PolarSSL v1.2.7
x509.h
Go to the documentation of this file.
1 
27 #ifndef POLARSSL_X509_H
28 #define POLARSSL_X509_H
29 
30 #include "asn1.h"
31 #include "rsa.h"
32 #include "dhm.h"
33 
43 #define POLARSSL_ERR_X509_FEATURE_UNAVAILABLE -0x2080
44 #define POLARSSL_ERR_X509_CERT_INVALID_PEM -0x2100
45 #define POLARSSL_ERR_X509_CERT_INVALID_FORMAT -0x2180
46 #define POLARSSL_ERR_X509_CERT_INVALID_VERSION -0x2200
47 #define POLARSSL_ERR_X509_CERT_INVALID_SERIAL -0x2280
48 #define POLARSSL_ERR_X509_CERT_INVALID_ALG -0x2300
49 #define POLARSSL_ERR_X509_CERT_INVALID_NAME -0x2380
50 #define POLARSSL_ERR_X509_CERT_INVALID_DATE -0x2400
51 #define POLARSSL_ERR_X509_CERT_INVALID_PUBKEY -0x2480
52 #define POLARSSL_ERR_X509_CERT_INVALID_SIGNATURE -0x2500
53 #define POLARSSL_ERR_X509_CERT_INVALID_EXTENSIONS -0x2580
54 #define POLARSSL_ERR_X509_CERT_UNKNOWN_VERSION -0x2600
55 #define POLARSSL_ERR_X509_CERT_UNKNOWN_SIG_ALG -0x2680
56 #define POLARSSL_ERR_X509_UNKNOWN_PK_ALG -0x2700
57 #define POLARSSL_ERR_X509_CERT_SIG_MISMATCH -0x2780
58 #define POLARSSL_ERR_X509_CERT_VERIFY_FAILED -0x2800
59 #define POLARSSL_ERR_X509_KEY_INVALID_VERSION -0x2880
60 #define POLARSSL_ERR_X509_KEY_INVALID_FORMAT -0x2900
61 #define POLARSSL_ERR_X509_CERT_UNKNOWN_FORMAT -0x2980
62 #define POLARSSL_ERR_X509_INVALID_INPUT -0x2A00
63 #define POLARSSL_ERR_X509_MALLOC_FAILED -0x2A80
64 #define POLARSSL_ERR_X509_FILE_IO_ERROR -0x2B00
65 /* \} name */
66 
67 
72 #define BADCERT_EXPIRED 0x01
73 #define BADCERT_REVOKED 0x02
74 #define BADCERT_CN_MISMATCH 0x04
75 #define BADCERT_NOT_TRUSTED 0x08
76 #define BADCRL_NOT_TRUSTED 0x10
77 #define BADCRL_EXPIRED 0x20
78 #define BADCERT_MISSING 0x40
79 #define BADCERT_SKIP_VERIFY 0x80
80 #define BADCERT_OTHER 0x0100
81 /* \} name */
82 /* \} addtogroup x509_module */
83 
84 /*
85  * various object identifiers
86  */
87 #define X520_COMMON_NAME 3
88 #define X520_COUNTRY 6
89 #define X520_LOCALITY 7
90 #define X520_STATE 8
91 #define X520_ORGANIZATION 10
92 #define X520_ORG_UNIT 11
93 #define PKCS9_EMAIL 1
94 
95 #define X509_OUTPUT_DER 0x01
96 #define X509_OUTPUT_PEM 0x02
97 #define PEM_LINE_LENGTH 72
98 #define X509_ISSUER 0x01
99 #define X509_SUBJECT 0x02
100 
101 #define OID_X520 "\x55\x04"
102 #define OID_CN OID_X520 "\x03"
103 #define OID_COUNTRY OID_X520 "\x06"
104 #define OID_LOCALITY OID_X520 "\x07"
105 #define OID_STATE OID_X520 "\x08"
106 #define OID_ORGANIZATION OID_X520 "\x0A"
107 #define OID_ORG_UNIT OID_X520 "\x0B"
108 
109 #define OID_PKCS1 "\x2A\x86\x48\x86\xF7\x0D\x01\x01"
110 #define OID_PKCS1_RSA OID_PKCS1 "\x01"
111 #define OID_PKCS1_SHA1 OID_PKCS1 "\x05"
112 
113 #define OID_RSA_SHA_OBS "\x2B\x0E\x03\x02\x1D"
114 
115 #define OID_PKCS9 "\x2A\x86\x48\x86\xF7\x0D\x01\x09"
116 #define OID_PKCS9_EMAIL OID_PKCS9 "\x01"
117 
119 #define OID_ID_CE "\x55\x1D"
126 #define OID_PKIX "\x2B\x06\x01\x05\x05\x07"
127 
128 /*
129  * OIDs for standard certificate extensions
130  */
131 #define OID_AUTHORITY_KEY_IDENTIFIER OID_ID_CE "\x23"
132 #define OID_SUBJECT_KEY_IDENTIFIER OID_ID_CE "\x0E"
133 #define OID_KEY_USAGE OID_ID_CE "\x0F"
134 #define OID_CERTIFICATE_POLICIES OID_ID_CE "\x20"
135 #define OID_POLICY_MAPPINGS OID_ID_CE "\x21"
136 #define OID_SUBJECT_ALT_NAME OID_ID_CE "\x11"
137 #define OID_ISSUER_ALT_NAME OID_ID_CE "\x12"
138 #define OID_SUBJECT_DIRECTORY_ATTRS OID_ID_CE "\x09"
139 #define OID_BASIC_CONSTRAINTS OID_ID_CE "\x13"
140 #define OID_NAME_CONSTRAINTS OID_ID_CE "\x1E"
141 #define OID_POLICY_CONSTRAINTS OID_ID_CE "\x24"
142 #define OID_EXTENDED_KEY_USAGE OID_ID_CE "\x25"
143 #define OID_CRL_DISTRIBUTION_POINTS OID_ID_CE "\x1F"
144 #define OID_INIHIBIT_ANYPOLICY OID_ID_CE "\x36"
145 #define OID_FRESHEST_CRL OID_ID_CE "\x2E"
147 /*
148  * X.509 v3 Key Usage Extension flags
149  */
150 #define KU_DIGITAL_SIGNATURE (0x80) /* bit 0 */
151 #define KU_NON_REPUDIATION (0x40) /* bit 1 */
152 #define KU_KEY_ENCIPHERMENT (0x20) /* bit 2 */
153 #define KU_DATA_ENCIPHERMENT (0x10) /* bit 3 */
154 #define KU_KEY_AGREEMENT (0x08) /* bit 4 */
155 #define KU_KEY_CERT_SIGN (0x04) /* bit 5 */
156 #define KU_CRL_SIGN (0x02) /* bit 6 */
157 
158 /*
159  * X.509 v3 Extended key usage OIDs
160  */
161 #define OID_ANY_EXTENDED_KEY_USAGE OID_EXTENDED_KEY_USAGE "\x00"
163 #define OID_KP OID_PKIX "\x03"
164 #define OID_SERVER_AUTH OID_KP "\x01"
165 #define OID_CLIENT_AUTH OID_KP "\x02"
166 #define OID_CODE_SIGNING OID_KP "\x03"
167 #define OID_EMAIL_PROTECTION OID_KP "\x04"
168 #define OID_TIME_STAMPING OID_KP "\x08"
169 #define OID_OCSP_SIGNING OID_KP "\x09"
171 #define STRING_SERVER_AUTH "TLS Web Server Authentication"
172 #define STRING_CLIENT_AUTH "TLS Web Client Authentication"
173 #define STRING_CODE_SIGNING "Code Signing"
174 #define STRING_EMAIL_PROTECTION "E-mail Protection"
175 #define STRING_TIME_STAMPING "Time Stamping"
176 #define STRING_OCSP_SIGNING "OCSP Signing"
177 
178 /*
179  * OIDs for CRL extensions
180  */
181 #define OID_PRIVATE_KEY_USAGE_PERIOD OID_ID_CE "\x10"
182 #define OID_CRL_NUMBER OID_ID_CE "\x14"
184 /*
185  * Netscape certificate extensions
186  */
187 #define OID_NETSCAPE "\x60\x86\x48\x01\x86\xF8\x42"
188 #define OID_NS_CERT OID_NETSCAPE "\x01"
189 #define OID_NS_CERT_TYPE OID_NS_CERT "\x01"
190 #define OID_NS_BASE_URL OID_NS_CERT "\x02"
191 #define OID_NS_REVOCATION_URL OID_NS_CERT "\x03"
192 #define OID_NS_CA_REVOCATION_URL OID_NS_CERT "\x04"
193 #define OID_NS_RENEWAL_URL OID_NS_CERT "\x07"
194 #define OID_NS_CA_POLICY_URL OID_NS_CERT "\x08"
195 #define OID_NS_SSL_SERVER_NAME OID_NS_CERT "\x0C"
196 #define OID_NS_COMMENT OID_NS_CERT "\x0D"
197 #define OID_NS_DATA_TYPE OID_NETSCAPE "\x02"
198 #define OID_NS_CERT_SEQUENCE OID_NS_DATA_TYPE "\x05"
199 
200 /*
201  * Netscape certificate types
202  * (http://www.mozilla.org/projects/security/pki/nss/tech-notes/tn3.html)
203  */
204 
205 #define NS_CERT_TYPE_SSL_CLIENT (0x80) /* bit 0 */
206 #define NS_CERT_TYPE_SSL_SERVER (0x40) /* bit 1 */
207 #define NS_CERT_TYPE_EMAIL (0x20) /* bit 2 */
208 #define NS_CERT_TYPE_OBJECT_SIGNING (0x10) /* bit 3 */
209 #define NS_CERT_TYPE_RESERVED (0x08) /* bit 4 */
210 #define NS_CERT_TYPE_SSL_CA (0x04) /* bit 5 */
211 #define NS_CERT_TYPE_EMAIL_CA (0x02) /* bit 6 */
212 #define NS_CERT_TYPE_OBJECT_SIGNING_CA (0x01) /* bit 7 */
213 
214 #define EXT_AUTHORITY_KEY_IDENTIFIER (1 << 0)
215 #define EXT_SUBJECT_KEY_IDENTIFIER (1 << 1)
216 #define EXT_KEY_USAGE (1 << 2)
217 #define EXT_CERTIFICATE_POLICIES (1 << 3)
218 #define EXT_POLICY_MAPPINGS (1 << 4)
219 #define EXT_SUBJECT_ALT_NAME (1 << 5)
220 #define EXT_ISSUER_ALT_NAME (1 << 6)
221 #define EXT_SUBJECT_DIRECTORY_ATTRS (1 << 7)
222 #define EXT_BASIC_CONSTRAINTS (1 << 8)
223 #define EXT_NAME_CONSTRAINTS (1 << 9)
224 #define EXT_POLICY_CONSTRAINTS (1 << 10)
225 #define EXT_EXTENDED_KEY_USAGE (1 << 11)
226 #define EXT_CRL_DISTRIBUTION_POINTS (1 << 12)
227 #define EXT_INIHIBIT_ANYPOLICY (1 << 13)
228 #define EXT_FRESHEST_CRL (1 << 14)
229 
230 #define EXT_NS_CERT_TYPE (1 << 16)
231 
232 /*
233  * Storage format identifiers
234  * Recognized formats: PEM and DER
235  */
236 #define X509_FORMAT_DER 1
237 #define X509_FORMAT_PEM 2
238 
252 
257 
262 typedef struct _x509_name
263 {
266  struct _x509_name *next;
267 }
268 x509_name;
269 
274 
276 typedef struct _x509_time
277 {
278  int year, mon, day;
279  int hour, min, sec;
280 }
281 x509_time;
282 
286 typedef struct _x509_cert
287 {
291  int version;
312  int ext_types;
313  int ca_istrue;
316  unsigned char key_usage;
320  unsigned char ns_cert_type;
324  int sig_alg;
326  struct _x509_cert *next;
327 }
328 x509_cert;
329 
334 typedef struct _x509_crl_entry
335 {
337 
339 
341 
343 
345 }
347 
352 typedef struct _x509_crl
353 {
357  int version;
359 
366 
370 
373  int sig_alg;
374 
375  struct _x509_crl *next;
376 }
377 x509_crl;
387 /*
388 typedef struct _x509_node
389 {
390  unsigned char *data;
391  unsigned char *p;
392  unsigned char *end;
393 
394  size_t len;
395 }
396 x509_node;
397 
398 typedef struct _x509_raw
399 {
400  x509_node raw;
401  x509_node tbs;
402 
403  x509_node version;
404  x509_node serial;
405  x509_node tbs_signalg;
406  x509_node issuer;
407  x509_node validity;
408  x509_node subject;
409  x509_node subpubkey;
410 
411  x509_node signalg;
412  x509_node sign;
413 }
414 x509_raw;
415 */
416 
417 #ifdef __cplusplus
418 extern "C" {
419 #endif
420 
441 int x509parse_crt( x509_cert *chain, const unsigned char *buf, size_t buflen );
442 
457 int x509parse_crtfile( x509_cert *chain, const char *path );
458 
473 int x509parse_crtpath( x509_cert *chain, const char *path );
474 
486 int x509parse_crl( x509_crl *chain, const unsigned char *buf, size_t buflen );
487 
498 int x509parse_crlfile( x509_crl *chain, const char *path );
499 
512 int x509parse_key( rsa_context *rsa,
513  const unsigned char *key, size_t keylen,
514  const unsigned char *pwd, size_t pwdlen );
515 
526 int x509parse_keyfile( rsa_context *rsa, const char *path,
527  const char *password );
528 
540  const unsigned char *key, size_t keylen );
541 
551 int x509parse_public_keyfile( rsa_context *rsa, const char *path );
552 
563 int x509parse_dhm( dhm_context *dhm, const unsigned char *dhmin, size_t dhminlen );
564 
574 int x509parse_dhmfile( dhm_context *dhm, const char *path );
575 
589 int x509parse_dn_gets( char *buf, size_t size, const x509_name *dn );
590 
602 int x509parse_serial_gets( char *buf, size_t size, const x509_buf *serial );
603 
616 int x509parse_cert_info( char *buf, size_t size, const char *prefix,
617  const x509_cert *crt );
618 
631 int x509parse_crl_info( char *buf, size_t size, const char *prefix,
632  const x509_crl *crl );
633 
642 const char *x509_oid_get_description( x509_buf *oid );
643 
654 int x509_oid_get_numeric_string( char *buf, size_t size, x509_buf *oid );
655 
665 int x509parse_time_expired( const x509_time *time );
666 
708 int x509parse_verify( x509_cert *crt,
709  x509_cert *trust_ca,
710  x509_crl *ca_crl,
711  const char *cn, int *flags,
712  int (*f_vrfy)(void *, x509_cert *, int, int *),
713  void *p_vrfy );
714 
724 int x509parse_revoked( const x509_cert *crt, const x509_crl *crl );
725 
740 void x509_free( x509_cert *crt );
741 
748 void x509_crl_free( x509_crl *crl );
749 
758 int x509_self_test( int verbose );
759 
760 #ifdef __cplusplus
761 }
762 #endif
763 
764 #endif /* x509.h */