summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/x509/x509_lcl.h
diff options
context:
space:
mode:
Diffstat (limited to 'src/lib/libcrypto/x509/x509_lcl.h')
-rw-r--r--src/lib/libcrypto/x509/x509_lcl.h317
1 files changed, 317 insertions, 0 deletions
diff --git a/src/lib/libcrypto/x509/x509_lcl.h b/src/lib/libcrypto/x509/x509_lcl.h
index 3e83b66dd6..1b352aee78 100644
--- a/src/lib/libcrypto/x509/x509_lcl.h
+++ b/src/lib/libcrypto/x509/x509_lcl.h
@@ -56,8 +56,325 @@
56 * 56 *
57 */ 57 */
58 58
59#ifndef HEADER_X509_LCL_H
60#define HEADER_X509_LCL_H
61
59__BEGIN_HIDDEN_DECLS 62__BEGIN_HIDDEN_DECLS
60 63
64struct X509_pubkey_st {
65 X509_ALGOR *algor;
66 ASN1_BIT_STRING *public_key;
67 EVP_PKEY *pkey;
68};
69
70struct X509_sig_st {
71 X509_ALGOR *algor;
72 ASN1_OCTET_STRING *digest;
73} /* X509_SIG */;
74
75struct X509_name_entry_st {
76 ASN1_OBJECT *object;
77 ASN1_STRING *value;
78 int set;
79 int size; /* temp variable */
80} /* X509_NAME_ENTRY */;
81
82/* we always keep X509_NAMEs in 2 forms. */
83struct X509_name_st {
84 STACK_OF(X509_NAME_ENTRY) *entries;
85 int modified; /* true if 'bytes' needs to be built */
86#ifndef OPENSSL_NO_BUFFER
87 BUF_MEM *bytes;
88#else
89 char *bytes;
90#endif
91/* unsigned long hash; Keep the hash around for lookups */
92 unsigned char *canon_enc;
93 int canon_enclen;
94} /* X509_NAME */;
95
96struct X509_extension_st {
97 ASN1_OBJECT *object;
98 ASN1_BOOLEAN critical;
99 ASN1_OCTET_STRING *value;
100} /* X509_EXTENSION */;
101
102struct x509_attributes_st {
103 ASN1_OBJECT *object;
104 int single; /* 0 for a set, 1 for a single item (which is wrong) */
105 union {
106 char *ptr;
107/* 0 */ STACK_OF(ASN1_TYPE) *set;
108/* 1 */ ASN1_TYPE *single;
109 } value;
110} /* X509_ATTRIBUTE */;
111
112struct X509_req_info_st {
113 ASN1_ENCODING enc;
114 ASN1_INTEGER *version;
115 X509_NAME *subject;
116 X509_PUBKEY *pubkey;
117 /* d=2 hl=2 l= 0 cons: cont: 00 */
118 STACK_OF(X509_ATTRIBUTE) *attributes; /* [ 0 ] */
119} /* X509_REQ_INFO */;
120
121struct X509_req_st {
122 X509_REQ_INFO *req_info;
123 X509_ALGOR *sig_alg;
124 ASN1_BIT_STRING *signature;
125 int references;
126} /* X509_REQ */;
127
128/*
129 * This stuff is certificate "auxiliary info" it contains details which are
130 * useful in certificate stores and databases. When used this is tagged onto
131 * the end of the certificate itself.
132 */
133struct x509_cert_aux_st {
134 STACK_OF(ASN1_OBJECT) *trust; /* trusted uses */
135 STACK_OF(ASN1_OBJECT) *reject; /* rejected uses */
136 ASN1_UTF8STRING *alias; /* "friendly name" */
137 ASN1_OCTET_STRING *keyid; /* key id of private key */
138 STACK_OF(X509_ALGOR) *other; /* other unspecified info */
139} /* X509_CERT_AUX */;
140
141struct x509_cinf_st {
142 ASN1_INTEGER *version; /* [ 0 ] default of v1 */
143 ASN1_INTEGER *serialNumber;
144 X509_ALGOR *signature;
145 X509_NAME *issuer;
146 X509_VAL *validity;
147 X509_NAME *subject;
148 X509_PUBKEY *key;
149 ASN1_BIT_STRING *issuerUID; /* [ 1 ] optional in v2 */
150 ASN1_BIT_STRING *subjectUID; /* [ 2 ] optional in v2 */
151 STACK_OF(X509_EXTENSION) *extensions; /* [ 3 ] optional in v3 */
152 ASN1_ENCODING enc;
153} /* X509_CINF */;
154
155struct x509_st {
156 X509_CINF *cert_info;
157 X509_ALGOR *sig_alg;
158 ASN1_BIT_STRING *signature;
159 int valid;
160 int references;
161 char *name;
162 CRYPTO_EX_DATA ex_data;
163 /* These contain copies of various extension values */
164 long ex_pathlen;
165 long ex_pcpathlen;
166 unsigned long ex_flags;
167 unsigned long ex_kusage;
168 unsigned long ex_xkusage;
169 unsigned long ex_nscert;
170 ASN1_OCTET_STRING *skid;
171 AUTHORITY_KEYID *akid;
172 X509_POLICY_CACHE *policy_cache;
173 STACK_OF(DIST_POINT) *crldp;
174 STACK_OF(GENERAL_NAME) *altname;
175 NAME_CONSTRAINTS *nc;
176#ifndef OPENSSL_NO_RFC3779
177 STACK_OF(IPAddressFamily) *rfc3779_addr;
178 struct ASIdentifiers_st *rfc3779_asid;
179#endif
180#ifndef OPENSSL_NO_SHA
181 unsigned char sha1_hash[SHA_DIGEST_LENGTH];
182#endif
183 X509_CERT_AUX *aux;
184} /* X509 */;
185
186struct x509_revoked_st {
187 ASN1_INTEGER *serialNumber;
188 ASN1_TIME *revocationDate;
189 STACK_OF(X509_EXTENSION) /* optional */ *extensions;
190 /* Set up if indirect CRL */
191 STACK_OF(GENERAL_NAME) *issuer;
192 /* Revocation reason */
193 int reason;
194 int sequence; /* load sequence */
195};
196
197struct X509_crl_info_st {
198 ASN1_INTEGER *version;
199 X509_ALGOR *sig_alg;
200 X509_NAME *issuer;
201 ASN1_TIME *lastUpdate;
202 ASN1_TIME *nextUpdate;
203 STACK_OF(X509_REVOKED) *revoked;
204 STACK_OF(X509_EXTENSION) /* [0] */ *extensions;
205 ASN1_ENCODING enc;
206} /* X509_CRL_INFO */;
207
208struct X509_crl_st {
209 /* actual signature */
210 X509_CRL_INFO *crl;
211 X509_ALGOR *sig_alg;
212 ASN1_BIT_STRING *signature;
213 int references;
214 int flags;
215 /* Copies of various extensions */
216 AUTHORITY_KEYID *akid;
217 ISSUING_DIST_POINT *idp;
218 /* Convenient breakdown of IDP */
219 int idp_flags;
220 int idp_reasons;
221 /* CRL and base CRL numbers for delta processing */
222 ASN1_INTEGER *crl_number;
223 ASN1_INTEGER *base_crl_number;
224#ifndef OPENSSL_NO_SHA
225 unsigned char sha1_hash[SHA_DIGEST_LENGTH];
226#endif
227 STACK_OF(GENERAL_NAMES) *issuers;
228 const X509_CRL_METHOD *meth;
229 void *meth_data;
230} /* X509_CRL */;
231
232struct pkcs8_priv_key_info_st {
233 ASN1_INTEGER *version;
234 X509_ALGOR *pkeyalg;
235 ASN1_OCTET_STRING *pkey;
236 STACK_OF(X509_ATTRIBUTE) *attributes;
237};
238
239struct x509_object_st {
240 /* one of the above types */
241 int type;
242 union {
243 char *ptr;
244 X509 *x509;
245 X509_CRL *crl;
246 EVP_PKEY *pkey;
247 } data;
248} /* X509_OBJECT */;
249
250struct x509_lookup_method_st {
251 const char *name;
252 int (*new_item)(X509_LOOKUP *ctx);
253 void (*free)(X509_LOOKUP *ctx);
254 int (*init)(X509_LOOKUP *ctx);
255 int (*shutdown)(X509_LOOKUP *ctx);
256 int (*ctrl)(X509_LOOKUP *ctx, int cmd, const char *argc, long argl,
257 char **ret);
258 int (*get_by_subject)(X509_LOOKUP *ctx, int type, X509_NAME *name,
259 X509_OBJECT *ret);
260 int (*get_by_issuer_serial)(X509_LOOKUP *ctx, int type, X509_NAME *name,
261 ASN1_INTEGER *serial,X509_OBJECT *ret);
262 int (*get_by_fingerprint)(X509_LOOKUP *ctx, int type,
263 const unsigned char *bytes, int len, X509_OBJECT *ret);
264 int (*get_by_alias)(X509_LOOKUP *ctx, int type, const char *str,
265 int len, X509_OBJECT *ret);
266} /* X509_LOOKUP_METHOD */;
267
268struct X509_VERIFY_PARAM_st {
269 char *name;
270 time_t check_time; /* Time to use */
271 unsigned long inh_flags; /* Inheritance flags */
272 unsigned long flags; /* Various verify flags */
273 int purpose; /* purpose to check untrusted certificates */
274 int trust; /* trust setting to check */
275 int depth; /* Verify depth */
276 STACK_OF(ASN1_OBJECT) *policies; /* Permissible policies */
277 X509_VERIFY_PARAM_ID *id; /* opaque ID data */
278} /* X509_VERIFY_PARAM */;
279
280/*
281 * This is used to hold everything. It is used for all certificate
282 * validation. Once we have a certificate chain, the 'verify'
283 * function is then called to actually check the cert chain.
284 */
285struct x509_store_st {
286 /* The following is a cache of trusted certs */
287 int cache; /* if true, stash any hits */
288 STACK_OF(X509_OBJECT) *objs; /* Cache of all objects */
289
290 /* These are external lookup methods */
291 STACK_OF(X509_LOOKUP) *get_cert_methods;
292
293 X509_VERIFY_PARAM *param;
294
295 /* Callbacks for various operations */
296 int (*verify)(X509_STORE_CTX *ctx); /* called to verify a certificate */
297 int (*verify_cb)(int ok,X509_STORE_CTX *ctx); /* error callback */
298 int (*get_issuer)(X509 **issuer, X509_STORE_CTX *ctx, X509 *x); /* get issuers cert from ctx */
299 int (*check_issued)(X509_STORE_CTX *ctx, X509 *x, X509 *issuer); /* check issued */
300 int (*check_revocation)(X509_STORE_CTX *ctx); /* Check revocation status of chain */
301 int (*get_crl)(X509_STORE_CTX *ctx, X509_CRL **crl, X509 *x); /* retrieve CRL */
302 int (*check_crl)(X509_STORE_CTX *ctx, X509_CRL *crl); /* Check CRL validity */
303 int (*cert_crl)(X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x); /* Check certificate against CRL */
304 STACK_OF(X509) * (*lookup_certs)(X509_STORE_CTX *ctx, X509_NAME *nm);
305 STACK_OF(X509_CRL) * (*lookup_crls)(X509_STORE_CTX *ctx, X509_NAME *nm);
306 int (*cleanup)(X509_STORE_CTX *ctx);
307
308 CRYPTO_EX_DATA ex_data;
309 int references;
310} /* X509_STORE */;
311
312/* This is the functions plus an instance of the local variables. */
313struct x509_lookup_st {
314 int init; /* have we been started */
315 int skip; /* don't use us. */
316 X509_LOOKUP_METHOD *method; /* the functions */
317 char *method_data; /* method data */
318
319 X509_STORE *store_ctx; /* who owns us */
320} /* X509_LOOKUP */;
321
322/*
323 * This is used when verifying cert chains. Since the gathering of the cert
324 * chain can take some time (and has to be 'retried'), this needs to be kept
325 * and passed around.
326 */
327struct x509_store_ctx_st {
328 X509_STORE *ctx;
329 int current_method; /* used when looking up certs */
330
331 /* The following are set by the caller */
332 X509 *cert; /* The cert to check */
333 STACK_OF(X509) *untrusted; /* chain of X509s - untrusted - passed in */
334 STACK_OF(X509_CRL) *crls; /* set of CRLs passed in */
335
336 X509_VERIFY_PARAM *param;
337 void *other_ctx; /* Other info for use with get_issuer() */
338
339 /* Callbacks for various operations */
340 int (*verify)(X509_STORE_CTX *ctx); /* called to verify a certificate */
341 int (*verify_cb)(int ok,X509_STORE_CTX *ctx); /* error callback */
342 int (*get_issuer)(X509 **issuer, X509_STORE_CTX *ctx, X509 *x); /* get issuers cert from ctx */
343 int (*check_issued)(X509_STORE_CTX *ctx, X509 *x, X509 *issuer); /* check issued */
344 int (*check_revocation)(X509_STORE_CTX *ctx); /* Check revocation status of chain */
345 int (*get_crl)(X509_STORE_CTX *ctx, X509_CRL **crl, X509 *x); /* retrieve CRL */
346 int (*check_crl)(X509_STORE_CTX *ctx, X509_CRL *crl); /* Check CRL validity */
347 int (*cert_crl)(X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x); /* Check certificate against CRL */
348 int (*check_policy)(X509_STORE_CTX *ctx);
349 STACK_OF(X509) * (*lookup_certs)(X509_STORE_CTX *ctx, X509_NAME *nm);
350 STACK_OF(X509_CRL) * (*lookup_crls)(X509_STORE_CTX *ctx, X509_NAME *nm);
351 int (*cleanup)(X509_STORE_CTX *ctx);
352
353 /* The following is built up */
354 int valid; /* if 0, rebuild chain */
355 int last_untrusted; /* XXX: number of untrusted certs in chain!!! */
356 STACK_OF(X509) *chain; /* chain of X509s - built up and trusted */
357 X509_POLICY_TREE *tree; /* Valid policy tree */
358
359 int explicit_policy; /* Require explicit policy value */
360
361 /* When something goes wrong, this is why */
362 int error_depth;
363 int error;
364 X509 *current_cert;
365 X509 *current_issuer; /* cert currently being tested as valid issuer */
366 X509_CRL *current_crl; /* current CRL */
367
368 int current_crl_score; /* score of current CRL */
369 unsigned int current_reasons; /* Reason mask */
370
371 X509_STORE_CTX *parent; /* For CRL path validation: parent context */
372
373 CRYPTO_EX_DATA ex_data;
374} /* X509_STORE_CTX */;
375
61int x509_check_cert_time(X509_STORE_CTX *ctx, X509 *x, int quiet); 376int x509_check_cert_time(X509_STORE_CTX *ctx, X509 *x, int quiet);
62 377
63__END_HIDDEN_DECLS 378__END_HIDDEN_DECLS
379
380#endif /* !HEADER_X509_LCL_H */
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-04-27 06:07:27 +0000