Marco Zecchini
/
Example_RTOS
Rtos API example
Embed:
(wiki syntax)
Show/hide line numbers
x509.h
Go to the documentation of this file.
00001 /** 00002 * \file x509.h 00003 * 00004 * \brief X.509 generic defines and structures 00005 * 00006 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved 00007 * SPDX-License-Identifier: Apache-2.0 00008 * 00009 * Licensed under the Apache License, Version 2.0 (the "License"); you may 00010 * not use this file except in compliance with the License. 00011 * You may obtain a copy of the License at 00012 * 00013 * http://www.apache.org/licenses/LICENSE-2.0 00014 * 00015 * Unless required by applicable law or agreed to in writing, software 00016 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT 00017 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 00018 * See the License for the specific language governing permissions and 00019 * limitations under the License. 00020 * 00021 * This file is part of mbed TLS (https://tls.mbed.org) 00022 */ 00023 #ifndef MBEDTLS_X509_H 00024 #define MBEDTLS_X509_H 00025 00026 #if !defined(MBEDTLS_CONFIG_FILE) 00027 #include "config.h" 00028 #else 00029 #include MBEDTLS_CONFIG_FILE 00030 #endif 00031 00032 #include "asn1.h" 00033 #include "pk.h" 00034 00035 #if defined(MBEDTLS_RSA_C) 00036 #include "rsa.h" 00037 #endif 00038 00039 /** 00040 * \addtogroup x509_module 00041 * \{ 00042 */ 00043 00044 #if !defined(MBEDTLS_X509_MAX_INTERMEDIATE_CA) 00045 /** 00046 * Maximum number of intermediate CAs in a verification chain. 00047 * That is, maximum length of the chain, excluding the end-entity certificate 00048 * and the trusted root certificate. 00049 * 00050 * Set this to a low value to prevent an adversary from making you waste 00051 * resources verifying an overlong certificate chain. 00052 */ 00053 #define MBEDTLS_X509_MAX_INTERMEDIATE_CA 8 00054 #endif 00055 00056 /** 00057 * \name X509 Error codes 00058 * \{ 00059 */ 00060 #define MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE -0x2080 /**< Unavailable feature, e.g. RSA hashing/encryption combination. */ 00061 #define MBEDTLS_ERR_X509_UNKNOWN_OID -0x2100 /**< Requested OID is unknown. */ 00062 #define MBEDTLS_ERR_X509_INVALID_FORMAT -0x2180 /**< The CRT/CRL/CSR format is invalid, e.g. different type expected. */ 00063 #define MBEDTLS_ERR_X509_INVALID_VERSION -0x2200 /**< The CRT/CRL/CSR version element is invalid. */ 00064 #define MBEDTLS_ERR_X509_INVALID_SERIAL -0x2280 /**< The serial tag or value is invalid. */ 00065 #define MBEDTLS_ERR_X509_INVALID_ALG -0x2300 /**< The algorithm tag or value is invalid. */ 00066 #define MBEDTLS_ERR_X509_INVALID_NAME -0x2380 /**< The name tag or value is invalid. */ 00067 #define MBEDTLS_ERR_X509_INVALID_DATE -0x2400 /**< The date tag or value is invalid. */ 00068 #define MBEDTLS_ERR_X509_INVALID_SIGNATURE -0x2480 /**< The signature tag or value invalid. */ 00069 #define MBEDTLS_ERR_X509_INVALID_EXTENSIONS -0x2500 /**< The extension tag or value is invalid. */ 00070 #define MBEDTLS_ERR_X509_UNKNOWN_VERSION -0x2580 /**< CRT/CRL/CSR has an unsupported version number. */ 00071 #define MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG -0x2600 /**< Signature algorithm (oid) is unsupported. */ 00072 #define MBEDTLS_ERR_X509_SIG_MISMATCH -0x2680 /**< Signature algorithms do not match. (see \c ::mbedtls_x509_crt sig_oid) */ 00073 #define MBEDTLS_ERR_X509_CERT_VERIFY_FAILED -0x2700 /**< Certificate verification failed, e.g. CRL, CA or signature check failed. */ 00074 #define MBEDTLS_ERR_X509_CERT_UNKNOWN_FORMAT -0x2780 /**< Format not recognized as DER or PEM. */ 00075 #define MBEDTLS_ERR_X509_BAD_INPUT_DATA -0x2800 /**< Input invalid. */ 00076 #define MBEDTLS_ERR_X509_ALLOC_FAILED -0x2880 /**< Allocation of memory failed. */ 00077 #define MBEDTLS_ERR_X509_FILE_IO_ERROR -0x2900 /**< Read/write of file failed. */ 00078 #define MBEDTLS_ERR_X509_BUFFER_TOO_SMALL -0x2980 /**< Destination buffer is too small. */ 00079 #define MBEDTLS_ERR_X509_FATAL_ERROR -0x3000 /**< A fatal error occured, eg the chain is too long or the vrfy callback failed. */ 00080 /* \} name */ 00081 00082 /** 00083 * \name X509 Verify codes 00084 * \{ 00085 */ 00086 /* Reminder: update x509_crt_verify_strings[] in library/x509_crt.c */ 00087 #define MBEDTLS_X509_BADCERT_EXPIRED 0x01 /**< The certificate validity has expired. */ 00088 #define MBEDTLS_X509_BADCERT_REVOKED 0x02 /**< The certificate has been revoked (is on a CRL). */ 00089 #define MBEDTLS_X509_BADCERT_CN_MISMATCH 0x04 /**< The certificate Common Name (CN) does not match with the expected CN. */ 00090 #define MBEDTLS_X509_BADCERT_NOT_TRUSTED 0x08 /**< The certificate is not correctly signed by the trusted CA. */ 00091 #define MBEDTLS_X509_BADCRL_NOT_TRUSTED 0x10 /**< The CRL is not correctly signed by the trusted CA. */ 00092 #define MBEDTLS_X509_BADCRL_EXPIRED 0x20 /**< The CRL is expired. */ 00093 #define MBEDTLS_X509_BADCERT_MISSING 0x40 /**< Certificate was missing. */ 00094 #define MBEDTLS_X509_BADCERT_SKIP_VERIFY 0x80 /**< Certificate verification was skipped. */ 00095 #define MBEDTLS_X509_BADCERT_OTHER 0x0100 /**< Other reason (can be used by verify callback) */ 00096 #define MBEDTLS_X509_BADCERT_FUTURE 0x0200 /**< The certificate validity starts in the future. */ 00097 #define MBEDTLS_X509_BADCRL_FUTURE 0x0400 /**< The CRL is from the future */ 00098 #define MBEDTLS_X509_BADCERT_KEY_USAGE 0x0800 /**< Usage does not match the keyUsage extension. */ 00099 #define MBEDTLS_X509_BADCERT_EXT_KEY_USAGE 0x1000 /**< Usage does not match the extendedKeyUsage extension. */ 00100 #define MBEDTLS_X509_BADCERT_NS_CERT_TYPE 0x2000 /**< Usage does not match the nsCertType extension. */ 00101 #define MBEDTLS_X509_BADCERT_BAD_MD 0x4000 /**< The certificate is signed with an unacceptable hash. */ 00102 #define MBEDTLS_X509_BADCERT_BAD_PK 0x8000 /**< The certificate is signed with an unacceptable PK alg (eg RSA vs ECDSA). */ 00103 #define MBEDTLS_X509_BADCERT_BAD_KEY 0x010000 /**< The certificate is signed with an unacceptable key (eg bad curve, RSA too short). */ 00104 #define MBEDTLS_X509_BADCRL_BAD_MD 0x020000 /**< The CRL is signed with an unacceptable hash. */ 00105 #define MBEDTLS_X509_BADCRL_BAD_PK 0x040000 /**< The CRL is signed with an unacceptable PK alg (eg RSA vs ECDSA). */ 00106 #define MBEDTLS_X509_BADCRL_BAD_KEY 0x080000 /**< The CRL is signed with an unacceptable key (eg bad curve, RSA too short). */ 00107 00108 /* \} name */ 00109 /* \} addtogroup x509_module */ 00110 00111 /* 00112 * X.509 v3 Key Usage Extension flags 00113 * Reminder: update x509_info_key_usage() when adding new flags. 00114 */ 00115 #define MBEDTLS_X509_KU_DIGITAL_SIGNATURE (0x80) /* bit 0 */ 00116 #define MBEDTLS_X509_KU_NON_REPUDIATION (0x40) /* bit 1 */ 00117 #define MBEDTLS_X509_KU_KEY_ENCIPHERMENT (0x20) /* bit 2 */ 00118 #define MBEDTLS_X509_KU_DATA_ENCIPHERMENT (0x10) /* bit 3 */ 00119 #define MBEDTLS_X509_KU_KEY_AGREEMENT (0x08) /* bit 4 */ 00120 #define MBEDTLS_X509_KU_KEY_CERT_SIGN (0x04) /* bit 5 */ 00121 #define MBEDTLS_X509_KU_CRL_SIGN (0x02) /* bit 6 */ 00122 #define MBEDTLS_X509_KU_ENCIPHER_ONLY (0x01) /* bit 7 */ 00123 #define MBEDTLS_X509_KU_DECIPHER_ONLY (0x8000) /* bit 8 */ 00124 00125 /* 00126 * Netscape certificate types 00127 * (http://www.mozilla.org/projects/security/pki/nss/tech-notes/tn3.html) 00128 */ 00129 00130 #define MBEDTLS_X509_NS_CERT_TYPE_SSL_CLIENT (0x80) /* bit 0 */ 00131 #define MBEDTLS_X509_NS_CERT_TYPE_SSL_SERVER (0x40) /* bit 1 */ 00132 #define MBEDTLS_X509_NS_CERT_TYPE_EMAIL (0x20) /* bit 2 */ 00133 #define MBEDTLS_X509_NS_CERT_TYPE_OBJECT_SIGNING (0x10) /* bit 3 */ 00134 #define MBEDTLS_X509_NS_CERT_TYPE_RESERVED (0x08) /* bit 4 */ 00135 #define MBEDTLS_X509_NS_CERT_TYPE_SSL_CA (0x04) /* bit 5 */ 00136 #define MBEDTLS_X509_NS_CERT_TYPE_EMAIL_CA (0x02) /* bit 6 */ 00137 #define MBEDTLS_X509_NS_CERT_TYPE_OBJECT_SIGNING_CA (0x01) /* bit 7 */ 00138 00139 /* 00140 * X.509 extension types 00141 * 00142 * Comments refer to the status for using certificates. Status can be 00143 * different for writing certificates or reading CRLs or CSRs. 00144 */ 00145 #define MBEDTLS_X509_EXT_AUTHORITY_KEY_IDENTIFIER (1 << 0) 00146 #define MBEDTLS_X509_EXT_SUBJECT_KEY_IDENTIFIER (1 << 1) 00147 #define MBEDTLS_X509_EXT_KEY_USAGE (1 << 2) 00148 #define MBEDTLS_X509_EXT_CERTIFICATE_POLICIES (1 << 3) 00149 #define MBEDTLS_X509_EXT_POLICY_MAPPINGS (1 << 4) 00150 #define MBEDTLS_X509_EXT_SUBJECT_ALT_NAME (1 << 5) /* Supported (DNS) */ 00151 #define MBEDTLS_X509_EXT_ISSUER_ALT_NAME (1 << 6) 00152 #define MBEDTLS_X509_EXT_SUBJECT_DIRECTORY_ATTRS (1 << 7) 00153 #define MBEDTLS_X509_EXT_BASIC_CONSTRAINTS (1 << 8) /* Supported */ 00154 #define MBEDTLS_X509_EXT_NAME_CONSTRAINTS (1 << 9) 00155 #define MBEDTLS_X509_EXT_POLICY_CONSTRAINTS (1 << 10) 00156 #define MBEDTLS_X509_EXT_EXTENDED_KEY_USAGE (1 << 11) 00157 #define MBEDTLS_X509_EXT_CRL_DISTRIBUTION_POINTS (1 << 12) 00158 #define MBEDTLS_X509_EXT_INIHIBIT_ANYPOLICY (1 << 13) 00159 #define MBEDTLS_X509_EXT_FRESHEST_CRL (1 << 14) 00160 00161 #define MBEDTLS_X509_EXT_NS_CERT_TYPE (1 << 16) 00162 00163 /* 00164 * Storage format identifiers 00165 * Recognized formats: PEM and DER 00166 */ 00167 #define MBEDTLS_X509_FORMAT_DER 1 00168 #define MBEDTLS_X509_FORMAT_PEM 2 00169 00170 #define MBEDTLS_X509_MAX_DN_NAME_SIZE 256 /**< Maximum value size of a DN entry */ 00171 00172 #ifdef __cplusplus 00173 extern "C" { 00174 #endif 00175 00176 /** 00177 * \addtogroup x509_module 00178 * \{ */ 00179 00180 /** 00181 * \name Structures for parsing X.509 certificates, CRLs and CSRs 00182 * \{ 00183 */ 00184 00185 /** 00186 * Type-length-value structure that allows for ASN1 using DER. 00187 */ 00188 typedef mbedtls_asn1_buf mbedtls_x509_buf; 00189 00190 /** 00191 * Container for ASN1 bit strings. 00192 */ 00193 typedef mbedtls_asn1_bitstring mbedtls_x509_bitstring; 00194 00195 /** 00196 * Container for ASN1 named information objects. 00197 * It allows for Relative Distinguished Names (e.g. cn=localhost,ou=code,etc.). 00198 */ 00199 typedef mbedtls_asn1_named_data mbedtls_x509_name; 00200 00201 /** 00202 * Container for a sequence of ASN.1 items 00203 */ 00204 typedef mbedtls_asn1_sequence mbedtls_x509_sequence; 00205 00206 /** Container for date and time (precision in seconds). */ 00207 typedef struct mbedtls_x509_time 00208 { 00209 int year, mon, day; /**< Date. */ 00210 int hour, min, sec; /**< Time. */ 00211 } 00212 mbedtls_x509_time; 00213 00214 /** \} name Structures for parsing X.509 certificates, CRLs and CSRs */ 00215 /** \} addtogroup x509_module */ 00216 00217 /** 00218 * \brief Store the certificate DN in printable form into buf; 00219 * no more than size characters will be written. 00220 * 00221 * \param buf Buffer to write to 00222 * \param size Maximum size of buffer 00223 * \param dn The X509 name to represent 00224 * 00225 * \return The length of the string written (not including the 00226 * terminated nul byte), or a negative error code. 00227 */ 00228 int mbedtls_x509_dn_gets( char *buf, size_t size, const mbedtls_x509_name *dn ); 00229 00230 /** 00231 * \brief Store the certificate serial in printable form into buf; 00232 * no more than size characters will be written. 00233 * 00234 * \param buf Buffer to write to 00235 * \param size Maximum size of buffer 00236 * \param serial The X509 serial to represent 00237 * 00238 * \return The length of the string written (not including the 00239 * terminated nul byte), or a negative error code. 00240 */ 00241 int mbedtls_x509_serial_gets( char *buf, size_t size, const mbedtls_x509_buf *serial ); 00242 00243 /** 00244 * \brief Check a given mbedtls_x509_time against the system time 00245 * and tell if it's in the past. 00246 * 00247 * \note Intended usage is "if( is_past( valid_to ) ) ERROR". 00248 * Hence the return value of 1 if on internal errors. 00249 * 00250 * \param to mbedtls_x509_time to check 00251 * 00252 * \return 1 if the given time is in the past or an error occured, 00253 * 0 otherwise. 00254 */ 00255 int mbedtls_x509_time_is_past( const mbedtls_x509_time *to ); 00256 00257 /** 00258 * \brief Check a given mbedtls_x509_time against the system time 00259 * and tell if it's in the future. 00260 * 00261 * \note Intended usage is "if( is_future( valid_from ) ) ERROR". 00262 * Hence the return value of 1 if on internal errors. 00263 * 00264 * \param from mbedtls_x509_time to check 00265 * 00266 * \return 1 if the given time is in the future or an error occured, 00267 * 0 otherwise. 00268 */ 00269 int mbedtls_x509_time_is_future( const mbedtls_x509_time *from ); 00270 00271 /** 00272 * \brief Checkup routine 00273 * 00274 * \return 0 if successful, or 1 if the test failed 00275 */ 00276 int mbedtls_x509_self_test( int verbose ); 00277 00278 /* 00279 * Internal module functions. You probably do not want to use these unless you 00280 * know you do. 00281 */ 00282 int mbedtls_x509_get_name( unsigned char **p, const unsigned char *end, 00283 mbedtls_x509_name *cur ); 00284 int mbedtls_x509_get_alg_null( unsigned char **p, const unsigned char *end, 00285 mbedtls_x509_buf *alg ); 00286 int mbedtls_x509_get_alg( unsigned char **p, const unsigned char *end, 00287 mbedtls_x509_buf *alg, mbedtls_x509_buf *params ); 00288 #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) 00289 int mbedtls_x509_get_rsassa_pss_params( const mbedtls_x509_buf *params, 00290 mbedtls_md_type_t *md_alg, mbedtls_md_type_t *mgf_md, 00291 int *salt_len ); 00292 #endif 00293 int mbedtls_x509_get_sig( unsigned char **p, const unsigned char *end, mbedtls_x509_buf *sig ); 00294 int mbedtls_x509_get_sig_alg( const mbedtls_x509_buf *sig_oid, const mbedtls_x509_buf *sig_params, 00295 mbedtls_md_type_t *md_alg, mbedtls_pk_type_t *pk_alg, 00296 void **sig_opts ); 00297 int mbedtls_x509_get_time( unsigned char **p, const unsigned char *end, 00298 mbedtls_x509_time *t ); 00299 int mbedtls_x509_get_serial( unsigned char **p, const unsigned char *end, 00300 mbedtls_x509_buf *serial ); 00301 int mbedtls_x509_get_ext( unsigned char **p, const unsigned char *end, 00302 mbedtls_x509_buf *ext, int tag ); 00303 int mbedtls_x509_sig_alg_gets( char *buf, size_t size, const mbedtls_x509_buf *sig_oid, 00304 mbedtls_pk_type_t pk_alg, mbedtls_md_type_t md_alg, 00305 const void *sig_opts ); 00306 int mbedtls_x509_key_size_helper( char *buf, size_t buf_size, const char *name ); 00307 int mbedtls_x509_string_to_names( mbedtls_asn1_named_data **head, const char *name ); 00308 int mbedtls_x509_set_extension( mbedtls_asn1_named_data **head, const char *oid, size_t oid_len, 00309 int critical, const unsigned char *val, 00310 size_t val_len ); 00311 int mbedtls_x509_write_extensions( unsigned char **p, unsigned char *start, 00312 mbedtls_asn1_named_data *first ); 00313 int mbedtls_x509_write_names( unsigned char **p, unsigned char *start, 00314 mbedtls_asn1_named_data *first ); 00315 int mbedtls_x509_write_sig( unsigned char **p, unsigned char *start, 00316 const char *oid, size_t oid_len, 00317 unsigned char *sig, size_t size ); 00318 00319 #define MBEDTLS_X509_SAFE_SNPRINTF \ 00320 do { \ 00321 if( ret < 0 || (size_t) ret >= n ) \ 00322 return( MBEDTLS_ERR_X509_BUFFER_TOO_SMALL ); \ 00323 \ 00324 n -= (size_t) ret; \ 00325 p += (size_t) ret; \ 00326 } while( 0 ) 00327 00328 #ifdef __cplusplus 00329 } 00330 #endif 00331 00332 #endif /* x509.h */
Generated on Sun Jul 17 2022 08:25:33 by 1.7.2