x509v3.h revision 8d520ff1dc2da35cdca849e982051b86468016d8 
1/*
2 * X.509v3 certificate parsing and processing
3 * Copyright (c) 2006, Jouni Malinen <j@w1.fi>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
8 *
9 * Alternatively, this software may be distributed under the terms of BSD
10 * license.
11 *
12 * See README and COPYING for more details.
13 */
14
15#ifndef X509V3_H
16#define X509V3_H
17
18#include "asn1.h"
19
20struct x509_algorithm_identifier {
21	struct asn1_oid oid;
22};
23
24struct x509_name_attr {
25	enum x509_name_attr_type {
26		X509_NAME_ATTR_NOT_USED,
27		X509_NAME_ATTR_DC,
28		X509_NAME_ATTR_CN,
29		X509_NAME_ATTR_C,
30		X509_NAME_ATTR_L,
31		X509_NAME_ATTR_ST,
32		X509_NAME_ATTR_O,
33		X509_NAME_ATTR_OU
34	} type;
35	char *value;
36};
37
38#define X509_MAX_NAME_ATTRIBUTES 20
39
40struct x509_name {
41	struct x509_name_attr attr[X509_MAX_NAME_ATTRIBUTES];
42	size_t num_attr;
43	char *email; /* emailAddress */
44
45	/* from alternative name extension */
46	char *alt_email; /* rfc822Name */
47	char *dns; /* dNSName */
48	char *uri; /* uniformResourceIdentifier */
49	u8 *ip; /* iPAddress */
50	size_t ip_len; /* IPv4: 4, IPv6: 16 */
51	struct asn1_oid rid; /* registeredID */
52};
53
54struct x509_certificate {
55	struct x509_certificate *next;
56	enum { X509_CERT_V1 = 0, X509_CERT_V2 = 1, X509_CERT_V3 = 2 } version;
57	unsigned long serial_number;
58	struct x509_algorithm_identifier signature;
59	struct x509_name issuer;
60	struct x509_name subject;
61	os_time_t not_before;
62	os_time_t not_after;
63	struct x509_algorithm_identifier public_key_alg;
64	u8 *public_key;
65	size_t public_key_len;
66	struct x509_algorithm_identifier signature_alg;
67	u8 *sign_value;
68	size_t sign_value_len;
69
70	/* Extensions */
71	unsigned int extensions_present;
72#define X509_EXT_BASIC_CONSTRAINTS		(1 << 0)
73#define X509_EXT_PATH_LEN_CONSTRAINT		(1 << 1)
74#define X509_EXT_KEY_USAGE			(1 << 2)
75#define X509_EXT_SUBJECT_ALT_NAME		(1 << 3)
76#define X509_EXT_ISSUER_ALT_NAME		(1 << 4)
77
78	/* BasicConstraints */
79	int ca; /* cA */
80	unsigned long path_len_constraint; /* pathLenConstraint */
81
82	/* KeyUsage */
83	unsigned long key_usage;
84#define X509_KEY_USAGE_DIGITAL_SIGNATURE	(1 << 0)
85#define X509_KEY_USAGE_NON_REPUDIATION		(1 << 1)
86#define X509_KEY_USAGE_KEY_ENCIPHERMENT		(1 << 2)
87#define X509_KEY_USAGE_DATA_ENCIPHERMENT	(1 << 3)
88#define X509_KEY_USAGE_KEY_AGREEMENT		(1 << 4)
89#define X509_KEY_USAGE_KEY_CERT_SIGN		(1 << 5)
90#define X509_KEY_USAGE_CRL_SIGN			(1 << 6)
91#define X509_KEY_USAGE_ENCIPHER_ONLY		(1 << 7)
92#define X509_KEY_USAGE_DECIPHER_ONLY		(1 << 8)
93
94	/*
95	 * The DER format certificate follows struct x509_certificate. These
96	 * pointers point to that buffer.
97	 */
98	const u8 *cert_start;
99	size_t cert_len;
100	const u8 *tbs_cert_start;
101	size_t tbs_cert_len;
102};
103
104enum {
105	X509_VALIDATE_OK,
106	X509_VALIDATE_BAD_CERTIFICATE,
107	X509_VALIDATE_UNSUPPORTED_CERTIFICATE,
108	X509_VALIDATE_CERTIFICATE_REVOKED,
109	X509_VALIDATE_CERTIFICATE_EXPIRED,
110	X509_VALIDATE_CERTIFICATE_UNKNOWN,
111	X509_VALIDATE_UNKNOWN_CA
112};
113
114void x509_certificate_free(struct x509_certificate *cert);
115struct x509_certificate * x509_certificate_parse(const u8 *buf, size_t len);
116void x509_name_string(struct x509_name *name, char *buf, size_t len);
117int x509_name_compare(struct x509_name *a, struct x509_name *b);
118void x509_certificate_chain_free(struct x509_certificate *cert);
119int x509_certificate_check_signature(struct x509_certificate *issuer,
120				     struct x509_certificate *cert);
121int x509_certificate_chain_validate(struct x509_certificate *trusted,
122				    struct x509_certificate *chain,
123				    int *reason);
124struct x509_certificate *
125x509_certificate_get_subject(struct x509_certificate *chain,
126			     struct x509_name *name);
127int x509_certificate_self_signed(struct x509_certificate *cert);
128
129#endif /* X509V3_H */
130