NAME
X509_CRL_METHOD_new,
X509_CRL_METHOD_free,
X509_CRL_set_default_method,
X509_CRL_set_meth_data,
X509_CRL_get_meth_data —
customize CRL handling
SYNOPSIS
#include
<openssl/x509.h>
X509_CRL_METHOD *
X509_CRL_METHOD_new(int
(*crl_init)(X509_CRL *crl), int (*crl_free)(X509_CRL
*crl), int (*crl_lookup)(X509_CRL *crl, X509_REVOKED
**ret, ASN1_INTEGER *ser, X509_NAME *issuer), int
(*crl_verify)(X509_CRL *crl, EVP_PKEY *pk));
void
X509_CRL_METHOD_free(X509_CRL_METHOD
*method);
void
X509_CRL_set_default_method(const
X509_CRL_METHOD *method);
void
X509_CRL_set_meth_data(X509_CRL
*crl, void
*data);
void *
X509_CRL_get_meth_data(X509_CRL
*crl);
DESCRIPTION
These functions customize BER decoding and signature verification of X.509 certificate revocation lists, as well as retrieval of revoked entries from such lists.
X509_CRL_METHOD_new()
allocates and initializes a new X509_CRL_METHOD
object, storing the four pointers to callback functions in it that are
provided as arguments.
X509_CRL_METHOD_free()
frees the given method object. If
method is a NULL pointer or
points to the static object built into the library, no action occurs.
X509_CRL_set_default_method()
designates the given method to be used for objects
that will be created with
X509_CRL_new(3) in the future. It has no effect on
X509_CRL objects that already exist. If
method is NULL, any previously
installed method will no longer be used for new
X509_CRL objects created in the future, and those
future objects will adhere to the default behaviour instead.
The optional function
crl_init()
will be called at the end of
d2i_X509_CRL(3), the optional function
crl_free()
near the end of
X509_CRL_free(3), immediately before freeing
crl itself. The function
crl_lookup()
will be called by
X509_CRL_get0_by_serial(3), setting
issuer to NULL, and by
X509_CRL_get0_by_cert(3), both instead of performing the
default action. The function
crl_verify()
will be called by
X509_CRL_verify(3) instead of performing the default
action.
X509_CRL_set_meth_data()
stores the pointer to the auxiliary data inside the
crl object. The pointer is expected to remain valid
during the whole lifetime of the crl object but is not
automatically freed when the crl object is freed.
X509_CRL_get_meth_data()
retrieves the data from crl the
was added with X509_CRL_set_meth_data(). This may
for example be useful inside the four callback methods installed with
X509_CRL_METHOD_new().
RETURN VALUES
X509_CRL_METHOD_new() returns a pointer to
the new object or NULL if memory allocation
fails.
X509_CRL_get_meth_data() returns the
pointer previously installed with
X509_CRL_set_meth_data() or
NULL if
X509_CRL_set_meth_data() was not called on
crl.
The callback functions crl_init() and
crl_free() are supposed to return 1 for success or 0
for failure.
The callback function crl_lookup() is
supposed to return 0 for failure or 1 for success, except if the revoked
entry has the reason "removeFromCRL", in which case it is supposed
to return 2.
The callback function crl_verify() is
supposed to return 1 if the signature is valid or 0 if the signature check
fails. If the signature could not be checked at all because it was invalid
or some other error occurred, -1 may be returned.
SEE ALSO
ASN1_INTEGER_new(3), d2i_X509_CRL(3), EVP_PKEY_new(3), X509_CRL_get0_by_serial(3), X509_CRL_new(3), X509_CRL_verify(3), X509_NAME_new(3), X509_REVOKED_new(3)
HISTORY
These functions first appeared in OpenSSL 1.0.0 and have been available since OpenBSD 4.9.