFY_CERT				 140
 
 /* Reason codes. */
 #define X509_R_BAD_X509_FILETYPE			 100
-#define X509_R_BASE64_DECODE_ERROR			 118
-#define X509_R_CANT_CHECK_DH_KEY			 114
-#define X509_R_CERT_ALREADY_IN_HASH_TABLE		 101
-#define X509_R_ERR_ASN1_LIB				 102
-#define X509_R_INVALID_DIRECTORY			 113
-#define X509_R_INVALID_FIELD_NAME			 119
-#define X509_R_INVALID_TRUST				 123
-#define X509_R_KEY_TYPE_MISMATCH			 115
-#define X509_R_KEY_VALUES_MISMATCH			 116
-#define X509_R_LOADING_CERT_DIR				 103
-#define X509_R_LOADING_DEFAULTS				 104
-#define X509_R_NO_CERT_SET_FOR_US_TO_VERIFY		 105
-#define X509_R_SHOULD_RETRY				 106
-#define X509_R_UNABLE_TO_FIND_PARAMETERS_IN_CHAIN	 107
-#define X509_R_UNABLE_TO_GET_CERTS_PUBLIC_KEY		 108
-#define X509_R_UNKNOWN_KEY_TYPE				 117
-#define X509_R_UNKNOWN_NID				 109
-#define X509_R_UNKNOWN_PURPOSE_ID			 121
-#define X509_R_UNKNOWN_TRUST_ID				 120
-#define X509_R_UNSUPPORTED_ALGORITHM			 111
-#define X509_R_WRONG_LOOKUP_TYPE			 112
+#define X509_R_BASE64_DECODE_ERROR			 101
+#define X509_R_CANT_CHECK_DH_KEY			 102
+#define X509_R_CERT_ALREADY_IN_HASH_TABLE		 103
+#define X509_R_ERR_ASN1_LIB				 104
+#define X509_R_INVALID_DIRECTORY			 105
+#define X509_R_INVALID_FIELD_NAME			 106
+#define X509_R_INVALID_TRUST				 107
+#define X509_R_KEY_TYPE_MISMATCH			 108
+#define X509_R_KEY_VALUES_MISMATCH			 109
+#define X509_R_LOADING_CERT_DIR				 110
+#define X509_R_LOADING_DEFAULTS				 111
+#define X509_R_NO_CERT_SET_FOR_US_TO_VERIFY		 112
+#define X509_R_SHOULD_RETRY				 113
+#define X509_R_UNABLE_TO_FIND_PARAMETERS_IN_CHAIN	 114
+#define X509_R_UNABLE_TO_GET_CERTS_PUBLIC_KEY		 115
+#define X509_R_UNKNOWN_KEY_TYPE				 116
+#define X509_R_UNKNOWN_NID				 117
+#define X509_R_UNKNOWN_PURPOSE_ID			 118
+#define X509_R_UNKNOWN_TRUST_ID				 119
+#define X509_R_UNSUPPORTED_ALGORITHM			 120
+#define X509_R_WRONG_LOOKUP_TYPE			 121
 #define X509_R_WRONG_TYPE				 122
 
 #ifdef  __cplusplus
Index: openssl/crypto/x509/x509_err.c
diff -u openssl/crypto/x509/x509_err.c:1.1.1.2 openssl/crypto/x509/x509_err.c:1.1.1.2.14.1
--- openssl/crypto/x509/x509_err.c:1.1.1.2	Fri Jan 17 23:08:08 2003
+++ openssl/crypto/x509/x509_err.c	Sun May  8 14:24:08 2005
@@ -1,6 +1,6 @@
 /* crypto/x509/x509_err.c */
 /* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
Index: openssl/crypto/x509/x509_trs.c
diff -u openssl/crypto/x509/x509_trs.c:1.1.1.3 openssl/crypto/x509/x509_trs.c:1.1.1.3.8.1
--- openssl/crypto/x509/x509_trs.c:1.1.1.3	Wed Oct  8 12:36:03 2003
+++ openssl/crypto/x509/x509_trs.c	Sun May  8 14:24:08 2005
@@ -84,7 +84,8 @@
 {X509_TRUST_EMAIL, 0, trust_1oidany, "S/MIME email", NID_email_protect, NULL},
 {X509_TRUST_OBJECT_SIGN, 0, trust_1oidany, "Object Signer", NID_code_sign, NULL},
 {X509_TRUST_OCSP_SIGN, 0, trust_1oid, "OCSP responder", NID_OCSP_sign, NULL},
-{X509_TRUST_OCSP_REQUEST, 0, trust_1oid, "OCSP request", NID_ad_OCSP, NULL}
+{X509_TRUST_OCSP_REQUEST, 0, trust_1oid, "OCSP request", NID_ad_OCSP, NULL},
+{X509_TRUST_TSA, 0, trust_1oidany, "TSA server", NID_time_stamp, NULL}
 };
 
 #define X509_TRUST_COUNT	(sizeof(trstandard)/sizeof(X509_TRUST))
Index: openssl/crypto/x509v3/v3_genn.c
diff -u openssl/crypto/x509v3/v3_genn.c:1.1.1.2 openssl/crypto/x509v3/v3_genn.c:1.1.1.2.14.1
--- openssl/crypto/x509v3/v3_genn.c:1.1.1.2	Fri Jan 17 23:08:09 2003
+++ openssl/crypto/x509v3/v3_genn.c	Sun May  8 14:24:08 2005
@@ -99,3 +99,62 @@
 ASN1_ITEM_TEMPLATE_END(GENERAL_NAMES)
 
 IMPLEMENT_ASN1_FUNCTIONS(GENERAL_NAMES)
+
+GENERAL_NAME *GENERAL_NAME_dup(GENERAL_NAME *a)
+	{
+	return (GENERAL_NAME *) ASN1_dup((int (*)()) i2d_GENERAL_NAME,
+					 (char *(*)()) d2i_GENERAL_NAME,
+					 (char *) a);
+	}
+
+/* Returns 0 if they are equal, != 0 otherwise. */
+int GENERAL_NAME_cmp(GENERAL_NAME *a, GENERAL_NAME *b)
+	{
+	int result = -1;
+
+	if (!a || !b || a->type != b->type) return -1;
+	switch(a->type)
+		{
+	case GEN_X400:
+	case GEN_EDIPARTY:
+		result = ASN1_TYPE_cmp(a->d.other, b->d.other);
+		break;
+
+	case GEN_OTHERNAME:
+		result = OTHERNAME_cmp(a->d.otherName, b->d.otherName);
+		break;
+
+	case GEN_EMAIL:
+	case GEN_DNS:
+	case GEN_URI:
+		result = ASN1_STRING_cmp(a->d.ia5, b->d.ia5);
+		break;
+
+	case GEN_DIRNAME:
+		result = X509_NAME_cmp(a->d.dirn, b->d.dirn);
+		break;
+
+	case GEN_IPADD:
+		result = ASN1_OCTET_STRING_cmp(a->d.ip, b->d.ip);
+		break;
+	
+	case GEN_RID:
+		result = OBJ_cmp(a->d.rid, b->d.rid);
+		break;
+		}
+	return result;
+	}
+
+/* Returns 0 if they are equal, != 0 otherwise. */
+int OTHERNAME_cmp(OTHERNAME *a, OTHERNAME *b)
+	{
+	int result = -1;
+
+	if (!a || !b) return -1;
+	/* Check their type first. */
+	if ((result = OBJ_cmp(a->type_id, b->type_id)) != 0)
+		return result;
+	/* Check the value. */
+	result = ASN1_TYPE_cmp(a->value, b->value);
+	return result;
+	}
Index: openssl/crypto/x509v3/v3_purp.c
diff -u openssl/crypto/x509v3/v3_purp.c:1.1.1.5 openssl/crypto/x509v3/v3_purp.c:1.1.1.5.2.1
--- openssl/crypto/x509v3/v3_purp.c:1.1.1.5	Sun May  8 13:20:05 2005
+++ openssl/crypto/x509v3/v3_purp.c	Sun May  8 14:24:08 2005
@@ -71,6 +71,7 @@
 static int check_purpose_smime_sign(const X509_PURPOSE *xp, const X509 *x, int ca);
 static int check_purpose_smime_encrypt(const X509_PURPOSE *xp, const X509 *x, int ca);
 static int check_purpose_crl_sign(const X509_PURPOSE *xp, const X509 *x, int ca);
+static int check_purpose_timestamp_sign(const X509_PURPOSE *xp, const X509 *x, int ca);
 static int no_check(const X509_PURPOSE *xp, const X509 *x, int ca);
 static int ocsp_helper(const X509_PURPOSE *xp, const X509 *x, int ca);
 
@@ -87,6 +88,7 @@
 	{X509_PURPOSE_CRL_SIGN, X509_TRUST_COMPAT, 0, check_purpose_crl_sign, "CRL signing", "crlsign", NULL},
 	{X509_PURPOSE_ANY, X509_TRUST_DEFAULT, 0, no_check, "Any Purpose", "any", NULL},
 	{X509_PURPOSE_OCSP_HELPER, X509_TRUST_COMPAT, 0, ocsp_helper, "OCSP helper", "ocsphelper", NULL},
+	{X509_PURPOSE_TIMESTAMP_SIGN, X509_TRUST_TSA, 0, check_purpose_timestamp_sign, "Time Stamp signing", "timestampsign", NULL},
 };
 
 #define X509_PURPOSE_COUNT (sizeof(xstandard)/sizeof(X509_PURPOSE))
@@ -578,6 +580,41 @@
 	return 1;
 }
 
+static int check_purpose_timestamp_sign(const X509_PURPOSE *xp, const X509 *x,
+					int ca)
+{
+	int i_ext;
+
+	/* If ca is true we must return if this is a valid CA certificate. */
+	if (ca) return check_ca(x);
+
+	/* 
+	 * Check the optional key usage field:
+	 * if Key Usage is present, it must be one of digitalSignature 
+	 * and/or nonRepudiation (other values are not consistent and shall
+	 * be rejected).
+	 */
+	if ((x->ex_flags & EXFLAG_KUSAGE)
+	    && ((x->ex_kusage & ~(KU_NON_REPUDIATION | KU_DIGITAL_SIGNATURE)) ||
+		!(x->ex_kusage & (KU_NON_REPUDIATION | KU_DIGITAL_SIGNATURE))))
+		return 0;
+
+	/* Only time stamp key usage is permitted and it's required. */
+	if (!(x->ex_flags & EXFLAG_XKUSAGE) || x->ex_xkusage != XKU_TIMESTAMP)
+		return 0;
+
+	/* Extended Key Usage MUST be critical */
+	i_ext = X509_get_ext_by_NID((X509 *) x, NID_ext_key_usage, 0);
+	if (i_ext >= 0)
+		{
+		X509_EXTENSION *ext = X509_get_ext((X509 *) x, i_ext);
+		if (!X509_EXTENSION_get_critical(ext))
+			return 0;
+		}
+
+	return 1;
+}
+
 static int no_check(const X509_PURPOSE *xp, const X509 *x, int ca)
 {
 	return 1;
Index: openssl/crypto/x509v3/v3_utl.c
diff -u openssl/crypto/x509v3/v3_utl.c:1.1.1.2 openssl/crypto/x509v3/v3_utl.c:1.1.1.2.14.1
--- openssl/crypto/x509v3/v3_utl.c:1.1.1.2	Fri Jan 17 23:08:09 2003
+++ openssl/crypto/x509v3/v3_utl.c	Sun May  8 14:24:08 2005
@@ -100,6 +100,19 @@
     return X509V3_add_value(name,(const char *)value,extlist);
     }
 
+/* New function for CONF_VALUE. */
+
+CONF_VALUE *X509V3_conf_new()
+	{
+	CONF_VALUE *v = (CONF_VALUE *) OPENSSL_malloc(sizeof(CONF_VALUE));
+	if (!v)
+		{
+		v->section = v->name = v->value = NULL;
+		}
+
+	return v;
+	}
+
 /* Free function for STACK_OF(CONF_VALUE) */
 
 void X509V3_conf_free(CONF_VALUE *conf)
Index: openssl/crypto/x509v3/x509v3.h
diff -u openssl/crypto/x509v3/x509v3.h:1.1.1.4 openssl/crypto/x509v3/x509v3.h:1.1.1.4.2.1
--- openssl/crypto/x509v3/x509v3.h:1.1.1.4	Sun May  8 13:20:05 2005
+++ openssl/crypto/x509v3/x509v3.h	Sun May  8 14:24:08 2005
@@ -394,9 +394,10 @@
 #define X509_PURPOSE_CRL_SIGN		6
 #define X509_PURPOSE_ANY		7
 #define X509_PURPOSE_OCSP_HELPER	8
+#define X509_PURPOSE_TIMESTAMP_SIGN	9
 
 #define X509_PURPOSE_MIN		1
-#define X509_PURPOSE_MAX		8
+#define X509_PURPOSE_MAX		9
 
 /* Flags for X509V3_EXT_print() */
 
@@ -441,6 +442,9 @@
 DECLARE_ASN1_FUNCTIONS(PKEY_USAGE_PERIOD)
 
 DECLARE_ASN1_FUNCTIONS(GENERAL_NAME)
+GENERAL_NAME *GENERAL_NAME_dup(GENERAL_NAME *a);
+int GENERAL_NAME_cmp(GENERAL_NAME *a, GENERAL_NAME *b);
+
 
 STACK_OF(CONF_VALUE) *i2v_GENERAL_NAME(X509V3_EXT_METHOD *method, GENERAL_NAME *gen, STACK_OF(CONF_VALUE) *ret);
 int GENERAL_NAME_print(BIO *out, GENERAL_NAME *gen);
@@ -454,6 +458,7 @@
 
 DECLARE_ASN1_FUNCTIONS(OTHERNAME)
 DECLARE_ASN1_FUNCTIONS(EDIPARTYNAME)
+int OTHERNAME_cmp(OTHERNAME *a, OTHERNAME *b);
 
 char *i2s_ASN1_OCTET_STRING(X509V3_EXT_METHOD *method, ASN1_OCTET_STRING *ia5);
 ASN1_OCTET_STRING *s2i_ASN1_OCTET_STRING(X509V3_EXT_METHOD *method, X509V3_CTX *ctx, char *str);
@@ -476,6 +481,7 @@
 
 #ifdef HEADER_CONF_H
 GENERAL_NAME *v2i_GENERAL_NAME(X509V3_EXT_METHOD *method, X509V3_CTX *ctx, CONF_VALUE *cnf);
+CONF_VALUE *X509V3_conf_new();
 void X509V3_conf_free(CONF_VALUE *val);
 
 X509_EXTENSION *X509V3_EXT_nconf_nid(CONF *conf, X509V3_CTX *ctx, int ext_nid, char *value);
Index: openssl/doc/standards.txt
diff -u openssl/doc/standards.txt:1.1.1.4 openssl/doc/standards.txt:1.1.1.4.2.1
--- openssl/doc/standards.txt:1.1.1.4	Sun May  8 13:19:54 2005
+++ openssl/doc/standards.txt	Sun May  8 14:24:08 2005
@@ -69,6 +69,10 @@
 3174 US Secure Hash Algorithm 1 (SHA1). D. Eastlake 3rd, P. Jones.
      September 2001. (Format: TXT=35525 bytes) (Status: INFORMATIONAL)
 
+3161 Internet X.509 Public Key Infrastructure, Time-Stamp Protocol (TSP)
+     C. Adams, P. Cain, D. Pinkas, R. Zuccherato. August 2001
+     (Status: PROPOSED STANDARD)
+
 3268 Advanced Encryption Standard (AES) Ciphersuites for Transport
      Layer Security (TLS). P. Chown. June 2002. (Format: TXT=13530 bytes)
      (Status: PROPOSED STANDARD)
Index: openssl/doc/apps/ts.pod
diff -u /dev/null openssl/doc/apps/ts.pod:1.1.20.1
--- /dev/null	Sun May  8 14:38:24 2005
+++ openssl/doc/apps/ts.pod	Sun May  8 14:24:08 2005
@@ -0,0 +1,609 @@
+=pod
+
+=head1 NAME
+
+ts - Time Stamping Authority tool (client/server)
+
+=head1 SYNOPSIS
+
+B<openssl> B<ts>
+B<-query>
+[B<-rand> file:file...]
+[B<-config> configfile]
+[B<-data> file_to_hash]
+[B<-digest> digest_bytes]
+[B<-md2>|B<-md4>|B<-md5>|B<-sha>|B<-sha1>|B<-mdc2>|B<-ripemd160>]
+[B<-policy> object_id]
+[B<-no_nonce>]
+[B<-cert>]
+[B<-in> request.tsq]
+[B<-out> request.tsq]
+[B<-text>]
+
+B<openssl> B<ts>
+B<-reply>
+[B<-config> configfile]
+[B<-section> tsa_section]
+[B<-queryfile> request.tsq]
+[B<-passin> password_src]
+[B<-signer> tsa_cert.pem]
+[B<-inkey> private.pem]
+[B<-chain> certs_file.pem]
+[B<-policy> object_id]
+[B<-in> response.tsr]
+[B<-token_in>]
+[B<-out> response.tsr]
+[B<-token_out>]
+[B<-text>]
+[B<-engine> id]
+
+B<openssl> B<ts>
+B<-verify>
+[B<-data> file_to_hash]
+[B<-digest> digest_bytes]
+[B<-queryfile> request.tsq]
+[B<-in> response.tsr]
+[B<-token_in>]
+[B<-CApath> trusted_cert_path]
+[B<-CAfile> trusted_certs.pem]
+[B<-untrusted> cert_file.pem]
+
+=head1 DESCRIPTION
+
+The B<ts> command is a basic Time Stamping Authority (TSA) client and server
+application as specified in RFC 3161 (Time-Stamp Protocol, TSP). A
+TSA can be part of a PKI deployment and its role is to provide long
+term proof of the existence of a certain datum before a particular
+time. Here is a brief description of the protocol:
+
+=over 4
+
+=item 1.
+
+The TSA client computes a one-way hash value for a data file and sends
+the hash to the TSA.
+
+=item 2.
+
+The TSA attaches the current date and time to the received hash value,
+signs them and sends the time stamp token back to the client. By
+creating this token the TSA certifies the existence of the original
+data file at the time of response generation.
+
+=item 3.
+
+The TSA client receives the time stamp token and verifies the
+signature on it. It also checks if the token contains the same hash
+value that it had sent to the TSA.
+
+=back
+
+There is one DER encoded protocol data unit defined for transporting a time
+stamp request to the TSA and one for sending the time stamp response
+back to the client. The B<ts> command has three main functions:
+creating a time stamp request based on a data file,
+creating a time stamp response based on a request, verifying if a
+response corresponds to a particular request or a data file.
+
+There is no support for sending the requests/responses automatically
+over HTTP or TCP yet as suggested in RFC 3161. The users must send the
+requests either by ftp or e-mail.
+
+=head1 OPTIONS
+
+=head2 Time Stamp Request generation
+
+The B<-query> switch can be used for creating and printing a time stamp
+request with the following options:
+
+=over 4
+
+=item B<-rand> file:file...
+
+The files containing random data for seeding the random number
+generator. Multiple files can be specified, the separator is B<;> for
+MS-Windows, B<,> for VMS and B<:> for all other platforms. (Optional)
+
+=item B<-config> configfile
+
+The configuration file to use, this option overrides the
+B<OPENSSL_CONF> environment variable. Only the OID section
+of the config file is used with the B<-query> command. (Optional)
+
+=item B<-data> file_to_hash
+
+The data file for which the time stamp request needs to be
+created. stdin is the default if neither the B<-data> nor the B<-digest>
+parameter is specified. (Optional)
+
+=item B<-digest> digest_bytes
+
+It is possible to specify the message imprint explicitly without the data
+file. The imprint must be specified in a hexadecimal format, two characters
+per byte, the bytes optionally separated by colons (e.g. 1A:F6:01:... or
+1AF601...). The number of bytes must match the message digest algorithm 
+in use. (Optional)
+
+=item B<-md2>|B<-md4>|B<-md5>|B<-sha>|B<-sha1>|B<-mdc2>|B<-ripemd160>
+
+The message digest to apply to the data file. The default is SHA-1. (Optional)
+
+=item B<-policy> object_id
+
+The policy that the client expects the TSA to use for creating the
+time stamp token. Either the dotted OID notation or OID names defined
+in the config file can be used. If no policy is requested the TSA will
+use its own default policy. (Optional)
+
+=item B<-no_nonce>
+
+No nonce is specified in the request if this option is
+given. Otherwise a 64 bit long pseudo-random none is
+included in the request. It is recommended to use nonce to
+protect against replay-attacks. (Optional)
+
+=item B<-cert>
+
+The TSA is expected to include its signing certificate in the
+response. (Optional)
+
+=item B<-in> request.tsq
+
+This option specifies a previously created time stamp request in DER
+format that will be printed into the output file. Useful when you need
+to examine the content of a request in human-readable
+
+format. (Optional)
+
+=item B<-out> request.tsq
+
+Name of the output file to which the request will be written. Default
+is stdout. (Optional)
+
+=item B<-text>
+
+If this option is specified the output is human-readable text format
+instead of DER. (Optional)
+
+=back
+
+=head2 Time Stamp Response generation
+
+A time stamp response (TimeStampResp) consists of a response status
+and the time stamp token itself (ContentInfo), if the token generation was
+successful. The B<-reply> command is for creating a time stamp
+response or time stamp token based on a request and printing the
+response/token in human-readable format. If B<-token_out> is not
+specified the output is always a time stamp response (TimeStampResp),
+otherwise it is a time stamp token (ContentInfo).
+
+=over 4
+
+=item B<-config> configfile
+
+The configuration file to use, this option overrides the
+B<OPENSSL_CONF> environment variable. See B<CONFIGURATION FILE
+OPTIONS> for configurable variables. (Optional)
+
+=item B<-section> tsa_section
+
+The name of the config file section conatining the settings for the
+response generation. If not specified the default TSA section is
+used, see B<CONFIGURATION FILE OPTIONS> for details. (Optional)
+
+=item B<-queryfile> request.tsq
+
+The name of the file containing a DER encoded time stamp request. (Optional)
+
+=item B<-passin> password_src
+
+Specifies the password source for the private key of the TSA. See
+B<PASS PHRASE ARGUMENTS> in L<openssl(1)|openssl(1)>. (Optional)
+
+=item B<-signer> tsa_cert.pem
+
+The signer certificate of the TSA in PEM format. The TSA signing
+certificate must have exactly one extended key usage assigned to it:
+timeStamping. The extended key usage must also be critical, otherwise
+the certificate is going to be refused. Overrides the B<signer_cert>
+variable of the config file. (Optional)
+
+=item B<-inkey> private.pem
+
+The signer private key of the TSA in PEM format. Overrides the
+B<signer_key> config file option. (Optional)
+
+=item B<-chain> certs_file.pem
+
+The collection of certificates in PEM format that will all
+be included in the response in addition to the signer certificate if
+the B<-cert> option was used for the request. This file is supposed to
+contain the certificate chain for the signer certificate from its
+issuer upwards. The B<-reply> command does not build a certificate
+chain automatically. (Optional)
+
+=item B<-policy> object_id
+
+The default policy to use for the response unless the client
+explicitly requires a particular TSA policy. The OID can be specified
+either in dotted notation or with its name. Overrides the
+B<default_policy> config file option. (Optional)
+
+=item B<-in> response.tsr
+
+Specifies a previously created time stamp response or time stamp token
+(if B<-token_in> is also specified) in DER format that will be written
+to the output file. This option does not require a request, it is
+useful e.g. when you need to examine the content of a response or
+token or you want to extract the time stamp token from a response. If
+the input is a token and the output is a time stamp response a default
+'granted' status info is added to the token. (Optional)
+
+=item B<-token_in>
+
+This flag can be used together with the B<-in> option and indicates
+that the input is a DER encoded time stamp token (ContentInfo) instead
+of a time stamp response (TimeStampResp). (Optional)
+
+=item B<-out> response.tsr
+
+The response is written to this file. The format and content of the
+file depends on other options (see B<-text>, B<-token_out>). The default is
+stdout. (Optional)
+
+=item B<-token_out>
+
+The output is a time stamp token (ContentInfo) instead of time stamp
+response (TimeStampResp). (Optional)
+
+=item B<-text>
+
+If this option is specified the output is human-readable text format
+instead of DER. (Optional)
+
+=item B<-engine> id
+
+Specifying an engine (by it's unique B<id> string) will cause B<ts>
+to attempt to obtain a functional reference to the specified engine,
+thus initialising it if needed. The engine will then be set as the default
+for all available algorithms. Default is builtin. (Optional)
+
+=back
+
+=head2 Time Stamp Response verification
+
+The B<-verify> command is for verifying if a time stamp response or time
+stamp token is valid and matches a particular time stamp request or
+data file. The B<-verify> command does not use the configuration file.
+
+=over 4
+
+=item B<-data> file_to_hash
+
+The response or token must be verified against file_to_hash. The file
+is hashed with the message digest algorithm specified in the token. 
+The B<-digest> and B<-queryfile> options must not be specified with this one.
+(Optional)
+
+=item B<-digest> digest_bytes
+
+The response or token must be verified against the message digest specified
+with this option. The number of bytes must match the message digest algorithm
+specified in the token. The B<-data> and B<-queryfile> options must not be
+specified with this one. (Optional)
+
+=item B<-queryfile> request.tsq
+
+The original time stamp request in DER format. The B<-data> and B<-digest>
+options must not be specified with this one. (Optional)
+
+=item B<-in> response.tsr
+
+The time stamp response that needs to be verified in DER format. (Mandatory)
+
+=item B<-token_in>
+
+This flag can be used together with the B<-in> option and indicates
+that the input is a DER encoded time stamp token (ContentInfo) instead
+of a time stamp response (TimeStampResp). (Optional)
+
+=item B<-CApath> trusted_cert_path
+
+The name of the directory containing the trused CA certificates of the
+client. See the similar option of L<verify(1)|verify(1)> for additional
+details. Either this option or B<-CAfile> must be specified. (Optional)
+
+
+=item B<-CAfile> trusted_certs.pem
+
+The name of the file containing a set of trusted self-signed CA 
+certificates in PEM format. See the similar option of 
+L<verify(1)|verify(1)> for additional details. Either this option 
+or B<-CApath> must be specified.
+(Optional)
+
+=item B<-untrusted> cert_file.pem
+
+Set of additional untrusted certificates in PEM format which may be
+needed when building the certificate chain for the TSA's signing
+certificate. This file must contain the TSA signing certificate and
+all intermediate CA certificates unless the response includes them.
+(Optional)
+
+=back
+
+=head1 CONFIGURATION FILE OPTIONS
+
+The B<-query> and B<-reply> commands make use of a configuration file
+defined by the B<OPENSSL_CONF> environment variable. See L<config(5)|config(5>
+for a general description of the syntax of the config file. The
+B<-query> command uses only the symbolic OID names section
+and it can work without it. However, the B<-reply> command needs the
+config file for its operation.
+
+When there is a command line switch equivalent of a variable the
+switch always overrides the settings in the config file.
+
+=over 4
+
+=item B<tsa> section, B<default_tsa>	
+
+This is the main section and it specifies the name of another section
+that contains all the options for the B<-reply> command. This default
+section can be overriden with the B<-section> command line switch. (Optional)
+
+=item B<oid_file>
+
+See L<ca(1)|ca(1)> for description. (Optional)
+
+=item B<oid_section>
+
+See L<ca(1)|ca(1)> for description. (Optional)
+
+=item B<RANDFILE>
+
+See L<ca(1)|ca(1)> for description. (Optional)
+
+=item B<serial>
+
+The name of the file containing the hexadecimal serial number of the
+last time stamp response created. This number is incremented by 1 for
+each response. If the file does not exit at the time of response
+generation a new file is created with serial number 1. (Mandatory)
+
+=item B<crypto_device>
+
+Specifies the OpenSSL engine that will be set as the default for 
+all available algorithms. The default value is builtin, you can specify 
+any other engines supported by OpenSSL (e.g. use chil for the NCipher HSM).
+(Optional)
+
+=item B<signer_cert>
+
+TSA signing certificate in PEM format. The same as the B<-signer>
+command line option. (Optional)
+
+=item B<certs>
+
+A file containing a set of PEM encoded certificates that need to be
+included in the response. The same as the B<-chain> command line
+option. (Optional)
+
+=item B<signer_key>
+
+The private key of the TSA in PEM format. The same as the B<-inkey>
+command line option. (Optional)
+
+=item B<default_policy>
+
+The default policy to use when the request does not mandate any
+policy. The same as the B<-policy> command line option. (Optional)
+
+=item B<other_policies>
+
+Comma separated list of policies that are also acceptable by the TSA
+and used only if the request explicitly specifies one of them. (Optional)
+
+=item B<digests>
+
+The list of message digest algorithms that the TSA accepts. At least
+one algorithm must be specified. (Mandatory)
+
+=item B<accuracy>
+
+The accuracy of the time source of the TSA in seconds, milliseconds
+and microseconds. E.g. secs:1, millisecs:500, microsecs:100. If any of
+the components is missing zero is assumed for that field. (Optional)
+
+=item B<clock_precision_digits>
+
+Specifies the maximum number of digits, which represent the fraction of 
+seconds, that  need to be included in the time field. The trailing zeroes
+must be removed from the time, so there might actually be fewer digits,
+or no fraction of seconds at all. Supported only on UNIX platforms.
+The maximum value is 6, default is 0.
+(Optional)
+
+=item B<ordering>
+
+If this option is yes the responses generated by this TSA can always
+be ordered, even if the time difference between two responses is less
+than the sum of their accuracies. Default is no. (Optional)
+
+=item B<tsa_name>
+
+Set this option to yes if the subject name of the TSA must be included in
+the TSA name field of the response. Default is no. (Optional)
+
+=item B<ess_cert_id_chain>
+
+The SignedData objects created by the TSA always contain the
+certificate identifier of the signing certificate in a signed
+attribute (see RFC 2634, Enhanced Security Services). If this option
+is set to yes and either the B<certs> variable or the B<-chain> option
+is specified then the certificate identifiers of the chain will also
+be included in the SigningCertificate signed attribute. If this
+variable is set to no, only the signing certificate identifier is
+included. Default is no. (Optional)
+
+=back
+
+=head1 ENVIRONMENT VARIABLES
+
+B<OPENSSL_CONF> contains the path of the configuration file and can be
+overriden by the B<-config> command line option.
+
+=head1 EXAMPLES
+
+All the examples below presume that B<OPENSSL_CONF> is set to a proper
+configuration file, e.g. the example configuration file 
+openssl/apps/openssl.cnf will do.
+
+=head2 Time Stamp Request
+
+To create a time stamp request for design1.txt with SHA-1 
+without nonce and policy and no certificate is required in the response:
+
+  openssl ts -query -data design1.txt -no_nonce \
+	-out design1.tsq
+
+To create a similar time stamp request with specifying the message imprint
+explicitly:
+
+  openssl ts -query -digest b7e5d3f93198b38379852f2c04e78d73abdd0f4b \
+	 -no_nonce -out design1.tsq
+
+To print the content of the previous request in human readable format:
+
+  openssl ts -query -in design1.tsq -text
+
+To create a time stamp request which includes the MD-5 digest 
+of design2.txt, requests the signer certificate and nonce,
+specifies a policy id (assuming the tsa_policy1 name is defined in the
+OID section of the config file):
+
+  openssl ts -query -data design2.txt -md5 \
+	-policy tsa_policy1 -cert -out design2.tsq
+
+=head2 Time Stamp Response
+
+Before generating a response a signing certificate must be created for
+the TSA that contains the B<timeStamping> critical extended key usage extension
+without any other key usage extensions. You can add the
+'extendedKeyUsage = critical,timeStamping' line to the user certificate section
+of the config file to generate a proper certificate. See L<req(1)|req(1)>,
+L<ca(1)|ca(1)>, L<x509(1)|x509(1)> for instructions. The examples
+below assume that cacert.pem contains the certificate of the CA,
+tsacert.pem is the signing certificate issued by cacert.pem and
+tsakey.pem is the private key of the TSA.
+
+To create a time stamp response for a request:
+
+  openssl ts -reply -queryfile design1.tsq -inkey tsakey.pem \
+	-signer tsacert.pem -out design1.tsr
+
+If you want to use the settings in the config file you could just write:
+
+  openssl ts -reply -queryfile design1.tsq -out design1.tsr
+
+To print a time stamp reply to stdout in human readable format:
+
+  openssl ts -reply -in design1.tsr -text
+
+To create a time stamp token instead of time stamp response:
+
+  openssl ts -reply -queryfile design1.tsq -out design1_token.der -token_out
+
+To print a time stamp token to stdout in human readable format:
+
+  openssl ts -reply -in design1_token.der -token_in -text -token_out
+
+To extract the time stamp token from a response:
+
+  openssl ts -reply -in design1.tsr -out design1_token.der -token_out
+
+To add 'granted' status info to a time stamp token thereby creating a
+valid response:
+
+  openssl ts -reply -in design1_token.der -token_in -out design1.tsr
+
+=head2 Time Stamp Verification
+
+To verify a time stamp reply against a request:
+
+  openssl ts -verify -queryfile design1.tsq -in design1.tsr \
+	-CAfile cacert.pem -untrusted tsacert.pem
+
+To verify a time stamp reply that includes the certificate chain:
+
+  openssl ts -verify -queryfile design2.tsq -in design2.tsr \
+	-CAfile cacert.pem
+
+To verify a time stamp token against the original data file:
+  openssl ts -verify -data design2.txt -in design2.tsr \
+	-CAfile cacert.pem
+
+To verify a time stamp token against a message imprint:
+  openssl ts -verify -digest b7e5d3f93198b38379852f2c04e78d73abdd0f4b \
+	 -in design2.tsr -CAfile cacert.pem
+
+You could also look at the 'test' directory for more examples.
+
+=head1 BUGS
+
+If you find any bugs or you have suggestions please write to
+Zoltan Glozik <zglozik@opentsa.org>. Known issues:
+
+=over 4
+
+=item * No support for time stamps over SMTP, though it is quite easy
+to implement an automatic e-mail based TSA with L<procmail(1)|procmail(1)> 
+and L<perl(1)|perl(1)>. HTTP server support is provided in the form of 
+a separate apache module. HTTP client support is provided by
+L<tsget(1)|tsget(1)>. Pure TCP/IP protocol is not supported.
+
+=item * The file containing the last serial number of the TSA is not
+locked when being read or written. This is a problem if more than one
+instance of L<openssl(1)|openssl(1)> is trying to create a time stamp
+response at the same time. This is not an issue when using the apache
+server module, it does proper locking.
+
+=item * Look for the FIXME word in the source files.
+
+=item * The source code should really be reviewed by somebody else, too.
+
+=item * More testing is needed, I have done only some basic tests (see
+test/testtsa).
+
+=back
+
+=cut
+
+=head1 AUTHOR
+
+=over 4
+
+=item * This patch kit was written by Zoltan Glozik
+<zglozik@opentsa.org> for the OpenTSA project. See
+http://www.opentsa.org/.
+
+=item * This product includes software developed by the OpenSSL
+Project for use in the OpenSSL Toolkit (http://www.OpenSSL.org/).
+
+=item * This product includes cryptographic software written by Eric
+Young (eay@cryptsoft.com).
+
+=item * This product includes software written by Tim Hudson
+(tjh@cryptsoft.com).
+
+=back
+
+=cut
+
+=head1 SEE ALSO
+
+L<tsget(1)|tsget(1)>, L<openssl(1)|openssl(1)>, L<req(1)|req(1)>, 
+L<x509(1)|x509(1)>, L<ca(1)|ca(1)>, L<genrsa(1)|genrsa(1)>, 
+L<config(5)|config(5)>
+
+=cut
Index: openssl/doc/apps/tsget.pod
diff -u /dev/null openssl/doc/apps/tsget.pod:1.1.16.1
--- /dev/null	Sun May  8 14:38:24 2005
+++ openssl/doc/apps/tsget.pod	Sun May  8 14:24:08 2005
@@ -0,0 +1,200 @@
+=pod
+
+=head1 NAME
+
+tsget - Time Stamping HTTP/HTTPS client
+
+=head1 SYNOPSIS
+
+B<tsget>
+B<-h> server_url
+[B<-e> extension]
+[B<-o> output]
+[B<-v>]
+[B<-d>]
+[B<-k> private_key.pem]
+[B<-p> key_password]
+[B<-c> client_cert.pem]
+[B<-C> CA_certs.pem]
+[B<-P> CA_path]
+[B<-r> file:file...]
+[B<-g> EGD_socket]
+[request]...
+
+=head1 DESCRIPTION
+
+The B<tsget> command can be used for sending a time stamp request, as
+specified in B<RFC 3161>, to a time stamp server over HTTP or HTTPS and storing
+the time stamp response in a file. This tool cannot be used for creating the
+requests and verifying responses, you can use the OpenSSL B<ts(1)> command to
+do that. B<tsget> can send several requests to the server without closing
+the TCP connection if more than one requests are specified on the command
+line.
+
+The tool sends the following HTTP request for each time stamp request:
+
+	POST url HTTP/1.1
+	User-Agent: OpenTSA tsget.pl/<version>
+	Host: <host>:<port>
+	Pragma: no-cache
+	Content-Type: application/timestamp-query
+	Accept: application/timestamp-reply
+	Content-Length: length of body
+
+	...binary request specified by the user...
+
+B<tsget> expects a response of type application/timestamp-reply, which is
+written to a file without any interpretation.
+
+=head1 OPTIONS
+
+=over 4
+
+=item B<-h> server_url
+
+The URL of the HTTP/HTTPS server listening for time stamp requests.
+
+=item B<-e> extension
+
+If the B<-o> option is not given this argument specifies the extension of the
+output files. The base name of the output file will be the same as those of
+the input files. Default extension is '.tsr'. (Optional)
+
+=item B<-o> output
+
+This option can be specified only when just one request is sent to the
+server. The time stamp response will be written to the given output file. '-'
+means standard output. In case of multiple time stamp requests or the absence
+of this argument the names of the output files will be derived from the names
+of the input files and the default or specified extension argument. (Optional)
+
+=item B<-v>
+
+The name of the currently processed request is printed on standard
+error. (Optional)
+
+=item B<-d>
+
+Switches on verbose mode for the underlying B<curl> library. You can see
+detailed debug messages for the connection. (Optional)
+
+=item B<-k> private_key.pem
+
+(HTTPS) In case of certificate-based client authentication over HTTPS
+<private_key.pem> must contain the private key of the user. The private key
+file can optionally be protected by a passphrase. The B<-c> option must also
+be specified. (Optional)
+
+=item B<-p> key_password
+
+(HTTPS) Specifies the passphrase for the private key specified by the B<-k>
+argument. If this option is omitted and the key is passphrase protected B<tsget>
+will ask for it. (Optional)
+
+=item B<-c> client_cert.pem
+
+(HTTPS) In case of certificate-based client authentication over HTTPS
+<client_cert.pem> must contain the X.509 certificate of the user.  The B<-k>
+option must also be specified. If this option is not specified no
+certificate-based client authentication will take place. (Optional)
+
+=item B<-C> CA_certs.pem
+
+(HTTPS) The trusted CA certificate store. The certificate chain of the peer's
+certificate must include one of the CA certificates specified in this file.
+Either option B<-C> or option B<-P> must be given in case of HTTPS. (Optional)
+
+=item B<-P> CA_path
+
+(HTTPS) The path containing the trusted CA certificates to verify the peer's
+certificate. The directory must be prepared with the B<c_rehash>
+OpenSSL utility. Either option B<-C> or option B<-P> must be given in case of
+HTTPS. (Optional)
+
+=item B<-rand> file:file...
+
+The files containing random data for seeding the random number
+generator. Multiple files can be specified, the separator is B<;> for
+MS-Windows, B<,> for VMS and B<:> for all other platforms. (Optional)
+
+=item B<-g> EGD_socket
+
+The name of an EGD socket to get random data from. (Optional)
+
+=item [request]...
+
+List of files containing B<RFC 3161> DER-encoded time stamp requests. If no
+requests are specifed only one request will be sent to the server and it will be
+read from the standard input. (Optional)
+
+=back
+
+=head1 ENVIRONMENT VARIABLES
+
+The B<TSGET> environment variable can optionally contain default
+arguments. The content of this variable is added to the list of command line
+arguments.
+
+=head1 EXAMPLES
+
+The examples below presume that B<file1.tsq> and B<file2.tsq> contain valid
+time stamp requests, tsa.opentsa.org listens at port 8080 for HTTP requests
+and at port 8443 for HTTPS requests, the TSA service is available at the /tsa
+absolute path.
+
+Get a time stamp response for file1.tsq over HTTP, output is written to 
+file1.tsr:
+	
+  tsget -h http://tsa.opentsa.org:8080/tsa file1.tsq
+
+Get a time stamp response for file1.tsq and file2.tsq over HTTP showing
+progress, output is written to file1.reply and file2.reply respectively:
+	
+  tsget -h http://tsa.opentsa.org:8080/tsa -v -e .reply \
+	file1.tsq file2.tsq
+
+Create a time stamp request, write it to file3.tsq, send it to the server and
+write the response to file3.tsr:
+	
+  openssl ts -query -data file3.txt -cert | tee file3.tsq \
+	| tsget -h http://tsa.opentsa.org:8080/tsa \
+	-o file3.tsr
+
+Get a time stamp response for file1.tsq over HTTPS without client
+authentication:
+	
+  tsget -h https://tsa.opentsa.org:8443/tsa \
+	-C cacerts.pem file1.tsq
+
+Get a time stamp response for file1.tsq over HTTPS with certificate-based
+client authentication (it will ask for the passphrase if client_key.pem is
+protected):
+
+  tsget -h https://tsa.opentsa.org:8443/tsa -C cacerts.pem \
+	-k client_key.pem -c client_cert.pem file1.tsq
+
+You can shorten the previous command line if you make use of the B<TSGET>
+environment variable. The following commands do the same as the previous
+example:
+
+  TSGET='-h https://tsa.opentsa.org:8443/tsa -C cacerts.pem \
+	-k client_key.pem -c client_cert.pem'
+  export TSGET
+  tsget file1.tsq
+
+=head1 BUGS
+
+If you find any bugs or you have suggestions please write to
+info@opentsa.org.
+
+=head1 AUTHOR
+
+This tool was written by Zoltan Glozik <zglozik@stones.com> for
+the OpenTSA project. See http://www.opentsa.org/.
+
+=head1 SEE ALSO
+
+L<openssl(1)|openssl(1)>, L<ts(1)|ts(1)>, L<curl(1)|curl(1)>, 
+B<RFC 3161>
+
+=cut
Index: openssl/fips/fips.h
diff -u openssl/fips/fips.h:1.1.1.1 openssl/fips/fips.h:1.1.1.1.4.1
--- openssl/fips/fips.h:1.1.1.1	Mon Nov  8 16:33:02 2004
+++ openssl/fips/fips.h	Sun May  8 14:24:08 2005
@@ -90,6 +90,7 @@
 /* Error codes for the FIPS functions. */
 
 /* Function codes. */
+#define FIPS_F_DH_GENERATE_PARAMETERS			 117
 #define FIPS_F_DSA_DO_SIGN				 111
 #define FIPS_F_DSA_DO_VERIFY				 112
 #define FIPS_F_DSA_GENERATE_PARAMETERS			 110
@@ -104,7 +105,6 @@
 #define FIPS_F_FIPS_SELFTEST_RSA			 108
 #define FIPS_F_FIPS_SELFTEST_SHA1			 103
 #define FIPS_F_HASH_FINAL				 100
-#define FIPS_F_DH_GENERATE_PARAMETERS			 117
 #define FIPS_F_RSA_EAY_PUBLIC_ENCRYPT			 114
 #define FIPS_F_RSA_GENERATE_KEY				 113
 #define FIPS_F_SSLEAY_RAND_BYTES			 101
Index: openssl/fips/fips_err.h
diff -u openssl/fips/fips_err.h:1.1.1.1 openssl/fips/fips_err.h:1.1.1.1.4.1
--- openssl/fips/fips_err.h:1.1.1.1	Mon Nov  8 16:33:02 2004
+++ openssl/fips/fips_err.h	Sun May  8 14:24:08 2005
@@ -1,6 +1,6 @@
 /* fips/fips_err.h */
 /* ====================================================================
- * Copyright (c) 1999-2003 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -66,6 +66,7 @@
 #ifndef OPENSSL_NO_ERR
 static ERR_STRING_DATA FIPS_str_functs[]=
 	{
+{ERR_PACK(0,FIPS_F_DH_GENERATE_PARAMETERS,0),	"DH_generate_parameters"},
 {ERR_PACK(0,FIPS_F_DSA_DO_SIGN,0),	"DSA_do_sign"},
 {ERR_PACK(0,FIPS_F_DSA_DO_VERIFY,0),	"DSA_do_verify"},
 {ERR_PACK(0,FIPS_F_DSA_GENERATE_PARAMETERS,0),	"DSA_generate_parameters"},
@@ -80,7 +81,6 @@
 {ERR_PACK(0,FIPS_F_FIPS_SELFTEST_RSA,0),	"FIPS_selftest_rsa"},
 {ERR_PACK(0,FIPS_F_FIPS_SELFTEST_SHA1,0),	"FIPS_selftest_sha1"},
 {ERR_PACK(0,FIPS_F_HASH_FINAL,0),	"HASH_FINAL"},
-{ERR_PACK(0,FIPS_F_DH_GENERATE_PARAMETERS,0),	"DH_generate_parameters"},
 {ERR_PACK(0,FIPS_F_RSA_EAY_PUBLIC_ENCRYPT,0),	"RSA_EAY_PUBLIC_ENCRYPT"},
 {ERR_PACK(0,FIPS_F_RSA_GENERATE_KEY,0),	"RSA_generate_key"},
 {ERR_PACK(0,FIPS_F_SSLEAY_RAND_BYTES,0),	"SSLEAY_RAND_BYTES"},
Index: openssl/test/CAtsa.cnf
diff -u /dev/null openssl/test/CAtsa.cnf:1.1.20.1
--- /dev/null	Sun May  8 14:38:24 2005
+++ openssl/test/CAtsa.cnf	Sun May  8 14:24:08 2005
@@ -0,0 +1,174 @@
+
+#
+# This config is used by the Time Stamp Authority tests.
+#
+
+# This definition stops the following lines choking if HOME isn't
+# defined.
+HOME			= .
+RANDFILE		= $ENV::HOME/.rnd
+
+# Extra OBJECT IDENTIFIER info:
+oid_section		= new_oids
+
+[ new_oids ]
+
+# Policies used by the TSA tests.
+tsa_policy1 = 1.2.3.4.1
+tsa_policy2 = 1.2.3.4.5.6
+tsa_policy3 = 1.2.3.4.5.7
+
+#----------------------------------------------------------------------
+[ ca ]
+default_ca	= CA_default		# The default ca section
+
+[ CA_default ]
+
+dir		= ./demoCA
+certs		= $dir/certs		# Where the issued certs are kept
+database	= $dir/index.txt	# database index file.
+new_certs_dir	= $dir/newcerts		# default place for new certs.
+
+certificate	= $dir/cacert.pem 	# The CA certificate
+serial		= $dir/serial 		# The current serial number
+private_key	= $dir/private/cakey.pem# The private key
+RANDFILE	= $dir/private/.rand	# private random number file
+
+x509_extensions	= usr_cert		# The extentions to add to the cert
+
+default_days	= 365			# how long to certify for
+default_md	= sha1			# which md to use.
+preserve	= no			# keep passed DN ordering
+
+policy		= policy_match
+
+# For the CA policy
+[ policy_match ]
+countryName		= supplied
+stateOrProvinceName	= supplied
+organizationName	= supplied
+organizationalUnitName	= optional
+commonName		= supplied
+emailAddress		= optional
+
+#----------------------------------------------------------------------
+[ req ]
+default_bits		= 1024
+default_md		= sha1
+distinguished_name	= req_distinguished_name
+encrypt_rsa_key		= no
+# attributes		= req_attributes
+x509_extensions	= v3_ca	# The extentions to add to the self signed cert
+
+string_mask = nombstr
+
+[ req_distinguished_name ]
+countryName			= Country Name (2 letter code)
+countryName_default		= HU
+countryName_min			= 2
+countryName_max			= 2
+
+stateOrProvinceName		= State or Province Name (full name)
+stateOrProvinceName_default	= 
+
+localityName			= Locality Name (eg, city)
+
+0.organizationName		= Organization Name (eg, company)
+0.organizationName_default	= 
+
+commonName			= Common Name (eg, YOUR name)
+commonName_max			= 64
+
+[ req_attributes ]
+challengePassword		= A challenge password
+challengePassword_min		= 4
+challengePassword_max		= 20
+
+unstructuredName		= An optional company name
+
+[ tsa_cert ]
+
+# TSA server cert is not a CA cert.
+basicConstraints=CA:FALSE
+
+# The following key usage flags are needed for TSA server certificates.
+keyUsage = nonRepudiation, digitalSignature
+extendedKeyUsage = critical,timeStamping
+
+# PKIX recommendations harmless if included in all certificates.
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer:always
+
+[ non_tsa_cert ]
+
+# This is not a CA cert and not a TSA cert, either (timeStamping usage missing)
+basicConstraints=CA:FALSE
+
+# The following key usage flags are needed for TSA server certificates.
+keyUsage = nonRepudiation, digitalSignature
+# timeStamping is not supported by this certificate
+# extendedKeyUsage = critical,timeStamping
+
+# PKIX recommendations harmless if included in all certificates.
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer:always
+
+[ v3_req ]
+
+# Extensions to add to a certificate request
+basicConstraints = CA:FALSE
+keyUsage = nonRepudiation, digitalSignature
+
+[ v3_ca ]
+
+# Extensions for a typical CA
+
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid:always,issuer:always
+basicConstraints = critical,CA:true
+keyUsage = cRLSign, keyCertSign
+
+#----------------------------------------------------------------------
+[ tsa ]
+
+default_tsa = tsa_config1	# the default TSA section
+
+[ tsa_config1 ]
+
+# These are used by the TSA reply generation only.
+dir		= .			# TSA root directory
+serial		= $dir/tsa_serial	# The current serial number (mandatory)
+signer_cert	= $dir/tsa_cert1.pem 	# The TSA signing certificate
+					# (optional)
+certs		= $dir/demoCA/cacert.pem# Certificate chain to include in reply
+					# (optional)
+signer_key	= $dir/tsa_key1.pem	# The TSA private key (optional)
+
+default_policy	= tsa_policy1		# Policy if request did not specify it
+					# (optional)
+other_policies	= tsa_policy2, tsa_policy3	# acceptable policies (optional)
+digests		= md5, sha1		# Acceptable message digests (mandatory)
+accuracy	= secs:1, millisecs:500, microsecs:100	# (optional)
+ordering		= yes	# Is ordering defined for timestamps?
+				# (optional, default: no)
+tsa_name		= yes	# Must the TSA name be included in the reply?
+				# (optional, default: no)
+ess_cert_id_chain	= yes	# Must the ESS cert id chain be included?
+				# (optional, default: no)
+
+[ tsa_config2 ]
+
+# This configuration uses a certificate which doesn't have timeStamping usage.
+# These are used by the TSA reply generation only.
+dir		= .			# TSA root directory
+serial		= $dir/tsa_serial	# The current serial number (mandatory)
+signer_cert	= $dir/tsa_cert2.pem 	# The TSA signing certificate
+					# (optional)
+certs		= $dir/demoCA/cacert.pem# Certificate chain to include in reply
+					# (optional)
+signer_key	= $dir/tsa_key2.pem	# The TSA private key (optional)
+
+default_policy	= tsa_policy1		# Policy if request did not specify it
+					# (optional)
+other_policies	= tsa_policy2, tsa_policy3	# acceptable policies (optional)
+digests		= md5, sha1		# Acceptable message digests (mandatory)
Index: openssl/test/Makefile
diff -u openssl/test/Makefile:1.1.1.2 openssl/test/Makefile:1.1.1.2.2.1
--- openssl/test/Makefile:1.1.1.2	Sun May  8 13:19:57 2005
+++ openssl/test/Makefile	Sun May  8 14:24:08 2005
@@ -130,7 +130,7 @@
 	test_rmd test_rc2 test_rc4 test_rc5 test_bf test_cast test_aes \
 	test_rand test_bn test_ec test_enc test_x509 test_rsa test_crl test_sid \
 	test_gen test_req test_pkcs7 test_verify test_dh test_dsa \
-	test_ss test_ca test_engine test_evp test_ssl
+	test_ss test_ca test_engine test_evp test_ssl test_tsa
 # temporarily removed
 # fips_test_aes
 
@@ -292,6 +292,13 @@
 #	@echo "test Rijndael"
 #	../util/shlib_wrap.sh ./$(AESTEST)
 
+test_tsa:
+	@if ../apps/openssl no-rsa; then \
+	  echo "skipping testtsa test -- requires RSA"; \
+	else \
+	  sh ./testtsa; \
+	fi
+
 lint:
 	lint -DLINT $(INCLUDES) $(SRC)>fluff
 
Index: openssl/test/testtsa
diff -u /dev/null openssl/test/testtsa:1.1.20.1
--- /dev/null	Sun May  8 14:38:24 2005
+++ openssl/test/testtsa	Sun May  8 14:24:08 2005
@@ -0,0 +1,234 @@
+#!/bin/sh
+
+#
+# A few very basic tests for the 'ts' time stamping authority command.
+#
+
+SH="/bin/sh"
+PATH=../../apps:$PATH
+export SH PATH
+
+OPENSSL_CONF="../CAtsa.cnf"
+export OPENSSL_CONF
+
+error () {
+
+    echo "ERROR DURING TSA TESTS!!!!!!!!!!!!!!!!" >&2
+    exit 1
+}
+
+setup_dir () {
+
+    rm -rf tsa 2>/dev/null
+    mkdir tsa
+    cd ./tsa
+}
+
+clean_up_dir () {
+
+    cd ..
+    rm -rf tsa
+}
+
+create_ca () {
+
+    echo "Creating a new CA for the TSA tests..."
+    /bin/rm -fr demoCA
+    $SH ../../apps/CA.sh -newca <<EOF
+
+HU
+Budapest
+Budapest
+Gov-CA Ltd.
+ca1
+EOF
+    test $? != 0 && error
+}
+
+create_tsa_cert () {
+
+    INDEX=$1
+    EXT=$2
+    openssl req -new -out tsa_req${INDEX}.pem -keyout tsa_key${INDEX}.pem <<EOF
+HU
+Budapest
+Buda
+Hun-TSA Ltd.
+tsa${INDEX}
+EOF
+    test $? != 0 && error
+
+    openssl ca -in tsa_req${INDEX}.pem -out tsa_cert${INDEX}.pem \
+	-extensions $EXT <<EOF
+y
+y
+EOF
+    test $? != 0 && error
+}
+
+print_request () {
+
+    openssl ts -query -in $1 -text
+}
+
+create_time_stamp_request1 () {
+
+    openssl ts -query -data ../testtsa -policy tsa_policy1 -cert -out req1.tsq
+    test $? != 0 && error
+}
+
+create_time_stamp_request2 () {
+
+    openssl ts -query -data ../testtsa -policy tsa_policy2 -no_nonce \
+	-out req2.tsq
+    test $? != 0 && error
+}
+
+create_time_stamp_request3 () {
+
+    openssl ts -query -data ../CAtsa.cnf -no_nonce -out req3.tsq
+    test $? != 0 && error
+}
+
+print_response () {
+
+    openssl ts -reply -in $1 -text
+    test $? != 0 && error
+}
+
+create_time_stamp_response () {
+
+    openssl ts -reply -section $3 -queryfile $1 -out $2
+    test $? != 0 && error
+}
+
+time_stamp_response_token_test () {
+
+    RESPONSE2=$2.copy.tsr
+    TOKEN_DER=$2.token.der
+    openssl ts -reply -in $2 -out $TOKEN_DER -token_out
+    test $? != 0 && error
+    openssl ts -reply -in $TOKEN_DER -token_in -out $RESPONSE2
+    test $? != 0 && error
+    cmp $RESPONSE2 $2
+    test $? != 0 && error
+    openssl ts -reply -in $2 -text -token_out
+    test $? != 0 && error
+    openssl ts -reply -in $TOKEN_DER -token_in -text -token_out
+    test $? != 0 && error
+    openssl ts -reply -queryfile $1 -text -token_out
+    test $? != 0 && error
+}
+
+verify_time_stamp_response () {
+
+    openssl ts -verify -queryfile $1 -in $2 -CAfile demoCA/cacert.pem \
+	-untrusted tsa_cert1.pem
+    test $? != 0 && error
+    openssl ts -verify -data $3 -in $2 -CAfile demoCA/cacert.pem \
+	-untrusted tsa_cert1.pem
+    test $? != 0 && error
+}
+
+verify_time_stamp_token () {
+
+    # create the token from the response first
+    openssl ts -reply -in $2 -out $2.token -token_out
+    test $? != 0 && error
+    openssl ts -verify -queryfile $1 -in $2.token -token_in \
+	-CAfile demoCA/cacert.pem -untrusted tsa_cert1.pem
+    test $? != 0 && error
+    openssl ts -verify -data $3 -in $2.token -token_in \
+	-CAfile demoCA/cacert.pem -untrusted tsa_cert1.pem
+    test $? != 0 && error
+}
+
+verify_time_stamp_response_fail () {
+
+    openssl ts -verify -queryfile $1 -in $2 -CAfile demoCA/cacert.pem \
+	-untrusted tsa_cert1.pem
+    # Checks if the verification failed, as it should have.
+    test $? == 0 && error
+}
+
+# main functions
+
+echo "Setting up TSA test directory..."
+setup_dir
+
+echo "Creating CA for TSA tests..."
+create_ca
+
+echo "Creating tsa_cert1.pem TSA server cert..."
+create_tsa_cert 1 tsa_cert
+
+echo "Creating tsa_cert2.pem non-TSA server cert..."
+create_tsa_cert 2 non_tsa_cert
+
+echo "Creating req1.req time stamp request for file testtsa..."
+create_time_stamp_request1
+
+echo "Printing req1.req..."
+print_request req1.tsq
+
+echo "Generating valid response for req1.req..."
+create_time_stamp_response req1.tsq resp1.tsr tsa_config1
+
+echo "Printing response..."
+print_response resp1.tsr
+
+echo "Verifying valid response..."
+verify_time_stamp_response req1.tsq resp1.tsr ../testtsa
+
+echo "Verifying valid token..."
+verify_time_stamp_token req1.tsq resp1.tsr ../testtsa
+
+# The tests below are commented out, because invalid signer certificates
+# can no longer be specified in the config file.
+
+# echo "Generating _invalid_ response for req1.req..."
+# create_time_stamp_response req1.tsq resp1_bad.tsr tsa_config2
+
+# echo "Printing response..."
+# print_response resp1_bad.tsr
+
+# echo "Verifying invalid response, it should fail..."
+# verify_time_stamp_response_fail req1.tsq resp1_bad.tsr
+
+echo "Creating req2.req time stamp request for file testtsa..."
+create_time_stamp_request2
+
+echo "Printing req2.req..."
+print_request req2.tsq
+
+echo "Generating valid response for req2.req..."
+create_time_stamp_response req2.tsq resp2.tsr tsa_config1
+
+echo "Checking '-token_in' and '-token_out' options with '-reply'..."
+time_stamp_response_token_test req2.tsq resp2.tsr
+
+echo "Printing response..."
+print_response resp2.tsr
+
+echo "Verifying valid response..."
+verify_time_stamp_response req2.tsq resp2.tsr ../testtsa
+
+echo "Verifying response against wrong request, it should fail..."
+verify_time_stamp_response_fail req1.tsq resp2.tsr
+
+echo "Verifying response against wrong request, it should fail..."
+verify_time_stamp_response_fail req2.tsq resp1.tsr
+
+echo "Creating req3.req time stamp request for file CAtsa.cnf..."
+create_time_stamp_request3
+
+echo "Printing req3.req..."
+print_request req3.tsq
+
+echo "Verifying response against wrong request, it should fail..."
+verify_time_stamp_response_fail req3.tsq resp1.tsr
+
+echo "Cleaning up..."
+clean_up_dir
+
+exit 0
Index: openssl/util/libeay.num
diff -u openssl/util/libeay.num:1.1.1.7 openssl/util/libeay.num:1.1.1.7.2.1
--- openssl/util/libeay.num:1.1.1.7	Sun May  8 13:19:58 2005
+++ openssl/util/libeay.num	Sun May  8 14:24:08 2005
@@ -1,14 +1,5 @@
-SSLeay                                  1	EXIST::FUNCTION:
-SSLeay_version                          2	EXIST::FUNCTION:
-ASN1_BIT_STRING_asn1_meth               3	EXIST::FUNCTION:
-ASN1_HEADER_free                        4	EXIST::FUNCTION:
-ASN1_HEADER_new                         5	EXIST::FUNCTION:
-ASN1_IA5STRING_asn1_meth                6	EXIST::FUNCTION:
-ASN1_INTEGER_get                        7	EXIST::FUNCTION:
-ASN1_INTEGER_set                        8	EXIST::FUNCTION:
-ASN1_INTEGER_to_BN                      9	EXIST::FUNCTION:
-ASN1_OBJECT_create                      10	EXIST::FUNCTION:
-ASN1_OBJECT_free                        11	EXIST::FUNCTION:
+TS_MSG_IMPRINT_get_algo                 8	EXIST::FUNCTION:
+TS_ACCURACY_free                        10	EXIST::FUNCTION:
 ASN1_OBJECT_new                         12	EXIST::FUNCTION:
 ASN1_PRINTABLE_type                     13	EXIST::FUNCTION:
 ASN1_STRING_cmp                         14	EXIST::FUNCTION:
@@ -2867,3 +2858,198 @@
 PROXY_CERT_INFO_EXTENSION_it            3307	EXIST:EXPORT_VAR_AS_FUNCTION:FUNCTION:
 PROXY_POLICY_free                       3308	EXIST::FUNCTION:
 PROXY_POLICY_new                        3309	EXIST::FUNCTION:
+TS_RESP_CTX_free                        3310	EXIST::FUNCTION:
+i2d_TS_ACCURACY                         3311	EXIST::FUNCTION:
+i2d_TS_MSG_IMPRINT_fp                   3312	EXIST::FUNCTION:
+i2d_TS_MSG_IMPRINT                      3313	EXIST::FUNCTION:
+i2d_TS_TST_INFO                         3314	EXIST::FUNCTION:
+TS_CONF_load_cert                       3315	EXIST::FUNCTION:
+TS_REQ_get_ext                          3316	EXIST::FUNCTION:
+TS_TST_INFO_set_nonce                   3317	EXIST::FUNCTION:
+TS_RESP_dup                             3318	EXIST::FUNCTION:
+i2d_TS_TST_INFO_fp                      3319	EXIST::FUNCTION:
+TS_TST_INFO_set_time                    3320	EXIST::FUNCTION:
+TS_REQ_set_policy_id                    3321	EXIST::FUNCTION:
+d2i_TS_RESP_fp                          3322	EXIST::FUNCTION:
+TS_RESP_set_status_info                 3323	EXIST::FUNCTION:
+TS_ACCURACY_set_millis                  3324	EXIST::FUNCTION:
+TS_REQ_dup                              3325	EXIST::FUNCTION:
+GENERAL_NAME_dup                        3326	EXIST::FUNCTION:
+TS_MSG_IMPRINT_set_algo                 3327	EXIST::FUNCTION:
+i2d_TS_TST_INFO_bio                     3328	EXIST::FUNCTION:
+TS_TST_INFO_set_ordering                3329	EXIST::FUNCTION:
+TS_TST_INFO_get_ext_by_OBJ              3330	EXIST::FUNCTION:
+TS_CONF_get_tsa_section                 3331	EXIST::FUNCTION:
+ASN1_OBJECT_free                        3332	EXIST::FUNCTION:
+TS_RESP_CTX_set_signer_key              3333	EXIST::FUNCTION:
+ASN1_INTEGER_get                        3334	EXIST::FUNCTION:
+i2d_ESS_SIGNING_CERT                    3335	EXIST::FUNCTION:
+TS_CONF_load_key                        3336	EXIST::FUNCTION:
+d2i_TS_MSG_IMPRINT_bio                  3337	EXIST::FUNCTION:
+TS_REQ_ext_free                         3338	EXIST::FUNCTION:
+SSLeay_version                          3339	EXIST::FUNCTION:
+TS_RESP_CTX_set_status_info             3340	EXIST::FUNCTION:
+TS_REQ_print_bio                        3341	EXIST::FUNCTION:
+TS_MSG_IMPRINT_print_bio                3342	EXIST::FUNCTION:
+TS_REQ_get_policy_id                    3343	EXIST::FUNCTION:
+d2i_TS_ACCURACY                         3344	EXIST::FUNCTION:
+TS_CONF_set_tsa_name                    3345	EXIST::FUNCTION:
+TS_TST_INFO_get_ext_by_NID              3346	EXIST::FUNCTION:
+TS_RESP_new                             3347	EXIST::FUNCTION:
+ESS_CERT_ID_dup                         3348	EXIST::FUNCTION:
+TS_STATUS_INFO_dup                      3349	EXIST::FUNCTION:
+TS_REQ_delete_ext                       3350	EXIST::FUNCTION:
+TS_REQ_get_msg_imprint                  3351	EXIST::FUNCTION:
+TS_TST_INFO_get_serial                  3352	EXIST::FUNCTION:
+TS_REQ_get_nonce                        3353	EXIST::FUNCTION:
+TS_STATUS_INFO_print_bio                3354	EXIST::FUNCTION:
+d2i_TS_TST_INFO                         3355	EXIST::FUNCTION:
+ASN1_IA5STRING_asn1_meth                3356	EXIST::FUNCTION:
+d2i_TS_RESP_bio                         3357	EXIST::FUNCTION:
+OTHERNAME_cmp                           3358	EXIST::FUNCTION:
+ASN1_BIT_STRING_asn1_meth               3359	EXIST::FUNCTION:
+TS_RESP_CTX_new                         3360	EXIST::FUNCTION:
+TS_RESP_set_tst_info                    3361	EXIST::FUNCTION:
+TS_RESP_CTX_set_signer_cert             3362	EXIST::FUNCTION:
+TS_REQ_set_msg_imprint                  3363	EXIST::FUNCTION:
+TS_CONF_set_digests                     3364	EXIST::FUNCTION:
+d2i_TS_MSG_IMPRINT                      3365	EXIST::FUNCTION:
+TS_REQ_get_ext_by_NID                   3366	EXIST::FUNCTION:
+ASN1_OBJECT_create                      3367	EXIST::FUNCTION:
+TS_ACCURACY_new                         3368	EXIST::FUNCTION:
+TS_TST_INFO_new                         3369	EXIST::FUNCTION:
+TS_CONF_set_default_engine              3370	EXIST::FUNCTION:
+TS_ACCURACY_set_seconds                 3371	EXIST::FUNCTION:
+TS_TST_INFO_get_time                    3372	EXIST::FUNCTION:
+d2i_ESS_ISSUER_SERIAL                   3373	EXIST::FUNCTION:
+TS_OBJ_print_bio                        3374	EXIST::FUNCTION:
+TS_RESP_get_status_info                 3375	EXIST::FUNCTION:
+PKCS7_to_TS_TST_INFO                    3376	EXIST::FUNCTION:
+TS_TST_INFO_add_ext                     3377	EXIST::FUNCTION:
+i2d_TS_RESP_fp                          3378	EXIST::FUNCTION:
+i2d_TS_MSG_IMPRINT_bio                  3379	EXIST::FUNCTION:
+TS_RESP_CTX_set_accuracy                3380	EXIST::FUNCTION:
+TS_REQ_set_nonce                        3381	EXIST::FUNCTION:
+ESS_CERT_ID_new                         3382	EXIST::FUNCTION:
+TS_REQ_get_ext_count                    3383	EXIST::FUNCTION:
+TS_TST_INFO_print_bio                   3384	EXIST::FUNCTION:
+i2d_TS_RESP                             3385	EXIST::FUNCTION:
+TS_VERIFY_CTX_cleanup                   3386	EXIST::FUNCTION:
+TS_STATUS_INFO_free                     3387	EXIST::FUNCTION:
+TS_RESP_verify_token                    3388	EXIST::FUNCTION:
+TS_TST_INFO_get_policy_id               3389	EXIST::FUNCTION:
+TS_REQ_get_cert_req                     3390	EXIST::FUNCTION:
+d2i_TS_TST_INFO_fp                      3391	EXIST::FUNCTION:
+TS_TST_INFO_get_ext_d2i                 3392	EXIST::FUNCTION:
+TS_RESP_CTX_add_policy                  3393	EXIST::FUNCTION:
+d2i_TS_RESP                             3394	EXIST::FUNCTION:
+TS_CONF_load_certs                      3395	EXIST::FUNCTION:
+TS_TST_INFO_get_msg_imprint             3396	EXIST::FUNCTION:
+ERR_load_TS_strings                     3397	EXIST::FUNCTION:
+TS_TST_INFO_get_version                 3398	EXIST::FUNCTION:
+ASN1_INTEGER_to_BN                      3399	EXIST::FUNCTION:
+TS_CONF_set_certs                       3400	EXIST::FUNCTION:
+TS_VERIFY_CTX_free                      3401	EXIST::FUNCTION:
+TS_REQ_get_ext_by_critical              3402	EXIST::FUNCTION:
+TS_RESP_CTX_set_serial_cb               3403	EXIST::FUNCTION:
+SSLeay                                  3404	EXIST::FUNCTION:
+TS_RESP_CTX_set_time_cb                 3405	EXIST::FUNCTION:
+TS_MSG_IMPRINT_get_msg                  3406	EXIST::FUNCTION:
+TS_TST_INFO_ext_free                    3407	EXIST::FUNCTION:
+TS_REQ_get_version                      3408	EXIST::FUNCTION:
+TS_REQ_add_ext                          3409	EXIST::FUNCTION:
+d2i_TS_TST_INFO_bio                     3410	EXIST::FUNCTION:
+TS_TST_INFO_get_ordering                3411	EXIST::FUNCTION:
+TS_RESP_print_bio                       3412	EXIST::FUNCTION:
+TS_TST_INFO_get_exts                    3413	EXIST::FUNCTION:
+ASN1_HEADER_new                         3414	EXIST::FUNCTION:
+TS_REQ_set_cert_req                     3415	EXIST::FUNCTION:
+TS_CONF_set_serial                      3416	EXIST::FUNCTION:
+TS_TST_INFO_free                        3417	EXIST::FUNCTION:
+d2i_TS_REQ_fp                           3418	EXIST::FUNCTION:
+TS_RESP_verify_response                 3419	EXIST::FUNCTION:
+i2d_ESS_ISSUER_SERIAL                   3420	EXIST::FUNCTION:
+TS_ACCURACY_get_seconds                 3421	EXIST::FUNCTION:
+TS_MSG_IMPRINT_dup                      3422	EXIST::FUNCTION:
+i2d_TS_REQ_bio                          3423	EXIST::FUNCTION:
+i2d_ESS_CERT_ID                         3424	EXIST::FUNCTION:
+TS_VERIFY_CTX_new                       3425	EXIST::FUNCTION:
+TS_RESP_CTX_set_extension_cb            3426	EXIST::FUNCTION:
+TS_RESP_CTX_set_status_info_cond        3427	EXIST::FUNCTION:
+TS_RESP_CTX_set_def_policy              3428	EXIST::FUNCTION:
+TS_RESP_create_response                 3429	EXIST::FUNCTION:
+TS_TST_INFO_get_nonce                   3430	EXIST::FUNCTION:
+TS_TST_INFO_set_policy_id               3431	EXIST::FUNCTION:
+TS_CONF_set_ess_cert_id_chain           3432	EXIST::FUNCTION:
+d2i_TS_REQ                              3433	EXIST::FUNCTION:
+ESS_SIGNING_CERT_new                    3434	EXIST::FUNCTION:
+i2d_TS_REQ                              3435	EXIST::FUNCTION:
+TS_TST_INFO_delete_ext                  3436	EXIST::FUNCTION:
+ESS_ISSUER_SERIAL_free                  3437	EXIST::FUNCTION:
+TS_CONF_set_signer_key                  3438	EXIST::FUNCTION:
+TS_ACCURACY_get_millis                  3439	EXIST::FUNCTION:
+TS_RESP_get_token                       3440	EXIST::FUNCTION:
+TS_ACCURACY_dup                         3441	EXIST::FUNCTION:
+TS_RESP_free                            3442	EXIST::FUNCTION:
+ESS_ISSUER_SERIAL_new                   3443	EXIST::FUNCTION:
+TS_RESP_CTX_add_md                      3444	EXIST::FUNCTION:
+TS_TST_INFO_dup                         3445	EXIST::FUNCTION:
+TS_TST_INFO_get_accuracy                3446	EXIST::FUNCTION:
+TS_TST_INFO_set_version                 3447	EXIST::FUNCTION:
+TS_RESP_CTX_get_tst_info                3448	EXIST::FUNCTION:
+TS_RESP_verify_signature                3449	EXIST::FUNCTION:
+TS_TST_INFO_get_tsa                     3450	EXIST::FUNCTION:
+TS_STATUS_INFO_new                      3451	EXIST::FUNCTION:
+TS_REQ_get_ext_d2i                      3452	EXIST::FUNCTION:
+TS_TST_INFO_get_ext_count               3453	EXIST::FUNCTION:
+TS_RESP_CTX_get_request                 3454	EXIST::FUNCTION:
+ASN1_INTEGER_set                        3455	EXIST::FUNCTION:
+ASN1_TYPE_cmp                           3456	EXIST::FUNCTION:
+d2i_TS_MSG_IMPRINT_fp                   3457	EXIST::FUNCTION:
+d2i_ESS_SIGNING_CERT                    3458	EXIST::FUNCTION:
+TS_CONF_set_ordering                    3459	EXIST::FUNCTION:
+TS_REQ_set_version                      3460	EXIST::FUNCTION:
+i2d_TS_STATUS_INFO                      3461	EXIST::FUNCTION:
+TS_TST_INFO_set_accuracy                3462	EXIST::FUNCTION:
+TS_TST_INFO_set_tsa                     3463	EXIST::FUNCTION:
+TS_CONF_set_accuracy                    3464	EXIST::FUNCTION:
+ESS_SIGNING_CERT_dup                    3465	EXIST::FUNCTION:
+d2i_TS_REQ_bio                          3466	EXIST::FUNCTION:
+TS_RESP_CTX_add_flags                   3467	EXIST::FUNCTION:
+d2i_TS_STATUS_INFO                      3468	EXIST::FUNCTION:
+TS_MSG_IMPRINT_set_msg                  3469	EXIST::FUNCTION:
+TS_REQ_free                             3470	EXIST::FUNCTION:
+TS_REQ_get_exts                         3471	EXIST::FUNCTION:
+TS_RESP_CTX_set_clock_precision_digits  3472	EXIST::FUNCTION:
+TS_RESP_CTX_add_failure_info            3473	EXIST::FUNCTION:
+i2d_TS_RESP_bio                         3474	EXIST::FUNCTION:
+TS_REQ_new                              3475	EXIST::FUNCTION:
+TS_MSG_IMPRINT_new                      3476	EXIST::FUNCTION:
+TS_TST_INFO_set_serial                  3477	EXIST::FUNCTION:
+TS_CONF_set_crypto_device               3478	EXIST::FUNCTION:
+TS_CONF_set_policies                    3479	EXIST::FUNCTION:
+ESS_CERT_ID_free                        3480	EXIST::FUNCTION:
+TS_MSG_IMPRINT_free                     3481	EXIST::FUNCTION:
+TS_VERIFY_CTX_init                      3482	EXIST::FUNCTION:
+TS_RESP_CTX_set_certs                   3483	EXIST::FUNCTION:
+TS_CONF_set_def_policy                  3484	EXIST::FUNCTION:
+ASN1_HEADER_free                        3485	EXIST::FUNCTION:
+TS_RESP_get_tst_info                    3486	EXIST::FUNCTION:
+TS_CONF_set_clock_precision_digits      3487	EXIST::FUNCTION:
+ESS_ISSUER_SERIAL_dup                   3488	EXIST::FUNCTION:
+TS_ACCURACY_get_micros                  3489	EXIST::FUNCTION:
+ASN1_BIT_STRING_check                   3490	EXIST::FUNCTION:
+TS_X509_ALGOR_print_bio                 3491	EXIST::FUNCTION:
+ESS_SIGNING_CERT_free                   3492	EXIST::FUNCTION:
+TS_TST_INFO_set_msg_imprint             3493	EXIST::FUNCTION:
+GENERAL_NAME_cmp                        3494	EXIST::FUNCTION:
+i2d_TS_REQ_fp                           3495	EXIST::FUNCTION:
+d2i_ESS_CERT_ID                         3496	EXIST::FUNCTION:
+TS_ext_print_bio                        3497	EXIST::FUNCTION:
+TS_ASN1_INTEGER_print_bio               3498	EXIST::FUNCTION:
+TS_ACCURACY_set_micros                  3499	EXIST::FUNCTION:
+TS_REQ_to_TS_VERIFY_CTX                 3500	EXIST::FUNCTION:
+TS_TST_INFO_get_ext                     3501	EXIST::FUNCTION:
+TS_TST_INFO_get_ext_by_critical         3502	EXIST::FUNCTION:
+TS_REQ_get_ext_by_OBJ                   3503	EXIST::FUNCTION:
+TS_CONF_set_signer_cert                 3504	EXIST::FUNCTION:
Index: openssl/util/mkdef.pl
diff -u openssl/util/mkdef.pl:1.1.1.8 openssl/util/mkdef.pl:1.1.1.8.2.1
--- openssl/util/mkdef.pl:1.1.1.8	Sun May  8 13:19:57 2005
+++ openssl/util/mkdef.pl	Sun May  8 14:24:08 2005
@@ -261,6 +261,7 @@
 $crypto.=" crypto/x509/x509.h";
 $crypto.=" crypto/x509/x509_vfy.h";
 $crypto.=" crypto/x509v3/x509v3.h";
+$crypto.=" crypto/ts/ts.h";
 $crypto.=" crypto/rand/rand.h";
 $crypto.=" crypto/comp/comp.h" ; # unless $no_comp;
 $crypto.=" crypto/ocsp/ocsp.h";
Index: openssl/util/mkerr.pl
diff -u openssl/util/mkerr.pl:1.1.1.6 openssl/util/mkerr.pl:1.1.1.6.2.1
--- openssl/util/mkerr.pl:1.1.1.6	Sun May  8 13:19:57 2005
+++ openssl/util/mkerr.pl	Sun May  8 14:24:08 2005
@@ -1,6 +1,7 @@
 #!/usr/local/bin/perl -w
 
 my $config = "crypto/err/openssl.ec";
+my $hprefix = "openssl/";
 my $debug = 0;
 my $rebuild = 0;
 my $static = 1;
@@ -14,6 +15,9 @@
 	if($arg eq "-conf") {
 		shift @ARGV;
 		$config = shift @ARGV;
+	} elsif($arg eq "-hprefix") {
+		shift @ARGV;
+		$hprefix = shift @ARGV;
 	} elsif($arg eq "-debug") {
 		$debug = 1;
 		shift @ARGV;
@@ -394,7 +398,7 @@
 	my $hincf;
 	if($static) {
 		$hfile =~ /([^\/]+)$/;
-		$hincf = "<openssl/$1>";
+		$hincf = "<${hprefix}$1>";
 	} else {
 		$hincf = "\"$hfile\"";
 	}
Index: openssl/util/mkfiles.pl
diff -u openssl/util/mkfiles.pl:1.1.1.5 openssl/util/mkfiles.pl:1.1.1.5.2.1
--- openssl/util/mkfiles.pl:1.1.1.5	Sun May  8 13:19:57 2005
+++ openssl/util/mkfiles.pl	Sun May  8 14:24:08 2005
@@ -51,6 +51,7 @@
 "crypto/ocsp",
 "crypto/ui",
 "crypto/krb5",
+"crypto/ts",
 "fips",
 "fips/aes",
 "fips/des",
