Restoring authorship annotation for <deshevoy@yandex-team.ru>. Commit 2 of 2.

11 files changed, 3731 insertions, 3731 deletions

diff --git a/contrib/libs/openssl/crypto/ts/ts_asn1.c b/contrib/libs/openssl/crypto/ts/ts_asn1.c
index 8812df698d..2840f5858a 100644
--- a/contrib/libs/openssl/crypto/ts/ts_asn1.c
+++ b/contrib/libs/openssl/crypto/ts/ts_asn1.c
@@ -1,276 +1,276 @@
-/* 
- * Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved. 
- * 
- * Licensed under the OpenSSL license (the "License").  You may not use 
- * this file except in compliance with the License.  You can obtain a copy 
- * in the file LICENSE in the source distribution or at 
- * https://www.openssl.org/source/license.html 
- */ 
- 
-#include <openssl/ts.h> 
-#include <openssl/err.h> 
-#include <openssl/asn1t.h> 
+/*
+ * Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the OpenSSL license (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#include <openssl/ts.h>
+#include <openssl/err.h>
+#include <openssl/asn1t.h>
 #include "ts_local.h"
- 
-ASN1_SEQUENCE(TS_MSG_IMPRINT) = { 
-        ASN1_SIMPLE(TS_MSG_IMPRINT, hash_algo, X509_ALGOR), 
-        ASN1_SIMPLE(TS_MSG_IMPRINT, hashed_msg, ASN1_OCTET_STRING) 
-} static_ASN1_SEQUENCE_END(TS_MSG_IMPRINT) 
- 
-IMPLEMENT_ASN1_FUNCTIONS_const(TS_MSG_IMPRINT) 
-IMPLEMENT_ASN1_DUP_FUNCTION(TS_MSG_IMPRINT) 
-TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_bio(BIO *bp, TS_MSG_IMPRINT **a) 
-{ 
-    return ASN1_d2i_bio_of(TS_MSG_IMPRINT, TS_MSG_IMPRINT_new, 
-                           d2i_TS_MSG_IMPRINT, bp, a); 
-} 
- 
-int i2d_TS_MSG_IMPRINT_bio(BIO *bp, TS_MSG_IMPRINT *a) 
-{ 
-    return ASN1_i2d_bio_of_const(TS_MSG_IMPRINT, i2d_TS_MSG_IMPRINT, bp, a); 
-} 
-#ifndef OPENSSL_NO_STDIO 
-TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT **a) 
-{ 
-    return ASN1_d2i_fp_of(TS_MSG_IMPRINT, TS_MSG_IMPRINT_new, 
-                          d2i_TS_MSG_IMPRINT, fp, a); 
-} 
- 
-int i2d_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT *a) 
-{ 
-    return ASN1_i2d_fp_of_const(TS_MSG_IMPRINT, i2d_TS_MSG_IMPRINT, fp, a); 
-} 
-#endif 
- 
-ASN1_SEQUENCE(TS_REQ) = { 
-        ASN1_SIMPLE(TS_REQ, version, ASN1_INTEGER), 
-        ASN1_SIMPLE(TS_REQ, msg_imprint, TS_MSG_IMPRINT), 
-        ASN1_OPT(TS_REQ, policy_id, ASN1_OBJECT), 
-        ASN1_OPT(TS_REQ, nonce, ASN1_INTEGER), 
-        ASN1_OPT(TS_REQ, cert_req, ASN1_FBOOLEAN), 
-        ASN1_IMP_SEQUENCE_OF_OPT(TS_REQ, extensions, X509_EXTENSION, 0) 
-} static_ASN1_SEQUENCE_END(TS_REQ) 
- 
-IMPLEMENT_ASN1_FUNCTIONS_const(TS_REQ) 
-IMPLEMENT_ASN1_DUP_FUNCTION(TS_REQ) 
-TS_REQ *d2i_TS_REQ_bio(BIO *bp, TS_REQ **a) 
-{ 
-    return ASN1_d2i_bio_of(TS_REQ, TS_REQ_new, d2i_TS_REQ, bp, a); 
-} 
- 
-int i2d_TS_REQ_bio(BIO *bp, TS_REQ *a) 
-{ 
-    return ASN1_i2d_bio_of_const(TS_REQ, i2d_TS_REQ, bp, a); 
-} 
-#ifndef OPENSSL_NO_STDIO 
-TS_REQ *d2i_TS_REQ_fp(FILE *fp, TS_REQ **a) 
-{ 
-    return ASN1_d2i_fp_of(TS_REQ, TS_REQ_new, d2i_TS_REQ, fp, a); 
-} 
- 
-int i2d_TS_REQ_fp(FILE *fp, TS_REQ *a) 
-{ 
-    return ASN1_i2d_fp_of_const(TS_REQ, i2d_TS_REQ, fp, a); 
-} 
-#endif 
- 
-ASN1_SEQUENCE(TS_ACCURACY) = { 
-        ASN1_OPT(TS_ACCURACY, seconds, ASN1_INTEGER), 
-        ASN1_IMP_OPT(TS_ACCURACY, millis, ASN1_INTEGER, 0), 
-        ASN1_IMP_OPT(TS_ACCURACY, micros, ASN1_INTEGER, 1) 
-} static_ASN1_SEQUENCE_END(TS_ACCURACY) 
- 
-IMPLEMENT_ASN1_FUNCTIONS_const(TS_ACCURACY) 
-IMPLEMENT_ASN1_DUP_FUNCTION(TS_ACCURACY) 
- 
-ASN1_SEQUENCE(TS_TST_INFO) = { 
-        ASN1_SIMPLE(TS_TST_INFO, version, ASN1_INTEGER), 
-        ASN1_SIMPLE(TS_TST_INFO, policy_id, ASN1_OBJECT), 
-        ASN1_SIMPLE(TS_TST_INFO, msg_imprint, TS_MSG_IMPRINT), 
-        ASN1_SIMPLE(TS_TST_INFO, serial, ASN1_INTEGER), 
-        ASN1_SIMPLE(TS_TST_INFO, time, ASN1_GENERALIZEDTIME), 
-        ASN1_OPT(TS_TST_INFO, accuracy, TS_ACCURACY), 
-        ASN1_OPT(TS_TST_INFO, ordering, ASN1_FBOOLEAN), 
-        ASN1_OPT(TS_TST_INFO, nonce, ASN1_INTEGER), 
-        ASN1_EXP_OPT(TS_TST_INFO, tsa, GENERAL_NAME, 0), 
-        ASN1_IMP_SEQUENCE_OF_OPT(TS_TST_INFO, extensions, X509_EXTENSION, 1) 
-} static_ASN1_SEQUENCE_END(TS_TST_INFO) 
- 
-IMPLEMENT_ASN1_FUNCTIONS_const(TS_TST_INFO) 
-IMPLEMENT_ASN1_DUP_FUNCTION(TS_TST_INFO) 
-TS_TST_INFO *d2i_TS_TST_INFO_bio(BIO *bp, TS_TST_INFO **a) 
-{ 
-    return ASN1_d2i_bio_of(TS_TST_INFO, TS_TST_INFO_new, d2i_TS_TST_INFO, bp, 
-                           a); 
-} 
- 
-int i2d_TS_TST_INFO_bio(BIO *bp, TS_TST_INFO *a) 
-{ 
-    return ASN1_i2d_bio_of_const(TS_TST_INFO, i2d_TS_TST_INFO, bp, a); 
-} 
-#ifndef OPENSSL_NO_STDIO 
-TS_TST_INFO *d2i_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO **a) 
-{ 
-    return ASN1_d2i_fp_of(TS_TST_INFO, TS_TST_INFO_new, d2i_TS_TST_INFO, fp, 
-                          a); 
-} 
- 
-int i2d_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO *a) 
-{ 
-    return ASN1_i2d_fp_of_const(TS_TST_INFO, i2d_TS_TST_INFO, fp, a); 
-} 
-#endif 
- 
-ASN1_SEQUENCE(TS_STATUS_INFO) = { 
-        ASN1_SIMPLE(TS_STATUS_INFO, status, ASN1_INTEGER), 
-        ASN1_SEQUENCE_OF_OPT(TS_STATUS_INFO, text, ASN1_UTF8STRING), 
-        ASN1_OPT(TS_STATUS_INFO, failure_info, ASN1_BIT_STRING) 
-} static_ASN1_SEQUENCE_END(TS_STATUS_INFO) 
- 
-IMPLEMENT_ASN1_FUNCTIONS_const(TS_STATUS_INFO) 
-IMPLEMENT_ASN1_DUP_FUNCTION(TS_STATUS_INFO) 
- 
-static int ts_resp_set_tst_info(TS_RESP *a) 
-{ 
-    long status; 
- 
-    status = ASN1_INTEGER_get(a->status_info->status); 
- 
-    if (a->token) { 
-        if (status != 0 && status != 1) { 
-            TSerr(TS_F_TS_RESP_SET_TST_INFO, TS_R_TOKEN_PRESENT); 
-            return 0; 
-        } 
-        TS_TST_INFO_free(a->tst_info); 
-        a->tst_info = PKCS7_to_TS_TST_INFO(a->token); 
-        if (!a->tst_info) { 
-            TSerr(TS_F_TS_RESP_SET_TST_INFO, 
-                  TS_R_PKCS7_TO_TS_TST_INFO_FAILED); 
-            return 0; 
-        } 
-    } else if (status == 0 || status == 1) { 
-        TSerr(TS_F_TS_RESP_SET_TST_INFO, TS_R_TOKEN_NOT_PRESENT); 
-        return 0; 
-    } 
- 
-    return 1; 
-} 
- 
-static int ts_resp_cb(int op, ASN1_VALUE **pval, const ASN1_ITEM *it, 
-                      void *exarg) 
-{ 
-    TS_RESP *ts_resp = (TS_RESP *)*pval; 
-    if (op == ASN1_OP_NEW_POST) { 
-        ts_resp->tst_info = NULL; 
-    } else if (op == ASN1_OP_FREE_POST) { 
-        TS_TST_INFO_free(ts_resp->tst_info); 
-    } else if (op == ASN1_OP_D2I_POST) { 
-        if (ts_resp_set_tst_info(ts_resp) == 0) 
-            return 0; 
-    } 
-    return 1; 
-} 
- 
-ASN1_SEQUENCE_cb(TS_RESP, ts_resp_cb) = { 
-        ASN1_SIMPLE(TS_RESP, status_info, TS_STATUS_INFO), 
-        ASN1_OPT(TS_RESP, token, PKCS7), 
-} static_ASN1_SEQUENCE_END_cb(TS_RESP, TS_RESP) 
- 
-IMPLEMENT_ASN1_FUNCTIONS_const(TS_RESP) 
- 
-IMPLEMENT_ASN1_DUP_FUNCTION(TS_RESP) 
- 
-TS_RESP *d2i_TS_RESP_bio(BIO *bp, TS_RESP **a) 
-{ 
-    return ASN1_d2i_bio_of(TS_RESP, TS_RESP_new, d2i_TS_RESP, bp, a); 
-} 
- 
-int i2d_TS_RESP_bio(BIO *bp, TS_RESP *a) 
-{ 
-    return ASN1_i2d_bio_of_const(TS_RESP, i2d_TS_RESP, bp, a); 
-} 
-#ifndef OPENSSL_NO_STDIO 
-TS_RESP *d2i_TS_RESP_fp(FILE *fp, TS_RESP **a) 
-{ 
-    return ASN1_d2i_fp_of(TS_RESP, TS_RESP_new, d2i_TS_RESP, fp, a); 
-} 
- 
-int i2d_TS_RESP_fp(FILE *fp, TS_RESP *a) 
-{ 
-    return ASN1_i2d_fp_of_const(TS_RESP, i2d_TS_RESP, fp, a); 
-} 
-#endif 
- 
-ASN1_SEQUENCE(ESS_ISSUER_SERIAL) = { 
-        ASN1_SEQUENCE_OF(ESS_ISSUER_SERIAL, issuer, GENERAL_NAME), 
-        ASN1_SIMPLE(ESS_ISSUER_SERIAL, serial, ASN1_INTEGER) 
-} static_ASN1_SEQUENCE_END(ESS_ISSUER_SERIAL) 
- 
-IMPLEMENT_ASN1_FUNCTIONS_const(ESS_ISSUER_SERIAL) 
-IMPLEMENT_ASN1_DUP_FUNCTION(ESS_ISSUER_SERIAL) 
- 
-ASN1_SEQUENCE(ESS_CERT_ID) = { 
-        ASN1_SIMPLE(ESS_CERT_ID, hash, ASN1_OCTET_STRING), 
-        ASN1_OPT(ESS_CERT_ID, issuer_serial, ESS_ISSUER_SERIAL) 
-} static_ASN1_SEQUENCE_END(ESS_CERT_ID) 
- 
-IMPLEMENT_ASN1_FUNCTIONS_const(ESS_CERT_ID) 
-IMPLEMENT_ASN1_DUP_FUNCTION(ESS_CERT_ID) 
- 
-ASN1_SEQUENCE(ESS_SIGNING_CERT) = { 
-        ASN1_SEQUENCE_OF(ESS_SIGNING_CERT, cert_ids, ESS_CERT_ID), 
-        ASN1_SEQUENCE_OF_OPT(ESS_SIGNING_CERT, policy_info, POLICYINFO) 
-} static_ASN1_SEQUENCE_END(ESS_SIGNING_CERT) 
- 
-IMPLEMENT_ASN1_FUNCTIONS_const(ESS_SIGNING_CERT) 
-IMPLEMENT_ASN1_DUP_FUNCTION(ESS_SIGNING_CERT) 
- 
-ASN1_SEQUENCE(ESS_CERT_ID_V2) = { 
-        ASN1_OPT(ESS_CERT_ID_V2, hash_alg, X509_ALGOR), 
-        ASN1_SIMPLE(ESS_CERT_ID_V2, hash, ASN1_OCTET_STRING), 
-        ASN1_OPT(ESS_CERT_ID_V2, issuer_serial, ESS_ISSUER_SERIAL) 
-} static_ASN1_SEQUENCE_END(ESS_CERT_ID_V2) 
- 
-IMPLEMENT_ASN1_FUNCTIONS_const(ESS_CERT_ID_V2) 
-IMPLEMENT_ASN1_DUP_FUNCTION(ESS_CERT_ID_V2) 
- 
-ASN1_SEQUENCE(ESS_SIGNING_CERT_V2) = { 
-        ASN1_SEQUENCE_OF(ESS_SIGNING_CERT_V2, cert_ids, ESS_CERT_ID_V2), 
-        ASN1_SEQUENCE_OF_OPT(ESS_SIGNING_CERT_V2, policy_info, POLICYINFO) 
-} static_ASN1_SEQUENCE_END(ESS_SIGNING_CERT_V2) 
- 
-IMPLEMENT_ASN1_FUNCTIONS_const(ESS_SIGNING_CERT_V2) 
-IMPLEMENT_ASN1_DUP_FUNCTION(ESS_SIGNING_CERT_V2) 
- 
-/* Getting encapsulated TS_TST_INFO object from PKCS7. */ 
-TS_TST_INFO *PKCS7_to_TS_TST_INFO(PKCS7 *token) 
-{ 
-    PKCS7_SIGNED *pkcs7_signed; 
-    PKCS7 *enveloped; 
-    ASN1_TYPE *tst_info_wrapper; 
-    ASN1_OCTET_STRING *tst_info_der; 
-    const unsigned char *p; 
- 
-    if (!PKCS7_type_is_signed(token)) { 
-        TSerr(TS_F_PKCS7_TO_TS_TST_INFO, TS_R_BAD_PKCS7_TYPE); 
-        return NULL; 
-    } 
-    if (PKCS7_get_detached(token)) { 
-        TSerr(TS_F_PKCS7_TO_TS_TST_INFO, TS_R_DETACHED_CONTENT); 
-        return NULL; 
-    } 
-    pkcs7_signed = token->d.sign; 
-    enveloped = pkcs7_signed->contents; 
-    if (OBJ_obj2nid(enveloped->type) != NID_id_smime_ct_TSTInfo) { 
-        TSerr(TS_F_PKCS7_TO_TS_TST_INFO, TS_R_BAD_PKCS7_TYPE); 
-        return NULL; 
-    } 
-    tst_info_wrapper = enveloped->d.other; 
-    if (tst_info_wrapper->type != V_ASN1_OCTET_STRING) { 
-        TSerr(TS_F_PKCS7_TO_TS_TST_INFO, TS_R_BAD_TYPE); 
-        return NULL; 
-    } 
-    tst_info_der = tst_info_wrapper->value.octet_string; 
-    p = tst_info_der->data; 
-    return d2i_TS_TST_INFO(NULL, &p, tst_info_der->length); 
-} 
+
+ASN1_SEQUENCE(TS_MSG_IMPRINT) = {
+        ASN1_SIMPLE(TS_MSG_IMPRINT, hash_algo, X509_ALGOR),
+        ASN1_SIMPLE(TS_MSG_IMPRINT, hashed_msg, ASN1_OCTET_STRING)
+} static_ASN1_SEQUENCE_END(TS_MSG_IMPRINT)
+
+IMPLEMENT_ASN1_FUNCTIONS_const(TS_MSG_IMPRINT)
+IMPLEMENT_ASN1_DUP_FUNCTION(TS_MSG_IMPRINT)
+TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_bio(BIO *bp, TS_MSG_IMPRINT **a)
+{
+    return ASN1_d2i_bio_of(TS_MSG_IMPRINT, TS_MSG_IMPRINT_new,
+                           d2i_TS_MSG_IMPRINT, bp, a);
+}
+
+int i2d_TS_MSG_IMPRINT_bio(BIO *bp, TS_MSG_IMPRINT *a)
+{
+    return ASN1_i2d_bio_of_const(TS_MSG_IMPRINT, i2d_TS_MSG_IMPRINT, bp, a);
+}
+#ifndef OPENSSL_NO_STDIO
+TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT **a)
+{
+    return ASN1_d2i_fp_of(TS_MSG_IMPRINT, TS_MSG_IMPRINT_new,
+                          d2i_TS_MSG_IMPRINT, fp, a);
+}
+
+int i2d_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT *a)
+{
+    return ASN1_i2d_fp_of_const(TS_MSG_IMPRINT, i2d_TS_MSG_IMPRINT, fp, a);
+}
+#endif
+
+ASN1_SEQUENCE(TS_REQ) = {
+        ASN1_SIMPLE(TS_REQ, version, ASN1_INTEGER),
+        ASN1_SIMPLE(TS_REQ, msg_imprint, TS_MSG_IMPRINT),
+        ASN1_OPT(TS_REQ, policy_id, ASN1_OBJECT),
+        ASN1_OPT(TS_REQ, nonce, ASN1_INTEGER),
+        ASN1_OPT(TS_REQ, cert_req, ASN1_FBOOLEAN),
+        ASN1_IMP_SEQUENCE_OF_OPT(TS_REQ, extensions, X509_EXTENSION, 0)
+} static_ASN1_SEQUENCE_END(TS_REQ)
+
+IMPLEMENT_ASN1_FUNCTIONS_const(TS_REQ)
+IMPLEMENT_ASN1_DUP_FUNCTION(TS_REQ)
+TS_REQ *d2i_TS_REQ_bio(BIO *bp, TS_REQ **a)
+{
+    return ASN1_d2i_bio_of(TS_REQ, TS_REQ_new, d2i_TS_REQ, bp, a);
+}
+
+int i2d_TS_REQ_bio(BIO *bp, TS_REQ *a)
+{
+    return ASN1_i2d_bio_of_const(TS_REQ, i2d_TS_REQ, bp, a);
+}
+#ifndef OPENSSL_NO_STDIO
+TS_REQ *d2i_TS_REQ_fp(FILE *fp, TS_REQ **a)
+{
+    return ASN1_d2i_fp_of(TS_REQ, TS_REQ_new, d2i_TS_REQ, fp, a);
+}
+
+int i2d_TS_REQ_fp(FILE *fp, TS_REQ *a)
+{
+    return ASN1_i2d_fp_of_const(TS_REQ, i2d_TS_REQ, fp, a);
+}
+#endif
+
+ASN1_SEQUENCE(TS_ACCURACY) = {
+        ASN1_OPT(TS_ACCURACY, seconds, ASN1_INTEGER),
+        ASN1_IMP_OPT(TS_ACCURACY, millis, ASN1_INTEGER, 0),
+        ASN1_IMP_OPT(TS_ACCURACY, micros, ASN1_INTEGER, 1)
+} static_ASN1_SEQUENCE_END(TS_ACCURACY)
+
+IMPLEMENT_ASN1_FUNCTIONS_const(TS_ACCURACY)
+IMPLEMENT_ASN1_DUP_FUNCTION(TS_ACCURACY)
+
+ASN1_SEQUENCE(TS_TST_INFO) = {
+        ASN1_SIMPLE(TS_TST_INFO, version, ASN1_INTEGER),
+        ASN1_SIMPLE(TS_TST_INFO, policy_id, ASN1_OBJECT),
+        ASN1_SIMPLE(TS_TST_INFO, msg_imprint, TS_MSG_IMPRINT),
+        ASN1_SIMPLE(TS_TST_INFO, serial, ASN1_INTEGER),
+        ASN1_SIMPLE(TS_TST_INFO, time, ASN1_GENERALIZEDTIME),
+        ASN1_OPT(TS_TST_INFO, accuracy, TS_ACCURACY),
+        ASN1_OPT(TS_TST_INFO, ordering, ASN1_FBOOLEAN),
+        ASN1_OPT(TS_TST_INFO, nonce, ASN1_INTEGER),
+        ASN1_EXP_OPT(TS_TST_INFO, tsa, GENERAL_NAME, 0),
+        ASN1_IMP_SEQUENCE_OF_OPT(TS_TST_INFO, extensions, X509_EXTENSION, 1)
+} static_ASN1_SEQUENCE_END(TS_TST_INFO)
+
+IMPLEMENT_ASN1_FUNCTIONS_const(TS_TST_INFO)
+IMPLEMENT_ASN1_DUP_FUNCTION(TS_TST_INFO)
+TS_TST_INFO *d2i_TS_TST_INFO_bio(BIO *bp, TS_TST_INFO **a)
+{
+    return ASN1_d2i_bio_of(TS_TST_INFO, TS_TST_INFO_new, d2i_TS_TST_INFO, bp,
+                           a);
+}
+
+int i2d_TS_TST_INFO_bio(BIO *bp, TS_TST_INFO *a)
+{
+    return ASN1_i2d_bio_of_const(TS_TST_INFO, i2d_TS_TST_INFO, bp, a);
+}
+#ifndef OPENSSL_NO_STDIO
+TS_TST_INFO *d2i_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO **a)
+{
+    return ASN1_d2i_fp_of(TS_TST_INFO, TS_TST_INFO_new, d2i_TS_TST_INFO, fp,
+                          a);
+}
+
+int i2d_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO *a)
+{
+    return ASN1_i2d_fp_of_const(TS_TST_INFO, i2d_TS_TST_INFO, fp, a);
+}
+#endif
+
+ASN1_SEQUENCE(TS_STATUS_INFO) = {
+        ASN1_SIMPLE(TS_STATUS_INFO, status, ASN1_INTEGER),
+        ASN1_SEQUENCE_OF_OPT(TS_STATUS_INFO, text, ASN1_UTF8STRING),
+        ASN1_OPT(TS_STATUS_INFO, failure_info, ASN1_BIT_STRING)
+} static_ASN1_SEQUENCE_END(TS_STATUS_INFO)
+
+IMPLEMENT_ASN1_FUNCTIONS_const(TS_STATUS_INFO)
+IMPLEMENT_ASN1_DUP_FUNCTION(TS_STATUS_INFO)
+
+static int ts_resp_set_tst_info(TS_RESP *a)
+{
+    long status;
+
+    status = ASN1_INTEGER_get(a->status_info->status);
+
+    if (a->token) {
+        if (status != 0 && status != 1) {
+            TSerr(TS_F_TS_RESP_SET_TST_INFO, TS_R_TOKEN_PRESENT);
+            return 0;
+        }
+        TS_TST_INFO_free(a->tst_info);
+        a->tst_info = PKCS7_to_TS_TST_INFO(a->token);
+        if (!a->tst_info) {
+            TSerr(TS_F_TS_RESP_SET_TST_INFO,
+                  TS_R_PKCS7_TO_TS_TST_INFO_FAILED);
+            return 0;
+        }
+    } else if (status == 0 || status == 1) {
+        TSerr(TS_F_TS_RESP_SET_TST_INFO, TS_R_TOKEN_NOT_PRESENT);
+        return 0;
+    }
+
+    return 1;
+}
+
+static int ts_resp_cb(int op, ASN1_VALUE **pval, const ASN1_ITEM *it,
+                      void *exarg)
+{
+    TS_RESP *ts_resp = (TS_RESP *)*pval;
+    if (op == ASN1_OP_NEW_POST) {
+        ts_resp->tst_info = NULL;
+    } else if (op == ASN1_OP_FREE_POST) {
+        TS_TST_INFO_free(ts_resp->tst_info);
+    } else if (op == ASN1_OP_D2I_POST) {
+        if (ts_resp_set_tst_info(ts_resp) == 0)
+            return 0;
+    }
+    return 1;
+}
+
+ASN1_SEQUENCE_cb(TS_RESP, ts_resp_cb) = {
+        ASN1_SIMPLE(TS_RESP, status_info, TS_STATUS_INFO),
+        ASN1_OPT(TS_RESP, token, PKCS7),
+} static_ASN1_SEQUENCE_END_cb(TS_RESP, TS_RESP)
+
+IMPLEMENT_ASN1_FUNCTIONS_const(TS_RESP)
+
+IMPLEMENT_ASN1_DUP_FUNCTION(TS_RESP)
+
+TS_RESP *d2i_TS_RESP_bio(BIO *bp, TS_RESP **a)
+{
+    return ASN1_d2i_bio_of(TS_RESP, TS_RESP_new, d2i_TS_RESP, bp, a);
+}
+
+int i2d_TS_RESP_bio(BIO *bp, TS_RESP *a)
+{
+    return ASN1_i2d_bio_of_const(TS_RESP, i2d_TS_RESP, bp, a);
+}
+#ifndef OPENSSL_NO_STDIO
+TS_RESP *d2i_TS_RESP_fp(FILE *fp, TS_RESP **a)
+{
+    return ASN1_d2i_fp_of(TS_RESP, TS_RESP_new, d2i_TS_RESP, fp, a);
+}
+
+int i2d_TS_RESP_fp(FILE *fp, TS_RESP *a)
+{
+    return ASN1_i2d_fp_of_const(TS_RESP, i2d_TS_RESP, fp, a);
+}
+#endif
+
+ASN1_SEQUENCE(ESS_ISSUER_SERIAL) = {
+        ASN1_SEQUENCE_OF(ESS_ISSUER_SERIAL, issuer, GENERAL_NAME),
+        ASN1_SIMPLE(ESS_ISSUER_SERIAL, serial, ASN1_INTEGER)
+} static_ASN1_SEQUENCE_END(ESS_ISSUER_SERIAL)
+
+IMPLEMENT_ASN1_FUNCTIONS_const(ESS_ISSUER_SERIAL)
+IMPLEMENT_ASN1_DUP_FUNCTION(ESS_ISSUER_SERIAL)
+
+ASN1_SEQUENCE(ESS_CERT_ID) = {
+        ASN1_SIMPLE(ESS_CERT_ID, hash, ASN1_OCTET_STRING),
+        ASN1_OPT(ESS_CERT_ID, issuer_serial, ESS_ISSUER_SERIAL)
+} static_ASN1_SEQUENCE_END(ESS_CERT_ID)
+
+IMPLEMENT_ASN1_FUNCTIONS_const(ESS_CERT_ID)
+IMPLEMENT_ASN1_DUP_FUNCTION(ESS_CERT_ID)
+
+ASN1_SEQUENCE(ESS_SIGNING_CERT) = {
+        ASN1_SEQUENCE_OF(ESS_SIGNING_CERT, cert_ids, ESS_CERT_ID),
+        ASN1_SEQUENCE_OF_OPT(ESS_SIGNING_CERT, policy_info, POLICYINFO)
+} static_ASN1_SEQUENCE_END(ESS_SIGNING_CERT)
+
+IMPLEMENT_ASN1_FUNCTIONS_const(ESS_SIGNING_CERT)
+IMPLEMENT_ASN1_DUP_FUNCTION(ESS_SIGNING_CERT)
+
+ASN1_SEQUENCE(ESS_CERT_ID_V2) = {
+        ASN1_OPT(ESS_CERT_ID_V2, hash_alg, X509_ALGOR),
+        ASN1_SIMPLE(ESS_CERT_ID_V2, hash, ASN1_OCTET_STRING),
+        ASN1_OPT(ESS_CERT_ID_V2, issuer_serial, ESS_ISSUER_SERIAL)
+} static_ASN1_SEQUENCE_END(ESS_CERT_ID_V2)
+
+IMPLEMENT_ASN1_FUNCTIONS_const(ESS_CERT_ID_V2)
+IMPLEMENT_ASN1_DUP_FUNCTION(ESS_CERT_ID_V2)
+
+ASN1_SEQUENCE(ESS_SIGNING_CERT_V2) = {
+        ASN1_SEQUENCE_OF(ESS_SIGNING_CERT_V2, cert_ids, ESS_CERT_ID_V2),
+        ASN1_SEQUENCE_OF_OPT(ESS_SIGNING_CERT_V2, policy_info, POLICYINFO)
+} static_ASN1_SEQUENCE_END(ESS_SIGNING_CERT_V2)
+
+IMPLEMENT_ASN1_FUNCTIONS_const(ESS_SIGNING_CERT_V2)
+IMPLEMENT_ASN1_DUP_FUNCTION(ESS_SIGNING_CERT_V2)
+
+/* Getting encapsulated TS_TST_INFO object from PKCS7. */
+TS_TST_INFO *PKCS7_to_TS_TST_INFO(PKCS7 *token)
+{
+    PKCS7_SIGNED *pkcs7_signed;
+    PKCS7 *enveloped;
+    ASN1_TYPE *tst_info_wrapper;
+    ASN1_OCTET_STRING *tst_info_der;
+    const unsigned char *p;
+
+    if (!PKCS7_type_is_signed(token)) {
+        TSerr(TS_F_PKCS7_TO_TS_TST_INFO, TS_R_BAD_PKCS7_TYPE);
+        return NULL;
+    }
+    if (PKCS7_get_detached(token)) {
+        TSerr(TS_F_PKCS7_TO_TS_TST_INFO, TS_R_DETACHED_CONTENT);
+        return NULL;
+    }
+    pkcs7_signed = token->d.sign;
+    enveloped = pkcs7_signed->contents;
+    if (OBJ_obj2nid(enveloped->type) != NID_id_smime_ct_TSTInfo) {
+        TSerr(TS_F_PKCS7_TO_TS_TST_INFO, TS_R_BAD_PKCS7_TYPE);
+        return NULL;
+    }
+    tst_info_wrapper = enveloped->d.other;
+    if (tst_info_wrapper->type != V_ASN1_OCTET_STRING) {
+        TSerr(TS_F_PKCS7_TO_TS_TST_INFO, TS_R_BAD_TYPE);
+        return NULL;
+    }
+    tst_info_der = tst_info_wrapper->value.octet_string;
+    p = tst_info_der->data;
+    return d2i_TS_TST_INFO(NULL, &p, tst_info_der->length);
+}
diff --git a/contrib/libs/openssl/crypto/ts/ts_conf.c b/contrib/libs/openssl/crypto/ts/ts_conf.c
index 3c5781b7dc..625089a59b 100644
--- a/contrib/libs/openssl/crypto/ts/ts_conf.c
+++ b/contrib/libs/openssl/crypto/ts/ts_conf.c
@@ -1,493 +1,493 @@
-/* 
- * Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved. 
- * 
- * Licensed under the OpenSSL license (the "License").  You may not use 
- * this file except in compliance with the License.  You can obtain a copy 
- * in the file LICENSE in the source distribution or at 
- * https://www.openssl.org/source/license.html 
- */ 
- 
-#include <string.h> 
- 
-#include <openssl/crypto.h> 
-#include "internal/cryptlib.h" 
-#include <openssl/pem.h> 
-#include <openssl/engine.h> 
-#include <openssl/ts.h> 
- 
-/* Macro definitions for the configuration file. */ 
-#define BASE_SECTION                    "tsa" 
-#define ENV_DEFAULT_TSA                 "default_tsa" 
-#define ENV_SERIAL                      "serial" 
-#define ENV_CRYPTO_DEVICE               "crypto_device" 
-#define ENV_SIGNER_CERT                 "signer_cert" 
-#define ENV_CERTS                       "certs" 
-#define ENV_SIGNER_KEY                  "signer_key" 
-#define ENV_SIGNER_DIGEST               "signer_digest" 
-#define ENV_DEFAULT_POLICY              "default_policy" 
-#define ENV_OTHER_POLICIES              "other_policies" 
-#define ENV_DIGESTS                     "digests" 
-#define ENV_ACCURACY                    "accuracy" 
-#define ENV_ORDERING                    "ordering" 
-#define ENV_TSA_NAME                    "tsa_name" 
-#define ENV_ESS_CERT_ID_CHAIN           "ess_cert_id_chain" 
-#define ENV_VALUE_SECS                  "secs" 
-#define ENV_VALUE_MILLISECS             "millisecs" 
-#define ENV_VALUE_MICROSECS             "microsecs" 
-#define ENV_CLOCK_PRECISION_DIGITS      "clock_precision_digits" 
-#define ENV_VALUE_YES                   "yes" 
-#define ENV_VALUE_NO                    "no" 
-#define ENV_ESS_CERT_ID_ALG             "ess_cert_id_alg" 
- 
-/* Function definitions for certificate and key loading. */ 
- 
-X509 *TS_CONF_load_cert(const char *file) 
-{ 
-    BIO *cert = NULL; 
-    X509 *x = NULL; 
- 
-    if ((cert = BIO_new_file(file, "r")) == NULL) 
-        goto end; 
-    x = PEM_read_bio_X509_AUX(cert, NULL, NULL, NULL); 
- end: 
-    if (x == NULL) 
-        TSerr(TS_F_TS_CONF_LOAD_CERT, TS_R_CANNOT_LOAD_CERT); 
-    BIO_free(cert); 
-    return x; 
-} 
- 
-STACK_OF(X509) *TS_CONF_load_certs(const char *file) 
-{ 
-    BIO *certs = NULL; 
-    STACK_OF(X509) *othercerts = NULL; 
-    STACK_OF(X509_INFO) *allcerts = NULL; 
-    int i; 
- 
-    if ((certs = BIO_new_file(file, "r")) == NULL) 
-        goto end; 
-    if ((othercerts = sk_X509_new_null()) == NULL) 
-        goto end; 
- 
-    allcerts = PEM_X509_INFO_read_bio(certs, NULL, NULL, NULL); 
-    for (i = 0; i < sk_X509_INFO_num(allcerts); i++) { 
-        X509_INFO *xi = sk_X509_INFO_value(allcerts, i); 
-        if (xi->x509) { 
-            sk_X509_push(othercerts, xi->x509); 
-            xi->x509 = NULL; 
-        } 
-    } 
- end: 
-    if (othercerts == NULL) 
-        TSerr(TS_F_TS_CONF_LOAD_CERTS, TS_R_CANNOT_LOAD_CERT); 
-    sk_X509_INFO_pop_free(allcerts, X509_INFO_free); 
-    BIO_free(certs); 
-    return othercerts; 
-} 
- 
-EVP_PKEY *TS_CONF_load_key(const char *file, const char *pass) 
-{ 
-    BIO *key = NULL; 
-    EVP_PKEY *pkey = NULL; 
- 
-    if ((key = BIO_new_file(file, "r")) == NULL) 
-        goto end; 
-    pkey = PEM_read_bio_PrivateKey(key, NULL, NULL, (char *)pass); 
- end: 
-    if (pkey == NULL) 
-        TSerr(TS_F_TS_CONF_LOAD_KEY, TS_R_CANNOT_LOAD_KEY); 
-    BIO_free(key); 
-    return pkey; 
-} 
- 
-/* Function definitions for handling configuration options. */ 
- 
-static void ts_CONF_lookup_fail(const char *name, const char *tag) 
-{ 
-    TSerr(TS_F_TS_CONF_LOOKUP_FAIL, TS_R_VAR_LOOKUP_FAILURE); 
-    ERR_add_error_data(3, name, "::", tag); 
-} 
- 
-static void ts_CONF_invalid(const char *name, const char *tag) 
-{ 
-    TSerr(TS_F_TS_CONF_INVALID, TS_R_VAR_BAD_VALUE); 
-    ERR_add_error_data(3, name, "::", tag); 
-} 
- 
-const char *TS_CONF_get_tsa_section(CONF *conf, const char *section) 
-{ 
-    if (!section) { 
-        section = NCONF_get_string(conf, BASE_SECTION, ENV_DEFAULT_TSA); 
-        if (!section) 
-            ts_CONF_lookup_fail(BASE_SECTION, ENV_DEFAULT_TSA); 
-    } 
-    return section; 
-} 
- 
-int TS_CONF_set_serial(CONF *conf, const char *section, TS_serial_cb cb, 
-                       TS_RESP_CTX *ctx) 
-{ 
-    int ret = 0; 
-    char *serial = NCONF_get_string(conf, section, ENV_SERIAL); 
-    if (!serial) { 
-        ts_CONF_lookup_fail(section, ENV_SERIAL); 
-        goto err; 
-    } 
-    TS_RESP_CTX_set_serial_cb(ctx, cb, serial); 
- 
-    ret = 1; 
- err: 
-    return ret; 
-} 
- 
-#ifndef OPENSSL_NO_ENGINE 
- 
-int TS_CONF_set_crypto_device(CONF *conf, const char *section, 
-                              const char *device) 
-{ 
-    int ret = 0; 
- 
-    if (device == NULL) 
-        device = NCONF_get_string(conf, section, ENV_CRYPTO_DEVICE); 
- 
-    if (device && !TS_CONF_set_default_engine(device)) { 
-        ts_CONF_invalid(section, ENV_CRYPTO_DEVICE); 
-        goto err; 
-    } 
-    ret = 1; 
- err: 
-    return ret; 
-} 
- 
-int TS_CONF_set_default_engine(const char *name) 
-{ 
-    ENGINE *e = NULL; 
-    int ret = 0; 
- 
-    if (strcmp(name, "builtin") == 0) 
-        return 1; 
- 
-    if ((e = ENGINE_by_id(name)) == NULL) 
-        goto err; 
-    if (strcmp(name, "chil") == 0) 
-        ENGINE_ctrl(e, ENGINE_CTRL_CHIL_SET_FORKCHECK, 1, 0, 0); 
-    if (!ENGINE_set_default(e, ENGINE_METHOD_ALL)) 
-        goto err; 
-    ret = 1; 
- 
- err: 
-    if (!ret) { 
-        TSerr(TS_F_TS_CONF_SET_DEFAULT_ENGINE, TS_R_COULD_NOT_SET_ENGINE); 
-        ERR_add_error_data(2, "engine:", name); 
-    } 
-    ENGINE_free(e); 
-    return ret; 
-} 
- 
-#endif 
- 
-int TS_CONF_set_signer_cert(CONF *conf, const char *section, 
-                            const char *cert, TS_RESP_CTX *ctx) 
-{ 
-    int ret = 0; 
-    X509 *cert_obj = NULL; 
- 
-    if (cert == NULL) { 
-        cert = NCONF_get_string(conf, section, ENV_SIGNER_CERT); 
-        if (cert == NULL) { 
-            ts_CONF_lookup_fail(section, ENV_SIGNER_CERT); 
-            goto err; 
-        } 
-    } 
-    if ((cert_obj = TS_CONF_load_cert(cert)) == NULL) 
-        goto err; 
-    if (!TS_RESP_CTX_set_signer_cert(ctx, cert_obj)) 
-        goto err; 
- 
-    ret = 1; 
- err: 
-    X509_free(cert_obj); 
-    return ret; 
-} 
- 
-int TS_CONF_set_certs(CONF *conf, const char *section, const char *certs, 
-                      TS_RESP_CTX *ctx) 
-{ 
-    int ret = 0; 
-    STACK_OF(X509) *certs_obj = NULL; 
- 
-    if (certs == NULL) { 
-        /* Certificate chain is optional. */ 
-        if ((certs = NCONF_get_string(conf, section, ENV_CERTS)) == NULL) 
-            goto end; 
-    } 
-    if ((certs_obj = TS_CONF_load_certs(certs)) == NULL) 
-        goto err; 
-    if (!TS_RESP_CTX_set_certs(ctx, certs_obj)) 
-        goto err; 
- end: 
-    ret = 1; 
- err: 
-    sk_X509_pop_free(certs_obj, X509_free); 
-    return ret; 
-} 
- 
-int TS_CONF_set_signer_key(CONF *conf, const char *section, 
-                           const char *key, const char *pass, 
-                           TS_RESP_CTX *ctx) 
-{ 
-    int ret = 0; 
-    EVP_PKEY *key_obj = NULL; 
-    if (!key) 
-        key = NCONF_get_string(conf, section, ENV_SIGNER_KEY); 
-    if (!key) { 
-        ts_CONF_lookup_fail(section, ENV_SIGNER_KEY); 
-        goto err; 
-    } 
-    if ((key_obj = TS_CONF_load_key(key, pass)) == NULL) 
-        goto err; 
-    if (!TS_RESP_CTX_set_signer_key(ctx, key_obj)) 
-        goto err; 
- 
-    ret = 1; 
- err: 
-    EVP_PKEY_free(key_obj); 
-    return ret; 
-} 
- 
-int TS_CONF_set_signer_digest(CONF *conf, const char *section, 
-                              const char *md, TS_RESP_CTX *ctx) 
-{ 
-    int ret = 0; 
-    const EVP_MD *sign_md = NULL; 
-    if (md == NULL) 
-        md = NCONF_get_string(conf, section, ENV_SIGNER_DIGEST); 
-    if (md == NULL) { 
-        ts_CONF_lookup_fail(section, ENV_SIGNER_DIGEST); 
-        goto err; 
-    } 
-    sign_md = EVP_get_digestbyname(md); 
-    if (sign_md == NULL) { 
-        ts_CONF_invalid(section, ENV_SIGNER_DIGEST); 
-        goto err; 
-    } 
-    if (!TS_RESP_CTX_set_signer_digest(ctx, sign_md)) 
-        goto err; 
- 
-    ret = 1; 
- err: 
-    return ret; 
-} 
- 
-int TS_CONF_set_def_policy(CONF *conf, const char *section, 
-                           const char *policy, TS_RESP_CTX *ctx) 
-{ 
-    int ret = 0; 
-    ASN1_OBJECT *policy_obj = NULL; 
-    if (!policy) 
-        policy = NCONF_get_string(conf, section, ENV_DEFAULT_POLICY); 
-    if (!policy) { 
-        ts_CONF_lookup_fail(section, ENV_DEFAULT_POLICY); 
-        goto err; 
-    } 
-    if ((policy_obj = OBJ_txt2obj(policy, 0)) == NULL) { 
-        ts_CONF_invalid(section, ENV_DEFAULT_POLICY); 
-        goto err; 
-    } 
-    if (!TS_RESP_CTX_set_def_policy(ctx, policy_obj)) 
-        goto err; 
- 
-    ret = 1; 
- err: 
-    ASN1_OBJECT_free(policy_obj); 
-    return ret; 
-} 
- 
-int TS_CONF_set_policies(CONF *conf, const char *section, TS_RESP_CTX *ctx) 
-{ 
-    int ret = 0; 
-    int i; 
-    STACK_OF(CONF_VALUE) *list = NULL; 
-    char *policies = NCONF_get_string(conf, section, ENV_OTHER_POLICIES); 
- 
-    /* If no other policy is specified, that's fine. */ 
-    if (policies && (list = X509V3_parse_list(policies)) == NULL) { 
-        ts_CONF_invalid(section, ENV_OTHER_POLICIES); 
-        goto err; 
-    } 
-    for (i = 0; i < sk_CONF_VALUE_num(list); ++i) { 
-        CONF_VALUE *val = sk_CONF_VALUE_value(list, i); 
-        const char *extval = val->value ? val->value : val->name; 
-        ASN1_OBJECT *objtmp; 
- 
-        if ((objtmp = OBJ_txt2obj(extval, 0)) == NULL) { 
-            ts_CONF_invalid(section, ENV_OTHER_POLICIES); 
-            goto err; 
-        } 
-        if (!TS_RESP_CTX_add_policy(ctx, objtmp)) 
-            goto err; 
-        ASN1_OBJECT_free(objtmp); 
-    } 
- 
-    ret = 1; 
- err: 
-    sk_CONF_VALUE_pop_free(list, X509V3_conf_free); 
-    return ret; 
-} 
- 
-int TS_CONF_set_digests(CONF *conf, const char *section, TS_RESP_CTX *ctx) 
-{ 
-    int ret = 0; 
-    int i; 
-    STACK_OF(CONF_VALUE) *list = NULL; 
-    char *digests = NCONF_get_string(conf, section, ENV_DIGESTS); 
- 
-    if (digests == NULL) { 
-        ts_CONF_lookup_fail(section, ENV_DIGESTS); 
-        goto err; 
-    } 
-    if ((list = X509V3_parse_list(digests)) == NULL) { 
-        ts_CONF_invalid(section, ENV_DIGESTS); 
-        goto err; 
-    } 
-    if (sk_CONF_VALUE_num(list) == 0) { 
-        ts_CONF_invalid(section, ENV_DIGESTS); 
-        goto err; 
-    } 
-    for (i = 0; i < sk_CONF_VALUE_num(list); ++i) { 
-        CONF_VALUE *val = sk_CONF_VALUE_value(list, i); 
-        const char *extval = val->value ? val->value : val->name; 
-        const EVP_MD *md; 
- 
-        if ((md = EVP_get_digestbyname(extval)) == NULL) { 
-            ts_CONF_invalid(section, ENV_DIGESTS); 
-            goto err; 
-        } 
-        if (!TS_RESP_CTX_add_md(ctx, md)) 
-            goto err; 
-    } 
- 
-    ret = 1; 
- err: 
-    sk_CONF_VALUE_pop_free(list, X509V3_conf_free); 
-    return ret; 
-} 
- 
-int TS_CONF_set_accuracy(CONF *conf, const char *section, TS_RESP_CTX *ctx) 
-{ 
-    int ret = 0; 
-    int i; 
-    int secs = 0, millis = 0, micros = 0; 
-    STACK_OF(CONF_VALUE) *list = NULL; 
-    char *accuracy = NCONF_get_string(conf, section, ENV_ACCURACY); 
- 
-    if (accuracy && (list = X509V3_parse_list(accuracy)) == NULL) { 
-        ts_CONF_invalid(section, ENV_ACCURACY); 
-        goto err; 
-    } 
-    for (i = 0; i < sk_CONF_VALUE_num(list); ++i) { 
-        CONF_VALUE *val = sk_CONF_VALUE_value(list, i); 
-        if (strcmp(val->name, ENV_VALUE_SECS) == 0) { 
-            if (val->value) 
-                secs = atoi(val->value); 
-        } else if (strcmp(val->name, ENV_VALUE_MILLISECS) == 0) { 
-            if (val->value) 
-                millis = atoi(val->value); 
-        } else if (strcmp(val->name, ENV_VALUE_MICROSECS) == 0) { 
-            if (val->value) 
-                micros = atoi(val->value); 
-        } else { 
-            ts_CONF_invalid(section, ENV_ACCURACY); 
-            goto err; 
-        } 
-    } 
-    if (!TS_RESP_CTX_set_accuracy(ctx, secs, millis, micros)) 
-        goto err; 
- 
-    ret = 1; 
- err: 
-    sk_CONF_VALUE_pop_free(list, X509V3_conf_free); 
-    return ret; 
-} 
- 
-int TS_CONF_set_clock_precision_digits(CONF *conf, const char *section, 
-                                       TS_RESP_CTX *ctx) 
-{ 
-    int ret = 0; 
-    long digits = 0; 
- 
-    /* 
-     * If not specified, set the default value to 0, i.e. sec precision 
-     */ 
-    if (!NCONF_get_number_e(conf, section, ENV_CLOCK_PRECISION_DIGITS, 
-                            &digits)) 
-        digits = 0; 
-    if (digits < 0 || digits > TS_MAX_CLOCK_PRECISION_DIGITS) { 
-        ts_CONF_invalid(section, ENV_CLOCK_PRECISION_DIGITS); 
-        goto err; 
-    } 
- 
-    if (!TS_RESP_CTX_set_clock_precision_digits(ctx, digits)) 
-        goto err; 
- 
-    return 1; 
- err: 
-    return ret; 
-} 
- 
-static int ts_CONF_add_flag(CONF *conf, const char *section, 
-                            const char *field, int flag, TS_RESP_CTX *ctx) 
-{ 
-    const char *value = NCONF_get_string(conf, section, field); 
- 
-    if (value) { 
-        if (strcmp(value, ENV_VALUE_YES) == 0) 
-            TS_RESP_CTX_add_flags(ctx, flag); 
-        else if (strcmp(value, ENV_VALUE_NO) != 0) { 
-            ts_CONF_invalid(section, field); 
-            return 0; 
-        } 
-    } 
- 
-    return 1; 
-} 
- 
-int TS_CONF_set_ordering(CONF *conf, const char *section, TS_RESP_CTX *ctx) 
-{ 
-    return ts_CONF_add_flag(conf, section, ENV_ORDERING, TS_ORDERING, ctx); 
-} 
- 
-int TS_CONF_set_tsa_name(CONF *conf, const char *section, TS_RESP_CTX *ctx) 
-{ 
-    return ts_CONF_add_flag(conf, section, ENV_TSA_NAME, TS_TSA_NAME, ctx); 
-} 
- 
-int TS_CONF_set_ess_cert_id_chain(CONF *conf, const char *section, 
-                                  TS_RESP_CTX *ctx) 
-{ 
-    return ts_CONF_add_flag(conf, section, ENV_ESS_CERT_ID_CHAIN, 
-                            TS_ESS_CERT_ID_CHAIN, ctx); 
-} 
- 
-int TS_CONF_set_ess_cert_id_digest(CONF *conf, const char *section, 
-                                   TS_RESP_CTX *ctx) 
-{ 
-    int ret = 0; 
-    const EVP_MD *cert_md = NULL; 
-    const char *md = NCONF_get_string(conf, section, ENV_ESS_CERT_ID_ALG); 
- 
-    if (md == NULL) 
-        md = "sha1"; 
- 
-    cert_md = EVP_get_digestbyname(md); 
-    if (cert_md == NULL) { 
-        ts_CONF_invalid(section, ENV_ESS_CERT_ID_ALG); 
-        goto err; 
-    } 
- 
-    if (!TS_RESP_CTX_set_ess_cert_id_digest(ctx, cert_md)) 
-        goto err; 
- 
-    ret = 1; 
-err: 
-    return ret; 
-} 
+/*
+ * Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the OpenSSL license (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#include <string.h>
+
+#include <openssl/crypto.h>
+#include "internal/cryptlib.h"
+#include <openssl/pem.h>
+#include <openssl/engine.h>
+#include <openssl/ts.h>
+
+/* Macro definitions for the configuration file. */
+#define BASE_SECTION                    "tsa"
+#define ENV_DEFAULT_TSA                 "default_tsa"
+#define ENV_SERIAL                      "serial"
+#define ENV_CRYPTO_DEVICE               "crypto_device"
+#define ENV_SIGNER_CERT                 "signer_cert"
+#define ENV_CERTS                       "certs"
+#define ENV_SIGNER_KEY                  "signer_key"
+#define ENV_SIGNER_DIGEST               "signer_digest"
+#define ENV_DEFAULT_POLICY              "default_policy"
+#define ENV_OTHER_POLICIES              "other_policies"
+#define ENV_DIGESTS                     "digests"
+#define ENV_ACCURACY                    "accuracy"
+#define ENV_ORDERING                    "ordering"
+#define ENV_TSA_NAME                    "tsa_name"
+#define ENV_ESS_CERT_ID_CHAIN           "ess_cert_id_chain"
+#define ENV_VALUE_SECS                  "secs"
+#define ENV_VALUE_MILLISECS             "millisecs"
+#define ENV_VALUE_MICROSECS             "microsecs"
+#define ENV_CLOCK_PRECISION_DIGITS      "clock_precision_digits"
+#define ENV_VALUE_YES                   "yes"
+#define ENV_VALUE_NO                    "no"
+#define ENV_ESS_CERT_ID_ALG             "ess_cert_id_alg"
+
+/* Function definitions for certificate and key loading. */
+
+X509 *TS_CONF_load_cert(const char *file)
+{
+    BIO *cert = NULL;
+    X509 *x = NULL;
+
+    if ((cert = BIO_new_file(file, "r")) == NULL)
+        goto end;
+    x = PEM_read_bio_X509_AUX(cert, NULL, NULL, NULL);
+ end:
+    if (x == NULL)
+        TSerr(TS_F_TS_CONF_LOAD_CERT, TS_R_CANNOT_LOAD_CERT);
+    BIO_free(cert);
+    return x;
+}
+
+STACK_OF(X509) *TS_CONF_load_certs(const char *file)
+{
+    BIO *certs = NULL;
+    STACK_OF(X509) *othercerts = NULL;
+    STACK_OF(X509_INFO) *allcerts = NULL;
+    int i;
+
+    if ((certs = BIO_new_file(file, "r")) == NULL)
+        goto end;
+    if ((othercerts = sk_X509_new_null()) == NULL)
+        goto end;
+
+    allcerts = PEM_X509_INFO_read_bio(certs, NULL, NULL, NULL);
+    for (i = 0; i < sk_X509_INFO_num(allcerts); i++) {
+        X509_INFO *xi = sk_X509_INFO_value(allcerts, i);
+        if (xi->x509) {
+            sk_X509_push(othercerts, xi->x509);
+            xi->x509 = NULL;
+        }
+    }
+ end:
+    if (othercerts == NULL)
+        TSerr(TS_F_TS_CONF_LOAD_CERTS, TS_R_CANNOT_LOAD_CERT);
+    sk_X509_INFO_pop_free(allcerts, X509_INFO_free);
+    BIO_free(certs);
+    return othercerts;
+}
+
+EVP_PKEY *TS_CONF_load_key(const char *file, const char *pass)
+{
+    BIO *key = NULL;
+    EVP_PKEY *pkey = NULL;
+
+    if ((key = BIO_new_file(file, "r")) == NULL)
+        goto end;
+    pkey = PEM_read_bio_PrivateKey(key, NULL, NULL, (char *)pass);
+ end:
+    if (pkey == NULL)
+        TSerr(TS_F_TS_CONF_LOAD_KEY, TS_R_CANNOT_LOAD_KEY);
+    BIO_free(key);
+    return pkey;
+}
+
+/* Function definitions for handling configuration options. */
+
+static void ts_CONF_lookup_fail(const char *name, const char *tag)
+{
+    TSerr(TS_F_TS_CONF_LOOKUP_FAIL, TS_R_VAR_LOOKUP_FAILURE);
+    ERR_add_error_data(3, name, "::", tag);
+}
+
+static void ts_CONF_invalid(const char *name, const char *tag)
+{
+    TSerr(TS_F_TS_CONF_INVALID, TS_R_VAR_BAD_VALUE);
+    ERR_add_error_data(3, name, "::", tag);
+}
+
+const char *TS_CONF_get_tsa_section(CONF *conf, const char *section)
+{
+    if (!section) {
+        section = NCONF_get_string(conf, BASE_SECTION, ENV_DEFAULT_TSA);
+        if (!section)
+            ts_CONF_lookup_fail(BASE_SECTION, ENV_DEFAULT_TSA);
+    }
+    return section;
+}
+
+int TS_CONF_set_serial(CONF *conf, const char *section, TS_serial_cb cb,
+                       TS_RESP_CTX *ctx)
+{
+    int ret = 0;
+    char *serial = NCONF_get_string(conf, section, ENV_SERIAL);
+    if (!serial) {
+        ts_CONF_lookup_fail(section, ENV_SERIAL);
+        goto err;
+    }
+    TS_RESP_CTX_set_serial_cb(ctx, cb, serial);
+
+    ret = 1;
+ err:
+    return ret;
+}
+
+#ifndef OPENSSL_NO_ENGINE
+
+int TS_CONF_set_crypto_device(CONF *conf, const char *section,
+                              const char *device)
+{
+    int ret = 0;
+
+    if (device == NULL)
+        device = NCONF_get_string(conf, section, ENV_CRYPTO_DEVICE);
+
+    if (device && !TS_CONF_set_default_engine(device)) {
+        ts_CONF_invalid(section, ENV_CRYPTO_DEVICE);
+        goto err;
+    }
+    ret = 1;
+ err:
+    return ret;
+}
+
+int TS_CONF_set_default_engine(const char *name)
+{
+    ENGINE *e = NULL;
+    int ret = 0;
+
+    if (strcmp(name, "builtin") == 0)
+        return 1;
+
+    if ((e = ENGINE_by_id(name)) == NULL)
+        goto err;
+    if (strcmp(name, "chil") == 0)
+        ENGINE_ctrl(e, ENGINE_CTRL_CHIL_SET_FORKCHECK, 1, 0, 0);
+    if (!ENGINE_set_default(e, ENGINE_METHOD_ALL))
+        goto err;
+    ret = 1;
+
+ err:
+    if (!ret) {
+        TSerr(TS_F_TS_CONF_SET_DEFAULT_ENGINE, TS_R_COULD_NOT_SET_ENGINE);
+        ERR_add_error_data(2, "engine:", name);
+    }
+    ENGINE_free(e);
+    return ret;
+}
+
+#endif
+
+int TS_CONF_set_signer_cert(CONF *conf, const char *section,
+                            const char *cert, TS_RESP_CTX *ctx)
+{
+    int ret = 0;
+    X509 *cert_obj = NULL;
+
+    if (cert == NULL) {
+        cert = NCONF_get_string(conf, section, ENV_SIGNER_CERT);
+        if (cert == NULL) {
+            ts_CONF_lookup_fail(section, ENV_SIGNER_CERT);
+            goto err;
+        }
+    }
+    if ((cert_obj = TS_CONF_load_cert(cert)) == NULL)
+        goto err;
+    if (!TS_RESP_CTX_set_signer_cert(ctx, cert_obj))
+        goto err;
+
+    ret = 1;
+ err:
+    X509_free(cert_obj);
+    return ret;
+}
+
+int TS_CONF_set_certs(CONF *conf, const char *section, const char *certs,
+                      TS_RESP_CTX *ctx)
+{
+    int ret = 0;
+    STACK_OF(X509) *certs_obj = NULL;
+
+    if (certs == NULL) {
+        /* Certificate chain is optional. */
+        if ((certs = NCONF_get_string(conf, section, ENV_CERTS)) == NULL)
+            goto end;
+    }
+    if ((certs_obj = TS_CONF_load_certs(certs)) == NULL)
+        goto err;
+    if (!TS_RESP_CTX_set_certs(ctx, certs_obj))
+        goto err;
+ end:
+    ret = 1;
+ err:
+    sk_X509_pop_free(certs_obj, X509_free);
+    return ret;
+}
+
+int TS_CONF_set_signer_key(CONF *conf, const char *section,
+                           const char *key, const char *pass,
+                           TS_RESP_CTX *ctx)
+{
+    int ret = 0;
+    EVP_PKEY *key_obj = NULL;
+    if (!key)
+        key = NCONF_get_string(conf, section, ENV_SIGNER_KEY);
+    if (!key) {
+        ts_CONF_lookup_fail(section, ENV_SIGNER_KEY);
+        goto err;
+    }
+    if ((key_obj = TS_CONF_load_key(key, pass)) == NULL)
+        goto err;
+    if (!TS_RESP_CTX_set_signer_key(ctx, key_obj))
+        goto err;
+
+    ret = 1;
+ err:
+    EVP_PKEY_free(key_obj);
+    return ret;
+}
+
+int TS_CONF_set_signer_digest(CONF *conf, const char *section,
+                              const char *md, TS_RESP_CTX *ctx)
+{
+    int ret = 0;
+    const EVP_MD *sign_md = NULL;
+    if (md == NULL)
+        md = NCONF_get_string(conf, section, ENV_SIGNER_DIGEST);
+    if (md == NULL) {
+        ts_CONF_lookup_fail(section, ENV_SIGNER_DIGEST);
+        goto err;
+    }
+    sign_md = EVP_get_digestbyname(md);
+    if (sign_md == NULL) {
+        ts_CONF_invalid(section, ENV_SIGNER_DIGEST);
+        goto err;
+    }
+    if (!TS_RESP_CTX_set_signer_digest(ctx, sign_md))
+        goto err;
+
+    ret = 1;
+ err:
+    return ret;
+}
+
+int TS_CONF_set_def_policy(CONF *conf, const char *section,
+                           const char *policy, TS_RESP_CTX *ctx)
+{
+    int ret = 0;
+    ASN1_OBJECT *policy_obj = NULL;
+    if (!policy)
+        policy = NCONF_get_string(conf, section, ENV_DEFAULT_POLICY);
+    if (!policy) {
+        ts_CONF_lookup_fail(section, ENV_DEFAULT_POLICY);
+        goto err;
+    }
+    if ((policy_obj = OBJ_txt2obj(policy, 0)) == NULL) {
+        ts_CONF_invalid(section, ENV_DEFAULT_POLICY);
+        goto err;
+    }
+    if (!TS_RESP_CTX_set_def_policy(ctx, policy_obj))
+        goto err;
+
+    ret = 1;
+ err:
+    ASN1_OBJECT_free(policy_obj);
+    return ret;
+}
+
+int TS_CONF_set_policies(CONF *conf, const char *section, TS_RESP_CTX *ctx)
+{
+    int ret = 0;
+    int i;
+    STACK_OF(CONF_VALUE) *list = NULL;
+    char *policies = NCONF_get_string(conf, section, ENV_OTHER_POLICIES);
+
+    /* If no other policy is specified, that's fine. */
+    if (policies && (list = X509V3_parse_list(policies)) == NULL) {
+        ts_CONF_invalid(section, ENV_OTHER_POLICIES);
+        goto err;
+    }
+    for (i = 0; i < sk_CONF_VALUE_num(list); ++i) {
+        CONF_VALUE *val = sk_CONF_VALUE_value(list, i);
+        const char *extval = val->value ? val->value : val->name;
+        ASN1_OBJECT *objtmp;
+
+        if ((objtmp = OBJ_txt2obj(extval, 0)) == NULL) {
+            ts_CONF_invalid(section, ENV_OTHER_POLICIES);
+            goto err;
+        }
+        if (!TS_RESP_CTX_add_policy(ctx, objtmp))
+            goto err;
+        ASN1_OBJECT_free(objtmp);
+    }
+
+    ret = 1;
+ err:
+    sk_CONF_VALUE_pop_free(list, X509V3_conf_free);
+    return ret;
+}
+
+int TS_CONF_set_digests(CONF *conf, const char *section, TS_RESP_CTX *ctx)
+{
+    int ret = 0;
+    int i;
+    STACK_OF(CONF_VALUE) *list = NULL;
+    char *digests = NCONF_get_string(conf, section, ENV_DIGESTS);
+
+    if (digests == NULL) {
+        ts_CONF_lookup_fail(section, ENV_DIGESTS);
+        goto err;
+    }
+    if ((list = X509V3_parse_list(digests)) == NULL) {
+        ts_CONF_invalid(section, ENV_DIGESTS);
+        goto err;
+    }
+    if (sk_CONF_VALUE_num(list) == 0) {
+        ts_CONF_invalid(section, ENV_DIGESTS);
+        goto err;
+    }
+    for (i = 0; i < sk_CONF_VALUE_num(list); ++i) {
+        CONF_VALUE *val = sk_CONF_VALUE_value(list, i);
+        const char *extval = val->value ? val->value : val->name;
+        const EVP_MD *md;
+
+        if ((md = EVP_get_digestbyname(extval)) == NULL) {
+            ts_CONF_invalid(section, ENV_DIGESTS);
+            goto err;
+        }
+        if (!TS_RESP_CTX_add_md(ctx, md))
+            goto err;
+    }
+
+    ret = 1;
+ err:
+    sk_CONF_VALUE_pop_free(list, X509V3_conf_free);
+    return ret;
+}
+
+int TS_CONF_set_accuracy(CONF *conf, const char *section, TS_RESP_CTX *ctx)
+{
+    int ret = 0;
+    int i;
+    int secs = 0, millis = 0, micros = 0;
+    STACK_OF(CONF_VALUE) *list = NULL;
+    char *accuracy = NCONF_get_string(conf, section, ENV_ACCURACY);
+
+    if (accuracy && (list = X509V3_parse_list(accuracy)) == NULL) {
+        ts_CONF_invalid(section, ENV_ACCURACY);
+        goto err;
+    }
+    for (i = 0; i < sk_CONF_VALUE_num(list); ++i) {
+        CONF_VALUE *val = sk_CONF_VALUE_value(list, i);
+        if (strcmp(val->name, ENV_VALUE_SECS) == 0) {
+            if (val->value)
+                secs = atoi(val->value);
+        } else if (strcmp(val->name, ENV_VALUE_MILLISECS) == 0) {
+            if (val->value)
+                millis = atoi(val->value);
+        } else if (strcmp(val->name, ENV_VALUE_MICROSECS) == 0) {
+            if (val->value)
+                micros = atoi(val->value);
+        } else {
+            ts_CONF_invalid(section, ENV_ACCURACY);
+            goto err;
+        }
+    }
+    if (!TS_RESP_CTX_set_accuracy(ctx, secs, millis, micros))
+        goto err;
+
+    ret = 1;
+ err:
+    sk_CONF_VALUE_pop_free(list, X509V3_conf_free);
+    return ret;
+}
+
+int TS_CONF_set_clock_precision_digits(CONF *conf, const char *section,
+                                       TS_RESP_CTX *ctx)
+{
+    int ret = 0;
+    long digits = 0;
+
+    /*
+     * If not specified, set the default value to 0, i.e. sec precision
+     */
+    if (!NCONF_get_number_e(conf, section, ENV_CLOCK_PRECISION_DIGITS,
+                            &digits))
+        digits = 0;
+    if (digits < 0 || digits > TS_MAX_CLOCK_PRECISION_DIGITS) {
+        ts_CONF_invalid(section, ENV_CLOCK_PRECISION_DIGITS);
+        goto err;
+    }
+
+    if (!TS_RESP_CTX_set_clock_precision_digits(ctx, digits))
+        goto err;
+
+    return 1;
+ err:
+    return ret;
+}
+
+static int ts_CONF_add_flag(CONF *conf, const char *section,
+                            const char *field, int flag, TS_RESP_CTX *ctx)
+{
+    const char *value = NCONF_get_string(conf, section, field);
+
+    if (value) {
+        if (strcmp(value, ENV_VALUE_YES) == 0)
+            TS_RESP_CTX_add_flags(ctx, flag);
+        else if (strcmp(value, ENV_VALUE_NO) != 0) {
+            ts_CONF_invalid(section, field);
+            return 0;
+        }
+    }
+
+    return 1;
+}
+
+int TS_CONF_set_ordering(CONF *conf, const char *section, TS_RESP_CTX *ctx)
+{
+    return ts_CONF_add_flag(conf, section, ENV_ORDERING, TS_ORDERING, ctx);
+}
+
+int TS_CONF_set_tsa_name(CONF *conf, const char *section, TS_RESP_CTX *ctx)
+{
+    return ts_CONF_add_flag(conf, section, ENV_TSA_NAME, TS_TSA_NAME, ctx);
+}
+
+int TS_CONF_set_ess_cert_id_chain(CONF *conf, const char *section,
+                                  TS_RESP_CTX *ctx)
+{
+    return ts_CONF_add_flag(conf, section, ENV_ESS_CERT_ID_CHAIN,
+                            TS_ESS_CERT_ID_CHAIN, ctx);
+}
+
+int TS_CONF_set_ess_cert_id_digest(CONF *conf, const char *section,
+                                   TS_RESP_CTX *ctx)
+{
+    int ret = 0;
+    const EVP_MD *cert_md = NULL;
+    const char *md = NCONF_get_string(conf, section, ENV_ESS_CERT_ID_ALG);
+
+    if (md == NULL)
+        md = "sha1";
+
+    cert_md = EVP_get_digestbyname(md);
+    if (cert_md == NULL) {
+        ts_CONF_invalid(section, ENV_ESS_CERT_ID_ALG);
+        goto err;
+    }
+
+    if (!TS_RESP_CTX_set_ess_cert_id_digest(ctx, cert_md))
+        goto err;
+
+    ret = 1;
+err:
+    return ret;
+}
diff --git a/contrib/libs/openssl/crypto/ts/ts_err.c b/contrib/libs/openssl/crypto/ts/ts_err.c
index 98d534d3a0..1f3854d849 100644
--- a/contrib/libs/openssl/crypto/ts/ts_err.c
+++ b/contrib/libs/openssl/crypto/ts/ts_err.c
@@ -1,184 +1,184 @@
-/* 
- * Generated by util/mkerr.pl DO NOT EDIT 
- * Copyright 1995-2017 The OpenSSL Project Authors. All Rights Reserved. 
- * 
- * Licensed under the OpenSSL license (the "License").  You may not use 
- * this file except in compliance with the License.  You can obtain a copy 
- * in the file LICENSE in the source distribution or at 
- * https://www.openssl.org/source/license.html 
- */ 
- 
-#include <openssl/err.h> 
-#include <openssl/tserr.h> 
- 
-#ifndef OPENSSL_NO_ERR 
- 
-static const ERR_STRING_DATA TS_str_functs[] = { 
-    {ERR_PACK(ERR_LIB_TS, TS_F_DEF_SERIAL_CB, 0), "def_serial_cb"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_DEF_TIME_CB, 0), "def_time_cb"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_ESS_ADD_SIGNING_CERT, 0), 
-     "ess_add_signing_cert"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_ESS_ADD_SIGNING_CERT_V2, 0), 
-     "ess_add_signing_cert_v2"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_ESS_CERT_ID_NEW_INIT, 0), 
-     "ess_CERT_ID_new_init"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_ESS_CERT_ID_V2_NEW_INIT, 0), 
-     "ess_cert_id_v2_new_init"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_ESS_SIGNING_CERT_NEW_INIT, 0), 
-     "ess_SIGNING_CERT_new_init"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_ESS_SIGNING_CERT_V2_NEW_INIT, 0), 
-     "ess_signing_cert_v2_new_init"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_INT_TS_RESP_VERIFY_TOKEN, 0), 
-     "int_ts_RESP_verify_token"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_PKCS7_TO_TS_TST_INFO, 0), 
-     "PKCS7_to_TS_TST_INFO"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_ACCURACY_SET_MICROS, 0), 
-     "TS_ACCURACY_set_micros"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_ACCURACY_SET_MILLIS, 0), 
-     "TS_ACCURACY_set_millis"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_ACCURACY_SET_SECONDS, 0), 
-     "TS_ACCURACY_set_seconds"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_CHECK_IMPRINTS, 0), "ts_check_imprints"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_CHECK_NONCES, 0), "ts_check_nonces"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_CHECK_POLICY, 0), "ts_check_policy"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_CHECK_SIGNING_CERTS, 0), 
-     "ts_check_signing_certs"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_CHECK_STATUS_INFO, 0), 
-     "ts_check_status_info"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_COMPUTE_IMPRINT, 0), "ts_compute_imprint"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_CONF_INVALID, 0), "ts_CONF_invalid"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_CONF_LOAD_CERT, 0), "TS_CONF_load_cert"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_CONF_LOAD_CERTS, 0), "TS_CONF_load_certs"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_CONF_LOAD_KEY, 0), "TS_CONF_load_key"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_CONF_LOOKUP_FAIL, 0), "ts_CONF_lookup_fail"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_CONF_SET_DEFAULT_ENGINE, 0), 
-     "TS_CONF_set_default_engine"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_GET_STATUS_TEXT, 0), "ts_get_status_text"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_MSG_IMPRINT_SET_ALGO, 0), 
-     "TS_MSG_IMPRINT_set_algo"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_REQ_SET_MSG_IMPRINT, 0), 
-     "TS_REQ_set_msg_imprint"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_REQ_SET_NONCE, 0), "TS_REQ_set_nonce"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_REQ_SET_POLICY_ID, 0), 
-     "TS_REQ_set_policy_id"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_CREATE_RESPONSE, 0), 
-     "TS_RESP_create_response"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_CREATE_TST_INFO, 0), 
-     "ts_RESP_create_tst_info"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_CTX_ADD_FAILURE_INFO, 0), 
-     "TS_RESP_CTX_add_failure_info"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_CTX_ADD_MD, 0), "TS_RESP_CTX_add_md"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_CTX_ADD_POLICY, 0), 
-     "TS_RESP_CTX_add_policy"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_CTX_NEW, 0), "TS_RESP_CTX_new"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_CTX_SET_ACCURACY, 0), 
-     "TS_RESP_CTX_set_accuracy"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_CTX_SET_CERTS, 0), 
-     "TS_RESP_CTX_set_certs"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_CTX_SET_DEF_POLICY, 0), 
-     "TS_RESP_CTX_set_def_policy"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_CTX_SET_SIGNER_CERT, 0), 
-     "TS_RESP_CTX_set_signer_cert"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_CTX_SET_STATUS_INFO, 0), 
-     "TS_RESP_CTX_set_status_info"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_GET_POLICY, 0), "ts_RESP_get_policy"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_SET_GENTIME_WITH_PRECISION, 0), 
-     "TS_RESP_set_genTime_with_precision"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_SET_STATUS_INFO, 0), 
-     "TS_RESP_set_status_info"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_SET_TST_INFO, 0), 
-     "TS_RESP_set_tst_info"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_SIGN, 0), "ts_RESP_sign"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_VERIFY_SIGNATURE, 0), 
-     "TS_RESP_verify_signature"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_TST_INFO_SET_ACCURACY, 0), 
-     "TS_TST_INFO_set_accuracy"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_TST_INFO_SET_MSG_IMPRINT, 0), 
-     "TS_TST_INFO_set_msg_imprint"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_TST_INFO_SET_NONCE, 0), 
-     "TS_TST_INFO_set_nonce"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_TST_INFO_SET_POLICY_ID, 0), 
-     "TS_TST_INFO_set_policy_id"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_TST_INFO_SET_SERIAL, 0), 
-     "TS_TST_INFO_set_serial"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_TST_INFO_SET_TIME, 0), 
-     "TS_TST_INFO_set_time"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_TST_INFO_SET_TSA, 0), "TS_TST_INFO_set_tsa"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_VERIFY, 0), ""}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_VERIFY_CERT, 0), "ts_verify_cert"}, 
-    {ERR_PACK(ERR_LIB_TS, TS_F_TS_VERIFY_CTX_NEW, 0), "TS_VERIFY_CTX_new"}, 
-    {0, NULL} 
-}; 
- 
-static const ERR_STRING_DATA TS_str_reasons[] = { 
-    {ERR_PACK(ERR_LIB_TS, 0, TS_R_BAD_PKCS7_TYPE), "bad pkcs7 type"}, 
-    {ERR_PACK(ERR_LIB_TS, 0, TS_R_BAD_TYPE), "bad type"}, 
-    {ERR_PACK(ERR_LIB_TS, 0, TS_R_CANNOT_LOAD_CERT), "cannot load certificate"}, 
-    {ERR_PACK(ERR_LIB_TS, 0, TS_R_CANNOT_LOAD_KEY), "cannot load private key"}, 
-    {ERR_PACK(ERR_LIB_TS, 0, TS_R_CERTIFICATE_VERIFY_ERROR), 
-    "certificate verify error"}, 
-    {ERR_PACK(ERR_LIB_TS, 0, TS_R_COULD_NOT_SET_ENGINE), 
-    "could not set engine"}, 
-    {ERR_PACK(ERR_LIB_TS, 0, TS_R_COULD_NOT_SET_TIME), "could not set time"}, 
-    {ERR_PACK(ERR_LIB_TS, 0, TS_R_DETACHED_CONTENT), "detached content"}, 
-    {ERR_PACK(ERR_LIB_TS, 0, TS_R_ESS_ADD_SIGNING_CERT_ERROR), 
-    "ess add signing cert error"}, 
-    {ERR_PACK(ERR_LIB_TS, 0, TS_R_ESS_ADD_SIGNING_CERT_V2_ERROR), 
-    "ess add signing cert v2 error"}, 
-    {ERR_PACK(ERR_LIB_TS, 0, TS_R_ESS_SIGNING_CERTIFICATE_ERROR), 
-    "ess signing certificate error"}, 
-    {ERR_PACK(ERR_LIB_TS, 0, TS_R_INVALID_NULL_POINTER), 
-    "invalid null pointer"}, 
-    {ERR_PACK(ERR_LIB_TS, 0, TS_R_INVALID_SIGNER_CERTIFICATE_PURPOSE), 
-    "invalid signer certificate purpose"}, 
-    {ERR_PACK(ERR_LIB_TS, 0, TS_R_MESSAGE_IMPRINT_MISMATCH), 
-    "message imprint mismatch"}, 
-    {ERR_PACK(ERR_LIB_TS, 0, TS_R_NONCE_MISMATCH), "nonce mismatch"}, 
-    {ERR_PACK(ERR_LIB_TS, 0, TS_R_NONCE_NOT_RETURNED), "nonce not returned"}, 
-    {ERR_PACK(ERR_LIB_TS, 0, TS_R_NO_CONTENT), "no content"}, 
-    {ERR_PACK(ERR_LIB_TS, 0, TS_R_NO_TIME_STAMP_TOKEN), "no time stamp token"}, 
-    {ERR_PACK(ERR_LIB_TS, 0, TS_R_PKCS7_ADD_SIGNATURE_ERROR), 
-    "pkcs7 add signature error"}, 
-    {ERR_PACK(ERR_LIB_TS, 0, TS_R_PKCS7_ADD_SIGNED_ATTR_ERROR), 
-    "pkcs7 add signed attr error"}, 
-    {ERR_PACK(ERR_LIB_TS, 0, TS_R_PKCS7_TO_TS_TST_INFO_FAILED), 
-    "pkcs7 to ts tst info failed"}, 
-    {ERR_PACK(ERR_LIB_TS, 0, TS_R_POLICY_MISMATCH), "policy mismatch"}, 
-    {ERR_PACK(ERR_LIB_TS, 0, TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE), 
-    "private key does not match certificate"}, 
-    {ERR_PACK(ERR_LIB_TS, 0, TS_R_RESPONSE_SETUP_ERROR), 
-    "response setup error"}, 
-    {ERR_PACK(ERR_LIB_TS, 0, TS_R_SIGNATURE_FAILURE), "signature failure"}, 
-    {ERR_PACK(ERR_LIB_TS, 0, TS_R_THERE_MUST_BE_ONE_SIGNER), 
-    "there must be one signer"}, 
-    {ERR_PACK(ERR_LIB_TS, 0, TS_R_TIME_SYSCALL_ERROR), "time syscall error"}, 
-    {ERR_PACK(ERR_LIB_TS, 0, TS_R_TOKEN_NOT_PRESENT), "token not present"}, 
-    {ERR_PACK(ERR_LIB_TS, 0, TS_R_TOKEN_PRESENT), "token present"}, 
-    {ERR_PACK(ERR_LIB_TS, 0, TS_R_TSA_NAME_MISMATCH), "tsa name mismatch"}, 
-    {ERR_PACK(ERR_LIB_TS, 0, TS_R_TSA_UNTRUSTED), "tsa untrusted"}, 
-    {ERR_PACK(ERR_LIB_TS, 0, TS_R_TST_INFO_SETUP_ERROR), 
-    "tst info setup error"}, 
-    {ERR_PACK(ERR_LIB_TS, 0, TS_R_TS_DATASIGN), "ts datasign"}, 
-    {ERR_PACK(ERR_LIB_TS, 0, TS_R_UNACCEPTABLE_POLICY), "unacceptable policy"}, 
-    {ERR_PACK(ERR_LIB_TS, 0, TS_R_UNSUPPORTED_MD_ALGORITHM), 
-    "unsupported md algorithm"}, 
-    {ERR_PACK(ERR_LIB_TS, 0, TS_R_UNSUPPORTED_VERSION), "unsupported version"}, 
-    {ERR_PACK(ERR_LIB_TS, 0, TS_R_VAR_BAD_VALUE), "var bad value"}, 
-    {ERR_PACK(ERR_LIB_TS, 0, TS_R_VAR_LOOKUP_FAILURE), 
-    "cannot find config variable"}, 
-    {ERR_PACK(ERR_LIB_TS, 0, TS_R_WRONG_CONTENT_TYPE), "wrong content type"}, 
-    {0, NULL} 
-}; 
- 
-#endif 
- 
-int ERR_load_TS_strings(void) 
-{ 
-#ifndef OPENSSL_NO_ERR 
-    if (ERR_func_error_string(TS_str_functs[0].error) == NULL) { 
-        ERR_load_strings_const(TS_str_functs); 
-        ERR_load_strings_const(TS_str_reasons); 
-    } 
-#endif 
-    return 1; 
-} 
+/*
+ * Generated by util/mkerr.pl DO NOT EDIT
+ * Copyright 1995-2017 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the OpenSSL license (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#include <openssl/err.h>
+#include <openssl/tserr.h>
+
+#ifndef OPENSSL_NO_ERR
+
+static const ERR_STRING_DATA TS_str_functs[] = {
+    {ERR_PACK(ERR_LIB_TS, TS_F_DEF_SERIAL_CB, 0), "def_serial_cb"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_DEF_TIME_CB, 0), "def_time_cb"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_ESS_ADD_SIGNING_CERT, 0),
+     "ess_add_signing_cert"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_ESS_ADD_SIGNING_CERT_V2, 0),
+     "ess_add_signing_cert_v2"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_ESS_CERT_ID_NEW_INIT, 0),
+     "ess_CERT_ID_new_init"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_ESS_CERT_ID_V2_NEW_INIT, 0),
+     "ess_cert_id_v2_new_init"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_ESS_SIGNING_CERT_NEW_INIT, 0),
+     "ess_SIGNING_CERT_new_init"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_ESS_SIGNING_CERT_V2_NEW_INIT, 0),
+     "ess_signing_cert_v2_new_init"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_INT_TS_RESP_VERIFY_TOKEN, 0),
+     "int_ts_RESP_verify_token"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_PKCS7_TO_TS_TST_INFO, 0),
+     "PKCS7_to_TS_TST_INFO"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_ACCURACY_SET_MICROS, 0),
+     "TS_ACCURACY_set_micros"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_ACCURACY_SET_MILLIS, 0),
+     "TS_ACCURACY_set_millis"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_ACCURACY_SET_SECONDS, 0),
+     "TS_ACCURACY_set_seconds"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_CHECK_IMPRINTS, 0), "ts_check_imprints"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_CHECK_NONCES, 0), "ts_check_nonces"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_CHECK_POLICY, 0), "ts_check_policy"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_CHECK_SIGNING_CERTS, 0),
+     "ts_check_signing_certs"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_CHECK_STATUS_INFO, 0),
+     "ts_check_status_info"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_COMPUTE_IMPRINT, 0), "ts_compute_imprint"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_CONF_INVALID, 0), "ts_CONF_invalid"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_CONF_LOAD_CERT, 0), "TS_CONF_load_cert"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_CONF_LOAD_CERTS, 0), "TS_CONF_load_certs"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_CONF_LOAD_KEY, 0), "TS_CONF_load_key"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_CONF_LOOKUP_FAIL, 0), "ts_CONF_lookup_fail"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_CONF_SET_DEFAULT_ENGINE, 0),
+     "TS_CONF_set_default_engine"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_GET_STATUS_TEXT, 0), "ts_get_status_text"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_MSG_IMPRINT_SET_ALGO, 0),
+     "TS_MSG_IMPRINT_set_algo"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_REQ_SET_MSG_IMPRINT, 0),
+     "TS_REQ_set_msg_imprint"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_REQ_SET_NONCE, 0), "TS_REQ_set_nonce"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_REQ_SET_POLICY_ID, 0),
+     "TS_REQ_set_policy_id"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_CREATE_RESPONSE, 0),
+     "TS_RESP_create_response"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_CREATE_TST_INFO, 0),
+     "ts_RESP_create_tst_info"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_CTX_ADD_FAILURE_INFO, 0),
+     "TS_RESP_CTX_add_failure_info"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_CTX_ADD_MD, 0), "TS_RESP_CTX_add_md"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_CTX_ADD_POLICY, 0),
+     "TS_RESP_CTX_add_policy"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_CTX_NEW, 0), "TS_RESP_CTX_new"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_CTX_SET_ACCURACY, 0),
+     "TS_RESP_CTX_set_accuracy"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_CTX_SET_CERTS, 0),
+     "TS_RESP_CTX_set_certs"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_CTX_SET_DEF_POLICY, 0),
+     "TS_RESP_CTX_set_def_policy"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_CTX_SET_SIGNER_CERT, 0),
+     "TS_RESP_CTX_set_signer_cert"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_CTX_SET_STATUS_INFO, 0),
+     "TS_RESP_CTX_set_status_info"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_GET_POLICY, 0), "ts_RESP_get_policy"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_SET_GENTIME_WITH_PRECISION, 0),
+     "TS_RESP_set_genTime_with_precision"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_SET_STATUS_INFO, 0),
+     "TS_RESP_set_status_info"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_SET_TST_INFO, 0),
+     "TS_RESP_set_tst_info"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_SIGN, 0), "ts_RESP_sign"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_RESP_VERIFY_SIGNATURE, 0),
+     "TS_RESP_verify_signature"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_TST_INFO_SET_ACCURACY, 0),
+     "TS_TST_INFO_set_accuracy"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_TST_INFO_SET_MSG_IMPRINT, 0),
+     "TS_TST_INFO_set_msg_imprint"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_TST_INFO_SET_NONCE, 0),
+     "TS_TST_INFO_set_nonce"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_TST_INFO_SET_POLICY_ID, 0),
+     "TS_TST_INFO_set_policy_id"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_TST_INFO_SET_SERIAL, 0),
+     "TS_TST_INFO_set_serial"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_TST_INFO_SET_TIME, 0),
+     "TS_TST_INFO_set_time"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_TST_INFO_SET_TSA, 0), "TS_TST_INFO_set_tsa"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_VERIFY, 0), ""},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_VERIFY_CERT, 0), "ts_verify_cert"},
+    {ERR_PACK(ERR_LIB_TS, TS_F_TS_VERIFY_CTX_NEW, 0), "TS_VERIFY_CTX_new"},
+    {0, NULL}
+};
+
+static const ERR_STRING_DATA TS_str_reasons[] = {
+    {ERR_PACK(ERR_LIB_TS, 0, TS_R_BAD_PKCS7_TYPE), "bad pkcs7 type"},
+    {ERR_PACK(ERR_LIB_TS, 0, TS_R_BAD_TYPE), "bad type"},
+    {ERR_PACK(ERR_LIB_TS, 0, TS_R_CANNOT_LOAD_CERT), "cannot load certificate"},
+    {ERR_PACK(ERR_LIB_TS, 0, TS_R_CANNOT_LOAD_KEY), "cannot load private key"},
+    {ERR_PACK(ERR_LIB_TS, 0, TS_R_CERTIFICATE_VERIFY_ERROR),
+    "certificate verify error"},
+    {ERR_PACK(ERR_LIB_TS, 0, TS_R_COULD_NOT_SET_ENGINE),
+    "could not set engine"},
+    {ERR_PACK(ERR_LIB_TS, 0, TS_R_COULD_NOT_SET_TIME), "could not set time"},
+    {ERR_PACK(ERR_LIB_TS, 0, TS_R_DETACHED_CONTENT), "detached content"},
+    {ERR_PACK(ERR_LIB_TS, 0, TS_R_ESS_ADD_SIGNING_CERT_ERROR),
+    "ess add signing cert error"},
+    {ERR_PACK(ERR_LIB_TS, 0, TS_R_ESS_ADD_SIGNING_CERT_V2_ERROR),
+    "ess add signing cert v2 error"},
+    {ERR_PACK(ERR_LIB_TS, 0, TS_R_ESS_SIGNING_CERTIFICATE_ERROR),
+    "ess signing certificate error"},
+    {ERR_PACK(ERR_LIB_TS, 0, TS_R_INVALID_NULL_POINTER),
+    "invalid null pointer"},
+    {ERR_PACK(ERR_LIB_TS, 0, TS_R_INVALID_SIGNER_CERTIFICATE_PURPOSE),
+    "invalid signer certificate purpose"},
+    {ERR_PACK(ERR_LIB_TS, 0, TS_R_MESSAGE_IMPRINT_MISMATCH),
+    "message imprint mismatch"},
+    {ERR_PACK(ERR_LIB_TS, 0, TS_R_NONCE_MISMATCH), "nonce mismatch"},
+    {ERR_PACK(ERR_LIB_TS, 0, TS_R_NONCE_NOT_RETURNED), "nonce not returned"},
+    {ERR_PACK(ERR_LIB_TS, 0, TS_R_NO_CONTENT), "no content"},
+    {ERR_PACK(ERR_LIB_TS, 0, TS_R_NO_TIME_STAMP_TOKEN), "no time stamp token"},
+    {ERR_PACK(ERR_LIB_TS, 0, TS_R_PKCS7_ADD_SIGNATURE_ERROR),
+    "pkcs7 add signature error"},
+    {ERR_PACK(ERR_LIB_TS, 0, TS_R_PKCS7_ADD_SIGNED_ATTR_ERROR),
+    "pkcs7 add signed attr error"},
+    {ERR_PACK(ERR_LIB_TS, 0, TS_R_PKCS7_TO_TS_TST_INFO_FAILED),
+    "pkcs7 to ts tst info failed"},
+    {ERR_PACK(ERR_LIB_TS, 0, TS_R_POLICY_MISMATCH), "policy mismatch"},
+    {ERR_PACK(ERR_LIB_TS, 0, TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE),
+    "private key does not match certificate"},
+    {ERR_PACK(ERR_LIB_TS, 0, TS_R_RESPONSE_SETUP_ERROR),
+    "response setup error"},
+    {ERR_PACK(ERR_LIB_TS, 0, TS_R_SIGNATURE_FAILURE), "signature failure"},
+    {ERR_PACK(ERR_LIB_TS, 0, TS_R_THERE_MUST_BE_ONE_SIGNER),
+    "there must be one signer"},
+    {ERR_PACK(ERR_LIB_TS, 0, TS_R_TIME_SYSCALL_ERROR), "time syscall error"},
+    {ERR_PACK(ERR_LIB_TS, 0, TS_R_TOKEN_NOT_PRESENT), "token not present"},
+    {ERR_PACK(ERR_LIB_TS, 0, TS_R_TOKEN_PRESENT), "token present"},
+    {ERR_PACK(ERR_LIB_TS, 0, TS_R_TSA_NAME_MISMATCH), "tsa name mismatch"},
+    {ERR_PACK(ERR_LIB_TS, 0, TS_R_TSA_UNTRUSTED), "tsa untrusted"},
+    {ERR_PACK(ERR_LIB_TS, 0, TS_R_TST_INFO_SETUP_ERROR),
+    "tst info setup error"},
+    {ERR_PACK(ERR_LIB_TS, 0, TS_R_TS_DATASIGN), "ts datasign"},
+    {ERR_PACK(ERR_LIB_TS, 0, TS_R_UNACCEPTABLE_POLICY), "unacceptable policy"},
+    {ERR_PACK(ERR_LIB_TS, 0, TS_R_UNSUPPORTED_MD_ALGORITHM),
+    "unsupported md algorithm"},
+    {ERR_PACK(ERR_LIB_TS, 0, TS_R_UNSUPPORTED_VERSION), "unsupported version"},
+    {ERR_PACK(ERR_LIB_TS, 0, TS_R_VAR_BAD_VALUE), "var bad value"},
+    {ERR_PACK(ERR_LIB_TS, 0, TS_R_VAR_LOOKUP_FAILURE),
+    "cannot find config variable"},
+    {ERR_PACK(ERR_LIB_TS, 0, TS_R_WRONG_CONTENT_TYPE), "wrong content type"},
+    {0, NULL}
+};
+
+#endif
+
+int ERR_load_TS_strings(void)
+{
+#ifndef OPENSSL_NO_ERR
+    if (ERR_func_error_string(TS_str_functs[0].error) == NULL) {
+        ERR_load_strings_const(TS_str_functs);
+        ERR_load_strings_const(TS_str_reasons);
+    }
+#endif
+    return 1;
+}
diff --git a/contrib/libs/openssl/crypto/ts/ts_lib.c b/contrib/libs/openssl/crypto/ts/ts_lib.c
index f50208dd5b..bfe981364b 100644
--- a/contrib/libs/openssl/crypto/ts/ts_lib.c
+++ b/contrib/libs/openssl/crypto/ts/ts_lib.c
@@ -1,92 +1,92 @@
-/* 
- * Copyright 2006-2018 The OpenSSL Project Authors. All Rights Reserved. 
- * 
- * Licensed under the OpenSSL license (the "License").  You may not use 
- * this file except in compliance with the License.  You can obtain a copy 
- * in the file LICENSE in the source distribution or at 
- * https://www.openssl.org/source/license.html 
- */ 
- 
-#include <stdio.h> 
-#include "internal/cryptlib.h" 
-#include <openssl/objects.h> 
-#include <openssl/bn.h> 
-#include <openssl/x509.h> 
-#include <openssl/x509v3.h> 
-#include <openssl/ts.h> 
+/*
+ * Copyright 2006-2018 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the OpenSSL license (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#include <stdio.h>
+#include "internal/cryptlib.h"
+#include <openssl/objects.h>
+#include <openssl/bn.h>
+#include <openssl/x509.h>
+#include <openssl/x509v3.h>
+#include <openssl/ts.h>
 #include "ts_local.h"
- 
-int TS_ASN1_INTEGER_print_bio(BIO *bio, const ASN1_INTEGER *num) 
-{ 
-    BIGNUM *num_bn; 
-    int result = 0; 
-    char *hex; 
- 
-    num_bn = ASN1_INTEGER_to_BN(num, NULL); 
-    if (num_bn == NULL) 
-        return -1; 
-    if ((hex = BN_bn2hex(num_bn))) { 
-        result = BIO_write(bio, "0x", 2) > 0; 
-        result = result && BIO_write(bio, hex, strlen(hex)) > 0; 
-        OPENSSL_free(hex); 
-    } 
-    BN_free(num_bn); 
- 
-    return result; 
-} 
- 
-int TS_OBJ_print_bio(BIO *bio, const ASN1_OBJECT *obj) 
-{ 
-    char obj_txt[128]; 
- 
-    OBJ_obj2txt(obj_txt, sizeof(obj_txt), obj, 0); 
-    BIO_printf(bio, "%s\n", obj_txt); 
- 
-    return 1; 
-} 
- 
-int TS_ext_print_bio(BIO *bio, const STACK_OF(X509_EXTENSION) *extensions) 
-{ 
-    int i, critical, n; 
-    X509_EXTENSION *ex; 
-    ASN1_OBJECT *obj; 
- 
-    BIO_printf(bio, "Extensions:\n"); 
-    n = X509v3_get_ext_count(extensions); 
-    for (i = 0; i < n; i++) { 
-        ex = X509v3_get_ext(extensions, i); 
-        obj = X509_EXTENSION_get_object(ex); 
-        if (i2a_ASN1_OBJECT(bio, obj) < 0) 
-            return 0; 
-        critical = X509_EXTENSION_get_critical(ex); 
-        BIO_printf(bio, ":%s\n", critical ? " critical" : ""); 
-        if (!X509V3_EXT_print(bio, ex, 0, 4)) { 
-            BIO_printf(bio, "%4s", ""); 
-            ASN1_STRING_print(bio, X509_EXTENSION_get_data(ex)); 
-        } 
-        BIO_write(bio, "\n", 1); 
-    } 
- 
-    return 1; 
-} 
- 
-int TS_X509_ALGOR_print_bio(BIO *bio, const X509_ALGOR *alg) 
-{ 
-    int i = OBJ_obj2nid(alg->algorithm); 
-    return BIO_printf(bio, "Hash Algorithm: %s\n", 
-                      (i == NID_undef) ? "UNKNOWN" : OBJ_nid2ln(i)); 
-} 
- 
-int TS_MSG_IMPRINT_print_bio(BIO *bio, TS_MSG_IMPRINT *a) 
-{ 
-    ASN1_OCTET_STRING *msg; 
- 
-    TS_X509_ALGOR_print_bio(bio, a->hash_algo); 
- 
-    BIO_printf(bio, "Message data:\n"); 
-    msg = a->hashed_msg; 
-    BIO_dump_indent(bio, (const char *)ASN1_STRING_get0_data(msg), 
-                    ASN1_STRING_length(msg), 4); 
- 
-    return 1; 
-} 
+
+int TS_ASN1_INTEGER_print_bio(BIO *bio, const ASN1_INTEGER *num)
+{
+    BIGNUM *num_bn;
+    int result = 0;
+    char *hex;
+
+    num_bn = ASN1_INTEGER_to_BN(num, NULL);
+    if (num_bn == NULL)
+        return -1;
+    if ((hex = BN_bn2hex(num_bn))) {
+        result = BIO_write(bio, "0x", 2) > 0;
+        result = result && BIO_write(bio, hex, strlen(hex)) > 0;
+        OPENSSL_free(hex);
+    }
+    BN_free(num_bn);
+
+    return result;
+}
+
+int TS_OBJ_print_bio(BIO *bio, const ASN1_OBJECT *obj)
+{
+    char obj_txt[128];
+
+    OBJ_obj2txt(obj_txt, sizeof(obj_txt), obj, 0);
+    BIO_printf(bio, "%s\n", obj_txt);
+
+    return 1;
+}
+
+int TS_ext_print_bio(BIO *bio, const STACK_OF(X509_EXTENSION) *extensions)
+{
+    int i, critical, n;
+    X509_EXTENSION *ex;
+    ASN1_OBJECT *obj;
+
+    BIO_printf(bio, "Extensions:\n");
+    n = X509v3_get_ext_count(extensions);
+    for (i = 0; i < n; i++) {
+        ex = X509v3_get_ext(extensions, i);
+        obj = X509_EXTENSION_get_object(ex);
+        if (i2a_ASN1_OBJECT(bio, obj) < 0)
+            return 0;
+        critical = X509_EXTENSION_get_critical(ex);
+        BIO_printf(bio, ":%s\n", critical ? " critical" : "");
+        if (!X509V3_EXT_print(bio, ex, 0, 4)) {
+            BIO_printf(bio, "%4s", "");
+            ASN1_STRING_print(bio, X509_EXTENSION_get_data(ex));
+        }
+        BIO_write(bio, "\n", 1);
+    }
+
+    return 1;
+}
+
+int TS_X509_ALGOR_print_bio(BIO *bio, const X509_ALGOR *alg)
+{
+    int i = OBJ_obj2nid(alg->algorithm);
+    return BIO_printf(bio, "Hash Algorithm: %s\n",
+                      (i == NID_undef) ? "UNKNOWN" : OBJ_nid2ln(i));
+}
+
+int TS_MSG_IMPRINT_print_bio(BIO *bio, TS_MSG_IMPRINT *a)
+{
+    ASN1_OCTET_STRING *msg;
+
+    TS_X509_ALGOR_print_bio(bio, a->hash_algo);
+
+    BIO_printf(bio, "Message data:\n");
+    msg = a->hashed_msg;
+    BIO_dump_indent(bio, (const char *)ASN1_STRING_get0_data(msg),
+                    ASN1_STRING_length(msg), 4);
+
+    return 1;
+}
diff --git a/contrib/libs/openssl/crypto/ts/ts_req_print.c b/contrib/libs/openssl/crypto/ts/ts_req_print.c
index 704e9ab4ff..4eba5cf018 100644
--- a/contrib/libs/openssl/crypto/ts/ts_req_print.c
+++ b/contrib/libs/openssl/crypto/ts/ts_req_print.c
@@ -1,51 +1,51 @@
-/* 
- * Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved. 
- * 
- * Licensed under the OpenSSL license (the "License").  You may not use 
- * this file except in compliance with the License.  You can obtain a copy 
- * in the file LICENSE in the source distribution or at 
- * https://www.openssl.org/source/license.html 
- */ 
- 
-#include <stdio.h> 
-#include "internal/cryptlib.h" 
-#include <openssl/objects.h> 
-#include <openssl/bn.h> 
-#include <openssl/x509v3.h> 
-#include <openssl/ts.h> 
+/*
+ * Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the OpenSSL license (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#include <stdio.h>
+#include "internal/cryptlib.h"
+#include <openssl/objects.h>
+#include <openssl/bn.h>
+#include <openssl/x509v3.h>
+#include <openssl/ts.h>
 #include "ts_local.h"
- 
-int TS_REQ_print_bio(BIO *bio, TS_REQ *a) 
-{ 
-    int v; 
-    ASN1_OBJECT *policy_id; 
- 
-    if (a == NULL) 
-        return 0; 
- 
-    v = TS_REQ_get_version(a); 
-    BIO_printf(bio, "Version: %d\n", v); 
- 
-    TS_MSG_IMPRINT_print_bio(bio, a->msg_imprint); 
- 
-    BIO_printf(bio, "Policy OID: "); 
-    policy_id = TS_REQ_get_policy_id(a); 
-    if (policy_id == NULL) 
-        BIO_printf(bio, "unspecified\n"); 
-    else 
-        TS_OBJ_print_bio(bio, policy_id); 
- 
-    BIO_printf(bio, "Nonce: "); 
-    if (a->nonce == NULL) 
-        BIO_printf(bio, "unspecified"); 
-    else 
-        TS_ASN1_INTEGER_print_bio(bio, a->nonce); 
-    BIO_write(bio, "\n", 1); 
- 
-    BIO_printf(bio, "Certificate required: %s\n", 
-               a->cert_req ? "yes" : "no"); 
- 
-    TS_ext_print_bio(bio, a->extensions); 
- 
-    return 1; 
-} 
+
+int TS_REQ_print_bio(BIO *bio, TS_REQ *a)
+{
+    int v;
+    ASN1_OBJECT *policy_id;
+
+    if (a == NULL)
+        return 0;
+
+    v = TS_REQ_get_version(a);
+    BIO_printf(bio, "Version: %d\n", v);
+
+    TS_MSG_IMPRINT_print_bio(bio, a->msg_imprint);
+
+    BIO_printf(bio, "Policy OID: ");
+    policy_id = TS_REQ_get_policy_id(a);
+    if (policy_id == NULL)
+        BIO_printf(bio, "unspecified\n");
+    else
+        TS_OBJ_print_bio(bio, policy_id);
+
+    BIO_printf(bio, "Nonce: ");
+    if (a->nonce == NULL)
+        BIO_printf(bio, "unspecified");
+    else
+        TS_ASN1_INTEGER_print_bio(bio, a->nonce);
+    BIO_write(bio, "\n", 1);
+
+    BIO_printf(bio, "Certificate required: %s\n",
+               a->cert_req ? "yes" : "no");
+
+    TS_ext_print_bio(bio, a->extensions);
+
+    return 1;
+}
diff --git a/contrib/libs/openssl/crypto/ts/ts_req_utils.c b/contrib/libs/openssl/crypto/ts/ts_req_utils.c
index 734ea69f43..a4568e3b77 100644
--- a/contrib/libs/openssl/crypto/ts/ts_req_utils.c
+++ b/contrib/libs/openssl/crypto/ts/ts_req_utils.c
@@ -1,183 +1,183 @@
-/* 
- * Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved. 
- * 
- * Licensed under the OpenSSL license (the "License").  You may not use 
- * this file except in compliance with the License.  You can obtain a copy 
- * in the file LICENSE in the source distribution or at 
- * https://www.openssl.org/source/license.html 
- */ 
- 
-#include <stdio.h> 
-#include "internal/cryptlib.h" 
-#include <openssl/objects.h> 
-#include <openssl/x509v3.h> 
-#include <openssl/ts.h> 
+/*
+ * Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the OpenSSL license (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#include <stdio.h>
+#include "internal/cryptlib.h"
+#include <openssl/objects.h>
+#include <openssl/x509v3.h>
+#include <openssl/ts.h>
 #include "ts_local.h"
- 
-int TS_REQ_set_version(TS_REQ *a, long version) 
-{ 
-    return ASN1_INTEGER_set(a->version, version); 
-} 
- 
-long TS_REQ_get_version(const TS_REQ *a) 
-{ 
-    return ASN1_INTEGER_get(a->version); 
-} 
- 
-int TS_REQ_set_msg_imprint(TS_REQ *a, TS_MSG_IMPRINT *msg_imprint) 
-{ 
-    TS_MSG_IMPRINT *new_msg_imprint; 
- 
-    if (a->msg_imprint == msg_imprint) 
-        return 1; 
-    new_msg_imprint = TS_MSG_IMPRINT_dup(msg_imprint); 
-    if (new_msg_imprint == NULL) { 
-        TSerr(TS_F_TS_REQ_SET_MSG_IMPRINT, ERR_R_MALLOC_FAILURE); 
-        return 0; 
-    } 
-    TS_MSG_IMPRINT_free(a->msg_imprint); 
-    a->msg_imprint = new_msg_imprint; 
-    return 1; 
-} 
- 
-TS_MSG_IMPRINT *TS_REQ_get_msg_imprint(TS_REQ *a) 
-{ 
-    return a->msg_imprint; 
-} 
- 
-int TS_MSG_IMPRINT_set_algo(TS_MSG_IMPRINT *a, X509_ALGOR *alg) 
-{ 
-    X509_ALGOR *new_alg; 
- 
-    if (a->hash_algo == alg) 
-        return 1; 
-    new_alg = X509_ALGOR_dup(alg); 
-    if (new_alg == NULL) { 
-        TSerr(TS_F_TS_MSG_IMPRINT_SET_ALGO, ERR_R_MALLOC_FAILURE); 
-        return 0; 
-    } 
-    X509_ALGOR_free(a->hash_algo); 
-    a->hash_algo = new_alg; 
-    return 1; 
-} 
- 
-X509_ALGOR *TS_MSG_IMPRINT_get_algo(TS_MSG_IMPRINT *a) 
-{ 
-    return a->hash_algo; 
-} 
- 
-int TS_MSG_IMPRINT_set_msg(TS_MSG_IMPRINT *a, unsigned char *d, int len) 
-{ 
-    return ASN1_OCTET_STRING_set(a->hashed_msg, d, len); 
-} 
- 
-ASN1_OCTET_STRING *TS_MSG_IMPRINT_get_msg(TS_MSG_IMPRINT *a) 
-{ 
-    return a->hashed_msg; 
-} 
- 
-int TS_REQ_set_policy_id(TS_REQ *a, const ASN1_OBJECT *policy) 
-{ 
-    ASN1_OBJECT *new_policy; 
- 
-    if (a->policy_id == policy) 
-        return 1; 
-    new_policy = OBJ_dup(policy); 
-    if (new_policy == NULL) { 
-        TSerr(TS_F_TS_REQ_SET_POLICY_ID, ERR_R_MALLOC_FAILURE); 
-        return 0; 
-    } 
-    ASN1_OBJECT_free(a->policy_id); 
-    a->policy_id = new_policy; 
-    return 1; 
-} 
- 
-ASN1_OBJECT *TS_REQ_get_policy_id(TS_REQ *a) 
-{ 
-    return a->policy_id; 
-} 
- 
-int TS_REQ_set_nonce(TS_REQ *a, const ASN1_INTEGER *nonce) 
-{ 
-    ASN1_INTEGER *new_nonce; 
- 
-    if (a->nonce == nonce) 
-        return 1; 
-    new_nonce = ASN1_INTEGER_dup(nonce); 
-    if (new_nonce == NULL) { 
-        TSerr(TS_F_TS_REQ_SET_NONCE, ERR_R_MALLOC_FAILURE); 
-        return 0; 
-    } 
-    ASN1_INTEGER_free(a->nonce); 
-    a->nonce = new_nonce; 
-    return 1; 
-} 
- 
-const ASN1_INTEGER *TS_REQ_get_nonce(const TS_REQ *a) 
-{ 
-    return a->nonce; 
-} 
- 
-int TS_REQ_set_cert_req(TS_REQ *a, int cert_req) 
-{ 
-    a->cert_req = cert_req ? 0xFF : 0x00; 
-    return 1; 
-} 
- 
-int TS_REQ_get_cert_req(const TS_REQ *a) 
-{ 
-    return a->cert_req ? 1 : 0; 
-} 
- 
-STACK_OF(X509_EXTENSION) *TS_REQ_get_exts(TS_REQ *a) 
-{ 
-    return a->extensions; 
-} 
- 
-void TS_REQ_ext_free(TS_REQ *a) 
-{ 
-    if (!a) 
-        return; 
-    sk_X509_EXTENSION_pop_free(a->extensions, X509_EXTENSION_free); 
-    a->extensions = NULL; 
-} 
- 
-int TS_REQ_get_ext_count(TS_REQ *a) 
-{ 
-    return X509v3_get_ext_count(a->extensions); 
-} 
- 
-int TS_REQ_get_ext_by_NID(TS_REQ *a, int nid, int lastpos) 
-{ 
-    return X509v3_get_ext_by_NID(a->extensions, nid, lastpos); 
-} 
- 
-int TS_REQ_get_ext_by_OBJ(TS_REQ *a, const ASN1_OBJECT *obj, int lastpos) 
-{ 
-    return X509v3_get_ext_by_OBJ(a->extensions, obj, lastpos); 
-} 
- 
-int TS_REQ_get_ext_by_critical(TS_REQ *a, int crit, int lastpos) 
-{ 
-    return X509v3_get_ext_by_critical(a->extensions, crit, lastpos); 
-} 
- 
-X509_EXTENSION *TS_REQ_get_ext(TS_REQ *a, int loc) 
-{ 
-    return X509v3_get_ext(a->extensions, loc); 
-} 
- 
-X509_EXTENSION *TS_REQ_delete_ext(TS_REQ *a, int loc) 
-{ 
-    return X509v3_delete_ext(a->extensions, loc); 
-} 
- 
-int TS_REQ_add_ext(TS_REQ *a, X509_EXTENSION *ex, int loc) 
-{ 
-    return X509v3_add_ext(&a->extensions, ex, loc) != NULL; 
-} 
- 
-void *TS_REQ_get_ext_d2i(TS_REQ *a, int nid, int *crit, int *idx) 
-{ 
-    return X509V3_get_d2i(a->extensions, nid, crit, idx); 
-} 
+
+int TS_REQ_set_version(TS_REQ *a, long version)
+{
+    return ASN1_INTEGER_set(a->version, version);
+}
+
+long TS_REQ_get_version(const TS_REQ *a)
+{
+    return ASN1_INTEGER_get(a->version);
+}
+
+int TS_REQ_set_msg_imprint(TS_REQ *a, TS_MSG_IMPRINT *msg_imprint)
+{
+    TS_MSG_IMPRINT *new_msg_imprint;
+
+    if (a->msg_imprint == msg_imprint)
+        return 1;
+    new_msg_imprint = TS_MSG_IMPRINT_dup(msg_imprint);
+    if (new_msg_imprint == NULL) {
+        TSerr(TS_F_TS_REQ_SET_MSG_IMPRINT, ERR_R_MALLOC_FAILURE);
+        return 0;
+    }
+    TS_MSG_IMPRINT_free(a->msg_imprint);
+    a->msg_imprint = new_msg_imprint;
+    return 1;
+}
+
+TS_MSG_IMPRINT *TS_REQ_get_msg_imprint(TS_REQ *a)
+{
+    return a->msg_imprint;
+}
+
+int TS_MSG_IMPRINT_set_algo(TS_MSG_IMPRINT *a, X509_ALGOR *alg)
+{
+    X509_ALGOR *new_alg;
+
+    if (a->hash_algo == alg)
+        return 1;
+    new_alg = X509_ALGOR_dup(alg);
+    if (new_alg == NULL) {
+        TSerr(TS_F_TS_MSG_IMPRINT_SET_ALGO, ERR_R_MALLOC_FAILURE);
+        return 0;
+    }
+    X509_ALGOR_free(a->hash_algo);
+    a->hash_algo = new_alg;
+    return 1;
+}
+
+X509_ALGOR *TS_MSG_IMPRINT_get_algo(TS_MSG_IMPRINT *a)
+{
+    return a->hash_algo;
+}
+
+int TS_MSG_IMPRINT_set_msg(TS_MSG_IMPRINT *a, unsigned char *d, int len)
+{
+    return ASN1_OCTET_STRING_set(a->hashed_msg, d, len);
+}
+
+ASN1_OCTET_STRING *TS_MSG_IMPRINT_get_msg(TS_MSG_IMPRINT *a)
+{
+    return a->hashed_msg;
+}
+
+int TS_REQ_set_policy_id(TS_REQ *a, const ASN1_OBJECT *policy)
+{
+    ASN1_OBJECT *new_policy;
+
+    if (a->policy_id == policy)
+        return 1;
+    new_policy = OBJ_dup(policy);
+    if (new_policy == NULL) {
+        TSerr(TS_F_TS_REQ_SET_POLICY_ID, ERR_R_MALLOC_FAILURE);
+        return 0;
+    }
+    ASN1_OBJECT_free(a->policy_id);
+    a->policy_id = new_policy;
+    return 1;
+}
+
+ASN1_OBJECT *TS_REQ_get_policy_id(TS_REQ *a)
+{
+    return a->policy_id;
+}
+
+int TS_REQ_set_nonce(TS_REQ *a, const ASN1_INTEGER *nonce)
+{
+    ASN1_INTEGER *new_nonce;
+
+    if (a->nonce == nonce)
+        return 1;
+    new_nonce = ASN1_INTEGER_dup(nonce);
+    if (new_nonce == NULL) {
+        TSerr(TS_F_TS_REQ_SET_NONCE, ERR_R_MALLOC_FAILURE);
+        return 0;
+    }
+    ASN1_INTEGER_free(a->nonce);
+    a->nonce = new_nonce;
+    return 1;
+}
+
+const ASN1_INTEGER *TS_REQ_get_nonce(const TS_REQ *a)
+{
+    return a->nonce;
+}
+
+int TS_REQ_set_cert_req(TS_REQ *a, int cert_req)
+{
+    a->cert_req = cert_req ? 0xFF : 0x00;
+    return 1;
+}
+
+int TS_REQ_get_cert_req(const TS_REQ *a)
+{
+    return a->cert_req ? 1 : 0;
+}
+
+STACK_OF(X509_EXTENSION) *TS_REQ_get_exts(TS_REQ *a)
+{
+    return a->extensions;
+}
+
+void TS_REQ_ext_free(TS_REQ *a)
+{
+    if (!a)
+        return;
+    sk_X509_EXTENSION_pop_free(a->extensions, X509_EXTENSION_free);
+    a->extensions = NULL;
+}
+
+int TS_REQ_get_ext_count(TS_REQ *a)
+{
+    return X509v3_get_ext_count(a->extensions);
+}
+
+int TS_REQ_get_ext_by_NID(TS_REQ *a, int nid, int lastpos)
+{
+    return X509v3_get_ext_by_NID(a->extensions, nid, lastpos);
+}
+
+int TS_REQ_get_ext_by_OBJ(TS_REQ *a, const ASN1_OBJECT *obj, int lastpos)
+{
+    return X509v3_get_ext_by_OBJ(a->extensions, obj, lastpos);
+}
+
+int TS_REQ_get_ext_by_critical(TS_REQ *a, int crit, int lastpos)
+{
+    return X509v3_get_ext_by_critical(a->extensions, crit, lastpos);
+}
+
+X509_EXTENSION *TS_REQ_get_ext(TS_REQ *a, int loc)
+{
+    return X509v3_get_ext(a->extensions, loc);
+}
+
+X509_EXTENSION *TS_REQ_delete_ext(TS_REQ *a, int loc)
+{
+    return X509v3_delete_ext(a->extensions, loc);
+}
+
+int TS_REQ_add_ext(TS_REQ *a, X509_EXTENSION *ex, int loc)
+{
+    return X509v3_add_ext(&a->extensions, ex, loc) != NULL;
+}
+
+void *TS_REQ_get_ext_d2i(TS_REQ *a, int nid, int *crit, int *idx)
+{
+    return X509V3_get_d2i(a->extensions, nid, crit, idx);
+}
diff --git a/contrib/libs/openssl/crypto/ts/ts_rsp_print.c b/contrib/libs/openssl/crypto/ts/ts_rsp_print.c
index 189c3c526e..a2451aaa8d 100644
--- a/contrib/libs/openssl/crypto/ts/ts_rsp_print.c
+++ b/contrib/libs/openssl/crypto/ts/ts_rsp_print.c
@@ -1,195 +1,195 @@
-/* 
- * Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved. 
- * 
- * Licensed under the OpenSSL license (the "License").  You may not use 
- * this file except in compliance with the License.  You can obtain a copy 
- * in the file LICENSE in the source distribution or at 
- * https://www.openssl.org/source/license.html 
- */ 
- 
-#include <stdio.h> 
-#include "internal/cryptlib.h" 
-#include <openssl/objects.h> 
-#include <openssl/bn.h> 
-#include <openssl/x509v3.h> 
-#include <openssl/ts.h> 
+/*
+ * Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the OpenSSL license (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#include <stdio.h>
+#include "internal/cryptlib.h"
+#include <openssl/objects.h>
+#include <openssl/bn.h>
+#include <openssl/x509v3.h>
+#include <openssl/ts.h>
 #include "ts_local.h"
- 
-struct status_map_st { 
-    int bit; 
-    const char *text; 
-}; 
- 
-static int ts_status_map_print(BIO *bio, const struct status_map_st *a, 
-                               const ASN1_BIT_STRING *v); 
-static int ts_ACCURACY_print_bio(BIO *bio, const TS_ACCURACY *accuracy); 
- 
- 
-int TS_RESP_print_bio(BIO *bio, TS_RESP *a) 
-{ 
-    BIO_printf(bio, "Status info:\n"); 
-    TS_STATUS_INFO_print_bio(bio, a->status_info); 
- 
-    BIO_printf(bio, "\nTST info:\n"); 
-    if (a->tst_info != NULL) 
-        TS_TST_INFO_print_bio(bio, a->tst_info); 
-    else 
-        BIO_printf(bio, "Not included.\n"); 
- 
-    return 1; 
-} 
- 
-int TS_STATUS_INFO_print_bio(BIO *bio, TS_STATUS_INFO *a) 
-{ 
-    static const char *status_map[] = { 
-        "Granted.", 
-        "Granted with modifications.", 
-        "Rejected.", 
-        "Waiting.", 
-        "Revocation warning.", 
-        "Revoked." 
-    }; 
-    static const struct status_map_st failure_map[] = { 
-        {TS_INFO_BAD_ALG, 
-         "unrecognized or unsupported algorithm identifier"}, 
-        {TS_INFO_BAD_REQUEST, 
-         "transaction not permitted or supported"}, 
-        {TS_INFO_BAD_DATA_FORMAT, 
-         "the data submitted has the wrong format"}, 
-        {TS_INFO_TIME_NOT_AVAILABLE, 
-         "the TSA's time source is not available"}, 
-        {TS_INFO_UNACCEPTED_POLICY, 
-         "the requested TSA policy is not supported by the TSA"}, 
-        {TS_INFO_UNACCEPTED_EXTENSION, 
-         "the requested extension is not supported by the TSA"}, 
-        {TS_INFO_ADD_INFO_NOT_AVAILABLE, 
-         "the additional information requested could not be understood " 
-         "or is not available"}, 
-        {TS_INFO_SYSTEM_FAILURE, 
-         "the request cannot be handled due to system failure"}, 
-        {-1, NULL} 
-    }; 
-    long status; 
-    int i, lines = 0; 
- 
-    BIO_printf(bio, "Status: "); 
-    status = ASN1_INTEGER_get(a->status); 
-    if (0 <= status && status < (long)OSSL_NELEM(status_map)) 
-        BIO_printf(bio, "%s\n", status_map[status]); 
-    else 
-        BIO_printf(bio, "out of bounds\n"); 
- 
-    BIO_printf(bio, "Status description: "); 
-    for (i = 0; i < sk_ASN1_UTF8STRING_num(a->text); ++i) { 
-        if (i > 0) 
-            BIO_puts(bio, "\t"); 
-        ASN1_STRING_print_ex(bio, sk_ASN1_UTF8STRING_value(a->text, i), 0); 
-        BIO_puts(bio, "\n"); 
-    } 
-    if (i == 0) 
-        BIO_printf(bio, "unspecified\n"); 
- 
-    BIO_printf(bio, "Failure info: "); 
-    if (a->failure_info != NULL) 
-        lines = ts_status_map_print(bio, failure_map, a->failure_info); 
-    if (lines == 0) 
-        BIO_printf(bio, "unspecified"); 
-    BIO_printf(bio, "\n"); 
- 
-    return 1; 
-} 
- 
-static int ts_status_map_print(BIO *bio, const struct status_map_st *a, 
-                               const ASN1_BIT_STRING *v) 
-{ 
-    int lines = 0; 
- 
-    for (; a->bit >= 0; ++a) { 
-        if (ASN1_BIT_STRING_get_bit(v, a->bit)) { 
-            if (++lines > 1) 
-                BIO_printf(bio, ", "); 
-            BIO_printf(bio, "%s", a->text); 
-        } 
-    } 
- 
-    return lines; 
-} 
- 
-int TS_TST_INFO_print_bio(BIO *bio, TS_TST_INFO *a) 
-{ 
-    int v; 
- 
-    if (a == NULL) 
-        return 0; 
- 
-    v = ASN1_INTEGER_get(a->version); 
-    BIO_printf(bio, "Version: %d\n", v); 
- 
-    BIO_printf(bio, "Policy OID: "); 
-    TS_OBJ_print_bio(bio, a->policy_id); 
- 
-    TS_MSG_IMPRINT_print_bio(bio, a->msg_imprint); 
- 
-    BIO_printf(bio, "Serial number: "); 
-    if (a->serial == NULL) 
-        BIO_printf(bio, "unspecified"); 
-    else 
-        TS_ASN1_INTEGER_print_bio(bio, a->serial); 
-    BIO_write(bio, "\n", 1); 
- 
-    BIO_printf(bio, "Time stamp: "); 
-    ASN1_GENERALIZEDTIME_print(bio, a->time); 
-    BIO_write(bio, "\n", 1); 
- 
-    BIO_printf(bio, "Accuracy: "); 
-    if (a->accuracy == NULL) 
-        BIO_printf(bio, "unspecified"); 
-    else 
-        ts_ACCURACY_print_bio(bio, a->accuracy); 
-    BIO_write(bio, "\n", 1); 
- 
-    BIO_printf(bio, "Ordering: %s\n", a->ordering ? "yes" : "no"); 
- 
-    BIO_printf(bio, "Nonce: "); 
-    if (a->nonce == NULL) 
-        BIO_printf(bio, "unspecified"); 
-    else 
-        TS_ASN1_INTEGER_print_bio(bio, a->nonce); 
-    BIO_write(bio, "\n", 1); 
- 
-    BIO_printf(bio, "TSA: "); 
-    if (a->tsa == NULL) 
-        BIO_printf(bio, "unspecified"); 
-    else { 
-        STACK_OF(CONF_VALUE) *nval; 
-        if ((nval = i2v_GENERAL_NAME(NULL, a->tsa, NULL))) 
-            X509V3_EXT_val_prn(bio, nval, 0, 0); 
-        sk_CONF_VALUE_pop_free(nval, X509V3_conf_free); 
-    } 
-    BIO_write(bio, "\n", 1); 
- 
-    TS_ext_print_bio(bio, a->extensions); 
- 
-    return 1; 
-} 
- 
-static int ts_ACCURACY_print_bio(BIO *bio, const TS_ACCURACY *a) 
-{ 
-    if (a->seconds != NULL) 
-        TS_ASN1_INTEGER_print_bio(bio, a->seconds); 
-    else 
-        BIO_printf(bio, "unspecified"); 
-    BIO_printf(bio, " seconds, "); 
-    if (a->millis != NULL) 
-        TS_ASN1_INTEGER_print_bio(bio, a->millis); 
-    else 
-        BIO_printf(bio, "unspecified"); 
-    BIO_printf(bio, " millis, "); 
-    if (a->micros != NULL) 
-        TS_ASN1_INTEGER_print_bio(bio, a->micros); 
-    else 
-        BIO_printf(bio, "unspecified"); 
-    BIO_printf(bio, " micros"); 
- 
-    return 1; 
-} 
+
+struct status_map_st {
+    int bit;
+    const char *text;
+};
+
+static int ts_status_map_print(BIO *bio, const struct status_map_st *a,
+                               const ASN1_BIT_STRING *v);
+static int ts_ACCURACY_print_bio(BIO *bio, const TS_ACCURACY *accuracy);
+
+
+int TS_RESP_print_bio(BIO *bio, TS_RESP *a)
+{
+    BIO_printf(bio, "Status info:\n");
+    TS_STATUS_INFO_print_bio(bio, a->status_info);
+
+    BIO_printf(bio, "\nTST info:\n");
+    if (a->tst_info != NULL)
+        TS_TST_INFO_print_bio(bio, a->tst_info);
+    else
+        BIO_printf(bio, "Not included.\n");
+
+    return 1;
+}
+
+int TS_STATUS_INFO_print_bio(BIO *bio, TS_STATUS_INFO *a)
+{
+    static const char *status_map[] = {
+        "Granted.",
+        "Granted with modifications.",
+        "Rejected.",
+        "Waiting.",
+        "Revocation warning.",
+        "Revoked."
+    };
+    static const struct status_map_st failure_map[] = {
+        {TS_INFO_BAD_ALG,
+         "unrecognized or unsupported algorithm identifier"},
+        {TS_INFO_BAD_REQUEST,
+         "transaction not permitted or supported"},
+        {TS_INFO_BAD_DATA_FORMAT,
+         "the data submitted has the wrong format"},
+        {TS_INFO_TIME_NOT_AVAILABLE,
+         "the TSA's time source is not available"},
+        {TS_INFO_UNACCEPTED_POLICY,
+         "the requested TSA policy is not supported by the TSA"},
+        {TS_INFO_UNACCEPTED_EXTENSION,
+         "the requested extension is not supported by the TSA"},
+        {TS_INFO_ADD_INFO_NOT_AVAILABLE,
+         "the additional information requested could not be understood "
+         "or is not available"},
+        {TS_INFO_SYSTEM_FAILURE,
+         "the request cannot be handled due to system failure"},
+        {-1, NULL}
+    };
+    long status;
+    int i, lines = 0;
+
+    BIO_printf(bio, "Status: ");
+    status = ASN1_INTEGER_get(a->status);
+    if (0 <= status && status < (long)OSSL_NELEM(status_map))
+        BIO_printf(bio, "%s\n", status_map[status]);
+    else
+        BIO_printf(bio, "out of bounds\n");
+
+    BIO_printf(bio, "Status description: ");
+    for (i = 0; i < sk_ASN1_UTF8STRING_num(a->text); ++i) {
+        if (i > 0)
+            BIO_puts(bio, "\t");
+        ASN1_STRING_print_ex(bio, sk_ASN1_UTF8STRING_value(a->text, i), 0);
+        BIO_puts(bio, "\n");
+    }
+    if (i == 0)
+        BIO_printf(bio, "unspecified\n");
+
+    BIO_printf(bio, "Failure info: ");
+    if (a->failure_info != NULL)
+        lines = ts_status_map_print(bio, failure_map, a->failure_info);
+    if (lines == 0)
+        BIO_printf(bio, "unspecified");
+    BIO_printf(bio, "\n");
+
+    return 1;
+}
+
+static int ts_status_map_print(BIO *bio, const struct status_map_st *a,
+                               const ASN1_BIT_STRING *v)
+{
+    int lines = 0;
+
+    for (; a->bit >= 0; ++a) {
+        if (ASN1_BIT_STRING_get_bit(v, a->bit)) {
+            if (++lines > 1)
+                BIO_printf(bio, ", ");
+            BIO_printf(bio, "%s", a->text);
+        }
+    }
+
+    return lines;
+}
+
+int TS_TST_INFO_print_bio(BIO *bio, TS_TST_INFO *a)
+{
+    int v;
+
+    if (a == NULL)
+        return 0;
+
+    v = ASN1_INTEGER_get(a->version);
+    BIO_printf(bio, "Version: %d\n", v);
+
+    BIO_printf(bio, "Policy OID: ");
+    TS_OBJ_print_bio(bio, a->policy_id);
+
+    TS_MSG_IMPRINT_print_bio(bio, a->msg_imprint);
+
+    BIO_printf(bio, "Serial number: ");
+    if (a->serial == NULL)
+        BIO_printf(bio, "unspecified");
+    else
+        TS_ASN1_INTEGER_print_bio(bio, a->serial);
+    BIO_write(bio, "\n", 1);
+
+    BIO_printf(bio, "Time stamp: ");
+    ASN1_GENERALIZEDTIME_print(bio, a->time);
+    BIO_write(bio, "\n", 1);
+
+    BIO_printf(bio, "Accuracy: ");
+    if (a->accuracy == NULL)
+        BIO_printf(bio, "unspecified");
+    else
+        ts_ACCURACY_print_bio(bio, a->accuracy);
+    BIO_write(bio, "\n", 1);
+
+    BIO_printf(bio, "Ordering: %s\n", a->ordering ? "yes" : "no");
+
+    BIO_printf(bio, "Nonce: ");
+    if (a->nonce == NULL)
+        BIO_printf(bio, "unspecified");
+    else
+        TS_ASN1_INTEGER_print_bio(bio, a->nonce);
+    BIO_write(bio, "\n", 1);
+
+    BIO_printf(bio, "TSA: ");
+    if (a->tsa == NULL)
+        BIO_printf(bio, "unspecified");
+    else {
+        STACK_OF(CONF_VALUE) *nval;
+        if ((nval = i2v_GENERAL_NAME(NULL, a->tsa, NULL)))
+            X509V3_EXT_val_prn(bio, nval, 0, 0);
+        sk_CONF_VALUE_pop_free(nval, X509V3_conf_free);
+    }
+    BIO_write(bio, "\n", 1);
+
+    TS_ext_print_bio(bio, a->extensions);
+
+    return 1;
+}
+
+static int ts_ACCURACY_print_bio(BIO *bio, const TS_ACCURACY *a)
+{
+    if (a->seconds != NULL)
+        TS_ASN1_INTEGER_print_bio(bio, a->seconds);
+    else
+        BIO_printf(bio, "unspecified");
+    BIO_printf(bio, " seconds, ");
+    if (a->millis != NULL)
+        TS_ASN1_INTEGER_print_bio(bio, a->millis);
+    else
+        BIO_printf(bio, "unspecified");
+    BIO_printf(bio, " millis, ");
+    if (a->micros != NULL)
+        TS_ASN1_INTEGER_print_bio(bio, a->micros);
+    else
+        BIO_printf(bio, "unspecified");
+    BIO_printf(bio, " micros");
+
+    return 1;
+}
diff --git a/contrib/libs/openssl/crypto/ts/ts_rsp_sign.c b/contrib/libs/openssl/crypto/ts/ts_rsp_sign.c
index b2cd0b5520..342582f024 100644
--- a/contrib/libs/openssl/crypto/ts/ts_rsp_sign.c
+++ b/contrib/libs/openssl/crypto/ts/ts_rsp_sign.c
@@ -1,1060 +1,1060 @@
-/* 
+/*
  * Copyright 2006-2020 The OpenSSL Project Authors. All Rights Reserved.
- * 
- * Licensed under the OpenSSL license (the "License").  You may not use 
- * this file except in compliance with the License.  You can obtain a copy 
- * in the file LICENSE in the source distribution or at 
- * https://www.openssl.org/source/license.html 
- */ 
- 
-#include "e_os.h" 
-#include "internal/cryptlib.h" 
- 
-#include <openssl/objects.h> 
-#include <openssl/ts.h> 
-#include <openssl/pkcs7.h> 
-#include <openssl/crypto.h> 
+ *
+ * Licensed under the OpenSSL license (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#include "e_os.h"
+#include "internal/cryptlib.h"
+
+#include <openssl/objects.h>
+#include <openssl/ts.h>
+#include <openssl/pkcs7.h>
+#include <openssl/crypto.h>
 #include "ts_local.h"
- 
-static ASN1_INTEGER *def_serial_cb(struct TS_resp_ctx *, void *); 
-static int def_time_cb(struct TS_resp_ctx *, void *, long *sec, long *usec); 
-static int def_extension_cb(struct TS_resp_ctx *, X509_EXTENSION *, void *); 
- 
-static void ts_RESP_CTX_init(TS_RESP_CTX *ctx); 
-static void ts_RESP_CTX_cleanup(TS_RESP_CTX *ctx); 
-static int ts_RESP_check_request(TS_RESP_CTX *ctx); 
-static ASN1_OBJECT *ts_RESP_get_policy(TS_RESP_CTX *ctx); 
-static TS_TST_INFO *ts_RESP_create_tst_info(TS_RESP_CTX *ctx, 
-                                            ASN1_OBJECT *policy); 
-static int ts_RESP_process_extensions(TS_RESP_CTX *ctx); 
-static int ts_RESP_sign(TS_RESP_CTX *ctx); 
- 
-static ESS_SIGNING_CERT *ess_SIGNING_CERT_new_init(X509 *signcert, 
-                                                   STACK_OF(X509) *certs); 
-static ESS_CERT_ID *ess_CERT_ID_new_init(X509 *cert, int issuer_needed); 
-static int ts_TST_INFO_content_new(PKCS7 *p7); 
-static int ess_add_signing_cert(PKCS7_SIGNER_INFO *si, ESS_SIGNING_CERT *sc); 
- 
-static ESS_SIGNING_CERT_V2 *ess_signing_cert_v2_new_init(const EVP_MD *hash_alg, 
-                                                         X509 *signcert, 
-                                                         STACK_OF(X509) 
-                                                         *certs); 
-static ESS_CERT_ID_V2 *ess_cert_id_v2_new_init(const EVP_MD *hash_alg, 
-                                               X509 *cert, int issuer_needed); 
-static int ess_add_signing_cert_v2(PKCS7_SIGNER_INFO *si, 
-                                   ESS_SIGNING_CERT_V2 *sc); 
- 
-static ASN1_GENERALIZEDTIME 
-*TS_RESP_set_genTime_with_precision(ASN1_GENERALIZEDTIME *, long, long, 
-                                    unsigned); 
- 
-/* Default callback for response generation. */ 
-static ASN1_INTEGER *def_serial_cb(struct TS_resp_ctx *ctx, void *data) 
-{ 
-    ASN1_INTEGER *serial = ASN1_INTEGER_new(); 
- 
-    if (serial == NULL) 
-        goto err; 
-    if (!ASN1_INTEGER_set(serial, 1)) 
-        goto err; 
-
-    return serial; 
- 
- err: 
-    TSerr(TS_F_DEF_SERIAL_CB, ERR_R_MALLOC_FAILURE); 
-    TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, 
-                                "Error during serial number generation."); 
+
+static ASN1_INTEGER *def_serial_cb(struct TS_resp_ctx *, void *);
+static int def_time_cb(struct TS_resp_ctx *, void *, long *sec, long *usec);
+static int def_extension_cb(struct TS_resp_ctx *, X509_EXTENSION *, void *);
+
+static void ts_RESP_CTX_init(TS_RESP_CTX *ctx);
+static void ts_RESP_CTX_cleanup(TS_RESP_CTX *ctx);
+static int ts_RESP_check_request(TS_RESP_CTX *ctx);
+static ASN1_OBJECT *ts_RESP_get_policy(TS_RESP_CTX *ctx);
+static TS_TST_INFO *ts_RESP_create_tst_info(TS_RESP_CTX *ctx,
+                                            ASN1_OBJECT *policy);
+static int ts_RESP_process_extensions(TS_RESP_CTX *ctx);
+static int ts_RESP_sign(TS_RESP_CTX *ctx);
+
+static ESS_SIGNING_CERT *ess_SIGNING_CERT_new_init(X509 *signcert,
+                                                   STACK_OF(X509) *certs);
+static ESS_CERT_ID *ess_CERT_ID_new_init(X509 *cert, int issuer_needed);
+static int ts_TST_INFO_content_new(PKCS7 *p7);
+static int ess_add_signing_cert(PKCS7_SIGNER_INFO *si, ESS_SIGNING_CERT *sc);
+
+static ESS_SIGNING_CERT_V2 *ess_signing_cert_v2_new_init(const EVP_MD *hash_alg,
+                                                         X509 *signcert,
+                                                         STACK_OF(X509)
+                                                         *certs);
+static ESS_CERT_ID_V2 *ess_cert_id_v2_new_init(const EVP_MD *hash_alg,
+                                               X509 *cert, int issuer_needed);
+static int ess_add_signing_cert_v2(PKCS7_SIGNER_INFO *si,
+                                   ESS_SIGNING_CERT_V2 *sc);
+
+static ASN1_GENERALIZEDTIME
+*TS_RESP_set_genTime_with_precision(ASN1_GENERALIZEDTIME *, long, long,
+                                    unsigned);
+
+/* Default callback for response generation. */
+static ASN1_INTEGER *def_serial_cb(struct TS_resp_ctx *ctx, void *data)
+{
+    ASN1_INTEGER *serial = ASN1_INTEGER_new();
+
+    if (serial == NULL)
+        goto err;
+    if (!ASN1_INTEGER_set(serial, 1))
+        goto err;
+
+    return serial;
+
+ err:
+    TSerr(TS_F_DEF_SERIAL_CB, ERR_R_MALLOC_FAILURE);
+    TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
+                                "Error during serial number generation.");
+    ASN1_INTEGER_free(serial);
+    return NULL;
+}
+
+#if defined(OPENSSL_SYS_UNIX)
+
+static int def_time_cb(struct TS_resp_ctx *ctx, void *data,
+                       long *sec, long *usec)
+{
+    struct timeval tv;
+    if (gettimeofday(&tv, NULL) != 0) {
+        TSerr(TS_F_DEF_TIME_CB, TS_R_TIME_SYSCALL_ERROR);
+        TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
+                                    "Time is not available.");
+        TS_RESP_CTX_add_failure_info(ctx, TS_INFO_TIME_NOT_AVAILABLE);
+        return 0;
+    }
+    *sec = tv.tv_sec;
+    *usec = tv.tv_usec;
+
+    return 1;
+}
+
+#else
+
+static int def_time_cb(struct TS_resp_ctx *ctx, void *data,
+                       long *sec, long *usec)
+{
+    time_t t;
+    if (time(&t) == (time_t)-1) {
+        TSerr(TS_F_DEF_TIME_CB, TS_R_TIME_SYSCALL_ERROR);
+        TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
+                                    "Time is not available.");
+        TS_RESP_CTX_add_failure_info(ctx, TS_INFO_TIME_NOT_AVAILABLE);
+        return 0;
+    }
+    *sec = (long)t;
+    *usec = 0;
+
+    return 1;
+}
+
+#endif
+
+static int def_extension_cb(struct TS_resp_ctx *ctx, X509_EXTENSION *ext,
+                            void *data)
+{
+    TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
+                                "Unsupported extension.");
+    TS_RESP_CTX_add_failure_info(ctx, TS_INFO_UNACCEPTED_EXTENSION);
+    return 0;
+}
+
+/* TS_RESP_CTX management functions. */
+
+TS_RESP_CTX *TS_RESP_CTX_new(void)
+{
+    TS_RESP_CTX *ctx;
+
+    if ((ctx = OPENSSL_zalloc(sizeof(*ctx))) == NULL) {
+        TSerr(TS_F_TS_RESP_CTX_NEW, ERR_R_MALLOC_FAILURE);
+        return NULL;
+    }
+
+    ctx->signer_md = EVP_sha256();
+
+    ctx->serial_cb = def_serial_cb;
+    ctx->time_cb = def_time_cb;
+    ctx->extension_cb = def_extension_cb;
+
+    return ctx;
+}
+
+void TS_RESP_CTX_free(TS_RESP_CTX *ctx)
+{
+    if (!ctx)
+        return;
+
+    X509_free(ctx->signer_cert);
+    EVP_PKEY_free(ctx->signer_key);
+    sk_X509_pop_free(ctx->certs, X509_free);
+    sk_ASN1_OBJECT_pop_free(ctx->policies, ASN1_OBJECT_free);
+    ASN1_OBJECT_free(ctx->default_policy);
+    sk_EVP_MD_free(ctx->mds);   /* No EVP_MD_free method exists. */
+    ASN1_INTEGER_free(ctx->seconds);
+    ASN1_INTEGER_free(ctx->millis);
+    ASN1_INTEGER_free(ctx->micros);
+    OPENSSL_free(ctx);
+}
+
+int TS_RESP_CTX_set_signer_cert(TS_RESP_CTX *ctx, X509 *signer)
+{
+    if (X509_check_purpose(signer, X509_PURPOSE_TIMESTAMP_SIGN, 0) != 1) {
+        TSerr(TS_F_TS_RESP_CTX_SET_SIGNER_CERT,
+              TS_R_INVALID_SIGNER_CERTIFICATE_PURPOSE);
+        return 0;
+    }
+    X509_free(ctx->signer_cert);
+    ctx->signer_cert = signer;
+    X509_up_ref(ctx->signer_cert);
+    return 1;
+}
+
+int TS_RESP_CTX_set_signer_key(TS_RESP_CTX *ctx, EVP_PKEY *key)
+{
+    EVP_PKEY_free(ctx->signer_key);
+    ctx->signer_key = key;
+    EVP_PKEY_up_ref(ctx->signer_key);
+
+    return 1;
+}
+
+int TS_RESP_CTX_set_signer_digest(TS_RESP_CTX *ctx, const EVP_MD *md)
+{
+    ctx->signer_md = md;
+    return 1;
+}
+
+int TS_RESP_CTX_set_def_policy(TS_RESP_CTX *ctx, const ASN1_OBJECT *def_policy)
+{
+    ASN1_OBJECT_free(ctx->default_policy);
+    if ((ctx->default_policy = OBJ_dup(def_policy)) == NULL)
+        goto err;
+    return 1;
+ err:
+    TSerr(TS_F_TS_RESP_CTX_SET_DEF_POLICY, ERR_R_MALLOC_FAILURE);
+    return 0;
+}
+
+int TS_RESP_CTX_set_certs(TS_RESP_CTX *ctx, STACK_OF(X509) *certs)
+{
+
+    sk_X509_pop_free(ctx->certs, X509_free);
+    ctx->certs = NULL;
+    if (!certs)
+        return 1;
+    if ((ctx->certs = X509_chain_up_ref(certs)) == NULL) {
+        TSerr(TS_F_TS_RESP_CTX_SET_CERTS, ERR_R_MALLOC_FAILURE);
+        return 0;
+    }
+
+    return 1;
+}
+
+int TS_RESP_CTX_add_policy(TS_RESP_CTX *ctx, const ASN1_OBJECT *policy)
+{
+    ASN1_OBJECT *copy = NULL;
+
+    if (ctx->policies == NULL
+        && (ctx->policies = sk_ASN1_OBJECT_new_null()) == NULL)
+        goto err;
+    if ((copy = OBJ_dup(policy)) == NULL)
+        goto err;
+    if (!sk_ASN1_OBJECT_push(ctx->policies, copy))
+        goto err;
+
+    return 1;
+ err:
+    TSerr(TS_F_TS_RESP_CTX_ADD_POLICY, ERR_R_MALLOC_FAILURE);
+    ASN1_OBJECT_free(copy);
+    return 0;
+}
+
+int TS_RESP_CTX_add_md(TS_RESP_CTX *ctx, const EVP_MD *md)
+{
+    if (ctx->mds == NULL
+        && (ctx->mds = sk_EVP_MD_new_null()) == NULL)
+        goto err;
+    if (!sk_EVP_MD_push(ctx->mds, md))
+        goto err;
+
+    return 1;
+ err:
+    TSerr(TS_F_TS_RESP_CTX_ADD_MD, ERR_R_MALLOC_FAILURE);
+    return 0;
+}
+
+#define TS_RESP_CTX_accuracy_free(ctx)          \
+        ASN1_INTEGER_free(ctx->seconds);        \
+        ctx->seconds = NULL;                    \
+        ASN1_INTEGER_free(ctx->millis);         \
+        ctx->millis = NULL;                     \
+        ASN1_INTEGER_free(ctx->micros);         \
+        ctx->micros = NULL;
+
+int TS_RESP_CTX_set_accuracy(TS_RESP_CTX *ctx,
+                             int secs, int millis, int micros)
+{
+
+    TS_RESP_CTX_accuracy_free(ctx);
+    if (secs
+        && ((ctx->seconds = ASN1_INTEGER_new()) == NULL
+            || !ASN1_INTEGER_set(ctx->seconds, secs)))
+        goto err;
+    if (millis
+        && ((ctx->millis = ASN1_INTEGER_new()) == NULL
+            || !ASN1_INTEGER_set(ctx->millis, millis)))
+        goto err;
+    if (micros
+        && ((ctx->micros = ASN1_INTEGER_new()) == NULL
+            || !ASN1_INTEGER_set(ctx->micros, micros)))
+        goto err;
+
+    return 1;
+ err:
+    TS_RESP_CTX_accuracy_free(ctx);
+    TSerr(TS_F_TS_RESP_CTX_SET_ACCURACY, ERR_R_MALLOC_FAILURE);
+    return 0;
+}
+
+void TS_RESP_CTX_add_flags(TS_RESP_CTX *ctx, int flags)
+{
+    ctx->flags |= flags;
+}
+
+void TS_RESP_CTX_set_serial_cb(TS_RESP_CTX *ctx, TS_serial_cb cb, void *data)
+{
+    ctx->serial_cb = cb;
+    ctx->serial_cb_data = data;
+}
+
+void TS_RESP_CTX_set_time_cb(TS_RESP_CTX *ctx, TS_time_cb cb, void *data)
+{
+    ctx->time_cb = cb;
+    ctx->time_cb_data = data;
+}
+
+void TS_RESP_CTX_set_extension_cb(TS_RESP_CTX *ctx,
+                                  TS_extension_cb cb, void *data)
+{
+    ctx->extension_cb = cb;
+    ctx->extension_cb_data = data;
+}
+
+int TS_RESP_CTX_set_status_info(TS_RESP_CTX *ctx,
+                                int status, const char *text)
+{
+    TS_STATUS_INFO *si = NULL;
+    ASN1_UTF8STRING *utf8_text = NULL;
+    int ret = 0;
+
+    if ((si = TS_STATUS_INFO_new()) == NULL)
+        goto err;
+    if (!ASN1_INTEGER_set(si->status, status))
+        goto err;
+    if (text) {
+        if ((utf8_text = ASN1_UTF8STRING_new()) == NULL
+            || !ASN1_STRING_set(utf8_text, text, strlen(text)))
+            goto err;
+        if (si->text == NULL
+            && (si->text = sk_ASN1_UTF8STRING_new_null()) == NULL)
+            goto err;
+        if (!sk_ASN1_UTF8STRING_push(si->text, utf8_text))
+            goto err;
+        utf8_text = NULL;       /* Ownership is lost. */
+    }
+    if (!TS_RESP_set_status_info(ctx->response, si))
+        goto err;
+    ret = 1;
+ err:
+    if (!ret)
+        TSerr(TS_F_TS_RESP_CTX_SET_STATUS_INFO, ERR_R_MALLOC_FAILURE);
+    TS_STATUS_INFO_free(si);
+    ASN1_UTF8STRING_free(utf8_text);
+    return ret;
+}
+
+int TS_RESP_CTX_set_status_info_cond(TS_RESP_CTX *ctx,
+                                     int status, const char *text)
+{
+    int ret = 1;
+    TS_STATUS_INFO *si = ctx->response->status_info;
+
+    if (ASN1_INTEGER_get(si->status) == TS_STATUS_GRANTED) {
+        ret = TS_RESP_CTX_set_status_info(ctx, status, text);
+    }
+    return ret;
+}
+
+int TS_RESP_CTX_add_failure_info(TS_RESP_CTX *ctx, int failure)
+{
+    TS_STATUS_INFO *si = ctx->response->status_info;
+    if (si->failure_info == NULL
+        && (si->failure_info = ASN1_BIT_STRING_new()) == NULL)
+        goto err;
+    if (!ASN1_BIT_STRING_set_bit(si->failure_info, failure, 1))
+        goto err;
+    return 1;
+ err:
+    TSerr(TS_F_TS_RESP_CTX_ADD_FAILURE_INFO, ERR_R_MALLOC_FAILURE);
+    return 0;
+}
+
+TS_REQ *TS_RESP_CTX_get_request(TS_RESP_CTX *ctx)
+{
+    return ctx->request;
+}
+
+TS_TST_INFO *TS_RESP_CTX_get_tst_info(TS_RESP_CTX *ctx)
+{
+    return ctx->tst_info;
+}
+
+int TS_RESP_CTX_set_clock_precision_digits(TS_RESP_CTX *ctx,
+                                           unsigned precision)
+{
+    if (precision > TS_MAX_CLOCK_PRECISION_DIGITS)
+        return 0;
+    ctx->clock_precision_digits = precision;
+    return 1;
+}
+
+/* Main entry method of the response generation. */
+TS_RESP *TS_RESP_create_response(TS_RESP_CTX *ctx, BIO *req_bio)
+{
+    ASN1_OBJECT *policy;
+    TS_RESP *response;
+    int result = 0;
+
+    ts_RESP_CTX_init(ctx);
+
+    if ((ctx->response = TS_RESP_new()) == NULL) {
+        TSerr(TS_F_TS_RESP_CREATE_RESPONSE, ERR_R_MALLOC_FAILURE);
+        goto end;
+    }
+    if ((ctx->request = d2i_TS_REQ_bio(req_bio, NULL)) == NULL) {
+        TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
+                                    "Bad request format or system error.");
+        TS_RESP_CTX_add_failure_info(ctx, TS_INFO_BAD_DATA_FORMAT);
+        goto end;
+    }
+    if (!TS_RESP_CTX_set_status_info(ctx, TS_STATUS_GRANTED, NULL))
+        goto end;
+    if (!ts_RESP_check_request(ctx))
+        goto end;
+    if ((policy = ts_RESP_get_policy(ctx)) == NULL)
+        goto end;
+    if ((ctx->tst_info = ts_RESP_create_tst_info(ctx, policy)) == NULL)
+        goto end;
+    if (!ts_RESP_process_extensions(ctx))
+        goto end;
+    if (!ts_RESP_sign(ctx))
+        goto end;
+    result = 1;
+
+ end:
+    if (!result) {
+        TSerr(TS_F_TS_RESP_CREATE_RESPONSE, TS_R_RESPONSE_SETUP_ERROR);
+        if (ctx->response != NULL) {
+            if (TS_RESP_CTX_set_status_info_cond(ctx,
+                                                 TS_STATUS_REJECTION,
+                                                 "Error during response "
+                                                 "generation.") == 0) {
+                TS_RESP_free(ctx->response);
+                ctx->response = NULL;
+            }
+        }
+    }
+    response = ctx->response;
+    ctx->response = NULL;       /* Ownership will be returned to caller. */
+    ts_RESP_CTX_cleanup(ctx);
+    return response;
+}
+
+/* Initializes the variable part of the context. */
+static void ts_RESP_CTX_init(TS_RESP_CTX *ctx)
+{
+    ctx->request = NULL;
+    ctx->response = NULL;
+    ctx->tst_info = NULL;
+}
+
+/* Cleans up the variable part of the context. */
+static void ts_RESP_CTX_cleanup(TS_RESP_CTX *ctx)
+{
+    TS_REQ_free(ctx->request);
+    ctx->request = NULL;
+    TS_RESP_free(ctx->response);
+    ctx->response = NULL;
+    TS_TST_INFO_free(ctx->tst_info);
+    ctx->tst_info = NULL;
+}
+
+/* Checks the format and content of the request. */
+static int ts_RESP_check_request(TS_RESP_CTX *ctx)
+{
+    TS_REQ *request = ctx->request;
+    TS_MSG_IMPRINT *msg_imprint;
+    X509_ALGOR *md_alg;
+    int md_alg_id;
+    const ASN1_OCTET_STRING *digest;
+    const EVP_MD *md = NULL;
+    int i;
+
+    if (TS_REQ_get_version(request) != 1) {
+        TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
+                                    "Bad request version.");
+        TS_RESP_CTX_add_failure_info(ctx, TS_INFO_BAD_REQUEST);
+        return 0;
+    }
+
+    msg_imprint = request->msg_imprint;
+    md_alg = msg_imprint->hash_algo;
+    md_alg_id = OBJ_obj2nid(md_alg->algorithm);
+    for (i = 0; !md && i < sk_EVP_MD_num(ctx->mds); ++i) {
+        const EVP_MD *current_md = sk_EVP_MD_value(ctx->mds, i);
+        if (md_alg_id == EVP_MD_type(current_md))
+            md = current_md;
+    }
+    if (!md) {
+        TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
+                                    "Message digest algorithm is "
+                                    "not supported.");
+        TS_RESP_CTX_add_failure_info(ctx, TS_INFO_BAD_ALG);
+        return 0;
+    }
+
+    if (md_alg->parameter && ASN1_TYPE_get(md_alg->parameter) != V_ASN1_NULL) {
+        TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
+                                    "Superfluous message digest "
+                                    "parameter.");
+        TS_RESP_CTX_add_failure_info(ctx, TS_INFO_BAD_ALG);
+        return 0;
+    }
+    digest = msg_imprint->hashed_msg;
+    if (digest->length != EVP_MD_size(md)) {
+        TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
+                                    "Bad message digest.");
+        TS_RESP_CTX_add_failure_info(ctx, TS_INFO_BAD_DATA_FORMAT);
+        return 0;
+    }
+
+    return 1;
+}
+
+/* Returns the TSA policy based on the requested and acceptable policies. */
+static ASN1_OBJECT *ts_RESP_get_policy(TS_RESP_CTX *ctx)
+{
+    ASN1_OBJECT *requested = ctx->request->policy_id;
+    ASN1_OBJECT *policy = NULL;
+    int i;
+
+    if (ctx->default_policy == NULL) {
+        TSerr(TS_F_TS_RESP_GET_POLICY, TS_R_INVALID_NULL_POINTER);
+        return NULL;
+    }
+    if (!requested || !OBJ_cmp(requested, ctx->default_policy))
+        policy = ctx->default_policy;
+
+    /* Check if the policy is acceptable. */
+    for (i = 0; !policy && i < sk_ASN1_OBJECT_num(ctx->policies); ++i) {
+        ASN1_OBJECT *current = sk_ASN1_OBJECT_value(ctx->policies, i);
+        if (!OBJ_cmp(requested, current))
+            policy = current;
+    }
+    if (!policy) {
+        TSerr(TS_F_TS_RESP_GET_POLICY, TS_R_UNACCEPTABLE_POLICY);
+        TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
+                                    "Requested policy is not " "supported.");
+        TS_RESP_CTX_add_failure_info(ctx, TS_INFO_UNACCEPTED_POLICY);
+    }
+    return policy;
+}
+
+/* Creates the TS_TST_INFO object based on the settings of the context. */
+static TS_TST_INFO *ts_RESP_create_tst_info(TS_RESP_CTX *ctx,
+                                            ASN1_OBJECT *policy)
+{
+    int result = 0;
+    TS_TST_INFO *tst_info = NULL;
+    ASN1_INTEGER *serial = NULL;
+    ASN1_GENERALIZEDTIME *asn1_time = NULL;
+    long sec, usec;
+    TS_ACCURACY *accuracy = NULL;
+    const ASN1_INTEGER *nonce;
+    GENERAL_NAME *tsa_name = NULL;
+
+    if ((tst_info = TS_TST_INFO_new()) == NULL)
+        goto end;
+    if (!TS_TST_INFO_set_version(tst_info, 1))
+        goto end;
+    if (!TS_TST_INFO_set_policy_id(tst_info, policy))
+        goto end;
+    if (!TS_TST_INFO_set_msg_imprint(tst_info, ctx->request->msg_imprint))
+        goto end;
+    if ((serial = ctx->serial_cb(ctx, ctx->serial_cb_data)) == NULL
+        || !TS_TST_INFO_set_serial(tst_info, serial))
+        goto end;
+    if (!ctx->time_cb(ctx, ctx->time_cb_data, &sec, &usec)
+        || (asn1_time =
+            TS_RESP_set_genTime_with_precision(NULL, sec, usec,
+                                        ctx->clock_precision_digits)) == NULL
+        || !TS_TST_INFO_set_time(tst_info, asn1_time))
+        goto end;
+
+    if ((ctx->seconds || ctx->millis || ctx->micros)
+        && (accuracy = TS_ACCURACY_new()) == NULL)
+        goto end;
+    if (ctx->seconds && !TS_ACCURACY_set_seconds(accuracy, ctx->seconds))
+        goto end;
+    if (ctx->millis && !TS_ACCURACY_set_millis(accuracy, ctx->millis))
+        goto end;
+    if (ctx->micros && !TS_ACCURACY_set_micros(accuracy, ctx->micros))
+        goto end;
+    if (accuracy && !TS_TST_INFO_set_accuracy(tst_info, accuracy))
+        goto end;
+
+    if ((ctx->flags & TS_ORDERING)
+        && !TS_TST_INFO_set_ordering(tst_info, 1))
+        goto end;
+
+    if ((nonce = ctx->request->nonce) != NULL
+        && !TS_TST_INFO_set_nonce(tst_info, nonce))
+        goto end;
+
+    if (ctx->flags & TS_TSA_NAME) {
+        if ((tsa_name = GENERAL_NAME_new()) == NULL)
+            goto end;
+        tsa_name->type = GEN_DIRNAME;
+        tsa_name->d.dirn =
+            X509_NAME_dup(X509_get_subject_name(ctx->signer_cert));
+        if (!tsa_name->d.dirn)
+            goto end;
+        if (!TS_TST_INFO_set_tsa(tst_info, tsa_name))
+            goto end;
+    }
+
+    result = 1;
+ end:
+    if (!result) {
+        TS_TST_INFO_free(tst_info);
+        tst_info = NULL;
+        TSerr(TS_F_TS_RESP_CREATE_TST_INFO, TS_R_TST_INFO_SETUP_ERROR);
+        TS_RESP_CTX_set_status_info_cond(ctx, TS_STATUS_REJECTION,
+                                         "Error during TSTInfo "
+                                         "generation.");
+    }
+    GENERAL_NAME_free(tsa_name);
+    TS_ACCURACY_free(accuracy);
+    ASN1_GENERALIZEDTIME_free(asn1_time);
     ASN1_INTEGER_free(serial);
-    return NULL; 
-} 
- 
-#if defined(OPENSSL_SYS_UNIX) 
- 
-static int def_time_cb(struct TS_resp_ctx *ctx, void *data, 
-                       long *sec, long *usec) 
-{ 
-    struct timeval tv; 
-    if (gettimeofday(&tv, NULL) != 0) { 
-        TSerr(TS_F_DEF_TIME_CB, TS_R_TIME_SYSCALL_ERROR); 
-        TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, 
-                                    "Time is not available."); 
-        TS_RESP_CTX_add_failure_info(ctx, TS_INFO_TIME_NOT_AVAILABLE); 
-        return 0; 
-    } 
-    *sec = tv.tv_sec; 
-    *usec = tv.tv_usec; 
- 
-    return 1; 
-} 
- 
-#else 
- 
-static int def_time_cb(struct TS_resp_ctx *ctx, void *data, 
-                       long *sec, long *usec) 
-{ 
-    time_t t; 
-    if (time(&t) == (time_t)-1) { 
-        TSerr(TS_F_DEF_TIME_CB, TS_R_TIME_SYSCALL_ERROR); 
-        TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, 
-                                    "Time is not available."); 
-        TS_RESP_CTX_add_failure_info(ctx, TS_INFO_TIME_NOT_AVAILABLE); 
-        return 0; 
-    } 
-    *sec = (long)t; 
-    *usec = 0; 
- 
-    return 1; 
-} 
- 
-#endif 
- 
-static int def_extension_cb(struct TS_resp_ctx *ctx, X509_EXTENSION *ext, 
-                            void *data) 
-{ 
-    TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, 
-                                "Unsupported extension."); 
-    TS_RESP_CTX_add_failure_info(ctx, TS_INFO_UNACCEPTED_EXTENSION); 
-    return 0; 
-} 
- 
-/* TS_RESP_CTX management functions. */ 
- 
-TS_RESP_CTX *TS_RESP_CTX_new(void) 
-{ 
-    TS_RESP_CTX *ctx; 
- 
-    if ((ctx = OPENSSL_zalloc(sizeof(*ctx))) == NULL) { 
-        TSerr(TS_F_TS_RESP_CTX_NEW, ERR_R_MALLOC_FAILURE); 
-        return NULL; 
-    } 
- 
-    ctx->signer_md = EVP_sha256(); 
- 
-    ctx->serial_cb = def_serial_cb; 
-    ctx->time_cb = def_time_cb; 
-    ctx->extension_cb = def_extension_cb; 
- 
-    return ctx; 
-} 
- 
-void TS_RESP_CTX_free(TS_RESP_CTX *ctx) 
-{ 
-    if (!ctx) 
-        return; 
- 
-    X509_free(ctx->signer_cert); 
-    EVP_PKEY_free(ctx->signer_key); 
-    sk_X509_pop_free(ctx->certs, X509_free); 
-    sk_ASN1_OBJECT_pop_free(ctx->policies, ASN1_OBJECT_free); 
-    ASN1_OBJECT_free(ctx->default_policy); 
-    sk_EVP_MD_free(ctx->mds);   /* No EVP_MD_free method exists. */ 
-    ASN1_INTEGER_free(ctx->seconds); 
-    ASN1_INTEGER_free(ctx->millis); 
-    ASN1_INTEGER_free(ctx->micros); 
-    OPENSSL_free(ctx); 
-} 
- 
-int TS_RESP_CTX_set_signer_cert(TS_RESP_CTX *ctx, X509 *signer) 
-{ 
-    if (X509_check_purpose(signer, X509_PURPOSE_TIMESTAMP_SIGN, 0) != 1) { 
-        TSerr(TS_F_TS_RESP_CTX_SET_SIGNER_CERT, 
-              TS_R_INVALID_SIGNER_CERTIFICATE_PURPOSE); 
-        return 0; 
-    } 
-    X509_free(ctx->signer_cert); 
-    ctx->signer_cert = signer; 
-    X509_up_ref(ctx->signer_cert); 
-    return 1; 
-} 
- 
-int TS_RESP_CTX_set_signer_key(TS_RESP_CTX *ctx, EVP_PKEY *key) 
-{ 
-    EVP_PKEY_free(ctx->signer_key); 
-    ctx->signer_key = key; 
-    EVP_PKEY_up_ref(ctx->signer_key); 
- 
-    return 1; 
-} 
- 
-int TS_RESP_CTX_set_signer_digest(TS_RESP_CTX *ctx, const EVP_MD *md) 
-{ 
-    ctx->signer_md = md; 
-    return 1; 
-} 
- 
-int TS_RESP_CTX_set_def_policy(TS_RESP_CTX *ctx, const ASN1_OBJECT *def_policy) 
-{ 
-    ASN1_OBJECT_free(ctx->default_policy); 
-    if ((ctx->default_policy = OBJ_dup(def_policy)) == NULL) 
-        goto err; 
-    return 1; 
- err: 
-    TSerr(TS_F_TS_RESP_CTX_SET_DEF_POLICY, ERR_R_MALLOC_FAILURE); 
-    return 0; 
-} 
- 
-int TS_RESP_CTX_set_certs(TS_RESP_CTX *ctx, STACK_OF(X509) *certs) 
-{ 
- 
-    sk_X509_pop_free(ctx->certs, X509_free); 
-    ctx->certs = NULL; 
-    if (!certs) 
-        return 1; 
-    if ((ctx->certs = X509_chain_up_ref(certs)) == NULL) { 
-        TSerr(TS_F_TS_RESP_CTX_SET_CERTS, ERR_R_MALLOC_FAILURE); 
-        return 0; 
-    } 
- 
-    return 1; 
-} 
- 
-int TS_RESP_CTX_add_policy(TS_RESP_CTX *ctx, const ASN1_OBJECT *policy) 
-{ 
-    ASN1_OBJECT *copy = NULL; 
- 
-    if (ctx->policies == NULL 
-        && (ctx->policies = sk_ASN1_OBJECT_new_null()) == NULL) 
-        goto err; 
-    if ((copy = OBJ_dup(policy)) == NULL) 
-        goto err; 
-    if (!sk_ASN1_OBJECT_push(ctx->policies, copy)) 
-        goto err; 
- 
-    return 1; 
- err: 
-    TSerr(TS_F_TS_RESP_CTX_ADD_POLICY, ERR_R_MALLOC_FAILURE); 
-    ASN1_OBJECT_free(copy); 
-    return 0; 
-} 
- 
-int TS_RESP_CTX_add_md(TS_RESP_CTX *ctx, const EVP_MD *md) 
-{ 
-    if (ctx->mds == NULL 
-        && (ctx->mds = sk_EVP_MD_new_null()) == NULL) 
-        goto err; 
-    if (!sk_EVP_MD_push(ctx->mds, md)) 
-        goto err; 
- 
-    return 1; 
- err: 
-    TSerr(TS_F_TS_RESP_CTX_ADD_MD, ERR_R_MALLOC_FAILURE); 
-    return 0; 
-} 
- 
-#define TS_RESP_CTX_accuracy_free(ctx)          \ 
-        ASN1_INTEGER_free(ctx->seconds);        \ 
-        ctx->seconds = NULL;                    \ 
-        ASN1_INTEGER_free(ctx->millis);         \ 
-        ctx->millis = NULL;                     \ 
-        ASN1_INTEGER_free(ctx->micros);         \ 
-        ctx->micros = NULL; 
- 
-int TS_RESP_CTX_set_accuracy(TS_RESP_CTX *ctx, 
-                             int secs, int millis, int micros) 
-{ 
- 
-    TS_RESP_CTX_accuracy_free(ctx); 
-    if (secs 
-        && ((ctx->seconds = ASN1_INTEGER_new()) == NULL 
-            || !ASN1_INTEGER_set(ctx->seconds, secs))) 
-        goto err; 
-    if (millis 
-        && ((ctx->millis = ASN1_INTEGER_new()) == NULL 
-            || !ASN1_INTEGER_set(ctx->millis, millis))) 
-        goto err; 
-    if (micros 
-        && ((ctx->micros = ASN1_INTEGER_new()) == NULL 
-            || !ASN1_INTEGER_set(ctx->micros, micros))) 
-        goto err; 
- 
-    return 1; 
- err: 
-    TS_RESP_CTX_accuracy_free(ctx); 
-    TSerr(TS_F_TS_RESP_CTX_SET_ACCURACY, ERR_R_MALLOC_FAILURE); 
-    return 0; 
-} 
- 
-void TS_RESP_CTX_add_flags(TS_RESP_CTX *ctx, int flags) 
-{ 
-    ctx->flags |= flags; 
-} 
- 
-void TS_RESP_CTX_set_serial_cb(TS_RESP_CTX *ctx, TS_serial_cb cb, void *data) 
-{ 
-    ctx->serial_cb = cb; 
-    ctx->serial_cb_data = data; 
-} 
- 
-void TS_RESP_CTX_set_time_cb(TS_RESP_CTX *ctx, TS_time_cb cb, void *data) 
-{ 
-    ctx->time_cb = cb; 
-    ctx->time_cb_data = data; 
-} 
- 
-void TS_RESP_CTX_set_extension_cb(TS_RESP_CTX *ctx, 
-                                  TS_extension_cb cb, void *data) 
-{ 
-    ctx->extension_cb = cb; 
-    ctx->extension_cb_data = data; 
-} 
- 
-int TS_RESP_CTX_set_status_info(TS_RESP_CTX *ctx, 
-                                int status, const char *text) 
-{ 
-    TS_STATUS_INFO *si = NULL; 
-    ASN1_UTF8STRING *utf8_text = NULL; 
-    int ret = 0; 
- 
-    if ((si = TS_STATUS_INFO_new()) == NULL) 
-        goto err; 
-    if (!ASN1_INTEGER_set(si->status, status)) 
-        goto err; 
-    if (text) { 
-        if ((utf8_text = ASN1_UTF8STRING_new()) == NULL 
-            || !ASN1_STRING_set(utf8_text, text, strlen(text))) 
-            goto err; 
-        if (si->text == NULL 
-            && (si->text = sk_ASN1_UTF8STRING_new_null()) == NULL) 
-            goto err; 
-        if (!sk_ASN1_UTF8STRING_push(si->text, utf8_text)) 
-            goto err; 
-        utf8_text = NULL;       /* Ownership is lost. */ 
-    } 
-    if (!TS_RESP_set_status_info(ctx->response, si)) 
-        goto err; 
-    ret = 1; 
- err: 
-    if (!ret) 
-        TSerr(TS_F_TS_RESP_CTX_SET_STATUS_INFO, ERR_R_MALLOC_FAILURE); 
-    TS_STATUS_INFO_free(si); 
-    ASN1_UTF8STRING_free(utf8_text); 
-    return ret; 
-} 
- 
-int TS_RESP_CTX_set_status_info_cond(TS_RESP_CTX *ctx, 
-                                     int status, const char *text) 
-{ 
-    int ret = 1; 
-    TS_STATUS_INFO *si = ctx->response->status_info; 
- 
-    if (ASN1_INTEGER_get(si->status) == TS_STATUS_GRANTED) { 
-        ret = TS_RESP_CTX_set_status_info(ctx, status, text); 
-    } 
-    return ret; 
-} 
- 
-int TS_RESP_CTX_add_failure_info(TS_RESP_CTX *ctx, int failure) 
-{ 
-    TS_STATUS_INFO *si = ctx->response->status_info; 
-    if (si->failure_info == NULL 
-        && (si->failure_info = ASN1_BIT_STRING_new()) == NULL) 
-        goto err; 
-    if (!ASN1_BIT_STRING_set_bit(si->failure_info, failure, 1)) 
-        goto err; 
-    return 1; 
- err: 
-    TSerr(TS_F_TS_RESP_CTX_ADD_FAILURE_INFO, ERR_R_MALLOC_FAILURE); 
-    return 0; 
-} 
- 
-TS_REQ *TS_RESP_CTX_get_request(TS_RESP_CTX *ctx) 
-{ 
-    return ctx->request; 
-} 
- 
-TS_TST_INFO *TS_RESP_CTX_get_tst_info(TS_RESP_CTX *ctx) 
-{ 
-    return ctx->tst_info; 
-} 
- 
-int TS_RESP_CTX_set_clock_precision_digits(TS_RESP_CTX *ctx, 
-                                           unsigned precision) 
-{ 
-    if (precision > TS_MAX_CLOCK_PRECISION_DIGITS) 
-        return 0; 
-    ctx->clock_precision_digits = precision; 
-    return 1; 
-} 
- 
-/* Main entry method of the response generation. */ 
-TS_RESP *TS_RESP_create_response(TS_RESP_CTX *ctx, BIO *req_bio) 
-{ 
-    ASN1_OBJECT *policy; 
-    TS_RESP *response; 
-    int result = 0; 
- 
-    ts_RESP_CTX_init(ctx); 
- 
-    if ((ctx->response = TS_RESP_new()) == NULL) { 
-        TSerr(TS_F_TS_RESP_CREATE_RESPONSE, ERR_R_MALLOC_FAILURE); 
-        goto end; 
-    } 
-    if ((ctx->request = d2i_TS_REQ_bio(req_bio, NULL)) == NULL) { 
-        TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, 
-                                    "Bad request format or system error."); 
-        TS_RESP_CTX_add_failure_info(ctx, TS_INFO_BAD_DATA_FORMAT); 
-        goto end; 
-    } 
-    if (!TS_RESP_CTX_set_status_info(ctx, TS_STATUS_GRANTED, NULL)) 
-        goto end; 
-    if (!ts_RESP_check_request(ctx)) 
-        goto end; 
-    if ((policy = ts_RESP_get_policy(ctx)) == NULL) 
-        goto end; 
-    if ((ctx->tst_info = ts_RESP_create_tst_info(ctx, policy)) == NULL) 
-        goto end; 
-    if (!ts_RESP_process_extensions(ctx)) 
-        goto end; 
-    if (!ts_RESP_sign(ctx)) 
-        goto end; 
-    result = 1; 
- 
- end: 
-    if (!result) { 
-        TSerr(TS_F_TS_RESP_CREATE_RESPONSE, TS_R_RESPONSE_SETUP_ERROR); 
-        if (ctx->response != NULL) { 
-            if (TS_RESP_CTX_set_status_info_cond(ctx, 
-                                                 TS_STATUS_REJECTION, 
-                                                 "Error during response " 
-                                                 "generation.") == 0) { 
-                TS_RESP_free(ctx->response); 
-                ctx->response = NULL; 
-            } 
-        } 
-    } 
-    response = ctx->response; 
-    ctx->response = NULL;       /* Ownership will be returned to caller. */ 
-    ts_RESP_CTX_cleanup(ctx); 
-    return response; 
-} 
- 
-/* Initializes the variable part of the context. */ 
-static void ts_RESP_CTX_init(TS_RESP_CTX *ctx) 
-{ 
-    ctx->request = NULL; 
-    ctx->response = NULL; 
-    ctx->tst_info = NULL; 
-} 
- 
-/* Cleans up the variable part of the context. */ 
-static void ts_RESP_CTX_cleanup(TS_RESP_CTX *ctx) 
-{ 
-    TS_REQ_free(ctx->request); 
-    ctx->request = NULL; 
-    TS_RESP_free(ctx->response); 
-    ctx->response = NULL; 
-    TS_TST_INFO_free(ctx->tst_info); 
-    ctx->tst_info = NULL; 
-} 
- 
-/* Checks the format and content of the request. */ 
-static int ts_RESP_check_request(TS_RESP_CTX *ctx) 
-{ 
-    TS_REQ *request = ctx->request; 
-    TS_MSG_IMPRINT *msg_imprint; 
-    X509_ALGOR *md_alg; 
-    int md_alg_id; 
-    const ASN1_OCTET_STRING *digest; 
-    const EVP_MD *md = NULL; 
-    int i; 
- 
-    if (TS_REQ_get_version(request) != 1) { 
-        TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, 
-                                    "Bad request version."); 
-        TS_RESP_CTX_add_failure_info(ctx, TS_INFO_BAD_REQUEST); 
-        return 0; 
-    } 
- 
-    msg_imprint = request->msg_imprint; 
-    md_alg = msg_imprint->hash_algo; 
-    md_alg_id = OBJ_obj2nid(md_alg->algorithm); 
-    for (i = 0; !md && i < sk_EVP_MD_num(ctx->mds); ++i) { 
-        const EVP_MD *current_md = sk_EVP_MD_value(ctx->mds, i); 
-        if (md_alg_id == EVP_MD_type(current_md)) 
-            md = current_md; 
-    } 
-    if (!md) { 
-        TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, 
-                                    "Message digest algorithm is " 
-                                    "not supported."); 
-        TS_RESP_CTX_add_failure_info(ctx, TS_INFO_BAD_ALG); 
-        return 0; 
-    } 
- 
-    if (md_alg->parameter && ASN1_TYPE_get(md_alg->parameter) != V_ASN1_NULL) { 
-        TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, 
-                                    "Superfluous message digest " 
-                                    "parameter."); 
-        TS_RESP_CTX_add_failure_info(ctx, TS_INFO_BAD_ALG); 
-        return 0; 
-    } 
-    digest = msg_imprint->hashed_msg; 
-    if (digest->length != EVP_MD_size(md)) { 
-        TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, 
-                                    "Bad message digest."); 
-        TS_RESP_CTX_add_failure_info(ctx, TS_INFO_BAD_DATA_FORMAT); 
-        return 0; 
-    } 
- 
-    return 1; 
-} 
- 
-/* Returns the TSA policy based on the requested and acceptable policies. */ 
-static ASN1_OBJECT *ts_RESP_get_policy(TS_RESP_CTX *ctx) 
-{ 
-    ASN1_OBJECT *requested = ctx->request->policy_id; 
-    ASN1_OBJECT *policy = NULL; 
-    int i; 
- 
-    if (ctx->default_policy == NULL) { 
-        TSerr(TS_F_TS_RESP_GET_POLICY, TS_R_INVALID_NULL_POINTER); 
-        return NULL; 
-    } 
-    if (!requested || !OBJ_cmp(requested, ctx->default_policy)) 
-        policy = ctx->default_policy; 
- 
-    /* Check if the policy is acceptable. */ 
-    for (i = 0; !policy && i < sk_ASN1_OBJECT_num(ctx->policies); ++i) { 
-        ASN1_OBJECT *current = sk_ASN1_OBJECT_value(ctx->policies, i); 
-        if (!OBJ_cmp(requested, current)) 
-            policy = current; 
-    } 
-    if (!policy) { 
-        TSerr(TS_F_TS_RESP_GET_POLICY, TS_R_UNACCEPTABLE_POLICY); 
-        TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, 
-                                    "Requested policy is not " "supported."); 
-        TS_RESP_CTX_add_failure_info(ctx, TS_INFO_UNACCEPTED_POLICY); 
-    } 
-    return policy; 
-} 
- 
-/* Creates the TS_TST_INFO object based on the settings of the context. */ 
-static TS_TST_INFO *ts_RESP_create_tst_info(TS_RESP_CTX *ctx, 
-                                            ASN1_OBJECT *policy) 
-{ 
-    int result = 0; 
-    TS_TST_INFO *tst_info = NULL; 
-    ASN1_INTEGER *serial = NULL; 
-    ASN1_GENERALIZEDTIME *asn1_time = NULL; 
-    long sec, usec; 
-    TS_ACCURACY *accuracy = NULL; 
-    const ASN1_INTEGER *nonce; 
-    GENERAL_NAME *tsa_name = NULL; 
- 
-    if ((tst_info = TS_TST_INFO_new()) == NULL) 
-        goto end; 
-    if (!TS_TST_INFO_set_version(tst_info, 1)) 
-        goto end; 
-    if (!TS_TST_INFO_set_policy_id(tst_info, policy)) 
-        goto end; 
-    if (!TS_TST_INFO_set_msg_imprint(tst_info, ctx->request->msg_imprint)) 
-        goto end; 
-    if ((serial = ctx->serial_cb(ctx, ctx->serial_cb_data)) == NULL 
-        || !TS_TST_INFO_set_serial(tst_info, serial)) 
-        goto end; 
-    if (!ctx->time_cb(ctx, ctx->time_cb_data, &sec, &usec) 
-        || (asn1_time = 
-            TS_RESP_set_genTime_with_precision(NULL, sec, usec, 
-                                        ctx->clock_precision_digits)) == NULL 
-        || !TS_TST_INFO_set_time(tst_info, asn1_time)) 
-        goto end; 
- 
-    if ((ctx->seconds || ctx->millis || ctx->micros) 
-        && (accuracy = TS_ACCURACY_new()) == NULL) 
-        goto end; 
-    if (ctx->seconds && !TS_ACCURACY_set_seconds(accuracy, ctx->seconds)) 
-        goto end; 
-    if (ctx->millis && !TS_ACCURACY_set_millis(accuracy, ctx->millis)) 
-        goto end; 
-    if (ctx->micros && !TS_ACCURACY_set_micros(accuracy, ctx->micros)) 
-        goto end; 
-    if (accuracy && !TS_TST_INFO_set_accuracy(tst_info, accuracy)) 
-        goto end; 
- 
-    if ((ctx->flags & TS_ORDERING) 
-        && !TS_TST_INFO_set_ordering(tst_info, 1)) 
-        goto end; 
- 
-    if ((nonce = ctx->request->nonce) != NULL 
-        && !TS_TST_INFO_set_nonce(tst_info, nonce)) 
-        goto end; 
- 
-    if (ctx->flags & TS_TSA_NAME) { 
-        if ((tsa_name = GENERAL_NAME_new()) == NULL) 
-            goto end; 
-        tsa_name->type = GEN_DIRNAME; 
-        tsa_name->d.dirn = 
-            X509_NAME_dup(X509_get_subject_name(ctx->signer_cert)); 
-        if (!tsa_name->d.dirn) 
-            goto end; 
-        if (!TS_TST_INFO_set_tsa(tst_info, tsa_name)) 
-            goto end; 
-    } 
- 
-    result = 1; 
- end: 
-    if (!result) { 
-        TS_TST_INFO_free(tst_info); 
-        tst_info = NULL; 
-        TSerr(TS_F_TS_RESP_CREATE_TST_INFO, TS_R_TST_INFO_SETUP_ERROR); 
-        TS_RESP_CTX_set_status_info_cond(ctx, TS_STATUS_REJECTION, 
-                                         "Error during TSTInfo " 
-                                         "generation."); 
-    } 
-    GENERAL_NAME_free(tsa_name); 
-    TS_ACCURACY_free(accuracy); 
-    ASN1_GENERALIZEDTIME_free(asn1_time); 
-    ASN1_INTEGER_free(serial); 
- 
-    return tst_info; 
-} 
- 
-/* Processing the extensions of the request. */ 
-static int ts_RESP_process_extensions(TS_RESP_CTX *ctx) 
-{ 
-    STACK_OF(X509_EXTENSION) *exts = ctx->request->extensions; 
-    int i; 
-    int ok = 1; 
- 
-    for (i = 0; ok && i < sk_X509_EXTENSION_num(exts); ++i) { 
-        X509_EXTENSION *ext = sk_X509_EXTENSION_value(exts, i); 
-        /* 
-         * The last argument was previously (void *)ctx->extension_cb, 
-         * but ISO C doesn't permit converting a function pointer to void *. 
-         * For lack of better information, I'm placing a NULL there instead. 
-         * The callback can pick its own address out from the ctx anyway... 
-         */ 
-        ok = (*ctx->extension_cb) (ctx, ext, NULL); 
-    } 
- 
-    return ok; 
-} 
- 
-/* Functions for signing the TS_TST_INFO structure of the context. */ 
-static int ts_RESP_sign(TS_RESP_CTX *ctx) 
-{ 
-    int ret = 0; 
-    PKCS7 *p7 = NULL; 
-    PKCS7_SIGNER_INFO *si; 
-    STACK_OF(X509) *certs;      /* Certificates to include in sc. */ 
-    ESS_SIGNING_CERT_V2 *sc2 = NULL; 
-    ESS_SIGNING_CERT *sc = NULL; 
-    ASN1_OBJECT *oid; 
-    BIO *p7bio = NULL; 
-    int i; 
- 
-    if (!X509_check_private_key(ctx->signer_cert, ctx->signer_key)) { 
-        TSerr(TS_F_TS_RESP_SIGN, TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE); 
-        goto err; 
-    } 
- 
-    if ((p7 = PKCS7_new()) == NULL) { 
-        TSerr(TS_F_TS_RESP_SIGN, ERR_R_MALLOC_FAILURE); 
-        goto err; 
-    } 
-    if (!PKCS7_set_type(p7, NID_pkcs7_signed)) 
-        goto err; 
-    if (!ASN1_INTEGER_set(p7->d.sign->version, 3)) 
-        goto err; 
- 
-    if (ctx->request->cert_req) { 
-        PKCS7_add_certificate(p7, ctx->signer_cert); 
-        if (ctx->certs) { 
-            for (i = 0; i < sk_X509_num(ctx->certs); ++i) { 
-                X509 *cert = sk_X509_value(ctx->certs, i); 
-                PKCS7_add_certificate(p7, cert); 
-            } 
-        } 
-    } 
- 
-    if ((si = PKCS7_add_signature(p7, ctx->signer_cert, 
-                                  ctx->signer_key, ctx->signer_md)) == NULL) { 
-        TSerr(TS_F_TS_RESP_SIGN, TS_R_PKCS7_ADD_SIGNATURE_ERROR); 
-        goto err; 
-    } 
- 
-    oid = OBJ_nid2obj(NID_id_smime_ct_TSTInfo); 
-    if (!PKCS7_add_signed_attribute(si, NID_pkcs9_contentType, 
-                                    V_ASN1_OBJECT, oid)) { 
-        TSerr(TS_F_TS_RESP_SIGN, TS_R_PKCS7_ADD_SIGNED_ATTR_ERROR); 
-        goto err; 
-    } 
- 
-    certs = ctx->flags & TS_ESS_CERT_ID_CHAIN ? ctx->certs : NULL; 
-    if (ctx->ess_cert_id_digest == NULL 
-        || ctx->ess_cert_id_digest == EVP_sha1()) { 
-        if ((sc = ess_SIGNING_CERT_new_init(ctx->signer_cert, certs)) == NULL) 
-            goto err; 
- 
-        if (!ess_add_signing_cert(si, sc)) { 
-            TSerr(TS_F_TS_RESP_SIGN, TS_R_ESS_ADD_SIGNING_CERT_ERROR); 
-            goto err; 
-        } 
-    } else { 
-        sc2 = ess_signing_cert_v2_new_init(ctx->ess_cert_id_digest, 
-                                           ctx->signer_cert, certs); 
-        if (sc2 == NULL) 
-            goto err; 
- 
-        if (!ess_add_signing_cert_v2(si, sc2)) { 
-            TSerr(TS_F_TS_RESP_SIGN, TS_R_ESS_ADD_SIGNING_CERT_V2_ERROR); 
-            goto err; 
-        } 
-    } 
- 
-    if (!ts_TST_INFO_content_new(p7)) 
-        goto err; 
-    if ((p7bio = PKCS7_dataInit(p7, NULL)) == NULL) { 
-        TSerr(TS_F_TS_RESP_SIGN, ERR_R_MALLOC_FAILURE); 
-        goto err; 
-    } 
-    if (!i2d_TS_TST_INFO_bio(p7bio, ctx->tst_info)) { 
-        TSerr(TS_F_TS_RESP_SIGN, TS_R_TS_DATASIGN); 
-        goto err; 
-    } 
-    if (!PKCS7_dataFinal(p7, p7bio)) { 
-        TSerr(TS_F_TS_RESP_SIGN, TS_R_TS_DATASIGN); 
-        goto err; 
-    } 
-    TS_RESP_set_tst_info(ctx->response, p7, ctx->tst_info); 
-    p7 = NULL;                  /* Ownership is lost. */ 
-    ctx->tst_info = NULL;       /* Ownership is lost. */ 
- 
-    ret = 1; 
- err: 
-    if (!ret) 
-        TS_RESP_CTX_set_status_info_cond(ctx, TS_STATUS_REJECTION, 
-                                         "Error during signature " 
-                                         "generation."); 
-    BIO_free_all(p7bio); 
-    ESS_SIGNING_CERT_V2_free(sc2); 
-    ESS_SIGNING_CERT_free(sc); 
-    PKCS7_free(p7); 
-    return ret; 
-} 
- 
-static ESS_SIGNING_CERT *ess_SIGNING_CERT_new_init(X509 *signcert, 
-                                                   STACK_OF(X509) *certs) 
-{ 
-    ESS_CERT_ID *cid; 
-    ESS_SIGNING_CERT *sc = NULL; 
-    int i; 
- 
-    if ((sc = ESS_SIGNING_CERT_new()) == NULL) 
-        goto err; 
-    if (sc->cert_ids == NULL 
-        && (sc->cert_ids = sk_ESS_CERT_ID_new_null()) == NULL) 
-        goto err; 
- 
-    if ((cid = ess_CERT_ID_new_init(signcert, 0)) == NULL 
-        || !sk_ESS_CERT_ID_push(sc->cert_ids, cid)) 
-        goto err; 
-    for (i = 0; i < sk_X509_num(certs); ++i) { 
-        X509 *cert = sk_X509_value(certs, i); 
-        if ((cid = ess_CERT_ID_new_init(cert, 1)) == NULL 
-            || !sk_ESS_CERT_ID_push(sc->cert_ids, cid)) 
-            goto err; 
-    } 
- 
-    return sc; 
- err: 
-    ESS_SIGNING_CERT_free(sc); 
-    TSerr(TS_F_ESS_SIGNING_CERT_NEW_INIT, ERR_R_MALLOC_FAILURE); 
-    return NULL; 
-} 
- 
-static ESS_CERT_ID *ess_CERT_ID_new_init(X509 *cert, int issuer_needed) 
-{ 
-    ESS_CERT_ID *cid = NULL; 
-    GENERAL_NAME *name = NULL; 
-    unsigned char cert_sha1[SHA_DIGEST_LENGTH]; 
- 
-    /* Call for side-effect of computing hash and caching extensions */ 
-    X509_check_purpose(cert, -1, 0); 
-    if ((cid = ESS_CERT_ID_new()) == NULL) 
-        goto err; 
+
+    return tst_info;
+}
+
+/* Processing the extensions of the request. */
+static int ts_RESP_process_extensions(TS_RESP_CTX *ctx)
+{
+    STACK_OF(X509_EXTENSION) *exts = ctx->request->extensions;
+    int i;
+    int ok = 1;
+
+    for (i = 0; ok && i < sk_X509_EXTENSION_num(exts); ++i) {
+        X509_EXTENSION *ext = sk_X509_EXTENSION_value(exts, i);
+        /*
+         * The last argument was previously (void *)ctx->extension_cb,
+         * but ISO C doesn't permit converting a function pointer to void *.
+         * For lack of better information, I'm placing a NULL there instead.
+         * The callback can pick its own address out from the ctx anyway...
+         */
+        ok = (*ctx->extension_cb) (ctx, ext, NULL);
+    }
+
+    return ok;
+}
+
+/* Functions for signing the TS_TST_INFO structure of the context. */
+static int ts_RESP_sign(TS_RESP_CTX *ctx)
+{
+    int ret = 0;
+    PKCS7 *p7 = NULL;
+    PKCS7_SIGNER_INFO *si;
+    STACK_OF(X509) *certs;      /* Certificates to include in sc. */
+    ESS_SIGNING_CERT_V2 *sc2 = NULL;
+    ESS_SIGNING_CERT *sc = NULL;
+    ASN1_OBJECT *oid;
+    BIO *p7bio = NULL;
+    int i;
+
+    if (!X509_check_private_key(ctx->signer_cert, ctx->signer_key)) {
+        TSerr(TS_F_TS_RESP_SIGN, TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE);
+        goto err;
+    }
+
+    if ((p7 = PKCS7_new()) == NULL) {
+        TSerr(TS_F_TS_RESP_SIGN, ERR_R_MALLOC_FAILURE);
+        goto err;
+    }
+    if (!PKCS7_set_type(p7, NID_pkcs7_signed))
+        goto err;
+    if (!ASN1_INTEGER_set(p7->d.sign->version, 3))
+        goto err;
+
+    if (ctx->request->cert_req) {
+        PKCS7_add_certificate(p7, ctx->signer_cert);
+        if (ctx->certs) {
+            for (i = 0; i < sk_X509_num(ctx->certs); ++i) {
+                X509 *cert = sk_X509_value(ctx->certs, i);
+                PKCS7_add_certificate(p7, cert);
+            }
+        }
+    }
+
+    if ((si = PKCS7_add_signature(p7, ctx->signer_cert,
+                                  ctx->signer_key, ctx->signer_md)) == NULL) {
+        TSerr(TS_F_TS_RESP_SIGN, TS_R_PKCS7_ADD_SIGNATURE_ERROR);
+        goto err;
+    }
+
+    oid = OBJ_nid2obj(NID_id_smime_ct_TSTInfo);
+    if (!PKCS7_add_signed_attribute(si, NID_pkcs9_contentType,
+                                    V_ASN1_OBJECT, oid)) {
+        TSerr(TS_F_TS_RESP_SIGN, TS_R_PKCS7_ADD_SIGNED_ATTR_ERROR);
+        goto err;
+    }
+
+    certs = ctx->flags & TS_ESS_CERT_ID_CHAIN ? ctx->certs : NULL;
+    if (ctx->ess_cert_id_digest == NULL
+        || ctx->ess_cert_id_digest == EVP_sha1()) {
+        if ((sc = ess_SIGNING_CERT_new_init(ctx->signer_cert, certs)) == NULL)
+            goto err;
+
+        if (!ess_add_signing_cert(si, sc)) {
+            TSerr(TS_F_TS_RESP_SIGN, TS_R_ESS_ADD_SIGNING_CERT_ERROR);
+            goto err;
+        }
+    } else {
+        sc2 = ess_signing_cert_v2_new_init(ctx->ess_cert_id_digest,
+                                           ctx->signer_cert, certs);
+        if (sc2 == NULL)
+            goto err;
+
+        if (!ess_add_signing_cert_v2(si, sc2)) {
+            TSerr(TS_F_TS_RESP_SIGN, TS_R_ESS_ADD_SIGNING_CERT_V2_ERROR);
+            goto err;
+        }
+    }
+
+    if (!ts_TST_INFO_content_new(p7))
+        goto err;
+    if ((p7bio = PKCS7_dataInit(p7, NULL)) == NULL) {
+        TSerr(TS_F_TS_RESP_SIGN, ERR_R_MALLOC_FAILURE);
+        goto err;
+    }
+    if (!i2d_TS_TST_INFO_bio(p7bio, ctx->tst_info)) {
+        TSerr(TS_F_TS_RESP_SIGN, TS_R_TS_DATASIGN);
+        goto err;
+    }
+    if (!PKCS7_dataFinal(p7, p7bio)) {
+        TSerr(TS_F_TS_RESP_SIGN, TS_R_TS_DATASIGN);
+        goto err;
+    }
+    TS_RESP_set_tst_info(ctx->response, p7, ctx->tst_info);
+    p7 = NULL;                  /* Ownership is lost. */
+    ctx->tst_info = NULL;       /* Ownership is lost. */
+
+    ret = 1;
+ err:
+    if (!ret)
+        TS_RESP_CTX_set_status_info_cond(ctx, TS_STATUS_REJECTION,
+                                         "Error during signature "
+                                         "generation.");
+    BIO_free_all(p7bio);
+    ESS_SIGNING_CERT_V2_free(sc2);
+    ESS_SIGNING_CERT_free(sc);
+    PKCS7_free(p7);
+    return ret;
+}
+
+static ESS_SIGNING_CERT *ess_SIGNING_CERT_new_init(X509 *signcert,
+                                                   STACK_OF(X509) *certs)
+{
+    ESS_CERT_ID *cid;
+    ESS_SIGNING_CERT *sc = NULL;
+    int i;
+
+    if ((sc = ESS_SIGNING_CERT_new()) == NULL)
+        goto err;
+    if (sc->cert_ids == NULL
+        && (sc->cert_ids = sk_ESS_CERT_ID_new_null()) == NULL)
+        goto err;
+
+    if ((cid = ess_CERT_ID_new_init(signcert, 0)) == NULL
+        || !sk_ESS_CERT_ID_push(sc->cert_ids, cid))
+        goto err;
+    for (i = 0; i < sk_X509_num(certs); ++i) {
+        X509 *cert = sk_X509_value(certs, i);
+        if ((cid = ess_CERT_ID_new_init(cert, 1)) == NULL
+            || !sk_ESS_CERT_ID_push(sc->cert_ids, cid))
+            goto err;
+    }
+
+    return sc;
+ err:
+    ESS_SIGNING_CERT_free(sc);
+    TSerr(TS_F_ESS_SIGNING_CERT_NEW_INIT, ERR_R_MALLOC_FAILURE);
+    return NULL;
+}
+
+static ESS_CERT_ID *ess_CERT_ID_new_init(X509 *cert, int issuer_needed)
+{
+    ESS_CERT_ID *cid = NULL;
+    GENERAL_NAME *name = NULL;
+    unsigned char cert_sha1[SHA_DIGEST_LENGTH];
+
+    /* Call for side-effect of computing hash and caching extensions */
+    X509_check_purpose(cert, -1, 0);
+    if ((cid = ESS_CERT_ID_new()) == NULL)
+        goto err;
     if (!X509_digest(cert, EVP_sha1(), cert_sha1, NULL))
         goto err;
-    if (!ASN1_OCTET_STRING_set(cid->hash, cert_sha1, SHA_DIGEST_LENGTH)) 
-        goto err; 
- 
-    /* Setting the issuer/serial if requested. */ 
-    if (issuer_needed) { 
-        if (cid->issuer_serial == NULL 
-            && (cid->issuer_serial = ESS_ISSUER_SERIAL_new()) == NULL) 
-            goto err; 
-        if ((name = GENERAL_NAME_new()) == NULL) 
-            goto err; 
-        name->type = GEN_DIRNAME; 
-        if ((name->d.dirn = X509_NAME_dup(X509_get_issuer_name(cert))) == NULL) 
-            goto err; 
-        if (!sk_GENERAL_NAME_push(cid->issuer_serial->issuer, name)) 
-            goto err; 
-        name = NULL;            /* Ownership is lost. */ 
-        ASN1_INTEGER_free(cid->issuer_serial->serial); 
-        if (!(cid->issuer_serial->serial = 
-              ASN1_INTEGER_dup(X509_get_serialNumber(cert)))) 
-            goto err; 
-    } 
- 
-    return cid; 
- err: 
-    GENERAL_NAME_free(name); 
-    ESS_CERT_ID_free(cid); 
-    TSerr(TS_F_ESS_CERT_ID_NEW_INIT, ERR_R_MALLOC_FAILURE); 
-    return NULL; 
-} 
- 
-static int ts_TST_INFO_content_new(PKCS7 *p7) 
-{ 
-    PKCS7 *ret = NULL; 
-    ASN1_OCTET_STRING *octet_string = NULL; 
- 
-    /* Create new encapsulated NID_id_smime_ct_TSTInfo content. */ 
-    if ((ret = PKCS7_new()) == NULL) 
-        goto err; 
-    if ((ret->d.other = ASN1_TYPE_new()) == NULL) 
-        goto err; 
-    ret->type = OBJ_nid2obj(NID_id_smime_ct_TSTInfo); 
-    if ((octet_string = ASN1_OCTET_STRING_new()) == NULL) 
-        goto err; 
-    ASN1_TYPE_set(ret->d.other, V_ASN1_OCTET_STRING, octet_string); 
-    octet_string = NULL; 
- 
-    /* Add encapsulated content to signed PKCS7 structure. */ 
-    if (!PKCS7_set_content(p7, ret)) 
-        goto err; 
- 
-    return 1; 
- err: 
-    ASN1_OCTET_STRING_free(octet_string); 
-    PKCS7_free(ret); 
-    return 0; 
-} 
- 
-static int ess_add_signing_cert(PKCS7_SIGNER_INFO *si, ESS_SIGNING_CERT *sc) 
-{ 
-    ASN1_STRING *seq = NULL; 
-    unsigned char *p, *pp = NULL; 
-    int len; 
- 
-    len = i2d_ESS_SIGNING_CERT(sc, NULL); 
-    if ((pp = OPENSSL_malloc(len)) == NULL) { 
-        TSerr(TS_F_ESS_ADD_SIGNING_CERT, ERR_R_MALLOC_FAILURE); 
-        goto err; 
-    } 
-    p = pp; 
-    i2d_ESS_SIGNING_CERT(sc, &p); 
-    if ((seq = ASN1_STRING_new()) == NULL || !ASN1_STRING_set(seq, pp, len)) { 
-        TSerr(TS_F_ESS_ADD_SIGNING_CERT, ERR_R_MALLOC_FAILURE); 
-        goto err; 
-    } 
-    OPENSSL_free(pp); 
-    pp = NULL; 
-    return PKCS7_add_signed_attribute(si, 
-                                      NID_id_smime_aa_signingCertificate, 
-                                      V_ASN1_SEQUENCE, seq); 
- err: 
-    ASN1_STRING_free(seq); 
-    OPENSSL_free(pp); 
- 
-    return 0; 
-} 
- 
-static ESS_SIGNING_CERT_V2 *ess_signing_cert_v2_new_init(const EVP_MD *hash_alg, 
-                                                         X509 *signcert, 
-                                                         STACK_OF(X509) *certs) 
-{ 
-    ESS_CERT_ID_V2 *cid = NULL; 
-    ESS_SIGNING_CERT_V2 *sc = NULL; 
-    int i; 
- 
-    if ((sc = ESS_SIGNING_CERT_V2_new()) == NULL) 
-        goto err; 
-    if ((cid = ess_cert_id_v2_new_init(hash_alg, signcert, 0)) == NULL) 
-        goto err; 
-    if (!sk_ESS_CERT_ID_V2_push(sc->cert_ids, cid)) 
-        goto err; 
-    cid = NULL; 
- 
-    for (i = 0; i < sk_X509_num(certs); ++i) { 
-        X509 *cert = sk_X509_value(certs, i); 
- 
-        if ((cid = ess_cert_id_v2_new_init(hash_alg, cert, 1)) == NULL) 
-            goto err; 
-        if (!sk_ESS_CERT_ID_V2_push(sc->cert_ids, cid)) 
-            goto err; 
-        cid = NULL; 
-    } 
- 
-    return sc; 
- err: 
-    ESS_SIGNING_CERT_V2_free(sc); 
-    ESS_CERT_ID_V2_free(cid); 
-    TSerr(TS_F_ESS_SIGNING_CERT_V2_NEW_INIT, ERR_R_MALLOC_FAILURE); 
-    return NULL; 
-} 
- 
-static ESS_CERT_ID_V2 *ess_cert_id_v2_new_init(const EVP_MD *hash_alg, 
-                                               X509 *cert, int issuer_needed) 
-{ 
-    ESS_CERT_ID_V2 *cid = NULL; 
-    GENERAL_NAME *name = NULL; 
-    unsigned char hash[EVP_MAX_MD_SIZE]; 
-    unsigned int hash_len = sizeof(hash); 
-    X509_ALGOR *alg = NULL; 
- 
-    memset(hash, 0, sizeof(hash)); 
- 
-    if ((cid = ESS_CERT_ID_V2_new()) == NULL) 
-        goto err; 
- 
-    if (hash_alg != EVP_sha256()) { 
-        alg = X509_ALGOR_new(); 
-        if (alg == NULL) 
-            goto err; 
-        X509_ALGOR_set_md(alg, hash_alg); 
-        if (alg->algorithm == NULL) 
-            goto err; 
-        cid->hash_alg = alg; 
-        alg = NULL; 
-    } else { 
-        cid->hash_alg = NULL; 
-    } 
- 
-    if (!X509_digest(cert, hash_alg, hash, &hash_len)) 
-        goto err; 
- 
-    if (!ASN1_OCTET_STRING_set(cid->hash, hash, hash_len)) 
-        goto err; 
- 
-    if (issuer_needed) { 
-        if ((cid->issuer_serial = ESS_ISSUER_SERIAL_new()) == NULL) 
-            goto err; 
-        if ((name = GENERAL_NAME_new()) == NULL) 
-            goto err; 
-        name->type = GEN_DIRNAME; 
-        if ((name->d.dirn = X509_NAME_dup(X509_get_issuer_name(cert))) == NULL) 
-            goto err; 
-        if (!sk_GENERAL_NAME_push(cid->issuer_serial->issuer, name)) 
-            goto err; 
-        name = NULL;            /* Ownership is lost. */ 
-        ASN1_INTEGER_free(cid->issuer_serial->serial); 
-        cid->issuer_serial->serial = 
-                ASN1_INTEGER_dup(X509_get_serialNumber(cert)); 
-        if (cid->issuer_serial->serial == NULL) 
-            goto err; 
-    } 
- 
-    return cid; 
- err: 
-    X509_ALGOR_free(alg); 
-    GENERAL_NAME_free(name); 
-    ESS_CERT_ID_V2_free(cid); 
-    TSerr(TS_F_ESS_CERT_ID_V2_NEW_INIT, ERR_R_MALLOC_FAILURE); 
-    return NULL; 
-} 
- 
-static int ess_add_signing_cert_v2(PKCS7_SIGNER_INFO *si, 
-                                   ESS_SIGNING_CERT_V2 *sc) 
-{ 
-    ASN1_STRING *seq = NULL; 
-    unsigned char *p, *pp = NULL; 
-    int len = i2d_ESS_SIGNING_CERT_V2(sc, NULL); 
- 
-    if ((pp = OPENSSL_malloc(len)) == NULL) { 
-        TSerr(TS_F_ESS_ADD_SIGNING_CERT_V2, ERR_R_MALLOC_FAILURE); 
-        goto err; 
-    } 
- 
-    p = pp; 
-    i2d_ESS_SIGNING_CERT_V2(sc, &p); 
-    if ((seq = ASN1_STRING_new()) == NULL || !ASN1_STRING_set(seq, pp, len)) { 
-        TSerr(TS_F_ESS_ADD_SIGNING_CERT_V2, ERR_R_MALLOC_FAILURE); 
-        goto err; 
-    } 
- 
-    OPENSSL_free(pp); 
-    pp = NULL; 
-    return PKCS7_add_signed_attribute(si, 
-                                      NID_id_smime_aa_signingCertificateV2, 
-                                      V_ASN1_SEQUENCE, seq); 
- err: 
-    ASN1_STRING_free(seq); 
-    OPENSSL_free(pp); 
-    return 0; 
-} 
- 
-static ASN1_GENERALIZEDTIME *TS_RESP_set_genTime_with_precision( 
-        ASN1_GENERALIZEDTIME *asn1_time, long sec, long usec, 
-        unsigned precision) 
-{ 
-    time_t time_sec = (time_t)sec; 
-    struct tm *tm = NULL, tm_result; 
-    char genTime_str[17 + TS_MAX_CLOCK_PRECISION_DIGITS]; 
-    char *p = genTime_str; 
-    char *p_end = genTime_str + sizeof(genTime_str); 
- 
-    if (precision > TS_MAX_CLOCK_PRECISION_DIGITS) 
-        goto err; 
- 
-    if ((tm = OPENSSL_gmtime(&time_sec, &tm_result)) == NULL) 
-        goto err; 
- 
-    /* 
-     * Put "genTime_str" in GeneralizedTime format.  We work around the 
-     * restrictions imposed by rfc3280 (i.e. "GeneralizedTime values MUST 
-     * NOT include fractional seconds") and OpenSSL related functions to 
-     * meet the rfc3161 requirement: "GeneralizedTime syntax can include 
-     * fraction-of-second details". 
-     */ 
-    p += BIO_snprintf(p, p_end - p, 
-                      "%04d%02d%02d%02d%02d%02d", 
-                      tm->tm_year + 1900, tm->tm_mon + 1, tm->tm_mday, 
-                      tm->tm_hour, tm->tm_min, tm->tm_sec); 
-    if (precision > 0) { 
-        BIO_snprintf(p, 2 + precision, ".%06ld", usec); 
-        p += strlen(p); 
- 
-        /* 
-         * To make things a bit harder, X.690 | ISO/IEC 8825-1 provides the 
-         * following restrictions for a DER-encoding, which OpenSSL 
-         * (specifically ASN1_GENERALIZEDTIME_check() function) doesn't 
-         * support: "The encoding MUST terminate with a "Z" (which means 
-         * "Zulu" time). The decimal point element, if present, MUST be the 
-         * point option ".". The fractional-seconds elements, if present, 
-         * MUST omit all trailing 0's; if the elements correspond to 0, they 
-         * MUST be wholly omitted, and the decimal point element also MUST be 
-         * omitted." 
-         */ 
-        /* 
-         * Remove trailing zeros. The dot guarantees the exit condition of 
-         * this loop even if all the digits are zero. 
-         */ 
-        while (*--p == '0') 
-             continue; 
-        if (*p != '.') 
-            ++p; 
-    } 
-    *p++ = 'Z'; 
-    *p++ = '\0'; 
- 
-    if (asn1_time == NULL 
-        && (asn1_time = ASN1_GENERALIZEDTIME_new()) == NULL) 
-        goto err; 
-    if (!ASN1_GENERALIZEDTIME_set_string(asn1_time, genTime_str)) { 
-        ASN1_GENERALIZEDTIME_free(asn1_time); 
-        goto err; 
-    } 
-    return asn1_time; 
- 
- err: 
-    TSerr(TS_F_TS_RESP_SET_GENTIME_WITH_PRECISION, TS_R_COULD_NOT_SET_TIME); 
-    return NULL; 
-} 
- 
-int TS_RESP_CTX_set_ess_cert_id_digest(TS_RESP_CTX *ctx, const EVP_MD *md) 
-{ 
-    ctx->ess_cert_id_digest = md; 
-    return 1; 
-} 
+    if (!ASN1_OCTET_STRING_set(cid->hash, cert_sha1, SHA_DIGEST_LENGTH))
+        goto err;
+
+    /* Setting the issuer/serial if requested. */
+    if (issuer_needed) {
+        if (cid->issuer_serial == NULL
+            && (cid->issuer_serial = ESS_ISSUER_SERIAL_new()) == NULL)
+            goto err;
+        if ((name = GENERAL_NAME_new()) == NULL)
+            goto err;
+        name->type = GEN_DIRNAME;
+        if ((name->d.dirn = X509_NAME_dup(X509_get_issuer_name(cert))) == NULL)
+            goto err;
+        if (!sk_GENERAL_NAME_push(cid->issuer_serial->issuer, name))
+            goto err;
+        name = NULL;            /* Ownership is lost. */
+        ASN1_INTEGER_free(cid->issuer_serial->serial);
+        if (!(cid->issuer_serial->serial =
+              ASN1_INTEGER_dup(X509_get_serialNumber(cert))))
+            goto err;
+    }
+
+    return cid;
+ err:
+    GENERAL_NAME_free(name);
+    ESS_CERT_ID_free(cid);
+    TSerr(TS_F_ESS_CERT_ID_NEW_INIT, ERR_R_MALLOC_FAILURE);
+    return NULL;
+}
+
+static int ts_TST_INFO_content_new(PKCS7 *p7)
+{
+    PKCS7 *ret = NULL;
+    ASN1_OCTET_STRING *octet_string = NULL;
+
+    /* Create new encapsulated NID_id_smime_ct_TSTInfo content. */
+    if ((ret = PKCS7_new()) == NULL)
+        goto err;
+    if ((ret->d.other = ASN1_TYPE_new()) == NULL)
+        goto err;
+    ret->type = OBJ_nid2obj(NID_id_smime_ct_TSTInfo);
+    if ((octet_string = ASN1_OCTET_STRING_new()) == NULL)
+        goto err;
+    ASN1_TYPE_set(ret->d.other, V_ASN1_OCTET_STRING, octet_string);
+    octet_string = NULL;
+
+    /* Add encapsulated content to signed PKCS7 structure. */
+    if (!PKCS7_set_content(p7, ret))
+        goto err;
+
+    return 1;
+ err:
+    ASN1_OCTET_STRING_free(octet_string);
+    PKCS7_free(ret);
+    return 0;
+}
+
+static int ess_add_signing_cert(PKCS7_SIGNER_INFO *si, ESS_SIGNING_CERT *sc)
+{
+    ASN1_STRING *seq = NULL;
+    unsigned char *p, *pp = NULL;
+    int len;
+
+    len = i2d_ESS_SIGNING_CERT(sc, NULL);
+    if ((pp = OPENSSL_malloc(len)) == NULL) {
+        TSerr(TS_F_ESS_ADD_SIGNING_CERT, ERR_R_MALLOC_FAILURE);
+        goto err;
+    }
+    p = pp;
+    i2d_ESS_SIGNING_CERT(sc, &p);
+    if ((seq = ASN1_STRING_new()) == NULL || !ASN1_STRING_set(seq, pp, len)) {
+        TSerr(TS_F_ESS_ADD_SIGNING_CERT, ERR_R_MALLOC_FAILURE);
+        goto err;
+    }
+    OPENSSL_free(pp);
+    pp = NULL;
+    return PKCS7_add_signed_attribute(si,
+                                      NID_id_smime_aa_signingCertificate,
+                                      V_ASN1_SEQUENCE, seq);
+ err:
+    ASN1_STRING_free(seq);
+    OPENSSL_free(pp);
+
+    return 0;
+}
+
+static ESS_SIGNING_CERT_V2 *ess_signing_cert_v2_new_init(const EVP_MD *hash_alg,
+                                                         X509 *signcert,
+                                                         STACK_OF(X509) *certs)
+{
+    ESS_CERT_ID_V2 *cid = NULL;
+    ESS_SIGNING_CERT_V2 *sc = NULL;
+    int i;
+
+    if ((sc = ESS_SIGNING_CERT_V2_new()) == NULL)
+        goto err;
+    if ((cid = ess_cert_id_v2_new_init(hash_alg, signcert, 0)) == NULL)
+        goto err;
+    if (!sk_ESS_CERT_ID_V2_push(sc->cert_ids, cid))
+        goto err;
+    cid = NULL;
+
+    for (i = 0; i < sk_X509_num(certs); ++i) {
+        X509 *cert = sk_X509_value(certs, i);
+
+        if ((cid = ess_cert_id_v2_new_init(hash_alg, cert, 1)) == NULL)
+            goto err;
+        if (!sk_ESS_CERT_ID_V2_push(sc->cert_ids, cid))
+            goto err;
+        cid = NULL;
+    }
+
+    return sc;
+ err:
+    ESS_SIGNING_CERT_V2_free(sc);
+    ESS_CERT_ID_V2_free(cid);
+    TSerr(TS_F_ESS_SIGNING_CERT_V2_NEW_INIT, ERR_R_MALLOC_FAILURE);
+    return NULL;
+}
+
+static ESS_CERT_ID_V2 *ess_cert_id_v2_new_init(const EVP_MD *hash_alg,
+                                               X509 *cert, int issuer_needed)
+{
+    ESS_CERT_ID_V2 *cid = NULL;
+    GENERAL_NAME *name = NULL;
+    unsigned char hash[EVP_MAX_MD_SIZE];
+    unsigned int hash_len = sizeof(hash);
+    X509_ALGOR *alg = NULL;
+
+    memset(hash, 0, sizeof(hash));
+
+    if ((cid = ESS_CERT_ID_V2_new()) == NULL)
+        goto err;
+
+    if (hash_alg != EVP_sha256()) {
+        alg = X509_ALGOR_new();
+        if (alg == NULL)
+            goto err;
+        X509_ALGOR_set_md(alg, hash_alg);
+        if (alg->algorithm == NULL)
+            goto err;
+        cid->hash_alg = alg;
+        alg = NULL;
+    } else {
+        cid->hash_alg = NULL;
+    }
+
+    if (!X509_digest(cert, hash_alg, hash, &hash_len))
+        goto err;
+
+    if (!ASN1_OCTET_STRING_set(cid->hash, hash, hash_len))
+        goto err;
+
+    if (issuer_needed) {
+        if ((cid->issuer_serial = ESS_ISSUER_SERIAL_new()) == NULL)
+            goto err;
+        if ((name = GENERAL_NAME_new()) == NULL)
+            goto err;
+        name->type = GEN_DIRNAME;
+        if ((name->d.dirn = X509_NAME_dup(X509_get_issuer_name(cert))) == NULL)
+            goto err;
+        if (!sk_GENERAL_NAME_push(cid->issuer_serial->issuer, name))
+            goto err;
+        name = NULL;            /* Ownership is lost. */
+        ASN1_INTEGER_free(cid->issuer_serial->serial);
+        cid->issuer_serial->serial =
+                ASN1_INTEGER_dup(X509_get_serialNumber(cert));
+        if (cid->issuer_serial->serial == NULL)
+            goto err;
+    }
+
+    return cid;
+ err:
+    X509_ALGOR_free(alg);
+    GENERAL_NAME_free(name);
+    ESS_CERT_ID_V2_free(cid);
+    TSerr(TS_F_ESS_CERT_ID_V2_NEW_INIT, ERR_R_MALLOC_FAILURE);
+    return NULL;
+}
+
+static int ess_add_signing_cert_v2(PKCS7_SIGNER_INFO *si,
+                                   ESS_SIGNING_CERT_V2 *sc)
+{
+    ASN1_STRING *seq = NULL;
+    unsigned char *p, *pp = NULL;
+    int len = i2d_ESS_SIGNING_CERT_V2(sc, NULL);
+
+    if ((pp = OPENSSL_malloc(len)) == NULL) {
+        TSerr(TS_F_ESS_ADD_SIGNING_CERT_V2, ERR_R_MALLOC_FAILURE);
+        goto err;
+    }
+
+    p = pp;
+    i2d_ESS_SIGNING_CERT_V2(sc, &p);
+    if ((seq = ASN1_STRING_new()) == NULL || !ASN1_STRING_set(seq, pp, len)) {
+        TSerr(TS_F_ESS_ADD_SIGNING_CERT_V2, ERR_R_MALLOC_FAILURE);
+        goto err;
+    }
+
+    OPENSSL_free(pp);
+    pp = NULL;
+    return PKCS7_add_signed_attribute(si,
+                                      NID_id_smime_aa_signingCertificateV2,
+                                      V_ASN1_SEQUENCE, seq);
+ err:
+    ASN1_STRING_free(seq);
+    OPENSSL_free(pp);
+    return 0;
+}
+
+static ASN1_GENERALIZEDTIME *TS_RESP_set_genTime_with_precision(
+        ASN1_GENERALIZEDTIME *asn1_time, long sec, long usec,
+        unsigned precision)
+{
+    time_t time_sec = (time_t)sec;
+    struct tm *tm = NULL, tm_result;
+    char genTime_str[17 + TS_MAX_CLOCK_PRECISION_DIGITS];
+    char *p = genTime_str;
+    char *p_end = genTime_str + sizeof(genTime_str);
+
+    if (precision > TS_MAX_CLOCK_PRECISION_DIGITS)
+        goto err;
+
+    if ((tm = OPENSSL_gmtime(&time_sec, &tm_result)) == NULL)
+        goto err;
+
+    /*
+     * Put "genTime_str" in GeneralizedTime format.  We work around the
+     * restrictions imposed by rfc3280 (i.e. "GeneralizedTime values MUST
+     * NOT include fractional seconds") and OpenSSL related functions to
+     * meet the rfc3161 requirement: "GeneralizedTime syntax can include
+     * fraction-of-second details".
+     */
+    p += BIO_snprintf(p, p_end - p,
+                      "%04d%02d%02d%02d%02d%02d",
+                      tm->tm_year + 1900, tm->tm_mon + 1, tm->tm_mday,
+                      tm->tm_hour, tm->tm_min, tm->tm_sec);
+    if (precision > 0) {
+        BIO_snprintf(p, 2 + precision, ".%06ld", usec);
+        p += strlen(p);
+
+        /*
+         * To make things a bit harder, X.690 | ISO/IEC 8825-1 provides the
+         * following restrictions for a DER-encoding, which OpenSSL
+         * (specifically ASN1_GENERALIZEDTIME_check() function) doesn't
+         * support: "The encoding MUST terminate with a "Z" (which means
+         * "Zulu" time). The decimal point element, if present, MUST be the
+         * point option ".". The fractional-seconds elements, if present,
+         * MUST omit all trailing 0's; if the elements correspond to 0, they
+         * MUST be wholly omitted, and the decimal point element also MUST be
+         * omitted."
+         */
+        /*
+         * Remove trailing zeros. The dot guarantees the exit condition of
+         * this loop even if all the digits are zero.
+         */
+        while (*--p == '0')
+             continue;
+        if (*p != '.')
+            ++p;
+    }
+    *p++ = 'Z';
+    *p++ = '\0';
+
+    if (asn1_time == NULL
+        && (asn1_time = ASN1_GENERALIZEDTIME_new()) == NULL)
+        goto err;
+    if (!ASN1_GENERALIZEDTIME_set_string(asn1_time, genTime_str)) {
+        ASN1_GENERALIZEDTIME_free(asn1_time);
+        goto err;
+    }
+    return asn1_time;
+
+ err:
+    TSerr(TS_F_TS_RESP_SET_GENTIME_WITH_PRECISION, TS_R_COULD_NOT_SET_TIME);
+    return NULL;
+}
+
+int TS_RESP_CTX_set_ess_cert_id_digest(TS_RESP_CTX *ctx, const EVP_MD *md)
+{
+    ctx->ess_cert_id_digest = md;
+    return 1;
+}
diff --git a/contrib/libs/openssl/crypto/ts/ts_rsp_utils.c b/contrib/libs/openssl/crypto/ts/ts_rsp_utils.c
index 9c6dab3e14..3fa0dbd0f0 100644
--- a/contrib/libs/openssl/crypto/ts/ts_rsp_utils.c
+++ b/contrib/libs/openssl/crypto/ts/ts_rsp_utils.c
@@ -1,365 +1,365 @@
-/* 
- * Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved. 
- * 
- * Licensed under the OpenSSL license (the "License").  You may not use 
- * this file except in compliance with the License.  You can obtain a copy 
- * in the file LICENSE in the source distribution or at 
- * https://www.openssl.org/source/license.html 
- */ 
- 
-#include <stdio.h> 
-#include "internal/cryptlib.h" 
-#include <openssl/objects.h> 
-#include <openssl/ts.h> 
-#include <openssl/pkcs7.h> 
+/*
+ * Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the OpenSSL license (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#include <stdio.h>
+#include "internal/cryptlib.h"
+#include <openssl/objects.h>
+#include <openssl/ts.h>
+#include <openssl/pkcs7.h>
 #include "ts_local.h"
- 
-int TS_RESP_set_status_info(TS_RESP *a, TS_STATUS_INFO *status_info) 
-{ 
-    TS_STATUS_INFO *new_status_info; 
- 
-    if (a->status_info == status_info) 
-        return 1; 
-    new_status_info = TS_STATUS_INFO_dup(status_info); 
-    if (new_status_info == NULL) { 
-        TSerr(TS_F_TS_RESP_SET_STATUS_INFO, ERR_R_MALLOC_FAILURE); 
-        return 0; 
-    } 
-    TS_STATUS_INFO_free(a->status_info); 
-    a->status_info = new_status_info; 
- 
-    return 1; 
-} 
- 
-TS_STATUS_INFO *TS_RESP_get_status_info(TS_RESP *a) 
-{ 
-    return a->status_info; 
-} 
- 
-/* Caller loses ownership of PKCS7 and TS_TST_INFO objects. */ 
-void TS_RESP_set_tst_info(TS_RESP *a, PKCS7 *p7, TS_TST_INFO *tst_info) 
-{ 
-    PKCS7_free(a->token); 
-    a->token = p7; 
-    TS_TST_INFO_free(a->tst_info); 
-    a->tst_info = tst_info; 
-} 
- 
-PKCS7 *TS_RESP_get_token(TS_RESP *a) 
-{ 
-    return a->token; 
-} 
- 
-TS_TST_INFO *TS_RESP_get_tst_info(TS_RESP *a) 
-{ 
-    return a->tst_info; 
-} 
- 
-int TS_TST_INFO_set_version(TS_TST_INFO *a, long version) 
-{ 
-    return ASN1_INTEGER_set(a->version, version); 
-} 
- 
-long TS_TST_INFO_get_version(const TS_TST_INFO *a) 
-{ 
-    return ASN1_INTEGER_get(a->version); 
-} 
- 
-int TS_TST_INFO_set_policy_id(TS_TST_INFO *a, ASN1_OBJECT *policy) 
-{ 
-    ASN1_OBJECT *new_policy; 
- 
-    if (a->policy_id == policy) 
-        return 1; 
-    new_policy = OBJ_dup(policy); 
-    if (new_policy == NULL) { 
-        TSerr(TS_F_TS_TST_INFO_SET_POLICY_ID, ERR_R_MALLOC_FAILURE); 
-        return 0; 
-    } 
-    ASN1_OBJECT_free(a->policy_id); 
-    a->policy_id = new_policy; 
-    return 1; 
-} 
- 
-ASN1_OBJECT *TS_TST_INFO_get_policy_id(TS_TST_INFO *a) 
-{ 
-    return a->policy_id; 
-} 
- 
-int TS_TST_INFO_set_msg_imprint(TS_TST_INFO *a, TS_MSG_IMPRINT *msg_imprint) 
-{ 
-    TS_MSG_IMPRINT *new_msg_imprint; 
- 
-    if (a->msg_imprint == msg_imprint) 
-        return 1; 
-    new_msg_imprint = TS_MSG_IMPRINT_dup(msg_imprint); 
-    if (new_msg_imprint == NULL) { 
-        TSerr(TS_F_TS_TST_INFO_SET_MSG_IMPRINT, ERR_R_MALLOC_FAILURE); 
-        return 0; 
-    } 
-    TS_MSG_IMPRINT_free(a->msg_imprint); 
-    a->msg_imprint = new_msg_imprint; 
-    return 1; 
-} 
- 
-TS_MSG_IMPRINT *TS_TST_INFO_get_msg_imprint(TS_TST_INFO *a) 
-{ 
-    return a->msg_imprint; 
-} 
- 
-int TS_TST_INFO_set_serial(TS_TST_INFO *a, const ASN1_INTEGER *serial) 
-{ 
-    ASN1_INTEGER *new_serial; 
- 
-    if (a->serial == serial) 
-        return 1; 
-    new_serial = ASN1_INTEGER_dup(serial); 
-    if (new_serial == NULL) { 
-        TSerr(TS_F_TS_TST_INFO_SET_SERIAL, ERR_R_MALLOC_FAILURE); 
-        return 0; 
-    } 
-    ASN1_INTEGER_free(a->serial); 
-    a->serial = new_serial; 
-    return 1; 
-} 
- 
-const ASN1_INTEGER *TS_TST_INFO_get_serial(const TS_TST_INFO *a) 
-{ 
-    return a->serial; 
-} 
- 
-int TS_TST_INFO_set_time(TS_TST_INFO *a, const ASN1_GENERALIZEDTIME *gtime) 
-{ 
-    ASN1_GENERALIZEDTIME *new_time; 
- 
-    if (a->time == gtime) 
-        return 1; 
-    new_time = ASN1_STRING_dup(gtime); 
-    if (new_time == NULL) { 
-        TSerr(TS_F_TS_TST_INFO_SET_TIME, ERR_R_MALLOC_FAILURE); 
-        return 0; 
-    } 
-    ASN1_GENERALIZEDTIME_free(a->time); 
-    a->time = new_time; 
-    return 1; 
-} 
- 
-const ASN1_GENERALIZEDTIME *TS_TST_INFO_get_time(const TS_TST_INFO *a) 
-{ 
-    return a->time; 
-} 
- 
-int TS_TST_INFO_set_accuracy(TS_TST_INFO *a, TS_ACCURACY *accuracy) 
-{ 
-    TS_ACCURACY *new_accuracy; 
- 
-    if (a->accuracy == accuracy) 
-        return 1; 
-    new_accuracy = TS_ACCURACY_dup(accuracy); 
-    if (new_accuracy == NULL) { 
-        TSerr(TS_F_TS_TST_INFO_SET_ACCURACY, ERR_R_MALLOC_FAILURE); 
-        return 0; 
-    } 
-    TS_ACCURACY_free(a->accuracy); 
-    a->accuracy = new_accuracy; 
-    return 1; 
-} 
- 
-TS_ACCURACY *TS_TST_INFO_get_accuracy(TS_TST_INFO *a) 
-{ 
-    return a->accuracy; 
-} 
- 
-int TS_ACCURACY_set_seconds(TS_ACCURACY *a, const ASN1_INTEGER *seconds) 
-{ 
-    ASN1_INTEGER *new_seconds; 
- 
-    if (a->seconds == seconds) 
-        return 1; 
-    new_seconds = ASN1_INTEGER_dup(seconds); 
-    if (new_seconds == NULL) { 
-        TSerr(TS_F_TS_ACCURACY_SET_SECONDS, ERR_R_MALLOC_FAILURE); 
-        return 0; 
-    } 
-    ASN1_INTEGER_free(a->seconds); 
-    a->seconds = new_seconds; 
-    return 1; 
-} 
- 
-const ASN1_INTEGER *TS_ACCURACY_get_seconds(const TS_ACCURACY *a) 
-{ 
-    return a->seconds; 
-} 
- 
-int TS_ACCURACY_set_millis(TS_ACCURACY *a, const ASN1_INTEGER *millis) 
-{ 
-    ASN1_INTEGER *new_millis = NULL; 
- 
-    if (a->millis == millis) 
-        return 1; 
-    if (millis != NULL) { 
-        new_millis = ASN1_INTEGER_dup(millis); 
-        if (new_millis == NULL) { 
-            TSerr(TS_F_TS_ACCURACY_SET_MILLIS, ERR_R_MALLOC_FAILURE); 
-            return 0; 
-        } 
-    } 
-    ASN1_INTEGER_free(a->millis); 
-    a->millis = new_millis; 
-    return 1; 
-} 
- 
-const ASN1_INTEGER *TS_ACCURACY_get_millis(const TS_ACCURACY *a) 
-{ 
-    return a->millis; 
-} 
- 
-int TS_ACCURACY_set_micros(TS_ACCURACY *a, const ASN1_INTEGER *micros) 
-{ 
-    ASN1_INTEGER *new_micros = NULL; 
- 
-    if (a->micros == micros) 
-        return 1; 
-    if (micros != NULL) { 
-        new_micros = ASN1_INTEGER_dup(micros); 
-        if (new_micros == NULL) { 
-            TSerr(TS_F_TS_ACCURACY_SET_MICROS, ERR_R_MALLOC_FAILURE); 
-            return 0; 
-        } 
-    } 
-    ASN1_INTEGER_free(a->micros); 
-    a->micros = new_micros; 
-    return 1; 
-} 
- 
-const ASN1_INTEGER *TS_ACCURACY_get_micros(const TS_ACCURACY *a) 
-{ 
-    return a->micros; 
-} 
- 
-int TS_TST_INFO_set_ordering(TS_TST_INFO *a, int ordering) 
-{ 
-    a->ordering = ordering ? 0xFF : 0x00; 
-    return 1; 
-} 
- 
-int TS_TST_INFO_get_ordering(const TS_TST_INFO *a) 
-{ 
-    return a->ordering ? 1 : 0; 
-} 
- 
-int TS_TST_INFO_set_nonce(TS_TST_INFO *a, const ASN1_INTEGER *nonce) 
-{ 
-    ASN1_INTEGER *new_nonce; 
- 
-    if (a->nonce == nonce) 
-        return 1; 
-    new_nonce = ASN1_INTEGER_dup(nonce); 
-    if (new_nonce == NULL) { 
-        TSerr(TS_F_TS_TST_INFO_SET_NONCE, ERR_R_MALLOC_FAILURE); 
-        return 0; 
-    } 
-    ASN1_INTEGER_free(a->nonce); 
-    a->nonce = new_nonce; 
-    return 1; 
-} 
- 
-const ASN1_INTEGER *TS_TST_INFO_get_nonce(const TS_TST_INFO *a) 
-{ 
-    return a->nonce; 
-} 
- 
-int TS_TST_INFO_set_tsa(TS_TST_INFO *a, GENERAL_NAME *tsa) 
-{ 
-    GENERAL_NAME *new_tsa; 
- 
-    if (a->tsa == tsa) 
-        return 1; 
-    new_tsa = GENERAL_NAME_dup(tsa); 
-    if (new_tsa == NULL) { 
-        TSerr(TS_F_TS_TST_INFO_SET_TSA, ERR_R_MALLOC_FAILURE); 
-        return 0; 
-    } 
-    GENERAL_NAME_free(a->tsa); 
-    a->tsa = new_tsa; 
-    return 1; 
-} 
- 
-GENERAL_NAME *TS_TST_INFO_get_tsa(TS_TST_INFO *a) 
-{ 
-    return a->tsa; 
-} 
- 
-STACK_OF(X509_EXTENSION) *TS_TST_INFO_get_exts(TS_TST_INFO *a) 
-{ 
-    return a->extensions; 
-} 
- 
-void TS_TST_INFO_ext_free(TS_TST_INFO *a) 
-{ 
-    if (!a) 
-        return; 
-    sk_X509_EXTENSION_pop_free(a->extensions, X509_EXTENSION_free); 
-    a->extensions = NULL; 
-} 
- 
-int TS_TST_INFO_get_ext_count(TS_TST_INFO *a) 
-{ 
-    return X509v3_get_ext_count(a->extensions); 
-} 
- 
-int TS_TST_INFO_get_ext_by_NID(TS_TST_INFO *a, int nid, int lastpos) 
-{ 
-    return X509v3_get_ext_by_NID(a->extensions, nid, lastpos); 
-} 
- 
-int TS_TST_INFO_get_ext_by_OBJ(TS_TST_INFO *a, const ASN1_OBJECT *obj, int lastpos) 
-{ 
-    return X509v3_get_ext_by_OBJ(a->extensions, obj, lastpos); 
-} 
- 
-int TS_TST_INFO_get_ext_by_critical(TS_TST_INFO *a, int crit, int lastpos) 
-{ 
-    return X509v3_get_ext_by_critical(a->extensions, crit, lastpos); 
-} 
- 
-X509_EXTENSION *TS_TST_INFO_get_ext(TS_TST_INFO *a, int loc) 
-{ 
-    return X509v3_get_ext(a->extensions, loc); 
-} 
- 
-X509_EXTENSION *TS_TST_INFO_delete_ext(TS_TST_INFO *a, int loc) 
-{ 
-    return X509v3_delete_ext(a->extensions, loc); 
-} 
- 
-int TS_TST_INFO_add_ext(TS_TST_INFO *a, X509_EXTENSION *ex, int loc) 
-{ 
-    return X509v3_add_ext(&a->extensions, ex, loc) != NULL; 
-} 
- 
-void *TS_TST_INFO_get_ext_d2i(TS_TST_INFO *a, int nid, int *crit, int *idx) 
-{ 
-    return X509V3_get_d2i(a->extensions, nid, crit, idx); 
-} 
- 
-int TS_STATUS_INFO_set_status(TS_STATUS_INFO *a, int i) 
-{ 
-    return ASN1_INTEGER_set(a->status, i); 
-} 
- 
-const ASN1_INTEGER *TS_STATUS_INFO_get0_status(const TS_STATUS_INFO *a) 
-{ 
-    return a->status; 
-} 
- 
-const STACK_OF(ASN1_UTF8STRING) * 
-TS_STATUS_INFO_get0_text(const TS_STATUS_INFO *a) 
-{ 
-    return a->text; 
-} 
- 
-const ASN1_BIT_STRING *TS_STATUS_INFO_get0_failure_info(const TS_STATUS_INFO *a) 
-{ 
-    return a->failure_info; 
-} 
+
+int TS_RESP_set_status_info(TS_RESP *a, TS_STATUS_INFO *status_info)
+{
+    TS_STATUS_INFO *new_status_info;
+
+    if (a->status_info == status_info)
+        return 1;
+    new_status_info = TS_STATUS_INFO_dup(status_info);
+    if (new_status_info == NULL) {
+        TSerr(TS_F_TS_RESP_SET_STATUS_INFO, ERR_R_MALLOC_FAILURE);
+        return 0;
+    }
+    TS_STATUS_INFO_free(a->status_info);
+    a->status_info = new_status_info;
+
+    return 1;
+}
+
+TS_STATUS_INFO *TS_RESP_get_status_info(TS_RESP *a)
+{
+    return a->status_info;
+}
+
+/* Caller loses ownership of PKCS7 and TS_TST_INFO objects. */
+void TS_RESP_set_tst_info(TS_RESP *a, PKCS7 *p7, TS_TST_INFO *tst_info)
+{
+    PKCS7_free(a->token);
+    a->token = p7;
+    TS_TST_INFO_free(a->tst_info);
+    a->tst_info = tst_info;
+}
+
+PKCS7 *TS_RESP_get_token(TS_RESP *a)
+{
+    return a->token;
+}
+
+TS_TST_INFO *TS_RESP_get_tst_info(TS_RESP *a)
+{
+    return a->tst_info;
+}
+
+int TS_TST_INFO_set_version(TS_TST_INFO *a, long version)
+{
+    return ASN1_INTEGER_set(a->version, version);
+}
+
+long TS_TST_INFO_get_version(const TS_TST_INFO *a)
+{
+    return ASN1_INTEGER_get(a->version);
+}
+
+int TS_TST_INFO_set_policy_id(TS_TST_INFO *a, ASN1_OBJECT *policy)
+{
+    ASN1_OBJECT *new_policy;
+
+    if (a->policy_id == policy)
+        return 1;
+    new_policy = OBJ_dup(policy);
+    if (new_policy == NULL) {
+        TSerr(TS_F_TS_TST_INFO_SET_POLICY_ID, ERR_R_MALLOC_FAILURE);
+        return 0;
+    }
+    ASN1_OBJECT_free(a->policy_id);
+    a->policy_id = new_policy;
+    return 1;
+}
+
+ASN1_OBJECT *TS_TST_INFO_get_policy_id(TS_TST_INFO *a)
+{
+    return a->policy_id;
+}
+
+int TS_TST_INFO_set_msg_imprint(TS_TST_INFO *a, TS_MSG_IMPRINT *msg_imprint)
+{
+    TS_MSG_IMPRINT *new_msg_imprint;
+
+    if (a->msg_imprint == msg_imprint)
+        return 1;
+    new_msg_imprint = TS_MSG_IMPRINT_dup(msg_imprint);
+    if (new_msg_imprint == NULL) {
+        TSerr(TS_F_TS_TST_INFO_SET_MSG_IMPRINT, ERR_R_MALLOC_FAILURE);
+        return 0;
+    }
+    TS_MSG_IMPRINT_free(a->msg_imprint);
+    a->msg_imprint = new_msg_imprint;
+    return 1;
+}
+
+TS_MSG_IMPRINT *TS_TST_INFO_get_msg_imprint(TS_TST_INFO *a)
+{
+    return a->msg_imprint;
+}
+
+int TS_TST_INFO_set_serial(TS_TST_INFO *a, const ASN1_INTEGER *serial)
+{
+    ASN1_INTEGER *new_serial;
+
+    if (a->serial == serial)
+        return 1;
+    new_serial = ASN1_INTEGER_dup(serial);
+    if (new_serial == NULL) {
+        TSerr(TS_F_TS_TST_INFO_SET_SERIAL, ERR_R_MALLOC_FAILURE);
+        return 0;
+    }
+    ASN1_INTEGER_free(a->serial);
+    a->serial = new_serial;
+    return 1;
+}
+
+const ASN1_INTEGER *TS_TST_INFO_get_serial(const TS_TST_INFO *a)
+{
+    return a->serial;
+}
+
+int TS_TST_INFO_set_time(TS_TST_INFO *a, const ASN1_GENERALIZEDTIME *gtime)
+{
+    ASN1_GENERALIZEDTIME *new_time;
+
+    if (a->time == gtime)
+        return 1;
+    new_time = ASN1_STRING_dup(gtime);
+    if (new_time == NULL) {
+        TSerr(TS_F_TS_TST_INFO_SET_TIME, ERR_R_MALLOC_FAILURE);
+        return 0;
+    }
+    ASN1_GENERALIZEDTIME_free(a->time);
+    a->time = new_time;
+    return 1;
+}
+
+const ASN1_GENERALIZEDTIME *TS_TST_INFO_get_time(const TS_TST_INFO *a)
+{
+    return a->time;
+}
+
+int TS_TST_INFO_set_accuracy(TS_TST_INFO *a, TS_ACCURACY *accuracy)
+{
+    TS_ACCURACY *new_accuracy;
+
+    if (a->accuracy == accuracy)
+        return 1;
+    new_accuracy = TS_ACCURACY_dup(accuracy);
+    if (new_accuracy == NULL) {
+        TSerr(TS_F_TS_TST_INFO_SET_ACCURACY, ERR_R_MALLOC_FAILURE);
+        return 0;
+    }
+    TS_ACCURACY_free(a->accuracy);
+    a->accuracy = new_accuracy;
+    return 1;
+}
+
+TS_ACCURACY *TS_TST_INFO_get_accuracy(TS_TST_INFO *a)
+{
+    return a->accuracy;
+}
+
+int TS_ACCURACY_set_seconds(TS_ACCURACY *a, const ASN1_INTEGER *seconds)
+{
+    ASN1_INTEGER *new_seconds;
+
+    if (a->seconds == seconds)
+        return 1;
+    new_seconds = ASN1_INTEGER_dup(seconds);
+    if (new_seconds == NULL) {
+        TSerr(TS_F_TS_ACCURACY_SET_SECONDS, ERR_R_MALLOC_FAILURE);
+        return 0;
+    }
+    ASN1_INTEGER_free(a->seconds);
+    a->seconds = new_seconds;
+    return 1;
+}
+
+const ASN1_INTEGER *TS_ACCURACY_get_seconds(const TS_ACCURACY *a)
+{
+    return a->seconds;
+}
+
+int TS_ACCURACY_set_millis(TS_ACCURACY *a, const ASN1_INTEGER *millis)
+{
+    ASN1_INTEGER *new_millis = NULL;
+
+    if (a->millis == millis)
+        return 1;
+    if (millis != NULL) {
+        new_millis = ASN1_INTEGER_dup(millis);
+        if (new_millis == NULL) {
+            TSerr(TS_F_TS_ACCURACY_SET_MILLIS, ERR_R_MALLOC_FAILURE);
+            return 0;
+        }
+    }
+    ASN1_INTEGER_free(a->millis);
+    a->millis = new_millis;
+    return 1;
+}
+
+const ASN1_INTEGER *TS_ACCURACY_get_millis(const TS_ACCURACY *a)
+{
+    return a->millis;
+}
+
+int TS_ACCURACY_set_micros(TS_ACCURACY *a, const ASN1_INTEGER *micros)
+{
+    ASN1_INTEGER *new_micros = NULL;
+
+    if (a->micros == micros)
+        return 1;
+    if (micros != NULL) {
+        new_micros = ASN1_INTEGER_dup(micros);
+        if (new_micros == NULL) {
+            TSerr(TS_F_TS_ACCURACY_SET_MICROS, ERR_R_MALLOC_FAILURE);
+            return 0;
+        }
+    }
+    ASN1_INTEGER_free(a->micros);
+    a->micros = new_micros;
+    return 1;
+}
+
+const ASN1_INTEGER *TS_ACCURACY_get_micros(const TS_ACCURACY *a)
+{
+    return a->micros;
+}
+
+int TS_TST_INFO_set_ordering(TS_TST_INFO *a, int ordering)
+{
+    a->ordering = ordering ? 0xFF : 0x00;
+    return 1;
+}
+
+int TS_TST_INFO_get_ordering(const TS_TST_INFO *a)
+{
+    return a->ordering ? 1 : 0;
+}
+
+int TS_TST_INFO_set_nonce(TS_TST_INFO *a, const ASN1_INTEGER *nonce)
+{
+    ASN1_INTEGER *new_nonce;
+
+    if (a->nonce == nonce)
+        return 1;
+    new_nonce = ASN1_INTEGER_dup(nonce);
+    if (new_nonce == NULL) {
+        TSerr(TS_F_TS_TST_INFO_SET_NONCE, ERR_R_MALLOC_FAILURE);
+        return 0;
+    }
+    ASN1_INTEGER_free(a->nonce);
+    a->nonce = new_nonce;
+    return 1;
+}
+
+const ASN1_INTEGER *TS_TST_INFO_get_nonce(const TS_TST_INFO *a)
+{
+    return a->nonce;
+}
+
+int TS_TST_INFO_set_tsa(TS_TST_INFO *a, GENERAL_NAME *tsa)
+{
+    GENERAL_NAME *new_tsa;
+
+    if (a->tsa == tsa)
+        return 1;
+    new_tsa = GENERAL_NAME_dup(tsa);
+    if (new_tsa == NULL) {
+        TSerr(TS_F_TS_TST_INFO_SET_TSA, ERR_R_MALLOC_FAILURE);
+        return 0;
+    }
+    GENERAL_NAME_free(a->tsa);
+    a->tsa = new_tsa;
+    return 1;
+}
+
+GENERAL_NAME *TS_TST_INFO_get_tsa(TS_TST_INFO *a)
+{
+    return a->tsa;
+}
+
+STACK_OF(X509_EXTENSION) *TS_TST_INFO_get_exts(TS_TST_INFO *a)
+{
+    return a->extensions;
+}
+
+void TS_TST_INFO_ext_free(TS_TST_INFO *a)
+{
+    if (!a)
+        return;
+    sk_X509_EXTENSION_pop_free(a->extensions, X509_EXTENSION_free);
+    a->extensions = NULL;
+}
+
+int TS_TST_INFO_get_ext_count(TS_TST_INFO *a)
+{
+    return X509v3_get_ext_count(a->extensions);
+}
+
+int TS_TST_INFO_get_ext_by_NID(TS_TST_INFO *a, int nid, int lastpos)
+{
+    return X509v3_get_ext_by_NID(a->extensions, nid, lastpos);
+}
+
+int TS_TST_INFO_get_ext_by_OBJ(TS_TST_INFO *a, const ASN1_OBJECT *obj, int lastpos)
+{
+    return X509v3_get_ext_by_OBJ(a->extensions, obj, lastpos);
+}
+
+int TS_TST_INFO_get_ext_by_critical(TS_TST_INFO *a, int crit, int lastpos)
+{
+    return X509v3_get_ext_by_critical(a->extensions, crit, lastpos);
+}
+
+X509_EXTENSION *TS_TST_INFO_get_ext(TS_TST_INFO *a, int loc)
+{
+    return X509v3_get_ext(a->extensions, loc);
+}
+
+X509_EXTENSION *TS_TST_INFO_delete_ext(TS_TST_INFO *a, int loc)
+{
+    return X509v3_delete_ext(a->extensions, loc);
+}
+
+int TS_TST_INFO_add_ext(TS_TST_INFO *a, X509_EXTENSION *ex, int loc)
+{
+    return X509v3_add_ext(&a->extensions, ex, loc) != NULL;
+}
+
+void *TS_TST_INFO_get_ext_d2i(TS_TST_INFO *a, int nid, int *crit, int *idx)
+{
+    return X509V3_get_d2i(a->extensions, nid, crit, idx);
+}
+
+int TS_STATUS_INFO_set_status(TS_STATUS_INFO *a, int i)
+{
+    return ASN1_INTEGER_set(a->status, i);
+}
+
+const ASN1_INTEGER *TS_STATUS_INFO_get0_status(const TS_STATUS_INFO *a)
+{
+    return a->status;
+}
+
+const STACK_OF(ASN1_UTF8STRING) *
+TS_STATUS_INFO_get0_text(const TS_STATUS_INFO *a)
+{
+    return a->text;
+}
+
+const ASN1_BIT_STRING *TS_STATUS_INFO_get0_failure_info(const TS_STATUS_INFO *a)
+{
+    return a->failure_info;
+}
diff --git a/contrib/libs/openssl/crypto/ts/ts_rsp_verify.c b/contrib/libs/openssl/crypto/ts/ts_rsp_verify.c
index 5ee6fcdd5c..7fe3d27e74 100644
--- a/contrib/libs/openssl/crypto/ts/ts_rsp_verify.c
+++ b/contrib/libs/openssl/crypto/ts/ts_rsp_verify.c
@@ -1,707 +1,707 @@
-/* 
+/*
  * Copyright 2006-2021 The OpenSSL Project Authors. All Rights Reserved.
- * 
- * Licensed under the OpenSSL license (the "License").  You may not use 
- * this file except in compliance with the License.  You can obtain a copy 
- * in the file LICENSE in the source distribution or at 
- * https://www.openssl.org/source/license.html 
- */ 
- 
-#include <stdio.h> 
-#include "internal/cryptlib.h" 
-#include <openssl/objects.h> 
-#include <openssl/ts.h> 
-#include <openssl/pkcs7.h> 
+ *
+ * Licensed under the OpenSSL license (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#include <stdio.h>
+#include "internal/cryptlib.h"
+#include <openssl/objects.h>
+#include <openssl/ts.h>
+#include <openssl/pkcs7.h>
 #include "ts_local.h"
- 
-static int ts_verify_cert(X509_STORE *store, STACK_OF(X509) *untrusted, 
-                          X509 *signer, STACK_OF(X509) **chain); 
-static int ts_check_signing_certs(PKCS7_SIGNER_INFO *si, 
-                                  STACK_OF(X509) *chain); 
-static ESS_SIGNING_CERT *ess_get_signing_cert(PKCS7_SIGNER_INFO *si); 
-static int ts_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert); 
-static int ts_issuer_serial_cmp(ESS_ISSUER_SERIAL *is, X509 *cert); 
-static int int_ts_RESP_verify_token(TS_VERIFY_CTX *ctx, 
-                                    PKCS7 *token, TS_TST_INFO *tst_info); 
-static int ts_check_status_info(TS_RESP *response); 
-static char *ts_get_status_text(STACK_OF(ASN1_UTF8STRING) *text); 
-static int ts_check_policy(const ASN1_OBJECT *req_oid, 
-                           const TS_TST_INFO *tst_info); 
-static int ts_compute_imprint(BIO *data, TS_TST_INFO *tst_info, 
-                              X509_ALGOR **md_alg, 
-                              unsigned char **imprint, unsigned *imprint_len); 
-static int ts_check_imprints(X509_ALGOR *algor_a, 
-                             const unsigned char *imprint_a, unsigned len_a, 
-                             TS_TST_INFO *tst_info); 
-static int ts_check_nonces(const ASN1_INTEGER *a, TS_TST_INFO *tst_info); 
-static int ts_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer); 
-static int ts_find_name(STACK_OF(GENERAL_NAME) *gen_names, 
-                        GENERAL_NAME *name); 
-static int ts_find_cert_v2(STACK_OF(ESS_CERT_ID_V2) *cert_ids, X509 *cert); 
-static ESS_SIGNING_CERT_V2 *ess_get_signing_cert_v2(PKCS7_SIGNER_INFO *si); 
- 
-/* 
- * This must be large enough to hold all values in ts_status_text (with 
- * comma separator) or all text fields in ts_failure_info (also with comma). 
- */ 
-#define TS_STATUS_BUF_SIZE      256 
- 
-/* 
- * Local mapping between response codes and descriptions. 
- */ 
-static const char *ts_status_text[] = { 
-    "granted", 
-    "grantedWithMods", 
-    "rejection", 
-    "waiting", 
-    "revocationWarning", 
-    "revocationNotification" 
-}; 
- 
-#define TS_STATUS_TEXT_SIZE     OSSL_NELEM(ts_status_text) 
- 
-static struct { 
-    int code; 
-    const char *text; 
-} ts_failure_info[] = { 
-    {TS_INFO_BAD_ALG, "badAlg"}, 
-    {TS_INFO_BAD_REQUEST, "badRequest"}, 
-    {TS_INFO_BAD_DATA_FORMAT, "badDataFormat"}, 
-    {TS_INFO_TIME_NOT_AVAILABLE, "timeNotAvailable"}, 
-    {TS_INFO_UNACCEPTED_POLICY, "unacceptedPolicy"}, 
-    {TS_INFO_UNACCEPTED_EXTENSION, "unacceptedExtension"}, 
-    {TS_INFO_ADD_INFO_NOT_AVAILABLE, "addInfoNotAvailable"}, 
-    {TS_INFO_SYSTEM_FAILURE, "systemFailure"} 
-}; 
- 
- 
-/*- 
- * This function carries out the following tasks: 
- *      - Checks if there is one and only one signer. 
- *      - Search for the signing certificate in 'certs' and in the response. 
- *      - Check the extended key usage and key usage fields of the signer 
- *      certificate (done by the path validation). 
- *      - Build and validate the certificate path. 
- *      - Check if the certificate path meets the requirements of the 
- *      SigningCertificate ESS signed attribute. 
- *      - Verify the signature value. 
- *      - Returns the signer certificate in 'signer', if 'signer' is not NULL. 
- */ 
-int TS_RESP_verify_signature(PKCS7 *token, STACK_OF(X509) *certs, 
-                             X509_STORE *store, X509 **signer_out) 
-{ 
-    STACK_OF(PKCS7_SIGNER_INFO) *sinfos = NULL; 
-    PKCS7_SIGNER_INFO *si; 
-    STACK_OF(X509) *signers = NULL; 
-    X509 *signer; 
-    STACK_OF(X509) *chain = NULL; 
-    char buf[4096]; 
-    int i, j = 0, ret = 0; 
-    BIO *p7bio = NULL; 
- 
-    /* Some sanity checks first. */ 
-    if (!token) { 
-        TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_INVALID_NULL_POINTER); 
-        goto err; 
-    } 
-    if (!PKCS7_type_is_signed(token)) { 
-        TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_WRONG_CONTENT_TYPE); 
-        goto err; 
-    } 
-    sinfos = PKCS7_get_signer_info(token); 
-    if (!sinfos || sk_PKCS7_SIGNER_INFO_num(sinfos) != 1) { 
-        TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_THERE_MUST_BE_ONE_SIGNER); 
-        goto err; 
-    } 
-    si = sk_PKCS7_SIGNER_INFO_value(sinfos, 0); 
-    if (PKCS7_get_detached(token)) { 
-        TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_NO_CONTENT); 
-        goto err; 
-    } 
- 
-    /* 
-     * Get hold of the signer certificate, search only internal certificates 
-     * if it was requested. 
-     */ 
-    signers = PKCS7_get0_signers(token, certs, 0); 
-    if (!signers || sk_X509_num(signers) != 1) 
-        goto err; 
-    signer = sk_X509_value(signers, 0); 
- 
-    if (!ts_verify_cert(store, certs, signer, &chain)) 
-        goto err; 
-    if (!ts_check_signing_certs(si, chain)) 
-        goto err; 
-    p7bio = PKCS7_dataInit(token, NULL); 
- 
-    /* We now have to 'read' from p7bio to calculate digests etc. */ 
-    while ((i = BIO_read(p7bio, buf, sizeof(buf))) > 0) 
-        continue; 
- 
-    j = PKCS7_signatureVerify(p7bio, token, si, signer); 
-    if (j <= 0) { 
-        TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_SIGNATURE_FAILURE); 
-        goto err; 
-    } 
- 
-    if (signer_out) { 
-        *signer_out = signer; 
-        X509_up_ref(signer); 
-    } 
-    ret = 1; 
- 
- err: 
-    BIO_free_all(p7bio); 
-    sk_X509_pop_free(chain, X509_free); 
-    sk_X509_free(signers); 
- 
-    return ret; 
-} 
- 
-/* 
- * The certificate chain is returned in chain. Caller is responsible for 
- * freeing the vector. 
- */ 
-static int ts_verify_cert(X509_STORE *store, STACK_OF(X509) *untrusted, 
-                          X509 *signer, STACK_OF(X509) **chain) 
-{ 
-    X509_STORE_CTX *cert_ctx = NULL; 
-    int i; 
-    int ret = 0; 
- 
-    *chain = NULL; 
-    cert_ctx = X509_STORE_CTX_new(); 
-    if (cert_ctx == NULL) { 
-        TSerr(TS_F_TS_VERIFY_CERT, ERR_R_MALLOC_FAILURE); 
-        goto err; 
-    } 
-    if (!X509_STORE_CTX_init(cert_ctx, store, signer, untrusted)) 
-        goto end; 
-    X509_STORE_CTX_set_purpose(cert_ctx, X509_PURPOSE_TIMESTAMP_SIGN); 
-    i = X509_verify_cert(cert_ctx); 
-    if (i <= 0) { 
-        int j = X509_STORE_CTX_get_error(cert_ctx); 
-        TSerr(TS_F_TS_VERIFY_CERT, TS_R_CERTIFICATE_VERIFY_ERROR); 
-        ERR_add_error_data(2, "Verify error:", 
-                           X509_verify_cert_error_string(j)); 
-        goto err; 
-    } 
-    *chain = X509_STORE_CTX_get1_chain(cert_ctx); 
-    ret = 1; 
-    goto end; 
- 
-err: 
-    ret = 0; 
- 
-end: 
-    X509_STORE_CTX_free(cert_ctx); 
-    return ret; 
-} 
- 
-static int ts_check_signing_certs(PKCS7_SIGNER_INFO *si, 
-                                  STACK_OF(X509) *chain) 
-{ 
-    ESS_SIGNING_CERT *ss = ess_get_signing_cert(si); 
-    STACK_OF(ESS_CERT_ID) *cert_ids = NULL; 
-    ESS_SIGNING_CERT_V2 *ssv2 = ess_get_signing_cert_v2(si); 
-    STACK_OF(ESS_CERT_ID_V2) *cert_ids_v2 = NULL; 
-    X509 *cert; 
-    int i = 0; 
-    int ret = 0; 
- 
-    if (ss != NULL) { 
-        cert_ids = ss->cert_ids; 
-        cert = sk_X509_value(chain, 0); 
-        if (ts_find_cert(cert_ids, cert) != 0) 
-            goto err; 
- 
-        /* 
-         * Check the other certificates of the chain if there are more than one 
-         * certificate ids in cert_ids. 
-         */ 
-        if (sk_ESS_CERT_ID_num(cert_ids) > 1) { 
-            for (i = 1; i < sk_X509_num(chain); ++i) { 
-                cert = sk_X509_value(chain, i); 
-                if (ts_find_cert(cert_ids, cert) < 0) 
-                    goto err; 
-            } 
-        } 
-    } else if (ssv2 != NULL) { 
-        cert_ids_v2 = ssv2->cert_ids; 
-        cert = sk_X509_value(chain, 0); 
-        if (ts_find_cert_v2(cert_ids_v2, cert) != 0) 
-            goto err; 
- 
-        /* 
-         * Check the other certificates of the chain if there are more than one 
-         * certificate ids in cert_ids. 
-         */ 
-        if (sk_ESS_CERT_ID_V2_num(cert_ids_v2) > 1) { 
-            for (i = 1; i < sk_X509_num(chain); ++i) { 
-                cert = sk_X509_value(chain, i); 
-                if (ts_find_cert_v2(cert_ids_v2, cert) < 0) 
-                    goto err; 
-            } 
-        } 
-    } else { 
-        goto err; 
-    } 
- 
-    ret = 1; 
- err: 
-    if (!ret) 
-        TSerr(TS_F_TS_CHECK_SIGNING_CERTS, 
-              TS_R_ESS_SIGNING_CERTIFICATE_ERROR); 
-    ESS_SIGNING_CERT_free(ss); 
-    ESS_SIGNING_CERT_V2_free(ssv2); 
-    return ret; 
-} 
- 
-static ESS_SIGNING_CERT *ess_get_signing_cert(PKCS7_SIGNER_INFO *si) 
-{ 
-    ASN1_TYPE *attr; 
-    const unsigned char *p; 
-    attr = PKCS7_get_signed_attribute(si, NID_id_smime_aa_signingCertificate); 
-    if (!attr) 
-        return NULL; 
-    p = attr->value.sequence->data; 
-    return d2i_ESS_SIGNING_CERT(NULL, &p, attr->value.sequence->length); 
-} 
- 
-static ESS_SIGNING_CERT_V2 *ess_get_signing_cert_v2(PKCS7_SIGNER_INFO *si) 
-{ 
-    ASN1_TYPE *attr; 
-    const unsigned char *p; 
- 
-    attr = PKCS7_get_signed_attribute(si, NID_id_smime_aa_signingCertificateV2); 
-    if (attr == NULL) 
-        return NULL; 
-    p = attr->value.sequence->data; 
-    return d2i_ESS_SIGNING_CERT_V2(NULL, &p, attr->value.sequence->length); 
-} 
- 
-/* Returns < 0 if certificate is not found, certificate index otherwise. */ 
-static int ts_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert) 
-{ 
-    int i; 
-    unsigned char cert_sha1[SHA_DIGEST_LENGTH]; 
- 
-    if (!cert_ids || !cert) 
-        return -1; 
- 
-    /* Recompute SHA1 hash of certificate if necessary (side effect). */ 
-    X509_check_purpose(cert, -1, 0); 
- 
+
+static int ts_verify_cert(X509_STORE *store, STACK_OF(X509) *untrusted,
+                          X509 *signer, STACK_OF(X509) **chain);
+static int ts_check_signing_certs(PKCS7_SIGNER_INFO *si,
+                                  STACK_OF(X509) *chain);
+static ESS_SIGNING_CERT *ess_get_signing_cert(PKCS7_SIGNER_INFO *si);
+static int ts_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert);
+static int ts_issuer_serial_cmp(ESS_ISSUER_SERIAL *is, X509 *cert);
+static int int_ts_RESP_verify_token(TS_VERIFY_CTX *ctx,
+                                    PKCS7 *token, TS_TST_INFO *tst_info);
+static int ts_check_status_info(TS_RESP *response);
+static char *ts_get_status_text(STACK_OF(ASN1_UTF8STRING) *text);
+static int ts_check_policy(const ASN1_OBJECT *req_oid,
+                           const TS_TST_INFO *tst_info);
+static int ts_compute_imprint(BIO *data, TS_TST_INFO *tst_info,
+                              X509_ALGOR **md_alg,
+                              unsigned char **imprint, unsigned *imprint_len);
+static int ts_check_imprints(X509_ALGOR *algor_a,
+                             const unsigned char *imprint_a, unsigned len_a,
+                             TS_TST_INFO *tst_info);
+static int ts_check_nonces(const ASN1_INTEGER *a, TS_TST_INFO *tst_info);
+static int ts_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer);
+static int ts_find_name(STACK_OF(GENERAL_NAME) *gen_names,
+                        GENERAL_NAME *name);
+static int ts_find_cert_v2(STACK_OF(ESS_CERT_ID_V2) *cert_ids, X509 *cert);
+static ESS_SIGNING_CERT_V2 *ess_get_signing_cert_v2(PKCS7_SIGNER_INFO *si);
+
+/*
+ * This must be large enough to hold all values in ts_status_text (with
+ * comma separator) or all text fields in ts_failure_info (also with comma).
+ */
+#define TS_STATUS_BUF_SIZE      256
+
+/*
+ * Local mapping between response codes and descriptions.
+ */
+static const char *ts_status_text[] = {
+    "granted",
+    "grantedWithMods",
+    "rejection",
+    "waiting",
+    "revocationWarning",
+    "revocationNotification"
+};
+
+#define TS_STATUS_TEXT_SIZE     OSSL_NELEM(ts_status_text)
+
+static struct {
+    int code;
+    const char *text;
+} ts_failure_info[] = {
+    {TS_INFO_BAD_ALG, "badAlg"},
+    {TS_INFO_BAD_REQUEST, "badRequest"},
+    {TS_INFO_BAD_DATA_FORMAT, "badDataFormat"},
+    {TS_INFO_TIME_NOT_AVAILABLE, "timeNotAvailable"},
+    {TS_INFO_UNACCEPTED_POLICY, "unacceptedPolicy"},
+    {TS_INFO_UNACCEPTED_EXTENSION, "unacceptedExtension"},
+    {TS_INFO_ADD_INFO_NOT_AVAILABLE, "addInfoNotAvailable"},
+    {TS_INFO_SYSTEM_FAILURE, "systemFailure"}
+};
+
+
+/*-
+ * This function carries out the following tasks:
+ *      - Checks if there is one and only one signer.
+ *      - Search for the signing certificate in 'certs' and in the response.
+ *      - Check the extended key usage and key usage fields of the signer
+ *      certificate (done by the path validation).
+ *      - Build and validate the certificate path.
+ *      - Check if the certificate path meets the requirements of the
+ *      SigningCertificate ESS signed attribute.
+ *      - Verify the signature value.
+ *      - Returns the signer certificate in 'signer', if 'signer' is not NULL.
+ */
+int TS_RESP_verify_signature(PKCS7 *token, STACK_OF(X509) *certs,
+                             X509_STORE *store, X509 **signer_out)
+{
+    STACK_OF(PKCS7_SIGNER_INFO) *sinfos = NULL;
+    PKCS7_SIGNER_INFO *si;
+    STACK_OF(X509) *signers = NULL;
+    X509 *signer;
+    STACK_OF(X509) *chain = NULL;
+    char buf[4096];
+    int i, j = 0, ret = 0;
+    BIO *p7bio = NULL;
+
+    /* Some sanity checks first. */
+    if (!token) {
+        TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_INVALID_NULL_POINTER);
+        goto err;
+    }
+    if (!PKCS7_type_is_signed(token)) {
+        TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_WRONG_CONTENT_TYPE);
+        goto err;
+    }
+    sinfos = PKCS7_get_signer_info(token);
+    if (!sinfos || sk_PKCS7_SIGNER_INFO_num(sinfos) != 1) {
+        TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_THERE_MUST_BE_ONE_SIGNER);
+        goto err;
+    }
+    si = sk_PKCS7_SIGNER_INFO_value(sinfos, 0);
+    if (PKCS7_get_detached(token)) {
+        TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_NO_CONTENT);
+        goto err;
+    }
+
+    /*
+     * Get hold of the signer certificate, search only internal certificates
+     * if it was requested.
+     */
+    signers = PKCS7_get0_signers(token, certs, 0);
+    if (!signers || sk_X509_num(signers) != 1)
+        goto err;
+    signer = sk_X509_value(signers, 0);
+
+    if (!ts_verify_cert(store, certs, signer, &chain))
+        goto err;
+    if (!ts_check_signing_certs(si, chain))
+        goto err;
+    p7bio = PKCS7_dataInit(token, NULL);
+
+    /* We now have to 'read' from p7bio to calculate digests etc. */
+    while ((i = BIO_read(p7bio, buf, sizeof(buf))) > 0)
+        continue;
+
+    j = PKCS7_signatureVerify(p7bio, token, si, signer);
+    if (j <= 0) {
+        TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_SIGNATURE_FAILURE);
+        goto err;
+    }
+
+    if (signer_out) {
+        *signer_out = signer;
+        X509_up_ref(signer);
+    }
+    ret = 1;
+
+ err:
+    BIO_free_all(p7bio);
+    sk_X509_pop_free(chain, X509_free);
+    sk_X509_free(signers);
+
+    return ret;
+}
+
+/*
+ * The certificate chain is returned in chain. Caller is responsible for
+ * freeing the vector.
+ */
+static int ts_verify_cert(X509_STORE *store, STACK_OF(X509) *untrusted,
+                          X509 *signer, STACK_OF(X509) **chain)
+{
+    X509_STORE_CTX *cert_ctx = NULL;
+    int i;
+    int ret = 0;
+
+    *chain = NULL;
+    cert_ctx = X509_STORE_CTX_new();
+    if (cert_ctx == NULL) {
+        TSerr(TS_F_TS_VERIFY_CERT, ERR_R_MALLOC_FAILURE);
+        goto err;
+    }
+    if (!X509_STORE_CTX_init(cert_ctx, store, signer, untrusted))
+        goto end;
+    X509_STORE_CTX_set_purpose(cert_ctx, X509_PURPOSE_TIMESTAMP_SIGN);
+    i = X509_verify_cert(cert_ctx);
+    if (i <= 0) {
+        int j = X509_STORE_CTX_get_error(cert_ctx);
+        TSerr(TS_F_TS_VERIFY_CERT, TS_R_CERTIFICATE_VERIFY_ERROR);
+        ERR_add_error_data(2, "Verify error:",
+                           X509_verify_cert_error_string(j));
+        goto err;
+    }
+    *chain = X509_STORE_CTX_get1_chain(cert_ctx);
+    ret = 1;
+    goto end;
+
+err:
+    ret = 0;
+
+end:
+    X509_STORE_CTX_free(cert_ctx);
+    return ret;
+}
+
+static int ts_check_signing_certs(PKCS7_SIGNER_INFO *si,
+                                  STACK_OF(X509) *chain)
+{
+    ESS_SIGNING_CERT *ss = ess_get_signing_cert(si);
+    STACK_OF(ESS_CERT_ID) *cert_ids = NULL;
+    ESS_SIGNING_CERT_V2 *ssv2 = ess_get_signing_cert_v2(si);
+    STACK_OF(ESS_CERT_ID_V2) *cert_ids_v2 = NULL;
+    X509 *cert;
+    int i = 0;
+    int ret = 0;
+
+    if (ss != NULL) {
+        cert_ids = ss->cert_ids;
+        cert = sk_X509_value(chain, 0);
+        if (ts_find_cert(cert_ids, cert) != 0)
+            goto err;
+
+        /*
+         * Check the other certificates of the chain if there are more than one
+         * certificate ids in cert_ids.
+         */
+        if (sk_ESS_CERT_ID_num(cert_ids) > 1) {
+            for (i = 1; i < sk_X509_num(chain); ++i) {
+                cert = sk_X509_value(chain, i);
+                if (ts_find_cert(cert_ids, cert) < 0)
+                    goto err;
+            }
+        }
+    } else if (ssv2 != NULL) {
+        cert_ids_v2 = ssv2->cert_ids;
+        cert = sk_X509_value(chain, 0);
+        if (ts_find_cert_v2(cert_ids_v2, cert) != 0)
+            goto err;
+
+        /*
+         * Check the other certificates of the chain if there are more than one
+         * certificate ids in cert_ids.
+         */
+        if (sk_ESS_CERT_ID_V2_num(cert_ids_v2) > 1) {
+            for (i = 1; i < sk_X509_num(chain); ++i) {
+                cert = sk_X509_value(chain, i);
+                if (ts_find_cert_v2(cert_ids_v2, cert) < 0)
+                    goto err;
+            }
+        }
+    } else {
+        goto err;
+    }
+
+    ret = 1;
+ err:
+    if (!ret)
+        TSerr(TS_F_TS_CHECK_SIGNING_CERTS,
+              TS_R_ESS_SIGNING_CERTIFICATE_ERROR);
+    ESS_SIGNING_CERT_free(ss);
+    ESS_SIGNING_CERT_V2_free(ssv2);
+    return ret;
+}
+
+static ESS_SIGNING_CERT *ess_get_signing_cert(PKCS7_SIGNER_INFO *si)
+{
+    ASN1_TYPE *attr;
+    const unsigned char *p;
+    attr = PKCS7_get_signed_attribute(si, NID_id_smime_aa_signingCertificate);
+    if (!attr)
+        return NULL;
+    p = attr->value.sequence->data;
+    return d2i_ESS_SIGNING_CERT(NULL, &p, attr->value.sequence->length);
+}
+
+static ESS_SIGNING_CERT_V2 *ess_get_signing_cert_v2(PKCS7_SIGNER_INFO *si)
+{
+    ASN1_TYPE *attr;
+    const unsigned char *p;
+
+    attr = PKCS7_get_signed_attribute(si, NID_id_smime_aa_signingCertificateV2);
+    if (attr == NULL)
+        return NULL;
+    p = attr->value.sequence->data;
+    return d2i_ESS_SIGNING_CERT_V2(NULL, &p, attr->value.sequence->length);
+}
+
+/* Returns < 0 if certificate is not found, certificate index otherwise. */
+static int ts_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert)
+{
+    int i;
+    unsigned char cert_sha1[SHA_DIGEST_LENGTH];
+
+    if (!cert_ids || !cert)
+        return -1;
+
+    /* Recompute SHA1 hash of certificate if necessary (side effect). */
+    X509_check_purpose(cert, -1, 0);
+
     if (!X509_digest(cert, EVP_sha1(), cert_sha1, NULL))
         return -1;
 
-    /* Look for cert in the cert_ids vector. */ 
-    for (i = 0; i < sk_ESS_CERT_ID_num(cert_ids); ++i) { 
-        ESS_CERT_ID *cid = sk_ESS_CERT_ID_value(cert_ids, i); 
- 
-        if (cid->hash->length == SHA_DIGEST_LENGTH 
-            && memcmp(cid->hash->data, cert_sha1, SHA_DIGEST_LENGTH) == 0) { 
-            ESS_ISSUER_SERIAL *is = cid->issuer_serial; 
-            if (!is || !ts_issuer_serial_cmp(is, cert)) 
-                return i; 
-        } 
-    } 
- 
-    return -1; 
-} 
- 
-/* Returns < 0 if certificate is not found, certificate index otherwise. */ 
-static int ts_find_cert_v2(STACK_OF(ESS_CERT_ID_V2) *cert_ids, X509 *cert) 
-{ 
-    int i; 
-    unsigned char cert_digest[EVP_MAX_MD_SIZE]; 
-    unsigned int len; 
- 
-    /* Look for cert in the cert_ids vector. */ 
-    for (i = 0; i < sk_ESS_CERT_ID_V2_num(cert_ids); ++i) { 
-        ESS_CERT_ID_V2 *cid = sk_ESS_CERT_ID_V2_value(cert_ids, i); 
-        const EVP_MD *md; 
- 
-        if (cid->hash_alg != NULL) 
-            md = EVP_get_digestbyobj(cid->hash_alg->algorithm); 
-        else 
-            md = EVP_sha256(); 
- 
+    /* Look for cert in the cert_ids vector. */
+    for (i = 0; i < sk_ESS_CERT_ID_num(cert_ids); ++i) {
+        ESS_CERT_ID *cid = sk_ESS_CERT_ID_value(cert_ids, i);
+
+        if (cid->hash->length == SHA_DIGEST_LENGTH
+            && memcmp(cid->hash->data, cert_sha1, SHA_DIGEST_LENGTH) == 0) {
+            ESS_ISSUER_SERIAL *is = cid->issuer_serial;
+            if (!is || !ts_issuer_serial_cmp(is, cert))
+                return i;
+        }
+    }
+
+    return -1;
+}
+
+/* Returns < 0 if certificate is not found, certificate index otherwise. */
+static int ts_find_cert_v2(STACK_OF(ESS_CERT_ID_V2) *cert_ids, X509 *cert)
+{
+    int i;
+    unsigned char cert_digest[EVP_MAX_MD_SIZE];
+    unsigned int len;
+
+    /* Look for cert in the cert_ids vector. */
+    for (i = 0; i < sk_ESS_CERT_ID_V2_num(cert_ids); ++i) {
+        ESS_CERT_ID_V2 *cid = sk_ESS_CERT_ID_V2_value(cert_ids, i);
+        const EVP_MD *md;
+
+        if (cid->hash_alg != NULL)
+            md = EVP_get_digestbyobj(cid->hash_alg->algorithm);
+        else
+            md = EVP_sha256();
+
         if (!X509_digest(cert, md, cert_digest, &len))
             return -1;
-        if (cid->hash->length != (int)len) 
-            return -1; 
- 
-        if (memcmp(cid->hash->data, cert_digest, cid->hash->length) == 0) { 
-            ESS_ISSUER_SERIAL *is = cid->issuer_serial; 
- 
-            if (is == NULL || !ts_issuer_serial_cmp(is, cert)) 
-                return i; 
-        } 
-    } 
- 
-    return -1; 
-} 
- 
-static int ts_issuer_serial_cmp(ESS_ISSUER_SERIAL *is, X509 *cert) 
-{ 
-    GENERAL_NAME *issuer; 
- 
-    if (!is || !cert || sk_GENERAL_NAME_num(is->issuer) != 1) 
-        return -1; 
- 
-    issuer = sk_GENERAL_NAME_value(is->issuer, 0); 
-    if (issuer->type != GEN_DIRNAME 
-        || X509_NAME_cmp(issuer->d.dirn, X509_get_issuer_name(cert))) 
-        return -1; 
- 
-    if (ASN1_INTEGER_cmp(is->serial, X509_get_serialNumber(cert))) 
-        return -1; 
- 
-    return 0; 
-} 
- 
-/*- 
- * Verifies whether 'response' contains a valid response with regards 
- * to the settings of the context: 
- *      - Gives an error message if the TS_TST_INFO is not present. 
- *      - Calls _TS_RESP_verify_token to verify the token content. 
- */ 
-int TS_RESP_verify_response(TS_VERIFY_CTX *ctx, TS_RESP *response) 
-{ 
-    PKCS7 *token = response->token; 
-    TS_TST_INFO *tst_info = response->tst_info; 
-    int ret = 0; 
- 
-    if (!ts_check_status_info(response)) 
-        goto err; 
-    if (!int_ts_RESP_verify_token(ctx, token, tst_info)) 
-        goto err; 
-    ret = 1; 
- 
- err: 
-    return ret; 
-} 
- 
-/* 
- * Tries to extract a TS_TST_INFO structure from the PKCS7 token and 
- * calls the internal int_TS_RESP_verify_token function for verifying it. 
- */ 
-int TS_RESP_verify_token(TS_VERIFY_CTX *ctx, PKCS7 *token) 
-{ 
-    TS_TST_INFO *tst_info = PKCS7_to_TS_TST_INFO(token); 
-    int ret = 0; 
-    if (tst_info) { 
-        ret = int_ts_RESP_verify_token(ctx, token, tst_info); 
-        TS_TST_INFO_free(tst_info); 
-    } 
-    return ret; 
-} 
- 
-/*- 
- * Verifies whether the 'token' contains a valid time stamp token 
- * with regards to the settings of the context. Only those checks are 
- * carried out that are specified in the context: 
- *      - Verifies the signature of the TS_TST_INFO. 
- *      - Checks the version number of the response. 
- *      - Check if the requested and returned policies math. 
- *      - Check if the message imprints are the same. 
- *      - Check if the nonces are the same. 
- *      - Check if the TSA name matches the signer. 
- *      - Check if the TSA name is the expected TSA. 
- */ 
-static int int_ts_RESP_verify_token(TS_VERIFY_CTX *ctx, 
-                                    PKCS7 *token, TS_TST_INFO *tst_info) 
-{ 
-    X509 *signer = NULL; 
-    GENERAL_NAME *tsa_name = tst_info->tsa; 
-    X509_ALGOR *md_alg = NULL; 
-    unsigned char *imprint = NULL; 
-    unsigned imprint_len = 0; 
-    int ret = 0; 
-    int flags = ctx->flags; 
- 
-    /* Some options require us to also check the signature */ 
-    if (((flags & TS_VFY_SIGNER) && tsa_name != NULL) 
-            || (flags & TS_VFY_TSA_NAME)) { 
-        flags |= TS_VFY_SIGNATURE; 
-    } 
- 
-    if ((flags & TS_VFY_SIGNATURE) 
-        && !TS_RESP_verify_signature(token, ctx->certs, ctx->store, &signer)) 
-        goto err; 
-    if ((flags & TS_VFY_VERSION) 
-        && TS_TST_INFO_get_version(tst_info) != 1) { 
-        TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_UNSUPPORTED_VERSION); 
-        goto err; 
-    } 
-    if ((flags & TS_VFY_POLICY) 
-        && !ts_check_policy(ctx->policy, tst_info)) 
-        goto err; 
-    if ((flags & TS_VFY_IMPRINT) 
-        && !ts_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len, 
-                              tst_info)) 
-        goto err; 
-    if ((flags & TS_VFY_DATA) 
-        && (!ts_compute_imprint(ctx->data, tst_info, 
-                                &md_alg, &imprint, &imprint_len) 
-            || !ts_check_imprints(md_alg, imprint, imprint_len, tst_info))) 
-        goto err; 
-    if ((flags & TS_VFY_NONCE) 
-        && !ts_check_nonces(ctx->nonce, tst_info)) 
-        goto err; 
-    if ((flags & TS_VFY_SIGNER) 
-        && tsa_name && !ts_check_signer_name(tsa_name, signer)) { 
-        TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_NAME_MISMATCH); 
-        goto err; 
-    } 
-    if ((flags & TS_VFY_TSA_NAME) 
-        && !ts_check_signer_name(ctx->tsa_name, signer)) { 
-        TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_UNTRUSTED); 
-        goto err; 
-    } 
-    ret = 1; 
- 
- err: 
-    X509_free(signer); 
-    X509_ALGOR_free(md_alg); 
-    OPENSSL_free(imprint); 
-    return ret; 
-} 
- 
-static int ts_check_status_info(TS_RESP *response) 
-{ 
-    TS_STATUS_INFO *info = response->status_info; 
-    long status = ASN1_INTEGER_get(info->status); 
-    const char *status_text = NULL; 
-    char *embedded_status_text = NULL; 
-    char failure_text[TS_STATUS_BUF_SIZE] = ""; 
- 
-    if (status == 0 || status == 1) 
-        return 1; 
- 
-    /* There was an error, get the description in status_text. */ 
-    if (0 <= status && status < (long) OSSL_NELEM(ts_status_text)) 
-        status_text = ts_status_text[status]; 
-    else 
-        status_text = "unknown code"; 
- 
-    if (sk_ASN1_UTF8STRING_num(info->text) > 0 
-        && (embedded_status_text = ts_get_status_text(info->text)) == NULL) 
-        return 0; 
- 
-    /* Fill in failure_text with the failure information. */ 
-    if (info->failure_info) { 
-        int i; 
-        int first = 1; 
-        for (i = 0; i < (int)OSSL_NELEM(ts_failure_info); ++i) { 
-            if (ASN1_BIT_STRING_get_bit(info->failure_info, 
-                                        ts_failure_info[i].code)) { 
-                if (!first) 
-                    strcat(failure_text, ","); 
-                else 
-                    first = 0; 
-                strcat(failure_text, ts_failure_info[i].text); 
-            } 
-        } 
-    } 
-    if (failure_text[0] == '\0') 
-        strcpy(failure_text, "unspecified"); 
- 
-    TSerr(TS_F_TS_CHECK_STATUS_INFO, TS_R_NO_TIME_STAMP_TOKEN); 
-    ERR_add_error_data(6, 
-                       "status code: ", status_text, 
-                       ", status text: ", embedded_status_text ? 
-                       embedded_status_text : "unspecified", 
-                       ", failure codes: ", failure_text); 
-    OPENSSL_free(embedded_status_text); 
- 
-    return 0; 
-} 
- 
-static char *ts_get_status_text(STACK_OF(ASN1_UTF8STRING) *text) 
-{ 
-    int i; 
-    int length = 0; 
-    char *result = NULL; 
-    char *p; 
- 
-    for (i = 0; i < sk_ASN1_UTF8STRING_num(text); ++i) { 
-        ASN1_UTF8STRING *current = sk_ASN1_UTF8STRING_value(text, i); 
-        if (ASN1_STRING_length(current) > TS_MAX_STATUS_LENGTH - length - 1) 
-            return NULL; 
-        length += ASN1_STRING_length(current); 
-        length += 1;            /* separator character */ 
-    } 
-    if ((result = OPENSSL_malloc(length)) == NULL) { 
-        TSerr(TS_F_TS_GET_STATUS_TEXT, ERR_R_MALLOC_FAILURE); 
-        return NULL; 
-    } 
- 
-    for (i = 0, p = result; i < sk_ASN1_UTF8STRING_num(text); ++i) { 
-        ASN1_UTF8STRING *current = sk_ASN1_UTF8STRING_value(text, i); 
-        length = ASN1_STRING_length(current); 
-        if (i > 0) 
-            *p++ = '/'; 
-        strncpy(p, (const char *)ASN1_STRING_get0_data(current), length); 
-        p += length; 
-    } 
-    *p = '\0'; 
- 
-    return result; 
-} 
- 
-static int ts_check_policy(const ASN1_OBJECT *req_oid, 
-                           const TS_TST_INFO *tst_info) 
-{ 
-    const ASN1_OBJECT *resp_oid = tst_info->policy_id; 
- 
-    if (OBJ_cmp(req_oid, resp_oid) != 0) { 
-        TSerr(TS_F_TS_CHECK_POLICY, TS_R_POLICY_MISMATCH); 
-        return 0; 
-    } 
- 
-    return 1; 
-} 
- 
-static int ts_compute_imprint(BIO *data, TS_TST_INFO *tst_info, 
-                              X509_ALGOR **md_alg, 
-                              unsigned char **imprint, unsigned *imprint_len) 
-{ 
-    TS_MSG_IMPRINT *msg_imprint = tst_info->msg_imprint; 
-    X509_ALGOR *md_alg_resp = msg_imprint->hash_algo; 
-    const EVP_MD *md; 
-    EVP_MD_CTX *md_ctx = NULL; 
-    unsigned char buffer[4096]; 
-    int length; 
- 
-    *md_alg = NULL; 
-    *imprint = NULL; 
- 
-    if ((*md_alg = X509_ALGOR_dup(md_alg_resp)) == NULL) 
-        goto err; 
-    if ((md = EVP_get_digestbyobj((*md_alg)->algorithm)) == NULL) { 
-        TSerr(TS_F_TS_COMPUTE_IMPRINT, TS_R_UNSUPPORTED_MD_ALGORITHM); 
-        goto err; 
-    } 
-    length = EVP_MD_size(md); 
-    if (length < 0) 
-        goto err; 
-    *imprint_len = length; 
-    if ((*imprint = OPENSSL_malloc(*imprint_len)) == NULL) { 
-        TSerr(TS_F_TS_COMPUTE_IMPRINT, ERR_R_MALLOC_FAILURE); 
-        goto err; 
-    } 
- 
-    md_ctx = EVP_MD_CTX_new(); 
-    if (md_ctx == NULL) { 
-        TSerr(TS_F_TS_COMPUTE_IMPRINT, ERR_R_MALLOC_FAILURE); 
-        goto err; 
-    } 
-    if (!EVP_DigestInit(md_ctx, md)) 
-        goto err; 
-    while ((length = BIO_read(data, buffer, sizeof(buffer))) > 0) { 
-        if (!EVP_DigestUpdate(md_ctx, buffer, length)) 
-            goto err; 
-    } 
-    if (!EVP_DigestFinal(md_ctx, *imprint, NULL)) 
-        goto err; 
-    EVP_MD_CTX_free(md_ctx); 
- 
-    return 1; 
- err: 
-    EVP_MD_CTX_free(md_ctx); 
-    X509_ALGOR_free(*md_alg); 
+        if (cid->hash->length != (int)len)
+            return -1;
+
+        if (memcmp(cid->hash->data, cert_digest, cid->hash->length) == 0) {
+            ESS_ISSUER_SERIAL *is = cid->issuer_serial;
+
+            if (is == NULL || !ts_issuer_serial_cmp(is, cert))
+                return i;
+        }
+    }
+
+    return -1;
+}
+
+static int ts_issuer_serial_cmp(ESS_ISSUER_SERIAL *is, X509 *cert)
+{
+    GENERAL_NAME *issuer;
+
+    if (!is || !cert || sk_GENERAL_NAME_num(is->issuer) != 1)
+        return -1;
+
+    issuer = sk_GENERAL_NAME_value(is->issuer, 0);
+    if (issuer->type != GEN_DIRNAME
+        || X509_NAME_cmp(issuer->d.dirn, X509_get_issuer_name(cert)))
+        return -1;
+
+    if (ASN1_INTEGER_cmp(is->serial, X509_get_serialNumber(cert)))
+        return -1;
+
+    return 0;
+}
+
+/*-
+ * Verifies whether 'response' contains a valid response with regards
+ * to the settings of the context:
+ *      - Gives an error message if the TS_TST_INFO is not present.
+ *      - Calls _TS_RESP_verify_token to verify the token content.
+ */
+int TS_RESP_verify_response(TS_VERIFY_CTX *ctx, TS_RESP *response)
+{
+    PKCS7 *token = response->token;
+    TS_TST_INFO *tst_info = response->tst_info;
+    int ret = 0;
+
+    if (!ts_check_status_info(response))
+        goto err;
+    if (!int_ts_RESP_verify_token(ctx, token, tst_info))
+        goto err;
+    ret = 1;
+
+ err:
+    return ret;
+}
+
+/*
+ * Tries to extract a TS_TST_INFO structure from the PKCS7 token and
+ * calls the internal int_TS_RESP_verify_token function for verifying it.
+ */
+int TS_RESP_verify_token(TS_VERIFY_CTX *ctx, PKCS7 *token)
+{
+    TS_TST_INFO *tst_info = PKCS7_to_TS_TST_INFO(token);
+    int ret = 0;
+    if (tst_info) {
+        ret = int_ts_RESP_verify_token(ctx, token, tst_info);
+        TS_TST_INFO_free(tst_info);
+    }
+    return ret;
+}
+
+/*-
+ * Verifies whether the 'token' contains a valid time stamp token
+ * with regards to the settings of the context. Only those checks are
+ * carried out that are specified in the context:
+ *      - Verifies the signature of the TS_TST_INFO.
+ *      - Checks the version number of the response.
+ *      - Check if the requested and returned policies math.
+ *      - Check if the message imprints are the same.
+ *      - Check if the nonces are the same.
+ *      - Check if the TSA name matches the signer.
+ *      - Check if the TSA name is the expected TSA.
+ */
+static int int_ts_RESP_verify_token(TS_VERIFY_CTX *ctx,
+                                    PKCS7 *token, TS_TST_INFO *tst_info)
+{
+    X509 *signer = NULL;
+    GENERAL_NAME *tsa_name = tst_info->tsa;
+    X509_ALGOR *md_alg = NULL;
+    unsigned char *imprint = NULL;
+    unsigned imprint_len = 0;
+    int ret = 0;
+    int flags = ctx->flags;
+
+    /* Some options require us to also check the signature */
+    if (((flags & TS_VFY_SIGNER) && tsa_name != NULL)
+            || (flags & TS_VFY_TSA_NAME)) {
+        flags |= TS_VFY_SIGNATURE;
+    }
+
+    if ((flags & TS_VFY_SIGNATURE)
+        && !TS_RESP_verify_signature(token, ctx->certs, ctx->store, &signer))
+        goto err;
+    if ((flags & TS_VFY_VERSION)
+        && TS_TST_INFO_get_version(tst_info) != 1) {
+        TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_UNSUPPORTED_VERSION);
+        goto err;
+    }
+    if ((flags & TS_VFY_POLICY)
+        && !ts_check_policy(ctx->policy, tst_info))
+        goto err;
+    if ((flags & TS_VFY_IMPRINT)
+        && !ts_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len,
+                              tst_info))
+        goto err;
+    if ((flags & TS_VFY_DATA)
+        && (!ts_compute_imprint(ctx->data, tst_info,
+                                &md_alg, &imprint, &imprint_len)
+            || !ts_check_imprints(md_alg, imprint, imprint_len, tst_info)))
+        goto err;
+    if ((flags & TS_VFY_NONCE)
+        && !ts_check_nonces(ctx->nonce, tst_info))
+        goto err;
+    if ((flags & TS_VFY_SIGNER)
+        && tsa_name && !ts_check_signer_name(tsa_name, signer)) {
+        TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_NAME_MISMATCH);
+        goto err;
+    }
+    if ((flags & TS_VFY_TSA_NAME)
+        && !ts_check_signer_name(ctx->tsa_name, signer)) {
+        TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_UNTRUSTED);
+        goto err;
+    }
+    ret = 1;
+
+ err:
+    X509_free(signer);
+    X509_ALGOR_free(md_alg);
+    OPENSSL_free(imprint);
+    return ret;
+}
+
+static int ts_check_status_info(TS_RESP *response)
+{
+    TS_STATUS_INFO *info = response->status_info;
+    long status = ASN1_INTEGER_get(info->status);
+    const char *status_text = NULL;
+    char *embedded_status_text = NULL;
+    char failure_text[TS_STATUS_BUF_SIZE] = "";
+
+    if (status == 0 || status == 1)
+        return 1;
+
+    /* There was an error, get the description in status_text. */
+    if (0 <= status && status < (long) OSSL_NELEM(ts_status_text))
+        status_text = ts_status_text[status];
+    else
+        status_text = "unknown code";
+
+    if (sk_ASN1_UTF8STRING_num(info->text) > 0
+        && (embedded_status_text = ts_get_status_text(info->text)) == NULL)
+        return 0;
+
+    /* Fill in failure_text with the failure information. */
+    if (info->failure_info) {
+        int i;
+        int first = 1;
+        for (i = 0; i < (int)OSSL_NELEM(ts_failure_info); ++i) {
+            if (ASN1_BIT_STRING_get_bit(info->failure_info,
+                                        ts_failure_info[i].code)) {
+                if (!first)
+                    strcat(failure_text, ",");
+                else
+                    first = 0;
+                strcat(failure_text, ts_failure_info[i].text);
+            }
+        }
+    }
+    if (failure_text[0] == '\0')
+        strcpy(failure_text, "unspecified");
+
+    TSerr(TS_F_TS_CHECK_STATUS_INFO, TS_R_NO_TIME_STAMP_TOKEN);
+    ERR_add_error_data(6,
+                       "status code: ", status_text,
+                       ", status text: ", embedded_status_text ?
+                       embedded_status_text : "unspecified",
+                       ", failure codes: ", failure_text);
+    OPENSSL_free(embedded_status_text);
+
+    return 0;
+}
+
+static char *ts_get_status_text(STACK_OF(ASN1_UTF8STRING) *text)
+{
+    int i;
+    int length = 0;
+    char *result = NULL;
+    char *p;
+
+    for (i = 0; i < sk_ASN1_UTF8STRING_num(text); ++i) {
+        ASN1_UTF8STRING *current = sk_ASN1_UTF8STRING_value(text, i);
+        if (ASN1_STRING_length(current) > TS_MAX_STATUS_LENGTH - length - 1)
+            return NULL;
+        length += ASN1_STRING_length(current);
+        length += 1;            /* separator character */
+    }
+    if ((result = OPENSSL_malloc(length)) == NULL) {
+        TSerr(TS_F_TS_GET_STATUS_TEXT, ERR_R_MALLOC_FAILURE);
+        return NULL;
+    }
+
+    for (i = 0, p = result; i < sk_ASN1_UTF8STRING_num(text); ++i) {
+        ASN1_UTF8STRING *current = sk_ASN1_UTF8STRING_value(text, i);
+        length = ASN1_STRING_length(current);
+        if (i > 0)
+            *p++ = '/';
+        strncpy(p, (const char *)ASN1_STRING_get0_data(current), length);
+        p += length;
+    }
+    *p = '\0';
+
+    return result;
+}
+
+static int ts_check_policy(const ASN1_OBJECT *req_oid,
+                           const TS_TST_INFO *tst_info)
+{
+    const ASN1_OBJECT *resp_oid = tst_info->policy_id;
+
+    if (OBJ_cmp(req_oid, resp_oid) != 0) {
+        TSerr(TS_F_TS_CHECK_POLICY, TS_R_POLICY_MISMATCH);
+        return 0;
+    }
+
+    return 1;
+}
+
+static int ts_compute_imprint(BIO *data, TS_TST_INFO *tst_info,
+                              X509_ALGOR **md_alg,
+                              unsigned char **imprint, unsigned *imprint_len)
+{
+    TS_MSG_IMPRINT *msg_imprint = tst_info->msg_imprint;
+    X509_ALGOR *md_alg_resp = msg_imprint->hash_algo;
+    const EVP_MD *md;
+    EVP_MD_CTX *md_ctx = NULL;
+    unsigned char buffer[4096];
+    int length;
+
     *md_alg = NULL;
-    OPENSSL_free(*imprint); 
-    *imprint_len = 0; 
-    *imprint = 0; 
-    return 0; 
-} 
- 
-static int ts_check_imprints(X509_ALGOR *algor_a, 
-                             const unsigned char *imprint_a, unsigned len_a, 
-                             TS_TST_INFO *tst_info) 
-{ 
-    TS_MSG_IMPRINT *b = tst_info->msg_imprint; 
-    X509_ALGOR *algor_b = b->hash_algo; 
-    int ret = 0; 
- 
-    if (algor_a) { 
-        if (OBJ_cmp(algor_a->algorithm, algor_b->algorithm)) 
-            goto err; 
- 
-        /* The parameter must be NULL in both. */ 
-        if ((algor_a->parameter 
-             && ASN1_TYPE_get(algor_a->parameter) != V_ASN1_NULL) 
-            || (algor_b->parameter 
-                && ASN1_TYPE_get(algor_b->parameter) != V_ASN1_NULL)) 
-            goto err; 
-    } 
- 
-    ret = len_a == (unsigned)ASN1_STRING_length(b->hashed_msg) && 
-        memcmp(imprint_a, ASN1_STRING_get0_data(b->hashed_msg), len_a) == 0; 
- err: 
-    if (!ret) 
-        TSerr(TS_F_TS_CHECK_IMPRINTS, TS_R_MESSAGE_IMPRINT_MISMATCH); 
-    return ret; 
-} 
- 
-static int ts_check_nonces(const ASN1_INTEGER *a, TS_TST_INFO *tst_info) 
-{ 
-    const ASN1_INTEGER *b = tst_info->nonce; 
- 
-    if (!b) { 
-        TSerr(TS_F_TS_CHECK_NONCES, TS_R_NONCE_NOT_RETURNED); 
-        return 0; 
-    } 
- 
-    /* No error if a nonce is returned without being requested. */ 
-    if (ASN1_INTEGER_cmp(a, b) != 0) { 
-        TSerr(TS_F_TS_CHECK_NONCES, TS_R_NONCE_MISMATCH); 
-        return 0; 
-    } 
- 
-    return 1; 
-} 
- 
-/* 
- * Check if the specified TSA name matches either the subject or one of the 
- * subject alternative names of the TSA certificate. 
- */ 
-static int ts_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer) 
-{ 
-    STACK_OF(GENERAL_NAME) *gen_names = NULL; 
-    int idx = -1; 
-    int found = 0; 
- 
-    if (tsa_name->type == GEN_DIRNAME 
-        && X509_name_cmp(tsa_name->d.dirn, X509_get_subject_name(signer)) == 0) 
-        return 1; 
-    gen_names = X509_get_ext_d2i(signer, NID_subject_alt_name, NULL, &idx); 
-    while (gen_names != NULL) { 
-        found = ts_find_name(gen_names, tsa_name) >= 0; 
-        if (found) 
-            break; 
-        /* 
-         * Get the next subject alternative name, although there should be no 
-         * more than one. 
-         */ 
-        GENERAL_NAMES_free(gen_names); 
-        gen_names = X509_get_ext_d2i(signer, NID_subject_alt_name, NULL, &idx); 
-    } 
-    GENERAL_NAMES_free(gen_names); 
- 
-    return found; 
-} 
- 
-/* Returns 1 if name is in gen_names, 0 otherwise. */ 
-static int ts_find_name(STACK_OF(GENERAL_NAME) *gen_names, GENERAL_NAME *name) 
-{ 
-    int i, found; 
-    for (i = 0, found = 0; !found && i < sk_GENERAL_NAME_num(gen_names); ++i) { 
-        GENERAL_NAME *current = sk_GENERAL_NAME_value(gen_names, i); 
-        found = GENERAL_NAME_cmp(current, name) == 0; 
-    } 
-    return found ? i - 1 : -1; 
-} 
+    *imprint = NULL;
+
+    if ((*md_alg = X509_ALGOR_dup(md_alg_resp)) == NULL)
+        goto err;
+    if ((md = EVP_get_digestbyobj((*md_alg)->algorithm)) == NULL) {
+        TSerr(TS_F_TS_COMPUTE_IMPRINT, TS_R_UNSUPPORTED_MD_ALGORITHM);
+        goto err;
+    }
+    length = EVP_MD_size(md);
+    if (length < 0)
+        goto err;
+    *imprint_len = length;
+    if ((*imprint = OPENSSL_malloc(*imprint_len)) == NULL) {
+        TSerr(TS_F_TS_COMPUTE_IMPRINT, ERR_R_MALLOC_FAILURE);
+        goto err;
+    }
+
+    md_ctx = EVP_MD_CTX_new();
+    if (md_ctx == NULL) {
+        TSerr(TS_F_TS_COMPUTE_IMPRINT, ERR_R_MALLOC_FAILURE);
+        goto err;
+    }
+    if (!EVP_DigestInit(md_ctx, md))
+        goto err;
+    while ((length = BIO_read(data, buffer, sizeof(buffer))) > 0) {
+        if (!EVP_DigestUpdate(md_ctx, buffer, length))
+            goto err;
+    }
+    if (!EVP_DigestFinal(md_ctx, *imprint, NULL))
+        goto err;
+    EVP_MD_CTX_free(md_ctx);
+
+    return 1;
+ err:
+    EVP_MD_CTX_free(md_ctx);
+    X509_ALGOR_free(*md_alg);
+    *md_alg = NULL;
+    OPENSSL_free(*imprint);
+    *imprint_len = 0;
+    *imprint = 0;
+    return 0;
+}
+
+static int ts_check_imprints(X509_ALGOR *algor_a,
+                             const unsigned char *imprint_a, unsigned len_a,
+                             TS_TST_INFO *tst_info)
+{
+    TS_MSG_IMPRINT *b = tst_info->msg_imprint;
+    X509_ALGOR *algor_b = b->hash_algo;
+    int ret = 0;
+
+    if (algor_a) {
+        if (OBJ_cmp(algor_a->algorithm, algor_b->algorithm))
+            goto err;
+
+        /* The parameter must be NULL in both. */
+        if ((algor_a->parameter
+             && ASN1_TYPE_get(algor_a->parameter) != V_ASN1_NULL)
+            || (algor_b->parameter
+                && ASN1_TYPE_get(algor_b->parameter) != V_ASN1_NULL))
+            goto err;
+    }
+
+    ret = len_a == (unsigned)ASN1_STRING_length(b->hashed_msg) &&
+        memcmp(imprint_a, ASN1_STRING_get0_data(b->hashed_msg), len_a) == 0;
+ err:
+    if (!ret)
+        TSerr(TS_F_TS_CHECK_IMPRINTS, TS_R_MESSAGE_IMPRINT_MISMATCH);
+    return ret;
+}
+
+static int ts_check_nonces(const ASN1_INTEGER *a, TS_TST_INFO *tst_info)
+{
+    const ASN1_INTEGER *b = tst_info->nonce;
+
+    if (!b) {
+        TSerr(TS_F_TS_CHECK_NONCES, TS_R_NONCE_NOT_RETURNED);
+        return 0;
+    }
+
+    /* No error if a nonce is returned without being requested. */
+    if (ASN1_INTEGER_cmp(a, b) != 0) {
+        TSerr(TS_F_TS_CHECK_NONCES, TS_R_NONCE_MISMATCH);
+        return 0;
+    }
+
+    return 1;
+}
+
+/*
+ * Check if the specified TSA name matches either the subject or one of the
+ * subject alternative names of the TSA certificate.
+ */
+static int ts_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer)
+{
+    STACK_OF(GENERAL_NAME) *gen_names = NULL;
+    int idx = -1;
+    int found = 0;
+
+    if (tsa_name->type == GEN_DIRNAME
+        && X509_name_cmp(tsa_name->d.dirn, X509_get_subject_name(signer)) == 0)
+        return 1;
+    gen_names = X509_get_ext_d2i(signer, NID_subject_alt_name, NULL, &idx);
+    while (gen_names != NULL) {
+        found = ts_find_name(gen_names, tsa_name) >= 0;
+        if (found)
+            break;
+        /*
+         * Get the next subject alternative name, although there should be no
+         * more than one.
+         */
+        GENERAL_NAMES_free(gen_names);
+        gen_names = X509_get_ext_d2i(signer, NID_subject_alt_name, NULL, &idx);
+    }
+    GENERAL_NAMES_free(gen_names);
+
+    return found;
+}
+
+/* Returns 1 if name is in gen_names, 0 otherwise. */
+static int ts_find_name(STACK_OF(GENERAL_NAME) *gen_names, GENERAL_NAME *name)
+{
+    int i, found;
+    for (i = 0, found = 0; !found && i < sk_GENERAL_NAME_num(gen_names); ++i) {
+        GENERAL_NAME *current = sk_GENERAL_NAME_value(gen_names, i);
+        found = GENERAL_NAME_cmp(current, name) == 0;
+    }
+    return found ? i - 1 : -1;
+}
diff --git a/contrib/libs/openssl/crypto/ts/ts_verify_ctx.c b/contrib/libs/openssl/crypto/ts/ts_verify_ctx.c
index 8ba282c201..32cd2f542b 100644
--- a/contrib/libs/openssl/crypto/ts/ts_verify_ctx.c
+++ b/contrib/libs/openssl/crypto/ts/ts_verify_ctx.c
@@ -1,148 +1,148 @@
-/* 
+/*
  * Copyright 2006-2021 The OpenSSL Project Authors. All Rights Reserved.
- * 
- * Licensed under the OpenSSL license (the "License").  You may not use 
- * this file except in compliance with the License.  You can obtain a copy 
- * in the file LICENSE in the source distribution or at 
- * https://www.openssl.org/source/license.html 
- */ 
- 
-#include "internal/cryptlib.h" 
-#include <openssl/objects.h> 
-#include <openssl/ts.h> 
+ *
+ * Licensed under the OpenSSL license (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#include "internal/cryptlib.h"
+#include <openssl/objects.h>
+#include <openssl/ts.h>
 #include "ts_local.h"
- 
-TS_VERIFY_CTX *TS_VERIFY_CTX_new(void) 
-{ 
-    TS_VERIFY_CTX *ctx = OPENSSL_zalloc(sizeof(*ctx)); 
- 
-    if (ctx == NULL) 
-        TSerr(TS_F_TS_VERIFY_CTX_NEW, ERR_R_MALLOC_FAILURE); 
-    return ctx; 
-} 
- 
-void TS_VERIFY_CTX_init(TS_VERIFY_CTX *ctx) 
-{ 
-    OPENSSL_assert(ctx != NULL); 
-    memset(ctx, 0, sizeof(*ctx)); 
-} 
- 
-void TS_VERIFY_CTX_free(TS_VERIFY_CTX *ctx) 
-{ 
-    if (!ctx) 
-        return; 
- 
-    TS_VERIFY_CTX_cleanup(ctx); 
-    OPENSSL_free(ctx); 
-} 
- 
-int TS_VERIFY_CTX_add_flags(TS_VERIFY_CTX *ctx, int f) 
-{ 
-    ctx->flags |= f; 
-    return ctx->flags; 
-} 
- 
-int TS_VERIFY_CTX_set_flags(TS_VERIFY_CTX *ctx, int f) 
-{ 
-    ctx->flags = f; 
-    return ctx->flags; 
-} 
- 
-BIO *TS_VERIFY_CTX_set_data(TS_VERIFY_CTX *ctx, BIO *b) 
-{ 
-    ctx->data = b; 
-    return ctx->data; 
-} 
- 
-X509_STORE *TS_VERIFY_CTX_set_store(TS_VERIFY_CTX *ctx, X509_STORE *s) 
-{ 
-    ctx->store = s; 
-    return ctx->store; 
-} 
- 
-STACK_OF(X509) *TS_VERIFY_CTS_set_certs(TS_VERIFY_CTX *ctx, 
-                                        STACK_OF(X509) *certs) 
-{ 
-    ctx->certs = certs; 
-    return ctx->certs; 
-} 
- 
-unsigned char *TS_VERIFY_CTX_set_imprint(TS_VERIFY_CTX *ctx, 
-                                         unsigned char *hexstr, long len) 
-{ 
-    ctx->imprint = hexstr; 
-    ctx->imprint_len = len; 
-    return ctx->imprint; 
-} 
- 
-void TS_VERIFY_CTX_cleanup(TS_VERIFY_CTX *ctx) 
-{ 
-    if (!ctx) 
-        return; 
- 
-    X509_STORE_free(ctx->store); 
-    sk_X509_pop_free(ctx->certs, X509_free); 
- 
-    ASN1_OBJECT_free(ctx->policy); 
- 
-    X509_ALGOR_free(ctx->md_alg); 
-    OPENSSL_free(ctx->imprint); 
- 
-    BIO_free_all(ctx->data); 
- 
-    ASN1_INTEGER_free(ctx->nonce); 
- 
-    GENERAL_NAME_free(ctx->tsa_name); 
- 
-    TS_VERIFY_CTX_init(ctx); 
-} 
- 
-TS_VERIFY_CTX *TS_REQ_to_TS_VERIFY_CTX(TS_REQ *req, TS_VERIFY_CTX *ctx) 
-{ 
-    TS_VERIFY_CTX *ret = ctx; 
-    ASN1_OBJECT *policy; 
-    TS_MSG_IMPRINT *imprint; 
-    X509_ALGOR *md_alg; 
-    ASN1_OCTET_STRING *msg; 
-    const ASN1_INTEGER *nonce; 
- 
-    OPENSSL_assert(req != NULL); 
-    if (ret) 
-        TS_VERIFY_CTX_cleanup(ret); 
-    else if ((ret = TS_VERIFY_CTX_new()) == NULL) 
-        return NULL; 
- 
-    ret->flags = TS_VFY_ALL_IMPRINT & ~(TS_VFY_TSA_NAME | TS_VFY_SIGNATURE); 
- 
-    if ((policy = req->policy_id) != NULL) { 
-        if ((ret->policy = OBJ_dup(policy)) == NULL) 
-            goto err; 
-    } else 
-        ret->flags &= ~TS_VFY_POLICY; 
- 
-    imprint = req->msg_imprint; 
-    md_alg = imprint->hash_algo; 
-    if ((ret->md_alg = X509_ALGOR_dup(md_alg)) == NULL) 
-        goto err; 
-    msg = imprint->hashed_msg; 
-    ret->imprint_len = ASN1_STRING_length(msg); 
+
+TS_VERIFY_CTX *TS_VERIFY_CTX_new(void)
+{
+    TS_VERIFY_CTX *ctx = OPENSSL_zalloc(sizeof(*ctx));
+
+    if (ctx == NULL)
+        TSerr(TS_F_TS_VERIFY_CTX_NEW, ERR_R_MALLOC_FAILURE);
+    return ctx;
+}
+
+void TS_VERIFY_CTX_init(TS_VERIFY_CTX *ctx)
+{
+    OPENSSL_assert(ctx != NULL);
+    memset(ctx, 0, sizeof(*ctx));
+}
+
+void TS_VERIFY_CTX_free(TS_VERIFY_CTX *ctx)
+{
+    if (!ctx)
+        return;
+
+    TS_VERIFY_CTX_cleanup(ctx);
+    OPENSSL_free(ctx);
+}
+
+int TS_VERIFY_CTX_add_flags(TS_VERIFY_CTX *ctx, int f)
+{
+    ctx->flags |= f;
+    return ctx->flags;
+}
+
+int TS_VERIFY_CTX_set_flags(TS_VERIFY_CTX *ctx, int f)
+{
+    ctx->flags = f;
+    return ctx->flags;
+}
+
+BIO *TS_VERIFY_CTX_set_data(TS_VERIFY_CTX *ctx, BIO *b)
+{
+    ctx->data = b;
+    return ctx->data;
+}
+
+X509_STORE *TS_VERIFY_CTX_set_store(TS_VERIFY_CTX *ctx, X509_STORE *s)
+{
+    ctx->store = s;
+    return ctx->store;
+}
+
+STACK_OF(X509) *TS_VERIFY_CTS_set_certs(TS_VERIFY_CTX *ctx,
+                                        STACK_OF(X509) *certs)
+{
+    ctx->certs = certs;
+    return ctx->certs;
+}
+
+unsigned char *TS_VERIFY_CTX_set_imprint(TS_VERIFY_CTX *ctx,
+                                         unsigned char *hexstr, long len)
+{
+    ctx->imprint = hexstr;
+    ctx->imprint_len = len;
+    return ctx->imprint;
+}
+
+void TS_VERIFY_CTX_cleanup(TS_VERIFY_CTX *ctx)
+{
+    if (!ctx)
+        return;
+
+    X509_STORE_free(ctx->store);
+    sk_X509_pop_free(ctx->certs, X509_free);
+
+    ASN1_OBJECT_free(ctx->policy);
+
+    X509_ALGOR_free(ctx->md_alg);
+    OPENSSL_free(ctx->imprint);
+
+    BIO_free_all(ctx->data);
+
+    ASN1_INTEGER_free(ctx->nonce);
+
+    GENERAL_NAME_free(ctx->tsa_name);
+
+    TS_VERIFY_CTX_init(ctx);
+}
+
+TS_VERIFY_CTX *TS_REQ_to_TS_VERIFY_CTX(TS_REQ *req, TS_VERIFY_CTX *ctx)
+{
+    TS_VERIFY_CTX *ret = ctx;
+    ASN1_OBJECT *policy;
+    TS_MSG_IMPRINT *imprint;
+    X509_ALGOR *md_alg;
+    ASN1_OCTET_STRING *msg;
+    const ASN1_INTEGER *nonce;
+
+    OPENSSL_assert(req != NULL);
+    if (ret)
+        TS_VERIFY_CTX_cleanup(ret);
+    else if ((ret = TS_VERIFY_CTX_new()) == NULL)
+        return NULL;
+
+    ret->flags = TS_VFY_ALL_IMPRINT & ~(TS_VFY_TSA_NAME | TS_VFY_SIGNATURE);
+
+    if ((policy = req->policy_id) != NULL) {
+        if ((ret->policy = OBJ_dup(policy)) == NULL)
+            goto err;
+    } else
+        ret->flags &= ~TS_VFY_POLICY;
+
+    imprint = req->msg_imprint;
+    md_alg = imprint->hash_algo;
+    if ((ret->md_alg = X509_ALGOR_dup(md_alg)) == NULL)
+        goto err;
+    msg = imprint->hashed_msg;
+    ret->imprint_len = ASN1_STRING_length(msg);
     if (ret->imprint_len <= 0)
         goto err;
-    if ((ret->imprint = OPENSSL_malloc(ret->imprint_len)) == NULL) 
-        goto err; 
-    memcpy(ret->imprint, ASN1_STRING_get0_data(msg), ret->imprint_len); 
- 
-    if ((nonce = req->nonce) != NULL) { 
-        if ((ret->nonce = ASN1_INTEGER_dup(nonce)) == NULL) 
-            goto err; 
-    } else 
-        ret->flags &= ~TS_VFY_NONCE; 
- 
-    return ret; 
- err: 
-    if (ctx) 
-        TS_VERIFY_CTX_cleanup(ctx); 
-    else 
-        TS_VERIFY_CTX_free(ret); 
-    return NULL; 
-} 
+    if ((ret->imprint = OPENSSL_malloc(ret->imprint_len)) == NULL)
+        goto err;
+    memcpy(ret->imprint, ASN1_STRING_get0_data(msg), ret->imprint_len);
+
+    if ((nonce = req->nonce) != NULL) {
+        if ((ret->nonce = ASN1_INTEGER_dup(nonce)) == NULL)
+            goto err;
+    } else
+        ret->flags &= ~TS_VFY_NONCE;
+
+    return ret;
+ err:
+    if (ctx)
+        TS_VERIFY_CTX_cleanup(ctx);
+    else
+        TS_VERIFY_CTX_free(ret);
+    return NULL;
+}