ssl: Integrate public_key CRL verification with the ssl application

1 files changed, 97 insertions, 0 deletions

diff --git a/lib/ssl/doc/src/ssl_crl_cache_api.xml b/lib/ssl/doc/src/ssl_crl_cache_api.xml
new file mode 100644
index 0000000000..24365c9f59
--- /dev/null
+++ b/lib/ssl/doc/src/ssl_crl_cache_api.xml
@@ -0,0 +1,97 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<!DOCTYPE erlref SYSTEM "erlref.dtd">
+
+<erlref>
+  <header>
+    <copyright>
+      <year>2015</year><year>2015</year>
+      <holder>Ericsson AB. All Rights Reserved.</holder>
+    </copyright>
+    <legalnotice>
+      The contents of this file are subject to the Erlang Public License,
+      Version 1.1, (the "License"); you may not use this file except in
+      compliance with the License. You should have received a copy of the
+      Erlang Public License along with this software. If not, it can be
+      retrieved online at http://www.erlang.org/.
+
+      Software distributed under the License is distributed on an "AS IS"
+      basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
+      the License for the specific language governing rights and limitations
+      under the License.
+    </legalnotice>
+    <title>ssl_crl_cache_api</title>
+    <file>ssl_crl_cache_api.xml</file>
+  </header>
+  
+  <module>ssl_crl_cache_api</module>
+  <modulesummary>API for a SSL/TLS CRL (Certificate Revocation List) cache.</modulesummary>
+  <description>
+    <p>
+      When SSL/TLS performs certificate path validation according to 
+      <url href="http://www.ietf.org/rfc/rfc5280.txt">RFC 5280 </url> it should
+      also perform CRL validation checks. To enable the CRL checks the application
+      needs access to CRLs. A database of CRLs can be set up in many different ways.
+      This module provides an API to integrate an arbitrary CRL cache with the erlang
+      ssl application. It is also used by the application itself to provide a simple
+      default implementation of a CRL cache. 
+    </p>
+  </description>
+  
+  <section>
+    <title>Common Data Types</title>
+    
+    <p>The following data types are used in the functions below:
+    </p>
+    
+    <p><c>cache_ref() = opaque()</c></p> 
+    <p> dist_point() = #'DistributionPoint'{} see <seealso
+    marker="public_key:cert_records"> X509 certificates records</seealso></p>
+  </section>
+  
+  <funcs>
+    <func>
+      <name>lookup(DistributionPoint, DbHandle) -> not_available | CRLs </name>
+      <fsummary> </fsummary>
+      <type>
+        <v> DistributionPoint = dist_point() </v>
+	<v> DbHandle  = cache_ref() </v>
+	<v> CRLs = [<seealso
+	   marker="public_key:public_key">public_key:der_encoded()</seealso>] </v>
+	</type>
+	<desc> <p>Lookup the CRLs belonging to the distribution point <c> Distributionpoint </c> </p>.
+	This function may choose to only look in the cache or to follow distribution point
+	links depending on how the cache is administrated.
+	</desc>
+    </func>
+    
+    <func>
+      <name>select(Issuer, DbHandle) -> CRLs </name>
+      <fsummary>Select the CRLs in the cache that are issued by <c>Issuer</c></fsummary>
+      <type>
+	<v> Issuer = <seealso
+	marker="public_key:public_key">public_key:issuer_name()</seealso></v>
+	<v> DbHandle  = cache_ref() </v>
+	</type>
+	<desc>
+	  <p>Select the CRLs in the cache that are issued by <c>Issuer</c> </p>
+	</desc>
+    </func>
+    
+    <func>
+      <name>fresh_crl(DistributionPoint, CRL) -> FreshCRL</name>
+      <fsummary> <c>fun fresh_crl/2 </c> will be used as input option <c>update_crl</c> to
+      public_key:pkix_crls_validate/3 </fsummary>
+      <type>
+	<v> DistributionPoint = dist_point() </v>
+	<v> CRL = [<seealso
+	marker="public_key:public_key">public_key:der_encoded()</seealso>] </v>
+	<v> FreshCRL = [<seealso
+	marker="public_key:public_key">public_key:der_encoded()</seealso>] </v>
+      </type>
+      <desc>
+	<p> <c>fun fresh_crl/2 </c> will be used as input option <c>update_crl</c> to
+	<seealso marker="public_key#pkix_path_validation-3">public_key:pkix_crls_validate/3 </seealso> </p>
+      </desc>
+    </func>
+  </funcs>
+</erlref>
\ No newline at end of file