[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[SCM] GNU gnutls branch, master, updated. gnutls_3_1_2-26-gc348926
|
From: |
Nikos Mavrogiannopoulos |
|
Subject: |
[SCM] GNU gnutls branch, master, updated. gnutls_3_1_2-26-gc348926 |
|
Date: |
Sun, 30 Sep 2012 22:37:36 +0000 |
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU gnutls".
http://git.savannah.gnu.org/cgit/gnutls.git/commit/?id=c34892626fe63157fac460877841fd7067bc1a6c
The branch, master has been updated
via c34892626fe63157fac460877841fd7067bc1a6c (commit)
via 59f20230fa3813b35286cc73edfa7029c7b694f5 (commit)
via 494ecee11ad5b650bf1b187c68b69a7aee4f23be (commit)
via a1e4b3ae4390988b9f16806b2e498f2f86f869c9 (commit)
from c9d778ddf36a19a427d30e501ba2b5d7ad81898a (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit c34892626fe63157fac460877841fd7067bc1a6c
Author: Nikos Mavrogiannopoulos <address@hidden>
Date: Mon Oct 1 00:20:53 2012 +0200
doc update
commit 59f20230fa3813b35286cc73edfa7029c7b694f5
Author: Nikos Mavrogiannopoulos <address@hidden>
Date: Mon Oct 1 00:19:03 2012 +0200
Added gnutls_x509_crl_reason_flags_t.
commit 494ecee11ad5b650bf1b187c68b69a7aee4f23be
Author: Nikos Mavrogiannopoulos <address@hidden>
Date: Mon Oct 1 00:18:43 2012 +0200
read revocation reason
commit a1e4b3ae4390988b9f16806b2e498f2f86f869c9
Author: Nikos Mavrogiannopoulos <address@hidden>
Date: Sun Sep 30 22:59:12 2012 +0200
simplified doc
-----------------------------------------------------------------------
Summary of changes:
doc/cha-cert-auth2.texi | 163 ++++++++++++++++---------------
lib/includes/gnutls/gnutls.h.in | 3 +-
lib/includes/gnutls/ocsp.h | 201 +++++++++++++++++++--------------------
lib/includes/gnutls/x509.h | 38 ++++++--
lib/x509/ocsp.c | 40 +++-----
lib/x509/x509.c | 12 +--
6 files changed, 229 insertions(+), 228 deletions(-)
diff --git a/doc/cha-cert-auth2.texi b/doc/cha-cert-auth2.texi
index fa6c55d..e375050 100644
--- a/doc/cha-cert-auth2.texi
+++ b/doc/cha-cert-auth2.texi
@@ -57,17 +57,13 @@ which should return a signed certificate.
@cindex CRL
A certificate revocation list (CRL) is a structure issued by an authority
-periodically containing a list of revoked certificates serial numbers.
+periodically containing a list of revoked certificates serial numbers.
The CRL structure is signed with the issuing authorities' keys. A typical
CRL contains the fields as shown in @ref{tab:crl}.
Certificate revocation lists are used to complement the expiration date of a
certificate,
in order to account for other reasons of revocation, such as compromised keys,
etc.
-A certificate request can be generated by
-associating it with a private key, setting the
-subject's information and finally self signing it.
-The last step ensures that the requester is in
-possession of the private key. Each CRL is valid for limited amount of
+Each CRL is valid for limited amount of
time and is required to provide, except for the current issuing time, also
the issuing time of the next update.
@@ -101,6 +97,24 @@ Optional CRL structure extensions.
@caption{Certificate revocation list fields.}
@end float
+The basic CRL structure functions follow.
+
address@hidden,gnutls_x509_crl_import,gnutls_x509_crl_export}
+
address@hidden Reading a CRL
+
+The most important function that extracts the certificate revocation
+information from a CRL is @funcref{gnutls_x509_crl_get_crt_serial}. Other
+functions that return other fields of the CRL structure are also provided.
+
address@hidden
+
address@hidden,gnutls_x509_crl_get_issuer_dn,gnutls_x509_crl_get_this_update,gnutls_x509_crl_get_next_update,gnutls_x509_crl_get_crt_count}
+
+
address@hidden Generation of a CRL
+
+The following functions can be used to generate a CRL.
@showfuncE{gnutls_x509_crl_set_version,gnutls_x509_crl_set_crt_serial,gnutls_x509_crl_set_crt,gnutls_x509_crl_set_next_update,gnutls_x509_crl_set_this_update}
@@ -140,10 +154,9 @@ in a CRL and/or perform an OCSP check for the certificate.
Before performing the OCSP query, the application will need to figure
out the address of the OCSP server. The OCSP server address can be
provided by the local user in manual configuration or may be stored
-in the certificate that is being checked. The latter is due to
-an extension field called the Authority Information Access (AIA) which
-may hold the location of the OCSP responder in
-the access method called @code{id-ad-ocsp}. The following function
+in the certificate that is being checked. When stored in a certificate
+the OCSP server is in the extension field called the Authority Information
+Access (AIA). The following function
extracts this information from a certificate.
@showfuncA{gnutls_x509_crt_get_authority_info_access}
@@ -191,19 +204,22 @@ requests are the following.
@showfuncE{gnutls_ocsp_req_init,gnutls_ocsp_req_deinit,gnutls_ocsp_req_import,gnutls_ocsp_req_export,gnutls_ocsp_req_print}
-There are two interfaces for setting the identity of a certificate in
-a OCSP request, the first being a low-level function when you have the
+To generate an OCSP request the issuer name hash, issuer key hash, and
+the checked certificate's serial number are required. There are two
+interfaces available for setting those in an OCSP request.
+The is a low-level function when you have the
issuer name hash, issuer key hash, and certificate serial number in
-binary form. The second is usually more useful if you have the
+binary form. The second is more useful if you have the
certificate (and its issuer) in a @code{gnutls_x509_crt_t} type.
-There is also a function to extract this information from an OCSP
+There is also a function to extract this information from existing an OCSP
request.
@showfuncC{gnutls_ocsp_req_add_cert_id,gnutls_ocsp_req_add_cert,gnutls_ocsp_req_get_cert_id}
Each OCSP request may contain a number of extensions. Extensions are
identified by an Object Identifier (OID) and an opaque data buffer
-whose syntax and semantics is implied by the OID.
+whose syntax and semantics is implied by the OID. You can extract or
+set those extensions using the following functions.
@showfuncB{gnutls_ocsp_req_get_extension,gnutls_ocsp_req_set_extension}
@@ -215,76 +231,65 @@ attacker will not be able to give a stale response for
the same nonce.
@showfuncC{gnutls_ocsp_req_get_nonce,gnutls_ocsp_req_set_nonce,gnutls_ocsp_req_randomize_nonce}
-The OCSP response structures is a bit more complex than the request.
-The important ASN.1 structure is as follows. In practice, all OCSP
-responses contain a Basic OCSP response sub-structure.
+The OCSP response structures is a complex structure. A simplified overview
+of it is in @ref{tab:ocsp-response}. Note that a response may contain
+information on multiple certificates.
+
address@hidden Table,tab:ocsp-response
address@hidden @columnfractions .2 .7
+
address@hidden Field @tab Description
+
address@hidden version @tab
+The OCSP response version number (typically 1).
+
address@hidden responder ID @tab
+An identifier of the responder (DN name or a hash of its key).
+
address@hidden issue time @tab
+The time the response was generated.
+
address@hidden thisUpdate @tab
+The issuing time of the revocation information.
+
address@hidden nextUpdate @tab
+The issuing time of the revocation information that will update that one.
+
address@hidden certificate status @tab
+The status of the certificate.
+
address@hidden certificate serial @tab
+The certificate's serial number.
+
address@hidden Revocation time @tab
+The time the certificate was revoked.
+
address@hidden Revocation reason @tab
+The reason the certificate was revoked.
+
address@hidden multitable
address@hidden most important OCSP response fields.}
address@hidden float
address@hidden
-OCSPResponse ::= SEQUENCE @{
- responseStatus OCSPResponseStatus,
- responseBytes [0] EXPLICIT ResponseBytes OPTIONAL @}
-
-OCSPResponseStatus ::= ENUMERATED @{
- successful (0), --Response has valid confirmations
- malformedRequest (1), --Illegal confirmation request
- internalError (2), --Internal error in issuer
- tryLater (3), --Try again later
- --(4) is not used
- sigRequired (5), --Must sign the request
- unauthorized (6) --Request unauthorized @}
-
-ResponseBytes ::= SEQUENCE @{
- responseType OBJECT IDENTIFIER,
- response OCTET STRING @}
-
-id-pkix-ocsp-basic OBJECT IDENTIFIER ::= @{ id-pkix-ocsp 1 @}
-
-BasicOCSPResponse ::= SEQUENCE @{
- tbsResponseData ResponseData,
- signatureAlgorithm AlgorithmIdentifier,
- signature BIT STRING,
- certs [0] EXPLICIT SEQUENCE OF Certificate OPTIONAL @}
-
-ResponseData ::= SEQUENCE @{
- version [0] EXPLICIT Version DEFAULT v1,
- responderID ResponderID,
- producedAt GeneralizedTime,
- responses SEQUENCE OF SingleResponse,
- responseExtensions [1] EXPLICIT Extensions OPTIONAL @}
-
-ResponderID ::= CHOICE @{
- byName [1] Name,
- byKey [2] KeyHash @}
-
-KeyHash ::= OCTET STRING -- SHA-1 hash of responder's public key
-(excluding the tag and length fields)
-
-SingleResponse ::= SEQUENCE @{
- certID CertID,
- certStatus CertStatus,
- thisUpdate GeneralizedTime,
- nextUpdate [0] EXPLICIT GeneralizedTime OPTIONAL,
- singleExtensions [1] EXPLICIT Extensions OPTIONAL @}
-
-CertStatus ::= CHOICE @{
- good [0] IMPLICIT NULL,
- revoked [1] IMPLICIT RevokedInfo,
- unknown [2] IMPLICIT UnknownInfo @}
-
-RevokedInfo ::= SEQUENCE @{
- revocationTime GeneralizedTime,
- revocationReason [0] EXPLICIT CRLReason OPTIONAL @}
address@hidden example
We provide basic functions for initialization, importing, exporting
-and deallocating OCSP responses. The Basic OCSP Response structure is
-automatically parsed when an OCSP Response is imported.
+and deallocating OCSP responses.
@showfuncE{gnutls_ocsp_resp_init,gnutls_ocsp_resp_deinit,gnutls_ocsp_resp_import,gnutls_ocsp_resp_export,gnutls_ocsp_resp_print}
-The OCSP response needs to be verified against some set of trust
-anchors before it can be relied upon, and it is wise to check whether
-the OCSP response corresponds to the certificate being checked.
+The utility function that extracts the revocation as well as other information
+from a response is shown below.
+
address@hidden
+
+The possible revocation reasons available in an OCSP response are shown
+below.
+
address@hidden,The revocation reasons}
+
+Note, that the OCSP response needs to be verified against some set of trust
+anchors before it can be relied upon. It is also important to check
+whether the received OCSP response corresponds to the certificate being
checked.
@showfuncC{gnutls_ocsp_resp_verify,gnutls_ocsp_resp_verify_direct,gnutls_ocsp_resp_check_crt}
diff --git a/lib/includes/gnutls/gnutls.h.in b/lib/includes/gnutls/gnutls.h.in
index c364440..e7de530 100644
--- a/lib/includes/gnutls/gnutls.h.in
+++ b/lib/includes/gnutls/gnutls.h.in
@@ -398,8 +398,9 @@ extern "C"
* @GNUTLS_HANDSHAKE_CERTIFICATE_VERIFY: Certificate verify.
* @GNUTLS_HANDSHAKE_CLIENT_KEY_EXCHANGE: Client key exchange.
* @GNUTLS_HANDSHAKE_FINISHED: Finished.
+ * @GNUTLS_HANDSHAKE_CERTIFICATE_STATUS: Certificate status (OCSP).
* @GNUTLS_HANDSHAKE_SUPPLEMENTAL: Supplemental.
- * @GNUTLS_HANDSHAKE_CHANGE_CIPHER_SPEC: Change Cipher Spec
+ * @GNUTLS_HANDSHAKE_CHANGE_CIPHER_SPEC: Change Cipher Spec.
* @GNUTLS_HANDSHAKE_CLIENT_HELLO_V2: SSLv2 Client Hello.
*
* Enumeration of different TLS handshake packets.
diff --git a/lib/includes/gnutls/ocsp.h b/lib/includes/gnutls/ocsp.h
index 2ad220e..af10feb 100644
--- a/lib/includes/gnutls/ocsp.h
+++ b/lib/includes/gnutls/ocsp.h
@@ -36,111 +36,110 @@ extern "C"
#define GNUTLS_OCSP_NONCE "1.3.6.1.5.5.7.48.1.2"
- /**
- * gnutls_ocsp_print_formats_t:
- * @GNUTLS_OCSP_PRINT_FULL: Full information about OCSP request/response.
- * @GNUTLS_OCSP_PRINT_COMPACT: More compact information about OCSP
request/response.
- *
- * Enumeration of different OCSP printing variants.
- */
- typedef enum gnutls_ocsp_print_formats_t
- {
- GNUTLS_OCSP_PRINT_FULL = 0,
- GNUTLS_OCSP_PRINT_COMPACT = 1,
- } gnutls_ocsp_print_formats_t;
+/**
+ * gnutls_ocsp_print_formats_t:
+ * @GNUTLS_OCSP_PRINT_FULL: Full information about OCSP request/response.
+ * @GNUTLS_OCSP_PRINT_COMPACT: More compact information about OCSP
request/response.
+ *
+ * Enumeration of different OCSP printing variants.
+ */
+typedef enum gnutls_ocsp_print_formats_t
+ {
+ GNUTLS_OCSP_PRINT_FULL = 0,
+ GNUTLS_OCSP_PRINT_COMPACT = 1,
+ } gnutls_ocsp_print_formats_t;
- /**
- * gnutls_ocsp_resp_status_t:
- * @GNUTLS_OCSP_RESP_SUCCESSFUL: Response has valid confirmations.
- * @GNUTLS_OCSP_RESP_MALFORMEDREQUEST: Illegal confirmation request
- * @GNUTLS_OCSP_RESP_INTERNALERROR: Internal error in issuer
- * @GNUTLS_OCSP_RESP_TRYLATER: Try again later
- * @GNUTLS_OCSP_RESP_SIGREQUIRED: Must sign the request
- * @GNUTLS_OCSP_RESP_UNAUTHORIZED: Request unauthorized
- *
- * Enumeration of different OCSP response status codes.
- */
- typedef enum gnutls_ocsp_resp_status_t
- {
- GNUTLS_OCSP_RESP_SUCCESSFUL = 0,
- GNUTLS_OCSP_RESP_MALFORMEDREQUEST = 1,
- GNUTLS_OCSP_RESP_INTERNALERROR = 2,
- GNUTLS_OCSP_RESP_TRYLATER = 3,
- GNUTLS_OCSP_RESP_SIGREQUIRED = 5,
- GNUTLS_OCSP_RESP_UNAUTHORIZED = 6
- } gnutls_ocsp_resp_status_t;
+/**
+ * gnutls_ocsp_resp_status_t:
+ * @GNUTLS_OCSP_RESP_SUCCESSFUL: Response has valid confirmations.
+ * @GNUTLS_OCSP_RESP_MALFORMEDREQUEST: Illegal confirmation request
+ * @GNUTLS_OCSP_RESP_INTERNALERROR: Internal error in issuer
+ * @GNUTLS_OCSP_RESP_TRYLATER: Try again later
+ * @GNUTLS_OCSP_RESP_SIGREQUIRED: Must sign the request
+ * @GNUTLS_OCSP_RESP_UNAUTHORIZED: Request unauthorized
+ *
+ * Enumeration of different OCSP response status codes.
+ */
+typedef enum gnutls_ocsp_resp_status_t
+ {
+ GNUTLS_OCSP_RESP_SUCCESSFUL = 0,
+ GNUTLS_OCSP_RESP_MALFORMEDREQUEST = 1,
+ GNUTLS_OCSP_RESP_INTERNALERROR = 2,
+ GNUTLS_OCSP_RESP_TRYLATER = 3,
+ GNUTLS_OCSP_RESP_SIGREQUIRED = 5,
+ GNUTLS_OCSP_RESP_UNAUTHORIZED = 6
+ } gnutls_ocsp_resp_status_t;
- /**
- * gnutls_ocsp_cert_status_t:
- * @GNUTLS_OCSP_CERT_GOOD: Positive response to status inquiry.
- * @GNUTLS_OCSP_CERT_REVOKED: Certificate has been revoked.
- * @GNUTLS_OCSP_CERT_UNKNOWN: The responder doesn't know about the
- * certificate.
- *
- * Enumeration of different OCSP response certificate status codes.
- */
- typedef enum gnutls_ocsp_cert_status_t
- {
- GNUTLS_OCSP_CERT_GOOD = 0,
- GNUTLS_OCSP_CERT_REVOKED = 1,
- GNUTLS_OCSP_CERT_UNKNOWN = 2
- } gnutls_ocsp_cert_status_t;
+/**
+ * gnutls_ocsp_cert_status_t:
+ * @GNUTLS_OCSP_CERT_GOOD: Positive response to status inquiry.
+ * @GNUTLS_OCSP_CERT_REVOKED: Certificate has been revoked.
+ * @GNUTLS_OCSP_CERT_UNKNOWN: The responder doesn't know about the
+ * certificate.
+ *
+ * Enumeration of different OCSP response certificate status codes.
+ */
+typedef enum gnutls_ocsp_cert_status_t
+ {
+ GNUTLS_OCSP_CERT_GOOD = 0,
+ GNUTLS_OCSP_CERT_REVOKED = 1,
+ GNUTLS_OCSP_CERT_UNKNOWN = 2
+ } gnutls_ocsp_cert_status_t;
- /**
- * gnutls_x509_crl_reason_t:
- * @GNUTLS_X509_CRLREASON_UNSPECIFIED: Unspecified reason.
- * @GNUTLS_X509_CRLREASON_KEYCOMPROMISE: Private key compromised.
- * @GNUTLS_X509_CRLREASON_CACOMPROMISE: CA compromised.
- * @GNUTLS_X509_CRLREASON_AFFILIATIONCHANGED: Affiliation has changed.
- * @GNUTLS_X509_CRLREASON_SUPERSEDED: Certificate superseded.
- * @GNUTLS_X509_CRLREASON_CESSATIONOFOPERATION: Operation has ceased.
- * @GNUTLS_X509_CRLREASON_CERTIFICATEHOLD: Certificate is on hold.
- * @GNUTLS_X509_CRLREASON_REMOVEFROMCRL: Will be removed from delta CRL.
- * @GNUTLS_X509_CRLREASON_PRIVILEGEWITHDRAWN: Privilege withdrawn.
- * @GNUTLS_X509_CRLREASON_AACOMPROMISE: AA compromised.
- *
- * Enumeration of different reason codes. Note that this
- * corresponds to the CRLReason ASN.1 enumeration type, and not the
- * ReasonFlags ASN.1 bit string.
- */
- typedef enum gnutls_x509_crl_reason_t
- {
- GNUTLS_X509_CRLREASON_UNSPECIFIED = 0,
- GNUTLS_X509_CRLREASON_KEYCOMPROMISE = 1,
- GNUTLS_X509_CRLREASON_CACOMPROMISE = 2,
- GNUTLS_X509_CRLREASON_AFFILIATIONCHANGED = 3,
- GNUTLS_X509_CRLREASON_SUPERSEDED = 4,
- GNUTLS_X509_CRLREASON_CESSATIONOFOPERATION = 5,
- GNUTLS_X509_CRLREASON_CERTIFICATEHOLD = 6,
- /* -- value 7 is not used */
- GNUTLS_X509_CRLREASON_REMOVEFROMCRL = 8,
- GNUTLS_X509_CRLREASON_PRIVILEGEWITHDRAWN = 9,
- GNUTLS_X509_CRLREASON_AACOMPROMISE = 10
- } gnutls_x509_crl_reason_t;
+/**
+ * gnutls_x509_crl_reason_t:
+ * @GNUTLS_X509_CRLREASON_UNSPECIFIED: Unspecified reason.
+ * @GNUTLS_X509_CRLREASON_KEYCOMPROMISE: Private key compromised.
+ * @GNUTLS_X509_CRLREASON_CACOMPROMISE: CA compromised.
+ * @GNUTLS_X509_CRLREASON_AFFILIATIONCHANGED: Affiliation has changed.
+ * @GNUTLS_X509_CRLREASON_SUPERSEDED: Certificate superseded.
+ * @GNUTLS_X509_CRLREASON_CESSATIONOFOPERATION: Operation has ceased.
+ * @GNUTLS_X509_CRLREASON_CERTIFICATEHOLD: Certificate is on hold.
+ * @GNUTLS_X509_CRLREASON_REMOVEFROMCRL: Will be removed from delta CRL.
+ * @GNUTLS_X509_CRLREASON_PRIVILEGEWITHDRAWN: Privilege withdrawn.
+ * @GNUTLS_X509_CRLREASON_AACOMPROMISE: AA compromised.
+ *
+ * Enumeration of different reason codes. Note that this
+ * corresponds to the CRLReason ASN.1 enumeration type, and not the
+ * ReasonFlags ASN.1 bit string.
+ */
+typedef enum gnutls_x509_crl_reason_t
+ {
+ GNUTLS_X509_CRLREASON_UNSPECIFIED = 0,
+ GNUTLS_X509_CRLREASON_KEYCOMPROMISE = 1,
+ GNUTLS_X509_CRLREASON_CACOMPROMISE = 2,
+ GNUTLS_X509_CRLREASON_AFFILIATIONCHANGED = 3,
+ GNUTLS_X509_CRLREASON_SUPERSEDED = 4,
+ GNUTLS_X509_CRLREASON_CESSATIONOFOPERATION = 5,
+ GNUTLS_X509_CRLREASON_CERTIFICATEHOLD = 6,
+ GNUTLS_X509_CRLREASON_REMOVEFROMCRL = 8,
+ GNUTLS_X509_CRLREASON_PRIVILEGEWITHDRAWN = 9,
+ GNUTLS_X509_CRLREASON_AACOMPROMISE = 10
+ } gnutls_x509_crl_reason_t;
- /**
- * gnutls_ocsp_verify_reason_t:
- * @GNUTLS_OCSP_VERIFY_SIGNER_NOT_FOUND: Signer cert not found.
- * @GNUTLS_OCSP_VERIFY_SIGNER_KEYUSAGE_ERROR: Signer keyusage bits incorrect.
- * @GNUTLS_OCSP_VERIFY_UNTRUSTED_SIGNER: Signer is not trusted.
- * @GNUTLS_OCSP_VERIFY_INSECURE_ALGORITHM: Signature using insecure
algorithm.
- * @GNUTLS_OCSP_VERIFY_SIGNATURE_FAILURE: Signature mismatch.
- * @GNUTLS_OCSP_VERIFY_CERT_NOT_ACTIVATED: Signer cert is not yet activated.
- * @GNUTLS_OCSP_VERIFY_CERT_EXPIRED: Signer cert has expired.
- *
- * Enumeration of OCSP verify status codes, used by
- * gnutls_ocsp_resp_verify() and gnutls_ocsp_resp_verify_direct().
- */
- typedef enum gnutls_ocsp_verify_reason_t
- {
- GNUTLS_OCSP_VERIFY_SIGNER_NOT_FOUND = 1,
- GNUTLS_OCSP_VERIFY_SIGNER_KEYUSAGE_ERROR = 2,
- GNUTLS_OCSP_VERIFY_UNTRUSTED_SIGNER = 4,
- GNUTLS_OCSP_VERIFY_INSECURE_ALGORITHM = 8,
- GNUTLS_OCSP_VERIFY_SIGNATURE_FAILURE = 16,
- GNUTLS_OCSP_VERIFY_CERT_NOT_ACTIVATED = 32,
- GNUTLS_OCSP_VERIFY_CERT_EXPIRED = 64
- } gnutls_ocsp_verify_reason_t;
+/**
+ * gnutls_ocsp_verify_reason_t:
+ * @GNUTLS_OCSP_VERIFY_SIGNER_NOT_FOUND: Signer cert not found.
+ * @GNUTLS_OCSP_VERIFY_SIGNER_KEYUSAGE_ERROR: Signer keyusage bits incorrect.
+ * @GNUTLS_OCSP_VERIFY_UNTRUSTED_SIGNER: Signer is not trusted.
+ * @GNUTLS_OCSP_VERIFY_INSECURE_ALGORITHM: Signature using insecure algorithm.
+ * @GNUTLS_OCSP_VERIFY_SIGNATURE_FAILURE: Signature mismatch.
+ * @GNUTLS_OCSP_VERIFY_CERT_NOT_ACTIVATED: Signer cert is not yet activated.
+ * @GNUTLS_OCSP_VERIFY_CERT_EXPIRED: Signer cert has expired.
+ *
+ * Enumeration of OCSP verify status codes, used by
+ * gnutls_ocsp_resp_verify() and gnutls_ocsp_resp_verify_direct().
+ */
+typedef enum gnutls_ocsp_verify_reason_t
+ {
+ GNUTLS_OCSP_VERIFY_SIGNER_NOT_FOUND = 1,
+ GNUTLS_OCSP_VERIFY_SIGNER_KEYUSAGE_ERROR = 2,
+ GNUTLS_OCSP_VERIFY_UNTRUSTED_SIGNER = 4,
+ GNUTLS_OCSP_VERIFY_INSECURE_ALGORITHM = 8,
+ GNUTLS_OCSP_VERIFY_SIGNATURE_FAILURE = 16,
+ GNUTLS_OCSP_VERIFY_CERT_NOT_ACTIVATED = 32,
+ GNUTLS_OCSP_VERIFY_CERT_EXPIRED = 64
+ } gnutls_ocsp_verify_reason_t;
struct gnutls_ocsp_req_int;
typedef struct gnutls_ocsp_req_int *gnutls_ocsp_req_t;
diff --git a/lib/includes/gnutls/x509.h b/lib/includes/gnutls/x509.h
index 8ca2e1b..94e01a4 100644
--- a/lib/includes/gnutls/x509.h
+++ b/lib/includes/gnutls/x509.h
@@ -212,16 +212,34 @@ extern "C"
gnutls_datum_t * data,
unsigned int *critical);
-#define GNUTLS_CRL_REASON_UNUSED 128
-#define GNUTLS_CRL_REASON_KEY_COMPROMISE 64
-#define GNUTLS_CRL_REASON_CA_COMPROMISE 32
-#define GNUTLS_CRL_REASON_AFFILIATION_CHANGED 16
-#define GNUTLS_CRL_REASON_SUPERSEDED 8
-#define GNUTLS_CRL_REASON_SUPERSEEDED GNUTLS_CRL_REASON_SUPERSEDED
-#define GNUTLS_CRL_REASON_CESSATION_OF_OPERATION 4
-#define GNUTLS_CRL_REASON_CERTIFICATE_HOLD 2
-#define GNUTLS_CRL_REASON_PRIVILEGE_WITHDRAWN 1
-#define GNUTLS_CRL_REASON_AA_COMPROMISE 32768
+#define GNUTLS_CRL_REASON_SUPERSEEDED GNUTLS_CRL_REASON_SUPERSEDED,
+ /**
+ * gnutls_x509_crl_reason_flags_t:
+ * @GNUTLS_CRL_REASON_PRIVILEGE_WITHDRAWN: The privileges were withdrawn
from the owner.
+ * @GNUTLS_CRL_REASON_CERTIFICATE_HOLD: The certificate is on hold.
+ * @GNUTLS_CRL_REASON_CESSATION_OF_OPERATION: The end-entity is no longer
operating.
+ * @GNUTLS_CRL_REASON_SUPERSEDED: There is a newer certificate of the owner.
+ * @GNUTLS_CRL_REASON_AFFILIATION_CHANGED: The end-entity affiliation has
changed.
+ * @GNUTLS_CRL_REASON_CA_COMPROMISE: The CA was compromised.
+ * @GNUTLS_CRL_REASON_KEY_COMPROMISE: The certificate's key was compromised.
+ * @GNUTLS_CRL_REASON_UNUSED: The key was never used.
+ * @GNUTLS_CRL_REASON_AA_COMPROMISE: AA compromised.
+ *
+ * Enumeration of types for the CRL revocation reasons.
+ */
+ typedef enum gnutls_x509_crl_reason_flags_t
+ {
+ GNUTLS_CRL_REASON_UNSPECIFIED=0,
+ GNUTLS_CRL_REASON_PRIVILEGE_WITHDRAWN=1,
+ GNUTLS_CRL_REASON_CERTIFICATE_HOLD=2,
+ GNUTLS_CRL_REASON_CESSATION_OF_OPERATION=4,
+ GNUTLS_CRL_REASON_SUPERSEDED=8,
+ GNUTLS_CRL_REASON_AFFILIATION_CHANGED=16,
+ GNUTLS_CRL_REASON_CA_COMPROMISE=32,
+ GNUTLS_CRL_REASON_KEY_COMPROMISE=64,
+ GNUTLS_CRL_REASON_UNUSED=128,
+ GNUTLS_CRL_REASON_AA_COMPROMISE=32768
+ } gnutls_x509_crl_reason_flags_t;
int gnutls_x509_crt_get_crl_dist_points (gnutls_x509_crt_t cert,
unsigned int seq, void *ret,
diff --git a/lib/x509/ocsp.c b/lib/x509/ocsp.c
index b7e134c..2ec35a5 100644
--- a/lib/x509/ocsp.c
+++ b/lib/x509/ocsp.c
@@ -1386,32 +1386,8 @@ cleanup:
*
* This function will return the certificate information of the
* @indx'ed response in the Basic OCSP Response @resp. The
- * information returned corresponds to the SingleResponse structure
- * except the final singleExtensions, reproduced here for illustration:
- *
- * <informalexample><programlisting>
- * SingleResponse ::= SEQUENCE {
- * certID CertID,
- * certStatus CertStatus,
- * thisUpdate GeneralizedTime,
- * nextUpdate [0] EXPLICIT GeneralizedTime OPTIONAL,
- * singleExtensions [1] EXPLICIT Extensions OPTIONAL }
- *
- * CertID ::= SEQUENCE {
- * hashAlgorithm AlgorithmIdentifier,
- * issuerNameHash OCTET STRING, -- Hash of Issuer's DN
- * issuerKeyHash OCTET STRING, -- Hash of Issuers public key
- * serialNumber CertificateSerialNumber }
- *
- * CertStatus ::= CHOICE {
- * good [0] IMPLICIT NULL,
- * revoked [1] IMPLICIT RevokedInfo,
- * unknown [2] IMPLICIT UnknownInfo }
- *
- * RevokedInfo ::= SEQUENCE {
- * revocationTime GeneralizedTime,
- * revocationReason [0] EXPLICIT CRLReason OPTIONAL }
- * </programlisting></informalexample>
+ * information returned corresponds to the OCSP SingleResponse structure
+ * except the final singleExtensions.
*
* Each of the pointers to output variables may be NULL to indicate
* that the caller is not interested in that value.
@@ -1596,6 +1572,18 @@ gnutls_ocsp_resp_get_single (gnutls_ocsp_resp_t resp,
}
/* revocation_reason */
+ if (revocation_reason)
+ {
+ snprintf (name, sizeof (name),
+ "tbsResponseData.responses.?%u.certStatus."
+ "revoked.revocationReason",
+ indx + 1);
+
+ ret = _gnutls_x509_read_uint (resp->basicresp, name,
+ revocation_reason);
+ if (ret < 0)
+ return gnutls_assert_val(ret);
+ }
return GNUTLS_E_SUCCESS;
}
diff --git a/lib/x509/x509.c b/lib/x509/x509.c
index 63be9bc..0e1430d 100644
--- a/lib/x509/x509.c
+++ b/lib/x509/x509.c
@@ -2758,23 +2758,13 @@ gnutls_x509_crt_verify_hash (gnutls_x509_crt_t crt,
unsigned int flags,
* @seq: specifies the sequence number of the distribution point (0 for the
first one, 1 for the second etc.)
* @ret: is the place where the distribution point will be copied to
* @ret_size: holds the size of ret.
- * @reason_flags: Revocation reasons flags.
+ * @reason_flags: Revocation reasons. An ORed sequence of flags from
%gnutls_x509_crl_reason_flags_t.
* @critical: will be non (0) if the extension is marked as critical (may be
null)
*
* This function retrieves the CRL distribution points (2.5.29.31),
* contained in the given certificate in the X509v3 Certificate
* Extensions.
*
- * @reason_flags should be an ORed sequence of
- * %GNUTLS_CRL_REASON_UNUSED, %GNUTLS_CRL_REASON_KEY_COMPROMISE,
- * %GNUTLS_CRL_REASON_CA_COMPROMISE,
- * %GNUTLS_CRL_REASON_AFFILIATION_CHANGED,
- * %GNUTLS_CRL_REASON_SUPERSEEDED,
- * %GNUTLS_CRL_REASON_CESSATION_OF_OPERATION,
- * %GNUTLS_CRL_REASON_CERTIFICATE_HOLD,
- * %GNUTLS_CRL_REASON_PRIVILEGE_WITHDRAWN,
- * %GNUTLS_CRL_REASON_AA_COMPROMISE, or (0) for all possible reasons.
- *
* Returns: %GNUTLS_E_SHORT_MEMORY_BUFFER and updates @ret_size if
* @ret_size is not enough to hold the distribution point, or the
* type of the distribution point if everything was ok. The type is
hooks/post-receive
--
GNU gnutls
| [Prev in Thread] |
Current Thread |
[Next in Thread] |
- [SCM] GNU gnutls branch, master, updated. gnutls_3_1_2-26-gc348926,
Nikos Mavrogiannopoulos <=