x509_vfy.h 19 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464
  1. /* $OpenBSD: x509_vfy.h,v 1.68 2024/03/02 10:57:03 tb Exp $ */
  2. /* Copyright (C) 1995-1998 Eric Young ([email protected])
  3. * All rights reserved.
  4. *
  5. * This package is an SSL implementation written
  6. * by Eric Young ([email protected]).
  7. * The implementation was written so as to conform with Netscapes SSL.
  8. *
  9. * This library is free for commercial and non-commercial use as long as
  10. * the following conditions are aheared to. The following conditions
  11. * apply to all code found in this distribution, be it the RC4, RSA,
  12. * lhash, DES, etc., code; not just the SSL code. The SSL documentation
  13. * included with this distribution is covered by the same copyright terms
  14. * except that the holder is Tim Hudson ([email protected]).
  15. *
  16. * Copyright remains Eric Young's, and as such any Copyright notices in
  17. * the code are not to be removed.
  18. * If this package is used in a product, Eric Young should be given attribution
  19. * as the author of the parts of the library used.
  20. * This can be in the form of a textual message at program startup or
  21. * in documentation (online or textual) provided with the package.
  22. *
  23. * Redistribution and use in source and binary forms, with or without
  24. * modification, are permitted provided that the following conditions
  25. * are met:
  26. * 1. Redistributions of source code must retain the copyright
  27. * notice, this list of conditions and the following disclaimer.
  28. * 2. Redistributions in binary form must reproduce the above copyright
  29. * notice, this list of conditions and the following disclaimer in the
  30. * documentation and/or other materials provided with the distribution.
  31. * 3. All advertising materials mentioning features or use of this software
  32. * must display the following acknowledgement:
  33. * "This product includes cryptographic software written by
  34. * Eric Young ([email protected])"
  35. * The word 'cryptographic' can be left out if the rouines from the library
  36. * being used are not cryptographic related :-).
  37. * 4. If you include any Windows specific code (or a derivative thereof) from
  38. * the apps directory (application code) you must include an acknowledgement:
  39. * "This product includes software written by Tim Hudson ([email protected])"
  40. *
  41. * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42. * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43. * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44. * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45. * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46. * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47. * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48. * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49. * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50. * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51. * SUCH DAMAGE.
  52. *
  53. * The licence and distribution terms for any publically available version or
  54. * derivative of this code cannot be changed. i.e. this code cannot simply be
  55. * copied and put under another distribution licence
  56. * [including the GNU Public Licence.]
  57. */
  58. #ifndef HEADER_X509_H
  59. #include <openssl/x509.h>
  60. /* openssl/x509.h ends up #include-ing this file at about the only
  61. * appropriate moment. */
  62. #endif
  63. #ifndef HEADER_X509_VFY_H
  64. #define HEADER_X509_VFY_H
  65. #include <openssl/opensslconf.h>
  66. #ifndef OPENSSL_NO_LHASH
  67. #include <openssl/lhash.h>
  68. #endif
  69. #include <openssl/bio.h>
  70. #include <openssl/crypto.h>
  71. #ifdef __cplusplus
  72. extern "C" {
  73. #endif
  74. /*
  75. * SSL_CTX -> X509_STORE
  76. * -> X509_LOOKUP
  77. * ->X509_LOOKUP_METHOD
  78. * -> X509_LOOKUP
  79. * ->X509_LOOKUP_METHOD
  80. *
  81. * SSL -> X509_STORE_CTX
  82. * ->X509_STORE
  83. *
  84. * The X509_STORE holds the tables etc for verification stuff.
  85. * A X509_STORE_CTX is used while validating a single certificate.
  86. * The X509_STORE has X509_LOOKUPs for looking up certs.
  87. * The X509_STORE then calls a function to actually verify the
  88. * certificate chain.
  89. */
  90. typedef enum {
  91. X509_LU_NONE,
  92. X509_LU_X509,
  93. X509_LU_CRL,
  94. } X509_LOOKUP_TYPE;
  95. DECLARE_STACK_OF(X509_LOOKUP)
  96. DECLARE_STACK_OF(X509_OBJECT)
  97. DECLARE_STACK_OF(X509_VERIFY_PARAM)
  98. /* XXX - unused in OpenSSL. Can we remove this? */
  99. typedef struct X509_VERIFY_PARAM_ID_st X509_VERIFY_PARAM_ID;
  100. int X509_STORE_set_depth(X509_STORE *store, int depth);
  101. void X509_STORE_CTX_set_depth(X509_STORE_CTX *ctx, int depth);
  102. #define X509_STORE_CTX_set_app_data(ctx,data) \
  103. X509_STORE_CTX_set_ex_data(ctx,0,data)
  104. #define X509_STORE_CTX_get_app_data(ctx) \
  105. X509_STORE_CTX_get_ex_data(ctx,0)
  106. #define X509_L_FILE_LOAD 1
  107. #define X509_L_ADD_DIR 2
  108. #define X509_L_MEM 3
  109. #define X509_LOOKUP_load_file(x,name,type) \
  110. X509_LOOKUP_ctrl((x),X509_L_FILE_LOAD,(name),(long)(type),NULL)
  111. #define X509_LOOKUP_add_dir(x,name,type) \
  112. X509_LOOKUP_ctrl((x),X509_L_ADD_DIR,(name),(long)(type),NULL)
  113. #define X509_LOOKUP_add_mem(x,iov,type) \
  114. X509_LOOKUP_ctrl((x),X509_L_MEM,(const char *)(iov),\
  115. (long)(type),NULL)
  116. #define X509_V_OK 0
  117. #define X509_V_ERR_UNSPECIFIED 1
  118. #define X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT 2
  119. #define X509_V_ERR_UNABLE_TO_GET_CRL 3
  120. #define X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE 4
  121. #define X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE 5
  122. #define X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY 6
  123. #define X509_V_ERR_CERT_SIGNATURE_FAILURE 7
  124. #define X509_V_ERR_CRL_SIGNATURE_FAILURE 8
  125. #define X509_V_ERR_CERT_NOT_YET_VALID 9
  126. #define X509_V_ERR_CERT_HAS_EXPIRED 10
  127. #define X509_V_ERR_CRL_NOT_YET_VALID 11
  128. #define X509_V_ERR_CRL_HAS_EXPIRED 12
  129. #define X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD 13
  130. #define X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD 14
  131. #define X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD 15
  132. #define X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD 16
  133. #define X509_V_ERR_OUT_OF_MEM 17
  134. #define X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT 18
  135. #define X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN 19
  136. #define X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY 20
  137. #define X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE 21
  138. #define X509_V_ERR_CERT_CHAIN_TOO_LONG 22
  139. #define X509_V_ERR_CERT_REVOKED 23
  140. #define X509_V_ERR_INVALID_CA 24
  141. #define X509_V_ERR_PATH_LENGTH_EXCEEDED 25
  142. #define X509_V_ERR_INVALID_PURPOSE 26
  143. #define X509_V_ERR_CERT_UNTRUSTED 27
  144. #define X509_V_ERR_CERT_REJECTED 28
  145. /* These are 'informational' when looking for issuer cert */
  146. #define X509_V_ERR_SUBJECT_ISSUER_MISMATCH 29
  147. #define X509_V_ERR_AKID_SKID_MISMATCH 30
  148. #define X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH 31
  149. #define X509_V_ERR_KEYUSAGE_NO_CERTSIGN 32
  150. #define X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER 33
  151. #define X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION 34
  152. #define X509_V_ERR_KEYUSAGE_NO_CRL_SIGN 35
  153. #define X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION 36
  154. #define X509_V_ERR_INVALID_NON_CA 37
  155. #define X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED 38
  156. #define X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE 39
  157. #define X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED 40
  158. #define X509_V_ERR_INVALID_EXTENSION 41
  159. #define X509_V_ERR_INVALID_POLICY_EXTENSION 42
  160. #define X509_V_ERR_NO_EXPLICIT_POLICY 43
  161. #define X509_V_ERR_DIFFERENT_CRL_SCOPE 44
  162. #define X509_V_ERR_UNSUPPORTED_EXTENSION_FEATURE 45
  163. #define X509_V_ERR_UNNESTED_RESOURCE 46
  164. #define X509_V_ERR_PERMITTED_VIOLATION 47
  165. #define X509_V_ERR_EXCLUDED_VIOLATION 48
  166. #define X509_V_ERR_SUBTREE_MINMAX 49
  167. #define X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE 51
  168. #define X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX 52
  169. #define X509_V_ERR_UNSUPPORTED_NAME_SYNTAX 53
  170. #define X509_V_ERR_CRL_PATH_VALIDATION_ERROR 54
  171. /* The application is not happy */
  172. #define X509_V_ERR_APPLICATION_VERIFICATION 50
  173. /* Host, email and IP check errors */
  174. #define X509_V_ERR_HOSTNAME_MISMATCH 62
  175. #define X509_V_ERR_EMAIL_MISMATCH 63
  176. #define X509_V_ERR_IP_ADDRESS_MISMATCH 64
  177. /* Caller error */
  178. #define X509_V_ERR_INVALID_CALL 65
  179. /* Issuer lookup error */
  180. #define X509_V_ERR_STORE_LOOKUP 66
  181. /* Security level errors */
  182. #define X509_V_ERR_EE_KEY_TOO_SMALL 67
  183. #define X509_V_ERR_CA_KEY_TOO_SMALL 68
  184. #define X509_V_ERR_CA_MD_TOO_WEAK 69
  185. /* Certificate verify flags */
  186. /* Deprecated in 1.1.0, has no effect. Various FFI bindings still expose it. */
  187. #define X509_V_FLAG_CB_ISSUER_CHECK 0x0
  188. /* Use check time instead of current time */
  189. #define X509_V_FLAG_USE_CHECK_TIME 0x2
  190. /* Lookup CRLs */
  191. #define X509_V_FLAG_CRL_CHECK 0x4
  192. /* Lookup CRLs for whole chain */
  193. #define X509_V_FLAG_CRL_CHECK_ALL 0x8
  194. /* Ignore unhandled critical extensions */
  195. #define X509_V_FLAG_IGNORE_CRITICAL 0x10
  196. /* Disable workarounds for broken certificates */
  197. #define X509_V_FLAG_X509_STRICT 0x20
  198. /* Enable proxy certificate validation */
  199. #define X509_V_FLAG_ALLOW_PROXY_CERTS 0x40
  200. /* Does nothing as its functionality has been enabled by default */
  201. #define X509_V_FLAG_POLICY_CHECK 0x80
  202. /* Policy variable require-explicit-policy */
  203. #define X509_V_FLAG_EXPLICIT_POLICY 0x100
  204. /* Policy variable inhibit-any-policy */
  205. #define X509_V_FLAG_INHIBIT_ANY 0x200
  206. /* Policy variable inhibit-policy-mapping */
  207. #define X509_V_FLAG_INHIBIT_MAP 0x400
  208. /* Notify callback that policy is OK */
  209. #define X509_V_FLAG_NOTIFY_POLICY 0x800
  210. /* Extended CRL features such as indirect CRLs, alternate CRL signing keys */
  211. #define X509_V_FLAG_EXTENDED_CRL_SUPPORT 0x1000
  212. /* Delta CRL support */
  213. #define X509_V_FLAG_USE_DELTAS 0x2000
  214. /* Check selfsigned CA signature */
  215. #define X509_V_FLAG_CHECK_SS_SIGNATURE 0x4000
  216. /* Use trusted store first */
  217. #define X509_V_FLAG_TRUSTED_FIRST 0x8000
  218. /* Allow partial chains if at least one certificate is in trusted store */
  219. #define X509_V_FLAG_PARTIAL_CHAIN 0x80000
  220. /* If the initial chain is not trusted, do not attempt to build an alternative
  221. * chain. Alternate chain checking was introduced in 1.0.2b. Setting this flag
  222. * will force the behaviour to match that of previous versions. */
  223. #define X509_V_FLAG_NO_ALT_CHAINS 0x100000
  224. /* Do not check certificate or CRL validity against current time. */
  225. #define X509_V_FLAG_NO_CHECK_TIME 0x200000
  226. /* Force the use of the legacy certificate verification */
  227. #define X509_V_FLAG_LEGACY_VERIFY 0x400000
  228. #define X509_VP_FLAG_DEFAULT 0x1
  229. #define X509_VP_FLAG_OVERWRITE 0x2
  230. #define X509_VP_FLAG_RESET_FLAGS 0x4
  231. #define X509_VP_FLAG_LOCKED 0x8
  232. #define X509_VP_FLAG_ONCE 0x10
  233. /*
  234. * Obsolete internal use: mask of policy related options.
  235. * This should really go away.
  236. */
  237. #define X509_V_FLAG_POLICY_MASK (X509_V_FLAG_POLICY_CHECK \
  238. | X509_V_FLAG_EXPLICIT_POLICY \
  239. | X509_V_FLAG_INHIBIT_ANY \
  240. | X509_V_FLAG_INHIBIT_MAP)
  241. X509_OBJECT *X509_OBJECT_new(void);
  242. void X509_OBJECT_free(X509_OBJECT *a);
  243. int X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, X509_LOOKUP_TYPE type,
  244. X509_NAME *name);
  245. X509_OBJECT *X509_OBJECT_retrieve_by_subject(STACK_OF(X509_OBJECT) *h,
  246. X509_LOOKUP_TYPE type, X509_NAME *name);
  247. X509_OBJECT *X509_OBJECT_retrieve_match(STACK_OF(X509_OBJECT) *h, X509_OBJECT *x);
  248. int X509_OBJECT_up_ref_count(X509_OBJECT *a);
  249. X509_LOOKUP_TYPE X509_OBJECT_get_type(const X509_OBJECT *a);
  250. X509 *X509_OBJECT_get0_X509(const X509_OBJECT *xo);
  251. X509_CRL *X509_OBJECT_get0_X509_CRL(X509_OBJECT *xo);
  252. X509_STORE *X509_STORE_new(void);
  253. void X509_STORE_free(X509_STORE *v);
  254. int X509_STORE_up_ref(X509_STORE *x);
  255. #define X509_STORE_get1_certs X509_STORE_CTX_get1_certs
  256. #define X509_STORE_get1_crls X509_STORE_CTX_get1_crls
  257. STACK_OF(X509) *X509_STORE_CTX_get1_certs(X509_STORE_CTX *st, X509_NAME *nm);
  258. STACK_OF(X509_CRL) *X509_STORE_CTX_get1_crls(X509_STORE_CTX *st, X509_NAME *nm);
  259. STACK_OF(X509_OBJECT) *X509_STORE_get0_objects(X509_STORE *xs);
  260. STACK_OF(X509_OBJECT) *X509_STORE_get1_objects(X509_STORE *xs);
  261. void *X509_STORE_get_ex_data(X509_STORE *xs, int idx);
  262. int X509_STORE_set_ex_data(X509_STORE *xs, int idx, void *data);
  263. #define X509_STORE_get_ex_new_index(l, p, newf, dupf, freef) \
  264. CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_X509_STORE, (l), (p), \
  265. (newf), (dupf), (freef))
  266. int X509_STORE_set_flags(X509_STORE *ctx, unsigned long flags);
  267. int X509_STORE_set_purpose(X509_STORE *ctx, int purpose);
  268. int X509_STORE_set_trust(X509_STORE *ctx, int trust);
  269. int X509_STORE_set1_param(X509_STORE *ctx, X509_VERIFY_PARAM *pm);
  270. X509_VERIFY_PARAM *X509_STORE_get0_param(X509_STORE *ctx);
  271. typedef int (*X509_STORE_CTX_verify_cb)(int, X509_STORE_CTX *);
  272. X509_STORE_CTX_verify_cb X509_STORE_get_verify_cb(X509_STORE *);
  273. void X509_STORE_set_verify_cb(X509_STORE *ctx,
  274. int (*verify_cb)(int, X509_STORE_CTX *));
  275. #define X509_STORE_set_verify_cb_func(ctx, func) \
  276. X509_STORE_set_verify_cb((ctx), (func))
  277. typedef int (*X509_STORE_CTX_check_issued_fn)(X509_STORE_CTX *ctx,
  278. X509 *subject, X509 *issuer);
  279. X509_STORE_CTX_check_issued_fn X509_STORE_get_check_issued(X509_STORE *store);
  280. void X509_STORE_set_check_issued(X509_STORE *store,
  281. X509_STORE_CTX_check_issued_fn check_issued);
  282. X509_STORE_CTX_check_issued_fn
  283. X509_STORE_CTX_get_check_issued(X509_STORE_CTX *ctx);
  284. X509_STORE_CTX *X509_STORE_CTX_new(void);
  285. int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x);
  286. void X509_STORE_CTX_free(X509_STORE_CTX *ctx);
  287. int X509_STORE_CTX_init(X509_STORE_CTX *ctx, X509_STORE *store,
  288. X509 *x509, STACK_OF(X509) *chain);
  289. X509 *X509_STORE_CTX_get0_cert(X509_STORE_CTX *ctx);
  290. STACK_OF(X509) *X509_STORE_CTX_get0_chain(X509_STORE_CTX *xs);
  291. X509_STORE *X509_STORE_CTX_get0_store(X509_STORE_CTX *xs);
  292. STACK_OF(X509) *X509_STORE_CTX_get0_untrusted(X509_STORE_CTX *ctx);
  293. void X509_STORE_CTX_set0_untrusted(X509_STORE_CTX *ctx, STACK_OF(X509) *sk);
  294. void X509_STORE_CTX_trusted_stack(X509_STORE_CTX *ctx, STACK_OF(X509) *sk);
  295. void X509_STORE_CTX_set0_trusted_stack(X509_STORE_CTX *ctx, STACK_OF(X509) *sk);
  296. void X509_STORE_CTX_cleanup(X509_STORE_CTX *ctx);
  297. X509_LOOKUP *X509_STORE_add_lookup(X509_STORE *v, X509_LOOKUP_METHOD *m);
  298. X509_LOOKUP_METHOD *X509_LOOKUP_hash_dir(void);
  299. X509_LOOKUP_METHOD *X509_LOOKUP_file(void);
  300. X509_LOOKUP_METHOD *X509_LOOKUP_mem(void);
  301. int X509_STORE_add_cert(X509_STORE *ctx, X509 *x);
  302. int X509_STORE_add_crl(X509_STORE *ctx, X509_CRL *x);
  303. int X509_STORE_CTX_get_by_subject(X509_STORE_CTX *vs, X509_LOOKUP_TYPE type,
  304. X509_NAME *name, X509_OBJECT *ret);
  305. #define X509_STORE_get_by_subject X509_STORE_CTX_get_by_subject
  306. X509_OBJECT *X509_STORE_CTX_get_obj_by_subject(X509_STORE_CTX *vs,
  307. X509_LOOKUP_TYPE type, X509_NAME *name);
  308. int X509_LOOKUP_ctrl(X509_LOOKUP *ctx, int cmd, const char *argc,
  309. long argl, char **ret);
  310. int X509_load_cert_file(X509_LOOKUP *ctx, const char *file, int type);
  311. int X509_load_crl_file(X509_LOOKUP *ctx, const char *file, int type);
  312. int X509_load_cert_crl_file(X509_LOOKUP *ctx, const char *file, int type);
  313. void X509_LOOKUP_free(X509_LOOKUP *ctx);
  314. int X509_STORE_load_locations(X509_STORE *ctx,
  315. const char *file, const char *dir);
  316. int X509_STORE_load_mem(X509_STORE *ctx, void *buf, int len);
  317. int X509_STORE_set_default_paths(X509_STORE *ctx);
  318. int X509_STORE_CTX_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
  319. CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func);
  320. int X509_STORE_CTX_set_ex_data(X509_STORE_CTX *ctx,int idx,void *data);
  321. void * X509_STORE_CTX_get_ex_data(X509_STORE_CTX *ctx,int idx);
  322. int X509_STORE_CTX_get_error(X509_STORE_CTX *ctx);
  323. void X509_STORE_CTX_set_error(X509_STORE_CTX *ctx,int s);
  324. int X509_STORE_CTX_get_error_depth(X509_STORE_CTX *ctx);
  325. void X509_STORE_CTX_set_error_depth(X509_STORE_CTX *ctx, int depth);
  326. X509 * X509_STORE_CTX_get_current_cert(X509_STORE_CTX *ctx);
  327. void X509_STORE_CTX_set_current_cert(X509_STORE_CTX *ctx, X509 *x);
  328. X509 *X509_STORE_CTX_get0_current_issuer(X509_STORE_CTX *ctx);
  329. X509_CRL *X509_STORE_CTX_get0_current_crl(X509_STORE_CTX *ctx);
  330. X509_STORE_CTX *X509_STORE_CTX_get0_parent_ctx(X509_STORE_CTX *ctx);
  331. STACK_OF(X509) *X509_STORE_CTX_get_chain(X509_STORE_CTX *ctx);
  332. STACK_OF(X509) *X509_STORE_CTX_get1_chain(X509_STORE_CTX *ctx);
  333. void X509_STORE_CTX_set_cert(X509_STORE_CTX *c,X509 *x);
  334. void X509_STORE_CTX_set_chain(X509_STORE_CTX *c,STACK_OF(X509) *sk);
  335. void X509_STORE_CTX_set0_crls(X509_STORE_CTX *c,STACK_OF(X509_CRL) *sk);
  336. int X509_STORE_CTX_set_purpose(X509_STORE_CTX *ctx, int purpose);
  337. int X509_STORE_CTX_set_trust(X509_STORE_CTX *ctx, int trust);
  338. void X509_STORE_CTX_set_flags(X509_STORE_CTX *ctx, unsigned long flags);
  339. void X509_STORE_CTX_set_time(X509_STORE_CTX *ctx, unsigned long flags,
  340. time_t t);
  341. void X509_STORE_CTX_set0_verified_chain(X509_STORE_CTX *ctx, STACK_OF(X509) *sk);
  342. int (*X509_STORE_CTX_get_verify(X509_STORE_CTX *ctx))(X509_STORE_CTX *);
  343. void X509_STORE_CTX_set_verify(X509_STORE_CTX *ctx,
  344. int (*verify)(X509_STORE_CTX *));
  345. int (*X509_STORE_CTX_get_verify_cb(X509_STORE_CTX *ctx))(int, X509_STORE_CTX *);
  346. void X509_STORE_CTX_set_verify_cb(X509_STORE_CTX *ctx,
  347. int (*verify_cb)(int, X509_STORE_CTX *));
  348. typedef int (*X509_STORE_CTX_verify_fn)(X509_STORE_CTX *);
  349. void X509_STORE_set_verify(X509_STORE *ctx, X509_STORE_CTX_verify_fn verify);
  350. X509_STORE_CTX_verify_fn X509_STORE_get_verify(X509_STORE *ctx);
  351. #define X509_STORE_set_verify_func(ctx, func) \
  352. X509_STORE_set_verify((ctx), (func))
  353. int X509_STORE_CTX_get_num_untrusted(X509_STORE_CTX *ctx);
  354. X509_VERIFY_PARAM *X509_STORE_CTX_get0_param(X509_STORE_CTX *ctx);
  355. void X509_STORE_CTX_set0_param(X509_STORE_CTX *ctx, X509_VERIFY_PARAM *param);
  356. int X509_STORE_CTX_set_default(X509_STORE_CTX *ctx, const char *name);
  357. /* X509_VERIFY_PARAM functions */
  358. X509_VERIFY_PARAM *X509_VERIFY_PARAM_new(void);
  359. void X509_VERIFY_PARAM_free(X509_VERIFY_PARAM *param);
  360. int X509_VERIFY_PARAM_inherit(X509_VERIFY_PARAM *to,
  361. const X509_VERIFY_PARAM *from);
  362. int X509_VERIFY_PARAM_set1(X509_VERIFY_PARAM *to,
  363. const X509_VERIFY_PARAM *from);
  364. int X509_VERIFY_PARAM_set1_name(X509_VERIFY_PARAM *param, const char *name);
  365. int X509_VERIFY_PARAM_set_flags(X509_VERIFY_PARAM *param, unsigned long flags);
  366. int X509_VERIFY_PARAM_clear_flags(X509_VERIFY_PARAM *param,
  367. unsigned long flags);
  368. unsigned long X509_VERIFY_PARAM_get_flags(X509_VERIFY_PARAM *param);
  369. int X509_VERIFY_PARAM_set_purpose(X509_VERIFY_PARAM *param, int purpose);
  370. int X509_VERIFY_PARAM_set_trust(X509_VERIFY_PARAM *param, int trust);
  371. void X509_VERIFY_PARAM_set_depth(X509_VERIFY_PARAM *param, int depth);
  372. void X509_VERIFY_PARAM_set_auth_level(X509_VERIFY_PARAM *param, int auth_level);
  373. time_t X509_VERIFY_PARAM_get_time(const X509_VERIFY_PARAM *param);
  374. void X509_VERIFY_PARAM_set_time(X509_VERIFY_PARAM *param, time_t t);
  375. int X509_VERIFY_PARAM_add0_policy(X509_VERIFY_PARAM *param,
  376. ASN1_OBJECT *policy);
  377. int X509_VERIFY_PARAM_set1_policies(X509_VERIFY_PARAM *param,
  378. STACK_OF(ASN1_OBJECT) *policies);
  379. int X509_VERIFY_PARAM_get_depth(const X509_VERIFY_PARAM *param);
  380. int X509_VERIFY_PARAM_set1_host(X509_VERIFY_PARAM *param, const char *name,
  381. size_t namelen);
  382. int X509_VERIFY_PARAM_add1_host(X509_VERIFY_PARAM *param, const char *name,
  383. size_t namelen);
  384. void X509_VERIFY_PARAM_set_hostflags(X509_VERIFY_PARAM *param,
  385. unsigned int flags);
  386. char *X509_VERIFY_PARAM_get0_peername(X509_VERIFY_PARAM *param);
  387. int X509_VERIFY_PARAM_set1_email(X509_VERIFY_PARAM *param, const char *email,
  388. size_t emaillen);
  389. int X509_VERIFY_PARAM_set1_ip(X509_VERIFY_PARAM *param, const unsigned char *ip,
  390. size_t iplen);
  391. int X509_VERIFY_PARAM_set1_ip_asc(X509_VERIFY_PARAM *param, const char *ipasc);
  392. const char *X509_VERIFY_PARAM_get0_name(const X509_VERIFY_PARAM *param);
  393. const X509_VERIFY_PARAM *X509_VERIFY_PARAM_get0(int id);
  394. int X509_VERIFY_PARAM_get_count(void);
  395. int X509_VERIFY_PARAM_add0_table(X509_VERIFY_PARAM *param);
  396. const X509_VERIFY_PARAM *X509_VERIFY_PARAM_lookup(const char *name);
  397. void X509_VERIFY_PARAM_table_cleanup(void);
  398. #ifdef __cplusplus
  399. }
  400. #endif
  401. #endif