include/openssl/cmp.h.in

   1 /*
   2  * {- join("\n * ", @autowarntext) -}
   3  *
   4  * Copyright 2007-2024 The OpenSSL Project Authors. All Rights Reserved.
   5  * Copyright Nokia 2007-2019
   6  * Copyright Siemens AG 2015-2019
   7  *
   8  * Licensed under the Apache License 2.0 (the "License").  You may not use
   9  * this file except in compliance with the License.  You can obtain a copy
  10  * in the file LICENSE in the source distribution or at
  11  * https://www.openssl.org/source/license.html
  12  */
  13
  14 {-
  15 use OpenSSL::stackhash qw(generate_stack_macros);
  16 -}
  17
  18 #ifndef OPENSSL_CMP_H
  19 # define OPENSSL_CMP_H
  20
  21 # include <openssl/opensslconf.h>
  22 # ifndef OPENSSL_NO_CMP
  23
  24 #  include <openssl/crmf.h>
  25 #  include <openssl/cmperr.h>
  26 #  include <openssl/cmp_util.h>
  27 #  include <openssl/http.h>
  28
  29 /* explicit #includes not strictly needed since implied by the above: */
  30 #  include <openssl/types.h>
  31 #  include <openssl/safestack.h>
  32 #  include <openssl/x509.h>
  33 #  include <openssl/x509v3.h>
  34
  35 #  ifdef __cplusplus
  36 extern "C" {
  37 #  endif
  38
  39 #  define OSSL_CMP_PVNO_2 2
  40 #  define OSSL_CMP_PVNO_3 3
  41 #  define OSSL_CMP_PVNO OSSL_CMP_PVNO_2 /* v2 is the default */
  42
  43 /*-
  44  *   PKIFailureInfo ::= BIT STRING {
  45  *   -- since we can fail in more than one way!
  46  *   -- More codes may be added in the future if/when required.
  47  *       badAlg              (0),
  48  *       -- unrecognized or unsupported Algorithm Identifier
  49  *       badMessageCheck     (1),
  50  *       -- integrity check failed (e.g., signature did not verify)
  51  *       badRequest          (2),
  52  *       -- transaction not permitted or supported
  53  *       badTime             (3),
  54  *       -- messageTime was not sufficiently close to the system time,
  55  *       -- as defined by local policy
  56  *       badCertId           (4),
  57  *       -- no certificate could be found matching the provided criteria
  58  *       badDataFormat       (5),
  59  *       -- the data submitted has the wrong format
  60  *       wrongAuthority      (6),
  61  *       -- the authority indicated in the request is different from the
  62  *       -- one creating the response token
  63  *       incorrectData       (7),
  64  *       -- the requester's data is incorrect (for notary services)
  65  *       missingTimeStamp    (8),
  66  *       -- when the timestamp is missing but should be there
  67  *       -- (by policy)
  68  *       badPOP              (9),
  69  *       -- the proof-of-possession failed
  70  *       certRevoked         (10),
  71  *          -- the certificate has already been revoked
  72  *       certConfirmed       (11),
  73  *          -- the certificate has already been confirmed
  74  *       wrongIntegrity      (12),
  75  *          -- invalid integrity, password based instead of signature or
  76  *          -- vice versa
  77  *       badRecipientNonce   (13),
  78  *          -- invalid recipient nonce, either missing or wrong value
  79  *       timeNotAvailable    (14),
  80  *          -- the TSA's time source is not available
  81  *       unacceptedPolicy    (15),
  82  *          -- the requested TSA policy is not supported by the TSA.
  83  *       unacceptedExtension (16),
  84  *          -- the requested extension is not supported by the TSA.
  85  *       addInfoNotAvailable (17),
  86  *          -- the additional information requested could not be
  87  *          -- understood or is not available
  88  *       badSenderNonce      (18),
  89  *          -- invalid sender nonce, either missing or wrong size
  90  *       badCertTemplate     (19),
  91  *          -- invalid cert. template or missing mandatory information
  92  *       signerNotTrusted    (20),
  93  *          -- signer of the message unknown or not trusted
  94  *       transactionIdInUse  (21),
  95  *          -- the transaction identifier is already in use
  96  *       unsupportedVersion  (22),
  97  *          -- the version of the message is not supported
  98  *       notAuthorized       (23),
  99  *          -- the sender was not authorized to make the preceding
 100  *          -- request or perform the preceding action
 101  *       systemUnavail       (24),
 102  *       -- the request cannot be handled due to system unavailability
 103  *       systemFailure       (25),
 104  *       -- the request cannot be handled due to system failure
 105  *       duplicateCertReq    (26)
 106  *       -- certificate cannot be issued because a duplicate
 107  *       -- certificate already exists
 108  *   }
 109  */
 110 #  define OSSL_CMP_PKIFAILUREINFO_badAlg 0
 111 #  define OSSL_CMP_PKIFAILUREINFO_badMessageCheck 1
 112 #  define OSSL_CMP_PKIFAILUREINFO_badRequest 2
 113 #  define OSSL_CMP_PKIFAILUREINFO_badTime 3
 114 #  define OSSL_CMP_PKIFAILUREINFO_badCertId 4
 115 #  define OSSL_CMP_PKIFAILUREINFO_badDataFormat 5
 116 #  define OSSL_CMP_PKIFAILUREINFO_wrongAuthority 6
 117 #  define OSSL_CMP_PKIFAILUREINFO_incorrectData 7
 118 #  define OSSL_CMP_PKIFAILUREINFO_missingTimeStamp 8
 119 #  define OSSL_CMP_PKIFAILUREINFO_badPOP 9
 120 #  define OSSL_CMP_PKIFAILUREINFO_certRevoked 10
 121 #  define OSSL_CMP_PKIFAILUREINFO_certConfirmed 11
 122 #  define OSSL_CMP_PKIFAILUREINFO_wrongIntegrity 12
 123 #  define OSSL_CMP_PKIFAILUREINFO_badRecipientNonce 13
 124 #  define OSSL_CMP_PKIFAILUREINFO_timeNotAvailable 14
 125 #  define OSSL_CMP_PKIFAILUREINFO_unacceptedPolicy 15
 126 #  define OSSL_CMP_PKIFAILUREINFO_unacceptedExtension 16
 127 #  define OSSL_CMP_PKIFAILUREINFO_addInfoNotAvailable 17
 128 #  define OSSL_CMP_PKIFAILUREINFO_badSenderNonce 18
 129 #  define OSSL_CMP_PKIFAILUREINFO_badCertTemplate 19
 130 #  define OSSL_CMP_PKIFAILUREINFO_signerNotTrusted 20
 131 #  define OSSL_CMP_PKIFAILUREINFO_transactionIdInUse 21
 132 #  define OSSL_CMP_PKIFAILUREINFO_unsupportedVersion 22
 133 #  define OSSL_CMP_PKIFAILUREINFO_notAuthorized 23
 134 #  define OSSL_CMP_PKIFAILUREINFO_systemUnavail 24
 135 #  define OSSL_CMP_PKIFAILUREINFO_systemFailure 25
 136 #  define OSSL_CMP_PKIFAILUREINFO_duplicateCertReq 26
 137 #  define OSSL_CMP_PKIFAILUREINFO_MAX 26
 138 #  define OSSL_CMP_PKIFAILUREINFO_MAX_BIT_PATTERN \
 139     ((1 << (OSSL_CMP_PKIFAILUREINFO_MAX + 1)) - 1)
 140 #  if OSSL_CMP_PKIFAILUREINFO_MAX_BIT_PATTERN > INT_MAX
 141 #   error CMP_PKIFAILUREINFO_MAX bit pattern does not fit in type int
 142 #  endif
 143 typedef ASN1_BIT_STRING OSSL_CMP_PKIFAILUREINFO;
 144
 145 #  define OSSL_CMP_CTX_FAILINFO_badAlg (1 << 0)
 146 #  define OSSL_CMP_CTX_FAILINFO_badMessageCheck (1 << 1)
 147 #  define OSSL_CMP_CTX_FAILINFO_badRequest (1 << 2)
 148 #  define OSSL_CMP_CTX_FAILINFO_badTime (1 << 3)
 149 #  define OSSL_CMP_CTX_FAILINFO_badCertId (1 << 4)
 150 #  define OSSL_CMP_CTX_FAILINFO_badDataFormat (1 << 5)
 151 #  define OSSL_CMP_CTX_FAILINFO_wrongAuthority (1 << 6)
 152 #  define OSSL_CMP_CTX_FAILINFO_incorrectData (1 << 7)
 153 #  define OSSL_CMP_CTX_FAILINFO_missingTimeStamp (1 << 8)
 154 #  define OSSL_CMP_CTX_FAILINFO_badPOP (1 << 9)
 155 #  define OSSL_CMP_CTX_FAILINFO_certRevoked (1 << 10)
 156 #  define OSSL_CMP_CTX_FAILINFO_certConfirmed (1 << 11)
 157 #  define OSSL_CMP_CTX_FAILINFO_wrongIntegrity (1 << 12)
 158 #  define OSSL_CMP_CTX_FAILINFO_badRecipientNonce (1 << 13)
 159 #  define OSSL_CMP_CTX_FAILINFO_timeNotAvailable (1 << 14)
 160 #  define OSSL_CMP_CTX_FAILINFO_unacceptedPolicy (1 << 15)
 161 #  define OSSL_CMP_CTX_FAILINFO_unacceptedExtension (1 << 16)
 162 #  define OSSL_CMP_CTX_FAILINFO_addInfoNotAvailable (1 << 17)
 163 #  define OSSL_CMP_CTX_FAILINFO_badSenderNonce (1 << 18)
 164 #  define OSSL_CMP_CTX_FAILINFO_badCertTemplate (1 << 19)
 165 #  define OSSL_CMP_CTX_FAILINFO_signerNotTrusted (1 << 20)
 166 #  define OSSL_CMP_CTX_FAILINFO_transactionIdInUse (1 << 21)
 167 #  define OSSL_CMP_CTX_FAILINFO_unsupportedVersion (1 << 22)
 168 #  define OSSL_CMP_CTX_FAILINFO_notAuthorized (1 << 23)
 169 #  define OSSL_CMP_CTX_FAILINFO_systemUnavail (1 << 24)
 170 #  define OSSL_CMP_CTX_FAILINFO_systemFailure (1 << 25)
 171 #  define OSSL_CMP_CTX_FAILINFO_duplicateCertReq (1 << 26)
 172
 173 /*-
 174  *   PKIStatus ::= INTEGER {
 175  *       accepted                (0),
 176  *       -- you got exactly what you asked for
 177  *       grantedWithMods        (1),
 178  *       -- you got something like what you asked for; the
 179  *       -- requester is responsible for ascertaining the differences
 180  *       rejection              (2),
 181  *       -- you don't get it, more information elsewhere in the message
 182  *       waiting                (3),
 183  *       -- the request body part has not yet been processed; expect to
 184  *       -- hear more later (note: proper handling of this status
 185  *       -- response MAY use the polling req/rep PKIMessages specified
 186  *       -- in Section 5.3.22; alternatively, polling in the underlying
 187  *       -- transport layer MAY have some utility in this regard)
 188  *       revocationWarning      (4),
 189  *       -- this message contains a warning that a revocation is
 190  *       -- imminent
 191  *       revocationNotification (5),
 192  *       -- notification that a revocation has occurred
 193  *       keyUpdateWarning       (6)
 194  *       -- update already done for the oldCertId specified in
 195  *       -- CertReqMsg
 196  *   }
 197  */
 198 #  define OSSL_CMP_PKISTATUS_request                -3
 199 #  define OSSL_CMP_PKISTATUS_trans                  -2
 200 #  define OSSL_CMP_PKISTATUS_unspecified            -1
 201 #  define OSSL_CMP_PKISTATUS_accepted               0
 202 #  define OSSL_CMP_PKISTATUS_grantedWithMods        1
 203 #  define OSSL_CMP_PKISTATUS_rejection              2
 204 #  define OSSL_CMP_PKISTATUS_waiting                3
 205 #  define OSSL_CMP_PKISTATUS_revocationWarning      4
 206 #  define OSSL_CMP_PKISTATUS_revocationNotification 5
 207 #  define OSSL_CMP_PKISTATUS_keyUpdateWarning       6
 208 typedef ASN1_INTEGER OSSL_CMP_PKISTATUS;
 209
 210 DECLARE_ASN1_ITEM(OSSL_CMP_PKISTATUS)
 211
 212 #  define OSSL_CMP_CERTORENCCERT_CERTIFICATE 0
 213 #  define OSSL_CMP_CERTORENCCERT_ENCRYPTEDCERT 1
 214
 215 /* data type declarations */
 216 typedef struct ossl_cmp_ctx_st OSSL_CMP_CTX;
 217 typedef struct ossl_cmp_pkiheader_st OSSL_CMP_PKIHEADER;
 218 DECLARE_ASN1_FUNCTIONS(OSSL_CMP_PKIHEADER)
 219 typedef struct ossl_cmp_msg_st OSSL_CMP_MSG;
 220 DECLARE_ASN1_DUP_FUNCTION(OSSL_CMP_MSG)
 221 DECLARE_ASN1_ENCODE_FUNCTIONS(OSSL_CMP_MSG, OSSL_CMP_MSG, OSSL_CMP_MSG)
 222 typedef struct ossl_cmp_certstatus_st OSSL_CMP_CERTSTATUS;
 223 {-
 224     generate_stack_macros("OSSL_CMP_CERTSTATUS");
 225 -}
 226 typedef struct ossl_cmp_itav_st OSSL_CMP_ITAV;
 227 DECLARE_ASN1_DUP_FUNCTION(OSSL_CMP_ITAV)
 228 {-
 229     generate_stack_macros("OSSL_CMP_ITAV");
 230 -}
 231 typedef struct ossl_cmp_revrepcontent_st OSSL_CMP_REVREPCONTENT;
 232 typedef struct ossl_cmp_pkisi_st OSSL_CMP_PKISI;
 233 DECLARE_ASN1_FUNCTIONS(OSSL_CMP_PKISI)
 234 DECLARE_ASN1_DUP_FUNCTION(OSSL_CMP_PKISI)
 235 {-
 236     generate_stack_macros("OSSL_CMP_PKISI");
 237 -}
 238 typedef struct ossl_cmp_certrepmessage_st OSSL_CMP_CERTREPMESSAGE;
 239 {-
 240     generate_stack_macros("OSSL_CMP_CERTREPMESSAGE");
 241 -}
 242 typedef struct ossl_cmp_pollrep_st OSSL_CMP_POLLREP;
 243 typedef STACK_OF(OSSL_CMP_POLLREP) OSSL_CMP_POLLREPCONTENT;
 244 typedef struct ossl_cmp_certresponse_st OSSL_CMP_CERTRESPONSE;
 245 {-
 246     generate_stack_macros("OSSL_CMP_CERTRESPONSE");
 247 -}
 248 typedef STACK_OF(ASN1_UTF8STRING) OSSL_CMP_PKIFREETEXT;
 249
 250 /*
 251  * function DECLARATIONS
 252  */
 253
 254 /* from cmp_asn.c */
 255 OSSL_CMP_ITAV *OSSL_CMP_ITAV_create(ASN1_OBJECT *type, ASN1_TYPE *value);
 256 void OSSL_CMP_ITAV_set0(OSSL_CMP_ITAV *itav, ASN1_OBJECT *type,
 257                         ASN1_TYPE *value);
 258 ASN1_OBJECT *OSSL_CMP_ITAV_get0_type(const OSSL_CMP_ITAV *itav);
 259 ASN1_TYPE *OSSL_CMP_ITAV_get0_value(const OSSL_CMP_ITAV *itav);
 260 int OSSL_CMP_ITAV_push0_stack_item(STACK_OF(OSSL_CMP_ITAV) **itav_sk_p,
 261                                    OSSL_CMP_ITAV *itav);
 262 void OSSL_CMP_ITAV_free(OSSL_CMP_ITAV *itav);
 263
 264 OSSL_CMP_ITAV *OSSL_CMP_ITAV_new0_certProfile(STACK_OF(ASN1_UTF8STRING)
 265                                               *certProfile);
 266 int OSSL_CMP_ITAV_get0_certProfile(const OSSL_CMP_ITAV *itav,
 267                                    STACK_OF(ASN1_UTF8STRING) **out);
 268 OSSL_CMP_ITAV *OSSL_CMP_ITAV_new_caCerts(const STACK_OF(X509) *caCerts);
 269 int OSSL_CMP_ITAV_get0_caCerts(const OSSL_CMP_ITAV *itav, STACK_OF(X509) **out);
 270
 271 OSSL_CMP_ITAV *OSSL_CMP_ITAV_new_rootCaCert(const X509 *rootCaCert);
 272 int OSSL_CMP_ITAV_get0_rootCaCert(const OSSL_CMP_ITAV *itav, X509 **out);
 273 OSSL_CMP_ITAV *OSSL_CMP_ITAV_new_rootCaKeyUpdate(const X509 *newWithNew,
 274                                                  const X509 *newWithOld,
 275                                                  const X509 *oldWithNew);
 276 int OSSL_CMP_ITAV_get0_rootCaKeyUpdate(const OSSL_CMP_ITAV *itav,
 277                                        X509 **newWithNew,
 278                                        X509 **newWithOld,
 279                                        X509 **oldWithNew);
 280
 281 void OSSL_CMP_MSG_free(OSSL_CMP_MSG *msg);
 282
 283 /* from cmp_ctx.c */
 284 OSSL_CMP_CTX *OSSL_CMP_CTX_new(OSSL_LIB_CTX *libctx, const char *propq);
 285 void OSSL_CMP_CTX_free(OSSL_CMP_CTX *ctx);
 286 int OSSL_CMP_CTX_reinit(OSSL_CMP_CTX *ctx);
 287 OSSL_LIB_CTX *OSSL_CMP_CTX_get0_libctx(const OSSL_CMP_CTX *ctx);
 288 const char *OSSL_CMP_CTX_get0_propq(const OSSL_CMP_CTX *ctx);
 289 /* CMP general options: */
 290 #  define OSSL_CMP_OPT_LOG_VERBOSITY 0
 291 /* CMP transfer options: */
 292 #  define OSSL_CMP_OPT_KEEP_ALIVE    10
 293 #  define OSSL_CMP_OPT_MSG_TIMEOUT   11
 294 #  define OSSL_CMP_OPT_TOTAL_TIMEOUT 12
 295 #  define OSSL_CMP_OPT_USE_TLS       13
 296 /* CMP request options: */
 297 #  define OSSL_CMP_OPT_VALIDITY_DAYS 20
 298 #  define OSSL_CMP_OPT_SUBJECTALTNAME_NODEFAULT 21
 299 #  define OSSL_CMP_OPT_SUBJECTALTNAME_CRITICAL 22
 300 #  define OSSL_CMP_OPT_POLICIES_CRITICAL 23
 301 #  define OSSL_CMP_OPT_POPO_METHOD 24
 302 #  define OSSL_CMP_OPT_IMPLICIT_CONFIRM 25
 303 #  define OSSL_CMP_OPT_DISABLE_CONFIRM 26
 304 #  define OSSL_CMP_OPT_REVOCATION_REASON 27
 305 /* CMP protection options: */
 306 #  define OSSL_CMP_OPT_UNPROTECTED_SEND 30
 307 #  define OSSL_CMP_OPT_UNPROTECTED_ERRORS 31
 308 #  define OSSL_CMP_OPT_OWF_ALGNID 32
 309 #  define OSSL_CMP_OPT_MAC_ALGNID 33
 310 #  define OSSL_CMP_OPT_DIGEST_ALGNID 34
 311 #  define OSSL_CMP_OPT_IGNORE_KEYUSAGE 35
 312 #  define OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR 36
 313 #  define OSSL_CMP_OPT_NO_CACHE_EXTRACERTS 37
 314 int OSSL_CMP_CTX_set_option(OSSL_CMP_CTX *ctx, int opt, int val);
 315 int OSSL_CMP_CTX_get_option(const OSSL_CMP_CTX *ctx, int opt);
 316 /* CMP-specific callback for logging and outputting the error queue: */
 317 int OSSL_CMP_CTX_set_log_cb(OSSL_CMP_CTX *ctx, OSSL_CMP_log_cb_t cb);
 318 #  define OSSL_CMP_CTX_set_log_verbosity(ctx, level) \
 319     OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_LOG_VERBOSITY, level)
 320 void OSSL_CMP_CTX_print_errors(const OSSL_CMP_CTX *ctx);
 321 /* message transfer: */
 322 int OSSL_CMP_CTX_set1_serverPath(OSSL_CMP_CTX *ctx, const char *path);
 323 int OSSL_CMP_CTX_set1_server(OSSL_CMP_CTX *ctx, const char *address);
 324 int OSSL_CMP_CTX_set_serverPort(OSSL_CMP_CTX *ctx, int port);
 325 int OSSL_CMP_CTX_set1_proxy(OSSL_CMP_CTX *ctx, const char *name);
 326 int OSSL_CMP_CTX_set1_no_proxy(OSSL_CMP_CTX *ctx, const char *names);
 327 #   ifndef OPENSSL_NO_HTTP
 328 int OSSL_CMP_CTX_set_http_cb(OSSL_CMP_CTX *ctx, OSSL_HTTP_bio_cb_t cb);
 329 int OSSL_CMP_CTX_set_http_cb_arg(OSSL_CMP_CTX *ctx, void *arg);
 330 void *OSSL_CMP_CTX_get_http_cb_arg(const OSSL_CMP_CTX *ctx);
 331 #   endif
 332 typedef OSSL_CMP_MSG *(*OSSL_CMP_transfer_cb_t) (OSSL_CMP_CTX *ctx,
 333                                                  const OSSL_CMP_MSG *req);
 334 int OSSL_CMP_CTX_set_transfer_cb(OSSL_CMP_CTX *ctx, OSSL_CMP_transfer_cb_t cb);
 335 int OSSL_CMP_CTX_set_transfer_cb_arg(OSSL_CMP_CTX *ctx, void *arg);
 336 void *OSSL_CMP_CTX_get_transfer_cb_arg(const OSSL_CMP_CTX *ctx);
 337 /* server authentication: */
 338 int OSSL_CMP_CTX_set1_srvCert(OSSL_CMP_CTX *ctx, X509 *cert);
 339 int OSSL_CMP_CTX_set1_expected_sender(OSSL_CMP_CTX *ctx, const X509_NAME *name);
 340 int OSSL_CMP_CTX_set0_trustedStore(OSSL_CMP_CTX *ctx, X509_STORE *store);
 341 #  define OSSL_CMP_CTX_set0_trusted OSSL_CMP_CTX_set0_trustedStore
 342 X509_STORE *OSSL_CMP_CTX_get0_trustedStore(const OSSL_CMP_CTX *ctx);
 343 #  define OSSL_CMP_CTX_get0_trusted OSSL_CMP_CTX_get0_trustedStore
 344 int OSSL_CMP_CTX_set1_untrusted(OSSL_CMP_CTX *ctx, STACK_OF(X509) *certs);
 345 STACK_OF(X509) *OSSL_CMP_CTX_get0_untrusted(const OSSL_CMP_CTX *ctx);
 346 /* client authentication: */
 347 int OSSL_CMP_CTX_set1_cert(OSSL_CMP_CTX *ctx, X509 *cert);
 348 int OSSL_CMP_CTX_build_cert_chain(OSSL_CMP_CTX *ctx, X509_STORE *own_trusted,
 349                                   STACK_OF(X509) *candidates);
 350 int OSSL_CMP_CTX_set1_pkey(OSSL_CMP_CTX *ctx, EVP_PKEY *pkey);
 351 int OSSL_CMP_CTX_set1_referenceValue(OSSL_CMP_CTX *ctx,
 352                                      const unsigned char *ref, int len);
 353 int OSSL_CMP_CTX_set1_secretValue(OSSL_CMP_CTX *ctx,
 354                                   const unsigned char *sec, int len);
 355 /* CMP message header and extra certificates: */
 356 int OSSL_CMP_CTX_set1_recipient(OSSL_CMP_CTX *ctx, const X509_NAME *name);
 357 int OSSL_CMP_CTX_push0_geninfo_ITAV(OSSL_CMP_CTX *ctx, OSSL_CMP_ITAV *itav);
 358 int OSSL_CMP_CTX_reset_geninfo_ITAVs(OSSL_CMP_CTX *ctx);
 359 STACK_OF(OSSL_CMP_ITAV)
 360     *OSSL_CMP_CTX_get0_geninfo_ITAVs(const OSSL_CMP_CTX *ctx);
 361 int OSSL_CMP_CTX_set1_extraCertsOut(OSSL_CMP_CTX *ctx,
 362                                     STACK_OF(X509) *extraCertsOut);
 363 /* certificate template: */
 364 int OSSL_CMP_CTX_set0_newPkey(OSSL_CMP_CTX *ctx, int priv, EVP_PKEY *pkey);
 365 EVP_PKEY *OSSL_CMP_CTX_get0_newPkey(const OSSL_CMP_CTX *ctx, int priv);
 366 int OSSL_CMP_CTX_set1_issuer(OSSL_CMP_CTX *ctx, const X509_NAME *name);
 367 int OSSL_CMP_CTX_set1_serialNumber(OSSL_CMP_CTX *ctx, const ASN1_INTEGER *sn);
 368 int OSSL_CMP_CTX_set1_subjectName(OSSL_CMP_CTX *ctx, const X509_NAME *name);
 369 int OSSL_CMP_CTX_push1_subjectAltName(OSSL_CMP_CTX *ctx,
 370                                       const GENERAL_NAME *name);
 371 int OSSL_CMP_CTX_set0_reqExtensions(OSSL_CMP_CTX *ctx, X509_EXTENSIONS *exts);
 372 int OSSL_CMP_CTX_reqExtensions_have_SAN(OSSL_CMP_CTX *ctx);
 373 int OSSL_CMP_CTX_push0_policy(OSSL_CMP_CTX *ctx, POLICYINFO *pinfo);
 374 int OSSL_CMP_CTX_set1_oldCert(OSSL_CMP_CTX *ctx, X509 *cert);
 375 int OSSL_CMP_CTX_set1_p10CSR(OSSL_CMP_CTX *ctx, const X509_REQ *csr);
 376 /* misc body contents: */
 377 int OSSL_CMP_CTX_push0_genm_ITAV(OSSL_CMP_CTX *ctx, OSSL_CMP_ITAV *itav);
 378 /* certificate confirmation: */
 379 typedef int (*OSSL_CMP_certConf_cb_t) (OSSL_CMP_CTX *ctx, X509 *cert,
 380                                        int fail_info, const char **txt);
 381 int OSSL_CMP_certConf_cb(OSSL_CMP_CTX *ctx, X509 *cert, int fail_info,
 382                          const char **text);
 383 int OSSL_CMP_CTX_set_certConf_cb(OSSL_CMP_CTX *ctx, OSSL_CMP_certConf_cb_t cb);
 384 int OSSL_CMP_CTX_set_certConf_cb_arg(OSSL_CMP_CTX *ctx, void *arg);
 385 void *OSSL_CMP_CTX_get_certConf_cb_arg(const OSSL_CMP_CTX *ctx);
 386 /* result fetching: */
 387 int OSSL_CMP_CTX_get_status(const OSSL_CMP_CTX *ctx);
 388 OSSL_CMP_PKIFREETEXT *OSSL_CMP_CTX_get0_statusString(const OSSL_CMP_CTX *ctx);
 389 int OSSL_CMP_CTX_get_failInfoCode(const OSSL_CMP_CTX *ctx);
 390 #  define OSSL_CMP_PKISI_BUFLEN 1024
 391 X509 *OSSL_CMP_CTX_get0_validatedSrvCert(const OSSL_CMP_CTX *ctx);
 392 X509 *OSSL_CMP_CTX_get0_newCert(const OSSL_CMP_CTX *ctx);
 393 STACK_OF(X509) *OSSL_CMP_CTX_get1_newChain(const OSSL_CMP_CTX *ctx);
 394 STACK_OF(X509) *OSSL_CMP_CTX_get1_caPubs(const OSSL_CMP_CTX *ctx);
 395 STACK_OF(X509) *OSSL_CMP_CTX_get1_extraCertsIn(const OSSL_CMP_CTX *ctx);
 396 int OSSL_CMP_CTX_set1_transactionID(OSSL_CMP_CTX *ctx,
 397                                     const ASN1_OCTET_STRING *id);
 398 int OSSL_CMP_CTX_set1_senderNonce(OSSL_CMP_CTX *ctx,
 399                                   const ASN1_OCTET_STRING *nonce);
 400
 401 /* from cmp_status.c */
 402 char *OSSL_CMP_CTX_snprint_PKIStatus(const OSSL_CMP_CTX *ctx, char *buf,
 403                                      size_t bufsize);
 404 char *OSSL_CMP_snprint_PKIStatusInfo(const OSSL_CMP_PKISI *statusInfo,
 405                                      char *buf, size_t bufsize);
 406 OSSL_CMP_PKISI *
 407 OSSL_CMP_STATUSINFO_new(int status, int fail_info, const char *text);
 408
 409 /* from cmp_hdr.c */
 410 ASN1_OCTET_STRING *OSSL_CMP_HDR_get0_transactionID(const
 411                                                    OSSL_CMP_PKIHEADER *hdr);
 412 ASN1_OCTET_STRING *OSSL_CMP_HDR_get0_recipNonce(const OSSL_CMP_PKIHEADER *hdr);
 413 STACK_OF(OSSL_CMP_ITAV)
 414     *OSSL_CMP_HDR_get0_geninfo_ITAVs(const OSSL_CMP_PKIHEADER *hdr);
 415
 416 /* from cmp_msg.c */
 417 OSSL_CMP_PKIHEADER *OSSL_CMP_MSG_get0_header(const OSSL_CMP_MSG *msg);
 418 int OSSL_CMP_MSG_get_bodytype(const OSSL_CMP_MSG *msg);
 419 X509_PUBKEY *OSSL_CMP_MSG_get0_certreq_publickey(const OSSL_CMP_MSG *msg);
 420 int OSSL_CMP_MSG_update_transactionID(OSSL_CMP_CTX *ctx, OSSL_CMP_MSG *msg);
 421 int OSSL_CMP_MSG_update_recipNonce(OSSL_CMP_CTX *ctx, OSSL_CMP_MSG *msg);
 422 OSSL_CRMF_MSG *OSSL_CMP_CTX_setup_CRM(OSSL_CMP_CTX *ctx, int for_KUR, int rid);
 423 OSSL_CMP_MSG *OSSL_CMP_MSG_read(const char *file, OSSL_LIB_CTX *libctx,
 424                                 const char *propq);
 425 int OSSL_CMP_MSG_write(const char *file, const OSSL_CMP_MSG *msg);
 426 OSSL_CMP_MSG *d2i_OSSL_CMP_MSG_bio(BIO *bio, OSSL_CMP_MSG **msg);
 427 int i2d_OSSL_CMP_MSG_bio(BIO *bio, const OSSL_CMP_MSG *msg);
 428
 429 /* from cmp_vfy.c */
 430 int OSSL_CMP_validate_msg(OSSL_CMP_CTX *ctx, const OSSL_CMP_MSG *msg);
 431 int OSSL_CMP_validate_cert_path(const OSSL_CMP_CTX *ctx,
 432                                 X509_STORE *trusted_store, X509 *cert);
 433
 434 /* from cmp_http.c */
 435 #   ifndef OPENSSL_NO_HTTP
 436 OSSL_CMP_MSG *OSSL_CMP_MSG_http_perform(OSSL_CMP_CTX *ctx,
 437                                         const OSSL_CMP_MSG *req);
 438 #   endif
 439
 440 /* from cmp_server.c */
 441 typedef struct ossl_cmp_srv_ctx_st OSSL_CMP_SRV_CTX;
 442 OSSL_CMP_MSG *OSSL_CMP_SRV_process_request(OSSL_CMP_SRV_CTX *srv_ctx,
 443                                            const OSSL_CMP_MSG *req);
 444 OSSL_CMP_MSG * OSSL_CMP_CTX_server_perform(OSSL_CMP_CTX *client_ctx,
 445                                            const OSSL_CMP_MSG *req);
 446 OSSL_CMP_SRV_CTX *OSSL_CMP_SRV_CTX_new(OSSL_LIB_CTX *libctx, const char *propq);
 447 void OSSL_CMP_SRV_CTX_free(OSSL_CMP_SRV_CTX *srv_ctx);
 448 typedef OSSL_CMP_PKISI *(*OSSL_CMP_SRV_cert_request_cb_t)
 449     (OSSL_CMP_SRV_CTX *srv_ctx, const OSSL_CMP_MSG *req, int certReqId,
 450      const OSSL_CRMF_MSG *crm, const X509_REQ *p10cr,
 451      X509 **certOut, STACK_OF(X509) **chainOut, STACK_OF(X509) **caPubs);
 452 typedef OSSL_CMP_PKISI *(*OSSL_CMP_SRV_rr_cb_t)(OSSL_CMP_SRV_CTX *srv_ctx,
 453                                                 const OSSL_CMP_MSG *req,
 454                                                 const X509_NAME *issuer,
 455                                                 const ASN1_INTEGER *serial);
 456 typedef int (*OSSL_CMP_SRV_genm_cb_t)(OSSL_CMP_SRV_CTX *srv_ctx,
 457                                       const OSSL_CMP_MSG *req,
 458                                       const STACK_OF(OSSL_CMP_ITAV) *in,
 459                                       STACK_OF(OSSL_CMP_ITAV) **out);
 460 typedef void (*OSSL_CMP_SRV_error_cb_t)(OSSL_CMP_SRV_CTX *srv_ctx,
 461                                         const OSSL_CMP_MSG *req,
 462                                         const OSSL_CMP_PKISI *statusInfo,
 463                                         const ASN1_INTEGER *errorCode,
 464                                         const OSSL_CMP_PKIFREETEXT *errDetails);
 465 typedef int (*OSSL_CMP_SRV_certConf_cb_t)(OSSL_CMP_SRV_CTX *srv_ctx,
 466                                           const OSSL_CMP_MSG *req,
 467                                           int certReqId,
 468                                           const ASN1_OCTET_STRING *certHash,
 469                                           const OSSL_CMP_PKISI *si);
 470 typedef int (*OSSL_CMP_SRV_pollReq_cb_t)(OSSL_CMP_SRV_CTX *srv_ctx,
 471                                          const OSSL_CMP_MSG *req, int certReqId,
 472                                          OSSL_CMP_MSG **certReq,
 473                                          int64_t *check_after);
 474 int OSSL_CMP_SRV_CTX_init(OSSL_CMP_SRV_CTX *srv_ctx, void *custom_ctx,
 475                           OSSL_CMP_SRV_cert_request_cb_t process_cert_request,
 476                           OSSL_CMP_SRV_rr_cb_t process_rr,
 477                           OSSL_CMP_SRV_genm_cb_t process_genm,
 478                           OSSL_CMP_SRV_error_cb_t process_error,
 479                           OSSL_CMP_SRV_certConf_cb_t process_certConf,
 480                           OSSL_CMP_SRV_pollReq_cb_t process_pollReq);
 481 typedef int (*OSSL_CMP_SRV_delayed_delivery_cb_t)(OSSL_CMP_SRV_CTX *srv_ctx,
 482                                                   const OSSL_CMP_MSG *req);
 483 typedef int (*OSSL_CMP_SRV_clean_transaction_cb_t)(OSSL_CMP_SRV_CTX *srv_ctx,
 484                                                    const ASN1_OCTET_STRING *id);
 485 int OSSL_CMP_SRV_CTX_init_trans(OSSL_CMP_SRV_CTX *srv_ctx,
 486                                 OSSL_CMP_SRV_delayed_delivery_cb_t delay,
 487                                 OSSL_CMP_SRV_clean_transaction_cb_t clean);
 488 OSSL_CMP_CTX *OSSL_CMP_SRV_CTX_get0_cmp_ctx(const OSSL_CMP_SRV_CTX *srv_ctx);
 489 void *OSSL_CMP_SRV_CTX_get0_custom_ctx(const OSSL_CMP_SRV_CTX *srv_ctx);
 490 int OSSL_CMP_SRV_CTX_set_send_unprotected_errors(OSSL_CMP_SRV_CTX *srv_ctx,
 491                                                  int val);
 492 int OSSL_CMP_SRV_CTX_set_accept_unprotected(OSSL_CMP_SRV_CTX *srv_ctx, int val);
 493 int OSSL_CMP_SRV_CTX_set_accept_raverified(OSSL_CMP_SRV_CTX *srv_ctx, int val);
 494 int OSSL_CMP_SRV_CTX_set_grant_implicit_confirm(OSSL_CMP_SRV_CTX *srv_ctx,
 495                                                 int val);
 496
 497 /* from cmp_client.c */
 498 X509 *OSSL_CMP_exec_certreq(OSSL_CMP_CTX *ctx, int req_type,
 499                             const OSSL_CRMF_MSG *crm);
 500 #  define OSSL_CMP_IR    0
 501 #  define OSSL_CMP_CR    2
 502 #  define OSSL_CMP_P10CR 4
 503 #  define OSSL_CMP_KUR   7
 504 #  define OSSL_CMP_GENM  21
 505 #  define OSSL_CMP_ERROR 23
 506 #  define OSSL_CMP_exec_IR_ses(ctx) \
 507     OSSL_CMP_exec_certreq(ctx, OSSL_CMP_IR, NULL)
 508 #  define OSSL_CMP_exec_CR_ses(ctx) \
 509     OSSL_CMP_exec_certreq(ctx, OSSL_CMP_CR, NULL)
 510 #  define OSSL_CMP_exec_P10CR_ses(ctx) \
 511     OSSL_CMP_exec_certreq(ctx, OSSL_CMP_P10CR, NULL)
 512 #  define OSSL_CMP_exec_KUR_ses(ctx) \
 513     OSSL_CMP_exec_certreq(ctx, OSSL_CMP_KUR, NULL)
 514 int OSSL_CMP_try_certreq(OSSL_CMP_CTX *ctx, int req_type,
 515                          const OSSL_CRMF_MSG *crm, int *checkAfter);
 516 int OSSL_CMP_exec_RR_ses(OSSL_CMP_CTX *ctx);
 517 STACK_OF(OSSL_CMP_ITAV) *OSSL_CMP_exec_GENM_ses(OSSL_CMP_CTX *ctx);
 518
 519 /* from cmp_genm.c */
 520 int OSSL_CMP_get1_caCerts(OSSL_CMP_CTX *ctx, STACK_OF(X509) **out);
 521 int OSSL_CMP_get1_rootCaKeyUpdate(OSSL_CMP_CTX *ctx,
 522                                   const X509 *oldWithOld, X509 **newWithNew,
 523                                   X509 **newWithOld, X509 **oldWithNew);
 524
 525 #  ifdef  __cplusplus
 526 }
 527 #  endif
 528 # endif /* !defined(OPENSSL_NO_CMP) */
 529 #endif /* !defined(OPENSSL_CMP_H) */