Add support for certificate stores in CERT structure. This makes it

[openssl.git] / ssl / ssl_locl.h

diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h
index 75128751c9b97bcfa7621840ccc18838050e3277..7b1c12c66250faadbb1bfb6c20affdac3861b7ca 100644 (file)
--- a/ssl/ssl_locl.h
+++ b/ssl/ssl_locl.h
@@ -505,13 +505,18 @@ typedef struct cert_st
                         * Probably it would make more sense to store
                         * an index, not a pointer. */
  
-       /* The following masks are for the key and auth
-        * algorithms that are supported by the certs below */
+       /* For servers the following masks are for the key and auth
+        * algorithms that are supported by the certs below.
+        * For clients they are masks of *disabled* algorithms based
+        * on the current session.
+        */
        int valid;
        unsigned long mask_k;
        unsigned long mask_a;
        unsigned long export_mask_k;
        unsigned long export_mask_a;
+       /* Client only */
+       unsigned long mask_ssl;
 #ifndef OPENSSL_NO_RSA
        RSA *rsa_tmp;
        RSA *(*rsa_tmp_cb)(SSL *ssl,int is_export,int keysize);
@@ -578,6 +583,12 @@ typedef struct cert_st
        int (*cert_cb)(SSL *ssl, void *arg);
        void *cert_cb_arg;
 
+       /* Optional X509_STORE for chain building or certificate validation
+        * If NULL the parent SSL_CTX store is used instead.
+        */
+       X509_STORE *chain_store;
+       X509_STORE *verify_store;
+
        int references; /* >1 only if SSL_copy_session_id is used */
        } CERT;
 
@@ -920,6 +931,8 @@ void ssl_cert_set_cert_cb(CERT *c, int (*cb)(SSL *ssl, void *arg), void *arg);
 
 int ssl_verify_cert_chain(SSL *s,STACK_OF(X509) *sk);
 int ssl_add_cert_chain(SSL *s, CERT_PKEY *cpk, unsigned long *l);
+int ssl_build_cert_chain(CERT *c, X509_STORE *chain_store, int flags);
+int ssl_cert_set_cert_store(CERT *c, X509_STORE *store, int chain, int ref);
 int ssl_undefined_function(SSL *s);
 int ssl_undefined_void_function(void);
 int ssl_undefined_const_function(const SSL *s);
@@ -1237,7 +1250,8 @@ int ssl_parse_clienthello_renegotiate_ext(SSL *s, unsigned char *d, int len,
                                          int *al);
 long ssl_get_algorithm2(SSL *s);
 int tls1_process_sigalgs(SSL *s, const unsigned char *data, int dsize);
-size_t tls12_get_sig_algs(SSL *s, unsigned char *p);
+size_t tls12_get_psigalgs(SSL *s, const unsigned char **psigs);
+void ssl_set_client_disabled(SSL *s);
 
 int ssl_add_clienthello_use_srtp_ext(SSL *s, unsigned char *p, int *len, int maxlen);
 int ssl_parse_clienthello_use_srtp_ext(SSL *s, unsigned char *d, int len,int *al);