PolarSSL
|
00001 00025 #ifndef POLARSSL_X509_H 00026 #define POLARSSL_X509_H 00027 00028 #include "polarssl/rsa.h" 00029 00030 /* 00031 * ASN1 Error codes 00032 * 00033 * These error codes will be OR'ed to X509 error codes for 00034 * higher error granularity. 00035 */ 00036 #define POLARSSL_ERR_ASN1_OUT_OF_DATA 0x0014 00037 #define POLARSSL_ERR_ASN1_UNEXPECTED_TAG 0x0016 00038 #define POLARSSL_ERR_ASN1_INVALID_LENGTH 0x0018 00039 #define POLARSSL_ERR_ASN1_LENGTH_MISMATCH 0x001A 00040 #define POLARSSL_ERR_ASN1_INVALID_DATA 0x001C 00041 00042 /* 00043 * X509 Error codes 00044 */ 00045 #define POLARSSL_ERR_X509_FEATURE_UNAVAILABLE -0x0020 00046 #define POLARSSL_ERR_X509_CERT_INVALID_PEM -0x0040 00047 #define POLARSSL_ERR_X509_CERT_INVALID_FORMAT -0x0060 00048 #define POLARSSL_ERR_X509_CERT_INVALID_VERSION -0x0080 00049 #define POLARSSL_ERR_X509_CERT_INVALID_SERIAL -0x00A0 00050 #define POLARSSL_ERR_X509_CERT_INVALID_ALG -0x00C0 00051 #define POLARSSL_ERR_X509_CERT_INVALID_NAME -0x00E0 00052 #define POLARSSL_ERR_X509_CERT_INVALID_DATE -0x0100 00053 #define POLARSSL_ERR_X509_CERT_INVALID_PUBKEY -0x0120 00054 #define POLARSSL_ERR_X509_CERT_INVALID_SIGNATURE -0x0140 00055 #define POLARSSL_ERR_X509_CERT_INVALID_EXTENSIONS -0x0160 00056 #define POLARSSL_ERR_X509_CERT_UNKNOWN_VERSION -0x0180 00057 #define POLARSSL_ERR_X509_CERT_UNKNOWN_SIG_ALG -0x01A0 00058 #define POLARSSL_ERR_X509_CERT_UNKNOWN_PK_ALG -0x01C0 00059 #define POLARSSL_ERR_X509_CERT_SIG_MISMATCH -0x01E0 00060 #define POLARSSL_ERR_X509_CERT_VERIFY_FAILED -0x0200 00061 #define POLARSSL_ERR_X509_KEY_INVALID_PEM -0x0220 00062 #define POLARSSL_ERR_X509_KEY_INVALID_VERSION -0x0240 00063 #define POLARSSL_ERR_X509_KEY_INVALID_FORMAT -0x0260 00064 #define POLARSSL_ERR_X509_KEY_INVALID_ENC_IV -0x0280 00065 #define POLARSSL_ERR_X509_KEY_UNKNOWN_ENC_ALG -0x02A0 00066 #define POLARSSL_ERR_X509_KEY_PASSWORD_REQUIRED -0x02C0 00067 #define POLARSSL_ERR_X509_KEY_PASSWORD_MISMATCH -0x02E0 00068 #define POLARSSL_ERR_X509_POINT_ERROR -0x0300 00069 #define POLARSSL_ERR_X509_VALUE_TO_LENGTH -0x0320 00070 00071 /* 00072 * X509 Verify codes 00073 */ 00074 #define BADCERT_EXPIRED 1 00075 #define BADCERT_REVOKED 2 00076 #define BADCERT_CN_MISMATCH 4 00077 #define BADCERT_NOT_TRUSTED 8 00078 #define BADCRL_NOT_TRUSTED 16 00079 #define BADCRL_EXPIRED 32 00080 00081 /* 00082 * DER constants 00083 */ 00084 #define ASN1_BOOLEAN 0x01 00085 #define ASN1_INTEGER 0x02 00086 #define ASN1_BIT_STRING 0x03 00087 #define ASN1_OCTET_STRING 0x04 00088 #define ASN1_NULL 0x05 00089 #define ASN1_OID 0x06 00090 #define ASN1_UTF8_STRING 0x0C 00091 #define ASN1_SEQUENCE 0x10 00092 #define ASN1_SET 0x11 00093 #define ASN1_PRINTABLE_STRING 0x13 00094 #define ASN1_T61_STRING 0x14 00095 #define ASN1_IA5_STRING 0x16 00096 #define ASN1_UTC_TIME 0x17 00097 #define ASN1_GENERALIZED_TIME 0x18 00098 #define ASN1_UNIVERSAL_STRING 0x1C 00099 #define ASN1_BMP_STRING 0x1E 00100 #define ASN1_PRIMITIVE 0x00 00101 #define ASN1_CONSTRUCTED 0x20 00102 #define ASN1_CONTEXT_SPECIFIC 0x80 00103 00104 /* 00105 * various object identifiers 00106 */ 00107 #define X520_COMMON_NAME 3 00108 #define X520_COUNTRY 6 00109 #define X520_LOCALITY 7 00110 #define X520_STATE 8 00111 #define X520_ORGANIZATION 10 00112 #define X520_ORG_UNIT 11 00113 #define PKCS9_EMAIL 1 00114 00115 #define X509_OUTPUT_DER 0x01 00116 #define X509_OUTPUT_PEM 0x02 00117 #define PEM_LINE_LENGTH 72 00118 #define X509_ISSUER 0x01 00119 #define X509_SUBJECT 0x02 00120 00121 #define OID_X520 "\x55\x04" 00122 #define OID_CN "\x55\x04\x03" 00123 #define OID_PKCS1 "\x2A\x86\x48\x86\xF7\x0D\x01\x01" 00124 #define OID_PKCS1_RSA "\x2A\x86\x48\x86\xF7\x0D\x01\x01\x01" 00125 #define OID_RSA_SHA_OBS "\x2B\x0E\x03\x02\x1D" 00126 #define OID_PKCS9 "\x2A\x86\x48\x86\xF7\x0D\x01\x09" 00127 #define OID_PKCS9_EMAIL "\x2A\x86\x48\x86\xF7\x0D\x01\x09\x01" 00128 00129 /* 00130 * Structures for parsing X.509 certificates 00131 */ 00132 typedef struct _x509_buf 00133 { 00134 int tag; 00135 int len; 00136 unsigned char *p; 00137 } 00138 x509_buf; 00139 00140 typedef struct _x509_name 00141 { 00142 x509_buf oid; 00143 x509_buf val; 00144 struct _x509_name *next; 00145 } 00146 x509_name; 00147 00148 typedef struct _x509_time 00149 { 00150 int year, mon, day; 00151 int hour, min, sec; 00152 } 00153 x509_time; 00154 00155 typedef struct _x509_cert 00156 { 00157 x509_buf raw; 00158 x509_buf tbs; 00159 00160 int version; 00161 x509_buf serial; 00162 x509_buf sig_oid1; 00163 00164 x509_buf issuer_raw; 00165 x509_buf subject_raw; 00166 00167 x509_name issuer; 00168 x509_name subject; 00169 00170 x509_time valid_from; 00171 x509_time valid_to; 00172 00173 x509_buf pk_oid; 00174 rsa_context rsa; 00175 00176 x509_buf issuer_id; 00177 x509_buf subject_id; 00178 x509_buf v3_ext; 00179 00180 int ca_istrue; 00181 int max_pathlen; 00182 00183 x509_buf sig_oid2; 00184 x509_buf sig; 00185 int sig_alg; 00186 00187 struct _x509_cert *next; 00188 } 00189 x509_cert; 00190 00191 typedef struct _x509_crl_entry 00192 { 00193 x509_buf raw; 00194 00195 x509_buf serial; 00196 00197 x509_time revocation_date; 00198 00199 x509_buf entry_ext; 00200 00201 struct _x509_crl_entry *next; 00202 } 00203 x509_crl_entry; 00204 00205 typedef struct _x509_crl 00206 { 00207 x509_buf raw; 00208 x509_buf tbs; 00209 00210 int version; 00211 x509_buf sig_oid1; 00212 00213 x509_buf issuer_raw; 00214 00215 x509_name issuer; 00216 00217 x509_time this_update; 00218 x509_time next_update; 00219 00220 x509_crl_entry entry; 00221 00222 x509_buf crl_ext; 00223 00224 x509_buf sig_oid2; 00225 x509_buf sig; 00226 int sig_alg; 00227 00228 struct _x509_crl *next; 00229 } 00230 x509_crl; 00231 00232 /* 00233 * Structures for writing X.509 certificates 00234 */ 00235 typedef struct _x509_node 00236 { 00237 unsigned char *data; 00238 unsigned char *p; 00239 unsigned char *end; 00240 00241 size_t len; 00242 } 00243 x509_node; 00244 00245 typedef struct _x509_raw 00246 { 00247 x509_node raw; 00248 x509_node tbs; 00249 00250 x509_node version; 00251 x509_node serial; 00252 x509_node tbs_signalg; 00253 x509_node issuer; 00254 x509_node validity; 00255 x509_node subject; 00256 x509_node subpubkey; 00257 00258 x509_node signalg; 00259 x509_node sign; 00260 } 00261 x509_raw; 00262 00263 #ifdef __cplusplus 00264 extern "C" { 00265 #endif 00266 00277 int x509parse_crt( x509_cert *chain, const unsigned char *buf, int buflen ); 00278 00288 int x509parse_crtfile( x509_cert *chain, const char *path ); 00289 00300 int x509parse_crl( x509_crl *chain, const unsigned char *buf, int buflen ); 00301 00311 int x509parse_crlfile( x509_crl *chain, const char *path ); 00312 00324 int x509parse_key( rsa_context *rsa, 00325 const unsigned char *key, int keylen, 00326 const unsigned char *pwd, int pwdlen ); 00327 00337 int x509parse_keyfile( rsa_context *rsa, const char *path, 00338 const char *password ); 00339 00351 int x509parse_dn_gets( char *buf, size_t size, const x509_name *dn ); 00352 00365 int x509parse_cert_info( char *buf, size_t size, const char *prefix, 00366 const x509_cert *crt ); 00367 00380 int x509parse_crl_info( char *buf, size_t size, const char *prefix, 00381 const x509_crl *crl ); 00382 00392 int x509parse_time_expired( const x509_time *time ); 00393 00414 int x509parse_verify( x509_cert *crt, 00415 x509_cert *trust_ca, 00416 x509_crl *ca_crl, 00417 const char *cn, int *flags ); 00418 00424 void x509_free( x509_cert *crt ); 00425 00431 void x509_crl_free( x509_crl *crl ); 00432 00438 int x509_self_test( int verbose ); 00439 00440 #ifdef __cplusplus 00441 } 00442 #endif 00443 00444 #endif /* x509.h */