Changeset 2a1ffd6 in mod_gnutls for src/gnutls_ocsp.h

Timestamp:

May 31, 2016, 1:12:53 PM (3 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

debian/master, debian/stretch-backports, master, upstream

Children:

64856fd

Parents:

d35b98e

Message:

Move trust list generation for OCSP to a separate function

The new function is supposed be used during server configuration
later, instead of recreating the trust list every time an OCSP
response is checked.

File:

• src/gnutls_ocsp.h (modified) (2 diffs)

src/gnutls_ocsp.h

@@ -19 +19 @@
 
 #include "gnutls/gnutls.h"
+#include "gnutls/x509.h"
 #include "httpd.h"
 #include "http_config.h"
@@ -26 +27 @@
                                          const char *arg);
 
+/*
+ * Create a trust list from a certificate chain (one or more
+ * certificates).
+ *
+ * tl: This trust list will be initialized and filled with the
+ * specified certificate(s)
+ *
+ * chain: certificate chain, must contain at least num certifictes
+ *
+ * num: number of certificates to load from chain
+ *
+ * Chain is supposed to be static (the trust chain of the server
+ * certificate), so when gnutls_x509_trust_list_deinit() is called on
+ * tl later, the "all" parameter should be zero.
+ *
+ * Returns GNUTLS_E_SUCCESS or a GnuTLS error code. In case of error
+ * tl will be uninitialized.
+ */
+int mgs_create_ocsp_trust_list(gnutls_x509_trust_list_t *tl,
+                               const gnutls_x509_crt_t *chain,
+                               const int num);
+
 int mgs_get_ocsp_response(gnutls_session_t session, void *ptr,
                           gnutls_datum_t *ocsp_response);