1 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2 * All rights reserved. 3 * 4 * This package is an SSL implementation written 5 * by Eric Young (eay@cryptsoft.com). 6 * The implementation was written so as to conform with Netscapes SSL. 7 * 8 * This library is free for commercial and non-commercial use as long as 9 * the following conditions are aheared to. The following conditions 10 * apply to all code found in this distribution, be it the RC4, RSA, 11 * lhash, DES, etc., code; not just the SSL code. The SSL documentation 12 * included with this distribution is covered by the same copyright terms 13 * except that the holder is Tim Hudson (tjh@cryptsoft.com). 14 * 15 * Copyright remains Eric Young's, and as such any Copyright notices in 16 * the code are not to be removed. 17 * If this package is used in a product, Eric Young should be given attribution 18 * as the author of the parts of the library used. 19 * This can be in the form of a textual message at program startup or 20 * in documentation (online or textual) provided with the package. 21 * 22 * Redistribution and use in source and binary forms, with or without 23 * modification, are permitted provided that the following conditions 24 * are met: 25 * 1. Redistributions of source code must retain the copyright 26 * notice, this list of conditions and the following disclaimer. 27 * 2. Redistributions in binary form must reproduce the above copyright 28 * notice, this list of conditions and the following disclaimer in the 29 * documentation and/or other materials provided with the distribution. 30 * 3. All advertising materials mentioning features or use of this software 31 * must display the following acknowledgement: 32 * "This product includes cryptographic software written by 33 * Eric Young (eay@cryptsoft.com)" 34 * The word 'cryptographic' can be left out if the rouines from the library 35 * being used are not cryptographic related :-). 36 * 4. If you include any Windows specific code (or a derivative thereof) from 37 * the apps directory (application code) you must include an acknowledgement: 38 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" 39 * 40 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND 41 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 42 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 43 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 44 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 45 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 46 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 48 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 49 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 50 * SUCH DAMAGE. 51 * 52 * The licence and distribution terms for any publically available version or 53 * derivative of this code cannot be changed. i.e. this code cannot simply be 54 * copied and put under another distribution licence 55 * [including the GNU Public Licence.] 56 */ 57 /* ==================================================================== 58 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED. 59 * ECDH support in OpenSSL originally developed by 60 * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project. 61 */ 62 63 #ifndef HEADER_X509_H 64 #define HEADER_X509_H 65 66 #include <openssl/asn1.h> 67 #include <openssl/base.h> 68 #include <openssl/bio.h> 69 #include <openssl/cipher.h> 70 #include <openssl/dh.h> 71 #include <openssl/dsa.h> 72 #include <openssl/ec.h> 73 #include <openssl/ecdh.h> 74 #include <openssl/ecdsa.h> 75 #include <openssl/evp.h> 76 #include <openssl/obj.h> 77 #include <openssl/pkcs7.h> 78 #include <openssl/pool.h> 79 #include <openssl/rsa.h> 80 #include <openssl/sha.h> 81 #include <openssl/stack.h> 82 #include <openssl/thread.h> 83 #include <time.h> 84 85 #ifdef __cplusplus 86 extern "C" { 87 #endif 88 89 90 // Legacy X.509 library. 91 // 92 // This header is part of OpenSSL's X.509 implementation. It is retained for 93 // compatibility but otherwise underdocumented and not actively maintained. In 94 // the future, a replacement library will be available. Meanwhile, minimize 95 // dependencies on this header where possible. 96 97 98 #define X509_FILETYPE_PEM 1 99 #define X509_FILETYPE_ASN1 2 100 #define X509_FILETYPE_DEFAULT 3 101 102 #define X509v3_KU_DIGITAL_SIGNATURE 0x0080 103 #define X509v3_KU_NON_REPUDIATION 0x0040 104 #define X509v3_KU_KEY_ENCIPHERMENT 0x0020 105 #define X509v3_KU_DATA_ENCIPHERMENT 0x0010 106 #define X509v3_KU_KEY_AGREEMENT 0x0008 107 #define X509v3_KU_KEY_CERT_SIGN 0x0004 108 #define X509v3_KU_CRL_SIGN 0x0002 109 #define X509v3_KU_ENCIPHER_ONLY 0x0001 110 #define X509v3_KU_DECIPHER_ONLY 0x8000 111 #define X509v3_KU_UNDEF 0xffff 112 113 DEFINE_STACK_OF(X509_ALGOR) 114 DECLARE_ASN1_SET_OF(X509_ALGOR) 115 116 typedef STACK_OF(X509_ALGOR) X509_ALGORS; 117 118 struct X509_val_st { 119 ASN1_TIME *notBefore; 120 ASN1_TIME *notAfter; 121 } /* X509_VAL */; 122 123 struct X509_pubkey_st { 124 X509_ALGOR *algor; 125 ASN1_BIT_STRING *public_key; 126 EVP_PKEY *pkey; 127 }; 128 129 struct X509_sig_st { 130 X509_ALGOR *algor; 131 ASN1_OCTET_STRING *digest; 132 } /* X509_SIG */; 133 134 struct X509_name_entry_st { 135 ASN1_OBJECT *object; 136 ASN1_STRING *value; 137 int set; 138 int size; // temp variable 139 } /* X509_NAME_ENTRY */; 140 141 DEFINE_STACK_OF(X509_NAME_ENTRY) 142 DECLARE_ASN1_SET_OF(X509_NAME_ENTRY) 143 144 // we always keep X509_NAMEs in 2 forms. 145 struct X509_name_st { 146 STACK_OF(X509_NAME_ENTRY) *entries; 147 int modified; // true if 'bytes' needs to be built 148 BUF_MEM *bytes; 149 // unsigned long hash; Keep the hash around for lookups 150 unsigned char *canon_enc; 151 int canon_enclen; 152 } /* X509_NAME */; 153 154 DEFINE_STACK_OF(X509_NAME) 155 156 struct X509_extension_st { 157 ASN1_OBJECT *object; 158 ASN1_BOOLEAN critical; 159 ASN1_OCTET_STRING *value; 160 } /* X509_EXTENSION */; 161 162 typedef STACK_OF(X509_EXTENSION) X509_EXTENSIONS; 163 164 DEFINE_STACK_OF(X509_EXTENSION) 165 DECLARE_ASN1_SET_OF(X509_EXTENSION) 166 167 // a sequence of these are used 168 struct x509_attributes_st { 169 ASN1_OBJECT *object; 170 int single; // 0 for a set, 1 for a single item (which is wrong) 171 union { 172 char *ptr; 173 /* 0 */ STACK_OF(ASN1_TYPE) *set; 174 /* 1 */ ASN1_TYPE *single; 175 } value; 176 } /* X509_ATTRIBUTE */; 177 178 DEFINE_STACK_OF(X509_ATTRIBUTE) 179 DECLARE_ASN1_SET_OF(X509_ATTRIBUTE) 180 181 182 struct X509_req_info_st { 183 ASN1_ENCODING enc; 184 ASN1_INTEGER *version; 185 X509_NAME *subject; 186 X509_PUBKEY *pubkey; 187 // d=2 hl=2 l= 0 cons: cont: 00 188 STACK_OF(X509_ATTRIBUTE) *attributes; // [ 0 ] 189 } /* X509_REQ_INFO */; 190 191 struct X509_req_st { 192 X509_REQ_INFO *req_info; 193 X509_ALGOR *sig_alg; 194 ASN1_BIT_STRING *signature; 195 CRYPTO_refcount_t references; 196 } /* X509_REQ */; 197 198 struct x509_cinf_st { 199 ASN1_INTEGER *version; // [ 0 ] default of v1 200 ASN1_INTEGER *serialNumber; 201 X509_ALGOR *signature; 202 X509_NAME *issuer; 203 X509_VAL *validity; 204 X509_NAME *subject; 205 X509_PUBKEY *key; 206 ASN1_BIT_STRING *issuerUID; // [ 1 ] optional in v2 207 ASN1_BIT_STRING *subjectUID; // [ 2 ] optional in v2 208 STACK_OF(X509_EXTENSION) *extensions; // [ 3 ] optional in v3 209 ASN1_ENCODING enc; 210 } /* X509_CINF */; 211 212 // This stuff is certificate "auxiliary info" 213 // it contains details which are useful in certificate 214 // stores and databases. When used this is tagged onto 215 // the end of the certificate itself 216 217 struct x509_cert_aux_st { 218 STACK_OF(ASN1_OBJECT) *trust; // trusted uses 219 STACK_OF(ASN1_OBJECT) *reject; // rejected uses 220 ASN1_UTF8STRING *alias; // "friendly name" 221 ASN1_OCTET_STRING *keyid; // key id of private key 222 STACK_OF(X509_ALGOR) *other; // other unspecified info 223 } /* X509_CERT_AUX */; 224 225 DECLARE_STACK_OF(DIST_POINT) 226 DECLARE_STACK_OF(GENERAL_NAME) 227 228 struct x509_st { 229 X509_CINF *cert_info; 230 X509_ALGOR *sig_alg; 231 ASN1_BIT_STRING *signature; 232 CRYPTO_refcount_t references; 233 CRYPTO_EX_DATA ex_data; 234 // These contain copies of various extension values 235 long ex_pathlen; 236 long ex_pcpathlen; 237 unsigned long ex_flags; 238 unsigned long ex_kusage; 239 unsigned long ex_xkusage; 240 unsigned long ex_nscert; 241 ASN1_OCTET_STRING *skid; 242 AUTHORITY_KEYID *akid; 243 X509_POLICY_CACHE *policy_cache; 244 STACK_OF(DIST_POINT) *crldp; 245 STACK_OF(GENERAL_NAME) *altname; 246 NAME_CONSTRAINTS *nc; 247 unsigned char sha1_hash[SHA_DIGEST_LENGTH]; 248 X509_CERT_AUX *aux; 249 CRYPTO_BUFFER *buf; 250 CRYPTO_MUTEX lock; 251 } /* X509 */; 252 253 DEFINE_STACK_OF(X509) 254 DECLARE_ASN1_SET_OF(X509) 255 256 // This is used for a table of trust checking functions 257 258 struct x509_trust_st { 259 int trust; 260 int flags; 261 int (*check_trust)(struct x509_trust_st *, X509 *, int); 262 char *name; 263 int arg1; 264 void *arg2; 265 } /* X509_TRUST */; 266 267 DEFINE_STACK_OF(X509_TRUST) 268 269 // standard trust ids 270 271 #define X509_TRUST_DEFAULT (-1) // Only valid in purpose settings 272 273 #define X509_TRUST_COMPAT 1 274 #define X509_TRUST_SSL_CLIENT 2 275 #define X509_TRUST_SSL_SERVER 3 276 #define X509_TRUST_EMAIL 4 277 #define X509_TRUST_OBJECT_SIGN 5 278 #define X509_TRUST_OCSP_SIGN 6 279 #define X509_TRUST_OCSP_REQUEST 7 280 #define X509_TRUST_TSA 8 281 282 // Keep these up to date! 283 #define X509_TRUST_MIN 1 284 #define X509_TRUST_MAX 8 285 286 287 // trust_flags values 288 #define X509_TRUST_DYNAMIC 1 289 #define X509_TRUST_DYNAMIC_NAME 2 290 291 // check_trust return codes 292 293 #define X509_TRUST_TRUSTED 1 294 #define X509_TRUST_REJECTED 2 295 #define X509_TRUST_UNTRUSTED 3 296 297 // Flags for X509_print_ex() 298 299 #define X509_FLAG_COMPAT 0 300 #define X509_FLAG_NO_HEADER 1L 301 #define X509_FLAG_NO_VERSION (1L << 1) 302 #define X509_FLAG_NO_SERIAL (1L << 2) 303 #define X509_FLAG_NO_SIGNAME (1L << 3) 304 #define X509_FLAG_NO_ISSUER (1L << 4) 305 #define X509_FLAG_NO_VALIDITY (1L << 5) 306 #define X509_FLAG_NO_SUBJECT (1L << 6) 307 #define X509_FLAG_NO_PUBKEY (1L << 7) 308 #define X509_FLAG_NO_EXTENSIONS (1L << 8) 309 #define X509_FLAG_NO_SIGDUMP (1L << 9) 310 #define X509_FLAG_NO_AUX (1L << 10) 311 #define X509_FLAG_NO_ATTRIBUTES (1L << 11) 312 #define X509_FLAG_NO_IDS (1L << 12) 313 314 // Flags specific to X509_NAME_print_ex() 315 316 // The field separator information 317 318 #define XN_FLAG_SEP_MASK (0xf << 16) 319 320 #define XN_FLAG_COMPAT 0 // Traditional SSLeay: use old X509_NAME_print 321 #define XN_FLAG_SEP_COMMA_PLUS (1 << 16) // RFC2253 ,+ 322 #define XN_FLAG_SEP_CPLUS_SPC (2 << 16) // ,+ spaced: more readable 323 #define XN_FLAG_SEP_SPLUS_SPC (3 << 16) // ;+ spaced 324 #define XN_FLAG_SEP_MULTILINE (4 << 16) // One line per field 325 326 #define XN_FLAG_DN_REV (1 << 20) // Reverse DN order 327 328 // How the field name is shown 329 330 #define XN_FLAG_FN_MASK (0x3 << 21) 331 332 #define XN_FLAG_FN_SN 0 // Object short name 333 #define XN_FLAG_FN_LN (1 << 21) // Object long name 334 #define XN_FLAG_FN_OID (2 << 21) // Always use OIDs 335 #define XN_FLAG_FN_NONE (3 << 21) // No field names 336 337 #define XN_FLAG_SPC_EQ (1 << 23) // Put spaces round '=' 338 339 // This determines if we dump fields we don't recognise: 340 // RFC2253 requires this. 341 342 #define XN_FLAG_DUMP_UNKNOWN_FIELDS (1 << 24) 343 344 #define XN_FLAG_FN_ALIGN (1 << 25) // Align field names to 20 characters 345 346 // Complete set of RFC2253 flags 347 348 #define XN_FLAG_RFC2253 \ 349 (ASN1_STRFLGS_RFC2253 | XN_FLAG_SEP_COMMA_PLUS | XN_FLAG_DN_REV | \ 350 XN_FLAG_FN_SN | XN_FLAG_DUMP_UNKNOWN_FIELDS) 351 352 // readable oneline form 353 354 #define XN_FLAG_ONELINE \ 355 (ASN1_STRFLGS_RFC2253 | ASN1_STRFLGS_ESC_QUOTE | XN_FLAG_SEP_CPLUS_SPC | \ 356 XN_FLAG_SPC_EQ | XN_FLAG_FN_SN) 357 358 // readable multiline form 359 360 #define XN_FLAG_MULTILINE \ 361 (ASN1_STRFLGS_ESC_CTRL | ASN1_STRFLGS_ESC_MSB | XN_FLAG_SEP_MULTILINE | \ 362 XN_FLAG_SPC_EQ | XN_FLAG_FN_LN | XN_FLAG_FN_ALIGN) 363 364 struct x509_revoked_st { 365 ASN1_INTEGER *serialNumber; 366 ASN1_TIME *revocationDate; 367 STACK_OF(X509_EXTENSION) /* optional */ *extensions; 368 // Set up if indirect CRL 369 STACK_OF(GENERAL_NAME) *issuer; 370 // Revocation reason 371 int reason; 372 int sequence; // load sequence 373 }; 374 375 DEFINE_STACK_OF(X509_REVOKED) 376 DECLARE_ASN1_SET_OF(X509_REVOKED) 377 378 struct X509_crl_info_st { 379 ASN1_INTEGER *version; 380 X509_ALGOR *sig_alg; 381 X509_NAME *issuer; 382 ASN1_TIME *lastUpdate; 383 ASN1_TIME *nextUpdate; 384 STACK_OF(X509_REVOKED) *revoked; 385 STACK_OF(X509_EXTENSION) /* [0] */ *extensions; 386 ASN1_ENCODING enc; 387 } /* X509_CRL_INFO */; 388 389 DECLARE_STACK_OF(GENERAL_NAMES) 390 391 struct X509_crl_st { 392 // actual signature 393 X509_CRL_INFO *crl; 394 X509_ALGOR *sig_alg; 395 ASN1_BIT_STRING *signature; 396 CRYPTO_refcount_t references; 397 int flags; 398 // Copies of various extensions 399 AUTHORITY_KEYID *akid; 400 ISSUING_DIST_POINT *idp; 401 // Convenient breakdown of IDP 402 int idp_flags; 403 int idp_reasons; 404 // CRL and base CRL numbers for delta processing 405 ASN1_INTEGER *crl_number; 406 ASN1_INTEGER *base_crl_number; 407 unsigned char sha1_hash[SHA_DIGEST_LENGTH]; 408 STACK_OF(GENERAL_NAMES) *issuers; 409 const X509_CRL_METHOD *meth; 410 void *meth_data; 411 } /* X509_CRL */; 412 413 DEFINE_STACK_OF(X509_CRL) 414 DECLARE_ASN1_SET_OF(X509_CRL) 415 416 struct private_key_st { 417 int version; 418 // The PKCS#8 data types 419 X509_ALGOR *enc_algor; 420 ASN1_OCTET_STRING *enc_pkey; // encrypted pub key 421 422 // When decrypted, the following will not be NULL 423 EVP_PKEY *dec_pkey; 424 425 // used to encrypt and decrypt 426 int key_length; 427 char *key_data; 428 int key_free; // true if we should auto free key_data 429 430 // expanded version of 'enc_algor' 431 EVP_CIPHER_INFO cipher; 432 } /* X509_PKEY */; 433 434 #ifndef OPENSSL_NO_EVP 435 struct X509_info_st { 436 X509 *x509; 437 X509_CRL *crl; 438 X509_PKEY *x_pkey; 439 440 EVP_CIPHER_INFO enc_cipher; 441 int enc_len; 442 char *enc_data; 443 444 } /* X509_INFO */; 445 446 DEFINE_STACK_OF(X509_INFO) 447 #endif 448 449 // The next 2 structures and their 8 routines were sent to me by 450 // Pat Richard <patr@x509.com> and are used to manipulate 451 // Netscapes spki structures - useful if you are writing a CA web page 452 struct Netscape_spkac_st { 453 X509_PUBKEY *pubkey; 454 ASN1_IA5STRING *challenge; // challenge sent in atlas >= PR2 455 } /* NETSCAPE_SPKAC */; 456 457 struct Netscape_spki_st { 458 NETSCAPE_SPKAC *spkac; // signed public key and challenge 459 X509_ALGOR *sig_algor; 460 ASN1_BIT_STRING *signature; 461 } /* NETSCAPE_SPKI */; 462 463 #ifdef __cplusplus 464 } 465 #endif 466 467 #include <openssl/x509_vfy.h> 468 469 #ifdef __cplusplus 470 extern "C" { 471 #endif 472 473 // TODO(davidben): Document remaining functions, reorganize them, and define 474 // supported patterns for using |X509| objects in general. In particular, when 475 // it is safe to call mutating functions is a little tricky due to various 476 // internal caches. 477 478 // X509_get_version returns the numerical value of |x509|'s version. That is, 479 // it returns zero for X.509v1, one for X.509v2, and two for X.509v3. Unknown 480 // versions are rejected by the parser, but a manually-created |X509| object may 481 // encode invalid versions. In that case, the function will return the invalid 482 // version, or -1 on overflow. 483 OPENSSL_EXPORT long X509_get_version(const X509 *x509); 484 485 // X509_get0_serialNumber returns |x509|'s serial number. 486 OPENSSL_EXPORT const ASN1_INTEGER *X509_get0_serialNumber(const X509 *x509); 487 488 // X509_get0_notBefore returns |x509|'s notBefore time. 489 OPENSSL_EXPORT const ASN1_TIME *X509_get0_notBefore(const X509 *x509); 490 491 // X509_get0_notAfter returns |x509|'s notAfter time. 492 OPENSSL_EXPORT const ASN1_TIME *X509_get0_notAfter(const X509 *x509); 493 494 // X509_set1_notBefore sets |x509|'s notBefore time to |tm|. It returns one on 495 // success and zero on error. 496 OPENSSL_EXPORT int X509_set1_notBefore(X509 *x509, const ASN1_TIME *tm); 497 498 // X509_set1_notAfter sets |x509|'s notAfter time to |tm|. it returns one on 499 // success and zero on error. 500 OPENSSL_EXPORT int X509_set1_notAfter(X509 *x509, const ASN1_TIME *tm); 501 502 // X509_getm_notBefore returns a mutable pointer to |x509|'s notBefore time. 503 OPENSSL_EXPORT ASN1_TIME *X509_getm_notBefore(X509 *x509); 504 505 // X509_getm_notAfter returns a mutable pointer to |x509|'s notAfter time. 506 OPENSSL_EXPORT ASN1_TIME *X509_getm_notAfter(X509 *x); 507 508 // X509_get_notBefore returns |x509|'s notBefore time. Note this function is not 509 // const-correct for legacy reasons. Use |X509_get0_notBefore| or 510 // |X509_getm_notBefore| instead. 511 OPENSSL_EXPORT ASN1_TIME *X509_get_notBefore(const X509 *x509); 512 513 // X509_get_notAfter returns |x509|'s notAfter time. Note this function is not 514 // const-correct for legacy reasons. Use |X509_get0_notAfter| or 515 // |X509_getm_notAfter| instead. 516 OPENSSL_EXPORT ASN1_TIME *X509_get_notAfter(const X509 *x509); 517 518 // X509_set_notBefore calls |X509_set1_notBefore|. Use |X509_set1_notBefore| 519 // instead. 520 OPENSSL_EXPORT int X509_set_notBefore(X509 *x509, const ASN1_TIME *tm); 521 522 // X509_set_notAfter calls |X509_set1_notAfter|. Use |X509_set1_notAfter| 523 // instead. 524 OPENSSL_EXPORT int X509_set_notAfter(X509 *x509, const ASN1_TIME *tm); 525 526 // X509_get0_uids sets |*out_issuer_uid| and |*out_subject_uid| to non-owning 527 // pointers to the issuerUID and subjectUID fields, respectively, of |x509|. 528 // Either output pointer may be NULL to skip the field. 529 OPENSSL_EXPORT void X509_get0_uids(const X509 *x509, 530 const ASN1_BIT_STRING **out_issuer_uid, 531 const ASN1_BIT_STRING **out_subject_uid); 532 533 // X509_get_cert_info returns |x509|'s TBSCertificate structure. Note this 534 // function is not const-correct for legacy reasons. 535 // 536 // This function is deprecated and may be removed in the future. It is not 537 // present in OpenSSL and constrains some improvements to the library. 538 OPENSSL_EXPORT X509_CINF *X509_get_cert_info(const X509 *x509); 539 540 // X509_extract_key is a legacy alias to |X509_get_pubkey|. Use 541 // |X509_get_pubkey| instead. 542 #define X509_extract_key(x) X509_get_pubkey(x) 543 544 // X509_get_pathlen returns path length constraint from the basic constraints 545 // extension in |x509|. (See RFC5280, section 4.2.1.9.) It returns -1 if the 546 // constraint is not present, or if some extension in |x509| was invalid. 547 // 548 // Note that decoding an |X509| object will not check for invalid extensions. To 549 // detect the error case, call |X509_get_extensions_flags| and check the 550 // |EXFLAG_INVALID| bit. 551 OPENSSL_EXPORT long X509_get_pathlen(X509 *x509); 552 553 // X509_REQ_get_version returns the numerical value of |req|'s version. That is, 554 // it returns zero for a v1 request. If |req| is invalid, it may return another 555 // value, or -1 on overflow. 556 OPENSSL_EXPORT long X509_REQ_get_version(const X509_REQ *req); 557 558 // X509_REQ_get_subject_name returns |req|'s subject name. Note this function is 559 // not const-correct for legacy reasons. 560 OPENSSL_EXPORT X509_NAME *X509_REQ_get_subject_name(const X509_REQ *req); 561 562 // X509_REQ_extract_key is a legacy alias for |X509_REQ_get_pubkey|. 563 #define X509_REQ_extract_key(a) X509_REQ_get_pubkey(a) 564 565 // X509_name_cmp is a legacy alias for |X509_NAME_cmp|. 566 #define X509_name_cmp(a, b) X509_NAME_cmp((a), (b)) 567 568 // X509_REQ_get_version returns the numerical value of |crl|'s version. That is, 569 // it returns zero for a v1 CRL and one for a v2 CRL. If |crl| is invalid, it 570 // may return another value, or -1 on overflow. 571 OPENSSL_EXPORT long X509_CRL_get_version(const X509_CRL *crl); 572 573 // X509_CRL_get0_lastUpdate returns |crl|'s lastUpdate time. 574 OPENSSL_EXPORT const ASN1_TIME *X509_CRL_get0_lastUpdate(const X509_CRL *crl); 575 576 // X509_CRL_get0_nextUpdate returns |crl|'s nextUpdate time, or NULL if |crl| 577 // has none. 578 OPENSSL_EXPORT const ASN1_TIME *X509_CRL_get0_nextUpdate(const X509_CRL *crl); 579 580 // X509_CRL_set1_lastUpdate sets |crl|'s lastUpdate time to |tm|. It returns one 581 // on success and zero on error. 582 OPENSSL_EXPORT int X509_CRL_set1_lastUpdate(X509_CRL *crl, const ASN1_TIME *tm); 583 584 // X509_CRL_set1_nextUpdate sets |crl|'s nextUpdate time to |tm|. It returns one 585 // on success and zero on error. 586 OPENSSL_EXPORT int X509_CRL_set1_nextUpdate(X509_CRL *crl, const ASN1_TIME *tm); 587 588 // The following symbols are deprecated aliases to |X509_CRL_set1_*|. 589 #define X509_CRL_set_lastUpdate X509_CRL_set1_lastUpdate 590 #define X509_CRL_set_nextUpdate X509_CRL_set1_nextUpdate 591 592 // X509_CRL_get_lastUpdate returns a mutable pointer to |crl|'s lastUpdate time. 593 // Use |X509_CRL_get0_lastUpdate| or |X509_CRL_set1_lastUpdate| instead. 594 OPENSSL_EXPORT ASN1_TIME *X509_CRL_get_lastUpdate(X509_CRL *crl); 595 596 // X509_CRL_get_nextUpdate returns a mutable pointer to |crl|'s nextUpdate time, 597 // or NULL if |crl| has none. Use |X509_CRL_get0_nextUpdate| or 598 // |X509_CRL_set1_nextUpdate| instead. 599 OPENSSL_EXPORT ASN1_TIME *X509_CRL_get_nextUpdate(X509_CRL *crl); 600 601 // X509_CRL_get_issuer returns |crl|'s issuer name. Note this function is not 602 // const-correct for legacy reasons. 603 OPENSSL_EXPORT X509_NAME *X509_CRL_get_issuer(const X509_CRL *crl); 604 605 // X509_CRL_get_REVOKED returns the list of revoked certificates in |crl|. 606 // 607 // TOOD(davidben): This function was originally a macro, without clear const 608 // semantics. It should take a const input and give const output, but the latter 609 // would break existing callers. For now, we match upstream. 610 OPENSSL_EXPORT STACK_OF(X509_REVOKED) *X509_CRL_get_REVOKED(X509_CRL *crl); 611 612 // X509_CRL_get0_extensions returns |crl|'s extension list. 613 OPENSSL_EXPORT const STACK_OF(X509_EXTENSION) *X509_CRL_get0_extensions( 614 const X509_CRL *crl); 615 616 // X509_CINF_set_modified marks |cinf| as modified so that changes will be 617 // reflected in serializing the structure. 618 // 619 // This function is deprecated and may be removed in the future. It is not 620 // present in OpenSSL and constrains some improvements to the library. 621 OPENSSL_EXPORT void X509_CINF_set_modified(X509_CINF *cinf); 622 623 // X509_CINF_get_signature returns the signature algorithm in |cinf|. Note this 624 // isn't the signature itself, but the extra copy of the signature algorithm 625 // in the TBSCertificate. 626 // 627 // This function is deprecated and may be removed in the future. It is not 628 // present in OpenSSL and constrains some improvements to the library. Use 629 // |X509_get0_tbs_sigalg| instead. 630 OPENSSL_EXPORT const X509_ALGOR *X509_CINF_get_signature(const X509_CINF *cinf); 631 632 // X509_SIG_get0 sets |*out_alg| and |*out_digest| to non-owning pointers to 633 // |sig|'s algorithm and digest fields, respectively. Either |out_alg| and 634 // |out_digest| may be NULL to skip those fields. 635 OPENSSL_EXPORT void X509_SIG_get0(const X509_SIG *sig, 636 const X509_ALGOR **out_alg, 637 const ASN1_OCTET_STRING **out_digest); 638 639 // X509_SIG_getm behaves like |X509_SIG_get0| but returns mutable pointers. 640 OPENSSL_EXPORT void X509_SIG_getm(X509_SIG *sig, X509_ALGOR **out_alg, 641 ASN1_OCTET_STRING **out_digest); 642 643 OPENSSL_EXPORT void X509_CRL_set_default_method(const X509_CRL_METHOD *meth); 644 OPENSSL_EXPORT X509_CRL_METHOD *X509_CRL_METHOD_new( 645 int (*crl_init)(X509_CRL *crl), int (*crl_free)(X509_CRL *crl), 646 int (*crl_lookup)(X509_CRL *crl, X509_REVOKED **ret, ASN1_INTEGER *ser, 647 X509_NAME *issuer), 648 int (*crl_verify)(X509_CRL *crl, EVP_PKEY *pk)); 649 OPENSSL_EXPORT void X509_CRL_METHOD_free(X509_CRL_METHOD *m); 650 651 OPENSSL_EXPORT void X509_CRL_set_meth_data(X509_CRL *crl, void *dat); 652 OPENSSL_EXPORT void *X509_CRL_get_meth_data(X509_CRL *crl); 653 654 // X509_get_X509_PUBKEY returns the public key of |x509|. Note this function is 655 // not const-correct for legacy reasons. Callers should not modify the returned 656 // object. 657 OPENSSL_EXPORT X509_PUBKEY *X509_get_X509_PUBKEY(const X509 *x509); 658 659 // X509_verify_cert_error_string returns |err| as a human-readable string, where 660 // |err| should be one of the |X509_V_*| values. If |err| is unknown, it returns 661 // a default description. 662 // 663 // TODO(davidben): Move this function to x509_vfy.h, with the |X509_V_*| 664 // definitions, or fold x509_vfy.h into this function. 665 OPENSSL_EXPORT const char *X509_verify_cert_error_string(long err); 666 667 // X509_verify checks that |x509| has a valid signature by |pkey|. It returns 668 // one if the signature is valid and zero otherwise. Note this function only 669 // checks the signature itself and does not perform a full certificate 670 // validation. 671 OPENSSL_EXPORT int X509_verify(X509 *x509, EVP_PKEY *pkey); 672 673 // X509_REQ_verify checks that |req| has a valid signature by |pkey|. It returns 674 // one if the signature is valid and zero otherwise. 675 OPENSSL_EXPORT int X509_REQ_verify(X509_REQ *req, EVP_PKEY *pkey); 676 677 // X509_CRL_verify checks that |crl| has a valid signature by |pkey|. It returns 678 // one if the signature is valid and zero otherwise. 679 OPENSSL_EXPORT int X509_CRL_verify(X509_CRL *crl, EVP_PKEY *pkey); 680 681 // NETSCAPE_SPKI_verify checks that |spki| has a valid signature by |pkey|. It 682 // returns one if the signature is valid and zero otherwise. 683 OPENSSL_EXPORT int NETSCAPE_SPKI_verify(NETSCAPE_SPKI *spki, EVP_PKEY *pkey); 684 685 // NETSCAPE_SPKI_b64_decode decodes |len| bytes from |str| as a base64-encoded 686 // Netscape signed public key and challenge (SPKAC) structure. It returns a 687 // newly-allocated |NETSCAPE_SPKI| structure with the result, or NULL on error. 688 // If |len| is 0 or negative, the length is calculated with |strlen| and |str| 689 // must be a NUL-terminated C string. 690 OPENSSL_EXPORT NETSCAPE_SPKI *NETSCAPE_SPKI_b64_decode(const char *str, 691 int len); 692 693 // NETSCAPE_SPKI_b64_encode encodes |spki| as a base64-encoded Netscape signed 694 // public key and challenge (SPKAC) structure. It returns a newly-allocated 695 // NUL-terminated C string with the result, or NULL on error. The caller must 696 // release the memory with |OPENSSL_free| when done. 697 OPENSSL_EXPORT char *NETSCAPE_SPKI_b64_encode(NETSCAPE_SPKI *spki); 698 699 // NETSCAPE_SPKI_get_pubkey decodes and returns the public key in |spki| as an 700 // |EVP_PKEY|, or NULL on error. The caller takes ownership of the resulting 701 // pointer and must call |EVP_PKEY_free| when done. 702 OPENSSL_EXPORT EVP_PKEY *NETSCAPE_SPKI_get_pubkey(NETSCAPE_SPKI *spki); 703 704 // NETSCAPE_SPKI_set_pubkey sets |spki|'s public key to |pkey|. It returns one 705 // on success or zero on error. This function does not take ownership of |pkey|, 706 // so the caller may continue to manage its lifetime independently of |spki|. 707 OPENSSL_EXPORT int NETSCAPE_SPKI_set_pubkey(NETSCAPE_SPKI *spki, 708 EVP_PKEY *pkey); 709 710 // X509_signature_dump writes a human-readable representation of |sig| to |bio|, 711 // indented with |indent| spaces. It returns one on success and zero on error. 712 OPENSSL_EXPORT int X509_signature_dump(BIO *bio, const ASN1_STRING *sig, 713 int indent); 714 715 // X509_signature_print writes a human-readable representation of |alg| and 716 // |sig| to |bio|. It returns one on success and zero on error. 717 OPENSSL_EXPORT int X509_signature_print(BIO *bio, const X509_ALGOR *alg, 718 const ASN1_STRING *sig); 719 720 // X509_sign signs |x509| with |pkey| and replaces the signature algorithm and 721 // signature fields. It returns one on success and zero on error. This function 722 // uses digest algorithm |md|, or |pkey|'s default if NULL. Other signing 723 // parameters use |pkey|'s defaults. To customize them, use |X509_sign_ctx|. 724 OPENSSL_EXPORT int X509_sign(X509 *x509, EVP_PKEY *pkey, const EVP_MD *md); 725 726 // X509_sign_ctx signs |x509| with |ctx| and replaces the signature algorithm 727 // and signature fields. It returns one on success and zero on error. The 728 // signature algorithm and parameters come from |ctx|, which must have been 729 // initialized with |EVP_DigestSignInit|. The caller should configure the 730 // corresponding |EVP_PKEY_CTX| before calling this function. 731 OPENSSL_EXPORT int X509_sign_ctx(X509 *x509, EVP_MD_CTX *ctx); 732 733 // X509_REQ_sign signs |req| with |pkey| and replaces the signature algorithm 734 // and signature fields. It returns one on success and zero on error. This 735 // function uses digest algorithm |md|, or |pkey|'s default if NULL. Other 736 // signing parameters use |pkey|'s defaults. To customize them, use 737 // |X509_REQ_sign_ctx|. 738 OPENSSL_EXPORT int X509_REQ_sign(X509_REQ *req, EVP_PKEY *pkey, 739 const EVP_MD *md); 740 741 // X509_REQ_sign_ctx signs |req| with |ctx| and replaces the signature algorithm 742 // and signature fields. It returns one on success and zero on error. The 743 // signature algorithm and parameters come from |ctx|, which must have been 744 // initialized with |EVP_DigestSignInit|. The caller should configure the 745 // corresponding |EVP_PKEY_CTX| before calling this function. 746 OPENSSL_EXPORT int X509_REQ_sign_ctx(X509_REQ *req, EVP_MD_CTX *ctx); 747 748 // X509_CRL_sign signs |crl| with |pkey| and replaces the signature algorithm 749 // and signature fields. It returns one on success and zero on error. This 750 // function uses digest algorithm |md|, or |pkey|'s default if NULL. Other 751 // signing parameters use |pkey|'s defaults. To customize them, use 752 // |X509_CRL_sign_ctx|. 753 OPENSSL_EXPORT int X509_CRL_sign(X509_CRL *crl, EVP_PKEY *pkey, 754 const EVP_MD *md); 755 756 // X509_CRL_sign_ctx signs |crl| with |ctx| and replaces the signature algorithm 757 // and signature fields. It returns one on success and zero on error. The 758 // signature algorithm and parameters come from |ctx|, which must have been 759 // initialized with |EVP_DigestSignInit|. The caller should configure the 760 // corresponding |EVP_PKEY_CTX| before calling this function. 761 OPENSSL_EXPORT int X509_CRL_sign_ctx(X509_CRL *crl, EVP_MD_CTX *ctx); 762 763 // NETSCAPE_SPKI_sign signs |spki| with |pkey| and replaces the signature 764 // algorithm and signature fields. It returns one on success and zero on error. 765 // This function uses digest algorithm |md|, or |pkey|'s default if NULL. Other 766 // signing parameters use |pkey|'s defaults. 767 OPENSSL_EXPORT int NETSCAPE_SPKI_sign(NETSCAPE_SPKI *spki, EVP_PKEY *pkey, 768 const EVP_MD *md); 769 770 // X509_pubkey_digest hashes the DER encoding of |x509|'s subjectPublicKeyInfo 771 // field with |md| and writes the result to |out|. |EVP_MD_CTX_size| bytes are 772 // written, which is at most |EVP_MAX_MD_SIZE|. If |out_len| is not NULL, 773 // |*out_len| is set to the number of bytes written. This function returns one 774 // on success and zero on error. 775 OPENSSL_EXPORT int X509_pubkey_digest(const X509 *x509, const EVP_MD *md, 776 uint8_t *out, unsigned *out_len); 777 778 // X509_digest hashes |x509|'s DER encoding with |md| and writes the result to 779 // |out|. |EVP_MD_CTX_size| bytes are written, which is at most 780 // |EVP_MAX_MD_SIZE|. If |out_len| is not NULL, |*out_len| is set to the number 781 // of bytes written. This function returns one on success and zero on error. 782 // Note this digest covers the entire certificate, not just the signed portion. 783 OPENSSL_EXPORT int X509_digest(const X509 *x509, const EVP_MD *md, uint8_t *out, 784 unsigned *out_len); 785 786 // X509_CRL_digest hashes |crl|'s DER encoding with |md| and writes the result 787 // to |out|. |EVP_MD_CTX_size| bytes are written, which is at most 788 // |EVP_MAX_MD_SIZE|. If |out_len| is not NULL, |*out_len| is set to the number 789 // of bytes written. This function returns one on success and zero on error. 790 // Note this digest covers the entire CRL, not just the signed portion. 791 OPENSSL_EXPORT int X509_CRL_digest(const X509_CRL *crl, const EVP_MD *md, 792 uint8_t *out, unsigned *out_len); 793 794 // X509_REQ_digest hashes |req|'s DER encoding with |md| and writes the result 795 // to |out|. |EVP_MD_CTX_size| bytes are written, which is at most 796 // |EVP_MAX_MD_SIZE|. If |out_len| is not NULL, |*out_len| is set to the number 797 // of bytes written. This function returns one on success and zero on error. 798 // Note this digest covers the entire certificate request, not just the signed 799 // portion. 800 OPENSSL_EXPORT int X509_REQ_digest(const X509_REQ *req, const EVP_MD *md, 801 uint8_t *out, unsigned *out_len); 802 803 // X509_NAME_digest hashes |name|'s DER encoding with |md| and writes the result 804 // to |out|. |EVP_MD_CTX_size| bytes are written, which is at most 805 // |EVP_MAX_MD_SIZE|. If |out_len| is not NULL, |*out_len| is set to the number 806 // of bytes written. This function returns one on success and zero on error. 807 OPENSSL_EXPORT int X509_NAME_digest(const X509_NAME *name, const EVP_MD *md, 808 uint8_t *out, unsigned *out_len); 809 810 // X509_parse_from_buffer parses an X.509 structure from |buf| and returns a 811 // fresh X509 or NULL on error. There must not be any trailing data in |buf|. 812 // The returned structure (if any) holds a reference to |buf| rather than 813 // copying parts of it as a normal |d2i_X509| call would do. 814 OPENSSL_EXPORT X509 *X509_parse_from_buffer(CRYPTO_BUFFER *buf); 815 816 #ifndef OPENSSL_NO_FP_API 817 OPENSSL_EXPORT X509 *d2i_X509_fp(FILE *fp, X509 **x509); 818 OPENSSL_EXPORT int i2d_X509_fp(FILE *fp, X509 *x509); 819 OPENSSL_EXPORT X509_CRL *d2i_X509_CRL_fp(FILE *fp, X509_CRL **crl); 820 OPENSSL_EXPORT int i2d_X509_CRL_fp(FILE *fp, X509_CRL *crl); 821 OPENSSL_EXPORT X509_REQ *d2i_X509_REQ_fp(FILE *fp, X509_REQ **req); 822 OPENSSL_EXPORT int i2d_X509_REQ_fp(FILE *fp, X509_REQ *req); 823 OPENSSL_EXPORT RSA *d2i_RSAPrivateKey_fp(FILE *fp, RSA **rsa); 824 OPENSSL_EXPORT int i2d_RSAPrivateKey_fp(FILE *fp, RSA *rsa); 825 OPENSSL_EXPORT RSA *d2i_RSAPublicKey_fp(FILE *fp, RSA **rsa); 826 OPENSSL_EXPORT int i2d_RSAPublicKey_fp(FILE *fp, RSA *rsa); 827 OPENSSL_EXPORT RSA *d2i_RSA_PUBKEY_fp(FILE *fp, RSA **rsa); 828 OPENSSL_EXPORT int i2d_RSA_PUBKEY_fp(FILE *fp, RSA *rsa); 829 #ifndef OPENSSL_NO_DSA 830 OPENSSL_EXPORT DSA *d2i_DSA_PUBKEY_fp(FILE *fp, DSA **dsa); 831 OPENSSL_EXPORT int i2d_DSA_PUBKEY_fp(FILE *fp, DSA *dsa); 832 OPENSSL_EXPORT DSA *d2i_DSAPrivateKey_fp(FILE *fp, DSA **dsa); 833 OPENSSL_EXPORT int i2d_DSAPrivateKey_fp(FILE *fp, DSA *dsa); 834 #endif 835 OPENSSL_EXPORT EC_KEY *d2i_EC_PUBKEY_fp(FILE *fp, EC_KEY **eckey); 836 OPENSSL_EXPORT int i2d_EC_PUBKEY_fp(FILE *fp, EC_KEY *eckey); 837 OPENSSL_EXPORT EC_KEY *d2i_ECPrivateKey_fp(FILE *fp, EC_KEY **eckey); 838 OPENSSL_EXPORT int i2d_ECPrivateKey_fp(FILE *fp, EC_KEY *eckey); 839 OPENSSL_EXPORT X509_SIG *d2i_PKCS8_fp(FILE *fp, X509_SIG **p8); 840 OPENSSL_EXPORT int i2d_PKCS8_fp(FILE *fp, X509_SIG *p8); 841 OPENSSL_EXPORT PKCS8_PRIV_KEY_INFO *d2i_PKCS8_PRIV_KEY_INFO_fp( 842 FILE *fp, PKCS8_PRIV_KEY_INFO **p8inf); 843 OPENSSL_EXPORT int i2d_PKCS8_PRIV_KEY_INFO_fp(FILE *fp, 844 PKCS8_PRIV_KEY_INFO *p8inf); 845 OPENSSL_EXPORT int i2d_PKCS8PrivateKeyInfo_fp(FILE *fp, EVP_PKEY *key); 846 OPENSSL_EXPORT int i2d_PrivateKey_fp(FILE *fp, EVP_PKEY *pkey); 847 OPENSSL_EXPORT EVP_PKEY *d2i_PrivateKey_fp(FILE *fp, EVP_PKEY **a); 848 OPENSSL_EXPORT int i2d_PUBKEY_fp(FILE *fp, EVP_PKEY *pkey); 849 OPENSSL_EXPORT EVP_PKEY *d2i_PUBKEY_fp(FILE *fp, EVP_PKEY **a); 850 #endif 851 852 OPENSSL_EXPORT X509 *d2i_X509_bio(BIO *bp, X509 **x509); 853 OPENSSL_EXPORT int i2d_X509_bio(BIO *bp, X509 *x509); 854 OPENSSL_EXPORT X509_CRL *d2i_X509_CRL_bio(BIO *bp, X509_CRL **crl); 855 OPENSSL_EXPORT int i2d_X509_CRL_bio(BIO *bp, X509_CRL *crl); 856 OPENSSL_EXPORT X509_REQ *d2i_X509_REQ_bio(BIO *bp, X509_REQ **req); 857 OPENSSL_EXPORT int i2d_X509_REQ_bio(BIO *bp, X509_REQ *req); 858 OPENSSL_EXPORT RSA *d2i_RSAPrivateKey_bio(BIO *bp, RSA **rsa); 859 OPENSSL_EXPORT int i2d_RSAPrivateKey_bio(BIO *bp, RSA *rsa); 860 OPENSSL_EXPORT RSA *d2i_RSAPublicKey_bio(BIO *bp, RSA **rsa); 861 OPENSSL_EXPORT int i2d_RSAPublicKey_bio(BIO *bp, RSA *rsa); 862 OPENSSL_EXPORT RSA *d2i_RSA_PUBKEY_bio(BIO *bp, RSA **rsa); 863 OPENSSL_EXPORT int i2d_RSA_PUBKEY_bio(BIO *bp, RSA *rsa); 864 #ifndef OPENSSL_NO_DSA 865 OPENSSL_EXPORT DSA *d2i_DSA_PUBKEY_bio(BIO *bp, DSA **dsa); 866 OPENSSL_EXPORT int i2d_DSA_PUBKEY_bio(BIO *bp, DSA *dsa); 867 OPENSSL_EXPORT DSA *d2i_DSAPrivateKey_bio(BIO *bp, DSA **dsa); 868 OPENSSL_EXPORT int i2d_DSAPrivateKey_bio(BIO *bp, DSA *dsa); 869 #endif 870 OPENSSL_EXPORT EC_KEY *d2i_EC_PUBKEY_bio(BIO *bp, EC_KEY **eckey); 871 OPENSSL_EXPORT int i2d_EC_PUBKEY_bio(BIO *bp, EC_KEY *eckey); 872 OPENSSL_EXPORT EC_KEY *d2i_ECPrivateKey_bio(BIO *bp, EC_KEY **eckey); 873 OPENSSL_EXPORT int i2d_ECPrivateKey_bio(BIO *bp, EC_KEY *eckey); 874 OPENSSL_EXPORT X509_SIG *d2i_PKCS8_bio(BIO *bp, X509_SIG **p8); 875 OPENSSL_EXPORT int i2d_PKCS8_bio(BIO *bp, X509_SIG *p8); 876 OPENSSL_EXPORT PKCS8_PRIV_KEY_INFO *d2i_PKCS8_PRIV_KEY_INFO_bio( 877 BIO *bp, PKCS8_PRIV_KEY_INFO **p8inf); 878 OPENSSL_EXPORT int i2d_PKCS8_PRIV_KEY_INFO_bio(BIO *bp, 879 PKCS8_PRIV_KEY_INFO *p8inf); 880 OPENSSL_EXPORT int i2d_PKCS8PrivateKeyInfo_bio(BIO *bp, EVP_PKEY *key); 881 OPENSSL_EXPORT int i2d_PrivateKey_bio(BIO *bp, EVP_PKEY *pkey); 882 OPENSSL_EXPORT EVP_PKEY *d2i_PrivateKey_bio(BIO *bp, EVP_PKEY **a); 883 OPENSSL_EXPORT int i2d_PUBKEY_bio(BIO *bp, EVP_PKEY *pkey); 884 OPENSSL_EXPORT EVP_PKEY *d2i_PUBKEY_bio(BIO *bp, EVP_PKEY **a); 885 OPENSSL_EXPORT DH *d2i_DHparams_bio(BIO *bp, DH **dh); 886 OPENSSL_EXPORT int i2d_DHparams_bio(BIO *bp, const DH *dh); 887 888 OPENSSL_EXPORT X509 *X509_dup(X509 *x509); 889 OPENSSL_EXPORT X509_ATTRIBUTE *X509_ATTRIBUTE_dup(X509_ATTRIBUTE *xa); 890 OPENSSL_EXPORT X509_EXTENSION *X509_EXTENSION_dup(X509_EXTENSION *ex); 891 OPENSSL_EXPORT X509_CRL *X509_CRL_dup(X509_CRL *crl); 892 OPENSSL_EXPORT X509_REVOKED *X509_REVOKED_dup(X509_REVOKED *rev); 893 OPENSSL_EXPORT X509_REQ *X509_REQ_dup(X509_REQ *req); 894 OPENSSL_EXPORT X509_ALGOR *X509_ALGOR_dup(X509_ALGOR *xn); 895 OPENSSL_EXPORT int X509_ALGOR_set0(X509_ALGOR *alg, const ASN1_OBJECT *aobj, 896 int ptype, void *pval); 897 OPENSSL_EXPORT void X509_ALGOR_get0(const ASN1_OBJECT **paobj, int *pptype, 898 const void **ppval, 899 const X509_ALGOR *algor); 900 OPENSSL_EXPORT void X509_ALGOR_set_md(X509_ALGOR *alg, const EVP_MD *md); 901 OPENSSL_EXPORT int X509_ALGOR_cmp(const X509_ALGOR *a, const X509_ALGOR *b); 902 903 OPENSSL_EXPORT X509_NAME *X509_NAME_dup(X509_NAME *xn); 904 OPENSSL_EXPORT X509_NAME_ENTRY *X509_NAME_ENTRY_dup(X509_NAME_ENTRY *ne); 905 OPENSSL_EXPORT int X509_NAME_ENTRY_set(const X509_NAME_ENTRY *ne); 906 907 OPENSSL_EXPORT int X509_NAME_get0_der(X509_NAME *nm, const unsigned char **pder, 908 size_t *pderlen); 909 910 OPENSSL_EXPORT int X509_cmp_time(const ASN1_TIME *s, time_t *t); 911 OPENSSL_EXPORT int X509_cmp_current_time(const ASN1_TIME *s); 912 OPENSSL_EXPORT ASN1_TIME *X509_time_adj(ASN1_TIME *s, long adj, time_t *t); 913 OPENSSL_EXPORT ASN1_TIME *X509_time_adj_ex(ASN1_TIME *s, int offset_day, 914 long offset_sec, time_t *t); 915 OPENSSL_EXPORT ASN1_TIME *X509_gmtime_adj(ASN1_TIME *s, long adj); 916 917 OPENSSL_EXPORT const char *X509_get_default_cert_area(void); 918 OPENSSL_EXPORT const char *X509_get_default_cert_dir(void); 919 OPENSSL_EXPORT const char *X509_get_default_cert_file(void); 920 OPENSSL_EXPORT const char *X509_get_default_cert_dir_env(void); 921 OPENSSL_EXPORT const char *X509_get_default_cert_file_env(void); 922 OPENSSL_EXPORT const char *X509_get_default_private_dir(void); 923 924 OPENSSL_EXPORT X509_REQ *X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey, 925 const EVP_MD *md); 926 OPENSSL_EXPORT X509 *X509_REQ_to_X509(X509_REQ *r, int days, EVP_PKEY *pkey); 927 928 DECLARE_ASN1_ENCODE_FUNCTIONS(X509_ALGORS, X509_ALGORS, X509_ALGORS) 929 DECLARE_ASN1_FUNCTIONS(X509_VAL) 930 931 DECLARE_ASN1_FUNCTIONS(X509_PUBKEY) 932 933 OPENSSL_EXPORT int X509_PUBKEY_set(X509_PUBKEY **x, EVP_PKEY *pkey); 934 OPENSSL_EXPORT EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key); 935 936 DECLARE_ASN1_FUNCTIONS(X509_SIG) 937 DECLARE_ASN1_FUNCTIONS(X509_REQ_INFO) 938 DECLARE_ASN1_FUNCTIONS(X509_REQ) 939 940 DECLARE_ASN1_FUNCTIONS(X509_ATTRIBUTE) 941 OPENSSL_EXPORT X509_ATTRIBUTE *X509_ATTRIBUTE_create(int nid, int atrtype, 942 void *value); 943 944 DECLARE_ASN1_FUNCTIONS(X509_EXTENSION) 945 DECLARE_ASN1_ENCODE_FUNCTIONS(X509_EXTENSIONS, X509_EXTENSIONS, X509_EXTENSIONS) 946 947 DECLARE_ASN1_FUNCTIONS(X509_NAME_ENTRY) 948 949 DECLARE_ASN1_FUNCTIONS(X509_NAME) 950 951 OPENSSL_EXPORT int X509_NAME_set(X509_NAME **xn, X509_NAME *name); 952 953 DECLARE_ASN1_FUNCTIONS(X509_CINF) 954 955 DECLARE_ASN1_FUNCTIONS(X509) 956 DECLARE_ASN1_FUNCTIONS(X509_CERT_AUX) 957 958 // X509_up_ref adds one to the reference count of |x| and returns one. 959 OPENSSL_EXPORT int X509_up_ref(X509 *x); 960 961 OPENSSL_EXPORT int X509_get_ex_new_index(long argl, void *argp, 962 CRYPTO_EX_unused *unused, 963 CRYPTO_EX_dup *dup_unused, 964 CRYPTO_EX_free *free_func); 965 OPENSSL_EXPORT int X509_set_ex_data(X509 *r, int idx, void *arg); 966 OPENSSL_EXPORT void *X509_get_ex_data(X509 *r, int idx); 967 OPENSSL_EXPORT int i2d_X509_AUX(X509 *a, unsigned char **pp); 968 OPENSSL_EXPORT X509 *d2i_X509_AUX(X509 **a, const unsigned char **pp, 969 long length); 970 971 // i2d_re_X509_tbs serializes the TBSCertificate portion of |x509|. If |outp| is 972 // NULL, nothing is written. Otherwise, if |*outp| is not NULL, the result is 973 // written to |*outp|, which must have enough space available, and |*outp| is 974 // advanced just past the output. If |outp| is non-NULL and |*outp| is NULL, it 975 // sets |*outp| to a newly-allocated buffer containing the result. The caller is 976 // responsible for releasing the buffer with |OPENSSL_free|. In all cases, this 977 // function returns the number of bytes in the result, whether written or not, 978 // or a negative value on error. 979 // 980 // This function re-encodes the TBSCertificate and may not reflect |x509|'s 981 // original encoding. It may be used to manually generate a signature for a new 982 // certificate. To verify certificates, use |i2d_X509_tbs| instead. 983 OPENSSL_EXPORT int i2d_re_X509_tbs(X509 *x509, unsigned char **outp); 984 985 // i2d_X509_tbs serializes the TBSCertificate portion of |x509|. If |outp| is 986 // NULL, nothing is written. Otherwise, if |*outp| is not NULL, the result is 987 // written to |*outp|, which must have enough space available, and |*outp| is 988 // advanced just past the output. If |outp| is non-NULL and |*outp| is NULL, it 989 // sets |*outp| to a newly-allocated buffer containing the result. The caller is 990 // responsible for releasing the buffer with |OPENSSL_free|. In all cases, this 991 // function returns the number of bytes in the result, whether written or not, 992 // or a negative value on error. 993 // 994 // This function preserves the original encoding of the TBSCertificate and may 995 // not reflect modifications made to |x509|. It may be used to manually verify 996 // the signature of an existing certificate. To generate certificates, use 997 // |i2d_re_X509_tbs| instead. 998 OPENSSL_EXPORT int i2d_X509_tbs(X509 *x509, unsigned char **outp); 999 1000 // X509_set1_signature_algo sets |x509|'s signature algorithm to |algo| and 1001 // returns one on success or zero on error. It updates both the signature field 1002 // of the TBSCertificate structure, and the signatureAlgorithm field of the 1003 // Certificate. 1004 OPENSSL_EXPORT int X509_set1_signature_algo(X509 *x509, const X509_ALGOR *algo); 1005 1006 // X509_set1_signature_value sets |x509|'s signature to a copy of the |sig_len| 1007 // bytes pointed by |sig|. It returns one on success and zero on error. 1008 // 1009 // Due to a specification error, X.509 certificates store signatures in ASN.1 1010 // BIT STRINGs, but signature algorithms return byte strings rather than bit 1011 // strings. This function creates a BIT STRING containing a whole number of 1012 // bytes, with the bit order matching the DER encoding. This matches the 1013 // encoding used by all X.509 signature algorithms. 1014 OPENSSL_EXPORT int X509_set1_signature_value(X509 *x509, const uint8_t *sig, 1015 size_t sig_len); 1016 1017 OPENSSL_EXPORT void X509_get0_signature(const ASN1_BIT_STRING **psig, 1018 const X509_ALGOR **palg, const X509 *x); 1019 OPENSSL_EXPORT int X509_get_signature_nid(const X509 *x); 1020 1021 OPENSSL_EXPORT int X509_alias_set1(X509 *x, const unsigned char *name, int len); 1022 OPENSSL_EXPORT int X509_keyid_set1(X509 *x, const unsigned char *id, int len); 1023 OPENSSL_EXPORT unsigned char *X509_alias_get0(X509 *x, int *len); 1024 OPENSSL_EXPORT unsigned char *X509_keyid_get0(X509 *x, int *len); 1025 OPENSSL_EXPORT int (*X509_TRUST_set_default(int (*trust)(int, X509 *, 1026 int)))(int, X509 *, 1027 int); 1028 OPENSSL_EXPORT int X509_TRUST_set(int *t, int trust); 1029 OPENSSL_EXPORT int X509_add1_trust_object(X509 *x, ASN1_OBJECT *obj); 1030 OPENSSL_EXPORT int X509_add1_reject_object(X509 *x, ASN1_OBJECT *obj); 1031 OPENSSL_EXPORT void X509_trust_clear(X509 *x); 1032 OPENSSL_EXPORT void X509_reject_clear(X509 *x); 1033 1034 DECLARE_ASN1_FUNCTIONS(X509_REVOKED) 1035 DECLARE_ASN1_FUNCTIONS(X509_CRL_INFO) 1036 DECLARE_ASN1_FUNCTIONS(X509_CRL) 1037 1038 OPENSSL_EXPORT int X509_CRL_add0_revoked(X509_CRL *crl, X509_REVOKED *rev); 1039 OPENSSL_EXPORT int X509_CRL_get0_by_serial(X509_CRL *crl, X509_REVOKED **ret, 1040 ASN1_INTEGER *serial); 1041 OPENSSL_EXPORT int X509_CRL_get0_by_cert(X509_CRL *crl, X509_REVOKED **ret, 1042 X509 *x); 1043 1044 OPENSSL_EXPORT X509_PKEY *X509_PKEY_new(void); 1045 OPENSSL_EXPORT void X509_PKEY_free(X509_PKEY *a); 1046 1047 DECLARE_ASN1_FUNCTIONS(NETSCAPE_SPKI) 1048 DECLARE_ASN1_FUNCTIONS(NETSCAPE_SPKAC) 1049 1050 OPENSSL_EXPORT X509_INFO *X509_INFO_new(void); 1051 OPENSSL_EXPORT void X509_INFO_free(X509_INFO *a); 1052 OPENSSL_EXPORT char *X509_NAME_oneline(const X509_NAME *a, char *buf, int size); 1053 1054 OPENSSL_EXPORT int ASN1_digest(i2d_of_void *i2d, const EVP_MD *type, char *data, 1055 unsigned char *md, unsigned int *len); 1056 1057 OPENSSL_EXPORT int ASN1_item_digest(const ASN1_ITEM *it, const EVP_MD *type, 1058 void *data, unsigned char *md, 1059 unsigned int *len); 1060 1061 OPENSSL_EXPORT int ASN1_item_verify(const ASN1_ITEM *it, X509_ALGOR *algor1, 1062 ASN1_BIT_STRING *signature, void *data, 1063 EVP_PKEY *pkey); 1064 1065 OPENSSL_EXPORT int ASN1_item_sign(const ASN1_ITEM *it, X509_ALGOR *algor1, 1066 X509_ALGOR *algor2, 1067 ASN1_BIT_STRING *signature, void *data, 1068 EVP_PKEY *pkey, const EVP_MD *type); 1069 OPENSSL_EXPORT int ASN1_item_sign_ctx(const ASN1_ITEM *it, X509_ALGOR *algor1, 1070 X509_ALGOR *algor2, 1071 ASN1_BIT_STRING *signature, void *asn, 1072 EVP_MD_CTX *ctx); 1073 1074 OPENSSL_EXPORT int X509_set_version(X509 *x, long version); 1075 OPENSSL_EXPORT int X509_set_serialNumber(X509 *x, ASN1_INTEGER *serial); 1076 OPENSSL_EXPORT ASN1_INTEGER *X509_get_serialNumber(X509 *x); 1077 OPENSSL_EXPORT int X509_set_issuer_name(X509 *x, X509_NAME *name); 1078 OPENSSL_EXPORT X509_NAME *X509_get_issuer_name(const X509 *a); 1079 OPENSSL_EXPORT int X509_set_subject_name(X509 *x, X509_NAME *name); 1080 OPENSSL_EXPORT X509_NAME *X509_get_subject_name(const X509 *a); 1081 OPENSSL_EXPORT int X509_set_pubkey(X509 *x, EVP_PKEY *pkey); 1082 OPENSSL_EXPORT EVP_PKEY *X509_get_pubkey(X509 *x); 1083 OPENSSL_EXPORT ASN1_BIT_STRING *X509_get0_pubkey_bitstr(const X509 *x); 1084 OPENSSL_EXPORT const STACK_OF(X509_EXTENSION) *X509_get0_extensions( 1085 const X509 *x); 1086 OPENSSL_EXPORT const X509_ALGOR *X509_get0_tbs_sigalg(const X509 *x); 1087 1088 OPENSSL_EXPORT int X509_REQ_set_version(X509_REQ *x, long version); 1089 OPENSSL_EXPORT int X509_REQ_set_subject_name(X509_REQ *req, X509_NAME *name); 1090 OPENSSL_EXPORT void X509_REQ_get0_signature(const X509_REQ *req, 1091 const ASN1_BIT_STRING **psig, 1092 const X509_ALGOR **palg); 1093 OPENSSL_EXPORT int X509_REQ_get_signature_nid(const X509_REQ *req); 1094 OPENSSL_EXPORT int i2d_re_X509_REQ_tbs(X509_REQ *req, unsigned char **pp); 1095 OPENSSL_EXPORT int X509_REQ_set_pubkey(X509_REQ *x, EVP_PKEY *pkey); 1096 OPENSSL_EXPORT EVP_PKEY *X509_REQ_get_pubkey(X509_REQ *req); 1097 OPENSSL_EXPORT int X509_REQ_extension_nid(int nid); 1098 OPENSSL_EXPORT const int *X509_REQ_get_extension_nids(void); 1099 OPENSSL_EXPORT void X509_REQ_set_extension_nids(const int *nids); 1100 OPENSSL_EXPORT STACK_OF(X509_EXTENSION) *X509_REQ_get_extensions(X509_REQ *req); 1101 OPENSSL_EXPORT int X509_REQ_add_extensions_nid(X509_REQ *req, 1102 STACK_OF(X509_EXTENSION) *exts, 1103 int nid); 1104 OPENSSL_EXPORT int X509_REQ_add_extensions(X509_REQ *req, 1105 STACK_OF(X509_EXTENSION) *exts); 1106 OPENSSL_EXPORT int X509_REQ_get_attr_count(const X509_REQ *req); 1107 OPENSSL_EXPORT int X509_REQ_get_attr_by_NID(const X509_REQ *req, int nid, 1108 int lastpos); 1109 OPENSSL_EXPORT int X509_REQ_get_attr_by_OBJ(const X509_REQ *req, 1110 ASN1_OBJECT *obj, int lastpos); 1111 OPENSSL_EXPORT X509_ATTRIBUTE *X509_REQ_get_attr(const X509_REQ *req, int loc); 1112 OPENSSL_EXPORT X509_ATTRIBUTE *X509_REQ_delete_attr(X509_REQ *req, int loc); 1113 OPENSSL_EXPORT int X509_REQ_add1_attr(X509_REQ *req, X509_ATTRIBUTE *attr); 1114 OPENSSL_EXPORT int X509_REQ_add1_attr_by_OBJ(X509_REQ *req, 1115 const ASN1_OBJECT *obj, int type, 1116 const unsigned char *bytes, 1117 int len); 1118 OPENSSL_EXPORT int X509_REQ_add1_attr_by_NID(X509_REQ *req, int nid, int type, 1119 const unsigned char *bytes, 1120 int len); 1121 OPENSSL_EXPORT int X509_REQ_add1_attr_by_txt(X509_REQ *req, 1122 const char *attrname, int type, 1123 const unsigned char *bytes, 1124 int len); 1125 1126 OPENSSL_EXPORT int X509_CRL_set_version(X509_CRL *x, long version); 1127 OPENSSL_EXPORT int X509_CRL_set_issuer_name(X509_CRL *x, X509_NAME *name); 1128 OPENSSL_EXPORT int X509_CRL_sort(X509_CRL *crl); 1129 OPENSSL_EXPORT int X509_CRL_up_ref(X509_CRL *crl); 1130 1131 OPENSSL_EXPORT void X509_CRL_get0_signature(const X509_CRL *crl, 1132 const ASN1_BIT_STRING **psig, 1133 const X509_ALGOR **palg); 1134 OPENSSL_EXPORT int X509_CRL_get_signature_nid(const X509_CRL *crl); 1135 1136 // i2d_re_X509_CRL_tbs serializes the TBSCertList portion of |crl|. If |outp| is 1137 // NULL, nothing is written. Otherwise, if |*outp| is not NULL, the result is 1138 // written to |*outp|, which must have enough space available, and |*outp| is 1139 // advanced just past the output. If |outp| is non-NULL and |*outp| is NULL, it 1140 // sets |*outp| to a newly-allocated buffer containing the result. The caller is 1141 // responsible for releasing the buffer with |OPENSSL_free|. In all cases, this 1142 // function returns the number of bytes in the result, whether written or not, 1143 // or a negative value on error. 1144 // 1145 // This function re-encodes the TBSCertList and may not reflect |crl|'s original 1146 // encoding. It may be used to manually generate a signature for a new CRL. To 1147 // verify CRLs, use |i2d_X509_CRL_tbs| instead. 1148 OPENSSL_EXPORT int i2d_re_X509_CRL_tbs(X509_CRL *crl, unsigned char **outp); 1149 1150 // i2d_X509_CRL_tbs serializes the TBSCertList portion of |crl|. If |outp| is 1151 // NULL, nothing is written. Otherwise, if |*outp| is not NULL, the result is 1152 // written to |*outp|, which must have enough space available, and |*outp| is 1153 // advanced just past the output. If |outp| is non-NULL and |*outp| is NULL, it 1154 // sets |*outp| to a newly-allocated buffer containing the result. The caller is 1155 // responsible for releasing the buffer with |OPENSSL_free|. In all cases, this 1156 // function returns the number of bytes in the result, whether written or not, 1157 // or a negative value on error. 1158 // 1159 // This function preserves the original encoding of the TBSCertList and may not 1160 // reflect modifications made to |crl|. It may be used to manually verify the 1161 // signature of an existing CRL. To generate CRLs, use |i2d_re_X509_CRL_tbs| 1162 // instead. 1163 OPENSSL_EXPORT int i2d_X509_CRL_tbs(X509_CRL *crl, unsigned char **outp); 1164 1165 // X509_REVOKED_get0_serialNumber returns the serial number of the certificate 1166 // revoked by |revoked|. 1167 OPENSSL_EXPORT const ASN1_INTEGER *X509_REVOKED_get0_serialNumber( 1168 const X509_REVOKED *revoked); 1169 1170 // X509_REVOKED_set_serialNumber sets |revoked|'s serial number to |serial|. It 1171 // returns one on success or zero on error. 1172 OPENSSL_EXPORT int X509_REVOKED_set_serialNumber(X509_REVOKED *revoked, 1173 const ASN1_INTEGER *serial); 1174 1175 // X509_REVOKED_get0_revocationDate returns the revocation time of the 1176 // certificate revoked by |revoked|. 1177 OPENSSL_EXPORT const ASN1_TIME *X509_REVOKED_get0_revocationDate( 1178 const X509_REVOKED *revoked); 1179 1180 // X509_REVOKED_set_revocationDate sets |revoked|'s revocation time to |tm|. It 1181 // returns one on success or zero on error. 1182 OPENSSL_EXPORT int X509_REVOKED_set_revocationDate(X509_REVOKED *revoked, 1183 const ASN1_TIME *tm); 1184 1185 // X509_REVOKED_get0_extensions returns |r|'s extensions. 1186 OPENSSL_EXPORT const STACK_OF(X509_EXTENSION) *X509_REVOKED_get0_extensions( 1187 const X509_REVOKED *r); 1188 1189 OPENSSL_EXPORT X509_CRL *X509_CRL_diff(X509_CRL *base, X509_CRL *newer, 1190 EVP_PKEY *skey, const EVP_MD *md, 1191 unsigned int flags); 1192 1193 OPENSSL_EXPORT int X509_REQ_check_private_key(X509_REQ *x509, EVP_PKEY *pkey); 1194 1195 OPENSSL_EXPORT int X509_check_private_key(X509 *x509, const EVP_PKEY *pkey); 1196 OPENSSL_EXPORT int X509_chain_check_suiteb(int *perror_depth, X509 *x, 1197 STACK_OF(X509) *chain, 1198 unsigned long flags); 1199 OPENSSL_EXPORT int X509_CRL_check_suiteb(X509_CRL *crl, EVP_PKEY *pk, 1200 unsigned long flags); 1201 OPENSSL_EXPORT STACK_OF(X509) *X509_chain_up_ref(STACK_OF(X509) *chain); 1202 1203 OPENSSL_EXPORT int X509_issuer_and_serial_cmp(const X509 *a, const X509 *b); 1204 OPENSSL_EXPORT unsigned long X509_issuer_and_serial_hash(X509 *a); 1205 1206 OPENSSL_EXPORT int X509_issuer_name_cmp(const X509 *a, const X509 *b); 1207 OPENSSL_EXPORT unsigned long X509_issuer_name_hash(X509 *a); 1208 1209 OPENSSL_EXPORT int X509_subject_name_cmp(const X509 *a, const X509 *b); 1210 OPENSSL_EXPORT unsigned long X509_subject_name_hash(X509 *x); 1211 1212 OPENSSL_EXPORT unsigned long X509_issuer_name_hash_old(X509 *a); 1213 OPENSSL_EXPORT unsigned long X509_subject_name_hash_old(X509 *x); 1214 1215 OPENSSL_EXPORT int X509_cmp(const X509 *a, const X509 *b); 1216 OPENSSL_EXPORT int X509_NAME_cmp(const X509_NAME *a, const X509_NAME *b); 1217 OPENSSL_EXPORT unsigned long X509_NAME_hash(X509_NAME *x); 1218 OPENSSL_EXPORT unsigned long X509_NAME_hash_old(X509_NAME *x); 1219 1220 OPENSSL_EXPORT int X509_CRL_cmp(const X509_CRL *a, const X509_CRL *b); 1221 OPENSSL_EXPORT int X509_CRL_match(const X509_CRL *a, const X509_CRL *b); 1222 #ifndef OPENSSL_NO_FP_API 1223 OPENSSL_EXPORT int X509_print_ex_fp(FILE *bp, X509 *x, unsigned long nmflag, 1224 unsigned long cflag); 1225 OPENSSL_EXPORT int X509_print_fp(FILE *bp, X509 *x); 1226 OPENSSL_EXPORT int X509_CRL_print_fp(FILE *bp, X509_CRL *x); 1227 OPENSSL_EXPORT int X509_REQ_print_fp(FILE *bp, X509_REQ *req); 1228 OPENSSL_EXPORT int X509_NAME_print_ex_fp(FILE *fp, const X509_NAME *nm, 1229 int indent, unsigned long flags); 1230 #endif 1231 1232 OPENSSL_EXPORT int X509_NAME_print(BIO *bp, const X509_NAME *name, int obase); 1233 OPENSSL_EXPORT int X509_NAME_print_ex(BIO *out, const X509_NAME *nm, int indent, 1234 unsigned long flags); 1235 OPENSSL_EXPORT int X509_print_ex(BIO *bp, X509 *x, unsigned long nmflag, 1236 unsigned long cflag); 1237 OPENSSL_EXPORT int X509_print(BIO *bp, X509 *x); 1238 OPENSSL_EXPORT int X509_ocspid_print(BIO *bp, X509 *x); 1239 OPENSSL_EXPORT int X509_CERT_AUX_print(BIO *bp, X509_CERT_AUX *x, int indent); 1240 OPENSSL_EXPORT int X509_CRL_print(BIO *bp, X509_CRL *x); 1241 OPENSSL_EXPORT int X509_REQ_print_ex(BIO *bp, X509_REQ *x, unsigned long nmflag, 1242 unsigned long cflag); 1243 OPENSSL_EXPORT int X509_REQ_print(BIO *bp, X509_REQ *req); 1244 1245 OPENSSL_EXPORT int X509_NAME_entry_count(const X509_NAME *name); 1246 OPENSSL_EXPORT int X509_NAME_get_text_by_NID(const X509_NAME *name, int nid, 1247 char *buf, int len); 1248 OPENSSL_EXPORT int X509_NAME_get_text_by_OBJ(const X509_NAME *name, 1249 const ASN1_OBJECT *obj, char *buf, 1250 int len); 1251 1252 // NOTE: you should be passsing -1, not 0 as lastpos. The functions that use 1253 // lastpos, search after that position on. 1254 OPENSSL_EXPORT int X509_NAME_get_index_by_NID(const X509_NAME *name, int nid, 1255 int lastpos); 1256 OPENSSL_EXPORT int X509_NAME_get_index_by_OBJ(const X509_NAME *name, 1257 const ASN1_OBJECT *obj, 1258 int lastpos); 1259 OPENSSL_EXPORT X509_NAME_ENTRY *X509_NAME_get_entry(const X509_NAME *name, 1260 int loc); 1261 OPENSSL_EXPORT X509_NAME_ENTRY *X509_NAME_delete_entry(X509_NAME *name, 1262 int loc); 1263 OPENSSL_EXPORT int X509_NAME_add_entry(X509_NAME *name, X509_NAME_ENTRY *ne, 1264 int loc, int set); 1265 OPENSSL_EXPORT int X509_NAME_add_entry_by_OBJ(X509_NAME *name, ASN1_OBJECT *obj, 1266 int type, 1267 const unsigned char *bytes, 1268 int len, int loc, int set); 1269 OPENSSL_EXPORT int X509_NAME_add_entry_by_NID(X509_NAME *name, int nid, 1270 int type, 1271 const unsigned char *bytes, 1272 int len, int loc, int set); 1273 OPENSSL_EXPORT X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_txt( 1274 X509_NAME_ENTRY **ne, const char *field, int type, 1275 const unsigned char *bytes, int len); 1276 OPENSSL_EXPORT X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_NID( 1277 X509_NAME_ENTRY **ne, int nid, int type, const unsigned char *bytes, 1278 int len); 1279 OPENSSL_EXPORT int X509_NAME_add_entry_by_txt(X509_NAME *name, 1280 const char *field, int type, 1281 const unsigned char *bytes, 1282 int len, int loc, int set); 1283 OPENSSL_EXPORT X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_OBJ( 1284 X509_NAME_ENTRY **ne, const ASN1_OBJECT *obj, int type, 1285 const unsigned char *bytes, int len); 1286 OPENSSL_EXPORT int X509_NAME_ENTRY_set_object(X509_NAME_ENTRY *ne, 1287 const ASN1_OBJECT *obj); 1288 OPENSSL_EXPORT int X509_NAME_ENTRY_set_data(X509_NAME_ENTRY *ne, int type, 1289 const unsigned char *bytes, 1290 int len); 1291 OPENSSL_EXPORT ASN1_OBJECT *X509_NAME_ENTRY_get_object( 1292 const X509_NAME_ENTRY *ne); 1293 OPENSSL_EXPORT ASN1_STRING *X509_NAME_ENTRY_get_data(const X509_NAME_ENTRY *ne); 1294 1295 OPENSSL_EXPORT int X509v3_get_ext_count(const STACK_OF(X509_EXTENSION) *x); 1296 OPENSSL_EXPORT int X509v3_get_ext_by_NID(const STACK_OF(X509_EXTENSION) *x, 1297 int nid, int lastpos); 1298 OPENSSL_EXPORT int X509v3_get_ext_by_OBJ(const STACK_OF(X509_EXTENSION) *x, 1299 const ASN1_OBJECT *obj, int lastpos); 1300 OPENSSL_EXPORT int X509v3_get_ext_by_critical(const STACK_OF(X509_EXTENSION) *x, 1301 int crit, int lastpos); 1302 OPENSSL_EXPORT X509_EXTENSION *X509v3_get_ext(const STACK_OF(X509_EXTENSION) *x, 1303 int loc); 1304 OPENSSL_EXPORT X509_EXTENSION *X509v3_delete_ext(STACK_OF(X509_EXTENSION) *x, 1305 int loc); 1306 OPENSSL_EXPORT STACK_OF(X509_EXTENSION) *X509v3_add_ext( 1307 STACK_OF(X509_EXTENSION) **x, X509_EXTENSION *ex, int loc); 1308 1309 OPENSSL_EXPORT int X509_get_ext_count(const X509 *x); 1310 OPENSSL_EXPORT int X509_get_ext_by_NID(const X509 *x, int nid, int lastpos); 1311 OPENSSL_EXPORT int X509_get_ext_by_OBJ(const X509 *x, const ASN1_OBJECT *obj, 1312 int lastpos); 1313 OPENSSL_EXPORT int X509_get_ext_by_critical(const X509 *x, int crit, 1314 int lastpos); 1315 OPENSSL_EXPORT X509_EXTENSION *X509_get_ext(const X509 *x, int loc); 1316 OPENSSL_EXPORT X509_EXTENSION *X509_delete_ext(X509 *x, int loc); 1317 OPENSSL_EXPORT int X509_add_ext(X509 *x, X509_EXTENSION *ex, int loc); 1318 1319 // X509_get_ext_d2i behaves like |X509V3_get_d2i| but looks for the extension in 1320 // |x509|'s extension list. 1321 // 1322 // WARNING: This function is difficult to use correctly. See the documentation 1323 // for |X509V3_get_d2i| for details. 1324 OPENSSL_EXPORT void *X509_get_ext_d2i(const X509 *x509, int nid, 1325 int *out_critical, int *out_idx); 1326 1327 // X509_add1_ext_i2d behaves like |X509V3_add1_i2d| but adds the extension to 1328 // |x|'s extension list. 1329 // 1330 // WARNING: This function may return zero or -1 on error. The caller must also 1331 // ensure |value|'s type matches |nid|. See the documentation for 1332 // |X509V3_add1_i2d| for details. 1333 OPENSSL_EXPORT int X509_add1_ext_i2d(X509 *x, int nid, void *value, int crit, 1334 unsigned long flags); 1335 1336 OPENSSL_EXPORT int X509_CRL_get_ext_count(const X509_CRL *x); 1337 OPENSSL_EXPORT int X509_CRL_get_ext_by_NID(const X509_CRL *x, int nid, 1338 int lastpos); 1339 OPENSSL_EXPORT int X509_CRL_get_ext_by_OBJ(const X509_CRL *x, 1340 const ASN1_OBJECT *obj, int lastpos); 1341 OPENSSL_EXPORT int X509_CRL_get_ext_by_critical(const X509_CRL *x, int crit, 1342 int lastpos); 1343 OPENSSL_EXPORT X509_EXTENSION *X509_CRL_get_ext(const X509_CRL *x, int loc); 1344 OPENSSL_EXPORT X509_EXTENSION *X509_CRL_delete_ext(X509_CRL *x, int loc); 1345 OPENSSL_EXPORT int X509_CRL_add_ext(X509_CRL *x, X509_EXTENSION *ex, int loc); 1346 1347 // X509_CRL_get_ext_d2i behaves like |X509V3_get_d2i| but looks for the 1348 // extension in |crl|'s extension list. 1349 // 1350 // WARNING: This function is difficult to use correctly. See the documentation 1351 // for |X509V3_get_d2i| for details. 1352 OPENSSL_EXPORT void *X509_CRL_get_ext_d2i(const X509_CRL *crl, int nid, 1353 int *out_critical, int *out_idx); 1354 1355 // X509_CRL_add1_ext_i2d behaves like |X509V3_add1_i2d| but adds the extension 1356 // to |x|'s extension list. 1357 // 1358 // WARNING: This function may return zero or -1 on error. The caller must also 1359 // ensure |value|'s type matches |nid|. See the documentation for 1360 // |X509V3_add1_i2d| for details. 1361 OPENSSL_EXPORT int X509_CRL_add1_ext_i2d(X509_CRL *x, int nid, void *value, 1362 int crit, unsigned long flags); 1363 1364 OPENSSL_EXPORT int X509_REVOKED_get_ext_count(const X509_REVOKED *x); 1365 OPENSSL_EXPORT int X509_REVOKED_get_ext_by_NID(const X509_REVOKED *x, int nid, 1366 int lastpos); 1367 OPENSSL_EXPORT int X509_REVOKED_get_ext_by_OBJ(const X509_REVOKED *x, 1368 const ASN1_OBJECT *obj, 1369 int lastpos); 1370 OPENSSL_EXPORT int X509_REVOKED_get_ext_by_critical(const X509_REVOKED *x, 1371 int crit, int lastpos); 1372 OPENSSL_EXPORT X509_EXTENSION *X509_REVOKED_get_ext(const X509_REVOKED *x, 1373 int loc); 1374 OPENSSL_EXPORT X509_EXTENSION *X509_REVOKED_delete_ext(X509_REVOKED *x, 1375 int loc); 1376 OPENSSL_EXPORT int X509_REVOKED_add_ext(X509_REVOKED *x, X509_EXTENSION *ex, 1377 int loc); 1378 1379 // X509_REVOKED_get_ext_d2i behaves like |X509V3_get_d2i| but looks for the 1380 // extension in |revoked|'s extension list. 1381 // 1382 // WARNING: This function is difficult to use correctly. See the documentation 1383 // for |X509V3_get_d2i| for details. 1384 OPENSSL_EXPORT void *X509_REVOKED_get_ext_d2i(const X509_REVOKED *revoked, 1385 int nid, int *out_critical, 1386 int *out_idx); 1387 1388 // X509_REVOKED_add1_ext_i2d behaves like |X509V3_add1_i2d| but adds the 1389 // extension to |x|'s extension list. 1390 // 1391 // WARNING: This function may return zero or -1 on error. The caller must also 1392 // ensure |value|'s type matches |nid|. See the documentation for 1393 // |X509V3_add1_i2d| for details. 1394 OPENSSL_EXPORT int X509_REVOKED_add1_ext_i2d(X509_REVOKED *x, int nid, 1395 void *value, int crit, 1396 unsigned long flags); 1397 1398 OPENSSL_EXPORT X509_EXTENSION *X509_EXTENSION_create_by_NID( 1399 X509_EXTENSION **ex, int nid, int crit, const ASN1_OCTET_STRING *data); 1400 OPENSSL_EXPORT X509_EXTENSION *X509_EXTENSION_create_by_OBJ( 1401 X509_EXTENSION **ex, const ASN1_OBJECT *obj, int crit, 1402 const ASN1_OCTET_STRING *data); 1403 OPENSSL_EXPORT int X509_EXTENSION_set_object(X509_EXTENSION *ex, 1404 const ASN1_OBJECT *obj); 1405 OPENSSL_EXPORT int X509_EXTENSION_set_critical(X509_EXTENSION *ex, int crit); 1406 OPENSSL_EXPORT int X509_EXTENSION_set_data(X509_EXTENSION *ex, 1407 const ASN1_OCTET_STRING *data); 1408 OPENSSL_EXPORT ASN1_OBJECT *X509_EXTENSION_get_object(X509_EXTENSION *ex); 1409 OPENSSL_EXPORT ASN1_OCTET_STRING *X509_EXTENSION_get_data(X509_EXTENSION *ne); 1410 OPENSSL_EXPORT int X509_EXTENSION_get_critical(X509_EXTENSION *ex); 1411 1412 OPENSSL_EXPORT int X509at_get_attr_count(const STACK_OF(X509_ATTRIBUTE) *x); 1413 OPENSSL_EXPORT int X509at_get_attr_by_NID(const STACK_OF(X509_ATTRIBUTE) *x, 1414 int nid, int lastpos); 1415 OPENSSL_EXPORT int X509at_get_attr_by_OBJ(const STACK_OF(X509_ATTRIBUTE) *sk, 1416 const ASN1_OBJECT *obj, int lastpos); 1417 OPENSSL_EXPORT X509_ATTRIBUTE *X509at_get_attr( 1418 const STACK_OF(X509_ATTRIBUTE) *x, int loc); 1419 OPENSSL_EXPORT X509_ATTRIBUTE *X509at_delete_attr(STACK_OF(X509_ATTRIBUTE) *x, 1420 int loc); 1421 OPENSSL_EXPORT STACK_OF(X509_ATTRIBUTE) *X509at_add1_attr( 1422 STACK_OF(X509_ATTRIBUTE) **x, X509_ATTRIBUTE *attr); 1423 OPENSSL_EXPORT STACK_OF(X509_ATTRIBUTE) *X509at_add1_attr_by_OBJ( 1424 STACK_OF(X509_ATTRIBUTE) **x, const ASN1_OBJECT *obj, int type, 1425 const unsigned char *bytes, int len); 1426 OPENSSL_EXPORT STACK_OF(X509_ATTRIBUTE) *X509at_add1_attr_by_NID( 1427 STACK_OF(X509_ATTRIBUTE) **x, int nid, int type, const unsigned char *bytes, 1428 int len); 1429 OPENSSL_EXPORT STACK_OF(X509_ATTRIBUTE) *X509at_add1_attr_by_txt( 1430 STACK_OF(X509_ATTRIBUTE) **x, const char *attrname, int type, 1431 const unsigned char *bytes, int len); 1432 OPENSSL_EXPORT void *X509at_get0_data_by_OBJ(STACK_OF(X509_ATTRIBUTE) *x, 1433 ASN1_OBJECT *obj, int lastpos, 1434 int type); 1435 OPENSSL_EXPORT X509_ATTRIBUTE *X509_ATTRIBUTE_create_by_NID( 1436 X509_ATTRIBUTE **attr, int nid, int atrtype, const void *data, int len); 1437 OPENSSL_EXPORT X509_ATTRIBUTE *X509_ATTRIBUTE_create_by_OBJ( 1438 X509_ATTRIBUTE **attr, const ASN1_OBJECT *obj, int atrtype, 1439 const void *data, int len); 1440 OPENSSL_EXPORT X509_ATTRIBUTE *X509_ATTRIBUTE_create_by_txt( 1441 X509_ATTRIBUTE **attr, const char *atrname, int type, 1442 const unsigned char *bytes, int len); 1443 OPENSSL_EXPORT int X509_ATTRIBUTE_set1_object(X509_ATTRIBUTE *attr, 1444 const ASN1_OBJECT *obj); 1445 OPENSSL_EXPORT int X509_ATTRIBUTE_set1_data(X509_ATTRIBUTE *attr, int attrtype, 1446 const void *data, int len); 1447 OPENSSL_EXPORT void *X509_ATTRIBUTE_get0_data(X509_ATTRIBUTE *attr, int idx, 1448 int atrtype, void *data); 1449 OPENSSL_EXPORT int X509_ATTRIBUTE_count(X509_ATTRIBUTE *attr); 1450 OPENSSL_EXPORT ASN1_OBJECT *X509_ATTRIBUTE_get0_object(X509_ATTRIBUTE *attr); 1451 OPENSSL_EXPORT ASN1_TYPE *X509_ATTRIBUTE_get0_type(X509_ATTRIBUTE *attr, 1452 int idx); 1453 1454 OPENSSL_EXPORT int X509_verify_cert(X509_STORE_CTX *ctx); 1455 1456 // lookup a cert from a X509 STACK 1457 OPENSSL_EXPORT X509 *X509_find_by_issuer_and_serial(STACK_OF(X509) *sk, 1458 X509_NAME *name, 1459 ASN1_INTEGER *serial); 1460 OPENSSL_EXPORT X509 *X509_find_by_subject(STACK_OF(X509) *sk, X509_NAME *name); 1461 1462 // PKCS#8 utilities 1463 1464 DECLARE_ASN1_FUNCTIONS(PKCS8_PRIV_KEY_INFO) 1465 1466 OPENSSL_EXPORT EVP_PKEY *EVP_PKCS82PKEY(PKCS8_PRIV_KEY_INFO *p8); 1467 OPENSSL_EXPORT PKCS8_PRIV_KEY_INFO *EVP_PKEY2PKCS8(EVP_PKEY *pkey); 1468 1469 OPENSSL_EXPORT int PKCS8_pkey_set0(PKCS8_PRIV_KEY_INFO *priv, ASN1_OBJECT *aobj, 1470 int version, int ptype, void *pval, 1471 unsigned char *penc, int penclen); 1472 OPENSSL_EXPORT int PKCS8_pkey_get0(ASN1_OBJECT **ppkalg, 1473 const unsigned char **pk, int *ppklen, 1474 X509_ALGOR **pa, PKCS8_PRIV_KEY_INFO *p8); 1475 1476 OPENSSL_EXPORT int X509_PUBKEY_set0_param(X509_PUBKEY *pub, 1477 const ASN1_OBJECT *aobj, int ptype, 1478 void *pval, unsigned char *penc, 1479 int penclen); 1480 OPENSSL_EXPORT int X509_PUBKEY_get0_param(ASN1_OBJECT **ppkalg, 1481 const unsigned char **pk, int *ppklen, 1482 X509_ALGOR **pa, X509_PUBKEY *pub); 1483 1484 OPENSSL_EXPORT int X509_check_trust(X509 *x, int id, int flags); 1485 OPENSSL_EXPORT int X509_TRUST_get_count(void); 1486 OPENSSL_EXPORT X509_TRUST *X509_TRUST_get0(int idx); 1487 OPENSSL_EXPORT int X509_TRUST_get_by_id(int id); 1488 OPENSSL_EXPORT int X509_TRUST_add(int id, int flags, 1489 int (*ck)(X509_TRUST *, X509 *, int), 1490 char *name, int arg1, void *arg2); 1491 OPENSSL_EXPORT void X509_TRUST_cleanup(void); 1492 OPENSSL_EXPORT int X509_TRUST_get_flags(const X509_TRUST *xp); 1493 OPENSSL_EXPORT char *X509_TRUST_get0_name(const X509_TRUST *xp); 1494 OPENSSL_EXPORT int X509_TRUST_get_trust(const X509_TRUST *xp); 1495 1496 1497 typedef struct rsa_pss_params_st { 1498 X509_ALGOR *hashAlgorithm; 1499 X509_ALGOR *maskGenAlgorithm; 1500 ASN1_INTEGER *saltLength; 1501 ASN1_INTEGER *trailerField; 1502 } RSA_PSS_PARAMS; 1503 1504 DECLARE_ASN1_FUNCTIONS(RSA_PSS_PARAMS) 1505 1506 1507 1508 #ifdef __cplusplus 1509 } 1510 #endif 1511 1512 #if !defined(BORINGSSL_NO_CXX) 1513 extern "C++" { 1514 1515 BSSL_NAMESPACE_BEGIN 1516 1517 BORINGSSL_MAKE_DELETER(NETSCAPE_SPKI, NETSCAPE_SPKI_free) 1518 BORINGSSL_MAKE_DELETER(RSA_PSS_PARAMS, RSA_PSS_PARAMS_free) 1519 BORINGSSL_MAKE_DELETER(X509, X509_free) 1520 BORINGSSL_MAKE_UP_REF(X509, X509_up_ref) 1521 BORINGSSL_MAKE_DELETER(X509_ALGOR, X509_ALGOR_free) 1522 BORINGSSL_MAKE_DELETER(X509_CRL, X509_CRL_free) 1523 BORINGSSL_MAKE_UP_REF(X509_CRL, X509_CRL_up_ref) 1524 BORINGSSL_MAKE_DELETER(X509_CRL_METHOD, X509_CRL_METHOD_free) 1525 BORINGSSL_MAKE_DELETER(X509_EXTENSION, X509_EXTENSION_free) 1526 BORINGSSL_MAKE_DELETER(X509_INFO, X509_INFO_free) 1527 BORINGSSL_MAKE_DELETER(X509_LOOKUP, X509_LOOKUP_free) 1528 BORINGSSL_MAKE_DELETER(X509_NAME, X509_NAME_free) 1529 BORINGSSL_MAKE_DELETER(X509_NAME_ENTRY, X509_NAME_ENTRY_free) 1530 BORINGSSL_MAKE_DELETER(X509_PKEY, X509_PKEY_free) 1531 BORINGSSL_MAKE_DELETER(X509_POLICY_TREE, X509_policy_tree_free) 1532 BORINGSSL_MAKE_DELETER(X509_PUBKEY, X509_PUBKEY_free) 1533 BORINGSSL_MAKE_DELETER(X509_REQ, X509_REQ_free) 1534 BORINGSSL_MAKE_DELETER(X509_REVOKED, X509_REVOKED_free) 1535 BORINGSSL_MAKE_DELETER(X509_SIG, X509_SIG_free) 1536 BORINGSSL_MAKE_DELETER(X509_STORE, X509_STORE_free) 1537 BORINGSSL_MAKE_DELETER(X509_STORE_CTX, X509_STORE_CTX_free) 1538 BORINGSSL_MAKE_DELETER(X509_VERIFY_PARAM, X509_VERIFY_PARAM_free) 1539 1540 using ScopedX509_STORE_CTX = 1541 internal::StackAllocated<X509_STORE_CTX, void, X509_STORE_CTX_zero, 1542 X509_STORE_CTX_cleanup>; 1543 1544 BSSL_NAMESPACE_END 1545 1546 } // extern C++ 1547 #endif // !BORINGSSL_NO_CXX 1548 1549 #define X509_R_AKID_MISMATCH 100 1550 #define X509_R_BAD_PKCS7_VERSION 101 1551 #define X509_R_BAD_X509_FILETYPE 102 1552 #define X509_R_BASE64_DECODE_ERROR 103 1553 #define X509_R_CANT_CHECK_DH_KEY 104 1554 #define X509_R_CERT_ALREADY_IN_HASH_TABLE 105 1555 #define X509_R_CRL_ALREADY_DELTA 106 1556 #define X509_R_CRL_VERIFY_FAILURE 107 1557 #define X509_R_IDP_MISMATCH 108 1558 #define X509_R_INVALID_BIT_STRING_BITS_LEFT 109 1559 #define X509_R_INVALID_DIRECTORY 110 1560 #define X509_R_INVALID_FIELD_NAME 111 1561 #define X509_R_INVALID_PSS_PARAMETERS 112 1562 #define X509_R_INVALID_TRUST 113 1563 #define X509_R_ISSUER_MISMATCH 114 1564 #define X509_R_KEY_TYPE_MISMATCH 115 1565 #define X509_R_KEY_VALUES_MISMATCH 116 1566 #define X509_R_LOADING_CERT_DIR 117 1567 #define X509_R_LOADING_DEFAULTS 118 1568 #define X509_R_NEWER_CRL_NOT_NEWER 119 1569 #define X509_R_NOT_PKCS7_SIGNED_DATA 120 1570 #define X509_R_NO_CERTIFICATES_INCLUDED 121 1571 #define X509_R_NO_CERT_SET_FOR_US_TO_VERIFY 122 1572 #define X509_R_NO_CRLS_INCLUDED 123 1573 #define X509_R_NO_CRL_NUMBER 124 1574 #define X509_R_PUBLIC_KEY_DECODE_ERROR 125 1575 #define X509_R_PUBLIC_KEY_ENCODE_ERROR 126 1576 #define X509_R_SHOULD_RETRY 127 1577 #define X509_R_UNKNOWN_KEY_TYPE 128 1578 #define X509_R_UNKNOWN_NID 129 1579 #define X509_R_UNKNOWN_PURPOSE_ID 130 1580 #define X509_R_UNKNOWN_TRUST_ID 131 1581 #define X509_R_UNSUPPORTED_ALGORITHM 132 1582 #define X509_R_WRONG_LOOKUP_TYPE 133 1583 #define X509_R_WRONG_TYPE 134 1584 #define X509_R_NAME_TOO_LONG 135 1585 #define X509_R_INVALID_PARAMETER 136 1586 #define X509_R_SIGNATURE_ALGORITHM_MISMATCH 137 1587 #define X509_R_DELTA_CRL_WITHOUT_CRL_NUMBER 138 1588 #define X509_R_INVALID_FIELD_FOR_VERSION 139 1589 #define X509_R_INVALID_VERSION 140 1590 1591 #endif 1592