| Dmitry Shmidt | 8d520ff | 2011-05-09 14:06:53 -0700 | [diff] [blame^] | 1 | /* |
| 2 | * X.509v3 certificate parsing and processing |
| 3 | * Copyright (c) 2006, Jouni Malinen <j@w1.fi> |
| 4 | * |
| 5 | * This program is free software; you can redistribute it and/or modify |
| 6 | * it under the terms of the GNU General Public License version 2 as |
| 7 | * published by the Free Software Foundation. |
| 8 | * |
| 9 | * Alternatively, this software may be distributed under the terms of BSD |
| 10 | * license. |
| 11 | * |
| 12 | * See README and COPYING for more details. |
| 13 | */ |
| 14 | |
| 15 | #ifndef X509V3_H |
| 16 | #define X509V3_H |
| 17 | |
| 18 | #include "asn1.h" |
| 19 | |
| 20 | struct x509_algorithm_identifier { |
| 21 | struct asn1_oid oid; |
| 22 | }; |
| 23 | |
| 24 | struct x509_name_attr { |
| 25 | enum x509_name_attr_type { |
| 26 | X509_NAME_ATTR_NOT_USED, |
| 27 | X509_NAME_ATTR_DC, |
| 28 | X509_NAME_ATTR_CN, |
| 29 | X509_NAME_ATTR_C, |
| 30 | X509_NAME_ATTR_L, |
| 31 | X509_NAME_ATTR_ST, |
| 32 | X509_NAME_ATTR_O, |
| 33 | X509_NAME_ATTR_OU |
| 34 | } type; |
| 35 | char *value; |
| 36 | }; |
| 37 | |
| 38 | #define X509_MAX_NAME_ATTRIBUTES 20 |
| 39 | |
| 40 | struct x509_name { |
| 41 | struct x509_name_attr attr[X509_MAX_NAME_ATTRIBUTES]; |
| 42 | size_t num_attr; |
| 43 | char *email; /* emailAddress */ |
| 44 | |
| 45 | /* from alternative name extension */ |
| 46 | char *alt_email; /* rfc822Name */ |
| 47 | char *dns; /* dNSName */ |
| 48 | char *uri; /* uniformResourceIdentifier */ |
| 49 | u8 *ip; /* iPAddress */ |
| 50 | size_t ip_len; /* IPv4: 4, IPv6: 16 */ |
| 51 | struct asn1_oid rid; /* registeredID */ |
| 52 | }; |
| 53 | |
| 54 | struct x509_certificate { |
| 55 | struct x509_certificate *next; |
| 56 | enum { X509_CERT_V1 = 0, X509_CERT_V2 = 1, X509_CERT_V3 = 2 } version; |
| 57 | unsigned long serial_number; |
| 58 | struct x509_algorithm_identifier signature; |
| 59 | struct x509_name issuer; |
| 60 | struct x509_name subject; |
| 61 | os_time_t not_before; |
| 62 | os_time_t not_after; |
| 63 | struct x509_algorithm_identifier public_key_alg; |
| 64 | u8 *public_key; |
| 65 | size_t public_key_len; |
| 66 | struct x509_algorithm_identifier signature_alg; |
| 67 | u8 *sign_value; |
| 68 | size_t sign_value_len; |
| 69 | |
| 70 | /* Extensions */ |
| 71 | unsigned int extensions_present; |
| 72 | #define X509_EXT_BASIC_CONSTRAINTS (1 << 0) |
| 73 | #define X509_EXT_PATH_LEN_CONSTRAINT (1 << 1) |
| 74 | #define X509_EXT_KEY_USAGE (1 << 2) |
| 75 | #define X509_EXT_SUBJECT_ALT_NAME (1 << 3) |
| 76 | #define X509_EXT_ISSUER_ALT_NAME (1 << 4) |
| 77 | |
| 78 | /* BasicConstraints */ |
| 79 | int ca; /* cA */ |
| 80 | unsigned long path_len_constraint; /* pathLenConstraint */ |
| 81 | |
| 82 | /* KeyUsage */ |
| 83 | unsigned long key_usage; |
| 84 | #define X509_KEY_USAGE_DIGITAL_SIGNATURE (1 << 0) |
| 85 | #define X509_KEY_USAGE_NON_REPUDIATION (1 << 1) |
| 86 | #define X509_KEY_USAGE_KEY_ENCIPHERMENT (1 << 2) |
| 87 | #define X509_KEY_USAGE_DATA_ENCIPHERMENT (1 << 3) |
| 88 | #define X509_KEY_USAGE_KEY_AGREEMENT (1 << 4) |
| 89 | #define X509_KEY_USAGE_KEY_CERT_SIGN (1 << 5) |
| 90 | #define X509_KEY_USAGE_CRL_SIGN (1 << 6) |
| 91 | #define X509_KEY_USAGE_ENCIPHER_ONLY (1 << 7) |
| 92 | #define X509_KEY_USAGE_DECIPHER_ONLY (1 << 8) |
| 93 | |
| 94 | /* |
| 95 | * The DER format certificate follows struct x509_certificate. These |
| 96 | * pointers point to that buffer. |
| 97 | */ |
| 98 | const u8 *cert_start; |
| 99 | size_t cert_len; |
| 100 | const u8 *tbs_cert_start; |
| 101 | size_t tbs_cert_len; |
| 102 | }; |
| 103 | |
| 104 | enum { |
| 105 | X509_VALIDATE_OK, |
| 106 | X509_VALIDATE_BAD_CERTIFICATE, |
| 107 | X509_VALIDATE_UNSUPPORTED_CERTIFICATE, |
| 108 | X509_VALIDATE_CERTIFICATE_REVOKED, |
| 109 | X509_VALIDATE_CERTIFICATE_EXPIRED, |
| 110 | X509_VALIDATE_CERTIFICATE_UNKNOWN, |
| 111 | X509_VALIDATE_UNKNOWN_CA |
| 112 | }; |
| 113 | |
| 114 | void x509_certificate_free(struct x509_certificate *cert); |
| 115 | struct x509_certificate * x509_certificate_parse(const u8 *buf, size_t len); |
| 116 | void x509_name_string(struct x509_name *name, char *buf, size_t len); |
| 117 | int x509_name_compare(struct x509_name *a, struct x509_name *b); |
| 118 | void x509_certificate_chain_free(struct x509_certificate *cert); |
| 119 | int x509_certificate_check_signature(struct x509_certificate *issuer, |
| 120 | struct x509_certificate *cert); |
| 121 | int x509_certificate_chain_validate(struct x509_certificate *trusted, |
| 122 | struct x509_certificate *chain, |
| 123 | int *reason); |
| 124 | struct x509_certificate * |
| 125 | x509_certificate_get_subject(struct x509_certificate *chain, |
| 126 | struct x509_name *name); |
| 127 | int x509_certificate_self_signed(struct x509_certificate *cert); |
| 128 | |
| 129 | #endif /* X509V3_H */ |