1 /* 2 * X.509v3 certificate parsing and processing 3 * Copyright (c) 2006, Jouni Malinen <j@w1.fi> 4 * 5 * This program is free software; you can redistribute it and/or modify 6 * it under the terms of the GNU General Public License version 2 as 7 * published by the Free Software Foundation. 8 * 9 * Alternatively, this software may be distributed under the terms of BSD 10 * license. 11 * 12 * See README and COPYING for more details. 13 */ 14 15 #ifndef X509V3_H 16 #define X509V3_H 17 18 #include "asn1.h" 19 20 struct x509_algorithm_identifier { 21 struct asn1_oid oid; 22 }; 23 24 struct x509_name { 25 char *cn; /* commonName */ 26 char *c; /* countryName */ 27 char *l; /* localityName */ 28 char *st; /* stateOrProvinceName */ 29 char *o; /* organizationName */ 30 char *ou; /* organizationalUnitName */ 31 char *email; /* emailAddress */ 32 }; 33 34 struct x509_certificate { 35 struct x509_certificate *next; 36 enum { X509_CERT_V1 = 0, X509_CERT_V2 = 1, X509_CERT_V3 = 2 } version; 37 unsigned long serial_number; 38 struct x509_algorithm_identifier signature; 39 struct x509_name issuer; 40 struct x509_name subject; 41 os_time_t not_before; 42 os_time_t not_after; 43 struct x509_algorithm_identifier public_key_alg; 44 u8 *public_key; 45 size_t public_key_len; 46 struct x509_algorithm_identifier signature_alg; 47 u8 *sign_value; 48 size_t sign_value_len; 49 50 /* Extensions */ 51 unsigned int extensions_present; 52 #define X509_EXT_BASIC_CONSTRAINTS (1 << 0) 53 #define X509_EXT_PATH_LEN_CONSTRAINT (1 << 1) 54 #define X509_EXT_KEY_USAGE (1 << 2) 55 56 /* BasicConstraints */ 57 int ca; /* cA */ 58 unsigned long path_len_constraint; /* pathLenConstraint */ 59 60 /* KeyUsage */ 61 unsigned long key_usage; 62 #define X509_KEY_USAGE_DIGITAL_SIGNATURE (1 << 0) 63 #define X509_KEY_USAGE_NON_REPUDIATION (1 << 1) 64 #define X509_KEY_USAGE_KEY_ENCIPHERMENT (1 << 2) 65 #define X509_KEY_USAGE_DATA_ENCIPHERMENT (1 << 3) 66 #define X509_KEY_USAGE_KEY_AGREEMENT (1 << 4) 67 #define X509_KEY_USAGE_KEY_CERT_SIGN (1 << 5) 68 #define X509_KEY_USAGE_CRL_SIGN (1 << 6) 69 #define X509_KEY_USAGE_ENCIPHER_ONLY (1 << 7) 70 #define X509_KEY_USAGE_DECIPHER_ONLY (1 << 8) 71 72 /* 73 * The DER format certificate follows struct x509_certificate. These 74 * pointers point to that buffer. 75 */ 76 const u8 *cert_start; 77 size_t cert_len; 78 const u8 *tbs_cert_start; 79 size_t tbs_cert_len; 80 }; 81 82 enum { 83 X509_VALIDATE_OK, 84 X509_VALIDATE_BAD_CERTIFICATE, 85 X509_VALIDATE_UNSUPPORTED_CERTIFICATE, 86 X509_VALIDATE_CERTIFICATE_REVOKED, 87 X509_VALIDATE_CERTIFICATE_EXPIRED, 88 X509_VALIDATE_CERTIFICATE_UNKNOWN, 89 X509_VALIDATE_UNKNOWN_CA 90 }; 91 92 #ifdef CONFIG_INTERNAL_X509 93 94 void x509_certificate_free(struct x509_certificate *cert); 95 struct x509_certificate * x509_certificate_parse(const u8 *buf, size_t len); 96 void x509_name_string(struct x509_name *name, char *buf, size_t len); 97 int x509_name_compare(struct x509_name *a, struct x509_name *b); 98 void x509_certificate_chain_free(struct x509_certificate *cert); 99 int x509_certificate_check_signature(struct x509_certificate *issuer, 100 struct x509_certificate *cert); 101 int x509_certificate_chain_validate(struct x509_certificate *trusted, 102 struct x509_certificate *chain, 103 int *reason); 104 struct x509_certificate * 105 x509_certificate_get_subject(struct x509_certificate *chain, 106 struct x509_name *name); 107 int x509_certificate_self_signed(struct x509_certificate *cert); 108 109 #else /* CONFIG_INTERNAL_X509 */ 110 111 static inline void x509_certificate_free(struct x509_certificate *cert) 112 { 113 } 114 115 static inline struct x509_certificate * 116 x509_certificate_parse(const u8 *buf, size_t len) 117 { 118 return NULL; 119 } 120 121 static inline void x509_name_string(struct x509_name *name, char *buf, 122 size_t len) 123 { 124 if (len) 125 buf[0] = '\0'; 126 } 127 128 static inline void x509_certificate_chain_free(struct x509_certificate *cert) 129 { 130 } 131 132 static inline int 133 x509_certificate_chain_validate(struct x509_certificate *trusted, 134 struct x509_certificate *chain, 135 int *reason) 136 { 137 return -1; 138 } 139 140 static inline struct x509_certificate * 141 x509_certificate_get_subject(struct x509_certificate *chain, 142 struct x509_name *name) 143 { 144 return NULL; 145 } 146 147 static inline int x509_certificate_self_signed(struct x509_certificate *cert) 148 { 149 return -1; 150 } 151 152 #endif /* CONFIG_INTERNAL_X509 */ 153 154 #endif /* X509V3_H */ 155