Adding upstream version 3.7.9.upstream/3.7.9upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 758 insertions, 0 deletions

diff --git a/doc/ocsp-api.texi b/doc/ocsp-api.texi
new file mode 100644
index 0000000..f3183ed
--- /dev/null
+++ b/doc/ocsp-api.texi
@@ -0,0 +1,758 @@
+
+@subheading gnutls_ocsp_req_add_cert
+@anchor{gnutls_ocsp_req_add_cert}
+@deftypefun {int} {gnutls_ocsp_req_add_cert} (gnutls_ocsp_req_t @var{req}, gnutls_digest_algorithm_t @var{digest}, gnutls_x509_crt_t @var{issuer}, gnutls_x509_crt_t @var{cert})
+@var{req}: should contain a @code{gnutls_ocsp_req_t}  type
+
+@var{digest}: hash algorithm, a @code{gnutls_digest_algorithm_t}  value
+
+@var{issuer}: issuer of  @code{subject} certificate
+
+@var{cert}: certificate to request status for
+
+This function will add another request to the OCSP request for a
+particular certificate.  The issuer name hash, issuer key hash, and
+serial number fields is populated as follows.  The issuer name and
+the serial number is taken from  @code{cert} .  The issuer key is taken
+from  @code{issuer} .  The hashed values will be hashed using the  @code{digest} algorithm, normally @code{GNUTLS_DIG_SHA1} .
+
+@strong{Returns:} On success, @code{GNUTLS_E_SUCCESS}  (0) is returned, otherwise a
+negative error code is returned.
+@end deftypefun
+
+@subheading gnutls_ocsp_req_add_cert_id
+@anchor{gnutls_ocsp_req_add_cert_id}
+@deftypefun {int} {gnutls_ocsp_req_add_cert_id} (gnutls_ocsp_req_t @var{req}, gnutls_digest_algorithm_t @var{digest}, const gnutls_datum_t * @var{issuer_name_hash}, const gnutls_datum_t * @var{issuer_key_hash}, const gnutls_datum_t * @var{serial_number})
+@var{req}: should contain a @code{gnutls_ocsp_req_t}  type
+
+@var{digest}: hash algorithm, a @code{gnutls_digest_algorithm_t}  value
+
+@var{issuer_name_hash}: hash of issuer's DN
+
+@var{issuer_key_hash}: hash of issuer's public key
+
+@var{serial_number}: serial number of certificate to check
+
+This function will add another request to the OCSP request for a
+particular certificate having the issuer name hash of
+ @code{issuer_name_hash} and issuer key hash of  @code{issuer_key_hash} (both
+hashed using  @code{digest} ) and serial number  @code{serial_number} .
+
+The information needed corresponds to the CertID structure:
+
+<informalexample><programlisting>
+CertID	  ::=     SEQUENCE @{
+hashAlgorithm       AlgorithmIdentifier,
+issuerNameHash      OCTET STRING, -- Hash of Issuer's DN
+issuerKeyHash       OCTET STRING, -- Hash of Issuers public key
+serialNumber	CertificateSerialNumber @}
+</programlisting></informalexample>
+
+@strong{Returns:} On success, @code{GNUTLS_E_SUCCESS}  (0) is returned, otherwise a
+negative error code is returned.
+@end deftypefun
+
+@subheading gnutls_ocsp_req_deinit
+@anchor{gnutls_ocsp_req_deinit}
+@deftypefun {void} {gnutls_ocsp_req_deinit} (gnutls_ocsp_req_t @var{req})
+@var{req}: The data to be deinitialized
+
+This function will deinitialize a OCSP request structure.
+@end deftypefun
+
+@subheading gnutls_ocsp_req_export
+@anchor{gnutls_ocsp_req_export}
+@deftypefun {int} {gnutls_ocsp_req_export} (gnutls_ocsp_req_const_t @var{req}, gnutls_datum_t * @var{data})
+@var{req}: Holds the OCSP request
+
+@var{data}: newly allocate buffer holding DER encoded OCSP request
+
+This function will export the OCSP request to DER format.
+
+@strong{Returns:} In case of failure a negative error code will be
+returned, and 0 on success.
+@end deftypefun
+
+@subheading gnutls_ocsp_req_get_cert_id
+@anchor{gnutls_ocsp_req_get_cert_id}
+@deftypefun {int} {gnutls_ocsp_req_get_cert_id} (gnutls_ocsp_req_const_t @var{req}, unsigned @var{indx}, gnutls_digest_algorithm_t * @var{digest}, gnutls_datum_t * @var{issuer_name_hash}, gnutls_datum_t * @var{issuer_key_hash}, gnutls_datum_t * @var{serial_number})
+@var{req}: should contain a @code{gnutls_ocsp_req_t}  type
+
+@var{indx}: Specifies which extension OID to get. Use (0) to get the first one.
+
+@var{digest}: output variable with @code{gnutls_digest_algorithm_t}  hash algorithm
+
+@var{issuer_name_hash}: output buffer with hash of issuer's DN
+
+@var{issuer_key_hash}: output buffer with hash of issuer's public key
+
+@var{serial_number}: output buffer with serial number of certificate to check
+
+This function will return the certificate information of the
+ @code{indx} 'ed request in the OCSP request.  The information returned
+corresponds to the CertID structure:
+
+<informalexample><programlisting>
+CertID	  ::=     SEQUENCE @{
+hashAlgorithm       AlgorithmIdentifier,
+issuerNameHash      OCTET STRING, -- Hash of Issuer's DN
+issuerKeyHash       OCTET STRING, -- Hash of Issuers public key
+serialNumber	CertificateSerialNumber @}
+</programlisting></informalexample>
+
+Each of the pointers to output variables may be NULL to indicate
+that the caller is not interested in that value.
+
+@strong{Returns:} On success, @code{GNUTLS_E_SUCCESS}  (0) is returned, otherwise a
+negative error code is returned.  If you have reached the last
+CertID available @code{GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE}  will be
+returned.
+@end deftypefun
+
+@subheading gnutls_ocsp_req_get_extension
+@anchor{gnutls_ocsp_req_get_extension}
+@deftypefun {int} {gnutls_ocsp_req_get_extension} (gnutls_ocsp_req_const_t @var{req}, unsigned @var{indx}, gnutls_datum_t * @var{oid}, unsigned int * @var{critical}, gnutls_datum_t * @var{data})
+@var{req}: should contain a @code{gnutls_ocsp_req_t}  type
+
+@var{indx}: Specifies which extension OID to get. Use (0) to get the first one.
+
+@var{oid}: will hold newly allocated buffer with OID of extension, may be NULL
+
+@var{critical}: output variable with critical flag, may be NULL.
+
+@var{data}: will hold newly allocated buffer with extension data, may be NULL
+
+This function will return all information about the requested
+extension in the OCSP request.  The information returned is the
+OID, the critical flag, and the data itself.  The extension OID
+will be stored as a string.  Any of  @code{oid} ,  @code{critical} , and  @code{data} may
+be NULL which means that the caller is not interested in getting
+that information back.
+
+The caller needs to deallocate memory by calling @code{gnutls_free()}  on
+ @code{oid} ->data and  @code{data} ->data.
+
+Since 3.7.0  @code{oid} ->size does not account for the terminating null byte.
+
+@strong{Returns:} On success, @code{GNUTLS_E_SUCCESS}  (0) is returned, otherwise a
+negative error code is returned.  If you have reached the last
+extension available @code{GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE}  will
+be returned.
+@end deftypefun
+
+@subheading gnutls_ocsp_req_get_nonce
+@anchor{gnutls_ocsp_req_get_nonce}
+@deftypefun {int} {gnutls_ocsp_req_get_nonce} (gnutls_ocsp_req_const_t @var{req}, unsigned int * @var{critical}, gnutls_datum_t * @var{nonce})
+@var{req}: should contain a @code{gnutls_ocsp_req_t}  type
+
+@var{critical}: whether nonce extension is marked critical, or NULL
+
+@var{nonce}: will hold newly allocated buffer with nonce data
+
+This function will return the OCSP request nonce extension data.
+
+The caller needs to deallocate memory by calling @code{gnutls_free()}  on
+ @code{nonce} ->data.
+
+@strong{Returns:} On success, @code{GNUTLS_E_SUCCESS}  (0) is returned, otherwise a
+negative error code is returned.
+@end deftypefun
+
+@subheading gnutls_ocsp_req_get_version
+@anchor{gnutls_ocsp_req_get_version}
+@deftypefun {int} {gnutls_ocsp_req_get_version} (gnutls_ocsp_req_const_t @var{req})
+@var{req}: should contain a @code{gnutls_ocsp_req_t}  type
+
+This function will return the version of the OCSP request.
+Typically this is always 1 indicating version 1.
+
+@strong{Returns:} version of OCSP request, or a negative error code on error.
+@end deftypefun
+
+@subheading gnutls_ocsp_req_import
+@anchor{gnutls_ocsp_req_import}
+@deftypefun {int} {gnutls_ocsp_req_import} (gnutls_ocsp_req_t @var{req}, const gnutls_datum_t * @var{data})
+@var{req}: The data to store the parsed request.
+
+@var{data}: DER encoded OCSP request.
+
+This function will convert the given DER encoded OCSP request to
+the native @code{gnutls_ocsp_req_t}  format. The output will be stored in
+ @code{req} .
+
+@strong{Returns:} On success, @code{GNUTLS_E_SUCCESS}  (0) is returned, otherwise a
+negative error value.
+@end deftypefun
+
+@subheading gnutls_ocsp_req_init
+@anchor{gnutls_ocsp_req_init}
+@deftypefun {int} {gnutls_ocsp_req_init} (gnutls_ocsp_req_t * @var{req})
+@var{req}: A pointer to the type to be initialized
+
+This function will initialize an OCSP request structure.
+
+@strong{Returns:} On success, @code{GNUTLS_E_SUCCESS}  (0) is returned, otherwise a
+negative error value.
+@end deftypefun
+
+@subheading gnutls_ocsp_req_print
+@anchor{gnutls_ocsp_req_print}
+@deftypefun {int} {gnutls_ocsp_req_print} (gnutls_ocsp_req_const_t @var{req}, gnutls_ocsp_print_formats_t @var{format}, gnutls_datum_t * @var{out})
+@var{req}: The data to be printed
+
+@var{format}: Indicate the format to use
+
+@var{out}: Newly allocated datum with (0) terminated string.
+
+This function will pretty print a OCSP request, suitable for
+display to a human.
+
+If the format is @code{GNUTLS_OCSP_PRINT_FULL}  then all fields of the
+request will be output, on multiple lines.
+
+The output  @code{out} ->data needs to be deallocate using @code{gnutls_free()} .
+
+@strong{Returns:} On success, @code{GNUTLS_E_SUCCESS}  (0) is returned, otherwise a
+negative error value.
+@end deftypefun
+
+@subheading gnutls_ocsp_req_randomize_nonce
+@anchor{gnutls_ocsp_req_randomize_nonce}
+@deftypefun {int} {gnutls_ocsp_req_randomize_nonce} (gnutls_ocsp_req_t @var{req})
+@var{req}: should contain a @code{gnutls_ocsp_req_t}  type
+
+This function will add or update an nonce extension to the OCSP
+request with a newly generated random value.
+
+@strong{Returns:} On success, @code{GNUTLS_E_SUCCESS}  (0) is returned, otherwise a
+negative error code is returned.
+@end deftypefun
+
+@subheading gnutls_ocsp_req_set_extension
+@anchor{gnutls_ocsp_req_set_extension}
+@deftypefun {int} {gnutls_ocsp_req_set_extension} (gnutls_ocsp_req_t @var{req}, const char * @var{oid}, unsigned int @var{critical}, const gnutls_datum_t * @var{data})
+@var{req}: should contain a @code{gnutls_ocsp_req_t}  type
+
+@var{oid}: buffer with OID of extension as a string.
+
+@var{critical}: critical flag, normally false.
+
+@var{data}: the extension data
+
+This function will add an extension to the OCSP request.  Calling
+this function multiple times for the same OID will overwrite values
+from earlier calls.
+
+@strong{Returns:} On success, @code{GNUTLS_E_SUCCESS}  (0) is returned, otherwise a
+negative error code is returned.
+@end deftypefun
+
+@subheading gnutls_ocsp_req_set_nonce
+@anchor{gnutls_ocsp_req_set_nonce}
+@deftypefun {int} {gnutls_ocsp_req_set_nonce} (gnutls_ocsp_req_t @var{req}, unsigned int @var{critical}, const gnutls_datum_t * @var{nonce})
+@var{req}: should contain a @code{gnutls_ocsp_req_t}  type
+
+@var{critical}: critical flag, normally false.
+
+@var{nonce}: the nonce data
+
+This function will add an nonce extension to the OCSP request.
+Calling this function multiple times will overwrite values from
+earlier calls.
+
+@strong{Returns:} On success, @code{GNUTLS_E_SUCCESS}  (0) is returned, otherwise a
+negative error code is returned.
+@end deftypefun
+
+@subheading gnutls_ocsp_resp_check_crt
+@anchor{gnutls_ocsp_resp_check_crt}
+@deftypefun {int} {gnutls_ocsp_resp_check_crt} (gnutls_ocsp_resp_const_t @var{resp}, unsigned int @var{indx}, gnutls_x509_crt_t @var{crt})
+@var{resp}: should contain a @code{gnutls_ocsp_resp_t}  type
+
+@var{indx}: Specifies response number to get. Use (0) to get the first one.
+
+@var{crt}: The certificate to check
+
+This function will check whether the OCSP response
+is about the provided certificate.
+
+@strong{Returns:} On success, @code{GNUTLS_E_SUCCESS}  (0) is returned, otherwise a
+negative error code is returned.  
+
+@strong{Since:} 3.1.3
+@end deftypefun
+
+@subheading gnutls_ocsp_resp_deinit
+@anchor{gnutls_ocsp_resp_deinit}
+@deftypefun {void} {gnutls_ocsp_resp_deinit} (gnutls_ocsp_resp_t @var{resp})
+@var{resp}: The data to be deinitialized
+
+This function will deinitialize a OCSP response structure.
+@end deftypefun
+
+@subheading gnutls_ocsp_resp_export
+@anchor{gnutls_ocsp_resp_export}
+@deftypefun {int} {gnutls_ocsp_resp_export} (gnutls_ocsp_resp_const_t @var{resp}, gnutls_datum_t * @var{data})
+@var{resp}: Holds the OCSP response
+
+@var{data}: newly allocate buffer holding DER encoded OCSP response
+
+This function will export the OCSP response to DER format.
+
+@strong{Returns:} In case of failure a negative error code will be
+returned, and 0 on success.
+@end deftypefun
+
+@subheading gnutls_ocsp_resp_export2
+@anchor{gnutls_ocsp_resp_export2}
+@deftypefun {int} {gnutls_ocsp_resp_export2} (gnutls_ocsp_resp_const_t @var{resp}, gnutls_datum_t * @var{data}, gnutls_x509_crt_fmt_t @var{fmt})
+@var{resp}: Holds the OCSP response
+
+@var{data}: newly allocate buffer holding DER or PEM encoded OCSP response
+
+@var{fmt}: DER or PEM
+
+This function will export the OCSP response to DER or PEM format.
+
+@strong{Returns:} In case of failure a negative error code will be
+returned, and 0 on success.
+
+@strong{Since:} 3.6.3
+@end deftypefun
+
+@subheading gnutls_ocsp_resp_get_certs
+@anchor{gnutls_ocsp_resp_get_certs}
+@deftypefun {int} {gnutls_ocsp_resp_get_certs} (gnutls_ocsp_resp_const_t @var{resp}, gnutls_x509_crt_t ** @var{certs}, size_t * @var{ncerts})
+@var{resp}: should contain a @code{gnutls_ocsp_resp_t}  type
+
+@var{certs}: newly allocated array with @code{gnutls_x509_crt_t}  certificates
+
+@var{ncerts}: output variable with number of allocated certs.
+
+This function will extract the X.509 certificates found in the
+Basic OCSP Response.  The  @code{certs} output variable will hold a newly
+allocated zero-terminated array with X.509 certificates.
+
+Every certificate in the array needs to be de-allocated with
+@code{gnutls_x509_crt_deinit()}  and the array itself must be freed using
+@code{gnutls_free()} .
+
+Both the  @code{certs} and  @code{ncerts} variables may be NULL.  Then the
+function will work as normal but will not return the NULL:d
+information.  This can be used to get the number of certificates
+only, or to just get the certificate array without its size.
+
+@strong{Returns:} On success, @code{GNUTLS_E_SUCCESS}  (0) is returned, otherwise a
+negative error value.
+@end deftypefun
+
+@subheading gnutls_ocsp_resp_get_extension
+@anchor{gnutls_ocsp_resp_get_extension}
+@deftypefun {int} {gnutls_ocsp_resp_get_extension} (gnutls_ocsp_resp_const_t @var{resp}, unsigned @var{indx}, gnutls_datum_t * @var{oid}, unsigned int * @var{critical}, gnutls_datum_t * @var{data})
+@var{resp}: should contain a @code{gnutls_ocsp_resp_t}  type
+
+@var{indx}: Specifies which extension OID to get. Use (0) to get the first one.
+
+@var{oid}: will hold newly allocated buffer with OID of extension, may be NULL
+
+@var{critical}: output variable with critical flag, may be NULL.
+
+@var{data}: will hold newly allocated buffer with extension data, may be NULL
+
+This function will return all information about the requested
+extension in the OCSP response.  The information returned is the
+OID, the critical flag, and the data itself.  The extension OID
+will be stored as a string.  Any of  @code{oid} ,  @code{critical} , and  @code{data} may
+be NULL which means that the caller is not interested in getting
+that information back.
+
+The caller needs to deallocate memory by calling @code{gnutls_free()}  on
+ @code{oid} ->data and  @code{data} ->data.
+
+Since 3.7.0  @code{oid} ->size does not account for the terminating null byte.
+
+@strong{Returns:} On success, @code{GNUTLS_E_SUCCESS}  (0) is returned, otherwise a
+negative error code is returned.  If you have reached the last
+extension available @code{GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE}  will
+be returned.
+@end deftypefun
+
+@subheading gnutls_ocsp_resp_get_nonce
+@anchor{gnutls_ocsp_resp_get_nonce}
+@deftypefun {int} {gnutls_ocsp_resp_get_nonce} (gnutls_ocsp_resp_const_t @var{resp}, unsigned int * @var{critical}, gnutls_datum_t * @var{nonce})
+@var{resp}: should contain a @code{gnutls_ocsp_resp_t}  type
+
+@var{critical}: whether nonce extension is marked critical
+
+@var{nonce}: will hold newly allocated buffer with nonce data
+
+This function will return the Basic OCSP Response nonce extension
+data.
+
+The caller needs to deallocate memory by calling @code{gnutls_free()}  on
+ @code{nonce} ->data.
+
+@strong{Returns:} On success, @code{GNUTLS_E_SUCCESS}  (0) is returned, otherwise a
+negative error code is returned.
+@end deftypefun
+
+@subheading gnutls_ocsp_resp_get_produced
+@anchor{gnutls_ocsp_resp_get_produced}
+@deftypefun {time_t} {gnutls_ocsp_resp_get_produced} (gnutls_ocsp_resp_const_t @var{resp})
+@var{resp}: should contain a @code{gnutls_ocsp_resp_t}  type
+
+This function will return the time when the OCSP response was
+signed.
+
+@strong{Returns:} signing time, or (time_t)-1 on error.
+@end deftypefun
+
+@subheading gnutls_ocsp_resp_get_responder
+@anchor{gnutls_ocsp_resp_get_responder}
+@deftypefun {int} {gnutls_ocsp_resp_get_responder} (gnutls_ocsp_resp_const_t @var{resp}, gnutls_datum_t * @var{dn})
+@var{resp}: should contain a @code{gnutls_ocsp_resp_t}  type
+
+@var{dn}: newly allocated buffer with name
+
+This function will extract the name of the Basic OCSP Response in
+the provided buffer. The name will be in the form
+"C=xxxx,O=yyyy,CN=zzzz" as described in RFC2253. The output string
+will be ASCII or UTF-8 encoded, depending on the certificate data.
+
+If the responder ID is not a name but a hash, this function
+will return zero and the  @code{dn} elements will be set to @code{NULL} .
+
+The caller needs to deallocate memory by calling @code{gnutls_free()}  on
+ @code{dn} ->data.
+
+This function does not output a fully RFC4514 compliant string, if
+that is required see @code{gnutls_ocsp_resp_get_responder2()} .
+
+@strong{Returns:} On success, @code{GNUTLS_E_SUCCESS}  (0) is returned, otherwise a
+negative error code is returned. When no data exist it will
+return success and set  @code{dn} elements to zero.
+@end deftypefun
+
+@subheading gnutls_ocsp_resp_get_responder2
+@anchor{gnutls_ocsp_resp_get_responder2}
+@deftypefun {int} {gnutls_ocsp_resp_get_responder2} (gnutls_ocsp_resp_const_t @var{resp}, gnutls_datum_t * @var{dn}, unsigned @var{flags})
+@var{resp}: should contain a @code{gnutls_ocsp_resp_t}  type
+
+@var{dn}: newly allocated buffer with name
+
+@var{flags}: zero or @code{GNUTLS_X509_DN_FLAG_COMPAT} 
+
+This function will extract the name of the Basic OCSP Response in
+the provided buffer. The name will be in the form
+"C=xxxx,O=yyyy,CN=zzzz" as described in RFC2253. The output string
+will be ASCII or UTF-8 encoded, depending on the certificate data.
+
+If the responder ID is not a name but a hash, this function
+will return zero and the  @code{dn} elements will be set to @code{NULL} .
+
+The caller needs to deallocate memory by calling @code{gnutls_free()}  on
+ @code{dn} ->data.
+
+When the flag @code{GNUTLS_X509_DN_FLAG_COMPAT}  is specified, the output
+format will match the format output by previous to 3.5.6 versions of GnuTLS
+which was not not fully RFC4514-compliant.
+
+@strong{Returns:} On success, @code{GNUTLS_E_SUCCESS}  (0) is returned, otherwise a
+negative error code is returned. When no data exist it will return
+@code{GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE} .
+@end deftypefun
+
+@subheading gnutls_ocsp_resp_get_responder_raw_id
+@anchor{gnutls_ocsp_resp_get_responder_raw_id}
+@deftypefun {int} {gnutls_ocsp_resp_get_responder_raw_id} (gnutls_ocsp_resp_const_t @var{resp}, unsigned @var{type}, gnutls_datum_t * @var{raw})
+@var{resp}: should contain a @code{gnutls_ocsp_resp_t}  type
+
+@var{type}: should be @code{GNUTLS_OCSP_RESP_ID_KEY}  or @code{GNUTLS_OCSP_RESP_ID_DN} 
+
+@var{raw}: newly allocated buffer with the raw ID
+
+This function will extract the raw key (or DN) ID of the Basic OCSP Response in
+the provided buffer. If the responder ID is not a key ID then
+this function will return @code{GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE} .
+
+The caller needs to deallocate memory by calling @code{gnutls_free()}  on
+ @code{dn} ->data.
+
+@strong{Returns:} On success, @code{GNUTLS_E_SUCCESS}  (0) is returned, otherwise a
+negative error code is returned.
+@end deftypefun
+
+@subheading gnutls_ocsp_resp_get_response
+@anchor{gnutls_ocsp_resp_get_response}
+@deftypefun {int} {gnutls_ocsp_resp_get_response} (gnutls_ocsp_resp_const_t @var{resp}, gnutls_datum_t * @var{response_type_oid}, gnutls_datum_t * @var{response})
+@var{resp}: should contain a @code{gnutls_ocsp_resp_t}  type
+
+@var{response_type_oid}: newly allocated output buffer with response type OID
+
+@var{response}: newly allocated output buffer with DER encoded response
+
+This function will extract the response type OID in and the
+response data from an OCSP response.  Normally the
+ @code{response_type_oid} is always "1.3.6.1.5.5.7.48.1.1" which means the
+ @code{response} should be decoded as a Basic OCSP Response, but
+technically other response types could be used.
+
+This function is typically only useful when you want to extract the
+response type OID of an response for diagnostic purposes.
+Otherwise @code{gnutls_ocsp_resp_import()}  will decode the basic OCSP
+response part and the caller need not worry about that aspect.
+
+Since 3.7.0  @code{response_type_oid} ->size does not account for the terminating
+null byte.
+
+@strong{Returns:} On success, @code{GNUTLS_E_SUCCESS}  (0) is returned, otherwise a
+negative error value.
+@end deftypefun
+
+@subheading gnutls_ocsp_resp_get_signature
+@anchor{gnutls_ocsp_resp_get_signature}
+@deftypefun {int} {gnutls_ocsp_resp_get_signature} (gnutls_ocsp_resp_const_t @var{resp}, gnutls_datum_t * @var{sig})
+@var{resp}: should contain a @code{gnutls_ocsp_resp_t}  type
+
+@var{sig}: newly allocated output buffer with signature data
+
+This function will extract the signature field of a OCSP response.
+
+@strong{Returns:} On success, @code{GNUTLS_E_SUCCESS}  (0) is returned, otherwise a
+negative error value.
+@end deftypefun
+
+@subheading gnutls_ocsp_resp_get_signature_algorithm
+@anchor{gnutls_ocsp_resp_get_signature_algorithm}
+@deftypefun {int} {gnutls_ocsp_resp_get_signature_algorithm} (gnutls_ocsp_resp_const_t @var{resp})
+@var{resp}: should contain a @code{gnutls_ocsp_resp_t}  type
+
+This function will return a value of the @code{gnutls_sign_algorithm_t} 
+enumeration that is the signature algorithm that has been used to
+sign the OCSP response.
+
+@strong{Returns:} a @code{gnutls_sign_algorithm_t}  value, or a negative error code
+on error.
+@end deftypefun
+
+@subheading gnutls_ocsp_resp_get_single
+@anchor{gnutls_ocsp_resp_get_single}
+@deftypefun {int} {gnutls_ocsp_resp_get_single} (gnutls_ocsp_resp_const_t @var{resp}, unsigned @var{indx}, gnutls_digest_algorithm_t * @var{digest}, gnutls_datum_t * @var{issuer_name_hash}, gnutls_datum_t * @var{issuer_key_hash}, gnutls_datum_t * @var{serial_number}, unsigned int * @var{cert_status}, time_t * @var{this_update}, time_t * @var{next_update}, time_t * @var{revocation_time}, unsigned int * @var{revocation_reason})
+@var{resp}: should contain a @code{gnutls_ocsp_resp_t}  type
+
+@var{indx}: Specifies response number to get. Use (0) to get the first one.
+
+@var{digest}: output variable with @code{gnutls_digest_algorithm_t}  hash algorithm
+
+@var{issuer_name_hash}: output buffer with hash of issuer's DN
+
+@var{issuer_key_hash}: output buffer with hash of issuer's public key
+
+@var{serial_number}: output buffer with serial number of certificate to check
+
+@var{cert_status}: a certificate status, a @code{gnutls_ocsp_cert_status_t}  enum.
+
+@var{this_update}: time at which the status is known to be correct.
+
+@var{next_update}: when newer information will be available, or (time_t)-1 if unspecified
+
+@var{revocation_time}: when  @code{cert_status} is @code{GNUTLS_OCSP_CERT_REVOKED} , holds time of revocation.
+
+@var{revocation_reason}: revocation reason, a @code{gnutls_x509_crl_reason_t}  enum.
+
+This function will return the certificate information of the
+ @code{indx} 'ed response in the Basic OCSP Response  @code{resp} .  The
+information returned corresponds to the OCSP SingleResponse structure
+except the final singleExtensions.
+
+Each of the pointers to output variables may be NULL to indicate
+that the caller is not interested in that value.
+
+@strong{Returns:} On success, @code{GNUTLS_E_SUCCESS}  (0) is returned, otherwise a
+negative error code is returned.  If you have reached the last
+CertID available @code{GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE}  will be
+returned.
+@end deftypefun
+
+@subheading gnutls_ocsp_resp_get_status
+@anchor{gnutls_ocsp_resp_get_status}
+@deftypefun {int} {gnutls_ocsp_resp_get_status} (gnutls_ocsp_resp_const_t @var{resp})
+@var{resp}: should contain a @code{gnutls_ocsp_resp_t}  type
+
+This function will return the status of a OCSP response, an
+@code{gnutls_ocsp_resp_status_t}  enumeration.
+
+@strong{Returns:} status of OCSP request as a @code{gnutls_ocsp_resp_status_t} , or
+a negative error code on error.
+@end deftypefun
+
+@subheading gnutls_ocsp_resp_get_version
+@anchor{gnutls_ocsp_resp_get_version}
+@deftypefun {int} {gnutls_ocsp_resp_get_version} (gnutls_ocsp_resp_const_t @var{resp})
+@var{resp}: should contain a @code{gnutls_ocsp_resp_t}  type
+
+This function will return the version of the Basic OCSP Response.
+Typically this is always 1 indicating version 1.
+
+@strong{Returns:} version of Basic OCSP response, or a negative error code
+on error.
+@end deftypefun
+
+@subheading gnutls_ocsp_resp_import
+@anchor{gnutls_ocsp_resp_import}
+@deftypefun {int} {gnutls_ocsp_resp_import} (gnutls_ocsp_resp_t @var{resp}, const gnutls_datum_t * @var{data})
+@var{resp}: The data to store the parsed response.
+
+@var{data}: DER encoded OCSP response.
+
+This function will convert the given DER encoded OCSP response to
+the native @code{gnutls_ocsp_resp_t}  format.  It also decodes the Basic
+OCSP Response part, if any.  The output will be stored in  @code{resp} .
+
+@strong{Returns:} On success, @code{GNUTLS_E_SUCCESS}  (0) is returned, otherwise a
+negative error value.
+@end deftypefun
+
+@subheading gnutls_ocsp_resp_import2
+@anchor{gnutls_ocsp_resp_import2}
+@deftypefun {int} {gnutls_ocsp_resp_import2} (gnutls_ocsp_resp_t @var{resp}, const gnutls_datum_t * @var{data}, gnutls_x509_crt_fmt_t @var{fmt})
+@var{resp}: The data to store the parsed response.
+
+@var{data}: DER or PEM encoded OCSP response.
+
+@var{fmt}: DER or PEM
+
+This function will convert the given OCSP response to
+the native @code{gnutls_ocsp_resp_t}  format.  It also decodes the Basic
+OCSP Response part, if any.  The output will be stored in  @code{resp} .
+
+@strong{Returns:} On success, @code{GNUTLS_E_SUCCESS}  (0) is returned, otherwise a
+negative error value.
+
+@strong{Since:} 3.6.3
+@end deftypefun
+
+@subheading gnutls_ocsp_resp_init
+@anchor{gnutls_ocsp_resp_init}
+@deftypefun {int} {gnutls_ocsp_resp_init} (gnutls_ocsp_resp_t * @var{resp})
+@var{resp}: A pointer to the type to be initialized
+
+This function will initialize an OCSP response structure.
+
+@strong{Returns:} On success, @code{GNUTLS_E_SUCCESS}  (0) is returned, otherwise a
+negative error value.
+@end deftypefun
+
+@subheading gnutls_ocsp_resp_list_import2
+@anchor{gnutls_ocsp_resp_list_import2}
+@deftypefun {int} {gnutls_ocsp_resp_list_import2} (gnutls_ocsp_resp_t ** @var{ocsps}, unsigned int * @var{size}, const gnutls_datum_t * @var{resp_data}, gnutls_x509_crt_fmt_t @var{format}, unsigned int @var{flags})
+@var{ocsps}: Will hold the parsed OCSP response list.
+
+@var{size}: It will contain the size of the list.
+
+@var{resp_data}: The PEM encoded OCSP list.
+
+@var{format}: One of @code{GNUTLS_X509_FMT_PEM}  or @code{GNUTLS_X509_FMT_DER} 
+
+@var{flags}: must be (0) or an OR'd sequence of gnutls_certificate_import_flags.
+
+This function will convert the given PEM encoded OCSP response list
+to the native gnutls_ocsp_resp_t format. The output will be stored
+in  @code{ocsps} which will be allocated and initialized.
+
+The OCSP responses should have a header of "OCSP RESPONSE".
+
+To deinitialize responses, you need to deinitialize each @code{gnutls_ocsp_resp_t} 
+structure independently, and use @code{gnutls_free()}  at  @code{ocsps} .
+
+In PEM files, when no OCSP responses are detected
+@code{GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE}  will be returned.
+
+@strong{Returns:} the number of responses read or a negative error value.
+
+@strong{Since:} 3.6.3
+@end deftypefun
+
+@subheading gnutls_ocsp_resp_print
+@anchor{gnutls_ocsp_resp_print}
+@deftypefun {int} {gnutls_ocsp_resp_print} (gnutls_ocsp_resp_const_t @var{resp}, gnutls_ocsp_print_formats_t @var{format}, gnutls_datum_t * @var{out})
+@var{resp}: The data to be printed
+
+@var{format}: Indicate the format to use
+
+@var{out}: Newly allocated datum with (0) terminated string.
+
+This function will pretty print a OCSP response, suitable for
+display to a human.
+
+If the format is @code{GNUTLS_OCSP_PRINT_FULL}  then all fields of the
+response will be output, on multiple lines.
+
+The output  @code{out} ->data needs to be deallocate using @code{gnutls_free()} .
+
+@strong{Returns:} On success, @code{GNUTLS_E_SUCCESS}  (0) is returned, otherwise a
+negative error value.
+@end deftypefun
+
+@subheading gnutls_ocsp_resp_verify
+@anchor{gnutls_ocsp_resp_verify}
+@deftypefun {int} {gnutls_ocsp_resp_verify} (gnutls_ocsp_resp_const_t @var{resp}, gnutls_x509_trust_list_t @var{trustlist}, unsigned int * @var{verify}, unsigned int @var{flags})
+@var{resp}: should contain a @code{gnutls_ocsp_resp_t}  type
+
+@var{trustlist}: trust anchors as a @code{gnutls_x509_trust_list_t}  type
+
+@var{verify}: output variable with verification status, an @code{gnutls_ocsp_verify_reason_t} 
+
+@var{flags}: verification flags from @code{gnutls_certificate_verify_flags} 
+
+Verify signature of the Basic OCSP Response against the public key
+in the certificate of a trusted signer.  The  @code{trustlist} should be
+populated with trust anchors.  The function will extract the signer
+certificate from the Basic OCSP Response and will verify it against
+the  @code{trustlist} .  A trusted signer is a certificate that is either
+in  @code{trustlist} , or it is signed directly by a certificate in
+ @code{trustlist} and has the id-ad-ocspSigning Extended Key Usage bit
+set.
+
+The output  @code{verify} variable will hold verification status codes
+(e.g., @code{GNUTLS_OCSP_VERIFY_SIGNER_NOT_FOUND} ,
+@code{GNUTLS_OCSP_VERIFY_INSECURE_ALGORITHM} ) which are only valid if the
+function returned @code{GNUTLS_E_SUCCESS} .
+
+Note that the function returns @code{GNUTLS_E_SUCCESS}  even when
+verification failed.  The caller must always inspect the  @code{verify} variable to find out the verification status.
+
+The  @code{flags} variable should be 0 for now.
+
+@strong{Returns:} On success, @code{GNUTLS_E_SUCCESS}  (0) is returned, otherwise a
+negative error value.
+@end deftypefun
+
+@subheading gnutls_ocsp_resp_verify_direct
+@anchor{gnutls_ocsp_resp_verify_direct}
+@deftypefun {int} {gnutls_ocsp_resp_verify_direct} (gnutls_ocsp_resp_const_t @var{resp}, gnutls_x509_crt_t @var{issuer}, unsigned int * @var{verify}, unsigned int @var{flags})
+@var{resp}: should contain a @code{gnutls_ocsp_resp_t}  type
+
+@var{issuer}: certificate believed to have signed the response
+
+@var{verify}: output variable with verification status, an @code{gnutls_ocsp_verify_reason_t} 
+
+@var{flags}: verification flags from @code{gnutls_certificate_verify_flags} 
+
+Verify signature of the Basic OCSP Response against the public key
+in the  @code{issuer} certificate.
+
+The output  @code{verify} variable will hold verification status codes
+(e.g., @code{GNUTLS_OCSP_VERIFY_SIGNER_NOT_FOUND} ,
+@code{GNUTLS_OCSP_VERIFY_INSECURE_ALGORITHM} ) which are only valid if the
+function returned @code{GNUTLS_E_SUCCESS} .
+
+Note that the function returns @code{GNUTLS_E_SUCCESS}  even when
+verification failed.  The caller must always inspect the  @code{verify} variable to find out the verification status.
+
+The  @code{flags} variable should be 0 for now.
+
+@strong{Returns:} On success, @code{GNUTLS_E_SUCCESS}  (0) is returned, otherwise a
+negative error value.
+@end deftypefun
+