trustbridge/nss-cmake-static: nss/lib/certhigh/ocsp.h annotate

annotate nss/lib/certhigh/ocsp.h @ 2:a945361df361

Fix NSS_LIBRARIES variable

author	Andre Heinecke <andre.heinecke@intevation.de>
date	Wed, 30 Jul 2014 16:20:44 +0200
parents	1e5118fa0cb1
children

rev	line source
0 1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1 /* This Source Code Form is subject to the terms of the Mozilla Public
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	2 * License, v. 2.0. If a copy of the MPL was not distributed with this
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	3 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	4
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	5 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	6 * Interface to the OCSP implementation.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	7 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	8
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	9 #ifndef _OCSP_H_
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	10 #define _OCSP_H_
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	11
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	12
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	13 #include "plarena.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	14 #include "seccomon.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	15 #include "secoidt.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	16 #include "keyt.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	17 #include "certt.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	18 #include "ocspt.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	19
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	20
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	21 /************************************************************************/
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	22 SEC_BEGIN_PROTOS
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	23
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	24 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	25 * This function registers the HttpClient with whose functions the
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	26 * HttpClientFcn structure has been populated as the default Http
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	27 * client.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	28 *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	29 * The function table must be a global object.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	30 * The caller must ensure that NSS will be able to call
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	31 * the registered functions for the lifetime of the process.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	32 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	33 extern SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	34 SEC_RegisterDefaultHttpClient(const SEC_HttpClientFcn *fcnTable);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	35
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	36 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	37 * This function obtains the HttpClient which has been registered
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	38 * by an earlier call to SEC_RegisterDefaultHttpClient.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	39 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	40 extern const SEC_HttpClientFcn *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	41 SEC_GetRegisteredHttpClient(void);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	42
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	43 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	44 * Sets parameters that control NSS' internal OCSP cache.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	45 * maxCacheEntries, special varlues are:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	46 * -1 disable cache
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	47 * 0 unlimited cache entries
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	48 * minimumSecondsToNextFetchAttempt:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	49 * whenever an OCSP request was attempted or completed over the network,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	50 * wait at least this number of seconds before trying to fetch again.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	51 * maximumSecondsToNextFetchAttempt:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	52 * this is the maximum age of a cached response we allow, until we try
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	53 * to fetch an updated response, even if the OCSP responder expects
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	54 * that newer information update will not be available yet.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	55 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	56 extern SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	57 CERT_OCSPCacheSettings(PRInt32 maxCacheEntries,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	58 PRUint32 minimumSecondsToNextFetchAttempt,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	59 PRUint32 maximumSecondsToNextFetchAttempt);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	60
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	61 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	62 * Set the desired behaviour on OCSP failures.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	63 * See definition of ocspFailureMode for allowed choices.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	64 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	65 extern SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	66 CERT_SetOCSPFailureMode(SEC_OcspFailureMode ocspFailureMode);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	67
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	68 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	69 * Configure the maximum time NSS will wait for an OCSP response.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	70 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	71 extern SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	72 CERT_SetOCSPTimeout(PRUint32 seconds);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	73
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	74 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	75 * Removes all items currently stored in the OCSP cache.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	76 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	77 extern SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	78 CERT_ClearOCSPCache(void);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	79
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	80 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	81 * FUNCTION: CERT_EnableOCSPChecking
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	82 * Turns on OCSP checking for the given certificate database.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	83 * INPUTS:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	84 * CERTCertDBHandle *handle
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	85 * Certificate database for which OCSP checking will be enabled.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	86 * RETURN:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	87 * Returns SECFailure if an error occurred (likely only problem
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	88 * allocating memory); SECSuccess otherwise.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	89 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	90 extern SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	91 CERT_EnableOCSPChecking(CERTCertDBHandle *handle);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	92
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	93 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	94 * FUNCTION: CERT_DisableOCSPChecking
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	95 * Turns off OCSP checking for the given certificate database.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	96 * This routine disables OCSP checking. Though it will return
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	97 * SECFailure if OCSP checking is not enabled, it is "safe" to
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	98 * call it that way and just ignore the return value, if it is
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	99 * easier to just call it than to "remember" whether it is enabled.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	100 * INPUTS:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	101 * CERTCertDBHandle *handle
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	102 * Certificate database for which OCSP checking will be disabled.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	103 * RETURN:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	104 * Returns SECFailure if an error occurred (usually means that OCSP
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	105 * checking was not enabled or status contexts were not initialized --
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	106 * error set will be SEC_ERROR_OCSP_NOT_ENABLED); SECSuccess otherwise.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	107 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	108 extern SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	109 CERT_DisableOCSPChecking(CERTCertDBHandle *handle);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	110
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	111 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	112 * FUNCTION: CERT_SetOCSPDefaultResponder
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	113 * Specify the location and cert of the default responder.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	114 * If OCSP checking is already enabled and use of a default responder
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	115 * is also already enabled, all OCSP checking from now on will go directly
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	116 * to the specified responder. If OCSP checking is not enabled, or if
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	117 * it is but use of a default responder is not enabled, the information
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	118 * will be recorded and take effect whenever both are enabled.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	119 * INPUTS:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	120 * CERTCertDBHandle *handle
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	121 * Cert database on which OCSP checking should use the default responder.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	122 * const char *url
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	123 * The location of the default responder (e.g. "http://foo.com:80/ocsp")
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	124 * Note that the location will not be tested until the first attempt
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	125 * to send a request there.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	126 * const char *name
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	127 * The nickname of the cert to trust (expected) to sign the OCSP responses.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	128 * If the corresponding cert cannot be found, SECFailure is returned.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	129 * RETURN:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	130 * Returns SECFailure if an error occurred; SECSuccess otherwise.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	131 * The most likely error is that the cert for "name" could not be found
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	132 * (probably SEC_ERROR_UNKNOWN_CERT). Other errors are low-level (no memory,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	133 * bad database, etc.).
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	134 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	135 extern SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	136 CERT_SetOCSPDefaultResponder(CERTCertDBHandle *handle,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	137 const char url, const char name);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	138
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	139 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	140 * FUNCTION: CERT_EnableOCSPDefaultResponder
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	141 * Turns on use of a default responder when OCSP checking.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	142 * If OCSP checking is already enabled, this will make subsequent checks
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	143 * go directly to the default responder. (The location of the responder
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	144 * and the nickname of the responder cert must already be specified.)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	145 * If OCSP checking is not enabled, this will be recorded and take effect
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	146 * whenever it is enabled.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	147 * INPUTS:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	148 * CERTCertDBHandle *handle
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	149 * Cert database on which OCSP checking should use the default responder.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	150 * RETURN:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	151 * Returns SECFailure if an error occurred; SECSuccess otherwise.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	152 * No errors are especially likely unless the caller did not previously
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	153 * perform a successful call to SetOCSPDefaultResponder (in which case
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	154 * the error set will be SEC_ERROR_OCSP_NO_DEFAULT_RESPONDER).
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	155 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	156 extern SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	157 CERT_EnableOCSPDefaultResponder(CERTCertDBHandle *handle);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	158
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	159 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	160 * FUNCTION: CERT_DisableOCSPDefaultResponder
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	161 * Turns off use of a default responder when OCSP checking.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	162 * (Does nothing if use of a default responder is not enabled.)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	163 * INPUTS:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	164 * CERTCertDBHandle *handle
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	165 * Cert database on which OCSP checking should stop using a default
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	166 * responder.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	167 * RETURN:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	168 * Returns SECFailure if an error occurred; SECSuccess otherwise.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	169 * Errors very unlikely (like random memory corruption...).
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	170 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	171 extern SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	172 CERT_DisableOCSPDefaultResponder(CERTCertDBHandle *handle);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	173
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	174 /* If forcePost is set, OCSP requests will only be sent using the HTTP POST
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	175 * method. When forcePost is not set, OCSP requests will be sent using the
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	176 * HTTP GET method, with a fallback to POST when we fail to receive a response
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	177 * and/or when we receive an uncacheable response like "Unknown."
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	178 *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	179 * The default is to use GET and fallback to POST.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	180 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	181 extern SECStatus CERT_ForcePostMethodForOCSP(PRBool forcePost);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	182
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	183 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	184 * -------------------------------------------------------
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	185 * The Functions above are those expected to be used by a client
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	186 * providing OCSP status checking along with every cert verification.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	187 * The functions below are for OCSP testing, debugging, or clients
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	188 * or servers performing more specialized OCSP tasks.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	189 * -------------------------------------------------------
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	190 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	191
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	192 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	193 * FUNCTION: CERT_CreateOCSPRequest
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	194 * Creates a CERTOCSPRequest, requesting the status of the certs in
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	195 * the given list.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	196 * INPUTS:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	197 * CERTCertList *certList
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	198 * A list of certs for which status will be requested.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	199 * Note that all of these certificates should have the same issuer,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	200 * or it's expected the response will be signed by a trusted responder.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	201 * If the certs need to be broken up into multiple requests, that
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	202 * must be handled by the caller (and thus by having multiple calls
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	203 * to this routine), who knows about where the request(s) are being
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	204 * sent and whether there are any trusted responders in place.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	205 * PRTime time
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	206 * Indicates the time for which the certificate status is to be
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	207 * determined -- this may be used in the search for the cert's issuer
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	208 * but has no effect on the request itself.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	209 * PRBool addServiceLocator
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	210 * If true, the Service Locator extension should be added to the
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	211 * single request(s) for each cert.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	212 * CERTCertificate *signerCert
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	213 * If non-NULL, means sign the request using this cert. Otherwise,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	214 * do not sign.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	215 * XXX note that request signing is not yet supported; see comment in code
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	216 * RETURN:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	217 * A pointer to a CERTOCSPRequest structure containing an OCSP request
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	218 * for the cert list. On error, null is returned, with an error set
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	219 * indicating the reason. This is likely SEC_ERROR_UNKNOWN_ISSUER.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	220 * (The issuer is needed to create a request for the certificate.)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	221 * Other errors are low-level problems (no memory, bad database, etc.).
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	222 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	223 extern CERTOCSPRequest *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	224 CERT_CreateOCSPRequest(CERTCertList *certList, PRTime time,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	225 PRBool addServiceLocator,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	226 CERTCertificate *signerCert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	227
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	228 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	229 * FUNCTION: CERT_AddOCSPAcceptableResponses
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	230 * Add the AcceptableResponses extension to an OCSP Request.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	231 * INPUTS:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	232 * CERTOCSPRequest *request
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	233 * The request to which the extension should be added.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	234 * SECOidTag responseType0, ...
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	235 * A list (of one or more) of SECOidTag -- each of the response types
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	236 * to be added. The last OID must be SEC_OID_PKIX_OCSP_BASIC_RESPONSE.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	237 * (This marks the end of the list, and it must be specified because a
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	238 * client conforming to the OCSP standard is required to handle the basic
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	239 * response type.) The OIDs are not checked in any way.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	240 * RETURN:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	241 * SECSuccess if the extension is added; SECFailure if anything goes wrong.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	242 * All errors are internal or low-level problems (e.g. no memory).
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	243 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	244 extern SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	245 CERT_AddOCSPAcceptableResponses(CERTOCSPRequest *request,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	246 SECOidTag responseType0, ...);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	247
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	248 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	249 * FUNCTION: CERT_EncodeOCSPRequest
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	250 * DER encodes an OCSP Request, possibly adding a signature as well.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	251 * XXX Signing is not yet supported, however; see comments in code.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	252 * INPUTS:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	253 * PLArenaPool *arena
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	254 * The return value is allocated from here.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	255 * If a NULL is passed in, allocation is done from the heap instead.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	256 * CERTOCSPRequest *request
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	257 * The request to be encoded.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	258 * void *pwArg
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	259 * Pointer to argument for password prompting, if needed. (Definitely
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	260 * not needed if not signing.)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	261 * RETURN:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	262 * Returns a NULL on error and a pointer to the SECItem with the
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	263 * encoded value otherwise. Any error is likely to be low-level
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	264 * (e.g. no memory).
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	265 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	266 extern SECItem *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	267 CERT_EncodeOCSPRequest(PLArenaPool arena, CERTOCSPRequest request,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	268 void *pwArg);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	269
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	270 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	271 * FUNCTION: CERT_DecodeOCSPRequest
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	272 * Decode a DER encoded OCSP Request.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	273 * INPUTS:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	274 * SECItem *src
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	275 * Pointer to a SECItem holding DER encoded OCSP Request.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	276 * RETURN:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	277 * Returns a pointer to a CERTOCSPRequest containing the decoded request.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	278 * On error, returns NULL. Most likely error is trouble decoding
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	279 * (SEC_ERROR_OCSP_MALFORMED_REQUEST), or low-level problem (no memory).
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	280 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	281 extern CERTOCSPRequest *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	282 CERT_DecodeOCSPRequest(const SECItem *src);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	283
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	284 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	285 * FUNCTION: CERT_DestroyOCSPRequest
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	286 * Frees an OCSP Request structure.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	287 * INPUTS:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	288 * CERTOCSPRequest *request
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	289 * Pointer to CERTOCSPRequest to be freed.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	290 * RETURN:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	291 * No return value; no errors.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	292 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	293 extern void
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	294 CERT_DestroyOCSPRequest(CERTOCSPRequest *request);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	295
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	296 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	297 * FUNCTION: CERT_DecodeOCSPResponse
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	298 * Decode a DER encoded OCSP Response.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	299 * INPUTS:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	300 * SECItem *src
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	301 * Pointer to a SECItem holding DER encoded OCSP Response.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	302 * RETURN:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	303 * Returns a pointer to a CERTOCSPResponse (the decoded OCSP Response);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	304 * the caller is responsible for destroying it. Or NULL if error (either
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	305 * response could not be decoded (SEC_ERROR_OCSP_MALFORMED_RESPONSE),
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	306 * it was of an unexpected type (SEC_ERROR_OCSP_UNKNOWN_RESPONSE_TYPE),
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	307 * or a low-level or internal error occurred).
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	308 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	309 extern CERTOCSPResponse *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	310 CERT_DecodeOCSPResponse(const SECItem *src);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	311
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	312 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	313 * FUNCTION: CERT_DestroyOCSPResponse
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	314 * Frees an OCSP Response structure.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	315 * INPUTS:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	316 * CERTOCSPResponse *request
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	317 * Pointer to CERTOCSPResponse to be freed.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	318 * RETURN:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	319 * No return value; no errors.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	320 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	321 extern void
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	322 CERT_DestroyOCSPResponse(CERTOCSPResponse *response);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	323
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	324 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	325 * FUNCTION: CERT_GetEncodedOCSPResponse
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	326 * Creates and sends a request to an OCSP responder, then reads and
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	327 * returns the (encoded) response.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	328 * INPUTS:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	329 * PLArenaPool *arena
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	330 * Pointer to arena from which return value will be allocated.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	331 * If NULL, result will be allocated from the heap (and thus should
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	332 * be freed via SECITEM_FreeItem).
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	333 * CERTCertList *certList
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	334 * A list of certs for which status will be requested.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	335 * Note that all of these certificates should have the same issuer,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	336 * or it's expected the response will be signed by a trusted responder.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	337 * If the certs need to be broken up into multiple requests, that
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	338 * must be handled by the caller (and thus by having multiple calls
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	339 * to this routine), who knows about where the request(s) are being
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	340 * sent and whether there are any trusted responders in place.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	341 * const char *location
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	342 * The location of the OCSP responder (a URL).
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	343 * PRTime time
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	344 * Indicates the time for which the certificate status is to be
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	345 * determined -- this may be used in the search for the cert's issuer
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	346 * but has no other bearing on the operation.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	347 * PRBool addServiceLocator
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	348 * If true, the Service Locator extension should be added to the
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	349 * single request(s) for each cert.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	350 * CERTCertificate *signerCert
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	351 * If non-NULL, means sign the request using this cert. Otherwise,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	352 * do not sign.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	353 * void *pwArg
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	354 * Pointer to argument for password prompting, if needed. (Definitely
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	355 * not needed if not signing.)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	356 * OUTPUTS:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	357 * CERTOCSPRequest **pRequest
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	358 * Pointer in which to store the OCSP request created for the given
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	359 * list of certificates. It is only filled in if the entire operation
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	360 * is successful and the pointer is not null -- and in that case the
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	361 * caller is then reponsible for destroying it.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	362 * RETURN:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	363 * Returns a pointer to the SECItem holding the response.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	364 * On error, returns null with error set describing the reason:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	365 * SEC_ERROR_UNKNOWN_ISSUER
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	366 * SEC_ERROR_CERT_BAD_ACCESS_LOCATION
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	367 * SEC_ERROR_OCSP_BAD_HTTP_RESPONSE
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	368 * Other errors are low-level problems (no memory, bad database, etc.).
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	369 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	370 extern SECItem *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	371 CERT_GetEncodedOCSPResponse(PLArenaPool arena, CERTCertList certList,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	372 const char *location, PRTime time,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	373 PRBool addServiceLocator,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	374 CERTCertificate signerCert, void pwArg,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	375 CERTOCSPRequest **pRequest);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	376
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	377 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	378 * FUNCTION: CERT_VerifyOCSPResponseSignature
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	379 * Check the signature on an OCSP Response. Will also perform a
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	380 * verification of the signer's certificate. Note, however, that a
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	381 * successful verification does not make any statement about the
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	382 * signer's authority to provide status for the certificate(s),
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	383 * that must be checked individually for each certificate.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	384 * INPUTS:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	385 * CERTOCSPResponse *response
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	386 * Pointer to response structure with signature to be checked.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	387 * CERTCertDBHandle *handle
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	388 * Pointer to CERTCertDBHandle for certificate DB to use for verification.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	389 * void *pwArg
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	390 * Pointer to argument for password prompting, if needed.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	391 * CERTCertificate *issuerCert
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	392 * Issuer of the certificate that generated the OCSP request.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	393 * OUTPUTS:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	394 * CERTCertificate **pSignerCert
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	395 * Pointer in which to store signer's certificate; only filled-in if
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	396 * non-null.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	397 * RETURN:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	398 * Returns SECSuccess when signature is valid, anything else means invalid.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	399 * Possible errors set:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	400 * SEC_ERROR_OCSP_MALFORMED_RESPONSE - unknown type of ResponderID
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	401 * SEC_ERROR_INVALID_TIME - bad format of "ProducedAt" time
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	402 * SEC_ERROR_UNKNOWN_SIGNER - signer's cert could not be found
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	403 * SEC_ERROR_BAD_SIGNATURE - the signature did not verify
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	404 * Other errors are any of the many possible failures in cert verification
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	405 * (e.g. SEC_ERROR_REVOKED_CERTIFICATE, SEC_ERROR_UNTRUSTED_ISSUER) when
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	406 * verifying the signer's cert, or low-level problems (no memory, etc.)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	407 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	408 extern SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	409 CERT_VerifyOCSPResponseSignature(CERTOCSPResponse *response,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	410 CERTCertDBHandle handle, void pwArg,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	411 CERTCertificate **pSignerCert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	412 CERTCertificate *issuerCert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	413
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	414 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	415 * FUNCTION: CERT_GetOCSPAuthorityInfoAccessLocation
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	416 * Get the value of the URI of the OCSP responder for the given cert.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	417 * This is found in the (optional) Authority Information Access extension
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	418 * in the cert.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	419 * INPUTS:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	420 * CERTCertificate *cert
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	421 * The certificate being examined.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	422 * RETURN:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	423 * char *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	424 * A copy of the URI for the OCSP method, if found. If either the
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	425 * extension is not present or it does not contain an entry for OCSP,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	426 * SEC_ERROR_EXTENSION_NOT_FOUND will be set and a NULL returned.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	427 * Any other error will also result in a NULL being returned.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	428 *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	429 * This result should be freed (via PORT_Free) when no longer in use.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	430 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	431 extern char *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	432 CERT_GetOCSPAuthorityInfoAccessLocation(const CERTCertificate *cert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	433
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	434 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	435 * FUNCTION: CERT_RegisterAlternateOCSPAIAInfoCallBack
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	436 * This function serves two purposes.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	437 * 1) It registers the address of a callback function that will be
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	438 * called for certs that have no OCSP AIA extension, to see if the
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	439 * callback wishes to supply an alternative URL for such an OCSP inquiry.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	440 * 2) It outputs the previously registered function's address to the
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	441 * address supplied by the caller, unless that is NULL.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	442 * The registered callback function returns NULL, or an allocated string
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	443 * that may be subsequently freed by calling PORT_Free().
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	444 * RETURN:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	445 * SECSuccess or SECFailure (if the library is not yet intialized)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	446 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	447 extern SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	448 CERT_RegisterAlternateOCSPAIAInfoCallBack(
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	449 CERT_StringFromCertFcn newCallback,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	450 CERT_StringFromCertFcn * oldCallback);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	451
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	452 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	453 * FUNCTION: CERT_ParseURL
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	454 * Parse a URI into hostname, port, and path. The scheme in the URI must
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	455 * be "http".
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	456 * INPUTS:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	457 * const char *url
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	458 * The URI to be parsed
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	459 * OUTPUTS:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	460 * char **pHostname
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	461 * Pointer to store the hostname obtained from the URI.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	462 * This result should be freed (via PORT_Free) when no longer in use.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	463 * PRUint16 *pPort
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	464 * Pointer to store the port number obtained from the URI.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	465 * char **pPath
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	466 * Pointer to store the path obtained from the URI.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	467 * This result should be freed (via PORT_Free) when no longer in use.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	468 * RETURN:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	469 * Returns SECSuccess when parsing was successful. Returns SECFailure when
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	470 * problems were encountered.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	471 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	472 extern SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	473 CERT_ParseURL(const char url, char pHostname, PRUint16 pPort, char **pPath);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	474
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	475 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	476 * FUNCTION: CERT_CheckOCSPStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	477 * Checks the status of a certificate via OCSP. Will only check status for
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	478 * a certificate that has an AIA (Authority Information Access) extension
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	479 * for OCSP or when a "default responder" is specified and enabled.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	480 * (If no AIA extension for OCSP and no default responder in place, the
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	481 * cert is considered to have a good status and SECSuccess is returned.)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	482 * INPUTS:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	483 * CERTCertDBHandle *handle
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	484 * certificate DB of the cert that is being checked
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	485 * CERTCertificate *cert
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	486 * the certificate being checked
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	487 * XXX in the long term also need a boolean parameter that specifies
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	488 * whether to check the cert chain, as well; for now we check only
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	489 * the leaf (the specified certificate)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	490 * PRTime time
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	491 * time for which status is to be determined
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	492 * void *pwArg
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	493 * argument for password prompting, if needed
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	494 * RETURN:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	495 * Returns SECSuccess if an approved OCSP responder "knows" the cert
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	496 * and returns a non-revoked status for it; SECFailure otherwise,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	497 * with an error set describing the reason:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	498 *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	499 * SEC_ERROR_OCSP_BAD_HTTP_RESPONSE
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	500 * SEC_ERROR_OCSP_FUTURE_RESPONSE
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	501 * SEC_ERROR_OCSP_MALFORMED_REQUEST
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	502 * SEC_ERROR_OCSP_MALFORMED_RESPONSE
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	503 * SEC_ERROR_OCSP_OLD_RESPONSE
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	504 * SEC_ERROR_OCSP_REQUEST_NEEDS_SIG
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	505 * SEC_ERROR_OCSP_SERVER_ERROR
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	506 * SEC_ERROR_OCSP_TRY_SERVER_LATER
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	507 * SEC_ERROR_OCSP_UNAUTHORIZED_REQUEST
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	508 * SEC_ERROR_OCSP_UNAUTHORIZED_RESPONSE
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	509 * SEC_ERROR_OCSP_UNKNOWN_CERT
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	510 * SEC_ERROR_OCSP_UNKNOWN_RESPONSE_STATUS
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	511 * SEC_ERROR_OCSP_UNKNOWN_RESPONSE_TYPE
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	512 *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	513 * SEC_ERROR_BAD_SIGNATURE
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	514 * SEC_ERROR_CERT_BAD_ACCESS_LOCATION
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	515 * SEC_ERROR_INVALID_TIME
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	516 * SEC_ERROR_REVOKED_CERTIFICATE
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	517 * SEC_ERROR_UNKNOWN_ISSUER
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	518 * SEC_ERROR_UNKNOWN_SIGNER
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	519 *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	520 * Other errors are any of the many possible failures in cert verification
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	521 * (e.g. SEC_ERROR_REVOKED_CERTIFICATE, SEC_ERROR_UNTRUSTED_ISSUER) when
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	522 * verifying the signer's cert, or low-level problems (error allocating
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	523 * memory, error performing ASN.1 decoding, etc.).
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	524 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	525 extern SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	526 CERT_CheckOCSPStatus(CERTCertDBHandle handle, CERTCertificate cert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	527 PRTime time, void *pwArg);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	528
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	529 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	530 * FUNCTION: CERT_CacheOCSPResponseFromSideChannel
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	531 * First, this function checks the OCSP cache to see if a good response
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	532 * for the given certificate already exists. If it does, then the function
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	533 * returns successfully.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	534 *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	535 * If not, then it validates that the given OCSP response is a valid,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	536 * good response for the given certificate and inserts it into the
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	537 * cache.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	538 *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	539 * This function is intended for use when OCSP responses are provided via a
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	540 * side-channel, i.e. TLS OCSP stapling (a.k.a. the status_request extension).
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	541 *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	542 * INPUTS:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	543 * CERTCertDBHandle *handle
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	544 * certificate DB of the cert that is being checked
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	545 * CERTCertificate *cert
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	546 * the certificate being checked
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	547 * PRTime time
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	548 * time for which status is to be determined
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	549 * SECItem *encodedResponse
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	550 * the DER encoded bytes of the OCSP response
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	551 * void *pwArg
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	552 * argument for password prompting, if needed
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	553 * RETURN:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	554 * SECSuccess if the cert was found in the cache, or if the OCSP response was
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	555 * found to be valid and inserted into the cache. SECFailure otherwise.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	556 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	557 extern SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	558 CERT_CacheOCSPResponseFromSideChannel(CERTCertDBHandle *handle,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	559 CERTCertificate *cert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	560 PRTime time,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	561 const SECItem *encodedResponse,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	562 void *pwArg);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	563
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	564 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	565 * FUNCTION: CERT_GetOCSPStatusForCertID
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	566 * Returns the OCSP status contained in the passed in parameter response
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	567 * that corresponds to the certID passed in.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	568 * INPUTS:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	569 * CERTCertDBHandle *handle
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	570 * certificate DB of the cert that is being checked
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	571 * CERTOCSPResponse *response
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	572 * the OCSP response we want to retrieve status from.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	573 * CERTOCSPCertID *certID
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	574 * the ID we want to look for from the response.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	575 * CERTCertificate *signerCert
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	576 * the certificate that was used to sign the OCSP response.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	577 * must be obtained via a call to CERT_VerifyOCSPResponseSignature.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	578 * PRTime time
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	579 * The time at which we're checking the status for.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	580 * RETURN:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	581 * Return values are the same as those for CERT_CheckOCSPStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	582 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	583 extern SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	584 CERT_GetOCSPStatusForCertID(CERTCertDBHandle *handle,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	585 CERTOCSPResponse *response,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	586 CERTOCSPCertID *certID,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	587 CERTCertificate *signerCert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	588 PRTime time);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	589
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	590 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	591 * FUNCTION CERT_GetOCSPResponseStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	592 * Returns the response status for the response passed.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	593 * INPUTS:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	594 * CERTOCSPResponse *response
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	595 * The response to query for status
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	596 * RETURN:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	597 * Returns SECSuccess if the response has a successful status value.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	598 * Otherwise it returns SECFailure and sets one of the following error
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	599 * codes via PORT_SetError
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	600 * SEC_ERROR_OCSP_MALFORMED_REQUEST
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	601 * SEC_ERROR_OCSP_SERVER_ERROR
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	602 * SEC_ERROR_OCSP_TRY_SERVER_LATER
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	603 * SEC_ERROR_OCSP_REQUEST_NEEDS_SIG
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	604 * SEC_ERROR_OCSP_UNAUTHORIZED_REQUEST
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	605 * SEC_ERROR_OCSP_UNKNOWN_RESPONSE_STATUS
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	606 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	607 extern SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	608 CERT_GetOCSPResponseStatus(CERTOCSPResponse *response);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	609
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	610 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	611 * FUNCTION CERT_CreateOCSPCertID
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	612 * Returns the OCSP certID for the certificate passed in.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	613 * INPUTS:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	614 * CERTCertificate *cert
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	615 * The certificate for which to create the certID for.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	616 * PRTime time
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	617 * The time at which the id is requested for. This is used
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	618 * to determine the appropriate issuer for the cert since
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	619 * the issuing CA may be an older expired certificate.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	620 * RETURN:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	621 * A new copy of a CERTOCSPCertID*. The memory for this certID
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	622 * should be freed by calling CERT_DestroyOCSPCertID when the
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	623 * certID is no longer necessary.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	624 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	625 extern CERTOCSPCertID*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	626 CERT_CreateOCSPCertID(CERTCertificate *cert, PRTime time);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	627
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	628 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	629 * FUNCTION: CERT_DestroyOCSPCertID
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	630 * Frees the memory associated with the certID passed in.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	631 * INPUTS:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	632 * CERTOCSPCertID* certID
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	633 * The certID that the caller no longer needs and wants to
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	634 * free the associated memory.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	635 * RETURN:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	636 * SECSuccess if freeing the memory was successful. Returns
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	637 * SECFailure if the memory passed in was not allocated with
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	638 * a call to CERT_CreateOCSPCertID.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	639 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	640 extern SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	641 CERT_DestroyOCSPCertID(CERTOCSPCertID* certID);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	642
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	643
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	644 extern CERTOCSPSingleResponse*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	645 CERT_CreateOCSPSingleResponseGood(PLArenaPool *arena,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	646 CERTOCSPCertID *id,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	647 PRTime thisUpdate,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	648 const PRTime *nextUpdate);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	649
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	650 extern CERTOCSPSingleResponse*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	651 CERT_CreateOCSPSingleResponseUnknown(PLArenaPool *arena,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	652 CERTOCSPCertID *id,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	653 PRTime thisUpdate,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	654 const PRTime *nextUpdate);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	655
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	656 extern CERTOCSPSingleResponse*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	657 CERT_CreateOCSPSingleResponseRevoked(
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	658 PLArenaPool *arena,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	659 CERTOCSPCertID *id,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	660 PRTime thisUpdate,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	661 const PRTime *nextUpdate,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	662 PRTime revocationTime,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	663 const CERTCRLEntryReasonCode* revocationReason);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	664
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	665 extern SECItem*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	666 CERT_CreateEncodedOCSPSuccessResponse(
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	667 PLArenaPool *arena,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	668 CERTCertificate *responderCert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	669 CERTOCSPResponderIDType responderIDType,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	670 PRTime producedAt,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	671 CERTOCSPSingleResponse **responses,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	672 void *wincx);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	673
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	674 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	675 * FUNCTION: CERT_CreateEncodedOCSPErrorResponse
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	676 * Creates an encoded OCSP response with an error response status.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	677 * INPUTS:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	678 * PLArenaPool *arena
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	679 * The return value is allocated from here.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	680 * If a NULL is passed in, allocation is done from the heap instead.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	681 * int error
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	682 * An NSS error code indicating an error response status. The error
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	683 * code is mapped to an OCSP response status as follows:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	684 * SEC_ERROR_OCSP_MALFORMED_REQUEST -> malformedRequest
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	685 * SEC_ERROR_OCSP_SERVER_ERROR -> internalError
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	686 * SEC_ERROR_OCSP_TRY_SERVER_LATER -> tryLater
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	687 * SEC_ERROR_OCSP_REQUEST_NEEDS_SIG -> sigRequired
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	688 * SEC_ERROR_OCSP_UNAUTHORIZED_REQUEST -> unauthorized
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	689 * where the OCSP response status is an enumerated type defined in
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	690 * RFC 2560:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	691 * OCSPResponseStatus ::= ENUMERATED {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	692 * successful (0), --Response has valid confirmations
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	693 * malformedRequest (1), --Illegal confirmation request
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	694 * internalError (2), --Internal error in issuer
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	695 * tryLater (3), --Try again later
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	696 * --(4) is not used
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	697 * sigRequired (5), --Must sign the request
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	698 * unauthorized (6) --Request unauthorized
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	699 * }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	700 * RETURN:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	701 * Returns a pointer to the SECItem holding the response.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	702 * On error, returns null with error set describing the reason:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	703 * SEC_ERROR_INVALID_ARGS
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	704 * Other errors are low-level problems (no memory, bad database, etc.).
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	705 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	706 extern SECItem*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	707 CERT_CreateEncodedOCSPErrorResponse(PLArenaPool *arena, int error);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	708
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	709 /* Sends an OCSP request using the HTTP POST method to the location addressed
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	710 * by the URL in \|location\| parameter. The request body will be
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	711 * \|encodedRequest\|, which must be a valid encoded OCSP request. On success,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	712 * the server's response is returned and the caller must free it using
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	713 * SECITEM_FreeItem. On failure, NULL is returned. No parsing or validation of
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	714 * the HTTP response is done.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	715 *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	716 * If a default HTTP client has been registered with
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	717 * SEC_RegisterDefaultHttpClient then that client is used. Otherwise, an
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	718 * internal HTTP client is used.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	719 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	720 SECItem* CERT_PostOCSPRequest(PLArenaPool arena, const char location,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	721 const SECItem *encodedRequest);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	722
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	723 /************************************************************************/
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	724 SEC_END_PROTOS
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	725
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	726 #endif /* _OCSP_H_ */

Mercurial > trustbridge > nss-cmake-static

annotate nss/lib/certhigh/ocsp.h @ 2:a945361df361