Initial trust code: allow setting of trust checking functions

[openssl.git] / crypto / x509 / x509.h

diff --git a/crypto/x509/x509.h b/crypto/x509/x509.h
index ed08dfb74aa66ddefb7e73fad5abb562230ad83b..227bbaf1ca269b65897a15490e82e4a230954bdc 100644 (file)
--- a/crypto/x509/x509.h
+++ b/crypto/x509/x509.h
@@ -236,7 +236,7 @@ typedef struct x509_cinf_st
  * the end of the certificate itself
  */
 
-/* Bit values for trust/notrust */
+/* Bit values for trust/reject */
 
 #define X509_TRUST_BIT_ALL                     0
 #define X509_TRUST_BIT_SSL_CLIENT              1
@@ -248,9 +248,9 @@ typedef struct x509_cinf_st
 typedef struct x509_cert_aux_st
        {
        ASN1_BIT_STRING *trust;                 /* trusted uses */
-       ASN1_BIT_STRING *notrust;               /* rejected uses */
+       ASN1_BIT_STRING *reject;                /* rejected uses */
        STACK_OF(ASN1_OBJECT) *othertrust;      /* extra uses */
-       STACK_OF(ASN1_OBJECT) *othernotrust;    /* extra rejected uses */
+       STACK_OF(ASN1_OBJECT) *otherreject;     /* extra rejected uses */
        ASN1_UTF8STRING *alias;                 /* "friendly name" */
        ASN1_TYPE *other;                       /* other unspecified info */
        } X509_CERT_AUX;
@@ -284,16 +284,29 @@ typedef struct x509_trust_st {
        int trust_flags;
        int (*check_trust)(struct x509_trust_st *, X509 *, int);
        char *trust_name;
-       int trust_bit;
-       void *usr_data;
+       int arg1;
+       void *arg2;
 } X509_TRUST;
 
-/* X509 trust ids */
+DECLARE_STACK_OF(X509_TRUST)
+
+/* standard trust ids */
 
 #define X509_TRUST_ANY         1
 #define X509_TRUST_SSL_CLIENT  2
 #define X509_TRUST_SSL_SERVER  3
 #define X509_TRUST_EMAIL       4
+#define X509_TRUST_OBJECT_SIGN 5
+
+/* trust_flags values */
+#define        X509_TRUST_DYNAMIC      1
+#define        X509_TRUST_DYNAMIC_NAME 2
+
+/* check_trust return codes */
+
+#define X509_TRUST_TRUSTED     1
+#define X509_TRUST_REJECTED    2
+#define X509_TRUST_UNTRUSTED   3
 
 typedef struct X509_revoked_st
        {
@@ -615,8 +628,8 @@ int X509_REQ_sign(X509_REQ *x, EVP_PKEY *pkey, const EVP_MD *md);
 int X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const EVP_MD *md);
 int NETSCAPE_SPKI_sign(NETSCAPE_SPKI *x, EVP_PKEY *pkey, const EVP_MD *md);
 
-int X509_digest(X509 *data,EVP_MD *type,unsigned char *md,unsigned int *len);
-int X509_NAME_digest(X509_NAME *data,EVP_MD *type,
+int X509_digest(X509 *data,const EVP_MD *type,unsigned char *md,unsigned int *len);
+int X509_NAME_digest(X509_NAME *data,const EVP_MD *type,
        unsigned char *md,unsigned int *len);
 #endif
 
@@ -701,7 +714,7 @@ const char *        X509_get_default_cert_dir_env(void );
 const char *   X509_get_default_cert_file_env(void );
 const char *   X509_get_default_private_dir(void );
 
-X509_REQ *     X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey, EVP_MD *md);
+X509_REQ *     X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey, const EVP_MD *md);
 X509 *         X509_REQ_to_X509(X509_REQ *r, int days,EVP_PKEY *pkey);
 void ERR_load_X509_strings(void );
 
@@ -803,12 +816,12 @@ X509_CERT_AUX *   d2i_X509_CERT_AUX(X509_CERT_AUX **a,unsigned char **pp,
 int X509_alias_set(X509 *x, unsigned char *name, int len);
 unsigned char * X509_alias_get(X509 *x, int *len);
 int X509_trust_set_bit(X509 *x, int bit, int value);
-int X509_notrust_set_bit(X509 *x, int bit, int value);
+int X509_reject_set_bit(X509 *x, int bit, int value);
 int X509_add_trust_object(X509 *x, ASN1_OBJECT *obj);
-int X509_add_notrust_object(X509 *x, ASN1_OBJECT *obj);
+int X509_add_reject_object(X509 *x, ASN1_OBJECT *obj);
 
 int X509_trust_set_bit_asc(X509 *x, char *str, int value);
-int X509_notrust_set_bit_asc(X509 *x, char *str, int value);
+int X509_reject_set_bit_asc(X509 *x, char *str, int value);
 
 X509_REVOKED * X509_REVOKED_new(void);
 void           X509_REVOKED_free(X509_REVOKED *a);
@@ -857,7 +870,7 @@ char *              X509_NAME_oneline(X509_NAME *a,char *buf,int size);
 int ASN1_verify(int (*i2d)(), X509_ALGOR *algor1,
        ASN1_BIT_STRING *signature,char *data,EVP_PKEY *pkey);
 
-int ASN1_digest(int (*i2d)(),EVP_MD *type,char *data,
+int ASN1_digest(int (*i2d)(),const EVP_MD *type,char *data,
        unsigned char *md,unsigned int *len);
 
 int ASN1_sign(int (*i2d)(), X509_ALGOR *algor1, X509_ALGOR *algor2,
@@ -1040,6 +1053,17 @@ EVP_PKEY *EVP_PKCS82PKEY(PKCS8_PRIV_KEY_INFO *p8);
 PKCS8_PRIV_KEY_INFO *EVP_PKEY2PKCS8(EVP_PKEY *pkey);
 PKCS8_PRIV_KEY_INFO *PKCS8_set_broken(PKCS8_PRIV_KEY_INFO *p8, int broken);
 
+int X509_check_trust(X509 *x, int id, int flags);
+int X509_TRUST_get_count(void);
+X509_TRUST * X509_TRUST_iget(int idx);
+int X509_TRUST_get_by_id(int id);
+int X509_TRUST_add(X509_TRUST *xp);
+void X509_TRUST_cleanup(void);
+void X509_TRUST_add_standard(void);
+int X509_TRUST_get_id(X509_TRUST *xp);
+char *X509_TRUST_iget_name(X509_TRUST *xp);
+int X509_TRUST_get_trust(X509_TRUST *xp);
+
 /* BEGIN ERROR CODES */
 /* The following lines are auto generated by the script mkerr.pl. Any changes
  * made after this point may be overwritten when the script is next run.
@@ -1077,6 +1101,7 @@ PKCS8_PRIV_KEY_INFO *PKCS8_set_broken(PKCS8_PRIV_KEY_INFO *p8, int broken);
 #define X509_F_X509_STORE_ADD_CERT                      124
 #define X509_F_X509_STORE_ADD_CRL                       125
 #define X509_F_X509_TO_X509_REQ                                 126
+#define X509_F_X509_TRUST_ADD                           133
 #define X509_F_X509_VERIFY_CERT                                 127
 
 /* Reason codes. */