1 /* 2 * X.509v3 certificate parsing and processing 3 * Copyright (c) 2006, Jouni Malinen <j@w1.fi> 4 * 5 * This program is free software; you can redistribute it and/or modify 6 * it under the terms of the GNU General Public License version 2 as 7 * published by the Free Software Foundation. 8 * 9 * Alternatively, this software may be distributed under the terms of BSD 10 * license. 11 * 12 * See README and COPYING for more details. 13 */ 14 15 #ifndef X509V3_H 16 #define X509V3_H 17 18 #include "asn1.h" 19 20 struct x509_algorithm_identifier { 21 struct asn1_oid oid; 22 }; 23 24 struct x509_name_attr { 25 enum x509_name_attr_type { 26 X509_NAME_ATTR_NOT_USED, 27 X509_NAME_ATTR_DC, 28 X509_NAME_ATTR_CN, 29 X509_NAME_ATTR_C, 30 X509_NAME_ATTR_L, 31 X509_NAME_ATTR_ST, 32 X509_NAME_ATTR_O, 33 X509_NAME_ATTR_OU 34 } type; 35 char *value; 36 }; 37 38 #define X509_MAX_NAME_ATTRIBUTES 20 39 40 struct x509_name { 41 struct x509_name_attr attr[X509_MAX_NAME_ATTRIBUTES]; 42 size_t num_attr; 43 char *email; /* emailAddress */ 44 45 /* from alternative name extension */ 46 char *alt_email; /* rfc822Name */ 47 char *dns; /* dNSName */ 48 char *uri; /* uniformResourceIdentifier */ 49 u8 *ip; /* iPAddress */ 50 size_t ip_len; /* IPv4: 4, IPv6: 16 */ 51 struct asn1_oid rid; /* registeredID */ 52 }; 53 54 struct x509_certificate { 55 struct x509_certificate *next; 56 enum { X509_CERT_V1 = 0, X509_CERT_V2 = 1, X509_CERT_V3 = 2 } version; 57 unsigned long serial_number; 58 struct x509_algorithm_identifier signature; 59 struct x509_name issuer; 60 struct x509_name subject; 61 os_time_t not_before; 62 os_time_t not_after; 63 struct x509_algorithm_identifier public_key_alg; 64 u8 *public_key; 65 size_t public_key_len; 66 struct x509_algorithm_identifier signature_alg; 67 u8 *sign_value; 68 size_t sign_value_len; 69 70 /* Extensions */ 71 unsigned int extensions_present; 72 #define X509_EXT_BASIC_CONSTRAINTS (1 << 0) 73 #define X509_EXT_PATH_LEN_CONSTRAINT (1 << 1) 74 #define X509_EXT_KEY_USAGE (1 << 2) 75 #define X509_EXT_SUBJECT_ALT_NAME (1 << 3) 76 #define X509_EXT_ISSUER_ALT_NAME (1 << 4) 77 78 /* BasicConstraints */ 79 int ca; /* cA */ 80 unsigned long path_len_constraint; /* pathLenConstraint */ 81 82 /* KeyUsage */ 83 unsigned long key_usage; 84 #define X509_KEY_USAGE_DIGITAL_SIGNATURE (1 << 0) 85 #define X509_KEY_USAGE_NON_REPUDIATION (1 << 1) 86 #define X509_KEY_USAGE_KEY_ENCIPHERMENT (1 << 2) 87 #define X509_KEY_USAGE_DATA_ENCIPHERMENT (1 << 3) 88 #define X509_KEY_USAGE_KEY_AGREEMENT (1 << 4) 89 #define X509_KEY_USAGE_KEY_CERT_SIGN (1 << 5) 90 #define X509_KEY_USAGE_CRL_SIGN (1 << 6) 91 #define X509_KEY_USAGE_ENCIPHER_ONLY (1 << 7) 92 #define X509_KEY_USAGE_DECIPHER_ONLY (1 << 8) 93 94 /* 95 * The DER format certificate follows struct x509_certificate. These 96 * pointers point to that buffer. 97 */ 98 const u8 *cert_start; 99 size_t cert_len; 100 const u8 *tbs_cert_start; 101 size_t tbs_cert_len; 102 }; 103 104 enum { 105 X509_VALIDATE_OK, 106 X509_VALIDATE_BAD_CERTIFICATE, 107 X509_VALIDATE_UNSUPPORTED_CERTIFICATE, 108 X509_VALIDATE_CERTIFICATE_REVOKED, 109 X509_VALIDATE_CERTIFICATE_EXPIRED, 110 X509_VALIDATE_CERTIFICATE_UNKNOWN, 111 X509_VALIDATE_UNKNOWN_CA 112 }; 113 114 void x509_certificate_free(struct x509_certificate *cert); 115 struct x509_certificate * x509_certificate_parse(const u8 *buf, size_t len); 116 void x509_name_string(struct x509_name *name, char *buf, size_t len); 117 int x509_name_compare(struct x509_name *a, struct x509_name *b); 118 void x509_certificate_chain_free(struct x509_certificate *cert); 119 int x509_certificate_check_signature(struct x509_certificate *issuer, 120 struct x509_certificate *cert); 121 int x509_certificate_chain_validate(struct x509_certificate *trusted, 122 struct x509_certificate *chain, 123 int *reason); 124 struct x509_certificate * 125 x509_certificate_get_subject(struct x509_certificate *chain, 126 struct x509_name *name); 127 int x509_certificate_self_signed(struct x509_certificate *cert); 128 129 #endif /* X509V3_H */ 130