1 /*
2 * X.509v3 certificate parsing and processing
3 * Copyright (c) 2006, Jouni Malinen <j@w1.fi>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
8 *
9 * Alternatively, this software may be distributed under the terms of BSD
10 * license.
11 *
12 * See README and COPYING for more details.
13 */
14
15 #ifndef X509V3_H
16 #define X509V3_H
17
18 #include "asn1.h"
19
20 struct x509_algorithm_identifier {
21 struct asn1_oid oid;
22 };
23
24 struct x509_name {
25 char *cn; /* commonName */
26 char *c; /* countryName */
27 char *l; /* localityName */
28 char *st; /* stateOrProvinceName */
29 char *o; /* organizationName */
30 char *ou; /* organizationalUnitName */
31 char *email; /* emailAddress */
32 };
33
34 struct x509_certificate {
35 struct x509_certificate *next;
36 enum { X509_CERT_V1 = 0, X509_CERT_V2 = 1, X509_CERT_V3 = 2 } version;
37 unsigned long serial_number;
38 struct x509_algorithm_identifier signature;
39 struct x509_name issuer;
40 struct x509_name subject;
41 os_time_t not_before;
42 os_time_t not_after;
43 struct x509_algorithm_identifier public_key_alg;
44 u8 *public_key;
45 size_t public_key_len;
46 struct x509_algorithm_identifier signature_alg;
47 u8 *sign_value;
48 size_t sign_value_len;
49
50 /* Extensions */
51 unsigned int extensions_present;
52 #define X509_EXT_BASIC_CONSTRAINTS (1 << 0)
53 #define X509_EXT_PATH_LEN_CONSTRAINT (1 << 1)
54 #define X509_EXT_KEY_USAGE (1 << 2)
55
56 /* BasicConstraints */
57 int ca; /* cA */
58 unsigned long path_len_constraint; /* pathLenConstraint */
59
60 /* KeyUsage */
61 unsigned long key_usage;
62 #define X509_KEY_USAGE_DIGITAL_SIGNATURE (1 << 0)
63 #define X509_KEY_USAGE_NON_REPUDIATION (1 << 1)
64 #define X509_KEY_USAGE_KEY_ENCIPHERMENT (1 << 2)
65 #define X509_KEY_USAGE_DATA_ENCIPHERMENT (1 << 3)
66 #define X509_KEY_USAGE_KEY_AGREEMENT (1 << 4)
67 #define X509_KEY_USAGE_KEY_CERT_SIGN (1 << 5)
68 #define X509_KEY_USAGE_CRL_SIGN (1 << 6)
69 #define X509_KEY_USAGE_ENCIPHER_ONLY (1 << 7)
70 #define X509_KEY_USAGE_DECIPHER_ONLY (1 << 8)
71
72 /*
73 * The DER format certificate follows struct x509_certificate. These
74 * pointers point to that buffer.
75 */
76 const u8 *cert_start;
77 size_t cert_len;
78 const u8 *tbs_cert_start;
79 size_t tbs_cert_len;
80 };
81
82 enum {
83 X509_VALIDATE_OK,
84 X509_VALIDATE_BAD_CERTIFICATE,
85 X509_VALIDATE_UNSUPPORTED_CERTIFICATE,
86 X509_VALIDATE_CERTIFICATE_REVOKED,
87 X509_VALIDATE_CERTIFICATE_EXPIRED,
88 X509_VALIDATE_CERTIFICATE_UNKNOWN,
89 X509_VALIDATE_UNKNOWN_CA
90 };
91
92 #ifdef CONFIG_INTERNAL_X509
93
94 void x509_certificate_free(struct x509_certificate *cert);
95 struct x509_certificate * x509_certificate_parse(const u8 *buf, size_t len);
96 void x509_name_string(struct x509_name *name, char *buf, size_t len);
97 int x509_name_compare(struct x509_name *a, struct x509_name *b);
98 void x509_certificate_chain_free(struct x509_certificate *cert);
99 int x509_certificate_check_signature(struct x509_certificate *issuer,
100 struct x509_certificate *cert);
101 int x509_certificate_chain_validate(struct x509_certificate *trusted,
102 struct x509_certificate *chain,
103 int *reason);
104 struct x509_certificate *
105 x509_certificate_get_subject(struct x509_certificate *chain,
106 struct x509_name *name);
107 int x509_certificate_self_signed(struct x509_certificate *cert);
108
109 #else /* CONFIG_INTERNAL_X509 */
110
x509_certificate_free(struct x509_certificate * cert)111 static inline void x509_certificate_free(struct x509_certificate *cert)
112 {
113 }
114
115 static inline struct x509_certificate *
x509_certificate_parse(const u8 * buf,size_t len)116 x509_certificate_parse(const u8 *buf, size_t len)
117 {
118 return NULL;
119 }
120
x509_name_string(struct x509_name * name,char * buf,size_t len)121 static inline void x509_name_string(struct x509_name *name, char *buf,
122 size_t len)
123 {
124 if (len)
125 buf[0] = '\0';
126 }
127
x509_certificate_chain_free(struct x509_certificate * cert)128 static inline void x509_certificate_chain_free(struct x509_certificate *cert)
129 {
130 }
131
132 static inline int
x509_certificate_chain_validate(struct x509_certificate * trusted,struct x509_certificate * chain,int * reason)133 x509_certificate_chain_validate(struct x509_certificate *trusted,
134 struct x509_certificate *chain,
135 int *reason)
136 {
137 return -1;
138 }
139
140 static inline struct x509_certificate *
x509_certificate_get_subject(struct x509_certificate * chain,struct x509_name * name)141 x509_certificate_get_subject(struct x509_certificate *chain,
142 struct x509_name *name)
143 {
144 return NULL;
145 }
146
x509_certificate_self_signed(struct x509_certificate * cert)147 static inline int x509_certificate_self_signed(struct x509_certificate *cert)
148 {
149 return -1;
150 }
151
152 #endif /* CONFIG_INTERNAL_X509 */
153
154 #endif /* X509V3_H */
155