1/* This is a generated file */
2#ifndef __hx509_protos_h__
3#define __hx509_protos_h__
4#ifndef DOXY
5
6#include <stdarg.h>
7
8#ifdef __cplusplus
9extern "C" {
10#endif
11
12#ifndef HX509_LIB
13#ifndef HX509_LIB_FUNCTION
14#if defined(_WIN32)
15#define HX509_LIB_FUNCTION __declspec(dllimport)
16#define HX509_LIB_CALL __stdcall
17#define HX509_LIB_VARIABLE __declspec(dllimport)
18#else
19#define HX509_LIB_FUNCTION
20#define HX509_LIB_CALL
21#define HX509_LIB_VARIABLE
22#endif
23#endif
24#endif
25/**
26 * Print a bitstring using a hx509_vprint_func function. To print to
27 * stdout use hx509_print_stdout().
28 *
29 * @param b bit string to print.
30 * @param func hx509_vprint_func to print with.
31 * @param ctx context variable to hx509_vprint_func function.
32 *
33 * @ingroup hx509_print
34 */
35
36void
37hx509_bitstring_print (
38 const heim_bit_string */*b*/,
39 hx509_vprint_func /*func*/,
40 void */*ctx*/);
41
42/**
43 * Sign a to-be-signed certificate object with a issuer certificate.
44 *
45 * The caller needs to at least have called the following functions on the
46 * to-be-signed certificate object:
47 * - hx509_ca_tbs_init()
48 * - hx509_ca_tbs_set_subject()
49 * - hx509_ca_tbs_set_spki()
50 *
51 * When done the to-be-signed certificate object should be freed with
52 * hx509_ca_tbs_free().
53 *
54 * When creating self-signed certificate use hx509_ca_sign_self() instead.
55 *
56 * @param context A hx509 context.
57 * @param tbs object to be signed.
58 * @param signer the CA certificate object to sign with (need private key).
59 * @param certificate return cerificate, free with hx509_cert_free().
60 *
61 * @return An hx509 error code, see hx509_get_error_string().
62 *
63 * @ingroup hx509_ca
64 */
65
66int
67hx509_ca_sign (
68 hx509_context /*context*/,
69 hx509_ca_tbs /*tbs*/,
70 hx509_cert /*signer*/,
71 hx509_cert */*certificate*/);
72
73/**
74 * Work just like hx509_ca_sign() but signs it-self.
75 *
76 * @param context A hx509 context.
77 * @param tbs object to be signed.
78 * @param signer private key to sign with.
79 * @param certificate return cerificate, free with hx509_cert_free().
80 *
81 * @return An hx509 error code, see hx509_get_error_string().
82 *
83 * @ingroup hx509_ca
84 */
85
86int
87hx509_ca_sign_self (
88 hx509_context /*context*/,
89 hx509_ca_tbs /*tbs*/,
90 hx509_private_key /*signer*/,
91 hx509_cert */*certificate*/);
92
93/**
94 * Add CRL distribution point URI to the to-be-signed certificate
95 * object.
96 *
97 * @param context A hx509 context.
98 * @param tbs object to be signed.
99 * @param uri uri to the CRL.
100 * @param issuername name of the issuer.
101 *
102 * @return An hx509 error code, see hx509_get_error_string().
103 *
104 * @ingroup hx509_ca
105 */
106
107int
108hx509_ca_tbs_add_crl_dp_uri (
109 hx509_context /*context*/,
110 hx509_ca_tbs /*tbs*/,
111 const char */*uri*/,
112 hx509_name /*issuername*/);
113
114/**
115 * An an extended key usage to the to-be-signed certificate object.
116 * Duplicates will detected and not added.
117 *
118 * @param context A hx509 context.
119 * @param tbs object to be signed.
120 * @param oid extended key usage to add.
121 *
122 * @return An hx509 error code, see hx509_get_error_string().
123 *
124 * @ingroup hx509_ca
125 */
126
127int
128hx509_ca_tbs_add_eku (
129 hx509_context /*context*/,
130 hx509_ca_tbs /*tbs*/,
131 const heim_oid */*oid*/);
132
133/**
134 * Add a Subject Alternative Name hostname to to-be-signed certificate
135 * object. A domain match starts with ., an exact match does not.
136 *
137 * Example of a an domain match: .domain.se matches the hostname
138 * host.domain.se.
139 *
140 * @param context A hx509 context.
141 * @param tbs object to be signed.
142 * @param dnsname a hostame.
143 *
144 * @return An hx509 error code, see hx509_get_error_string().
145 *
146 * @ingroup hx509_ca
147 */
148
149int
150hx509_ca_tbs_add_san_hostname (
151 hx509_context /*context*/,
152 hx509_ca_tbs /*tbs*/,
153 const char */*dnsname*/);
154
155/**
156 * Add a Jabber/XMPP jid Subject Alternative Name to the to-be-signed
157 * certificate object. The jid is an UTF8 string.
158 *
159 * @param context A hx509 context.
160 * @param tbs object to be signed.
161 * @param jid string of an a jabber id in UTF8.
162 *
163 * @return An hx509 error code, see hx509_get_error_string().
164 *
165 * @ingroup hx509_ca
166 */
167
168int
169hx509_ca_tbs_add_san_jid (
170 hx509_context /*context*/,
171 hx509_ca_tbs /*tbs*/,
172 const char */*jid*/);
173
174/**
175 * Add Microsoft UPN Subject Alternative Name to the to-be-signed
176 * certificate object. The principal string is a UTF8 string.
177 *
178 * @param context A hx509 context.
179 * @param tbs object to be signed.
180 * @param principal Microsoft UPN string.
181 *
182 * @return An hx509 error code, see hx509_get_error_string().
183 *
184 * @ingroup hx509_ca
185 */
186
187int
188hx509_ca_tbs_add_san_ms_upn (
189 hx509_context /*context*/,
190 hx509_ca_tbs /*tbs*/,
191 const char */*principal*/);
192
193/**
194 * Add Subject Alternative Name otherName to the to-be-signed
195 * certificate object.
196 *
197 * @param context A hx509 context.
198 * @param tbs object to be signed.
199 * @param oid the oid of the OtherName.
200 * @param os data in the other name.
201 *
202 * @return An hx509 error code, see hx509_get_error_string().
203 *
204 * @ingroup hx509_ca
205 */
206
207int
208hx509_ca_tbs_add_san_otherName (
209 hx509_context /*context*/,
210 hx509_ca_tbs /*tbs*/,
211 const heim_oid */*oid*/,
212 const heim_octet_string */*os*/);
213
214/**
215 * Add Kerberos Subject Alternative Name to the to-be-signed
216 * certificate object. The principal string is a UTF8 string.
217 *
218 * @param context A hx509 context.
219 * @param tbs object to be signed.
220 * @param principal Kerberos principal to add to the certificate.
221 *
222 * @return An hx509 error code, see hx509_get_error_string().
223 *
224 * @ingroup hx509_ca
225 */
226
227int
228hx509_ca_tbs_add_san_pkinit (
229 hx509_context /*context*/,
230 hx509_ca_tbs /*tbs*/,
231 const char */*principal*/);
232
233/**
234 * Add a Subject Alternative Name rfc822 (email address) to
235 * to-be-signed certificate object.
236 *
237 * @param context A hx509 context.
238 * @param tbs object to be signed.
239 * @param rfc822Name a string to a email address.
240 *
241 * @return An hx509 error code, see hx509_get_error_string().
242 *
243 * @ingroup hx509_ca
244 */
245
246int
247hx509_ca_tbs_add_san_rfc822name (
248 hx509_context /*context*/,
249 hx509_ca_tbs /*tbs*/,
250 const char */*rfc822Name*/);
251
252/**
253 * Free an To Be Signed object.
254 *
255 * @param tbs object to free.
256 *
257 * @ingroup hx509_ca
258 */
259
260void
261hx509_ca_tbs_free (hx509_ca_tbs */*tbs*/);
262
263/**
264 * Allocate an to-be-signed certificate object that will be converted
265 * into an certificate.
266 *
267 * @param context A hx509 context.
268 * @param tbs returned to-be-signed certicate object, free with
269 * hx509_ca_tbs_free().
270 *
271 * @return An hx509 error code, see hx509_get_error_string().
272 *
273 * @ingroup hx509_ca
274 */
275
276int
277hx509_ca_tbs_init (
278 hx509_context /*context*/,
279 hx509_ca_tbs */*tbs*/);
280
281/**
282 * Make the to-be-signed certificate object a CA certificate. If the
283 * pathLenConstraint is negative path length constraint is used.
284 *
285 * @param context A hx509 context.
286 * @param tbs object to be signed.
287 * @param pathLenConstraint path length constraint, negative, no
288 * constraint.
289 *
290 * @return An hx509 error code, see hx509_get_error_string().
291 *
292 * @ingroup hx509_ca
293 */
294
295int
296hx509_ca_tbs_set_ca (
297 hx509_context /*context*/,
298 hx509_ca_tbs /*tbs*/,
299 int /*pathLenConstraint*/);
300
301/**
302 * Make the to-be-signed certificate object a windows domain controller certificate.
303 *
304 * @param context A hx509 context.
305 * @param tbs object to be signed.
306 *
307 * @return An hx509 error code, see hx509_get_error_string().
308 *
309 * @ingroup hx509_ca
310 */
311
312int
313hx509_ca_tbs_set_domaincontroller (
314 hx509_context /*context*/,
315 hx509_ca_tbs /*tbs*/);
316
317/**
318 * Set the absolute time when the certificate is valid to.
319 *
320 * @param context A hx509 context.
321 * @param tbs object to be signed.
322 * @param t time when the certificate will expire
323 *
324 * @return An hx509 error code, see hx509_get_error_string().
325 *
326 * @ingroup hx509_ca
327 */
328
329int
330hx509_ca_tbs_set_notAfter (
331 hx509_context /*context*/,
332 hx509_ca_tbs /*tbs*/,
333 time_t /*t*/);
334
335/**
336 * Set the relative time when the certificiate is going to expire.
337 *
338 * @param context A hx509 context.
339 * @param tbs object to be signed.
340 * @param delta seconds to the certificate is going to expire.
341 *
342 * @return An hx509 error code, see hx509_get_error_string().
343 *
344 * @ingroup hx509_ca
345 */
346
347int
348hx509_ca_tbs_set_notAfter_lifetime (
349 hx509_context /*context*/,
350 hx509_ca_tbs /*tbs*/,
351 time_t /*delta*/);
352
353/**
354 * Set the absolute time when the certificate is valid from. If not
355 * set the current time will be used.
356 *
357 * @param context A hx509 context.
358 * @param tbs object to be signed.
359 * @param t time the certificated will start to be valid
360 *
361 * @return An hx509 error code, see hx509_get_error_string().
362 *
363 * @ingroup hx509_ca
364 */
365
366int
367hx509_ca_tbs_set_notBefore (
368 hx509_context /*context*/,
369 hx509_ca_tbs /*tbs*/,
370 time_t /*t*/);
371
372/**
373 * Make the to-be-signed certificate object a proxy certificate. If the
374 * pathLenConstraint is negative path length constraint is used.
375 *
376 * @param context A hx509 context.
377 * @param tbs object to be signed.
378 * @param pathLenConstraint path length constraint, negative, no
379 * constraint.
380 *
381 * @return An hx509 error code, see hx509_get_error_string().
382 *
383 * @ingroup hx509_ca
384 */
385
386int
387hx509_ca_tbs_set_proxy (
388 hx509_context /*context*/,
389 hx509_ca_tbs /*tbs*/,
390 int /*pathLenConstraint*/);
391
392/**
393 * Set the serial number to use for to-be-signed certificate object.
394 *
395 * @param context A hx509 context.
396 * @param tbs object to be signed.
397 * @param serialNumber serial number to use for the to-be-signed
398 * certificate object.
399 *
400 * @return An hx509 error code, see hx509_get_error_string().
401 *
402 * @ingroup hx509_ca
403 */
404
405int
406hx509_ca_tbs_set_serialnumber (
407 hx509_context /*context*/,
408 hx509_ca_tbs /*tbs*/,
409 const heim_integer */*serialNumber*/);
410
411/**
412 * Set signature algorithm on the to be signed certificate
413 *
414 * @param context A hx509 context.
415 * @param tbs object to be signed.
416 * @param sigalg signature algorithm to use
417 *
418 * @return An hx509 error code, see hx509_get_error_string().
419 *
420 * @ingroup hx509_ca
421 */
422
423int
424hx509_ca_tbs_set_signature_algorithm (
425 hx509_context /*context*/,
426 hx509_ca_tbs /*tbs*/,
427 const AlgorithmIdentifier */*sigalg*/);
428
429/**
430 * Set the subject public key info (SPKI) in the to-be-signed certificate
431 * object. SPKI is the public key and key related parameters in the
432 * certificate.
433 *
434 * @param context A hx509 context.
435 * @param tbs object to be signed.
436 * @param spki subject public key info to use for the to-be-signed certificate object.
437 *
438 * @return An hx509 error code, see hx509_get_error_string().
439 *
440 * @ingroup hx509_ca
441 */
442
443int
444hx509_ca_tbs_set_spki (
445 hx509_context /*context*/,
446 hx509_ca_tbs /*tbs*/,
447 const SubjectPublicKeyInfo */*spki*/);
448
449/**
450 * Set the subject name of a to-be-signed certificate object.
451 *
452 * @param context A hx509 context.
453 * @param tbs object to be signed.
454 * @param subject the name to set a subject.
455 *
456 * @return An hx509 error code, see hx509_get_error_string().
457 *
458 * @ingroup hx509_ca
459 */
460
461int
462hx509_ca_tbs_set_subject (
463 hx509_context /*context*/,
464 hx509_ca_tbs /*tbs*/,
465 hx509_name /*subject*/);
466
467/**
468 * Initialize the to-be-signed certificate object from a template certifiate.
469 *
470 * @param context A hx509 context.
471 * @param tbs object to be signed.
472 * @param flags bit field selecting what to copy from the template
473 * certifiate.
474 * @param cert template certificate.
475 *
476 * @return An hx509 error code, see hx509_get_error_string().
477 *
478 * @ingroup hx509_ca
479 */
480
481int
482hx509_ca_tbs_set_template (
483 hx509_context /*context*/,
484 hx509_ca_tbs /*tbs*/,
485 int /*flags*/,
486 hx509_cert /*cert*/);
487
488/**
489 * Set the issuerUniqueID and subjectUniqueID
490 *
491 * These are only supposed to be used considered with version 2
492 * certificates, replaced by the two extensions SubjectKeyIdentifier
493 * and IssuerKeyIdentifier. This function is to allow application
494 * using legacy protocol to issue them.
495 *
496 * @param context A hx509 context.
497 * @param tbs object to be signed.
498 * @param issuerUniqueID to be set
499 * @param subjectUniqueID to be set
500 *
501 * @return An hx509 error code, see hx509_get_error_string().
502 *
503 * @ingroup hx509_ca
504 */
505
506int
507hx509_ca_tbs_set_unique (
508 hx509_context /*context*/,
509 hx509_ca_tbs /*tbs*/,
510 const heim_bit_string */*subjectUniqueID*/,
511 const heim_bit_string */*issuerUniqueID*/);
512
513/**
514 * Expand the the subject name in the to-be-signed certificate object
515 * using hx509_name_expand().
516 *
517 * @param context A hx509 context.
518 * @param tbs object to be signed.
519 * @param env environment variable to expand variables in the subject
520 * name, see hx509_env_init().
521 *
522 * @return An hx509 error code, see hx509_get_error_string().
523 *
524 * @ingroup hx509_ca
525 */
526
527int
528hx509_ca_tbs_subject_expand (
529 hx509_context /*context*/,
530 hx509_ca_tbs /*tbs*/,
531 hx509_env /*env*/);
532
533/**
534 * Make of template units, use to build flags argument to
535 * hx509_ca_tbs_set_template() with parse_units().
536 *
537 * @return an units structure.
538 *
539 * @ingroup hx509_ca
540 */
541
542const struct units *
543hx509_ca_tbs_template_units (void);
544
545/**
546 * Encodes the hx509 certificate as a DER encode binary.
547 *
548 * @param context A hx509 context.
549 * @param c the certificate to encode.
550 * @param os the encode certificate, set to NULL, 0 on case of
551 * error. Free the os->data with hx509_xfree().
552 *
553 * @return An hx509 error code, see hx509_get_error_string().
554 *
555 * @ingroup hx509_cert
556 */
557
558int
559hx509_cert_binary (
560 hx509_context /*context*/,
561 hx509_cert /*c*/,
562 heim_octet_string */*os*/);
563
564/**
565 * Check the extended key usage on the hx509 certificate.
566 *
567 * @param context A hx509 context.
568 * @param cert A hx509 context.
569 * @param eku the EKU to check for
570 * @param allow_any_eku if the any EKU is set, allow that to be a
571 * substitute.
572 *
573 * @return An hx509 error code, see hx509_get_error_string().
574 *
575 * @ingroup hx509_cert
576 */
577
578int
579hx509_cert_check_eku (
580 hx509_context /*context*/,
581 hx509_cert /*cert*/,
582 const heim_oid */*eku*/,
583 int /*allow_any_eku*/);
584
585/**
586 * Compare to hx509 certificate object, useful for sorting.
587 *
588 * @param p a hx509 certificate object.
589 * @param q a hx509 certificate object.
590 *
591 * @return 0 the objects are the same, returns > 0 is p is "larger"
592 * then q, < 0 if p is "smaller" then q.
593 *
594 * @ingroup hx509_cert
595 */
596
597int
598hx509_cert_cmp (
599 hx509_cert /*p*/,
600 hx509_cert /*q*/);
601
602/**
603 * Return a list of subjectAltNames specified by oid in the
604 * certificate. On error the
605 *
606 * The returned list of octet string should be freed with
607 * hx509_free_octet_string_list().
608 *
609 * @param context A hx509 context.
610 * @param cert a hx509 certificate object.
611 * @param oid an oid to for SubjectAltName.
612 * @param list list of matching SubjectAltName.
613 *
614 * @return An hx509 error code, see hx509_get_error_string().
615 *
616 * @ingroup hx509_cert
617 */
618
619int
620hx509_cert_find_subjectAltName_otherName (
621 hx509_context /*context*/,
622 hx509_cert /*cert*/,
623 const heim_oid */*oid*/,
624 hx509_octet_string_list */*list*/);
625
626/**
627 * Free reference to the hx509 certificate object, if the refcounter
628 * reaches 0, the object if freed. Its allowed to pass in NULL.
629 *
630 * @param cert the cert to free.
631 *
632 * @ingroup hx509_cert
633 */
634
635void
636hx509_cert_free (hx509_cert /*cert*/);
637
638/**
639 * Get the SubjectPublicKeyInfo structure from the hx509 certificate.
640 *
641 * @param context a hx509 context.
642 * @param p a hx509 certificate object.
643 * @param spki SubjectPublicKeyInfo, should be freed with
644 * free_SubjectPublicKeyInfo().
645 *
646 * @return An hx509 error code, see hx509_get_error_string().
647 *
648 * @ingroup hx509_cert
649 */
650
651int
652hx509_cert_get_SPKI (
653 hx509_context /*context*/,
654 hx509_cert /*p*/,
655 SubjectPublicKeyInfo */*spki*/);
656
657/**
658 * Get the AlgorithmIdentifier from the hx509 certificate.
659 *
660 * @param context a hx509 context.
661 * @param p a hx509 certificate object.
662 * @param alg AlgorithmIdentifier, should be freed with
663 * free_AlgorithmIdentifier(). The algorithmidentifier is
664 * typicly rsaEncryption, or id-ecPublicKey, or some other
665 * public key mechanism.
666 *
667 * @return An hx509 error code, see hx509_get_error_string().
668 *
669 * @ingroup hx509_cert
670 */
671
672int
673hx509_cert_get_SPKI_AlgorithmIdentifier (
674 hx509_context /*context*/,
675 hx509_cert /*p*/,
676 AlgorithmIdentifier */*alg*/);
677
678/**
679 * Get an external attribute for the certificate, examples are
680 * friendly name and id.
681 *
682 * @param cert hx509 certificate object to search
683 * @param oid an oid to search for.
684 *
685 * @return an hx509_cert_attribute, only valid as long as the
686 * certificate is referenced.
687 *
688 * @ingroup hx509_cert
689 */
690
691hx509_cert_attribute
692hx509_cert_get_attribute (
693 hx509_cert /*cert*/,
694 const heim_oid */*oid*/);
695
696/**
697 * Return the name of the base subject of the hx509 certificate. If
698 * the certiicate is a verified proxy certificate, the this function
699 * return the base certificate (root of the proxy chain). If the proxy
700 * certificate is not verified with the base certificate
701 * HX509_PROXY_CERTIFICATE_NOT_CANONICALIZED is returned.
702 *
703 * @param context a hx509 context.
704 * @param c a hx509 certificate object.
705 * @param name a pointer to a hx509 name, should be freed by
706 * hx509_name_free(). See also hx509_cert_get_subject().
707 *
708 * @return An hx509 error code, see hx509_get_error_string().
709 *
710 * @ingroup hx509_cert
711 */
712
713int
714hx509_cert_get_base_subject (
715 hx509_context /*context*/,
716 hx509_cert /*c*/,
717 hx509_name */*name*/);
718
719/**
720 * Get friendly name of the certificate.
721 *
722 * @param cert cert to get the friendly name from.
723 *
724 * @return an friendly name or NULL if there is. The friendly name is
725 * only valid as long as the certificate is referenced.
726 *
727 * @ingroup hx509_cert
728 */
729
730const char *
731hx509_cert_get_friendly_name (hx509_cert /*cert*/);
732
733/**
734 * Return the name of the issuer of the hx509 certificate.
735 *
736 * @param p a hx509 certificate object.
737 * @param name a pointer to a hx509 name, should be freed by
738 * hx509_name_free().
739 *
740 * @return An hx509 error code, see hx509_get_error_string().
741 *
742 * @ingroup hx509_cert
743 */
744
745int
746hx509_cert_get_issuer (
747 hx509_cert /*p*/,
748 hx509_name */*name*/);
749
750/**
751 * Get a copy of the Issuer Unique ID
752 *
753 * @param context a hx509_context
754 * @param p a hx509 certificate
755 * @param issuer the issuer id returned, free with der_free_bit_string()
756 *
757 * @return An hx509 error code, see hx509_get_error_string(). The
758 * error code HX509_EXTENSION_NOT_FOUND is returned if the certificate
759 * doesn't have a issuerUniqueID
760 *
761 * @ingroup hx509_cert
762 */
763
764int
765hx509_cert_get_issuer_unique_id (
766 hx509_context /*context*/,
767 hx509_cert /*p*/,
768 heim_bit_string */*issuer*/);
769
770/**
771 * Get notAfter time of the certificate.
772 *
773 * @param p a hx509 certificate object.
774 *
775 * @return return not after time.
776 *
777 * @ingroup hx509_cert
778 */
779
780time_t
781hx509_cert_get_notAfter (hx509_cert /*p*/);
782
783/**
784 * Get notBefore time of the certificate.
785 *
786 * @param p a hx509 certificate object.
787 *
788 * @return return not before time
789 *
790 * @ingroup hx509_cert
791 */
792
793time_t
794hx509_cert_get_notBefore (hx509_cert /*p*/);
795
796/**
797 * Get serial number of the certificate.
798 *
799 * @param p a hx509 certificate object.
800 * @param i serial number, should be freed ith der_free_heim_integer().
801 *
802 * @return An hx509 error code, see hx509_get_error_string().
803 *
804 * @ingroup hx509_cert
805 */
806
807int
808hx509_cert_get_serialnumber (
809 hx509_cert /*p*/,
810 heim_integer */*i*/);
811
812/**
813 * Return the name of the subject of the hx509 certificate.
814 *
815 * @param p a hx509 certificate object.
816 * @param name a pointer to a hx509 name, should be freed by
817 * hx509_name_free(). See also hx509_cert_get_base_subject().
818 *
819 * @return An hx509 error code, see hx509_get_error_string().
820 *
821 * @ingroup hx509_cert
822 */
823
824int
825hx509_cert_get_subject (
826 hx509_cert /*p*/,
827 hx509_name */*name*/);
828
829/**
830 * Get a copy of the Subect Unique ID
831 *
832 * @param context a hx509_context
833 * @param p a hx509 certificate
834 * @param subject the subject id returned, free with der_free_bit_string()
835 *
836 * @return An hx509 error code, see hx509_get_error_string(). The
837 * error code HX509_EXTENSION_NOT_FOUND is returned if the certificate
838 * doesn't have a subjectUniqueID
839 *
840 * @ingroup hx509_cert
841 */
842
843int
844hx509_cert_get_subject_unique_id (
845 hx509_context /*context*/,
846 hx509_cert /*p*/,
847 heim_bit_string */*subject*/);
848
849int
850hx509_cert_have_private_key (hx509_cert /*p*/);
851
852/**
853 * Allocate and init an hx509 certificate object from the decoded
854 * certificate `c´.
855 *
856 * @param context A hx509 context.
857 * @param c
858 * @param error
859 *
860 * @return Returns an hx509 certificate
861 *
862 * @ingroup hx509_cert
863 */
864
865hx509_cert
866hx509_cert_init (
867 hx509_context /*context*/,
868 const Certificate */*c*/,
869 heim_error_t */*error*/);
870
871/**
872 * Just like hx509_cert_init(), but instead of a decode certificate
873 * takes an pointer and length to a memory region that contains a
874 * DER/BER encoded certificate.
875 *
876 * If the memory region doesn't contain just the certificate and
877 * nothing more the function will fail with
878 * HX509_EXTRA_DATA_AFTER_STRUCTURE.
879 *
880 * @param context A hx509 context.
881 * @param ptr pointer to memory region containing encoded certificate.
882 * @param len length of memory region.
883 * @param error possibly returns an error
884 *
885 * @return An hx509 certificate
886 *
887 * @ingroup hx509_cert
888 */
889
890hx509_cert
891hx509_cert_init_data (
892 hx509_context /*context*/,
893 const void */*ptr*/,
894 size_t /*len*/,
895 heim_error_t */*error*/);
896
897/**
898 * Print certificate usage for a certificate to a string.
899 *
900 * @param context A hx509 context.
901 * @param c a certificate print the keyusage for.
902 * @param s the return string with the keysage printed in to, free
903 * with hx509_xfree().
904 *
905 * @return An hx509 error code, see hx509_get_error_string().
906 *
907 * @ingroup hx509_print
908 */
909
910int
911hx509_cert_keyusage_print (
912 hx509_context /*context*/,
913 hx509_cert /*c*/,
914 char **/*s*/);
915
916int
917hx509_cert_public_encrypt (
918 hx509_context /*context*/,
919 const heim_octet_string */*cleartext*/,
920 const hx509_cert /*p*/,
921 heim_oid */*encryption_oid*/,
922 heim_octet_string */*ciphertext*/);
923
924/**
925 * Add a reference to a hx509 certificate object.
926 *
927 * @param cert a pointer to an hx509 certificate object.
928 *
929 * @return the same object as is passed in.
930 *
931 * @ingroup hx509_cert
932 */
933
934hx509_cert
935hx509_cert_ref (hx509_cert /*cert*/);
936
937/**
938 * Set the friendly name on the certificate.
939 *
940 * @param cert The certificate to set the friendly name on
941 * @param name Friendly name.
942 *
943 * @return An hx509 error code, see hx509_get_error_string().
944 *
945 * @ingroup hx509_cert
946 */
947
948int
949hx509_cert_set_friendly_name (
950 hx509_cert /*cert*/,
951 const char */*name*/);
952
953/**
954 * Add a certificate to the certificiate store.
955 *
956 * The receiving keyset certs will either increase reference counter
957 * of the cert or make a deep copy, either way, the caller needs to
958 * free the cert itself.
959 *
960 * @param context a hx509 context.
961 * @param certs certificate store to add the certificate to.
962 * @param cert certificate to add.
963 *
964 * @return Returns an hx509 error code.
965 *
966 * @ingroup hx509_keyset
967 */
968
969int
970hx509_certs_add (
971 hx509_context /*context*/,
972 hx509_certs /*certs*/,
973 hx509_cert /*cert*/);
974
975/**
976 * Same a hx509_certs_merge() but use a lock and name to describe the
977 * from source.
978 *
979 * @param context a hx509 context.
980 * @param to the store to merge into.
981 * @param lock a lock that unlocks the certificates store, use NULL to
982 * select no password/certifictes/prompt lock (see @ref page_lock).
983 * @param name name of the source store
984 *
985 * @return Returns an hx509 error code.
986 *
987 * @ingroup hx509_keyset
988 */
989
990int
991hx509_certs_append (
992 hx509_context /*context*/,
993 hx509_certs /*to*/,
994 hx509_lock /*lock*/,
995 const char */*name*/);
996
997/**
998 * End the iteration over certificates.
999 *
1000 * @param context a hx509 context.
1001 * @param certs certificate store to iterate over.
1002 * @param cursor cursor that will keep track of progress, freed.
1003 *
1004 * @return Returns an hx509 error code.
1005 *
1006 * @ingroup hx509_keyset
1007 */
1008
1009int
1010hx509_certs_end_seq (
1011 hx509_context /*context*/,
1012 hx509_certs /*certs*/,
1013 hx509_cursor /*cursor*/);
1014
1015/**
1016 * Filter certificate matching the query.
1017 *
1018 * @param context a hx509 context.
1019 * @param certs certificate store to search.
1020 * @param q query allocated with @ref hx509_query functions.
1021 * @param result the filtered certificate store, caller must free with
1022 * hx509_certs_free().
1023 *
1024 * @return Returns an hx509 error code.
1025 *
1026 * @ingroup hx509_keyset
1027 */
1028
1029int
1030hx509_certs_filter (
1031 hx509_context /*context*/,
1032 hx509_certs /*certs*/,
1033 const hx509_query */*q*/,
1034 hx509_certs */*result*/);
1035
1036/**
1037 * Find a certificate matching the query.
1038 *
1039 * @param context a hx509 context.
1040 * @param certs certificate store to search.
1041 * @param q query allocated with @ref hx509_query functions.
1042 * @param r return certificate (or NULL on error), should be freed
1043 * with hx509_cert_free().
1044 *
1045 * @return Returns an hx509 error code.
1046 *
1047 * @ingroup hx509_keyset
1048 */
1049
1050int
1051hx509_certs_find (
1052 hx509_context /*context*/,
1053 hx509_certs /*certs*/,
1054 const hx509_query */*q*/,
1055 hx509_cert */*r*/);
1056
1057/**
1058 * Free a certificate store.
1059 *
1060 * @param certs certificate store to free.
1061 *
1062 * @ingroup hx509_keyset
1063 */
1064
1065void
1066hx509_certs_free (hx509_certs */*certs*/);
1067
1068/**
1069 * Print some info about the certificate store.
1070 *
1071 * @param context a hx509 context.
1072 * @param certs certificate store to print information about.
1073 * @param func function that will get each line of the information, if
1074 * NULL is used the data is printed on a FILE descriptor that should
1075 * be passed in ctx, if ctx also is NULL, stdout is used.
1076 * @param ctx parameter to func.
1077 *
1078 * @return Returns an hx509 error code.
1079 *
1080 * @ingroup hx509_keyset
1081 */
1082
1083int
1084hx509_certs_info (
1085 hx509_context /*context*/,
1086 hx509_certs /*certs*/,
1087 int (*/*func*/)(void *, const char *),
1088 void */*ctx*/);
1089
1090/**
1091 * Open or creates a new hx509 certificate store.
1092 *
1093 * @param context A hx509 context
1094 * @param name name of the store, format is TYPE:type-specific-string,
1095 * if NULL is used the MEMORY store is used.
1096 * @param flags list of flags:
1097 * - HX509_CERTS_CREATE create a new keystore of the specific TYPE.
1098 * - HX509_CERTS_UNPROTECT_ALL fails if any private key failed to be extracted.
1099 * @param lock a lock that unlocks the certificates store, use NULL to
1100 * select no password/certifictes/prompt lock (see @ref page_lock).
1101 * @param certs return pointer, free with hx509_certs_free().
1102 *
1103 * @return Returns an hx509 error code.
1104 *
1105 * @ingroup hx509_keyset
1106 */
1107
1108int
1109hx509_certs_init (
1110 hx509_context /*context*/,
1111 const char */*name*/,
1112 int /*flags*/,
1113 hx509_lock /*lock*/,
1114 hx509_certs */*certs*/);
1115
1116/**
1117 * Iterate over all certificates in a keystore and call a block
1118 * for each of them.
1119 *
1120 * @param context a hx509 context.
1121 * @param certs certificate store to iterate over.
1122 * @param func block to call for each certificate. The function
1123 * should return non-zero to abort the iteration, that value is passed
1124 * back to the caller of hx509_certs_iter().
1125 *
1126 * @return Returns an hx509 error code.
1127 *
1128 * @ingroup hx509_keyset
1129 */
1130
1131#ifdef __BLOCKS__
1132int
1133hx509_certs_iter (
1134 hx509_context /*context*/,
1135 hx509_certs /*certs*/,
1136 int (^func)(hx509_cert));
1137#endif /* __BLOCKS__ */
1138
1139/**
1140 * Iterate over all certificates in a keystore and call a function
1141 * for each of them.
1142 *
1143 * @param context a hx509 context.
1144 * @param certs certificate store to iterate over.
1145 * @param func function to call for each certificate. The function
1146 * should return non-zero to abort the iteration, that value is passed
1147 * back to the caller of hx509_certs_iter_f().
1148 * @param ctx context variable that will passed to the function.
1149 *
1150 * @return Returns an hx509 error code.
1151 *
1152 * @ingroup hx509_keyset
1153 */
1154
1155int
1156hx509_certs_iter_f (
1157 hx509_context /*context*/,
1158 hx509_certs /*certs*/,
1159 int (*/*func*/)(hx509_context, void *, hx509_cert),
1160 void */*ctx*/);
1161
1162/**
1163 * Merge a certificate store into another. The from store is keep
1164 * intact.
1165 *
1166 * @param context a hx509 context.
1167 * @param to the store to merge into.
1168 * @param from the store to copy the object from.
1169 *
1170 * @return Returns an hx509 error code.
1171 *
1172 * @ingroup hx509_keyset
1173 */
1174
1175int
1176hx509_certs_merge (
1177 hx509_context /*context*/,
1178 hx509_certs /*to*/,
1179 hx509_certs /*from*/);
1180
1181/**
1182 * Get next ceritificate from the certificate keystore pointed out by
1183 * cursor.
1184 *
1185 * @param context a hx509 context.
1186 * @param certs certificate store to iterate over.
1187 * @param cursor cursor that keeps track of progress.
1188 * @param cert return certificate next in store, NULL if the store
1189 * contains no more certificates. Free with hx509_cert_free().
1190 *
1191 * @return Returns an hx509 error code.
1192 *
1193 * @ingroup hx509_keyset
1194 */
1195
1196int
1197hx509_certs_next_cert (
1198 hx509_context /*context*/,
1199 hx509_certs /*certs*/,
1200 hx509_cursor /*cursor*/,
1201 hx509_cert */*cert*/);
1202
1203hx509_certs
1204hx509_certs_ref (hx509_certs /*certs*/);
1205
1206/**
1207 * Start the integration
1208 *
1209 * @param context a hx509 context.
1210 * @param certs certificate store to iterate over
1211 * @param cursor cursor that will keep track of progress, free with
1212 * hx509_certs_end_seq().
1213 *
1214 * @return Returns an hx509 error code. HX509_UNSUPPORTED_OPERATION is
1215 * returned if the certificate store doesn't support the iteration
1216 * operation.
1217 *
1218 * @ingroup hx509_keyset
1219 */
1220
1221int
1222hx509_certs_start_seq (
1223 hx509_context /*context*/,
1224 hx509_certs /*certs*/,
1225 hx509_cursor */*cursor*/);
1226
1227/**
1228 * Write the certificate store to stable storage.
1229 *
1230 * @param context A hx509 context.
1231 * @param certs a certificate store to store.
1232 * @param flags currently unused, use 0.
1233 * @param lock a lock that unlocks the certificates store, use NULL to
1234 * select no password/certifictes/prompt lock (see @ref page_lock).
1235 *
1236 * @return Returns an hx509 error code. HX509_UNSUPPORTED_OPERATION if
1237 * the certificate store doesn't support the store operation.
1238 *
1239 * @ingroup hx509_keyset
1240 */
1241
1242int
1243hx509_certs_store (
1244 hx509_context /*context*/,
1245 hx509_certs /*certs*/,
1246 int /*flags*/,
1247 hx509_lock /*lock*/);
1248
1249/**
1250 * Function to use to hx509_certs_iter_f() as a function argument, the
1251 * ctx variable to hx509_certs_iter_f() should be a FILE file descriptor.
1252 *
1253 * @param context a hx509 context.
1254 * @param ctx used by hx509_certs_iter_f().
1255 * @param c a certificate
1256 *
1257 * @return Returns an hx509 error code.
1258 *
1259 * @ingroup hx509_keyset
1260 */
1261
1262int
1263hx509_ci_print_names (
1264 hx509_context /*context*/,
1265 void */*ctx*/,
1266 hx509_cert /*c*/);
1267
1268/**
1269 * Resets the error strings the hx509 context.
1270 *
1271 * @param context A hx509 context.
1272 *
1273 * @ingroup hx509_error
1274 */
1275
1276void
1277hx509_clear_error_string (hx509_context /*context*/);
1278
1279int
1280hx509_cms_create_signed (
1281 hx509_context /*context*/,
1282 int /*flags*/,
1283 const heim_oid */*eContentType*/,
1284 const void */*data*/,
1285 size_t /*length*/,
1286 const AlgorithmIdentifier */*digest_alg*/,
1287 hx509_certs /*certs*/,
1288 hx509_peer_info /*peer*/,
1289 hx509_certs /*anchors*/,
1290 hx509_certs /*pool*/,
1291 heim_octet_string */*signed_data*/);
1292
1293/**
1294 * Decode SignedData and verify that the signature is correct.
1295 *
1296 * @param context A hx509 context.
1297 * @param flags
1298 * @param eContentType the type of the data.
1299 * @param data data to sign
1300 * @param length length of the data that data point to.
1301 * @param digest_alg digest algorithm to use, use NULL to get the
1302 * default or the peer determined algorithm.
1303 * @param cert certificate to use for sign the data.
1304 * @param peer info about the peer the message to send the message to,
1305 * like what digest algorithm to use.
1306 * @param anchors trust anchors that the client will use, used to
1307 * polulate the certificates included in the message
1308 * @param pool certificates to use in try to build the path to the
1309 * trust anchors.
1310 * @param signed_data the output of the function, free with
1311 * der_free_octet_string().
1312 *
1313 * @return Returns an hx509 error code.
1314 *
1315 * @ingroup hx509_cms
1316 */
1317
1318int
1319hx509_cms_create_signed_1 (
1320 hx509_context /*context*/,
1321 int /*flags*/,
1322 const heim_oid */*eContentType*/,
1323 const void */*data*/,
1324 size_t /*length*/,
1325 const AlgorithmIdentifier */*digest_alg*/,
1326 hx509_cert /*cert*/,
1327 hx509_peer_info /*peer*/,
1328 hx509_certs /*anchors*/,
1329 hx509_certs /*pool*/,
1330 heim_octet_string */*signed_data*/);
1331
1332/**
1333 * Use HX509_CMS_SIGNATURE_NO_SIGNER to create no sigInfo (no
1334 * signatures).
1335 */
1336
1337int
1338hx509_cms_decrypt_encrypted (
1339 hx509_context /*context*/,
1340 hx509_lock /*lock*/,
1341 const void */*data*/,
1342 size_t /*length*/,
1343 heim_oid */*contentType*/,
1344 heim_octet_string */*content*/);
1345
1346/**
1347 * Encrypt end encode EnvelopedData.
1348 *
1349 * Encrypt and encode EnvelopedData. The data is encrypted with a
1350 * random key and the the random key is encrypted with the
1351 * certificates private key. This limits what private key type can be
1352 * used to RSA.
1353 *
1354 * @param context A hx509 context.
1355 * @param flags flags to control the behavior.
1356 * - HX509_CMS_EV_NO_KU_CHECK - Dont check KU on certificate
1357 * - HX509_CMS_EV_ALLOW_WEAK - Allow weak crytpo
1358 * - HX509_CMS_EV_ID_NAME - prefer issuer name and serial number
1359 * @param cert Certificate to encrypt the EnvelopedData encryption key
1360 * with.
1361 * @param data pointer the data to encrypt.
1362 * @param length length of the data that data point to.
1363 * @param encryption_type Encryption cipher to use for the bulk data,
1364 * use NULL to get default.
1365 * @param contentType type of the data that is encrypted
1366 * @param content the output of the function,
1367 * free with der_free_octet_string().
1368 *
1369 * @return an hx509 error code.
1370 *
1371 * @ingroup hx509_cms
1372 */
1373
1374int
1375hx509_cms_envelope_1 (
1376 hx509_context /*context*/,
1377 int /*flags*/,
1378 hx509_cert /*cert*/,
1379 const void */*data*/,
1380 size_t /*length*/,
1381 const heim_oid */*encryption_type*/,
1382 const heim_oid */*contentType*/,
1383 heim_octet_string */*content*/);
1384
1385/**
1386 * Decode and unencrypt EnvelopedData.
1387 *
1388 * Extract data and parameteres from from the EnvelopedData. Also
1389 * supports using detached EnvelopedData.
1390 *
1391 * @param context A hx509 context.
1392 * @param certs Certificate that can decrypt the EnvelopedData
1393 * encryption key.
1394 * @param flags HX509_CMS_UE flags to control the behavior.
1395 * @param data pointer the structure the contains the DER/BER encoded
1396 * EnvelopedData stucture.
1397 * @param length length of the data that data point to.
1398 * @param encryptedContent in case of detached signature, this
1399 * contains the actual encrypted data, othersize its should be NULL.
1400 * @param time_now set the current time, if zero the library uses now as the date.
1401 * @param contentType output type oid, should be freed with der_free_oid().
1402 * @param content the data, free with der_free_octet_string().
1403 *
1404 * @return an hx509 error code.
1405 *
1406 * @ingroup hx509_cms
1407 */
1408
1409int
1410hx509_cms_unenvelope (
1411 hx509_context /*context*/,
1412 hx509_certs /*certs*/,
1413 int /*flags*/,
1414 const void */*data*/,
1415 size_t /*length*/,
1416 const heim_octet_string */*encryptedContent*/,
1417 time_t /*time_now*/,
1418 heim_oid */*contentType*/,
1419 heim_octet_string */*content*/);
1420
1421/**
1422 * Decode an ContentInfo and unwrap data and oid it.
1423 *
1424 * @param in the encoded buffer.
1425 * @param oid type of the content.
1426 * @param out data to be wrapped.
1427 * @param have_data since the data is optional, this flags show dthe
1428 * diffrence between no data and the zero length data.
1429 *
1430 * @return Returns an hx509 error code.
1431 *
1432 * @ingroup hx509_cms
1433 */
1434
1435int
1436hx509_cms_unwrap_ContentInfo (
1437 const heim_octet_string */*in*/,
1438 heim_oid */*oid*/,
1439 heim_octet_string */*out*/,
1440 int */*have_data*/);
1441
1442/**
1443 * Decode SignedData and verify that the signature is correct.
1444 *
1445 * @param context A hx509 context.
1446 * @param ctx a hx509 verify context.
1447 * @param flags to control the behaivor of the function.
1448 * - HX509_CMS_VS_NO_KU_CHECK - Don't check KeyUsage
1449 * - HX509_CMS_VS_ALLOW_DATA_OID_MISMATCH - allow oid mismatch
1450 * - HX509_CMS_VS_ALLOW_ZERO_SIGNER - no signer, see below.
1451 * @param data pointer to CMS SignedData encoded data.
1452 * @param length length of the data that data point to.
1453 * @param signedContent external data used for signature.
1454 * @param pool certificate pool to build certificates paths.
1455 * @param contentType free with der_free_oid().
1456 * @param content the output of the function, free with
1457 * der_free_octet_string().
1458 * @param signer_certs list of the cerficates used to sign this
1459 * request, free with hx509_certs_free().
1460 *
1461 * @return an hx509 error code.
1462 *
1463 * @ingroup hx509_cms
1464 */
1465
1466int
1467hx509_cms_verify_signed (
1468 hx509_context /*context*/,
1469 hx509_verify_ctx /*ctx*/,
1470 unsigned int /*flags*/,
1471 const void */*data*/,
1472 size_t /*length*/,
1473 const heim_octet_string */*signedContent*/,
1474 hx509_certs /*pool*/,
1475 heim_oid */*contentType*/,
1476 heim_octet_string */*content*/,
1477 hx509_certs */*signer_certs*/);
1478
1479/**
1480 * Wrap data and oid in a ContentInfo and encode it.
1481 *
1482 * @param oid type of the content.
1483 * @param buf data to be wrapped. If a NULL pointer is passed in, the
1484 * optional content field in the ContentInfo is not going be filled
1485 * in.
1486 * @param res the encoded buffer, the result should be freed with
1487 * der_free_octet_string().
1488 *
1489 * @return Returns an hx509 error code.
1490 *
1491 * @ingroup hx509_cms
1492 */
1493
1494int
1495hx509_cms_wrap_ContentInfo (
1496 const heim_oid */*oid*/,
1497 const heim_octet_string */*buf*/,
1498 heim_octet_string */*res*/);
1499
1500/**
1501 * Free the context allocated by hx509_context_init().
1502 *
1503 * @param context context to be freed.
1504 *
1505 * @ingroup hx509
1506 */
1507
1508void
1509hx509_context_free (hx509_context */*context*/);
1510
1511/**
1512 * Creates a hx509 context that most functions in the library
1513 * uses. The context is only allowed to be used by one thread at each
1514 * moment. Free the context with hx509_context_free().
1515 *
1516 * @param context Returns a pointer to new hx509 context.
1517 *
1518 * @return Returns an hx509 error code.
1519 *
1520 * @ingroup hx509
1521 */
1522
1523int
1524hx509_context_init (hx509_context */*context*/);
1525
1526/**
1527 * Selects if the hx509_revoke_verify() function is going to require
1528 * the existans of a revokation method (OCSP, CRL) or not. Note that
1529 * hx509_verify_path(), hx509_cms_verify_signed(), and other function
1530 * call hx509_revoke_verify().
1531 *
1532 * @param context hx509 context to change the flag for.
1533 * @param flag zero, revokation method required, non zero missing
1534 * revokation method ok
1535 *
1536 * @ingroup hx509_verify
1537 */
1538
1539void
1540hx509_context_set_missing_revoke (
1541 hx509_context /*context*/,
1542 int /*flag*/);
1543
1544/**
1545 * Add revoked certificate to an CRL context.
1546 *
1547 * @param context a hx509 context.
1548 * @param crl the CRL to add the revoked certificate to.
1549 * @param certs keyset of certificate to revoke.
1550 *
1551 * @return An hx509 error code, see hx509_get_error_string().
1552 *
1553 * @ingroup hx509_verify
1554 */
1555
1556int
1557hx509_crl_add_revoked_certs (
1558 hx509_context /*context*/,
1559 hx509_crl /*crl*/,
1560 hx509_certs /*certs*/);
1561
1562/**
1563 * Create a CRL context. Use hx509_crl_free() to free the CRL context.
1564 *
1565 * @param context a hx509 context.
1566 * @param crl return pointer to a newly allocated CRL context.
1567 *
1568 * @return An hx509 error code, see hx509_get_error_string().
1569 *
1570 * @ingroup hx509_verify
1571 */
1572
1573int
1574hx509_crl_alloc (
1575 hx509_context /*context*/,
1576 hx509_crl */*crl*/);
1577
1578/**
1579 * Free a CRL context.
1580 *
1581 * @param context a hx509 context.
1582 * @param crl a CRL context to free.
1583 *
1584 * @ingroup hx509_verify
1585 */
1586
1587void
1588hx509_crl_free (
1589 hx509_context /*context*/,
1590 hx509_crl */*crl*/);
1591
1592/**
1593 * Set the lifetime of a CRL context.
1594 *
1595 * @param context a hx509 context.
1596 * @param crl a CRL context
1597 * @param delta delta time the certificate is valid, library adds the
1598 * current time to this.
1599 *
1600 * @return An hx509 error code, see hx509_get_error_string().
1601 *
1602 * @ingroup hx509_verify
1603 */
1604
1605int
1606hx509_crl_lifetime (
1607 hx509_context /*context*/,
1608 hx509_crl /*crl*/,
1609 int /*delta*/);
1610
1611/**
1612 * Sign a CRL and return an encode certificate.
1613 *
1614 * @param context a hx509 context.
1615 * @param signer certificate to sign the CRL with
1616 * @param crl the CRL to sign
1617 * @param os return the signed and encoded CRL, free with
1618 * free_heim_octet_string()
1619 *
1620 * @return An hx509 error code, see hx509_get_error_string().
1621 *
1622 * @ingroup hx509_verify
1623 */
1624
1625int
1626hx509_crl_sign (
1627 hx509_context /*context*/,
1628 hx509_cert /*signer*/,
1629 hx509_crl /*crl*/,
1630 heim_octet_string */*os*/);
1631
1632const AlgorithmIdentifier *
1633hx509_crypto_aes128_cbc (void);
1634
1635const AlgorithmIdentifier *
1636hx509_crypto_aes256_cbc (void);
1637
1638void
1639hx509_crypto_allow_weak (hx509_crypto /*crypto*/);
1640
1641int
1642hx509_crypto_available (
1643 hx509_context /*context*/,
1644 int /*type*/,
1645 hx509_cert /*source*/,
1646 AlgorithmIdentifier **/*val*/,
1647 unsigned int */*plen*/);
1648
1649int
1650hx509_crypto_decrypt (
1651 hx509_crypto /*crypto*/,
1652 const void */*data*/,
1653 const size_t /*length*/,
1654 heim_octet_string */*ivec*/,
1655 heim_octet_string */*clear*/);
1656
1657const AlgorithmIdentifier *
1658hx509_crypto_des_rsdi_ede3_cbc (void);
1659
1660void
1661hx509_crypto_destroy (hx509_crypto /*crypto*/);
1662
1663int
1664hx509_crypto_encrypt (
1665 hx509_crypto /*crypto*/,
1666 const void */*data*/,
1667 const size_t /*length*/,
1668 const heim_octet_string */*ivec*/,
1669 heim_octet_string **/*ciphertext*/);
1670
1671const heim_oid *
1672hx509_crypto_enctype_by_name (const char */*name*/);
1673
1674void
1675hx509_crypto_free_algs (
1676 AlgorithmIdentifier */*val*/,
1677 unsigned int /*len*/);
1678
1679int
1680hx509_crypto_get_params (
1681 hx509_context /*context*/,
1682 hx509_crypto /*crypto*/,
1683 const heim_octet_string */*ivec*/,
1684 heim_octet_string */*param*/);
1685
1686int
1687hx509_crypto_init (
1688 hx509_context /*context*/,
1689 const char */*provider*/,
1690 const heim_oid */*enctype*/,
1691 hx509_crypto */*crypto*/);
1692
1693const char *
1694hx509_crypto_provider (hx509_crypto /*crypto*/);
1695
1696int
1697hx509_crypto_random_iv (
1698 hx509_crypto /*crypto*/,
1699 heim_octet_string */*ivec*/);
1700
1701int
1702hx509_crypto_select (
1703 const hx509_context /*context*/,
1704 int /*type*/,
1705 const hx509_private_key /*source*/,
1706 hx509_peer_info /*peer*/,
1707 AlgorithmIdentifier */*selected*/);
1708
1709int
1710hx509_crypto_set_key_data (
1711 hx509_crypto /*crypto*/,
1712 const void */*data*/,
1713 size_t /*length*/);
1714
1715int
1716hx509_crypto_set_key_name (
1717 hx509_crypto /*crypto*/,
1718 const char */*name*/);
1719
1720void
1721hx509_crypto_set_padding (
1722 hx509_crypto /*crypto*/,
1723 int /*padding_type*/);
1724
1725int
1726hx509_crypto_set_params (
1727 hx509_context /*context*/,
1728 hx509_crypto /*crypto*/,
1729 const heim_octet_string */*param*/,
1730 heim_octet_string */*ivec*/);
1731
1732int
1733hx509_crypto_set_random_key (
1734 hx509_crypto /*crypto*/,
1735 heim_octet_string */*key*/);
1736
1737/**
1738 * Add a new key/value pair to the hx509_env.
1739 *
1740 * @param context A hx509 context.
1741 * @param env environment to add the environment variable too.
1742 * @param key key to add
1743 * @param value value to add
1744 *
1745 * @return An hx509 error code, see hx509_get_error_string().
1746 *
1747 * @ingroup hx509_env
1748 */
1749
1750int
1751hx509_env_add (
1752 hx509_context /*context*/,
1753 hx509_env */*env*/,
1754 const char */*key*/,
1755 const char */*value*/);
1756
1757/**
1758 * Add a new key/binding pair to the hx509_env.
1759 *
1760 * @param context A hx509 context.
1761 * @param env environment to add the environment variable too.
1762 * @param key key to add
1763 * @param list binding list to add
1764 *
1765 * @return An hx509 error code, see hx509_get_error_string().
1766 *
1767 * @ingroup hx509_env
1768 */
1769
1770int
1771hx509_env_add_binding (
1772 hx509_context /*context*/,
1773 hx509_env */*env*/,
1774 const char */*key*/,
1775 hx509_env /*list*/);
1776
1777/**
1778 * Search the hx509_env for a key.
1779 *
1780 * @param context A hx509 context.
1781 * @param env environment to add the environment variable too.
1782 * @param key key to search for.
1783 *
1784 * @return the value if the key is found, NULL otherwise.
1785 *
1786 * @ingroup hx509_env
1787 */
1788
1789const char *
1790hx509_env_find (
1791 hx509_context /*context*/,
1792 hx509_env /*env*/,
1793 const char */*key*/);
1794
1795/**
1796 * Search the hx509_env for a binding.
1797 *
1798 * @param context A hx509 context.
1799 * @param env environment to add the environment variable too.
1800 * @param key key to search for.
1801 *
1802 * @return the binding if the key is found, NULL if not found.
1803 *
1804 * @ingroup hx509_env
1805 */
1806
1807hx509_env
1808hx509_env_find_binding (
1809 hx509_context /*context*/,
1810 hx509_env /*env*/,
1811 const char */*key*/);
1812
1813/**
1814 * Free an hx509_env environment context.
1815 *
1816 * @param env the environment to free.
1817 *
1818 * @ingroup hx509_env
1819 */
1820
1821void
1822hx509_env_free (hx509_env */*env*/);
1823
1824/**
1825 * Search the hx509_env for a length based key.
1826 *
1827 * @param context A hx509 context.
1828 * @param env environment to add the environment variable too.
1829 * @param key key to search for.
1830 * @param len length of key.
1831 *
1832 * @return the value if the key is found, NULL otherwise.
1833 *
1834 * @ingroup hx509_env
1835 */
1836
1837const char *
1838hx509_env_lfind (
1839 hx509_context /*context*/,
1840 hx509_env /*env*/,
1841 const char */*key*/,
1842 size_t /*len*/);
1843
1844/**
1845 * Print error message and fatally exit from error code
1846 *
1847 * @param context A hx509 context.
1848 * @param exit_code exit() code from process.
1849 * @param error_code Error code for the reason to exit.
1850 * @param fmt format string with the exit message.
1851 * @param ... argument to format string.
1852 *
1853 * @ingroup hx509_error
1854 */
1855
1856void
1857hx509_err (
1858 hx509_context /*context*/,
1859 int /*exit_code*/,
1860 int /*error_code*/,
1861 const char */*fmt*/,
1862 ...);
1863
1864hx509_private_key_ops *
1865hx509_find_private_alg (const heim_oid */*oid*/);
1866
1867/**
1868 * Free error string returned by hx509_get_error_string().
1869 *
1870 * @param str error string to free.
1871 *
1872 * @ingroup hx509_error
1873 */
1874
1875void
1876hx509_free_error_string (char */*str*/);
1877
1878/**
1879 * Free a list of octet strings returned by another hx509 library
1880 * function.
1881 *
1882 * @param list list to be freed.
1883 *
1884 * @ingroup hx509_misc
1885 */
1886
1887void
1888hx509_free_octet_string_list (hx509_octet_string_list */*list*/);
1889
1890/**
1891 * Unparse the hx509 name in name into a string.
1892 *
1893 * @param name the name to print
1894 * @param str an allocated string returns the name in string form
1895 *
1896 * @return An hx509 error code, see hx509_get_error_string().
1897 *
1898 * @ingroup hx509_name
1899 */
1900
1901int
1902hx509_general_name_unparse (
1903 GeneralName */*name*/,
1904 char **/*str*/);
1905
1906/**
1907 * Get an error string from context associated with error_code.
1908 *
1909 * @param context A hx509 context.
1910 * @param error_code Get error message for this error code.
1911 *
1912 * @return error string, free with hx509_free_error_string().
1913 *
1914 * @ingroup hx509_error
1915 */
1916
1917char *
1918hx509_get_error_string (
1919 hx509_context /*context*/,
1920 int /*error_code*/);
1921
1922/**
1923 * Get one random certificate from the certificate store.
1924 *
1925 * @param context a hx509 context.
1926 * @param certs a certificate store to get the certificate from.
1927 * @param c return certificate, should be freed with hx509_cert_free().
1928 *
1929 * @return Returns an hx509 error code.
1930 *
1931 * @ingroup hx509_keyset
1932 */
1933
1934int
1935hx509_get_one_cert (
1936 hx509_context /*context*/,
1937 hx509_certs /*certs*/,
1938 hx509_cert */*c*/);
1939
1940int
1941hx509_lock_add_cert (
1942 hx509_context /*context*/,
1943 hx509_lock /*lock*/,
1944 hx509_cert /*cert*/);
1945
1946int
1947hx509_lock_add_certs (
1948 hx509_context /*context*/,
1949 hx509_lock /*lock*/,
1950 hx509_certs /*certs*/);
1951
1952int
1953hx509_lock_add_password (
1954 hx509_lock /*lock*/,
1955 const char */*password*/);
1956
1957int
1958hx509_lock_command_string (
1959 hx509_lock /*lock*/,
1960 const char */*string*/);
1961
1962void
1963hx509_lock_free (hx509_lock /*lock*/);
1964
1965/**
1966 * @page page_lock Locking and unlocking certificates and encrypted data.
1967 *
1968 * See the library functions here: @ref hx509_lock
1969 */
1970
1971int
1972hx509_lock_init (
1973 hx509_context /*context*/,
1974 hx509_lock */*lock*/);
1975
1976int
1977hx509_lock_prompt (
1978 hx509_lock /*lock*/,
1979 hx509_prompt */*prompt*/);
1980
1981void
1982hx509_lock_reset_certs (
1983 hx509_context /*context*/,
1984 hx509_lock /*lock*/);
1985
1986void
1987hx509_lock_reset_passwords (hx509_lock /*lock*/);
1988
1989void
1990hx509_lock_reset_promper (hx509_lock /*lock*/);
1991
1992int
1993hx509_lock_set_prompter (
1994 hx509_lock /*lock*/,
1995 hx509_prompter_fct /*prompt*/,
1996 void */*data*/);
1997
1998/**
1999 * Convert a hx509_name object to DER encoded name.
2000 *
2001 * @param name name to concert
2002 * @param os data to a DER encoded name, free the resulting octet
2003 * string with hx509_xfree(os->data).
2004 *
2005 * @return An hx509 error code, see hx509_get_error_string().
2006 *
2007 * @ingroup hx509_name
2008 */
2009
2010int
2011hx509_name_binary (
2012 const hx509_name /*name*/,
2013 heim_octet_string */*os*/);
2014
2015/**
2016 * Compare to hx509 name object, useful for sorting.
2017 *
2018 * @param n1 a hx509 name object.
2019 * @param n2 a hx509 name object.
2020 *
2021 * @return 0 the objects are the same, returns > 0 is n2 is "larger"
2022 * then n2, < 0 if n1 is "smaller" then n2.
2023 *
2024 * @ingroup hx509_name
2025 */
2026
2027int
2028hx509_name_cmp (
2029 hx509_name /*n1*/,
2030 hx509_name /*n2*/);
2031
2032/**
2033 * Copy a hx509 name object.
2034 *
2035 * @param context A hx509 cotext.
2036 * @param from the name to copy from
2037 * @param to the name to copy to
2038 *
2039 * @return An hx509 error code, see hx509_get_error_string().
2040 *
2041 * @ingroup hx509_name
2042 */
2043
2044int
2045hx509_name_copy (
2046 hx509_context /*context*/,
2047 const hx509_name /*from*/,
2048 hx509_name */*to*/);
2049
2050/**
2051 * Expands variables in the name using env. Variables are on the form
2052 * ${name}. Useful when dealing with certificate templates.
2053 *
2054 * @param context A hx509 cotext.
2055 * @param name the name to expand.
2056 * @param env environment variable to expand.
2057 *
2058 * @return An hx509 error code, see hx509_get_error_string().
2059 *
2060 * @ingroup hx509_name
2061 */
2062
2063int
2064hx509_name_expand (
2065 hx509_context /*context*/,
2066 hx509_name /*name*/,
2067 hx509_env /*env*/);
2068
2069/**
2070 * Free a hx509 name object, upond return *name will be NULL.
2071 *
2072 * @param name a hx509 name object to be freed.
2073 *
2074 * @ingroup hx509_name
2075 */
2076
2077void
2078hx509_name_free (hx509_name */*name*/);
2079
2080/**
2081 * Unparse the hx509 name in name into a string.
2082 *
2083 * @param name the name to check if its empty/null.
2084 *
2085 * @return non zero if the name is empty/null.
2086 *
2087 * @ingroup hx509_name
2088 */
2089
2090int
2091hx509_name_is_null_p (const hx509_name /*name*/);
2092
2093int
2094hx509_name_normalize (
2095 hx509_context /*context*/,
2096 hx509_name /*name*/);
2097
2098/**
2099 * Convert a hx509_name into a Name.
2100 *
2101 * @param from the name to copy from
2102 * @param to the name to copy to
2103 *
2104 * @return An hx509 error code, see hx509_get_error_string().
2105 *
2106 * @ingroup hx509_name
2107 */
2108
2109int
2110hx509_name_to_Name (
2111 const hx509_name /*from*/,
2112 Name */*to*/);
2113
2114/**
2115 * Convert the hx509 name object into a printable string.
2116 * The resulting string should be freed with free().
2117 *
2118 * @param name name to print
2119 * @param str the string to return
2120 *
2121 * @return An hx509 error code, see hx509_get_error_string().
2122 *
2123 * @ingroup hx509_name
2124 */
2125
2126int
2127hx509_name_to_string (
2128 const hx509_name /*name*/,
2129 char **/*str*/);
2130
2131/**
2132 * Create an OCSP request for a set of certificates.
2133 *
2134 * @param context a hx509 context
2135 * @param reqcerts list of certificates to request ocsp data for
2136 * @param pool certificate pool to use when signing
2137 * @param signer certificate to use to sign the request
2138 * @param digest the signing algorithm in the request, if NULL use the
2139 * default signature algorithm,
2140 * @param request the encoded request, free with free_heim_octet_string().
2141 * @param nonce nonce in the request, free with free_heim_octet_string().
2142 *
2143 * @return An hx509 error code, see hx509_get_error_string().
2144 *
2145 * @ingroup hx509_revoke
2146 */
2147
2148int
2149hx509_ocsp_request (
2150 hx509_context /*context*/,
2151 hx509_certs /*reqcerts*/,
2152 hx509_certs /*pool*/,
2153 hx509_cert /*signer*/,
2154 const AlgorithmIdentifier */*digest*/,
2155 heim_octet_string */*request*/,
2156 heim_octet_string */*nonce*/);
2157
2158/**
2159 * Verify that the certificate is part of the OCSP reply and it's not
2160 * expired. Doesn't verify signature the OCSP reply or it's done by a
2161 * authorized sender, that is assumed to be already done.
2162 *
2163 * @param context a hx509 context
2164 * @param now the time right now, if 0, use the current time.
2165 * @param cert the certificate to verify
2166 * @param flags flags control the behavior
2167 * @param data pointer to the encode ocsp reply
2168 * @param length the length of the encode ocsp reply
2169 * @param expiration return the time the OCSP will expire and need to
2170 * be rechecked.
2171 *
2172 * @return An hx509 error code, see hx509_get_error_string().
2173 *
2174 * @ingroup hx509_verify
2175 */
2176
2177int
2178hx509_ocsp_verify (
2179 hx509_context /*context*/,
2180 time_t /*now*/,
2181 hx509_cert /*cert*/,
2182 int /*flags*/,
2183 const void */*data*/,
2184 size_t /*length*/,
2185 time_t */*expiration*/);
2186
2187/**
2188 * Print a oid using a hx509_vprint_func function. To print to stdout
2189 * use hx509_print_stdout().
2190 *
2191 * @param oid oid to print
2192 * @param func hx509_vprint_func to print with.
2193 * @param ctx context variable to hx509_vprint_func function.
2194 *
2195 * @ingroup hx509_print
2196 */
2197
2198void
2199hx509_oid_print (
2200 const heim_oid */*oid*/,
2201 hx509_vprint_func /*func*/,
2202 void */*ctx*/);
2203
2204/**
2205 * Print a oid to a string.
2206 *
2207 * @param oid oid to print
2208 * @param str allocated string, free with hx509_xfree().
2209 *
2210 * @return An hx509 error code, see hx509_get_error_string().
2211 *
2212 * @ingroup hx509_print
2213 */
2214
2215int
2216hx509_oid_sprint (
2217 const heim_oid */*oid*/,
2218 char **/*str*/);
2219
2220/**
2221 * Parse a string into a hx509 name object.
2222 *
2223 * @param context A hx509 context.
2224 * @param str a string to parse.
2225 * @param name the resulting object, NULL in case of error.
2226 *
2227 * @return An hx509 error code, see hx509_get_error_string().
2228 *
2229 * @ingroup hx509_name
2230 */
2231
2232int
2233hx509_parse_name (
2234 hx509_context /*context*/,
2235 const char */*str*/,
2236 hx509_name */*name*/);
2237
2238int
2239hx509_parse_private_key (
2240 hx509_context /*context*/,
2241 const AlgorithmIdentifier */*keyai*/,
2242 const void */*data*/,
2243 size_t /*len*/,
2244 hx509_key_format_t /*format*/,
2245 hx509_private_key */*private_key*/);
2246
2247/**
2248 * Add an additional algorithm that the peer supports.
2249 *
2250 * @param context A hx509 context.
2251 * @param peer the peer to set the new algorithms for
2252 * @param val an AlgorithmsIdentier to add
2253 *
2254 * @return An hx509 error code, see hx509_get_error_string().
2255 *
2256 * @ingroup hx509_peer
2257 */
2258
2259int
2260hx509_peer_info_add_cms_alg (
2261 hx509_context /*context*/,
2262 hx509_peer_info /*peer*/,
2263 const AlgorithmIdentifier */*val*/);
2264
2265/**
2266 * Allocate a new peer info structure an init it to default values.
2267 *
2268 * @param context A hx509 context.
2269 * @param peer return an allocated peer, free with hx509_peer_info_free().
2270 *
2271 * @return An hx509 error code, see hx509_get_error_string().
2272 *
2273 * @ingroup hx509_peer
2274 */
2275
2276int
2277hx509_peer_info_alloc (
2278 hx509_context /*context*/,
2279 hx509_peer_info */*peer*/);
2280
2281/**
2282 * Free a peer info structure.
2283 *
2284 * @param peer peer info to be freed.
2285 *
2286 * @ingroup hx509_peer
2287 */
2288
2289void
2290hx509_peer_info_free (hx509_peer_info /*peer*/);
2291
2292/**
2293 * Set the certificate that remote peer is using.
2294 *
2295 * @param peer peer info to update
2296 * @param cert cerificate of the remote peer.
2297 *
2298 * @return An hx509 error code, see hx509_get_error_string().
2299 *
2300 * @ingroup hx509_peer
2301 */
2302
2303int
2304hx509_peer_info_set_cert (
2305 hx509_peer_info /*peer*/,
2306 hx509_cert /*cert*/);
2307
2308/**
2309 * Set the algorithms that the peer supports.
2310 *
2311 * @param context A hx509 context.
2312 * @param peer the peer to set the new algorithms for
2313 * @param val array of supported AlgorithmsIdentiers
2314 * @param len length of array val.
2315 *
2316 * @return An hx509 error code, see hx509_get_error_string().
2317 *
2318 * @ingroup hx509_peer
2319 */
2320
2321int
2322hx509_peer_info_set_cms_algs (
2323 hx509_context /*context*/,
2324 hx509_peer_info /*peer*/,
2325 const AlgorithmIdentifier */*val*/,
2326 size_t /*len*/);
2327
2328int
2329hx509_pem_add_header (
2330 hx509_pem_header **/*headers*/,
2331 const char */*header*/,
2332 const char */*value*/);
2333
2334const char *
2335hx509_pem_find_header (
2336 const hx509_pem_header */*h*/,
2337 const char */*header*/);
2338
2339void
2340hx509_pem_free_header (hx509_pem_header */*headers*/);
2341
2342int
2343hx509_pem_read (
2344 hx509_context /*context*/,
2345 FILE */*f*/,
2346 hx509_pem_read_func /*func*/,
2347 void */*ctx*/);
2348
2349int
2350hx509_pem_write (
2351 hx509_context /*context*/,
2352 const char */*type*/,
2353 hx509_pem_header */*headers*/,
2354 FILE */*f*/,
2355 const void */*data*/,
2356 size_t /*size*/);
2357
2358/**
2359 * Print a simple representation of a certificate
2360 *
2361 * @param context A hx509 context, can be NULL
2362 * @param cert certificate to print
2363 * @param out the stdio output stream, if NULL, stdout is used
2364 *
2365 * @return An hx509 error code
2366 *
2367 * @ingroup hx509_cert
2368 */
2369
2370int
2371hx509_print_cert (
2372 hx509_context /*context*/,
2373 hx509_cert /*cert*/,
2374 FILE */*out*/);
2375
2376/**
2377 * Helper function to print on stdout for:
2378 * - hx509_oid_print(),
2379 * - hx509_bitstring_print(),
2380 * - hx509_validate_ctx_set_print().
2381 *
2382 * @param ctx the context to the print function. If the ctx is NULL,
2383 * stdout is used.
2384 * @param fmt the printing format.
2385 * @param va the argumet list.
2386 *
2387 * @ingroup hx509_print
2388 */
2389
2390void
2391hx509_print_stdout (
2392 void */*ctx*/,
2393 const char */*fmt*/,
2394 va_list /*va*/);
2395
2396int
2397hx509_private_key2SPKI (
2398 hx509_context /*context*/,
2399 hx509_private_key /*private_key*/,
2400 SubjectPublicKeyInfo */*spki*/);
2401
2402void
2403hx509_private_key_assign_rsa (
2404 hx509_private_key /*key*/,
2405 void */*ptr*/);
2406
2407int
2408hx509_private_key_free (hx509_private_key */*key*/);
2409
2410int
2411hx509_private_key_init (
2412 hx509_private_key */*key*/,
2413 hx509_private_key_ops */*ops*/,
2414 void */*keydata*/);
2415
2416int
2417hx509_private_key_private_decrypt (
2418 hx509_context /*context*/,
2419 const heim_octet_string */*ciphertext*/,
2420 const heim_oid */*encryption_oid*/,
2421 hx509_private_key /*p*/,
2422 heim_octet_string */*cleartext*/);
2423
2424int
2425hx509_prompt_hidden (hx509_prompt_type /*type*/);
2426
2427/**
2428 * Allocate an query controller. Free using hx509_query_free().
2429 *
2430 * @param context A hx509 context.
2431 * @param q return pointer to a hx509_query.
2432 *
2433 * @return An hx509 error code, see hx509_get_error_string().
2434 *
2435 * @ingroup hx509_cert
2436 */
2437
2438int
2439hx509_query_alloc (
2440 hx509_context /*context*/,
2441 hx509_query **/*q*/);
2442
2443/**
2444 * Free the query controller.
2445 *
2446 * @param context A hx509 context.
2447 * @param q a pointer to the query controller.
2448 *
2449 * @ingroup hx509_cert
2450 */
2451
2452void
2453hx509_query_free (
2454 hx509_context /*context*/,
2455 hx509_query */*q*/);
2456
2457/**
2458 * Set the query controller to match using a specific match function.
2459 *
2460 * @param q a hx509 query controller.
2461 * @param func function to use for matching, if the argument is NULL,
2462 * the match function is removed.
2463 * @param ctx context passed to the function.
2464 *
2465 * @return An hx509 error code, see hx509_get_error_string().
2466 *
2467 * @ingroup hx509_cert
2468 */
2469
2470int
2471hx509_query_match_cmp_func (
2472 hx509_query */*q*/,
2473 int (*/*func*/)(hx509_context, hx509_cert, void *),
2474 void */*ctx*/);
2475
2476/**
2477 * Set the query controller to require an one specific EKU (extended
2478 * key usage). Any previous EKU matching is overwitten. If NULL is
2479 * passed in as the eku, the EKU requirement is reset.
2480 *
2481 * @param q a hx509 query controller.
2482 * @param eku an EKU to match on.
2483 *
2484 * @return An hx509 error code, see hx509_get_error_string().
2485 *
2486 * @ingroup hx509_cert
2487 */
2488
2489int
2490hx509_query_match_eku (
2491 hx509_query */*q*/,
2492 const heim_oid */*eku*/);
2493
2494int
2495hx509_query_match_expr (
2496 hx509_context /*context*/,
2497 hx509_query */*q*/,
2498 const char */*expr*/);
2499
2500/**
2501 * Set the query controller to match on a friendly name
2502 *
2503 * @param q a hx509 query controller.
2504 * @param name a friendly name to match on
2505 *
2506 * @return An hx509 error code, see hx509_get_error_string().
2507 *
2508 * @ingroup hx509_cert
2509 */
2510
2511int
2512hx509_query_match_friendly_name (
2513 hx509_query */*q*/,
2514 const char */*name*/);
2515
2516/**
2517 * Set the issuer and serial number of match in the query
2518 * controller. The function make copies of the isser and serial number.
2519 *
2520 * @param q a hx509 query controller
2521 * @param issuer issuer to search for
2522 * @param serialNumber the serialNumber of the issuer.
2523 *
2524 * @return An hx509 error code, see hx509_get_error_string().
2525 *
2526 * @ingroup hx509_cert
2527 */
2528
2529int
2530hx509_query_match_issuer_serial (
2531 hx509_query */*q*/,
2532 const Name */*issuer*/,
2533 const heim_integer */*serialNumber*/);
2534
2535/**
2536 * Set match options for the hx509 query controller.
2537 *
2538 * @param q query controller.
2539 * @param option options to control the query controller.
2540 *
2541 * @return An hx509 error code, see hx509_get_error_string().
2542 *
2543 * @ingroup hx509_cert
2544 */
2545
2546void
2547hx509_query_match_option (
2548 hx509_query */*q*/,
2549 hx509_query_option /*option*/);
2550
2551/**
2552 * Set a statistic file for the query statistics.
2553 *
2554 * @param context A hx509 context.
2555 * @param fn statistics file name
2556 *
2557 * @ingroup hx509_cert
2558 */
2559
2560void
2561hx509_query_statistic_file (
2562 hx509_context /*context*/,
2563 const char */*fn*/);
2564
2565/**
2566 * Unparse the statistics file and print the result on a FILE descriptor.
2567 *
2568 * @param context A hx509 context.
2569 * @param printtype tyep to print
2570 * @param out the FILE to write the data on.
2571 *
2572 * @ingroup hx509_cert
2573 */
2574
2575void
2576hx509_query_unparse_stats (
2577 hx509_context /*context*/,
2578 int /*printtype*/,
2579 FILE */*out*/);
2580
2581void
2582hx509_request_free (hx509_request */*req*/);
2583
2584int
2585hx509_request_get_SubjectPublicKeyInfo (
2586 hx509_context /*context*/,
2587 hx509_request /*req*/,
2588 SubjectPublicKeyInfo */*key*/);
2589
2590int
2591hx509_request_get_name (
2592 hx509_context /*context*/,
2593 hx509_request /*req*/,
2594 hx509_name */*name*/);
2595
2596int
2597hx509_request_init (
2598 hx509_context /*context*/,
2599 hx509_request */*req*/);
2600
2601int
2602hx509_request_set_SubjectPublicKeyInfo (
2603 hx509_context /*context*/,
2604 hx509_request /*req*/,
2605 const SubjectPublicKeyInfo */*key*/);
2606
2607int
2608hx509_request_set_name (
2609 hx509_context /*context*/,
2610 hx509_request /*req*/,
2611 hx509_name /*name*/);
2612
2613/**
2614 * Add a CRL file to the revokation context.
2615 *
2616 * @param context hx509 context
2617 * @param ctx hx509 revokation context
2618 * @param path path to file that is going to be added to the context.
2619 *
2620 * @return An hx509 error code, see hx509_get_error_string().
2621 *
2622 * @ingroup hx509_revoke
2623 */
2624
2625int
2626hx509_revoke_add_crl (
2627 hx509_context /*context*/,
2628 hx509_revoke_ctx /*ctx*/,
2629 const char */*path*/);
2630
2631/**
2632 * Add a OCSP file to the revokation context.
2633 *
2634 * @param context hx509 context
2635 * @param ctx hx509 revokation context
2636 * @param path path to file that is going to be added to the context.
2637 *
2638 * @return An hx509 error code, see hx509_get_error_string().
2639 *
2640 * @ingroup hx509_revoke
2641 */
2642
2643int
2644hx509_revoke_add_ocsp (
2645 hx509_context /*context*/,
2646 hx509_revoke_ctx /*ctx*/,
2647 const char */*path*/);
2648
2649/**
2650 * Free a hx509 revokation context.
2651 *
2652 * @param ctx context to be freed
2653 *
2654 * @ingroup hx509_revoke
2655 */
2656
2657void
2658hx509_revoke_free (hx509_revoke_ctx */*ctx*/);
2659
2660/**
2661 * Allocate a revokation context. Free with hx509_revoke_free().
2662 *
2663 * @param context A hx509 context.
2664 * @param ctx returns a newly allocated revokation context.
2665 *
2666 * @return An hx509 error code, see hx509_get_error_string().
2667 *
2668 * @ingroup hx509_revoke
2669 */
2670
2671int
2672hx509_revoke_init (
2673 hx509_context /*context*/,
2674 hx509_revoke_ctx */*ctx*/);
2675
2676/**
2677 * Print the OCSP reply stored in a file.
2678 *
2679 * @param context a hx509 context
2680 * @param path path to a file with a OCSP reply
2681 * @param out the out FILE descriptor to print the reply on
2682 *
2683 * @return An hx509 error code, see hx509_get_error_string().
2684 *
2685 * @ingroup hx509_revoke
2686 */
2687
2688int
2689hx509_revoke_ocsp_print (
2690 hx509_context /*context*/,
2691 const char */*path*/,
2692 FILE */*out*/);
2693
2694int
2695hx509_revoke_print (
2696 hx509_context /*context*/,
2697 hx509_revoke_ctx /*ctx*/,
2698 FILE */*out*/);
2699
2700/**
2701 * Check that a certificate is not expired according to a revokation
2702 * context. Also need the parent certificte to the check OCSP
2703 * parent identifier.
2704 *
2705 * @param context hx509 context
2706 * @param ctx hx509 revokation context
2707 * @param certs
2708 * @param now
2709 * @param cert
2710 * @param parent_cert
2711 *
2712 * @return An hx509 error code, see hx509_get_error_string().
2713 *
2714 * @ingroup hx509_revoke
2715 */
2716
2717int
2718hx509_revoke_verify (
2719 hx509_context /*context*/,
2720 hx509_revoke_ctx /*ctx*/,
2721 hx509_certs /*certs*/,
2722 time_t /*now*/,
2723 hx509_cert /*cert*/,
2724 hx509_cert /*parent_cert*/);
2725
2726/**
2727 * See hx509_set_error_stringv().
2728 *
2729 * @param context A hx509 context.
2730 * @param flags
2731 * - HX509_ERROR_APPEND appends the error string to the old messages
2732 (code is updated).
2733 * @param code error code related to error message
2734 * @param fmt error message format
2735 * @param ... arguments to error message format
2736 *
2737 * @ingroup hx509_error
2738 */
2739
2740void
2741hx509_set_error_string (
2742 hx509_context /*context*/,
2743 int /*flags*/,
2744 int /*code*/,
2745 const char */*fmt*/,
2746 ...);
2747
2748/**
2749 * Add an error message to the hx509 context.
2750 *
2751 * @param context A hx509 context.
2752 * @param flags
2753 * - HX509_ERROR_APPEND appends the error string to the old messages
2754 (code is updated).
2755 * @param code error code related to error message
2756 * @param fmt error message format
2757 * @param ap arguments to error message format
2758 *
2759 * @ingroup hx509_error
2760 */
2761
2762void
2763hx509_set_error_stringv (
2764 hx509_context /*context*/,
2765 int /*flags*/,
2766 int /*code*/,
2767 const char */*fmt*/,
2768 va_list /*ap*/);
2769
2770const AlgorithmIdentifier *
2771hx509_signature_ecPublicKey (void);
2772
2773const AlgorithmIdentifier *
2774hx509_signature_ecdsa_with_sha256 (void);
2775
2776const AlgorithmIdentifier *
2777hx509_signature_md5 (void);
2778
2779const AlgorithmIdentifier *
2780hx509_signature_rsa (void);
2781
2782const AlgorithmIdentifier *
2783hx509_signature_rsa_pkcs1_x509 (void);
2784
2785const AlgorithmIdentifier *
2786hx509_signature_rsa_with_md5 (void);
2787
2788const AlgorithmIdentifier *
2789hx509_signature_rsa_with_sha1 (void);
2790
2791const AlgorithmIdentifier *
2792hx509_signature_rsa_with_sha256 (void);
2793
2794const AlgorithmIdentifier *
2795hx509_signature_rsa_with_sha384 (void);
2796
2797const AlgorithmIdentifier *
2798hx509_signature_rsa_with_sha512 (void);
2799
2800const AlgorithmIdentifier *
2801hx509_signature_sha1 (void);
2802
2803const AlgorithmIdentifier *
2804hx509_signature_sha256 (void);
2805
2806const AlgorithmIdentifier *
2807hx509_signature_sha384 (void);
2808
2809const AlgorithmIdentifier *
2810hx509_signature_sha512 (void);
2811
2812/**
2813 * Convert a DER encoded name info a string.
2814 *
2815 * @param data data to a DER/BER encoded name
2816 * @param length length of data
2817 * @param str the resulting string, is NULL on failure.
2818 *
2819 * @return An hx509 error code, see hx509_get_error_string().
2820 *
2821 * @ingroup hx509_name
2822 */
2823
2824int
2825hx509_unparse_der_name (
2826 const void */*data*/,
2827 size_t /*length*/,
2828 char **/*str*/);
2829
2830/**
2831 * Validate/Print the status of the certificate.
2832 *
2833 * @param context A hx509 context.
2834 * @param ctx A hx509 validation context.
2835 * @param cert the cerificate to validate/print.
2836
2837 * @return An hx509 error code, see hx509_get_error_string().
2838 *
2839 * @ingroup hx509_print
2840 */
2841
2842int
2843hx509_validate_cert (
2844 hx509_context /*context*/,
2845 hx509_validate_ctx /*ctx*/,
2846 hx509_cert /*cert*/);
2847
2848/**
2849 * Add flags to control the behaivor of the hx509_validate_cert()
2850 * function.
2851 *
2852 * @param ctx A hx509 validation context.
2853 * @param flags flags to add to the validation context.
2854 *
2855 * @return An hx509 error code, see hx509_get_error_string().
2856 *
2857 * @ingroup hx509_print
2858 */
2859
2860void
2861hx509_validate_ctx_add_flags (
2862 hx509_validate_ctx /*ctx*/,
2863 int /*flags*/);
2864
2865/**
2866 * Free an hx509 validate context.
2867 *
2868 * @param ctx the hx509 validate context to free.
2869 *
2870 * @ingroup hx509_print
2871 */
2872
2873void
2874hx509_validate_ctx_free (hx509_validate_ctx /*ctx*/);
2875
2876/**
2877 * Allocate a hx509 validation/printing context.
2878 *
2879 * @param context A hx509 context.
2880 * @param ctx a new allocated hx509 validation context, free with
2881 * hx509_validate_ctx_free().
2882
2883 * @return An hx509 error code, see hx509_get_error_string().
2884 *
2885 * @ingroup hx509_print
2886 */
2887
2888int
2889hx509_validate_ctx_init (
2890 hx509_context /*context*/,
2891 hx509_validate_ctx */*ctx*/);
2892
2893/**
2894 * Set the printing functions for the validation context.
2895 *
2896 * @param ctx a hx509 valication context.
2897 * @param func the printing function to usea.
2898 * @param c the context variable to the printing function.
2899 *
2900 * @return An hx509 error code, see hx509_get_error_string().
2901 *
2902 * @ingroup hx509_print
2903 */
2904
2905void
2906hx509_validate_ctx_set_print (
2907 hx509_validate_ctx /*ctx*/,
2908 hx509_vprint_func /*func*/,
2909 void */*c*/);
2910
2911/**
2912 * Set the trust anchors in the verification context, makes an
2913 * reference to the keyset, so the consumer can free the keyset
2914 * independent of the destruction of the verification context (ctx).
2915 * If there already is a keyset attached, it's released.
2916 *
2917 * @param ctx a verification context
2918 * @param set a keyset containing the trust anchors.
2919 *
2920 * @ingroup hx509_verify
2921 */
2922
2923void
2924hx509_verify_attach_anchors (
2925 hx509_verify_ctx /*ctx*/,
2926 hx509_certs /*set*/);
2927
2928/**
2929 * Attach an revocation context to the verfication context, , makes an
2930 * reference to the revoke context, so the consumer can free the
2931 * revoke context independent of the destruction of the verification
2932 * context. If there is no revoke context, the verification process is
2933 * NOT going to check any verification status.
2934 *
2935 * @param ctx a verification context.
2936 * @param revoke_ctx a revoke context.
2937 *
2938 * @ingroup hx509_verify
2939 */
2940
2941void
2942hx509_verify_attach_revoke (
2943 hx509_verify_ctx /*ctx*/,
2944 hx509_revoke_ctx /*revoke_ctx*/);
2945
2946void
2947hx509_verify_ctx_f_allow_best_before_signature_algs (
2948 hx509_context /*ctx*/,
2949 int /*boolean*/);
2950
2951/**
2952 * Allow using the operating system builtin trust anchors if no other
2953 * trust anchors are configured.
2954 *
2955 * @param ctx a verification context
2956 * @param boolean if non zero, useing the operating systems builtin
2957 * trust anchors.
2958 *
2959 *
2960 * @return An hx509 error code, see hx509_get_error_string().
2961 *
2962 * @ingroup hx509_cert
2963 */
2964
2965void
2966hx509_verify_ctx_f_allow_default_trustanchors (
2967 hx509_verify_ctx /*ctx*/,
2968 int /*boolean*/);
2969
2970/**
2971 * Free an hx509 verification context.
2972 *
2973 * @param ctx the context to be freed.
2974 *
2975 * @ingroup hx509_verify
2976 */
2977
2978void
2979hx509_verify_destroy_ctx (hx509_verify_ctx /*ctx*/);
2980
2981/**
2982 * Verify that the certificate is allowed to be used for the hostname
2983 * and address.
2984 *
2985 * @param context A hx509 context.
2986 * @param cert the certificate to match with
2987 * @param flags Flags to modify the behavior:
2988 * - HX509_VHN_F_ALLOW_NO_MATCH no match is ok
2989 * @param type type of hostname:
2990 * - HX509_HN_HOSTNAME for plain hostname.
2991 * - HX509_HN_DNSSRV for DNS SRV names.
2992 * @param hostname the hostname to check
2993 * @param sa address of the host
2994 * @param sa_size length of address
2995 *
2996 * @return An hx509 error code, see hx509_get_error_string().
2997 *
2998 * @ingroup hx509_cert
2999 */
3000
3001int
3002hx509_verify_hostname (
3003 hx509_context /*context*/,
3004 const hx509_cert /*cert*/,
3005 int /*flags*/,
3006 hx509_hostname_type /*type*/,
3007 const char */*hostname*/,
3008 const struct sockaddr */*sa*/,
3009 int /*sa_size*/);
3010
3011/**
3012 * Allocate an verification context that is used fo control the
3013 * verification process.
3014 *
3015 * @param context A hx509 context.
3016 * @param ctx returns a pointer to a hx509_verify_ctx object.
3017 *
3018 * @return An hx509 error code, see hx509_get_error_string().
3019 *
3020 * @ingroup hx509_verify
3021 */
3022
3023int
3024hx509_verify_init_ctx (
3025 hx509_context /*context*/,
3026 hx509_verify_ctx */*ctx*/);
3027
3028/**
3029 * Build and verify the path for the certificate to the trust anchor
3030 * specified in the verify context. The path is constructed from the
3031 * certificate, the pool and the trust anchors.
3032 *
3033 * @param context A hx509 context.
3034 * @param ctx A hx509 verification context.
3035 * @param cert the certificate to build the path from.
3036 * @param pool A keyset of certificates to build the chain from.
3037 *
3038 * @return An hx509 error code, see hx509_get_error_string().
3039 *
3040 * @ingroup hx509_verify
3041 */
3042
3043int
3044hx509_verify_path (
3045 hx509_context /*context*/,
3046 hx509_verify_ctx /*ctx*/,
3047 hx509_cert /*cert*/,
3048 hx509_certs /*pool*/);
3049
3050/**
3051 * Set the maximum depth of the certificate chain that the path
3052 * builder is going to try.
3053 *
3054 * @param ctx a verification context
3055 * @param max_depth maxium depth of the certificate chain, include
3056 * trust anchor.
3057 *
3058 * @ingroup hx509_verify
3059 */
3060
3061void
3062hx509_verify_set_max_depth (
3063 hx509_verify_ctx /*ctx*/,
3064 unsigned int /*max_depth*/);
3065
3066/**
3067 * Allow or deny the use of proxy certificates
3068 *
3069 * @param ctx a verification context
3070 * @param boolean if non zero, allow proxy certificates.
3071 *
3072 * @ingroup hx509_verify
3073 */
3074
3075void
3076hx509_verify_set_proxy_certificate (
3077 hx509_verify_ctx /*ctx*/,
3078 int /*boolean*/);
3079
3080/**
3081 * Select strict RFC3280 verification of certificiates. This means
3082 * checking key usage on CA certificates, this will make version 1
3083 * certificiates unuseable.
3084 *
3085 * @param ctx a verification context
3086 * @param boolean if non zero, use strict verification.
3087 *
3088 * @ingroup hx509_verify
3089 */
3090
3091void
3092hx509_verify_set_strict_rfc3280_verification (
3093 hx509_verify_ctx /*ctx*/,
3094 int /*boolean*/);
3095
3096/**
3097 * Set the clock time the the verification process is going to
3098 * use. Used to check certificate in the past and future time. If not
3099 * set the current time will be used.
3100 *
3101 * @param ctx a verification context.
3102 * @param t the time the verifiation is using.
3103 *
3104 *
3105 * @ingroup hx509_verify
3106 */
3107
3108void
3109hx509_verify_set_time (
3110 hx509_verify_ctx /*ctx*/,
3111 time_t /*t*/);
3112
3113/**
3114 * Verify a signature made using the private key of an certificate.
3115 *
3116 * @param context A hx509 context.
3117 * @param signer the certificate that made the signature.
3118 * @param alg algorthm that was used to sign the data.
3119 * @param data the data that was signed.
3120 * @param sig the sigature to verify.
3121 *
3122 * @return An hx509 error code, see hx509_get_error_string().
3123 *
3124 * @ingroup hx509_crypto
3125 */
3126
3127int
3128hx509_verify_signature (
3129 hx509_context /*context*/,
3130 const hx509_cert /*signer*/,
3131 const AlgorithmIdentifier */*alg*/,
3132 const heim_octet_string */*data*/,
3133 const heim_octet_string */*sig*/);
3134
3135/**
3136 * Free a data element allocated in the library.
3137 *
3138 * @param ptr data to be freed.
3139 *
3140 * @ingroup hx509_misc
3141 */
3142
3143void
3144hx509_xfree (void */*ptr*/);
3145
3146int
3147yywrap (void);
3148
3149#ifdef __cplusplus
3150}
3151#endif
3152
3153#endif /* DOXY */
3154#endif /* __hx509_protos_h__ */
3155