CRLs

Author: arckoor

doc/api_ref/ffi.rst

@@ -1670,20 +1670,20 @@ X.509 Certificates
 
    Return the subject key ID set in the certificate, which may be empty.
 
-.. cpp:function::int botan_x509_get_basic_constraints(botan_x509_cert_t cert, int* is_ca, size_t* limit)
+.. cpp:function::int botan_x509_cert_is_ca(botan_x509_cert_t cert, int* is_ca, size_t* limit)
 
    Checks whether the certificate is a CA certificate and sets ``is_ca`` to 1 if it is, 0 otherwise.
    If it is a CA certificate, ``limit`` is set to the path limit, otherwise 0.
 
-.. cpp:function::int botan_x509_get_key_constraints(botan_x509_cert_t cert, uint32_t* usage)
+.. cpp:function::int botan_x509_cert_get_key_constraints(botan_x509_cert_t cert, uint32_t* usage)
 
    Returns the key usage constraints.
 
-.. cpp:function::int botan_x509_get_ocsp_responder(botan_x509_cert_t cert, botan_view_ctx ctx, botan_view_str_fn view)
+.. cpp:function::int botan_x509_cert_get_ocsp_responder(botan_x509_cert_t cert, botan_view_ctx ctx, botan_view_str_fn view)
 
    Returns the OCSP responder.
 
-.. cpp:function::int botan_x509_is_self_signed(botan_x509_cert_t cert, int* out)
+.. cpp:function::int botan_x509_cert_is_self_signed(botan_x509_cert_t cert, int* out)
 
    Checks whether the certificate is self signed and sets ``out`` to 1 if it is, 0 otherwise.
 
@@ -1800,11 +1800,11 @@ X.509 Certificates
 
    Destroy the IP Address Blocks object.
 
-.. cpp:function::int botan_x509_ext_create_ip_addr_blocks(botan_x509_ext_ip_addr_blocks_t* ip_addr_blocks)
+.. cpp:function::int botan_x509_ext_ip_addr_blocks_create(botan_x509_ext_ip_addr_blocks_t* ip_addr_blocks)
 
    Create a new IP Address Blocks object.
 
-.. cpp:function::int botan_x509_ext_create_ip_addr_blocks_from_cert(botan_x509_cert_t cert, \
+.. cpp:function::int botan_x509_ext_ip_addr_blocks_create_from_cert(botan_x509_cert_t cert, \
                   botan_x509_ext_ip_addr_blocks_t* ip_addr_blocks)
 
    Get an IP Address Blocks object from a certificate. Cannot be mutated.
@@ -1876,11 +1876,11 @@ X.509 Certificates
 
    Destroy the AS Blocks object.
 
-.. cpp:function::int botan_x509_ext_create_as_blocks(botan_x509_ext_as_blocks_t* as_blocks)
+.. cpp:function::int botan_x509_ext_as_blocks_create(botan_x509_ext_as_blocks_t* as_blocks)
 
    Create a new AS Blocks object.
 
-.. cpp:function::int botan_x509_ext_create_as_blocks_from_cert(botan_x509_cert_t cert, botan_x509_ext_as_blocks_t* as_blocks)
+.. cpp:function::int botan_x509_ext_as_blocks_create_from_cert(botan_x509_cert_t cert, botan_x509_ext_as_blocks_t* as_blocks)
 
    Get an AS Blocks object from a certificate. Cannot be mutated.
 
@@ -1919,12 +1919,11 @@ X.509 Certificates
 
 .. cpp:function::int botan_x509_cert_params_builder_destroy(botan_x509_cert_params_builder_t builder)
 
-   Destroy the options object.
+   Destroy the Certificate Params Builder object.
 
-.. cpp:function::int botan_x509_create_cert_params_builder(botan_x509_cert_params_builder_t* builder_obj);
+.. cpp:function::int botan_x509_cert_params_builder_create(botan_x509_cert_params_builder_t* builder_obj);
 
-   Create a new certificate builder object. ``opts`` defines the common name (e.g. `common_name/country/organization/organizational_unit`).
-   ``expire_time`` if given is the expiration time from current clock in seconds.
+   Create a new Certificate Params Builder object.
 
 .. cpp:function::int botan_x509_cert_params_builder_add_common_name(botan_x509_cert_params_builder_t builder, const char* name);
 
@@ -1954,7 +1953,7 @@ X.509 Certificates
 
 .. cpp:function::int botan_x509_cert_params_builder_add_allowed_extended_usage(botan_x509_cert_params_builder_t builder, botan_asn1_oid_t oid);
 
-.. cpp:function::int botan_x509_cert_params_builder_set_as_ca_certificate(botan_x509_cert_params_builder_t builder, size_t limit);
+.. cpp:function::int botan_x509_cert_params_builder_set_as_ca_certificate(botan_x509_cert_params_builder_t builder, size_t limit=None);
 
    Mark the certificate for CA usage.
 
@@ -1964,12 +1963,13 @@ X.509 Certificates
 .. cpp:function::int botan_x509_cert_params_builder_add_ext_as_blocks(botan_x509_cert_params_builder_t builder, \
                   botan_x509_ext_as_blocks_t as_blocks, int is_critical);
 
-.. cpp:function::int botan_x509_create_self_signed_cert(botan_x509_cert_t* cert_obj, \
+.. cpp:function::int botan_x509_cert_create_self_signed(botan_x509_cert_t* cert_obj, \
                   botan_privkey_t key, \
                   botan_x509_cert_params_builder_t builder, \
                   botan_rng_t rng, \
                   uint64_t not_before, \
                   uint64_t not_after, \
+                  const botan_mp_t* serial_number, \
                   const char* hash_fn, \
                   const char* padding)
 
@@ -1983,7 +1983,20 @@ X.509 Certificates
 
    Destroy the PKCS #10 certificate request object.
 
-.. cpp:function::int botan_x509_create_pkcs10_req(botan_x509_pkcs10_req_t* req_obj, \
+.. cpp:function::int botan_x509_pkcs10_req_load_file(botan_x509_pkcs10_req_t* req_obj, const char* req_path)
+
+.. cpp:function::int botan_x509_pkcs10_req_load(botan_x509_pkcs10_req_t* req_obj, const uint8_t req_bits[], size_t req_bits_len)
+
+.. cpp:function::int int botan_x509_pkcs10_req_get_public_key(botan_x509_pkcs10_req_t req, botan_pubkey_t* key)
+
+.. cpp:function::int int botan_x509_pkcs10_req_get_key_constraints(botan_x509_pkcs10_req_t req, uint32_t* usage)
+
+.. cpp:function::int int botan_x509_pkcs10_req_is_ca(botan_x509_pkcs10_req_t req, int* is_ca, size_t* limit)
+
+.. cpp:function::int int botan_x509_pkcs10_req_verify_signature(botan_x509_pkcs10_req_t req, botan_pubkey_t key, int* result)
+
+
+.. cpp:function::int botan_x509_pkcs10_req_create(botan_x509_pkcs10_req_t* req_obj, \
                   botan_privkey_t key, \
                   botan_x509_cert_params_builder_t builder, \
                   botan_rng_t rng, \
@@ -1995,13 +2008,16 @@ X.509 Certificates
 
 .. cpp:function::int botan_x509_pkcs10_req_view_pem(botan_x509_pkcs10_req_t req, botan_view_ctx ctx, botan_view_str_fn view)
 
-.. cpp:function::int botan_x509_sign_req(botan_x509_cert_t* subject_cert, \
+.. cpp:function::int int botan_x509_pkcs10_req_view_der(botan_x509_pkcs10_req_t req, botan_view_ctx ctx, botan_view_bin_fn view)
+
+.. cpp:function::int botan_x509_pkcs10_req_sign(botan_x509_cert_t* subject_cert, \
                   botan_x509_pkcs10_req_t subject_req, \
                   botan_x509_cert_t issuing_cert, \
                   botan_privkey_t issuing_key, \
                   botan_rng_t rng, \
                   uint64_t not_before, \
                   uint64_t not_after, \
+                  const botan_mp_t* serial_number, \
                   const char* hash_fn, \
                   const char* padding)
 
@@ -2023,6 +2039,38 @@ X.509 Certificate Revocation Lists
 
    Load a CRL from a file.
 
+.. cpp:function:: int botan_x509_crl_create(botan_x509_crl_t* crl_obj, \
+                          botan_rng_t rng, \
+                          botan_x509_cert_t ca_cert, \
+                          botan_privkey_t ca_key, \
+                          uint64_t issue_time, \
+                          uint32_t next_update, \
+                          const char* hash_fn, \
+                          const char* padding)
+
+.. cpp:function:: int botan_x509_crl_update(botan_x509_crl_t* crl_obj, \
+                          botan_x509_crl_t last_crl, \
+                          botan_rng_t rng, \
+                          botan_x509_cert_t ca_cert, \
+                          botan_privkey_t ca_key, \
+                          uint64_t issue_time, \
+                          uint32_t next_update, \
+                          const botan_x509_cert_t* revoked, \
+                          size_t revoked_len, \
+                          uint8_t reason, \
+                          const char* hash_fn, \
+                          const char* padding)
+
+.. cpp:function:: int botan_x509_crl_get_count(botan_x509_crl_t crl, size_t* count);
+
+.. cpp:function:: int botan_x509_crl_get_entry(botan_x509_crl_t crl, size_t i, uint8_t serial[], size_t* serial_len, uint64_t* expire_time, uint8_t* reason)
+
+.. cpp:function:: int botan_x509_crl_verify_signature(botan_x509_crl_t crl, botan_pubkey_t key, int* result)
+
+.. cpp:function:: int botan_x509_crl_view_pem(botan_x509_crl_t crl, botan_view_ctx ctx, botan_view_str_fn view)
+
+.. cpp:function:: int botan_x509_crl_view_der(botan_x509_crl_t crl, botan_view_ctx ctx, botan_view_bin_fn view)
+
 .. cpp:function:: int botan_x509_crl_destroy(botan_x509_crl_t crl)
 
    Destroy the CRL object.

doc/api_ref/python.rst

@@ -561,6 +561,14 @@ Multiple Precision Integers (MPI)
    Most of the usual arithmetic operators (``__add__``, ``__mul__``, etc) are
    defined.
 
+   .. py:classmethod:: from_bytes(buf)
+
+       Create a new MPI object from the big-endian binary encoding produced by ``to_bytes()``.
+
+   .. py:method::  to_bytes()
+
+      Return a big-endian binary encoding of the number.
+
    .. py:method:: inverse_mod(modulus)
 
       Return the inverse of ``self`` modulo ``modulus``, or zero if no inverse exists
@@ -755,7 +763,7 @@ X509CertificateBuilder
 
    .. py:method:: add_ext_as_blocks(as_blocks, is_critical)
 
-   .. py:method:: create_self_signed(key, rng, not_before, not_after, hash_fn=None, padding=None)
+   .. py:method:: create_self_signed(key, rng, not_before, not_after, serial_number=None, hash_fn=None, padding=None)
 
       Create a self-signed certificate from the given certificate options.
       ``not_before`` and ``not_after`` are expected to be the time since the UNIX epoch, in seconds.
@@ -771,12 +779,12 @@ X509ExtIPAddrBlocks
 
 .. py:class:: X509ExtIPAddrBlocks(cert=None)
 
-   .. py:method:: add_ip(ip, safi=None)
+   .. py:method:: add_addr(ip, safi=None)
 
       Add a single IP address to the extension. ``ip`` is expected to be a ``list[int]``
       of length 4/16 for IPv4/IPv6.
 
-   .. py:method:: add_ip_range(min_, max_, safi=None)
+   .. py:method:: add_range(min_, max_, safi=None)
 
       Add an IP address range to the extension.
 
@@ -836,12 +844,26 @@ PKCS10Req
 
 .. py:class:: PKCS10Req()
 
+   .. py:method:: public_key()
+
+      Get the public key associated with the signing request.
+
+   .. py:method:: key_constraints()
+
+      Return a list of all the key constraints listed in the signing request.
+
+   .. py:method:: verify(key)
+
+      Verify the signature of the signing request.
+
    .. py:method:: sign(issuing_cert, issuing_key, rng, not_before, not_after, hash_fn=None, padding=None)
 
       ``not_before`` and ``not_after`` are expected to be the time since the UNIX epoch, in seconds.
 
    .. py:method:: to_pem()
 
+   .. py:method:: to_der()
+
 X509Cert
 -----------------------------------------
 
@@ -921,7 +943,7 @@ X509Cert
 
       Return True if the certificates Key Usage extension contains all constraints given in ``usage_list``.
       Also return True if the certificate doesn't have this extension.
-      Example usage constraints are: ``"DIGITAL_SIGNATURE"``, ``"KEY_CERT_SIGN"``, ``"CRL_SIGN"``.
+      Example usage constraints are: ``X509KeyConstraints.DIGITAL_SIGNATURE"``, ``X509KeyConstraints.KEY_CERT_SIGN``, ``X509KeyConstraints.CRL_SIGN``.
 
    .. py:method:: key_constraints()
 
@@ -995,6 +1017,31 @@ X509CRL
    A CRL in PEM or DER format can be loaded from a file, with the ``filename`` argument,
    or from a bytestring, with the ``buf`` argument.
 
+   .. py:classmethod:: create(rng, ca_cert, ca_key, issue_time, next_update, hash_fn=None, padding=None)
+
+      Create a new CRL for the given CA.
+      ``issue_time`` is expected to be the time since the UNIX epoch, in seconds, ``next_update`` the time in seconds until the next update.
+
+
+   .. py:method:: revoke(rng, ca_cert, ca_key, issue_time, next_update, revoked, reason, hash_fn=None, padding=None)
+
+      Revoke certificates issued by the CA.
+      ``issue_time`` is expected to be the time since the UNIX epoch, in seconds, ``next_update`` the time in seconds until the next update.
+      Revoked is expected to be a list of certificates you want to revoked, reason should be of instance ``X509CRLReason``.
+      This method returns a new CRL, it does not modify the existing one!
+
+   .. py:method:: revoked()
+
+      Return entries listed in the CRL.
+
+   .. py:method:: verify(key)
+
+      Verify the signature of the CRL.
+
+   .. py:method:: to_pem()
+
+   .. py:method:: to_der()
+