Fix engine cryptodev: pointer to IV

[oweals/openssl.git] / crypto / ct / ct_locl.h

diff --git a/crypto/ct/ct_locl.h b/crypto/ct/ct_locl.h
index b82fabc4f0dead57a8e0dbf546d7f2c41d33ef45..b1a65d626277c11b5e40ad9334e3598855759f91 100644 (file)
--- a/crypto/ct/ct_locl.h
+++ b/crypto/ct/ct_locl.h
@@ -50,15 +50,11 @@
  * ====================================================================
  */
 
-#ifdef OPENSSL_NO_CT
-# error CT is disabled.
-#endif
-
 #include <stddef.h>
-
 #include <openssl/ct.h>
 #include <openssl/evp.h>
 #include <openssl/x509.h>
+#include <openssl/x509v3.h>
 #include <openssl/safestack.h>
 
 /*
@@ -125,8 +121,6 @@ struct sct_st {
     ct_log_entry_type_t entry_type;
     /* Where this SCT was found, e.g. certificate, OCSP response, etc. */
     sct_source_t source;
-    /* The CT log that produced this SCT. */
-    CTLOG *log;
     /* The result of the last attempt to validate this SCT. */
     sct_validation_status_t validation_status;
 };
@@ -154,8 +148,6 @@ struct ct_policy_eval_ctx_st {
     X509 *cert;
     X509 *issuer;
     CTLOG_STORE *log_store;
-    STACK_OF(SCT) *good_scts;
-    STACK_OF(SCT) *bad_scts;
 };
 
 /*
@@ -167,20 +159,45 @@ SCT_CTX *SCT_CTX_new(void);
  */
 void SCT_CTX_free(SCT_CTX *sctx);
 
-/* Sets the certificate that the SCT is related to */
-int SCT_CTX_set1_cert(SCT_CTX *sctx, X509 *cert, X509 *presigner);
-/* Sets the issuer of the certificate that the SCT is related to */
-int SCT_CTX_set1_issuer(SCT_CTX *sctx, const X509 *issuer);
-/* Sets the public key of the issuer of the certificate that the SCT relates to */
-int SCT_CTX_set1_issuer_pubkey(SCT_CTX *sctx, X509_PUBKEY *pubkey);
-/* Sets the public key of the CT log that the SCT is from */
-int SCT_CTX_set1_pubkey(SCT_CTX *sctx, X509_PUBKEY *pubkey);
+/*
+ * Sets the certificate that the SCT was created for.
+ * If *cert does not have a poison extension, presigner must be NULL.
+ * If *cert does not have a poison extension, it may have a single SCT
+ * (NID_ct_precert_scts) extension.
+ * If either *cert or *presigner have an AKID (NID_authority_key_identifier)
+ * extension, both must have one.
+ * Returns 1 on success, 0 on failure.
+ */
+__owur int SCT_CTX_set1_cert(SCT_CTX *sctx, X509 *cert, X509 *presigner);
+
+/*
+ * Sets the issuer of the certificate that the SCT was created for.
+ * This is just a convenience method to save extracting the public key and
+ * calling SCT_CTX_set1_issuer_pubkey().
+ * Issuer must not be NULL.
+ * Returns 1 on success, 0 on failure.
+ */
+__owur int SCT_CTX_set1_issuer(SCT_CTX *sctx, const X509 *issuer);
 
 /*
- * Does this SCT have the minimum fields populated to be usuable?
+ * Sets the public key of the issuer of the certificate that the SCT was created
+ * for.
+ * The public key must not be NULL.
+ * Returns 1 on success, 0 on failure.
+ */
+__owur int SCT_CTX_set1_issuer_pubkey(SCT_CTX *sctx, X509_PUBKEY *pubkey);
+
+/*
+ * Sets the public key of the CT log that the SCT is from.
+ * Returns 1 on success, 0 on failure.
+ */
+__owur int SCT_CTX_set1_pubkey(SCT_CTX *sctx, X509_PUBKEY *pubkey);
+
+/*
+ * Does this SCT have the minimum fields populated to be usable?
  * Returns 1 if so, 0 otherwise.
  */
-int SCT_is_complete(const SCT *sct);
+__owur int SCT_is_complete(const SCT *sct);
 
 /*
  * Does this SCT have the signature-related fields populated?
@@ -188,6 +205,10 @@ int SCT_is_complete(const SCT *sct);
  * This checks that the signature and hash algorithms are set to supported
  * values and that the signature field is set.
  */
-int SCT_signature_is_complete(const SCT *sct);
+__owur int SCT_signature_is_complete(const SCT *sct);
 
 
+/*
+ * Handlers for Certificate Transparency X509v3/OCSP extensions
+ */
+extern const X509V3_EXT_METHOD v3_ct_scts[];