Remove X509_PUBKEY lock.

[openssl.git] / crypto / ct / ct_locl.h

diff --git a/crypto/ct/ct_locl.h b/crypto/ct/ct_locl.h
index eb1d377b4ac7c939e73c68fac10243d1074ef5ef..b1a65d626277c11b5e40ad9334e3598855759f91 100644 (file)
--- a/crypto/ct/ct_locl.h
+++ b/crypto/ct/ct_locl.h
@@ -50,15 +50,11 @@
  * ====================================================================
  */
 
-#ifdef OPENSSL_NO_CT
-# error CT is disabled.
-#endif
-
 #include <stddef.h>
-
 #include <openssl/ct.h>
 #include <openssl/evp.h>
 #include <openssl/x509.h>
+#include <openssl/x509v3.h>
 #include <openssl/safestack.h>
 
 /*
@@ -125,8 +121,6 @@ struct sct_st {
     ct_log_entry_type_t entry_type;
     /* Where this SCT was found, e.g. certificate, OCSP response, etc. */
     sct_source_t source;
-    /* The CT log that produced this SCT. */
-    CTLOG *log;
     /* The result of the last attempt to validate this SCT. */
     sct_validation_status_t validation_status;
 };
@@ -154,8 +148,6 @@ struct ct_policy_eval_ctx_st {
     X509 *cert;
     X509 *issuer;
     CTLOG_STORE *log_store;
-    STACK_OF(SCT) *good_scts;
-    STACK_OF(SCT) *bad_scts;
 };
 
 /*
@@ -168,14 +160,18 @@ SCT_CTX *SCT_CTX_new(void);
 void SCT_CTX_free(SCT_CTX *sctx);
 
 /*
- * Sets the certificate that the SCT is being verified against.
- * This will fail if the certificate is invalid.
+ * Sets the certificate that the SCT was created for.
+ * If *cert does not have a poison extension, presigner must be NULL.
+ * If *cert does not have a poison extension, it may have a single SCT
+ * (NID_ct_precert_scts) extension.
+ * If either *cert or *presigner have an AKID (NID_authority_key_identifier)
+ * extension, both must have one.
  * Returns 1 on success, 0 on failure.
  */
 __owur int SCT_CTX_set1_cert(SCT_CTX *sctx, X509 *cert, X509 *presigner);
 
 /*
- * Sets the issuer of the certificate that the SCT is being verified against.
+ * Sets the issuer of the certificate that the SCT was created for.
  * This is just a convenience method to save extracting the public key and
  * calling SCT_CTX_set1_issuer_pubkey().
  * Issuer must not be NULL.
@@ -184,8 +180,8 @@ __owur int SCT_CTX_set1_cert(SCT_CTX *sctx, X509 *cert, X509 *presigner);
 __owur int SCT_CTX_set1_issuer(SCT_CTX *sctx, const X509 *issuer);
 
 /*
- * Sets the public key of the issuer of the certificate that the SCT is being
- * verified against.
+ * Sets the public key of the issuer of the certificate that the SCT was created
+ * for.
  * The public key must not be NULL.
  * Returns 1 on success, 0 on failure.
  */
@@ -198,7 +194,7 @@ __owur int SCT_CTX_set1_issuer_pubkey(SCT_CTX *sctx, X509_PUBKEY *pubkey);
 __owur int SCT_CTX_set1_pubkey(SCT_CTX *sctx, X509_PUBKEY *pubkey);
 
 /*
- * Does this SCT have the minimum fields populated to be usuable?
+ * Does this SCT have the minimum fields populated to be usable?
  * Returns 1 if so, 0 otherwise.
  */
 __owur int SCT_is_complete(const SCT *sct);
@@ -212,3 +208,7 @@ __owur int SCT_is_complete(const SCT *sct);
 __owur int SCT_signature_is_complete(const SCT *sct);
 
 
+/*
+ * Handlers for Certificate Transparency X509v3/OCSP extensions
+ */
+extern const X509V3_EXT_METHOD v3_ct_scts[];