caching of ocsp responses (experimental), no crl caching yet

src/libstrongswan/credentials/certificates/ac.h

@@ -51,7 +51,7 @@ struct ac_t {
 	 * @param that			other attribute certificate
 	 * @return				TRUE if same holder
 	 */
-	bool (*equals_holder) (const ac_t *this, const ac_t *other);
+	bool (*equals_holder) (ac_t *this, ac_t *other);
 };
 
 #endif /* AC_H_ @}*/

src/libstrongswan/credentials/certificates/certificate.c

@@ -32,10 +32,10 @@ ENUM(certificate_type_names, CERT_ANY, CERT_PGP,
 );
 
 ENUM(cert_validation_names, VALIDATION_GOOD, VALIDATION_SKIPPED,
-	"GOOD",
-	"REVOKED",
-	"UNKNOWN",
-	"FAILED",
-	"SKIPPED",
+	"VALIDATION_GOOD",
+	"VALIDATION_STALE",
+	"VALIDATION_REVOKED",
+	"VALIDATION_FAILED",
+	"VALIDATION_SKIPPED",
 );
 

src/libstrongswan/credentials/certificates/certificate.h

@@ -62,13 +62,13 @@ extern enum_name_t *certificate_type_names;
 enum cert_validation_t {
 	/** certificate has been validated successfully */
 	VALIDATION_GOOD,
-	/** validation failed, certificate is revoked */
+	/** certificate has been validated, but check based on stale information */
+	VALIDATION_STALE,
+	/** certificate has been revoked */
 	VALIDATION_REVOKED,
-	/* ocsp status is unknown or crl is stale */
-	VALIDATION_UNKNOWN,
-	/** validation process failed due to an error */
+	/** validation failed due to a processing error */
 	VALIDATION_FAILED,
-	/** validation has been skipped (no cdps available) */
+	/** validation has been skipped due to missing validation information */
 	VALIDATION_SKIPPED,
 };
 
@@ -129,17 +129,12 @@ struct certificate_t {
 	id_match_t (*has_issuer)(certificate_t *this, identification_t *issuer);
 	
 	/**
-	 * Check if this certificate is issued by a specific issuer.
+	 * Check if this certificate is issued and signed by a specific issuer.
 	 *
-	 * As signature verification is computional expensive, it is optional 
-	 * and may be skipped. While this is not sufficient for verification
-	 * purposes, it is to e.g. find matching certificates.
-	 * 
 	 * @param issuer	issuer's certificate
-	 * @param checksig	TRUE to verify signature, FALSE to compare issuer only
 	 * @return 			TRUE if certificate issued by issuer and trusted
 	 */
-	bool (*issued_by)(certificate_t *this, certificate_t *issuer, bool checksig);
+	bool (*issued_by)(certificate_t *this, certificate_t *issuer);
 	
 	/**
 	 * Get the public key associated to this certificate.

src/libstrongswan/credentials/certificates/ocsp_request.c

@@ -1,19 +0,0 @@
-/*
- * Copyright (C) 2008 Martin Willi
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- *
- * $Id$
- */
-
-#include "ocsp_request.h"
-