Tidy up CRL handling by checking for critical extensions when it is

[openssl.git] / crypto / asn1 / asn1_locl.h

diff --git a/crypto/asn1/asn1_locl.h b/crypto/asn1/asn1_locl.h
index a81f56238f4715f152ea1baa29a6a6a0a20eec96..318e27eeb4f3dc6227e52e2df94029c0fe3b4da6 100644 (file)
--- a/crypto/asn1/asn1_locl.h
+++ b/crypto/asn1/asn1_locl.h
@@ -104,7 +104,7 @@ struct evp_pkey_asn1_method_st
                                                        ASN1_PCTX *pctx);
 
        void (*pkey_free)(EVP_PKEY *pkey);
-       void (*pkey_ctrl)(EVP_PKEY *pkey, int op, long arg1, void *arg2);
+       int (*pkey_ctrl)(EVP_PKEY *pkey, int op, long arg1, void *arg2);
 
        /* Legacy functions for old PEM */
 
@@ -113,3 +113,18 @@ struct evp_pkey_asn1_method_st
        int (*old_priv_encode)(const EVP_PKEY *pkey, unsigned char **pder);
 
        } /* EVP_PKEY_ASN1_METHOD */;
+
+/* Method to handle CRL access.
+ * In general a CRL could be very large (several Mb) and can consume large
+ * amounts of resources if stored in memory by multiple processes.
+ * This method allows general CRL operations to be redirected to more
+ * efficient callbacks: for example a CRL entry database.
+ */
+
+struct x509_crl_method_st
+       {
+       int (*crl_init)(X509_CRL *crl);
+       int (*crl_free)(X509_CRL *crl);
+       int (*crl_lookup)(X509_CRL *crl, X509_REVOKED **ret, ASN1_INTEGER *ser);
+       int (*crl_verify)(X509_CRL *crl, EVP_PKEY *pk);
+       };