| /* |
| * X.509v3 certificate parsing and processing |
| * Copyright (c) 2006-2011, Jouni Malinen <j@w1.fi> |
| * |
| * This software may be distributed under the terms of the BSD license. |
| * See README for more details. |
| */ |
| |
| #ifndef X509V3_H |
| #define X509V3_H |
| |
| #include "asn1.h" |
| |
| struct x509_algorithm_identifier { |
| struct asn1_oid oid; |
| }; |
| |
| struct x509_name_attr { |
| enum x509_name_attr_type { |
| X509_NAME_ATTR_NOT_USED, |
| X509_NAME_ATTR_DC, |
| X509_NAME_ATTR_CN, |
| X509_NAME_ATTR_C, |
| X509_NAME_ATTR_L, |
| X509_NAME_ATTR_ST, |
| X509_NAME_ATTR_O, |
| X509_NAME_ATTR_OU |
| } type; |
| char *value; |
| }; |
| |
| #define X509_MAX_NAME_ATTRIBUTES 20 |
| |
| struct x509_name { |
| struct x509_name_attr attr[X509_MAX_NAME_ATTRIBUTES]; |
| size_t num_attr; |
| char *email; /* emailAddress */ |
| |
| /* from alternative name extension */ |
| char *alt_email; /* rfc822Name */ |
| char *dns; /* dNSName */ |
| char *uri; /* uniformResourceIdentifier */ |
| u8 *ip; /* iPAddress */ |
| size_t ip_len; /* IPv4: 4, IPv6: 16 */ |
| struct asn1_oid rid; /* registeredID */ |
| }; |
| |
| struct x509_certificate { |
| struct x509_certificate *next; |
| enum { X509_CERT_V1 = 0, X509_CERT_V2 = 1, X509_CERT_V3 = 2 } version; |
| unsigned long serial_number; |
| struct x509_algorithm_identifier signature; |
| struct x509_name issuer; |
| struct x509_name subject; |
| os_time_t not_before; |
| os_time_t not_after; |
| struct x509_algorithm_identifier public_key_alg; |
| u8 *public_key; |
| size_t public_key_len; |
| struct x509_algorithm_identifier signature_alg; |
| u8 *sign_value; |
| size_t sign_value_len; |
| |
| /* Extensions */ |
| unsigned int extensions_present; |
| #define X509_EXT_BASIC_CONSTRAINTS (1 << 0) |
| #define X509_EXT_PATH_LEN_CONSTRAINT (1 << 1) |
| #define X509_EXT_KEY_USAGE (1 << 2) |
| #define X509_EXT_SUBJECT_ALT_NAME (1 << 3) |
| #define X509_EXT_ISSUER_ALT_NAME (1 << 4) |
| |
| /* BasicConstraints */ |
| int ca; /* cA */ |
| unsigned long path_len_constraint; /* pathLenConstraint */ |
| |
| /* KeyUsage */ |
| unsigned long key_usage; |
| #define X509_KEY_USAGE_DIGITAL_SIGNATURE (1 << 0) |
| #define X509_KEY_USAGE_NON_REPUDIATION (1 << 1) |
| #define X509_KEY_USAGE_KEY_ENCIPHERMENT (1 << 2) |
| #define X509_KEY_USAGE_DATA_ENCIPHERMENT (1 << 3) |
| #define X509_KEY_USAGE_KEY_AGREEMENT (1 << 4) |
| #define X509_KEY_USAGE_KEY_CERT_SIGN (1 << 5) |
| #define X509_KEY_USAGE_CRL_SIGN (1 << 6) |
| #define X509_KEY_USAGE_ENCIPHER_ONLY (1 << 7) |
| #define X509_KEY_USAGE_DECIPHER_ONLY (1 << 8) |
| |
| /* |
| * The DER format certificate follows struct x509_certificate. These |
| * pointers point to that buffer. |
| */ |
| const u8 *cert_start; |
| size_t cert_len; |
| const u8 *tbs_cert_start; |
| size_t tbs_cert_len; |
| }; |
| |
| enum { |
| X509_VALIDATE_OK, |
| X509_VALIDATE_BAD_CERTIFICATE, |
| X509_VALIDATE_UNSUPPORTED_CERTIFICATE, |
| X509_VALIDATE_CERTIFICATE_REVOKED, |
| X509_VALIDATE_CERTIFICATE_EXPIRED, |
| X509_VALIDATE_CERTIFICATE_UNKNOWN, |
| X509_VALIDATE_UNKNOWN_CA |
| }; |
| |
| void x509_certificate_free(struct x509_certificate *cert); |
| struct x509_certificate * x509_certificate_parse(const u8 *buf, size_t len); |
| void x509_name_string(struct x509_name *name, char *buf, size_t len); |
| int x509_name_compare(struct x509_name *a, struct x509_name *b); |
| void x509_certificate_chain_free(struct x509_certificate *cert); |
| int x509_certificate_check_signature(struct x509_certificate *issuer, |
| struct x509_certificate *cert); |
| int x509_certificate_chain_validate(struct x509_certificate *trusted, |
| struct x509_certificate *chain, |
| int *reason, int disable_time_checks); |
| struct x509_certificate * |
| x509_certificate_get_subject(struct x509_certificate *chain, |
| struct x509_name *name); |
| int x509_certificate_self_signed(struct x509_certificate *cert); |
| |
| #endif /* X509V3_H */ |