summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/ocsp/ocsp.h
diff options
context:
space:
mode:
Diffstat (limited to 'src/lib/libcrypto/ocsp/ocsp.h')
-rw-r--r--src/lib/libcrypto/ocsp/ocsp.h623
1 files changed, 623 insertions, 0 deletions
diff --git a/src/lib/libcrypto/ocsp/ocsp.h b/src/lib/libcrypto/ocsp/ocsp.h
new file mode 100644
index 0000000000..a0577a717e
--- /dev/null
+++ b/src/lib/libcrypto/ocsp/ocsp.h
@@ -0,0 +1,623 @@
1/* ocsp.h */
2/* Written by Tom Titchener <Tom_Titchener@groove.net> for the OpenSSL
3 * project. */
4
5/* History:
6 This file was transfered to Richard Levitte from CertCo by Kathy
7 Weinhold in mid-spring 2000 to be included in OpenSSL or released
8 as a patch kit. */
9
10/* ====================================================================
11 * Copyright (c) 1998-2000 The OpenSSL Project. All rights reserved.
12 *
13 * Redistribution and use in source and binary forms, with or without
14 * modification, are permitted provided that the following conditions
15 * are met:
16 *
17 * 1. Redistributions of source code must retain the above copyright
18 * notice, this list of conditions and the following disclaimer.
19 *
20 * 2. Redistributions in binary form must reproduce the above copyright
21 * notice, this list of conditions and the following disclaimer in
22 * the documentation and/or other materials provided with the
23 * distribution.
24 *
25 * 3. All advertising materials mentioning features or use of this
26 * software must display the following acknowledgment:
27 * "This product includes software developed by the OpenSSL Project
28 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
29 *
30 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
31 * endorse or promote products derived from this software without
32 * prior written permission. For written permission, please contact
33 * openssl-core@openssl.org.
34 *
35 * 5. Products derived from this software may not be called "OpenSSL"
36 * nor may "OpenSSL" appear in their names without prior written
37 * permission of the OpenSSL Project.
38 *
39 * 6. Redistributions of any form whatsoever must retain the following
40 * acknowledgment:
41 * "This product includes software developed by the OpenSSL Project
42 * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
43 *
44 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
45 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
46 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
47 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
48 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
49 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
50 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
51 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
52 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
53 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
54 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
55 * OF THE POSSIBILITY OF SUCH DAMAGE.
56 * ====================================================================
57 *
58 * This product includes cryptographic software written by Eric Young
59 * (eay@cryptsoft.com). This product includes software written by Tim
60 * Hudson (tjh@cryptsoft.com).
61 *
62 */
63
64#ifndef HEADER_OCSP_H
65#define HEADER_OCSP_H
66
67#include <openssl/x509.h>
68#include <openssl/x509v3.h>
69#include <openssl/safestack.h>
70
71#ifdef __cplusplus
72extern "C" {
73#endif
74
75/* Various flags and values */
76
77#define OCSP_DEFAULT_NONCE_LENGTH 16
78
79#define OCSP_NOCERTS 0x1
80#define OCSP_NOINTERN 0x2
81#define OCSP_NOSIGS 0x4
82#define OCSP_NOCHAIN 0x8
83#define OCSP_NOVERIFY 0x10
84#define OCSP_NOEXPLICIT 0x20
85#define OCSP_NOCASIGN 0x40
86#define OCSP_NODELEGATED 0x80
87#define OCSP_NOCHECKS 0x100
88#define OCSP_TRUSTOTHER 0x200
89#define OCSP_RESPID_KEY 0x400
90#define OCSP_NOTIME 0x800
91
92/* CertID ::= SEQUENCE {
93 * hashAlgorithm AlgorithmIdentifier,
94 * issuerNameHash OCTET STRING, -- Hash of Issuer's DN
95 * issuerKeyHash OCTET STRING, -- Hash of Issuers public key (excluding the tag & length fields)
96 * serialNumber CertificateSerialNumber }
97 */
98typedef struct ocsp_cert_id_st
99 {
100 X509_ALGOR *hashAlgorithm;
101 ASN1_OCTET_STRING *issuerNameHash;
102 ASN1_OCTET_STRING *issuerKeyHash;
103 ASN1_INTEGER *serialNumber;
104 } OCSP_CERTID;
105
106DECLARE_STACK_OF(OCSP_CERTID)
107
108/* Request ::= SEQUENCE {
109 * reqCert CertID,
110 * singleRequestExtensions [0] EXPLICIT Extensions OPTIONAL }
111 */
112typedef struct ocsp_one_request_st
113 {
114 OCSP_CERTID *reqCert;
115 STACK_OF(X509_EXTENSION) *singleRequestExtensions;
116 } OCSP_ONEREQ;
117
118DECLARE_STACK_OF(OCSP_ONEREQ)
119DECLARE_ASN1_SET_OF(OCSP_ONEREQ)
120
121
122/* TBSRequest ::= SEQUENCE {
123 * version [0] EXPLICIT Version DEFAULT v1,
124 * requestorName [1] EXPLICIT GeneralName OPTIONAL,
125 * requestList SEQUENCE OF Request,
126 * requestExtensions [2] EXPLICIT Extensions OPTIONAL }
127 */
128typedef struct ocsp_req_info_st
129 {
130 ASN1_INTEGER *version;
131 GENERAL_NAME *requestorName;
132 STACK_OF(OCSP_ONEREQ) *requestList;
133 STACK_OF(X509_EXTENSION) *requestExtensions;
134 } OCSP_REQINFO;
135
136/* Signature ::= SEQUENCE {
137 * signatureAlgorithm AlgorithmIdentifier,
138 * signature BIT STRING,
139 * certs [0] EXPLICIT SEQUENCE OF Certificate OPTIONAL }
140 */
141typedef struct ocsp_signature_st
142 {
143 X509_ALGOR *signatureAlgorithm;
144 ASN1_BIT_STRING *signature;
145 STACK_OF(X509) *certs;
146 } OCSP_SIGNATURE;
147
148/* OCSPRequest ::= SEQUENCE {
149 * tbsRequest TBSRequest,
150 * optionalSignature [0] EXPLICIT Signature OPTIONAL }
151 */
152typedef struct ocsp_request_st
153 {
154 OCSP_REQINFO *tbsRequest;
155 OCSP_SIGNATURE *optionalSignature; /* OPTIONAL */
156 } OCSP_REQUEST;
157
158/* OCSPResponseStatus ::= ENUMERATED {
159 * successful (0), --Response has valid confirmations
160 * malformedRequest (1), --Illegal confirmation request
161 * internalError (2), --Internal error in issuer
162 * tryLater (3), --Try again later
163 * --(4) is not used
164 * sigRequired (5), --Must sign the request
165 * unauthorized (6) --Request unauthorized
166 * }
167 */
168#define OCSP_RESPONSE_STATUS_SUCCESSFUL 0
169#define OCSP_RESPONSE_STATUS_MALFORMEDREQUEST 1
170#define OCSP_RESPONSE_STATUS_INTERNALERROR 2
171#define OCSP_RESPONSE_STATUS_TRYLATER 3
172#define OCSP_RESPONSE_STATUS_SIGREQUIRED 5
173#define OCSP_RESPONSE_STATUS_UNAUTHORIZED 6
174
175/* ResponseBytes ::= SEQUENCE {
176 * responseType OBJECT IDENTIFIER,
177 * response OCTET STRING }
178 */
179typedef struct ocsp_resp_bytes_st
180 {
181 ASN1_OBJECT *responseType;
182 ASN1_OCTET_STRING *response;
183 } OCSP_RESPBYTES;
184
185/* OCSPResponse ::= SEQUENCE {
186 * responseStatus OCSPResponseStatus,
187 * responseBytes [0] EXPLICIT ResponseBytes OPTIONAL }
188 */
189struct ocsp_response_st
190 {
191 ASN1_ENUMERATED *responseStatus;
192 OCSP_RESPBYTES *responseBytes;
193 };
194
195/* ResponderID ::= CHOICE {
196 * byName [1] Name,
197 * byKey [2] KeyHash }
198 */
199#define V_OCSP_RESPID_NAME 0
200#define V_OCSP_RESPID_KEY 1
201struct ocsp_responder_id_st
202 {
203 int type;
204 union {
205 X509_NAME* byName;
206 ASN1_OCTET_STRING *byKey;
207 } value;
208 };
209
210DECLARE_STACK_OF(OCSP_RESPID)
211DECLARE_ASN1_FUNCTIONS(OCSP_RESPID)
212
213/* KeyHash ::= OCTET STRING --SHA-1 hash of responder's public key
214 * --(excluding the tag and length fields)
215 */
216
217/* RevokedInfo ::= SEQUENCE {
218 * revocationTime GeneralizedTime,
219 * revocationReason [0] EXPLICIT CRLReason OPTIONAL }
220 */
221typedef struct ocsp_revoked_info_st
222 {
223 ASN1_GENERALIZEDTIME *revocationTime;
224 ASN1_ENUMERATED *revocationReason;
225 } OCSP_REVOKEDINFO;
226
227/* CertStatus ::= CHOICE {
228 * good [0] IMPLICIT NULL,
229 * revoked [1] IMPLICIT RevokedInfo,
230 * unknown [2] IMPLICIT UnknownInfo }
231 */
232#define V_OCSP_CERTSTATUS_GOOD 0
233#define V_OCSP_CERTSTATUS_REVOKED 1
234#define V_OCSP_CERTSTATUS_UNKNOWN 2
235typedef struct ocsp_cert_status_st
236 {
237 int type;
238 union {
239 ASN1_NULL *good;
240 OCSP_REVOKEDINFO *revoked;
241 ASN1_NULL *unknown;
242 } value;
243 } OCSP_CERTSTATUS;
244
245/* SingleResponse ::= SEQUENCE {
246 * certID CertID,
247 * certStatus CertStatus,
248 * thisUpdate GeneralizedTime,
249 * nextUpdate [0] EXPLICIT GeneralizedTime OPTIONAL,
250 * singleExtensions [1] EXPLICIT Extensions OPTIONAL }
251 */
252typedef struct ocsp_single_response_st
253 {
254 OCSP_CERTID *certId;
255 OCSP_CERTSTATUS *certStatus;
256 ASN1_GENERALIZEDTIME *thisUpdate;
257 ASN1_GENERALIZEDTIME *nextUpdate;
258 STACK_OF(X509_EXTENSION) *singleExtensions;
259 } OCSP_SINGLERESP;
260
261DECLARE_STACK_OF(OCSP_SINGLERESP)
262DECLARE_ASN1_SET_OF(OCSP_SINGLERESP)
263
264/* ResponseData ::= SEQUENCE {
265 * version [0] EXPLICIT Version DEFAULT v1,
266 * responderID ResponderID,
267 * producedAt GeneralizedTime,
268 * responses SEQUENCE OF SingleResponse,
269 * responseExtensions [1] EXPLICIT Extensions OPTIONAL }
270 */
271typedef struct ocsp_response_data_st
272 {
273 ASN1_INTEGER *version;
274 OCSP_RESPID *responderId;
275 ASN1_GENERALIZEDTIME *producedAt;
276 STACK_OF(OCSP_SINGLERESP) *responses;
277 STACK_OF(X509_EXTENSION) *responseExtensions;
278 } OCSP_RESPDATA;
279
280/* BasicOCSPResponse ::= SEQUENCE {
281 * tbsResponseData ResponseData,
282 * signatureAlgorithm AlgorithmIdentifier,
283 * signature BIT STRING,
284 * certs [0] EXPLICIT SEQUENCE OF Certificate OPTIONAL }
285 */
286 /* Note 1:
287 The value for "signature" is specified in the OCSP rfc2560 as follows:
288 "The value for the signature SHALL be computed on the hash of the DER
289 encoding ResponseData." This means that you must hash the DER-encoded
290 tbsResponseData, and then run it through a crypto-signing function, which
291 will (at least w/RSA) do a hash-'n'-private-encrypt operation. This seems
292 a bit odd, but that's the spec. Also note that the data structures do not
293 leave anywhere to independently specify the algorithm used for the initial
294 hash. So, we look at the signature-specification algorithm, and try to do
295 something intelligent. -- Kathy Weinhold, CertCo */
296 /* Note 2:
297 It seems that the mentioned passage from RFC 2560 (section 4.2.1) is open
298 for interpretation. I've done tests against another responder, and found
299 that it doesn't do the double hashing that the RFC seems to say one
300 should. Therefore, all relevant functions take a flag saying which
301 variant should be used. -- Richard Levitte, OpenSSL team and CeloCom */
302typedef struct ocsp_basic_response_st
303 {
304 OCSP_RESPDATA *tbsResponseData;
305 X509_ALGOR *signatureAlgorithm;
306 ASN1_BIT_STRING *signature;
307 STACK_OF(X509) *certs;
308 } OCSP_BASICRESP;
309
310/*
311 * CRLReason ::= ENUMERATED {
312 * unspecified (0),
313 * keyCompromise (1),
314 * cACompromise (2),
315 * affiliationChanged (3),
316 * superseded (4),
317 * cessationOfOperation (5),
318 * certificateHold (6),
319 * removeFromCRL (8) }
320 */
321#define OCSP_REVOKED_STATUS_NOSTATUS -1
322#define OCSP_REVOKED_STATUS_UNSPECIFIED 0
323#define OCSP_REVOKED_STATUS_KEYCOMPROMISE 1
324#define OCSP_REVOKED_STATUS_CACOMPROMISE 2
325#define OCSP_REVOKED_STATUS_AFFILIATIONCHANGED 3
326#define OCSP_REVOKED_STATUS_SUPERSEDED 4
327#define OCSP_REVOKED_STATUS_CESSATIONOFOPERATION 5
328#define OCSP_REVOKED_STATUS_CERTIFICATEHOLD 6
329#define OCSP_REVOKED_STATUS_REMOVEFROMCRL 8
330
331/* CrlID ::= SEQUENCE {
332 * crlUrl [0] EXPLICIT IA5String OPTIONAL,
333 * crlNum [1] EXPLICIT INTEGER OPTIONAL,
334 * crlTime [2] EXPLICIT GeneralizedTime OPTIONAL }
335 */
336typedef struct ocsp_crl_id_st
337 {
338 ASN1_IA5STRING *crlUrl;
339 ASN1_INTEGER *crlNum;
340 ASN1_GENERALIZEDTIME *crlTime;
341 } OCSP_CRLID;
342
343/* ServiceLocator ::= SEQUENCE {
344 * issuer Name,
345 * locator AuthorityInfoAccessSyntax OPTIONAL }
346 */
347typedef struct ocsp_service_locator_st
348 {
349 X509_NAME* issuer;
350 STACK_OF(ACCESS_DESCRIPTION) *locator;
351 } OCSP_SERVICELOC;
352
353#define PEM_STRING_OCSP_REQUEST "OCSP REQUEST"
354#define PEM_STRING_OCSP_RESPONSE "OCSP RESPONSE"
355
356#define d2i_OCSP_REQUEST_bio(bp,p) ASN1_d2i_bio_of(OCSP_REQUEST,OCSP_REQUEST_new,d2i_OCSP_REQUEST,bp,p)
357
358#define d2i_OCSP_RESPONSE_bio(bp,p) ASN1_d2i_bio_of(OCSP_RESPONSE,OCSP_RESPONSE_new,d2i_OCSP_RESPONSE,bp,p)
359
360#define PEM_read_bio_OCSP_REQUEST(bp,x,cb) (OCSP_REQUEST *)PEM_ASN1_read_bio( \
361 (char *(*)())d2i_OCSP_REQUEST,PEM_STRING_OCSP_REQUEST,bp,(char **)x,cb,NULL)
362
363#define PEM_read_bio_OCSP_RESPONSE(bp,x,cb)(OCSP_RESPONSE *)PEM_ASN1_read_bio(\
364 (char *(*)())d2i_OCSP_RESPONSE,PEM_STRING_OCSP_RESPONSE,bp,(char **)x,cb,NULL)
365
366#define PEM_write_bio_OCSP_REQUEST(bp,o) \
367 PEM_ASN1_write_bio((int (*)())i2d_OCSP_REQUEST,PEM_STRING_OCSP_REQUEST,\
368 bp,(char *)o, NULL,NULL,0,NULL,NULL)
369
370#define PEM_write_bio_OCSP_RESPONSE(bp,o) \
371 PEM_ASN1_write_bio((int (*)())i2d_OCSP_RESPONSE,PEM_STRING_OCSP_RESPONSE,\
372 bp,(char *)o, NULL,NULL,0,NULL,NULL)
373
374#define i2d_OCSP_RESPONSE_bio(bp,o) ASN1_i2d_bio_of(OCSP_RESPONSE,i2d_OCSP_RESPONSE,bp,o)
375
376#define i2d_OCSP_REQUEST_bio(bp,o) ASN1_i2d_bio_of(OCSP_REQUEST,i2d_OCSP_REQUEST,bp,o)
377
378#define OCSP_REQUEST_sign(o,pkey,md) \
379 ASN1_item_sign(ASN1_ITEM_rptr(OCSP_REQINFO),\
380 o->optionalSignature->signatureAlgorithm,NULL,\
381 o->optionalSignature->signature,o->tbsRequest,pkey,md)
382
383#define OCSP_BASICRESP_sign(o,pkey,md,d) \
384 ASN1_item_sign(ASN1_ITEM_rptr(OCSP_RESPDATA),o->signatureAlgorithm,NULL,\
385 o->signature,o->tbsResponseData,pkey,md)
386
387#define OCSP_REQUEST_verify(a,r) ASN1_item_verify(ASN1_ITEM_rptr(OCSP_REQINFO),\
388 a->optionalSignature->signatureAlgorithm,\
389 a->optionalSignature->signature,a->tbsRequest,r)
390
391#define OCSP_BASICRESP_verify(a,r,d) ASN1_item_verify(ASN1_ITEM_rptr(OCSP_RESPDATA),\
392 a->signatureAlgorithm,a->signature,a->tbsResponseData,r)
393
394#define ASN1_BIT_STRING_digest(data,type,md,len) \
395 ASN1_item_digest(ASN1_ITEM_rptr(ASN1_BIT_STRING),type,data,md,len)
396
397#define OCSP_CERTID_dup(cid) ASN1_dup_of(OCSP_CERTID,i2d_OCSP_CERTID,d2i_OCSP_CERTID,cid)
398
399#define OCSP_CERTSTATUS_dup(cs)\
400 (OCSP_CERTSTATUS*)ASN1_dup((int(*)())i2d_OCSP_CERTSTATUS,\
401 (char *(*)())d2i_OCSP_CERTSTATUS,(char *)(cs))
402
403OCSP_RESPONSE *OCSP_sendreq_bio(BIO *b, char *path, OCSP_REQUEST *req);
404OCSP_REQ_CTX *OCSP_sendreq_new(BIO *io, char *path, OCSP_REQUEST *req,
405 int maxline);
406int OCSP_sendreq_nbio(OCSP_RESPONSE **presp, OCSP_REQ_CTX *rctx);
407void OCSP_REQ_CTX_free(OCSP_REQ_CTX *rctx);
408
409OCSP_CERTID *OCSP_cert_to_id(const EVP_MD *dgst, X509 *subject, X509 *issuer);
410
411OCSP_CERTID *OCSP_cert_id_new(const EVP_MD *dgst,
412 X509_NAME *issuerName,
413 ASN1_BIT_STRING* issuerKey,
414 ASN1_INTEGER *serialNumber);
415
416OCSP_ONEREQ *OCSP_request_add0_id(OCSP_REQUEST *req, OCSP_CERTID *cid);
417
418int OCSP_request_add1_nonce(OCSP_REQUEST *req, unsigned char *val, int len);
419int OCSP_basic_add1_nonce(OCSP_BASICRESP *resp, unsigned char *val, int len);
420int OCSP_check_nonce(OCSP_REQUEST *req, OCSP_BASICRESP *bs);
421int OCSP_copy_nonce(OCSP_BASICRESP *resp, OCSP_REQUEST *req);
422
423int OCSP_request_set1_name(OCSP_REQUEST *req, X509_NAME *nm);
424int OCSP_request_add1_cert(OCSP_REQUEST *req, X509 *cert);
425
426int OCSP_request_sign(OCSP_REQUEST *req,
427 X509 *signer,
428 EVP_PKEY *key,
429 const EVP_MD *dgst,
430 STACK_OF(X509) *certs,
431 unsigned long flags);
432
433int OCSP_response_status(OCSP_RESPONSE *resp);
434OCSP_BASICRESP *OCSP_response_get1_basic(OCSP_RESPONSE *resp);
435
436int OCSP_resp_count(OCSP_BASICRESP *bs);
437OCSP_SINGLERESP *OCSP_resp_get0(OCSP_BASICRESP *bs, int idx);
438int OCSP_resp_find(OCSP_BASICRESP *bs, OCSP_CERTID *id, int last);
439int OCSP_single_get0_status(OCSP_SINGLERESP *single, int *reason,
440 ASN1_GENERALIZEDTIME **revtime,
441 ASN1_GENERALIZEDTIME **thisupd,
442 ASN1_GENERALIZEDTIME **nextupd);
443int OCSP_resp_find_status(OCSP_BASICRESP *bs, OCSP_CERTID *id, int *status,
444 int *reason,
445 ASN1_GENERALIZEDTIME **revtime,
446 ASN1_GENERALIZEDTIME **thisupd,
447 ASN1_GENERALIZEDTIME **nextupd);
448int OCSP_check_validity(ASN1_GENERALIZEDTIME *thisupd,
449 ASN1_GENERALIZEDTIME *nextupd,
450 long sec, long maxsec);
451
452int OCSP_request_verify(OCSP_REQUEST *req, STACK_OF(X509) *certs, X509_STORE *store, unsigned long flags);
453
454int OCSP_parse_url(char *url, char **phost, char **pport, char **ppath, int *pssl);
455
456int OCSP_id_issuer_cmp(OCSP_CERTID *a, OCSP_CERTID *b);
457int OCSP_id_cmp(OCSP_CERTID *a, OCSP_CERTID *b);
458
459int OCSP_request_onereq_count(OCSP_REQUEST *req);
460OCSP_ONEREQ *OCSP_request_onereq_get0(OCSP_REQUEST *req, int i);
461OCSP_CERTID *OCSP_onereq_get0_id(OCSP_ONEREQ *one);
462int OCSP_id_get0_info(ASN1_OCTET_STRING **piNameHash, ASN1_OBJECT **pmd,
463 ASN1_OCTET_STRING **pikeyHash,
464 ASN1_INTEGER **pserial, OCSP_CERTID *cid);
465int OCSP_request_is_signed(OCSP_REQUEST *req);
466OCSP_RESPONSE *OCSP_response_create(int status, OCSP_BASICRESP *bs);
467OCSP_SINGLERESP *OCSP_basic_add1_status(OCSP_BASICRESP *rsp,
468 OCSP_CERTID *cid,
469 int status, int reason,
470 ASN1_TIME *revtime,
471 ASN1_TIME *thisupd, ASN1_TIME *nextupd);
472int OCSP_basic_add1_cert(OCSP_BASICRESP *resp, X509 *cert);
473int OCSP_basic_sign(OCSP_BASICRESP *brsp,
474 X509 *signer, EVP_PKEY *key, const EVP_MD *dgst,
475 STACK_OF(X509) *certs, unsigned long flags);
476
477ASN1_STRING *ASN1_STRING_encode(ASN1_STRING *s, i2d_of_void *i2d,
478 void *data, STACK_OF(ASN1_OBJECT) *sk);
479#define ASN1_STRING_encode_of(type,s,i2d,data,sk) \
480 ASN1_STRING_encode(s, CHECKED_I2D_OF(type, i2d), data, sk)
481
482X509_EXTENSION *OCSP_crlID_new(char *url, long *n, char *tim);
483
484X509_EXTENSION *OCSP_accept_responses_new(char **oids);
485
486X509_EXTENSION *OCSP_archive_cutoff_new(char* tim);
487
488X509_EXTENSION *OCSP_url_svcloc_new(X509_NAME* issuer, char **urls);
489
490int OCSP_REQUEST_get_ext_count(OCSP_REQUEST *x);
491int OCSP_REQUEST_get_ext_by_NID(OCSP_REQUEST *x, int nid, int lastpos);
492int OCSP_REQUEST_get_ext_by_OBJ(OCSP_REQUEST *x, ASN1_OBJECT *obj, int lastpos);
493int OCSP_REQUEST_get_ext_by_critical(OCSP_REQUEST *x, int crit, int lastpos);
494X509_EXTENSION *OCSP_REQUEST_get_ext(OCSP_REQUEST *x, int loc);
495X509_EXTENSION *OCSP_REQUEST_delete_ext(OCSP_REQUEST *x, int loc);
496void *OCSP_REQUEST_get1_ext_d2i(OCSP_REQUEST *x, int nid, int *crit, int *idx);
497int OCSP_REQUEST_add1_ext_i2d(OCSP_REQUEST *x, int nid, void *value, int crit,
498 unsigned long flags);
499int OCSP_REQUEST_add_ext(OCSP_REQUEST *x, X509_EXTENSION *ex, int loc);
500
501int OCSP_ONEREQ_get_ext_count(OCSP_ONEREQ *x);
502int OCSP_ONEREQ_get_ext_by_NID(OCSP_ONEREQ *x, int nid, int lastpos);
503int OCSP_ONEREQ_get_ext_by_OBJ(OCSP_ONEREQ *x, ASN1_OBJECT *obj, int lastpos);
504int OCSP_ONEREQ_get_ext_by_critical(OCSP_ONEREQ *x, int crit, int lastpos);
505X509_EXTENSION *OCSP_ONEREQ_get_ext(OCSP_ONEREQ *x, int loc);
506X509_EXTENSION *OCSP_ONEREQ_delete_ext(OCSP_ONEREQ *x, int loc);
507void *OCSP_ONEREQ_get1_ext_d2i(OCSP_ONEREQ *x, int nid, int *crit, int *idx);
508int OCSP_ONEREQ_add1_ext_i2d(OCSP_ONEREQ *x, int nid, void *value, int crit,
509 unsigned long flags);
510int OCSP_ONEREQ_add_ext(OCSP_ONEREQ *x, X509_EXTENSION *ex, int loc);
511
512int OCSP_BASICRESP_get_ext_count(OCSP_BASICRESP *x);
513int OCSP_BASICRESP_get_ext_by_NID(OCSP_BASICRESP *x, int nid, int lastpos);
514int OCSP_BASICRESP_get_ext_by_OBJ(OCSP_BASICRESP *x, ASN1_OBJECT *obj, int lastpos);
515int OCSP_BASICRESP_get_ext_by_critical(OCSP_BASICRESP *x, int crit, int lastpos);
516X509_EXTENSION *OCSP_BASICRESP_get_ext(OCSP_BASICRESP *x, int loc);
517X509_EXTENSION *OCSP_BASICRESP_delete_ext(OCSP_BASICRESP *x, int loc);
518void *OCSP_BASICRESP_get1_ext_d2i(OCSP_BASICRESP *x, int nid, int *crit, int *idx);
519int OCSP_BASICRESP_add1_ext_i2d(OCSP_BASICRESP *x, int nid, void *value, int crit,
520 unsigned long flags);
521int OCSP_BASICRESP_add_ext(OCSP_BASICRESP *x, X509_EXTENSION *ex, int loc);
522
523int OCSP_SINGLERESP_get_ext_count(OCSP_SINGLERESP *x);
524int OCSP_SINGLERESP_get_ext_by_NID(OCSP_SINGLERESP *x, int nid, int lastpos);
525int OCSP_SINGLERESP_get_ext_by_OBJ(OCSP_SINGLERESP *x, ASN1_OBJECT *obj, int lastpos);
526int OCSP_SINGLERESP_get_ext_by_critical(OCSP_SINGLERESP *x, int crit, int lastpos);
527X509_EXTENSION *OCSP_SINGLERESP_get_ext(OCSP_SINGLERESP *x, int loc);
528X509_EXTENSION *OCSP_SINGLERESP_delete_ext(OCSP_SINGLERESP *x, int loc);
529void *OCSP_SINGLERESP_get1_ext_d2i(OCSP_SINGLERESP *x, int nid, int *crit, int *idx);
530int OCSP_SINGLERESP_add1_ext_i2d(OCSP_SINGLERESP *x, int nid, void *value, int crit,
531 unsigned long flags);
532int OCSP_SINGLERESP_add_ext(OCSP_SINGLERESP *x, X509_EXTENSION *ex, int loc);
533
534DECLARE_ASN1_FUNCTIONS(OCSP_SINGLERESP)
535DECLARE_ASN1_FUNCTIONS(OCSP_CERTSTATUS)
536DECLARE_ASN1_FUNCTIONS(OCSP_REVOKEDINFO)
537DECLARE_ASN1_FUNCTIONS(OCSP_BASICRESP)
538DECLARE_ASN1_FUNCTIONS(OCSP_RESPDATA)
539DECLARE_ASN1_FUNCTIONS(OCSP_RESPID)
540DECLARE_ASN1_FUNCTIONS(OCSP_RESPONSE)
541DECLARE_ASN1_FUNCTIONS(OCSP_RESPBYTES)
542DECLARE_ASN1_FUNCTIONS(OCSP_ONEREQ)
543DECLARE_ASN1_FUNCTIONS(OCSP_CERTID)
544DECLARE_ASN1_FUNCTIONS(OCSP_REQUEST)
545DECLARE_ASN1_FUNCTIONS(OCSP_SIGNATURE)
546DECLARE_ASN1_FUNCTIONS(OCSP_REQINFO)
547DECLARE_ASN1_FUNCTIONS(OCSP_CRLID)
548DECLARE_ASN1_FUNCTIONS(OCSP_SERVICELOC)
549
550char *OCSP_response_status_str(long s);
551char *OCSP_cert_status_str(long s);
552char *OCSP_crl_reason_str(long s);
553
554int OCSP_REQUEST_print(BIO *bp, OCSP_REQUEST* a, unsigned long flags);
555int OCSP_RESPONSE_print(BIO *bp, OCSP_RESPONSE* o, unsigned long flags);
556
557int OCSP_basic_verify(OCSP_BASICRESP *bs, STACK_OF(X509) *certs,
558 X509_STORE *st, unsigned long flags);
559
560/* BEGIN ERROR CODES */
561/* The following lines are auto generated by the script mkerr.pl. Any changes
562 * made after this point may be overwritten when the script is next run.
563 */
564void ERR_load_OCSP_strings(void);
565
566/* Error codes for the OCSP functions. */
567
568/* Function codes. */
569#define OCSP_F_ASN1_STRING_ENCODE 100
570#define OCSP_F_D2I_OCSP_NONCE 102
571#define OCSP_F_OCSP_BASIC_ADD1_STATUS 103
572#define OCSP_F_OCSP_BASIC_SIGN 104
573#define OCSP_F_OCSP_BASIC_VERIFY 105
574#define OCSP_F_OCSP_CERT_ID_NEW 101
575#define OCSP_F_OCSP_CHECK_DELEGATED 106
576#define OCSP_F_OCSP_CHECK_IDS 107
577#define OCSP_F_OCSP_CHECK_ISSUER 108
578#define OCSP_F_OCSP_CHECK_VALIDITY 115
579#define OCSP_F_OCSP_MATCH_ISSUERID 109
580#define OCSP_F_OCSP_PARSE_URL 114
581#define OCSP_F_OCSP_REQUEST_SIGN 110
582#define OCSP_F_OCSP_REQUEST_VERIFY 116
583#define OCSP_F_OCSP_RESPONSE_GET1_BASIC 111
584#define OCSP_F_OCSP_SENDREQ_BIO 112
585#define OCSP_F_PARSE_HTTP_LINE1 117
586#define OCSP_F_REQUEST_VERIFY 113
587
588/* Reason codes. */
589#define OCSP_R_BAD_DATA 100
590#define OCSP_R_CERTIFICATE_VERIFY_ERROR 101
591#define OCSP_R_DIGEST_ERR 102
592#define OCSP_R_ERROR_IN_NEXTUPDATE_FIELD 122
593#define OCSP_R_ERROR_IN_THISUPDATE_FIELD 123
594#define OCSP_R_ERROR_PARSING_URL 121
595#define OCSP_R_MISSING_OCSPSIGNING_USAGE 103
596#define OCSP_R_NEXTUPDATE_BEFORE_THISUPDATE 124
597#define OCSP_R_NOT_BASIC_RESPONSE 104
598#define OCSP_R_NO_CERTIFICATES_IN_CHAIN 105
599#define OCSP_R_NO_CONTENT 106
600#define OCSP_R_NO_PUBLIC_KEY 107
601#define OCSP_R_NO_RESPONSE_DATA 108
602#define OCSP_R_NO_REVOKED_TIME 109
603#define OCSP_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE 110
604#define OCSP_R_REQUEST_NOT_SIGNED 128
605#define OCSP_R_RESPONSE_CONTAINS_NO_REVOCATION_DATA 111
606#define OCSP_R_ROOT_CA_NOT_TRUSTED 112
607#define OCSP_R_SERVER_READ_ERROR 113
608#define OCSP_R_SERVER_RESPONSE_ERROR 114
609#define OCSP_R_SERVER_RESPONSE_PARSE_ERROR 115
610#define OCSP_R_SERVER_WRITE_ERROR 116
611#define OCSP_R_SIGNATURE_FAILURE 117
612#define OCSP_R_SIGNER_CERTIFICATE_NOT_FOUND 118
613#define OCSP_R_STATUS_EXPIRED 125
614#define OCSP_R_STATUS_NOT_YET_VALID 126
615#define OCSP_R_STATUS_TOO_OLD 127
616#define OCSP_R_UNKNOWN_MESSAGE_DIGEST 119
617#define OCSP_R_UNKNOWN_NID 120
618#define OCSP_R_UNSUPPORTED_REQUESTORNAME_TYPE 129
619
620#ifdef __cplusplus
621}
622#endif
623#endif
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-11-02 00:42:12 +0000