ots.c

/***
timestamp module provide basic Time Stamping Authority (TSA) client and server operations as
specified in RFC 3161 (Time-Stamp Protocol, TSP). A TSA can be part of a PKI deployment and its role
is to provide long term proof of the existence of a certain datum before a particular time.

@module ts
@usage
  ts = require'openssl'.ts
*/
#include "openssl.h"
#include "private.h"

#include <stdint.h>
#if OPENSSL_VERSION_NUMBER >= 0x10000000L
#include <openssl/asn1.h>
#include <openssl/ts.h>

/***
create a new ts_msg_imprint object.
@function ts_msg_imprint_new
@tparam string data
@tparam string|integer|asn1_object alg alg name, nid or object identity
@treturn ts_msg_imprint
*/
static int
openssl_ts_msg_imprint_new(lua_State *L)
{
  size_t        sz = 0;
  const char   *data = luaL_checklstring(L, 1, &sz);
  const EVP_MD *md = get_digest(L, 2, NULL);

  TS_MSG_IMPRINT *msg = TS_MSG_IMPRINT_new();

  int ret = TS_MSG_IMPRINT_set_msg(msg, (unsigned char *)data, sz);
  if (sz != EVP_MD_size(md)) luaL_error(L, "data size not match with digest size");

  if (ret == 1) {
    X509_ALGOR *alg = X509_ALGOR_new();
#if defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER >= 0x30900000L
    X509_ALGOR_set0(alg, OBJ_nid2obj(EVP_MD_type(md)), V_ASN1_NULL, NULL);
#else
    X509_ALGOR_set_md(alg, md);
#endif
    if (ret == 1) ret = TS_MSG_IMPRINT_set_algo(msg, alg);

    X509_ALGOR_free(alg);
    PUSH_OBJECT(msg, "openssl.ts_msg_imprint");
  } else
    ret = openssl_pushresult(L, ret);
  return ret;
}

/***
read and parse ts_msg_imprint from DER encoded data
@function ts_msg_imprint_read
@tparam string data DER encoded ts_msg_imprint data
@treturn ts_msg_imprint|nil parsed object or nil on error
*/
static int
openssl_ts_msg_imprint_read(lua_State *L)
{
  size_t               sz = 0;
  const unsigned char *data = (const unsigned char *)luaL_checklstring(L, 1, &sz);
  TS_MSG_IMPRINT      *msg = d2i_TS_MSG_IMPRINT(NULL, &data, sz);
  if (msg)
    PUSH_OBJECT(msg, "openssl.ts_msg_imprint");
  else
    lua_pushnil(L);
  return 1;
}

/***
export a ts_msg_imprint object as DER encoded data
@function export
@treturn string
*/
static int
openssl_ts_msg_imprint_export(lua_State *L)
{
  TS_MSG_IMPRINT *msg = CHECK_OBJECT(1, TS_MSG_IMPRINT, "openssl.ts_msg_imprint");
  unsigned char  *buf = NULL;
  int             len = i2d_TS_MSG_IMPRINT(msg, &buf);
  if (len >= 0) {
    lua_pushlstring(L, (const char *)buf, len);
    OPENSSL_free(buf);
    len = 1;
  } else
    len = openssl_pushresult(L, len);
  return len;
}

/***
get a ts_msg_imprint msg
@function msg
@treturn asn1_string
*/
static int
openssl_ts_msg_imprint_msg(lua_State *L)
{
  TS_MSG_IMPRINT    *msg = CHECK_OBJECT(1, TS_MSG_IMPRINT, "openssl.ts_msg_imprint");
  ASN1_OCTET_STRING *s = TS_MSG_IMPRINT_get_msg(msg);

  PUSH_ASN1_OCTET_STRING(L, s);
  return 1;
}

/***
get a ts_msg_imprint algo
@function algo
@treturn openssl.x509_algor
*/
static int
openssl_ts_msg_imprint_algo(lua_State *L)
{
  TS_MSG_IMPRINT *msg = CHECK_OBJECT(1, TS_MSG_IMPRINT, "openssl.ts_msg_imprint");
  X509_ALGOR     *a = TS_MSG_IMPRINT_get_algo(msg);

  a = X509_ALGOR_dup(a);
  PUSH_OBJECT(a, "openssl.x509_algor");
  return 1;
}

/***
get a ts_msg_imprint table contains msg and algo fields
@function totable
@treturn table
*/
static int
openssl_ts_msg_imprint_totable(lua_State *L)
{
  TS_MSG_IMPRINT *msg = CHECK_OBJECT(1, TS_MSG_IMPRINT, "openssl.ts_msg_imprint");

  ASN1_OCTET_STRING *s = TS_MSG_IMPRINT_get_msg(msg);
  X509_ALGOR        *a = TS_MSG_IMPRINT_get_algo(msg);

  lua_newtable(L);
  PUSH_ASN1_OCTET_STRING(L, s);
  lua_setfield(L, -2, "msg");

  a = X509_ALGOR_dup(a);
  PUSH_OBJECT(a, "openssl.x509_algor");
  lua_setfield(L, -2, "algo");

  return 1;
}

/***
duplicate ts_msg_imprint object
@function dup
@treturn ts_msg_imprint
*/
static int
openssl_ts_msg_imprint_dup(lua_State *L)
{
  TS_MSG_IMPRINT *msg = CHECK_OBJECT(1, TS_MSG_IMPRINT, "openssl.ts_msg_imprint");
  msg = TS_MSG_IMPRINT_dup(msg);
  PUSH_OBJECT(msg, "openssl.ts_msg_imprint");
  return 1;
}

static int
openssl_ts_msg_imprint_gc(lua_State *L)
{
  TS_MSG_IMPRINT *msg = CHECK_OBJECT(1, TS_MSG_IMPRINT, "openssl.ts_msg_imprint");
  TS_MSG_IMPRINT_free(msg);
  return 0;
}

static luaL_Reg ts_msg_imprint_funcs[] = {
  { "dup",        openssl_ts_msg_imprint_dup     },
  { "msg",        openssl_ts_msg_imprint_msg     },
  { "algo",       openssl_ts_msg_imprint_algo    },
  { "export",     openssl_ts_msg_imprint_export  },
  { "totable",    openssl_ts_msg_imprint_totable },

  { "__gc",       openssl_ts_msg_imprint_gc      },
  { "__tostring", auxiliar_tostring              },

  { NULL,         NULL                           }
};

/***
create new timestamp accuracy object
@function ts_accuracy_new
@tparam[opt] number seconds accuracy in seconds
@tparam[opt] number millis accuracy in milliseconds
@tparam[opt] number micros accuracy in microseconds
@treturn ts_accuracy new timestamp accuracy object or nil on failure
*/
static int
openssl_ts_accuracy_new(lua_State *L)
{
  int    ret;
  time_t seconds = 0;
  int    millis = 0, micros = 0;

  TS_ACCURACY  *accuracy = NULL;
  ASN1_INTEGER *sec = NULL;
  ASN1_INTEGER *mil = NULL;
  ASN1_INTEGER *mic = NULL;

  seconds = luaL_checkinteger(L, 1);
  millis = luaL_optinteger(L, 2, millis);
  micros = luaL_optinteger(L, 3, micros);

  accuracy = TS_ACCURACY_new();
  sec = ASN1_INTEGER_new();
  mil = ASN1_INTEGER_new();
  mic = ASN1_INTEGER_new();

  ret = ASN1_INTEGER_set(sec, (long)seconds);
  if (ret == 1) ret = TS_ACCURACY_set_seconds(accuracy, sec);

  if (ret == 1) {
    ret = ASN1_INTEGER_set(mil, millis);
    if (ret == 1) ret = TS_ACCURACY_set_millis(accuracy, mil);
  }

  if (ret == 1) {
    ret = ASN1_INTEGER_set(mic, micros);
    if (ret == 1) ret = TS_ACCURACY_set_micros(accuracy, mic);
  }

  if (ret == 1) {
    PUSH_OBJECT(accuracy, "openssl.ts_accuracy");
  } else {
    TS_ACCURACY_free(accuracy);
    ret = 0;
  }

  ASN1_INTEGER_free(sec);
  ASN1_INTEGER_free(mil);
  ASN1_INTEGER_free(mic);
  return ret;
}

/***
get or set accuracy in seconds
@function seconds
@tparam[opt] number seconds optional seconds value to set
@treturn number current seconds value when called without parameters
@treturn boolean true when setting value successfully
*/
static int
openssl_ts_accuracy_seconds(lua_State *L)
{
  int          ret = 0;
  TS_ACCURACY *accuracy = CHECK_OBJECT(1, TS_ACCURACY, "openssl.ts_accuracy");
  if (lua_isnone(L, 2)) {
    const ASN1_INTEGER *ai = TS_ACCURACY_get_seconds(accuracy);
    lua_pushinteger(L, ASN1_INTEGER_get(ai));
    ret = 1;
  } else {
    time_t        seconds = luaL_checkinteger(L, 2);
    ASN1_INTEGER *ai = ASN1_INTEGER_new();
    ret = ASN1_INTEGER_set(ai, (long)seconds);
    if (ret == 1) ret = TS_ACCURACY_set_seconds(accuracy, ai);
    ret = openssl_pushresult(L, ret);
    ASN1_INTEGER_free(ai);
  }
  return ret;
}

/***
get or set accuracy in milliseconds
@function millis
@tparam[opt] number millis optional milliseconds value to set
@treturn number current milliseconds value when called without parameters
@treturn boolean true when setting value successfully
*/
static int
openssl_ts_accuracy_millis(lua_State *L)
{
  int          ret = 0;
  TS_ACCURACY *accuracy = CHECK_OBJECT(1, TS_ACCURACY, "openssl.ts_accuracy");
  if (lua_isnone(L, 2)) {
    const ASN1_INTEGER *ai = TS_ACCURACY_get_millis(accuracy);
    lua_pushinteger(L, ASN1_INTEGER_get(ai));
    ret = 1;
  } else {
    int           millies = luaL_checkinteger(L, 2);
    ASN1_INTEGER *ai = ASN1_INTEGER_new();
    ret = ASN1_INTEGER_set(ai, (long)millies);
    if (ret == 1) ret = TS_ACCURACY_set_millis(accuracy, ai);
    ret = openssl_pushresult(L, ret);
    ASN1_INTEGER_free(ai);
  }
  return ret;
}

/***
get or set timestamp accuracy microseconds
@function micros
@tparam[opt] number micros microseconds value to set (if provided)
@treturn number current microseconds value (if getting)
@treturn boolean success status (if setting)
*/
static int
openssl_ts_accuracy_micros(lua_State *L)
{
  int          ret = 0;
  TS_ACCURACY *accuracy = CHECK_OBJECT(1, TS_ACCURACY, "openssl.ts_accuracy");
  if (lua_isnone(L, 2)) {
    const ASN1_INTEGER *ai = TS_ACCURACY_get_micros(accuracy);
    lua_pushinteger(L, ASN1_INTEGER_get(ai));
    ret = 1;
  } else {
    int           micros = luaL_checkinteger(L, 2);
    ASN1_INTEGER *ai = ASN1_INTEGER_new();
    ret = ASN1_INTEGER_set(ai, (long)micros);
    if (ret == 1) ret = TS_ACCURACY_set_micros(accuracy, ai);
    ret = openssl_pushresult(L, ret);
    ASN1_INTEGER_free(ai);
  }
  return ret;
}

/***
duplicate timestamp accuracy object
@function dup
@treturn ts_accuracy new duplicated ts_accuracy object
*/
static int
openssl_ts_accuracy_dup(lua_State *L)
{
  TS_ACCURACY *accuracy = CHECK_OBJECT(1, TS_ACCURACY, "openssl.ts_accuracy");
  accuracy = TS_ACCURACY_dup(accuracy);
  PUSH_OBJECT(accuracy, "openssl.ts_accuracy");
  return 1;
}

static int
openssl_ts_accuracy_gc(lua_State *L)
{
  TS_ACCURACY *accuracy = CHECK_OBJECT(1, TS_ACCURACY, "openssl.ts_accuracy");
  TS_ACCURACY_free(accuracy);
  return 0;
}

/***
export timestamp accuracy to DER encoded string
@function export
@treturn string DER encoded representation of ts_accuracy object
*/
static int
openssl_ts_accuracy_export(lua_State *L)
{
  TS_ACCURACY   *accuracy = CHECK_OBJECT(1, TS_ACCURACY, "openssl.ts_accuracy");
  unsigned char *buf = NULL;
  int            len = i2d_TS_ACCURACY(accuracy, &buf);
  if (len >= 0) {
    lua_pushlstring(L, (const char *)buf, len);
    OPENSSL_free(buf);
    len = 1;
  } else
    len = openssl_pushresult(L, len);
  return len;
}

/***
read timestamp accuracy from DER data
@function ts_accuracy_read
@tparam string data DER encoded timestamp accuracy data
@treturn ts_accuracy timestamp accuracy object or nil on failure
*/
static int
openssl_ts_accuracy_read(lua_State *L)
{
  size_t               sz = 0;
  const unsigned char *data = (const unsigned char *)luaL_checklstring(L, 1, &sz);
  TS_ACCURACY         *accuracy = d2i_TS_ACCURACY(NULL, &data, sz);
  if (accuracy)
    PUSH_OBJECT(accuracy, "openssl.ts_accuracy");
  else
    lua_pushnil(L);
  return 1;
}

/***
convert timestamp accuracy to table representation
@function totable
@treturn table accuracy information with micros, millis, and seconds fields
*/
static int
openssl_ts_accuracy_totable(lua_State *L)
{
  TS_ACCURACY *accuracy = CHECK_OBJECT(1, TS_ACCURACY, "openssl.ts_accuracy");
  lua_newtable(L);

  lua_pushinteger(L, ASN1_INTEGER_get(TS_ACCURACY_get_micros(accuracy)));
  lua_setfield(L, -2, "micros");

  lua_pushinteger(L, ASN1_INTEGER_get(TS_ACCURACY_get_millis(accuracy)));
  lua_setfield(L, -2, "millis");

  lua_pushinteger(L, ASN1_INTEGER_get(TS_ACCURACY_get_seconds(accuracy)));
  lua_setfield(L, -2, "seconds");

  return 1;
}

static luaL_Reg ts_accuracy_funcs[] = {
  { "dup",        openssl_ts_accuracy_dup     },
  { "micros",     openssl_ts_accuracy_micros  },
  { "millis",     openssl_ts_accuracy_millis  },
  { "seconds",    openssl_ts_accuracy_seconds },
  { "export",     openssl_ts_accuracy_export  },
  { "totable",    openssl_ts_accuracy_totable },

  { "__gc",       openssl_ts_accuracy_gc      },
  { "__tostring", auxiliar_tostring           },

  { NULL,         NULL                        }
};

/***
get version of ts_tst_info object object
@function version
@treturn integer
*/
static int
openssl_ts_info_version(lua_State *L)
{
  TS_TST_INFO *info = CHECK_OBJECT(1, TS_TST_INFO, "openssl.ts_tst_info");
  lua_pushinteger(L, TS_TST_INFO_get_version(info));
  return 1;
}

/***
get policy_id of ts_tst_info object object
@function policy_id
@treturn asn1_object
*/
static int
openssl_ts_info_policy_id(lua_State *L)
{
  TS_TST_INFO *info = CHECK_OBJECT(1, TS_TST_INFO, "openssl.ts_tst_info");
  openssl_push_asn1object(L, TS_TST_INFO_get_policy_id(info));
  return 1;
}

/***
get msg_imprint of ts_tst_info object object
@function msg_imprint
@treturn ts_msg_imprint
*/
static int
openssl_ts_info_msg_imprint(lua_State *L)
{
  TS_TST_INFO    *info = CHECK_OBJECT(1, TS_TST_INFO, "openssl.ts_tst_info");
  TS_MSG_IMPRINT *msg = TS_TST_INFO_get_msg_imprint(info);
  if (msg) {
    msg = TS_MSG_IMPRINT_dup(msg);
    PUSH_OBJECT(msg, "openssl.ts_msg_imprint");
  } else
    lua_pushnil(L);
  return 1;
}

/***
get serialNumber of ts_tst_info object object
@function serial
@treturn openssl.bn
*/
static int
openssl_ts_info_serial(lua_State *L)
{
  TS_TST_INFO *info = CHECK_OBJECT(1, TS_TST_INFO, "openssl.ts_tst_info");
  openssl_push_asn1integer_as_bn(L, TS_TST_INFO_get_serial(info));
  return 1;
}

/***
get time of ts_tst_info object object
@function time
@treturn asn1_time
*/
static int
openssl_ts_info_time(lua_State *L)
{
  TS_TST_INFO *info = CHECK_OBJECT(1, TS_TST_INFO, "openssl.ts_tst_info");
  openssl_push_asn1(L, TS_TST_INFO_get_time(info), V_ASN1_GENERALIZEDTIME);
  return 1;
}

/***
get accuracy of ts_tst_info object object
@function accuracy
@treturn table
*/
static int
openssl_ts_info_accuracy(lua_State *L)
{
  int          ret = 0;
  TS_TST_INFO *info = CHECK_OBJECT(1, TS_TST_INFO, "openssl.ts_tst_info");
  if (lua_isnone(L, 2)) {
    TS_ACCURACY *accuracy = TS_TST_INFO_get_accuracy(info);
    accuracy = TS_ACCURACY_dup(accuracy);
    PUSH_OBJECT(accuracy, "openssl.ts_accuracy");
    ret = 1;
  } else {
    TS_ACCURACY *accuracy = CHECK_OBJECT(2, TS_ACCURACY, "openssl.ts_accuracy");
    int          ret = TS_TST_INFO_set_accuracy(info, accuracy);
    ret = openssl_pushresult(L, ret);
  }
  return ret;
}

/***
get ordering of ts_tst_info object object
@function ording
@treturn table
*/
/***
get ordering flag from timestamp info
@function ordering
@treturn boolean true if ordering is required
*/
static int
openssl_ts_info_ordering(lua_State *L)
{
  TS_TST_INFO *info = CHECK_OBJECT(1, TS_TST_INFO, "openssl.ts_tst_info");
  lua_pushboolean(L, TS_TST_INFO_get_ordering(info));
  return 1;
}

/***
get nonce of ts_tst_info object object
@function nonce
@treturn openssl.bn
*/
static int
openssl_ts_info_nonce(lua_State *L)
{
  TS_TST_INFO *info = CHECK_OBJECT(1, TS_TST_INFO, "openssl.ts_tst_info");
  openssl_push_asn1integer_as_bn(L, TS_TST_INFO_get_nonce(info));
  return 1;
}

/***
get tsa nonce of ts_tst_info object object
@function tsa
@treturn x509.name
*/
static int
openssl_ts_info_tsa(lua_State *L)
{
  TS_TST_INFO *info = CHECK_OBJECT(1, TS_TST_INFO, "openssl.ts_tst_info");
  openssl_push_general_name(L, TS_TST_INFO_get_tsa(info));
  return 1;
}

/***
get extensions nonce of ts_tst_info object object
@function extensions
@treturn table
*/
static int
openssl_ts_info_extensions(lua_State *L)
{
  TS_TST_INFO *info = CHECK_OBJECT(1, TS_TST_INFO, "openssl.ts_tst_info");
  STACK_OF(X509_EXTENSION) *exts = TS_TST_INFO_get_exts(info);
  if (exts) {
    openssl_sk_x509_extension_totable(L, exts);
  } else
    lua_pushnil(L);
  return 1;
}

static int
openssl_ts_info_gc(lua_State *L)
{
  TS_TST_INFO *info = CHECK_OBJECT(1, TS_TST_INFO, "openssl.ts_tst_info");
  TS_TST_INFO_free(info);
  return 0;
}

static luaL_Reg ts_tst_info_funcs[] = {
  { "version",     openssl_ts_info_version     },
  { "policy_id",   openssl_ts_info_policy_id   },
  { "msg_imprint", openssl_ts_info_msg_imprint },
  { "serial",      openssl_ts_info_serial      },
  { "time",        openssl_ts_info_time        },
  { "accuracy",    openssl_ts_info_accuracy    },
  { "ordering",    openssl_ts_info_ordering    },
  { "nonce",       openssl_ts_info_nonce       },
  { "tsa",         openssl_ts_info_tsa         },
  { "extensions",  openssl_ts_info_extensions  },

  { "__gc",        openssl_ts_info_gc          },
  { "__tostring",  auxiliar_tostring           },

  { NULL,          NULL                        }
};

/***
create a new ts_req object.
@function req_new
@tparam[opt=1] integer version
@treturn openssl.ts_req timestamp sign request object
-- @see openssl/ts.h:TS_REQ_
*/
static int openssl_ts_req_new(lua_State *L)
{
  TS_REQ *ts_req = TS_REQ_new();
  long    version = luaL_optinteger(L, 1, 1);

  int ret = TS_REQ_set_version(ts_req, version);
  if (ret == 1) {
    PUSH_OBJECT(ts_req, "openssl.ts_req");
    return 1;
  }
  TS_REQ_free(ts_req);
  return 0;
}

/***
read ts_req object from string or bio data
@function req_read
@tparam string|bio input
@treturn openssl.ts_req timestamp sign request object
-- @see openssl/ts.h:TS_REQ_
*/
static int openssl_ts_req_read(lua_State *L)
{
  BIO    *in = load_bio_object(L, 1);
  TS_REQ *ts_req = d2i_TS_REQ_bio(in, NULL);
  BIO_free(in);
  if (ts_req) {
    PUSH_OBJECT(ts_req, "openssl.ts_req");
    return 1;
  }
  return 0;
}

/***
read ts_resp object from string or bio input
@function resp_read
@tparam string|bio input
@treturn openssl.ts_resp object
*/
static int openssl_ts_resp_read(lua_State *L)
{
  BIO     *in = load_bio_object(L, 1);
  TS_RESP *res = d2i_TS_RESP_bio(in, NULL);
  BIO_free(in);
  if (res) {
    PUSH_OBJECT(res, "openssl.ts_resp");
  } else
    lua_pushnil(L);
  return 1;
}

/***
create ts_resp_ctx object
@function resp_ctx_new
@tparam openssl.x509 signer timestamp certificate
@tparam openssl.evp_pkey pkey private key to sign ts_req
@tparam asn1_object|string|nid identity for default policy object
@treturn openssl.ts_resp_ctx object
*/
static int openssl_ts_resp_ctx_new(lua_State *L)
{
  TS_RESP_CTX *ctx = NULL;
  X509        *signer = NULL;
  EVP_PKEY    *pkey = NULL;
  ASN1_OBJECT *obj = NULL;
  int          ret = 1;

  luaL_argcheck(L, auxiliar_getclassudata(L, "openssl.x509", 1), 1, "need openssl.x509 object");
  luaL_argcheck(L, auxiliar_getclassudata(L, "openssl.evp_pkey", 2), 2, "need openssl.pkey object");
  luaL_argcheck(L,
                auxiliar_getclassudata(L, "openssl.asn1_object", 3) || lua_isnumber(L, 3)
                  || lua_isstring(L, 3),
                3,
                "need openssl.asn1_object, nid string or number");

  signer = CHECK_OBJECT(1, X509, "openssl.x509");
  pkey = CHECK_OBJECT(2, EVP_PKEY, "openssl.evp_pkey");
  obj = openssl_get_asn1object(L, 3, 0);

  if (signer && pkey) {
    ret = X509_check_private_key(signer, pkey);
    if (ret != 1) luaL_error(L, "signer cert and private key not match");
  }

  ctx = TS_RESP_CTX_new();
  if (ret == 1 && obj) ret = TS_RESP_CTX_set_def_policy(ctx, obj);
  if (ret == 1 && signer) ret = TS_RESP_CTX_set_signer_cert(ctx, signer);
  if (ret == 1 && pkey) ret = TS_RESP_CTX_set_signer_key(ctx, pkey);

  if (ret == 1) {
    PUSH_OBJECT(ctx, "openssl.ts_resp_ctx");
    openssl_newvalue(L, ctx);
  } else {
    TS_RESP_CTX_free(ctx);
    ctx = NULL;
    lua_pushnil(L);
  }
  if (obj) ASN1_OBJECT_free(obj);
  return 1;
}

/***
create ts_verify_ctx object
@function verify_ctx_new
@tparam[opt=nil] string|ts_req reqdata
@treturn ts_verify_ctx object
*/
static int openssl_ts_verify_ctx_new(lua_State *L)
{
  TS_VERIFY_CTX *ctx = NULL;
  if (lua_isnone(L, 1)) {
    ctx = TS_VERIFY_CTX_new();
  } else if (lua_isstring(L, 1)) {
    BIO    *bio = load_bio_object(L, 1);
    TS_REQ *req = d2i_TS_REQ_bio(bio, NULL);
    BIO_free(bio);
    if (req) {
      ctx = TS_REQ_to_TS_VERIFY_CTX(req, NULL);
      TS_REQ_free(req);
    } else {
      luaL_argerror(L, 1, "must be ts_req data or object or nil");
    }
  } else {
    TS_REQ *req = CHECK_OBJECT(1, TS_REQ, "openssl.ts_req");
    ctx = TS_REQ_to_TS_VERIFY_CTX(req, NULL);
  }
  if (ctx) {
    PUSH_OBJECT(ctx, "openssl.ts_verify_ctx");
  } else
    lua_pushnil(L);
  return 1;
}

static luaL_Reg R[] = {
  { "req_new",             openssl_ts_req_new          },
  { "req_read",            openssl_ts_req_read         },
  { "resp_read",           openssl_ts_resp_read        },
  { "ts_accuracy_read",    openssl_ts_accuracy_read    },
  { "ts_msg_imprint_read", openssl_ts_msg_imprint_read },

  { "resp_ctx_new",        openssl_ts_resp_ctx_new     },
  { "verify_ctx_new",      openssl_ts_verify_ctx_new   },
  { "ts_accuracy_new",     openssl_ts_accuracy_new     },
  { "ts_msg_imprint_new",  openssl_ts_msg_imprint_new  },

  { NULL,                  NULL                        }
};

/***
openssl.ts_req object
@type ts_req
*/
/***
make a clone of ts_req object
@function dup
@treturn openssl.ts_req
*/
static int
openssl_ts_req_dup(lua_State *L)
{
  TS_REQ *req = CHECK_OBJECT(1, TS_REQ, "openssl.ts_req");
  req = TS_REQ_dup(req);
  PUSH_OBJECT(req, "openssl.ts_req");
  return 1;
}

/***
get cert_req
@function cert_req
@treturn boolean true for set or not
*/
/***
set cert_req
@function cert_req
@tparam boolean cert_req
@treturn boolean result
*/
static int
openssl_ts_req_cert_req(lua_State *L)
{
  TS_REQ *req = CHECK_OBJECT(1, TS_REQ, "openssl.ts_req");
  if (lua_isnone(L, 2)) {
    lua_pushboolean(L, TS_REQ_get_cert_req(req));
    return 1;
  } else {
    int cert_req = auxiliar_checkboolean(L, 2);
    int ret = TS_REQ_set_cert_req(req, cert_req);
    return openssl_pushresult(L, ret);
  }
}

/***
get nonce
@function nonce
@treturn openssl.bn openssl.bn object
*/
/***
set nonce
@tparam string|bn nonce
@treturn boolean result
@function nonce
*/
static int
openssl_ts_req_nonce(lua_State *L)
{
  TS_REQ *req = CHECK_OBJECT(1, TS_REQ, "openssl.ts_req");
  if (lua_isnone(L, 2)) {
    return openssl_push_asn1integer_as_bn(L, TS_REQ_get_nonce(req));
  } else {
    BIGNUM *bn = BN_get(L, 2);
    if (bn) {
      ASN1_INTEGER *ai = BN_to_ASN1_INTEGER(bn, NULL);
      int           ret = TS_REQ_set_nonce(req, ai);
      ASN1_INTEGER_free(ai);
      BN_free(bn);
      return openssl_pushresult(L, ret);
    }
    return luaL_argerror(L, 2, "invalid openssl.bn or can't convert to openssl.bn");
  }
}

/***
get policy_id
@function policy_id
@treturn asn1_object
*/
/***
set policy_id
@function policy_id
@tparam asn1_object|number id  identity for asn1_object
@treturn boolean result
*/
static int
openssl_ts_req_policy_id(lua_State *L)
{
  TS_REQ *req = CHECK_OBJECT(1, TS_REQ, "openssl.ts_req");
  if (lua_isnone(L, 2)) {
    ASN1_OBJECT *obj = TS_REQ_get_policy_id(req);
    openssl_push_asn1object(L, obj);
    return 1;
  } else {
    ASN1_OBJECT *obj = openssl_get_asn1object(L, 2, 0);
    int          ret = TS_REQ_set_policy_id(req, obj);
    ASN1_OBJECT_free(obj);
    return openssl_pushresult(L, ret);
  }
}

/***
get version
@treturn integer
@function version
*/
/***
set version
@tparam integer version
@treturn boolean result
@function version
*/
static int
openssl_ts_req_version(lua_State *L)
{
  TS_REQ *req = CHECK_OBJECT(1, TS_REQ, "openssl.ts_req");
  if (lua_isnone(L, 2)) {
    lua_pushinteger(L, TS_REQ_get_version(req));
    return 1;
  } else {
    long v = luaL_checkinteger(L, 2);
    int  ret = TS_REQ_set_version(req, v);
    return openssl_pushresult(L, ret);
  }
}

/***
get msg_imprint
@function msg_imprint
@treturn string octet octet string
@treturn table with algorithm and paramater
*/
/***
set msg_imprint
@function msg_imprint
@tparam string data digest value of message
@tparam[opt='sha'] string|evp_md md_alg
@treturn boolean result
*/
static int
openssl_ts_req_msg_imprint(lua_State *L)
{
  TS_REQ *req = CHECK_OBJECT(1, TS_REQ, "openssl.ts_req");
  if (lua_isnone(L, 2)) {
    TS_MSG_IMPRINT *msg = TS_REQ_get_msg_imprint(req);
    if (msg) {
      msg = TS_MSG_IMPRINT_dup(msg);
      PUSH_OBJECT(msg, "openssl.ts_msg_imprint");
    } else
      lua_pushnil(L);
    return 1;
  } else {
    TS_MSG_IMPRINT *msg = CHECK_OBJECT(2, TS_MSG_IMPRINT, "openssl.ts_msg_imprint");
    int             ret = TS_REQ_set_msg_imprint(req, msg);

    return openssl_pushresult(L, ret);
  }
};

/***
create ts_verify_ctx from ts_req object
@function to_verify_ctx
@treturn ts_verify_ctx object
*/
static int openssl_ts_req_to_verify_ctx(lua_State *L)
{
  TS_REQ        *req = CHECK_OBJECT(1, TS_REQ, "openssl.ts_req");
  TS_VERIFY_CTX *ctx = TS_REQ_to_TS_VERIFY_CTX(req, NULL);
  PUSH_OBJECT(ctx, "openssl.ts_verify_ctx");
  return 1;
}

/***
export ts_req to string
@function export
@treturn string
*/
static int openssl_ts_req_export(lua_State *L)
{
  TS_REQ        *ts_req = CHECK_OBJECT(1, TS_REQ, "openssl.ts_req");
  unsigned char *data = NULL;
  int            len = i2d_TS_REQ(ts_req, &data);
  if (len > 0) {
    lua_pushlstring(L, (const char *)data, (size_t)len);
    OPENSSL_free(data);
    return 1;
  }
  return 0;
}

/***
add X509 extension to timestamp request
@function add_ext
@tparam x509_extension extension X509 extension to add
@tparam[opt] number location position to insert extension
@treturn boolean true on success, false on failure
*/
static int openssl_ts_req_add_ext(lua_State *L)
{
  TS_REQ         *ts_req = CHECK_OBJECT(1, TS_REQ, "openssl.ts_req");
  X509_EXTENSION *x = CHECK_OBJECT(2, X509_EXTENSION, "openssl.x509_extension");
  int             loc = luaL_optint(L, 3, TS_REQ_get_ext_count(ts_req));
  int             ret;

  ret = TS_REQ_add_ext(ts_req, x, loc);
  return openssl_pushresult(L, ret);
}

/***
get info as table
@function info
@treturn table
*/
static int openssl_ts_req_info(lua_State *L)
{
  TS_REQ *req = CHECK_OBJECT(1, TS_REQ, "openssl.ts_req");

  lua_newtable(L);

  lua_pushinteger(L, TS_REQ_get_version(req));
  lua_setfield(L, -2, "version");

  AUXILIAR_SET(L, -1, "cert_req", TS_REQ_get_cert_req(req), boolean);

  if (TS_REQ_get_policy_id(req)) {
    openssl_push_asn1object(L, TS_REQ_get_policy_id(req));
    lua_setfield(L, -2, "policy_id");
  }

  openssl_push_asn1integer_as_bn(L, TS_REQ_get_nonce(req));
  lua_setfield(L, -2, "nonce");

  lua_newtable(L);
  {
    TS_MSG_IMPRINT    *msg_inprint = TS_REQ_get_msg_imprint(req);
    ASN1_OCTET_STRING *os = TS_MSG_IMPRINT_get_msg(msg_inprint);
    X509_ALGOR        *alg = TS_MSG_IMPRINT_get_algo(msg_inprint);

    AUXILIAR_SETLSTR(L, -1, "hashed_msg", (const char *)ASN1_STRING_get0_data(os), ASN1_STRING_length(os));
    alg = X509_ALGOR_dup(alg);
    PUSH_OBJECT(alg, "openssl.x509_algor");
    lua_setfield(L, -2, "hash_algo");
  }
  lua_setfield(L, -2, "msg_imprint");

  if (TS_REQ_get_exts(req)) {
    lua_pushstring(L, "extensions");
    openssl_sk_x509_extension_totable(L, TS_REQ_get_exts(req));
    lua_rawset(L, -3);
  }

  return 1;
}

static int openssl_ts_req_gc(lua_State *L)
{
  TS_REQ *req = CHECK_OBJECT(1, TS_REQ, "openssl.ts_req");
  TS_REQ_free(req);
  return 0;
}

static luaL_Reg ts_req_funs[] = {
  { "dup",           openssl_ts_req_dup           },
  { "cert_req",      openssl_ts_req_cert_req      },
  { "msg_imprint",   openssl_ts_req_msg_imprint   },
  { "nonce",         openssl_ts_req_nonce         },
  { "policy_id",     openssl_ts_req_policy_id     },
  { "version",       openssl_ts_req_version       },
  { "info",          openssl_ts_req_info          },
  { "export",        openssl_ts_req_export        },
  { "add_ext",       openssl_ts_req_add_ext       },

  { "to_verify_ctx", openssl_ts_req_to_verify_ctx },

  { "__tostring",    auxiliar_tostring            },
  { "__gc",          openssl_ts_req_gc            },

  { NULL,            NULL                         }
};

/***
openssl.ts_resp object
@type ts_resp
*/
static int openssl_ts_resp_gc(lua_State *L)
{
  TS_RESP *res = CHECK_OBJECT(1, TS_RESP, "openssl.ts_resp");
  TS_RESP_free(res);
  return 0;
}

/***
duplicate ts_resp object
@function dup
@treturn openssl.ts_resp object
*/
static int openssl_ts_resp_dup(lua_State *L)
{
  TS_RESP *res = CHECK_OBJECT(1, TS_RESP, "openssl.ts_resp");
  res = TS_RESP_dup(res);
  PUSH_OBJECT(res, "openssl.ts_resp");
  return 1;
}

/***
export ts_resp to string
@function export
@treturn string
*/
static int openssl_ts_resp_export(lua_State *L)
{
  int      ret = 0;
  TS_RESP *res = CHECK_OBJECT(1, TS_RESP, "openssl.ts_resp");
  BIO     *bio = BIO_new(BIO_s_mem());
  if (i2d_TS_RESP_bio(bio, res)) {
    char *bio_mem_ptr = NULL;
    long bio_mem_len = BIO_get_mem_data(bio, &bio_mem_ptr);
    lua_pushlstring(L, bio_mem_ptr, bio_mem_len);
    ret = 1;
  }
  BIO_free(bio);
  return ret;
}

/***
get tst_info as table or tst_info filed value
@function tst_info
@tparam[opt] string field
@return tst_info table or feild value
*/
static int openssl_ts_resp_tst_info(lua_State *L)
{
  TS_RESP     *resp = CHECK_OBJECT(1, TS_RESP, "openssl.ts_resp");
  TS_TST_INFO *info = TS_RESP_get_tst_info(resp);

  if (info) {
    info = TS_TST_INFO_dup(info);
    PUSH_OBJECT(info, "openssl.ts_tst_info");
  } else
    lua_pushnil(L);

  return 1;
}

/***
get status_info as table
@function status_info
@treturn table
*/
static int openssl_ts_resp_status_info(lua_State *L)
{
  TS_RESP        *res = CHECK_OBJECT(1, TS_RESP, "openssl.ts_resp");
  TS_STATUS_INFO *si = TS_RESP_get_status_info(res);
  const STACK_OF(ASN1_UTF8STRING) *sk = TS_STATUS_INFO_get0_text(si);
  const ASN1_BIT_STRING *failure_info = TS_STATUS_INFO_get0_failure_info(si);

  lua_newtable(L);

  openssl_push_asn1integer_as_bn(L, TS_STATUS_INFO_get0_status(si));
  lua_setfield(L, -2, "status");

  if (failure_info) {
    openssl_push_asn1(L, failure_info, V_ASN1_BIT_STRING);
    lua_setfield(L, -2, "failure_info");
  }

  if (sk) {
    int i = 0, n = 0;
    n = sk_ASN1_UTF8STRING_num(sk);
    for (i = 0; i < n; i++) {
      ASN1_UTF8STRING *x = sk_ASN1_UTF8STRING_value(sk, i);
      lua_pushlstring(L, (const char *)ASN1_STRING_get0_data(x), ASN1_STRING_length(x));
      lua_rawseti(L, -2, i + 1);
    }
  }

  return 1;
}

/***
get pkcs7 token of ts_tst_info
@function token
@treturn token
*/
static int
openssl_ts_resp_token(lua_State *L)
{
  TS_RESP *res = CHECK_OBJECT(1, TS_RESP, "openssl.ts_resp");
  PKCS7   *token = TS_RESP_get_token(res);
  if (token) {
    token = PKCS7_dup(token);
    PUSH_OBJECT(token, "openssl.pkcs7");
  } else
    lua_pushnil(L);
  return 1;
}

static luaL_Reg ts_resp_funs[] = {
  { "dup",         openssl_ts_resp_dup         },
  { "export",      openssl_ts_resp_export      },
  { "status_info", openssl_ts_resp_status_info },
  { "token",       openssl_ts_resp_token       },
  { "tst_info",    openssl_ts_resp_tst_info    },

  { "__tostring",  auxiliar_tostring           },
  { "__gc",        openssl_ts_resp_gc          },

  { NULL,          NULL                        }
};

/* ts_resp_ctx object */
/***
openssl.ts_resp_ctx object
@type ts_resp_ctx
*/
/***
create response for ts_req
@function create_response
@tparam string|bio|ts_req data support string,bio ts_req content or ts_req object
@treturn openssl.ts_resp result
*/
/***
sign ts_req and get ts_resp, alias of create_response
@function sign
@tparam string|bio|ts_req data support string,bio ts_req content or ts_req object
@treturn openssl.ts_resp result
*/
static int openssl_ts_create_response(lua_State *L)
{
  TS_RESP_CTX *ctx = CHECK_OBJECT(1, TS_RESP_CTX, "openssl.ts_resp_ctx");
  BIO         *bio = load_bio_object(L, 2);
  TS_RESP     *resp = TS_RESP_create_response(ctx, bio);
  if (resp) {
    PUSH_OBJECT(resp, "openssl.ts_resp");
  } else
    lua_pushnil(L);
  BIO_free(bio);

  return 1;
}

/***
get signer cert and pkey
@function signer
@treturn openssl.x509 cert object or nil
@treturn openssl.evp_pkey pkey object or nil
*/
/***
set signer cert and pkey
@function signer
@tparam openssl.x509 cert signer cert
@tparam openssl.evp_pkey pkey signer pkey
@treturn boolean result
*/
static int openssl_ts_resp_ctx_signer(lua_State *L)
{
  TS_RESP_CTX *ctx = CHECK_OBJECT(1, TS_RESP_CTX, "openssl.ts_resp_ctx");
  X509        *signer = CHECK_OBJECT(2, X509, "openssl.x509");
  EVP_PKEY    *pkey = CHECK_OBJECT(3, EVP_PKEY, "openssl.evp_pkey");
  int          ret = X509_check_private_key(signer, pkey);
  if (ret != 1) {
    luaL_error(L, "signer cert and private key not match");
  }
  if (ret == 1) ret = TS_RESP_CTX_set_signer_cert(ctx, signer);
  if (ret == 1) ret = TS_RESP_CTX_set_signer_key(ctx, pkey);
  return openssl_pushresult(L, ret);
}

/***
set additional certs
@function certs
@tparam table certs array of certificates
@treturn boolean success
*/
static int openssl_ts_resp_ctx_certs(lua_State *L)
{
  int          ret;
  TS_RESP_CTX *ctx = CHECK_OBJECT(1, TS_RESP_CTX, "openssl.ts_resp_ctx");
  STACK_OF(X509) *certs = openssl_sk_x509_fromtable(L, 2);
  ret = TS_RESP_CTX_set_certs(ctx, certs);
  sk_X509_pop_free(certs, X509_free);
  return openssl_pushresult(L, ret);
}

/***
set default policy
@function default_policy
@tparam asn1_object|integer|string policy
@treturn boolean success
*/
static int openssl_ts_resp_ctx_default_policy(lua_State *L)
{
  TS_RESP_CTX *ctx = CHECK_OBJECT(1, TS_RESP_CTX, "openssl.ts_resp_ctx");
  ASN1_OBJECT *obj = openssl_get_asn1object(L, 2, 0);
  int          ret = TS_RESP_CTX_set_def_policy(ctx, obj);
  ASN1_OBJECT_free(obj);
  return openssl_pushresult(L, ret);
}

/***
set policies
@function policies
@tparam asn1_object|integer|string|stack_of_asn1_object|table policies
@treturn boolean success
*/
static int openssl_ts_resp_ctx_policies(lua_State *L)
{
  TS_RESP_CTX *ctx = CHECK_OBJECT(1, TS_RESP_CTX, "openssl.ts_resp_ctx");
  ASN1_OBJECT *obj = NULL;
  int          ret = 1;
  int          i;
  int          n = lua_gettop(L);
  luaL_argcheck(L, n > 1, 2, "need one or more asn1_object");
  for (i = 2; i <= n && ret == 1; i++) {
    if (lua_istable(L, i)) {
      int j, k;
      k = lua_rawlen(L, i);
      for (j = 1; j <= k && ret == 1; j++) {
        lua_rawgeti(L, i, j);
        obj = openssl_get_asn1object(L, -1, 0);
        lua_pop(L, 1);

        ret = TS_RESP_CTX_add_policy(ctx, obj);
        ASN1_OBJECT_free(obj);
      }
    } else {
      obj = openssl_get_asn1object(L, i, 0);
      ret = TS_RESP_CTX_add_policy(ctx, obj);
      ASN1_OBJECT_free(obj);
    }
  }
  return openssl_pushresult(L, ret);
}

/***
get accuracy
@function accuracy
@treturn integer seconds
@treturn integer millis
@treturn integer micros
*/
/***
set accuracy
@function accuracy
@tparam integer seconds
@tparam integer millis
@tparam integer micros
@treturn boolean result
*/
static int openssl_ts_resp_ctx_accuracy(lua_State *L)
{
  TS_RESP_CTX *ctx = CHECK_OBJECT(1, TS_RESP_CTX, "openssl.ts_resp_ctx");
  int          seconds = luaL_checkint(L, 2);
  int          millis = luaL_checkint(L, 3);
  int          micros = luaL_checkint(L, 4);
  int          ret = TS_RESP_CTX_set_accuracy(ctx, seconds, millis, micros);
  return openssl_pushresult(L, ret);
}

/***
get clock_precision_digits
@function clock_precision_digits
@treturn integer clock_precision_digits
*/
/***
set clock_precision_digits
@function clock_precision_digits
@tparam integer clock_precision_digits
@treturn boolean result
*/
static int openssl_ts_resp_ctx_clock_precision_digits(lua_State *L)
{
  TS_RESP_CTX *ctx = CHECK_OBJECT(1, TS_RESP_CTX, "openssl.ts_resp_ctx");
  int          ret;
  int          clock_precision_digits = luaL_checkint(L, 2);
  if (clock_precision_digits > TS_MAX_CLOCK_PRECISION_DIGITS)
    clock_precision_digits = TS_MAX_CLOCK_PRECISION_DIGITS;
  if (clock_precision_digits < 0) clock_precision_digits = 0;
  ret = TS_RESP_CTX_set_clock_precision_digits(ctx, clock_precision_digits);
  return openssl_pushresult(L, ret);
}

/***
add flags to TS response context
@function add_flags
@tparam number flags flags to add
@treturn nil always returns nil
*/
static int openssl_ts_resp_ctx_add_flags(lua_State *L)
{
  TS_RESP_CTX *ctx = CHECK_OBJECT(1, TS_RESP_CTX, "openssl.ts_resp_ctx");
  int          flags = luaL_checkint(L, 2);
  TS_RESP_CTX_add_flags(ctx, flags);
  return 0;
}

/***
set support digest method
@function md
@tparam table mds support digest method
@treturn boolean result
*/
/***
add digest
@function md
@tparam string|evp_digest md_alg
@treturn boolean result
*/
static int openssl_ts_resp_ctx_md(lua_State *L)
{
  TS_RESP_CTX *ctx = CHECK_OBJECT(1, TS_RESP_CTX, "openssl.ts_resp_ctx");
  if (lua_istable(L, 2)) {
    int i;
    int n = lua_rawlen(L, 2);
    int ret = 1;
    for (i = 1; ret == 1 && i <= n; i++) {
      const EVP_MD *md;
      lua_rawgeti(L, 2, i);
      md = get_digest(L, -1, NULL);
      lua_pop(L, 1);
      if (md) {
        ret = TS_RESP_CTX_add_md(ctx, md);
      } else {
        lua_pushfstring(L, "#%d not valid evp_digest object or id", i);
        luaL_argcheck(L, md, 2, lua_tostring(L, -1));
        lua_pop(L, 1);
      }
    }
    return openssl_pushresult(L, ret);
  } else {
    const EVP_MD *md = get_digest(L, 2, NULL);
    int           ret = TS_RESP_CTX_add_md(ctx, md);
    return openssl_pushresult(L, ret);
  }
}

/***
get tst_info as table
@function tst_info
@tparam[opt] string field
@return tst_info table or feild value
*/
static int openssl_ts_resp_ctx_tst_info(lua_State *L)
{
  TS_RESP_CTX *ctx = CHECK_OBJECT(1, TS_RESP_CTX, "openssl.ts_resp_ctx");
  TS_TST_INFO *info = TS_RESP_CTX_get_tst_info(ctx);

  if (info) {
    info = TS_TST_INFO_dup(info);
    PUSH_OBJECT(info, "openssl.ts_tst_info");
  } else
    lua_pushnil(L);

  return 1;
}

/***
get ts_req object
@function request
@treturn rs_req
*/
static int openssl_ts_resp_ctx_request(lua_State *L)
{
  TS_RESP_CTX *ctx = CHECK_OBJECT(1, TS_RESP_CTX, "openssl.ts_resp_ctx");
  TS_REQ      *req = TS_RESP_CTX_get_request(ctx);
  if (req) {
    PUSH_OBJECT(req, "openssl.ts_req");
  } else
    lua_pushnil(L);
  return 1;
}

typedef struct
{
  int callback;
  int cb_arg;
} TS_CB_ARG;

static const char *time_cb_key = "time_cb_key";
static const char *serial_cb_key = "serial_cb_key";

static ASN1_INTEGER *
openssl_serial_cb(TS_RESP_CTX *ctx, void *data)
{
  int        err;
  TS_CB_ARG *arg;
  lua_State *L = data;

  openssl_valueget(L, ctx, serial_cb_key);
  if (!lua_isuserdata(L, -1)) {
    TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, "Error during serial number generation.");
    TS_RESP_CTX_add_failure_info(ctx, TS_INFO_ADD_INFO_NOT_AVAILABLE);

    lua_pop(L, 1);
    return NULL;
  }
  arg = lua_touserdata(L, -1);
  lua_pop(L, 1); /* remove openssl_valueget returned value */

  lua_rawgeti(L, LUA_REGISTRYINDEX, arg->callback);
  lua_rawgeti(L, LUA_REGISTRYINDEX, arg->cb_arg);
  err = lua_pcall(L, 1, 1, 0);
  if (err == 0) {
    ASN1_INTEGER *ai = NULL;
    BIGNUM       *bn = BN_get(L, -1);
    lua_pop(L, 1); /* remove callback returned value */
    if (bn) {
      ai = BN_to_ASN1_INTEGER(bn, NULL);
      BN_free(bn);
    }
    if (ai == NULL) {
      TS_RESP_CTX_set_status_info(
        ctx, TS_STATUS_REJECTION, "Error during serial number generation.");
      TS_RESP_CTX_add_failure_info(ctx, TS_INFO_ADD_INFO_NOT_AVAILABLE);
      luaL_error(L, "Error during serial number generation.");
    }
    return ai;
  } else {
    lua_error(L);
  }
  return NULL;
};

/***
set serial generate callback function
@function set_serial_cb
@tparam function serial_cb serial_cb with proto funciont(ts_resp_ctx, arg) return openssl.bn end
@tparam[opt] table arg optional argument passed to callback
@treturn nil always returns nil
@usage
  function serial_cb(tsa,arg)
    local bn = ...
    return bn
  end
  local arg = {}
  ts_resp_ctx:set_serial_cb(serial_cb, arg)
*/
static int openssl_ts_resp_ctx_set_serial_cb(lua_State *L)
{
  TS_RESP_CTX *ctx = CHECK_OBJECT(1, TS_RESP_CTX, "openssl.ts_resp_ctx");
  TS_CB_ARG   *arg = NULL;
  int          top = lua_gettop(L);

  luaL_checktype(L, 2, LUA_TFUNCTION);
  arg = (TS_CB_ARG *)lua_newuserdata(L, sizeof(TS_CB_ARG));

  lua_pushvalue(L, 2);
  arg->callback = luaL_ref(L, LUA_REGISTRYINDEX);
  if (top > 2)
    lua_pushvalue(L, 3);
  else
    lua_pushnil(L);
  arg->cb_arg = luaL_ref(L, LUA_REGISTRYINDEX);

  openssl_valueset(L, ctx, serial_cb_key);
  TS_RESP_CTX_set_serial_cb(ctx, openssl_serial_cb, openssl_mainthread(L));
  return 0;
};

static int
openssl_time_cb(TS_RESP_CTX *ctx, void *data, time_t *sec, long *usec)
{
  int        err;
  TS_CB_ARG *arg;
  lua_State *L = data;

  openssl_valueget(L, ctx, time_cb_key);
  if (!lua_isuserdata(L, -1)) {
    TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, "could not get current time");
    lua_pop(L, 1); /* remove openssl_valueget returned value */
    return 0;
  }
  arg = lua_touserdata(L, -1);
  lua_pop(L, 1); /* remove openssl_valueget returned value */

  lua_rawgeti(L, LUA_REGISTRYINDEX, arg->callback);
  lua_rawgeti(L, LUA_REGISTRYINDEX, arg->cb_arg);
  err = lua_pcall(L, 1, 2, 0);
  if (err == 0) {
    if (lua_isnumber(L, -2)) {
      *sec = (time_t)luaL_checkinteger(L, -2);
      *usec = (long)luaL_optinteger(L, -1, 0);
      lua_pop(L, 2); /* remove callback returned value */
      return 1;
    }
    lua_pop(L, 2); /* remove callback returned value */

    TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION, "could not get current time");
    return 0;
  } else {
    lua_error(L);
  }
  return 0;
}

/***
set time callback function
@function set_time_cb
@tparam function time_cb serial_cb with proto funciont(ts_resp_ctx, arg) return sec, usec end
@tparam[opt] table arg optional argument passed to callback
@treturn nil always returns nil
@usage
  function time_cb(tsa,arg)
    local time = os.time()
    local utime = nil
    return time,utime
  end
  local arg = {}
  ts_resp_ctx:set_time_cb(time_cb, arg)
*/
static int openssl_ts_resp_ctx_set_time_cb(lua_State *L)
{
  TS_RESP_CTX *ctx = CHECK_OBJECT(1, TS_RESP_CTX, "openssl.ts_resp_ctx");
  TS_CB_ARG   *arg = NULL;
  int          top = lua_gettop(L);
  luaL_checktype(L, 2, LUA_TFUNCTION);
  arg = (TS_CB_ARG *)lua_newuserdata(L, sizeof(TS_CB_ARG));

  lua_pushvalue(L, 2);
  arg->callback = luaL_ref(L, LUA_REGISTRYINDEX);
  if (top > 2)
    lua_pushvalue(L, 3);
  else
    lua_pushnil(L);
  arg->cb_arg = luaL_ref(L, LUA_REGISTRYINDEX);

  openssl_valueset(L, ctx, time_cb_key);
#if defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x3060000fL
  ctx->time_cb = openssl_time_cb;
  ctx->time_cb_data = L;
#else
  TS_RESP_CTX_set_time_cb(ctx, openssl_time_cb, openssl_mainthread(L));
#endif
  return 0;
}

static int openssl_ts_resp_ctx_gc(lua_State *L)
{
  TS_RESP_CTX *ctx = CHECK_OBJECT(1, TS_RESP_CTX, "openssl.ts_resp_ctx");
  openssl_valueget(L, ctx, time_cb_key);
  if (lua_isuserdata(L, -1)) {
    TS_CB_ARG *arg = lua_touserdata(L, -1);
    luaL_unref(L, LUA_REGISTRYINDEX, arg->callback);
    luaL_unref(L, LUA_REGISTRYINDEX, arg->cb_arg);
  }
  lua_pop(L, 1);
  openssl_valueget(L, ctx, serial_cb_key);
  if (lua_isuserdata(L, -1)) {
    TS_CB_ARG *arg = lua_touserdata(L, -1);
    luaL_unref(L, LUA_REGISTRYINDEX, arg->callback);
    luaL_unref(L, LUA_REGISTRYINDEX, arg->cb_arg);
  }
  lua_pop(L, 1);
  openssl_freevalue(L, ctx);
  TS_RESP_CTX_free(ctx);
  return 0;
}

static luaL_Reg ts_resp_ctx_funs[] = {
  /* get and set */
  { "signer",                 openssl_ts_resp_ctx_signer                 },
  { "certs",                  openssl_ts_resp_ctx_certs                  },
  { "default_policy",         openssl_ts_resp_ctx_default_policy         },
  { "policies",               openssl_ts_resp_ctx_policies               },
  { "accuracy",               openssl_ts_resp_ctx_accuracy               },
  { "clock_precision_digits", openssl_ts_resp_ctx_clock_precision_digits },
  { "md",                     openssl_ts_resp_ctx_md                     },
  { "add_flags",              openssl_ts_resp_ctx_add_flags              },

  /* set */
  { "set_serial_cb",          openssl_ts_resp_ctx_set_serial_cb          },
  { "set_time_cb",            openssl_ts_resp_ctx_set_time_cb            },

  /* get */
  { "request",                openssl_ts_resp_ctx_request                },
  { "tst_info",               openssl_ts_resp_ctx_tst_info               },

  { "sign",                   openssl_ts_create_response                 },
  { "create_response",        openssl_ts_create_response                 },

  { "__tostring",             auxiliar_tostring                          },
  { "__gc",                   openssl_ts_resp_ctx_gc                     },

  { NULL,                     NULL                                       }
};

/* ts_verify_ctx object */

/***
openssl.ts_verify_ctx object
@type ts_verify_ctx
*/
/***
get x509_store cacerts
@function store
@treturn stack_of_x509
*/
/***
set x509_store cacerts
@tparam x509_store cacerts
@treturn boolean result
@function store
*/
static int
openssl_ts_verify_ctx_store(lua_State *L)
{
  TS_VERIFY_CTX *ctx = CHECK_OBJECT(1, TS_VERIFY_CTX, "openssl.ts_verify_ctx");
  X509_STORE    *store = CHECK_OBJECT(2, X509_STORE, "openssl.x509_store");
  X509_STORE_up_ref(store);
#if OPENSSL_VERSION_NUMBER >= 0x30400000L && !defined(LIBRESSL_VERSION_NUMBER)
  /* Use TS_VERIFY_CTX_set0_store for OpenSSL 3.4+ (clear semantics) */
  TS_VERIFY_CTX_set0_store(ctx, store);
#else
  TS_VERIFY_CTX_set_store(ctx, store);
#endif
  return 0;
}

/***
set or add flags
@function flags
@tparam integer flags
@tparam[opt=nil] boolean add or set flags, default to do set
@treturn integer return current value
*/
static int
openssl_ts_verify_ctx_flags(lua_State *L)
{
  TS_VERIFY_CTX *ctx = CHECK_OBJECT(1, TS_VERIFY_CTX, "openssl.ts_verify_ctx");
  int            flags = luaL_checkint(L, 2);
  int            add = lua_isnone(L, 3) ? 0 : lua_toboolean(L, 3);
  if (add)
    flags = TS_VERIFY_CTX_add_flags(ctx, flags);
  else
    flags = TS_VERIFY_CTX_set_flags(ctx, flags);
  lua_pushinteger(L, flags);
  return 1;
}

/***
set data
@function data
@tparam openssl.bio data object
@treturn boolean result
*/
static int
openssl_ts_verify_ctx_data(lua_State *L)
{
  TS_VERIFY_CTX *ctx = CHECK_OBJECT(1, TS_VERIFY_CTX, "openssl.ts_verify_ctx");
  BIO           *bio = load_bio_object(L, 2);
#if OPENSSL_VERSION_NUMBER >= 0x30400000L && !defined(LIBRESSL_VERSION_NUMBER)
  /* Use TS_VERIFY_CTX_set0_data for OpenSSL 3.4+ (clear semantics) */
  TS_VERIFY_CTX_set0_data(ctx, bio);
#else
  TS_VERIFY_CTX_set_data(ctx, bio);
#endif
  return 0;
}

/***
get imprint
@function imprint
@treturn string imprint
*/
/***
set imprint
@function imprint
@tparam string imprint
@treturn boolean result
*/
static int
openssl_ts_verify_ctx_imprint(lua_State *L)
{
  TS_VERIFY_CTX *ctx = CHECK_OBJECT(1, TS_VERIFY_CTX, "openssl.ts_verify_ctx");
  size_t         imprint_len;
  const char    *imprint = luaL_checklstring(L, 2, &imprint_len);
  unsigned char *to = OPENSSL_malloc(imprint_len);
  memcpy(to, imprint, imprint_len);
#if OPENSSL_VERSION_NUMBER >= 0x30400000L && !defined(LIBRESSL_VERSION_NUMBER)
  /* Use TS_VERIFY_CTX_set0_imprint for OpenSSL 3.4+ (clear semantics) */
  TS_VERIFY_CTX_set0_imprint(ctx, to, imprint_len);
#else
  TS_VERIFY_CTX_set_imprint(ctx, to, imprint_len);
#endif
  return 0;
}

static int openssl_ts_verify_ctx_gc(lua_State *L)
{
  TS_VERIFY_CTX *ctx = CHECK_OBJECT(1, TS_VERIFY_CTX, "openssl.ts_verify_ctx");
#if OPENSSL_VERSION_NUMBER < 0x10100000L                                                           \
  || (defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x3050000fL)
  if (ctx->store != NULL && ctx->store->references > 1)
    CRYPTO_add(&ctx->store->references, -1, CRYPTO_LOCK_X509_STORE);
  ctx->store = NULL;
#endif
  TS_VERIFY_CTX_cleanup(ctx);
  TS_VERIFY_CTX_free(ctx);
  return 0;
}

/***
verify ts_resp object, pkcs7 token or ts_resp data
@function verify
@tparam ts_resp|pkcs7|string data
@treturn boolean result
*/
static int openssl_ts_verify_ctx_verify(lua_State *L)
{
  TS_VERIFY_CTX *ctx = CHECK_OBJECT(1, TS_VERIFY_CTX, "openssl.ts_verify_ctx");
  int            ret = 0;
  if (auxiliar_getclassudata(L, "openssl.ts_resp", 2)) {
    TS_RESP *response = CHECK_OBJECT(2, TS_RESP, "openssl.ts_resp");
    ret = TS_RESP_verify_response(ctx, response);
  } else if (auxiliar_getclassudata(L, "openssl.pkcs7", 2)) {
    PKCS7 *token = CHECK_OBJECT(2, PKCS7, "openssl.pkcs7");
    ret = TS_RESP_verify_token(ctx, token);
  } else if (lua_isstring(L, 2)) {
    size_t               size;
    const unsigned char *data = (const unsigned char *)lua_tolstring(L, 2, &size);
    TS_RESP             *resp = d2i_TS_RESP(NULL, &data, size);
    if (resp) {
      ret = TS_RESP_verify_response(ctx, resp);
      TS_RESP_free(resp);
    } else
      luaL_argerror(L, 2, "data is not ts_resp object");
  } else {
    luaL_argerror(L, 2, "must be ts_resp or pkcs7 object");
  }
  return openssl_pushresult(L, ret);
}

static luaL_Reg ts_verify_ctx_funs[] = {
  { "store",      openssl_ts_verify_ctx_store   },
  { "flags",      openssl_ts_verify_ctx_flags   },
  { "verify",     openssl_ts_verify_ctx_verify  },
  { "data",       openssl_ts_verify_ctx_data    },
  { "imprint",    openssl_ts_verify_ctx_imprint },

  { "__tostring", auxiliar_tostring             },
  { "__gc",       openssl_ts_verify_ctx_gc      },

  { NULL,         NULL                          }
};
#endif

static LuaL_Enumeration ots_const[] = {
  { "STATUS_GRANTED",                 TS_STATUS_GRANTED                 },
  { "STATUS_GRANTED_WITH_MODS",       TS_STATUS_GRANTED_WITH_MODS       },
  { "STATUS_REJECTION",               TS_STATUS_REJECTION               },
  { "STATUS_WAITING",                 TS_STATUS_WAITING                 },
  { "STATUS_REVOCATION_WARNIN",       TS_STATUS_REVOCATION_WARNING      },
  { "STATUS_REVOCATION_NOTIFICATION", TS_STATUS_REVOCATION_NOTIFICATION },

  { "INFO_BAD_ALG",                   TS_INFO_BAD_ALG                   },
  { "INFO_BAD_REQUEST",               TS_INFO_BAD_REQUEST               },
  { "INFO_BAD_DATA_FORMA",            TS_INFO_BAD_DATA_FORMAT           },
  { "INFO_TIME_NOT_AVAILABL",         TS_INFO_TIME_NOT_AVAILABLE        },
  { "INFO_UNACCEPTED_POLICY",         TS_INFO_UNACCEPTED_POLICY         },
  { "INFO_UNACCEPTED_EXTENSION",      TS_INFO_UNACCEPTED_EXTENSION      },
  { "INFO_ADD_INFO_NOT_AVAILABL",     TS_INFO_ADD_INFO_NOT_AVAILABLE    },
  { "INFO_SYSTEM_FAILUR",             TS_INFO_SYSTEM_FAILURE            },

  { "VFY_SIGNATURE",                  TS_VFY_SIGNATURE                  },
  { "VFY_VERSION",                    TS_VFY_VERSION                    },
  { "VFY_POLICY",                     TS_VFY_POLICY                     },
  { "VFY_IMPRINT",                    TS_VFY_IMPRINT                    },
  { "VFY_DATA",                       TS_VFY_DATA                       },
  { "VFY_NONCE",                      TS_VFY_NONCE                      },
  { "VFY_SIGNER",                     TS_VFY_SIGNER                     },
  { "VFY_TSA_NAME",                   TS_VFY_TSA_NAME                   },
  { "VFY_ALL_IMPRINT",                TS_VFY_ALL_IMPRINT                },
  { "VFY_ALL_DATA",                   TS_VFY_ALL_DATA                   },

  { NULL,                             0                                 }
};

int
luaopen_ts(lua_State *L)
{
#if OPENSSL_VERSION_NUMBER >= 0x10000000L
  auxiliar_newclass(L, "openssl.ts_req", ts_req_funs);
  auxiliar_newclass(L, "openssl.ts_resp", ts_resp_funs);
  auxiliar_newclass(L, "openssl.ts_resp_ctx", ts_resp_ctx_funs);
  auxiliar_newclass(L, "openssl.ts_verify_ctx", ts_verify_ctx_funs);
  auxiliar_newclass(L, "openssl.ts_tst_info", ts_tst_info_funcs);
  auxiliar_newclass(L, "openssl.ts_accuracy", ts_accuracy_funcs);
  auxiliar_newclass(L, "openssl.ts_msg_imprint", ts_msg_imprint_funcs);

  lua_newtable(L);
  luaL_setfuncs(L, R, 0);

  auxiliar_enumerate(L, -1, ots_const);
#else
  lua_pushnil(L);
#endif
  return 1;
}