include/openssl/ct.h

0001 /*
0002  * WARNING: do not edit!
0003  * Generated by Makefile from include/openssl/ct.h.in
0004  *
0005  * Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
0006  *
0007  * Licensed under the Apache License 2.0 (the "License").  You may not use
0008  * this file except in compliance with the License.  You can obtain a copy
0009  * in the file LICENSE in the source distribution or at
0010  * https://www.openssl.org/source/license.html
0011  */
0012
0013
0014
0015 #ifndef OPENSSL_CT_H
0016 # define OPENSSL_CT_H
0017 # pragma once
0018
0019 # include <openssl/macros.h>
0020 # ifndef OPENSSL_NO_DEPRECATED_3_0
0021 #  define HEADER_CT_H
0022 # endif
0023
0024 # include <openssl/opensslconf.h>
0025
0026 # ifndef OPENSSL_NO_CT
0027 # include <openssl/types.h>
0028 # include <openssl/safestack.h>
0029 # include <openssl/x509.h>
0030 # include <openssl/cterr.h>
0031 # ifdef  __cplusplus
0032 extern "C" {
0033 # endif
0034
0035
0036 /* Minimum RSA key size, from RFC6962 */
0037 # define SCT_MIN_RSA_BITS 2048
0038
0039 /* All hashes are SHA256 in v1 of Certificate Transparency */
0040 # define CT_V1_HASHLEN SHA256_DIGEST_LENGTH
0041
0042 SKM_DEFINE_STACK_OF_INTERNAL(SCT, SCT, SCT)
0043 #define sk_SCT_num(sk) OPENSSL_sk_num(ossl_check_const_SCT_sk_type(sk))
0044 #define sk_SCT_value(sk, idx) ((SCT *)OPENSSL_sk_value(ossl_check_const_SCT_sk_type(sk), (idx)))
0045 #define sk_SCT_new(cmp) ((STACK_OF(SCT) *)OPENSSL_sk_new(ossl_check_SCT_compfunc_type(cmp)))
0046 #define sk_SCT_new_null() ((STACK_OF(SCT) *)OPENSSL_sk_new_null())
0047 #define sk_SCT_new_reserve(cmp, n) ((STACK_OF(SCT) *)OPENSSL_sk_new_reserve(ossl_check_SCT_compfunc_type(cmp), (n)))
0048 #define sk_SCT_reserve(sk, n) OPENSSL_sk_reserve(ossl_check_SCT_sk_type(sk), (n))
0049 #define sk_SCT_free(sk) OPENSSL_sk_free(ossl_check_SCT_sk_type(sk))
0050 #define sk_SCT_zero(sk) OPENSSL_sk_zero(ossl_check_SCT_sk_type(sk))
0051 #define sk_SCT_delete(sk, i) ((SCT *)OPENSSL_sk_delete(ossl_check_SCT_sk_type(sk), (i)))
0052 #define sk_SCT_delete_ptr(sk, ptr) ((SCT *)OPENSSL_sk_delete_ptr(ossl_check_SCT_sk_type(sk), ossl_check_SCT_type(ptr)))
0053 #define sk_SCT_push(sk, ptr) OPENSSL_sk_push(ossl_check_SCT_sk_type(sk), ossl_check_SCT_type(ptr))
0054 #define sk_SCT_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_SCT_sk_type(sk), ossl_check_SCT_type(ptr))
0055 #define sk_SCT_pop(sk) ((SCT *)OPENSSL_sk_pop(ossl_check_SCT_sk_type(sk)))
0056 #define sk_SCT_shift(sk) ((SCT *)OPENSSL_sk_shift(ossl_check_SCT_sk_type(sk)))
0057 #define sk_SCT_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_SCT_sk_type(sk),ossl_check_SCT_freefunc_type(freefunc))
0058 #define sk_SCT_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_SCT_sk_type(sk), ossl_check_SCT_type(ptr), (idx))
0059 #define sk_SCT_set(sk, idx, ptr) ((SCT *)OPENSSL_sk_set(ossl_check_SCT_sk_type(sk), (idx), ossl_check_SCT_type(ptr)))
0060 #define sk_SCT_find(sk, ptr) OPENSSL_sk_find(ossl_check_SCT_sk_type(sk), ossl_check_SCT_type(ptr))
0061 #define sk_SCT_find_ex(sk, ptr) OPENSSL_sk_find_ex(ossl_check_SCT_sk_type(sk), ossl_check_SCT_type(ptr))
0062 #define sk_SCT_find_all(sk, ptr, pnum) OPENSSL_sk_find_all(ossl_check_SCT_sk_type(sk), ossl_check_SCT_type(ptr), pnum)
0063 #define sk_SCT_sort(sk) OPENSSL_sk_sort(ossl_check_SCT_sk_type(sk))
0064 #define sk_SCT_is_sorted(sk) OPENSSL_sk_is_sorted(ossl_check_const_SCT_sk_type(sk))
0065 #define sk_SCT_dup(sk) ((STACK_OF(SCT) *)OPENSSL_sk_dup(ossl_check_const_SCT_sk_type(sk)))
0066 #define sk_SCT_deep_copy(sk, copyfunc, freefunc) ((STACK_OF(SCT) *)OPENSSL_sk_deep_copy(ossl_check_const_SCT_sk_type(sk), ossl_check_SCT_copyfunc_type(copyfunc), ossl_check_SCT_freefunc_type(freefunc)))
0067 #define sk_SCT_set_cmp_func(sk, cmp) ((sk_SCT_compfunc)OPENSSL_sk_set_cmp_func(ossl_check_SCT_sk_type(sk), ossl_check_SCT_compfunc_type(cmp)))
0068 SKM_DEFINE_STACK_OF_INTERNAL(CTLOG, CTLOG, CTLOG)
0069 #define sk_CTLOG_num(sk) OPENSSL_sk_num(ossl_check_const_CTLOG_sk_type(sk))
0070 #define sk_CTLOG_value(sk, idx) ((CTLOG *)OPENSSL_sk_value(ossl_check_const_CTLOG_sk_type(sk), (idx)))
0071 #define sk_CTLOG_new(cmp) ((STACK_OF(CTLOG) *)OPENSSL_sk_new(ossl_check_CTLOG_compfunc_type(cmp)))
0072 #define sk_CTLOG_new_null() ((STACK_OF(CTLOG) *)OPENSSL_sk_new_null())
0073 #define sk_CTLOG_new_reserve(cmp, n) ((STACK_OF(CTLOG) *)OPENSSL_sk_new_reserve(ossl_check_CTLOG_compfunc_type(cmp), (n)))
0074 #define sk_CTLOG_reserve(sk, n) OPENSSL_sk_reserve(ossl_check_CTLOG_sk_type(sk), (n))
0075 #define sk_CTLOG_free(sk) OPENSSL_sk_free(ossl_check_CTLOG_sk_type(sk))
0076 #define sk_CTLOG_zero(sk) OPENSSL_sk_zero(ossl_check_CTLOG_sk_type(sk))
0077 #define sk_CTLOG_delete(sk, i) ((CTLOG *)OPENSSL_sk_delete(ossl_check_CTLOG_sk_type(sk), (i)))
0078 #define sk_CTLOG_delete_ptr(sk, ptr) ((CTLOG *)OPENSSL_sk_delete_ptr(ossl_check_CTLOG_sk_type(sk), ossl_check_CTLOG_type(ptr)))
0079 #define sk_CTLOG_push(sk, ptr) OPENSSL_sk_push(ossl_check_CTLOG_sk_type(sk), ossl_check_CTLOG_type(ptr))
0080 #define sk_CTLOG_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_CTLOG_sk_type(sk), ossl_check_CTLOG_type(ptr))
0081 #define sk_CTLOG_pop(sk) ((CTLOG *)OPENSSL_sk_pop(ossl_check_CTLOG_sk_type(sk)))
0082 #define sk_CTLOG_shift(sk) ((CTLOG *)OPENSSL_sk_shift(ossl_check_CTLOG_sk_type(sk)))
0083 #define sk_CTLOG_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_CTLOG_sk_type(sk),ossl_check_CTLOG_freefunc_type(freefunc))
0084 #define sk_CTLOG_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_CTLOG_sk_type(sk), ossl_check_CTLOG_type(ptr), (idx))
0085 #define sk_CTLOG_set(sk, idx, ptr) ((CTLOG *)OPENSSL_sk_set(ossl_check_CTLOG_sk_type(sk), (idx), ossl_check_CTLOG_type(ptr)))
0086 #define sk_CTLOG_find(sk, ptr) OPENSSL_sk_find(ossl_check_CTLOG_sk_type(sk), ossl_check_CTLOG_type(ptr))
0087 #define sk_CTLOG_find_ex(sk, ptr) OPENSSL_sk_find_ex(ossl_check_CTLOG_sk_type(sk), ossl_check_CTLOG_type(ptr))
0088 #define sk_CTLOG_find_all(sk, ptr, pnum) OPENSSL_sk_find_all(ossl_check_CTLOG_sk_type(sk), ossl_check_CTLOG_type(ptr), pnum)
0089 #define sk_CTLOG_sort(sk) OPENSSL_sk_sort(ossl_check_CTLOG_sk_type(sk))
0090 #define sk_CTLOG_is_sorted(sk) OPENSSL_sk_is_sorted(ossl_check_const_CTLOG_sk_type(sk))
0091 #define sk_CTLOG_dup(sk) ((STACK_OF(CTLOG) *)OPENSSL_sk_dup(ossl_check_const_CTLOG_sk_type(sk)))
0092 #define sk_CTLOG_deep_copy(sk, copyfunc, freefunc) ((STACK_OF(CTLOG) *)OPENSSL_sk_deep_copy(ossl_check_const_CTLOG_sk_type(sk), ossl_check_CTLOG_copyfunc_type(copyfunc), ossl_check_CTLOG_freefunc_type(freefunc)))
0093 #define sk_CTLOG_set_cmp_func(sk, cmp) ((sk_CTLOG_compfunc)OPENSSL_sk_set_cmp_func(ossl_check_CTLOG_sk_type(sk), ossl_check_CTLOG_compfunc_type(cmp)))
0094
0095
0096
0097 typedef enum {
0098     CT_LOG_ENTRY_TYPE_NOT_SET = -1,
0099     CT_LOG_ENTRY_TYPE_X509 = 0,
0100     CT_LOG_ENTRY_TYPE_PRECERT = 1
0101 } ct_log_entry_type_t;
0102
0103 typedef enum {
0104     SCT_VERSION_NOT_SET = -1,
0105     SCT_VERSION_V1 = 0
0106 } sct_version_t;
0107
0108 typedef enum {
0109     SCT_SOURCE_UNKNOWN,
0110     SCT_SOURCE_TLS_EXTENSION,
0111     SCT_SOURCE_X509V3_EXTENSION,
0112     SCT_SOURCE_OCSP_STAPLED_RESPONSE
0113 } sct_source_t;
0114
0115 typedef enum {
0116     SCT_VALIDATION_STATUS_NOT_SET,
0117     SCT_VALIDATION_STATUS_UNKNOWN_LOG,
0118     SCT_VALIDATION_STATUS_VALID,
0119     SCT_VALIDATION_STATUS_INVALID,
0120     SCT_VALIDATION_STATUS_UNVERIFIED,
0121     SCT_VALIDATION_STATUS_UNKNOWN_VERSION
0122 } sct_validation_status_t;
0123
0124 /******************************************
0125  * CT policy evaluation context functions *
0126  ******************************************/
0127
0128 /*
0129  * Creates a new, empty policy evaluation context associated with the given
0130  * library context and property query string.
0131  * The caller is responsible for calling CT_POLICY_EVAL_CTX_free when finished
0132  * with the CT_POLICY_EVAL_CTX.
0133  */
0134 CT_POLICY_EVAL_CTX *CT_POLICY_EVAL_CTX_new_ex(OSSL_LIB_CTX *libctx,
0135                                               const char *propq);
0136
0137 /*
0138  * The same as CT_POLICY_EVAL_CTX_new_ex() but the default library
0139  * context and property query string is used.
0140  */
0141 CT_POLICY_EVAL_CTX *CT_POLICY_EVAL_CTX_new(void);
0142
0143 /* Deletes a policy evaluation context and anything it owns. */
0144 void CT_POLICY_EVAL_CTX_free(CT_POLICY_EVAL_CTX *ctx);
0145
0146 /* Gets the peer certificate that the SCTs are for */
0147 X509* CT_POLICY_EVAL_CTX_get0_cert(const CT_POLICY_EVAL_CTX *ctx);
0148
0149 /*
0150  * Sets the certificate associated with the received SCTs.
0151  * Increments the reference count of cert.
0152  * Returns 1 on success, 0 otherwise.
0153  */
0154 int CT_POLICY_EVAL_CTX_set1_cert(CT_POLICY_EVAL_CTX *ctx, X509 *cert);
0155
0156 /* Gets the issuer of the aforementioned certificate */
0157 X509* CT_POLICY_EVAL_CTX_get0_issuer(const CT_POLICY_EVAL_CTX *ctx);
0158
0159 /*
0160  * Sets the issuer of the certificate associated with the received SCTs.
0161  * Increments the reference count of issuer.
0162  * Returns 1 on success, 0 otherwise.
0163  */
0164 int CT_POLICY_EVAL_CTX_set1_issuer(CT_POLICY_EVAL_CTX *ctx, X509 *issuer);
0165
0166 /* Gets the CT logs that are trusted sources of SCTs */
0167 const CTLOG_STORE *CT_POLICY_EVAL_CTX_get0_log_store(const CT_POLICY_EVAL_CTX *ctx);
0168
0169 /* Sets the log store that is in use. It must outlive the CT_POLICY_EVAL_CTX. */
0170 void CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE(CT_POLICY_EVAL_CTX *ctx,
0171                                                CTLOG_STORE *log_store);
0172
0173 /*
0174  * Gets the time, in milliseconds since the Unix epoch, that will be used as the
0175  * current time when checking whether an SCT was issued in the future.
0176  * Such SCTs will fail validation, as required by RFC6962.
0177  */
0178 uint64_t CT_POLICY_EVAL_CTX_get_time(const CT_POLICY_EVAL_CTX *ctx);
0179
0180 /*
0181  * Sets the time to evaluate SCTs against, in milliseconds since the Unix epoch.
0182  * If an SCT's timestamp is after this time, it will be interpreted as having
0183  * been issued in the future. RFC6962 states that "TLS clients MUST reject SCTs
0184  * whose timestamp is in the future", so an SCT will not validate in this case.
0185  */
0186 void CT_POLICY_EVAL_CTX_set_time(CT_POLICY_EVAL_CTX *ctx, uint64_t time_in_ms);
0187
0188 /*****************
0189  * SCT functions *
0190  *****************/
0191
0192 /*
0193  * Creates a new, blank SCT.
0194  * The caller is responsible for calling SCT_free when finished with the SCT.
0195  */
0196 SCT *SCT_new(void);
0197
0198 /*
0199  * Creates a new SCT from some base64-encoded strings.
0200  * The caller is responsible for calling SCT_free when finished with the SCT.
0201  */
0202 SCT *SCT_new_from_base64(unsigned char version,
0203                          const char *logid_base64,
0204                          ct_log_entry_type_t entry_type,
0205                          uint64_t timestamp,
0206                          const char *extensions_base64,
0207                          const char *signature_base64);
0208
0209 /*
0210  * Frees the SCT and the underlying data structures.
0211  */
0212 void SCT_free(SCT *sct);
0213
0214 /*
0215  * Free a stack of SCTs, and the underlying SCTs themselves.
0216  * Intended to be compatible with X509V3_EXT_FREE.
0217  */
0218 void SCT_LIST_free(STACK_OF(SCT) *a);
0219
0220 /*
0221  * Returns the version of the SCT.
0222  */
0223 sct_version_t SCT_get_version(const SCT *sct);
0224
0225 /*
0226  * Set the version of an SCT.
0227  * Returns 1 on success, 0 if the version is unrecognized.
0228  */
0229 __owur int SCT_set_version(SCT *sct, sct_version_t version);
0230
0231 /*
0232  * Returns the log entry type of the SCT.
0233  */
0234 ct_log_entry_type_t SCT_get_log_entry_type(const SCT *sct);
0235
0236 /*
0237  * Set the log entry type of an SCT.
0238  * Returns 1 on success, 0 otherwise.
0239  */
0240 __owur int SCT_set_log_entry_type(SCT *sct, ct_log_entry_type_t entry_type);
0241
0242 /*
0243  * Gets the ID of the log that an SCT came from.
0244  * Ownership of the log ID remains with the SCT.
0245  * Returns the length of the log ID.
0246  */
0247 size_t SCT_get0_log_id(const SCT *sct, unsigned char **log_id);
0248
0249 /*
0250  * Set the log ID of an SCT to point directly to the *log_id specified.
0251  * The SCT takes ownership of the specified pointer.
0252  * Returns 1 on success, 0 otherwise.
0253  */
0254 __owur int SCT_set0_log_id(SCT *sct, unsigned char *log_id, size_t log_id_len);
0255
0256 /*
0257  * Set the log ID of an SCT.
0258  * This makes a copy of the log_id.
0259  * Returns 1 on success, 0 otherwise.
0260  */
0261 __owur int SCT_set1_log_id(SCT *sct, const unsigned char *log_id,
0262                            size_t log_id_len);
0263
0264 /*
0265  * Returns the timestamp for the SCT (epoch time in milliseconds).
0266  */
0267 uint64_t SCT_get_timestamp(const SCT *sct);
0268
0269 /*
0270  * Set the timestamp of an SCT (epoch time in milliseconds).
0271  */
0272 void SCT_set_timestamp(SCT *sct, uint64_t timestamp);
0273
0274 /*
0275  * Return the NID for the signature used by the SCT.
0276  * For CT v1, this will be either NID_sha256WithRSAEncryption or
0277  * NID_ecdsa_with_SHA256 (or NID_undef if incorrect/unset).
0278  */
0279 int SCT_get_signature_nid(const SCT *sct);
0280
0281 /*
0282  * Set the signature type of an SCT
0283  * For CT v1, this should be either NID_sha256WithRSAEncryption or
0284  * NID_ecdsa_with_SHA256.
0285  * Returns 1 on success, 0 otherwise.
0286  */
0287 __owur int SCT_set_signature_nid(SCT *sct, int nid);
0288
0289 /*
0290  * Set *ext to point to the extension data for the SCT. ext must not be NULL.
0291  * The SCT retains ownership of this pointer.
0292  * Returns length of the data pointed to.
0293  */
0294 size_t SCT_get0_extensions(const SCT *sct, unsigned char **ext);
0295
0296 /*
0297  * Set the extensions of an SCT to point directly to the *ext specified.
0298  * The SCT takes ownership of the specified pointer.
0299  */
0300 void SCT_set0_extensions(SCT *sct, unsigned char *ext, size_t ext_len);
0301
0302 /*
0303  * Set the extensions of an SCT.
0304  * This takes a copy of the ext.
0305  * Returns 1 on success, 0 otherwise.
0306  */
0307 __owur int SCT_set1_extensions(SCT *sct, const unsigned char *ext,
0308                                size_t ext_len);
0309
0310 /*
0311  * Set *sig to point to the signature for the SCT. sig must not be NULL.
0312  * The SCT retains ownership of this pointer.
0313  * Returns length of the data pointed to.
0314  */
0315 size_t SCT_get0_signature(const SCT *sct, unsigned char **sig);
0316
0317 /*
0318  * Set the signature of an SCT to point directly to the *sig specified.
0319  * The SCT takes ownership of the specified pointer.
0320  */
0321 void SCT_set0_signature(SCT *sct, unsigned char *sig, size_t sig_len);
0322
0323 /*
0324  * Set the signature of an SCT to be a copy of the *sig specified.
0325  * Returns 1 on success, 0 otherwise.
0326  */
0327 __owur int SCT_set1_signature(SCT *sct, const unsigned char *sig,
0328                               size_t sig_len);
0329
0330 /*
0331  * The origin of this SCT, e.g. TLS extension, OCSP response, etc.
0332  */
0333 sct_source_t SCT_get_source(const SCT *sct);
0334
0335 /*
0336  * Set the origin of this SCT, e.g. TLS extension, OCSP response, etc.
0337  * Returns 1 on success, 0 otherwise.
0338  */
0339 __owur int SCT_set_source(SCT *sct, sct_source_t source);
0340
0341 /*
0342  * Returns a text string describing the validation status of |sct|.
0343  */
0344 const char *SCT_validation_status_string(const SCT *sct);
0345
0346 /*
0347  * Pretty-prints an |sct| to |out|.
0348  * It will be indented by the number of spaces specified by |indent|.
0349  * If |logs| is not NULL, it will be used to lookup the CT log that the SCT came
0350  * from, so that the log name can be printed.
0351  */
0352 void SCT_print(const SCT *sct, BIO *out, int indent, const CTLOG_STORE *logs);
0353
0354 /*
0355  * Pretty-prints an |sct_list| to |out|.
0356  * It will be indented by the number of spaces specified by |indent|.
0357  * SCTs will be delimited by |separator|.
0358  * If |logs| is not NULL, it will be used to lookup the CT log that each SCT
0359  * came from, so that the log names can be printed.
0360  */
0361 void SCT_LIST_print(const STACK_OF(SCT) *sct_list, BIO *out, int indent,
0362                     const char *separator, const CTLOG_STORE *logs);
0363
0364 /*
0365  * Gets the last result of validating this SCT.
0366  * If it has not been validated yet, returns SCT_VALIDATION_STATUS_NOT_SET.
0367  */
0368 sct_validation_status_t SCT_get_validation_status(const SCT *sct);
0369
0370 /*
0371  * Validates the given SCT with the provided context.
0372  * Sets the "validation_status" field of the SCT.
0373  * Returns 1 if the SCT is valid and the signature verifies.
0374  * Returns 0 if the SCT is invalid or could not be verified.
0375  * Returns -1 if an error occurs.
0376  */
0377 __owur int SCT_validate(SCT *sct, const CT_POLICY_EVAL_CTX *ctx);
0378
0379 /*
0380  * Validates the given list of SCTs with the provided context.
0381  * Sets the "validation_status" field of each SCT.
0382  * Returns 1 if there are no invalid SCTs and all signatures verify.
0383  * Returns 0 if at least one SCT is invalid or could not be verified.
0384  * Returns a negative integer if an error occurs.
0385  */
0386 __owur int SCT_LIST_validate(const STACK_OF(SCT) *scts,
0387                              CT_POLICY_EVAL_CTX *ctx);
0388
0389
0390 /*********************************
0391  * SCT parsing and serialization *
0392  *********************************/
0393
0394 /*
0395  * Serialize (to TLS format) a stack of SCTs and return the length.
0396  * "a" must not be NULL.
0397  * If "pp" is NULL, just return the length of what would have been serialized.
0398  * If "pp" is not NULL and "*pp" is null, function will allocate a new pointer
0399  * for data that caller is responsible for freeing (only if function returns
0400  * successfully).
0401  * If "pp" is NULL and "*pp" is not NULL, caller is responsible for ensuring
0402  * that "*pp" is large enough to accept all of the serialized data.
0403  * Returns < 0 on error, >= 0 indicating bytes written (or would have been)
0404  * on success.
0405  */
0406 __owur int i2o_SCT_LIST(const STACK_OF(SCT) *a, unsigned char **pp);
0407
0408 /*
0409  * Convert TLS format SCT list to a stack of SCTs.
0410  * If "a" or "*a" is NULL, a new stack will be created that the caller is
0411  * responsible for freeing (by calling SCT_LIST_free).
0412  * "**pp" and "*pp" must not be NULL.
0413  * Upon success, "*pp" will point to after the last bytes read, and a stack
0414  * will be returned.
0415  * Upon failure, a NULL pointer will be returned, and the position of "*pp" is
0416  * not defined.
0417  */
0418 STACK_OF(SCT) *o2i_SCT_LIST(STACK_OF(SCT) **a, const unsigned char **pp,
0419                             size_t len);
0420
0421 /*
0422  * Serialize (to DER format) a stack of SCTs and return the length.
0423  * "a" must not be NULL.
0424  * If "pp" is NULL, just returns the length of what would have been serialized.
0425  * If "pp" is not NULL and "*pp" is null, function will allocate a new pointer
0426  * for data that caller is responsible for freeing (only if function returns
0427  * successfully).
0428  * If "pp" is NULL and "*pp" is not NULL, caller is responsible for ensuring
0429  * that "*pp" is large enough to accept all of the serialized data.
0430  * Returns < 0 on error, >= 0 indicating bytes written (or would have been)
0431  * on success.
0432  */
0433 __owur int i2d_SCT_LIST(const STACK_OF(SCT) *a, unsigned char **pp);
0434
0435 /*
0436  * Parses an SCT list in DER format and returns it.
0437  * If "a" or "*a" is NULL, a new stack will be created that the caller is
0438  * responsible for freeing (by calling SCT_LIST_free).
0439  * "**pp" and "*pp" must not be NULL.
0440  * Upon success, "*pp" will point to after the last bytes read, and a stack
0441  * will be returned.
0442  * Upon failure, a NULL pointer will be returned, and the position of "*pp" is
0443  * not defined.
0444  */
0445 STACK_OF(SCT) *d2i_SCT_LIST(STACK_OF(SCT) **a, const unsigned char **pp,
0446                             long len);
0447
0448 /*
0449  * Serialize (to TLS format) an |sct| and write it to |out|.
0450  * If |out| is null, no SCT will be output but the length will still be returned.
0451  * If |out| points to a null pointer, a string will be allocated to hold the
0452  * TLS-format SCT. It is the responsibility of the caller to free it.
0453  * If |out| points to an allocated string, the TLS-format SCT will be written
0454  * to it.
0455  * The length of the SCT in TLS format will be returned.
0456  */
0457 __owur int i2o_SCT(const SCT *sct, unsigned char **out);
0458
0459 /*
0460  * Parses an SCT in TLS format and returns it.
0461  * If |psct| is not null, it will end up pointing to the parsed SCT. If it
0462  * already points to a non-null pointer, the pointer will be free'd.
0463  * |in| should be a pointer to a string containing the TLS-format SCT.
0464  * |in| will be advanced to the end of the SCT if parsing succeeds.
0465  * |len| should be the length of the SCT in |in|.
0466  * Returns NULL if an error occurs.
0467  * If the SCT is an unsupported version, only the SCT's 'sct' and 'sct_len'
0468  * fields will be populated (with |in| and |len| respectively).
0469  */
0470 SCT *o2i_SCT(SCT **psct, const unsigned char **in, size_t len);
0471
0472 /********************
0473  * CT log functions *
0474  ********************/
0475
0476 /*
0477  * Creates a new CT log instance with the given |public_key| and |name| and
0478  * associates it with the give library context |libctx| and property query
0479  * string |propq|.
0480  * Takes ownership of |public_key| but copies |name|.
0481  * Returns NULL if malloc fails or if |public_key| cannot be converted to DER.
0482  * Should be deleted by the caller using CTLOG_free when no longer needed.
0483  */
0484 CTLOG *CTLOG_new_ex(EVP_PKEY *public_key, const char *name, OSSL_LIB_CTX *libctx,
0485                     const char *propq);
0486
0487 /*
0488  * The same as CTLOG_new_ex except that the default library context and
0489  * property query string are used.
0490  */
0491 CTLOG *CTLOG_new(EVP_PKEY *public_key, const char *name);
0492
0493 /*
0494  * Creates a new CTLOG instance with the base64-encoded SubjectPublicKeyInfo DER
0495  * in |pkey_base64| and associated with the given library context |libctx| and
0496  * property query string |propq|. The |name| is a string to help users identify
0497  * this log.
0498  * Returns 1 on success, 0 on failure.
0499  * Should be deleted by the caller using CTLOG_free when no longer needed.
0500  */
0501 int CTLOG_new_from_base64_ex(CTLOG **ct_log, const char *pkey_base64,
0502                              const char *name, OSSL_LIB_CTX *libctx,
0503                              const char *propq);
0504
0505 /*
0506  * The same as CTLOG_new_from_base64_ex() except that the default
0507  * library context and property query string are used.
0508  * Returns 1 on success, 0 on failure.
0509  */
0510 int CTLOG_new_from_base64(CTLOG ** ct_log,
0511                           const char *pkey_base64, const char *name);
0512
0513 /*
0514  * Deletes a CT log instance and its fields.
0515  */
0516 void CTLOG_free(CTLOG *log);
0517
0518 /* Gets the name of the CT log */
0519 const char *CTLOG_get0_name(const CTLOG *log);
0520 /* Gets the ID of the CT log */
0521 void CTLOG_get0_log_id(const CTLOG *log, const uint8_t **log_id,
0522                        size_t *log_id_len);
0523 /* Gets the public key of the CT log */
0524 EVP_PKEY *CTLOG_get0_public_key(const CTLOG *log);
0525
0526 /**************************
0527  * CT log store functions *
0528  **************************/
0529
0530 /*
0531  * Creates a new CT log store and associates it with the given libctx and
0532  * property query string.
0533  * Should be deleted by the caller using CTLOG_STORE_free when no longer needed.
0534  */
0535 CTLOG_STORE *CTLOG_STORE_new_ex(OSSL_LIB_CTX *libctx, const char *propq);
0536
0537 /*
0538  * Same as CTLOG_STORE_new_ex except that the default libctx and
0539  * property query string are used.
0540  * Should be deleted by the caller using CTLOG_STORE_free when no longer needed.
0541  */
0542 CTLOG_STORE *CTLOG_STORE_new(void);
0543
0544 /*
0545  * Deletes a CT log store and all of the CT log instances held within.
0546  */
0547 void CTLOG_STORE_free(CTLOG_STORE *store);
0548
0549 /*
0550  * Finds a CT log in the store based on its log ID.
0551  * Returns the CT log, or NULL if no match is found.
0552  */
0553 const CTLOG *CTLOG_STORE_get0_log_by_id(const CTLOG_STORE *store,
0554                                         const uint8_t *log_id,
0555                                         size_t log_id_len);
0556
0557 /*
0558  * Loads a CT log list into a |store| from a |file|.
0559  * Returns 1 if loading is successful, or 0 otherwise.
0560  */
0561 __owur int CTLOG_STORE_load_file(CTLOG_STORE *store, const char *file);
0562
0563 /*
0564  * Loads the default CT log list into a |store|.
0565  * Returns 1 if loading is successful, or 0 otherwise.
0566  */
0567 __owur int CTLOG_STORE_load_default_file(CTLOG_STORE *store);
0568
0569 #  ifdef  __cplusplus
0570 }
0571 #  endif
0572 # endif
0573 #endif