16d49e1aeSJan Lentfer /* 26d49e1aeSJan Lentfer * X.509v3 certificate parsing and processing 33ff40c12SJohn Marino * Copyright (c) 2006-2011, Jouni Malinen <j@w1.fi> 46d49e1aeSJan Lentfer * 53ff40c12SJohn Marino * This software may be distributed under the terms of the BSD license. 63ff40c12SJohn Marino * See README for more details. 76d49e1aeSJan Lentfer */ 86d49e1aeSJan Lentfer 96d49e1aeSJan Lentfer #ifndef X509V3_H 106d49e1aeSJan Lentfer #define X509V3_H 116d49e1aeSJan Lentfer 126d49e1aeSJan Lentfer #include "asn1.h" 136d49e1aeSJan Lentfer 146d49e1aeSJan Lentfer struct x509_algorithm_identifier { 156d49e1aeSJan Lentfer struct asn1_oid oid; 166d49e1aeSJan Lentfer }; 176d49e1aeSJan Lentfer 183ff40c12SJohn Marino struct x509_name_attr { 193ff40c12SJohn Marino enum x509_name_attr_type { 203ff40c12SJohn Marino X509_NAME_ATTR_NOT_USED, 213ff40c12SJohn Marino X509_NAME_ATTR_DC, 223ff40c12SJohn Marino X509_NAME_ATTR_CN, 233ff40c12SJohn Marino X509_NAME_ATTR_C, 243ff40c12SJohn Marino X509_NAME_ATTR_L, 253ff40c12SJohn Marino X509_NAME_ATTR_ST, 263ff40c12SJohn Marino X509_NAME_ATTR_O, 273ff40c12SJohn Marino X509_NAME_ATTR_OU 283ff40c12SJohn Marino } type; 293ff40c12SJohn Marino char *value; 303ff40c12SJohn Marino }; 313ff40c12SJohn Marino 323ff40c12SJohn Marino #define X509_MAX_NAME_ATTRIBUTES 20 333ff40c12SJohn Marino 346d49e1aeSJan Lentfer struct x509_name { 353ff40c12SJohn Marino struct x509_name_attr attr[X509_MAX_NAME_ATTRIBUTES]; 363ff40c12SJohn Marino size_t num_attr; 376d49e1aeSJan Lentfer char *email; /* emailAddress */ 383ff40c12SJohn Marino 393ff40c12SJohn Marino /* from alternative name extension */ 403ff40c12SJohn Marino char *alt_email; /* rfc822Name */ 413ff40c12SJohn Marino char *dns; /* dNSName */ 423ff40c12SJohn Marino char *uri; /* uniformResourceIdentifier */ 433ff40c12SJohn Marino u8 *ip; /* iPAddress */ 443ff40c12SJohn Marino size_t ip_len; /* IPv4: 4, IPv6: 16 */ 453ff40c12SJohn Marino struct asn1_oid rid; /* registeredID */ 466d49e1aeSJan Lentfer }; 476d49e1aeSJan Lentfer 48*a1157835SDaniel Fojt #define X509_MAX_SERIAL_NUM_LEN 20 49*a1157835SDaniel Fojt 506d49e1aeSJan Lentfer struct x509_certificate { 516d49e1aeSJan Lentfer struct x509_certificate *next; 526d49e1aeSJan Lentfer enum { X509_CERT_V1 = 0, X509_CERT_V2 = 1, X509_CERT_V3 = 2 } version; 53*a1157835SDaniel Fojt u8 serial_number[X509_MAX_SERIAL_NUM_LEN]; 54*a1157835SDaniel Fojt size_t serial_number_len; 556d49e1aeSJan Lentfer struct x509_algorithm_identifier signature; 566d49e1aeSJan Lentfer struct x509_name issuer; 576d49e1aeSJan Lentfer struct x509_name subject; 58*a1157835SDaniel Fojt u8 *subject_dn; 59*a1157835SDaniel Fojt size_t subject_dn_len; 606d49e1aeSJan Lentfer os_time_t not_before; 616d49e1aeSJan Lentfer os_time_t not_after; 626d49e1aeSJan Lentfer struct x509_algorithm_identifier public_key_alg; 636d49e1aeSJan Lentfer u8 *public_key; 646d49e1aeSJan Lentfer size_t public_key_len; 656d49e1aeSJan Lentfer struct x509_algorithm_identifier signature_alg; 666d49e1aeSJan Lentfer u8 *sign_value; 676d49e1aeSJan Lentfer size_t sign_value_len; 686d49e1aeSJan Lentfer 696d49e1aeSJan Lentfer /* Extensions */ 706d49e1aeSJan Lentfer unsigned int extensions_present; 716d49e1aeSJan Lentfer #define X509_EXT_BASIC_CONSTRAINTS (1 << 0) 726d49e1aeSJan Lentfer #define X509_EXT_PATH_LEN_CONSTRAINT (1 << 1) 736d49e1aeSJan Lentfer #define X509_EXT_KEY_USAGE (1 << 2) 743ff40c12SJohn Marino #define X509_EXT_SUBJECT_ALT_NAME (1 << 3) 753ff40c12SJohn Marino #define X509_EXT_ISSUER_ALT_NAME (1 << 4) 76*a1157835SDaniel Fojt #define X509_EXT_EXT_KEY_USAGE (1 << 5) 776d49e1aeSJan Lentfer 786d49e1aeSJan Lentfer /* BasicConstraints */ 796d49e1aeSJan Lentfer int ca; /* cA */ 806d49e1aeSJan Lentfer unsigned long path_len_constraint; /* pathLenConstraint */ 816d49e1aeSJan Lentfer 826d49e1aeSJan Lentfer /* KeyUsage */ 836d49e1aeSJan Lentfer unsigned long key_usage; 846d49e1aeSJan Lentfer #define X509_KEY_USAGE_DIGITAL_SIGNATURE (1 << 0) 856d49e1aeSJan Lentfer #define X509_KEY_USAGE_NON_REPUDIATION (1 << 1) 866d49e1aeSJan Lentfer #define X509_KEY_USAGE_KEY_ENCIPHERMENT (1 << 2) 876d49e1aeSJan Lentfer #define X509_KEY_USAGE_DATA_ENCIPHERMENT (1 << 3) 886d49e1aeSJan Lentfer #define X509_KEY_USAGE_KEY_AGREEMENT (1 << 4) 896d49e1aeSJan Lentfer #define X509_KEY_USAGE_KEY_CERT_SIGN (1 << 5) 906d49e1aeSJan Lentfer #define X509_KEY_USAGE_CRL_SIGN (1 << 6) 916d49e1aeSJan Lentfer #define X509_KEY_USAGE_ENCIPHER_ONLY (1 << 7) 926d49e1aeSJan Lentfer #define X509_KEY_USAGE_DECIPHER_ONLY (1 << 8) 936d49e1aeSJan Lentfer 94*a1157835SDaniel Fojt /* ExtKeyUsage */ 95*a1157835SDaniel Fojt unsigned long ext_key_usage; 96*a1157835SDaniel Fojt #define X509_EXT_KEY_USAGE_ANY (1 << 0) 97*a1157835SDaniel Fojt #define X509_EXT_KEY_USAGE_SERVER_AUTH (1 << 1) 98*a1157835SDaniel Fojt #define X509_EXT_KEY_USAGE_CLIENT_AUTH (1 << 2) 99*a1157835SDaniel Fojt #define X509_EXT_KEY_USAGE_OCSP (1 << 3) 100*a1157835SDaniel Fojt 1016d49e1aeSJan Lentfer /* 1026d49e1aeSJan Lentfer * The DER format certificate follows struct x509_certificate. These 1036d49e1aeSJan Lentfer * pointers point to that buffer. 1046d49e1aeSJan Lentfer */ 1056d49e1aeSJan Lentfer const u8 *cert_start; 1066d49e1aeSJan Lentfer size_t cert_len; 1076d49e1aeSJan Lentfer const u8 *tbs_cert_start; 1086d49e1aeSJan Lentfer size_t tbs_cert_len; 109*a1157835SDaniel Fojt 110*a1157835SDaniel Fojt /* Meta data used for certificate validation */ 111*a1157835SDaniel Fojt unsigned int ocsp_good:1; 112*a1157835SDaniel Fojt unsigned int ocsp_revoked:1; 113*a1157835SDaniel Fojt unsigned int issuer_trusted:1; 1146d49e1aeSJan Lentfer }; 1156d49e1aeSJan Lentfer 1166d49e1aeSJan Lentfer enum { 1176d49e1aeSJan Lentfer X509_VALIDATE_OK, 1186d49e1aeSJan Lentfer X509_VALIDATE_BAD_CERTIFICATE, 1196d49e1aeSJan Lentfer X509_VALIDATE_UNSUPPORTED_CERTIFICATE, 1206d49e1aeSJan Lentfer X509_VALIDATE_CERTIFICATE_REVOKED, 1216d49e1aeSJan Lentfer X509_VALIDATE_CERTIFICATE_EXPIRED, 1226d49e1aeSJan Lentfer X509_VALIDATE_CERTIFICATE_UNKNOWN, 1236d49e1aeSJan Lentfer X509_VALIDATE_UNKNOWN_CA 1246d49e1aeSJan Lentfer }; 1256d49e1aeSJan Lentfer 1266d49e1aeSJan Lentfer void x509_certificate_free(struct x509_certificate *cert); 127*a1157835SDaniel Fojt int x509_parse_algorithm_identifier(const u8 *buf, size_t len, 128*a1157835SDaniel Fojt struct x509_algorithm_identifier *id, 129*a1157835SDaniel Fojt const u8 **next); 130*a1157835SDaniel Fojt int x509_parse_name(const u8 *buf, size_t len, struct x509_name *name, 131*a1157835SDaniel Fojt const u8 **next); 132*a1157835SDaniel Fojt int x509_parse_time(const u8 *buf, size_t len, u8 asn1_tag, os_time_t *val); 1336d49e1aeSJan Lentfer struct x509_certificate * x509_certificate_parse(const u8 *buf, size_t len); 134*a1157835SDaniel Fojt void x509_free_name(struct x509_name *name); 1356d49e1aeSJan Lentfer void x509_name_string(struct x509_name *name, char *buf, size_t len); 1366d49e1aeSJan Lentfer int x509_name_compare(struct x509_name *a, struct x509_name *b); 1376d49e1aeSJan Lentfer void x509_certificate_chain_free(struct x509_certificate *cert); 138*a1157835SDaniel Fojt int x509_check_signature(struct x509_certificate *issuer, 139*a1157835SDaniel Fojt struct x509_algorithm_identifier *signature, 140*a1157835SDaniel Fojt const u8 *sign_value, size_t sign_value_len, 141*a1157835SDaniel Fojt const u8 *signed_data, size_t signed_data_len); 1426d49e1aeSJan Lentfer int x509_certificate_check_signature(struct x509_certificate *issuer, 1436d49e1aeSJan Lentfer struct x509_certificate *cert); 1446d49e1aeSJan Lentfer int x509_certificate_chain_validate(struct x509_certificate *trusted, 1456d49e1aeSJan Lentfer struct x509_certificate *chain, 1463ff40c12SJohn Marino int *reason, int disable_time_checks); 1476d49e1aeSJan Lentfer struct x509_certificate * 1486d49e1aeSJan Lentfer x509_certificate_get_subject(struct x509_certificate *chain, 1496d49e1aeSJan Lentfer struct x509_name *name); 1506d49e1aeSJan Lentfer int x509_certificate_self_signed(struct x509_certificate *cert); 1516d49e1aeSJan Lentfer 152*a1157835SDaniel Fojt int x509_sha1_oid(struct asn1_oid *oid); 153*a1157835SDaniel Fojt int x509_sha256_oid(struct asn1_oid *oid); 154*a1157835SDaniel Fojt int x509_sha384_oid(struct asn1_oid *oid); 155*a1157835SDaniel Fojt int x509_sha512_oid(struct asn1_oid *oid); 156*a1157835SDaniel Fojt 1576d49e1aeSJan Lentfer #endif /* X509V3_H */ 158