OLD | NEW |
1 /* This Source Code Form is subject to the terms of the Mozilla Public | 1 /* This Source Code Form is subject to the terms of the Mozilla Public |
2 * License, v. 2.0. If a copy of the MPL was not distributed with this | 2 * License, v. 2.0. If a copy of the MPL was not distributed with this |
3 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ | 3 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ |
4 /* | 4 /* |
5 * ocspi.h - NSS internal interfaces to OCSP code | 5 * ocspi.h - NSS internal interfaces to OCSP code |
6 */ | 6 */ |
7 | 7 |
8 #ifndef _OCSPI_H_ | 8 #ifndef _OCSPI_H_ |
9 #define _OCSPI_H_ | 9 #define _OCSPI_H_ |
10 | 10 |
11 SECStatus OCSP_InitGlobal(void); | 11 SECStatus OCSP_InitGlobal(void); |
12 SECStatus OCSP_ShutdownGlobal(void); | 12 SECStatus OCSP_ShutdownGlobal(void); |
13 | 13 |
14 ocspResponseData * | 14 ocspResponseData * |
15 ocsp_GetResponseData(CERTOCSPResponse *response, SECItem **tbsResponseDataDER); | 15 ocsp_GetResponseData(CERTOCSPResponse *response, SECItem **tbsResponseDataDER); |
16 | 16 |
17 ocspSignature * | 17 ocspSignature * |
18 ocsp_GetResponseSignature(CERTOCSPResponse *response); | 18 ocsp_GetResponseSignature(CERTOCSPResponse *response); |
19 | 19 |
20 SECItem * | 20 SECItem * |
21 ocsp_DigestValue(PRArenaPool *arena, SECOidTag digestAlg, | 21 ocsp_DigestValue(PLArenaPool *arena, SECOidTag digestAlg, |
22 SECItem *fill, const SECItem *src); | 22 SECItem *fill, const SECItem *src); |
23 | 23 |
24 PRBool | 24 PRBool |
25 ocsp_CertIsOCSPDefaultResponder(CERTCertDBHandle *handle, CERTCertificate *cert)
; | 25 ocsp_CertIsOCSPDefaultResponder(CERTCertDBHandle *handle, CERTCertificate *cert)
; |
26 | 26 |
27 CERTCertificate * | 27 CERTCertificate * |
28 ocsp_GetSignerCertificate(CERTCertDBHandle *handle, ocspResponseData *tbsData, | 28 ocsp_GetSignerCertificate(CERTCertDBHandle *handle, ocspResponseData *tbsData, |
29 ocspSignature *signature, CERTCertificate *issuer); | 29 ocspSignature *signature, CERTCertificate *issuer); |
30 | 30 |
31 SECStatus | 31 SECStatus |
32 ocsp_VerifyResponseSignature(CERTCertificate *signerCert, | 32 ocsp_VerifyResponseSignature(CERTCertificate *signerCert, |
33 ocspSignature *signature, | 33 ocspSignature *signature, |
34 SECItem *tbsResponseDataDER, | 34 SECItem *tbsResponseDataDER, |
35 void *pwArg); | 35 void *pwArg); |
36 | 36 |
37 CERTOCSPRequest * | 37 CERTOCSPRequest * |
38 cert_CreateSingleCertOCSPRequest(CERTOCSPCertID *certID, | 38 cert_CreateSingleCertOCSPRequest(CERTOCSPCertID *certID, |
39 CERTCertificate *singleCert, | 39 CERTCertificate *singleCert, |
40 int64 time, | 40 PRTime time, |
41 PRBool addServiceLocator, | 41 PRBool addServiceLocator, |
42 CERTCertificate *signerCert); | 42 CERTCertificate *signerCert); |
43 | 43 |
44 SECStatus | 44 SECStatus |
45 ocsp_GetCachedOCSPResponseStatusIfFresh(CERTOCSPCertID *certID, | 45 ocsp_GetCachedOCSPResponseStatusIfFresh(CERTOCSPCertID *certID, |
46 int64 time, | 46 PRTime time, |
47 PRBool ignoreOcspFailureMode, | 47 PRBool ignoreOcspFailureMode, |
48 SECStatus *rvOcsp, | 48 SECStatus *rvOcsp, |
49 SECErrorCodes *missingResponseError); | 49 SECErrorCodes *missingResponseError); |
50 | 50 |
51 /* | 51 /* |
52 * FUNCTION: cert_ProcessOCSPResponse | 52 * FUNCTION: cert_ProcessOCSPResponse |
53 * Same behavior and basic parameters as CERT_GetOCSPStatusForCertID. | 53 * Same behavior and basic parameters as CERT_GetOCSPStatusForCertID. |
54 * In addition it can update the OCSP cache (using information | 54 * In addition it can update the OCSP cache (using information |
55 * available internally to this function). | 55 * available internally to this function). |
56 * INPUTS: | 56 * INPUTS: |
57 * CERTCertDBHandle *handle | 57 * CERTCertDBHandle *handle |
58 * certificate DB of the cert that is being checked | 58 * certificate DB of the cert that is being checked |
59 * CERTOCSPResponse *response | 59 * CERTOCSPResponse *response |
60 * the OCSP response we want to retrieve status from. | 60 * the OCSP response we want to retrieve status from. |
61 * CERTOCSPCertID *certID | 61 * CERTOCSPCertID *certID |
62 * the ID we want to look for from the response. | 62 * the ID we want to look for from the response. |
63 * CERTCertificate *signerCert | 63 * CERTCertificate *signerCert |
64 * the certificate that was used to sign the OCSP response. | 64 * the certificate that was used to sign the OCSP response. |
65 * must be obtained via a call to CERT_VerifyOCSPResponseSignature. | 65 * must be obtained via a call to CERT_VerifyOCSPResponseSignature. |
66 * int64 time | 66 * PRTime time |
67 * The time at which we're checking the status for. | 67 * The time at which we're checking the status for. |
68 * PRBool *certIDWasConsumed | 68 * PRBool *certIDWasConsumed |
69 * In and Out parameter. | 69 * In and Out parameter. |
70 * If certIDWasConsumed is NULL on input, | 70 * If certIDWasConsumed is NULL on input, |
71 * this function might produce a deep copy of cert ID | 71 * this function might produce a deep copy of cert ID |
72 * for storing it in the cache. | 72 * for storing it in the cache. |
73 * If out value is true, ownership of parameter certID was | 73 * If out value is true, ownership of parameter certID was |
74 * transferred to the OCSP cache. | 74 * transferred to the OCSP cache. |
75 * SECStatus *cacheUpdateStatus | 75 * SECStatus *cacheUpdateStatus |
76 * This optional out parameter will contain the result | 76 * This optional out parameter will contain the result |
77 * of the cache update operation (if requested). | 77 * of the cache update operation (if requested). |
78 * RETURN: | 78 * RETURN: |
79 * The return value is not influenced by the cache operation, | 79 * The return value is not influenced by the cache operation, |
80 * it matches the documentation for CERT_CheckOCSPStatus | 80 * it matches the documentation for CERT_CheckOCSPStatus |
81 */ | 81 */ |
82 | 82 |
83 SECStatus | 83 SECStatus |
84 cert_ProcessOCSPResponse(CERTCertDBHandle *handle, | 84 cert_ProcessOCSPResponse(CERTCertDBHandle *handle, |
85 CERTOCSPResponse *response, | 85 CERTOCSPResponse *response, |
86 CERTOCSPCertID *certID, | 86 CERTOCSPCertID *certID, |
87 CERTCertificate *signerCert, | 87 CERTCertificate *signerCert, |
88 int64 time, | 88 PRTime time, |
89 PRBool *certIDWasConsumed, | 89 PRBool *certIDWasConsumed, |
90 SECStatus *cacheUpdateStatus); | 90 SECStatus *cacheUpdateStatus); |
91 | 91 |
92 /* | 92 /* |
93 * FUNCTION: cert_RememberOCSPProcessingFailure | 93 * FUNCTION: cert_RememberOCSPProcessingFailure |
94 * If an application notices a failure during OCSP processing, | 94 * If an application notices a failure during OCSP processing, |
95 * it should finally call this function. The failure will be recorded | 95 * it should finally call this function. The failure will be recorded |
96 * in the OCSP cache in order to avoid repetitive failures. | 96 * in the OCSP cache in order to avoid repetitive failures. |
97 * INPUTS: | 97 * INPUTS: |
98 * CERTOCSPCertID *certID | 98 * CERTOCSPCertID *certID |
(...skipping 34 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
133 * The function checks the global ocsp settings and | 133 * The function checks the global ocsp settings and |
134 * tells how to treat an ocsp response fetching failure. | 134 * tells how to treat an ocsp response fetching failure. |
135 * RETURNS: | 135 * RETURNS: |
136 * if PR_TRUE is returned, then treat fetching as a | 136 * if PR_TRUE is returned, then treat fetching as a |
137 * revoked cert status. | 137 * revoked cert status. |
138 */ | 138 */ |
139 PRBool | 139 PRBool |
140 ocsp_FetchingFailureIsVerificationFailure(void); | 140 ocsp_FetchingFailureIsVerificationFailure(void); |
141 | 141 |
142 #endif /* _OCSPI_H_ */ | 142 #endif /* _OCSPI_H_ */ |
OLD | NEW |