www.project-moonshot.org Git - mech_eap.orig/blob - libeap/src/tls/x509v3.h

   1 /*
   2  * X.509v3 certificate parsing and processing
   3  * Copyright (c) 2006, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #ifndef X509V3_H
  16 #define X509V3_H
  17
  18 #include "asn1.h"
  19
  20 struct x509_algorithm_identifier {
  21         struct asn1_oid oid;
  22 };
  23
  24 struct x509_name_attr {
  25         enum x509_name_attr_type {
  26                 X509_NAME_ATTR_NOT_USED,
  27                 X509_NAME_ATTR_DC,
  28                 X509_NAME_ATTR_CN,
  29                 X509_NAME_ATTR_C,
  30                 X509_NAME_ATTR_L,
  31                 X509_NAME_ATTR_ST,
  32                 X509_NAME_ATTR_O,
  33                 X509_NAME_ATTR_OU
  34         } type;
  35         char *value;
  36 };
  37
  38 #define X509_MAX_NAME_ATTRIBUTES 20
  39
  40 struct x509_name {
  41         struct x509_name_attr attr[X509_MAX_NAME_ATTRIBUTES];
  42         size_t num_attr;
  43         char *email; /* emailAddress */
  44
  45         /* from alternative name extension */
  46         char *alt_email; /* rfc822Name */
  47         char *dns; /* dNSName */
  48         char *uri; /* uniformResourceIdentifier */
  49         u8 *ip; /* iPAddress */
  50         size_t ip_len; /* IPv4: 4, IPv6: 16 */
  51         struct asn1_oid rid; /* registeredID */
  52 };
  53
  54 struct x509_certificate {
  55         struct x509_certificate *next;
  56         enum { X509_CERT_V1 = 0, X509_CERT_V2 = 1, X509_CERT_V3 = 2 } version;
  57         unsigned long serial_number;
  58         struct x509_algorithm_identifier signature;
  59         struct x509_name issuer;
  60         struct x509_name subject;
  61         os_time_t not_before;
  62         os_time_t not_after;
  63         struct x509_algorithm_identifier public_key_alg;
  64         u8 *public_key;
  65         size_t public_key_len;
  66         struct x509_algorithm_identifier signature_alg;
  67         u8 *sign_value;
  68         size_t sign_value_len;
  69
  70         /* Extensions */
  71         unsigned int extensions_present;
  72 #define X509_EXT_BASIC_CONSTRAINTS              (1 << 0)
  73 #define X509_EXT_PATH_LEN_CONSTRAINT            (1 << 1)
  74 #define X509_EXT_KEY_USAGE                      (1 << 2)
  75 #define X509_EXT_SUBJECT_ALT_NAME               (1 << 3)
  76 #define X509_EXT_ISSUER_ALT_NAME                (1 << 4)
  77
  78         /* BasicConstraints */
  79         int ca; /* cA */
  80         unsigned long path_len_constraint; /* pathLenConstraint */
  81
  82         /* KeyUsage */
  83         unsigned long key_usage;
  84 #define X509_KEY_USAGE_DIGITAL_SIGNATURE        (1 << 0)
  85 #define X509_KEY_USAGE_NON_REPUDIATION          (1 << 1)
  86 #define X509_KEY_USAGE_KEY_ENCIPHERMENT         (1 << 2)
  87 #define X509_KEY_USAGE_DATA_ENCIPHERMENT        (1 << 3)
  88 #define X509_KEY_USAGE_KEY_AGREEMENT            (1 << 4)
  89 #define X509_KEY_USAGE_KEY_CERT_SIGN            (1 << 5)
  90 #define X509_KEY_USAGE_CRL_SIGN                 (1 << 6)
  91 #define X509_KEY_USAGE_ENCIPHER_ONLY            (1 << 7)
  92 #define X509_KEY_USAGE_DECIPHER_ONLY            (1 << 8)
  93
  94         /*
  95          * The DER format certificate follows struct x509_certificate. These
  96          * pointers point to that buffer.
  97          */
  98         const u8 *cert_start;
  99         size_t cert_len;
 100         const u8 *tbs_cert_start;
 101         size_t tbs_cert_len;
 102 };
 103
 104 enum {
 105         X509_VALIDATE_OK,
 106         X509_VALIDATE_BAD_CERTIFICATE,
 107         X509_VALIDATE_UNSUPPORTED_CERTIFICATE,
 108         X509_VALIDATE_CERTIFICATE_REVOKED,
 109         X509_VALIDATE_CERTIFICATE_EXPIRED,
 110         X509_VALIDATE_CERTIFICATE_UNKNOWN,
 111         X509_VALIDATE_UNKNOWN_CA
 112 };
 113
 114 void x509_certificate_free(struct x509_certificate *cert);
 115 struct x509_certificate * x509_certificate_parse(const u8 *buf, size_t len);
 116 void x509_name_string(struct x509_name *name, char *buf, size_t len);
 117 int x509_name_compare(struct x509_name *a, struct x509_name *b);
 118 void x509_certificate_chain_free(struct x509_certificate *cert);
 119 int x509_certificate_check_signature(struct x509_certificate *issuer,
 120                                      struct x509_certificate *cert);
 121 int x509_certificate_chain_validate(struct x509_certificate *trusted,
 122                                     struct x509_certificate *chain,
 123                                     int *reason);
 124 struct x509_certificate *
 125 x509_certificate_get_subject(struct x509_certificate *chain,
 126                              struct x509_name *name);
 127 int x509_certificate_self_signed(struct x509_certificate *cert);
 128
 129 #endif /* X509V3_H */