| 1 | /** @file
|
|---|
| 2 | * IPRT - Crypto - X.509, Public Key and Privilege Management Infrastructure.
|
|---|
| 3 | */
|
|---|
| 4 |
|
|---|
| 5 | /*
|
|---|
| 6 | * Copyright (C) 2014-2023 Oracle and/or its affiliates.
|
|---|
| 7 | *
|
|---|
| 8 | * This file is part of VirtualBox base platform packages, as
|
|---|
| 9 | * available from https://www.virtualbox.org.
|
|---|
| 10 | *
|
|---|
| 11 | * This program is free software; you can redistribute it and/or
|
|---|
| 12 | * modify it under the terms of the GNU General Public License
|
|---|
| 13 | * as published by the Free Software Foundation, in version 3 of the
|
|---|
| 14 | * License.
|
|---|
| 15 | *
|
|---|
| 16 | * This program is distributed in the hope that it will be useful, but
|
|---|
| 17 | * WITHOUT ANY WARRANTY; without even the implied warranty of
|
|---|
| 18 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|---|
| 19 | * General Public License for more details.
|
|---|
| 20 | *
|
|---|
| 21 | * You should have received a copy of the GNU General Public License
|
|---|
| 22 | * along with this program; if not, see <https://www.gnu.org/licenses>.
|
|---|
| 23 | *
|
|---|
| 24 | * The contents of this file may alternatively be used under the terms
|
|---|
| 25 | * of the Common Development and Distribution License Version 1.0
|
|---|
| 26 | * (CDDL), a copy of it is provided in the "COPYING.CDDL" file included
|
|---|
| 27 | * in the VirtualBox distribution, in which case the provisions of the
|
|---|
| 28 | * CDDL are applicable instead of those of the GPL.
|
|---|
| 29 | *
|
|---|
| 30 | * You may elect to license modified versions of this file under the
|
|---|
| 31 | * terms and conditions of either the GPL or the CDDL or both.
|
|---|
| 32 | *
|
|---|
| 33 | * SPDX-License-Identifier: GPL-3.0-only OR CDDL-1.0
|
|---|
| 34 | */
|
|---|
| 35 |
|
|---|
| 36 | #ifndef IPRT_INCLUDED_crypto_x509_h
|
|---|
| 37 | #define IPRT_INCLUDED_crypto_x509_h
|
|---|
| 38 | #ifndef RT_WITHOUT_PRAGMA_ONCE
|
|---|
| 39 | # pragma once
|
|---|
| 40 | #endif
|
|---|
| 41 |
|
|---|
| 42 | #include <iprt/asn1.h>
|
|---|
| 43 | #include <iprt/crypto/pem.h>
|
|---|
| 44 |
|
|---|
| 45 |
|
|---|
| 46 | RT_C_DECLS_BEGIN
|
|---|
| 47 |
|
|---|
| 48 | struct RTCRPKCS7SETOFCERTS;
|
|---|
| 49 |
|
|---|
| 50 |
|
|---|
| 51 | /** @defgroup grp_rt_crypto Crypto
|
|---|
| 52 | * @ingroup grp_rt
|
|---|
| 53 | * @{
|
|---|
| 54 | */
|
|---|
| 55 |
|
|---|
| 56 | /** @defgroup grp_rt_crx509 RTCrX509 - Public Key and Privilege Management Infrastructure.
|
|---|
| 57 | * @{
|
|---|
| 58 | */
|
|---|
| 59 |
|
|---|
| 60 | /**
|
|---|
| 61 | * X.509 algorithm identifier (IPRT representation).
|
|---|
| 62 | */
|
|---|
| 63 | typedef struct RTCRX509ALGORITHMIDENTIFIER
|
|---|
| 64 | {
|
|---|
| 65 | /** The sequence making up this algorithm identifier. */
|
|---|
| 66 | RTASN1SEQUENCECORE SeqCore;
|
|---|
| 67 | /** The algorithm object ID. */
|
|---|
| 68 | RTASN1OBJID Algorithm;
|
|---|
| 69 | /** Optional parameters specified by the algorithm. */
|
|---|
| 70 | RTASN1DYNTYPE Parameters;
|
|---|
| 71 | } RTCRX509ALGORITHMIDENTIFIER;
|
|---|
| 72 | /** Poitner to the IPRT representation of a X.509 algorithm identifier. */
|
|---|
| 73 | typedef RTCRX509ALGORITHMIDENTIFIER *PRTCRX509ALGORITHMIDENTIFIER;
|
|---|
| 74 | /** Poitner to the const IPRT representation of a X.509 algorithm identifier. */
|
|---|
| 75 | typedef RTCRX509ALGORITHMIDENTIFIER const *PCRTCRX509ALGORITHMIDENTIFIER;
|
|---|
| 76 | RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509ALGORITHMIDENTIFIER, RTDECL, RTCrX509AlgorithmIdentifier, SeqCore.Asn1Core);
|
|---|
| 77 | RTASN1_IMPL_GEN_SET_OF_TYPEDEFS_AND_PROTOS(RTCRX509ALGORITHMIDENTIFIERS, RTCRX509ALGORITHMIDENTIFIER, RTDECL, RTCrX509AlgorithmIdentifiers);
|
|---|
| 78 |
|
|---|
| 79 | /**
|
|---|
| 80 | * Tries to convert an X.509 digest algorithm ID into a RTDIGESTTYPE value.
|
|---|
| 81 | *
|
|---|
| 82 | * @returns Valid RTDIGESTTYPE on success, RTDIGESTTYPE_INVALID on failure.
|
|---|
| 83 | * @param pThis The IPRT representation of a X.509 algorithm
|
|---|
| 84 | * identifier object.
|
|---|
| 85 | */
|
|---|
| 86 | RTDECL(RTDIGESTTYPE) RTCrX509AlgorithmIdentifier_QueryDigestType(PCRTCRX509ALGORITHMIDENTIFIER pThis);
|
|---|
| 87 |
|
|---|
| 88 | /**
|
|---|
| 89 | * Tries to figure the digest size of an X.509 digest algorithm ID.
|
|---|
| 90 | *
|
|---|
| 91 | * @returns The digest size in bytes, UINT32_MAX if unknown digest.
|
|---|
| 92 | * @param pThis The IPRT representation of a X.509 algorithm
|
|---|
| 93 | * identifier object.
|
|---|
| 94 | */
|
|---|
| 95 | RTDECL(uint32_t) RTCrX509AlgorithmIdentifier_QueryDigestSize(PCRTCRX509ALGORITHMIDENTIFIER pThis);
|
|---|
| 96 |
|
|---|
| 97 | RTDECL(int) RTCrX509AlgorithmIdentifier_CompareWithString(PCRTCRX509ALGORITHMIDENTIFIER pThis, const char *pszObjId);
|
|---|
| 98 |
|
|---|
| 99 | /**
|
|---|
| 100 | * Compares a digest with an encrypted digest algorithm, checking if they
|
|---|
| 101 | * specify the same digest.
|
|---|
| 102 | *
|
|---|
| 103 | * @returns 0 if same digest, -1 if the digest is unknown, 1 if the encrypted
|
|---|
| 104 | * digest does not match.
|
|---|
| 105 | * @param pDigest The digest algorithm.
|
|---|
| 106 | * @param pEncryptedDigest The encrypted digest algorithm.
|
|---|
| 107 | */
|
|---|
| 108 | RTDECL(int) RTCrX509AlgorithmIdentifier_CompareDigestAndEncryptedDigest(PCRTCRX509ALGORITHMIDENTIFIER pDigest,
|
|---|
| 109 | PCRTCRX509ALGORITHMIDENTIFIER pEncryptedDigest);
|
|---|
| 110 | /**
|
|---|
| 111 | * Compares a digest OID with an encrypted digest algorithm OID, checking if
|
|---|
| 112 | * they specify the same digest.
|
|---|
| 113 | *
|
|---|
| 114 | * @returns 0 if same digest, -1 if the digest is unknown, 1 if the encrypted
|
|---|
| 115 | * digest does not match.
|
|---|
| 116 | * @param pszDigestOid The digest algorithm OID.
|
|---|
| 117 | * @param pszEncryptedDigestOid The encrypted digest algorithm OID.
|
|---|
| 118 | */
|
|---|
| 119 | RTDECL(int) RTCrX509AlgorithmIdentifier_CompareDigestOidAndEncryptedDigestOid(const char *pszDigestOid,
|
|---|
| 120 | const char *pszEncryptedDigestOid);
|
|---|
| 121 |
|
|---|
| 122 |
|
|---|
| 123 | /**
|
|---|
| 124 | * Combine the encryption algorithm with the digest algorithm.
|
|---|
| 125 | *
|
|---|
| 126 | * @returns OID of encrypted digest algorithm.
|
|---|
| 127 | * @param pEncryption The encryption algorithm. Will work if this is
|
|---|
| 128 | * the OID of an encrypted digest algorithm too, as
|
|---|
| 129 | * long as it matches @a pDigest.
|
|---|
| 130 | * @param pDigest The digest algorithm. Will work if this is the
|
|---|
| 131 | * OID of an encrypted digest algorithm too, as
|
|---|
| 132 | * long as it matches @a pEncryption.
|
|---|
| 133 | */
|
|---|
| 134 | RTDECL(const char *) RTCrX509AlgorithmIdentifier_CombineEncryptionAndDigest(PCRTCRX509ALGORITHMIDENTIFIER pEncryption,
|
|---|
| 135 | PCRTCRX509ALGORITHMIDENTIFIER pDigest);
|
|---|
| 136 |
|
|---|
| 137 | /**
|
|---|
| 138 | * Combine the encryption algorithm OID with the digest algorithm OID.
|
|---|
| 139 | *
|
|---|
| 140 | * @returns OID of encrypted digest algorithm.
|
|---|
| 141 | * @param pszEncryptionOid The encryption algorithm. Will work if this is
|
|---|
| 142 | * the OID of an encrypted digest algorithm too, as
|
|---|
| 143 | * long as it matches @a pszDigestOid.
|
|---|
| 144 | * @param pszDigestOid The digest algorithm. Will work if this is the
|
|---|
| 145 | * OID of an encrypted digest algorithm too, as
|
|---|
| 146 | * long as it matches @a pszEncryptionOid.
|
|---|
| 147 | */
|
|---|
| 148 | RTDECL(const char *) RTCrX509AlgorithmIdentifier_CombineEncryptionOidAndDigestOid(const char *pszEncryptionOid,
|
|---|
| 149 | const char *pszDigestOid);
|
|---|
| 150 |
|
|---|
| 151 |
|
|---|
| 152 | /** @name Typical Digest Algorithm OIDs.
|
|---|
| 153 | * @{ */
|
|---|
| 154 | #define RTCRX509ALGORITHMIDENTIFIERID_MD2 "1.2.840.113549.2.2"
|
|---|
| 155 | #define RTCRX509ALGORITHMIDENTIFIERID_MD4 "1.2.840.113549.2.4"
|
|---|
| 156 | #define RTCRX509ALGORITHMIDENTIFIERID_MD5 "1.2.840.113549.2.5"
|
|---|
| 157 | #define RTCRX509ALGORITHMIDENTIFIERID_SHA1 "1.3.14.3.2.26"
|
|---|
| 158 | #define RTCRX509ALGORITHMIDENTIFIERID_SHA256 "2.16.840.1.101.3.4.2.1"
|
|---|
| 159 | #define RTCRX509ALGORITHMIDENTIFIERID_SHA384 "2.16.840.1.101.3.4.2.2"
|
|---|
| 160 | #define RTCRX509ALGORITHMIDENTIFIERID_SHA512 "2.16.840.1.101.3.4.2.3"
|
|---|
| 161 | #define RTCRX509ALGORITHMIDENTIFIERID_SHA224 "2.16.840.1.101.3.4.2.4"
|
|---|
| 162 | #define RTCRX509ALGORITHMIDENTIFIERID_SHA512T224 "2.16.840.1.101.3.4.2.5"
|
|---|
| 163 | #define RTCRX509ALGORITHMIDENTIFIERID_SHA512T256 "2.16.840.1.101.3.4.2.6"
|
|---|
| 164 | #define RTCRX509ALGORITHMIDENTIFIERID_SHA3_224 "2.16.840.1.101.3.4.2.7"
|
|---|
| 165 | #define RTCRX509ALGORITHMIDENTIFIERID_SHA3_256 "2.16.840.1.101.3.4.2.8"
|
|---|
| 166 | #define RTCRX509ALGORITHMIDENTIFIERID_SHA3_384 "2.16.840.1.101.3.4.2.9"
|
|---|
| 167 | #define RTCRX509ALGORITHMIDENTIFIERID_SHA3_512 "2.16.840.1.101.3.4.2.10"
|
|---|
| 168 | #define RTCRX509ALGORITHMIDENTIFIERID_WHIRLPOOL "1.0.10118.3.0.55"
|
|---|
| 169 | /** @} */
|
|---|
| 170 |
|
|---|
| 171 | /** @name Encrypted Digest Algorithm OIDs.
|
|---|
| 172 | * @remarks The PKCS variants are the default ones, alternative OID are marked
|
|---|
| 173 | * as such.
|
|---|
| 174 | * @{ */
|
|---|
| 175 | #define RTCRX509ALGORITHMIDENTIFIERID_RSA "1.2.840.113549.1.1.1"
|
|---|
| 176 | #define RTCRX509ALGORITHMIDENTIFIERID_MD2_WITH_RSA "1.2.840.113549.1.1.2"
|
|---|
| 177 | #define RTCRX509ALGORITHMIDENTIFIERID_MD4_WITH_RSA "1.2.840.113549.1.1.3"
|
|---|
| 178 | #define RTCRX509ALGORITHMIDENTIFIERID_MD5_WITH_RSA "1.2.840.113549.1.1.4"
|
|---|
| 179 | #define RTCRX509ALGORITHMIDENTIFIERID_SHA1_WITH_RSA "1.2.840.113549.1.1.5"
|
|---|
| 180 | #define RTCRX509ALGORITHMIDENTIFIERID_SHA256_WITH_RSA "1.2.840.113549.1.1.11"
|
|---|
| 181 | #define RTCRX509ALGORITHMIDENTIFIERID_SHA384_WITH_RSA "1.2.840.113549.1.1.12"
|
|---|
| 182 | #define RTCRX509ALGORITHMIDENTIFIERID_SHA512_WITH_RSA "1.2.840.113549.1.1.13"
|
|---|
| 183 | #define RTCRX509ALGORITHMIDENTIFIERID_SHA224_WITH_RSA "1.2.840.113549.1.1.14"
|
|---|
| 184 | #define RTCRX509ALGORITHMIDENTIFIERID_SHA512T224_WITH_RSA "1.2.840.113549.1.1.15"
|
|---|
| 185 | #define RTCRX509ALGORITHMIDENTIFIERID_SHA512T256_WITH_RSA "1.2.840.113549.1.1.16"
|
|---|
| 186 | #define RTCRX509ALGORITHMIDENTIFIERID_SHA3_224_WITH_RSA "2.16.840.1.101.3.4.3.13"
|
|---|
| 187 | #define RTCRX509ALGORITHMIDENTIFIERID_SHA3_256_WITH_RSA "2.16.840.1.101.3.4.3.14"
|
|---|
| 188 | #define RTCRX509ALGORITHMIDENTIFIERID_SHA3_384_WITH_RSA "2.16.840.1.101.3.4.3.15"
|
|---|
| 189 | #define RTCRX509ALGORITHMIDENTIFIERID_SHA3_512_WITH_RSA "2.16.840.1.101.3.4.3.16"
|
|---|
| 190 | /** @} */
|
|---|
| 191 |
|
|---|
| 192 |
|
|---|
| 193 |
|
|---|
| 194 |
|
|---|
| 195 | /**
|
|---|
| 196 | * One X.509 AttributeTypeAndValue (IPRT representation).
|
|---|
| 197 | */
|
|---|
| 198 | typedef struct RTCRX509ATTRIBUTETYPEANDVALUE
|
|---|
| 199 | {
|
|---|
| 200 | /** Sequence core. */
|
|---|
| 201 | RTASN1SEQUENCECORE SeqCore;
|
|---|
| 202 | /** The attribute type (object ID). */
|
|---|
| 203 | RTASN1OBJID Type;
|
|---|
| 204 | /** The attribute value (what it is is defined by Type). */
|
|---|
| 205 | RTASN1DYNTYPE Value;
|
|---|
| 206 | } RTCRX509ATTRIBUTETYPEANDVALUE;
|
|---|
| 207 | /** Pointer to a X.509 AttributeTypeAndValue (IPRT representation). */
|
|---|
| 208 | typedef RTCRX509ATTRIBUTETYPEANDVALUE *PRTCRX509ATTRIBUTETYPEANDVALUE;
|
|---|
| 209 | /** Pointer to a const X.509 AttributeTypeAndValue (IPRT representation). */
|
|---|
| 210 | typedef RTCRX509ATTRIBUTETYPEANDVALUE const *PCRTCRX509ATTRIBUTETYPEANDVALUE;
|
|---|
| 211 | RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509ATTRIBUTETYPEANDVALUE, RTDECL, RTCrX509AttributeTypeAndValue, SeqCore.Asn1Core);
|
|---|
| 212 | RTASN1_IMPL_GEN_SET_OF_TYPEDEFS_AND_PROTOS(RTCRX509ATTRIBUTETYPEANDVALUES, RTCRX509ATTRIBUTETYPEANDVALUE, RTDECL, RTCrX509AttributeTypeAndValues);
|
|---|
| 213 |
|
|---|
| 214 | RTASN1TYPE_ALIAS(RTCRX509RELATIVEDISTINGUISHEDNAME, RTCRX509ATTRIBUTETYPEANDVALUES, RTCrX509RelativeDistinguishedName, RTCrX509AttributeTypeAndValues);
|
|---|
| 215 |
|
|---|
| 216 |
|
|---|
| 217 | RTASN1_IMPL_GEN_SEQ_OF_TYPEDEFS_AND_PROTOS(RTCRX509NAME, RTCRX509RELATIVEDISTINGUISHEDNAME, RTDECL, RTCrX509Name);
|
|---|
| 218 | RTDECL(int) RTCrX509Name_CheckSanity(PCRTCRX509NAME pName, uint32_t fFlags, PRTERRINFO pErrInfo, const char *pszErrorTag);
|
|---|
| 219 | RTDECL(bool) RTCrX509Name_MatchByRfc5280(PCRTCRX509NAME pLeft, PCRTCRX509NAME pRight);
|
|---|
| 220 |
|
|---|
| 221 | /**
|
|---|
| 222 | * Name constraint matching (RFC-5280).
|
|---|
| 223 | *
|
|---|
| 224 | * @returns true on match, false on mismatch.
|
|---|
| 225 | * @param pConstraint The constraint name.
|
|---|
| 226 | * @param pName The name to match against the constraint.
|
|---|
| 227 | * @sa RTCrX509GeneralName_ConstraintMatch,
|
|---|
| 228 | * RTCrX509RelativeDistinguishedName_ConstraintMatch
|
|---|
| 229 | */
|
|---|
| 230 | RTDECL(bool) RTCrX509Name_ConstraintMatch(PCRTCRX509NAME pConstraint, PCRTCRX509NAME pName);
|
|---|
| 231 | RTDECL(int) RTCrX509Name_RecodeAsUtf8(PRTCRX509NAME pThis, PCRTASN1ALLOCATORVTABLE pAllocator);
|
|---|
| 232 |
|
|---|
| 233 | /**
|
|---|
| 234 | * Matches the directory name against a comma separated list of the component
|
|---|
| 235 | * strings (case sensitive).
|
|---|
| 236 | *
|
|---|
| 237 | * @returns true if match, false if mismatch.
|
|---|
| 238 | * @param pThis The name object.
|
|---|
| 239 | * @param pszString The string to match against. For example:
|
|---|
| 240 | * "C=US, ST=California, L=Redwood Shores, O=Oracle Corporation"
|
|---|
| 241 | *
|
|---|
| 242 | * @remarks This is doing a straight compare, no extra effort is expended in
|
|---|
| 243 | * dealing with different component order. If the component order
|
|---|
| 244 | * differs, there won't be any match.
|
|---|
| 245 | */
|
|---|
| 246 | RTDECL(bool) RTCrX509Name_MatchWithString(PCRTCRX509NAME pThis, const char *pszString);
|
|---|
| 247 |
|
|---|
| 248 | /**
|
|---|
| 249 | * Formats the name as a command separated list of components with type
|
|---|
| 250 | * prefixes.
|
|---|
| 251 | *
|
|---|
| 252 | * The output of this function is suitable for use with
|
|---|
| 253 | * RTCrX509Name_MatchWithString.
|
|---|
| 254 | *
|
|---|
| 255 | * @returns IPRT status code.
|
|---|
| 256 | * @param pThis The name object.
|
|---|
| 257 | * @param pszBuf The output buffer.
|
|---|
| 258 | * @param cbBuf The size of the output buffer.
|
|---|
| 259 | * @param pcbActual Where to return the number of bytes required for the
|
|---|
| 260 | * output, including the null terminator character.
|
|---|
| 261 | * Optional.
|
|---|
| 262 | */
|
|---|
| 263 | RTDECL(int) RTCrX509Name_FormatAsString(PCRTCRX509NAME pThis, char *pszBuf, size_t cbBuf, size_t *pcbActual);
|
|---|
| 264 |
|
|---|
| 265 |
|
|---|
| 266 | /**
|
|---|
| 267 | * Looks up the RDN ID and returns the short name for it, if found.
|
|---|
| 268 | *
|
|---|
| 269 | * @returns Short name (e.g. 'CN') or NULL.
|
|---|
| 270 | * @param pRdnId The RDN ID to look up.
|
|---|
| 271 | */
|
|---|
| 272 | RTDECL(const char *) RTCrX509Name_GetShortRdn(PCRTASN1OBJID pRdnId);
|
|---|
| 273 |
|
|---|
| 274 | /**
|
|---|
| 275 | * One X.509 OtherName (IPRT representation).
|
|---|
| 276 | */
|
|---|
| 277 | typedef struct RTCRX509OTHERNAME
|
|---|
| 278 | {
|
|---|
| 279 | /** The sequence core. */
|
|---|
| 280 | RTASN1SEQUENCECORE SeqCore;
|
|---|
| 281 | /** The name type identifier. */
|
|---|
| 282 | RTASN1OBJID TypeId;
|
|---|
| 283 | /** The name value (explicit tag 0). */
|
|---|
| 284 | RTASN1DYNTYPE Value;
|
|---|
| 285 | } RTCRX509OTHERNAME;
|
|---|
| 286 | /** Pointer to a X.509 OtherName (IPRT representation). */
|
|---|
| 287 | typedef RTCRX509OTHERNAME *PRTCRX509OTHERNAME;
|
|---|
| 288 | /** Pointer to a const X.509 OtherName (IPRT representation). */
|
|---|
| 289 | typedef RTCRX509OTHERNAME const *PCRTCRX509OTHERNAME;
|
|---|
| 290 | RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509OTHERNAME, RTDECL, RTCrX509OtherName, SeqCore.Asn1Core);
|
|---|
| 291 |
|
|---|
| 292 |
|
|---|
| 293 | typedef enum RTCRX509GENERALNAMECHOICE
|
|---|
| 294 | {
|
|---|
| 295 | RTCRX509GENERALNAMECHOICE_INVALID = 0,
|
|---|
| 296 | RTCRX509GENERALNAMECHOICE_OTHER_NAME,
|
|---|
| 297 | RTCRX509GENERALNAMECHOICE_RFC822_NAME,
|
|---|
| 298 | RTCRX509GENERALNAMECHOICE_DNS_NAME,
|
|---|
| 299 | RTCRX509GENERALNAMECHOICE_X400_ADDRESS,
|
|---|
| 300 | RTCRX509GENERALNAMECHOICE_DIRECTORY_NAME,
|
|---|
| 301 | RTCRX509GENERALNAMECHOICE_EDI_PARTY_NAME,
|
|---|
| 302 | RTCRX509GENERALNAMECHOICE_URI,
|
|---|
| 303 | RTCRX509GENERALNAMECHOICE_IP_ADDRESS,
|
|---|
| 304 | RTCRX509GENERALNAMECHOICE_REGISTERED_ID,
|
|---|
| 305 | RTCRX509GENERALNAMECHOICE_END,
|
|---|
| 306 | RTCRX509GENERALNAMECHOICE_32BIT_HACK = 0x7fffffff
|
|---|
| 307 | } RTCRX509GENERALNAMECHOICE;
|
|---|
| 308 |
|
|---|
| 309 | /**
|
|---|
| 310 | * One X.509 GeneralName (IPRT representation).
|
|---|
| 311 | *
|
|---|
| 312 | * This is represented as a union. Use the RTCRX509GENERALNAME_IS_XXX predicate
|
|---|
| 313 | * macros to figure out which member is valid (Asn1Core is always valid).
|
|---|
| 314 | */
|
|---|
| 315 | typedef struct RTCRX509GENERALNAME
|
|---|
| 316 | {
|
|---|
| 317 | /** Dummy ASN.1 record, not encoded. */
|
|---|
| 318 | RTASN1DUMMY Dummy;
|
|---|
| 319 | /** The value allocation. */
|
|---|
| 320 | RTASN1ALLOCATION Allocation;
|
|---|
| 321 | /** The choice of value. */
|
|---|
| 322 | RTCRX509GENERALNAMECHOICE enmChoice;
|
|---|
| 323 | /** The value union. */
|
|---|
| 324 | union
|
|---|
| 325 | {
|
|---|
| 326 | /** Tag 0: Other Name. */
|
|---|
| 327 | PRTCRX509OTHERNAME pT0_OtherName;
|
|---|
| 328 | /** Tag 1: RFC-822 Name. */
|
|---|
| 329 | PRTASN1STRING pT1_Rfc822;
|
|---|
| 330 | /** Tag 2: DNS name. */
|
|---|
| 331 | PRTASN1STRING pT2_DnsName;
|
|---|
| 332 | /** Tag 3: X.400 Address. */
|
|---|
| 333 | struct
|
|---|
| 334 | {
|
|---|
| 335 | /** Context tag 3. */
|
|---|
| 336 | RTASN1CONTEXTTAG3 CtxTag3;
|
|---|
| 337 | /** Later. */
|
|---|
| 338 | RTASN1DYNTYPE X400Address;
|
|---|
| 339 | } *pT3;
|
|---|
| 340 | /** Tag 4: Directory Name. */
|
|---|
| 341 | struct
|
|---|
| 342 | {
|
|---|
| 343 | /** Context tag 4. */
|
|---|
| 344 | RTASN1CONTEXTTAG4 CtxTag4;
|
|---|
| 345 | /** Directory name. */
|
|---|
| 346 | RTCRX509NAME DirectoryName;
|
|---|
| 347 | } *pT4;
|
|---|
| 348 | /** Tag 5: EDI Party Name. */
|
|---|
| 349 | struct
|
|---|
| 350 | {
|
|---|
| 351 | /** Context tag 5. */
|
|---|
| 352 | RTASN1CONTEXTTAG5 CtxTag5;
|
|---|
| 353 | /** Later. */
|
|---|
| 354 | RTASN1DYNTYPE EdiPartyName;
|
|---|
| 355 | } *pT5;
|
|---|
| 356 | /** Tag 6: URI. */
|
|---|
| 357 | PRTASN1STRING pT6_Uri;
|
|---|
| 358 | /** Tag 7: IP address. Either 4/8 (IPv4) or 16/32 (IPv16) octets long. */
|
|---|
| 359 | PRTASN1OCTETSTRING pT7_IpAddress;
|
|---|
| 360 | /** Tag 8: Registered ID. */
|
|---|
| 361 | PRTASN1OBJID pT8_RegisteredId;
|
|---|
| 362 | } u;
|
|---|
| 363 | } RTCRX509GENERALNAME;
|
|---|
| 364 | /** Pointer to the IPRT representation of an X.509 general name. */
|
|---|
| 365 | typedef RTCRX509GENERALNAME *PRTCRX509GENERALNAME;
|
|---|
| 366 | /** Pointer to the const IPRT representation of an X.509 general name. */
|
|---|
| 367 | typedef RTCRX509GENERALNAME const *PCRTCRX509GENERALNAME;
|
|---|
| 368 | RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509GENERALNAME, RTDECL, RTCrX509GeneralName, Dummy.Asn1Core);
|
|---|
| 369 |
|
|---|
| 370 | /** @name RTCRX509GENERALNAME tag predicates.
|
|---|
| 371 | * @{ */
|
|---|
| 372 | #define RTCRX509GENERALNAME_IS_OTHER_NAME(a_GenName) ((a_GenName)->enmChoice == RTCRX509GENERALNAMECHOICE_OTHER_NAME)
|
|---|
| 373 | #define RTCRX509GENERALNAME_IS_RFC822_NAME(a_GenName) ((a_GenName)->enmChoice == RTCRX509GENERALNAMECHOICE_RFC822_NAME)
|
|---|
| 374 | #define RTCRX509GENERALNAME_IS_DNS_NAME(a_GenName) ((a_GenName)->enmChoice == RTCRX509GENERALNAMECHOICE_DNS_NAME)
|
|---|
| 375 | #define RTCRX509GENERALNAME_IS_X400_ADDRESS(a_GenName) ((a_GenName)->enmChoice == RTCRX509GENERALNAMECHOICE_X400_ADDRESS)
|
|---|
| 376 | #define RTCRX509GENERALNAME_IS_DIRECTORY_NAME(a_GenName) ((a_GenName)->enmChoice == RTCRX509GENERALNAMECHOICE_DIRECTORY_NAME)
|
|---|
| 377 | #define RTCRX509GENERALNAME_IS_EDI_PARTY_NAME(a_GenName) ((a_GenName)->enmChoice == RTCRX509GENERALNAMECHOICE_EDI_PARTY_NAME)
|
|---|
| 378 | #define RTCRX509GENERALNAME_IS_URI(a_GenName) ((a_GenName)->enmChoice == RTCRX509GENERALNAMECHOICE_URI)
|
|---|
| 379 | #define RTCRX509GENERALNAME_IS_IP_ADDRESS(a_GenName) ((a_GenName)->enmChoice == RTCRX509GENERALNAMECHOICE_IP_ADDRESS)
|
|---|
| 380 | #define RTCRX509GENERALNAME_IS_REGISTERED_ID(a_GenName) ((a_GenName)->enmChoice == RTCRX509GENERALNAMECHOICE_REGISTERED_ID)
|
|---|
| 381 | /** @} */
|
|---|
| 382 |
|
|---|
| 383 |
|
|---|
| 384 | RTASN1_IMPL_GEN_SEQ_OF_TYPEDEFS_AND_PROTOS(RTCRX509GENERALNAMES, RTCRX509GENERALNAME, RTDECL, RTCrX509GeneralNames);
|
|---|
| 385 | RTDECL(bool) RTCrX509GeneralName_ConstraintMatch(PCRTCRX509GENERALNAME pConstraint, PCRTCRX509GENERALNAME pName);
|
|---|
| 386 |
|
|---|
| 387 |
|
|---|
| 388 | /**
|
|---|
| 389 | * X.509 Validity (IPRT representation).
|
|---|
| 390 | */
|
|---|
| 391 | typedef struct RTCRX509VALIDITY
|
|---|
| 392 | {
|
|---|
| 393 | /** Core sequence bits. */
|
|---|
| 394 | RTASN1SEQUENCECORE SeqCore;
|
|---|
| 395 | /** Effective starting. */
|
|---|
| 396 | RTASN1TIME NotBefore;
|
|---|
| 397 | /** Expires after. */
|
|---|
| 398 | RTASN1TIME NotAfter;
|
|---|
| 399 | } RTCRX509VALIDITY;
|
|---|
| 400 | /** Pointer to the IPRT representation of an X.509 validity sequence. */
|
|---|
| 401 | typedef RTCRX509VALIDITY *PRTCRX509VALIDITY;
|
|---|
| 402 | /** Pointer ot the const IPRT representation of an X.509 validity sequence. */
|
|---|
| 403 | typedef RTCRX509VALIDITY const *PCRTCRX509VALIDITY;
|
|---|
| 404 | RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509VALIDITY, RTDECL, RTCrX509Validity, SeqCore.Asn1Core);
|
|---|
| 405 |
|
|---|
| 406 | RTDECL(bool) RTCrX509Validity_IsValidAtTimeSpec(PCRTCRX509VALIDITY pThis, PCRTTIMESPEC pTimeSpec);
|
|---|
| 407 |
|
|---|
| 408 |
|
|---|
| 409 | #if 0
|
|---|
| 410 | /**
|
|---|
| 411 | * X.509 UniqueIdentifier (IPRT representation).
|
|---|
| 412 | */
|
|---|
| 413 | typedef struct RTCRX509UNIQUEIDENTIFIER
|
|---|
| 414 | {
|
|---|
| 415 | /** Representation is a bit string. */
|
|---|
| 416 | RTASN1BITSTRING BitString;
|
|---|
| 417 | } RTCRX509UNIQUEIDENTIFIER;
|
|---|
| 418 | /** Pointer to the IPRT representation of an X.509 unique identifier. */
|
|---|
| 419 | typedef RTCRX509UNIQUEIDENTIFIER *PRTCRX509UNIQUEIDENTIFIER;
|
|---|
| 420 | /** Pointer to the const IPRT representation of an X.509 unique identifier. */
|
|---|
| 421 | typedef RTCRX509UNIQUEIDENTIFIER const *PCRTCRX509UNIQUEIDENTIFIER;
|
|---|
| 422 | RTASN1TYPE_STANDARD_PROTOTYPES_NO_GET_CORE(RTCRX509UNIQUEIDENTIFIER, RTDECL, RTCrX509UniqueIdentifier);
|
|---|
| 423 | #endif
|
|---|
| 424 | RTASN1TYPE_ALIAS(RTCRX509UNIQUEIDENTIFIER, RTASN1BITSTRING, RTCrX509UniqueIdentifier, RTAsn1BitString);
|
|---|
| 425 |
|
|---|
| 426 |
|
|---|
| 427 | /**
|
|---|
| 428 | * X.509 SubjectPublicKeyInfo (IPRT representation).
|
|---|
| 429 | */
|
|---|
| 430 | typedef struct RTCRX509SUBJECTPUBLICKEYINFO
|
|---|
| 431 | {
|
|---|
| 432 | /** Core sequence bits. */
|
|---|
| 433 | RTASN1SEQUENCECORE SeqCore;
|
|---|
| 434 | /** The algorithm used with the public key. */
|
|---|
| 435 | RTCRX509ALGORITHMIDENTIFIER Algorithm;
|
|---|
| 436 | /** A bit string containing the public key.
|
|---|
| 437 | *
|
|---|
| 438 | * For algorithms like rsaEncryption this is generally a sequence of two
|
|---|
| 439 | * integers, where the first one has lots of bits, and the second one being a
|
|---|
| 440 | * modulous value. These are details specific to the algorithm and not relevant
|
|---|
| 441 | * when validating the certificate chain. */
|
|---|
| 442 | RTASN1BITSTRING SubjectPublicKey;
|
|---|
| 443 | } RTCRX509SUBJECTPUBLICKEYINFO;
|
|---|
| 444 | /** Pointer to the IPRT representation of an X.509 subject public key info
|
|---|
| 445 | * sequence. */
|
|---|
| 446 | typedef RTCRX509SUBJECTPUBLICKEYINFO *PRTCRX509SUBJECTPUBLICKEYINFO;
|
|---|
| 447 | /** Pointer to the const IPRT representation of an X.509 subject public key info
|
|---|
| 448 | * sequence. */
|
|---|
| 449 | typedef RTCRX509SUBJECTPUBLICKEYINFO const *PCRTCRX509SUBJECTPUBLICKEYINFO;
|
|---|
| 450 | RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509SUBJECTPUBLICKEYINFO, RTDECL, RTCrX509SubjectPublicKeyInfo, SeqCore.Asn1Core);
|
|---|
| 451 |
|
|---|
| 452 |
|
|---|
| 453 | /**
|
|---|
| 454 | * One X.509 AuthorityKeyIdentifier (IPRT representation).
|
|---|
| 455 | */
|
|---|
| 456 | typedef struct RTCRX509AUTHORITYKEYIDENTIFIER
|
|---|
| 457 | {
|
|---|
| 458 | /** Sequence core. */
|
|---|
| 459 | RTASN1SEQUENCECORE SeqCore;
|
|---|
| 460 | /** Tag 0, optional, implicit: Key identifier. */
|
|---|
| 461 | RTASN1OCTETSTRING KeyIdentifier;
|
|---|
| 462 | /** Tag 1, optional, implicit: Issuer name. */
|
|---|
| 463 | RTCRX509GENERALNAMES AuthorityCertIssuer;
|
|---|
| 464 | /** Tag 2, optional, implicit: Serial number of issuer. */
|
|---|
| 465 | RTASN1INTEGER AuthorityCertSerialNumber;
|
|---|
| 466 | } RTCRX509AUTHORITYKEYIDENTIFIER;
|
|---|
| 467 | /** Pointer to the IPRT representation of an X.509 AuthorityKeyIdentifier
|
|---|
| 468 | * sequence. */
|
|---|
| 469 | typedef RTCRX509AUTHORITYKEYIDENTIFIER *PRTCRX509AUTHORITYKEYIDENTIFIER;
|
|---|
| 470 | /** Pointer to the const IPRT representation of an X.509 AuthorityKeyIdentifier
|
|---|
| 471 | * sequence. */
|
|---|
| 472 | typedef RTCRX509AUTHORITYKEYIDENTIFIER const *PCRTCRX509AUTHORITYKEYIDENTIFIER;
|
|---|
| 473 | RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509AUTHORITYKEYIDENTIFIER, RTDECL, RTCrX509AuthorityKeyIdentifier, SeqCore.Asn1Core);
|
|---|
| 474 |
|
|---|
| 475 |
|
|---|
| 476 | /**
|
|---|
| 477 | * One X.509 OldAuthorityKeyIdentifier (IPRT representation).
|
|---|
| 478 | */
|
|---|
| 479 | typedef struct RTCRX509OLDAUTHORITYKEYIDENTIFIER
|
|---|
| 480 | {
|
|---|
| 481 | /** Sequence core. */
|
|---|
| 482 | RTASN1SEQUENCECORE SeqCore;
|
|---|
| 483 | /** Tag 0, optional, implicit: Key identifier. */
|
|---|
| 484 | RTASN1OCTETSTRING KeyIdentifier;
|
|---|
| 485 | struct
|
|---|
| 486 | {
|
|---|
| 487 | RTASN1CONTEXTTAG1 CtxTag1;
|
|---|
| 488 | /** Tag 1, optional, implicit: Issuer name. */
|
|---|
| 489 | RTCRX509NAME AuthorityCertIssuer;
|
|---|
| 490 | } T1;
|
|---|
| 491 | /** Tag 2, optional, implicit: Serial number of issuer. */
|
|---|
| 492 | RTASN1INTEGER AuthorityCertSerialNumber;
|
|---|
| 493 | } RTCRX509OLDAUTHORITYKEYIDENTIFIER;
|
|---|
| 494 | /** Pointer to the IPRT representation of an X.509 AuthorityKeyIdentifier
|
|---|
| 495 | * sequence. */
|
|---|
| 496 | typedef RTCRX509OLDAUTHORITYKEYIDENTIFIER *PRTCRX509OLDAUTHORITYKEYIDENTIFIER;
|
|---|
| 497 | /** Pointer to the const IPRT representation of an X.509 AuthorityKeyIdentifier
|
|---|
| 498 | * sequence. */
|
|---|
| 499 | typedef RTCRX509OLDAUTHORITYKEYIDENTIFIER const *PCRTCRX509OLDAUTHORITYKEYIDENTIFIER;
|
|---|
| 500 | RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509OLDAUTHORITYKEYIDENTIFIER, RTDECL, RTCrX509OldAuthorityKeyIdentifier, SeqCore.Asn1Core);
|
|---|
| 501 |
|
|---|
| 502 |
|
|---|
| 503 | /**
|
|---|
| 504 | * One X.509 PolicyQualifierInfo (IPRT representation).
|
|---|
| 505 | */
|
|---|
| 506 | typedef struct RTCRX509POLICYQUALIFIERINFO
|
|---|
| 507 | {
|
|---|
| 508 | /** Core sequence bits. */
|
|---|
| 509 | RTASN1SEQUENCECORE SeqCore;
|
|---|
| 510 | /** The policy object ID. */
|
|---|
| 511 | RTASN1OBJID PolicyQualifierId;
|
|---|
| 512 | /** Anything defined by the policy qualifier id. */
|
|---|
| 513 | RTASN1DYNTYPE Qualifier;
|
|---|
| 514 | } RTCRX509POLICYQUALIFIERINFO;
|
|---|
| 515 | /** Pointer to the IPRT representation of an X.509 PolicyQualifierInfo
|
|---|
| 516 | * sequence. */
|
|---|
| 517 | typedef RTCRX509POLICYQUALIFIERINFO *PRTCRX509POLICYQUALIFIERINFO;
|
|---|
| 518 | /** Pointer to the const IPRT representation of an X.509 PolicyQualifierInfo
|
|---|
| 519 | * sequence. */
|
|---|
| 520 | typedef RTCRX509POLICYQUALIFIERINFO const *PCRTCRX509POLICYQUALIFIERINFO;
|
|---|
| 521 | RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509POLICYQUALIFIERINFO, RTDECL, RTCrX509PolicyQualifierInfo, SeqCore.Asn1Core);
|
|---|
| 522 | RTASN1_IMPL_GEN_SEQ_OF_TYPEDEFS_AND_PROTOS(RTCRX509POLICYQUALIFIERINFOS, RTCRX509POLICYQUALIFIERINFO, RTDECL, RTCrX509PolicyQualifierInfos);
|
|---|
| 523 |
|
|---|
| 524 |
|
|---|
| 525 | /**
|
|---|
| 526 | * One X.509 PolicyInformation (IPRT representation).
|
|---|
| 527 | */
|
|---|
| 528 | typedef struct RTCRX509POLICYINFORMATION
|
|---|
| 529 | {
|
|---|
| 530 | /** Core sequence bits. */
|
|---|
| 531 | RTASN1SEQUENCECORE SeqCore;
|
|---|
| 532 | /** The policy object ID. */
|
|---|
| 533 | RTASN1OBJID PolicyIdentifier;
|
|---|
| 534 | /** Optional sequence of policy qualifiers. */
|
|---|
| 535 | RTCRX509POLICYQUALIFIERINFOS PolicyQualifiers;
|
|---|
| 536 | } RTCRX509POLICYINFORMATION;
|
|---|
| 537 | /** Pointer to the IPRT representation of an X.509 PolicyInformation
|
|---|
| 538 | * sequence. */
|
|---|
| 539 | typedef RTCRX509POLICYINFORMATION *PRTCRX509POLICYINFORMATION;
|
|---|
| 540 | /** Pointer to the const IPRT representation of an X.509 PolicyInformation
|
|---|
| 541 | * sequence. */
|
|---|
| 542 | typedef RTCRX509POLICYINFORMATION const *PCRTCRX509POLICYINFORMATION;
|
|---|
| 543 | RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509POLICYINFORMATION, RTDECL, RTCrX509PolicyInformation, SeqCore.Asn1Core);
|
|---|
| 544 | RTASN1_IMPL_GEN_SEQ_OF_TYPEDEFS_AND_PROTOS(RTCRX509CERTIFICATEPOLICIES, RTCRX509POLICYINFORMATION, RTDECL, RTCrX509CertificatePolicies);
|
|---|
| 545 |
|
|---|
| 546 | /** Sepcial policy object ID that matches any policy. */
|
|---|
| 547 | #define RTCRX509_ID_CE_CP_ANY_POLICY_OID "2.5.29.32.0"
|
|---|
| 548 |
|
|---|
| 549 |
|
|---|
| 550 | /**
|
|---|
| 551 | * One X.509 PolicyMapping (IPRT representation).
|
|---|
| 552 | */
|
|---|
| 553 | typedef struct RTCRX509POLICYMAPPING
|
|---|
| 554 | {
|
|---|
| 555 | /** Core sequence bits. */
|
|---|
| 556 | RTASN1SEQUENCECORE SeqCore;
|
|---|
| 557 | /** Issuer policy ID. */
|
|---|
| 558 | RTASN1OBJID IssuerDomainPolicy;
|
|---|
| 559 | /** Subject policy ID. */
|
|---|
| 560 | RTASN1OBJID SubjectDomainPolicy;
|
|---|
| 561 | } RTCRX509POLICYMAPPING;
|
|---|
| 562 | /** Pointer to the IPRT representation of a sequence of X.509 PolicyMapping. */
|
|---|
| 563 | typedef RTCRX509POLICYMAPPING *PRTCRX509POLICYMAPPING;
|
|---|
| 564 | /** Pointer to the const IPRT representation of a sequence of X.509
|
|---|
| 565 | * PolicyMapping. */
|
|---|
| 566 | typedef RTCRX509POLICYMAPPING const *PCRTCRX509POLICYMAPPING;
|
|---|
| 567 | RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509POLICYMAPPING, RTDECL, RTCrX509PolicyMapping, SeqCore.Asn1Core);
|
|---|
| 568 | RTASN1_IMPL_GEN_SEQ_OF_TYPEDEFS_AND_PROTOS(RTCRX509POLICYMAPPINGS, RTCRX509POLICYMAPPING, RTDECL, RTCrX509PolicyMappings);
|
|---|
| 569 |
|
|---|
| 570 |
|
|---|
| 571 | /**
|
|---|
| 572 | * X.509 BasicConstraints (IPRT representation).
|
|---|
| 573 | */
|
|---|
| 574 | typedef struct RTCRX509BASICCONSTRAINTS
|
|---|
| 575 | {
|
|---|
| 576 | /** Core sequence bits. */
|
|---|
| 577 | RTASN1SEQUENCECORE SeqCore;
|
|---|
| 578 | /** Is this ia certficiate authority? Default to false. */
|
|---|
| 579 | RTASN1BOOLEAN CA;
|
|---|
| 580 | /** Path length constraint. */
|
|---|
| 581 | RTASN1INTEGER PathLenConstraint;
|
|---|
| 582 | } RTCRX509BASICCONSTRAINTS;
|
|---|
| 583 | /** Pointer to the IPRT representation of a sequence of X.509
|
|---|
| 584 | * BasicConstraints. */
|
|---|
| 585 | typedef RTCRX509BASICCONSTRAINTS *PRTCRX509BASICCONSTRAINTS;
|
|---|
| 586 | /** Pointer to the const IPRT representation of a sequence of X.509
|
|---|
| 587 | * BasicConstraints. */
|
|---|
| 588 | typedef RTCRX509BASICCONSTRAINTS const *PCRTCRX509BASICCONSTRAINTS;
|
|---|
| 589 | RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509BASICCONSTRAINTS, RTDECL, RTCrX509BasicConstraints, SeqCore.Asn1Core);
|
|---|
| 590 |
|
|---|
| 591 |
|
|---|
| 592 | /**
|
|---|
| 593 | * X.509 GeneralSubtree (IPRT representation).
|
|---|
| 594 | */
|
|---|
| 595 | typedef struct RTCRX509GENERALSUBTREE
|
|---|
| 596 | {
|
|---|
| 597 | /** Core sequence bits. */
|
|---|
| 598 | RTASN1SEQUENCECORE SeqCore;
|
|---|
| 599 | /** Base name. */
|
|---|
| 600 | RTCRX509GENERALNAME Base;
|
|---|
| 601 | /** Tag 0, optional: Minimum, default 0. Fixed at 0 by RFC-5280. */
|
|---|
| 602 | RTASN1INTEGER Minimum;
|
|---|
| 603 | /** Tag 1, optional: Maximum. Fixed as not-present by RFC-5280. */
|
|---|
| 604 | RTASN1INTEGER Maximum;
|
|---|
| 605 | } RTCRX509GENERALSUBTREE;
|
|---|
| 606 | /** Pointer to the IPRT representation of a sequence of X.509 GeneralSubtree. */
|
|---|
| 607 | typedef RTCRX509GENERALSUBTREE *PRTCRX509GENERALSUBTREE;
|
|---|
| 608 | /** Pointer to the const IPRT representation of a sequence of X.509
|
|---|
| 609 | * GeneralSubtree. */
|
|---|
| 610 | typedef RTCRX509GENERALSUBTREE const *PCRTCRX509GENERALSUBTREE;
|
|---|
| 611 | RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509GENERALSUBTREE, RTDECL, RTCrX509GeneralSubtree, SeqCore.Asn1Core);
|
|---|
| 612 |
|
|---|
| 613 | RTDECL(bool) RTCrX509GeneralSubtree_ConstraintMatch(PCRTCRX509GENERALSUBTREE pConstraint, PCRTCRX509GENERALSUBTREE pName);
|
|---|
| 614 |
|
|---|
| 615 | RTASN1_IMPL_GEN_SEQ_OF_TYPEDEFS_AND_PROTOS(RTCRX509GENERALSUBTREES, RTCRX509GENERALSUBTREE, RTDECL, RTCrX509GeneralSubtrees);
|
|---|
| 616 |
|
|---|
| 617 |
|
|---|
| 618 | /**
|
|---|
| 619 | * X.509 NameConstraints (IPRT representation).
|
|---|
| 620 | */
|
|---|
| 621 | typedef struct RTCRX509NAMECONSTRAINTS
|
|---|
| 622 | {
|
|---|
| 623 | /** Core sequence bits. */
|
|---|
| 624 | RTASN1SEQUENCECORE SeqCore;
|
|---|
| 625 | /** Tag 0, optional: Permitted subtrees. */
|
|---|
| 626 | struct
|
|---|
| 627 | {
|
|---|
| 628 | /** Context tag. */
|
|---|
| 629 | RTASN1CONTEXTTAG0 CtxTag0;
|
|---|
| 630 | /** The permitted subtrees. */
|
|---|
| 631 | RTCRX509GENERALSUBTREES PermittedSubtrees;
|
|---|
| 632 | } T0;
|
|---|
| 633 | /** Tag 1, optional: Excluded subtrees. */
|
|---|
| 634 | struct
|
|---|
| 635 | {
|
|---|
| 636 | /** Context tag. */
|
|---|
| 637 | RTASN1CONTEXTTAG1 CtxTag1;
|
|---|
| 638 | /** The excluded subtrees. */
|
|---|
| 639 | RTCRX509GENERALSUBTREES ExcludedSubtrees;
|
|---|
| 640 | } T1;
|
|---|
| 641 | } RTCRX509NAMECONSTRAINTS;
|
|---|
| 642 | /** Pointer to the IPRT representation of a sequence of X.509
|
|---|
| 643 | * NameConstraints. */
|
|---|
| 644 | typedef RTCRX509NAMECONSTRAINTS *PRTCRX509NAMECONSTRAINTS;
|
|---|
| 645 | /** Pointer to the const IPRT representation of a sequence of X.509
|
|---|
| 646 | * NameConstraints. */
|
|---|
| 647 | typedef RTCRX509NAMECONSTRAINTS const *PCRTCRX509NAMECONSTRAINTS;
|
|---|
| 648 | RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509NAMECONSTRAINTS, RTDECL, RTCrX509NameConstraints, SeqCore.Asn1Core);
|
|---|
| 649 |
|
|---|
| 650 |
|
|---|
| 651 | /**
|
|---|
| 652 | * X.509 PolicyConstraints (IPRT representation).
|
|---|
| 653 | */
|
|---|
| 654 | typedef struct RTCRX509POLICYCONSTRAINTS
|
|---|
| 655 | {
|
|---|
| 656 | /** Core sequence bits. */
|
|---|
| 657 | RTASN1SEQUENCECORE SeqCore;
|
|---|
| 658 | /** Tag 0, optional: Certificates before an explicit policy is required. */
|
|---|
| 659 | RTASN1INTEGER RequireExplicitPolicy;
|
|---|
| 660 | /** Tag 1, optional: Certificates before policy mapping is inhibited. */
|
|---|
| 661 | RTASN1INTEGER InhibitPolicyMapping;
|
|---|
| 662 | } RTCRX509POLICYCONSTRAINTS;
|
|---|
| 663 | /** Pointer to the IPRT representation of a sequence of X.509
|
|---|
| 664 | * PolicyConstraints. */
|
|---|
| 665 | typedef RTCRX509POLICYCONSTRAINTS *PRTCRX509POLICYCONSTRAINTS;
|
|---|
| 666 | /** Pointer to the const IPRT representation of a sequence of X.509
|
|---|
| 667 | * PolicyConstraints. */
|
|---|
| 668 | typedef RTCRX509POLICYCONSTRAINTS const *PCRTCRX509POLICYCONSTRAINTS;
|
|---|
| 669 | RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509POLICYCONSTRAINTS, RTDECL, RTCrX509PolicyConstraints, SeqCore.Asn1Core);
|
|---|
| 670 |
|
|---|
| 671 |
|
|---|
| 672 | /**
|
|---|
| 673 | * Indicates what an X.509 extension value encapsulates.
|
|---|
| 674 | */
|
|---|
| 675 | typedef enum RTCRX509EXTENSIONVALUE
|
|---|
| 676 | {
|
|---|
| 677 | RTCRX509EXTENSIONVALUE_INVALID = 0,
|
|---|
| 678 | /** Unknown, no decoding available just the octet string. */
|
|---|
| 679 | RTCRX509EXTENSIONVALUE_UNKNOWN,
|
|---|
| 680 | /** Unencapsulated (i.e. octet string). */
|
|---|
| 681 | RTCRX509EXTENSIONVALUE_NOT_ENCAPSULATED,
|
|---|
| 682 |
|
|---|
| 683 | /** Bit string (RTASN1BITSTRING). */
|
|---|
| 684 | RTCRX509EXTENSIONVALUE_BIT_STRING,
|
|---|
| 685 | /** Octet string (RTASN1OCTETSTRING). */
|
|---|
| 686 | RTCRX509EXTENSIONVALUE_OCTET_STRING,
|
|---|
| 687 | /** Integer string (RTASN1INTEGER). */
|
|---|
| 688 | RTCRX509EXTENSIONVALUE_INTEGER,
|
|---|
| 689 | /** Sequence of object identifiers (RTASN1SEQOFOBJIDS). */
|
|---|
| 690 | RTCRX509EXTENSIONVALUE_SEQ_OF_OBJ_IDS,
|
|---|
| 691 |
|
|---|
| 692 | /** Authority key identifier (RTCRX509AUTHORITYKEYIDENTIFIER). */
|
|---|
| 693 | RTCRX509EXTENSIONVALUE_AUTHORITY_KEY_IDENTIFIER,
|
|---|
| 694 | /** Old Authority key identifier (RTCRX509OLDAUTHORITYKEYIDENTIFIER). */
|
|---|
| 695 | RTCRX509EXTENSIONVALUE_OLD_AUTHORITY_KEY_IDENTIFIER,
|
|---|
| 696 | /** Certificate policies (RTCRX509CERTIFICATEPOLICIES). */
|
|---|
| 697 | RTCRX509EXTENSIONVALUE_CERTIFICATE_POLICIES,
|
|---|
| 698 | /** Sequence of policy mappings (RTCRX509POLICYMAPPINGS). */
|
|---|
| 699 | RTCRX509EXTENSIONVALUE_POLICY_MAPPINGS,
|
|---|
| 700 | /** Basic constraints (RTCRX509BASICCONSTRAINTS). */
|
|---|
| 701 | RTCRX509EXTENSIONVALUE_BASIC_CONSTRAINTS,
|
|---|
| 702 | /** Name constraints (RTCRX509NAMECONSTRAINTS). */
|
|---|
| 703 | RTCRX509EXTENSIONVALUE_NAME_CONSTRAINTS,
|
|---|
| 704 | /** Policy constraints (RTCRX509POLICYCONSTRAINTS). */
|
|---|
| 705 | RTCRX509EXTENSIONVALUE_POLICY_CONSTRAINTS,
|
|---|
| 706 | /** Sequence of general names (RTCRX509GENERALNAMES). */
|
|---|
| 707 | RTCRX509EXTENSIONVALUE_GENERAL_NAMES,
|
|---|
| 708 |
|
|---|
| 709 | /** Blow the type up to 32-bits. */
|
|---|
| 710 | RTCRX509EXTENSIONVALUE_32BIT_HACK = 0x7fffffff
|
|---|
| 711 | } RTCRX509EXTENSIONVALUE;
|
|---|
| 712 |
|
|---|
| 713 | /**
|
|---|
| 714 | * One X.509 Extension (IPRT representation).
|
|---|
| 715 | */
|
|---|
| 716 | typedef struct RTCRX509EXTENSION
|
|---|
| 717 | {
|
|---|
| 718 | /** Core sequence bits. */
|
|---|
| 719 | RTASN1SEQUENCECORE SeqCore;
|
|---|
| 720 | /** Extension ID. */
|
|---|
| 721 | RTASN1OBJID ExtnId;
|
|---|
| 722 | /** Whether this is critical (default @c false). */
|
|---|
| 723 | RTASN1BOOLEAN Critical;
|
|---|
| 724 | /** Indicates what ExtnValue.pEncapsulated points at. */
|
|---|
| 725 | RTCRX509EXTENSIONVALUE enmValue;
|
|---|
| 726 | /** The value.
|
|---|
| 727 | * Contains extension specific data that we don't yet parse. */
|
|---|
| 728 | RTASN1OCTETSTRING ExtnValue;
|
|---|
| 729 | } RTCRX509EXTENSION;
|
|---|
| 730 | /** Pointer to the IPRT representation of one X.509 extensions. */
|
|---|
| 731 | typedef RTCRX509EXTENSION *PRTCRX509EXTENSION;
|
|---|
| 732 | /** Pointer to the const IPRT representation of one X.509 extension. */
|
|---|
| 733 | typedef RTCRX509EXTENSION const *PCRTCRX509EXTENSION;
|
|---|
| 734 | RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509EXTENSION, RTDECL, RTCrX509Extension, SeqCore.Asn1Core);
|
|---|
| 735 | RTASN1_IMPL_GEN_SEQ_OF_TYPEDEFS_AND_PROTOS(RTCRX509EXTENSIONS, RTCRX509EXTENSION, RTDECL, RTCrX509Extensions);
|
|---|
| 736 |
|
|---|
| 737 | RTDECL(int) RTCrX509Extension_ExtnValue_DecodeAsn1(PRTASN1CURSOR pCursor, uint32_t fFlags,
|
|---|
| 738 | PRTCRX509EXTENSION pThis, const char *pszErrorTag);
|
|---|
| 739 |
|
|---|
| 740 |
|
|---|
| 741 | /**
|
|---|
| 742 | * X.509 To-be-signed certificate information (IPRT representation).
|
|---|
| 743 | */
|
|---|
| 744 | typedef struct RTCRX509TBSCERTIFICATE
|
|---|
| 745 | {
|
|---|
| 746 | /** Sequence core. */
|
|---|
| 747 | RTASN1SEQUENCECORE SeqCore;
|
|---|
| 748 | /** Structure version. */
|
|---|
| 749 | struct
|
|---|
| 750 | {
|
|---|
| 751 | /** Context tag with value 0. */
|
|---|
| 752 | RTASN1CONTEXTTAG0 CtxTag0;
|
|---|
| 753 | /** The actual value (RTCRX509TBSCERTIFICATE_V1, ...). */
|
|---|
| 754 | RTASN1INTEGER Version;
|
|---|
| 755 | } T0;
|
|---|
| 756 | /** The serial number of the certificate. */
|
|---|
| 757 | RTASN1INTEGER SerialNumber;
|
|---|
| 758 | /** The signature algorithm. */
|
|---|
| 759 | RTCRX509ALGORITHMIDENTIFIER Signature;
|
|---|
| 760 | /** The issuer name. */
|
|---|
| 761 | RTCRX509NAME Issuer;
|
|---|
| 762 | /** The certificate validity period. */
|
|---|
| 763 | RTCRX509VALIDITY Validity;
|
|---|
| 764 | /** The subject name. */
|
|---|
| 765 | RTCRX509NAME Subject;
|
|---|
| 766 | /** The public key for this certificate. */
|
|---|
| 767 | RTCRX509SUBJECTPUBLICKEYINFO SubjectPublicKeyInfo;
|
|---|
| 768 | /** Issuer unique identifier (optional, version >= v2). */
|
|---|
| 769 | struct
|
|---|
| 770 | {
|
|---|
| 771 | /** Context tag with value 1. */
|
|---|
| 772 | RTASN1CONTEXTTAG1 CtxTag1;
|
|---|
| 773 | /** The unique identifier value. */
|
|---|
| 774 | RTCRX509UNIQUEIDENTIFIER IssuerUniqueId;
|
|---|
| 775 | } T1;
|
|---|
| 776 | /** Subject unique identifier (optional, version >= v2). */
|
|---|
| 777 | struct
|
|---|
| 778 | {
|
|---|
| 779 | /** Context tag with value 2. */
|
|---|
| 780 | RTASN1CONTEXTTAG2 CtxTag2;
|
|---|
| 781 | /** The unique identifier value. */
|
|---|
| 782 | RTCRX509UNIQUEIDENTIFIER SubjectUniqueId;
|
|---|
| 783 | } T2;
|
|---|
| 784 | /** Extensions (optional, version >= v3). */
|
|---|
| 785 | struct
|
|---|
| 786 | {
|
|---|
| 787 | /** Context tag with value 3. */
|
|---|
| 788 | RTASN1CONTEXTTAG3 CtxTag3;
|
|---|
| 789 | /** The unique identifier value. */
|
|---|
| 790 | RTCRX509EXTENSIONS Extensions;
|
|---|
| 791 | /** Extensions summary flags (RTCRX509TBSCERTIFICATE_F_PRESENT_XXX). */
|
|---|
| 792 | uint32_t fFlags;
|
|---|
| 793 | /** Key usage flags (RTCRX509CERT_KEY_USAGE_F_XXX). */
|
|---|
| 794 | uint32_t fKeyUsage;
|
|---|
| 795 | /** Extended key usage flags (RTCRX509CERT_EKU_F_XXX). */
|
|---|
| 796 | uint64_t fExtKeyUsage;
|
|---|
| 797 |
|
|---|
| 798 | /** Pointer to the authority key ID extension if present. */
|
|---|
| 799 | PCRTCRX509AUTHORITYKEYIDENTIFIER pAuthorityKeyIdentifier;
|
|---|
| 800 | /** Pointer to the OLD authority key ID extension if present. */
|
|---|
| 801 | PCRTCRX509OLDAUTHORITYKEYIDENTIFIER pOldAuthorityKeyIdentifier;
|
|---|
| 802 | /** Pointer to the subject key ID extension if present. */
|
|---|
| 803 | PCRTASN1OCTETSTRING pSubjectKeyIdentifier;
|
|---|
| 804 | /** Pointer to the alternative subject name extension if present. */
|
|---|
| 805 | PCRTCRX509GENERALNAMES pAltSubjectName;
|
|---|
| 806 | /** Pointer to the alternative issuer name extension if present. */
|
|---|
| 807 | PCRTCRX509GENERALNAMES pAltIssuerName;
|
|---|
| 808 | /** Pointer to the certificate policies extension if present. */
|
|---|
| 809 | PCRTCRX509CERTIFICATEPOLICIES pCertificatePolicies;
|
|---|
| 810 | /** Pointer to the policy mappings extension if present. */
|
|---|
| 811 | PCRTCRX509POLICYMAPPINGS pPolicyMappings;
|
|---|
| 812 | /** Pointer to the basic constraints extension if present. */
|
|---|
| 813 | PCRTCRX509BASICCONSTRAINTS pBasicConstraints;
|
|---|
| 814 | /** Pointer to the name constraints extension if present. */
|
|---|
| 815 | PCRTCRX509NAMECONSTRAINTS pNameConstraints;
|
|---|
| 816 | /** Pointer to the policy constraints extension if present. */
|
|---|
| 817 | PCRTCRX509POLICYCONSTRAINTS pPolicyConstraints;
|
|---|
| 818 | /** Pointer to the inhibit anyPolicy extension if present. */
|
|---|
| 819 | PCRTASN1INTEGER pInhibitAnyPolicy;
|
|---|
| 820 | } T3;
|
|---|
| 821 | } RTCRX509TBSCERTIFICATE;
|
|---|
| 822 | /** Pointer to the IPRT representation of a X.509 TBSCertificate. */
|
|---|
| 823 | typedef RTCRX509TBSCERTIFICATE *PRTCRX509TBSCERTIFICATE;
|
|---|
| 824 | /** Pointer to the const IPRT representation of a X.509 TBSCertificate. */
|
|---|
| 825 | typedef RTCRX509TBSCERTIFICATE const *PCRTCRX509TBSCERTIFICATE;
|
|---|
| 826 | RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509TBSCERTIFICATE, RTDECL, RTCrX509TbsCertificate, SeqCore.Asn1Core);
|
|---|
| 827 |
|
|---|
| 828 | /** @name RTCRX509TBSCERTIFICATE::T0.Version values.
|
|---|
| 829 | * @{ */
|
|---|
| 830 | #define RTCRX509TBSCERTIFICATE_V1 0
|
|---|
| 831 | #define RTCRX509TBSCERTIFICATE_V2 1
|
|---|
| 832 | #define RTCRX509TBSCERTIFICATE_V3 2
|
|---|
| 833 | /** @} */
|
|---|
| 834 |
|
|---|
| 835 | /** @name RTCRX509TBSCERTIFICATE::T3.fFlags values.
|
|---|
| 836 | * @{ */
|
|---|
| 837 | #define RTCRX509TBSCERTIFICATE_F_PRESENT_KEY_USAGE RT_BIT_32(0)
|
|---|
| 838 | #define RTCRX509TBSCERTIFICATE_F_PRESENT_EXT_KEY_USAGE RT_BIT_32(1)
|
|---|
| 839 | #define RTCRX509TBSCERTIFICATE_F_PRESENT_SUBJECT_KEY_IDENTIFIER RT_BIT_32(2)
|
|---|
| 840 | #define RTCRX509TBSCERTIFICATE_F_PRESENT_SUBJECT_ALT_NAME RT_BIT_32(3)
|
|---|
| 841 | #define RTCRX509TBSCERTIFICATE_F_PRESENT_ISSUER_ALT_NAME RT_BIT_32(4)
|
|---|
| 842 | #define RTCRX509TBSCERTIFICATE_F_PRESENT_CERTIFICATE_POLICIES RT_BIT_32(5)
|
|---|
| 843 | #define RTCRX509TBSCERTIFICATE_F_PRESENT_POLICY_MAPPINGS RT_BIT_32(6)
|
|---|
| 844 | #define RTCRX509TBSCERTIFICATE_F_PRESENT_BASIC_CONSTRAINTS RT_BIT_32(7)
|
|---|
| 845 | #define RTCRX509TBSCERTIFICATE_F_PRESENT_NAME_CONSTRAINTS RT_BIT_32(8)
|
|---|
| 846 | #define RTCRX509TBSCERTIFICATE_F_PRESENT_POLICY_CONSTRAINTS RT_BIT_32(9)
|
|---|
| 847 | #define RTCRX509TBSCERTIFICATE_F_PRESENT_AUTHORITY_KEY_IDENTIFIER RT_BIT_32(10)
|
|---|
| 848 | #define RTCRX509TBSCERTIFICATE_F_PRESENT_OLD_AUTHORITY_KEY_IDENTIFIER RT_BIT_32(11)
|
|---|
| 849 | #define RTCRX509TBSCERTIFICATE_F_PRESENT_ACCEPTABLE_CERT_POLICIES RT_BIT_32(12)
|
|---|
| 850 | #define RTCRX509TBSCERTIFICATE_F_PRESENT_INHIBIT_ANY_POLICY RT_BIT_32(13)
|
|---|
| 851 | #define RTCRX509TBSCERTIFICATE_F_PRESENT_OTHER RT_BIT_32(22) /**< Other unknown extension present. */
|
|---|
| 852 | #define RTCRX509TBSCERTIFICATE_F_PRESENT_NONE RT_BIT_32(23) /**< No extensions present. */
|
|---|
| 853 | /** @} */
|
|---|
| 854 |
|
|---|
| 855 | /** @name X.509 Key Usage flags. (RFC-5280 section 4.2.1.3.)
|
|---|
| 856 | * @{ */
|
|---|
| 857 | #define RTCRX509CERT_KEY_USAGE_F_DIGITAL_SIGNATURE_BIT 0
|
|---|
| 858 | #define RTCRX509CERT_KEY_USAGE_F_DIGITAL_SIGNATURE RT_BIT_32(0)
|
|---|
| 859 | #define RTCRX509CERT_KEY_USAGE_F_CONTENT_COMMITTMENT_BIT 1
|
|---|
| 860 | #define RTCRX509CERT_KEY_USAGE_F_CONTENT_COMMITTMENT RT_BIT_32(1)
|
|---|
| 861 | #define RTCRX509CERT_KEY_USAGE_F_KEY_ENCIPHERMENT_BIT 2
|
|---|
| 862 | #define RTCRX509CERT_KEY_USAGE_F_KEY_ENCIPHERMENT RT_BIT_32(2)
|
|---|
| 863 | #define RTCRX509CERT_KEY_USAGE_F_DATA_ENCIPHERMENT_BIT 3
|
|---|
| 864 | #define RTCRX509CERT_KEY_USAGE_F_DATA_ENCIPHERMENT RT_BIT_32(3)
|
|---|
| 865 | #define RTCRX509CERT_KEY_USAGE_F_KEY_AGREEMENT_BIT 4
|
|---|
| 866 | #define RTCRX509CERT_KEY_USAGE_F_KEY_AGREEMENT RT_BIT_32(4)
|
|---|
| 867 | #define RTCRX509CERT_KEY_USAGE_F_KEY_CERT_SIGN_BIT 5
|
|---|
| 868 | #define RTCRX509CERT_KEY_USAGE_F_KEY_CERT_SIGN RT_BIT_32(5)
|
|---|
| 869 | #define RTCRX509CERT_KEY_USAGE_F_CRL_SIGN_BIT 6
|
|---|
| 870 | #define RTCRX509CERT_KEY_USAGE_F_CRL_SIGN RT_BIT_32(6)
|
|---|
| 871 | #define RTCRX509CERT_KEY_USAGE_F_ENCIPHERMENT_ONLY_BIT 7
|
|---|
| 872 | #define RTCRX509CERT_KEY_USAGE_F_ENCIPHERMENT_ONLY RT_BIT_32(7)
|
|---|
| 873 | #define RTCRX509CERT_KEY_USAGE_F_DECIPHERMENT_ONLY_BIT 8
|
|---|
| 874 | #define RTCRX509CERT_KEY_USAGE_F_DECIPHERMENT_ONLY RT_BIT_32(8)
|
|---|
| 875 | /** @} */
|
|---|
| 876 |
|
|---|
| 877 | /** @name X.509 Extended Key Usage flags. (RFC-5280 section 4.2.1.12, ++.)
|
|---|
| 878 | * @remarks Needless to say, these flags doesn't cover all possible extended key
|
|---|
| 879 | * usages, because there is a potential unlimited number of them. Only
|
|---|
| 880 | * ones relevant to IPRT and it's users are covered.
|
|---|
| 881 | * @{ */
|
|---|
| 882 | #define RTCRX509CERT_EKU_F_ANY RT_BIT_64(0)
|
|---|
| 883 | #define RTCRX509CERT_EKU_F_SERVER_AUTH RT_BIT_64(1)
|
|---|
| 884 | #define RTCRX509CERT_EKU_F_CLIENT_AUTH RT_BIT_64(2)
|
|---|
| 885 | #define RTCRX509CERT_EKU_F_CODE_SIGNING RT_BIT_64(3)
|
|---|
| 886 | #define RTCRX509CERT_EKU_F_EMAIL_PROTECTION RT_BIT_64(4)
|
|---|
| 887 | #define RTCRX509CERT_EKU_F_IPSEC_END_SYSTEM RT_BIT_64(5)
|
|---|
| 888 | #define RTCRX509CERT_EKU_F_IPSEC_TUNNEL RT_BIT_64(6)
|
|---|
| 889 | #define RTCRX509CERT_EKU_F_IPSEC_USER RT_BIT_64(7)
|
|---|
| 890 | #define RTCRX509CERT_EKU_F_TIMESTAMPING RT_BIT_64(8)
|
|---|
| 891 | #define RTCRX509CERT_EKU_F_OCSP_SIGNING RT_BIT_64(9)
|
|---|
| 892 | #define RTCRX509CERT_EKU_F_DVCS RT_BIT_64(10)
|
|---|
| 893 | #define RTCRX509CERT_EKU_F_SBGP_CERT_AA_SERVICE_AUTH RT_BIT_64(11)
|
|---|
| 894 | #define RTCRX509CERT_EKU_F_EAP_OVER_PPP RT_BIT_64(12)
|
|---|
| 895 | #define RTCRX509CERT_EKU_F_EAP_OVER_LAN RT_BIT_64(13)
|
|---|
| 896 | #define RTCRX509CERT_EKU_F_OTHER RT_BIT_64(16) /**< Other unknown extended key usage present. */
|
|---|
| 897 | #define RTCRX509CERT_EKU_F_APPLE_CODE_SIGNING RT_BIT_64(24)
|
|---|
| 898 | #define RTCRX509CERT_EKU_F_APPLE_CODE_SIGNING_DEVELOPMENT RT_BIT_64(25)
|
|---|
| 899 | #define RTCRX509CERT_EKU_F_APPLE_SOFTWARE_UPDATE_SIGNING RT_BIT_64(26)
|
|---|
| 900 | #define RTCRX509CERT_EKU_F_APPLE_CODE_SIGNING_THIRD_PARTY RT_BIT_64(27)
|
|---|
| 901 | #define RTCRX509CERT_EKU_F_APPLE_RESOURCE_SIGNING RT_BIT_64(28)
|
|---|
| 902 | #define RTCRX509CERT_EKU_F_APPLE_SYSTEM_IDENTITY RT_BIT_64(29)
|
|---|
| 903 | #define RTCRX509CERT_EKU_F_MS_TIMESTAMP_SIGNING RT_BIT_64(32)
|
|---|
| 904 | #define RTCRX509CERT_EKU_F_MS_NT5_CRYPTO RT_BIT_64(33)
|
|---|
| 905 | #define RTCRX509CERT_EKU_F_MS_OEM_WHQL_CRYPTO RT_BIT_64(34)
|
|---|
| 906 | #define RTCRX509CERT_EKU_F_MS_EMBEDDED_NT_CRYPTO RT_BIT_64(35)
|
|---|
| 907 | #define RTCRX509CERT_EKU_F_MS_KERNEL_MODE_CODE_SIGNING RT_BIT_64(36)
|
|---|
| 908 | #define RTCRX509CERT_EKU_F_MS_LIFETIME_SIGNING RT_BIT_64(37)
|
|---|
| 909 | #define RTCRX509CERT_EKU_F_MS_DRM RT_BIT_64(38)
|
|---|
| 910 | #define RTCRX509CERT_EKU_F_MS_DRM_INDIVIDUALIZATION RT_BIT_64(39)
|
|---|
| 911 | #define RTCRX509CERT_EKU_F_MS_WHQL_CRYPTO RT_BIT_64(40)
|
|---|
| 912 | #define RTCRX509CERT_EKU_F_MS_ATTEST_WHQL_CRYPTO RT_BIT_64(41)
|
|---|
| 913 | /** @} */
|
|---|
| 914 |
|
|---|
| 915 | /** @name Key purpose OIDs (extKeyUsage)
|
|---|
| 916 | * @{ */
|
|---|
| 917 | #define RTCRX509_ANY_EXTENDED_KEY_USAGE_OID "2.5.29.37.0"
|
|---|
| 918 | #define RTCRX509_ID_KP_OID "1.3.6.1.5.5.7.3"
|
|---|
| 919 | #define RTCRX509_ID_KP_SERVER_AUTH_OID "1.3.6.1.5.5.7.3.1"
|
|---|
| 920 | #define RTCRX509_ID_KP_CLIENT_AUTH_OID "1.3.6.1.5.5.7.3.2"
|
|---|
| 921 | #define RTCRX509_ID_KP_CODE_SIGNING_OID "1.3.6.1.5.5.7.3.3"
|
|---|
| 922 | #define RTCRX509_ID_KP_EMAIL_PROTECTION_OID "1.3.6.1.5.5.7.3.4"
|
|---|
| 923 | #define RTCRX509_ID_KP_IPSEC_END_SYSTEM_OID "1.3.6.1.5.5.7.3.5"
|
|---|
| 924 | #define RTCRX509_ID_KP_IPSEC_TUNNEL_OID "1.3.6.1.5.5.7.3.6"
|
|---|
| 925 | #define RTCRX509_ID_KP_IPSEC_USER_OID "1.3.6.1.5.5.7.3.7"
|
|---|
| 926 | #define RTCRX509_ID_KP_TIMESTAMPING_OID "1.3.6.1.5.5.7.3.8"
|
|---|
| 927 | #define RTCRX509_ID_KP_OCSP_SIGNING_OID "1.3.6.1.5.5.7.3.9"
|
|---|
| 928 | #define RTCRX509_ID_KP_DVCS_OID "1.3.6.1.5.5.7.3.10"
|
|---|
| 929 | #define RTCRX509_ID_KP_SBGP_CERT_AA_SERVICE_AUTH_OID "1.3.6.1.5.5.7.3.11"
|
|---|
| 930 | #define RTCRX509_ID_KP_EAP_OVER_PPP_OID "1.3.6.1.5.5.7.3.13"
|
|---|
| 931 | #define RTCRX509_ID_KP_EAP_OVER_LAN_OID "1.3.6.1.5.5.7.3.14"
|
|---|
| 932 | /** @} */
|
|---|
| 933 |
|
|---|
| 934 | /** @name Microsoft extended key usage OIDs
|
|---|
| 935 | * @{ */
|
|---|
| 936 | #define RTCRX509_MS_EKU_CERT_TRUST_LIST_SIGNING_OID "1.3.6.1.4.1.311.10.3.1"
|
|---|
| 937 | #define RTCRX509_MS_EKU_TIMESTAMP_SIGNING_OID "1.3.6.1.4.1.311.10.3.2"
|
|---|
| 938 | #define RTCRX509_MS_EKU_SERVER_GATED_CRYPTO_OID "1.3.6.1.4.1.311.10.3.3"
|
|---|
| 939 | #define RTCRX509_MS_EKU_SGC_SERIALIZED_OID "1.3.6.1.4.1.311.10.3.3.1"
|
|---|
| 940 | #define RTCRX509_MS_EKU_ENCRYPTED_FILE_SYSTEM_OID "1.3.6.1.4.1.311.10.3.4"
|
|---|
| 941 | #define RTCRX509_MS_EKU_WHQL_CRYPTO_OID "1.3.6.1.4.1.311.10.3.5"
|
|---|
| 942 | #define RTCRX509_MS_EKU_ATTEST_WHQL_CRYPTO_OID "1.3.6.1.4.1.311.10.3.5.1"
|
|---|
| 943 | #define RTCRX509_MS_EKU_NT5_CRYPTO_OID "1.3.6.1.4.1.311.10.3.6"
|
|---|
| 944 | #define RTCRX509_MS_EKU_OEM_WHQL_CRYPTO_OID "1.3.6.1.4.1.311.10.3.7"
|
|---|
| 945 | #define RTCRX509_MS_EKU_EMBEDDED_NT_CRYPTO_OID "1.3.6.1.4.1.311.10.3.8"
|
|---|
| 946 | #define RTCRX509_MS_EKU_ROOT_LIST_SIGNER_OID "1.3.6.1.4.1.311.10.3.9"
|
|---|
| 947 | #define RTCRX509_MS_EKU_QUALIFIED_SUBORDINATE_OID "1.3.6.1.4.1.311.10.3.10"
|
|---|
| 948 | #define RTCRX509_MS_EKU_KEY_RECOVERY_3_OID "1.3.6.1.4.1.311.10.3.11"
|
|---|
| 949 | #define RTCRX509_MS_EKU_DOCUMENT_SIGNING_OID "1.3.6.1.4.1.311.10.3.12"
|
|---|
| 950 | #define RTCRX509_MS_EKU_LIFETIME_SIGNING_OID "1.3.6.1.4.1.311.10.3.13"
|
|---|
| 951 | #define RTCRX509_MS_EKU_MOBILE_DEVICE_SOFTWARE_OID "1.3.6.1.4.1.311.10.3.14"
|
|---|
| 952 | #define RTCRX509_MS_EKU_SMART_DISPLAY_OID "1.3.6.1.4.1.311.10.3.15"
|
|---|
| 953 | #define RTCRX509_MS_EKU_CSP_SIGNATURE_OID "1.3.6.1.4.1.311.10.3.16"
|
|---|
| 954 | #define RTCRX509_MS_EKU_EFS_RECOVERY_OID "1.3.6.1.4.1.311.10.3.4.1"
|
|---|
| 955 | #define RTCRX509_MS_EKU_DRM_OID "1.3.6.1.4.1.311.10.5.1"
|
|---|
| 956 | #define RTCRX509_MS_EKU_DRM_INDIVIDUALIZATION_OID "1.3.6.1.4.1.311.10.5.2"
|
|---|
| 957 | #define RTCRX509_MS_EKU_LICENSES_OID "1.3.6.1.4.1.311.10.5.3"
|
|---|
| 958 | #define RTCRX509_MS_EKU_LICENSE_SERVER_OID "1.3.6.1.4.1.311.10.5.4"
|
|---|
| 959 | #define RTCRX509_MS_EKU_ENROLLMENT_AGENT_OID "1.3.6.1.4.1.311.20.2.1"
|
|---|
| 960 | #define RTCRX509_MS_EKU_SMARTCARD_LOGON_OID "1.3.6.1.4.1.311.20.2.2"
|
|---|
| 961 | #define RTCRX509_MS_EKU_CA_EXCHANGE_OID "1.3.6.1.4.1.311.21.5"
|
|---|
| 962 | #define RTCRX509_MS_EKU_KEY_RECOVERY_21_OID "1.3.6.1.4.1.311.21.6"
|
|---|
| 963 | #define RTCRX509_MS_EKU_SYSTEM_HEALTH_OID "1.3.6.1.4.1.311.47.1.1"
|
|---|
| 964 | #define RTCRX509_MS_EKU_SYSTEM_HEALTH_LOOPHOLE_OID "1.3.6.1.4.1.311.47.1.3"
|
|---|
| 965 | #define RTCRX509_MS_EKU_KERNEL_MODE_CODE_SIGNING_OID "1.3.6.1.4.1.311.61.1.1"
|
|---|
| 966 | /** @} */
|
|---|
| 967 |
|
|---|
| 968 | /** @name Apple extended key usage OIDs
|
|---|
| 969 | * @{ */
|
|---|
| 970 | #define RTCRX509_APPLE_EKU_APPLE_EXTENDED_KEY_USAGE_OID "1.2.840.113635.100.4"
|
|---|
| 971 | #define RTCRX509_APPLE_EKU_CODE_SIGNING_OID "1.2.840.113635.100.4.1"
|
|---|
| 972 | #define RTCRX509_APPLE_EKU_CODE_SIGNING_DEVELOPMENT_OID "1.2.840.113635.100.4.1.1"
|
|---|
| 973 | #define RTCRX509_APPLE_EKU_SOFTWARE_UPDATE_SIGNING_OID "1.2.840.113635.100.4.1.2"
|
|---|
| 974 | #define RTCRX509_APPLE_EKU_CODE_SIGNING_THRID_PARTY_OID "1.2.840.113635.100.4.1.3"
|
|---|
| 975 | #define RTCRX509_APPLE_EKU_RESOURCE_SIGNING_OID "1.2.840.113635.100.4.1.4"
|
|---|
| 976 | #define RTCRX509_APPLE_EKU_ICHAT_SIGNING_OID "1.2.840.113635.100.4.2"
|
|---|
| 977 | #define RTCRX509_APPLE_EKU_ICHAT_ENCRYPTION_OID "1.2.840.113635.100.4.3"
|
|---|
| 978 | #define RTCRX509_APPLE_EKU_SYSTEM_IDENTITY_OID "1.2.840.113635.100.4.4"
|
|---|
| 979 | #define RTCRX509_APPLE_EKU_CRYPTO_ENV_OID "1.2.840.113635.100.4.5"
|
|---|
| 980 | #define RTCRX509_APPLE_EKU_CRYPTO_PRODUCTION_ENV_OID "1.2.840.113635.100.4.5.1"
|
|---|
| 981 | #define RTCRX509_APPLE_EKU_CRYPTO_MAINTENANCE_ENV_OID "1.2.840.113635.100.4.5.2"
|
|---|
| 982 | #define RTCRX509_APPLE_EKU_CRYPTO_TEST_ENV_OID "1.2.840.113635.100.4.5.3"
|
|---|
| 983 | #define RTCRX509_APPLE_EKU_CRYPTO_DEVELOPMENT_ENV_OID "1.2.840.113635.100.4.5.4"
|
|---|
| 984 | #define RTCRX509_APPLE_EKU_CRYPTO_QOS_OID "1.2.840.113635.100.4.6"
|
|---|
| 985 | #define RTCRX509_APPLE_EKU_CRYPTO_TIER0_QOS_OID "1.2.840.113635.100.4.6.1"
|
|---|
| 986 | #define RTCRX509_APPLE_EKU_CRYPTO_TIER1_QOS_OID "1.2.840.113635.100.4.6.2"
|
|---|
| 987 | #define RTCRX509_APPLE_EKU_CRYPTO_TIER2_QOS_OID "1.2.840.113635.100.4.6.3"
|
|---|
| 988 | #define RTCRX509_APPLE_EKU_CRYPTO_TIER3_QOS_OID "1.2.840.113635.100.4.6.4"
|
|---|
| 989 | /** @} */
|
|---|
| 990 |
|
|---|
| 991 | /**
|
|---|
| 992 | * Use this to update derived values after changing the certificate
|
|---|
| 993 | * extensions.
|
|---|
| 994 | *
|
|---|
| 995 | * @returns IPRT status code
|
|---|
| 996 | * @param pThis The certificate.
|
|---|
| 997 | * @param pErrInfo Where to return additional error information. Optional.
|
|---|
| 998 | */
|
|---|
| 999 | RTDECL(int) RTCrX509TbsCertificate_ReprocessExtensions(PRTCRX509TBSCERTIFICATE pThis, PRTERRINFO pErrInfo);
|
|---|
| 1000 |
|
|---|
| 1001 |
|
|---|
| 1002 | /**
|
|---|
| 1003 | * One X.509 Certificate (IPRT representation).
|
|---|
| 1004 | */
|
|---|
| 1005 | typedef struct RTCRX509CERTIFICATE
|
|---|
| 1006 | {
|
|---|
| 1007 | /** Sequence core. */
|
|---|
| 1008 | RTASN1SEQUENCECORE SeqCore;
|
|---|
| 1009 | /** The to-be-signed certificate information. */
|
|---|
| 1010 | RTCRX509TBSCERTIFICATE TbsCertificate;
|
|---|
| 1011 | /** The signature algorithm (must match TbsCertificate.Signature). */
|
|---|
| 1012 | RTCRX509ALGORITHMIDENTIFIER SignatureAlgorithm;
|
|---|
| 1013 | /** The signature value. */
|
|---|
| 1014 | RTASN1BITSTRING SignatureValue;
|
|---|
| 1015 | } RTCRX509CERTIFICATE;
|
|---|
| 1016 | /** Pointer to the IPRT representation of one X.509 certificate. */
|
|---|
| 1017 | typedef RTCRX509CERTIFICATE *PRTCRX509CERTIFICATE;
|
|---|
| 1018 | /** Pointer to the const IPRT representation of one X.509 certificate. */
|
|---|
| 1019 | typedef RTCRX509CERTIFICATE const *PCRTCRX509CERTIFICATE;
|
|---|
| 1020 | RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509CERTIFICATE, RTDECL, RTCrX509Certificate, SeqCore.Asn1Core);
|
|---|
| 1021 |
|
|---|
| 1022 | /**
|
|---|
| 1023 | * Checks if a certificate matches a given issuer name and serial number.
|
|---|
| 1024 | *
|
|---|
| 1025 | * @returns True / false.
|
|---|
| 1026 | * @param pCertificate The X.509 certificat.
|
|---|
| 1027 | * @param pIssuer The issuer name to match against.
|
|---|
| 1028 | * @param pSerialNumber The serial number to match against.
|
|---|
| 1029 | */
|
|---|
| 1030 | RTDECL(bool) RTCrX509Certificate_MatchIssuerAndSerialNumber(PCRTCRX509CERTIFICATE pCertificate,
|
|---|
| 1031 | PCRTCRX509NAME pIssuer, PCRTASN1INTEGER pSerialNumber);
|
|---|
| 1032 |
|
|---|
| 1033 | RTDECL(bool) RTCrX509Certificate_MatchSubjectOrAltSubjectByRfc5280(PCRTCRX509CERTIFICATE pThis, PCRTCRX509NAME pName);
|
|---|
| 1034 | RTDECL(bool) RTCrX509Certificate_IsSelfSigned(PCRTCRX509CERTIFICATE pCertificate);
|
|---|
| 1035 |
|
|---|
| 1036 | RTDECL(int) RTCrX509Certificate_VerifySignature(PCRTCRX509CERTIFICATE pThis, PCRTASN1OBJID pAlgorithm,
|
|---|
| 1037 | PCRTASN1DYNTYPE pParameters, PCRTASN1BITSTRING pPublicKey,
|
|---|
| 1038 | PRTERRINFO pErrInfo);
|
|---|
| 1039 | RTDECL(int) RTCrX509Certificate_VerifySignatureSelfSigned(PCRTCRX509CERTIFICATE pThis, PRTERRINFO pErrInfo);
|
|---|
| 1040 | RTDECL(int) RTCrX509Certificate_ReadFromFile(PRTCRX509CERTIFICATE pCertificate, const char *pszFilename, uint32_t fFlags,
|
|---|
| 1041 | PCRTASN1ALLOCATORVTABLE pAllocator, PRTERRINFO pErrInfo);
|
|---|
| 1042 | RTDECL(int) RTCrX509Certificate_ReadFromBuffer(PRTCRX509CERTIFICATE pCertificate, const void *pvBuf, size_t cbBuf,
|
|---|
| 1043 | uint32_t fFlags, PCRTASN1ALLOCATORVTABLE pAllocator,
|
|---|
| 1044 | PRTERRINFO pErrInfo, const char *pszErrorTag);
|
|---|
| 1045 | /** @name Flags for RTCrX509Certificate_ReadFromFile and
|
|---|
| 1046 | * RTCrX509Certificate_ReadFromBuffer
|
|---|
| 1047 | * @{ */
|
|---|
| 1048 | /** Only allow PEM certificates, not binary ones.
|
|---|
| 1049 | * @sa RTCRPEMREADFILE_F_ONLY_PEM */
|
|---|
| 1050 | #define RTCRX509CERT_READ_F_PEM_ONLY RT_BIT(1)
|
|---|
| 1051 | /** @} */
|
|---|
| 1052 |
|
|---|
| 1053 | /** X509 Certificate markers for RTCrPemFindFirstSectionInContent et al. */
|
|---|
| 1054 | extern RTDATADECL(RTCRPEMMARKER const) g_aRTCrX509CertificateMarkers[];
|
|---|
| 1055 | /** Number of entries in g_aRTCrX509CertificateMarkers. */
|
|---|
| 1056 | extern RTDATADECL(uint32_t const) g_cRTCrX509CertificateMarkers;
|
|---|
| 1057 |
|
|---|
| 1058 |
|
|---|
| 1059 | /** Wrapper around RTCrPemWriteAsn1ToVfsIoStrm(). */
|
|---|
| 1060 | DECLINLINE(ssize_t) RTCrX509Certificate_WriteToVfsIoStrm(RTVFSIOSTREAM hVfsIos, PRTCRX509CERTIFICATE pCertificate,
|
|---|
| 1061 | PRTERRINFO pErrInfo)
|
|---|
| 1062 | {
|
|---|
| 1063 | return RTCrPemWriteAsn1ToVfsIoStrm(hVfsIos, &pCertificate->SeqCore.Asn1Core, 0 /*fFlags*/,
|
|---|
| 1064 | g_aRTCrX509CertificateMarkers[0].paWords[0].pszWord, pErrInfo);
|
|---|
| 1065 | }
|
|---|
| 1066 |
|
|---|
| 1067 | /** Wrapper around RTCrPemWriteAsn1ToVfsFile(). */
|
|---|
| 1068 | DECLINLINE(ssize_t) RTCrX509Certificate_WriteToVfsFile(RTVFSFILE hVfsFile, PRTCRX509CERTIFICATE pCertificate,
|
|---|
| 1069 | PRTERRINFO pErrInfo)
|
|---|
| 1070 | {
|
|---|
| 1071 | return RTCrPemWriteAsn1ToVfsFile(hVfsFile, &pCertificate->SeqCore.Asn1Core, 0 /*fFlags*/,
|
|---|
| 1072 | g_aRTCrX509CertificateMarkers[0].paWords[0].pszWord, pErrInfo);
|
|---|
| 1073 | }
|
|---|
| 1074 |
|
|---|
| 1075 | /** @name X.509 Certificate Extensions
|
|---|
| 1076 | * @{ */
|
|---|
| 1077 | /** Old AuthorityKeyIdentifier OID. */
|
|---|
| 1078 | #define RTCRX509_ID_CE_OLD_AUTHORITY_KEY_IDENTIFIER_OID "2.5.29.1"
|
|---|
| 1079 | /** Old CertificatePolicies extension OID. */
|
|---|
| 1080 | #define RTCRX509_ID_CE_OLD_CERTIFICATE_POLICIES_OID "2.5.29.3"
|
|---|
| 1081 | /** Old SubjectAltName extension OID. */
|
|---|
| 1082 | #define RTCRX509_ID_CE_OLD_SUBJECT_ALT_NAME_OID "2.5.29.7"
|
|---|
| 1083 | /** Old IssuerAltName extension OID. */
|
|---|
| 1084 | #define RTCRX509_ID_CE_OLD_ISSUER_ALT_NAME_OID "2.5.29.8"
|
|---|
| 1085 | /** Old BasicContraints extension OID. */
|
|---|
| 1086 | #define RTCRX509_ID_CE_OLD_BASIC_CONSTRAINTS_OID "2.5.29.10"
|
|---|
| 1087 | /** SubjectKeyIdentifier OID. */
|
|---|
| 1088 | #define RTCRX509_ID_CE_SUBJECT_KEY_IDENTIFIER_OID "2.5.29.14"
|
|---|
| 1089 | /** KeyUsage OID. */
|
|---|
| 1090 | #define RTCRX509_ID_CE_KEY_USAGE_OID "2.5.29.15"
|
|---|
| 1091 | /** PrivateKeyUsagePeriod OID. */
|
|---|
| 1092 | #define RTCRX509_ID_CE_PRIVATE_KEY_USAGE_PERIOD_OID "2.5.29.16"
|
|---|
| 1093 | /** SubjectAltName extension OID. */
|
|---|
| 1094 | #define RTCRX509_ID_CE_SUBJECT_ALT_NAME_OID "2.5.29.17"
|
|---|
| 1095 | /** IssuerAltName extension OID. */
|
|---|
| 1096 | #define RTCRX509_ID_CE_ISSUER_ALT_NAME_OID "2.5.29.18"
|
|---|
| 1097 | /** BasicContraints extension OID. */
|
|---|
| 1098 | #define RTCRX509_ID_CE_BASIC_CONSTRAINTS_OID "2.5.29.19"
|
|---|
| 1099 | /** NameContraints extension OID. */
|
|---|
| 1100 | #define RTCRX509_ID_CE_NAME_CONSTRAINTS_OID "2.5.29.30"
|
|---|
| 1101 | /** CertificatePolicies extension OID. */
|
|---|
| 1102 | #define RTCRX509_ID_CE_CERTIFICATE_POLICIES_OID "2.5.29.32"
|
|---|
| 1103 | /** PolicyMappings extension OID. */
|
|---|
| 1104 | #define RTCRX509_ID_CE_POLICY_MAPPINGS_OID "2.5.29.33"
|
|---|
| 1105 | /** AuthorityKeyIdentifier OID. */
|
|---|
| 1106 | #define RTCRX509_ID_CE_AUTHORITY_KEY_IDENTIFIER_OID "2.5.29.35"
|
|---|
| 1107 | /** PolicyContraints extension OID. */
|
|---|
| 1108 | #define RTCRX509_ID_CE_POLICY_CONSTRAINTS_OID "2.5.29.36"
|
|---|
| 1109 | /** ExtKeyUsage (extended key usage) extension OID. */
|
|---|
| 1110 | #define RTCRX509_ID_CE_EXT_KEY_USAGE_OID "2.5.29.37"
|
|---|
| 1111 | /** ExtKeyUsage: OID for permitting any unspecified key usage. */
|
|---|
| 1112 | #define RTCRX509_ID_CE_ANY_EXTENDED_KEY_USAGE_OID "2.5.29.37.0"
|
|---|
| 1113 | /** AuthorityAttributeIdentifier OID. */
|
|---|
| 1114 | #define RTCRX509_ID_CE_AUTHORITY_ATTRIBUTE_IDENTIFIER_OID "2.5.29.38"
|
|---|
| 1115 | /** AcceptableCertPolicies OID. */
|
|---|
| 1116 | #define RTCRX509_ID_CE_ACCEPTABLE_CERT_POLICIES_OID "2.5.29.52"
|
|---|
| 1117 | /** InhibitAnyPolicy OID. */
|
|---|
| 1118 | #define RTCRX509_ID_CE_INHIBIT_ANY_POLICY_OID "2.5.29.54"
|
|---|
| 1119 | /** @} */
|
|---|
| 1120 |
|
|---|
| 1121 |
|
|---|
| 1122 | /*
|
|---|
| 1123 | * Sequence of X.509 Certifcates (IPRT representation).
|
|---|
| 1124 | */
|
|---|
| 1125 | RTASN1_IMPL_GEN_SET_OF_TYPEDEFS_AND_PROTOS(RTCRX509CERTIFICATES, RTCRX509CERTIFICATE, RTDECL, RTCrX509Certificates);
|
|---|
| 1126 |
|
|---|
| 1127 | /**
|
|---|
| 1128 | * Looks up a certificate by issuer name and serial number.
|
|---|
| 1129 | *
|
|---|
| 1130 | * @returns Pointer to the given certificate if found, NULL if not.
|
|---|
| 1131 | * @param pCertificates The X.509 certificate set to search.
|
|---|
| 1132 | * @param pIssuer The issuer name of the wanted certificate.
|
|---|
| 1133 | * @param pSerialNumber The serial number of the wanted certificate.
|
|---|
| 1134 | */
|
|---|
| 1135 | RTDECL(PCRTCRX509CERTIFICATE) RTCrX509Certificates_FindByIssuerAndSerialNumber(PCRTCRX509CERTIFICATES pCertificates,
|
|---|
| 1136 | PCRTCRX509NAME pIssuer,
|
|---|
| 1137 | PCRTASN1INTEGER pSerialNumber);
|
|---|
| 1138 |
|
|---|
| 1139 |
|
|---|
| 1140 |
|
|---|
| 1141 | RTDECL(int) RTCrX509CertPathsCreate(PRTCRX509CERTPATHS phCertPaths, PCRTCRX509CERTIFICATE pTarget);
|
|---|
| 1142 | RTDECL(uint32_t) RTCrX509CertPathsRetain(RTCRX509CERTPATHS hCertPaths);
|
|---|
| 1143 | RTDECL(uint32_t) RTCrX509CertPathsRelease(RTCRX509CERTPATHS hCertPaths);
|
|---|
| 1144 | RTDECL(int) RTCrX509CertPathsSetTrustedStore(RTCRX509CERTPATHS hCertPaths, RTCRSTORE hTrustedStore);
|
|---|
| 1145 | RTDECL(int) RTCrX509CertPathsSetUntrustedStore(RTCRX509CERTPATHS hCertPaths, RTCRSTORE hUntrustedStore);
|
|---|
| 1146 | RTDECL(int) RTCrX509CertPathsSetUntrustedArray(RTCRX509CERTPATHS hCertPaths, PCRTCRX509CERTIFICATE paCerts, uint32_t cCerts);
|
|---|
| 1147 | RTDECL(int) RTCrX509CertPathsSetUntrustedSet(RTCRX509CERTPATHS hCertPaths, struct RTCRPKCS7SETOFCERTS const *pSetOfCerts);
|
|---|
| 1148 | RTDECL(int) RTCrX509CertPathsSetValidTime(RTCRX509CERTPATHS hCertPaths, PCRTTIME pTime);
|
|---|
| 1149 | RTDECL(int) RTCrX509CertPathsSetValidTimeSpec(RTCRX509CERTPATHS hCertPaths, PCRTTIMESPEC pTimeSpec);
|
|---|
| 1150 | RTDECL(int) RTCrX509CertPathsSetTrustAnchorChecks(RTCRX509CERTPATHS hCertPaths, bool fEnable);
|
|---|
| 1151 | RTDECL(int) RTCrX509CertPathsCreateEx(PRTCRX509CERTPATHS phCertPaths, PCRTCRX509CERTIFICATE pTarget, RTCRSTORE hTrustedStore,
|
|---|
| 1152 | RTCRSTORE hUntrustedStore, PCRTCRX509CERTIFICATE paUntrustedCerts, uint32_t cUntrustedCerts,
|
|---|
| 1153 | PCRTTIMESPEC pValidTime);
|
|---|
| 1154 | RTDECL(int) RTCrX509CertPathsBuild(RTCRX509CERTPATHS hCertPaths, PRTERRINFO pErrInfo);
|
|---|
| 1155 | RTDECL(int) RTCrX509CertPathsDumpOne(RTCRX509CERTPATHS hCertPaths, uint32_t iPath, uint32_t uVerbosity,
|
|---|
| 1156 | PFNRTDUMPPRINTFV pfnPrintfV, void *pvUser);
|
|---|
| 1157 | RTDECL(int) RTCrX509CertPathsDumpAll(RTCRX509CERTPATHS hCertPaths, uint32_t uVerbosity,
|
|---|
| 1158 | PFNRTDUMPPRINTFV pfnPrintfV, void *pvUser);
|
|---|
| 1159 |
|
|---|
| 1160 | RTDECL(int) RTCrX509CertPathsValidateOne(RTCRX509CERTPATHS hCertPaths, uint32_t iPath, PRTERRINFO pErrInfo);
|
|---|
| 1161 | RTDECL(int) RTCrX509CertPathsValidateAll(RTCRX509CERTPATHS hCertPaths, uint32_t *pcValidPaths, PRTERRINFO pErrInfo);
|
|---|
| 1162 |
|
|---|
| 1163 | RTDECL(uint32_t) RTCrX509CertPathsGetPathCount(RTCRX509CERTPATHS hCertPaths);
|
|---|
| 1164 | RTDECL(int) RTCrX509CertPathsQueryPathInfo(RTCRX509CERTPATHS hCertPaths, uint32_t iPath,
|
|---|
| 1165 | bool *pfTrusted, uint32_t *pcNodes, PCRTCRX509NAME *ppSubject,
|
|---|
| 1166 | PCRTCRX509SUBJECTPUBLICKEYINFO *ppPublicKeyInfo,
|
|---|
| 1167 | PCRTCRX509CERTIFICATE *ppCert, PCRTCRCERTCTX *ppCertCtx, int *prcVerify);
|
|---|
| 1168 | RTDECL(uint32_t) RTCrX509CertPathsGetPathLength(RTCRX509CERTPATHS hCertPaths, uint32_t iPath);
|
|---|
| 1169 | RTDECL(int) RTCrX509CertPathsGetPathVerifyResult(RTCRX509CERTPATHS hCertPaths, uint32_t iPath);
|
|---|
| 1170 | RTDECL(PCRTCRX509CERTIFICATE) RTCrX509CertPathsGetPathNodeCert(RTCRX509CERTPATHS hCertPaths, uint32_t iPath, uint32_t iNode);
|
|---|
| 1171 |
|
|---|
| 1172 |
|
|---|
| 1173 | RT_C_DECLS_END
|
|---|
| 1174 |
|
|---|
| 1175 | /** @} */
|
|---|
| 1176 |
|
|---|
| 1177 | /** @} */
|
|---|
| 1178 |
|
|---|
| 1179 | #endif /* !IPRT_INCLUDED_crypto_x509_h */
|
|---|
| 1180 |
|
|---|
