]> git.ipfire.org Git - thirdparty/openssl.git/blame - include/openssl/x509_vfy.h
projects / thirdparty / openssl.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
OSSL_STORE: constify the criterion parameter a bit more
[thirdparty/openssl.git] / include / openssl / x509_vfy.h
CommitLineData
21dcbebc 1/*
83cf7abf 2 * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
0f113f3e 3 *
48f4ad77 4 * Licensed under the Apache License 2.0 (the "License"). You may not use
21dcbebc
RS		 5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
d02b48c6
RE		 8 */
9
ae4186b0
DMSP		 10#ifndef OPENSSL_X509_VFY_H
11# define OPENSSL_X509_VFY_H
d86167ec
DMSP		 12# pragma once
13
14# include <openssl/macros.h>
15# if !OPENSSL_API_3
16# define HEADER_X509_VFY_H
17# endif
d02b48c6 18
895c2f84
VD		 19/*
20 * Protect against recursion, x509.h and x509_vfy.h each include the other.
21 */
ae4186b0 22# ifndef OPENSSL_X509_H
895c2f84
VD		 23# include <openssl/x509.h>
24# endif
25
0f113f3e 26# include <openssl/opensslconf.h>
a00ae6c4 27# include <openssl/lhash.h>
0f113f3e
MC		 28# include <openssl/bio.h>
29# include <openssl/crypto.h>
30# include <openssl/symhacks.h>
82271cee 31
d02b48c6
RE		 32#ifdef __cplusplus
33extern "C" {
34#endif
35
1d97c843 36/*-
0f113f3e
MC		 37SSL_CTX -> X509_STORE
38 -> X509_LOOKUP
39 ->X509_LOOKUP_METHOD
40 -> X509_LOOKUP
41 ->X509_LOOKUP_METHOD
42
43SSL -> X509_STORE_CTX
44 ->X509_STORE
d02b48c6
RE		 45
46The X509_STORE holds the tables etc for verification stuff.
47A X509_STORE_CTX is used while validating a single certificate.
48The X509_STORE has X509_LOOKUPs for looking up certs.
49The X509_STORE then calls a function to actually verify the
50certificate chain.
51*/
52
bca3f06b 53typedef enum {
4c4a2f67
DSH		 54 X509_LU_NONE = 0,
55 X509_LU_X509, X509_LU_CRL
bca3f06b 56} X509_LOOKUP_TYPE;
0f113f3e 57
fcd2d5a6 58#if !OPENSSL_API_1_1_0
4c4a2f67
DSH		 59#define X509_LU_RETRY -1
60#define X509_LU_FAIL 0
ba1a1c37 61#endif
a6801a91 62
85885715
DSH		 63DEFINE_STACK_OF(X509_LOOKUP)
64DEFINE_STACK_OF(X509_OBJECT)
85885715 65DEFINE_STACK_OF(X509_VERIFY_PARAM)
5d7c222d 66
5d7c222d 67int X509_STORE_set_depth(X509_STORE *store, int depth);
d02b48c6 68
7cafbb4b 69typedef int (*X509_STORE_CTX_verify_cb)(int, X509_STORE_CTX *);
1060a50b
RL		 70typedef int (*X509_STORE_CTX_verify_fn)(X509_STORE_CTX *);
71typedef int (*X509_STORE_CTX_get_issuer_fn)(X509 **issuer,
72 X509_STORE_CTX *ctx, X509 *x);
73typedef int (*X509_STORE_CTX_check_issued_fn)(X509_STORE_CTX *ctx,
74 X509 *x, X509 *issuer);
75typedef int (*X509_STORE_CTX_check_revocation_fn)(X509_STORE_CTX *ctx);
76typedef int (*X509_STORE_CTX_get_crl_fn)(X509_STORE_CTX *ctx,
77 X509_CRL **crl, X509 *x);
78typedef int (*X509_STORE_CTX_check_crl_fn)(X509_STORE_CTX *ctx, X509_CRL *crl);
79typedef int (*X509_STORE_CTX_cert_crl_fn)(X509_STORE_CTX *ctx,
80 X509_CRL *crl, X509 *x);
81typedef int (*X509_STORE_CTX_check_policy_fn)(X509_STORE_CTX *ctx);
82typedef STACK_OF(X509) *(*X509_STORE_CTX_lookup_certs_fn)(X509_STORE_CTX *ctx,
83 X509_NAME *nm);
84typedef STACK_OF(X509_CRL) *(*X509_STORE_CTX_lookup_crls_fn)(X509_STORE_CTX *ctx,
85 X509_NAME *nm);
86typedef int (*X509_STORE_CTX_cleanup_fn)(X509_STORE_CTX *ctx);
7cafbb4b 87
d02b48c6 88
5d7c222d 89void X509_STORE_CTX_set_depth(X509_STORE_CTX *ctx, int depth);
7f89714e 90
0f113f3e
MC		 91# define X509_STORE_CTX_set_app_data(ctx,data) \
92 X509_STORE_CTX_set_ex_data(ctx,0,data)
93# define X509_STORE_CTX_get_app_data(ctx) \
94 X509_STORE_CTX_get_ex_data(ctx,0)
d02b48c6 95
0f113f3e
MC		 96# define X509_L_FILE_LOAD 1
97# define X509_L_ADD_DIR 2
d02b48c6 98
0f113f3e
MC		 99# define X509_LOOKUP_load_file(x,name,type) \
100 X509_LOOKUP_ctrl((x),X509_L_FILE_LOAD,(name),(long)(type),NULL)
d02b48c6 101
0f113f3e
MC		 102# define X509_LOOKUP_add_dir(x,name,type) \
103 X509_LOOKUP_ctrl((x),X509_L_ADD_DIR,(name),(long)(type),NULL)
d02b48c6 104
0f113f3e 105# define X509_V_OK 0
e29c73c9 106# define X509_V_ERR_UNSPECIFIED 1
0f113f3e
MC		 107# define X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT 2
108# define X509_V_ERR_UNABLE_TO_GET_CRL 3
109# define X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE 4
110# define X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE 5
111# define X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY 6
112# define X509_V_ERR_CERT_SIGNATURE_FAILURE 7
113# define X509_V_ERR_CRL_SIGNATURE_FAILURE 8
114# define X509_V_ERR_CERT_NOT_YET_VALID 9
115# define X509_V_ERR_CERT_HAS_EXPIRED 10
116# define X509_V_ERR_CRL_NOT_YET_VALID 11
117# define X509_V_ERR_CRL_HAS_EXPIRED 12
118# define X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD 13
119# define X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD 14
120# define X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD 15
121# define X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD 16
122# define X509_V_ERR_OUT_OF_MEM 17
123# define X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT 18
124# define X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN 19
125# define X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY 20
126# define X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE 21
127# define X509_V_ERR_CERT_CHAIN_TOO_LONG 22
128# define X509_V_ERR_CERT_REVOKED 23
129# define X509_V_ERR_INVALID_CA 24
130# define X509_V_ERR_PATH_LENGTH_EXCEEDED 25
131# define X509_V_ERR_INVALID_PURPOSE 26
132# define X509_V_ERR_CERT_UNTRUSTED 27
133# define X509_V_ERR_CERT_REJECTED 28
2f043896 134/* These are 'informational' when looking for issuer cert */
0f113f3e
MC		 135# define X509_V_ERR_SUBJECT_ISSUER_MISMATCH 29
136# define X509_V_ERR_AKID_SKID_MISMATCH 30
137# define X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH 31
138# define X509_V_ERR_KEYUSAGE_NO_CERTSIGN 32
0f113f3e
MC		 139# define X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER 33
140# define X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION 34
141# define X509_V_ERR_KEYUSAGE_NO_CRL_SIGN 35
142# define X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION 36
143# define X509_V_ERR_INVALID_NON_CA 37
144# define X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED 38
145# define X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE 39
146# define X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED 40
0f113f3e
MC		 147# define X509_V_ERR_INVALID_EXTENSION 41
148# define X509_V_ERR_INVALID_POLICY_EXTENSION 42
149# define X509_V_ERR_NO_EXPLICIT_POLICY 43
150# define X509_V_ERR_DIFFERENT_CRL_SCOPE 44
151# define X509_V_ERR_UNSUPPORTED_EXTENSION_FEATURE 45
0f113f3e 152# define X509_V_ERR_UNNESTED_RESOURCE 46
0f113f3e
MC		 153# define X509_V_ERR_PERMITTED_VIOLATION 47
154# define X509_V_ERR_EXCLUDED_VIOLATION 48
155# define X509_V_ERR_SUBTREE_MINMAX 49
d33def66
VD		 156/* The application is not happy */
157# define X509_V_ERR_APPLICATION_VERIFICATION 50
0f113f3e
MC		 158# define X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE 51
159# define X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX 52
160# define X509_V_ERR_UNSUPPORTED_NAME_SYNTAX 53
161# define X509_V_ERR_CRL_PATH_VALIDATION_ERROR 54
2b3936e8 162/* Another issuer check debug option */
0f113f3e 163# define X509_V_ERR_PATH_LOOP 55
3ad344a5 164/* Suite B mode algorithm violation */
0f113f3e
MC		 165# define X509_V_ERR_SUITE_B_INVALID_VERSION 56
166# define X509_V_ERR_SUITE_B_INVALID_ALGORITHM 57
167# define X509_V_ERR_SUITE_B_INVALID_CURVE 58
168# define X509_V_ERR_SUITE_B_INVALID_SIGNATURE_ALGORITHM 59
169# define X509_V_ERR_SUITE_B_LOS_NOT_ALLOWED 60
170# define X509_V_ERR_SUITE_B_CANNOT_SIGN_P_384_WITH_P_256 61
3bf15e29 171/* Host, email and IP check errors */
0f113f3e
MC		 172# define X509_V_ERR_HOSTNAME_MISMATCH 62
173# define X509_V_ERR_EMAIL_MISMATCH 63
174# define X509_V_ERR_IP_ADDRESS_MISMATCH 64
c0a445a9
VD		 175/* DANE TLSA errors */
176# define X509_V_ERR_DANE_NO_MATCH 65
fbb82a60
VD		 177/* security level errors */
178# define X509_V_ERR_EE_KEY_TOO_SMALL 66
179# define X509_V_ERR_CA_KEY_TOO_SMALL 67
180# define X509_V_ERR_CA_MD_TOO_WEAK 68
f3e235ed
VD		 181/* Caller error */
182# define X509_V_ERR_INVALID_CALL 69
183/* Issuer lookup error */
184# define X509_V_ERR_STORE_LOOKUP 70
f75b34c8
VD		 185/* Certificate transparency */
186# define X509_V_ERR_NO_VALID_SCTS 71
f3e235ed 187
c8223538 188# define X509_V_ERR_PROXY_SUBJECT_NAME_VIOLATION 72
3bb0f989
TS		 189/* OCSP status errors */
190# define X509_V_ERR_OCSP_VERIFY_NEEDED 73 /* Need OCSP verification */
191# define X509_V_ERR_OCSP_VERIFY_FAILED 74 /* Couldn't verify cert through OCSP */
192# define X509_V_ERR_OCSP_CERT_UNKNOWN 75 /* Certificate wasn't recognized by the OCSP responder */
c8223538 193
ffd2df13
RL		 194# define X509_V_ERR_SIGNATURE_ALGORITHM_MISMATCH 76
195# define X509_V_ERR_NO_ISSUER_PUBLIC_KEY 77
196
197
2f043896
DSH		 198/* Certificate verify flags */
199
fcd2d5a6 200# if !OPENSSL_API_1_1_0
d33def66
VD		 201# define X509_V_FLAG_CB_ISSUER_CHECK 0x0 /* Deprecated */
202# endif
bc501570 203/* Use check time instead of current time */
0f113f3e 204# define X509_V_FLAG_USE_CHECK_TIME 0x2
bc501570 205/* Lookup CRLs */
0f113f3e 206# define X509_V_FLAG_CRL_CHECK 0x4
bc501570 207/* Lookup CRLs for whole chain */
0f113f3e 208# define X509_V_FLAG_CRL_CHECK_ALL 0x8
bc501570 209/* Ignore unhandled critical extensions */
0f113f3e 210# define X509_V_FLAG_IGNORE_CRITICAL 0x10
bc501570 211/* Disable workarounds for broken certificates */
0f113f3e 212# define X509_V_FLAG_X509_STRICT 0x20
d9bfe4f9 213/* Enable proxy certificate validation */
0f113f3e 214# define X509_V_FLAG_ALLOW_PROXY_CERTS 0x40
4acc3e90 215/* Enable policy checking */
0f113f3e 216# define X509_V_FLAG_POLICY_CHECK 0x80
4acc3e90 217/* Policy variable require-explicit-policy */
0f113f3e 218# define X509_V_FLAG_EXPLICIT_POLICY 0x100
4acc3e90 219/* Policy variable inhibit-any-policy */
0f113f3e 220# define X509_V_FLAG_INHIBIT_ANY 0x200
5d7c222d 221/* Policy variable inhibit-policy-mapping */
0f113f3e 222# define X509_V_FLAG_INHIBIT_MAP 0x400
5d7c222d 223/* Notify callback that policy is OK */
0f113f3e 224# define X509_V_FLAG_NOTIFY_POLICY 0x800
9d84d4ed 225/* Extended CRL features such as indirect CRLs, alternate CRL signing keys */
0f113f3e 226# define X509_V_FLAG_EXTENDED_CRL_SUPPORT 0x1000
d43c4497 227/* Delta CRL support */
0f113f3e 228# define X509_V_FLAG_USE_DELTAS 0x2000
8483a003 229/* Check self-signed CA signature */
0f113f3e 230# define X509_V_FLAG_CHECK_SS_SIGNATURE 0x4000
db28aa86 231/* Use trusted store first */
0f113f3e 232# define X509_V_FLAG_TRUSTED_FIRST 0x8000
3ad344a5 233/* Suite B 128 bit only mode: not normally used */
0f113f3e 234# define X509_V_FLAG_SUITEB_128_LOS_ONLY 0x10000
3ad344a5 235/* Suite B 192 bit only mode */
0f113f3e 236# define X509_V_FLAG_SUITEB_192_LOS 0x20000
3ad344a5 237/* Suite B 128 bit mode allowing 192 bit algorithms */
0f113f3e 238# define X509_V_FLAG_SUITEB_128_LOS 0x30000
51e7a437 239/* Allow partial chains if at least one certificate is in trusted store */
0f113f3e 240# define X509_V_FLAG_PARTIAL_CHAIN 0x80000
15dba5be
MC		 241/*
242 * If the initial chain is not trusted, do not attempt to build an alternative
243 * chain. Alternate chain checking was introduced in 1.1.0. Setting this flag
244 * will force the behaviour to match that of previous versions.
245 */
246# define X509_V_FLAG_NO_ALT_CHAINS 0x100000
d35ff2c0
DW		 247/* Do not check certificate/CRL validity against current time */
248# define X509_V_FLAG_NO_CHECK_TIME 0x200000
5d7c222d 249
0f113f3e
MC		 250# define X509_VP_FLAG_DEFAULT 0x1
251# define X509_VP_FLAG_OVERWRITE 0x2
252# define X509_VP_FLAG_RESET_FLAGS 0x4
253# define X509_VP_FLAG_LOCKED 0x8
254# define X509_VP_FLAG_ONCE 0x10
5d7c222d
DSH		 255
256/* Internal use: mask of policy related options */
0f113f3e
MC		 257# define X509_V_FLAG_POLICY_MASK (X509_V_FLAG_POLICY_CHECK \
258 | X509_V_FLAG_EXPLICIT_POLICY \
259 | X509_V_FLAG_INHIBIT_ANY \
260 | X509_V_FLAG_INHIBIT_MAP)
2f043896 261
0946a198 262int X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, X509_LOOKUP_TYPE type,
0f113f3e
MC		 263 X509_NAME *name);
264X509_OBJECT *X509_OBJECT_retrieve_by_subject(STACK_OF(X509_OBJECT) *h,
0946a198
DSH		 265 X509_LOOKUP_TYPE type,
266 X509_NAME *name);
0f113f3e
MC		 267X509_OBJECT *X509_OBJECT_retrieve_match(STACK_OF(X509_OBJECT) *h,
268 X509_OBJECT *x);
c5ebfcab 269int X509_OBJECT_up_ref_count(X509_OBJECT *a);
6ddbb4cd 270X509_OBJECT *X509_OBJECT_new(void);
f0e0fd51 271void X509_OBJECT_free(X509_OBJECT *a);
0946a198 272X509_LOOKUP_TYPE X509_OBJECT_get_type(const X509_OBJECT *a);
7d7da288 273X509 *X509_OBJECT_get0_X509(const X509_OBJECT *a);
0124f32a 274int X509_OBJECT_set1_X509(X509_OBJECT *a, X509 *obj);
6ddbb4cd 275X509_CRL *X509_OBJECT_get0_X509_CRL(X509_OBJECT *a);
0124f32a 276int X509_OBJECT_set1_X509_CRL(X509_OBJECT *a, X509_CRL *obj);
0f113f3e 277X509_STORE *X509_STORE_new(void);
d02b48c6 278void X509_STORE_free(X509_STORE *v);
3067095e
RL		 279int X509_STORE_lock(X509_STORE *ctx);
280int X509_STORE_unlock(X509_STORE *ctx);
c001ce33 281int X509_STORE_up_ref(X509_STORE *v);
f0c58c32 282STACK_OF(X509_OBJECT) *X509_STORE_get0_objects(X509_STORE *v);
d02b48c6 283
6ddbb4cd
RS		 284STACK_OF(X509) *X509_STORE_CTX_get1_certs(X509_STORE_CTX *st, X509_NAME *nm);
285STACK_OF(X509_CRL) *X509_STORE_CTX_get1_crls(X509_STORE_CTX *st, X509_NAME *nm);
5d7c222d 286int X509_STORE_set_flags(X509_STORE *ctx, unsigned long flags);
926a56bf
DSH		 287int X509_STORE_set_purpose(X509_STORE *ctx, int purpose);
288int X509_STORE_set_trust(X509_STORE *ctx, int trust);
5d7c222d 289int X509_STORE_set1_param(X509_STORE *ctx, X509_VERIFY_PARAM *pm);
f0c58c32 290X509_VERIFY_PARAM *X509_STORE_get0_param(X509_STORE *ctx);
bdee69f7 291
1060a50b
RL		 292void X509_STORE_set_verify(X509_STORE *ctx, X509_STORE_CTX_verify_fn verify);
293#define X509_STORE_set_verify_func(ctx, func) \
294 X509_STORE_set_verify((ctx),(func))
4a7b3a7b
VD		 295void X509_STORE_CTX_set_verify(X509_STORE_CTX *ctx,
296 X509_STORE_CTX_verify_fn verify);
1060a50b 297X509_STORE_CTX_verify_fn X509_STORE_get_verify(X509_STORE *ctx);
a5b37fca 298void X509_STORE_set_verify_cb(X509_STORE *ctx,
1060a50b
RL		 299 X509_STORE_CTX_verify_cb verify_cb);
300# define X509_STORE_set_verify_cb_func(ctx,func) \
301 X509_STORE_set_verify_cb((ctx),(func))
302X509_STORE_CTX_verify_cb X509_STORE_get_verify_cb(X509_STORE *ctx);
303void X509_STORE_set_get_issuer(X509_STORE *ctx,
304 X509_STORE_CTX_get_issuer_fn get_issuer);
305X509_STORE_CTX_get_issuer_fn X509_STORE_get_get_issuer(X509_STORE *ctx);
306void X509_STORE_set_check_issued(X509_STORE *ctx,
307 X509_STORE_CTX_check_issued_fn check_issued);
308X509_STORE_CTX_check_issued_fn X509_STORE_get_check_issued(X509_STORE *ctx);
309void X509_STORE_set_check_revocation(X509_STORE *ctx,
310 X509_STORE_CTX_check_revocation_fn check_revocation);
311X509_STORE_CTX_check_revocation_fn X509_STORE_get_check_revocation(X509_STORE *ctx);
312void X509_STORE_set_get_crl(X509_STORE *ctx,
313 X509_STORE_CTX_get_crl_fn get_crl);
314X509_STORE_CTX_get_crl_fn X509_STORE_get_get_crl(X509_STORE *ctx);
315void X509_STORE_set_check_crl(X509_STORE *ctx,
316 X509_STORE_CTX_check_crl_fn check_crl);
317X509_STORE_CTX_check_crl_fn X509_STORE_get_check_crl(X509_STORE *ctx);
318void X509_STORE_set_cert_crl(X509_STORE *ctx,
319 X509_STORE_CTX_cert_crl_fn cert_crl);
320X509_STORE_CTX_cert_crl_fn X509_STORE_get_cert_crl(X509_STORE *ctx);
0a5fe2eb
RL		 321void X509_STORE_set_check_policy(X509_STORE *ctx,
322 X509_STORE_CTX_check_policy_fn check_policy);
323X509_STORE_CTX_check_policy_fn X509_STORE_get_check_policy(X509_STORE *ctx);
1060a50b
RL		 324void X509_STORE_set_lookup_certs(X509_STORE *ctx,
325 X509_STORE_CTX_lookup_certs_fn lookup_certs);
326X509_STORE_CTX_lookup_certs_fn X509_STORE_get_lookup_certs(X509_STORE *ctx);
327void X509_STORE_set_lookup_crls(X509_STORE *ctx,
328 X509_STORE_CTX_lookup_crls_fn lookup_crls);
329#define X509_STORE_set_lookup_crls_cb(ctx, func) \
330 X509_STORE_set_lookup_crls((ctx), (func))
331X509_STORE_CTX_lookup_crls_fn X509_STORE_get_lookup_crls(X509_STORE *ctx);
332void X509_STORE_set_cleanup(X509_STORE *ctx,
333 X509_STORE_CTX_cleanup_fn cleanup);
334X509_STORE_CTX_cleanup_fn X509_STORE_get_cleanup(X509_STORE *ctx);
a5b37fca 335
3aec886e
KY		 336#define X509_STORE_get_ex_new_index(l, p, newf, dupf, freef) \
337 CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_X509_STORE, l, p, newf, dupf, freef)
338int X509_STORE_set_ex_data(X509_STORE *ctx, int idx, void *data);
339void *X509_STORE_get_ex_data(X509_STORE *ctx, int idx);
2c340864 340
11262391 341X509_STORE_CTX *X509_STORE_CTX_new(void);
2f043896
DSH		 342
343int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x);
344
11262391 345void X509_STORE_CTX_free(X509_STORE_CTX *ctx);
79aa04ef 346int X509_STORE_CTX_init(X509_STORE_CTX *ctx, X509_STORE *store,
0f113f3e 347 X509 *x509, STACK_OF(X509) *chain);
f0e0fd51 348void X509_STORE_CTX_set0_trusted_stack(X509_STORE_CTX *ctx, STACK_OF(X509) *sk);
d02b48c6
RE		 349void X509_STORE_CTX_cleanup(X509_STORE_CTX *ctx);
350
2c340864 351X509_STORE *X509_STORE_CTX_get0_store(X509_STORE_CTX *ctx);
f0e0fd51
RS		 352X509 *X509_STORE_CTX_get0_cert(X509_STORE_CTX *ctx);
353STACK_OF(X509)* X509_STORE_CTX_get0_untrusted(X509_STORE_CTX *ctx);
4dba585f 354void X509_STORE_CTX_set0_untrusted(X509_STORE_CTX *ctx, STACK_OF(X509) *sk);
f0e0fd51
RS		 355void X509_STORE_CTX_set_verify_cb(X509_STORE_CTX *ctx,
356 X509_STORE_CTX_verify_cb verify);
357X509_STORE_CTX_verify_cb X509_STORE_CTX_get_verify_cb(X509_STORE_CTX *ctx);
1060a50b
RL		 358X509_STORE_CTX_verify_fn X509_STORE_CTX_get_verify(X509_STORE_CTX *ctx);
359X509_STORE_CTX_get_issuer_fn X509_STORE_CTX_get_get_issuer(X509_STORE_CTX *ctx);
360X509_STORE_CTX_check_issued_fn X509_STORE_CTX_get_check_issued(X509_STORE_CTX *ctx);
361X509_STORE_CTX_check_revocation_fn X509_STORE_CTX_get_check_revocation(X509_STORE_CTX *ctx);
362X509_STORE_CTX_get_crl_fn X509_STORE_CTX_get_get_crl(X509_STORE_CTX *ctx);
363X509_STORE_CTX_check_crl_fn X509_STORE_CTX_get_check_crl(X509_STORE_CTX *ctx);
364X509_STORE_CTX_cert_crl_fn X509_STORE_CTX_get_cert_crl(X509_STORE_CTX *ctx);
365X509_STORE_CTX_check_policy_fn X509_STORE_CTX_get_check_policy(X509_STORE_CTX *ctx);
366X509_STORE_CTX_lookup_certs_fn X509_STORE_CTX_get_lookup_certs(X509_STORE_CTX *ctx);
367X509_STORE_CTX_lookup_crls_fn X509_STORE_CTX_get_lookup_crls(X509_STORE_CTX *ctx);
368X509_STORE_CTX_cleanup_fn X509_STORE_CTX_get_cleanup(X509_STORE_CTX *ctx);
2c340864 369
fcd2d5a6 370#if !OPENSSL_API_1_1_0
1755d460
VD		 371# define X509_STORE_CTX_get_chain X509_STORE_CTX_get0_chain
372# define X509_STORE_CTX_set_chain X509_STORE_CTX_set0_untrusted
373# define X509_STORE_CTX_trusted_stack X509_STORE_CTX_set0_trusted_stack
6ddbb4cd 374# define X509_STORE_get_by_subject X509_STORE_CTX_get_by_subject
2c75f03b
DMSP		 375# define X509_STORE_get1_certs X509_STORE_CTX_get1_certs
376# define X509_STORE_get1_crls X509_STORE_CTX_get1_crls
377/* the following macro is misspelled; use X509_STORE_get1_certs instead */
6ddbb4cd 378# define X509_STORE_get1_cert X509_STORE_CTX_get1_certs
2c75f03b 379/* the following macro is misspelled; use X509_STORE_get1_crls instead */
6ddbb4cd 380# define X509_STORE_get1_crl X509_STORE_CTX_get1_crls
1755d460
VD		 381#endif
382
d02b48c6 383X509_LOOKUP *X509_STORE_add_lookup(X509_STORE *v, X509_LOOKUP_METHOD *m);
d02b48c6
RE		 384X509_LOOKUP_METHOD *X509_LOOKUP_hash_dir(void);
385X509_LOOKUP_METHOD *X509_LOOKUP_file(void);
386
0124f32a
MY		 387typedef int (*X509_LOOKUP_ctrl_fn)(X509_LOOKUP *ctx, int cmd, const char *argc,
388 long argl, char **ret);
389typedef int (*X509_LOOKUP_get_by_subject_fn)(X509_LOOKUP *ctx,
390 X509_LOOKUP_TYPE type,
391 X509_NAME *name,
392 X509_OBJECT *ret);
393typedef int (*X509_LOOKUP_get_by_issuer_serial_fn)(X509_LOOKUP *ctx,
394 X509_LOOKUP_TYPE type,
395 X509_NAME *name,
396 ASN1_INTEGER *serial,
397 X509_OBJECT *ret);
398typedef int (*X509_LOOKUP_get_by_fingerprint_fn)(X509_LOOKUP *ctx,
399 X509_LOOKUP_TYPE type,
400 const unsigned char* bytes,
401 int len,
402 X509_OBJECT *ret);
403typedef int (*X509_LOOKUP_get_by_alias_fn)(X509_LOOKUP *ctx,
404 X509_LOOKUP_TYPE type,
405 const char *str,
406 int len,
407 X509_OBJECT *ret);
408
409X509_LOOKUP_METHOD *X509_LOOKUP_meth_new(const char *name);
410void X509_LOOKUP_meth_free(X509_LOOKUP_METHOD *method);
411
412int X509_LOOKUP_meth_set_new_item(X509_LOOKUP_METHOD *method,
413 int (*new_item) (X509_LOOKUP *ctx));
414int (*X509_LOOKUP_meth_get_new_item(const X509_LOOKUP_METHOD* method))
415 (X509_LOOKUP *ctx);
416
417int X509_LOOKUP_meth_set_free(X509_LOOKUP_METHOD *method,
50f3994b 418 void (*free_fn) (X509_LOOKUP *ctx));
0124f32a
MY		 419void (*X509_LOOKUP_meth_get_free(const X509_LOOKUP_METHOD* method))
420 (X509_LOOKUP *ctx);
421
422int X509_LOOKUP_meth_set_init(X509_LOOKUP_METHOD *method,
423 int (*init) (X509_LOOKUP *ctx));
424int (*X509_LOOKUP_meth_get_init(const X509_LOOKUP_METHOD* method))
425 (X509_LOOKUP *ctx);
426
427int X509_LOOKUP_meth_set_shutdown(X509_LOOKUP_METHOD *method,
428 int (*shutdown) (X509_LOOKUP *ctx));
429int (*X509_LOOKUP_meth_get_shutdown(const X509_LOOKUP_METHOD* method))
430 (X509_LOOKUP *ctx);
431
432int X509_LOOKUP_meth_set_ctrl(X509_LOOKUP_METHOD *method,
433 X509_LOOKUP_ctrl_fn ctrl_fn);
434X509_LOOKUP_ctrl_fn X509_LOOKUP_meth_get_ctrl(const X509_LOOKUP_METHOD *method);
435
436int X509_LOOKUP_meth_set_get_by_subject(X509_LOOKUP_METHOD *method,
437 X509_LOOKUP_get_by_subject_fn fn);
438X509_LOOKUP_get_by_subject_fn X509_LOOKUP_meth_get_get_by_subject(
439 const X509_LOOKUP_METHOD *method);
440
441int X509_LOOKUP_meth_set_get_by_issuer_serial(X509_LOOKUP_METHOD *method,
442 X509_LOOKUP_get_by_issuer_serial_fn fn);
443X509_LOOKUP_get_by_issuer_serial_fn X509_LOOKUP_meth_get_get_by_issuer_serial(
444 const X509_LOOKUP_METHOD *method);
445
446int X509_LOOKUP_meth_set_get_by_fingerprint(X509_LOOKUP_METHOD *method,
447 X509_LOOKUP_get_by_fingerprint_fn fn);
448X509_LOOKUP_get_by_fingerprint_fn X509_LOOKUP_meth_get_get_by_fingerprint(
449 const X509_LOOKUP_METHOD *method);
450
451int X509_LOOKUP_meth_set_get_by_alias(X509_LOOKUP_METHOD *method,
452 X509_LOOKUP_get_by_alias_fn fn);
453X509_LOOKUP_get_by_alias_fn X509_LOOKUP_meth_get_get_by_alias(
454 const X509_LOOKUP_METHOD *method);
455
456
d02b48c6 457int X509_STORE_add_cert(X509_STORE *ctx, X509 *x);
58964a49 458int X509_STORE_add_crl(X509_STORE *ctx, X509_CRL *x);
d02b48c6 459
0946a198
DSH		 460int X509_STORE_CTX_get_by_subject(X509_STORE_CTX *vs, X509_LOOKUP_TYPE type,
461 X509_NAME *name, X509_OBJECT *ret);
462X509_OBJECT *X509_STORE_CTX_get_obj_by_subject(X509_STORE_CTX *vs,
463 X509_LOOKUP_TYPE type,
6ddbb4cd 464 X509_NAME *name);
d02b48c6 465
303c0028 466int X509_LOOKUP_ctrl(X509_LOOKUP *ctx, int cmd, const char *argc,
0f113f3e 467 long argl, char **ret);
58964a49 468
e778802f
BL		 469int X509_load_cert_file(X509_LOOKUP *ctx, const char *file, int type);
470int X509_load_crl_file(X509_LOOKUP *ctx, const char *file, int type);
52664f50 471int X509_load_cert_crl_file(X509_LOOKUP *ctx, const char *file, int type);
d02b48c6
RE		 472
473X509_LOOKUP *X509_LOOKUP_new(X509_LOOKUP_METHOD *method);
474void X509_LOOKUP_free(X509_LOOKUP *ctx);
475int X509_LOOKUP_init(X509_LOOKUP *ctx);
0946a198
DSH		 476int X509_LOOKUP_by_subject(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type,
477 X509_NAME *name, X509_OBJECT *ret);
478int X509_LOOKUP_by_issuer_serial(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type,
479 X509_NAME *name, ASN1_INTEGER *serial,
480 X509_OBJECT *ret);
481int X509_LOOKUP_by_fingerprint(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type,
cfc5e0aa 482 const unsigned char *bytes, int len,
0f113f3e 483 X509_OBJECT *ret);
0946a198 484int X509_LOOKUP_by_alias(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type,
cfc5e0aa 485 const char *str, int len, X509_OBJECT *ret);
0124f32a
MY		 486int X509_LOOKUP_set_method_data(X509_LOOKUP *ctx, void *data);
487void *X509_LOOKUP_get_method_data(const X509_LOOKUP *ctx);
488X509_STORE *X509_LOOKUP_get_store(const X509_LOOKUP *ctx);
d02b48c6
RE		 489int X509_LOOKUP_shutdown(X509_LOOKUP *ctx);
490
0f113f3e
MC		 491int X509_STORE_load_locations(X509_STORE *ctx,
492 const char *file, const char *dir);
493int X509_STORE_set_default_paths(X509_STORE *ctx);
0f113f3e 494
e6390aca
RS		 495#define X509_STORE_CTX_get_ex_new_index(l, p, newf, dupf, freef) \
496 CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_X509_STORE_CTX, l, p, newf, dupf, freef)
0f113f3e
MC		 497int X509_STORE_CTX_set_ex_data(X509_STORE_CTX *ctx, int idx, void *data);
498void *X509_STORE_CTX_get_ex_data(X509_STORE_CTX *ctx, int idx);
499int X509_STORE_CTX_get_error(X509_STORE_CTX *ctx);
500void X509_STORE_CTX_set_error(X509_STORE_CTX *ctx, int s);
501int X509_STORE_CTX_get_error_depth(X509_STORE_CTX *ctx);
51227177 502void X509_STORE_CTX_set_error_depth(X509_STORE_CTX *ctx, int depth);
0f113f3e 503X509 *X509_STORE_CTX_get_current_cert(X509_STORE_CTX *ctx);
c9654873 504void X509_STORE_CTX_set_current_cert(X509_STORE_CTX *ctx, X509 *x);
2008e714
DSH		 505X509 *X509_STORE_CTX_get0_current_issuer(X509_STORE_CTX *ctx);
506X509_CRL *X509_STORE_CTX_get0_current_crl(X509_STORE_CTX *ctx);
507X509_STORE_CTX *X509_STORE_CTX_get0_parent_ctx(X509_STORE_CTX *ctx);
f0e0fd51 508STACK_OF(X509) *X509_STORE_CTX_get0_chain(X509_STORE_CTX *ctx);
c7cb16a8 509STACK_OF(X509) *X509_STORE_CTX_get1_chain(X509_STORE_CTX *ctx);
0f113f3e 510void X509_STORE_CTX_set_cert(X509_STORE_CTX *c, X509 *x);
f0e0fd51 511void X509_STORE_CTX_set0_verified_chain(X509_STORE_CTX *c, STACK_OF(X509) *sk);
0f113f3e 512void X509_STORE_CTX_set0_crls(X509_STORE_CTX *c, STACK_OF(X509_CRL) *sk);
13938ace 513int X509_STORE_CTX_set_purpose(X509_STORE_CTX *ctx, int purpose);
bb7cd4e3 514int X509_STORE_CTX_set_trust(X509_STORE_CTX *ctx, int trust);
13938ace 515int X509_STORE_CTX_purpose_inherit(X509_STORE_CTX *ctx, int def_purpose,
0f113f3e 516 int purpose, int trust);
5d7c222d
DSH		 517void X509_STORE_CTX_set_flags(X509_STORE_CTX *ctx, unsigned long flags);
518void X509_STORE_CTX_set_time(X509_STORE_CTX *ctx, unsigned long flags,
0f113f3e 519 time_t t);
0f113f3e 520
5d7c222d
DSH		 521X509_POLICY_TREE *X509_STORE_CTX_get0_policy_tree(X509_STORE_CTX *ctx);
522int X509_STORE_CTX_get_explicit_policy(X509_STORE_CTX *ctx);
7f3f41d8 523int X509_STORE_CTX_get_num_untrusted(X509_STORE_CTX *ctx);
5d7c222d
DSH		 524
525X509_VERIFY_PARAM *X509_STORE_CTX_get0_param(X509_STORE_CTX *ctx);
6ef2ff62 526void X509_STORE_CTX_set0_param(X509_STORE_CTX *ctx, X509_VERIFY_PARAM *param);
5d7c222d
DSH		 527int X509_STORE_CTX_set_default(X509_STORE_CTX *ctx, const char *name);
528
919ba009
VD		 529/*
530 * Bridge opacity barrier between libcrypt and libssl, also needed to support
531 * offline testing in test/danetest.c
532 */
b9aec69a 533void X509_STORE_CTX_set0_dane(X509_STORE_CTX *ctx, SSL_DANE *dane);
5ae4ceb9 534#define DANE_FLAG_NO_DANE_EE_NAMECHECKS (1L << 0)
919ba009 535
5d7c222d
DSH		 536/* X509_VERIFY_PARAM functions */
537
538X509_VERIFY_PARAM *X509_VERIFY_PARAM_new(void);
539void X509_VERIFY_PARAM_free(X509_VERIFY_PARAM *param);
540int X509_VERIFY_PARAM_inherit(X509_VERIFY_PARAM *to,
0f113f3e
MC		 541 const X509_VERIFY_PARAM *from);
542int X509_VERIFY_PARAM_set1(X509_VERIFY_PARAM *to,
543 const X509_VERIFY_PARAM *from);
5d7c222d 544int X509_VERIFY_PARAM_set1_name(X509_VERIFY_PARAM *param, const char *name);
0f113f3e
MC		 545int X509_VERIFY_PARAM_set_flags(X509_VERIFY_PARAM *param,
546 unsigned long flags);
f022c177 547int X509_VERIFY_PARAM_clear_flags(X509_VERIFY_PARAM *param,
0f113f3e 548 unsigned long flags);
4588cb44 549unsigned long X509_VERIFY_PARAM_get_flags(X509_VERIFY_PARAM *param);
5d7c222d
DSH		 550int X509_VERIFY_PARAM_set_purpose(X509_VERIFY_PARAM *param, int purpose);
551int X509_VERIFY_PARAM_set_trust(X509_VERIFY_PARAM *param, int trust);
552void X509_VERIFY_PARAM_set_depth(X509_VERIFY_PARAM *param, int depth);
fbb82a60 553void X509_VERIFY_PARAM_set_auth_level(X509_VERIFY_PARAM *param, int auth_level);
329f2f4a 554time_t X509_VERIFY_PARAM_get_time(const X509_VERIFY_PARAM *param);
5d7c222d
DSH		 555void X509_VERIFY_PARAM_set_time(X509_VERIFY_PARAM *param, time_t t);
556int X509_VERIFY_PARAM_add0_policy(X509_VERIFY_PARAM *param,
0f113f3e
MC		 557 ASN1_OBJECT *policy);
558int X509_VERIFY_PARAM_set1_policies(X509_VERIFY_PARAM *param,
559 STACK_OF(ASN1_OBJECT) *policies);
3bf15e29 560
a47bc283
RS		 561int X509_VERIFY_PARAM_set_inh_flags(X509_VERIFY_PARAM *param,
562 uint32_t flags);
563uint32_t X509_VERIFY_PARAM_get_inh_flags(const X509_VERIFY_PARAM *param);
564
3bf15e29 565int X509_VERIFY_PARAM_set1_host(X509_VERIFY_PARAM *param,
0f113f3e 566 const char *name, size_t namelen);
8abffa4a 567int X509_VERIFY_PARAM_add1_host(X509_VERIFY_PARAM *param,
0f113f3e 568 const char *name, size_t namelen);
397a8e74 569void X509_VERIFY_PARAM_set_hostflags(X509_VERIFY_PARAM *param,
0f113f3e 570 unsigned int flags);
4db296d9 571unsigned int X509_VERIFY_PARAM_get_hostflags(const X509_VERIFY_PARAM *param);
4588cb44 572char *X509_VERIFY_PARAM_get0_peername(X509_VERIFY_PARAM *);
919ba009 573void X509_VERIFY_PARAM_move_peername(X509_VERIFY_PARAM *, X509_VERIFY_PARAM *);
3bf15e29 574int X509_VERIFY_PARAM_set1_email(X509_VERIFY_PARAM *param,
0f113f3e 575 const char *email, size_t emaillen);
3bf15e29 576int X509_VERIFY_PARAM_set1_ip(X509_VERIFY_PARAM *param,
0f113f3e
MC		 577 const unsigned char *ip, size_t iplen);
578int X509_VERIFY_PARAM_set1_ip_asc(X509_VERIFY_PARAM *param,
579 const char *ipasc);
3bf15e29 580
5d7c222d 581int X509_VERIFY_PARAM_get_depth(const X509_VERIFY_PARAM *param);
fbb82a60 582int X509_VERIFY_PARAM_get_auth_level(const X509_VERIFY_PARAM *param);
9b3d7570 583const char *X509_VERIFY_PARAM_get0_name(const X509_VERIFY_PARAM *param);
5d7c222d
DSH		 584
585int X509_VERIFY_PARAM_add0_table(X509_VERIFY_PARAM *param);
9b3d7570
DSH		 586int X509_VERIFY_PARAM_get_count(void);
587const X509_VERIFY_PARAM *X509_VERIFY_PARAM_get0(int id);
5d7c222d
DSH		 588const X509_VERIFY_PARAM *X509_VERIFY_PARAM_lookup(const char *name);
589void X509_VERIFY_PARAM_table_cleanup(void);
d02b48c6 590
895c2f84
VD		 591/* Non positive return values are errors */
592#define X509_PCY_TREE_FAILURE -2 /* Failure to satisfy explicit policy */
593#define X509_PCY_TREE_INVALID -1 /* Inconsistent or invalid extensions */
594#define X509_PCY_TREE_INTERNAL 0 /* Internal error, most likely malloc */
595
596/*
597 * Positive return values form a bit mask, all but the first are internal to
598 * the library and don't appear in results from X509_policy_check().
599 */
600#define X509_PCY_TREE_VALID 1 /* The policy tree is valid */
601#define X509_PCY_TREE_EMPTY 2 /* The policy tree is empty */
602#define X509_PCY_TREE_EXPLICIT 4 /* Explicit policy required */
603
b6a5fdb8 604int X509_policy_check(X509_POLICY_TREE **ptree, int *pexplicit_policy,
0f113f3e
MC		 605 STACK_OF(X509) *certs,
606 STACK_OF(ASN1_OBJECT) *policy_oids, unsigned int flags);
4acc3e90
DSH		 607
608void X509_policy_tree_free(X509_POLICY_TREE *tree);
609
610int X509_policy_tree_level_count(const X509_POLICY_TREE *tree);
0f113f3e
MC		 611X509_POLICY_LEVEL *X509_policy_tree_get0_level(const X509_POLICY_TREE *tree,
612 int i);
4acc3e90 613
0f113f3e
MC		 614STACK_OF(X509_POLICY_NODE) *X509_policy_tree_get0_policies(const
615 X509_POLICY_TREE
616 *tree);
4acc3e90 617
0f113f3e
MC		 618STACK_OF(X509_POLICY_NODE) *X509_policy_tree_get0_user_policies(const
619 X509_POLICY_TREE
620 *tree);
4acc3e90
DSH		 621
622int X509_policy_level_node_count(X509_POLICY_LEVEL *level);
623
0f113f3e
MC		 624X509_POLICY_NODE *X509_policy_level_get0_node(X509_POLICY_LEVEL *level,
625 int i);
4acc3e90
DSH		 626
627const ASN1_OBJECT *X509_policy_node_get0_policy(const X509_POLICY_NODE *node);
628
0f113f3e
MC		 629STACK_OF(POLICYQUALINFO) *X509_policy_node_get0_qualifiers(const
630 X509_POLICY_NODE
631 *node);
632const X509_POLICY_NODE *X509_policy_node_get0_parent(const X509_POLICY_NODE
633 *node);
4acc3e90 634
d02b48c6
RE		 635#ifdef __cplusplus
636}
637#endif
638#endif
A mirror of the official openssl repository