2 * X.509v3 certificate parsing and processing
3 * Copyright (c) 2006, Jouni Malinen <j@w1.fi>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
9 * Alternatively, this software may be distributed under the terms of BSD
12 * See README and COPYING for more details.
20 struct x509_algorithm_identifier {
24 struct x509_name_attr {
25 enum x509_name_attr_type {
26 X509_NAME_ATTR_NOT_USED,
38 #define X509_MAX_NAME_ATTRIBUTES 20
41 struct x509_name_attr attr[X509_MAX_NAME_ATTRIBUTES];
43 char *email; /* emailAddress */
45 /* from alternative name extension */
46 char *alt_email; /* rfc822Name */
47 char *dns; /* dNSName */
48 char *uri; /* uniformResourceIdentifier */
49 u8 *ip; /* iPAddress */
50 size_t ip_len; /* IPv4: 4, IPv6: 16 */
51 struct asn1_oid rid; /* registeredID */
54 struct x509_certificate {
55 struct x509_certificate *next;
56 enum { X509_CERT_V1 = 0, X509_CERT_V2 = 1, X509_CERT_V3 = 2 } version;
57 unsigned long serial_number;
58 struct x509_algorithm_identifier signature;
59 struct x509_name issuer;
60 struct x509_name subject;
63 struct x509_algorithm_identifier public_key_alg;
65 size_t public_key_len;
66 struct x509_algorithm_identifier signature_alg;
68 size_t sign_value_len;
71 unsigned int extensions_present;
72 #define X509_EXT_BASIC_CONSTRAINTS (1 << 0)
73 #define X509_EXT_PATH_LEN_CONSTRAINT (1 << 1)
74 #define X509_EXT_KEY_USAGE (1 << 2)
75 #define X509_EXT_SUBJECT_ALT_NAME (1 << 3)
76 #define X509_EXT_ISSUER_ALT_NAME (1 << 4)
78 /* BasicConstraints */
80 unsigned long path_len_constraint; /* pathLenConstraint */
83 unsigned long key_usage;
84 #define X509_KEY_USAGE_DIGITAL_SIGNATURE (1 << 0)
85 #define X509_KEY_USAGE_NON_REPUDIATION (1 << 1)
86 #define X509_KEY_USAGE_KEY_ENCIPHERMENT (1 << 2)
87 #define X509_KEY_USAGE_DATA_ENCIPHERMENT (1 << 3)
88 #define X509_KEY_USAGE_KEY_AGREEMENT (1 << 4)
89 #define X509_KEY_USAGE_KEY_CERT_SIGN (1 << 5)
90 #define X509_KEY_USAGE_CRL_SIGN (1 << 6)
91 #define X509_KEY_USAGE_ENCIPHER_ONLY (1 << 7)
92 #define X509_KEY_USAGE_DECIPHER_ONLY (1 << 8)
95 * The DER format certificate follows struct x509_certificate. These
96 * pointers point to that buffer.
100 const u8 *tbs_cert_start;
106 X509_VALIDATE_BAD_CERTIFICATE,
107 X509_VALIDATE_UNSUPPORTED_CERTIFICATE,
108 X509_VALIDATE_CERTIFICATE_REVOKED,
109 X509_VALIDATE_CERTIFICATE_EXPIRED,
110 X509_VALIDATE_CERTIFICATE_UNKNOWN,
111 X509_VALIDATE_UNKNOWN_CA
114 void x509_certificate_free(struct x509_certificate *cert);
115 struct x509_certificate * x509_certificate_parse(const u8 *buf, size_t len);
116 void x509_name_string(struct x509_name *name, char *buf, size_t len);
117 int x509_name_compare(struct x509_name *a, struct x509_name *b);
118 void x509_certificate_chain_free(struct x509_certificate *cert);
119 int x509_certificate_check_signature(struct x509_certificate *issuer,
120 struct x509_certificate *cert);
121 int x509_certificate_chain_validate(struct x509_certificate *trusted,
122 struct x509_certificate *chain,
124 struct x509_certificate *
125 x509_certificate_get_subject(struct x509_certificate *chain,
126 struct x509_name *name);
127 int x509_certificate_self_signed(struct x509_certificate *cert);
129 #endif /* X509V3_H */