glib2 2.2.5-x86-mingw32 → 3.0.0-x86-mingw32

data/vendor/local/include/gnutls/self-test.h

@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2014 Free Software Foundation, Inc.
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GnuTLS.
+ *
+ * The GnuTLS is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+
+#ifndef __GNUTLS_SELF_H
+#define __GNUTLS_SELF_H
+
+#include <gnutls/gnutls.h>
+
+ /* Self checking functions */
+ 
+ /* The functions are not part of the main API, and are conditionally
+  * enabled. */
+
+int gnutls_cipher_self_test(unsigned all, gnutls_cipher_algorithm_t cipher);
+int gnutls_mac_self_test(unsigned all, gnutls_mac_algorithm_t mac);
+int gnutls_digest_self_test(unsigned all, gnutls_digest_algorithm_t digest);
+int gnutls_pk_self_test(unsigned all, gnutls_pk_algorithm_t pk);
+
+#endif

data/vendor/local/include/gnutls/system-keys.h

@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2014 Red Hat, Inc.
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GnuTLS.
+ *
+ * The GnuTLS is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+
+#ifndef __GNUTLS_SYSTEM_KEYS_H
+#define __GNUTLS_SYSTEM_KEYS_H
+
+#include <gnutls/gnutls.h>
+#include <gnutls/x509.h>
+
+/* This API allows to access user key and certificate pairs that are
+ * available in the current system. If any passwords are required,
+ * they will be requested through the pin callbacks.
+ */
+
+/* *INDENT-OFF* */
+#ifdef __cplusplus
+extern "C" {
+#endif
+/* *INDENT-ON* */
+
+struct system_key_iter_st;
+typedef struct system_key_iter_st *gnutls_system_key_iter_t;
+
+void gnutls_system_key_iter_deinit(gnutls_system_key_iter_t iter);
+int
+gnutls_system_key_iter_get_info(gnutls_system_key_iter_t *iter,
+			       unsigned cert_type /* gnutls_certificate_type_t */,
+			       char **cert_url,
+			       char **key_url,
+			       char **label,
+			       gnutls_datum_t *der,
+			       unsigned int flags);
+
+int gnutls_system_key_delete(const char *cert_url, const char *key_url);
+
+int gnutls_system_key_add_x509(gnutls_x509_crt_t crt, gnutls_x509_privkey_t privkey,
+				const char *label, char **cert_url, char **key_url);
+
+/* *INDENT-OFF* */
+#ifdef __cplusplus
+}
+#endif
+/* *INDENT-ON* */
+#endif

data/vendor/local/include/gnutls/urls.h

@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2014 Red Hat, Inc.
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GnuTLS.
+ *
+ * The GnuTLS is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+
+#ifndef __GNUTLS_URLS_H
+#define __GNUTLS_URLS_H
+
+#include <gnutls/gnutls.h>
+#include <gnutls/x509.h>
+#include <gnutls/abstract.h>
+
+/* This API allows to register application specific URLs for
+ * keys and certificates.
+ */
+
+/* *INDENT-OFF* */
+#ifdef __cplusplus
+extern "C" {
+#endif
+/* *INDENT-ON* */
+
+typedef int (*gnutls_privkey_import_url_func)(gnutls_privkey_t pkey,
+					       const char *url, unsigned flags);
+
+typedef int (*gnutls_x509_crt_import_url_func)(gnutls_x509_crt_t pkey,
+					        const char *url, unsigned flags);
+
+/* The following callbacks are optional */
+
+/* This is to enable gnutls_pubkey_import_url() */
+typedef int (*gnutls_pubkey_import_url_func)(gnutls_pubkey_t pkey,
+					     const char *url, unsigned flags);
+
+/* This is to allow constructing a certificate chain. It will be provided
+ * the initial certificate URL and the certificate to find its issuer, and must
+ * return zero and the DER encoding of the issuer's certificate. If not available,
+ * it should return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE. */
+typedef int (*gnutls_get_raw_issuer_func)(const char *url, gnutls_x509_crt_t crt,
+					  gnutls_datum_t *issuer_der, unsigned flags);
+
+typedef struct gnutls_custom_url_st {
+	const char *name;
+	unsigned name_size;
+	gnutls_privkey_import_url_func import_key;
+	gnutls_x509_crt_import_url_func import_crt;
+	gnutls_pubkey_import_url_func import_pubkey;
+	gnutls_get_raw_issuer_func get_issuer;
+	void *future1; /* replace in a future extension */
+	void *future2; /* replace in a future extension */
+} gnutls_custom_url_st;
+
+int gnutls_register_custom_url(const gnutls_custom_url_st *st);
+
+/* *INDENT-OFF* */
+#ifdef __cplusplus
+}
+#endif
+/* *INDENT-ON* */
+#endif

data/vendor/local/include/gnutls/x509-ext.h

@@ -0,0 +1,194 @@
+/*
+ * Copyright (C) 2014 Free Software Foundation, Inc.
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GnuTLS.
+ *
+ * The GnuTLS is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+
+/* Prototypes for direct handling of extension data */
+
+#ifndef GNUTLS_X509_EXT_H
+#define GNUTLS_X509_EXT_H
+
+#include <gnutls/gnutls.h>
+#include <gnutls/x509.h>
+
+/* *INDENT-OFF* */
+#ifdef __cplusplus
+extern "C" {
+#endif
+/* *INDENT-ON* */
+
+typedef struct gnutls_subject_alt_names_st *gnutls_subject_alt_names_t;
+
+int gnutls_subject_alt_names_init(gnutls_subject_alt_names_t *);
+void gnutls_subject_alt_names_deinit(gnutls_subject_alt_names_t sans);
+int gnutls_subject_alt_names_get(gnutls_subject_alt_names_t sans, unsigned int seq,
+				 unsigned int *san_type, gnutls_datum_t * san,
+				 gnutls_datum_t * othername_oid);
+int gnutls_subject_alt_names_set(gnutls_subject_alt_names_t sans,
+				 unsigned int san_type,
+				 const gnutls_datum_t * san,
+				 const char* othername_oid);
+
+
+int gnutls_x509_ext_import_subject_alt_names(const gnutls_datum_t * ext,
+					 gnutls_subject_alt_names_t,
+					 unsigned int flags);
+int gnutls_x509_ext_export_subject_alt_names(gnutls_subject_alt_names_t,
+					  gnutls_datum_t * ext);
+
+/* They are exactly the same */
+#define gnutls_x509_ext_import_issuer_alt_name gnutls_x509_ext_import_subject_alt_name
+#define gnutls_x509_ext_export_issuer_alt_name gnutls_x509_ext_export_subject_alt_name
+
+typedef struct gnutls_x509_crl_dist_points_st *gnutls_x509_crl_dist_points_t;
+
+int gnutls_x509_crl_dist_points_init(gnutls_x509_crl_dist_points_t *);
+void gnutls_x509_crl_dist_points_deinit(gnutls_x509_crl_dist_points_t);
+int gnutls_x509_crl_dist_points_get(gnutls_x509_crl_dist_points_t, unsigned int seq,
+				  unsigned int *type,
+				  gnutls_datum_t *dist, unsigned int *reason_flags);
+int gnutls_x509_crl_dist_points_set(gnutls_x509_crl_dist_points_t,
+				 gnutls_x509_subject_alt_name_t type,
+				 const gnutls_datum_t *dist, unsigned int reason_flags);
+
+int gnutls_x509_ext_import_crl_dist_points(const gnutls_datum_t * ext,
+					gnutls_x509_crl_dist_points_t dp,
+					unsigned int flags);
+int gnutls_x509_ext_export_crl_dist_points(gnutls_x509_crl_dist_points_t dp,
+					gnutls_datum_t * ext);
+
+int gnutls_x509_ext_import_name_constraints(const gnutls_datum_t * ext,
+					 gnutls_x509_name_constraints_t nc,
+					 unsigned int flags);
+int gnutls_x509_ext_export_name_constraints(gnutls_x509_name_constraints_t nc,
+					 gnutls_datum_t * ext);
+
+typedef struct gnutls_x509_aia_st *gnutls_x509_aia_t;
+
+int gnutls_x509_aia_init(gnutls_x509_aia_t *);
+void gnutls_x509_aia_deinit(gnutls_x509_aia_t);
+int gnutls_x509_aia_get(gnutls_x509_aia_t aia, unsigned int seq,
+			gnutls_datum_t *oid,
+			unsigned *san_type,
+			gnutls_datum_t *san);
+int gnutls_x509_aia_set(gnutls_x509_aia_t aia,
+			const char *oid,
+			unsigned san_type,
+			const gnutls_datum_t * san);
+
+int gnutls_x509_ext_import_aia(const gnutls_datum_t * ext,
+				gnutls_x509_aia_t,
+				unsigned int flags);
+int gnutls_x509_ext_export_aia(gnutls_x509_aia_t aia,
+					      gnutls_datum_t * ext);
+
+int gnutls_x509_ext_import_subject_key_id(const gnutls_datum_t * ext,
+				       gnutls_datum_t * id);
+int gnutls_x509_ext_export_subject_key_id(const gnutls_datum_t * id,
+				       gnutls_datum_t * ext);
+
+typedef struct gnutls_x509_aki_st *gnutls_x509_aki_t;
+
+int gnutls_x509_ext_export_authority_key_id(gnutls_x509_aki_t,
+					 gnutls_datum_t * ext);
+int gnutls_x509_ext_import_authority_key_id(const gnutls_datum_t * ext,
+					 gnutls_x509_aki_t,
+					 unsigned int flags);
+
+int gnutls_x509_othername_to_virtual(const char *oid, 
+				     const gnutls_datum_t *othername,
+				     unsigned int *virt_type,
+				     gnutls_datum_t *virt);
+
+int gnutls_x509_aki_init(gnutls_x509_aki_t *);
+int gnutls_x509_aki_get_id(gnutls_x509_aki_t, gnutls_datum_t *id);
+int gnutls_x509_aki_get_cert_issuer(gnutls_x509_aki_t aki, unsigned int seq,
+				 unsigned int *san_type, gnutls_datum_t * san,
+				 gnutls_datum_t *othername_oid,
+				 gnutls_datum_t *serial);
+int gnutls_x509_aki_set_id(gnutls_x509_aki_t aki, const gnutls_datum_t *id);
+int gnutls_x509_aki_set_cert_issuer(gnutls_x509_aki_t aki, 
+				 unsigned int san_type, 
+				 const gnutls_datum_t * san,
+				 const char *othername_oid,
+				 const gnutls_datum_t * serial);
+void gnutls_x509_aki_deinit(gnutls_x509_aki_t);
+
+int gnutls_x509_ext_import_private_key_usage_period(const gnutls_datum_t * ext,
+						 time_t * activation,
+						 time_t * expiration);
+int gnutls_x509_ext_export_private_key_usage_period(time_t activation,
+						 time_t expiration,
+						 gnutls_datum_t * ext);
+
+int gnutls_x509_ext_import_basic_constraints(const gnutls_datum_t * ext,
+					  unsigned int *ca, int *pathlen);
+int gnutls_x509_ext_export_basic_constraints(unsigned int ca, int pathlen,
+					  gnutls_datum_t * ext);
+
+typedef struct gnutls_x509_key_purposes_st *gnutls_x509_key_purposes_t;
+
+int gnutls_x509_key_purpose_init(gnutls_x509_key_purposes_t *p);
+void gnutls_x509_key_purpose_deinit(gnutls_x509_key_purposes_t p);
+int gnutls_x509_key_purpose_set(gnutls_x509_key_purposes_t p, const char *oid);
+int gnutls_x509_key_purpose_get(gnutls_x509_key_purposes_t p, unsigned idx, gnutls_datum_t *oid);
+
+int gnutls_x509_ext_import_key_purposes(const gnutls_datum_t * ext,
+				     gnutls_x509_key_purposes_t,
+				     unsigned int flags);
+int gnutls_x509_ext_export_key_purposes(gnutls_x509_key_purposes_t,
+				     gnutls_datum_t * ext);
+
+
+int gnutls_x509_ext_import_key_usage(const gnutls_datum_t * ext,
+				  unsigned int *key_usage);
+int gnutls_x509_ext_export_key_usage(unsigned int key_usage,
+				  gnutls_datum_t * ext);
+
+int gnutls_x509_ext_import_proxy(const gnutls_datum_t * ext, int *pathlen,
+			      char **policyLanguage, char **policy,
+			      size_t * sizeof_policy);
+int gnutls_x509_ext_export_proxy(int pathLenConstraint, const char *policyLanguage,
+			      const char *policy, size_t sizeof_policy,
+			      gnutls_datum_t * ext);
+
+typedef struct gnutls_x509_policies_st *gnutls_x509_policies_t;
+
+int gnutls_x509_policies_init(gnutls_x509_policies_t *);
+void gnutls_x509_policies_deinit(gnutls_x509_policies_t);
+
+int gnutls_x509_policies_get(gnutls_x509_policies_t policies, unsigned int seq,
+				 struct gnutls_x509_policy_st *policy);
+int gnutls_x509_policies_set(gnutls_x509_policies_t policies,
+				 const struct gnutls_x509_policy_st *policy);
+
+int gnutls_x509_ext_import_policies(const gnutls_datum_t * ext, gnutls_x509_policies_t
+				 policies,
+				 unsigned int flags);
+int gnutls_x509_ext_export_policies(gnutls_x509_policies_t policies,
+				 gnutls_datum_t * ext);
+
+
+/* *INDENT-OFF* */
+#ifdef __cplusplus
+}
+#endif
+/* *INDENT-ON* */
+#endif				/* GNUTLS_X509_H */

data/vendor/local/include/gnutls/x509.h

@@ -87,6 +87,20 @@ extern "C" {
 #define GNUTLS_FSAN_SET 0
 #define GNUTLS_FSAN_APPEND 1
 
+#define GNUTLS_X509EXT_OID_SUBJECT_KEY_ID "2.5.29.14"
+#define GNUTLS_X509EXT_OID_KEY_USAGE "2.5.29.15"
+#define GNUTLS_X509EXT_OID_PRIVATE_KEY_USAGE_PERIOD "2.5.29.16"
+#define GNUTLS_X509EXT_OID_SAN "2.5.29.17"
+#define GNUTLS_X509EXT_OID_IAN "2.5.29.18"
+#define GNUTLS_X509EXT_OID_BASIC_CONSTRAINTS "2.5.29.19"
+#define GNUTLS_X509EXT_OID_NAME_CONSTRAINTS "2.5.29.30"
+#define GNUTLS_X509EXT_OID_CRL_DIST_POINTS "2.5.29.31"
+#define GNUTLS_X509EXT_OID_CRT_POLICY "2.5.29.32"
+#define GNUTLS_X509EXT_OID_AUTHORITY_KEY_ID "2.5.29.35"
+#define GNUTLS_X509EXT_OID_EXTENDED_KEY_USAGE "2.5.29.37"
+#define GNUTLS_X509EXT_OID_AUTHORITY_INFO_ACCESS "1.3.6.1.5.5.7.1.1"
+#define GNUTLS_X509EXT_OID_PROXY_CRT_INFO "1.3.6.1.5.5.7.1.14"
+
 /* Certificate handling functions.
  */
 
@@ -98,12 +112,14 @@ extern "C" {
  * @GNUTLS_X509_CRT_LIST_FAIL_IF_UNSORTED: Fail if the certificates
  *   in the buffer are not ordered starting from subject to issuer.
  *   The error code will be %GNUTLS_E_CERTIFICATE_LIST_UNSORTED.
+ * @GNUTLS_X509_CRT_LIST_SORT: Sort the certificate chain if unsorted.
  *
  * Enumeration of different certificate import flags.
  */
 typedef enum gnutls_certificate_import_flags {
 	GNUTLS_X509_CRT_LIST_IMPORT_FAIL_IF_EXCEED = 1,
-	GNUTLS_X509_CRT_LIST_FAIL_IF_UNSORTED = 2
+	GNUTLS_X509_CRT_LIST_FAIL_IF_UNSORTED = 1<<1,
+	GNUTLS_X509_CRT_LIST_SORT = 1<<2
 } gnutls_certificate_import_flags;
 
 int gnutls_x509_crt_init(gnutls_x509_crt_t * cert);
@@ -121,6 +137,12 @@ int gnutls_x509_crt_list_import(gnutls_x509_crt_t * certs,
 				const gnutls_datum_t * data,
 				gnutls_x509_crt_fmt_t format,
 				unsigned int flags);
+
+int gnutls_x509_crt_import_url(gnutls_x509_crt_t crt,
+				      const char *url, unsigned int flags
+				      /* GNUTLS_PKCS11_OBJ_FLAG_* */
+    );
+
 int gnutls_x509_crt_export(gnutls_x509_crt_t cert,
 			   gnutls_x509_crt_fmt_t format,
 			   void *output_data, size_t * output_data_size);
@@ -157,11 +179,32 @@ int gnutls_x509_crt_get_dn_by_oid(gnutls_x509_crt_t cert,
 				  size_t * buf_size);
 int gnutls_x509_crt_check_hostname(gnutls_x509_crt_t cert,
 				   const char *hostname);
+int gnutls_x509_crt_check_hostname2(gnutls_x509_crt_t cert,
+	 			    const char *hostname, unsigned int flags);
+int
+gnutls_x509_crt_check_email(gnutls_x509_crt_t cert,
+			    const char *email, unsigned int flags);
 
 int gnutls_x509_crt_get_signature_algorithm(gnutls_x509_crt_t cert);
 int gnutls_x509_crt_get_signature(gnutls_x509_crt_t cert,
 				  char *sig, size_t * sizeof_sig);
 int gnutls_x509_crt_get_version(gnutls_x509_crt_t cert);
+
+
+/**
+ * gnutls_keyid_flags_t:
+ * @GNUTLS_KEYID_USE_SHA1: Use SHA1 as the key ID algorithm (default).
+ * @GNUTLS_KEYID_USE_SHA256: Use SHA256 as the key ID algorithm.
+ * @GNUTLS_KEYID_USE_BEST_KNOWN: Use the best known algorithm to calculate key ID. Using that option will make your program behavior depend on the version of gnutls linked with. That option has a cap of 64-bytes key IDs.
+ *
+ * Enumeration of different flags for the key ID functions.
+ 
+ */
+typedef enum {
+	GNUTLS_KEYID_USE_SHA1 = 0,
+	GNUTLS_KEYID_USE_SHA256 = (1<<0),
+	GNUTLS_KEYID_USE_BEST_KNOWN = (1<<30)
+} gnutls_keyid_flags_t;
 int gnutls_x509_crt_get_key_id(gnutls_x509_crt_t crt,
 			       unsigned int flags,
 			       unsigned char *output_data,
@@ -221,6 +264,7 @@ typedef enum gnutls_info_access_what_t {
 	/* use 100-108 for the generalName types, populate as needed */
 	GNUTLS_IA_URI = 106,
 	/* quick-access variants that match both OID and name type. */
+	GNUTLS_IA_UNKNOWN = 10000,
 	GNUTLS_IA_OCSP_URI = 10006,
 	GNUTLS_IA_CAISSUERS_URI = 10106
 } gnutls_info_access_what_t;
@@ -233,6 +277,40 @@ int gnutls_x509_crt_get_authority_info_access(gnutls_x509_crt_t
 					      data, unsigned int
 					      *critical);
 
+typedef struct gnutls_name_constraints_st *gnutls_x509_name_constraints_t;
+
+unsigned gnutls_x509_name_constraints_check(gnutls_x509_name_constraints_t nc,
+				       gnutls_x509_subject_alt_name_t type,
+				       const gnutls_datum_t * name);
+unsigned gnutls_x509_name_constraints_check_crt(gnutls_x509_name_constraints_t nc,
+				       gnutls_x509_subject_alt_name_t type,
+				       gnutls_x509_crt_t crt);
+
+int gnutls_x509_name_constraints_init(gnutls_x509_name_constraints_t *nc);
+void gnutls_x509_name_constraints_deinit(gnutls_x509_name_constraints_t nc);
+
+#define GNUTLS_NAME_CONSTRAINTS_FLAG_APPEND 1
+int gnutls_x509_crt_get_name_constraints(gnutls_x509_crt_t crt,
+					 gnutls_x509_name_constraints_t nc,
+					 unsigned int flags,
+					 unsigned int *critical);
+int gnutls_x509_name_constraints_add_permitted(gnutls_x509_name_constraints_t nc,
+					       gnutls_x509_subject_alt_name_t type,
+					       const gnutls_datum_t * name);
+int gnutls_x509_name_constraints_add_excluded(gnutls_x509_name_constraints_t nc,
+					      gnutls_x509_subject_alt_name_t type,
+					      const gnutls_datum_t * name);
+int gnutls_x509_crt_set_name_constraints(gnutls_x509_crt_t crt, 
+					 gnutls_x509_name_constraints_t nc,
+					 unsigned int critical);
+int gnutls_x509_name_constraints_get_permitted(gnutls_x509_name_constraints_t nc,
+				     unsigned idx,
+				     unsigned *type, gnutls_datum_t * name);
+int gnutls_x509_name_constraints_get_excluded(gnutls_x509_name_constraints_t nc,
+				     unsigned idx,
+				     unsigned *type, gnutls_datum_t * name);
+
+
 #define GNUTLS_CRL_REASON_SUPERSEEDED GNUTLS_CRL_REASON_SUPERSEDED,
   /**
    * gnutls_x509_crl_reason_flags_t:
@@ -302,6 +380,10 @@ int gnutls_x509_crt_get_pk_dsa_raw(gnutls_x509_crt_t crt,
 				   gnutls_datum_t * p,
 				   gnutls_datum_t * q,
 				   gnutls_datum_t * g, gnutls_datum_t * y);
+int gnutls_x509_crt_get_pk_ecc_raw(gnutls_x509_crt_t crt,
+				   gnutls_ecc_curve_t * curve,
+				   gnutls_datum_t * x,
+				   gnutls_datum_t * y);
 
 int gnutls_x509_crt_get_subject_alt_name(gnutls_x509_crt_t cert,
 					 unsigned int seq,
@@ -392,7 +474,7 @@ void gnutls_x509_policy_release(struct gnutls_x509_policy_st
 				*policy);
 int gnutls_x509_crt_get_policy(gnutls_x509_crt_t crt, int indx, struct gnutls_x509_policy_st
 			       *policy, unsigned int *critical);
-int gnutls_x509_crt_set_policy(gnutls_x509_crt_t crt, struct gnutls_x509_policy_st
+int gnutls_x509_crt_set_policy(gnutls_x509_crt_t crt, const struct gnutls_x509_policy_st
 			       *policy, unsigned int critical);
 
 int gnutls_x509_dn_oid_known(const char *oid);
@@ -410,6 +492,13 @@ int gnutls_x509_crt_get_extension_by_oid(gnutls_x509_crt_t cert,
 					 size_t * buf_size,
 					 unsigned int *critical);
 
+int gnutls_x509_crq_get_signature_algorithm(gnutls_x509_crq_t crq);
+int
+gnutls_x509_crq_get_extension_by_oid2(gnutls_x509_crq_t crq,
+				     const char *oid, int indx,
+				     gnutls_datum_t *output,
+				     unsigned int *critical);
+
 	/* Read extensions by sequence number. */
 int gnutls_x509_crt_get_extension_info(gnutls_x509_crt_t cert,
 				       int indx, void *oid,
@@ -418,6 +507,10 @@ int gnutls_x509_crt_get_extension_info(gnutls_x509_crt_t cert,
 int gnutls_x509_crt_get_extension_data(gnutls_x509_crt_t cert,
 				       int indx, void *data,
 				       size_t * sizeof_data);
+int
+gnutls_x509_crt_get_extension_data2(gnutls_x509_crt_t cert,
+			       unsigned indx, gnutls_datum_t * data);
+
 
 int gnutls_x509_crt_set_extension_by_oid(gnutls_x509_crt_t crt,
 					 const char *oid,
@@ -461,6 +554,13 @@ int gnutls_x509_crt_set_subject_alt_name(gnutls_x509_crt_t crt,
 					 type, const void *data,
 					 unsigned int data_size,
 					 unsigned int flags);
+
+int gnutls_x509_crt_set_issuer_alt_name(gnutls_x509_crt_t crt,
+					 gnutls_x509_subject_alt_name_t
+					 type, const void *data,
+					 unsigned int data_size,
+					 unsigned int flags);
+
 int gnutls_x509_crt_sign(gnutls_x509_crt_t crt,
 			 gnutls_x509_crt_t issuer,
 			 gnutls_x509_privkey_t issuer_key);
@@ -515,7 +615,7 @@ int gnutls_x509_rdn_get_by_oid(const gnutls_datum_t * idn,
 			       unsigned int raw_flag, void *buf,
 			       size_t * sizeof_buf);
 
-typedef void *gnutls_x509_dn_t;
+typedef struct gnutls_x509_dn_st *gnutls_x509_dn_t;
 
 typedef struct gnutls_x509_ava_st {
 	gnutls_datum_t oid;
@@ -530,6 +630,8 @@ int gnutls_x509_crt_get_issuer(gnutls_x509_crt_t cert,
 int gnutls_x509_dn_get_rdn_ava(gnutls_x509_dn_t dn, int irdn,
 			       int iava, gnutls_x509_ava_st * ava);
 
+int gnutls_x509_dn_get_str(gnutls_x509_dn_t dn, gnutls_datum_t *str);
+
 int gnutls_x509_dn_init(gnutls_x509_dn_t * dn);
 
 int gnutls_x509_dn_import(gnutls_x509_dn_t dn,
@@ -587,6 +689,16 @@ int gnutls_x509_crl_get_crt_count(gnutls_x509_crl_t crl);
 int gnutls_x509_crl_get_crt_serial(gnutls_x509_crl_t crl, int indx,
 				   unsigned char *serial,
 				   size_t * serial_size, time_t * t);
+
+typedef struct gnutls_x509_crl_iter * gnutls_x509_crl_iter_t;
+
+int gnutls_x509_crl_iter_crt_serial(gnutls_x509_crl_t crl,
+				    gnutls_x509_crl_iter_t *,
+				    unsigned char *serial,
+				    size_t * serial_size, time_t * t);
+
+void gnutls_x509_crl_iter_deinit(gnutls_x509_crl_iter_t);
+
 #define gnutls_x509_crl_get_certificate_count gnutls_x509_crl_get_crt_count
 #define gnutls_x509_crl_get_certificate gnutls_x509_crl_get_crt_serial
 
@@ -650,6 +762,9 @@ int gnutls_x509_crl_get_extension_info(gnutls_x509_crl_t crl,
 int gnutls_x509_crl_get_extension_data(gnutls_x509_crl_t crl,
 				       int indx, void *data,
 				       size_t * sizeof_data);
+int
+gnutls_x509_crl_get_extension_data2(gnutls_x509_crl_t crl,
+			       unsigned indx, gnutls_datum_t * data);
 
 int gnutls_x509_crl_set_authority_key_id(gnutls_x509_crl_t crl,
 					 const void *id, size_t id_size);
@@ -658,41 +773,6 @@ int gnutls_x509_crl_set_number(gnutls_x509_crl_t crl,
 			       const void *nr, size_t nr_size);
 
 
-/* PKCS7 structures handling
- */
-struct gnutls_pkcs7_int;
-typedef struct gnutls_pkcs7_int *gnutls_pkcs7_t;
-
-int gnutls_pkcs7_init(gnutls_pkcs7_t * pkcs7);
-void gnutls_pkcs7_deinit(gnutls_pkcs7_t pkcs7);
-int gnutls_pkcs7_import(gnutls_pkcs7_t pkcs7,
-			const gnutls_datum_t * data,
-			gnutls_x509_crt_fmt_t format);
-int gnutls_pkcs7_export(gnutls_pkcs7_t pkcs7,
-			gnutls_x509_crt_fmt_t format,
-			void *output_data, size_t * output_data_size);
-int gnutls_pkcs7_export2(gnutls_pkcs7_t pkcs7,
-			 gnutls_x509_crt_fmt_t format,
-			 gnutls_datum_t * out);
-
-int gnutls_pkcs7_get_crt_count(gnutls_pkcs7_t pkcs7);
-int gnutls_pkcs7_get_crt_raw(gnutls_pkcs7_t pkcs7, int indx,
-			     void *certificate, size_t * certificate_size);
-
-int gnutls_pkcs7_set_crt_raw(gnutls_pkcs7_t pkcs7,
-			     const gnutls_datum_t * crt);
-int gnutls_pkcs7_set_crt(gnutls_pkcs7_t pkcs7, gnutls_x509_crt_t crt);
-int gnutls_pkcs7_delete_crt(gnutls_pkcs7_t pkcs7, int indx);
-
-int gnutls_pkcs7_get_crl_raw(gnutls_pkcs7_t pkcs7,
-			     int indx, void *crl, size_t * crl_size);
-int gnutls_pkcs7_get_crl_count(gnutls_pkcs7_t pkcs7);
-
-int gnutls_pkcs7_set_crl_raw(gnutls_pkcs7_t pkcs7,
-			     const gnutls_datum_t * crl);
-int gnutls_pkcs7_set_crl(gnutls_pkcs7_t pkcs7, gnutls_x509_crl_t crl);
-int gnutls_pkcs7_delete_crl(gnutls_pkcs7_t pkcs7, int indx);
-
 /* X.509 Certificate verification functions.
  */
 
@@ -703,10 +783,6 @@ int gnutls_pkcs7_delete_crl(gnutls_pkcs7_t pkcs7, int indx);
  *   unless you know what this means.
  * @GNUTLS_VERIFY_DISABLE_TRUSTED_TIME_CHECKS: If set a signer in the trusted
  *   list is never checked for expiration or activation.
- * @GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT: Allow trusted CA certificates
- *   with version 1. This is safer than %GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT,
- *   and should be used instead. That way only signers in your trusted list
- *   will be allowed to have certificates of version 1. This is the default.
  * @GNUTLS_VERIFY_DO_NOT_ALLOW_X509_V1_CA_CRT: Do not allow trusted CA
  *   certificates that have version 1.  This option is to be used
  *   to deprecate all certificates of version 1.
@@ -721,23 +797,29 @@ int gnutls_pkcs7_delete_crl(gnutls_pkcs7_t pkcs7, int indx);
  * @GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT: Allow CA certificates that
  *   have version 1 (both root and intermediate). This might be
  *   dangerous since those haven't the basicConstraints
- *   extension. Must be used in combination with
- *   %GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT.
+ *   extension. 
  * @GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD2: Allow certificates to be signed
  *   using the broken MD2 algorithm.
  * @GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD5: Allow certificates to be signed
  *   using the broken MD5 algorithm.
+ * @GNUTLS_VERIFY_ALLOW_BROKEN: Allow certificates to be signed
+ *   using any broken algorithm.
  * @GNUTLS_VERIFY_DISABLE_TIME_CHECKS: Disable checking of activation
  *   and expiration validity periods of certificate chains. Don't set
  *   this unless you understand the security implications.
  * @GNUTLS_VERIFY_DISABLE_CRL_CHECKS: Disable checking for validity
  *   using certificate revocation lists or the available OCSP data.
+ * @GNUTLS_VERIFY_DO_NOT_ALLOW_WILDCARDS: When including a hostname
+ *   check in the verification, do not consider any wildcards.
+ * @GNUTLS_VERIFY_USE_TLS1_RSA: This indicates that a (raw) RSA signature is provided
+ *   as in the TLS 1.0 protocol. Not all functions accept this flag.
  *
- * Enumeration of different certificate verify flags.
+ * Enumeration of different certificate verify flags. Additional
+ * verification profiles can be set using GNUTLS_PROFILE_TO_VFLAGS()
+ * and %gnutls_certificate_verification_profiles_t.
  */
 typedef enum gnutls_certificate_verify_flags {
 	GNUTLS_VERIFY_DISABLE_CA_SIGN = 1 << 0,
-	GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT = 1 << 1,
 	GNUTLS_VERIFY_DO_NOT_ALLOW_SAME = 1 << 2,
 	GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT = 1 << 3,
 	GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD2 = 1 << 4,
@@ -748,8 +830,56 @@ typedef enum gnutls_certificate_verify_flags {
 	GNUTLS_VERIFY_DISABLE_CRL_CHECKS = 1 << 9,
 	GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN = 1 << 10,
 	GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN = 1 << 11,
+	GNUTLS_VERIFY_DO_NOT_ALLOW_WILDCARDS = 1 << 12,
+	GNUTLS_VERIFY_USE_TLS1_RSA = 1 << 13
+	/* cannot exceed 2^24 due to GNUTLS_PROFILE_TO_VFLAGS() */
 } gnutls_certificate_verify_flags;
 
+#define GNUTLS_VERIFY_ALLOW_BROKEN (GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD2|GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD5)
+
+/**
+ * gnutls_certificate_verification_profiles_t:
+ * @GNUTLS_PROFILE_VERY_WEAK: A verification profile that
+ *  corresponds to @GNUTLS_SEC_PARAM_VERY_WEAK (64 bits)
+ * @GNUTLS_PROFILE_LOW: A verification profile that
+ *  corresponds to @GNUTLS_SEC_PARAM_LOW (80 bits)
+ * @GNUTLS_PROFILE_LEGACY: A verification profile that
+ *  corresponds to @GNUTLS_SEC_PARAM_LEGACY (96 bits)
+ * @GNUTLS_PROFILE_MEDIUM: A verification profile that
+ *  corresponds to @GNUTLS_SEC_PARAM_MEDIUM (112 bits)
+ * @GNUTLS_PROFILE_HIGH: A verification profile that
+ *  corresponds to @GNUTLS_SEC_PARAM_HIGH (128 bits)
+ * @GNUTLS_PROFILE_ULTRA: A verification profile that
+ *  corresponds to @GNUTLS_SEC_PARAM_ULTRA (256 bits)
+% * @GNUTLS_PROFILE_SUITEB128: A verification profile that
+ *  applies the SUITEB128 rules
+ * @GNUTLS_PROFILE_SUITEB192: A verification profile that
+ *  applies the SUITEB192 rules
+ *
+ * Enumeration of different certificate verification profiles.
+ */
+typedef enum gnutls_certificate_verification_profiles_t {
+	GNUTLS_PROFILE_VERY_WEAK = 1,
+	GNUTLS_PROFILE_LOW = 2,
+	GNUTLS_PROFILE_LEGACY = 4,
+	GNUTLS_PROFILE_MEDIUM = 5,
+	GNUTLS_PROFILE_HIGH = 6,
+	GNUTLS_PROFILE_ULTRA = 7,
+	
+	GNUTLS_PROFILE_SUITEB128=32,
+	GNUTLS_PROFILE_SUITEB192=33
+	/*GNUTLS_PROFILE_MAX=255*/
+} gnutls_certificate_verification_profiles_t;
+
+#define GNUTLS_PROFILE_TO_VFLAGS(x) \
+	(((unsigned)x)<<24)
+
+#define GNUTLS_VFLAGS_PROFILE_MASK (0xff000000)
+
+#define GNUTLS_VFLAGS_TO_PROFILE(x) \
+	((((unsigned)x)>>24)&0xff)
+
+
 int gnutls_x509_crt_check_issuer(gnutls_x509_crt_t cert,
 				 gnutls_x509_crt_t issuer);
 
@@ -770,6 +900,13 @@ int gnutls_x509_crl_verify(gnutls_x509_crl_t crl,
 			   int CA_list_length, unsigned int flags,
 			   unsigned int *verify);
 
+int
+gnutls_x509_crt_verify_data2(gnutls_x509_crt_t crt,
+			   gnutls_sign_algorithm_t algo,
+			   unsigned int flags,
+			   const gnutls_datum_t * data,
+			   const gnutls_datum_t * signature);
+
 int gnutls_x509_crt_check_revocation(gnutls_x509_crt_t cert,
 				     const gnutls_x509_crl_t *
 				     crl_list, int crl_list_length);
@@ -793,40 +930,58 @@ int gnutls_x509_crt_set_key_purpose_oid(gnutls_x509_crt_t cert,
  */
 
 #define GNUTLS_PKCS8_PLAIN GNUTLS_PKCS_PLAIN
-#define GNUTLS_PKCS8_USE_PKCS12_3DES GNUTLS_PKCS_USE_PKCS12_3DES
-#define GNUTLS_PKCS8_USE_PKCS12_ARCFOUR GNUTLS_PKCS_USE_PKCS12_ARCFOUR
-#define GNUTLS_PKCS8_USE_PKCS12_RC2_40 GNUTLS_PKCS_USE_PKCS12_RC2_40
+#define GNUTLS_PKCS8_USE_PKCS12_3DES GNUTLS_PKCS_PKCS12_3DES
+#define GNUTLS_PKCS8_USE_PKCS12_ARCFOUR GNUTLS_PKCS_PKCS12_ARCFOUR
+#define GNUTLS_PKCS8_USE_PKCS12_RC2_40 GNUTLS_PKCS_PKCS12_RC2_40
 
 /**
  * gnutls_pkcs_encrypt_flags_t:
  * @GNUTLS_PKCS_PLAIN: Unencrypted private key.
  * @GNUTLS_PKCS_NULL_PASSWORD: Some schemas distinguish between an empty and a NULL password.
- * @GNUTLS_PKCS_USE_PKCS12_3DES: PKCS-12 3DES.
- * @GNUTLS_PKCS_USE_PKCS12_ARCFOUR: PKCS-12 ARCFOUR.
- * @GNUTLS_PKCS_USE_PKCS12_RC2_40: PKCS-12 RC2-40.
- * @GNUTLS_PKCS_USE_PBES2_3DES: PBES2 3DES.
- * @GNUTLS_PKCS_USE_PBES2_AES_128: PBES2 AES-128.
- * @GNUTLS_PKCS_USE_PBES2_AES_192: PBES2 AES-192.
- * @GNUTLS_PKCS_USE_PBES2_AES_256: PBES2 AES-256.
+ * @GNUTLS_PKCS_PKCS12_3DES: PKCS-12 3DES.
+ * @GNUTLS_PKCS_PKCS12_ARCFOUR: PKCS-12 ARCFOUR.
+ * @GNUTLS_PKCS_PKCS12_RC2_40: PKCS-12 RC2-40.
+ * @GNUTLS_PKCS_PBES2_3DES: PBES2 3DES.
+ * @GNUTLS_PKCS_PBES2_AES_128: PBES2 AES-128.
+ * @GNUTLS_PKCS_PBES2_AES_192: PBES2 AES-192.
+ * @GNUTLS_PKCS_PBES2_AES_256: PBES2 AES-256.
+ * @GNUTLS_PKCS_PBES2_DES: PBES2 single DES.
  *
  * Enumeration of different PKCS encryption flags.
  */
 typedef enum gnutls_pkcs_encrypt_flags_t {
 	GNUTLS_PKCS_PLAIN = 1,
-	GNUTLS_PKCS_USE_PKCS12_3DES = 2,
-	GNUTLS_PKCS_USE_PKCS12_ARCFOUR = 4,
-	GNUTLS_PKCS_USE_PKCS12_RC2_40 = 8,
-	GNUTLS_PKCS_USE_PBES2_3DES = 16,
-	GNUTLS_PKCS_USE_PBES2_AES_128 = 32,
-	GNUTLS_PKCS_USE_PBES2_AES_192 = 64,
-	GNUTLS_PKCS_USE_PBES2_AES_256 = 128,
-	GNUTLS_PKCS_NULL_PASSWORD = 256
+	GNUTLS_PKCS_PKCS12_3DES = 1<<1,
+	GNUTLS_PKCS_PKCS12_ARCFOUR = 1<<2,
+	GNUTLS_PKCS_PKCS12_RC2_40 = 1<<3,
+	GNUTLS_PKCS_PBES2_3DES = 1<<4,
+	GNUTLS_PKCS_PBES2_AES_128 = 1<<5,
+	GNUTLS_PKCS_PBES2_AES_192 = 1<<6,
+	GNUTLS_PKCS_PBES2_AES_256 = 1<<7,
+	GNUTLS_PKCS_NULL_PASSWORD = 1<<8,
+	GNUTLS_PKCS_PBES2_DES = 1<<9
 } gnutls_pkcs_encrypt_flags_t;
 
+#define GNUTLS_PKCS_USE_PKCS12_3DES GNUTLS_PKCS_PKCS12_3DES
+#define GNUTLS_PKCS_USE_PKCS12_ARCFOUR GNUTLS_PKCS_PKCS12_ARCFOUR
+#define GNUTLS_PKCS_USE_PKCS12_RC2_40 GNUTLS_PKCS_PKCS12_RC2_40
+#define GNUTLS_PKCS_USE_PBES2_3DES GNUTLS_PKCS_PBES2_3DES
+#define GNUTLS_PKCS_USE_PBES2_AES_128 GNUTLS_PKCS_PBES2_AES_128
+#define GNUTLS_PKCS_USE_PBES2_AES_192 GNUTLS_PKCS_PBES2_AES_192
+#define GNUTLS_PKCS_USE_PBES2_AES_256 GNUTLS_PKCS_PBES2_AES_256
+
+const char *gnutls_pkcs_schema_get_name(unsigned int schema);
+const char *gnutls_pkcs_schema_get_oid(unsigned int schema);
+
 int gnutls_x509_privkey_init(gnutls_x509_privkey_t * key);
 void gnutls_x509_privkey_deinit(gnutls_x509_privkey_t key);
 gnutls_sec_param_t
 gnutls_x509_privkey_sec_param(gnutls_x509_privkey_t key);
+
+void gnutls_x509_privkey_set_pin_function(gnutls_x509_privkey_t key,
+				      gnutls_pin_callback_t fn,
+				      void *userdata);
+
 int gnutls_x509_privkey_cpy(gnutls_x509_privkey_t dst,
 			    gnutls_x509_privkey_t src);
 int gnutls_x509_privkey_import(gnutls_x509_privkey_t key,
@@ -841,6 +996,12 @@ int gnutls_x509_privkey_import_openssl(gnutls_x509_privkey_t key,
 				       const gnutls_datum_t * data,
 				       const char *password);
 
+int
+gnutls_pkcs8_info(const gnutls_datum_t * data, gnutls_x509_crt_fmt_t format,
+		  unsigned int *schema, unsigned int *cipher,
+		  void *salt, unsigned int *salt_size,
+		  unsigned int *iter_count, char **oid);
+
 int gnutls_x509_privkey_import2(gnutls_x509_privkey_t key,
 				const gnutls_datum_t * data,
 				gnutls_x509_crt_fmt_t format,
@@ -935,6 +1096,14 @@ int gnutls_x509_privkey_export_ecc_raw(gnutls_x509_privkey_t key,
 				       gnutls_datum_t * x,
 				       gnutls_datum_t * y,
 				       gnutls_datum_t * k);
+
+int gnutls_x509_privkey_sign_data(gnutls_x509_privkey_t key,
+				  gnutls_digest_algorithm_t digest,
+				  unsigned int flags,
+				  const gnutls_datum_t * data,
+				  void *signature,
+				  size_t * signature_size);
+
 /* Certificate request stuff.
  */
 
@@ -1038,6 +1207,10 @@ int gnutls_x509_crq_get_key_purpose_oid(gnutls_x509_crq_t crq,
 int gnutls_x509_crq_get_extension_data(gnutls_x509_crq_t crq,
 				       int indx, void *data,
 				       size_t * sizeof_data);
+int
+gnutls_x509_crq_get_extension_data2(gnutls_x509_crq_t crq,
+			       unsigned indx,
+			       gnutls_datum_t * data);
 int gnutls_x509_crq_get_extension_info(gnutls_x509_crq_t crq,
 				       int indx, void *oid,
 				       size_t * sizeof_oid,
@@ -1082,8 +1255,14 @@ int gnutls_x509_crq_get_extension_by_oid(gnutls_x509_crq_t crq,
 					 void *buf,
 					 size_t * sizeof_buf,
 					 unsigned int *critical);
+int
+gnutls_x509_crt_get_extension_by_oid2(gnutls_x509_crt_t cert,
+				     const char *oid, int indx,
+				     gnutls_datum_t *output,
+				     unsigned int *critical);
 
 typedef struct gnutls_x509_trust_list_st *gnutls_x509_trust_list_t;
+typedef struct gnutls_x509_trust_list_iter *gnutls_x509_trust_list_iter_t;
 
 int
 gnutls_x509_trust_list_init(gnutls_x509_trust_list_t * list,
@@ -1098,10 +1277,26 @@ int gnutls_x509_trust_list_get_issuer(gnutls_x509_trust_list_t
 				      gnutls_x509_crt_t * issuer,
 				      unsigned int flags);
 
+int gnutls_x509_trust_list_get_issuer_by_dn(gnutls_x509_trust_list_t list,
+				      const gnutls_datum_t *dn,
+				      gnutls_x509_crt_t *issuer,
+				      unsigned int flags);
+
+int gnutls_x509_trust_list_get_issuer_by_subject_key_id(gnutls_x509_trust_list_t list,
+				      const gnutls_datum_t *dn,
+				      const gnutls_datum_t *spki,
+				      gnutls_x509_crt_t *issuer,
+				      unsigned int flags);
+
+#define GNUTLS_TL_VERIFY_CRL 1
+#define GNUTLS_TL_USE_IN_TLS (1<<1)
+#define GNUTLS_TL_NO_DUPLICATES (1<<2)
+#define GNUTLS_TL_NO_DUPLICATE_KEY (1<<3)
+#define GNUTLS_TL_GET_COPY (1<<4)
 int
 gnutls_x509_trust_list_add_cas(gnutls_x509_trust_list_t list,
 			       const gnutls_x509_crt_t * clist,
-			       int clist_size, unsigned int flags);
+			       unsigned clist_size, unsigned int flags);
 int gnutls_x509_trust_list_remove_cas(gnutls_x509_trust_list_t
 				      list,
 				      const gnutls_x509_crt_t *
@@ -1114,7 +1309,6 @@ int gnutls_x509_trust_list_add_named_crt(gnutls_x509_trust_list_t
 					 size_t name_size,
 					 unsigned int flags);
 
-#define GNUTLS_TL_VERIFY_CRL 1
 int
 gnutls_x509_trust_list_add_crls(gnutls_x509_trust_list_t list,
 				const gnutls_x509_crl_t *
@@ -1122,6 +1316,14 @@ gnutls_x509_trust_list_add_crls(gnutls_x509_trust_list_t list,
 				unsigned int flags,
 				unsigned int verification_flags);
 
+
+int
+gnutls_x509_trust_list_iter_get_ca(gnutls_x509_trust_list_t list,
+                                   gnutls_x509_trust_list_iter_t *iter,
+                                   gnutls_x509_crt_t *crt);
+
+void gnutls_x509_trust_list_iter_deinit(gnutls_x509_trust_list_iter_t iter);
+
 typedef int gnutls_verify_output_function(gnutls_x509_crt_t cert, gnutls_x509_crt_t issuer,	/* The issuer if verification failed 
 												 * because of him. might be null.
 												 */
@@ -1136,6 +1338,16 @@ int gnutls_x509_trust_list_verify_named_crt
      const void *name, size_t name_size, unsigned int flags,
      unsigned int *verify, gnutls_verify_output_function func);
 
+int
+gnutls_x509_trust_list_verify_crt2(gnutls_x509_trust_list_t list,
+				  gnutls_x509_crt_t * cert_list,
+				  unsigned int cert_list_size,
+				  gnutls_typed_vdata_st * data,
+				  unsigned int elements,
+				  unsigned int flags,
+				  unsigned int *voutput,
+				  gnutls_verify_output_function func);
+
 int
 gnutls_x509_trust_list_verify_crt(gnutls_x509_trust_list_t list,
 				  gnutls_x509_crt_t * cert_list,
@@ -1162,6 +1374,14 @@ gnutls_x509_trust_list_add_trust_file(gnutls_x509_trust_list_t
 				      unsigned int tl_flags,
 				      unsigned int tl_vflags);
 
+int
+gnutls_x509_trust_list_add_trust_dir(gnutls_x509_trust_list_t list,
+				      const char *ca_dir,
+				      const char *crl_dir,
+				      gnutls_x509_crt_fmt_t type,
+				      unsigned int tl_flags,
+				      unsigned int tl_vflags);
+
 int
 gnutls_x509_trust_list_remove_trust_file(gnutls_x509_trust_list_t
 					 list,
@@ -1183,6 +1403,24 @@ gnutls_x509_trust_list_add_system_trust(gnutls_x509_trust_list_t
 void gnutls_certificate_set_trust_list
     (gnutls_certificate_credentials_t res,
      gnutls_x509_trust_list_t tlist, unsigned flags);
+void gnutls_certificate_get_trust_list
+    (gnutls_certificate_credentials_t res,
+     gnutls_x509_trust_list_t *tlist);
+
+typedef struct gnutls_x509_ext_st {
+	char *oid;
+	unsigned int critical;
+	gnutls_datum_t data;
+} gnutls_x509_ext_st;
+
+void gnutls_x509_ext_deinit(gnutls_x509_ext_st *ext);
+
+int
+gnutls_x509_ext_print(gnutls_x509_ext_st *exts, unsigned int exts_size,
+		      gnutls_certificate_print_formats_t format,
+		      gnutls_datum_t * out);
+
+#include <gnutls/pkcs7.h>
 
 /* *INDENT-OFF* */
 #ifdef __cplusplus