2 * Copyright (c) 2004 - 2007 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36 #ifndef HEIMDAL_HX509_H
37 #define HEIMDAL_HX509_H 1
39 #include <rfc2459_asn1.h>
40 #include <rfc4108_asn1.h>
45 typedef struct hx509_cert_attribute_data
*hx509_cert_attribute
;
46 typedef struct hx509_cert_data
*hx509_cert
;
47 typedef struct hx509_certs_data
*hx509_certs
;
48 typedef struct hx509_context_data
*hx509_context
;
49 typedef struct hx509_crypto_data
*hx509_crypto
;
50 typedef struct hx509_lock_data
*hx509_lock
;
51 typedef struct hx509_name_data
*hx509_name
;
52 typedef struct hx509_private_key
*hx509_private_key
;
53 typedef struct hx509_private_key_ops hx509_private_key_ops
;
54 typedef struct hx509_validate_ctx_data
*hx509_validate_ctx
;
55 typedef struct hx509_verify_ctx_data
*hx509_verify_ctx
;
56 typedef struct hx509_revoke_ctx_data
*hx509_revoke_ctx
;
57 typedef struct hx509_query_data hx509_query
;
58 typedef void * hx509_cursor
;
59 typedef struct hx509_request_data
*hx509_request
;
60 typedef struct hx509_error_data
*hx509_error
;
61 typedef struct hx509_peer_info
*hx509_peer_info
;
62 typedef struct hx509_ca_tbs
*hx509_ca_tbs
;
63 typedef struct hx509_env_data
*hx509_env
;
64 typedef struct hx509_crl
*hx509_crl
;
66 typedef void (*hx509_vprint_func
)(void *, const char *, va_list);
69 HX509_SAN_TYPE_UNSUPPORTED
= 0,
70 /* The following correspond to the enum GeneralName_enum values: */
71 HX509_SAN_TYPE_EMAIL
= 2,
72 HX509_SAN_TYPE_DNSNAME
= 3,
73 HX509_SAN_TYPE_DN
= 4,
74 HX509_SAN_TYPE_REGISTERED_ID
= 7,
76 * Missing support for:
79 * - various otherName SANs we know about (e.g., DNSSRV)
81 * The following are otherName SAN types, and assigned manually here:
83 HX509_SAN_TYPE_XMPP
= 32,
84 HX509_SAN_TYPE_PKINIT
= 33,
85 HX509_SAN_TYPE_MS_UPN
= 34,
86 HX509_SAN_TYPE_DNSSRV
= 35, /* SRVName [RFC4985] */
87 HX509_SAN_TYPE_PERMANENT_ID
= 36, /* PermanentIdentifier [RFC4043] */
88 HX509_SAN_TYPE_HW_MODULE
= 37, /* HardwareModuleName [RFC4108] */
92 HX509_VHN_F_ALLOW_NO_MATCH
= 1
96 HX509_VALIDATE_F_VALIDATE
= 1,
97 HX509_VALIDATE_F_VERBOSE
= 2
101 HX509_CRYPTO_PADDING_PKCS7
= 0,
102 HX509_CRYPTO_PADDING_NONE
= 1
106 HX509_KEY_FORMAT_GUESS
= 0,
107 HX509_KEY_FORMAT_DER
= 1,
108 HX509_KEY_FORMAT_WIN_BACKUPKEY
= 2,
109 HX509_KEY_FORMAT_PKCS8
= 3,
111 typedef uint32_t hx509_key_format_t
;
113 struct hx509_cert_attribute_data
{
115 heim_octet_string data
;
119 HX509_PROMPT_TYPE_PASSWORD
= 0x1, /* password, hidden */
120 HX509_PROMPT_TYPE_QUESTION
= 0x2, /* question, not hidden */
121 HX509_PROMPT_TYPE_INFO
= 0x4 /* infomation, reply doesn't matter */
124 typedef struct hx509_prompt
{
126 hx509_prompt_type type
;
127 heim_octet_string reply
;
130 typedef int (*hx509_prompter_fct
)(void *, const hx509_prompt
*);
132 typedef struct hx509_octet_string_list
{
134 heim_octet_string
*val
;
135 } hx509_octet_string_list
;
137 typedef struct hx509_pem_header
{
138 struct hx509_pem_header
*next
;
144 (*hx509_pem_read_func
)(hx509_context
, const char *, const hx509_pem_header
*,
145 const void *, size_t, void *ctx
);
148 * Options passed to hx509_query_match_option.
151 HX509_QUERY_OPTION_PRIVATE_KEY
= 1,
152 HX509_QUERY_OPTION_KU_ENCIPHERMENT
= 2,
153 HX509_QUERY_OPTION_KU_DIGITALSIGNATURE
= 3,
154 HX509_QUERY_OPTION_KU_KEYCERTSIGN
= 4,
155 HX509_QUERY_OPTION_END
= 0xffff
156 } hx509_query_option
;
158 /* flags to hx509_certs_init */
159 #define HX509_CERTS_CREATE 0x01
160 #define HX509_CERTS_UNPROTECT_ALL 0x02
161 #define HX509_CERTS_NO_PRIVATE_KEYS 0x04
163 /* flags to hx509_certs_store */
164 #define HX509_CERTS_STORE_NO_PRIVATE_KEYS 0x04
165 #define HX509_CERTS_STORE_NO_ROOTS 0x08
168 /* flags to hx509_set_error_string */
169 #define HX509_ERROR_APPEND 0x01
171 /* flags to hx509_cms_unenvelope */
172 #define HX509_CMS_UE_DONT_REQUIRE_KU_ENCIPHERMENT 0x01
173 #define HX509_CMS_UE_ALLOW_WEAK 0x02
175 /* flags to hx509_cms_envelope_1 */
176 #define HX509_CMS_EV_NO_KU_CHECK 0x01
177 #define HX509_CMS_EV_ALLOW_WEAK 0x02
178 #define HX509_CMS_EV_ID_NAME 0x04
180 /* flags to hx509_cms_verify_signed */
181 #define HX509_CMS_VS_ALLOW_DATA_OID_MISMATCH 0x01
182 #define HX509_CMS_VS_NO_KU_CHECK 0x02
183 #define HX509_CMS_VS_ALLOW_ZERO_SIGNER 0x04
184 #define HX509_CMS_VS_NO_VALIDATE 0x08
186 /* flags from hx509_cms_verify_signed_ext (out verify_flags) */
187 #define HX509_CMS_VSE_VALIDATED 0x01
189 /* selectors passed to hx509_crypto_select and hx509_crypto_available */
190 #define HX509_SELECT_ALL 0
191 #define HX509_SELECT_DIGEST 1
192 #define HX509_SELECT_PUBLIC_SIG 2
193 #define HX509_SELECT_PUBLIC_ENC 3
194 #define HX509_SELECT_SECRET_ENC 4
196 /* flags to hx509_ca_tbs_set_template */
197 #define HX509_CA_TEMPLATE_SUBJECT 1
198 #define HX509_CA_TEMPLATE_SERIAL 2
199 #define HX509_CA_TEMPLATE_NOTBEFORE 4
200 #define HX509_CA_TEMPLATE_NOTAFTER 8
201 #define HX509_CA_TEMPLATE_SPKI 16
202 #define HX509_CA_TEMPLATE_KU 32
203 #define HX509_CA_TEMPLATE_EKU 64
204 #define HX509_CA_TEMPLATE_PKINIT_MAX_LIFE 128
206 /* flags hx509_cms_create_signed* */
207 #define HX509_CMS_SIGNATURE_DETACHED 0x01
208 #define HX509_CMS_SIGNATURE_ID_NAME 0x02
209 #define HX509_CMS_SIGNATURE_NO_SIGNER 0x04
210 #define HX509_CMS_SIGNATURE_LEAF_ONLY 0x08
211 #define HX509_CMS_SIGNATURE_NO_CERTS 0x10
213 /* hx509_verify_hostname nametype */
215 HX509_HN_HOSTNAME
= 0,
217 } hx509_hostname_type
;
219 #include <hx509-protos.h>
220 #include <hx509_err.h>
222 #endif /* HEIMDAL_HX509_H */