Tidy up CRL handling by checking for critical extensions when it is

[openssl.git] / crypto / x509 / x509.h

diff --git a/crypto/x509/x509.h b/crypto/x509/x509.h
index 66990ae5a88e831dab3ea36fd9957515f7257d1f..f28086c175f770bf5038a492a719563f6dcc85cd 100644 (file)
--- a/crypto/x509/x509.h
+++ b/crypto/x509/x509.h
@@ -155,12 +155,12 @@ typedef struct X509_val_st
        ASN1_TIME *notAfter;
        } X509_VAL;
 
-typedef struct X509_pubkey_st
+struct X509_pubkey_st
        {
        X509_ALGOR *algor;
        ASN1_BIT_STRING *public_key;
        EVP_PKEY *pkey;
-       } X509_PUBKEY;
+       };
 
 typedef struct X509_sig_st
        {
@@ -189,7 +189,9 @@ struct X509_name_st
 #else
        char *bytes;
 #endif
-       unsigned long hash; /* Keep the hash around for lookups */
+/*     unsigned long hash; Keep the hash around for lookups */
+       unsigned char *canon_enc;
+       int canon_enclen;
        } /* X509_NAME */;
 
 DECLARE_STACK_OF(X509_NAME)
@@ -286,8 +288,9 @@ struct x509_st
        unsigned long ex_xkusage;
        unsigned long ex_nscert;
        ASN1_OCTET_STRING *skid;
-       struct AUTHORITY_KEYID_st *akid;
+       AUTHORITY_KEYID *akid;
        X509_POLICY_CACHE *policy_cache;
+       STACK_OF(DIST_POINT) *crldp;
 #ifndef OPENSSL_NO_SHA
        unsigned char sha1_hash[SHA_DIGEST_LENGTH];
 #endif
@@ -326,10 +329,11 @@ typedef struct x509_cert_pair_st {
 #define X509_TRUST_OBJECT_SIGN 5
 #define X509_TRUST_OCSP_SIGN   6
 #define X509_TRUST_OCSP_REQUEST        7
+#define X509_TRUST_TSA         8
 
 /* Keep these up to date! */
 #define X509_TRUST_MIN         1
-#define X509_TRUST_MAX         7
+#define X509_TRUST_MAX         8
 
 
 /* trust_flags values */
@@ -416,13 +420,13 @@ typedef struct x509_cert_pair_st {
                        XN_FLAG_FN_LN | \
                        XN_FLAG_FN_ALIGN)
 
-typedef struct X509_revoked_st
+struct x509_revoked_st
        {
        ASN1_INTEGER *serialNumber;
        ASN1_TIME *revocationDate;
        STACK_OF(X509_EXTENSION) /* optional */ *extensions;
        int sequence; /* load sequence */
-       } X509_REVOKED;
+       };
 
 DECLARE_STACK_OF(X509_REVOKED)
 DECLARE_ASN1_SET_OF(X509_REVOKED)
@@ -446,6 +450,17 @@ struct X509_crl_st
        X509_ALGOR *sig_alg;
        ASN1_BIT_STRING *signature;
        int references;
+       int flags;
+       /* Copies of various extensions */
+       AUTHORITY_KEYID *akid;
+       ISSUING_DIST_POINT *idp;
+       /* Convenient breakdown of IDP */
+       int idp_flags;
+       int idp_reasons;
+#ifndef OPENSSL_NO_SHA
+       unsigned char sha1_hash[SHA_DIGEST_LENGTH];
+#endif
+       X509_CRL_METHOD *meth;
        } /* X509_CRL */;
 
 DECLARE_STACK_OF(X509_CRL)
@@ -544,7 +559,7 @@ X509_ALGOR *prf;
 
 /* PKCS#8 private key info structure */
 
-typedef struct pkcs8_priv_key_info_st
+struct pkcs8_priv_key_info_st
         {
         int broken;     /* Flag for various broken formats */
 #define PKCS8_OK               0
@@ -555,7 +570,7 @@ typedef struct pkcs8_priv_key_info_st
         X509_ALGOR *pkeyalg;
         ASN1_TYPE *pkey; /* Should be OCTET STRING but some are broken */
         STACK_OF(X509_ATTRIBUTE) *attributes;
-        } PKCS8_PRIV_KEY_INFO;
+        };
 
 #ifdef  __cplusplus
 }
@@ -858,6 +873,10 @@ X509_EXTENSION *X509_EXTENSION_dup(X509_EXTENSION *ex);
 X509_CRL *X509_CRL_dup(X509_CRL *crl);
 X509_REQ *X509_REQ_dup(X509_REQ *req);
 X509_ALGOR *X509_ALGOR_dup(X509_ALGOR *xn);
+int X509_ALGOR_set0(X509_ALGOR *alg, ASN1_OBJECT *aobj, int ptype, void *pval);
+void X509_ALGOR_get0(ASN1_OBJECT **paobj, int *pptype, void **ppval,
+                                               X509_ALGOR *algor);
+
 X509_NAME *X509_NAME_dup(X509_NAME *xn);
 X509_NAME_ENTRY *X509_NAME_ENTRY_dup(X509_NAME_ENTRY *ne);
 
@@ -951,6 +970,8 @@ DECLARE_ASN1_FUNCTIONS(X509_CRL_INFO)
 DECLARE_ASN1_FUNCTIONS(X509_CRL)
 
 int X509_CRL_add0_revoked(X509_CRL *crl, X509_REVOKED *rev);
+int X509_CRL_get0_by_serial(X509_CRL *crl,
+               X509_REVOKED **ret, ASN1_INTEGER *serial);
 
 X509_PKEY *    X509_PKEY_new(void );
 void           X509_PKEY_free(X509_PKEY *a);
@@ -1057,6 +1078,7 @@ int               X509_NAME_cmp(const X509_NAME *a, const X509_NAME *b);
 unsigned long  X509_NAME_hash(X509_NAME *x);
 
 int            X509_CRL_cmp(const X509_CRL *a, const X509_CRL *b);
+int            X509_CRL_match(const X509_CRL *a, const X509_CRL *b);
 #ifndef OPENSSL_NO_FP_API
 int            X509_print_ex_fp(FILE *bp,X509 *x, unsigned long nmflag, unsigned long cflag);
 int            X509_print_fp(FILE *bp,X509 *x);
@@ -1233,6 +1255,9 @@ DECLARE_ASN1_FUNCTIONS(PBKDF2PARAM)
 X509_ALGOR *PKCS5_pbe_set(int alg, int iter, unsigned char *salt, int saltlen);
 X509_ALGOR *PKCS5_pbe2_set(const EVP_CIPHER *cipher, int iter,
                                         unsigned char *salt, int saltlen);
+X509_ALGOR *PKCS5_pbe2_set_iv(const EVP_CIPHER *cipher, int iter,
+                                unsigned char *salt, int saltlen,
+                                unsigned char *aiv, int prf_nid);
 
 /* PKCS#8 utilities */
 
@@ -1243,6 +1268,22 @@ PKCS8_PRIV_KEY_INFO *EVP_PKEY2PKCS8(EVP_PKEY *pkey);
 PKCS8_PRIV_KEY_INFO *EVP_PKEY2PKCS8_broken(EVP_PKEY *pkey, int broken);
 PKCS8_PRIV_KEY_INFO *PKCS8_set_broken(PKCS8_PRIV_KEY_INFO *p8, int broken);
 
+int PKCS8_pkey_set0(PKCS8_PRIV_KEY_INFO *priv, ASN1_OBJECT *aobj,
+                       int version, int ptype, void *pval,
+                               unsigned char *penc, int penclen);
+int PKCS8_pkey_get0(ASN1_OBJECT **ppkalg,
+               const unsigned char **pk, int *ppklen,
+               X509_ALGOR **pa,
+               PKCS8_PRIV_KEY_INFO *p8);
+
+int X509_PUBKEY_set0_param(X509_PUBKEY *pub, ASN1_OBJECT *aobj,
+                                       int ptype, void *pval,
+                                       unsigned char *penc, int penclen);
+int X509_PUBKEY_get0_param(ASN1_OBJECT **ppkalg,
+               const unsigned char **pk, int *ppklen,
+               X509_ALGOR **pa,
+               X509_PUBKEY *pub);
+
 int X509_check_trust(X509 *x, int id, int flags);
 int X509_TRUST_get_count(void);
 X509_TRUST * X509_TRUST_get0(int idx);
@@ -1322,7 +1363,10 @@ void ERR_load_X509_strings(void);
 #define X509_R_KEY_VALUES_MISMATCH                      116
 #define X509_R_LOADING_CERT_DIR                                 103
 #define X509_R_LOADING_DEFAULTS                                 104
+#define X509_R_METHOD_NOT_SUPPORTED                     124
 #define X509_R_NO_CERT_SET_FOR_US_TO_VERIFY             105
+#define X509_R_PUBLIC_KEY_DECODE_ERROR                  125
+#define X509_R_PUBLIC_KEY_ENCODE_ERROR                  126
 #define X509_R_SHOULD_RETRY                             106
 #define X509_R_UNABLE_TO_FIND_PARAMETERS_IN_CHAIN       107
 #define X509_R_UNABLE_TO_GET_CERTS_PUBLIC_KEY           108