Hannes Tschofenig / Mbed 2 deprecated aes-gcm-test-program

Example program to test AES-GCM functionality. Used for a workshop

Dependencies:   mbed

SSL/include/polarssl/x509_crt.h@0:796d0f61a05b, 2018-09-27 (annotated)

Committer:
HannesTschofenig
Date:
Thu Sep 27 06:34:22 2018 +0000
Revision:
0:796d0f61a05b
Example AES-GCM test program

Who changed what in which revision?

UserRevisionLine numberNew contents of line
HannesTschofenig 0:796d0f61a05b 1 /**
HannesTschofenig 0:796d0f61a05b 2 * \file x509_crt.h
HannesTschofenig 0:796d0f61a05b 3 *
HannesTschofenig 0:796d0f61a05b 4 * \brief X.509 certificate parsing and writing
HannesTschofenig 0:796d0f61a05b 5 *
HannesTschofenig 0:796d0f61a05b 6 * Copyright (C) 2006-2013, Brainspark B.V.
HannesTschofenig 0:796d0f61a05b 7 *
HannesTschofenig 0:796d0f61a05b 8 * This file is part of PolarSSL (http://www.polarssl.org)
HannesTschofenig 0:796d0f61a05b 9 * Lead Maintainer: Paul Bakker <polarssl_maintainer at polarssl.org>
HannesTschofenig 0:796d0f61a05b 10 *
HannesTschofenig 0:796d0f61a05b 11 * All rights reserved.
HannesTschofenig 0:796d0f61a05b 12 *
HannesTschofenig 0:796d0f61a05b 13 * This program is free software; you can redistribute it and/or modify
HannesTschofenig 0:796d0f61a05b 14 * it under the terms of the GNU General Public License as published by
HannesTschofenig 0:796d0f61a05b 15 * the Free Software Foundation; either version 2 of the License, or
HannesTschofenig 0:796d0f61a05b 16 * (at your option) any later version.
HannesTschofenig 0:796d0f61a05b 17 *
HannesTschofenig 0:796d0f61a05b 18 * This program is distributed in the hope that it will be useful,
HannesTschofenig 0:796d0f61a05b 19 * but WITHOUT ANY WARRANTY; without even the implied warranty of
HannesTschofenig 0:796d0f61a05b 20 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
HannesTschofenig 0:796d0f61a05b 21 * GNU General Public License for more details.
HannesTschofenig 0:796d0f61a05b 22 *
HannesTschofenig 0:796d0f61a05b 23 * You should have received a copy of the GNU General Public License along
HannesTschofenig 0:796d0f61a05b 24 * with this program; if not, write to the Free Software Foundation, Inc.,
HannesTschofenig 0:796d0f61a05b 25 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
HannesTschofenig 0:796d0f61a05b 26 */
HannesTschofenig 0:796d0f61a05b 27 #ifndef POLARSSL_X509_CRT_H
HannesTschofenig 0:796d0f61a05b 28 #define POLARSSL_X509_CRT_H
HannesTschofenig 0:796d0f61a05b 29
HannesTschofenig 0:796d0f61a05b 30 #if !defined(POLARSSL_CONFIG_FILE)
HannesTschofenig 0:796d0f61a05b 31 #include "config.h"
HannesTschofenig 0:796d0f61a05b 32 #else
HannesTschofenig 0:796d0f61a05b 33 #include POLARSSL_CONFIG_FILE
HannesTschofenig 0:796d0f61a05b 34 #endif
HannesTschofenig 0:796d0f61a05b 35
HannesTschofenig 0:796d0f61a05b 36 #include "x509.h"
HannesTschofenig 0:796d0f61a05b 37
HannesTschofenig 0:796d0f61a05b 38 #include "x509_crl.h"
HannesTschofenig 0:796d0f61a05b 39
HannesTschofenig 0:796d0f61a05b 40 /**
HannesTschofenig 0:796d0f61a05b 41 * \addtogroup x509_module
HannesTschofenig 0:796d0f61a05b 42 * \{
HannesTschofenig 0:796d0f61a05b 43 */
HannesTschofenig 0:796d0f61a05b 44
HannesTschofenig 0:796d0f61a05b 45 #ifdef __cplusplus
HannesTschofenig 0:796d0f61a05b 46 extern "C" {
HannesTschofenig 0:796d0f61a05b 47 #endif
HannesTschofenig 0:796d0f61a05b 48
HannesTschofenig 0:796d0f61a05b 49 /**
HannesTschofenig 0:796d0f61a05b 50 * \name Structures and functions for parsing and writing X.509 certificates
HannesTschofenig 0:796d0f61a05b 51 * \{
HannesTschofenig 0:796d0f61a05b 52 */
HannesTschofenig 0:796d0f61a05b 53
HannesTschofenig 0:796d0f61a05b 54 /**
HannesTschofenig 0:796d0f61a05b 55 * Container for an X.509 certificate. The certificate may be chained.
HannesTschofenig 0:796d0f61a05b 56 */
HannesTschofenig 0:796d0f61a05b 57 typedef struct _x509_crt
HannesTschofenig 0:796d0f61a05b 58 {
HannesTschofenig 0:796d0f61a05b 59 x509_buf raw; /**< The raw certificate data (DER). */
HannesTschofenig 0:796d0f61a05b 60 x509_buf tbs; /**< The raw certificate body (DER). The part that is To Be Signed. */
HannesTschofenig 0:796d0f61a05b 61
HannesTschofenig 0:796d0f61a05b 62 int version; /**< The X.509 version. (0=v1, 1=v2, 2=v3) */
HannesTschofenig 0:796d0f61a05b 63 x509_buf serial; /**< Unique id for certificate issued by a specific CA. */
HannesTschofenig 0:796d0f61a05b 64 x509_buf sig_oid1; /**< Signature algorithm, e.g. sha1RSA */
HannesTschofenig 0:796d0f61a05b 65
HannesTschofenig 0:796d0f61a05b 66 x509_buf issuer_raw; /**< The raw issuer data (DER). Used for quick comparison. */
HannesTschofenig 0:796d0f61a05b 67 x509_buf subject_raw; /**< The raw subject data (DER). Used for quick comparison. */
HannesTschofenig 0:796d0f61a05b 68
HannesTschofenig 0:796d0f61a05b 69 x509_name issuer; /**< The parsed issuer data (named information object). */
HannesTschofenig 0:796d0f61a05b 70 x509_name subject; /**< The parsed subject data (named information object). */
HannesTschofenig 0:796d0f61a05b 71
HannesTschofenig 0:796d0f61a05b 72 x509_time valid_from; /**< Start time of certificate validity. */
HannesTschofenig 0:796d0f61a05b 73 x509_time valid_to; /**< End time of certificate validity. */
HannesTschofenig 0:796d0f61a05b 74
HannesTschofenig 0:796d0f61a05b 75 pk_context pk; /**< Container for the public key context. */
HannesTschofenig 0:796d0f61a05b 76
HannesTschofenig 0:796d0f61a05b 77 x509_buf issuer_id; /**< Optional X.509 v2/v3 issuer unique identifier. */
HannesTschofenig 0:796d0f61a05b 78 x509_buf subject_id; /**< Optional X.509 v2/v3 subject unique identifier. */
HannesTschofenig 0:796d0f61a05b 79 x509_buf v3_ext; /**< Optional X.509 v3 extensions. */
HannesTschofenig 0:796d0f61a05b 80 x509_sequence subject_alt_names; /**< Optional list of Subject Alternative Names (Only dNSName supported). */
HannesTschofenig 0:796d0f61a05b 81
HannesTschofenig 0:796d0f61a05b 82 int ext_types; /**< Bit string containing detected and parsed extensions */
HannesTschofenig 0:796d0f61a05b 83 int ca_istrue; /**< Optional Basic Constraint extension value: 1 if this certificate belongs to a CA, 0 otherwise. */
HannesTschofenig 0:796d0f61a05b 84 int max_pathlen; /**< Optional Basic Constraint extension value: The maximum path length to the root certificate. Path length is 1 higher than RFC 5280 'meaning', so 1+ */
HannesTschofenig 0:796d0f61a05b 85
HannesTschofenig 0:796d0f61a05b 86 unsigned char key_usage; /**< Optional key usage extension value: See the values in x509.h */
HannesTschofenig 0:796d0f61a05b 87
HannesTschofenig 0:796d0f61a05b 88 x509_sequence ext_key_usage; /**< Optional list of extended key usage OIDs. */
HannesTschofenig 0:796d0f61a05b 89
HannesTschofenig 0:796d0f61a05b 90 unsigned char ns_cert_type; /**< Optional Netscape certificate type extension value: See the values in x509.h */
HannesTschofenig 0:796d0f61a05b 91
HannesTschofenig 0:796d0f61a05b 92 x509_buf sig_oid2; /**< Signature algorithm. Must match sig_oid1. */
HannesTschofenig 0:796d0f61a05b 93 x509_buf sig; /**< Signature: hash of the tbs part signed with the private key. */
HannesTschofenig 0:796d0f61a05b 94 md_type_t sig_md; /**< Internal representation of the MD algorithm of the signature algorithm, e.g. POLARSSL_MD_SHA256 */
HannesTschofenig 0:796d0f61a05b 95 pk_type_t sig_pk /**< Internal representation of the Public Key algorithm of the signature algorithm, e.g. POLARSSL_PK_RSA */;
HannesTschofenig 0:796d0f61a05b 96
HannesTschofenig 0:796d0f61a05b 97 struct _x509_crt *next; /**< Next certificate in the CA-chain. */
HannesTschofenig 0:796d0f61a05b 98 }
HannesTschofenig 0:796d0f61a05b 99 x509_crt;
HannesTschofenig 0:796d0f61a05b 100
HannesTschofenig 0:796d0f61a05b 101 #define X509_CRT_VERSION_1 0
HannesTschofenig 0:796d0f61a05b 102 #define X509_CRT_VERSION_2 1
HannesTschofenig 0:796d0f61a05b 103 #define X509_CRT_VERSION_3 2
HannesTschofenig 0:796d0f61a05b 104
HannesTschofenig 0:796d0f61a05b 105 #define X509_RFC5280_MAX_SERIAL_LEN 32
HannesTschofenig 0:796d0f61a05b 106 #define X509_RFC5280_UTC_TIME_LEN 15
HannesTschofenig 0:796d0f61a05b 107
HannesTschofenig 0:796d0f61a05b 108 /**
HannesTschofenig 0:796d0f61a05b 109 * Container for writing a certificate (CRT)
HannesTschofenig 0:796d0f61a05b 110 */
HannesTschofenig 0:796d0f61a05b 111 typedef struct _x509write_cert
HannesTschofenig 0:796d0f61a05b 112 {
HannesTschofenig 0:796d0f61a05b 113 int version;
HannesTschofenig 0:796d0f61a05b 114 mpi serial;
HannesTschofenig 0:796d0f61a05b 115 pk_context *subject_key;
HannesTschofenig 0:796d0f61a05b 116 pk_context *issuer_key;
HannesTschofenig 0:796d0f61a05b 117 asn1_named_data *subject;
HannesTschofenig 0:796d0f61a05b 118 asn1_named_data *issuer;
HannesTschofenig 0:796d0f61a05b 119 md_type_t md_alg;
HannesTschofenig 0:796d0f61a05b 120 char not_before[X509_RFC5280_UTC_TIME_LEN + 1];
HannesTschofenig 0:796d0f61a05b 121 char not_after[X509_RFC5280_UTC_TIME_LEN + 1];
HannesTschofenig 0:796d0f61a05b 122 asn1_named_data *extensions;
HannesTschofenig 0:796d0f61a05b 123 }
HannesTschofenig 0:796d0f61a05b 124 x509write_cert;
HannesTschofenig 0:796d0f61a05b 125
HannesTschofenig 0:796d0f61a05b 126 #if defined(POLARSSL_X509_CRT_PARSE_C)
HannesTschofenig 0:796d0f61a05b 127 /**
HannesTschofenig 0:796d0f61a05b 128 * \brief Parse a single DER formatted certificate and add it
HannesTschofenig 0:796d0f61a05b 129 * to the chained list.
HannesTschofenig 0:796d0f61a05b 130 *
HannesTschofenig 0:796d0f61a05b 131 * \param chain points to the start of the chain
HannesTschofenig 0:796d0f61a05b 132 * \param buf buffer holding the certificate DER data
HannesTschofenig 0:796d0f61a05b 133 * \param buflen size of the buffer
HannesTschofenig 0:796d0f61a05b 134 *
HannesTschofenig 0:796d0f61a05b 135 * \return 0 if successful, or a specific X509 or PEM error code
HannesTschofenig 0:796d0f61a05b 136 */
HannesTschofenig 0:796d0f61a05b 137 int x509_crt_parse_der( x509_crt *chain, const unsigned char *buf,
HannesTschofenig 0:796d0f61a05b 138 size_t buflen );
HannesTschofenig 0:796d0f61a05b 139
HannesTschofenig 0:796d0f61a05b 140 /**
HannesTschofenig 0:796d0f61a05b 141 * \brief Parse one or more certificates and add them
HannesTschofenig 0:796d0f61a05b 142 * to the chained list. Parses permissively. If some
HannesTschofenig 0:796d0f61a05b 143 * certificates can be parsed, the result is the number
HannesTschofenig 0:796d0f61a05b 144 * of failed certificates it encountered. If none complete
HannesTschofenig 0:796d0f61a05b 145 * correctly, the first error is returned.
HannesTschofenig 0:796d0f61a05b 146 *
HannesTschofenig 0:796d0f61a05b 147 * \param chain points to the start of the chain
HannesTschofenig 0:796d0f61a05b 148 * \param buf buffer holding the certificate data
HannesTschofenig 0:796d0f61a05b 149 * \param buflen size of the buffer
HannesTschofenig 0:796d0f61a05b 150 *
HannesTschofenig 0:796d0f61a05b 151 * \return 0 if all certificates parsed successfully, a positive number
HannesTschofenig 0:796d0f61a05b 152 * if partly successful or a specific X509 or PEM error code
HannesTschofenig 0:796d0f61a05b 153 */
HannesTschofenig 0:796d0f61a05b 154 int x509_crt_parse( x509_crt *chain, const unsigned char *buf, size_t buflen );
HannesTschofenig 0:796d0f61a05b 155
HannesTschofenig 0:796d0f61a05b 156 #if defined(POLARSSL_FS_IO)
HannesTschofenig 0:796d0f61a05b 157 /**
HannesTschofenig 0:796d0f61a05b 158 * \brief Load one or more certificates and add them
HannesTschofenig 0:796d0f61a05b 159 * to the chained list. Parses permissively. If some
HannesTschofenig 0:796d0f61a05b 160 * certificates can be parsed, the result is the number
HannesTschofenig 0:796d0f61a05b 161 * of failed certificates it encountered. If none complete
HannesTschofenig 0:796d0f61a05b 162 * correctly, the first error is returned.
HannesTschofenig 0:796d0f61a05b 163 *
HannesTschofenig 0:796d0f61a05b 164 * \param chain points to the start of the chain
HannesTschofenig 0:796d0f61a05b 165 * \param path filename to read the certificates from
HannesTschofenig 0:796d0f61a05b 166 *
HannesTschofenig 0:796d0f61a05b 167 * \return 0 if all certificates parsed successfully, a positive number
HannesTschofenig 0:796d0f61a05b 168 * if partly successful or a specific X509 or PEM error code
HannesTschofenig 0:796d0f61a05b 169 */
HannesTschofenig 0:796d0f61a05b 170 int x509_crt_parse_file( x509_crt *chain, const char *path );
HannesTschofenig 0:796d0f61a05b 171
HannesTschofenig 0:796d0f61a05b 172 /**
HannesTschofenig 0:796d0f61a05b 173 * \brief Load one or more certificate files from a path and add them
HannesTschofenig 0:796d0f61a05b 174 * to the chained list. Parses permissively. If some
HannesTschofenig 0:796d0f61a05b 175 * certificates can be parsed, the result is the number
HannesTschofenig 0:796d0f61a05b 176 * of failed certificates it encountered. If none complete
HannesTschofenig 0:796d0f61a05b 177 * correctly, the first error is returned.
HannesTschofenig 0:796d0f61a05b 178 *
HannesTschofenig 0:796d0f61a05b 179 * \warning This function is NOT thread-safe unless
HannesTschofenig 0:796d0f61a05b 180 * POLARSSL_THREADING_PTHREADS is defined. If you're using an
HannesTschofenig 0:796d0f61a05b 181 * alternative threading implementation, you should either use
HannesTschofenig 0:796d0f61a05b 182 * this function only in the main thread, or mutex it.
HannesTschofenig 0:796d0f61a05b 183 *
HannesTschofenig 0:796d0f61a05b 184 * \param chain points to the start of the chain
HannesTschofenig 0:796d0f61a05b 185 * \param path directory / folder to read the certificate files from
HannesTschofenig 0:796d0f61a05b 186 *
HannesTschofenig 0:796d0f61a05b 187 * \return 0 if all certificates parsed successfully, a positive number
HannesTschofenig 0:796d0f61a05b 188 * if partly successful or a specific X509 or PEM error code
HannesTschofenig 0:796d0f61a05b 189 */
HannesTschofenig 0:796d0f61a05b 190 int x509_crt_parse_path( x509_crt *chain, const char *path );
HannesTschofenig 0:796d0f61a05b 191 #endif /* POLARSSL_FS_IO */
HannesTschofenig 0:796d0f61a05b 192
HannesTschofenig 0:796d0f61a05b 193 /**
HannesTschofenig 0:796d0f61a05b 194 * \brief Returns an informational string about the
HannesTschofenig 0:796d0f61a05b 195 * certificate.
HannesTschofenig 0:796d0f61a05b 196 *
HannesTschofenig 0:796d0f61a05b 197 * \param buf Buffer to write to
HannesTschofenig 0:796d0f61a05b 198 * \param size Maximum size of buffer
HannesTschofenig 0:796d0f61a05b 199 * \param prefix A line prefix
HannesTschofenig 0:796d0f61a05b 200 * \param crt The X509 certificate to represent
HannesTschofenig 0:796d0f61a05b 201 *
HannesTschofenig 0:796d0f61a05b 202 * \return The amount of data written to the buffer, or -1 in
HannesTschofenig 0:796d0f61a05b 203 * case of an error.
HannesTschofenig 0:796d0f61a05b 204 */
HannesTschofenig 0:796d0f61a05b 205 int x509_crt_info( char *buf, size_t size, const char *prefix,
HannesTschofenig 0:796d0f61a05b 206 const x509_crt *crt );
HannesTschofenig 0:796d0f61a05b 207
HannesTschofenig 0:796d0f61a05b 208 /**
HannesTschofenig 0:796d0f61a05b 209 * \brief Verify the certificate signature
HannesTschofenig 0:796d0f61a05b 210 *
HannesTschofenig 0:796d0f61a05b 211 * The verify callback is a user-supplied callback that
HannesTschofenig 0:796d0f61a05b 212 * can clear / modify / add flags for a certificate. If set,
HannesTschofenig 0:796d0f61a05b 213 * the verification callback is called for each
HannesTschofenig 0:796d0f61a05b 214 * certificate in the chain (from the trust-ca down to the
HannesTschofenig 0:796d0f61a05b 215 * presented crt). The parameters for the callback are:
HannesTschofenig 0:796d0f61a05b 216 * (void *parameter, x509_crt *crt, int certificate_depth,
HannesTschofenig 0:796d0f61a05b 217 * int *flags). With the flags representing current flags for
HannesTschofenig 0:796d0f61a05b 218 * that specific certificate and the certificate depth from
HannesTschofenig 0:796d0f61a05b 219 * the bottom (Peer cert depth = 0).
HannesTschofenig 0:796d0f61a05b 220 *
HannesTschofenig 0:796d0f61a05b 221 * All flags left after returning from the callback
HannesTschofenig 0:796d0f61a05b 222 * are also returned to the application. The function should
HannesTschofenig 0:796d0f61a05b 223 * return 0 for anything but a fatal error.
HannesTschofenig 0:796d0f61a05b 224 *
HannesTschofenig 0:796d0f61a05b 225 * \param crt a certificate to be verified
HannesTschofenig 0:796d0f61a05b 226 * \param trust_ca the trusted CA chain
HannesTschofenig 0:796d0f61a05b 227 * \param ca_crl the CRL chain for trusted CA's
HannesTschofenig 0:796d0f61a05b 228 * \param cn expected Common Name (can be set to
HannesTschofenig 0:796d0f61a05b 229 * NULL if the CN must not be verified)
HannesTschofenig 0:796d0f61a05b 230 * \param flags result of the verification
HannesTschofenig 0:796d0f61a05b 231 * \param f_vrfy verification function
HannesTschofenig 0:796d0f61a05b 232 * \param p_vrfy verification parameter
HannesTschofenig 0:796d0f61a05b 233 *
HannesTschofenig 0:796d0f61a05b 234 * \return 0 if successful or POLARSSL_ERR_X509_SIG_VERIFY_FAILED,
HannesTschofenig 0:796d0f61a05b 235 * in which case *flags will have one or more of
HannesTschofenig 0:796d0f61a05b 236 * the following values set:
HannesTschofenig 0:796d0f61a05b 237 * BADCERT_EXPIRED --
HannesTschofenig 0:796d0f61a05b 238 * BADCERT_REVOKED --
HannesTschofenig 0:796d0f61a05b 239 * BADCERT_CN_MISMATCH --
HannesTschofenig 0:796d0f61a05b 240 * BADCERT_NOT_TRUSTED
HannesTschofenig 0:796d0f61a05b 241 * or another error in case of a fatal error encountered
HannesTschofenig 0:796d0f61a05b 242 * during the verification process.
HannesTschofenig 0:796d0f61a05b 243 */
HannesTschofenig 0:796d0f61a05b 244 int x509_crt_verify( x509_crt *crt,
HannesTschofenig 0:796d0f61a05b 245 x509_crt *trust_ca,
HannesTschofenig 0:796d0f61a05b 246 x509_crl *ca_crl,
HannesTschofenig 0:796d0f61a05b 247 const char *cn, int *flags,
HannesTschofenig 0:796d0f61a05b 248 int (*f_vrfy)(void *, x509_crt *, int, int *),
HannesTschofenig 0:796d0f61a05b 249 void *p_vrfy );
HannesTschofenig 0:796d0f61a05b 250
HannesTschofenig 0:796d0f61a05b 251 #if defined(POLARSSL_X509_CHECK_KEY_USAGE)
HannesTschofenig 0:796d0f61a05b 252 /**
HannesTschofenig 0:796d0f61a05b 253 * \brief Check usage of certificate against keyUsage extension.
HannesTschofenig 0:796d0f61a05b 254 *
HannesTschofenig 0:796d0f61a05b 255 * \param crt Leaf certificate used.
HannesTschofenig 0:796d0f61a05b 256 * \param usage Intended usage(s) (eg KU_KEY_ENCIPHERMENT before using the
HannesTschofenig 0:796d0f61a05b 257 * certificate to perform an RSA key exchange).
HannesTschofenig 0:796d0f61a05b 258 *
HannesTschofenig 0:796d0f61a05b 259 * \return 0 is these uses of the certificate are allowed,
HannesTschofenig 0:796d0f61a05b 260 * POLARSSL_ERR_X509_BAD_INPUT_DATA if the keyUsage extension
HannesTschofenig 0:796d0f61a05b 261 * is present but does not contain all the bits set in the
HannesTschofenig 0:796d0f61a05b 262 * usage argument.
HannesTschofenig 0:796d0f61a05b 263 *
HannesTschofenig 0:796d0f61a05b 264 * \note You should only call this function on leaf certificates, on
HannesTschofenig 0:796d0f61a05b 265 * (intermediate) CAs the keyUsage extension is automatically
HannesTschofenig 0:796d0f61a05b 266 * checked by \c x509_crt_verify().
HannesTschofenig 0:796d0f61a05b 267 */
HannesTschofenig 0:796d0f61a05b 268 int x509_crt_check_key_usage( const x509_crt *crt, int usage );
HannesTschofenig 0:796d0f61a05b 269 #endif /* POLARSSL_X509_CHECK_KEY_USAGE) */
HannesTschofenig 0:796d0f61a05b 270
HannesTschofenig 0:796d0f61a05b 271 #if defined(POLARSSL_X509_CHECK_EXTENDED_KEY_USAGE)
HannesTschofenig 0:796d0f61a05b 272 /**
HannesTschofenig 0:796d0f61a05b 273 * \brief Check usage of certificate against extentedJeyUsage.
HannesTschofenig 0:796d0f61a05b 274 *
HannesTschofenig 0:796d0f61a05b 275 * \param crt Leaf certificate used.
HannesTschofenig 0:796d0f61a05b 276 * \param usage_oid Intended usage (eg OID_SERVER_AUTH or OID_CLIENT_AUTH).
HannesTschofenig 0:796d0f61a05b 277 * \param usage_len Length of usage_oid (eg given by OID_SIZE()).
HannesTschofenig 0:796d0f61a05b 278 *
HannesTschofenig 0:796d0f61a05b 279 * \return 0 is this use of the certificate is allowed,
HannesTschofenig 0:796d0f61a05b 280 * POLARSSL_ERR_X509_BAD_INPUT_DATA if not.
HannesTschofenig 0:796d0f61a05b 281 *
HannesTschofenig 0:796d0f61a05b 282 * \note Usually only makes sense on leaf certificates.
HannesTschofenig 0:796d0f61a05b 283 */
HannesTschofenig 0:796d0f61a05b 284 int x509_crt_check_extended_key_usage( const x509_crt *crt,
HannesTschofenig 0:796d0f61a05b 285 const char *usage_oid,
HannesTschofenig 0:796d0f61a05b 286 size_t usage_len );
HannesTschofenig 0:796d0f61a05b 287 #endif /* POLARSSL_X509_CHECK_EXTENDED_KEY_USAGE) */
HannesTschofenig 0:796d0f61a05b 288
HannesTschofenig 0:796d0f61a05b 289 #if defined(POLARSSL_X509_CRL_PARSE_C)
HannesTschofenig 0:796d0f61a05b 290 /**
HannesTschofenig 0:796d0f61a05b 291 * \brief Verify the certificate revocation status
HannesTschofenig 0:796d0f61a05b 292 *
HannesTschofenig 0:796d0f61a05b 293 * \param crt a certificate to be verified
HannesTschofenig 0:796d0f61a05b 294 * \param crl the CRL to verify against
HannesTschofenig 0:796d0f61a05b 295 *
HannesTschofenig 0:796d0f61a05b 296 * \return 1 if the certificate is revoked, 0 otherwise
HannesTschofenig 0:796d0f61a05b 297 *
HannesTschofenig 0:796d0f61a05b 298 */
HannesTschofenig 0:796d0f61a05b 299 int x509_crt_revoked( const x509_crt *crt, const x509_crl *crl );
HannesTschofenig 0:796d0f61a05b 300 #endif /* POLARSSL_X509_CRL_PARSE_C */
HannesTschofenig 0:796d0f61a05b 301
HannesTschofenig 0:796d0f61a05b 302 /**
HannesTschofenig 0:796d0f61a05b 303 * \brief Initialize a certificate (chain)
HannesTschofenig 0:796d0f61a05b 304 *
HannesTschofenig 0:796d0f61a05b 305 * \param crt Certificate chain to initialize
HannesTschofenig 0:796d0f61a05b 306 */
HannesTschofenig 0:796d0f61a05b 307 void x509_crt_init( x509_crt *crt );
HannesTschofenig 0:796d0f61a05b 308
HannesTschofenig 0:796d0f61a05b 309 /**
HannesTschofenig 0:796d0f61a05b 310 * \brief Unallocate all certificate data
HannesTschofenig 0:796d0f61a05b 311 *
HannesTschofenig 0:796d0f61a05b 312 * \param crt Certificate chain to free
HannesTschofenig 0:796d0f61a05b 313 */
HannesTschofenig 0:796d0f61a05b 314 void x509_crt_free( x509_crt *crt );
HannesTschofenig 0:796d0f61a05b 315 #endif /* POLARSSL_X509_CRT_PARSE_C */
HannesTschofenig 0:796d0f61a05b 316
HannesTschofenig 0:796d0f61a05b 317 /* \} name */
HannesTschofenig 0:796d0f61a05b 318 /* \} addtogroup x509_module */
HannesTschofenig 0:796d0f61a05b 319
HannesTschofenig 0:796d0f61a05b 320 #if defined(POLARSSL_X509_CRT_WRITE_C)
HannesTschofenig 0:796d0f61a05b 321 /**
HannesTschofenig 0:796d0f61a05b 322 * \brief Initialize a CRT writing context
HannesTschofenig 0:796d0f61a05b 323 *
HannesTschofenig 0:796d0f61a05b 324 * \param ctx CRT context to initialize
HannesTschofenig 0:796d0f61a05b 325 */
HannesTschofenig 0:796d0f61a05b 326 void x509write_crt_init( x509write_cert *ctx );
HannesTschofenig 0:796d0f61a05b 327
HannesTschofenig 0:796d0f61a05b 328 /**
HannesTschofenig 0:796d0f61a05b 329 * \brief Set the verion for a Certificate
HannesTschofenig 0:796d0f61a05b 330 * Default: X509_CRT_VERSION_3
HannesTschofenig 0:796d0f61a05b 331 *
HannesTschofenig 0:796d0f61a05b 332 * \param ctx CRT context to use
HannesTschofenig 0:796d0f61a05b 333 * \param version version to set (X509_CRT_VERSION_1, X509_CRT_VERSION_2 or
HannesTschofenig 0:796d0f61a05b 334 * X509_CRT_VERSION_3)
HannesTschofenig 0:796d0f61a05b 335 */
HannesTschofenig 0:796d0f61a05b 336 void x509write_crt_set_version( x509write_cert *ctx, int version );
HannesTschofenig 0:796d0f61a05b 337
HannesTschofenig 0:796d0f61a05b 338 /**
HannesTschofenig 0:796d0f61a05b 339 * \brief Set the serial number for a Certificate.
HannesTschofenig 0:796d0f61a05b 340 *
HannesTschofenig 0:796d0f61a05b 341 * \param ctx CRT context to use
HannesTschofenig 0:796d0f61a05b 342 * \param serial serial number to set
HannesTschofenig 0:796d0f61a05b 343 *
HannesTschofenig 0:796d0f61a05b 344 * \return 0 if successful
HannesTschofenig 0:796d0f61a05b 345 */
HannesTschofenig 0:796d0f61a05b 346 int x509write_crt_set_serial( x509write_cert *ctx, const mpi *serial );
HannesTschofenig 0:796d0f61a05b 347
HannesTschofenig 0:796d0f61a05b 348 /**
HannesTschofenig 0:796d0f61a05b 349 * \brief Set the validity period for a Certificate
HannesTschofenig 0:796d0f61a05b 350 * Timestamps should be in string format for UTC timezone
HannesTschofenig 0:796d0f61a05b 351 * i.e. "YYYYMMDDhhmmss"
HannesTschofenig 0:796d0f61a05b 352 * e.g. "20131231235959" for December 31st 2013
HannesTschofenig 0:796d0f61a05b 353 * at 23:59:59
HannesTschofenig 0:796d0f61a05b 354 *
HannesTschofenig 0:796d0f61a05b 355 * \param ctx CRT context to use
HannesTschofenig 0:796d0f61a05b 356 * \param not_before not_before timestamp
HannesTschofenig 0:796d0f61a05b 357 * \param not_after not_after timestamp
HannesTschofenig 0:796d0f61a05b 358 *
HannesTschofenig 0:796d0f61a05b 359 * \return 0 if timestamp was parsed successfully, or
HannesTschofenig 0:796d0f61a05b 360 * a specific error code
HannesTschofenig 0:796d0f61a05b 361 */
HannesTschofenig 0:796d0f61a05b 362 int x509write_crt_set_validity( x509write_cert *ctx, const char *not_before,
HannesTschofenig 0:796d0f61a05b 363 const char *not_after );
HannesTschofenig 0:796d0f61a05b 364
HannesTschofenig 0:796d0f61a05b 365 /**
HannesTschofenig 0:796d0f61a05b 366 * \brief Set the issuer name for a Certificate
HannesTschofenig 0:796d0f61a05b 367 * Issuer names should contain a comma-separated list
HannesTschofenig 0:796d0f61a05b 368 * of OID types and values:
HannesTschofenig 0:796d0f61a05b 369 * e.g. "C=NL,O=Offspark,CN=PolarSSL CA"
HannesTschofenig 0:796d0f61a05b 370 *
HannesTschofenig 0:796d0f61a05b 371 * \param ctx CRT context to use
HannesTschofenig 0:796d0f61a05b 372 * \param issuer_name issuer name to set
HannesTschofenig 0:796d0f61a05b 373 *
HannesTschofenig 0:796d0f61a05b 374 * \return 0 if issuer name was parsed successfully, or
HannesTschofenig 0:796d0f61a05b 375 * a specific error code
HannesTschofenig 0:796d0f61a05b 376 */
HannesTschofenig 0:796d0f61a05b 377 int x509write_crt_set_issuer_name( x509write_cert *ctx,
HannesTschofenig 0:796d0f61a05b 378 const char *issuer_name );
HannesTschofenig 0:796d0f61a05b 379
HannesTschofenig 0:796d0f61a05b 380 /**
HannesTschofenig 0:796d0f61a05b 381 * \brief Set the subject name for a Certificate
HannesTschofenig 0:796d0f61a05b 382 * Subject names should contain a comma-separated list
HannesTschofenig 0:796d0f61a05b 383 * of OID types and values:
HannesTschofenig 0:796d0f61a05b 384 * e.g. "C=NL,O=Offspark,CN=PolarSSL Server 1"
HannesTschofenig 0:796d0f61a05b 385 *
HannesTschofenig 0:796d0f61a05b 386 * \param ctx CRT context to use
HannesTschofenig 0:796d0f61a05b 387 * \param subject_name subject name to set
HannesTschofenig 0:796d0f61a05b 388 *
HannesTschofenig 0:796d0f61a05b 389 * \return 0 if subject name was parsed successfully, or
HannesTschofenig 0:796d0f61a05b 390 * a specific error code
HannesTschofenig 0:796d0f61a05b 391 */
HannesTschofenig 0:796d0f61a05b 392 int x509write_crt_set_subject_name( x509write_cert *ctx,
HannesTschofenig 0:796d0f61a05b 393 const char *subject_name );
HannesTschofenig 0:796d0f61a05b 394
HannesTschofenig 0:796d0f61a05b 395 /**
HannesTschofenig 0:796d0f61a05b 396 * \brief Set the subject public key for the certificate
HannesTschofenig 0:796d0f61a05b 397 *
HannesTschofenig 0:796d0f61a05b 398 * \param ctx CRT context to use
HannesTschofenig 0:796d0f61a05b 399 * \param key public key to include
HannesTschofenig 0:796d0f61a05b 400 */
HannesTschofenig 0:796d0f61a05b 401 void x509write_crt_set_subject_key( x509write_cert *ctx, pk_context *key );
HannesTschofenig 0:796d0f61a05b 402
HannesTschofenig 0:796d0f61a05b 403 /**
HannesTschofenig 0:796d0f61a05b 404 * \brief Set the issuer key used for signing the certificate
HannesTschofenig 0:796d0f61a05b 405 *
HannesTschofenig 0:796d0f61a05b 406 * \param ctx CRT context to use
HannesTschofenig 0:796d0f61a05b 407 * \param key private key to sign with
HannesTschofenig 0:796d0f61a05b 408 */
HannesTschofenig 0:796d0f61a05b 409 void x509write_crt_set_issuer_key( x509write_cert *ctx, pk_context *key );
HannesTschofenig 0:796d0f61a05b 410
HannesTschofenig 0:796d0f61a05b 411 /**
HannesTschofenig 0:796d0f61a05b 412 * \brief Set the MD algorithm to use for the signature
HannesTschofenig 0:796d0f61a05b 413 * (e.g. POLARSSL_MD_SHA1)
HannesTschofenig 0:796d0f61a05b 414 *
HannesTschofenig 0:796d0f61a05b 415 * \param ctx CRT context to use
HannesTschofenig 0:796d0f61a05b 416 * \param md_alg MD algorithm to use
HannesTschofenig 0:796d0f61a05b 417 */
HannesTschofenig 0:796d0f61a05b 418 void x509write_crt_set_md_alg( x509write_cert *ctx, md_type_t md_alg );
HannesTschofenig 0:796d0f61a05b 419
HannesTschofenig 0:796d0f61a05b 420 /**
HannesTschofenig 0:796d0f61a05b 421 * \brief Generic function to add to or replace an extension in the
HannesTschofenig 0:796d0f61a05b 422 * CRT
HannesTschofenig 0:796d0f61a05b 423 *
HannesTschofenig 0:796d0f61a05b 424 * \param ctx CRT context to use
HannesTschofenig 0:796d0f61a05b 425 * \param oid OID of the extension
HannesTschofenig 0:796d0f61a05b 426 * \param oid_len length of the OID
HannesTschofenig 0:796d0f61a05b 427 * \param critical if the extension is critical (per the RFC's definition)
HannesTschofenig 0:796d0f61a05b 428 * \param val value of the extension OCTET STRING
HannesTschofenig 0:796d0f61a05b 429 * \param val_len length of the value data
HannesTschofenig 0:796d0f61a05b 430 *
HannesTschofenig 0:796d0f61a05b 431 * \return 0 if successful, or a POLARSSL_ERR_X509WRITE_MALLOC_FAILED
HannesTschofenig 0:796d0f61a05b 432 */
HannesTschofenig 0:796d0f61a05b 433 int x509write_crt_set_extension( x509write_cert *ctx,
HannesTschofenig 0:796d0f61a05b 434 const char *oid, size_t oid_len,
HannesTschofenig 0:796d0f61a05b 435 int critical,
HannesTschofenig 0:796d0f61a05b 436 const unsigned char *val, size_t val_len );
HannesTschofenig 0:796d0f61a05b 437
HannesTschofenig 0:796d0f61a05b 438 /**
HannesTschofenig 0:796d0f61a05b 439 * \brief Set the basicConstraints extension for a CRT
HannesTschofenig 0:796d0f61a05b 440 *
HannesTschofenig 0:796d0f61a05b 441 * \param ctx CRT context to use
HannesTschofenig 0:796d0f61a05b 442 * \param is_ca is this a CA certificate
HannesTschofenig 0:796d0f61a05b 443 * \param max_pathlen maximum length of certificate chains below this
HannesTschofenig 0:796d0f61a05b 444 * certificate (only for CA certificates, -1 is
HannesTschofenig 0:796d0f61a05b 445 * inlimited)
HannesTschofenig 0:796d0f61a05b 446 *
HannesTschofenig 0:796d0f61a05b 447 * \return 0 if successful, or a POLARSSL_ERR_X509WRITE_MALLOC_FAILED
HannesTschofenig 0:796d0f61a05b 448 */
HannesTschofenig 0:796d0f61a05b 449 int x509write_crt_set_basic_constraints( x509write_cert *ctx,
HannesTschofenig 0:796d0f61a05b 450 int is_ca, int max_pathlen );
HannesTschofenig 0:796d0f61a05b 451
HannesTschofenig 0:796d0f61a05b 452 #if defined(POLARSSL_SHA1_C)
HannesTschofenig 0:796d0f61a05b 453 /**
HannesTschofenig 0:796d0f61a05b 454 * \brief Set the subjectKeyIdentifier extension for a CRT
HannesTschofenig 0:796d0f61a05b 455 * Requires that x509write_crt_set_subject_key() has been
HannesTschofenig 0:796d0f61a05b 456 * called before
HannesTschofenig 0:796d0f61a05b 457 *
HannesTschofenig 0:796d0f61a05b 458 * \param ctx CRT context to use
HannesTschofenig 0:796d0f61a05b 459 *
HannesTschofenig 0:796d0f61a05b 460 * \return 0 if successful, or a POLARSSL_ERR_X509WRITE_MALLOC_FAILED
HannesTschofenig 0:796d0f61a05b 461 */
HannesTschofenig 0:796d0f61a05b 462 int x509write_crt_set_subject_key_identifier( x509write_cert *ctx );
HannesTschofenig 0:796d0f61a05b 463
HannesTschofenig 0:796d0f61a05b 464 /**
HannesTschofenig 0:796d0f61a05b 465 * \brief Set the authorityKeyIdentifier extension for a CRT
HannesTschofenig 0:796d0f61a05b 466 * Requires that x509write_crt_set_issuer_key() has been
HannesTschofenig 0:796d0f61a05b 467 * called before
HannesTschofenig 0:796d0f61a05b 468 *
HannesTschofenig 0:796d0f61a05b 469 * \param ctx CRT context to use
HannesTschofenig 0:796d0f61a05b 470 *
HannesTschofenig 0:796d0f61a05b 471 * \return 0 if successful, or a POLARSSL_ERR_X509WRITE_MALLOC_FAILED
HannesTschofenig 0:796d0f61a05b 472 */
HannesTschofenig 0:796d0f61a05b 473 int x509write_crt_set_authority_key_identifier( x509write_cert *ctx );
HannesTschofenig 0:796d0f61a05b 474 #endif /* POLARSSL_SHA1_C */
HannesTschofenig 0:796d0f61a05b 475
HannesTschofenig 0:796d0f61a05b 476 /**
HannesTschofenig 0:796d0f61a05b 477 * \brief Set the Key Usage Extension flags
HannesTschofenig 0:796d0f61a05b 478 * (e.g. KU_DIGITAL_SIGNATURE | KU_KEY_CERT_SIGN)
HannesTschofenig 0:796d0f61a05b 479 *
HannesTschofenig 0:796d0f61a05b 480 * \param ctx CRT context to use
HannesTschofenig 0:796d0f61a05b 481 * \param key_usage key usage flags to set
HannesTschofenig 0:796d0f61a05b 482 *
HannesTschofenig 0:796d0f61a05b 483 * \return 0 if successful, or POLARSSL_ERR_X509WRITE_MALLOC_FAILED
HannesTschofenig 0:796d0f61a05b 484 */
HannesTschofenig 0:796d0f61a05b 485 int x509write_crt_set_key_usage( x509write_cert *ctx, unsigned char key_usage );
HannesTschofenig 0:796d0f61a05b 486
HannesTschofenig 0:796d0f61a05b 487 /**
HannesTschofenig 0:796d0f61a05b 488 * \brief Set the Netscape Cert Type flags
HannesTschofenig 0:796d0f61a05b 489 * (e.g. NS_CERT_TYPE_SSL_CLIENT | NS_CERT_TYPE_EMAIL)
HannesTschofenig 0:796d0f61a05b 490 *
HannesTschofenig 0:796d0f61a05b 491 * \param ctx CRT context to use
HannesTschofenig 0:796d0f61a05b 492 * \param ns_cert_type Netscape Cert Type flags to set
HannesTschofenig 0:796d0f61a05b 493 *
HannesTschofenig 0:796d0f61a05b 494 * \return 0 if successful, or POLARSSL_ERR_X509WRITE_MALLOC_FAILED
HannesTschofenig 0:796d0f61a05b 495 */
HannesTschofenig 0:796d0f61a05b 496 int x509write_crt_set_ns_cert_type( x509write_cert *ctx,
HannesTschofenig 0:796d0f61a05b 497 unsigned char ns_cert_type );
HannesTschofenig 0:796d0f61a05b 498
HannesTschofenig 0:796d0f61a05b 499 /**
HannesTschofenig 0:796d0f61a05b 500 * \brief Free the contents of a CRT write context
HannesTschofenig 0:796d0f61a05b 501 *
HannesTschofenig 0:796d0f61a05b 502 * \param ctx CRT context to free
HannesTschofenig 0:796d0f61a05b 503 */
HannesTschofenig 0:796d0f61a05b 504 void x509write_crt_free( x509write_cert *ctx );
HannesTschofenig 0:796d0f61a05b 505
HannesTschofenig 0:796d0f61a05b 506 /**
HannesTschofenig 0:796d0f61a05b 507 * \brief Write a built up certificate to a X509 DER structure
HannesTschofenig 0:796d0f61a05b 508 * Note: data is written at the end of the buffer! Use the
HannesTschofenig 0:796d0f61a05b 509 * return value to determine where you should start
HannesTschofenig 0:796d0f61a05b 510 * using the buffer
HannesTschofenig 0:796d0f61a05b 511 *
HannesTschofenig 0:796d0f61a05b 512 * \param ctx certificate to write away
HannesTschofenig 0:796d0f61a05b 513 * \param buf buffer to write to
HannesTschofenig 0:796d0f61a05b 514 * \param size size of the buffer
HannesTschofenig 0:796d0f61a05b 515 * \param f_rng RNG function (for signature, see note)
HannesTschofenig 0:796d0f61a05b 516 * \param p_rng RNG parameter
HannesTschofenig 0:796d0f61a05b 517 *
HannesTschofenig 0:796d0f61a05b 518 * \return length of data written if successful, or a specific
HannesTschofenig 0:796d0f61a05b 519 * error code
HannesTschofenig 0:796d0f61a05b 520 *
HannesTschofenig 0:796d0f61a05b 521 * \note f_rng may be NULL if RSA is used for signature and the
HannesTschofenig 0:796d0f61a05b 522 * signature is made offline (otherwise f_rng is desirable
HannesTschofenig 0:796d0f61a05b 523 * for countermeasures against timing attacks).
HannesTschofenig 0:796d0f61a05b 524 * ECDSA signatures always require a non-NULL f_rng.
HannesTschofenig 0:796d0f61a05b 525 */
HannesTschofenig 0:796d0f61a05b 526 int x509write_crt_der( x509write_cert *ctx, unsigned char *buf, size_t size,
HannesTschofenig 0:796d0f61a05b 527 int (*f_rng)(void *, unsigned char *, size_t),
HannesTschofenig 0:796d0f61a05b 528 void *p_rng );
HannesTschofenig 0:796d0f61a05b 529
HannesTschofenig 0:796d0f61a05b 530 #if defined(POLARSSL_PEM_WRITE_C)
HannesTschofenig 0:796d0f61a05b 531 /**
HannesTschofenig 0:796d0f61a05b 532 * \brief Write a built up certificate to a X509 PEM string
HannesTschofenig 0:796d0f61a05b 533 *
HannesTschofenig 0:796d0f61a05b 534 * \param ctx certificate to write away
HannesTschofenig 0:796d0f61a05b 535 * \param buf buffer to write to
HannesTschofenig 0:796d0f61a05b 536 * \param size size of the buffer
HannesTschofenig 0:796d0f61a05b 537 * \param f_rng RNG function (for signature, see note)
HannesTschofenig 0:796d0f61a05b 538 * \param p_rng RNG parameter
HannesTschofenig 0:796d0f61a05b 539 *
HannesTschofenig 0:796d0f61a05b 540 * \return 0 successful, or a specific error code
HannesTschofenig 0:796d0f61a05b 541 *
HannesTschofenig 0:796d0f61a05b 542 * \note f_rng may be NULL if RSA is used for signature and the
HannesTschofenig 0:796d0f61a05b 543 * signature is made offline (otherwise f_rng is desirable
HannesTschofenig 0:796d0f61a05b 544 * for countermeasures against timing attacks).
HannesTschofenig 0:796d0f61a05b 545 * ECDSA signatures always require a non-NULL f_rng.
HannesTschofenig 0:796d0f61a05b 546 */
HannesTschofenig 0:796d0f61a05b 547 int x509write_crt_pem( x509write_cert *ctx, unsigned char *buf, size_t size,
HannesTschofenig 0:796d0f61a05b 548 int (*f_rng)(void *, unsigned char *, size_t),
HannesTschofenig 0:796d0f61a05b 549 void *p_rng );
HannesTschofenig 0:796d0f61a05b 550 #endif /* POLARSSL_PEM_WRITE_C */
HannesTschofenig 0:796d0f61a05b 551 #endif /* POLARSSL_X509_CRT_WRITE_C */
HannesTschofenig 0:796d0f61a05b 552
HannesTschofenig 0:796d0f61a05b 553 #ifdef __cplusplus
HannesTschofenig 0:796d0f61a05b 554 }
HannesTschofenig 0:796d0f61a05b 555 #endif
HannesTschofenig 0:796d0f61a05b 556
HannesTschofenig 0:796d0f61a05b 557 #endif /* x509_crt.h */
HannesTschofenig 0:796d0f61a05b 558
HannesTschofenig 0:796d0f61a05b 559