void *http_cb_arg; /* allows to store optional argument to cb */
/* server authentication */
- int unprotectedErrors; /* accept neg. response with no/invalid protection */
- /* to cope with broken server */
+ /*
+ * unprotectedErrors may be set as workaround for broken server responses:
+ * accept missing or invalid protection of regular error messages, negative
+ * certificate responses (ip/cp/kup), revocation responses (rp), and PKIConf
+ */
+ int unprotectedErrors;
X509 *srvCert; /* certificate used to identify the server */
X509 *validatedSrvCert; /* caches any already validated server cert */
X509_NAME *expected_sender; /* expected sender in pkiheader of response */
X509_STORE *trusted; /* trust store maybe w CRLs and cert verify callback */
STACK_OF(X509) *untrusted_certs; /* untrusted (intermediate) certs */
int ignore_keyusage; /* ignore key usage entry when validating certs */
- int permitTAInExtraCertsForIR; /* allow use of root certs in extracerts */
- /* when validating message protection; used for 3GPP-style E.7 */
+ /*
+ * permitTAInExtraCertsForIR allows use of root certs in extracerts
+ * when validating message protection; this is used for 3GPP-style E.7
+ */
+ int permitTAInExtraCertsForIR;
/* client authentication */
int unprotectedSend; /* send unprotected PKI messages */
OSSL_CMP_CERTREPMESSAGE *ip; /* 1 */
OSSL_CRMF_MSGS *cr; /* 2 */
OSSL_CMP_CERTREPMESSAGE *cp; /* 3 */
- /* p10cr [4] CertificationRequest, --imported from [PKCS10] */
- /*
+ /*-
+ * p10cr [4] CertificationRequest, --imported from [PKCS10]
+ *
* PKCS10_CERTIFICATIONREQUEST is effectively X509_REQ
* so it is used directly
*/
X509_REQ *p10cr; /* 4 */
- /* popdecc [5] POPODecKeyChallContent, --pop Challenge */
- /* POPODecKeyChallContent ::= SEQUENCE OF Challenge */
+ /*-
+ * popdecc [5] POPODecKeyChallContent, --pop Challenge
+ *
+ * POPODecKeyChallContent ::= SEQUENCE OF Challenge
+ */
OSSL_CMP_POPODECKEYCHALLCONTENT *popdecc; /* 5 */
- /* popdecr [6] POPODecKeyRespContent, --pop Response */
- /* POPODecKeyRespContent ::= SEQUENCE OF INTEGER */
+ /*-
+ * popdecr [6] POPODecKeyRespContent, --pop Response
+ *
+ * POPODecKeyRespContent ::= SEQUENCE OF INTEGER
+ */
OSSL_CMP_POPODECKEYRESPCONTENT *popdecr; /* 6 */
OSSL_CRMF_MSGS *kur; /* 7 */
OSSL_CMP_CERTREPMESSAGE *kup; /* 8 */
OSSL_CRMF_MSGS *krr; /* 9 */
- /* krp [10] KeyRecRepContent, --Key Recovery Response */
+ /*-
+ * krp [10] KeyRecRepContent, --Key Recovery Response
+ */
OSSL_CMP_KEYRECREPCONTENT *krp; /* 10 */
- /* rr [11] RevReqContent, --Revocation Request */
+ /*-
+ * rr [11] RevReqContent, --Revocation Request
+ */
OSSL_CMP_REVREQCONTENT *rr; /* 11 */
- /* rp [12] RevRepContent, --Revocation Response */
+ /*-
+ * rp [12] RevRepContent, --Revocation Response
+ */
OSSL_CMP_REVREPCONTENT *rp; /* 12 */
- /* ccr [13] CertReqMessages, --Cross-Cert. Request */
+ /*-
+ * ccr [13] CertReqMessages, --Cross-Cert. Request
+ */
OSSL_CRMF_MSGS *ccr; /* 13 */
- /* ccp [14] CertRepMessage, --Cross-Cert. Response */
+ /*-
+ * ccp [14] CertRepMessage, --Cross-Cert. Response
+ */
OSSL_CMP_CERTREPMESSAGE *ccp; /* 14 */
- /* ckuann [15] CAKeyUpdAnnContent, --CA Key Update Ann. */
+ /*-
+ * ckuann [15] CAKeyUpdAnnContent, --CA Key Update Ann.
+ */
OSSL_CMP_CAKEYUPDANNCONTENT *ckuann; /* 15 */
- /* cann [16] CertAnnContent, --Certificate Ann. */
- /* OSSL_CMP_CMPCERTIFICATE is effectively X509 so it is used directly */
- X509 *cann; /* 16 */
- /* rann [17] RevAnnContent, --Revocation Ann. */
+ /*-
+ * cann [16] CertAnnContent, --Certificate Ann.
+ * OSSL_CMP_CMPCERTIFICATE is effectively X509 so it is used directly
+ */
+ X509 *cann; /* 16 */
+ /*-
+ * rann [17] RevAnnContent, --Revocation Ann.
+ */
OSSL_CMP_REVANNCONTENT *rann; /* 17 */
- /* crlann [18] CRLAnnContent, --CRL Announcement */
- /* CRLAnnContent ::= SEQUENCE OF CertificateList */
- OSSL_CMP_CRLANNCONTENT *crlann;
- /* PKIConfirmContent ::= NULL */
- /* pkiconf [19] PKIConfirmContent, --Confirmation */
- /* OSSL_CMP_PKICONFIRMCONTENT would be only a typedef of ASN1_NULL */
- /* OSSL_CMP_CONFIRMCONTENT *pkiconf; */
- /*
+ /*-
+ * crlann [18] CRLAnnContent, --CRL Announcement
+ * CRLAnnContent ::= SEQUENCE OF CertificateList
+ */
+ OSSL_CMP_CRLANNCONTENT *crlann; /* 18 */
+ /*-
+ * PKIConfirmContent ::= NULL
+ * pkiconf [19] PKIConfirmContent, --Confirmation
+ * OSSL_CMP_PKICONFIRMCONTENT would be only a typedef of ASN1_NULL
+ * OSSL_CMP_CONFIRMCONTENT *pkiconf;
+ *
* NOTE: this should ASN1_NULL according to the RFC
* but there might be a struct in it when sent from faulty servers...
*/
ASN1_TYPE *pkiconf; /* 19 */
- /* nested [20] NestedMessageContent, --Nested Message */
- /* NestedMessageContent ::= PKIMessages */
+ /*-
+ * nested [20] NestedMessageContent, --Nested Message
+ * NestedMessageContent ::= PKIMessages
+ */
OSSL_CMP_MSGS *nested; /* 20 */
- /* genm [21] GenMsgContent, --General Message */
- /* GenMsgContent ::= SEQUENCE OF InfoTypeAndValue */
+ /*-
+ * genm [21] GenMsgContent, --General Message
+ * GenMsgContent ::= SEQUENCE OF InfoTypeAndValue
+ */
OSSL_CMP_GENMSGCONTENT *genm; /* 21 */
- /* genp [22] GenRepContent, --General Response */
- /* GenRepContent ::= SEQUENCE OF InfoTypeAndValue */
+ /*-
+ * genp [22] GenRepContent, --General Response
+ * GenRepContent ::= SEQUENCE OF InfoTypeAndValue
+ */
OSSL_CMP_GENREPCONTENT *genp; /* 22 */
- /* error [23] ErrorMsgContent, --Error Message */
+ /*-
+ * error [23] ErrorMsgContent, --Error Message
+ */
OSSL_CMP_ERRORMSGCONTENT *error; /* 23 */
- /* certConf [24] CertConfirmContent, --Certificate confirm */
+ /*-
+ * certConf [24] CertConfirmContent, --Certificate confirm
+ */
OSSL_CMP_CERTCONFIRMCONTENT *certConf; /* 24 */
- /* pollReq [25] PollReqContent, --Polling request */
- OSSL_CMP_POLLREQCONTENT *pollReq;
- /* pollRep [26] PollRepContent --Polling response */
- OSSL_CMP_POLLREPCONTENT *pollRep;
+ /*-
+ * pollReq [25] PollReqContent, --Polling request
+ */
+ OSSL_CMP_POLLREQCONTENT *pollReq; /* 25 */
+ /*-
+ * pollRep [26] PollRepContent --Polling response
+ */
+ OSSL_CMP_POLLREPCONTENT *pollRep; /* 26 */
} value;
} OSSL_CMP_PKIBODY;
DECLARE_ASN1_FUNCTIONS(OSSL_CMP_PKIBODY)
# define ossl_cmp_add_error_data(txt) ossl_cmp_add_error_txt(" : ", txt)
# define ossl_cmp_add_error_line(txt) ossl_cmp_add_error_txt("\n", txt)
/* functions manipulating lists of certificates etc could be generally useful */
-int ossl_cmp_sk_X509_add1_cert (STACK_OF(X509) *sk, X509 *cert,
- int no_dup, int prepend);
+int ossl_cmp_sk_X509_add1_cert(STACK_OF(X509) *sk, X509 *cert,
+ int no_dup, int prepend);
int ossl_cmp_sk_X509_add1_certs(STACK_OF(X509) *sk, STACK_OF(X509) *certs,
- int no_self_signed, int no_dups, int prepend);
+ int no_self_issued, int no_dups, int prepend);
int ossl_cmp_X509_STORE_add1_certs(X509_STORE *store, STACK_OF(X509) *certs,
- int only_self_signed);
-STACK_OF(X509) *ossl_cmp_X509_STORE_get1_certs(X509_STORE *store);
+ int only_self_issued);
int ossl_cmp_asn1_octet_string_set1(ASN1_OCTET_STRING **tgt,
const ASN1_OCTET_STRING *src);
int ossl_cmp_asn1_octet_string_set1_bytes(ASN1_OCTET_STRING **tgt,
OSSL_CMP_PKISI *
ossl_cmp_revrepcontent_get_pkistatusinfo(OSSL_CMP_REVREPCONTENT *rrep, int rsid);
OSSL_CRMF_CERTID *ossl_cmp_revrepcontent_get_CertId(OSSL_CMP_REVREPCONTENT *rrep,
- int rsid);
+ int rsid);
OSSL_CMP_POLLREP *
ossl_cmp_pollrepcontent_get0_pollrep(const OSSL_CMP_POLLREPCONTENT *prc,
int rid);
const OSSL_CMP_CERTRESPONSE *crep);
OSSL_CMP_MSG *ossl_cmp_msg_load(const char *file);
/* BIO definitions */
-# define OSSL_d2i_CMP_MSG_bio(bp, p) \
+# define OSSL_d2i_CMP_MSG_bio(bp, p) \
ASN1_d2i_bio_of(OSSL_CMP_MSG, OSSL_CMP_MSG_new, d2i_OSSL_CMP_MSG, bp, p)
-# define OSSL_i2d_CMP_MSG_bio(bp, o) \
+# define OSSL_i2d_CMP_MSG_bio(bp, o) \
ASN1_i2d_bio_of(OSSL_CMP_MSG, i2d_OSSL_CMP_MSG, bp, o)
/* from cmp_protect.c */
projects / thirdparty / openssl.git / blobdiff