13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync/** @file
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * IPRT - Crypto - Trust Anchor Format (RFC-5914).
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync/*
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * Copyright (C) 2006-2014 Oracle Corporation
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync *
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * This file is part of VirtualBox Open Source Edition (OSE), as
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * available from http://www.virtualbox.org. This file is free software;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * you can redistribute it and/or modify it under the terms of the GNU
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * General Public License (GPL) as published by the Free Software
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * Foundation, in version 2 as it comes in the "COPYING" file of the
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync *
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * The contents of this file may alternatively be used under the terms
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * of the Common Development and Distribution License Version 1.0
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * (CDDL) only, as it comes in the "COPYING.CDDL" file of the
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * VirtualBox OSE distribution, in which case the provisions of the
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * CDDL are applicable instead of those of the GPL.
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync *
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * You may elect to license modified versions of this file under the
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * terms and conditions of either the GPL or the CDDL or both.
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync#ifndef ___iprt_crypto_taf_h
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync#define ___iprt_crypto_taf_h
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync#include <iprt/asn1.h>
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync#include <iprt/crypto/x509.h>
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsyncRT_C_DECLS_BEGIN
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync/** @defgroup grp_rt_crtaf RTCrTaf - Trust Anchor Format (RFC-5914)
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * @ingroup grp_rt_crypto
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * @{
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync/**
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * RFC-5914 CertPathControls (IPRT representation).
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsynctypedef struct RTCRTAFCERTPATHCONTROLS
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync{
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /** Sequence core. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync RTASN1SEQUENCECORE SeqCore;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /** The trust anchor subject. For use in path construction. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync RTCRX509NAME TaName;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /** Certificate, optional, implicit tag 0. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync RTCRX509CERTIFICATE Certificate;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /** Certificate policies, optional, implicit tag 1.
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * @remarks This is an ASN.1 SEQUENCE, not an ASN.1 SET as the name
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * mistakenly might be taken to indicate. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync RTCRX509CERTIFICATEPOLICIES PolicySet;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /** Policy flags, optional, implicit tag 2. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync RTASN1BITSTRING PolicyFlags;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /** Name constraints, optional, implicit tag 3. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync RTCRX509NAMECONSTRAINTS NameConstr;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /** Path length constraints, optional, implicit tag 4. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync RTASN1INTEGER PathLenConstraint;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync} RTCRTAFCERTPATHCONTROLS;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync/** Pointer to the IPRT representation of a RFC-5914 CertPathControls. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsynctypedef RTCRTAFCERTPATHCONTROLS *PRTCRTAFCERTPATHCONTROLS;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync/** Pointer to the const IPRT representation of a RFC-5914 CertPathControls. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsynctypedef RTCRTAFCERTPATHCONTROLS const *PCRTCRTAFCERTPATHCONTROLS;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsyncRTASN1TYPE_STANDARD_PROTOTYPES(RTCRTAFCERTPATHCONTROLS, RTDECL, RTCrTafCertPathControls, SeqCore.Asn1Core);
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync/** @name Bit definitions for RTCRTAFCERTPATHCONTROL::PolicyFlags
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * @{ */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync#define RTCRTAFCERTPOLICYFLAGS_INHIBIT_POLICY_MAPPING 0
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync#define RTCRTAFCERTPOLICYFLAGS_REQUIRE_EXPLICIT_POLICY 1
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync#define RTCRTAFCERTPOLICYFLAGS_INHIBIT_ANY_POLICY 2
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync/** @} */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync/**
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * RFC-5914 TrustAnchorInfo (IPRT representation).
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsynctypedef struct RTCRTAFTRUSTANCHORINFO
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync{
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /** Sequence core. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync RTASN1SEQUENCECORE SeqCore;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /** The version number (defaults to v1). */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync RTASN1INTEGER Version;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /** The public key of the trust anchor. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync RTCRX509SUBJECTPUBLICKEYINFO PubKey;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /** Key identifier. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync RTASN1OCTETSTRING KeyIdentifier;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /** Trust anchor title, optional, size 1 to 64. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync RTASN1STRING TaTitle;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /** Certificate path controls, optional. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync RTCRTAFCERTPATHCONTROLS CertPath;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /** Extensions, explicit optional, context tag 1. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync struct
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync {
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /** Context tag 1. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync RTASN1CONTEXTTAG1 CtxTag1;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /** The extensions. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync RTCRX509EXTENSIONS Exts;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync } T1;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /** Title language tag, implicit optional, context tag 2.
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * Defaults to "en". */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync RTASN1STRING TaTitleLangTag;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync} RTCRTAFTRUSTANCHORINFO;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync/** Pointer to the IPRT representation of a RFC-5914 TrustAnchorInfo. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsynctypedef RTCRTAFTRUSTANCHORINFO *PRTCRTAFTRUSTANCHORINFO;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync/** Pointer to the const IPRT representation of a RFC-5914 TrustAnchorInfo. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsynctypedef RTCRTAFTRUSTANCHORINFO const *PCRTCRTAFTRUSTANCHORINFO;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsyncRTASN1TYPE_STANDARD_PROTOTYPES(RTCRTAFTRUSTANCHORINFO, RTDECL, RTCrTafTrustAnchorInfo, SeqCore.Asn1Core);
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync/** TrustAnchorInfo version 1. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync#define RTCRTAFTRUSTANCHORINFO_V1 1
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync/** Indicates what kind of value a TrustAnchorChoice structure contains. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsynctypedef enum RTCRTAFTRUSTANCHORCHOICEVAL
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync{
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /** Invalid zero value. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync RTCRTAFTRUSTANCHORCHOICEVAL_INVALID = 0,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /** RTCRTAFTRUSTANCHORCHOICE::u.pCertificate. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync RTCRTAFTRUSTANCHORCHOICEVAL_CERTIFICATE,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /** RTCRTAFTRUSTANCHORCHOICE::u.pT1. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync RTCRTAFTRUSTANCHORCHOICEVAL_TBS_CERTIFICATE,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /** RTCRTAFTRUSTANCHORCHOICE::u.pT2. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync RTCRTAFTRUSTANCHORCHOICEVAL_TRUST_ANCHOR_INFO,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /** End of valid choices. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync RTCRTAFTRUSTANCHORCHOICEVAL_END,
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /** Make sure it's (at least) 32-bit wide. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync RTCRTAFTRUSTANCHORCHOICEVAL_32BIT_HACK = 0x7fffffff
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync} RTCRTAFTRUSTANCHORCHOICEVAL;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync/**
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * RFC-5914 TrustAnchorChoice (IPRT representation).
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsynctypedef struct RTCRTAFTRUSTANCHORCHOICE
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync{
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /** Dummy object for simplifying everything. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync RTASN1DUMMY Dummy;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /** Allocation for the valid member (to optimize space usage). */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync RTASN1ALLOCATION Allocation;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /** Indicates which of the pointers are valid. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync RTCRTAFTRUSTANCHORCHOICEVAL enmChoice;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /** Choice union. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync union
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync {
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /** Generic ASN.1 core pointer for the choice. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync PRTASN1CORE pAsn1Core;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /** Choice 0: X509 certificate. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync PRTCRX509CERTIFICATE pCertificate;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /** Choice 1: To-be-signed certificate part. This may differ from the
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * TBSCertificate member of the original certificate. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync struct
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync {
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /** Explicit context tag. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync RTASN1CONTEXTTAG1 CtxTag1;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /** Pointer to the TBS certificate structure. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync RTCRX509TBSCERTIFICATE TbsCert;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync } *pT1;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /** Choice 2: To-be-signed certificate part. This may differ from the
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * TBSCertificate member of the original certificate. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync struct
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync {
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /** Explicit context tag. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync RTASN1CONTEXTTAG2 CtxTag2;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync /** Pointer to the trust anchor infomration structure. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync RTCRTAFTRUSTANCHORINFO TaInfo;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync } *pT2;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync } u;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync} RTCRTAFTRUSTANCHORCHOICE;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync/** Pointer to the IPRT representation of a RFC-5914 TrustAnchorChoice. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsynctypedef RTCRTAFTRUSTANCHORCHOICE *PRTCRTAFTRUSTANCHORCHOICE;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync/** Pointer to the const IPRT representation of a RFC-5914 TrustAnchorChoice. */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsynctypedef RTCRTAFTRUSTANCHORCHOICE const *PCRTCRTAFTRUSTANCHORCHOICE;
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsyncRTASN1TYPE_STANDARD_PROTOTYPES(RTCRTAFTRUSTANCHORCHOICE, RTDECL, RTCrTafTrustAnchorChoice, Dummy.Asn1Core);
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync/*
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync * RFC-5914 TrustAnchorList (IPRT representation).
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsyncRTASN1_IMPL_GEN_SEQ_OF_TYPEDEFS_AND_PROTOS(RTCRTAFTRUSTANCHORLIST, RTCRTAFTRUSTANCHORCHOICE, RTDECL, RTCrTafTrustAnchorList);
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync/** @} */
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsyncRT_C_DECLS_END
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync#endif
13493ab7596e827b8d0caab2c89e635dd65f78f9vboxsync