1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
|
/*
* Copyright (C) 2011-2012 Free Software Foundation, Inc.
*
* Author: Simon Josefsson
*
* This file is part of GnuTLS.
*
* The GnuTLS is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public License
* as published by the Free Software Foundation; either version 2.1 of
* the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with this program. If not, see <https://www.gnu.org/licenses/>
*
*/
/* Online Certificate Status Protocol - RFC 2560
*/
#ifndef GNUTLS_OCSP_H
#define GNUTLS_OCSP_H
#include <gnutls/gnutls.h>
#include <gnutls/x509.h>
/* *INDENT-OFF* */
#ifdef __cplusplus
extern "C" {
#endif
/* *INDENT-ON* */
#define GNUTLS_OCSP_NONCE "1.3.6.1.5.5.7.48.1.2"
/**
* gnutls_ocsp_print_formats_t:
* @GNUTLS_OCSP_PRINT_FULL: Full information about OCSP request/response.
* @GNUTLS_OCSP_PRINT_COMPACT: More compact information about OCSP request/response.
*
* Enumeration of different OCSP printing variants.
*/
typedef enum gnutls_ocsp_print_formats_t {
GNUTLS_OCSP_PRINT_FULL = 0,
GNUTLS_OCSP_PRINT_COMPACT = 1
} gnutls_ocsp_print_formats_t;
/**
* gnutls_ocsp_resp_status_t:
* @GNUTLS_OCSP_RESP_SUCCESSFUL: Response has valid confirmations.
* @GNUTLS_OCSP_RESP_MALFORMEDREQUEST: Illegal confirmation request
* @GNUTLS_OCSP_RESP_INTERNALERROR: Internal error in issuer
* @GNUTLS_OCSP_RESP_TRYLATER: Try again later
* @GNUTLS_OCSP_RESP_SIGREQUIRED: Must sign the request
* @GNUTLS_OCSP_RESP_UNAUTHORIZED: Request unauthorized
*
* Enumeration of different OCSP response status codes.
*/
typedef enum gnutls_ocsp_resp_status_t {
GNUTLS_OCSP_RESP_SUCCESSFUL = 0,
GNUTLS_OCSP_RESP_MALFORMEDREQUEST = 1,
GNUTLS_OCSP_RESP_INTERNALERROR = 2,
GNUTLS_OCSP_RESP_TRYLATER = 3,
GNUTLS_OCSP_RESP_SIGREQUIRED = 5,
GNUTLS_OCSP_RESP_UNAUTHORIZED = 6
} gnutls_ocsp_resp_status_t;
/**
* gnutls_ocsp_cert_status_t:
* @GNUTLS_OCSP_CERT_GOOD: Positive response to status inquiry.
* @GNUTLS_OCSP_CERT_REVOKED: Certificate has been revoked.
* @GNUTLS_OCSP_CERT_UNKNOWN: The responder doesn't know about the
* certificate.
*
* Enumeration of different OCSP response certificate status codes.
*/
typedef enum gnutls_ocsp_cert_status_t {
GNUTLS_OCSP_CERT_GOOD = 0,
GNUTLS_OCSP_CERT_REVOKED = 1,
GNUTLS_OCSP_CERT_UNKNOWN = 2
} gnutls_ocsp_cert_status_t;
/**
* gnutls_x509_crl_reason_t:
* @GNUTLS_X509_CRLREASON_UNSPECIFIED: Unspecified reason.
* @GNUTLS_X509_CRLREASON_KEYCOMPROMISE: Private key compromised.
* @GNUTLS_X509_CRLREASON_CACOMPROMISE: CA compromised.
* @GNUTLS_X509_CRLREASON_AFFILIATIONCHANGED: Affiliation has changed.
* @GNUTLS_X509_CRLREASON_SUPERSEDED: Certificate superseded.
* @GNUTLS_X509_CRLREASON_CESSATIONOFOPERATION: Operation has ceased.
* @GNUTLS_X509_CRLREASON_CERTIFICATEHOLD: Certificate is on hold.
* @GNUTLS_X509_CRLREASON_REMOVEFROMCRL: Will be removed from delta CRL.
* @GNUTLS_X509_CRLREASON_PRIVILEGEWITHDRAWN: Privilege withdrawn.
* @GNUTLS_X509_CRLREASON_AACOMPROMISE: AA compromised.
*
* Enumeration of different reason codes. Note that this
* corresponds to the CRLReason ASN.1 enumeration type, and not the
* ReasonFlags ASN.1 bit string.
*/
typedef enum gnutls_x509_crl_reason_t {
GNUTLS_X509_CRLREASON_UNSPECIFIED = 0,
GNUTLS_X509_CRLREASON_KEYCOMPROMISE = 1,
GNUTLS_X509_CRLREASON_CACOMPROMISE = 2,
GNUTLS_X509_CRLREASON_AFFILIATIONCHANGED = 3,
GNUTLS_X509_CRLREASON_SUPERSEDED = 4,
GNUTLS_X509_CRLREASON_CESSATIONOFOPERATION = 5,
GNUTLS_X509_CRLREASON_CERTIFICATEHOLD = 6,
GNUTLS_X509_CRLREASON_REMOVEFROMCRL = 8,
GNUTLS_X509_CRLREASON_PRIVILEGEWITHDRAWN = 9,
GNUTLS_X509_CRLREASON_AACOMPROMISE = 10
} gnutls_x509_crl_reason_t;
/* When adding a verify failure reason update:
* _gnutls_ocsp_verify_status_to_str()
*/
/**
* gnutls_ocsp_verify_reason_t:
* @GNUTLS_OCSP_VERIFY_SIGNER_NOT_FOUND: Signer cert not found.
* @GNUTLS_OCSP_VERIFY_SIGNER_KEYUSAGE_ERROR: Signer keyusage bits incorrect.
* @GNUTLS_OCSP_VERIFY_UNTRUSTED_SIGNER: Signer is not trusted.
* @GNUTLS_OCSP_VERIFY_INSECURE_ALGORITHM: Signature using insecure algorithm.
* @GNUTLS_OCSP_VERIFY_SIGNATURE_FAILURE: Signature mismatch.
* @GNUTLS_OCSP_VERIFY_CERT_NOT_ACTIVATED: Signer cert is not yet activated.
* @GNUTLS_OCSP_VERIFY_CERT_EXPIRED: Signer cert has expired.
*
* Enumeration of OCSP verify status codes, used by
* gnutls_ocsp_resp_verify() and gnutls_ocsp_resp_verify_direct().
*/
typedef enum gnutls_ocsp_verify_reason_t {
GNUTLS_OCSP_VERIFY_SIGNER_NOT_FOUND = 1,
GNUTLS_OCSP_VERIFY_SIGNER_KEYUSAGE_ERROR = 2,
GNUTLS_OCSP_VERIFY_UNTRUSTED_SIGNER = 4,
GNUTLS_OCSP_VERIFY_INSECURE_ALGORITHM = 8,
GNUTLS_OCSP_VERIFY_SIGNATURE_FAILURE = 16,
GNUTLS_OCSP_VERIFY_CERT_NOT_ACTIVATED = 32,
GNUTLS_OCSP_VERIFY_CERT_EXPIRED = 64
} gnutls_ocsp_verify_reason_t;
struct gnutls_ocsp_req_int;
typedef struct gnutls_ocsp_req_int *gnutls_ocsp_req_t;
int gnutls_ocsp_req_init(gnutls_ocsp_req_t * req);
void gnutls_ocsp_req_deinit(gnutls_ocsp_req_t req);
int gnutls_ocsp_req_import(gnutls_ocsp_req_t req,
const gnutls_datum_t * data);
int gnutls_ocsp_req_export(gnutls_ocsp_req_t req, gnutls_datum_t * data);
int gnutls_ocsp_req_print(gnutls_ocsp_req_t req,
gnutls_ocsp_print_formats_t format,
gnutls_datum_t * out);
int gnutls_ocsp_req_get_version(gnutls_ocsp_req_t req);
int gnutls_ocsp_req_get_cert_id(gnutls_ocsp_req_t req,
unsigned indx,
gnutls_digest_algorithm_t * digest,
gnutls_datum_t * issuer_name_hash,
gnutls_datum_t * issuer_key_hash,
gnutls_datum_t * serial_number);
int gnutls_ocsp_req_add_cert_id(gnutls_ocsp_req_t req,
gnutls_digest_algorithm_t digest,
const gnutls_datum_t *
issuer_name_hash,
const gnutls_datum_t *
issuer_key_hash,
const gnutls_datum_t * serial_number);
int gnutls_ocsp_req_add_cert(gnutls_ocsp_req_t req,
gnutls_digest_algorithm_t digest,
gnutls_x509_crt_t issuer,
gnutls_x509_crt_t cert);
int gnutls_ocsp_req_get_extension(gnutls_ocsp_req_t req,
unsigned indx,
gnutls_datum_t * oid,
unsigned int *critical,
gnutls_datum_t * data);
int gnutls_ocsp_req_set_extension(gnutls_ocsp_req_t req,
const char *oid,
unsigned int critical,
const gnutls_datum_t * data);
int gnutls_ocsp_req_get_nonce(gnutls_ocsp_req_t req,
unsigned int *critical,
gnutls_datum_t * nonce);
int gnutls_ocsp_req_set_nonce(gnutls_ocsp_req_t req,
unsigned int critical,
const gnutls_datum_t * nonce);
int gnutls_ocsp_req_randomize_nonce(gnutls_ocsp_req_t req);
struct gnutls_ocsp_resp_int;
typedef struct gnutls_ocsp_resp_int *gnutls_ocsp_resp_t;
int gnutls_ocsp_resp_init(gnutls_ocsp_resp_t * resp);
void gnutls_ocsp_resp_deinit(gnutls_ocsp_resp_t resp);
int gnutls_ocsp_resp_import(gnutls_ocsp_resp_t resp,
const gnutls_datum_t * data);
int gnutls_ocsp_resp_import2(gnutls_ocsp_resp_t resp,
const gnutls_datum_t * data,
gnutls_x509_crt_fmt_t fmt);
int gnutls_ocsp_resp_export(gnutls_ocsp_resp_t resp,
gnutls_datum_t * data);
int gnutls_ocsp_resp_export2(gnutls_ocsp_resp_t resp,
gnutls_datum_t * data,
gnutls_x509_crt_fmt_t fmt);
int gnutls_ocsp_resp_print(gnutls_ocsp_resp_t resp,
gnutls_ocsp_print_formats_t format,
gnutls_datum_t * out);
int gnutls_ocsp_resp_get_status(gnutls_ocsp_resp_t resp);
int gnutls_ocsp_resp_get_response(gnutls_ocsp_resp_t resp,
gnutls_datum_t *
response_type_oid,
gnutls_datum_t * response);
int gnutls_ocsp_resp_get_version(gnutls_ocsp_resp_t resp);
int gnutls_ocsp_resp_get_responder(gnutls_ocsp_resp_t resp,
gnutls_datum_t * dn);
int gnutls_ocsp_resp_get_responder2(gnutls_ocsp_resp_t resp,
gnutls_datum_t * dn,
unsigned flags);
/* the raw key ID of the responder */
#define GNUTLS_OCSP_RESP_ID_KEY 1
/* the raw DN of the responder */
#define GNUTLS_OCSP_RESP_ID_DN 2
int
gnutls_ocsp_resp_get_responder_raw_id(gnutls_ocsp_resp_t resp,
unsigned type,
gnutls_datum_t * raw);
time_t gnutls_ocsp_resp_get_produced(gnutls_ocsp_resp_t resp);
int gnutls_ocsp_resp_get_single(gnutls_ocsp_resp_t resp,
unsigned indx,
gnutls_digest_algorithm_t * digest,
gnutls_datum_t * issuer_name_hash,
gnutls_datum_t * issuer_key_hash,
gnutls_datum_t * serial_number,
unsigned int *cert_status,
time_t * this_update,
time_t * next_update,
time_t * revocation_time,
unsigned int *revocation_reason);
int gnutls_ocsp_resp_get_extension(gnutls_ocsp_resp_t resp,
unsigned indx,
gnutls_datum_t * oid,
unsigned int *critical,
gnutls_datum_t * data);
int gnutls_ocsp_resp_get_nonce(gnutls_ocsp_resp_t resp,
unsigned int *critical,
gnutls_datum_t * nonce);
int gnutls_ocsp_resp_get_signature_algorithm(gnutls_ocsp_resp_t resp);
int gnutls_ocsp_resp_get_signature(gnutls_ocsp_resp_t resp,
gnutls_datum_t * sig);
int gnutls_ocsp_resp_get_certs(gnutls_ocsp_resp_t resp,
gnutls_x509_crt_t ** certs,
size_t * ncerts);
int gnutls_ocsp_resp_verify_direct(gnutls_ocsp_resp_t resp,
gnutls_x509_crt_t issuer,
unsigned int *verify,
unsigned int flags);
int gnutls_ocsp_resp_verify(gnutls_ocsp_resp_t resp,
gnutls_x509_trust_list_t trustlist,
unsigned int *verify, unsigned int flags);
int gnutls_ocsp_resp_check_crt(gnutls_ocsp_resp_t resp,
unsigned int indx, gnutls_x509_crt_t crt);
int
gnutls_ocsp_resp_list_import2(gnutls_ocsp_resp_t **ocsps,
unsigned int *size,
const gnutls_datum_t *resp_data,
gnutls_x509_crt_fmt_t format,
unsigned int flags);
/* *INDENT-OFF* */
#ifdef __cplusplus
}
#endif
/* *INDENT-ON* */
#endif /* GNUTLS_OCSP_H */
|
