Const-correct and document trust/reject object APIs

This'll probably need another pass once we figure out what to do with
X509_TRUST, but put it with the other aux functions.

Bug: 426
Change-Id: I6ae2e45b94bace40307dd4dcc1c8702fc8baa8eb
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/63925
Reviewed-by: Bob Beck <bbe@google.com>
Auto-Submit: David Benjamin <davidben@google.com>
Commit-Queue: Bob Beck <bbe@google.com>

crypto/x509/x_x509a.c

diff --git a/crypto/x509/x_x509a.c b/crypto/x509/x_x509a.c
index 4b34caa..da5da09 100644
--- a/crypto/x509/x_x509a.c
+++ b/crypto/x509/x_x509a.c
@@ -150,7 +150,7 @@
   return keyid != NULL ? keyid->data : NULL;
 }
 
-int X509_add1_trust_object(X509 *x, ASN1_OBJECT *obj) {
+int X509_add1_trust_object(X509 *x, const ASN1_OBJECT *obj) {
   ASN1_OBJECT *objtmp = OBJ_dup(obj);
   if (objtmp == NULL) {
     goto err;
@@ -172,7 +172,7 @@
   return 0;
 }
 
-int X509_add1_reject_object(X509 *x, ASN1_OBJECT *obj) {
+int X509_add1_reject_object(X509 *x, const ASN1_OBJECT *obj) {
   ASN1_OBJECT *objtmp = OBJ_dup(obj);
   if (objtmp == NULL) {
     goto err;

include/openssl/x509.h

diff --git a/include/openssl/x509.h b/include/openssl/x509.h
index 8a1e293..9e9adbd 100644
--- a/include/openssl/x509.h
+++ b/include/openssl/x509.h
@@ -452,6 +452,24 @@
 // to zero before calling this function.
 OPENSSL_EXPORT unsigned char *X509_keyid_get0(X509 *x509, int *out_len);
 
+// X509_add1_trust_object configures |x509| as a valid trust anchor for |obj|.
+// It returns one on success and zero on error. |obj| should be a certificate
+// usage OID associated with an |X509_TRUST| object.
+OPENSSL_EXPORT int X509_add1_trust_object(X509 *x509, const ASN1_OBJECT *obj);
+
+// X509_add1_reject_object configures |x509| as distrusted for |obj|. It returns
+// one on success and zero on error. |obj| should be a certificate usage OID
+// associated with an |X509_TRUST| object.
+OPENSSL_EXPORT int X509_add1_reject_object(X509 *x509, const ASN1_OBJECT *obj);
+
+// X509_reject_clear clears the list of OIDs for which |x509| is trusted. See
+// also |X509_add1_trust_object|.
+OPENSSL_EXPORT void X509_trust_clear(X509 *x509);
+
+// X509_reject_clear clears the list of OIDs for which |x509| is distrusted. See
+// also |X509_add1_reject_object|.
+OPENSSL_EXPORT void X509_reject_clear(X509 *x509);
+
 
 // Certificate revocation lists.
 //
@@ -2285,11 +2303,6 @@
 
 DECLARE_ASN1_FUNCTIONS_const(X509_SIG)
 
-OPENSSL_EXPORT int X509_add1_trust_object(X509 *x, ASN1_OBJECT *obj);
-OPENSSL_EXPORT int X509_add1_reject_object(X509 *x, ASN1_OBJECT *obj);
-OPENSSL_EXPORT void X509_trust_clear(X509 *x);
-OPENSSL_EXPORT void X509_reject_clear(X509 *x);
-
 
 OPENSSL_EXPORT int X509_TRUST_set(int *t, int trust);