1*2139Sjp161948The STORE type 2*2139Sjp161948============== 3*2139Sjp161948 4*2139Sjp161948A STORE, as defined in this code section, is really a rather simple 5*2139Sjp161948thing which stores objects and per-object associations to a number 6*2139Sjp161948of attributes. What attributes are supported entirely depends on 7*2139Sjp161948the particular implementation of a STORE. It has some support for 8*2139Sjp161948generation of certain objects (for example, keys and CRLs). 9*2139Sjp161948 10*2139Sjp161948 11*2139Sjp161948Supported object types 12*2139Sjp161948---------------------- 13*2139Sjp161948 14*2139Sjp161948For now, the objects that are supported are the following: 15*2139Sjp161948 16*2139Sjp161948X.509 certificate 17*2139Sjp161948X.509 CRL 18*2139Sjp161948private key 19*2139Sjp161948public key 20*2139Sjp161948number 21*2139Sjp161948arbitrary (application) data 22*2139Sjp161948 23*2139Sjp161948The intention is that a STORE should be able to store everything 24*2139Sjp161948needed by an application that wants a cert/key store, as well as 25*2139Sjp161948the data a CA might need to store (this includes the serial number 26*2139Sjp161948counter, which explains the support for numbers). 27*2139Sjp161948 28*2139Sjp161948 29*2139Sjp161948Supported attribute types 30*2139Sjp161948------------------------- 31*2139Sjp161948 32*2139Sjp161948For now, the following attributes are supported: 33*2139Sjp161948 34*2139Sjp161948Friendly Name - the value is a normal C string 35*2139Sjp161948Key ID - the value is a 160 bit SHA1 hash 36*2139Sjp161948Issuer Key ID - the value is a 160 bit SHA1 hash 37*2139Sjp161948Subject Key ID - the value is a 160 bit SHA1 hash 38*2139Sjp161948Issuer/Serial Hash - the value is a 160 bit SHA1 hash 39*2139Sjp161948Issuer - the value is a X509_NAME 40*2139Sjp161948Serial - the value is a BIGNUM 41*2139Sjp161948Subject - the value is a X509_NAME 42*2139Sjp161948Certificate Hash - the value is a 160 bit SHA1 hash 43*2139Sjp161948Email - the value is a normal C string 44*2139Sjp161948Filename - the value is a normal C string 45*2139Sjp161948 46*2139Sjp161948It is expected that these attributes should be enough to support 47*2139Sjp161948the need from most, if not all, current applications. Applications 48*2139Sjp161948that need to do certificate verification would typically use Subject 49*2139Sjp161948Key ID, Issuer/Serial Hash or Subject to look up issuer certificates. 50*2139Sjp161948S/MIME applications would typically use Email to look up recipient 51*2139Sjp161948and signer certificates. 52*2139Sjp161948 53*2139Sjp161948There's added support for combined sets of attributes to search for, 54*2139Sjp161948with the special OR attribute. 55*2139Sjp161948 56*2139Sjp161948 57*2139Sjp161948Supported basic functionality 58*2139Sjp161948----------------------------- 59*2139Sjp161948 60*2139Sjp161948The functions that are supported through the STORE type are these: 61*2139Sjp161948 62*2139Sjp161948generate_object - for example to generate keys and CRLs 63*2139Sjp161948get_object - to look up one object 64*2139Sjp161948 NOTE: this function is really rather 65*2139Sjp161948 redundant and probably of lesser usage 66*2139Sjp161948 than the list functions 67*2139Sjp161948store_object - store an object and the attributes 68*2139Sjp161948 associated with it 69*2139Sjp161948modify_object - modify the attributes associated with 70*2139Sjp161948 a specific object 71*2139Sjp161948revoke_object - revoke an object 72*2139Sjp161948 NOTE: this only marks an object as 73*2139Sjp161948 invalid, it doesn't remove the object 74*2139Sjp161948 from the database 75*2139Sjp161948delete_object - remove an object from the database 76*2139Sjp161948list_object - list objects associated with a given 77*2139Sjp161948 set of attributes 78*2139Sjp161948 NOTE: this is really four functions: 79*2139Sjp161948 list_start, list_next, list_end and 80*2139Sjp161948 list_endp 81*2139Sjp161948update_store - update the internal data of the store 82*2139Sjp161948lock_store - lock the store 83*2139Sjp161948unlock_store - unlock the store 84*2139Sjp161948 85*2139Sjp161948The list functions need some extra explanation: list_start is 86*2139Sjp161948used to set up a lookup. That's where the attributes to use in 87*2139Sjp161948the search are set up. It returns a search context. list_next 88*2139Sjp161948returns the next object searched for. list_end closes the search. 89*2139Sjp161948list_endp is used to check if we have reached the end. 90*2139Sjp161948 91*2139Sjp161948A few words on the store functions as well: update_store is 92*2139Sjp161948typically used by a CA application to update the internal 93*2139Sjp161948structure of a database. This may for example involve automatic 94*2139Sjp161948removal of expired certificates. lock_store and unlock_store 95*2139Sjp161948are used for locking a store to allow exclusive writes. 96