security/nss/lib/certhigh/ocspi.h

   1 /* ***** BEGIN LICENSE BLOCK *****
   2  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
   3  *
   4  * The contents of this file are subject to the Mozilla Public License Version
   5  * 1.1 (the "License"); you may not use this file except in compliance with
   6  * the License. You may obtain a copy of the License at
   7  * http://www.mozilla.org/MPL/
   8  *
   9  * Software distributed under the License is distributed on an "AS IS" basis,
  10  * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
  11  * for the specific language governing rights and limitations under the
  12  * License.
  13  *
  14  * The Original Code is the Netscape security libraries.
  15  *
  16  * The Initial Developer of the Original Code is
  17  * Netscape Communications Corporation.
  18  * Portions created by the Initial Developer are Copyright (C) 1994-2000
  19  * the Initial Developer. All Rights Reserved.
  20  *
  21  * Contributor(s):
  22  *
  23  * Alternatively, the contents of this file may be used under the terms of
  24  * either the GNU General Public License Version 2 or later (the "GPL"), or
  25  * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
  26  * in which case the provisions of the GPL or the LGPL are applicable instead
  27  * of those above. If you wish to allow use of your version of this file only
  28  * under the terms of either the GPL or the LGPL, and not to allow others to
  29  * use your version of this file under the terms of the MPL, indicate your
  30  * decision by deleting the provisions above and replace them with the notice
  31  * and other provisions required by the GPL or the LGPL. If you do not delete
  32  * the provisions above, a recipient may use your version of this file under
  33  * the terms of any one of the MPL, the GPL or the LGPL.
  34  *
  35  * ***** END LICENSE BLOCK ***** */
  36 /*
  37  * ocspi.h - NSS internal interfaces to OCSP code
  38  *
  39  * $Id: ocspi.h,v 1.9 2008/02/06 17:27:48 kaie%kuix.de Exp $
  40  */
  41
  42 #ifndef _OCSPI_H_
  43 #define _OCSPI_H_
  44
  45 SECStatus OCSP_InitGlobal(void);
  46 SECStatus OCSP_ShutdownGlobal(void);
  47
  48 ocspResponseData *
  49 ocsp_GetResponseData(CERTOCSPResponse *response, SECItem **tbsResponseDataDER);
  50
  51 ocspSignature *
  52 ocsp_GetResponseSignature(CERTOCSPResponse *response);
  53
  54 PRBool
  55 ocsp_CertIsOCSPDefaultResponder(CERTCertDBHandle *handle, CERTCertificate *cert);
  56
  57 CERTCertificate *
  58 ocsp_GetSignerCertificate(CERTCertDBHandle *handle, ocspResponseData *tbsData,
  59                           ocspSignature *signature, CERTCertificate *issuer);
  60
  61 SECStatus
  62 ocsp_VerifyResponseSignature(CERTCertificate *signerCert,
  63                              ocspSignature *signature,
  64                              SECItem *tbsResponseDataDER,
  65                              void *pwArg);
  66
  67 CERTOCSPRequest *
  68 cert_CreateSingleCertOCSPRequest(CERTOCSPCertID *certID,
  69                                  CERTCertificate *singleCert,
  70                                  int64 time,
  71                                  PRBool addServiceLocator,
  72                                  CERTCertificate *signerCert);
  73
  74 SECStatus
  75 ocsp_GetCachedOCSPResponseStatusIfFresh(CERTOCSPCertID *certID,
  76                                         int64 time,
  77                                         PRBool ignoreOcspFailureMode,
  78                                         SECStatus *rvOcsp,
  79                                         SECErrorCodes *missingResponseError);
  80
  81 /*
  82  * FUNCTION: cert_ProcessOCSPResponse
  83  *  Same behavior and basic parameters as CERT_GetOCSPStatusForCertID.
  84  *  In addition it can update the OCSP cache (using information
  85  *  available internally to this function).
  86  * INPUTS:
  87  *  CERTCertDBHandle *handle
  88  *    certificate DB of the cert that is being checked
  89  *  CERTOCSPResponse *response
  90  *    the OCSP response we want to retrieve status from.
  91  *  CERTOCSPCertID *certID
  92  *    the ID we want to look for from the response.
  93  *  CERTCertificate *signerCert
  94  *    the certificate that was used to sign the OCSP response.
  95  *    must be obtained via a call to CERT_VerifyOCSPResponseSignature.
  96  *  int64 time
  97  *    The time at which we're checking the status for.
  98  *  PRBool *certIDWasConsumed
  99  *    In and Out parameter.
 100  *    If certIDWasConsumed is NULL on input,
 101  *    this function might produce a deep copy of cert ID
 102  *    for storing it in the cache.
 103  *    If out value is true, ownership of parameter certID was
 104  *    transferred to the OCSP cache.
 105  *  SECStatus *cacheUpdateStatus
 106  *    This optional out parameter will contain the result
 107  *    of the cache update operation (if requested).
 108  *  RETURN:
 109  *    The return value is not influenced by the cache operation,
 110  *    it matches the documentation for CERT_CheckOCSPStatus
 111  */
 112
 113 SECStatus
 114 cert_ProcessOCSPResponse(CERTCertDBHandle *handle,
 115                          CERTOCSPResponse *response,
 116                          CERTOCSPCertID   *certID,
 117                          CERTCertificate  *signerCert,
 118                          int64             time,
 119                          PRBool           *certIDWasConsumed,
 120                          SECStatus        *cacheUpdateStatus);
 121
 122 /*
 123  * FUNCTION: cert_RememberOCSPProcessingFailure
 124  *  If an application notices a failure during OCSP processing,
 125  *  it should finally call this function. The failure will be recorded
 126  *  in the OCSP cache in order to avoid repetitive failures.
 127  * INPUTS:
 128  *  CERTOCSPCertID *certID
 129  *    the ID that was used for the failed OCSP processing
 130  *  PRBool *certIDWasConsumed
 131  *    Out parameter, if set to true, ownership of parameter certID was
 132  *    transferred to the OCSP cache.
 133  *  RETURN:
 134  *    Status of the cache update operation.
 135  */
 136
 137 SECStatus
 138 cert_RememberOCSPProcessingFailure(CERTOCSPCertID *certID,
 139                                    PRBool         *certIDWasConsumed);
 140
 141 #endif /* _OCSPI_H_ */