x509.h@ 57250

Last change on this file since 57250 was 56291, checked in by vboxsync, 10 years ago
include: Updated (C) year.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 50.9 KB

Line
1	/** @file
2	* IPRT - Crypto - X.509, Public Key and Privilege Management Infrastructure.
3	*/
4
5	/*
6	* Copyright (C) 2014-2015 Oracle Corporation
7	*
8	* This file is part of VirtualBox Open Source Edition (OSE), as
9	* available from http://www.virtualbox.org. This file is free software;
10	* you can redistribute it and/or modify it under the terms of the GNU
11	* General Public License (GPL) as published by the Free Software
12	* Foundation, in version 2 as it comes in the "COPYING" file of the
13	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
14	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
15	*
16	* The contents of this file may alternatively be used under the terms
17	* of the Common Development and Distribution License Version 1.0
18	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
19	* VirtualBox OSE distribution, in which case the provisions of the
20	* CDDL are applicable instead of those of the GPL.
21	*
22	* You may elect to license modified versions of this file under the
23	* terms and conditions of either the GPL or the CDDL or both.
24	*/
25
26	#ifndef ___iprt_crypto_x509_h
27	#define ___iprt_crypto_x509_h
28
29	#include <iprt/asn1.h>
30
31
32	RT_C_DECLS_BEGIN
33
34
35	/** @defgroup grp_rt_crypto Crypto
36	* @ingroup grp_rt
37	* @{
38	*/
39
40	/** @defgroup grp_rt_crx509 RTCrX509 - Public Key and Privilege Management Infrastructure.
41	* @{
42	*/
43
44	/**
45	* X.509 algorithm identifier (IPRT representation).
46	*/
47	typedef struct RTCRX509ALGORITHMIDENTIFIER
48	{
49	/** The sequence making up this algorithm identifier. */
50	RTASN1SEQUENCECORE SeqCore;
51	/** The algorithm object ID. */
52	RTASN1OBJID Algorithm;
53	/** Optional parameters specified by the algorithm. */
54	RTASN1DYNTYPE Parameters;
55	} RTCRX509ALGORITHMIDENTIFIER;
56	/** Poitner to the IPRT representation of a X.509 algorithm identifier. */
57	typedef RTCRX509ALGORITHMIDENTIFIER *PRTCRX509ALGORITHMIDENTIFIER;
58	/** Poitner to the const IPRT representation of a X.509 algorithm identifier. */
59	typedef RTCRX509ALGORITHMIDENTIFIER const *PCRTCRX509ALGORITHMIDENTIFIER;
60	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509ALGORITHMIDENTIFIER, RTDECL, RTCrX509AlgorithmIdentifier, SeqCore.Asn1Core);
61	RTASN1_IMPL_GEN_SET_OF_TYPEDEFS_AND_PROTOS(RTCRX509ALGORITHMIDENTIFIERS, RTCRX509ALGORITHMIDENTIFIER, RTDECL, RTCrX509AlgorithmIdentifiers);
62
63	/**
64	* Tries to convert an X.509 digest algorithm ID into a RTDIGESTTYPE value.
65	*
66	* @returns Valid RTDIGESTTYPE on success, RTDIGESTTYPE_INVALID on failure.
67	* @param pThis The IPRT representation of a X.509 algorithm
68	* identifier object.
69	*/
70	RTDECL(RTDIGESTTYPE) RTCrX509AlgorithmIdentifier_QueryDigestType(PCRTCRX509ALGORITHMIDENTIFIER pThis);
71
72	/**
73	* Tries to figure the digest size of an X.509 digest algorithm ID.
74	*
75	* @returns The digest size in bytes, UINT32_MAX if unknown digest.
76	* @param pThis The IPRT representation of a X.509 algorithm
77	* identifier object.
78	*/
79	RTDECL(uint32_t) RTCrX509AlgorithmIdentifier_QueryDigestSize(PCRTCRX509ALGORITHMIDENTIFIER pThis);
80
81	RTDECL(int) RTCrX509AlgorithmIdentifier_CompareWithString(PCRTCRX509ALGORITHMIDENTIFIER pThis, const char *pszObjId);
82
83	/**
84	* Compares a digest with an encrypted digest algorithm, checking if they
85	* specify the same digest.
86	*
87	* @returns 0 if same digest, -1 if the digest is unknown, 1 if the encrypted
88	* digest does not match.
89	* @param pDigest The digest algorithm.
90	* @param pEncryptedDigest The encrypted digest algorithm.
91	*/
92	RTDECL(int) RTCrX509AlgorithmIdentifier_CompareDigestAndEncryptedDigest(PCRTCRX509ALGORITHMIDENTIFIER pDigest,
93	PCRTCRX509ALGORITHMIDENTIFIER pEncryptedDigest);
94
95	/** @name Typical Digest Algorithm OIDs.
96	* @{ */
97	#define RTCRX509ALGORITHMIDENTIFIERID_MD2 "1.2.840.113549.2.2"
98	#define RTCRX509ALGORITHMIDENTIFIERID_MD4 "1.2.840.113549.2.4"
99	#define RTCRX509ALGORITHMIDENTIFIERID_MD5 "1.2.840.113549.2.5"
100	#define RTCRX509ALGORITHMIDENTIFIERID_SHA1 "1.3.14.3.2.26"
101	#define RTCRX509ALGORITHMIDENTIFIERID_SHA256 "2.16.840.1.101.3.4.2.1"
102	#define RTCRX509ALGORITHMIDENTIFIERID_SHA384 "2.16.840.1.101.3.4.2.2"
103	#define RTCRX509ALGORITHMIDENTIFIERID_SHA512 "2.16.840.1.101.3.4.2.3"
104	#define RTCRX509ALGORITHMIDENTIFIERID_SHA224 "2.16.840.1.101.3.4.2.4"
105	#define RTCRX509ALGORITHMIDENTIFIERID_SHA512T224 "2.16.840.1.101.3.4.2.5"
106	#define RTCRX509ALGORITHMIDENTIFIERID_SHA512T256 "2.16.840.1.101.3.4.2.6"
107	#define RTCRX509ALGORITHMIDENTIFIERID_WHIRLPOOL "1.0.10118.3.0.55"
108	/** @} */
109
110	/** @name Encrypted Digest Algorithm OIDs.
111	* @remarks The PKCS variants are the default ones, alternative OID are marked
112	* as such.
113	* @{ */
114	#define RTCRX509ALGORITHMIDENTIFIERID_RSA "1.2.840.113549.1.1.1"
115	#define RTCRX509ALGORITHMIDENTIFIERID_MD2_WITH_RSA "1.2.840.113549.1.1.2"
116	#define RTCRX509ALGORITHMIDENTIFIERID_MD4_WITH_RSA "1.2.840.113549.1.1.3"
117	#define RTCRX509ALGORITHMIDENTIFIERID_MD5_WITH_RSA "1.2.840.113549.1.1.4"
118	#define RTCRX509ALGORITHMIDENTIFIERID_SHA1_WITH_RSA "1.2.840.113549.1.1.5"
119	#define RTCRX509ALGORITHMIDENTIFIERID_SHA256_WITH_RSA "1.2.840.113549.1.1.11"
120	#define RTCRX509ALGORITHMIDENTIFIERID_SHA384_WITH_RSA "1.2.840.113549.1.1.12"
121	#define RTCRX509ALGORITHMIDENTIFIERID_SHA512_WITH_RSA "1.2.840.113549.1.1.13"
122	#define RTCRX509ALGORITHMIDENTIFIERID_SHA224_WITH_RSA "1.2.840.113549.1.1.14"
123	/** @} */
124
125
126
127
128	/**
129	* One X.509 AttributeTypeAndValue (IPRT representation).
130	*/
131	typedef struct RTCRX509ATTRIBUTETYPEANDVALUE
132	{
133	/** Sequence core. */
134	RTASN1SEQUENCECORE SeqCore;
135	/** The attribute type (object ID). */
136	RTASN1OBJID Type;
137	/** The attribute value (what it is is defined by Type). */
138	RTASN1DYNTYPE Value;
139	} RTCRX509ATTRIBUTETYPEANDVALUE;
140	/** Pointer to a X.509 AttributeTypeAndValue (IPRT representation). */
141	typedef RTCRX509ATTRIBUTETYPEANDVALUE *PRTCRX509ATTRIBUTETYPEANDVALUE;
142	/** Pointer to a const X.509 AttributeTypeAndValue (IPRT representation). */
143	typedef RTCRX509ATTRIBUTETYPEANDVALUE const *PCRTCRX509ATTRIBUTETYPEANDVALUE;
144	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509ATTRIBUTETYPEANDVALUE, RTDECL, RTCrX509AttributeTypeAndValue, SeqCore.Asn1Core);
145	RTASN1_IMPL_GEN_SET_OF_TYPEDEFS_AND_PROTOS(RTCRX509ATTRIBUTETYPEANDVALUES, RTCRX509ATTRIBUTETYPEANDVALUE, RTDECL, RTCrX509AttributeTypeAndValues);
146
147	RTASN1TYPE_ALIAS(RTCRX509RELATIVEDISTINGUISHEDNAME, RTCRX509ATTRIBUTETYPEANDVALUES, RTCrX509RelativeDistinguishedName, RTCrX509AttributeTypeAndValues);
148
149
150	RTASN1_IMPL_GEN_SEQ_OF_TYPEDEFS_AND_PROTOS(RTCRX509NAME, RTCRX509RELATIVEDISTINGUISHEDNAME, RTDECL, RTCrX509Name);
151	RTDECL(int) RTCrX509Name_CheckSanity(PCRTCRX509NAME pName, uint32_t fFlags, PRTERRINFO pErrInfo, const char *pszErrorTag);
152	RTDECL(bool) RTCrX509Name_MatchByRfc5280(PCRTCRX509NAME pLeft, PCRTCRX509NAME pRight);
153
154	/**
155	* Name constraint matching (RFC-5280).
156	*
157	* @returns true on match, false on mismatch.
158	* @param pConstraint The constraint name.
159	* @param pName The name to match against the constraint.
160	* @sa RTCrX509GeneralName_ConstraintMatch,
161	* RTCrX509RelativeDistinguishedName_ConstraintMatch
162	*/
163	RTDECL(bool) RTCrX509Name_ConstraintMatch(PCRTCRX509NAME pConstraint, PCRTCRX509NAME pName);
164	RTDECL(int) RTCrX509Name_RecodeAsUtf8(PRTCRX509NAME pThis, PCRTASN1ALLOCATORVTABLE pAllocator);
165
166	/**
167	* Matches the directory name against a comma separated list of the comonent
168	* strings (case sensitive).
169	*
170	* @returns true if match, false if mismatch.
171	* @param pThis The name object.
172	* @param pszString The string to match against. For example:
173	* "C=US, ST=California, L=Redwood Shores, O=Oracle Corporation"
174	*
175	* @remarks This is doing a straight compare, no extra effort is expended in
176	* dealing with different component order. If the component order
177	* differs, there won't be any match.
178	*/
179	RTDECL(bool) RTCrX509Name_MatchWithString(PCRTCRX509NAME pThis, const char *pszString);
180
181	/**
182	* Formats the name as a command separated list of components with type
183	* prefixes.
184	*
185	* The output of this function is suitable for use with
186	* RTCrX509Name_MatchWithString.
187	*
188	* @returns IPRT status code.
189	* @param pThis The name object.
190	* @param pszBuf The output buffer.
191	* @param cbBuf The size of the output buffer.
192	* @param pcbActual Where to return the number of bytes required for the
193	* output, including the null terminator character.
194	* Optional.
195	*/
196	RTDECL(int) RTCrX509Name_FormatAsString(PCRTCRX509NAME pThis, char pszBuf, size_t cbBuf, size_t pcbActual);
197
198
199	/**
200	* One X.509 OtherName (IPRT representation).
201	*/
202	typedef struct RTCRX509OTHERNAME
203	{
204	/** The sequence core. */
205	RTASN1SEQUENCECORE SeqCore;
206	/** The name type identifier. */
207	RTASN1OBJID TypeId;
208	/** The name value (explicit tag 0). */
209	RTASN1DYNTYPE Value;
210	} RTCRX509OTHERNAME;
211	/** Pointer to a X.509 OtherName (IPRT representation). */
212	typedef RTCRX509OTHERNAME *PRTCRX509OTHERNAME;
213	/** Pointer to a const X.509 OtherName (IPRT representation). */
214	typedef RTCRX509OTHERNAME const *PCRTCRX509OTHERNAME;
215	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509OTHERNAME, RTDECL, RTCrX509OtherName, SeqCore.Asn1Core);
216
217
218	typedef enum RTCRX509GENERALNAMECHOICE
219	{
220	RTCRX509GENERALNAMECHOICE_INVALID = 0,
221	RTCRX509GENERALNAMECHOICE_OTHER_NAME,
222	RTCRX509GENERALNAMECHOICE_RFC822_NAME,
223	RTCRX509GENERALNAMECHOICE_DNS_NAME,
224	RTCRX509GENERALNAMECHOICE_X400_ADDRESS,
225	RTCRX509GENERALNAMECHOICE_DIRECTORY_NAME,
226	RTCRX509GENERALNAMECHOICE_EDI_PARTY_NAME,
227	RTCRX509GENERALNAMECHOICE_URI,
228	RTCRX509GENERALNAMECHOICE_IP_ADDRESS,
229	RTCRX509GENERALNAMECHOICE_REGISTERED_ID,
230	RTCRX509GENERALNAMECHOICE_END,
231	RTCRX509GENERALNAMECHOICE_32BIT_HACK = 0x7fffffff
232	} RTCRX509GENERALNAMECHOICE;
233
234	/**
235	* One X.509 GeneralName (IPRT representation).
236	*
237	* This is represented as a union. Use the RTCRX509GENERALNAME_IS_XXX predicate
238	* macros to figure out which member is valid (Asn1Core is always valid).
239	*/
240	typedef struct RTCRX509GENERALNAME
241	{
242	/** Dummy ASN.1 record, not encoded. */
243	RTASN1DUMMY Dummy;
244	/** The value allocation. */
245	RTASN1ALLOCATION Allocation;
246	/** The choice of value. */
247	RTCRX509GENERALNAMECHOICE enmChoice;
248	/** The value union. */
249	union
250	{
251	/** Tag 0: Other Name. */
252	PRTCRX509OTHERNAME pT0_OtherName;
253	/** Tag 1: RFC-822 Name. */
254	PRTASN1STRING pT1_Rfc822;
255	/** Tag 2: DNS name. */
256	PRTASN1STRING pT2_DnsName;
257	/** Tag 3: X.400 Address. */
258	struct
259	{
260	/** Context tag 3. */
261	RTASN1CONTEXTTAG3 CtxTag3;
262	/** Later. */
263	RTASN1DYNTYPE X400Address;
264	} *pT3;
265	/** Tag 4: Directory Name. */
266	struct
267	{
268	/** Context tag 4. */
269	RTASN1CONTEXTTAG4 CtxTag4;
270	/** Directory name. */
271	RTCRX509NAME DirectoryName;
272	} *pT4;
273	/** Tag 5: EDI Party Name. */
274	struct
275	{
276	/** Context tag 5. */
277	RTASN1CONTEXTTAG5 CtxTag5;
278	/** Later. */
279	RTASN1DYNTYPE EdiPartyName;
280	} *pT5;
281	/** Tag 6: URI. */
282	PRTASN1STRING pT6_Uri;
283	/** Tag 7: IP address. Either 4/8 (IPv4) or 16/32 (IPv16) octets long. */
284	PRTASN1OCTETSTRING pT7_IpAddress;
285	/** Tag 8: Registered ID. */
286	PRTASN1OBJID pT8_RegisteredId;
287	} u;
288	} RTCRX509GENERALNAME;
289	/** Pointer to the IPRT representation of an X.509 general name. */
290	typedef RTCRX509GENERALNAME *PRTCRX509GENERALNAME;
291	/** Pointer to the const IPRT representation of an X.509 general name. */
292	typedef RTCRX509GENERALNAME const *PCRTCRX509GENERALNAME;
293	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509GENERALNAME, RTDECL, RTCrX509GeneralName, Dummy.Asn1Core);
294
295	/** @name RTCRX509GENERALNAME tag predicates.
296	* @{ */
297	#define RTCRX509GENERALNAME_IS_OTHER_NAME(a_GenName) ((a_GenName)->enmChoice == RTCRX509GENERALNAMECHOICE_OTHER_NAME)
298	#define RTCRX509GENERALNAME_IS_RFC822_NAME(a_GenName) ((a_GenName)->enmChoice == RTCRX509GENERALNAMECHOICE_RFC822_NAME)
299	#define RTCRX509GENERALNAME_IS_DNS_NAME(a_GenName) ((a_GenName)->enmChoice == RTCRX509GENERALNAMECHOICE_DNS_NAME)
300	#define RTCRX509GENERALNAME_IS_X400_ADDRESS(a_GenName) ((a_GenName)->enmChoice == RTCRX509GENERALNAMECHOICE_X400_ADDRESS)
301	#define RTCRX509GENERALNAME_IS_DIRECTORY_NAME(a_GenName) ((a_GenName)->enmChoice == RTCRX509GENERALNAMECHOICE_DIRECTORY_NAME)
302	#define RTCRX509GENERALNAME_IS_EDI_PARTY_NAME(a_GenName) ((a_GenName)->enmChoice == RTCRX509GENERALNAMECHOICE_EDI_PARTY_NAME)
303	#define RTCRX509GENERALNAME_IS_URI(a_GenName) ((a_GenName)->enmChoice == RTCRX509GENERALNAMECHOICE_URI)
304	#define RTCRX509GENERALNAME_IS_IP_ADDRESS(a_GenName) ((a_GenName)->enmChoice == RTCRX509GENERALNAMECHOICE_IP_ADDRESS)
305	#define RTCRX509GENERALNAME_IS_REGISTERED_ID(a_GenName) ((a_GenName)->enmChoice == RTCRX509GENERALNAMECHOICE_REGISTERED_ID)
306	/** @} */
307
308
309	RTASN1_IMPL_GEN_SEQ_OF_TYPEDEFS_AND_PROTOS(RTCRX509GENERALNAMES, RTCRX509GENERALNAME, RTDECL, RTCrX509GeneralNames);
310	RTDECL(bool) RTCrX509GeneralName_ConstraintMatch(PCRTCRX509GENERALNAME pConstraint, PCRTCRX509GENERALNAME pName);
311
312
313	/**
314	* X.509 Validity (IPRT representation).
315	*/
316	typedef struct RTCRX509VALIDITY
317	{
318	/** Core sequence bits. */
319	RTASN1SEQUENCECORE SeqCore;
320	/** Effective starting. */
321	RTASN1TIME NotBefore;
322	/** Expires after. */
323	RTASN1TIME NotAfter;
324	} RTCRX509VALIDITY;
325	/** Pointer to the IPRT representation of an X.509 validity sequence. */
326	typedef RTCRX509VALIDITY *PRTCRX509VALIDITY;
327	/** Pointer ot the const IPRT representation of an X.509 validity sequence. */
328	typedef RTCRX509VALIDITY const *PCRTCRX509VALIDITY;
329	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509VALIDITY, RTDECL, RTCrX509Validity, SeqCore.Asn1Core);
330
331	RTDECL(bool) RTCrX509Validity_IsValidAtTimeSpec(PCRTCRX509VALIDITY pThis, PCRTTIMESPEC pTimeSpec);
332
333
334	#if 0
335	/**
336	* X.509 UniqueIdentifier (IPRT representation).
337	*/
338	typedef struct RTCRX509UNIQUEIDENTIFIER
339	{
340	/** Representation is a bit string. */
341	RTASN1BITSTRING BitString;
342	} RTCRX509UNIQUEIDENTIFIER;
343	/** Pointer to the IPRT representation of an X.509 unique identifier. */
344	typedef RTCRX509UNIQUEIDENTIFIER *PRTCRX509UNIQUEIDENTIFIER;
345	/** Pointer to the const IPRT representation of an X.509 unique identifier. */
346	typedef RTCRX509UNIQUEIDENTIFIER const *PCRTCRX509UNIQUEIDENTIFIER;
347	RTASN1TYPE_STANDARD_PROTOTYPES_NO_GET_CORE(RTCRX509UNIQUEIDENTIFIER, RTDECL, RTCrX509UniqueIdentifier);
348	#endif
349	RTASN1TYPE_ALIAS(RTCRX509UNIQUEIDENTIFIER, RTASN1BITSTRING, RTCrX509UniqueIdentifier, RTAsn1BitString);
350
351
352	/**
353	* X.509 SubjectPublicKeyInfo (IPRT representation).
354	*/
355	typedef struct RTCRX509SUBJECTPUBLICKEYINFO
356	{
357	/** Core sequence bits. */
358	RTASN1SEQUENCECORE SeqCore;
359	/** The algorithm used with the public key. */
360	RTCRX509ALGORITHMIDENTIFIER Algorithm;
361	/** A bit string containing the public key.
362	*
363	* For algorithms like rsaEncryption this is generally a sequence of two
364	* integers, where the first one has lots of bits, and the second one being a
365	* modulous value. These are details specific to the algorithm and not relevant
366	* when validating the certificate chain. */
367	RTASN1BITSTRING SubjectPublicKey;
368	} RTCRX509SUBJECTPUBLICKEYINFO;
369	/** Pointer to the IPRT representation of an X.509 subject public key info
370	* sequence. */
371	typedef RTCRX509SUBJECTPUBLICKEYINFO *PRTCRX509SUBJECTPUBLICKEYINFO;
372	/** Pointer to the const IPRT representation of an X.509 subject public key info
373	* sequence. */
374	typedef RTCRX509SUBJECTPUBLICKEYINFO const *PCRTCRX509SUBJECTPUBLICKEYINFO;
375	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509SUBJECTPUBLICKEYINFO, RTDECL, RTCrX509SubjectPublicKeyInfo, SeqCore.Asn1Core);
376
377
378	/**
379	* One X.509 AuthorityKeyIdentifier (IPRT representation).
380	*/
381	typedef struct RTCRX509AUTHORITYKEYIDENTIFIER
382	{
383	/** Sequence core. */
384	RTASN1SEQUENCECORE SeqCore;
385	/** Tag 0, optional, implicit: Key identifier. */
386	RTASN1OCTETSTRING KeyIdentifier;
387	/** Tag 1, optional, implicit: Issuer name. */
388	RTCRX509GENERALNAMES AuthorityCertIssuer;
389	/** Tag 2, optional, implicit: Serial number of issuer. */
390	RTASN1INTEGER AuthorityCertSerialNumber;
391	} RTCRX509AUTHORITYKEYIDENTIFIER;
392	/** Pointer to the IPRT representation of an X.509 AuthorityKeyIdentifier
393	* sequence. */
394	typedef RTCRX509AUTHORITYKEYIDENTIFIER *PRTCRX509AUTHORITYKEYIDENTIFIER;
395	/** Pointer to the const IPRT representation of an X.509 AuthorityKeyIdentifier
396	* sequence. */
397	typedef RTCRX509AUTHORITYKEYIDENTIFIER const *PCRTCRX509AUTHORITYKEYIDENTIFIER;
398	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509AUTHORITYKEYIDENTIFIER, RTDECL, RTCrX509AuthorityKeyIdentifier, SeqCore.Asn1Core);
399
400
401	/**
402	* One X.509 OldAuthorityKeyIdentifier (IPRT representation).
403	*/
404	typedef struct RTCRX509OLDAUTHORITYKEYIDENTIFIER
405	{
406	/** Sequence core. */
407	RTASN1SEQUENCECORE SeqCore;
408	/** Tag 0, optional, implicit: Key identifier. */
409	RTASN1OCTETSTRING KeyIdentifier;
410	struct
411	{
412	RTASN1CONTEXTTAG1 CtxTag1;
413	/** Tag 1, optional, implicit: Issuer name. */
414	RTCRX509NAME AuthorityCertIssuer;
415	} T1;
416	/** Tag 2, optional, implicit: Serial number of issuer. */
417	RTASN1INTEGER AuthorityCertSerialNumber;
418	} RTCRX509OLDAUTHORITYKEYIDENTIFIER;
419	/** Pointer to the IPRT representation of an X.509 AuthorityKeyIdentifier
420	* sequence. */
421	typedef RTCRX509OLDAUTHORITYKEYIDENTIFIER *PRTCRX509OLDAUTHORITYKEYIDENTIFIER;
422	/** Pointer to the const IPRT representation of an X.509 AuthorityKeyIdentifier
423	* sequence. */
424	typedef RTCRX509OLDAUTHORITYKEYIDENTIFIER const *PCRTCRX509OLDAUTHORITYKEYIDENTIFIER;
425	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509OLDAUTHORITYKEYIDENTIFIER, RTDECL, RTCrX509OldAuthorityKeyIdentifier, SeqCore.Asn1Core);
426
427
428	/**
429	* One X.509 PolicyQualifierInfo (IPRT representation).
430	*/
431	typedef struct RTCRX509POLICYQUALIFIERINFO
432	{
433	/** Core sequence bits. */
434	RTASN1SEQUENCECORE SeqCore;
435	/** The policy object ID. */
436	RTASN1OBJID PolicyQualifierId;
437	/** Anything defined by the policy qualifier id. */
438	RTASN1DYNTYPE Qualifier;
439	} RTCRX509POLICYQUALIFIERINFO;
440	/** Pointer to the IPRT representation of an X.509 PolicyQualifierInfo
441	* sequence. */
442	typedef RTCRX509POLICYQUALIFIERINFO *PRTCRX509POLICYQUALIFIERINFO;
443	/** Pointer to the const IPRT representation of an X.509 PolicyQualifierInfo
444	* sequence. */
445	typedef RTCRX509POLICYQUALIFIERINFO const *PCRTCRX509POLICYQUALIFIERINFO;
446	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509POLICYQUALIFIERINFO, RTDECL, RTCrX509PolicyQualifierInfo, SeqCore.Asn1Core);
447	RTASN1_IMPL_GEN_SEQ_OF_TYPEDEFS_AND_PROTOS(RTCRX509POLICYQUALIFIERINFOS, RTCRX509POLICYQUALIFIERINFO, RTDECL, RTCrX509PolicyQualifierInfos);
448
449
450	/**
451	* One X.509 PolicyInformation (IPRT representation).
452	*/
453	typedef struct RTCRX509POLICYINFORMATION
454	{
455	/** Core sequence bits. */
456	RTASN1SEQUENCECORE SeqCore;
457	/** The policy object ID. */
458	RTASN1OBJID PolicyIdentifier;
459	/** Optional sequence of policy qualifiers. */
460	RTCRX509POLICYQUALIFIERINFOS PolicyQualifiers;
461	} RTCRX509POLICYINFORMATION;
462	/** Pointer to the IPRT representation of an X.509 PolicyInformation
463	* sequence. */
464	typedef RTCRX509POLICYINFORMATION *PRTCRX509POLICYINFORMATION;
465	/** Pointer to the const IPRT representation of an X.509 PolicyInformation
466	* sequence. */
467	typedef RTCRX509POLICYINFORMATION const *PCRTCRX509POLICYINFORMATION;
468	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509POLICYINFORMATION, RTDECL, RTCrX509PolicyInformation, SeqCore.Asn1Core);
469	RTASN1_IMPL_GEN_SEQ_OF_TYPEDEFS_AND_PROTOS(RTCRX509CERTIFICATEPOLICIES, RTCRX509POLICYINFORMATION, RTDECL, RTCrX509CertificatePolicies);
470
471	/** Sepcial policy object ID that matches any policy. */
472	#define RTCRX509_ID_CE_CP_ANY_POLICY_OID "2.5.29.32.0"
473
474
475	/**
476	* One X.509 PolicyMapping (IPRT representation).
477	*/
478	typedef struct RTCRX509POLICYMAPPING
479	{
480	/** Core sequence bits. */
481	RTASN1SEQUENCECORE SeqCore;
482	/** Issuer policy ID. */
483	RTASN1OBJID IssuerDomainPolicy;
484	/** Subject policy ID. */
485	RTASN1OBJID SubjectDomainPolicy;
486	} RTCRX509POLICYMAPPING;
487	/** Pointer to the IPRT representation of a sequence of X.509 PolicyMapping. */
488	typedef RTCRX509POLICYMAPPING *PRTCRX509POLICYMAPPING;
489	/** Pointer to the const IPRT representation of a sequence of X.509
490	* PolicyMapping. */
491	typedef RTCRX509POLICYMAPPING const *PCRTCRX509POLICYMAPPING;
492	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509POLICYMAPPING, RTDECL, RTCrX509PolicyMapping, SeqCore.Asn1Core);
493	RTASN1_IMPL_GEN_SEQ_OF_TYPEDEFS_AND_PROTOS(RTCRX509POLICYMAPPINGS, RTCRX509POLICYMAPPING, RTDECL, RTCrX509PolicyMappings);
494
495
496	/**
497	* X.509 BasicConstraints (IPRT representation).
498	*/
499	typedef struct RTCRX509BASICCONSTRAINTS
500	{
501	/** Core sequence bits. */
502	RTASN1SEQUENCECORE SeqCore;
503	/** Is this ia certficiate authority? Default to false. */
504	RTASN1BOOLEAN CA;
505	/** Path length constraint. */
506	RTASN1INTEGER PathLenConstraint;
507	} RTCRX509BASICCONSTRAINTS;
508	/** Pointer to the IPRT representation of a sequence of X.509
509	* BasicConstraints. */
510	typedef RTCRX509BASICCONSTRAINTS *PRTCRX509BASICCONSTRAINTS;
511	/** Pointer to the const IPRT representation of a sequence of X.509
512	* BasicConstraints. */
513	typedef RTCRX509BASICCONSTRAINTS const *PCRTCRX509BASICCONSTRAINTS;
514	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509BASICCONSTRAINTS, RTDECL, RTCrX509BasicConstraints, SeqCore.Asn1Core);
515
516
517	/**
518	* X.509 GeneralSubtree (IPRT representation).
519	*/
520	typedef struct RTCRX509GENERALSUBTREE
521	{
522	/** Core sequence bits. */
523	RTASN1SEQUENCECORE SeqCore;
524	/** Base name. */
525	RTCRX509GENERALNAME Base;
526	/** Tag 0, optional: Minimum, default 0. Fixed at 0 by RFC-5280. */
527	RTASN1INTEGER Minimum;
528	/** Tag 1, optional: Maximum. Fixed as not-present by RFC-5280. */
529	RTASN1INTEGER Maximum;
530	} RTCRX509GENERALSUBTREE;
531	/** Pointer to the IPRT representation of a sequence of X.509 GeneralSubtree. */
532	typedef RTCRX509GENERALSUBTREE *PRTCRX509GENERALSUBTREE;
533	/** Pointer to the const IPRT representation of a sequence of X.509
534	* GeneralSubtree. */
535	typedef RTCRX509GENERALSUBTREE const *PCRTCRX509GENERALSUBTREE;
536	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509GENERALSUBTREE, RTDECL, RTCrX509GeneralSubtree, SeqCore.Asn1Core);
537
538	RTDECL(bool) RTCrX509GeneralSubtree_ConstraintMatch(PCRTCRX509GENERALSUBTREE pConstraint, PCRTCRX509GENERALSUBTREE pName);
539
540	RTASN1_IMPL_GEN_SEQ_OF_TYPEDEFS_AND_PROTOS(RTCRX509GENERALSUBTREES, RTCRX509GENERALSUBTREE, RTDECL, RTCrX509GeneralSubtrees);
541
542
543	/**
544	* X.509 NameConstraints (IPRT representation).
545	*/
546	typedef struct RTCRX509NAMECONSTRAINTS
547	{
548	/** Core sequence bits. */
549	RTASN1SEQUENCECORE SeqCore;
550	/** Tag 0, optional: Permitted subtrees. */
551	struct
552	{
553	/** Context tag. */
554	RTASN1CONTEXTTAG0 CtxTag0;
555	/** The permitted subtrees. */
556	RTCRX509GENERALSUBTREES PermittedSubtrees;
557	} T0;
558	/** Tag 1, optional: Excluded subtrees. */
559	struct
560	{
561	/** Context tag. */
562	RTASN1CONTEXTTAG1 CtxTag1;
563	/** The excluded subtrees. */
564	RTCRX509GENERALSUBTREES ExcludedSubtrees;
565	} T1;
566	} RTCRX509NAMECONSTRAINTS;
567	/** Pointer to the IPRT representation of a sequence of X.509
568	* NameConstraints. */
569	typedef RTCRX509NAMECONSTRAINTS *PRTCRX509NAMECONSTRAINTS;
570	/** Pointer to the const IPRT representation of a sequence of X.509
571	* NameConstraints. */
572	typedef RTCRX509NAMECONSTRAINTS const *PCRTCRX509NAMECONSTRAINTS;
573	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509NAMECONSTRAINTS, RTDECL, RTCrX509NameConstraints, SeqCore.Asn1Core);
574
575
576	/**
577	* X.509 PolicyConstraints (IPRT representation).
578	*/
579	typedef struct RTCRX509POLICYCONSTRAINTS
580	{
581	/** Core sequence bits. */
582	RTASN1SEQUENCECORE SeqCore;
583	/** Tag 0, optional: Certificates before an explicit policy is required. */
584	RTASN1INTEGER RequireExplicitPolicy;
585	/** Tag 1, optional: Certificates before policy mapping is inhibited. */
586	RTASN1INTEGER InhibitPolicyMapping;
587	} RTCRX509POLICYCONSTRAINTS;
588	/** Pointer to the IPRT representation of a sequence of X.509
589	* PolicyConstraints. */
590	typedef RTCRX509POLICYCONSTRAINTS *PRTCRX509POLICYCONSTRAINTS;
591	/** Pointer to the const IPRT representation of a sequence of X.509
592	* PolicyConstraints. */
593	typedef RTCRX509POLICYCONSTRAINTS const *PCRTCRX509POLICYCONSTRAINTS;
594	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509POLICYCONSTRAINTS, RTDECL, RTCrX509PolicyConstraints, SeqCore.Asn1Core);
595
596
597	/**
598	* Indicates what an X.509 extension value encapsulates.
599	*/
600	typedef enum RTCRX509EXTENSIONVALUE
601	{
602	RTCRX509EXTENSIONVALUE_INVALID = 0,
603	/** Unknown, no decoding available just the octet string. */
604	RTCRX509EXTENSIONVALUE_UNKNOWN,
605	/** Unencapsulated (i.e. octet string). */
606	RTCRX509EXTENSIONVALUE_NOT_ENCAPSULATED,
607
608	/** Bit string (RTASN1BITSTRING). */
609	RTCRX509EXTENSIONVALUE_BIT_STRING,
610	/** Octet string (RTASN1OCTETSTRING). */
611	RTCRX509EXTENSIONVALUE_OCTET_STRING,
612	/** Integer string (RTASN1INTEGER). */
613	RTCRX509EXTENSIONVALUE_INTEGER,
614	/** Sequence of object identifiers (RTASN1SEQOFOBJIDS). */
615	RTCRX509EXTENSIONVALUE_SEQ_OF_OBJ_IDS,
616
617	/** Authority key identifier (RTCRX509AUTHORITYKEYIDENTIFIER). */
618	RTCRX509EXTENSIONVALUE_AUTHORITY_KEY_IDENTIFIER,
619	/** Old Authority key identifier (RTCRX509OLDAUTHORITYKEYIDENTIFIER). */
620	RTCRX509EXTENSIONVALUE_OLD_AUTHORITY_KEY_IDENTIFIER,
621	/** Certificate policies (RTCRX509CERTIFICATEPOLICIES). */
622	RTCRX509EXTENSIONVALUE_CERTIFICATE_POLICIES,
623	/** Sequence of policy mappings (RTCRX509POLICYMAPPINGS). */
624	RTCRX509EXTENSIONVALUE_POLICY_MAPPINGS,
625	/** Basic constraints (RTCRX509BASICCONSTRAINTS). */
626	RTCRX509EXTENSIONVALUE_BASIC_CONSTRAINTS,
627	/** Name constraints (RTCRX509NAMECONSTRAINTS). */
628	RTCRX509EXTENSIONVALUE_NAME_CONSTRAINTS,
629	/** Policy constraints (RTCRX509POLICYCONSTRAINTS). */
630	RTCRX509EXTENSIONVALUE_POLICY_CONSTRAINTS,
631	/** Sequence of general names (RTCRX509GENERALNAMES). */
632	RTCRX509EXTENSIONVALUE_GENERAL_NAMES,
633
634	/** Blow the type up to 32-bits. */
635	RTCRX509EXTENSIONVALUE_32BIT_HACK = 0x7fffffff
636	} RTCRX509EXTENSIONVALUE;
637
638	/**
639	* One X.509 Extension (IPRT representation).
640	*/
641	typedef struct RTCRX509EXTENSION
642	{
643	/** Core sequence bits. */
644	RTASN1SEQUENCECORE SeqCore;
645	/** Extension ID. */
646	RTASN1OBJID ExtnId;
647	/** Whether this is critical (default @c false). */
648	RTASN1BOOLEAN Critical;
649	/** Indicates what ExtnValue.pEncapsulated points at. */
650	RTCRX509EXTENSIONVALUE enmValue;
651	/** The value.
652	* Contains extension specific data that we don't yet parse. */
653	RTASN1OCTETSTRING ExtnValue;
654	} RTCRX509EXTENSION;
655	/** Pointer to the IPRT representation of one X.509 extensions. */
656	typedef RTCRX509EXTENSION *PRTCRX509EXTENSION;
657	/** Pointer to the const IPRT representation of one X.509 extension. */
658	typedef RTCRX509EXTENSION const *PCRTCRX509EXTENSION;
659	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509EXTENSION, RTDECL, RTCrX509Extension, SeqCore.Asn1Core);
660	RTASN1_IMPL_GEN_SEQ_OF_TYPEDEFS_AND_PROTOS(RTCRX509EXTENSIONS, RTCRX509EXTENSION, RTDECL, RTCrX509Extensions);
661
662	RTDECL(int) RTCrX509Extension_ExtnValue_DecodeAsn1(PRTASN1CURSOR pCursor, uint32_t fFlags,
663	PRTCRX509EXTENSION pThis, const char *pszErrorTag);
664
665
666	/**
667	* X.509 To-be-signed certificate information (IPRT representation).
668	*/
669	typedef struct RTCRX509TBSCERTIFICATE
670	{
671	/** Sequence core. */
672	RTASN1SEQUENCECORE SeqCore;
673	/** Structure version. */
674	struct
675	{
676	/** Context tag with value 0. */
677	RTASN1CONTEXTTAG0 CtxTag0;
678	/** The actual value (RTCRX509TBSCERTIFICATE_V1, ...). */
679	RTASN1INTEGER Version;
680	} T0;
681	/** The serial number of the certificate. */
682	RTASN1INTEGER SerialNumber;
683	/** The signature algorithm. */
684	RTCRX509ALGORITHMIDENTIFIER Signature;
685	/** The issuer name. */
686	RTCRX509NAME Issuer;
687	/** The certificate validity period. */
688	RTCRX509VALIDITY Validity;
689	/** The subject name. */
690	RTCRX509NAME Subject;
691	/** The public key for this certificate. */
692	RTCRX509SUBJECTPUBLICKEYINFO SubjectPublicKeyInfo;
693	/** Issuer unique identifier (optional, version >= v2). */
694	struct
695	{
696	/** Context tag with value 1. */
697	RTASN1CONTEXTTAG1 CtxTag1;
698	/** The unique identifier value. */
699	RTCRX509UNIQUEIDENTIFIER IssuerUniqueId;
700	} T1;
701	/** Subject unique identifier (optional, version >= v2). */
702	struct
703	{
704	/** Context tag with value 2. */
705	RTASN1CONTEXTTAG2 CtxTag2;
706	/** The unique identifier value. */
707	RTCRX509UNIQUEIDENTIFIER SubjectUniqueId;
708	} T2;
709	/** Extensions (optional, version >= v3). */
710	struct
711	{
712	/** Context tag with value 3. */
713	RTASN1CONTEXTTAG3 CtxTag3;
714	/** The unique identifier value. */
715	RTCRX509EXTENSIONS Extensions;
716	/** Extensions summary flags. */
717	uint32_t fFlags;
718	/** Key usage flags. */
719	uint32_t fKeyUsage;
720	/** Extended key usage flags. */
721	uint32_t fExtKeyUsage;
722
723	/** Pointer to the authority key ID extension if present. */
724	PCRTCRX509AUTHORITYKEYIDENTIFIER pAuthorityKeyIdentifier;
725	/** Pointer to the OLD authority key ID extension if present. */
726	PCRTCRX509OLDAUTHORITYKEYIDENTIFIER pOldAuthorityKeyIdentifier;
727	/** Pointer to the subject key ID extension if present. */
728	PCRTASN1OCTETSTRING pSubjectKeyIdentifier;
729	/** Pointer to the alternative subject name extension if present. */
730	PCRTCRX509GENERALNAMES pAltSubjectName;
731	/** Pointer to the alternative issuer name extension if present. */
732	PCRTCRX509GENERALNAMES pAltIssuerName;
733	/** Pointer to the certificate policies extension if present. */
734	PCRTCRX509CERTIFICATEPOLICIES pCertificatePolicies;
735	/** Pointer to the policy mappings extension if present. */
736	PCRTCRX509POLICYMAPPINGS pPolicyMappings;
737	/** Pointer to the basic constraints extension if present. */
738	PCRTCRX509BASICCONSTRAINTS pBasicConstraints;
739	/** Pointer to the name constraints extension if present. */
740	PCRTCRX509NAMECONSTRAINTS pNameConstraints;
741	/** Pointer to the policy constraints extension if present. */
742	PCRTCRX509POLICYCONSTRAINTS pPolicyConstraints;
743	/** Pointer to the inhibit anyPolicy extension if present. */
744	PCRTASN1INTEGER pInhibitAnyPolicy;
745	} T3;
746	} RTCRX509TBSCERTIFICATE;
747	/** Pointer to the IPRT representation of a X.509 TBSCertificate. */
748	typedef RTCRX509TBSCERTIFICATE *PRTCRX509TBSCERTIFICATE;
749	/** Pointer to the const IPRT representation of a X.509 TBSCertificate. */
750	typedef RTCRX509TBSCERTIFICATE const *PCRTCRX509TBSCERTIFICATE;
751	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509TBSCERTIFICATE, RTDECL, RTCrX509TbsCertificate, SeqCore.Asn1Core);
752
753	/** @name RTCRX509TBSCERTIFICATE::T0.Version values.
754	* @{ */
755	#define RTCRX509TBSCERTIFICATE_V1 0
756	#define RTCRX509TBSCERTIFICATE_V2 1
757	#define RTCRX509TBSCERTIFICATE_V3 2
758	/** @} */
759
760	/** @name RTCRX509TBSCERTIFICATE::T3.fFlags values.
761	* @{ */
762	#define RTCRX509TBSCERTIFICATE_F_PRESENT_KEY_USAGE RT_BIT_32(0)
763	#define RTCRX509TBSCERTIFICATE_F_PRESENT_EXT_KEY_USAGE RT_BIT_32(1)
764	#define RTCRX509TBSCERTIFICATE_F_PRESENT_SUBJECT_KEY_IDENTIFIER RT_BIT_32(2)
765	#define RTCRX509TBSCERTIFICATE_F_PRESENT_SUBJECT_ALT_NAME RT_BIT_32(3)
766	#define RTCRX509TBSCERTIFICATE_F_PRESENT_ISSUER_ALT_NAME RT_BIT_32(4)
767	#define RTCRX509TBSCERTIFICATE_F_PRESENT_CERTIFICATE_POLICIES RT_BIT_32(5)
768	#define RTCRX509TBSCERTIFICATE_F_PRESENT_POLICY_MAPPINGS RT_BIT_32(6)
769	#define RTCRX509TBSCERTIFICATE_F_PRESENT_BASIC_CONSTRAINTS RT_BIT_32(7)
770	#define RTCRX509TBSCERTIFICATE_F_PRESENT_NAME_CONSTRAINTS RT_BIT_32(8)
771	#define RTCRX509TBSCERTIFICATE_F_PRESENT_POLICY_CONSTRAINTS RT_BIT_32(9)
772	#define RTCRX509TBSCERTIFICATE_F_PRESENT_AUTHORITY_KEY_IDENTIFIER RT_BIT_32(10)
773	#define RTCRX509TBSCERTIFICATE_F_PRESENT_OLD_AUTHORITY_KEY_IDENTIFIER RT_BIT_32(11)
774	#define RTCRX509TBSCERTIFICATE_F_PRESENT_ACCEPTABLE_CERT_POLICIES RT_BIT_32(12)
775	#define RTCRX509TBSCERTIFICATE_F_PRESENT_INHIBIT_ANY_POLICY RT_BIT_32(13)
776	#define RTCRX509TBSCERTIFICATE_F_PRESENT_OTHER RT_BIT_32(22) /*< Other unknown extension present. /
777	#define RTCRX509TBSCERTIFICATE_F_PRESENT_NONE RT_BIT_32(23) /*< No extensions present. /
778	/** @} */
779
780	/** @name X.509 Key Usage flags. (RFC-5280 section 4.2.1.3.)
781	* @{ */
782	#define RTCRX509CERT_KEY_USAGE_F_DIGITAL_SIGNATURE_BIT 0
783	#define RTCRX509CERT_KEY_USAGE_F_DIGITAL_SIGNATURE RT_BIT_32(0)
784	#define RTCRX509CERT_KEY_USAGE_F_CONTENT_COMMITTMENT_BIT 1
785	#define RTCRX509CERT_KEY_USAGE_F_CONTENT_COMMITTMENT RT_BIT_32(1)
786	#define RTCRX509CERT_KEY_USAGE_F_KEY_ENCIPHERMENT_BIT 2
787	#define RTCRX509CERT_KEY_USAGE_F_KEY_ENCIPHERMENT RT_BIT_32(2)
788	#define RTCRX509CERT_KEY_USAGE_F_DATA_ENCIPHERMENT_BIT 3
789	#define RTCRX509CERT_KEY_USAGE_F_DATA_ENCIPHERMENT RT_BIT_32(3)
790	#define RTCRX509CERT_KEY_USAGE_F_KEY_AGREEMENT_BIT 4
791	#define RTCRX509CERT_KEY_USAGE_F_KEY_AGREEMENT RT_BIT_32(4)
792	#define RTCRX509CERT_KEY_USAGE_F_KEY_CERT_SIGN_BIT 5
793	#define RTCRX509CERT_KEY_USAGE_F_KEY_CERT_SIGN RT_BIT_32(5)
794	#define RTCRX509CERT_KEY_USAGE_F_CRL_SIGN_BIT 6
795	#define RTCRX509CERT_KEY_USAGE_F_CRL_SIGN RT_BIT_32(6)
796	#define RTCRX509CERT_KEY_USAGE_F_ENCIPHERMENT_ONLY_BIT 7
797	#define RTCRX509CERT_KEY_USAGE_F_ENCIPHERMENT_ONLY RT_BIT_32(7)
798	#define RTCRX509CERT_KEY_USAGE_F_DECIPHERMENT_ONLY_BIT 8
799	#define RTCRX509CERT_KEY_USAGE_F_DECIPHERMENT_ONLY RT_BIT_32(8)
800	/** @} */
801
802	/** @name X.509 Extended Key Usage flags. (RFC-5280 section 4.2.1.12, ++.)
803	* @remarks Needless to say, these flags doesn't cover all possible extended key
804	* usages, because there is a potential unlimited number of them. Only
805	* ones relevant to IPRT and it's users are covered.
806	* @{ */
807	#define RTCRX509CERT_EKU_F_ANY RT_BIT_64(0)
808	#define RTCRX509CERT_EKU_F_SERVER_AUTH RT_BIT_64(1)
809	#define RTCRX509CERT_EKU_F_CLIENT_AUTH RT_BIT_64(2)
810	#define RTCRX509CERT_EKU_F_CODE_SIGNING RT_BIT_64(3)
811	#define RTCRX509CERT_EKU_F_EMAIL_PROTECTION RT_BIT_64(4)
812	#define RTCRX509CERT_EKU_F_IPSEC_END_SYSTEM RT_BIT_64(5)
813	#define RTCRX509CERT_EKU_F_IPSEC_TUNNEL RT_BIT_64(6)
814	#define RTCRX509CERT_EKU_F_IPSEC_USER RT_BIT_64(7)
815	#define RTCRX509CERT_EKU_F_TIMESTAMPING RT_BIT_64(8)
816	#define RTCRX509CERT_EKU_F_OCSP_SIGNING RT_BIT_64(9)
817	#define RTCRX509CERT_EKU_F_DVCS RT_BIT_64(10)
818	#define RTCRX509CERT_EKU_F_SBGP_CERT_AA_SERVICE_AUTH RT_BIT_64(11)
819	#define RTCRX509CERT_EKU_F_EAP_OVER_PPP RT_BIT_64(12)
820	#define RTCRX509CERT_EKU_F_EAP_OVER_LAN RT_BIT_64(13)
821	#define RTCRX509CERT_EKU_F_OTHER RT_BIT_64(16) /*< Other unknown extended key usage present. /
822	#define RTCRX509CERT_EKU_F_APPLE_CODE_SIGNING RT_BIT_64(24)
823	#define RTCRX509CERT_EKU_F_APPLE_CODE_SIGNING_DEVELOPMENT RT_BIT_64(25)
824	#define RTCRX509CERT_EKU_F_APPLE_SOFTWARE_UPDATE_SIGNING RT_BIT_64(26)
825	#define RTCRX509CERT_EKU_F_APPLE_CODE_SIGNING_THIRD_PARTY RT_BIT_64(27)
826	#define RTCRX509CERT_EKU_F_APPLE_RESOURCE_SIGNING RT_BIT_64(28)
827	#define RTCRX509CERT_EKU_F_APPLE_SYSTEM_IDENTITY RT_BIT_64(29)
828	#define RTCRX509CERT_EKU_F_MS_TIMESTAMP_SIGNING RT_BIT_64(32)
829	#define RTCRX509CERT_EKU_F_MS_NT5_CRYPTO RT_BIT_64(33)
830	#define RTCRX509CERT_EKU_F_MS_OEM_WHQL_CRYPTO RT_BIT_64(34)
831	#define RTCRX509CERT_EKU_F_MS_EMBEDDED_NT_CRYPTO RT_BIT_64(35)
832	#define RTCRX509CERT_EKU_F_MS_KERNEL_MODE_CODE_SIGNING RT_BIT_64(36)
833	#define RTCRX509CERT_EKU_F_MS_LIFETIME_SIGNING RT_BIT_64(37)
834	#define RTCRX509CERT_EKU_F_MS_DRM RT_BIT_64(38)
835	#define RTCRX509CERT_EKU_F_MS_DRM_INDIVIDUALIZATION RT_BIT_64(39)
836	/** @} */
837
838	/** @name Key purpose OIDs (extKeyUsage)
839	* @{ */
840	#define RTCRX509_ANY_EXTENDED_KEY_USAGE_OID "2.5.29.37.0"
841	#define RTCRX509_ID_KP_OID "1.3.6.1.5.5.7.3"
842	#define RTCRX509_ID_KP_SERVER_AUTH_OID "1.3.6.1.5.5.7.3.1"
843	#define RTCRX509_ID_KP_CLIENT_AUTH_OID "1.3.6.1.5.5.7.3.2"
844	#define RTCRX509_ID_KP_CODE_SIGNING_OID "1.3.6.1.5.5.7.3.3"
845	#define RTCRX509_ID_KP_EMAIL_PROTECTION_OID "1.3.6.1.5.5.7.3.4"
846	#define RTCRX509_ID_KP_IPSEC_END_SYSTEM_OID "1.3.6.1.5.5.7.3.5"
847	#define RTCRX509_ID_KP_IPSEC_TUNNEL_OID "1.3.6.1.5.5.7.3.6"
848	#define RTCRX509_ID_KP_IPSEC_USER_OID "1.3.6.1.5.5.7.3.7"
849	#define RTCRX509_ID_KP_TIMESTAMPING_OID "1.3.6.1.5.5.7.3.8"
850	#define RTCRX509_ID_KP_OCSP_SIGNING_OID "1.3.6.1.5.5.7.3.9"
851	#define RTCRX509_ID_KP_DVCS_OID "1.3.6.1.5.5.7.3.10"
852	#define RTCRX509_ID_KP_SBGP_CERT_AA_SERVICE_AUTH_OID "1.3.6.1.5.5.7.3.11"
853	#define RTCRX509_ID_KP_EAP_OVER_PPP_OID "1.3.6.1.5.5.7.3.13"
854	#define RTCRX509_ID_KP_EAP_OVER_LAN_OID "1.3.6.1.5.5.7.3.14"
855	/** @} */
856
857	/** @name Microsoft extended key usage OIDs
858	* @{ */
859	#define RTCRX509_MS_EKU_CERT_TRUST_LIST_SIGNING_OID "1.3.6.1.4.1.311.10.3.1"
860	#define RTCRX509_MS_EKU_TIMESTAMP_SIGNING_OID "1.3.6.1.4.1.311.10.3.2"
861	#define RTCRX509_MS_EKU_SERVER_GATED_CRYPTO_OID "1.3.6.1.4.1.311.10.3.3"
862	#define RTCRX509_MS_EKU_SGC_SERIALIZED_OID "1.3.6.1.4.1.311.10.3.3.1"
863	#define RTCRX509_MS_EKU_ENCRYPTED_FILE_SYSTEM_OID "1.3.6.1.4.1.311.10.3.4"
864	#define RTCRX509_MS_EKU_WHQL_CRYPTO_OID "1.3.6.1.4.1.311.10.3.5"
865	#define RTCRX509_MS_EKU_NT5_CRYPTO_OID "1.3.6.1.4.1.311.10.3.6"
866	#define RTCRX509_MS_EKU_OEM_WHQL_CRYPTO_OID "1.3.6.1.4.1.311.10.3.7"
867	#define RTCRX509_MS_EKU_EMBEDDED_NT_CRYPTO_OID "1.3.6.1.4.1.311.10.3.8"
868	#define RTCRX509_MS_EKU_ROOT_LIST_SIGNER_OID "1.3.6.1.4.1.311.10.3.9"
869	#define RTCRX509_MS_EKU_QUALIFIED_SUBORDINATE_OID "1.3.6.1.4.1.311.10.3.10"
870	#define RTCRX509_MS_EKU_KEY_RECOVERY_3_OID "1.3.6.1.4.1.311.10.3.11"
871	#define RTCRX509_MS_EKU_DOCUMENT_SIGNING_OID "1.3.6.1.4.1.311.10.3.12"
872	#define RTCRX509_MS_EKU_LIFETIME_SIGNING_OID "1.3.6.1.4.1.311.10.3.13"
873	#define RTCRX509_MS_EKU_MOBILE_DEVICE_SOFTWARE_OID "1.3.6.1.4.1.311.10.3.14"
874	#define RTCRX509_MS_EKU_SMART_DISPLAY_OID "1.3.6.1.4.1.311.10.3.15"
875	#define RTCRX509_MS_EKU_CSP_SIGNATURE_OID "1.3.6.1.4.1.311.10.3.16"
876	#define RTCRX509_MS_EKU_EFS_RECOVERY_OID "1.3.6.1.4.1.311.10.3.4.1"
877	#define RTCRX509_MS_EKU_DRM_OID "1.3.6.1.4.1.311.10.5.1"
878	#define RTCRX509_MS_EKU_DRM_INDIVIDUALIZATION_OID "1.3.6.1.4.1.311.10.5.2"
879	#define RTCRX509_MS_EKU_LICENSES_OID "1.3.6.1.4.1.311.10.5.3"
880	#define RTCRX509_MS_EKU_LICENSE_SERVER_OID "1.3.6.1.4.1.311.10.5.4"
881	#define RTCRX509_MS_EKU_ENROLLMENT_AGENT_OID "1.3.6.1.4.1.311.20.2.1"
882	#define RTCRX509_MS_EKU_SMARTCARD_LOGON_OID "1.3.6.1.4.1.311.20.2.2"
883	#define RTCRX509_MS_EKU_CA_EXCHANGE_OID "1.3.6.1.4.1.311.21.5"
884	#define RTCRX509_MS_EKU_KEY_RECOVERY_21_OID "1.3.6.1.4.1.311.21.6"
885	#define RTCRX509_MS_EKU_SYSTEM_HEALTH_OID "1.3.6.1.4.1.311.47.1.1"
886	#define RTCRX509_MS_EKU_SYSTEM_HEALTH_LOOPHOLE_OID "1.3.6.1.4.1.311.47.1.3"
887	#define RTCRX509_MS_EKU_KERNEL_MODE_CODE_SIGNING_OID "1.3.6.1.4.1.311.61.1.1"
888	/** @} */
889
890	/** @name Apple extended key usage OIDs
891	* @{ */
892	#define RTCRX509_APPLE_EKU_APPLE_EXTENDED_KEY_USAGE_OID "1.2.840.113635.100.4"
893	#define RTCRX509_APPLE_EKU_CODE_SIGNING_OID "1.2.840.113635.100.4.1"
894	#define RTCRX509_APPLE_EKU_CODE_SIGNING_DEVELOPMENT_OID "1.2.840.113635.100.4.1.1"
895	#define RTCRX509_APPLE_EKU_SOFTWARE_UPDATE_SIGNING_OID "1.2.840.113635.100.4.1.2"
896	#define RTCRX509_APPLE_EKU_CODE_SIGNING_THRID_PARTY_OID "1.2.840.113635.100.4.1.3"
897	#define RTCRX509_APPLE_EKU_RESOURCE_SIGNING_OID "1.2.840.113635.100.4.1.4"
898	#define RTCRX509_APPLE_EKU_ICHAT_SIGNING_OID "1.2.840.113635.100.4.2"
899	#define RTCRX509_APPLE_EKU_ICHAT_ENCRYPTION_OID "1.2.840.113635.100.4.3"
900	#define RTCRX509_APPLE_EKU_SYSTEM_IDENTITY_OID "1.2.840.113635.100.4.4"
901	#define RTCRX509_APPLE_EKU_CRYPTO_ENV_OID "1.2.840.113635.100.4.5"
902	#define RTCRX509_APPLE_EKU_CRYPTO_PRODUCTION_ENV_OID "1.2.840.113635.100.4.5.1"
903	#define RTCRX509_APPLE_EKU_CRYPTO_MAINTENANCE_ENV_OID "1.2.840.113635.100.4.5.2"
904	#define RTCRX509_APPLE_EKU_CRYPTO_TEST_ENV_OID "1.2.840.113635.100.4.5.3"
905	#define RTCRX509_APPLE_EKU_CRYPTO_DEVELOPMENT_ENV_OID "1.2.840.113635.100.4.5.4"
906	#define RTCRX509_APPLE_EKU_CRYPTO_QOS_OID "1.2.840.113635.100.4.6"
907	#define RTCRX509_APPLE_EKU_CRYPTO_TIER0_QOS_OID "1.2.840.113635.100.4.6.1"
908	#define RTCRX509_APPLE_EKU_CRYPTO_TIER1_QOS_OID "1.2.840.113635.100.4.6.2"
909	#define RTCRX509_APPLE_EKU_CRYPTO_TIER2_QOS_OID "1.2.840.113635.100.4.6.3"
910	#define RTCRX509_APPLE_EKU_CRYPTO_TIER3_QOS_OID "1.2.840.113635.100.4.6.4"
911	/** @} */
912
913	/**
914	* Use this to update derived values after changing the certificate
915	* extensions.
916	*
917	* @returns IPRT status code
918	* @param pThis The certificate.
919	* @param pErrInfo Where to return additional error information. Optional.
920	*/
921	RTDECL(int) RTCrX509TbsCertificate_ReprocessExtensions(PRTCRX509TBSCERTIFICATE pThis, PRTERRINFO pErrInfo);
922
923
924	/**
925	* One X.509 Certificate (IPRT representation).
926	*/
927	typedef struct RTCRX509CERTIFICATE
928	{
929	/** Sequence core. */
930	RTASN1SEQUENCECORE SeqCore;
931	/** The to-be-signed certificate information. */
932	RTCRX509TBSCERTIFICATE TbsCertificate;
933	/** The signature algorithm (must match TbsCertificate.Signature). */
934	RTCRX509ALGORITHMIDENTIFIER SignatureAlgorithm;
935	/** The signature value. */
936	RTASN1BITSTRING SignatureValue;
937	} RTCRX509CERTIFICATE;
938	/** Pointer to the IPRT representation of one X.509 certificate. */
939	typedef RTCRX509CERTIFICATE *PRTCRX509CERTIFICATE;
940	/** Pointer to the const IPRT representation of one X.509 certificate. */
941	typedef RTCRX509CERTIFICATE const *PCRTCRX509CERTIFICATE;
942	RTASN1TYPE_STANDARD_PROTOTYPES(RTCRX509CERTIFICATE, RTDECL, RTCrX509Certificate, SeqCore.Asn1Core);
943
944	/**
945	* Checks if a certificate matches a given issuer name and serial number.
946	*
947	* @returns True / false.
948	* @param pCertificates The X.509 certificat.
949	* @param pIssuer The issuer name to match against.
950	* @param pSerialNumber The serial number to match against.
951	*/
952	RTDECL(bool) RTCrX509Certificate_MatchIssuerAndSerialNumber(PCRTCRX509CERTIFICATE pCertificate,
953	PCRTCRX509NAME pIssuer, PCRTASN1INTEGER pSerialNumber);
954
955	RTDECL(bool) RTCrX509Certificate_MatchSubjectOrAltSubjectByRfc5280(PCRTCRX509CERTIFICATE pThis, PCRTCRX509NAME pName);
956	RTDECL(bool) RTCrX509Certificate_IsSelfSigned(PCRTCRX509CERTIFICATE pCertificate);
957
958	RTDECL(int) RTCrX509Certificate_VerifySignature(PCRTCRX509CERTIFICATE pThis, PCRTASN1OBJID pAlgorithm,
959	PCRTASN1DYNTYPE pParameters, PCRTASN1BITSTRING pPublicKey,
960	PRTERRINFO pErrInfo);
961	RTDECL(int) RTCrX509Certificate_ReadFromFile(PRTCRX509CERTIFICATE pCertificate, const char *pszFilename, uint32_t fFlags,
962	PCRTASN1ALLOCATORVTABLE pAllocator, PRTERRINFO pErrInfo);
963
964
965	/** @name X.509 Certificate Extensions
966	* @{ */
967	/** Old AuthorityKeyIdentifier OID. */
968	#define RTCRX509_ID_CE_OLD_AUTHORITY_KEY_IDENTIFIER_OID "2.5.29.1"
969	/** Old CertificatePolicies extension OID. */
970	#define RTCRX509_ID_CE_OLD_CERTIFICATE_POLICIES_OID "2.5.29.3"
971	/** Old SubjectAltName extension OID. */
972	#define RTCRX509_ID_CE_OLD_SUBJECT_ALT_NAME_OID "2.5.29.7"
973	/** Old IssuerAltName extension OID. */
974	#define RTCRX509_ID_CE_OLD_ISSUER_ALT_NAME_OID "2.5.29.8"
975	/** Old BasicContraints extension OID. */
976	#define RTCRX509_ID_CE_OLD_BASIC_CONSTRAINTS_OID "2.5.29.10"
977	/** SubjectKeyIdentifier OID. */
978	#define RTCRX509_ID_CE_SUBJECT_KEY_IDENTIFIER_OID "2.5.29.14"
979	/** KeyUsage OID. */
980	#define RTCRX509_ID_CE_KEY_USAGE_OID "2.5.29.15"
981	/** PrivateKeyUsagePeriod OID. */
982	#define RTCRX509_ID_CE_PRIVATE_KEY_USAGE_PERIOD_OID "2.5.29.16"
983	/** SubjectAltName extension OID. */
984	#define RTCRX509_ID_CE_SUBJECT_ALT_NAME_OID "2.5.29.17"
985	/** IssuerAltName extension OID. */
986	#define RTCRX509_ID_CE_ISSUER_ALT_NAME_OID "2.5.29.18"
987	/** BasicContraints extension OID. */
988	#define RTCRX509_ID_CE_BASIC_CONSTRAINTS_OID "2.5.29.19"
989	/** NameContraints extension OID. */
990	#define RTCRX509_ID_CE_NAME_CONSTRAINTS_OID "2.5.29.30"
991	/** CertificatePolicies extension OID. */
992	#define RTCRX509_ID_CE_CERTIFICATE_POLICIES_OID "2.5.29.32"
993	/** PolicyMappings extension OID. */
994	#define RTCRX509_ID_CE_POLICY_MAPPINGS_OID "2.5.29.33"
995	/** AuthorityKeyIdentifier OID. */
996	#define RTCRX509_ID_CE_AUTHORITY_KEY_IDENTIFIER_OID "2.5.29.35"
997	/** PolicyContraints extension OID. */
998	#define RTCRX509_ID_CE_POLICY_CONSTRAINTS_OID "2.5.29.36"
999	/** ExtKeyUsage (extended key usage) extension OID. */
1000	#define RTCRX509_ID_CE_EXT_KEY_USAGE_OID "2.5.29.37"
1001	/** ExtKeyUsage: OID for permitting any unspecified key usage. */
1002	#define RTCRX509_ID_CE_ANY_EXTENDED_KEY_USAGE_OID "2.5.29.37.0"
1003	/** AuthorityAttributeIdentifier OID. */
1004	#define RTCRX509_ID_CE_AUTHORITY_ATTRIBUTE_IDENTIFIER_OID "2.5.29.38"
1005	/** AcceptableCertPolicies OID. */
1006	#define RTCRX509_ID_CE_ACCEPTABLE_CERT_POLICIES_OID "2.5.29.52"
1007	/** InhibitAnyPolicy OID. */
1008	#define RTCRX509_ID_CE_INHIBIT_ANY_POLICY_OID "2.5.29.54"
1009	/** @} */
1010
1011
1012	/*
1013	* Sequence of X.509 Certifcates (IPRT representation).
1014	*/
1015	RTASN1_IMPL_GEN_SET_OF_TYPEDEFS_AND_PROTOS(RTCRX509CERTIFICATES, RTCRX509CERTIFICATE, RTDECL, RTCrX509Certificates);
1016
1017	/**
1018	* Looks up a certificate by issuer name and serial number.
1019	*
1020	* @returns Pointer to the given certificate if found, NULL if not.
1021	* @param pCertificates The X.509 certificate set to search.
1022	* @param pIssuer The issuer name of the wanted certificate.
1023	* @param pSerialNumber The serial number of the wanted certificate.
1024	*/
1025	RTDECL(PCRTCRX509CERTIFICATE) RTCrX509Certificates_FindByIssuerAndSerialNumber(PCRTCRX509CERTIFICATES pCertificates,
1026	PCRTCRX509NAME pIssuer,
1027	PCRTASN1INTEGER pSerialNumber);
1028
1029
1030
1031	RTDECL(int) RTCrX509CertPathsCreate(PRTCRX509CERTPATHS phCertPaths, PCRTCRX509CERTIFICATE pTarget);
1032	RTDECL(uint32_t) RTCrX509CertPathsRetain(RTCRX509CERTPATHS hCertPaths);
1033	RTDECL(uint32_t) RTCrX509CertPathsRelease(RTCRX509CERTPATHS hCertPaths);
1034	RTDECL(int) RTCrX509CertPathsSetTrustedStore(RTCRX509CERTPATHS hCertPaths, RTCRSTORE hTrustedStore);
1035	RTDECL(int) RTCrX509CertPathsSetUntrustedStore(RTCRX509CERTPATHS hCertPaths, RTCRSTORE hUntrustedStore);
1036	RTDECL(int) RTCrX509CertPathsSetUntrustedArray(RTCRX509CERTPATHS hCertPaths, PCRTCRX509CERTIFICATE paCerts, uint32_t cCerts);
1037	RTDECL(int) RTCrX509CertPathsSetUntrustedSet(RTCRX509CERTPATHS hCertPaths, struct RTCRPKCS7SETOFCERTS const *pSetOfCerts);
1038	RTDECL(int) RTCrX509CertPathsSetValidTime(RTCRX509CERTPATHS hCertPaths, PCRTTIME pTime);
1039	RTDECL(int) RTCrX509CertPathsSetValidTimeSpec(RTCRX509CERTPATHS hCertPaths, PCRTTIMESPEC pTimeSpec);
1040	RTDECL(int) RTCrX509CertPathsCreateEx(PRTCRX509CERTPATHS phCertPaths, PCRTCRX509CERTIFICATE pTarget, RTCRSTORE hTrustedStore,
1041	RTCRSTORE hUntrustedStore, PCRTCRX509CERTIFICATE paUntrustedCerts, uint32_t cUntrustedCerts,
1042	PCRTTIMESPEC pValidTime);
1043	RTDECL(int) RTCrX509CertPathsBuild(RTCRX509CERTPATHS hCertPaths, PRTERRINFO pErrInfo);
1044	RTDECL(int) RTCrX509CertPathsDumpOne(RTCRX509CERTPATHS hCertPaths, uint32_t iPath, uint32_t uVerbosity,
1045	PFNRTDUMPPRINTFV pfnPrintfV, void *pvUser);
1046	RTDECL(int) RTCrX509CertPathsDumpAll(RTCRX509CERTPATHS hCertPaths, uint32_t uVerbosity,
1047	PFNRTDUMPPRINTFV pfnPrintfV, void *pvUser);
1048
1049	RTDECL(int) RTCrX509CertPathsValidateOne(RTCRX509CERTPATHS hCertPaths, uint32_t iPath, PRTERRINFO pErrInfo);
1050	RTDECL(int) RTCrX509CertPathsValidateAll(RTCRX509CERTPATHS hCertPaths, uint32_t *pcValidPaths, PRTERRINFO pErrInfo);
1051
1052	RTDECL(uint32_t) RTCrX509CertPathsGetPathCount(RTCRX509CERTPATHS hCertPaths);
1053	RTDECL(int) RTCrX509CertPathsQueryPathInfo(RTCRX509CERTPATHS hCertPaths, uint32_t iPath,
1054	bool pfTrusted, uint32_t pcNodes, PCRTCRX509NAME *ppSubject,
1055	PCRTCRX509SUBJECTPUBLICKEYINFO *ppPublicKeyInfo,
1056	PCRTCRX509CERTIFICATE ppCert, PCRTCRCERTCTX ppCertCtx, int *prcVerify);
1057	RTDECL(uint32_t) RTCrX509CertPathsGetPathLength(RTCRX509CERTPATHS hCertPaths, uint32_t iPath);
1058	RTDECL(int) RTCrX509CertPathsGetPathVerifyResult(RTCRX509CERTPATHS hCertPaths, uint32_t iPath);
1059	RTDECL(PCRTCRX509CERTIFICATE) RTCrX509CertPathsGetPathNodeCert(RTCRX509CERTPATHS hCertPaths, uint32_t iPath, uint32_t iNode);
1060
1061
1062	RT_C_DECLS_END
1063
1064	/** @} */
1065
1066	/** @} */
1067
1068	#endif
1069

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/include/iprt/crypto/x509.h@ 57250

Download in other formats: