x509.h revision 4ee2f4fc8e99dc69ba5d63fd7dd3f52a38d0501e
/** @file
* IPRT - Crypto - X.509, Public Key and Privilege Management Infrastructure.
*/
/*
* Copyright (C) 2014 Oracle Corporation
*
* This file is part of VirtualBox Open Source Edition (OSE), as
* available from http://www.virtualbox.org. This file is free software;
* General Public License (GPL) as published by the Free Software
* Foundation, in version 2 as it comes in the "COPYING" file of the
* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
*
* The contents of this file may alternatively be used under the terms
* of the Common Development and Distribution License Version 1.0
* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
* VirtualBox OSE distribution, in which case the provisions of the
* CDDL are applicable instead of those of the GPL.
*
* You may elect to license modified versions of this file under the
* terms and conditions of either the GPL or the CDDL or both.
*/
#ifndef ___iprt_crypto_x509_h
#define ___iprt_crypto_x509_h
/** @defgroup grp_rt_crypto Crypto
* @ingroup grp_rt
* @{
*/
/** @defgroup grp_rt_crx509 RTCrX509 - Public Key and Privilege Management Infrastructure.
* @{
*/
/**
* X.509 algorithm identifier (IPRT representation).
*/
typedef struct RTCRX509ALGORITHMIDENTIFIER
{
/** The sequence making up this algorithm identifier. */
/** The algorithm object ID. */
/** Optional parameters specified by the algorithm. */
/** Poitner to the IPRT representation of a X.509 algorithm identifier. */
/** Poitner to the const IPRT representation of a X.509 algorithm identifier. */
typedef RTCRX509ALGORITHMIDENTIFIER const *PCRTCRX509ALGORITHMIDENTIFIER;
RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509ALGORITHMIDENTIFIER, RTDECL, RTCrX509AlgorithmIdentifier, SeqCore.Asn1Core);
RTASN1_IMPL_GEN_SET_OF_TYPEDEFS_AND_PROTOS(RTCRX509ALGORITHMIDENTIFIERS, RTCRX509ALGORITHMIDENTIFIER, RTDECL, RTCrX509AlgorithmIdentifiers);
/**
* Tries to convert an X.509 digest algorithm ID into a RTDIGESTTYPE value.
*
* @returns Valid RTDIGESTTYPE on success, RTDIGESTTYPE_INVALID on failure.
* @param pThis The IPRT representation of a X.509 algorithm
* identifier object.
*/
RTDECL(RTDIGESTTYPE) RTCrX509AlgorithmIdentifier_QueryDigestType(PCRTCRX509ALGORITHMIDENTIFIER pThis);
/**
* Tries to figure the digest size of an X.509 digest algorithm ID.
*
* @returns The digest size in bytes, UINT32_MAX if unknown digest.
* @param pThis The IPRT representation of a X.509 algorithm
* identifier object.
*/
RTDECL(int) RTCrX509AlgorithmIdentifier_CompareWithString(PCRTCRX509ALGORITHMIDENTIFIER pThis, const char *pszObjId);
/**
* Compares a digest with an encrypted digest algorithm, checking if they
* specify the same digest.
*
* @returns 0 if same digest, -1 if the digest is unknown, 1 if the encrypted
* digest does not match.
* @param pDigest The digest algorithm.
* @param pEncryptedDigest The encrypted digest algorithm.
*/
RTDECL(int) RTCrX509AlgorithmIdentifier_CompareDigestAndEncryptedDigest(PCRTCRX509ALGORITHMIDENTIFIER pDigest,
/** @name Typical Digest Algorithm OIDs.
* @{ */
#define RTCRX509ALGORITHMIDENTIFIERID_MD2 "1.2.840.113549.2.2"
#define RTCRX509ALGORITHMIDENTIFIERID_MD4 "1.2.840.113549.2.4"
#define RTCRX509ALGORITHMIDENTIFIERID_MD5 "1.2.840.113549.2.5"
#define RTCRX509ALGORITHMIDENTIFIERID_SHA1 "1.3.14.3.2.26"
#define RTCRX509ALGORITHMIDENTIFIERID_SHA256 "2.16.840.1.101.3.4.2.1"
#define RTCRX509ALGORITHMIDENTIFIERID_SHA384 "2.16.840.1.101.3.4.2.2"
#define RTCRX509ALGORITHMIDENTIFIERID_SHA512 "2.16.840.1.101.3.4.2.3"
#define RTCRX509ALGORITHMIDENTIFIERID_SHA224 "2.16.840.1.101.3.4.2.4"
#define RTCRX509ALGORITHMIDENTIFIERID_SHA512T224 "2.16.840.1.101.3.4.2.5"
#define RTCRX509ALGORITHMIDENTIFIERID_SHA512T256 "2.16.840.1.101.3.4.2.6"
#define RTCRX509ALGORITHMIDENTIFIERID_WHIRLPOOL "1.0.10118.3.0.55"
/** @} */
/** @name Encrypted Digest Algorithm OIDs.
* @remarks The PKCS variants are the default ones, alternative OID are marked
* as such.
* @{ */
#define RTCRX509ALGORITHMIDENTIFIERID_RSA "1.2.840.113549.1.1.1"
#define RTCRX509ALGORITHMIDENTIFIERID_MD2_WITH_RSA "1.2.840.113549.1.1.2"
#define RTCRX509ALGORITHMIDENTIFIERID_MD4_WITH_RSA "1.2.840.113549.1.1.3"
#define RTCRX509ALGORITHMIDENTIFIERID_MD5_WITH_RSA "1.2.840.113549.1.1.4"
#define RTCRX509ALGORITHMIDENTIFIERID_SHA1_WITH_RSA "1.2.840.113549.1.1.5"
#define RTCRX509ALGORITHMIDENTIFIERID_SHA256_WITH_RSA "1.2.840.113549.1.1.11"
#define RTCRX509ALGORITHMIDENTIFIERID_SHA384_WITH_RSA "1.2.840.113549.1.1.12"
#define RTCRX509ALGORITHMIDENTIFIERID_SHA512_WITH_RSA "1.2.840.113549.1.1.13"
#define RTCRX509ALGORITHMIDENTIFIERID_SHA224_WITH_RSA "1.2.840.113549.1.1.14"
/** @} */
/**
* One X.509 AttributeTypeAndValue (IPRT representation).
*/
typedef struct RTCRX509ATTRIBUTETYPEANDVALUE
{
/** Sequence core. */
/** The attribute type (object ID). */
/** The attribute value (what it is is defined by Type). */
/** Pointer to a X.509 AttributeTypeAndValue (IPRT representation). */
/** Pointer to a const X.509 AttributeTypeAndValue (IPRT representation). */
typedef RTCRX509ATTRIBUTETYPEANDVALUE const *PCRTCRX509ATTRIBUTETYPEANDVALUE;
RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509ATTRIBUTETYPEANDVALUE, RTDECL, RTCrX509AttributeTypeAndValue, SeqCore.Asn1Core);
RTASN1_IMPL_GEN_SET_OF_TYPEDEFS_AND_PROTOS(RTCRX509ATTRIBUTETYPEANDVALUES, RTCRX509ATTRIBUTETYPEANDVALUE, RTDECL, RTCrX509AttributeTypeAndValues);
RTASN1TYPE_ALIAS(RTCRX509RELATIVEDISTINGUISHEDNAME, RTCRX509ATTRIBUTETYPEANDVALUES, RTCrX509RelativeDistinguishedName, RTCrX509AttributeTypeAndValues);
RTASN1_IMPL_GEN_SEQ_OF_TYPEDEFS_AND_PROTOS(RTCRX509NAME, RTCRX509RELATIVEDISTINGUISHEDNAME, RTDECL, RTCrX509Name);
RTDECL(int) RTCrX509Name_CheckSanity(PCRTCRX509NAME pName, uint32_t fFlags, PRTERRINFO pErrInfo, const char *pszErrorTag);
/**
* Name constraint matching (RFC-5280).
*
* @returns true on match, false on mismatch.
* @param pConstraint The constraint name.
* @param pName The name to match against the constraint.
* @sa RTCrX509GeneralName_ConstraintMatch,
* RTCrX509RelativeDistinguishedName_ConstraintMatch
*/
/**
* Matches the directory name against a comma separated list of the comonent
* strings (case sensitive).
*
* @returns true if match, false if mismatch.
* @param pThis The name object.
* @param pszString The string to match against. For example:
* "C=US, ST=California, L=Redwood Shores, O=Oracle Corporation"
*
* @remarks This is doing a straight compare, no extra effort is expended in
* dealing with different component order. If the component order
* differs, there won't be any match.
*/
/**
* Formats the name as a command separated list of components with type
* prefixes.
*
* The output of this function is suitable for use with
* RTCrX509Name_MatchWithString.
*
* @returns IPRT status code.
* @param pThis The name object.
* @param pszBuf The output buffer.
* @param cbBuf The size of the output buffer.
* @param pcbActual Where to return the number of bytes required for the
* output, including the null terminator character.
* Optional.
*/
RTDECL(int) RTCrX509Name_FormatAsString(PCRTCRX509NAME pThis, char *pszBuf, size_t cbBuf, size_t *pcbActual);
typedef enum RTCRX509GENERALNAMECHOICE
{
RTCRX509GENERALNAMECHOICE_32BIT_HACK = 0x7fffffff
/**
* One X.509 GeneralName (IPRT representation).
*
* This is represented as a union. Use the RTCRX509GENERALNAME_IS_XXX predicate
* macros to figure out which member is valid (Asn1Core is always valid).
*/
typedef struct RTCRX509GENERALNAME
{
/** Dummy ASN.1 record, not encoded. */
/** The value allocation. */
/** The choice of value. */
/** The value union. */
union
{
/** Tag 0: Other. */
struct
{
/** Context tag 0. */
/** User defined. */
} *pT0;
/** Tag 1: RFC-822 Name. */
/** Tag 2: DNS name. */
/** Tag 3: X.400 Address. */
struct
{
/** Context tag 3. */
/** Later. */
} *pT3;
/** Tag 4: Directory Name. */
struct
{
/** Context tag 4. */
/** Directory name. */
} *pT4;
/** Tag 5: EDI Party Name. */
struct
{
/** Context tag 5. */
/** Later. */
} *pT5;
/** Tag 6: URI. */
/** Tag 7: IP address. Either 4/8 (IPv4) or 16/32 (IPv16) octets long. */
/** Tag 8: Registered ID. */
} u;
/** Pointer to the IPRT representation of an X.509 general name. */
typedef RTCRX509GENERALNAME *PRTCRX509GENERALNAME;
/** Pointer to the const IPRT representation of an X.509 general name. */
typedef RTCRX509GENERALNAME const *PCRTCRX509GENERALNAME;
/** @name RTCRX509GENERALNAME tag predicates.
* @{ */
#define RTCRX509GENERALNAME_IS_OTHER_NAME(a_GenName) ((a_GenName)->enmChoice == RTCRX509GENERALNAMECHOICE_OTHER_NAME)
#define RTCRX509GENERALNAME_IS_RFC822_NAME(a_GenName) ((a_GenName)->enmChoice == RTCRX509GENERALNAMECHOICE_RFC822_NAME)
#define RTCRX509GENERALNAME_IS_DNS_NAME(a_GenName) ((a_GenName)->enmChoice == RTCRX509GENERALNAMECHOICE_DNS_NAME)
#define RTCRX509GENERALNAME_IS_X400_ADDRESS(a_GenName) ((a_GenName)->enmChoice == RTCRX509GENERALNAMECHOICE_X400_ADDRESS)
#define RTCRX509GENERALNAME_IS_DIRECTORY_NAME(a_GenName) ((a_GenName)->enmChoice == RTCRX509GENERALNAMECHOICE_DIRECTORY_NAME)
#define RTCRX509GENERALNAME_IS_EDI_PARTY_NAME(a_GenName) ((a_GenName)->enmChoice == RTCRX509GENERALNAMECHOICE_EDI_PARTY_NAME)
#define RTCRX509GENERALNAME_IS_URI(a_GenName) ((a_GenName)->enmChoice == RTCRX509GENERALNAMECHOICE_URI)
#define RTCRX509GENERALNAME_IS_IP_ADDRESS(a_GenName) ((a_GenName)->enmChoice == RTCRX509GENERALNAMECHOICE_IP_ADDRESS)
#define RTCRX509GENERALNAME_IS_REGISTERED_ID(a_GenName) ((a_GenName)->enmChoice == RTCRX509GENERALNAMECHOICE_REGISTERED_ID)
/** @} */
RTASN1_IMPL_GEN_SEQ_OF_TYPEDEFS_AND_PROTOS(RTCRX509GENERALNAMES, RTCRX509GENERALNAME, RTDECL, RTCrX509GeneralNames);
RTDECL(bool) RTCrX509GeneralName_ConstraintMatch(PCRTCRX509GENERALNAME pConstraint, PCRTCRX509GENERALNAME pName);
/**
* X.509 Validity (IPRT representation).
*/
typedef struct RTCRX509VALIDITY
{
/** Core sequence bits. */
/** Effective starting. */
/** Expires after. */
/** Pointer to the IPRT representation of an X.509 validity sequence. */
typedef RTCRX509VALIDITY *PRTCRX509VALIDITY;
/** Pointer ot the const IPRT representation of an X.509 validity sequence. */
typedef RTCRX509VALIDITY const *PCRTCRX509VALIDITY;
#if 0
/**
* X.509 UniqueIdentifier (IPRT representation).
*/
typedef struct RTCRX509UNIQUEIDENTIFIER
{
/** Representation is a bit string. */
/** Pointer to the IPRT representation of an X.509 unique identifier. */
/** Pointer to the const IPRT representation of an X.509 unique identifier. */
typedef RTCRX509UNIQUEIDENTIFIER const *PCRTCRX509UNIQUEIDENTIFIER;
RTASN1TYPE_STANDARD_PROTOTYPES_NO_GET_CORE(RTCRX509UNIQUEIDENTIFIER, RTDECL, RTCrX509UniqueIdentifier);
#endif
RTASN1TYPE_ALIAS(RTCRX509UNIQUEIDENTIFIER, RTASN1BITSTRING, RTCrX509UniqueIdentifier, RTAsn1BitString);
/**
* X.509 SubjectPublicKeyInfo (IPRT representation).
*/
typedef struct RTCRX509SUBJECTPUBLICKEYINFO
{
/** Core sequence bits. */
/** The algorithm used with the public key. */
/** A bit string containing the public key.
*
* For algorithms like rsaEncryption this is generally a sequence of two
* integers, where the first one has lots of bits, and the second one being a
* modulous value. These are details specific to the algorithm and not relevant
* when validating the certificate chain. */
/** Pointer to the IPRT representation of an X.509 subject public key info
* sequence. */
/** Pointer to the const IPRT representation of an X.509 subject public key info
* sequence. */
typedef RTCRX509SUBJECTPUBLICKEYINFO const *PCRTCRX509SUBJECTPUBLICKEYINFO;
RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509SUBJECTPUBLICKEYINFO, RTDECL, RTCrX509SubjectPublicKeyInfo, SeqCore.Asn1Core);
/**
* One X.509 AuthorityKeyIdentifier (IPRT representation).
*/
typedef struct RTCRX509AUTHORITYKEYIDENTIFIER
{
/** Sequence core. */
/** Tag 0, optional, implicit: Key identifier. */
/** Tag 1, optional, implicit: Issuer name. */
/** Tag 2, optional, implicit: Serial number of issuer. */
/** Pointer to the IPRT representation of an X.509 AuthorityKeyIdentifier
* sequence. */
/** Pointer to the const IPRT representation of an X.509 AuthorityKeyIdentifier
* sequence. */
typedef RTCRX509AUTHORITYKEYIDENTIFIER const *PCRTCRX509AUTHORITYKEYIDENTIFIER;
RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509AUTHORITYKEYIDENTIFIER, RTDECL, RTCrX509AuthorityKeyIdentifier, SeqCore.Asn1Core);
/**
* One X.509 OldAuthorityKeyIdentifier (IPRT representation).
*/
typedef struct RTCRX509OLDAUTHORITYKEYIDENTIFIER
{
/** Sequence core. */
/** Tag 0, optional, implicit: Key identifier. */
struct
{
/** Tag 1, optional, implicit: Issuer name. */
} T1;
/** Tag 2, optional, implicit: Serial number of issuer. */
/** Pointer to the IPRT representation of an X.509 AuthorityKeyIdentifier
* sequence. */
/** Pointer to the const IPRT representation of an X.509 AuthorityKeyIdentifier
* sequence. */
typedef RTCRX509OLDAUTHORITYKEYIDENTIFIER const *PCRTCRX509OLDAUTHORITYKEYIDENTIFIER;
RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509OLDAUTHORITYKEYIDENTIFIER, RTDECL, RTCrX509OldAuthorityKeyIdentifier, SeqCore.Asn1Core);
/**
* One X.509 PolicyQualifierInfo (IPRT representation).
*/
typedef struct RTCRX509POLICYQUALIFIERINFO
{
/** Core sequence bits. */
/** The policy object ID. */
/** Anything defined by the policy qualifier id. */
/** Pointer to the IPRT representation of an X.509 PolicyQualifierInfo
* sequence. */
/** Pointer to the const IPRT representation of an X.509 PolicyQualifierInfo
* sequence. */
typedef RTCRX509POLICYQUALIFIERINFO const *PCRTCRX509POLICYQUALIFIERINFO;
RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509POLICYQUALIFIERINFO, RTDECL, RTCrX509PolicyQualifierInfo, SeqCore.Asn1Core);
RTASN1_IMPL_GEN_SEQ_OF_TYPEDEFS_AND_PROTOS(RTCRX509POLICYQUALIFIERINFOS, RTCRX509POLICYQUALIFIERINFO, RTDECL, RTCrX509PolicyQualifierInfos);
/**
* One X.509 PolicyInformation (IPRT representation).
*/
typedef struct RTCRX509POLICYINFORMATION
{
/** Core sequence bits. */
/** The policy object ID. */
/** Optional sequence of policy qualifiers. */
/** Pointer to the IPRT representation of an X.509 PolicyInformation
* sequence. */
/** Pointer to the const IPRT representation of an X.509 PolicyInformation
* sequence. */
typedef RTCRX509POLICYINFORMATION const *PCRTCRX509POLICYINFORMATION;
RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509POLICYINFORMATION, RTDECL, RTCrX509PolicyInformation, SeqCore.Asn1Core);
RTASN1_IMPL_GEN_SEQ_OF_TYPEDEFS_AND_PROTOS(RTCRX509CERTIFICATEPOLICIES, RTCRX509POLICYINFORMATION, RTDECL, RTCrX509CertificatePolicies);
/** Sepcial policy object ID that matches any policy. */
#define RTCRX509_ID_CE_CP_ANY_POLICY_OID "2.5.29.32.0"
/**
* One X.509 PolicyMapping (IPRT representation).
*/
typedef struct RTCRX509POLICYMAPPING
{
/** Core sequence bits. */
/** Issuer policy ID. */
/** Subject policy ID. */
/** Pointer to the IPRT representation of a sequence of X.509 PolicyMapping. */
typedef RTCRX509POLICYMAPPING *PRTCRX509POLICYMAPPING;
/** Pointer to the const IPRT representation of a sequence of X.509
* PolicyMapping. */
typedef RTCRX509POLICYMAPPING const *PCRTCRX509POLICYMAPPING;
RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509POLICYMAPPING, RTDECL, RTCrX509PolicyMapping, SeqCore.Asn1Core);
RTASN1_IMPL_GEN_SEQ_OF_TYPEDEFS_AND_PROTOS(RTCRX509POLICYMAPPINGS, RTCRX509POLICYMAPPING, RTDECL, RTCrX509PolicyMappings);
/**
* X.509 BasicConstraints (IPRT representation).
*/
typedef struct RTCRX509BASICCONSTRAINTS
{
/** Core sequence bits. */
/** Is this ia certficiate authority? Default to false. */
/** Path length constraint. */
/** Pointer to the IPRT representation of a sequence of X.509
* BasicConstraints. */
/** Pointer to the const IPRT representation of a sequence of X.509
* BasicConstraints. */
typedef RTCRX509BASICCONSTRAINTS const *PCRTCRX509BASICCONSTRAINTS;
RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509BASICCONSTRAINTS, RTDECL, RTCrX509BasicConstraints, SeqCore.Asn1Core);
/**
* X.509 GeneralSubtree (IPRT representation).
*/
typedef struct RTCRX509GENERALSUBTREE
{
/** Core sequence bits. */
/** Base name. */
/** Tag 0, optional: Minimum, default 0. Fixed at 0 by RFC-5280. */
/** Tag 1, optional: Maximum. Fixed as not-present by RFC-5280. */
/** Pointer to the IPRT representation of a sequence of X.509 GeneralSubtree. */
/** Pointer to the const IPRT representation of a sequence of X.509
* GeneralSubtree. */
typedef RTCRX509GENERALSUBTREE const *PCRTCRX509GENERALSUBTREE;
RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509GENERALSUBTREE, RTDECL, RTCrX509GeneralSubtree, SeqCore.Asn1Core);
RTDECL(bool) RTCrX509GeneralSubtree_ConstraintMatch(PCRTCRX509GENERALSUBTREE pConstraint, PCRTCRX509GENERALSUBTREE pName);
RTASN1_IMPL_GEN_SEQ_OF_TYPEDEFS_AND_PROTOS(RTCRX509GENERALSUBTREES, RTCRX509GENERALSUBTREE, RTDECL, RTCrX509GeneralSubtrees);
/**
* X.509 NameConstraints (IPRT representation).
*/
typedef struct RTCRX509NAMECONSTRAINTS
{
/** Core sequence bits. */
/** Tag 0, optional: Permitted subtrees. */
struct
{
/** Context tag. */
/** The permitted subtrees. */
} T0;
/** Tag 1, optional: Excluded subtrees. */
struct
{
/** Context tag. */
/** The excluded subtrees. */
} T1;
/** Pointer to the IPRT representation of a sequence of X.509
* NameConstraints. */
/** Pointer to the const IPRT representation of a sequence of X.509
* NameConstraints. */
typedef RTCRX509NAMECONSTRAINTS const *PCRTCRX509NAMECONSTRAINTS;
RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509NAMECONSTRAINTS, RTDECL, RTCrX509NameConstraints, SeqCore.Asn1Core);
/**
* X.509 PolicyConstraints (IPRT representation).
*/
typedef struct RTCRX509POLICYCONSTRAINTS
{
/** Core sequence bits. */
/** Tag 0, optional: Certificates before an explicit policy is required. */
/** Tag 1, optional: Certificates before policy mapping is inhibited. */
/** Pointer to the IPRT representation of a sequence of X.509
* PolicyConstraints. */
/** Pointer to the const IPRT representation of a sequence of X.509
* PolicyConstraints. */
typedef RTCRX509POLICYCONSTRAINTS const *PCRTCRX509POLICYCONSTRAINTS;
RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509POLICYCONSTRAINTS, RTDECL, RTCrX509PolicyConstraints, SeqCore.Asn1Core);
/**
* Indicates what an X.509 extension value encapsulates.
*/
typedef enum RTCRX509EXTENSIONVALUE
{
/** Unknown, no decoding available just the octet string. */
/** Unencapsulated (i.e. octet string). */
/** Bit string (RTASN1BITSTRING). */
/** Octet string (RTASN1OCTETSTRING). */
/** Integer string (RTASN1INTEGER). */
/** Sequence of object identifiers (RTASN1SEQOFOBJIDS). */
/** Authority key identifier (RTCRX509AUTHORITYKEYIDENTIFIER). */
/** Old Authority key identifier (RTCRX509OLDAUTHORITYKEYIDENTIFIER). */
/** Certificate policies (RTCRX509CERTIFICATEPOLICIES). */
/** Sequence of policy mappings (RTCRX509POLICYMAPPINGS). */
/** Basic constraints (RTCRX509BASICCONSTRAINTS). */
/** Name constraints (RTCRX509NAMECONSTRAINTS). */
/** Policy constraints (RTCRX509POLICYCONSTRAINTS). */
/** Sequence of general names (RTCRX509GENERALNAMES). */
/** Blow the type up to 32-bits. */
RTCRX509EXTENSIONVALUE_32BIT_HACK = 0x7fffffff
/**
* One X.509 Extension (IPRT representation).
*/
typedef struct RTCRX509EXTENSION
{
/** Core sequence bits. */
/** Extension ID. */
/** Whether this is critical (default @c false). */
/** Indicates what ExtnValue.pEncapsulated points at. */
/** The value.
* Contains extension specific data that we don't yet parse. */
/** Pointer to the IPRT representation of one X.509 extensions. */
typedef RTCRX509EXTENSION *PRTCRX509EXTENSION;
/** Pointer to the const IPRT representation of one X.509 extension. */
typedef RTCRX509EXTENSION const *PCRTCRX509EXTENSION;
RTASN1_IMPL_GEN_SEQ_OF_TYPEDEFS_AND_PROTOS(RTCRX509EXTENSIONS, RTCRX509EXTENSION, RTDECL, RTCrX509Extensions);
/**
* X.509 To-be-signed certificate information (IPRT representation).
*/
typedef struct RTCRX509TBSCERTIFICATE
{
/** Sequence core. */
/** Structure version. */
struct
{
/** Context tag with value 0. */
/** The actual value (RTCRX509TBSCERTIFICATE_V1, ...). */
} T0;
/** The serial number of the certificate. */
/** The signature algorithm. */
/** The issuer name. */
/** The certificate validity period. */
/** The subject name. */
/** The public key for this certificate. */
/** Issuer unique identifier (optional, version >= v2). */
struct
{
/** Context tag with value 1. */
/** The unique identifier value. */
} T1;
/** Subject unique identifier (optional, version >= v2). */
struct
{
/** Context tag with value 2. */
/** The unique identifier value. */
} T2;
/** Extensions (optional, version >= v3). */
struct
{
/** Context tag with value 3. */
/** The unique identifier value. */
/** Extensions summary flags. */
/** Key usage flags. */
/** Extended key usage flags. */
/** Pointer to the authority key ID extension if present. */
/** Pointer to the OLD authority key ID extension if present. */
/** Pointer to the subject key ID extension if present. */
/** Pointer to the alternative subject name extension if present. */
/** Pointer to the alternative issuer name extension if present. */
/** Pointer to the certificate policies extension if present. */
/** Pointer to the policy mappings extension if present. */
/** Pointer to the basic constraints extension if present. */
/** Pointer to the name constraints extension if present. */
/** Pointer to the policy constraints extension if present. */
/** Pointer to the inhibit anyPolicy extension if present. */
} T3;
/** Pointer to the IPRT representation of a X.509 TBSCertificate. */
/** Pointer to the const IPRT representation of a X.509 TBSCertificate. */
typedef RTCRX509TBSCERTIFICATE const *PCRTCRX509TBSCERTIFICATE;
RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509TBSCERTIFICATE, RTDECL, RTCrX509TbsCertificate, SeqCore.Asn1Core);
/** @name RTCRX509TBSCERTIFICATE::T0.Version values.
* @{ */
#define RTCRX509TBSCERTIFICATE_V1 0
#define RTCRX509TBSCERTIFICATE_V2 1
#define RTCRX509TBSCERTIFICATE_V3 2
/** @} */
/** @name RTCRX509TBSCERTIFICATE::T3.fFlags values.
* @{ */
#define RTCRX509TBSCERTIFICATE_F_PRESENT_OTHER RT_BIT_32(22) /**< Other unknown extension present. */
/** @} */
/** @name X.509 Key Usage flags. (RFC-5280 section 4.2.1.3.)
* @{ */
#define RTCRX509CERT_KEY_USAGE_F_CRL_SIGN_BIT 6
/** @} */
/** @name X.509 Extended Key Usage flags. (RFC-5280 section 4.2.1.12, ++.)
* @remarks Needless to say, these flags doesn't cover all possible extended key
* usages, because there is a potential unlimited number of them. Only
* ones relevant to IPRT and it's users are covered.
* @{ */
#define RTCRX509CERT_EKU_F_ANY RT_BIT_64(0)
/** @} */
/** @name Key purpose OIDs (extKeyUsage)
* @{ */
#define RTCRX509_ANY_EXTENDED_KEY_USAGE_OID "2.5.29.37.0"
#define RTCRX509_ID_KP_OID "1.3.6.1.5.5.7.3"
#define RTCRX509_ID_KP_SERVER_AUTH_OID "1.3.6.1.5.5.7.3.1"
#define RTCRX509_ID_KP_CLIENT_AUTH_OID "1.3.6.1.5.5.7.3.2"
#define RTCRX509_ID_KP_CODE_SIGNING_OID "1.3.6.1.5.5.7.3.3"
#define RTCRX509_ID_KP_EMAIL_PROTECTION_OID "1.3.6.1.5.5.7.3.4"
#define RTCRX509_ID_KP_IPSEC_END_SYSTEM_OID "1.3.6.1.5.5.7.3.5"
#define RTCRX509_ID_KP_IPSEC_TUNNEL_OID "1.3.6.1.5.5.7.3.6"
#define RTCRX509_ID_KP_IPSEC_USER_OID "1.3.6.1.5.5.7.3.7"
#define RTCRX509_ID_KP_TIMESTAMPING_OID "1.3.6.1.5.5.7.3.8"
#define RTCRX509_ID_KP_OCSP_SIGNING_OID "1.3.6.1.5.5.7.3.9"
#define RTCRX509_ID_KP_DVCS_OID "1.3.6.1.5.5.7.3.10"
#define RTCRX509_ID_KP_SBGP_CERT_AA_SERVICE_AUTH_OID "1.3.6.1.5.5.7.3.11"
#define RTCRX509_ID_KP_EAP_OVER_PPP_OID "1.3.6.1.5.5.7.3.13"
#define RTCRX509_ID_KP_EAP_OVER_LAN_OID "1.3.6.1.5.5.7.3.14"
/** @} */
/** @name Microsoft extended key usage OIDs
* @{ */
#define RTCRX509_MS_EKU_CERT_TRUST_LIST_SIGNING_OID "1.3.6.1.4.1.311.10.3.1"
#define RTCRX509_MS_EKU_TIMESTAMP_SIGNING_OID "1.3.6.1.4.1.311.10.3.2"
#define RTCRX509_MS_EKU_SERVER_GATED_CRYPTO_OID "1.3.6.1.4.1.311.10.3.3"
#define RTCRX509_MS_EKU_SGC_SERIALIZED_OID "1.3.6.1.4.1.311.10.3.3.1"
#define RTCRX509_MS_EKU_ENCRYPTED_FILE_SYSTEM_OID "1.3.6.1.4.1.311.10.3.4"
#define RTCRX509_MS_EKU_WHQL_CRYPTO_OID "1.3.6.1.4.1.311.10.3.5"
#define RTCRX509_MS_EKU_NT5_CRYPTO_OID "1.3.6.1.4.1.311.10.3.6"
#define RTCRX509_MS_EKU_OEM_WHQL_CRYPTO_OID "1.3.6.1.4.1.311.10.3.7"
#define RTCRX509_MS_EKU_EMBEDDED_NT_CRYPTO_OID "1.3.6.1.4.1.311.10.3.8"
#define RTCRX509_MS_EKU_ROOT_LIST_SIGNER_OID "1.3.6.1.4.1.311.10.3.9"
#define RTCRX509_MS_EKU_QUALIFIED_SUBORDINATE_OID "1.3.6.1.4.1.311.10.3.10"
#define RTCRX509_MS_EKU_KEY_RECOVERY_3_OID "1.3.6.1.4.1.311.10.3.11"
#define RTCRX509_MS_EKU_DOCUMENT_SIGNING_OID "1.3.6.1.4.1.311.10.3.12"
#define RTCRX509_MS_EKU_LIFETIME_SIGNING_OID "1.3.6.1.4.1.311.10.3.13"
#define RTCRX509_MS_EKU_MOBILE_DEVICE_SOFTWARE_OID "1.3.6.1.4.1.311.10.3.14"
#define RTCRX509_MS_EKU_SMART_DISPLAY_OID "1.3.6.1.4.1.311.10.3.15"
#define RTCRX509_MS_EKU_CSP_SIGNATURE_OID "1.3.6.1.4.1.311.10.3.16"
#define RTCRX509_MS_EKU_EFS_RECOVERY_OID "1.3.6.1.4.1.311.10.3.4.1"
#define RTCRX509_MS_EKU_DRM_OID "1.3.6.1.4.1.311.10.5.1"
#define RTCRX509_MS_EKU_DRM_INDIVIDUALIZATION_OID "1.3.6.1.4.1.311.10.5.2"
#define RTCRX509_MS_EKU_LICENSES_OID "1.3.6.1.4.1.311.10.5.3"
#define RTCRX509_MS_EKU_LICENSE_SERVER_OID "1.3.6.1.4.1.311.10.5.4"
#define RTCRX509_MS_EKU_ENROLLMENT_AGENT_OID "1.3.6.1.4.1.311.20.2.1"
#define RTCRX509_MS_EKU_SMARTCARD_LOGON_OID "1.3.6.1.4.1.311.20.2.2"
#define RTCRX509_MS_EKU_CA_EXCHANGE_OID "1.3.6.1.4.1.311.21.5"
#define RTCRX509_MS_EKU_KEY_RECOVERY_21_OID "1.3.6.1.4.1.311.21.6"
#define RTCRX509_MS_EKU_SYSTEM_HEALTH_OID "1.3.6.1.4.1.311.47.1.1"
#define RTCRX509_MS_EKU_SYSTEM_HEALTH_LOOPHOLE_OID "1.3.6.1.4.1.311.47.1.3"
#define RTCRX509_MS_EKU_KERNEL_MODE_CODE_SIGNING_OID "1.3.6.1.4.1.311.61.1.1"
/** @} */
/** @name Apple extended key usage OIDs
* @{ */
#define RTCRX509_APPLE_EKU_APPLE_EXTENDED_KEY_USAGE_OID "1.2.840.113635.100.4"
#define RTCRX509_APPLE_EKU_CODE_SIGNING_OID "1.2.840.113635.100.4.1"
#define RTCRX509_APPLE_EKU_CODE_SIGNING_DEVELOPMENT_OID "1.2.840.113635.100.4.1.1"
#define RTCRX509_APPLE_EKU_SOFTWARE_UPDATE_SIGNING_OID "1.2.840.113635.100.4.1.2"
#define RTCRX509_APPLE_EKU_CODE_SIGNING_THRID_PARTY_OID "1.2.840.113635.100.4.1.3"
#define RTCRX509_APPLE_EKU_RESOURCE_SIGNING_OID "1.2.840.113635.100.4.1.4"
#define RTCRX509_APPLE_EKU_ICHAT_SIGNING_OID "1.2.840.113635.100.4.2"
#define RTCRX509_APPLE_EKU_ICHAT_ENCRYPTION_OID "1.2.840.113635.100.4.3"
#define RTCRX509_APPLE_EKU_SYSTEM_IDENTITY_OID "1.2.840.113635.100.4.4"
#define RTCRX509_APPLE_EKU_CRYPTO_ENV_OID "1.2.840.113635.100.4.5"
#define RTCRX509_APPLE_EKU_CRYPTO_PRODUCTION_ENV_OID "1.2.840.113635.100.4.5.1"
#define RTCRX509_APPLE_EKU_CRYPTO_MAINTENANCE_ENV_OID "1.2.840.113635.100.4.5.2"
#define RTCRX509_APPLE_EKU_CRYPTO_TEST_ENV_OID "1.2.840.113635.100.4.5.3"
#define RTCRX509_APPLE_EKU_CRYPTO_DEVELOPMENT_ENV_OID "1.2.840.113635.100.4.5.4"
#define RTCRX509_APPLE_EKU_CRYPTO_QOS_OID "1.2.840.113635.100.4.6"
#define RTCRX509_APPLE_EKU_CRYPTO_TIER0_QOS_OID "1.2.840.113635.100.4.6.1"
#define RTCRX509_APPLE_EKU_CRYPTO_TIER1_QOS_OID "1.2.840.113635.100.4.6.2"
#define RTCRX509_APPLE_EKU_CRYPTO_TIER2_QOS_OID "1.2.840.113635.100.4.6.3"
#define RTCRX509_APPLE_EKU_CRYPTO_TIER3_QOS_OID "1.2.840.113635.100.4.6.4"
/** @} */
/**
* Use this to update derived values after changing the certificate
* extensions.
*
* @returns IPRT status code
* @param pThis The certificate.
* @param pErrInfo Where to return additional error information. Optional.
*/
RTDECL(int) RTCrX509TbsCertificate_ReprocessExtensions(PRTCRX509TBSCERTIFICATE pThis, PRTERRINFO pErrInfo);
/**
* One X.509 Certificate (IPRT representation).
*/
typedef struct RTCRX509CERTIFICATE
{
/** Sequence core. */
/** The to-be-signed certificate information. */
/** The signature algorithm (must match TbsCertificate.Signature). */
/** The signature value. */
/** Pointer to the IPRT representation of one X.509 certificate. */
typedef RTCRX509CERTIFICATE *PRTCRX509CERTIFICATE;
/** Pointer to the const IPRT representation of one X.509 certificate. */
typedef RTCRX509CERTIFICATE const *PCRTCRX509CERTIFICATE;
/**
* Checks if a certificate matches a given issuer name and serial number.
*
* @returns True / false.
* @param pCertificates The X.509 certificat.
* @param pIssuer The issuer name to match against.
* @param pSerialNumber The serial number to match against.
*/
RTDECL(bool) RTCrX509Certificate_MatchSubjectOrAltSubjectByRfc5280(PCRTCRX509CERTIFICATE pThis, PCRTCRX509NAME pName);
RTDECL(int) RTCrX509Certificate_VerifySignature(PCRTCRX509CERTIFICATE pThis, PCRTASN1OBJID pAlgorithm,
RTDECL(int) RTCrX509Certificate_ReadFromFile(PRTCRX509CERTIFICATE pCertificate, const char *pszFilename, uint32_t fFlags,
/** @name X.509 Certificate Extensions
* @{ */
/** Old AuthorityKeyIdentifier OID. */
#define RTCRX509_ID_CE_OLD_AUTHORITY_KEY_IDENTIFIER_OID "2.5.29.1"
/** Old CertificatePolicies extension OID. */
#define RTCRX509_ID_CE_OLD_CERTIFICATE_POLICIES_OID "2.5.29.3"
/** Old SubjectAltName extension OID. */
#define RTCRX509_ID_CE_OLD_SUBJECT_ALT_NAME_OID "2.5.29.7"
/** Old IssuerAltName extension OID. */
#define RTCRX509_ID_CE_OLD_ISSUER_ALT_NAME_OID "2.5.29.8"
/** Old BasicContraints extension OID. */
#define RTCRX509_ID_CE_OLD_BASIC_CONSTRAINTS_OID "2.5.29.10"
/** SubjectKeyIdentifier OID. */
#define RTCRX509_ID_CE_SUBJECT_KEY_IDENTIFIER_OID "2.5.29.14"
/** KeyUsage OID. */
#define RTCRX509_ID_CE_KEY_USAGE_OID "2.5.29.15"
/** PrivateKeyUsagePeriod OID. */
#define RTCRX509_ID_CE_PRIVATE_KEY_USAGE_PERIOD_OID "2.5.29.16"
/** SubjectAltName extension OID. */
#define RTCRX509_ID_CE_SUBJECT_ALT_NAME_OID "2.5.29.17"
/** IssuerAltName extension OID. */
#define RTCRX509_ID_CE_ISSUER_ALT_NAME_OID "2.5.29.18"
/** BasicContraints extension OID. */
#define RTCRX509_ID_CE_BASIC_CONSTRAINTS_OID "2.5.29.19"
/** NameContraints extension OID. */
#define RTCRX509_ID_CE_NAME_CONSTRAINTS_OID "2.5.29.30"
/** CertificatePolicies extension OID. */
#define RTCRX509_ID_CE_CERTIFICATE_POLICIES_OID "2.5.29.32"
/** PolicyMappings extension OID. */
#define RTCRX509_ID_CE_POLICY_MAPPINGS_OID "2.5.29.33"
/** AuthorityKeyIdentifier OID. */
#define RTCRX509_ID_CE_AUTHORITY_KEY_IDENTIFIER_OID "2.5.29.35"
/** PolicyContraints extension OID. */
#define RTCRX509_ID_CE_POLICY_CONSTRAINTS_OID "2.5.29.36"
/** ExtKeyUsage (extended key usage) extension OID. */
#define RTCRX509_ID_CE_EXT_KEY_USAGE_OID "2.5.29.37"
/** ExtKeyUsage: OID for permitting any unspecified key usage. */
#define RTCRX509_ID_CE_ANY_EXTENDED_KEY_USAGE_OID "2.5.29.37.0"
/** AuthorityAttributeIdentifier OID. */
#define RTCRX509_ID_CE_AUTHORITY_ATTRIBUTE_IDENTIFIER_OID "2.5.29.38"
/** AcceptableCertPolicies OID. */
#define RTCRX509_ID_CE_ACCEPTABLE_CERT_POLICIES_OID "2.5.29.52"
/** InhibitAnyPolicy OID. */
#define RTCRX509_ID_CE_INHIBIT_ANY_POLICY_OID "2.5.29.54"
/** @} */
/*
* Sequence of X.509 Certifcates (IPRT representation).
*/
RTASN1_IMPL_GEN_SET_OF_TYPEDEFS_AND_PROTOS(RTCRX509CERTIFICATES, RTCRX509CERTIFICATE, RTDECL, RTCrX509Certificates);
/**
* Looks up a certificate by issuer name and serial number.
*
* @returns Pointer to the given certificate if found, NULL if not.
* @param pCertificates The X.509 certificate set to search.
* @param pIssuer The issuer name of the wanted certificate.
* @param pSerialNumber The serial number of the wanted certificate.
*/
RTDECL(PCRTCRX509CERTIFICATE) RTCrX509Certificates_FindByIssuerAndSerialNumber(PCRTCRX509CERTIFICATES pCertificates,
RTDECL(int) RTCrX509CertPathsSetTrustedStore(RTCRX509CERTPATHS hCertPaths, RTCRSTORE hTrustedStore);
RTDECL(int) RTCrX509CertPathsSetUntrustedStore(RTCRX509CERTPATHS hCertPaths, RTCRSTORE hUntrustedStore);
RTDECL(int) RTCrX509CertPathsSetUntrustedArray(RTCRX509CERTPATHS hCertPaths, PCRTCRX509CERTIFICATE paCerts, uint32_t cCerts);
RTDECL(int) RTCrX509CertPathsSetUntrustedSet(RTCRX509CERTPATHS hCertPaths, struct RTCRPKCS7SETOFCERTS const *pSetOfCerts);
RTDECL(int) RTCrX509CertPathsSetValidTimeSpec(RTCRX509CERTPATHS hCertPaths, PCRTTIMESPEC pTimeSpec);
RTDECL(int) RTCrX509CertPathsCreateEx(PRTCRX509CERTPATHS phCertPaths, PCRTCRX509CERTIFICATE pTarget, RTCRSTORE hTrustedStore,
RTDECL(int) RTCrX509CertPathsDumpOne(RTCRX509CERTPATHS hCertPaths, uint32_t iPath, uint32_t uVerbosity,
RTDECL(int) RTCrX509CertPathsValidateOne(RTCRX509CERTPATHS hCertPaths, uint32_t iPath, PRTERRINFO pErrInfo);
RTDECL(int) RTCrX509CertPathsValidateAll(RTCRX509CERTPATHS hCertPaths, uint32_t *pcValidPaths, PRTERRINFO pErrInfo);
RTDECL(PCRTCRX509CERTIFICATE) RTCrX509CertPathsGetPathNodeCert(RTCRX509CERTPATHS hCertPaths, uint32_t iPath, uint32_t iNode);
/** @} */
/** @} */
#endif