2 * X.509v3 certificate parsing and processing
3 * Copyright (c) 2006, Jouni Malinen <j@w1.fi>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
9 * Alternatively, this software may be distributed under the terms of BSD
12 * See README and COPYING for more details.
20 struct x509_algorithm_identifier
{
24 struct x509_name_attr
{
25 enum x509_name_attr_type
{
26 X509_NAME_ATTR_NOT_USED
,
38 #define X509_MAX_NAME_ATTRIBUTES 20
41 struct x509_name_attr attr
[X509_MAX_NAME_ATTRIBUTES
];
43 char *email
; /* emailAddress */
45 /* from alternative name extension */
46 char *alt_email
; /* rfc822Name */
47 char *dns
; /* dNSName */
48 char *uri
; /* uniformResourceIdentifier */
49 u8
*ip
; /* iPAddress */
50 size_t ip_len
; /* IPv4: 4, IPv6: 16 */
51 struct asn1_oid rid
; /* registeredID */
54 struct x509_certificate
{
55 struct x509_certificate
*next
;
56 enum { X509_CERT_V1
= 0, X509_CERT_V2
= 1, X509_CERT_V3
= 2 } version
;
57 unsigned long serial_number
;
58 struct x509_algorithm_identifier signature
;
59 struct x509_name issuer
;
60 struct x509_name subject
;
63 struct x509_algorithm_identifier public_key_alg
;
65 size_t public_key_len
;
66 struct x509_algorithm_identifier signature_alg
;
68 size_t sign_value_len
;
71 unsigned int extensions_present
;
72 #define X509_EXT_BASIC_CONSTRAINTS (1 << 0)
73 #define X509_EXT_PATH_LEN_CONSTRAINT (1 << 1)
74 #define X509_EXT_KEY_USAGE (1 << 2)
75 #define X509_EXT_SUBJECT_ALT_NAME (1 << 3)
76 #define X509_EXT_ISSUER_ALT_NAME (1 << 4)
78 /* BasicConstraints */
80 unsigned long path_len_constraint
; /* pathLenConstraint */
83 unsigned long key_usage
;
84 #define X509_KEY_USAGE_DIGITAL_SIGNATURE (1 << 0)
85 #define X509_KEY_USAGE_NON_REPUDIATION (1 << 1)
86 #define X509_KEY_USAGE_KEY_ENCIPHERMENT (1 << 2)
87 #define X509_KEY_USAGE_DATA_ENCIPHERMENT (1 << 3)
88 #define X509_KEY_USAGE_KEY_AGREEMENT (1 << 4)
89 #define X509_KEY_USAGE_KEY_CERT_SIGN (1 << 5)
90 #define X509_KEY_USAGE_CRL_SIGN (1 << 6)
91 #define X509_KEY_USAGE_ENCIPHER_ONLY (1 << 7)
92 #define X509_KEY_USAGE_DECIPHER_ONLY (1 << 8)
95 * The DER format certificate follows struct x509_certificate. These
96 * pointers point to that buffer.
100 const u8
*tbs_cert_start
;
106 X509_VALIDATE_BAD_CERTIFICATE
,
107 X509_VALIDATE_UNSUPPORTED_CERTIFICATE
,
108 X509_VALIDATE_CERTIFICATE_REVOKED
,
109 X509_VALIDATE_CERTIFICATE_EXPIRED
,
110 X509_VALIDATE_CERTIFICATE_UNKNOWN
,
111 X509_VALIDATE_UNKNOWN_CA
114 void x509_certificate_free(struct x509_certificate
*cert
);
115 struct x509_certificate
* x509_certificate_parse(const u8
*buf
, size_t len
);
116 void x509_name_string(struct x509_name
*name
, char *buf
, size_t len
);
117 int x509_name_compare(struct x509_name
*a
, struct x509_name
*b
);
118 void x509_certificate_chain_free(struct x509_certificate
*cert
);
119 int x509_certificate_check_signature(struct x509_certificate
*issuer
,
120 struct x509_certificate
*cert
);
121 int x509_certificate_chain_validate(struct x509_certificate
*trusted
,
122 struct x509_certificate
*chain
,
124 struct x509_certificate
*
125 x509_certificate_get_subject(struct x509_certificate
*chain
,
126 struct x509_name
*name
);
127 int x509_certificate_self_signed(struct x509_certificate
*cert
);
129 #endif /* X509V3_H */