x509.h@ 94480

Last change on this file since 94480 was 93115, checked in by vboxsync, 3 years ago
scm --update-copyright-year
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 56.5 KB

Line
1	/** @file
2	* IPRT - Crypto - X.509, Public Key and Privilege Management Infrastructure.
3	*/
4
5	/*
6	* Copyright (C) 2014-2022 Oracle Corporation
7	*
8	* This file is part of VirtualBox Open Source Edition (OSE), as
9	* available from http://www.virtualbox.org. This file is free software;
10	* you can redistribute it and/or modify it under the terms of the GNU
11	* General Public License (GPL) as published by the Free Software
12	* Foundation, in version 2 as it comes in the "COPYING" file of the
13	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
14	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
15	*
16	* The contents of this file may alternatively be used under the terms
17	* of the Common Development and Distribution License Version 1.0
18	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
19	* VirtualBox OSE distribution, in which case the provisions of the
20	* CDDL are applicable instead of those of the GPL.
21	*
22	* You may elect to license modified versions of this file under the
23	* terms and conditions of either the GPL or the CDDL or both.
24	*/
25
26	#ifndef IPRT_INCLUDED_crypto_x509_h
27	#define IPRT_INCLUDED_crypto_x509_h
28	#ifndef RT_WITHOUT_PRAGMA_ONCE
29	# pragma once
30	#endif
31
32	#include <iprt/asn1.h>
33	#include <iprt/crypto/pem.h>
34
35
36	RT_C_DECLS_BEGIN
37
38	struct RTCRPKCS7SETOFCERTS;
39
40
41	/** @defgroup grp_rt_crypto Crypto
42	* @ingroup grp_rt
43	* @{
44	*/
45
46	/** @defgroup grp_rt_crx509 RTCrX509 - Public Key and Privilege Management Infrastructure.
47	* @{
48	*/
49
50	/**
51	* X.509 algorithm identifier (IPRT representation).
52	*/
53	typedef struct RTCRX509ALGORITHMIDENTIFIER
54	{
55	/** The sequence making up this algorithm identifier. */
56	RTASN1SEQUENCECORE SeqCore;
57	/** The algorithm object ID. */
58	RTASN1OBJID Algorithm;
59	/** Optional parameters specified by the algorithm. */
60	RTASN1DYNTYPE Parameters;
61	} RTCRX509ALGORITHMIDENTIFIER;
62	/** Poitner to the IPRT representation of a X.509 algorithm identifier. */
63	typedef RTCRX509ALGORITHMIDENTIFIER *PRTCRX509ALGORITHMIDENTIFIER;
64	/** Poitner to the const IPRT representation of a X.509 algorithm identifier. */
65	typedef RTCRX509ALGORITHMIDENTIFIER const *PCRTCRX509ALGORITHMIDENTIFIER;
66	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509ALGORITHMIDENTIFIER, RTDECL, RTCrX509AlgorithmIdentifier, SeqCore.Asn1Core);
67	RTASN1_IMPL_GEN_SET_OF_TYPEDEFS_AND_PROTOS(RTCRX509ALGORITHMIDENTIFIERS, RTCRX509ALGORITHMIDENTIFIER, RTDECL, RTCrX509AlgorithmIdentifiers);
68
69	/**
70	* Tries to convert an X.509 digest algorithm ID into a RTDIGESTTYPE value.
71	*
72	* @returns Valid RTDIGESTTYPE on success, RTDIGESTTYPE_INVALID on failure.
73	* @param pThis The IPRT representation of a X.509 algorithm
74	* identifier object.
75	*/
76	RTDECL(RTDIGESTTYPE) RTCrX509AlgorithmIdentifier_QueryDigestType(PCRTCRX509ALGORITHMIDENTIFIER pThis);
77
78	/**
79	* Tries to figure the digest size of an X.509 digest algorithm ID.
80	*
81	* @returns The digest size in bytes, UINT32_MAX if unknown digest.
82	* @param pThis The IPRT representation of a X.509 algorithm
83	* identifier object.
84	*/
85	RTDECL(uint32_t) RTCrX509AlgorithmIdentifier_QueryDigestSize(PCRTCRX509ALGORITHMIDENTIFIER pThis);
86
87	RTDECL(int) RTCrX509AlgorithmIdentifier_CompareWithString(PCRTCRX509ALGORITHMIDENTIFIER pThis, const char *pszObjId);
88
89	/**
90	* Compares a digest with an encrypted digest algorithm, checking if they
91	* specify the same digest.
92	*
93	* @returns 0 if same digest, -1 if the digest is unknown, 1 if the encrypted
94	* digest does not match.
95	* @param pDigest The digest algorithm.
96	* @param pEncryptedDigest The encrypted digest algorithm.
97	*/
98	RTDECL(int) RTCrX509AlgorithmIdentifier_CompareDigestAndEncryptedDigest(PCRTCRX509ALGORITHMIDENTIFIER pDigest,
99	PCRTCRX509ALGORITHMIDENTIFIER pEncryptedDigest);
100	/**
101	* Compares a digest OID with an encrypted digest algorithm OID, checking if
102	* they specify the same digest.
103	*
104	* @returns 0 if same digest, -1 if the digest is unknown, 1 if the encrypted
105	* digest does not match.
106	* @param pszDigestOid The digest algorithm OID.
107	* @param pszEncryptedDigestOid The encrypted digest algorithm OID.
108	*/
109	RTDECL(int) RTCrX509AlgorithmIdentifier_CompareDigestOidAndEncryptedDigestOid(const char *pszDigestOid,
110	const char *pszEncryptedDigestOid);
111
112
113	/**
114	* Combine the encryption algorithm with the digest algorithm.
115	*
116	* @returns OID of encrypted digest algorithm.
117	* @param pEncryption The encryption algorithm. Will work if this is
118	* the OID of an encrypted digest algorithm too, as
119	* long as it matches @a pDigest.
120	* @param pDigest The digest algorithm. Will work if this is the
121	* OID of an encrypted digest algorithm too, as
122	* long as it matches @a pEncryption.
123	*/
124	RTDECL(const char *) RTCrX509AlgorithmIdentifier_CombineEncryptionAndDigest(PCRTCRX509ALGORITHMIDENTIFIER pEncryption,
125	PCRTCRX509ALGORITHMIDENTIFIER pDigest);
126
127	/**
128	* Combine the encryption algorithm OID with the digest algorithm OID.
129	*
130	* @returns OID of encrypted digest algorithm.
131	* @param pszEncryptionOid The encryption algorithm. Will work if this is
132	* the OID of an encrypted digest algorithm too, as
133	* long as it matches @a pszDigestOid.
134	* @param pszDigestOid The digest algorithm. Will work if this is the
135	* OID of an encrypted digest algorithm too, as
136	* long as it matches @a pszEncryptionOid.
137	*/
138	RTDECL(const char ) RTCrX509AlgorithmIdentifier_CombineEncryptionOidAndDigestOid(const char pszEncryptionOid,
139	const char *pszDigestOid);
140
141
142	/** @name Typical Digest Algorithm OIDs.
143	* @{ */
144	#define RTCRX509ALGORITHMIDENTIFIERID_MD2 "1.2.840.113549.2.2"
145	#define RTCRX509ALGORITHMIDENTIFIERID_MD4 "1.2.840.113549.2.4"
146	#define RTCRX509ALGORITHMIDENTIFIERID_MD5 "1.2.840.113549.2.5"
147	#define RTCRX509ALGORITHMIDENTIFIERID_SHA1 "1.3.14.3.2.26"
148	#define RTCRX509ALGORITHMIDENTIFIERID_SHA256 "2.16.840.1.101.3.4.2.1"
149	#define RTCRX509ALGORITHMIDENTIFIERID_SHA384 "2.16.840.1.101.3.4.2.2"
150	#define RTCRX509ALGORITHMIDENTIFIERID_SHA512 "2.16.840.1.101.3.4.2.3"
151	#define RTCRX509ALGORITHMIDENTIFIERID_SHA224 "2.16.840.1.101.3.4.2.4"
152	#define RTCRX509ALGORITHMIDENTIFIERID_SHA512T224 "2.16.840.1.101.3.4.2.5"
153	#define RTCRX509ALGORITHMIDENTIFIERID_SHA512T256 "2.16.840.1.101.3.4.2.6"
154	#define RTCRX509ALGORITHMIDENTIFIERID_SHA3_224 "2.16.840.1.101.3.4.2.7"
155	#define RTCRX509ALGORITHMIDENTIFIERID_SHA3_256 "2.16.840.1.101.3.4.2.8"
156	#define RTCRX509ALGORITHMIDENTIFIERID_SHA3_384 "2.16.840.1.101.3.4.2.9"
157	#define RTCRX509ALGORITHMIDENTIFIERID_SHA3_512 "2.16.840.1.101.3.4.2.10"
158	#define RTCRX509ALGORITHMIDENTIFIERID_WHIRLPOOL "1.0.10118.3.0.55"
159	/** @} */
160
161	/** @name Encrypted Digest Algorithm OIDs.
162	* @remarks The PKCS variants are the default ones, alternative OID are marked
163	* as such.
164	* @{ */
165	#define RTCRX509ALGORITHMIDENTIFIERID_RSA "1.2.840.113549.1.1.1"
166	#define RTCRX509ALGORITHMIDENTIFIERID_MD2_WITH_RSA "1.2.840.113549.1.1.2"
167	#define RTCRX509ALGORITHMIDENTIFIERID_MD4_WITH_RSA "1.2.840.113549.1.1.3"
168	#define RTCRX509ALGORITHMIDENTIFIERID_MD5_WITH_RSA "1.2.840.113549.1.1.4"
169	#define RTCRX509ALGORITHMIDENTIFIERID_SHA1_WITH_RSA "1.2.840.113549.1.1.5"
170	#define RTCRX509ALGORITHMIDENTIFIERID_SHA256_WITH_RSA "1.2.840.113549.1.1.11"
171	#define RTCRX509ALGORITHMIDENTIFIERID_SHA384_WITH_RSA "1.2.840.113549.1.1.12"
172	#define RTCRX509ALGORITHMIDENTIFIERID_SHA512_WITH_RSA "1.2.840.113549.1.1.13"
173	#define RTCRX509ALGORITHMIDENTIFIERID_SHA224_WITH_RSA "1.2.840.113549.1.1.14"
174	#define RTCRX509ALGORITHMIDENTIFIERID_SHA512T224_WITH_RSA "1.2.840.113549.1.1.15"
175	#define RTCRX509ALGORITHMIDENTIFIERID_SHA512T256_WITH_RSA "1.2.840.113549.1.1.16"
176	#define RTCRX509ALGORITHMIDENTIFIERID_SHA3_224_WITH_RSA "2.16.840.1.101.3.4.3.13"
177	#define RTCRX509ALGORITHMIDENTIFIERID_SHA3_256_WITH_RSA "2.16.840.1.101.3.4.3.14"
178	#define RTCRX509ALGORITHMIDENTIFIERID_SHA3_384_WITH_RSA "2.16.840.1.101.3.4.3.15"
179	#define RTCRX509ALGORITHMIDENTIFIERID_SHA3_512_WITH_RSA "2.16.840.1.101.3.4.3.16"
180	/** @} */
181
182
183
184
185	/**
186	* One X.509 AttributeTypeAndValue (IPRT representation).
187	*/
188	typedef struct RTCRX509ATTRIBUTETYPEANDVALUE
189	{
190	/** Sequence core. */
191	RTASN1SEQUENCECORE SeqCore;
192	/** The attribute type (object ID). */
193	RTASN1OBJID Type;
194	/** The attribute value (what it is is defined by Type). */
195	RTASN1DYNTYPE Value;
196	} RTCRX509ATTRIBUTETYPEANDVALUE;
197	/** Pointer to a X.509 AttributeTypeAndValue (IPRT representation). */
198	typedef RTCRX509ATTRIBUTETYPEANDVALUE *PRTCRX509ATTRIBUTETYPEANDVALUE;
199	/** Pointer to a const X.509 AttributeTypeAndValue (IPRT representation). */
200	typedef RTCRX509ATTRIBUTETYPEANDVALUE const *PCRTCRX509ATTRIBUTETYPEANDVALUE;
201	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509ATTRIBUTETYPEANDVALUE, RTDECL, RTCrX509AttributeTypeAndValue, SeqCore.Asn1Core);
202	RTASN1_IMPL_GEN_SET_OF_TYPEDEFS_AND_PROTOS(RTCRX509ATTRIBUTETYPEANDVALUES, RTCRX509ATTRIBUTETYPEANDVALUE, RTDECL, RTCrX509AttributeTypeAndValues);
203
204	RTASN1TYPE_ALIAS(RTCRX509RELATIVEDISTINGUISHEDNAME, RTCRX509ATTRIBUTETYPEANDVALUES, RTCrX509RelativeDistinguishedName, RTCrX509AttributeTypeAndValues);
205
206
207	RTASN1_IMPL_GEN_SEQ_OF_TYPEDEFS_AND_PROTOS(RTCRX509NAME, RTCRX509RELATIVEDISTINGUISHEDNAME, RTDECL, RTCrX509Name);
208	RTDECL(int) RTCrX509Name_CheckSanity(PCRTCRX509NAME pName, uint32_t fFlags, PRTERRINFO pErrInfo, const char *pszErrorTag);
209	RTDECL(bool) RTCrX509Name_MatchByRfc5280(PCRTCRX509NAME pLeft, PCRTCRX509NAME pRight);
210
211	/**
212	* Name constraint matching (RFC-5280).
213	*
214	* @returns true on match, false on mismatch.
215	* @param pConstraint The constraint name.
216	* @param pName The name to match against the constraint.
217	* @sa RTCrX509GeneralName_ConstraintMatch,
218	* RTCrX509RelativeDistinguishedName_ConstraintMatch
219	*/
220	RTDECL(bool) RTCrX509Name_ConstraintMatch(PCRTCRX509NAME pConstraint, PCRTCRX509NAME pName);
221	RTDECL(int) RTCrX509Name_RecodeAsUtf8(PRTCRX509NAME pThis, PCRTASN1ALLOCATORVTABLE pAllocator);
222
223	/**
224	* Matches the directory name against a comma separated list of the component
225	* strings (case sensitive).
226	*
227	* @returns true if match, false if mismatch.
228	* @param pThis The name object.
229	* @param pszString The string to match against. For example:
230	* "C=US, ST=California, L=Redwood Shores, O=Oracle Corporation"
231	*
232	* @remarks This is doing a straight compare, no extra effort is expended in
233	* dealing with different component order. If the component order
234	* differs, there won't be any match.
235	*/
236	RTDECL(bool) RTCrX509Name_MatchWithString(PCRTCRX509NAME pThis, const char *pszString);
237
238	/**
239	* Formats the name as a command separated list of components with type
240	* prefixes.
241	*
242	* The output of this function is suitable for use with
243	* RTCrX509Name_MatchWithString.
244	*
245	* @returns IPRT status code.
246	* @param pThis The name object.
247	* @param pszBuf The output buffer.
248	* @param cbBuf The size of the output buffer.
249	* @param pcbActual Where to return the number of bytes required for the
250	* output, including the null terminator character.
251	* Optional.
252	*/
253	RTDECL(int) RTCrX509Name_FormatAsString(PCRTCRX509NAME pThis, char pszBuf, size_t cbBuf, size_t pcbActual);
254
255
256	/**
257	* Looks up the RDN ID and returns the short name for it, if found.
258	*
259	* @returns Short name (e.g. 'CN') or NULL.
260	* @param pRdnId The RDN ID to look up.
261	*/
262	RTDECL(const char *) RTCrX509Name_GetShortRdn(PCRTASN1OBJID pRdnId);
263
264	/**
265	* One X.509 OtherName (IPRT representation).
266	*/
267	typedef struct RTCRX509OTHERNAME
268	{
269	/** The sequence core. */
270	RTASN1SEQUENCECORE SeqCore;
271	/** The name type identifier. */
272	RTASN1OBJID TypeId;
273	/** The name value (explicit tag 0). */
274	RTASN1DYNTYPE Value;
275	} RTCRX509OTHERNAME;
276	/** Pointer to a X.509 OtherName (IPRT representation). */
277	typedef RTCRX509OTHERNAME *PRTCRX509OTHERNAME;
278	/** Pointer to a const X.509 OtherName (IPRT representation). */
279	typedef RTCRX509OTHERNAME const *PCRTCRX509OTHERNAME;
280	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509OTHERNAME, RTDECL, RTCrX509OtherName, SeqCore.Asn1Core);
281
282
283	typedef enum RTCRX509GENERALNAMECHOICE
284	{
285	RTCRX509GENERALNAMECHOICE_INVALID = 0,
286	RTCRX509GENERALNAMECHOICE_OTHER_NAME,
287	RTCRX509GENERALNAMECHOICE_RFC822_NAME,
288	RTCRX509GENERALNAMECHOICE_DNS_NAME,
289	RTCRX509GENERALNAMECHOICE_X400_ADDRESS,
290	RTCRX509GENERALNAMECHOICE_DIRECTORY_NAME,
291	RTCRX509GENERALNAMECHOICE_EDI_PARTY_NAME,
292	RTCRX509GENERALNAMECHOICE_URI,
293	RTCRX509GENERALNAMECHOICE_IP_ADDRESS,
294	RTCRX509GENERALNAMECHOICE_REGISTERED_ID,
295	RTCRX509GENERALNAMECHOICE_END,
296	RTCRX509GENERALNAMECHOICE_32BIT_HACK = 0x7fffffff
297	} RTCRX509GENERALNAMECHOICE;
298
299	/**
300	* One X.509 GeneralName (IPRT representation).
301	*
302	* This is represented as a union. Use the RTCRX509GENERALNAME_IS_XXX predicate
303	* macros to figure out which member is valid (Asn1Core is always valid).
304	*/
305	typedef struct RTCRX509GENERALNAME
306	{
307	/** Dummy ASN.1 record, not encoded. */
308	RTASN1DUMMY Dummy;
309	/** The value allocation. */
310	RTASN1ALLOCATION Allocation;
311	/** The choice of value. */
312	RTCRX509GENERALNAMECHOICE enmChoice;
313	/** The value union. */
314	union
315	{
316	/** Tag 0: Other Name. */
317	PRTCRX509OTHERNAME pT0_OtherName;
318	/** Tag 1: RFC-822 Name. */
319	PRTASN1STRING pT1_Rfc822;
320	/** Tag 2: DNS name. */
321	PRTASN1STRING pT2_DnsName;
322	/** Tag 3: X.400 Address. */
323	struct
324	{
325	/** Context tag 3. */
326	RTASN1CONTEXTTAG3 CtxTag3;
327	/** Later. */
328	RTASN1DYNTYPE X400Address;
329	} *pT3;
330	/** Tag 4: Directory Name. */
331	struct
332	{
333	/** Context tag 4. */
334	RTASN1CONTEXTTAG4 CtxTag4;
335	/** Directory name. */
336	RTCRX509NAME DirectoryName;
337	} *pT4;
338	/** Tag 5: EDI Party Name. */
339	struct
340	{
341	/** Context tag 5. */
342	RTASN1CONTEXTTAG5 CtxTag5;
343	/** Later. */
344	RTASN1DYNTYPE EdiPartyName;
345	} *pT5;
346	/** Tag 6: URI. */
347	PRTASN1STRING pT6_Uri;
348	/** Tag 7: IP address. Either 4/8 (IPv4) or 16/32 (IPv16) octets long. */
349	PRTASN1OCTETSTRING pT7_IpAddress;
350	/** Tag 8: Registered ID. */
351	PRTASN1OBJID pT8_RegisteredId;
352	} u;
353	} RTCRX509GENERALNAME;
354	/** Pointer to the IPRT representation of an X.509 general name. */
355	typedef RTCRX509GENERALNAME *PRTCRX509GENERALNAME;
356	/** Pointer to the const IPRT representation of an X.509 general name. */
357	typedef RTCRX509GENERALNAME const *PCRTCRX509GENERALNAME;
358	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509GENERALNAME, RTDECL, RTCrX509GeneralName, Dummy.Asn1Core);
359
360	/** @name RTCRX509GENERALNAME tag predicates.
361	* @{ */
362	#define RTCRX509GENERALNAME_IS_OTHER_NAME(a_GenName) ((a_GenName)->enmChoice == RTCRX509GENERALNAMECHOICE_OTHER_NAME)
363	#define RTCRX509GENERALNAME_IS_RFC822_NAME(a_GenName) ((a_GenName)->enmChoice == RTCRX509GENERALNAMECHOICE_RFC822_NAME)
364	#define RTCRX509GENERALNAME_IS_DNS_NAME(a_GenName) ((a_GenName)->enmChoice == RTCRX509GENERALNAMECHOICE_DNS_NAME)
365	#define RTCRX509GENERALNAME_IS_X400_ADDRESS(a_GenName) ((a_GenName)->enmChoice == RTCRX509GENERALNAMECHOICE_X400_ADDRESS)
366	#define RTCRX509GENERALNAME_IS_DIRECTORY_NAME(a_GenName) ((a_GenName)->enmChoice == RTCRX509GENERALNAMECHOICE_DIRECTORY_NAME)
367	#define RTCRX509GENERALNAME_IS_EDI_PARTY_NAME(a_GenName) ((a_GenName)->enmChoice == RTCRX509GENERALNAMECHOICE_EDI_PARTY_NAME)
368	#define RTCRX509GENERALNAME_IS_URI(a_GenName) ((a_GenName)->enmChoice == RTCRX509GENERALNAMECHOICE_URI)
369	#define RTCRX509GENERALNAME_IS_IP_ADDRESS(a_GenName) ((a_GenName)->enmChoice == RTCRX509GENERALNAMECHOICE_IP_ADDRESS)
370	#define RTCRX509GENERALNAME_IS_REGISTERED_ID(a_GenName) ((a_GenName)->enmChoice == RTCRX509GENERALNAMECHOICE_REGISTERED_ID)
371	/** @} */
372
373
374	RTASN1_IMPL_GEN_SEQ_OF_TYPEDEFS_AND_PROTOS(RTCRX509GENERALNAMES, RTCRX509GENERALNAME, RTDECL, RTCrX509GeneralNames);
375	RTDECL(bool) RTCrX509GeneralName_ConstraintMatch(PCRTCRX509GENERALNAME pConstraint, PCRTCRX509GENERALNAME pName);
376
377
378	/**
379	* X.509 Validity (IPRT representation).
380	*/
381	typedef struct RTCRX509VALIDITY
382	{
383	/** Core sequence bits. */
384	RTASN1SEQUENCECORE SeqCore;
385	/** Effective starting. */
386	RTASN1TIME NotBefore;
387	/** Expires after. */
388	RTASN1TIME NotAfter;
389	} RTCRX509VALIDITY;
390	/** Pointer to the IPRT representation of an X.509 validity sequence. */
391	typedef RTCRX509VALIDITY *PRTCRX509VALIDITY;
392	/** Pointer ot the const IPRT representation of an X.509 validity sequence. */
393	typedef RTCRX509VALIDITY const *PCRTCRX509VALIDITY;
394	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509VALIDITY, RTDECL, RTCrX509Validity, SeqCore.Asn1Core);
395
396	RTDECL(bool) RTCrX509Validity_IsValidAtTimeSpec(PCRTCRX509VALIDITY pThis, PCRTTIMESPEC pTimeSpec);
397
398
399	#if 0
400	/**
401	* X.509 UniqueIdentifier (IPRT representation).
402	*/
403	typedef struct RTCRX509UNIQUEIDENTIFIER
404	{
405	/** Representation is a bit string. */
406	RTASN1BITSTRING BitString;
407	} RTCRX509UNIQUEIDENTIFIER;
408	/** Pointer to the IPRT representation of an X.509 unique identifier. */
409	typedef RTCRX509UNIQUEIDENTIFIER *PRTCRX509UNIQUEIDENTIFIER;
410	/** Pointer to the const IPRT representation of an X.509 unique identifier. */
411	typedef RTCRX509UNIQUEIDENTIFIER const *PCRTCRX509UNIQUEIDENTIFIER;
412	RTASN1TYPE_STANDARD_PROTOTYPES_NO_GET_CORE(RTCRX509UNIQUEIDENTIFIER, RTDECL, RTCrX509UniqueIdentifier);
413	#endif
414	RTASN1TYPE_ALIAS(RTCRX509UNIQUEIDENTIFIER, RTASN1BITSTRING, RTCrX509UniqueIdentifier, RTAsn1BitString);
415
416
417	/**
418	* X.509 SubjectPublicKeyInfo (IPRT representation).
419	*/
420	typedef struct RTCRX509SUBJECTPUBLICKEYINFO
421	{
422	/** Core sequence bits. */
423	RTASN1SEQUENCECORE SeqCore;
424	/** The algorithm used with the public key. */
425	RTCRX509ALGORITHMIDENTIFIER Algorithm;
426	/** A bit string containing the public key.
427	*
428	* For algorithms like rsaEncryption this is generally a sequence of two
429	* integers, where the first one has lots of bits, and the second one being a
430	* modulous value. These are details specific to the algorithm and not relevant
431	* when validating the certificate chain. */
432	RTASN1BITSTRING SubjectPublicKey;
433	} RTCRX509SUBJECTPUBLICKEYINFO;
434	/** Pointer to the IPRT representation of an X.509 subject public key info
435	* sequence. */
436	typedef RTCRX509SUBJECTPUBLICKEYINFO *PRTCRX509SUBJECTPUBLICKEYINFO;
437	/** Pointer to the const IPRT representation of an X.509 subject public key info
438	* sequence. */
439	typedef RTCRX509SUBJECTPUBLICKEYINFO const *PCRTCRX509SUBJECTPUBLICKEYINFO;
440	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509SUBJECTPUBLICKEYINFO, RTDECL, RTCrX509SubjectPublicKeyInfo, SeqCore.Asn1Core);
441
442
443	/**
444	* One X.509 AuthorityKeyIdentifier (IPRT representation).
445	*/
446	typedef struct RTCRX509AUTHORITYKEYIDENTIFIER
447	{
448	/** Sequence core. */
449	RTASN1SEQUENCECORE SeqCore;
450	/** Tag 0, optional, implicit: Key identifier. */
451	RTASN1OCTETSTRING KeyIdentifier;
452	/** Tag 1, optional, implicit: Issuer name. */
453	RTCRX509GENERALNAMES AuthorityCertIssuer;
454	/** Tag 2, optional, implicit: Serial number of issuer. */
455	RTASN1INTEGER AuthorityCertSerialNumber;
456	} RTCRX509AUTHORITYKEYIDENTIFIER;
457	/** Pointer to the IPRT representation of an X.509 AuthorityKeyIdentifier
458	* sequence. */
459	typedef RTCRX509AUTHORITYKEYIDENTIFIER *PRTCRX509AUTHORITYKEYIDENTIFIER;
460	/** Pointer to the const IPRT representation of an X.509 AuthorityKeyIdentifier
461	* sequence. */
462	typedef RTCRX509AUTHORITYKEYIDENTIFIER const *PCRTCRX509AUTHORITYKEYIDENTIFIER;
463	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509AUTHORITYKEYIDENTIFIER, RTDECL, RTCrX509AuthorityKeyIdentifier, SeqCore.Asn1Core);
464
465
466	/**
467	* One X.509 OldAuthorityKeyIdentifier (IPRT representation).
468	*/
469	typedef struct RTCRX509OLDAUTHORITYKEYIDENTIFIER
470	{
471	/** Sequence core. */
472	RTASN1SEQUENCECORE SeqCore;
473	/** Tag 0, optional, implicit: Key identifier. */
474	RTASN1OCTETSTRING KeyIdentifier;
475	struct
476	{
477	RTASN1CONTEXTTAG1 CtxTag1;
478	/** Tag 1, optional, implicit: Issuer name. */
479	RTCRX509NAME AuthorityCertIssuer;
480	} T1;
481	/** Tag 2, optional, implicit: Serial number of issuer. */
482	RTASN1INTEGER AuthorityCertSerialNumber;
483	} RTCRX509OLDAUTHORITYKEYIDENTIFIER;
484	/** Pointer to the IPRT representation of an X.509 AuthorityKeyIdentifier
485	* sequence. */
486	typedef RTCRX509OLDAUTHORITYKEYIDENTIFIER *PRTCRX509OLDAUTHORITYKEYIDENTIFIER;
487	/** Pointer to the const IPRT representation of an X.509 AuthorityKeyIdentifier
488	* sequence. */
489	typedef RTCRX509OLDAUTHORITYKEYIDENTIFIER const *PCRTCRX509OLDAUTHORITYKEYIDENTIFIER;
490	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509OLDAUTHORITYKEYIDENTIFIER, RTDECL, RTCrX509OldAuthorityKeyIdentifier, SeqCore.Asn1Core);
491
492
493	/**
494	* One X.509 PolicyQualifierInfo (IPRT representation).
495	*/
496	typedef struct RTCRX509POLICYQUALIFIERINFO
497	{
498	/** Core sequence bits. */
499	RTASN1SEQUENCECORE SeqCore;
500	/** The policy object ID. */
501	RTASN1OBJID PolicyQualifierId;
502	/** Anything defined by the policy qualifier id. */
503	RTASN1DYNTYPE Qualifier;
504	} RTCRX509POLICYQUALIFIERINFO;
505	/** Pointer to the IPRT representation of an X.509 PolicyQualifierInfo
506	* sequence. */
507	typedef RTCRX509POLICYQUALIFIERINFO *PRTCRX509POLICYQUALIFIERINFO;
508	/** Pointer to the const IPRT representation of an X.509 PolicyQualifierInfo
509	* sequence. */
510	typedef RTCRX509POLICYQUALIFIERINFO const *PCRTCRX509POLICYQUALIFIERINFO;
511	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509POLICYQUALIFIERINFO, RTDECL, RTCrX509PolicyQualifierInfo, SeqCore.Asn1Core);
512	RTASN1_IMPL_GEN_SEQ_OF_TYPEDEFS_AND_PROTOS(RTCRX509POLICYQUALIFIERINFOS, RTCRX509POLICYQUALIFIERINFO, RTDECL, RTCrX509PolicyQualifierInfos);
513
514
515	/**
516	* One X.509 PolicyInformation (IPRT representation).
517	*/
518	typedef struct RTCRX509POLICYINFORMATION
519	{
520	/** Core sequence bits. */
521	RTASN1SEQUENCECORE SeqCore;
522	/** The policy object ID. */
523	RTASN1OBJID PolicyIdentifier;
524	/** Optional sequence of policy qualifiers. */
525	RTCRX509POLICYQUALIFIERINFOS PolicyQualifiers;
526	} RTCRX509POLICYINFORMATION;
527	/** Pointer to the IPRT representation of an X.509 PolicyInformation
528	* sequence. */
529	typedef RTCRX509POLICYINFORMATION *PRTCRX509POLICYINFORMATION;
530	/** Pointer to the const IPRT representation of an X.509 PolicyInformation
531	* sequence. */
532	typedef RTCRX509POLICYINFORMATION const *PCRTCRX509POLICYINFORMATION;
533	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509POLICYINFORMATION, RTDECL, RTCrX509PolicyInformation, SeqCore.Asn1Core);
534	RTASN1_IMPL_GEN_SEQ_OF_TYPEDEFS_AND_PROTOS(RTCRX509CERTIFICATEPOLICIES, RTCRX509POLICYINFORMATION, RTDECL, RTCrX509CertificatePolicies);
535
536	/** Sepcial policy object ID that matches any policy. */
537	#define RTCRX509_ID_CE_CP_ANY_POLICY_OID "2.5.29.32.0"
538
539
540	/**
541	* One X.509 PolicyMapping (IPRT representation).
542	*/
543	typedef struct RTCRX509POLICYMAPPING
544	{
545	/** Core sequence bits. */
546	RTASN1SEQUENCECORE SeqCore;
547	/** Issuer policy ID. */
548	RTASN1OBJID IssuerDomainPolicy;
549	/** Subject policy ID. */
550	RTASN1OBJID SubjectDomainPolicy;
551	} RTCRX509POLICYMAPPING;
552	/** Pointer to the IPRT representation of a sequence of X.509 PolicyMapping. */
553	typedef RTCRX509POLICYMAPPING *PRTCRX509POLICYMAPPING;
554	/** Pointer to the const IPRT representation of a sequence of X.509
555	* PolicyMapping. */
556	typedef RTCRX509POLICYMAPPING const *PCRTCRX509POLICYMAPPING;
557	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509POLICYMAPPING, RTDECL, RTCrX509PolicyMapping, SeqCore.Asn1Core);
558	RTASN1_IMPL_GEN_SEQ_OF_TYPEDEFS_AND_PROTOS(RTCRX509POLICYMAPPINGS, RTCRX509POLICYMAPPING, RTDECL, RTCrX509PolicyMappings);
559
560
561	/**
562	* X.509 BasicConstraints (IPRT representation).
563	*/
564	typedef struct RTCRX509BASICCONSTRAINTS
565	{
566	/** Core sequence bits. */
567	RTASN1SEQUENCECORE SeqCore;
568	/** Is this ia certficiate authority? Default to false. */
569	RTASN1BOOLEAN CA;
570	/** Path length constraint. */
571	RTASN1INTEGER PathLenConstraint;
572	} RTCRX509BASICCONSTRAINTS;
573	/** Pointer to the IPRT representation of a sequence of X.509
574	* BasicConstraints. */
575	typedef RTCRX509BASICCONSTRAINTS *PRTCRX509BASICCONSTRAINTS;
576	/** Pointer to the const IPRT representation of a sequence of X.509
577	* BasicConstraints. */
578	typedef RTCRX509BASICCONSTRAINTS const *PCRTCRX509BASICCONSTRAINTS;
579	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509BASICCONSTRAINTS, RTDECL, RTCrX509BasicConstraints, SeqCore.Asn1Core);
580
581
582	/**
583	* X.509 GeneralSubtree (IPRT representation).
584	*/
585	typedef struct RTCRX509GENERALSUBTREE
586	{
587	/** Core sequence bits. */
588	RTASN1SEQUENCECORE SeqCore;
589	/** Base name. */
590	RTCRX509GENERALNAME Base;
591	/** Tag 0, optional: Minimum, default 0. Fixed at 0 by RFC-5280. */
592	RTASN1INTEGER Minimum;
593	/** Tag 1, optional: Maximum. Fixed as not-present by RFC-5280. */
594	RTASN1INTEGER Maximum;
595	} RTCRX509GENERALSUBTREE;
596	/** Pointer to the IPRT representation of a sequence of X.509 GeneralSubtree. */
597	typedef RTCRX509GENERALSUBTREE *PRTCRX509GENERALSUBTREE;
598	/** Pointer to the const IPRT representation of a sequence of X.509
599	* GeneralSubtree. */
600	typedef RTCRX509GENERALSUBTREE const *PCRTCRX509GENERALSUBTREE;
601	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509GENERALSUBTREE, RTDECL, RTCrX509GeneralSubtree, SeqCore.Asn1Core);
602
603	RTDECL(bool) RTCrX509GeneralSubtree_ConstraintMatch(PCRTCRX509GENERALSUBTREE pConstraint, PCRTCRX509GENERALSUBTREE pName);
604
605	RTASN1_IMPL_GEN_SEQ_OF_TYPEDEFS_AND_PROTOS(RTCRX509GENERALSUBTREES, RTCRX509GENERALSUBTREE, RTDECL, RTCrX509GeneralSubtrees);
606
607
608	/**
609	* X.509 NameConstraints (IPRT representation).
610	*/
611	typedef struct RTCRX509NAMECONSTRAINTS
612	{
613	/** Core sequence bits. */
614	RTASN1SEQUENCECORE SeqCore;
615	/** Tag 0, optional: Permitted subtrees. */
616	struct
617	{
618	/** Context tag. */
619	RTASN1CONTEXTTAG0 CtxTag0;
620	/** The permitted subtrees. */
621	RTCRX509GENERALSUBTREES PermittedSubtrees;
622	} T0;
623	/** Tag 1, optional: Excluded subtrees. */
624	struct
625	{
626	/** Context tag. */
627	RTASN1CONTEXTTAG1 CtxTag1;
628	/** The excluded subtrees. */
629	RTCRX509GENERALSUBTREES ExcludedSubtrees;
630	} T1;
631	} RTCRX509NAMECONSTRAINTS;
632	/** Pointer to the IPRT representation of a sequence of X.509
633	* NameConstraints. */
634	typedef RTCRX509NAMECONSTRAINTS *PRTCRX509NAMECONSTRAINTS;
635	/** Pointer to the const IPRT representation of a sequence of X.509
636	* NameConstraints. */
637	typedef RTCRX509NAMECONSTRAINTS const *PCRTCRX509NAMECONSTRAINTS;
638	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509NAMECONSTRAINTS, RTDECL, RTCrX509NameConstraints, SeqCore.Asn1Core);
639
640
641	/**
642	* X.509 PolicyConstraints (IPRT representation).
643	*/
644	typedef struct RTCRX509POLICYCONSTRAINTS
645	{
646	/** Core sequence bits. */
647	RTASN1SEQUENCECORE SeqCore;
648	/** Tag 0, optional: Certificates before an explicit policy is required. */
649	RTASN1INTEGER RequireExplicitPolicy;
650	/** Tag 1, optional: Certificates before policy mapping is inhibited. */
651	RTASN1INTEGER InhibitPolicyMapping;
652	} RTCRX509POLICYCONSTRAINTS;
653	/** Pointer to the IPRT representation of a sequence of X.509
654	* PolicyConstraints. */
655	typedef RTCRX509POLICYCONSTRAINTS *PRTCRX509POLICYCONSTRAINTS;
656	/** Pointer to the const IPRT representation of a sequence of X.509
657	* PolicyConstraints. */
658	typedef RTCRX509POLICYCONSTRAINTS const *PCRTCRX509POLICYCONSTRAINTS;
659	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509POLICYCONSTRAINTS, RTDECL, RTCrX509PolicyConstraints, SeqCore.Asn1Core);
660
661
662	/**
663	* Indicates what an X.509 extension value encapsulates.
664	*/
665	typedef enum RTCRX509EXTENSIONVALUE
666	{
667	RTCRX509EXTENSIONVALUE_INVALID = 0,
668	/** Unknown, no decoding available just the octet string. */
669	RTCRX509EXTENSIONVALUE_UNKNOWN,
670	/** Unencapsulated (i.e. octet string). */
671	RTCRX509EXTENSIONVALUE_NOT_ENCAPSULATED,
672
673	/** Bit string (RTASN1BITSTRING). */
674	RTCRX509EXTENSIONVALUE_BIT_STRING,
675	/** Octet string (RTASN1OCTETSTRING). */
676	RTCRX509EXTENSIONVALUE_OCTET_STRING,
677	/** Integer string (RTASN1INTEGER). */
678	RTCRX509EXTENSIONVALUE_INTEGER,
679	/** Sequence of object identifiers (RTASN1SEQOFOBJIDS). */
680	RTCRX509EXTENSIONVALUE_SEQ_OF_OBJ_IDS,
681
682	/** Authority key identifier (RTCRX509AUTHORITYKEYIDENTIFIER). */
683	RTCRX509EXTENSIONVALUE_AUTHORITY_KEY_IDENTIFIER,
684	/** Old Authority key identifier (RTCRX509OLDAUTHORITYKEYIDENTIFIER). */
685	RTCRX509EXTENSIONVALUE_OLD_AUTHORITY_KEY_IDENTIFIER,
686	/** Certificate policies (RTCRX509CERTIFICATEPOLICIES). */
687	RTCRX509EXTENSIONVALUE_CERTIFICATE_POLICIES,
688	/** Sequence of policy mappings (RTCRX509POLICYMAPPINGS). */
689	RTCRX509EXTENSIONVALUE_POLICY_MAPPINGS,
690	/** Basic constraints (RTCRX509BASICCONSTRAINTS). */
691	RTCRX509EXTENSIONVALUE_BASIC_CONSTRAINTS,
692	/** Name constraints (RTCRX509NAMECONSTRAINTS). */
693	RTCRX509EXTENSIONVALUE_NAME_CONSTRAINTS,
694	/** Policy constraints (RTCRX509POLICYCONSTRAINTS). */
695	RTCRX509EXTENSIONVALUE_POLICY_CONSTRAINTS,
696	/** Sequence of general names (RTCRX509GENERALNAMES). */
697	RTCRX509EXTENSIONVALUE_GENERAL_NAMES,
698
699	/** Blow the type up to 32-bits. */
700	RTCRX509EXTENSIONVALUE_32BIT_HACK = 0x7fffffff
701	} RTCRX509EXTENSIONVALUE;
702
703	/**
704	* One X.509 Extension (IPRT representation).
705	*/
706	typedef struct RTCRX509EXTENSION
707	{
708	/** Core sequence bits. */
709	RTASN1SEQUENCECORE SeqCore;
710	/** Extension ID. */
711	RTASN1OBJID ExtnId;
712	/** Whether this is critical (default @c false). */
713	RTASN1BOOLEAN Critical;
714	/** Indicates what ExtnValue.pEncapsulated points at. */
715	RTCRX509EXTENSIONVALUE enmValue;
716	/** The value.
717	* Contains extension specific data that we don't yet parse. */
718	RTASN1OCTETSTRING ExtnValue;
719	} RTCRX509EXTENSION;
720	/** Pointer to the IPRT representation of one X.509 extensions. */
721	typedef RTCRX509EXTENSION *PRTCRX509EXTENSION;
722	/** Pointer to the const IPRT representation of one X.509 extension. */
723	typedef RTCRX509EXTENSION const *PCRTCRX509EXTENSION;
724	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509EXTENSION, RTDECL, RTCrX509Extension, SeqCore.Asn1Core);
725	RTASN1_IMPL_GEN_SEQ_OF_TYPEDEFS_AND_PROTOS(RTCRX509EXTENSIONS, RTCRX509EXTENSION, RTDECL, RTCrX509Extensions);
726
727	RTDECL(int) RTCrX509Extension_ExtnValue_DecodeAsn1(PRTASN1CURSOR pCursor, uint32_t fFlags,
728	PRTCRX509EXTENSION pThis, const char *pszErrorTag);
729
730
731	/**
732	* X.509 To-be-signed certificate information (IPRT representation).
733	*/
734	typedef struct RTCRX509TBSCERTIFICATE
735	{
736	/** Sequence core. */
737	RTASN1SEQUENCECORE SeqCore;
738	/** Structure version. */
739	struct
740	{
741	/** Context tag with value 0. */
742	RTASN1CONTEXTTAG0 CtxTag0;
743	/** The actual value (RTCRX509TBSCERTIFICATE_V1, ...). */
744	RTASN1INTEGER Version;
745	} T0;
746	/** The serial number of the certificate. */
747	RTASN1INTEGER SerialNumber;
748	/** The signature algorithm. */
749	RTCRX509ALGORITHMIDENTIFIER Signature;
750	/** The issuer name. */
751	RTCRX509NAME Issuer;
752	/** The certificate validity period. */
753	RTCRX509VALIDITY Validity;
754	/** The subject name. */
755	RTCRX509NAME Subject;
756	/** The public key for this certificate. */
757	RTCRX509SUBJECTPUBLICKEYINFO SubjectPublicKeyInfo;
758	/** Issuer unique identifier (optional, version >= v2). */
759	struct
760	{
761	/** Context tag with value 1. */
762	RTASN1CONTEXTTAG1 CtxTag1;
763	/** The unique identifier value. */
764	RTCRX509UNIQUEIDENTIFIER IssuerUniqueId;
765	} T1;
766	/** Subject unique identifier (optional, version >= v2). */
767	struct
768	{
769	/** Context tag with value 2. */
770	RTASN1CONTEXTTAG2 CtxTag2;
771	/** The unique identifier value. */
772	RTCRX509UNIQUEIDENTIFIER SubjectUniqueId;
773	} T2;
774	/** Extensions (optional, version >= v3). */
775	struct
776	{
777	/** Context tag with value 3. */
778	RTASN1CONTEXTTAG3 CtxTag3;
779	/** The unique identifier value. */
780	RTCRX509EXTENSIONS Extensions;
781	/** Extensions summary flags (RTCRX509TBSCERTIFICATE_F_PRESENT_XXX). */
782	uint32_t fFlags;
783	/** Key usage flags (RTCRX509CERT_KEY_USAGE_F_XXX). */
784	uint32_t fKeyUsage;
785	/** Extended key usage flags (RTCRX509CERT_EKU_F_XXX). */
786	uint64_t fExtKeyUsage;
787
788	/** Pointer to the authority key ID extension if present. */
789	PCRTCRX509AUTHORITYKEYIDENTIFIER pAuthorityKeyIdentifier;
790	/** Pointer to the OLD authority key ID extension if present. */
791	PCRTCRX509OLDAUTHORITYKEYIDENTIFIER pOldAuthorityKeyIdentifier;
792	/** Pointer to the subject key ID extension if present. */
793	PCRTASN1OCTETSTRING pSubjectKeyIdentifier;
794	/** Pointer to the alternative subject name extension if present. */
795	PCRTCRX509GENERALNAMES pAltSubjectName;
796	/** Pointer to the alternative issuer name extension if present. */
797	PCRTCRX509GENERALNAMES pAltIssuerName;
798	/** Pointer to the certificate policies extension if present. */
799	PCRTCRX509CERTIFICATEPOLICIES pCertificatePolicies;
800	/** Pointer to the policy mappings extension if present. */
801	PCRTCRX509POLICYMAPPINGS pPolicyMappings;
802	/** Pointer to the basic constraints extension if present. */
803	PCRTCRX509BASICCONSTRAINTS pBasicConstraints;
804	/** Pointer to the name constraints extension if present. */
805	PCRTCRX509NAMECONSTRAINTS pNameConstraints;
806	/** Pointer to the policy constraints extension if present. */
807	PCRTCRX509POLICYCONSTRAINTS pPolicyConstraints;
808	/** Pointer to the inhibit anyPolicy extension if present. */
809	PCRTASN1INTEGER pInhibitAnyPolicy;
810	} T3;
811	} RTCRX509TBSCERTIFICATE;
812	/** Pointer to the IPRT representation of a X.509 TBSCertificate. */
813	typedef RTCRX509TBSCERTIFICATE *PRTCRX509TBSCERTIFICATE;
814	/** Pointer to the const IPRT representation of a X.509 TBSCertificate. */
815	typedef RTCRX509TBSCERTIFICATE const *PCRTCRX509TBSCERTIFICATE;
816	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509TBSCERTIFICATE, RTDECL, RTCrX509TbsCertificate, SeqCore.Asn1Core);
817
818	/** @name RTCRX509TBSCERTIFICATE::T0.Version values.
819	* @{ */
820	#define RTCRX509TBSCERTIFICATE_V1 0
821	#define RTCRX509TBSCERTIFICATE_V2 1
822	#define RTCRX509TBSCERTIFICATE_V3 2
823	/** @} */
824
825	/** @name RTCRX509TBSCERTIFICATE::T3.fFlags values.
826	* @{ */
827	#define RTCRX509TBSCERTIFICATE_F_PRESENT_KEY_USAGE RT_BIT_32(0)
828	#define RTCRX509TBSCERTIFICATE_F_PRESENT_EXT_KEY_USAGE RT_BIT_32(1)
829	#define RTCRX509TBSCERTIFICATE_F_PRESENT_SUBJECT_KEY_IDENTIFIER RT_BIT_32(2)
830	#define RTCRX509TBSCERTIFICATE_F_PRESENT_SUBJECT_ALT_NAME RT_BIT_32(3)
831	#define RTCRX509TBSCERTIFICATE_F_PRESENT_ISSUER_ALT_NAME RT_BIT_32(4)
832	#define RTCRX509TBSCERTIFICATE_F_PRESENT_CERTIFICATE_POLICIES RT_BIT_32(5)
833	#define RTCRX509TBSCERTIFICATE_F_PRESENT_POLICY_MAPPINGS RT_BIT_32(6)
834	#define RTCRX509TBSCERTIFICATE_F_PRESENT_BASIC_CONSTRAINTS RT_BIT_32(7)
835	#define RTCRX509TBSCERTIFICATE_F_PRESENT_NAME_CONSTRAINTS RT_BIT_32(8)
836	#define RTCRX509TBSCERTIFICATE_F_PRESENT_POLICY_CONSTRAINTS RT_BIT_32(9)
837	#define RTCRX509TBSCERTIFICATE_F_PRESENT_AUTHORITY_KEY_IDENTIFIER RT_BIT_32(10)
838	#define RTCRX509TBSCERTIFICATE_F_PRESENT_OLD_AUTHORITY_KEY_IDENTIFIER RT_BIT_32(11)
839	#define RTCRX509TBSCERTIFICATE_F_PRESENT_ACCEPTABLE_CERT_POLICIES RT_BIT_32(12)
840	#define RTCRX509TBSCERTIFICATE_F_PRESENT_INHIBIT_ANY_POLICY RT_BIT_32(13)
841	#define RTCRX509TBSCERTIFICATE_F_PRESENT_OTHER RT_BIT_32(22) /*< Other unknown extension present. /
842	#define RTCRX509TBSCERTIFICATE_F_PRESENT_NONE RT_BIT_32(23) /*< No extensions present. /
843	/** @} */
844
845	/** @name X.509 Key Usage flags. (RFC-5280 section 4.2.1.3.)
846	* @{ */
847	#define RTCRX509CERT_KEY_USAGE_F_DIGITAL_SIGNATURE_BIT 0
848	#define RTCRX509CERT_KEY_USAGE_F_DIGITAL_SIGNATURE RT_BIT_32(0)
849	#define RTCRX509CERT_KEY_USAGE_F_CONTENT_COMMITTMENT_BIT 1
850	#define RTCRX509CERT_KEY_USAGE_F_CONTENT_COMMITTMENT RT_BIT_32(1)
851	#define RTCRX509CERT_KEY_USAGE_F_KEY_ENCIPHERMENT_BIT 2
852	#define RTCRX509CERT_KEY_USAGE_F_KEY_ENCIPHERMENT RT_BIT_32(2)
853	#define RTCRX509CERT_KEY_USAGE_F_DATA_ENCIPHERMENT_BIT 3
854	#define RTCRX509CERT_KEY_USAGE_F_DATA_ENCIPHERMENT RT_BIT_32(3)
855	#define RTCRX509CERT_KEY_USAGE_F_KEY_AGREEMENT_BIT 4
856	#define RTCRX509CERT_KEY_USAGE_F_KEY_AGREEMENT RT_BIT_32(4)
857	#define RTCRX509CERT_KEY_USAGE_F_KEY_CERT_SIGN_BIT 5
858	#define RTCRX509CERT_KEY_USAGE_F_KEY_CERT_SIGN RT_BIT_32(5)
859	#define RTCRX509CERT_KEY_USAGE_F_CRL_SIGN_BIT 6
860	#define RTCRX509CERT_KEY_USAGE_F_CRL_SIGN RT_BIT_32(6)
861	#define RTCRX509CERT_KEY_USAGE_F_ENCIPHERMENT_ONLY_BIT 7
862	#define RTCRX509CERT_KEY_USAGE_F_ENCIPHERMENT_ONLY RT_BIT_32(7)
863	#define RTCRX509CERT_KEY_USAGE_F_DECIPHERMENT_ONLY_BIT 8
864	#define RTCRX509CERT_KEY_USAGE_F_DECIPHERMENT_ONLY RT_BIT_32(8)
865	/** @} */
866
867	/** @name X.509 Extended Key Usage flags. (RFC-5280 section 4.2.1.12, ++.)
868	* @remarks Needless to say, these flags doesn't cover all possible extended key
869	* usages, because there is a potential unlimited number of them. Only
870	* ones relevant to IPRT and it's users are covered.
871	* @{ */
872	#define RTCRX509CERT_EKU_F_ANY RT_BIT_64(0)
873	#define RTCRX509CERT_EKU_F_SERVER_AUTH RT_BIT_64(1)
874	#define RTCRX509CERT_EKU_F_CLIENT_AUTH RT_BIT_64(2)
875	#define RTCRX509CERT_EKU_F_CODE_SIGNING RT_BIT_64(3)
876	#define RTCRX509CERT_EKU_F_EMAIL_PROTECTION RT_BIT_64(4)
877	#define RTCRX509CERT_EKU_F_IPSEC_END_SYSTEM RT_BIT_64(5)
878	#define RTCRX509CERT_EKU_F_IPSEC_TUNNEL RT_BIT_64(6)
879	#define RTCRX509CERT_EKU_F_IPSEC_USER RT_BIT_64(7)
880	#define RTCRX509CERT_EKU_F_TIMESTAMPING RT_BIT_64(8)
881	#define RTCRX509CERT_EKU_F_OCSP_SIGNING RT_BIT_64(9)
882	#define RTCRX509CERT_EKU_F_DVCS RT_BIT_64(10)
883	#define RTCRX509CERT_EKU_F_SBGP_CERT_AA_SERVICE_AUTH RT_BIT_64(11)
884	#define RTCRX509CERT_EKU_F_EAP_OVER_PPP RT_BIT_64(12)
885	#define RTCRX509CERT_EKU_F_EAP_OVER_LAN RT_BIT_64(13)
886	#define RTCRX509CERT_EKU_F_OTHER RT_BIT_64(16) /*< Other unknown extended key usage present. /
887	#define RTCRX509CERT_EKU_F_APPLE_CODE_SIGNING RT_BIT_64(24)
888	#define RTCRX509CERT_EKU_F_APPLE_CODE_SIGNING_DEVELOPMENT RT_BIT_64(25)
889	#define RTCRX509CERT_EKU_F_APPLE_SOFTWARE_UPDATE_SIGNING RT_BIT_64(26)
890	#define RTCRX509CERT_EKU_F_APPLE_CODE_SIGNING_THIRD_PARTY RT_BIT_64(27)
891	#define RTCRX509CERT_EKU_F_APPLE_RESOURCE_SIGNING RT_BIT_64(28)
892	#define RTCRX509CERT_EKU_F_APPLE_SYSTEM_IDENTITY RT_BIT_64(29)
893	#define RTCRX509CERT_EKU_F_MS_TIMESTAMP_SIGNING RT_BIT_64(32)
894	#define RTCRX509CERT_EKU_F_MS_NT5_CRYPTO RT_BIT_64(33)
895	#define RTCRX509CERT_EKU_F_MS_OEM_WHQL_CRYPTO RT_BIT_64(34)
896	#define RTCRX509CERT_EKU_F_MS_EMBEDDED_NT_CRYPTO RT_BIT_64(35)
897	#define RTCRX509CERT_EKU_F_MS_KERNEL_MODE_CODE_SIGNING RT_BIT_64(36)
898	#define RTCRX509CERT_EKU_F_MS_LIFETIME_SIGNING RT_BIT_64(37)
899	#define RTCRX509CERT_EKU_F_MS_DRM RT_BIT_64(38)
900	#define RTCRX509CERT_EKU_F_MS_DRM_INDIVIDUALIZATION RT_BIT_64(39)
901	#define RTCRX509CERT_EKU_F_MS_WHQL_CRYPTO RT_BIT_64(40)
902	#define RTCRX509CERT_EKU_F_MS_ATTEST_WHQL_CRYPTO RT_BIT_64(41)
903	/** @} */
904
905	/** @name Key purpose OIDs (extKeyUsage)
906	* @{ */
907	#define RTCRX509_ANY_EXTENDED_KEY_USAGE_OID "2.5.29.37.0"
908	#define RTCRX509_ID_KP_OID "1.3.6.1.5.5.7.3"
909	#define RTCRX509_ID_KP_SERVER_AUTH_OID "1.3.6.1.5.5.7.3.1"
910	#define RTCRX509_ID_KP_CLIENT_AUTH_OID "1.3.6.1.5.5.7.3.2"
911	#define RTCRX509_ID_KP_CODE_SIGNING_OID "1.3.6.1.5.5.7.3.3"
912	#define RTCRX509_ID_KP_EMAIL_PROTECTION_OID "1.3.6.1.5.5.7.3.4"
913	#define RTCRX509_ID_KP_IPSEC_END_SYSTEM_OID "1.3.6.1.5.5.7.3.5"
914	#define RTCRX509_ID_KP_IPSEC_TUNNEL_OID "1.3.6.1.5.5.7.3.6"
915	#define RTCRX509_ID_KP_IPSEC_USER_OID "1.3.6.1.5.5.7.3.7"
916	#define RTCRX509_ID_KP_TIMESTAMPING_OID "1.3.6.1.5.5.7.3.8"
917	#define RTCRX509_ID_KP_OCSP_SIGNING_OID "1.3.6.1.5.5.7.3.9"
918	#define RTCRX509_ID_KP_DVCS_OID "1.3.6.1.5.5.7.3.10"
919	#define RTCRX509_ID_KP_SBGP_CERT_AA_SERVICE_AUTH_OID "1.3.6.1.5.5.7.3.11"
920	#define RTCRX509_ID_KP_EAP_OVER_PPP_OID "1.3.6.1.5.5.7.3.13"
921	#define RTCRX509_ID_KP_EAP_OVER_LAN_OID "1.3.6.1.5.5.7.3.14"
922	/** @} */
923
924	/** @name Microsoft extended key usage OIDs
925	* @{ */
926	#define RTCRX509_MS_EKU_CERT_TRUST_LIST_SIGNING_OID "1.3.6.1.4.1.311.10.3.1"
927	#define RTCRX509_MS_EKU_TIMESTAMP_SIGNING_OID "1.3.6.1.4.1.311.10.3.2"
928	#define RTCRX509_MS_EKU_SERVER_GATED_CRYPTO_OID "1.3.6.1.4.1.311.10.3.3"
929	#define RTCRX509_MS_EKU_SGC_SERIALIZED_OID "1.3.6.1.4.1.311.10.3.3.1"
930	#define RTCRX509_MS_EKU_ENCRYPTED_FILE_SYSTEM_OID "1.3.6.1.4.1.311.10.3.4"
931	#define RTCRX509_MS_EKU_WHQL_CRYPTO_OID "1.3.6.1.4.1.311.10.3.5"
932	#define RTCRX509_MS_EKU_ATTEST_WHQL_CRYPTO_OID "1.3.6.1.4.1.311.10.3.5.1"
933	#define RTCRX509_MS_EKU_NT5_CRYPTO_OID "1.3.6.1.4.1.311.10.3.6"
934	#define RTCRX509_MS_EKU_OEM_WHQL_CRYPTO_OID "1.3.6.1.4.1.311.10.3.7"
935	#define RTCRX509_MS_EKU_EMBEDDED_NT_CRYPTO_OID "1.3.6.1.4.1.311.10.3.8"
936	#define RTCRX509_MS_EKU_ROOT_LIST_SIGNER_OID "1.3.6.1.4.1.311.10.3.9"
937	#define RTCRX509_MS_EKU_QUALIFIED_SUBORDINATE_OID "1.3.6.1.4.1.311.10.3.10"
938	#define RTCRX509_MS_EKU_KEY_RECOVERY_3_OID "1.3.6.1.4.1.311.10.3.11"
939	#define RTCRX509_MS_EKU_DOCUMENT_SIGNING_OID "1.3.6.1.4.1.311.10.3.12"
940	#define RTCRX509_MS_EKU_LIFETIME_SIGNING_OID "1.3.6.1.4.1.311.10.3.13"
941	#define RTCRX509_MS_EKU_MOBILE_DEVICE_SOFTWARE_OID "1.3.6.1.4.1.311.10.3.14"
942	#define RTCRX509_MS_EKU_SMART_DISPLAY_OID "1.3.6.1.4.1.311.10.3.15"
943	#define RTCRX509_MS_EKU_CSP_SIGNATURE_OID "1.3.6.1.4.1.311.10.3.16"
944	#define RTCRX509_MS_EKU_EFS_RECOVERY_OID "1.3.6.1.4.1.311.10.3.4.1"
945	#define RTCRX509_MS_EKU_DRM_OID "1.3.6.1.4.1.311.10.5.1"
946	#define RTCRX509_MS_EKU_DRM_INDIVIDUALIZATION_OID "1.3.6.1.4.1.311.10.5.2"
947	#define RTCRX509_MS_EKU_LICENSES_OID "1.3.6.1.4.1.311.10.5.3"
948	#define RTCRX509_MS_EKU_LICENSE_SERVER_OID "1.3.6.1.4.1.311.10.5.4"
949	#define RTCRX509_MS_EKU_ENROLLMENT_AGENT_OID "1.3.6.1.4.1.311.20.2.1"
950	#define RTCRX509_MS_EKU_SMARTCARD_LOGON_OID "1.3.6.1.4.1.311.20.2.2"
951	#define RTCRX509_MS_EKU_CA_EXCHANGE_OID "1.3.6.1.4.1.311.21.5"
952	#define RTCRX509_MS_EKU_KEY_RECOVERY_21_OID "1.3.6.1.4.1.311.21.6"
953	#define RTCRX509_MS_EKU_SYSTEM_HEALTH_OID "1.3.6.1.4.1.311.47.1.1"
954	#define RTCRX509_MS_EKU_SYSTEM_HEALTH_LOOPHOLE_OID "1.3.6.1.4.1.311.47.1.3"
955	#define RTCRX509_MS_EKU_KERNEL_MODE_CODE_SIGNING_OID "1.3.6.1.4.1.311.61.1.1"
956	/** @} */
957
958	/** @name Apple extended key usage OIDs
959	* @{ */
960	#define RTCRX509_APPLE_EKU_APPLE_EXTENDED_KEY_USAGE_OID "1.2.840.113635.100.4"
961	#define RTCRX509_APPLE_EKU_CODE_SIGNING_OID "1.2.840.113635.100.4.1"
962	#define RTCRX509_APPLE_EKU_CODE_SIGNING_DEVELOPMENT_OID "1.2.840.113635.100.4.1.1"
963	#define RTCRX509_APPLE_EKU_SOFTWARE_UPDATE_SIGNING_OID "1.2.840.113635.100.4.1.2"
964	#define RTCRX509_APPLE_EKU_CODE_SIGNING_THRID_PARTY_OID "1.2.840.113635.100.4.1.3"
965	#define RTCRX509_APPLE_EKU_RESOURCE_SIGNING_OID "1.2.840.113635.100.4.1.4"
966	#define RTCRX509_APPLE_EKU_ICHAT_SIGNING_OID "1.2.840.113635.100.4.2"
967	#define RTCRX509_APPLE_EKU_ICHAT_ENCRYPTION_OID "1.2.840.113635.100.4.3"
968	#define RTCRX509_APPLE_EKU_SYSTEM_IDENTITY_OID "1.2.840.113635.100.4.4"
969	#define RTCRX509_APPLE_EKU_CRYPTO_ENV_OID "1.2.840.113635.100.4.5"
970	#define RTCRX509_APPLE_EKU_CRYPTO_PRODUCTION_ENV_OID "1.2.840.113635.100.4.5.1"
971	#define RTCRX509_APPLE_EKU_CRYPTO_MAINTENANCE_ENV_OID "1.2.840.113635.100.4.5.2"
972	#define RTCRX509_APPLE_EKU_CRYPTO_TEST_ENV_OID "1.2.840.113635.100.4.5.3"
973	#define RTCRX509_APPLE_EKU_CRYPTO_DEVELOPMENT_ENV_OID "1.2.840.113635.100.4.5.4"
974	#define RTCRX509_APPLE_EKU_CRYPTO_QOS_OID "1.2.840.113635.100.4.6"
975	#define RTCRX509_APPLE_EKU_CRYPTO_TIER0_QOS_OID "1.2.840.113635.100.4.6.1"
976	#define RTCRX509_APPLE_EKU_CRYPTO_TIER1_QOS_OID "1.2.840.113635.100.4.6.2"
977	#define RTCRX509_APPLE_EKU_CRYPTO_TIER2_QOS_OID "1.2.840.113635.100.4.6.3"
978	#define RTCRX509_APPLE_EKU_CRYPTO_TIER3_QOS_OID "1.2.840.113635.100.4.6.4"
979	/** @} */
980
981	/**
982	* Use this to update derived values after changing the certificate
983	* extensions.
984	*
985	* @returns IPRT status code
986	* @param pThis The certificate.
987	* @param pErrInfo Where to return additional error information. Optional.
988	*/
989	RTDECL(int) RTCrX509TbsCertificate_ReprocessExtensions(PRTCRX509TBSCERTIFICATE pThis, PRTERRINFO pErrInfo);
990
991
992	/**
993	* One X.509 Certificate (IPRT representation).
994	*/
995	typedef struct RTCRX509CERTIFICATE
996	{
997	/** Sequence core. */
998	RTASN1SEQUENCECORE SeqCore;
999	/** The to-be-signed certificate information. */
1000	RTCRX509TBSCERTIFICATE TbsCertificate;
1001	/** The signature algorithm (must match TbsCertificate.Signature). */
1002	RTCRX509ALGORITHMIDENTIFIER SignatureAlgorithm;
1003	/** The signature value. */
1004	RTASN1BITSTRING SignatureValue;
1005	} RTCRX509CERTIFICATE;
1006	/** Pointer to the IPRT representation of one X.509 certificate. */
1007	typedef RTCRX509CERTIFICATE *PRTCRX509CERTIFICATE;
1008	/** Pointer to the const IPRT representation of one X.509 certificate. */
1009	typedef RTCRX509CERTIFICATE const *PCRTCRX509CERTIFICATE;
1010	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509CERTIFICATE, RTDECL, RTCrX509Certificate, SeqCore.Asn1Core);
1011
1012	/**
1013	* Checks if a certificate matches a given issuer name and serial number.
1014	*
1015	* @returns True / false.
1016	* @param pCertificate The X.509 certificat.
1017	* @param pIssuer The issuer name to match against.
1018	* @param pSerialNumber The serial number to match against.
1019	*/
1020	RTDECL(bool) RTCrX509Certificate_MatchIssuerAndSerialNumber(PCRTCRX509CERTIFICATE pCertificate,
1021	PCRTCRX509NAME pIssuer, PCRTASN1INTEGER pSerialNumber);
1022
1023	RTDECL(bool) RTCrX509Certificate_MatchSubjectOrAltSubjectByRfc5280(PCRTCRX509CERTIFICATE pThis, PCRTCRX509NAME pName);
1024	RTDECL(bool) RTCrX509Certificate_IsSelfSigned(PCRTCRX509CERTIFICATE pCertificate);
1025
1026	RTDECL(int) RTCrX509Certificate_VerifySignature(PCRTCRX509CERTIFICATE pThis, PCRTASN1OBJID pAlgorithm,
1027	PCRTASN1DYNTYPE pParameters, PCRTASN1BITSTRING pPublicKey,
1028	PRTERRINFO pErrInfo);
1029	RTDECL(int) RTCrX509Certificate_VerifySignatureSelfSigned(PCRTCRX509CERTIFICATE pThis, PRTERRINFO pErrInfo);
1030	RTDECL(int) RTCrX509Certificate_ReadFromFile(PRTCRX509CERTIFICATE pCertificate, const char *pszFilename, uint32_t fFlags,
1031	PCRTASN1ALLOCATORVTABLE pAllocator, PRTERRINFO pErrInfo);
1032	RTDECL(int) RTCrX509Certificate_ReadFromBuffer(PRTCRX509CERTIFICATE pCertificate, const void *pvBuf, size_t cbBuf,
1033	uint32_t fFlags, PCRTASN1ALLOCATORVTABLE pAllocator,
1034	PRTERRINFO pErrInfo, const char *pszErrorTag);
1035	/** @name Flags for RTCrX509Certificate_ReadFromFile and
1036	* RTCrX509Certificate_ReadFromBuffer
1037	* @{ */
1038	/** Only allow PEM certificates, not binary ones.
1039	* @sa RTCRPEMREADFILE_F_ONLY_PEM */
1040	#define RTCRX509CERT_READ_F_PEM_ONLY RT_BIT(1)
1041	/** @} */
1042
1043	/** X509 Certificate markers for RTCrPemFindFirstSectionInContent et al. */
1044	extern RTDATADECL(RTCRPEMMARKER const) g_aRTCrX509CertificateMarkers[];
1045	/** Number of entries in g_aRTCrX509CertificateMarkers. */
1046	extern RTDATADECL(uint32_t const) g_cRTCrX509CertificateMarkers;
1047
1048
1049	/** Wrapper around RTCrPemWriteAsn1ToVfsIoStrm(). */
1050	DECLINLINE(ssize_t) RTCrX509Certificate_WriteToVfsIoStrm(RTVFSIOSTREAM hVfsIos, PRTCRX509CERTIFICATE pCertificate,
1051	PRTERRINFO pErrInfo)
1052	{
1053	return RTCrPemWriteAsn1ToVfsIoStrm(hVfsIos, &pCertificate->SeqCore.Asn1Core, 0 /fFlags/,
1054	g_aRTCrX509CertificateMarkers[0].paWords[0].pszWord, pErrInfo);
1055	}
1056
1057	/** Wrapper around RTCrPemWriteAsn1ToVfsFile(). */
1058	DECLINLINE(ssize_t) RTCrX509Certificate_WriteToVfsFile(RTVFSFILE hVfsFile, PRTCRX509CERTIFICATE pCertificate,
1059	PRTERRINFO pErrInfo)
1060	{
1061	return RTCrPemWriteAsn1ToVfsFile(hVfsFile, &pCertificate->SeqCore.Asn1Core, 0 /fFlags/,
1062	g_aRTCrX509CertificateMarkers[0].paWords[0].pszWord, pErrInfo);
1063	}
1064
1065	/** @name X.509 Certificate Extensions
1066	* @{ */
1067	/** Old AuthorityKeyIdentifier OID. */
1068	#define RTCRX509_ID_CE_OLD_AUTHORITY_KEY_IDENTIFIER_OID "2.5.29.1"
1069	/** Old CertificatePolicies extension OID. */
1070	#define RTCRX509_ID_CE_OLD_CERTIFICATE_POLICIES_OID "2.5.29.3"
1071	/** Old SubjectAltName extension OID. */
1072	#define RTCRX509_ID_CE_OLD_SUBJECT_ALT_NAME_OID "2.5.29.7"
1073	/** Old IssuerAltName extension OID. */
1074	#define RTCRX509_ID_CE_OLD_ISSUER_ALT_NAME_OID "2.5.29.8"
1075	/** Old BasicContraints extension OID. */
1076	#define RTCRX509_ID_CE_OLD_BASIC_CONSTRAINTS_OID "2.5.29.10"
1077	/** SubjectKeyIdentifier OID. */
1078	#define RTCRX509_ID_CE_SUBJECT_KEY_IDENTIFIER_OID "2.5.29.14"
1079	/** KeyUsage OID. */
1080	#define RTCRX509_ID_CE_KEY_USAGE_OID "2.5.29.15"
1081	/** PrivateKeyUsagePeriod OID. */
1082	#define RTCRX509_ID_CE_PRIVATE_KEY_USAGE_PERIOD_OID "2.5.29.16"
1083	/** SubjectAltName extension OID. */
1084	#define RTCRX509_ID_CE_SUBJECT_ALT_NAME_OID "2.5.29.17"
1085	/** IssuerAltName extension OID. */
1086	#define RTCRX509_ID_CE_ISSUER_ALT_NAME_OID "2.5.29.18"
1087	/** BasicContraints extension OID. */
1088	#define RTCRX509_ID_CE_BASIC_CONSTRAINTS_OID "2.5.29.19"
1089	/** NameContraints extension OID. */
1090	#define RTCRX509_ID_CE_NAME_CONSTRAINTS_OID "2.5.29.30"
1091	/** CertificatePolicies extension OID. */
1092	#define RTCRX509_ID_CE_CERTIFICATE_POLICIES_OID "2.5.29.32"
1093	/** PolicyMappings extension OID. */
1094	#define RTCRX509_ID_CE_POLICY_MAPPINGS_OID "2.5.29.33"
1095	/** AuthorityKeyIdentifier OID. */
1096	#define RTCRX509_ID_CE_AUTHORITY_KEY_IDENTIFIER_OID "2.5.29.35"
1097	/** PolicyContraints extension OID. */
1098	#define RTCRX509_ID_CE_POLICY_CONSTRAINTS_OID "2.5.29.36"
1099	/** ExtKeyUsage (extended key usage) extension OID. */
1100	#define RTCRX509_ID_CE_EXT_KEY_USAGE_OID "2.5.29.37"
1101	/** ExtKeyUsage: OID for permitting any unspecified key usage. */
1102	#define RTCRX509_ID_CE_ANY_EXTENDED_KEY_USAGE_OID "2.5.29.37.0"
1103	/** AuthorityAttributeIdentifier OID. */
1104	#define RTCRX509_ID_CE_AUTHORITY_ATTRIBUTE_IDENTIFIER_OID "2.5.29.38"
1105	/** AcceptableCertPolicies OID. */
1106	#define RTCRX509_ID_CE_ACCEPTABLE_CERT_POLICIES_OID "2.5.29.52"
1107	/** InhibitAnyPolicy OID. */
1108	#define RTCRX509_ID_CE_INHIBIT_ANY_POLICY_OID "2.5.29.54"
1109	/** @} */
1110
1111
1112	/*
1113	* Sequence of X.509 Certifcates (IPRT representation).
1114	*/
1115	RTASN1_IMPL_GEN_SET_OF_TYPEDEFS_AND_PROTOS(RTCRX509CERTIFICATES, RTCRX509CERTIFICATE, RTDECL, RTCrX509Certificates);
1116
1117	/**
1118	* Looks up a certificate by issuer name and serial number.
1119	*
1120	* @returns Pointer to the given certificate if found, NULL if not.
1121	* @param pCertificates The X.509 certificate set to search.
1122	* @param pIssuer The issuer name of the wanted certificate.
1123	* @param pSerialNumber The serial number of the wanted certificate.
1124	*/
1125	RTDECL(PCRTCRX509CERTIFICATE) RTCrX509Certificates_FindByIssuerAndSerialNumber(PCRTCRX509CERTIFICATES pCertificates,
1126	PCRTCRX509NAME pIssuer,
1127	PCRTASN1INTEGER pSerialNumber);
1128
1129
1130
1131	RTDECL(int) RTCrX509CertPathsCreate(PRTCRX509CERTPATHS phCertPaths, PCRTCRX509CERTIFICATE pTarget);
1132	RTDECL(uint32_t) RTCrX509CertPathsRetain(RTCRX509CERTPATHS hCertPaths);
1133	RTDECL(uint32_t) RTCrX509CertPathsRelease(RTCRX509CERTPATHS hCertPaths);
1134	RTDECL(int) RTCrX509CertPathsSetTrustedStore(RTCRX509CERTPATHS hCertPaths, RTCRSTORE hTrustedStore);
1135	RTDECL(int) RTCrX509CertPathsSetUntrustedStore(RTCRX509CERTPATHS hCertPaths, RTCRSTORE hUntrustedStore);
1136	RTDECL(int) RTCrX509CertPathsSetUntrustedArray(RTCRX509CERTPATHS hCertPaths, PCRTCRX509CERTIFICATE paCerts, uint32_t cCerts);
1137	RTDECL(int) RTCrX509CertPathsSetUntrustedSet(RTCRX509CERTPATHS hCertPaths, struct RTCRPKCS7SETOFCERTS const *pSetOfCerts);
1138	RTDECL(int) RTCrX509CertPathsSetValidTime(RTCRX509CERTPATHS hCertPaths, PCRTTIME pTime);
1139	RTDECL(int) RTCrX509CertPathsSetValidTimeSpec(RTCRX509CERTPATHS hCertPaths, PCRTTIMESPEC pTimeSpec);
1140	RTDECL(int) RTCrX509CertPathsSetTrustAnchorChecks(RTCRX509CERTPATHS hCertPaths, bool fEnable);
1141	RTDECL(int) RTCrX509CertPathsCreateEx(PRTCRX509CERTPATHS phCertPaths, PCRTCRX509CERTIFICATE pTarget, RTCRSTORE hTrustedStore,
1142	RTCRSTORE hUntrustedStore, PCRTCRX509CERTIFICATE paUntrustedCerts, uint32_t cUntrustedCerts,
1143	PCRTTIMESPEC pValidTime);
1144	RTDECL(int) RTCrX509CertPathsBuild(RTCRX509CERTPATHS hCertPaths, PRTERRINFO pErrInfo);
1145	RTDECL(int) RTCrX509CertPathsDumpOne(RTCRX509CERTPATHS hCertPaths, uint32_t iPath, uint32_t uVerbosity,
1146	PFNRTDUMPPRINTFV pfnPrintfV, void *pvUser);
1147	RTDECL(int) RTCrX509CertPathsDumpAll(RTCRX509CERTPATHS hCertPaths, uint32_t uVerbosity,
1148	PFNRTDUMPPRINTFV pfnPrintfV, void *pvUser);
1149
1150	RTDECL(int) RTCrX509CertPathsValidateOne(RTCRX509CERTPATHS hCertPaths, uint32_t iPath, PRTERRINFO pErrInfo);
1151	RTDECL(int) RTCrX509CertPathsValidateAll(RTCRX509CERTPATHS hCertPaths, uint32_t *pcValidPaths, PRTERRINFO pErrInfo);
1152
1153	RTDECL(uint32_t) RTCrX509CertPathsGetPathCount(RTCRX509CERTPATHS hCertPaths);
1154	RTDECL(int) RTCrX509CertPathsQueryPathInfo(RTCRX509CERTPATHS hCertPaths, uint32_t iPath,
1155	bool pfTrusted, uint32_t pcNodes, PCRTCRX509NAME *ppSubject,
1156	PCRTCRX509SUBJECTPUBLICKEYINFO *ppPublicKeyInfo,
1157	PCRTCRX509CERTIFICATE ppCert, PCRTCRCERTCTX ppCertCtx, int *prcVerify);
1158	RTDECL(uint32_t) RTCrX509CertPathsGetPathLength(RTCRX509CERTPATHS hCertPaths, uint32_t iPath);
1159	RTDECL(int) RTCrX509CertPathsGetPathVerifyResult(RTCRX509CERTPATHS hCertPaths, uint32_t iPath);
1160	RTDECL(PCRTCRX509CERTIFICATE) RTCrX509CertPathsGetPathNodeCert(RTCRX509CERTPATHS hCertPaths, uint32_t iPath, uint32_t iNode);
1161
1162
1163	RT_C_DECLS_END
1164
1165	/** @} */
1166
1167	/** @} */
1168
1169	#endif /* !IPRT_INCLUDED_crypto_x509_h */
1170

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/include/iprt/crypto/x509.h@ 94480

Download in other formats: