1/* 2 * X.509v3 certificate parsing and processing 3 * Copyright (c) 2006, Jouni Malinen <j@w1.fi> 4 * 5 * This program is free software; you can redistribute it and/or modify 6 * it under the terms of the GNU General Public License version 2 as 7 * published by the Free Software Foundation. 8 * 9 * Alternatively, this software may be distributed under the terms of BSD 10 * license. 11 * 12 * See README and COPYING for more details. 13 */ 14 15#ifndef X509V3_H 16#define X509V3_H 17 18#include "asn1.h" 19 20struct x509_algorithm_identifier { 21 struct asn1_oid oid; 22}; 23 24struct x509_name_attr { 25 enum x509_name_attr_type { 26 X509_NAME_ATTR_NOT_USED, 27 X509_NAME_ATTR_DC, 28 X509_NAME_ATTR_CN, 29 X509_NAME_ATTR_C, 30 X509_NAME_ATTR_L, 31 X509_NAME_ATTR_ST, 32 X509_NAME_ATTR_O, 33 X509_NAME_ATTR_OU 34 } type; 35 char *value; 36}; 37 38#define X509_MAX_NAME_ATTRIBUTES 20 39 40struct x509_name { 41 struct x509_name_attr attr[X509_MAX_NAME_ATTRIBUTES]; 42 size_t num_attr; 43 char *email; /* emailAddress */ 44 45 /* from alternative name extension */ 46 char *alt_email; /* rfc822Name */ 47 char *dns; /* dNSName */ 48 char *uri; /* uniformResourceIdentifier */ 49 u8 *ip; /* iPAddress */ 50 size_t ip_len; /* IPv4: 4, IPv6: 16 */ 51 struct asn1_oid rid; /* registeredID */ 52}; 53 54struct x509_certificate { 55 struct x509_certificate *next; 56 enum { X509_CERT_V1 = 0, X509_CERT_V2 = 1, X509_CERT_V3 = 2 } version; 57 unsigned long serial_number; 58 struct x509_algorithm_identifier signature; 59 struct x509_name issuer; 60 struct x509_name subject; 61 os_time_t not_before; 62 os_time_t not_after; 63 struct x509_algorithm_identifier public_key_alg; 64 u8 *public_key; 65 size_t public_key_len; 66 struct x509_algorithm_identifier signature_alg; 67 u8 *sign_value; 68 size_t sign_value_len; 69 70 /* Extensions */ 71 unsigned int extensions_present; 72#define X509_EXT_BASIC_CONSTRAINTS (1 << 0) 73#define X509_EXT_PATH_LEN_CONSTRAINT (1 << 1) 74#define X509_EXT_KEY_USAGE (1 << 2) 75#define X509_EXT_SUBJECT_ALT_NAME (1 << 3) 76#define X509_EXT_ISSUER_ALT_NAME (1 << 4) 77 78 /* BasicConstraints */ 79 int ca; /* cA */ 80 unsigned long path_len_constraint; /* pathLenConstraint */ 81 82 /* KeyUsage */ 83 unsigned long key_usage; 84#define X509_KEY_USAGE_DIGITAL_SIGNATURE (1 << 0) 85#define X509_KEY_USAGE_NON_REPUDIATION (1 << 1) 86#define X509_KEY_USAGE_KEY_ENCIPHERMENT (1 << 2) 87#define X509_KEY_USAGE_DATA_ENCIPHERMENT (1 << 3) 88#define X509_KEY_USAGE_KEY_AGREEMENT (1 << 4) 89#define X509_KEY_USAGE_KEY_CERT_SIGN (1 << 5) 90#define X509_KEY_USAGE_CRL_SIGN (1 << 6) 91#define X509_KEY_USAGE_ENCIPHER_ONLY (1 << 7) 92#define X509_KEY_USAGE_DECIPHER_ONLY (1 << 8) 93 94 /* 95 * The DER format certificate follows struct x509_certificate. These 96 * pointers point to that buffer. 97 */ 98 const u8 *cert_start; 99 size_t cert_len; 100 const u8 *tbs_cert_start; 101 size_t tbs_cert_len; 102}; 103 104enum { 105 X509_VALIDATE_OK, 106 X509_VALIDATE_BAD_CERTIFICATE, 107 X509_VALIDATE_UNSUPPORTED_CERTIFICATE, 108 X509_VALIDATE_CERTIFICATE_REVOKED, 109 X509_VALIDATE_CERTIFICATE_EXPIRED, 110 X509_VALIDATE_CERTIFICATE_UNKNOWN, 111 X509_VALIDATE_UNKNOWN_CA 112}; 113 114void x509_certificate_free(struct x509_certificate *cert); 115struct x509_certificate * x509_certificate_parse(const u8 *buf, size_t len); 116void x509_name_string(struct x509_name *name, char *buf, size_t len); 117int x509_name_compare(struct x509_name *a, struct x509_name *b); 118void x509_certificate_chain_free(struct x509_certificate *cert); 119int x509_certificate_check_signature(struct x509_certificate *issuer, 120 struct x509_certificate *cert); 121int x509_certificate_chain_validate(struct x509_certificate *trusted, 122 struct x509_certificate *chain, 123 int *reason); 124struct x509_certificate * 125x509_certificate_get_subject(struct x509_certificate *chain, 126 struct x509_name *name); 127int x509_certificate_self_signed(struct x509_certificate *cert); 128 129#endif /* X509V3_H */ 130