1 // Copyright 2015 The Chromium Authors 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #ifndef BSSL_PKI_CERTIFICATE_POLICIES_H_ 6 #define BSSL_PKI_CERTIFICATE_POLICIES_H_ 7 8 #include "fillins/openssl_util.h" 9 #include <stdint.h> 10 11 #include <vector> 12 13 14 #include "input.h" 15 #include <optional> 16 17 namespace bssl { 18 19 class CertErrors; 20 21 // Returns the DER-encoded OID, without tag or length, of the anyPolicy 22 // certificate policy defined in RFC 5280 section 4.2.1.4. 23 inline constexpr uint8_t kAnyPolicyOid[] = {0x55, 0x1D, 0x20, 0x00}; 24 25 // From RFC 5280: 26 // 27 // id-ce-inhibitAnyPolicy OBJECT IDENTIFIER ::= { id-ce 54 } 28 // 29 // In dotted notation: 2.5.29.54 30 inline constexpr uint8_t kInhibitAnyPolicyOid[] = {0x55, 0x1d, 0x36}; 31 32 // From RFC 5280: 33 // 34 // id-ce-policyMappings OBJECT IDENTIFIER ::= { id-ce 33 } 35 // 36 // In dotted notation: 2.5.29.33 37 inline constexpr uint8_t kPolicyMappingsOid[] = {0x55, 0x1d, 0x21}; 38 39 // -- policyQualifierIds for Internet policy qualifiers 40 // 41 // id-qt OBJECT IDENTIFIER ::= { id-pkix 2 } 42 // id-qt-cps OBJECT IDENTIFIER ::= { id-qt 1 } 43 // 44 // In dotted decimal form: 1.3.6.1.5.5.7.2.1 45 inline constexpr uint8_t kCpsPointerId[] = {0x2b, 0x06, 0x01, 0x05, 46 0x05, 0x07, 0x02, 0x01}; 47 48 // id-qt-unotice OBJECT IDENTIFIER ::= { id-qt 2 } 49 // 50 // In dotted decimal form: 1.3.6.1.5.5.7.2.2 51 inline constexpr uint8_t kUserNoticeId[] = {0x2b, 0x06, 0x01, 0x05, 52 0x05, 0x07, 0x02, 0x02}; 53 54 struct PolicyQualifierInfo { 55 der::Input qualifier_oid; 56 der::Input qualifier; 57 }; 58 59 struct OPENSSL_EXPORT PolicyInformation { 60 PolicyInformation(); 61 ~PolicyInformation(); 62 PolicyInformation(const PolicyInformation&); 63 PolicyInformation(PolicyInformation&&); 64 65 der::Input policy_oid; 66 std::vector<PolicyQualifierInfo> policy_qualifiers; 67 }; 68 69 // Parses a certificatePolicies extension and stores the policy information 70 // |*policies|, in the order presented in |extension_value|. 71 // 72 // Returns true on success. On failure returns false and may add errors to 73 // |errors|, which must be non-null. 74 // 75 // The values in |policies| are only valid as long as |extension_value| is (as 76 // it references data). 77 OPENSSL_EXPORT bool ParseCertificatePoliciesExtension( 78 const der::Input& extension_value, 79 std::vector<PolicyInformation>* policies, 80 CertErrors* errors); 81 82 // Parses a certificatePolicies extension and stores the policy OIDs in 83 // |*policy_oids|, in sorted order. 84 // 85 // If policyQualifiers for User Notice or CPS are present then they are 86 // ignored (RFC 5280 section 4.2.1.4 says "optional qualifiers, which MAY 87 // be present, are not expected to change the definition of the policy." 88 // 89 // If a policy qualifier other than User Notice/CPS is present, parsing 90 // will fail if |fail_parsing_unknown_qualifier_oids| was set to true, 91 // otherwise the unrecognized qualifiers wil be skipped and not parsed 92 // any further. 93 // 94 // Returns true on success. On failure returns false and may add errors to 95 // |errors|, which must be non-null. 96 // 97 // The values in |policy_oids| are only valid as long as |extension_value| is 98 // (as it references data). 99 OPENSSL_EXPORT bool ParseCertificatePoliciesExtensionOids( 100 const der::Input& extension_value, 101 bool fail_parsing_unknown_qualifier_oids, 102 std::vector<der::Input>* policy_oids, 103 CertErrors* errors); 104 105 struct ParsedPolicyConstraints { 106 std::optional<uint8_t> require_explicit_policy; 107 108 std::optional<uint8_t> inhibit_policy_mapping; 109 }; 110 111 // Parses a PolicyConstraints SEQUENCE as defined by RFC 5280. Returns true on 112 // success, and sets |out|. 113 [[nodiscard]] OPENSSL_EXPORT bool ParsePolicyConstraints( 114 const der::Input& policy_constraints_tlv, 115 ParsedPolicyConstraints* out); 116 117 // Parses an InhibitAnyPolicy as defined by RFC 5280. Returns num certs on 118 // success, or empty if parser fails. 119 [[nodiscard]] OPENSSL_EXPORT std::optional<uint8_t> ParseInhibitAnyPolicy( 120 const der::Input& inhibit_any_policy_tlv); 121 122 struct ParsedPolicyMapping { 123 der::Input issuer_domain_policy; 124 der::Input subject_domain_policy; 125 }; 126 127 // Parses a PolicyMappings SEQUENCE as defined by RFC 5280. Returns true on 128 // success, and sets |mappings|. 129 [[nodiscard]] OPENSSL_EXPORT bool ParsePolicyMappings( 130 const der::Input& policy_mappings_tlv, 131 std::vector<ParsedPolicyMapping>* mappings); 132 133 } // namespace net 134 135 #endif // BSSL_PKI_CERTIFICATE_POLICIES_H_ 136