Xuyi Wang
/
wolfSSL
Important changes to repositories hosted on mbed.com
Mbed hosted mercurial repositories are deprecated and are due to be permanently deleted in July 2026.
To keep a copy of this software download the repository Zip archive or clone locally using Mercurial.
It is also possible to export all your personal repositories from the account settings page.
wolfssl/wolfcrypt/asn.h@15:117db924cf7c, 2018-08-18 (annotated)
- Committer:
- wolfSSL
- Date:
- Sat Aug 18 22:20:43 2018 +0000
- Revision:
- 15:117db924cf7c
wolfSSL 3.15.3
Who changed what in which revision?
| User | Revision | Line number | New contents of line |
|---|---|---|---|
| wolfSSL | 15:117db924cf7c | 1 | /* asn.h |
| wolfSSL | 15:117db924cf7c | 2 | * |
| wolfSSL | 15:117db924cf7c | 3 | * Copyright (C) 2006-2017 wolfSSL Inc. |
| wolfSSL | 15:117db924cf7c | 4 | * |
| wolfSSL | 15:117db924cf7c | 5 | * This file is part of wolfSSL. |
| wolfSSL | 15:117db924cf7c | 6 | * |
| wolfSSL | 15:117db924cf7c | 7 | * wolfSSL is free software; you can redistribute it and/or modify |
| wolfSSL | 15:117db924cf7c | 8 | * it under the terms of the GNU General Public License as published by |
| wolfSSL | 15:117db924cf7c | 9 | * the Free Software Foundation; either version 2 of the License, or |
| wolfSSL | 15:117db924cf7c | 10 | * (at your option) any later version. |
| wolfSSL | 15:117db924cf7c | 11 | * |
| wolfSSL | 15:117db924cf7c | 12 | * wolfSSL is distributed in the hope that it will be useful, |
| wolfSSL | 15:117db924cf7c | 13 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| wolfSSL | 15:117db924cf7c | 14 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| wolfSSL | 15:117db924cf7c | 15 | * GNU General Public License for more details. |
| wolfSSL | 15:117db924cf7c | 16 | * |
| wolfSSL | 15:117db924cf7c | 17 | * You should have received a copy of the GNU General Public License |
| wolfSSL | 15:117db924cf7c | 18 | * along with this program; if not, write to the Free Software |
| wolfSSL | 15:117db924cf7c | 19 | * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA |
| wolfSSL | 15:117db924cf7c | 20 | */ |
| wolfSSL | 15:117db924cf7c | 21 | |
| wolfSSL | 15:117db924cf7c | 22 | /*! |
| wolfSSL | 15:117db924cf7c | 23 | \file wolfssl/wolfcrypt/asn.h |
| wolfSSL | 15:117db924cf7c | 24 | */ |
| wolfSSL | 15:117db924cf7c | 25 | |
| wolfSSL | 15:117db924cf7c | 26 | #ifndef WOLF_CRYPT_ASN_H |
| wolfSSL | 15:117db924cf7c | 27 | #define WOLF_CRYPT_ASN_H |
| wolfSSL | 15:117db924cf7c | 28 | |
| wolfSSL | 15:117db924cf7c | 29 | #include <wolfssl/wolfcrypt/types.h> |
| wolfSSL | 15:117db924cf7c | 30 | |
| wolfSSL | 15:117db924cf7c | 31 | #ifndef NO_ASN |
| wolfSSL | 15:117db924cf7c | 32 | |
| wolfSSL | 15:117db924cf7c | 33 | |
| wolfSSL | 15:117db924cf7c | 34 | #if !defined(NO_ASN_TIME) && defined(NO_TIME_H) |
| wolfSSL | 15:117db924cf7c | 35 | #define NO_ASN_TIME /* backwards compatibility with NO_TIME_H */ |
| wolfSSL | 15:117db924cf7c | 36 | #endif |
| wolfSSL | 15:117db924cf7c | 37 | |
| wolfSSL | 15:117db924cf7c | 38 | #include <wolfssl/wolfcrypt/integer.h> |
| wolfSSL | 15:117db924cf7c | 39 | |
| wolfSSL | 15:117db924cf7c | 40 | /* fips declare of RsaPrivateKeyDecode @wc_fips */ |
| wolfSSL | 15:117db924cf7c | 41 | #if defined(HAVE_FIPS) && !defined(NO_RSA) && \ |
| wolfSSL | 15:117db924cf7c | 42 | (!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2)) |
| wolfSSL | 15:117db924cf7c | 43 | #include <cyassl/ctaocrypt/rsa.h> |
| wolfSSL | 15:117db924cf7c | 44 | #endif |
| wolfSSL | 15:117db924cf7c | 45 | |
| wolfSSL | 15:117db924cf7c | 46 | #ifndef NO_DH |
| wolfSSL | 15:117db924cf7c | 47 | #include <wolfssl/wolfcrypt/dh.h> |
| wolfSSL | 15:117db924cf7c | 48 | #endif |
| wolfSSL | 15:117db924cf7c | 49 | #ifndef NO_DSA |
| wolfSSL | 15:117db924cf7c | 50 | #include <wolfssl/wolfcrypt/dsa.h> |
| wolfSSL | 15:117db924cf7c | 51 | #endif |
| wolfSSL | 15:117db924cf7c | 52 | #ifndef NO_SHA |
| wolfSSL | 15:117db924cf7c | 53 | #include <wolfssl/wolfcrypt/sha.h> |
| wolfSSL | 15:117db924cf7c | 54 | #endif |
| wolfSSL | 15:117db924cf7c | 55 | #ifndef NO_MD5 |
| wolfSSL | 15:117db924cf7c | 56 | #include <wolfssl/wolfcrypt/md5.h> |
| wolfSSL | 15:117db924cf7c | 57 | #endif |
| wolfSSL | 15:117db924cf7c | 58 | #include <wolfssl/wolfcrypt/sha256.h> |
| wolfSSL | 15:117db924cf7c | 59 | #include <wolfssl/wolfcrypt/asn_public.h> /* public interface */ |
| wolfSSL | 15:117db924cf7c | 60 | |
| wolfSSL | 15:117db924cf7c | 61 | |
| wolfSSL | 15:117db924cf7c | 62 | #ifdef __cplusplus |
| wolfSSL | 15:117db924cf7c | 63 | extern "C" { |
| wolfSSL | 15:117db924cf7c | 64 | #endif |
| wolfSSL | 15:117db924cf7c | 65 | |
| wolfSSL | 15:117db924cf7c | 66 | enum { |
| wolfSSL | 15:117db924cf7c | 67 | ISSUER = 0, |
| wolfSSL | 15:117db924cf7c | 68 | SUBJECT = 1, |
| wolfSSL | 15:117db924cf7c | 69 | |
| wolfSSL | 15:117db924cf7c | 70 | EXTERNAL_SERIAL_SIZE = 32, |
| wolfSSL | 15:117db924cf7c | 71 | |
| wolfSSL | 15:117db924cf7c | 72 | BEFORE = 0, |
| wolfSSL | 15:117db924cf7c | 73 | AFTER = 1 |
| wolfSSL | 15:117db924cf7c | 74 | }; |
| wolfSSL | 15:117db924cf7c | 75 | |
| wolfSSL | 15:117db924cf7c | 76 | /* ASN Tags */ |
| wolfSSL | 15:117db924cf7c | 77 | enum ASN_Tags { |
| wolfSSL | 15:117db924cf7c | 78 | ASN_BOOLEAN = 0x01, |
| wolfSSL | 15:117db924cf7c | 79 | ASN_INTEGER = 0x02, |
| wolfSSL | 15:117db924cf7c | 80 | ASN_BIT_STRING = 0x03, |
| wolfSSL | 15:117db924cf7c | 81 | ASN_OCTET_STRING = 0x04, |
| wolfSSL | 15:117db924cf7c | 82 | ASN_TAG_NULL = 0x05, |
| wolfSSL | 15:117db924cf7c | 83 | ASN_OBJECT_ID = 0x06, |
| wolfSSL | 15:117db924cf7c | 84 | ASN_ENUMERATED = 0x0a, |
| wolfSSL | 15:117db924cf7c | 85 | ASN_UTF8STRING = 0x0c, |
| wolfSSL | 15:117db924cf7c | 86 | ASN_SEQUENCE = 0x10, |
| wolfSSL | 15:117db924cf7c | 87 | ASN_SET = 0x11, |
| wolfSSL | 15:117db924cf7c | 88 | ASN_UTC_TIME = 0x17, |
| wolfSSL | 15:117db924cf7c | 89 | ASN_OTHER_TYPE = 0x00, |
| wolfSSL | 15:117db924cf7c | 90 | ASN_RFC822_TYPE = 0x01, |
| wolfSSL | 15:117db924cf7c | 91 | ASN_DNS_TYPE = 0x02, |
| wolfSSL | 15:117db924cf7c | 92 | ASN_DIR_TYPE = 0x04, |
| wolfSSL | 15:117db924cf7c | 93 | ASN_URI_TYPE = 0x06, /* the value 6 is from GeneralName OID */ |
| wolfSSL | 15:117db924cf7c | 94 | ASN_GENERALIZED_TIME = 0x18, |
| wolfSSL | 15:117db924cf7c | 95 | CRL_EXTENSIONS = 0xa0, |
| wolfSSL | 15:117db924cf7c | 96 | ASN_EXTENSIONS = 0xa3, |
| wolfSSL | 15:117db924cf7c | 97 | ASN_LONG_LENGTH = 0x80, |
| wolfSSL | 15:117db924cf7c | 98 | ASN_INDEF_LENGTH = 0x80, |
| wolfSSL | 15:117db924cf7c | 99 | |
| wolfSSL | 15:117db924cf7c | 100 | /* ASN_Flags - Bitmask */ |
| wolfSSL | 15:117db924cf7c | 101 | ASN_CONSTRUCTED = 0x20, |
| wolfSSL | 15:117db924cf7c | 102 | ASN_CONTEXT_SPECIFIC = 0x80, |
| wolfSSL | 15:117db924cf7c | 103 | }; |
| wolfSSL | 15:117db924cf7c | 104 | |
| wolfSSL | 15:117db924cf7c | 105 | #define ASN_UTC_TIME_SIZE 14 |
| wolfSSL | 15:117db924cf7c | 106 | #define ASN_GENERALIZED_TIME_SIZE 16 |
| wolfSSL | 15:117db924cf7c | 107 | |
| wolfSSL | 15:117db924cf7c | 108 | enum DN_Tags { |
| wolfSSL | 15:117db924cf7c | 109 | ASN_COMMON_NAME = 0x03, /* CN */ |
| wolfSSL | 15:117db924cf7c | 110 | ASN_SUR_NAME = 0x04, /* SN */ |
| wolfSSL | 15:117db924cf7c | 111 | ASN_SERIAL_NUMBER = 0x05, /* serialNumber */ |
| wolfSSL | 15:117db924cf7c | 112 | ASN_COUNTRY_NAME = 0x06, /* C */ |
| wolfSSL | 15:117db924cf7c | 113 | ASN_LOCALITY_NAME = 0x07, /* L */ |
| wolfSSL | 15:117db924cf7c | 114 | ASN_STATE_NAME = 0x08, /* ST */ |
| wolfSSL | 15:117db924cf7c | 115 | ASN_ORG_NAME = 0x0a, /* O */ |
| wolfSSL | 15:117db924cf7c | 116 | ASN_ORGUNIT_NAME = 0x0b, /* OU */ |
| wolfSSL | 15:117db924cf7c | 117 | ASN_EMAIL_NAME = 0x98, /* not oid number there is 97 in 2.5.4.0-97 */ |
| wolfSSL | 15:117db924cf7c | 118 | |
| wolfSSL | 15:117db924cf7c | 119 | /* pilot attribute types |
| wolfSSL | 15:117db924cf7c | 120 | * OID values of 0.9.2342.19200300.100.1.* */ |
| wolfSSL | 15:117db924cf7c | 121 | ASN_USER_ID = 0x01, /* UID */ |
| wolfSSL | 15:117db924cf7c | 122 | ASN_DOMAIN_COMPONENT = 0x19 /* DC */ |
| wolfSSL | 15:117db924cf7c | 123 | }; |
| wolfSSL | 15:117db924cf7c | 124 | |
| wolfSSL | 15:117db924cf7c | 125 | /* DN Tag Strings */ |
| wolfSSL | 15:117db924cf7c | 126 | #define WOLFSSL_COMMON_NAME "/CN=" |
| wolfSSL | 15:117db924cf7c | 127 | #define WOLFSSL_SUR_NAME "/SN=" |
| wolfSSL | 15:117db924cf7c | 128 | #define WOLFSSL_SERIAL_NUMBER "/serialNumber=" |
| wolfSSL | 15:117db924cf7c | 129 | #define WOLFSSL_COUNTRY_NAME "/C=" |
| wolfSSL | 15:117db924cf7c | 130 | #define WOLFSSL_LOCALITY_NAME "/L=" |
| wolfSSL | 15:117db924cf7c | 131 | #define WOLFSSL_STATE_NAME "/ST=" |
| wolfSSL | 15:117db924cf7c | 132 | #define WOLFSSL_ORG_NAME "/O=" |
| wolfSSL | 15:117db924cf7c | 133 | #define WOLFSSL_ORGUNIT_NAME "/OU=" |
| wolfSSL | 15:117db924cf7c | 134 | #define WOLFSSL_DOMAIN_COMPONENT "/DC=" |
| wolfSSL | 15:117db924cf7c | 135 | |
| wolfSSL | 15:117db924cf7c | 136 | enum ECC_TYPES { |
| wolfSSL | 15:117db924cf7c | 137 | ECC_PREFIX_0 = 160, |
| wolfSSL | 15:117db924cf7c | 138 | ECC_PREFIX_1 = 161 |
| wolfSSL | 15:117db924cf7c | 139 | }; |
| wolfSSL | 15:117db924cf7c | 140 | |
| wolfSSL | 15:117db924cf7c | 141 | enum Misc_ASN { |
| wolfSSL | 15:117db924cf7c | 142 | ASN_NAME_MAX = 256, |
| wolfSSL | 15:117db924cf7c | 143 | MAX_SALT_SIZE = 64, /* MAX PKCS Salt length */ |
| wolfSSL | 15:117db924cf7c | 144 | MAX_IV_SIZE = 64, /* MAX PKCS Iv length */ |
| wolfSSL | 15:117db924cf7c | 145 | ASN_BOOL_SIZE = 2, /* including type */ |
| wolfSSL | 15:117db924cf7c | 146 | ASN_ECC_HEADER_SZ = 2, /* String type + 1 byte len */ |
| wolfSSL | 15:117db924cf7c | 147 | ASN_ECC_CONTEXT_SZ = 2, /* Content specific type + 1 byte len */ |
| wolfSSL | 15:117db924cf7c | 148 | #ifdef NO_SHA |
| wolfSSL | 15:117db924cf7c | 149 | KEYID_SIZE = WC_SHA256_DIGEST_SIZE, |
| wolfSSL | 15:117db924cf7c | 150 | #else |
| wolfSSL | 15:117db924cf7c | 151 | KEYID_SIZE = WC_SHA_DIGEST_SIZE, |
| wolfSSL | 15:117db924cf7c | 152 | #endif |
| wolfSSL | 15:117db924cf7c | 153 | RSA_INTS = 8, /* RSA ints in private key */ |
| wolfSSL | 15:117db924cf7c | 154 | DSA_INTS = 5, /* DSA ints in private key */ |
| wolfSSL | 15:117db924cf7c | 155 | MIN_DATE_SIZE = 13, |
| wolfSSL | 15:117db924cf7c | 156 | MAX_DATE_SIZE = 32, |
| wolfSSL | 15:117db924cf7c | 157 | ASN_GEN_TIME_SZ = 15, /* 7 numbers * 2 + Zulu tag */ |
| wolfSSL | 15:117db924cf7c | 158 | MAX_ENCODED_SIG_SZ = 512, |
| wolfSSL | 15:117db924cf7c | 159 | MAX_SIG_SZ = 256, |
| wolfSSL | 15:117db924cf7c | 160 | MAX_ALGO_SZ = 20, |
| wolfSSL | 15:117db924cf7c | 161 | MAX_SHORT_SZ = 6, /* asn int + byte len + 4 byte length */ |
| wolfSSL | 15:117db924cf7c | 162 | MAX_SEQ_SZ = 5, /* enum(seq | con) + length(4) */ |
| wolfSSL | 15:117db924cf7c | 163 | MAX_SET_SZ = 5, /* enum(set | con) + length(4) */ |
| wolfSSL | 15:117db924cf7c | 164 | MAX_OCTET_STR_SZ = 5, /* enum(set | con) + length(4) */ |
| wolfSSL | 15:117db924cf7c | 165 | MAX_EXP_SZ = 5, /* enum(contextspec|con|exp) + length(4) */ |
| wolfSSL | 15:117db924cf7c | 166 | MAX_PRSTR_SZ = 5, /* enum(prstr) + length(4) */ |
| wolfSSL | 15:117db924cf7c | 167 | MAX_VERSION_SZ = 5, /* enum + id + version(byte) + (header(2))*/ |
| wolfSSL | 15:117db924cf7c | 168 | MAX_ENCODED_DIG_SZ = 73, /* sha512 + enum(bit or octet) + length(4) */ |
| wolfSSL | 15:117db924cf7c | 169 | MAX_RSA_INT_SZ = 517, /* RSA raw sz 4096 for bits + tag + len(4) */ |
| wolfSSL | 15:117db924cf7c | 170 | MAX_NTRU_KEY_SZ = 610, /* NTRU 112 bit public key */ |
| wolfSSL | 15:117db924cf7c | 171 | MAX_NTRU_ENC_SZ = 628, /* NTRU 112 bit DER public encoding */ |
| wolfSSL | 15:117db924cf7c | 172 | MAX_LENGTH_SZ = 4, /* Max length size for DER encoding */ |
| wolfSSL | 15:117db924cf7c | 173 | MAX_RSA_E_SZ = 16, /* Max RSA public e size */ |
| wolfSSL | 15:117db924cf7c | 174 | MAX_CA_SZ = 32, /* Max encoded CA basic constraint length */ |
| wolfSSL | 15:117db924cf7c | 175 | MAX_SN_SZ = 35, /* Max encoded serial number (INT) length */ |
| wolfSSL | 15:117db924cf7c | 176 | MAX_DER_DIGEST_SZ = MAX_ENCODED_DIG_SZ + MAX_ALGO_SZ + MAX_SEQ_SZ, /* Maximum DER digest size */ |
| wolfSSL | 15:117db924cf7c | 177 | #ifdef WOLFSSL_CERT_GEN |
| wolfSSL | 15:117db924cf7c | 178 | #ifdef WOLFSSL_CERT_REQ |
| wolfSSL | 15:117db924cf7c | 179 | /* Max encoded cert req attributes length */ |
| wolfSSL | 15:117db924cf7c | 180 | MAX_ATTRIB_SZ = MAX_SEQ_SZ * 3 + (11 + MAX_SEQ_SZ) * 2 + |
| wolfSSL | 15:117db924cf7c | 181 | MAX_PRSTR_SZ + CTC_NAME_SIZE, /* 11 is the OID size */ |
| wolfSSL | 15:117db924cf7c | 182 | #endif |
| wolfSSL | 15:117db924cf7c | 183 | #if defined(WOLFSSL_ALT_NAMES) || defined(WOLFSSL_CERT_EXT) |
| wolfSSL | 15:117db924cf7c | 184 | MAX_EXTENSIONS_SZ = 1 + MAX_LENGTH_SZ + CTC_MAX_ALT_SIZE, |
| wolfSSL | 15:117db924cf7c | 185 | #else |
| wolfSSL | 15:117db924cf7c | 186 | MAX_EXTENSIONS_SZ = 1 + MAX_LENGTH_SZ + MAX_CA_SZ, |
| wolfSSL | 15:117db924cf7c | 187 | #endif |
| wolfSSL | 15:117db924cf7c | 188 | /* Max total extensions, id + len + others */ |
| wolfSSL | 15:117db924cf7c | 189 | #endif |
| wolfSSL | 15:117db924cf7c | 190 | #if defined(WOLFSSL_CERT_EXT) || defined(OPENSSL_EXTRA) |
| wolfSSL | 15:117db924cf7c | 191 | MAX_OID_SZ = 32, /* Max DER length of OID*/ |
| wolfSSL | 15:117db924cf7c | 192 | MAX_OID_STRING_SZ = 64, /* Max string length representation of OID*/ |
| wolfSSL | 15:117db924cf7c | 193 | #endif |
| wolfSSL | 15:117db924cf7c | 194 | #ifdef WOLFSSL_CERT_EXT |
| wolfSSL | 15:117db924cf7c | 195 | MAX_KID_SZ = 45, /* Max encoded KID length (SHA-256 case) */ |
| wolfSSL | 15:117db924cf7c | 196 | MAX_KEYUSAGE_SZ = 18, /* Max encoded Key Usage length */ |
| wolfSSL | 15:117db924cf7c | 197 | MAX_EXTKEYUSAGE_SZ = 12 + (6 * (8 + 2)) + |
| wolfSSL | 15:117db924cf7c | 198 | CTC_MAX_EKU_OID_SZ, /* Max encoded ExtKeyUsage |
| wolfSSL | 15:117db924cf7c | 199 | (SEQ/LEN + OBJID + OCTSTR/LEN + SEQ + (6 * (SEQ + OID))) */ |
| wolfSSL | 15:117db924cf7c | 200 | MAX_CERTPOL_NB = CTC_MAX_CERTPOL_NB,/* Max number of Cert Policy */ |
| wolfSSL | 15:117db924cf7c | 201 | MAX_CERTPOL_SZ = CTC_MAX_CERTPOL_SZ, |
| wolfSSL | 15:117db924cf7c | 202 | #endif |
| wolfSSL | 15:117db924cf7c | 203 | MAX_NAME_ENTRIES = 5, /* extra entries added to x509 name struct */ |
| wolfSSL | 15:117db924cf7c | 204 | OCSP_NONCE_EXT_SZ = 35, /* OCSP Nonce Extension size */ |
| wolfSSL | 15:117db924cf7c | 205 | MAX_OCSP_EXT_SZ = 58, /* Max OCSP Extension length */ |
| wolfSSL | 15:117db924cf7c | 206 | MAX_OCSP_NONCE_SZ = 16, /* OCSP Nonce size */ |
| wolfSSL | 15:117db924cf7c | 207 | EIGHTK_BUF = 8192, /* Tmp buffer size */ |
| wolfSSL | 15:117db924cf7c | 208 | MAX_PUBLIC_KEY_SZ = MAX_NTRU_ENC_SZ + MAX_ALGO_SZ + MAX_SEQ_SZ * 2, |
| wolfSSL | 15:117db924cf7c | 209 | /* use bigger NTRU size */ |
| wolfSSL | 15:117db924cf7c | 210 | #ifdef WOLFSSL_ENCRYPTED_KEYS |
| wolfSSL | 15:117db924cf7c | 211 | HEADER_ENCRYPTED_KEY_SIZE = 88,/* Extra header size for encrypted key */ |
| wolfSSL | 15:117db924cf7c | 212 | #else |
| wolfSSL | 15:117db924cf7c | 213 | HEADER_ENCRYPTED_KEY_SIZE = 0, |
| wolfSSL | 15:117db924cf7c | 214 | #endif |
| wolfSSL | 15:117db924cf7c | 215 | TRAILING_ZERO = 1, /* Used for size of zero pad */ |
| wolfSSL | 15:117db924cf7c | 216 | MIN_VERSION_SZ = 3, /* Min bytes needed for GetMyVersion */ |
| wolfSSL | 15:117db924cf7c | 217 | #if defined(OPENSSL_ALL) || defined(WOLFSSL_MYSQL_COMPATIBLE) || defined(WOLFSSL_NGINX) || \ |
| wolfSSL | 15:117db924cf7c | 218 | defined(WOLFSSL_HAPROXY) || defined(OPENSSL_EXTRA) |
| wolfSSL | 15:117db924cf7c | 219 | MAX_TIME_STRING_SZ = 25, /* Max length of formatted time string */ |
| wolfSSL | 15:117db924cf7c | 220 | #endif |
| wolfSSL | 15:117db924cf7c | 221 | |
| wolfSSL | 15:117db924cf7c | 222 | PKCS5_SALT_SZ = 8, |
| wolfSSL | 15:117db924cf7c | 223 | |
| wolfSSL | 15:117db924cf7c | 224 | PEM_LINE_LEN = 80, /* PEM line max + fudge */ |
| wolfSSL | 15:117db924cf7c | 225 | }; |
| wolfSSL | 15:117db924cf7c | 226 | |
| wolfSSL | 15:117db924cf7c | 227 | |
| wolfSSL | 15:117db924cf7c | 228 | enum Oid_Types { |
| wolfSSL | 15:117db924cf7c | 229 | oidHashType = 0, |
| wolfSSL | 15:117db924cf7c | 230 | oidSigType = 1, |
| wolfSSL | 15:117db924cf7c | 231 | oidKeyType = 2, |
| wolfSSL | 15:117db924cf7c | 232 | oidCurveType = 3, |
| wolfSSL | 15:117db924cf7c | 233 | oidBlkType = 4, |
| wolfSSL | 15:117db924cf7c | 234 | oidOcspType = 5, |
| wolfSSL | 15:117db924cf7c | 235 | oidCertExtType = 6, |
| wolfSSL | 15:117db924cf7c | 236 | oidCertAuthInfoType = 7, |
| wolfSSL | 15:117db924cf7c | 237 | oidCertPolicyType = 8, |
| wolfSSL | 15:117db924cf7c | 238 | oidCertAltNameType = 9, |
| wolfSSL | 15:117db924cf7c | 239 | oidCertKeyUseType = 10, |
| wolfSSL | 15:117db924cf7c | 240 | oidKdfType = 11, |
| wolfSSL | 15:117db924cf7c | 241 | oidKeyWrapType = 12, |
| wolfSSL | 15:117db924cf7c | 242 | oidCmsKeyAgreeType = 13, |
| wolfSSL | 15:117db924cf7c | 243 | oidPBEType = 14, |
| wolfSSL | 15:117db924cf7c | 244 | oidHmacType = 15, |
| wolfSSL | 15:117db924cf7c | 245 | oidIgnoreType |
| wolfSSL | 15:117db924cf7c | 246 | }; |
| wolfSSL | 15:117db924cf7c | 247 | |
| wolfSSL | 15:117db924cf7c | 248 | |
| wolfSSL | 15:117db924cf7c | 249 | enum Hash_Sum { |
| wolfSSL | 15:117db924cf7c | 250 | MD2h = 646, |
| wolfSSL | 15:117db924cf7c | 251 | MD5h = 649, |
| wolfSSL | 15:117db924cf7c | 252 | SHAh = 88, |
| wolfSSL | 15:117db924cf7c | 253 | SHA224h = 417, |
| wolfSSL | 15:117db924cf7c | 254 | SHA256h = 414, |
| wolfSSL | 15:117db924cf7c | 255 | SHA384h = 415, |
| wolfSSL | 15:117db924cf7c | 256 | SHA512h = 416 |
| wolfSSL | 15:117db924cf7c | 257 | }; |
| wolfSSL | 15:117db924cf7c | 258 | |
| wolfSSL | 15:117db924cf7c | 259 | |
| wolfSSL | 15:117db924cf7c | 260 | #if !defined(NO_DES3) || !defined(NO_AES) |
| wolfSSL | 15:117db924cf7c | 261 | enum Block_Sum { |
| wolfSSL | 15:117db924cf7c | 262 | #ifdef WOLFSSL_AES_128 |
| wolfSSL | 15:117db924cf7c | 263 | AES128CBCb = 414, |
| wolfSSL | 15:117db924cf7c | 264 | #endif |
| wolfSSL | 15:117db924cf7c | 265 | #ifdef WOLFSSL_AES_192 |
| wolfSSL | 15:117db924cf7c | 266 | AES192CBCb = 434, |
| wolfSSL | 15:117db924cf7c | 267 | #endif |
| wolfSSL | 15:117db924cf7c | 268 | #ifdef WOLFSSL_AES_256 |
| wolfSSL | 15:117db924cf7c | 269 | AES256CBCb = 454, |
| wolfSSL | 15:117db924cf7c | 270 | #endif |
| wolfSSL | 15:117db924cf7c | 271 | #ifndef NO_DES3 |
| wolfSSL | 15:117db924cf7c | 272 | DESb = 69, |
| wolfSSL | 15:117db924cf7c | 273 | DES3b = 652 |
| wolfSSL | 15:117db924cf7c | 274 | #endif |
| wolfSSL | 15:117db924cf7c | 275 | }; |
| wolfSSL | 15:117db924cf7c | 276 | #endif /* !NO_DES3 || !NO_AES */ |
| wolfSSL | 15:117db924cf7c | 277 | |
| wolfSSL | 15:117db924cf7c | 278 | |
| wolfSSL | 15:117db924cf7c | 279 | enum Key_Sum { |
| wolfSSL | 15:117db924cf7c | 280 | DSAk = 515, |
| wolfSSL | 15:117db924cf7c | 281 | RSAk = 645, |
| wolfSSL | 15:117db924cf7c | 282 | NTRUk = 274, |
| wolfSSL | 15:117db924cf7c | 283 | ECDSAk = 518, |
| wolfSSL | 15:117db924cf7c | 284 | ED25519k = 256 |
| wolfSSL | 15:117db924cf7c | 285 | }; |
| wolfSSL | 15:117db924cf7c | 286 | |
| wolfSSL | 15:117db924cf7c | 287 | |
| wolfSSL | 15:117db924cf7c | 288 | #ifndef NO_AES |
| wolfSSL | 15:117db924cf7c | 289 | enum KeyWrap_Sum { |
| wolfSSL | 15:117db924cf7c | 290 | #ifdef WOLFSSL_AES_128 |
| wolfSSL | 15:117db924cf7c | 291 | AES128_WRAP = 417, |
| wolfSSL | 15:117db924cf7c | 292 | #endif |
| wolfSSL | 15:117db924cf7c | 293 | #ifdef WOLFSSL_AES_192 |
| wolfSSL | 15:117db924cf7c | 294 | AES192_WRAP = 437, |
| wolfSSL | 15:117db924cf7c | 295 | #endif |
| wolfSSL | 15:117db924cf7c | 296 | #ifdef WOLFSSL_AES_256 |
| wolfSSL | 15:117db924cf7c | 297 | AES256_WRAP = 457 |
| wolfSSL | 15:117db924cf7c | 298 | #endif |
| wolfSSL | 15:117db924cf7c | 299 | }; |
| wolfSSL | 15:117db924cf7c | 300 | #endif /* !NO_AES */ |
| wolfSSL | 15:117db924cf7c | 301 | |
| wolfSSL | 15:117db924cf7c | 302 | enum Key_Agree { |
| wolfSSL | 15:117db924cf7c | 303 | dhSinglePass_stdDH_sha1kdf_scheme = 464, |
| wolfSSL | 15:117db924cf7c | 304 | dhSinglePass_stdDH_sha224kdf_scheme = 188, |
| wolfSSL | 15:117db924cf7c | 305 | dhSinglePass_stdDH_sha256kdf_scheme = 189, |
| wolfSSL | 15:117db924cf7c | 306 | dhSinglePass_stdDH_sha384kdf_scheme = 190, |
| wolfSSL | 15:117db924cf7c | 307 | dhSinglePass_stdDH_sha512kdf_scheme = 191, |
| wolfSSL | 15:117db924cf7c | 308 | }; |
| wolfSSL | 15:117db924cf7c | 309 | |
| wolfSSL | 15:117db924cf7c | 310 | |
| wolfSSL | 15:117db924cf7c | 311 | enum Ecc_Sum { |
| wolfSSL | 15:117db924cf7c | 312 | ECC_SECP112R1_OID = 182, |
| wolfSSL | 15:117db924cf7c | 313 | ECC_SECP112R2_OID = 183, |
| wolfSSL | 15:117db924cf7c | 314 | ECC_SECP128R1_OID = 204, |
| wolfSSL | 15:117db924cf7c | 315 | ECC_SECP128R2_OID = 205, |
| wolfSSL | 15:117db924cf7c | 316 | ECC_SECP160R1_OID = 184, |
| wolfSSL | 15:117db924cf7c | 317 | ECC_SECP160R2_OID = 206, |
| wolfSSL | 15:117db924cf7c | 318 | ECC_SECP160K1_OID = 185, |
| wolfSSL | 15:117db924cf7c | 319 | ECC_BRAINPOOLP160R1_OID = 98, |
| wolfSSL | 15:117db924cf7c | 320 | ECC_SECP192R1_OID = 520, |
| wolfSSL | 15:117db924cf7c | 321 | ECC_PRIME192V2_OID = 521, |
| wolfSSL | 15:117db924cf7c | 322 | ECC_PRIME192V3_OID = 522, |
| wolfSSL | 15:117db924cf7c | 323 | ECC_SECP192K1_OID = 207, |
| wolfSSL | 15:117db924cf7c | 324 | ECC_BRAINPOOLP192R1_OID = 100, |
| wolfSSL | 15:117db924cf7c | 325 | ECC_SECP224R1_OID = 209, |
| wolfSSL | 15:117db924cf7c | 326 | ECC_SECP224K1_OID = 208, |
| wolfSSL | 15:117db924cf7c | 327 | ECC_BRAINPOOLP224R1_OID = 102, |
| wolfSSL | 15:117db924cf7c | 328 | ECC_PRIME239V1_OID = 523, |
| wolfSSL | 15:117db924cf7c | 329 | ECC_PRIME239V2_OID = 524, |
| wolfSSL | 15:117db924cf7c | 330 | ECC_PRIME239V3_OID = 525, |
| wolfSSL | 15:117db924cf7c | 331 | ECC_SECP256R1_OID = 526, |
| wolfSSL | 15:117db924cf7c | 332 | ECC_SECP256K1_OID = 186, |
| wolfSSL | 15:117db924cf7c | 333 | ECC_BRAINPOOLP256R1_OID = 104, |
| wolfSSL | 15:117db924cf7c | 334 | ECC_X25519_OID = 365, |
| wolfSSL | 15:117db924cf7c | 335 | ECC_ED25519_OID = 256, |
| wolfSSL | 15:117db924cf7c | 336 | ECC_BRAINPOOLP320R1_OID = 106, |
| wolfSSL | 15:117db924cf7c | 337 | ECC_SECP384R1_OID = 210, |
| wolfSSL | 15:117db924cf7c | 338 | ECC_BRAINPOOLP384R1_OID = 108, |
| wolfSSL | 15:117db924cf7c | 339 | ECC_BRAINPOOLP512R1_OID = 110, |
| wolfSSL | 15:117db924cf7c | 340 | ECC_SECP521R1_OID = 211, |
| wolfSSL | 15:117db924cf7c | 341 | }; |
| wolfSSL | 15:117db924cf7c | 342 | |
| wolfSSL | 15:117db924cf7c | 343 | |
| wolfSSL | 15:117db924cf7c | 344 | enum KDF_Sum { |
| wolfSSL | 15:117db924cf7c | 345 | PBKDF2_OID = 660 |
| wolfSSL | 15:117db924cf7c | 346 | }; |
| wolfSSL | 15:117db924cf7c | 347 | |
| wolfSSL | 15:117db924cf7c | 348 | |
| wolfSSL | 15:117db924cf7c | 349 | enum HMAC_Sum { |
| wolfSSL | 15:117db924cf7c | 350 | HMAC_SHA224_OID = 652, |
| wolfSSL | 15:117db924cf7c | 351 | HMAC_SHA256_OID = 653, |
| wolfSSL | 15:117db924cf7c | 352 | HMAC_SHA384_OID = 654, |
| wolfSSL | 15:117db924cf7c | 353 | HMAC_SHA512_OID = 655 |
| wolfSSL | 15:117db924cf7c | 354 | }; |
| wolfSSL | 15:117db924cf7c | 355 | |
| wolfSSL | 15:117db924cf7c | 356 | |
| wolfSSL | 15:117db924cf7c | 357 | enum Extensions_Sum { |
| wolfSSL | 15:117db924cf7c | 358 | BASIC_CA_OID = 133, |
| wolfSSL | 15:117db924cf7c | 359 | ALT_NAMES_OID = 131, |
| wolfSSL | 15:117db924cf7c | 360 | CRL_DIST_OID = 145, |
| wolfSSL | 15:117db924cf7c | 361 | AUTH_INFO_OID = 69, /* id-pe 1 */ |
| wolfSSL | 15:117db924cf7c | 362 | AUTH_KEY_OID = 149, |
| wolfSSL | 15:117db924cf7c | 363 | SUBJ_KEY_OID = 128, |
| wolfSSL | 15:117db924cf7c | 364 | CERT_POLICY_OID = 146, |
| wolfSSL | 15:117db924cf7c | 365 | KEY_USAGE_OID = 129, /* 2.5.29.15 */ |
| wolfSSL | 15:117db924cf7c | 366 | INHIBIT_ANY_OID = 168, /* 2.5.29.54 */ |
| wolfSSL | 15:117db924cf7c | 367 | EXT_KEY_USAGE_OID = 151, /* 2.5.29.37 */ |
| wolfSSL | 15:117db924cf7c | 368 | NAME_CONS_OID = 144, /* 2.5.29.30 */ |
| wolfSSL | 15:117db924cf7c | 369 | PRIV_KEY_USAGE_PERIOD_OID = 130, /* 2.5.29.16 */ |
| wolfSSL | 15:117db924cf7c | 370 | SUBJECT_INFO_ACCESS = 79, /* id-pe 11 */ |
| wolfSSL | 15:117db924cf7c | 371 | POLICY_MAP_OID = 147, |
| wolfSSL | 15:117db924cf7c | 372 | POLICY_CONST_OID = 150, |
| wolfSSL | 15:117db924cf7c | 373 | ISSUE_ALT_NAMES_OID = 132, |
| wolfSSL | 15:117db924cf7c | 374 | TLS_FEATURE_OID = 92 /* id-pe 24 */ |
| wolfSSL | 15:117db924cf7c | 375 | }; |
| wolfSSL | 15:117db924cf7c | 376 | |
| wolfSSL | 15:117db924cf7c | 377 | enum CertificatePolicy_Sum { |
| wolfSSL | 15:117db924cf7c | 378 | CP_ANY_OID = 146 /* id-ce 32 0 */ |
| wolfSSL | 15:117db924cf7c | 379 | }; |
| wolfSSL | 15:117db924cf7c | 380 | |
| wolfSSL | 15:117db924cf7c | 381 | enum SepHardwareName_Sum { |
| wolfSSL | 15:117db924cf7c | 382 | HW_NAME_OID = 79 /* 1.3.6.1.5.5.7.8.4 from RFC 4108*/ |
| wolfSSL | 15:117db924cf7c | 383 | }; |
| wolfSSL | 15:117db924cf7c | 384 | |
| wolfSSL | 15:117db924cf7c | 385 | enum AuthInfo_Sum { |
| wolfSSL | 15:117db924cf7c | 386 | AIA_OCSP_OID = 116, /* 1.3.6.1.5.5.7.48.1 */ |
| wolfSSL | 15:117db924cf7c | 387 | AIA_CA_ISSUER_OID = 117 /* 1.3.6.1.5.5.7.48.2 */ |
| wolfSSL | 15:117db924cf7c | 388 | }; |
| wolfSSL | 15:117db924cf7c | 389 | |
| wolfSSL | 15:117db924cf7c | 390 | enum ExtKeyUsage_Sum { /* From RFC 5280 */ |
| wolfSSL | 15:117db924cf7c | 391 | EKU_ANY_OID = 151, /* 2.5.29.37.0, anyExtendedKeyUsage */ |
| wolfSSL | 15:117db924cf7c | 392 | EKU_SERVER_AUTH_OID = 71, /* 1.3.6.1.5.5.7.3.1, id-kp-serverAuth */ |
| wolfSSL | 15:117db924cf7c | 393 | EKU_CLIENT_AUTH_OID = 72, /* 1.3.6.1.5.5.7.3.2, id-kp-clientAuth */ |
| wolfSSL | 15:117db924cf7c | 394 | EKU_CODESIGNING_OID = 73, /* 1.3.6.1.5.5.7.3.3, id-kp-codeSigning */ |
| wolfSSL | 15:117db924cf7c | 395 | EKU_EMAILPROTECT_OID = 74, /* 1.3.6.1.5.5.7.3.4, id-kp-emailProtection */ |
| wolfSSL | 15:117db924cf7c | 396 | EKU_TIMESTAMP_OID = 78, /* 1.3.6.1.5.5.7.3.8, id-kp-timeStamping */ |
| wolfSSL | 15:117db924cf7c | 397 | EKU_OCSP_SIGN_OID = 79 /* 1.3.6.1.5.5.7.3.9, id-kp-OCSPSigning */ |
| wolfSSL | 15:117db924cf7c | 398 | }; |
| wolfSSL | 15:117db924cf7c | 399 | |
| wolfSSL | 15:117db924cf7c | 400 | |
| wolfSSL | 15:117db924cf7c | 401 | enum VerifyType { |
| wolfSSL | 15:117db924cf7c | 402 | NO_VERIFY = 0, |
| wolfSSL | 15:117db924cf7c | 403 | VERIFY = 1, |
| wolfSSL | 15:117db924cf7c | 404 | VERIFY_CRL = 2, |
| wolfSSL | 15:117db924cf7c | 405 | VERIFY_OCSP = 3 |
| wolfSSL | 15:117db924cf7c | 406 | }; |
| wolfSSL | 15:117db924cf7c | 407 | |
| wolfSSL | 15:117db924cf7c | 408 | #ifdef WOLFSSL_CERT_EXT |
| wolfSSL | 15:117db924cf7c | 409 | enum KeyIdType { |
| wolfSSL | 15:117db924cf7c | 410 | SKID_TYPE = 0, |
| wolfSSL | 15:117db924cf7c | 411 | AKID_TYPE = 1 |
| wolfSSL | 15:117db924cf7c | 412 | }; |
| wolfSSL | 15:117db924cf7c | 413 | #endif |
| wolfSSL | 15:117db924cf7c | 414 | |
| wolfSSL | 15:117db924cf7c | 415 | /* Key usage extension bits (based on RFC 5280) */ |
| wolfSSL | 15:117db924cf7c | 416 | #define KEYUSE_DIGITAL_SIG 0x0080 |
| wolfSSL | 15:117db924cf7c | 417 | #define KEYUSE_CONTENT_COMMIT 0x0040 |
| wolfSSL | 15:117db924cf7c | 418 | #define KEYUSE_KEY_ENCIPHER 0x0020 |
| wolfSSL | 15:117db924cf7c | 419 | #define KEYUSE_DATA_ENCIPHER 0x0010 |
| wolfSSL | 15:117db924cf7c | 420 | #define KEYUSE_KEY_AGREE 0x0008 |
| wolfSSL | 15:117db924cf7c | 421 | #define KEYUSE_KEY_CERT_SIGN 0x0004 |
| wolfSSL | 15:117db924cf7c | 422 | #define KEYUSE_CRL_SIGN 0x0002 |
| wolfSSL | 15:117db924cf7c | 423 | #define KEYUSE_ENCIPHER_ONLY 0x0001 |
| wolfSSL | 15:117db924cf7c | 424 | #define KEYUSE_DECIPHER_ONLY 0x8000 |
| wolfSSL | 15:117db924cf7c | 425 | |
| wolfSSL | 15:117db924cf7c | 426 | /* Extended Key Usage bits (internal mapping only) */ |
| wolfSSL | 15:117db924cf7c | 427 | #define EXTKEYUSE_USER 0x80 |
| wolfSSL | 15:117db924cf7c | 428 | #define EXTKEYUSE_OCSP_SIGN 0x40 |
| wolfSSL | 15:117db924cf7c | 429 | #define EXTKEYUSE_TIMESTAMP 0x20 |
| wolfSSL | 15:117db924cf7c | 430 | #define EXTKEYUSE_EMAILPROT 0x10 |
| wolfSSL | 15:117db924cf7c | 431 | #define EXTKEYUSE_CODESIGN 0x08 |
| wolfSSL | 15:117db924cf7c | 432 | #define EXTKEYUSE_CLIENT_AUTH 0x04 |
| wolfSSL | 15:117db924cf7c | 433 | #define EXTKEYUSE_SERVER_AUTH 0x02 |
| wolfSSL | 15:117db924cf7c | 434 | #define EXTKEYUSE_ANY 0x01 |
| wolfSSL | 15:117db924cf7c | 435 | |
| wolfSSL | 15:117db924cf7c | 436 | typedef struct DNS_entry DNS_entry; |
| wolfSSL | 15:117db924cf7c | 437 | |
| wolfSSL | 15:117db924cf7c | 438 | struct DNS_entry { |
| wolfSSL | 15:117db924cf7c | 439 | DNS_entry* next; /* next on DNS list */ |
| wolfSSL | 15:117db924cf7c | 440 | int type; /* i.e. ASN_DNS_TYPE */ |
| wolfSSL | 15:117db924cf7c | 441 | int len; /* actual DNS len */ |
| wolfSSL | 15:117db924cf7c | 442 | char* name; /* actual DNS name */ |
| wolfSSL | 15:117db924cf7c | 443 | }; |
| wolfSSL | 15:117db924cf7c | 444 | |
| wolfSSL | 15:117db924cf7c | 445 | |
| wolfSSL | 15:117db924cf7c | 446 | typedef struct Base_entry Base_entry; |
| wolfSSL | 15:117db924cf7c | 447 | |
| wolfSSL | 15:117db924cf7c | 448 | struct Base_entry { |
| wolfSSL | 15:117db924cf7c | 449 | Base_entry* next; /* next on name base list */ |
| wolfSSL | 15:117db924cf7c | 450 | char* name; /* actual name base */ |
| wolfSSL | 15:117db924cf7c | 451 | int nameSz; /* name length */ |
| wolfSSL | 15:117db924cf7c | 452 | byte type; /* Name base type (DNS or RFC822) */ |
| wolfSSL | 15:117db924cf7c | 453 | }; |
| wolfSSL | 15:117db924cf7c | 454 | |
| wolfSSL | 15:117db924cf7c | 455 | #define DOMAIN_COMPONENT_MAX 10 |
| wolfSSL | 15:117db924cf7c | 456 | |
| wolfSSL | 15:117db924cf7c | 457 | struct DecodedName { |
| wolfSSL | 15:117db924cf7c | 458 | char* fullName; |
| wolfSSL | 15:117db924cf7c | 459 | int fullNameLen; |
| wolfSSL | 15:117db924cf7c | 460 | int entryCount; |
| wolfSSL | 15:117db924cf7c | 461 | int cnIdx; |
| wolfSSL | 15:117db924cf7c | 462 | int cnLen; |
| wolfSSL | 15:117db924cf7c | 463 | int snIdx; |
| wolfSSL | 15:117db924cf7c | 464 | int snLen; |
| wolfSSL | 15:117db924cf7c | 465 | int cIdx; |
| wolfSSL | 15:117db924cf7c | 466 | int cLen; |
| wolfSSL | 15:117db924cf7c | 467 | int lIdx; |
| wolfSSL | 15:117db924cf7c | 468 | int lLen; |
| wolfSSL | 15:117db924cf7c | 469 | int stIdx; |
| wolfSSL | 15:117db924cf7c | 470 | int stLen; |
| wolfSSL | 15:117db924cf7c | 471 | int oIdx; |
| wolfSSL | 15:117db924cf7c | 472 | int oLen; |
| wolfSSL | 15:117db924cf7c | 473 | int ouIdx; |
| wolfSSL | 15:117db924cf7c | 474 | int ouLen; |
| wolfSSL | 15:117db924cf7c | 475 | int emailIdx; |
| wolfSSL | 15:117db924cf7c | 476 | int emailLen; |
| wolfSSL | 15:117db924cf7c | 477 | int uidIdx; |
| wolfSSL | 15:117db924cf7c | 478 | int uidLen; |
| wolfSSL | 15:117db924cf7c | 479 | int serialIdx; |
| wolfSSL | 15:117db924cf7c | 480 | int serialLen; |
| wolfSSL | 15:117db924cf7c | 481 | int dcIdx[DOMAIN_COMPONENT_MAX]; |
| wolfSSL | 15:117db924cf7c | 482 | int dcLen[DOMAIN_COMPONENT_MAX]; |
| wolfSSL | 15:117db924cf7c | 483 | int dcNum; |
| wolfSSL | 15:117db924cf7c | 484 | int dcMode; |
| wolfSSL | 15:117db924cf7c | 485 | }; |
| wolfSSL | 15:117db924cf7c | 486 | |
| wolfSSL | 15:117db924cf7c | 487 | enum SignatureState { |
| wolfSSL | 15:117db924cf7c | 488 | SIG_STATE_BEGIN, |
| wolfSSL | 15:117db924cf7c | 489 | SIG_STATE_HASH, |
| wolfSSL | 15:117db924cf7c | 490 | SIG_STATE_KEY, |
| wolfSSL | 15:117db924cf7c | 491 | SIG_STATE_DO, |
| wolfSSL | 15:117db924cf7c | 492 | SIG_STATE_CHECK, |
| wolfSSL | 15:117db924cf7c | 493 | }; |
| wolfSSL | 15:117db924cf7c | 494 | |
| wolfSSL | 15:117db924cf7c | 495 | |
| wolfSSL | 15:117db924cf7c | 496 | #ifdef HAVE_PK_CALLBACKS |
| wolfSSL | 15:117db924cf7c | 497 | #ifdef HAVE_ECC |
| wolfSSL | 15:117db924cf7c | 498 | typedef int (*wc_CallbackEccVerify)( |
| wolfSSL | 15:117db924cf7c | 499 | const unsigned char* sig, unsigned int sigSz, |
| wolfSSL | 15:117db924cf7c | 500 | const unsigned char* hash, unsigned int hashSz, |
| wolfSSL | 15:117db924cf7c | 501 | const unsigned char* keyDer, unsigned int keySz, |
| wolfSSL | 15:117db924cf7c | 502 | int* result, void* ctx); |
| wolfSSL | 15:117db924cf7c | 503 | #endif |
| wolfSSL | 15:117db924cf7c | 504 | #ifndef NO_RSA |
| wolfSSL | 15:117db924cf7c | 505 | typedef int (*wc_CallbackRsaVerify)( |
| wolfSSL | 15:117db924cf7c | 506 | unsigned char* sig, unsigned int sigSz, |
| wolfSSL | 15:117db924cf7c | 507 | unsigned char** out, |
| wolfSSL | 15:117db924cf7c | 508 | const unsigned char* keyDer, unsigned int keySz, |
| wolfSSL | 15:117db924cf7c | 509 | void* ctx); |
| wolfSSL | 15:117db924cf7c | 510 | #endif |
| wolfSSL | 15:117db924cf7c | 511 | #endif /* HAVE_PK_CALLBACKS */ |
| wolfSSL | 15:117db924cf7c | 512 | |
| wolfSSL | 15:117db924cf7c | 513 | struct SignatureCtx { |
| wolfSSL | 15:117db924cf7c | 514 | void* heap; |
| wolfSSL | 15:117db924cf7c | 515 | byte* digest; |
| wolfSSL | 15:117db924cf7c | 516 | #ifndef NO_RSA |
| wolfSSL | 15:117db924cf7c | 517 | byte* out; |
| wolfSSL | 15:117db924cf7c | 518 | byte* plain; |
| wolfSSL | 15:117db924cf7c | 519 | #endif |
| wolfSSL | 15:117db924cf7c | 520 | #if defined(HAVE_ECC) || defined(HAVE_ED25519) |
| wolfSSL | 15:117db924cf7c | 521 | int verify; |
| wolfSSL | 15:117db924cf7c | 522 | #endif |
| wolfSSL | 15:117db924cf7c | 523 | union { |
| wolfSSL | 15:117db924cf7c | 524 | #ifndef NO_RSA |
| wolfSSL | 15:117db924cf7c | 525 | struct RsaKey* rsa; |
| wolfSSL | 15:117db924cf7c | 526 | #endif |
| wolfSSL | 15:117db924cf7c | 527 | #ifdef HAVE_ECC |
| wolfSSL | 15:117db924cf7c | 528 | struct ecc_key* ecc; |
| wolfSSL | 15:117db924cf7c | 529 | #endif |
| wolfSSL | 15:117db924cf7c | 530 | #ifdef HAVE_ED25519 |
| wolfSSL | 15:117db924cf7c | 531 | struct ed25519_key* ed25519; |
| wolfSSL | 15:117db924cf7c | 532 | #endif |
| wolfSSL | 15:117db924cf7c | 533 | void* ptr; |
| wolfSSL | 15:117db924cf7c | 534 | } key; |
| wolfSSL | 15:117db924cf7c | 535 | int devId; |
| wolfSSL | 15:117db924cf7c | 536 | int state; |
| wolfSSL | 15:117db924cf7c | 537 | int typeH; |
| wolfSSL | 15:117db924cf7c | 538 | int digestSz; |
| wolfSSL | 15:117db924cf7c | 539 | word32 keyOID; |
| wolfSSL | 15:117db924cf7c | 540 | #ifdef WOLFSSL_ASYNC_CRYPT |
| wolfSSL | 15:117db924cf7c | 541 | WC_ASYNC_DEV* asyncDev; |
| wolfSSL | 15:117db924cf7c | 542 | void* asyncCtx; |
| wolfSSL | 15:117db924cf7c | 543 | #endif |
| wolfSSL | 15:117db924cf7c | 544 | |
| wolfSSL | 15:117db924cf7c | 545 | #ifdef HAVE_PK_CALLBACKS |
| wolfSSL | 15:117db924cf7c | 546 | #ifdef HAVE_ECC |
| wolfSSL | 15:117db924cf7c | 547 | wc_CallbackEccVerify pkCbEcc; |
| wolfSSL | 15:117db924cf7c | 548 | void* pkCtxEcc; |
| wolfSSL | 15:117db924cf7c | 549 | #endif |
| wolfSSL | 15:117db924cf7c | 550 | #ifndef NO_RSA |
| wolfSSL | 15:117db924cf7c | 551 | wc_CallbackRsaVerify pkCbRsa; |
| wolfSSL | 15:117db924cf7c | 552 | void* pkCtxRsa; |
| wolfSSL | 15:117db924cf7c | 553 | #endif |
| wolfSSL | 15:117db924cf7c | 554 | #endif /* HAVE_PK_CALLBACKS */ |
| wolfSSL | 15:117db924cf7c | 555 | }; |
| wolfSSL | 15:117db924cf7c | 556 | |
| wolfSSL | 15:117db924cf7c | 557 | enum CertSignState { |
| wolfSSL | 15:117db924cf7c | 558 | CERTSIGN_STATE_BEGIN, |
| wolfSSL | 15:117db924cf7c | 559 | CERTSIGN_STATE_DIGEST, |
| wolfSSL | 15:117db924cf7c | 560 | CERTSIGN_STATE_ENCODE, |
| wolfSSL | 15:117db924cf7c | 561 | CERTSIGN_STATE_DO, |
| wolfSSL | 15:117db924cf7c | 562 | }; |
| wolfSSL | 15:117db924cf7c | 563 | |
| wolfSSL | 15:117db924cf7c | 564 | struct CertSignCtx { |
| wolfSSL | 15:117db924cf7c | 565 | byte* sig; |
| wolfSSL | 15:117db924cf7c | 566 | byte* digest; |
| wolfSSL | 15:117db924cf7c | 567 | #ifndef NO_RSA |
| wolfSSL | 15:117db924cf7c | 568 | byte* encSig; |
| wolfSSL | 15:117db924cf7c | 569 | int encSigSz; |
| wolfSSL | 15:117db924cf7c | 570 | #endif |
| wolfSSL | 15:117db924cf7c | 571 | int state; /* enum CertSignState */ |
| wolfSSL | 15:117db924cf7c | 572 | }; |
| wolfSSL | 15:117db924cf7c | 573 | |
| wolfSSL | 15:117db924cf7c | 574 | |
| wolfSSL | 15:117db924cf7c | 575 | typedef struct DecodedCert DecodedCert; |
| wolfSSL | 15:117db924cf7c | 576 | typedef struct DecodedName DecodedName; |
| wolfSSL | 15:117db924cf7c | 577 | typedef struct Signer Signer; |
| wolfSSL | 15:117db924cf7c | 578 | #ifdef WOLFSSL_TRUST_PEER_CERT |
| wolfSSL | 15:117db924cf7c | 579 | typedef struct TrustedPeerCert TrustedPeerCert; |
| wolfSSL | 15:117db924cf7c | 580 | #endif /* WOLFSSL_TRUST_PEER_CERT */ |
| wolfSSL | 15:117db924cf7c | 581 | typedef struct SignatureCtx SignatureCtx; |
| wolfSSL | 15:117db924cf7c | 582 | typedef struct CertSignCtx CertSignCtx; |
| wolfSSL | 15:117db924cf7c | 583 | |
| wolfSSL | 15:117db924cf7c | 584 | |
| wolfSSL | 15:117db924cf7c | 585 | struct DecodedCert { |
| wolfSSL | 15:117db924cf7c | 586 | byte* publicKey; |
| wolfSSL | 15:117db924cf7c | 587 | word32 pubKeySize; |
| wolfSSL | 15:117db924cf7c | 588 | int pubKeyStored; |
| wolfSSL | 15:117db924cf7c | 589 | word32 certBegin; /* offset to start of cert */ |
| wolfSSL | 15:117db924cf7c | 590 | word32 sigIndex; /* offset to start of signature */ |
| wolfSSL | 15:117db924cf7c | 591 | word32 sigLength; /* length of signature */ |
| wolfSSL | 15:117db924cf7c | 592 | word32 signatureOID; /* sum of algorithm object id */ |
| wolfSSL | 15:117db924cf7c | 593 | word32 keyOID; /* sum of key algo object id */ |
| wolfSSL | 15:117db924cf7c | 594 | int version; /* cert version, 1 or 3 */ |
| wolfSSL | 15:117db924cf7c | 595 | DNS_entry* altNames; /* alt names list of dns entries */ |
| wolfSSL | 15:117db924cf7c | 596 | #ifndef IGNORE_NAME_CONSTRAINTS |
| wolfSSL | 15:117db924cf7c | 597 | DNS_entry* altEmailNames; /* alt names list of RFC822 entries */ |
| wolfSSL | 15:117db924cf7c | 598 | Base_entry* permittedNames; /* Permitted name bases */ |
| wolfSSL | 15:117db924cf7c | 599 | Base_entry* excludedNames; /* Excluded name bases */ |
| wolfSSL | 15:117db924cf7c | 600 | #endif /* IGNORE_NAME_CONSTRAINTS */ |
| wolfSSL | 15:117db924cf7c | 601 | byte subjectHash[KEYID_SIZE]; /* hash of all Names */ |
| wolfSSL | 15:117db924cf7c | 602 | byte issuerHash[KEYID_SIZE]; /* hash of all Names */ |
| wolfSSL | 15:117db924cf7c | 603 | #ifdef HAVE_OCSP |
| wolfSSL | 15:117db924cf7c | 604 | byte issuerKeyHash[KEYID_SIZE]; /* hash of the public Key */ |
| wolfSSL | 15:117db924cf7c | 605 | #endif /* HAVE_OCSP */ |
| wolfSSL | 15:117db924cf7c | 606 | byte* signature; /* not owned, points into raw cert */ |
| wolfSSL | 15:117db924cf7c | 607 | char* subjectCN; /* CommonName */ |
| wolfSSL | 15:117db924cf7c | 608 | int subjectCNLen; /* CommonName Length */ |
| wolfSSL | 15:117db924cf7c | 609 | char subjectCNEnc; /* CommonName Encoding */ |
| wolfSSL | 15:117db924cf7c | 610 | char issuer[ASN_NAME_MAX]; /* full name including common name */ |
| wolfSSL | 15:117db924cf7c | 611 | char subject[ASN_NAME_MAX]; /* full name including common name */ |
| wolfSSL | 15:117db924cf7c | 612 | int verify; /* Default to yes, but could be off */ |
| wolfSSL | 15:117db924cf7c | 613 | byte* source; /* byte buffer holder cert, NOT owner */ |
| wolfSSL | 15:117db924cf7c | 614 | word32 srcIdx; /* current offset into buffer */ |
| wolfSSL | 15:117db924cf7c | 615 | word32 maxIdx; /* max offset based on init size */ |
| wolfSSL | 15:117db924cf7c | 616 | void* heap; /* for user memory overrides */ |
| wolfSSL | 15:117db924cf7c | 617 | byte serial[EXTERNAL_SERIAL_SIZE]; /* raw serial number */ |
| wolfSSL | 15:117db924cf7c | 618 | int serialSz; /* raw serial bytes stored */ |
| wolfSSL | 15:117db924cf7c | 619 | byte* extensions; /* not owned, points into raw cert */ |
| wolfSSL | 15:117db924cf7c | 620 | int extensionsSz; /* length of cert extensions */ |
| wolfSSL | 15:117db924cf7c | 621 | word32 extensionsIdx; /* if want to go back and parse later */ |
| wolfSSL | 15:117db924cf7c | 622 | byte* extAuthInfo; /* Authority Information Access URI */ |
| wolfSSL | 15:117db924cf7c | 623 | int extAuthInfoSz; /* length of the URI */ |
| wolfSSL | 15:117db924cf7c | 624 | byte* extCrlInfo; /* CRL Distribution Points */ |
| wolfSSL | 15:117db924cf7c | 625 | int extCrlInfoSz; /* length of the URI */ |
| wolfSSL | 15:117db924cf7c | 626 | byte extSubjKeyId[KEYID_SIZE]; /* Subject Key ID */ |
| wolfSSL | 15:117db924cf7c | 627 | byte extAuthKeyId[KEYID_SIZE]; /* Authority Key ID */ |
| wolfSSL | 15:117db924cf7c | 628 | byte pathLength; /* CA basic constraint path length */ |
| wolfSSL | 15:117db924cf7c | 629 | word16 extKeyUsage; /* Key usage bitfield */ |
| wolfSSL | 15:117db924cf7c | 630 | byte extExtKeyUsage; /* Extended Key usage bitfield */ |
| wolfSSL | 15:117db924cf7c | 631 | |
| wolfSSL | 15:117db924cf7c | 632 | #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL) |
| wolfSSL | 15:117db924cf7c | 633 | byte* extExtKeyUsageSrc; |
| wolfSSL | 15:117db924cf7c | 634 | word32 extExtKeyUsageSz; |
| wolfSSL | 15:117db924cf7c | 635 | word32 extExtKeyUsageCount; |
| wolfSSL | 15:117db924cf7c | 636 | byte* extAuthKeyIdSrc; |
| wolfSSL | 15:117db924cf7c | 637 | word32 extAuthKeyIdSz; |
| wolfSSL | 15:117db924cf7c | 638 | byte* extSubjKeyIdSrc; |
| wolfSSL | 15:117db924cf7c | 639 | word32 extSubjKeyIdSz; |
| wolfSSL | 15:117db924cf7c | 640 | #endif |
| wolfSSL | 15:117db924cf7c | 641 | |
| wolfSSL | 15:117db924cf7c | 642 | #if defined(HAVE_ECC) || defined(HAVE_ED25519) |
| wolfSSL | 15:117db924cf7c | 643 | word32 pkCurveOID; /* Public Key's curve OID */ |
| wolfSSL | 15:117db924cf7c | 644 | #endif /* HAVE_ECC */ |
| wolfSSL | 15:117db924cf7c | 645 | byte* beforeDate; |
| wolfSSL | 15:117db924cf7c | 646 | int beforeDateLen; |
| wolfSSL | 15:117db924cf7c | 647 | byte* afterDate; |
| wolfSSL | 15:117db924cf7c | 648 | int afterDateLen; |
| wolfSSL | 15:117db924cf7c | 649 | #ifdef HAVE_PKCS7 |
| wolfSSL | 15:117db924cf7c | 650 | byte* issuerRaw; /* pointer to issuer inside source */ |
| wolfSSL | 15:117db924cf7c | 651 | int issuerRawLen; |
| wolfSSL | 15:117db924cf7c | 652 | #endif |
| wolfSSL | 15:117db924cf7c | 653 | #ifndef IGNORE_NAME_CONSTRAINT |
| wolfSSL | 15:117db924cf7c | 654 | byte* subjectRaw; /* pointer to subject inside source */ |
| wolfSSL | 15:117db924cf7c | 655 | int subjectRawLen; |
| wolfSSL | 15:117db924cf7c | 656 | #endif |
| wolfSSL | 15:117db924cf7c | 657 | #ifdef WOLFSSL_CERT_GEN |
| wolfSSL | 15:117db924cf7c | 658 | /* easy access to subject info for other sign */ |
| wolfSSL | 15:117db924cf7c | 659 | char* subjectSN; |
| wolfSSL | 15:117db924cf7c | 660 | int subjectSNLen; |
| wolfSSL | 15:117db924cf7c | 661 | char subjectSNEnc; |
| wolfSSL | 15:117db924cf7c | 662 | char* subjectC; |
| wolfSSL | 15:117db924cf7c | 663 | int subjectCLen; |
| wolfSSL | 15:117db924cf7c | 664 | char subjectCEnc; |
| wolfSSL | 15:117db924cf7c | 665 | char* subjectL; |
| wolfSSL | 15:117db924cf7c | 666 | int subjectLLen; |
| wolfSSL | 15:117db924cf7c | 667 | char subjectLEnc; |
| wolfSSL | 15:117db924cf7c | 668 | char* subjectST; |
| wolfSSL | 15:117db924cf7c | 669 | int subjectSTLen; |
| wolfSSL | 15:117db924cf7c | 670 | char subjectSTEnc; |
| wolfSSL | 15:117db924cf7c | 671 | char* subjectO; |
| wolfSSL | 15:117db924cf7c | 672 | int subjectOLen; |
| wolfSSL | 15:117db924cf7c | 673 | char subjectOEnc; |
| wolfSSL | 15:117db924cf7c | 674 | char* subjectOU; |
| wolfSSL | 15:117db924cf7c | 675 | int subjectOULen; |
| wolfSSL | 15:117db924cf7c | 676 | char subjectOUEnc; |
| wolfSSL | 15:117db924cf7c | 677 | char* subjectEmail; |
| wolfSSL | 15:117db924cf7c | 678 | int subjectEmailLen; |
| wolfSSL | 15:117db924cf7c | 679 | #endif /* WOLFSSL_CERT_GEN */ |
| wolfSSL | 15:117db924cf7c | 680 | #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL) |
| wolfSSL | 15:117db924cf7c | 681 | DecodedName issuerName; |
| wolfSSL | 15:117db924cf7c | 682 | DecodedName subjectName; |
| wolfSSL | 15:117db924cf7c | 683 | #endif /* OPENSSL_EXTRA */ |
| wolfSSL | 15:117db924cf7c | 684 | #ifdef WOLFSSL_SEP |
| wolfSSL | 15:117db924cf7c | 685 | int deviceTypeSz; |
| wolfSSL | 15:117db924cf7c | 686 | byte* deviceType; |
| wolfSSL | 15:117db924cf7c | 687 | int hwTypeSz; |
| wolfSSL | 15:117db924cf7c | 688 | byte* hwType; |
| wolfSSL | 15:117db924cf7c | 689 | int hwSerialNumSz; |
| wolfSSL | 15:117db924cf7c | 690 | byte* hwSerialNum; |
| wolfSSL | 15:117db924cf7c | 691 | #endif /* WOLFSSL_SEP */ |
| wolfSSL | 15:117db924cf7c | 692 | #ifdef WOLFSSL_CERT_EXT |
| wolfSSL | 15:117db924cf7c | 693 | char extCertPolicies[MAX_CERTPOL_NB][MAX_CERTPOL_SZ]; |
| wolfSSL | 15:117db924cf7c | 694 | int extCertPoliciesNb; |
| wolfSSL | 15:117db924cf7c | 695 | #endif /* WOLFSSL_CERT_EXT */ |
| wolfSSL | 15:117db924cf7c | 696 | |
| wolfSSL | 15:117db924cf7c | 697 | Signer* ca; |
| wolfSSL | 15:117db924cf7c | 698 | SignatureCtx sigCtx; |
| wolfSSL | 15:117db924cf7c | 699 | |
| wolfSSL | 15:117db924cf7c | 700 | /* Option Bits */ |
| wolfSSL | 15:117db924cf7c | 701 | byte subjectCNStored : 1; /* have we saved a copy we own */ |
| wolfSSL | 15:117db924cf7c | 702 | byte extSubjKeyIdSet : 1; /* Set when the SKID was read from cert */ |
| wolfSSL | 15:117db924cf7c | 703 | byte extAuthKeyIdSet : 1; /* Set when the AKID was read from cert */ |
| wolfSSL | 15:117db924cf7c | 704 | #ifndef IGNORE_NAME_CONSTRAINTS |
| wolfSSL | 15:117db924cf7c | 705 | byte extNameConstraintSet : 1; |
| wolfSSL | 15:117db924cf7c | 706 | #endif |
| wolfSSL | 15:117db924cf7c | 707 | byte isCA : 1; /* CA basic constraint true */ |
| wolfSSL | 15:117db924cf7c | 708 | byte pathLengthSet : 1; /* CA basic const path length set */ |
| wolfSSL | 15:117db924cf7c | 709 | byte weOwnAltNames : 1; /* altNames haven't been given to copy */ |
| wolfSSL | 15:117db924cf7c | 710 | byte extKeyUsageSet : 1; |
| wolfSSL | 15:117db924cf7c | 711 | byte extExtKeyUsageSet : 1; /* Extended Key Usage set */ |
| wolfSSL | 15:117db924cf7c | 712 | byte extCRLdistSet : 1; |
| wolfSSL | 15:117db924cf7c | 713 | byte extAuthInfoSet : 1; |
| wolfSSL | 15:117db924cf7c | 714 | byte extBasicConstSet : 1; |
| wolfSSL | 15:117db924cf7c | 715 | byte extSubjAltNameSet : 1; |
| wolfSSL | 15:117db924cf7c | 716 | byte inhibitAnyOidSet : 1; |
| wolfSSL | 15:117db924cf7c | 717 | #ifdef WOLFSSL_SEP |
| wolfSSL | 15:117db924cf7c | 718 | byte extCertPolicySet : 1; |
| wolfSSL | 15:117db924cf7c | 719 | #endif |
| wolfSSL | 15:117db924cf7c | 720 | #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL) |
| wolfSSL | 15:117db924cf7c | 721 | byte extCRLdistCrit : 1; |
| wolfSSL | 15:117db924cf7c | 722 | byte extAuthInfoCrit : 1; |
| wolfSSL | 15:117db924cf7c | 723 | byte extBasicConstCrit : 1; |
| wolfSSL | 15:117db924cf7c | 724 | byte extSubjAltNameCrit : 1; |
| wolfSSL | 15:117db924cf7c | 725 | byte extAuthKeyIdCrit : 1; |
| wolfSSL | 15:117db924cf7c | 726 | #ifndef IGNORE_NAME_CONSTRAINTS |
| wolfSSL | 15:117db924cf7c | 727 | byte extNameConstraintCrit : 1; |
| wolfSSL | 15:117db924cf7c | 728 | #endif |
| wolfSSL | 15:117db924cf7c | 729 | byte extSubjKeyIdCrit : 1; |
| wolfSSL | 15:117db924cf7c | 730 | byte extKeyUsageCrit : 1; |
| wolfSSL | 15:117db924cf7c | 731 | byte extExtKeyUsageCrit : 1; |
| wolfSSL | 15:117db924cf7c | 732 | #endif /* OPENSSL_EXTRA */ |
| wolfSSL | 15:117db924cf7c | 733 | #ifdef WOLFSSL_SEP |
| wolfSSL | 15:117db924cf7c | 734 | byte extCertPolicyCrit : 1; |
| wolfSSL | 15:117db924cf7c | 735 | #endif |
| wolfSSL | 15:117db924cf7c | 736 | |
| wolfSSL | 15:117db924cf7c | 737 | }; |
| wolfSSL | 15:117db924cf7c | 738 | |
| wolfSSL | 15:117db924cf7c | 739 | |
| wolfSSL | 15:117db924cf7c | 740 | #ifdef NO_SHA |
| wolfSSL | 15:117db924cf7c | 741 | #define SIGNER_DIGEST_SIZE WC_SHA256_DIGEST_SIZE |
| wolfSSL | 15:117db924cf7c | 742 | #else |
| wolfSSL | 15:117db924cf7c | 743 | #define SIGNER_DIGEST_SIZE WC_SHA_DIGEST_SIZE |
| wolfSSL | 15:117db924cf7c | 744 | #endif |
| wolfSSL | 15:117db924cf7c | 745 | |
| wolfSSL | 15:117db924cf7c | 746 | /* CA Signers */ |
| wolfSSL | 15:117db924cf7c | 747 | /* if change layout change PERSIST_CERT_CACHE functions too */ |
| wolfSSL | 15:117db924cf7c | 748 | struct Signer { |
| wolfSSL | 15:117db924cf7c | 749 | word32 pubKeySize; |
| wolfSSL | 15:117db924cf7c | 750 | word32 keyOID; /* key type */ |
| wolfSSL | 15:117db924cf7c | 751 | word16 keyUsage; |
| wolfSSL | 15:117db924cf7c | 752 | byte pathLength; |
| wolfSSL | 15:117db924cf7c | 753 | byte pathLengthSet; |
| wolfSSL | 15:117db924cf7c | 754 | byte* publicKey; |
| wolfSSL | 15:117db924cf7c | 755 | int nameLen; |
| wolfSSL | 15:117db924cf7c | 756 | char* name; /* common name */ |
| wolfSSL | 15:117db924cf7c | 757 | #ifndef IGNORE_NAME_CONSTRAINTS |
| wolfSSL | 15:117db924cf7c | 758 | Base_entry* permittedNames; |
| wolfSSL | 15:117db924cf7c | 759 | Base_entry* excludedNames; |
| wolfSSL | 15:117db924cf7c | 760 | #endif /* IGNORE_NAME_CONSTRAINTS */ |
| wolfSSL | 15:117db924cf7c | 761 | byte subjectNameHash[SIGNER_DIGEST_SIZE]; |
| wolfSSL | 15:117db924cf7c | 762 | /* sha hash of names in certificate */ |
| wolfSSL | 15:117db924cf7c | 763 | #ifndef NO_SKID |
| wolfSSL | 15:117db924cf7c | 764 | byte subjectKeyIdHash[SIGNER_DIGEST_SIZE]; |
| wolfSSL | 15:117db924cf7c | 765 | /* sha hash of names in certificate */ |
| wolfSSL | 15:117db924cf7c | 766 | #endif |
| wolfSSL | 15:117db924cf7c | 767 | #ifdef WOLFSSL_SIGNER_DER_CERT |
| wolfSSL | 15:117db924cf7c | 768 | DerBuffer* derCert; |
| wolfSSL | 15:117db924cf7c | 769 | #endif |
| wolfSSL | 15:117db924cf7c | 770 | Signer* next; |
| wolfSSL | 15:117db924cf7c | 771 | }; |
| wolfSSL | 15:117db924cf7c | 772 | |
| wolfSSL | 15:117db924cf7c | 773 | |
| wolfSSL | 15:117db924cf7c | 774 | #ifdef WOLFSSL_TRUST_PEER_CERT |
| wolfSSL | 15:117db924cf7c | 775 | /* used for having trusted peer certs rather then CA */ |
| wolfSSL | 15:117db924cf7c | 776 | struct TrustedPeerCert { |
| wolfSSL | 15:117db924cf7c | 777 | int nameLen; |
| wolfSSL | 15:117db924cf7c | 778 | char* name; /* common name */ |
| wolfSSL | 15:117db924cf7c | 779 | #ifndef IGNORE_NAME_CONSTRAINTS |
| wolfSSL | 15:117db924cf7c | 780 | Base_entry* permittedNames; |
| wolfSSL | 15:117db924cf7c | 781 | Base_entry* excludedNames; |
| wolfSSL | 15:117db924cf7c | 782 | #endif /* IGNORE_NAME_CONSTRAINTS */ |
| wolfSSL | 15:117db924cf7c | 783 | byte subjectNameHash[SIGNER_DIGEST_SIZE]; |
| wolfSSL | 15:117db924cf7c | 784 | /* sha hash of names in certificate */ |
| wolfSSL | 15:117db924cf7c | 785 | #ifndef NO_SKID |
| wolfSSL | 15:117db924cf7c | 786 | byte subjectKeyIdHash[SIGNER_DIGEST_SIZE]; |
| wolfSSL | 15:117db924cf7c | 787 | /* sha hash of names in certificate */ |
| wolfSSL | 15:117db924cf7c | 788 | #endif |
| wolfSSL | 15:117db924cf7c | 789 | word32 sigLen; |
| wolfSSL | 15:117db924cf7c | 790 | byte* sig; |
| wolfSSL | 15:117db924cf7c | 791 | struct TrustedPeerCert* next; |
| wolfSSL | 15:117db924cf7c | 792 | }; |
| wolfSSL | 15:117db924cf7c | 793 | #endif /* WOLFSSL_TRUST_PEER_CERT */ |
| wolfSSL | 15:117db924cf7c | 794 | |
| wolfSSL | 15:117db924cf7c | 795 | |
| wolfSSL | 15:117db924cf7c | 796 | /* for testing or custom openssl wrappers */ |
| wolfSSL | 15:117db924cf7c | 797 | #if defined(WOLFSSL_TEST_CERT) || defined(OPENSSL_EXTRA) || \ |
| wolfSSL | 15:117db924cf7c | 798 | defined(OPENSSL_EXTRA_X509_SMALL) |
| wolfSSL | 15:117db924cf7c | 799 | #define WOLFSSL_ASN_API WOLFSSL_API |
| wolfSSL | 15:117db924cf7c | 800 | #else |
| wolfSSL | 15:117db924cf7c | 801 | #define WOLFSSL_ASN_API WOLFSSL_LOCAL |
| wolfSSL | 15:117db924cf7c | 802 | #endif |
| wolfSSL | 15:117db924cf7c | 803 | |
| wolfSSL | 15:117db924cf7c | 804 | WOLFSSL_ASN_API int wc_BerToDer(const byte* ber, word32 berSz, byte* der, |
| wolfSSL | 15:117db924cf7c | 805 | word32* derSz); |
| wolfSSL | 15:117db924cf7c | 806 | |
| wolfSSL | 15:117db924cf7c | 807 | WOLFSSL_ASN_API void FreeAltNames(DNS_entry*, void*); |
| wolfSSL | 15:117db924cf7c | 808 | #ifndef IGNORE_NAME_CONSTRAINTS |
| wolfSSL | 15:117db924cf7c | 809 | WOLFSSL_ASN_API void FreeNameSubtrees(Base_entry*, void*); |
| wolfSSL | 15:117db924cf7c | 810 | #endif /* IGNORE_NAME_CONSTRAINTS */ |
| wolfSSL | 15:117db924cf7c | 811 | WOLFSSL_ASN_API void InitDecodedCert(DecodedCert*, byte*, word32, void*); |
| wolfSSL | 15:117db924cf7c | 812 | WOLFSSL_ASN_API void FreeDecodedCert(DecodedCert*); |
| wolfSSL | 15:117db924cf7c | 813 | WOLFSSL_ASN_API int ParseCert(DecodedCert*, int type, int verify, void* cm); |
| wolfSSL | 15:117db924cf7c | 814 | |
| wolfSSL | 15:117db924cf7c | 815 | WOLFSSL_LOCAL int DecodePolicyOID(char *o, word32 oSz, byte *in, word32 inSz); |
| wolfSSL | 15:117db924cf7c | 816 | WOLFSSL_LOCAL int ParseCertRelative(DecodedCert*,int type,int verify,void* cm); |
| wolfSSL | 15:117db924cf7c | 817 | WOLFSSL_LOCAL int DecodeToKey(DecodedCert*, int verify); |
| wolfSSL | 15:117db924cf7c | 818 | |
| wolfSSL | 15:117db924cf7c | 819 | WOLFSSL_LOCAL const byte* OidFromId(word32 id, word32 type, word32* oidSz); |
| wolfSSL | 15:117db924cf7c | 820 | WOLFSSL_LOCAL Signer* MakeSigner(void*); |
| wolfSSL | 15:117db924cf7c | 821 | WOLFSSL_LOCAL void FreeSigner(Signer*, void*); |
| wolfSSL | 15:117db924cf7c | 822 | WOLFSSL_LOCAL void FreeSignerTable(Signer**, int, void*); |
| wolfSSL | 15:117db924cf7c | 823 | #ifdef WOLFSSL_TRUST_PEER_CERT |
| wolfSSL | 15:117db924cf7c | 824 | WOLFSSL_LOCAL void FreeTrustedPeer(TrustedPeerCert*, void*); |
| wolfSSL | 15:117db924cf7c | 825 | WOLFSSL_LOCAL void FreeTrustedPeerTable(TrustedPeerCert**, int, void*); |
| wolfSSL | 15:117db924cf7c | 826 | #endif /* WOLFSSL_TRUST_PEER_CERT */ |
| wolfSSL | 15:117db924cf7c | 827 | |
| wolfSSL | 15:117db924cf7c | 828 | WOLFSSL_ASN_API int ToTraditional(byte* buffer, word32 length); |
| wolfSSL | 15:117db924cf7c | 829 | WOLFSSL_LOCAL int ToTraditionalInline(const byte* input, word32* inOutIdx, |
| wolfSSL | 15:117db924cf7c | 830 | word32 length); |
| wolfSSL | 15:117db924cf7c | 831 | WOLFSSL_LOCAL int ToTraditionalEnc(byte* buffer, word32 length,const char*,int); |
| wolfSSL | 15:117db924cf7c | 832 | WOLFSSL_ASN_API int UnTraditionalEnc(byte* key, word32 keySz, byte* out, |
| wolfSSL | 15:117db924cf7c | 833 | word32* outSz, const char* password, int passwordSz, int vPKCS, |
| wolfSSL | 15:117db924cf7c | 834 | int vAlgo, byte* salt, word32 saltSz, int itt, WC_RNG* rng, void* heap); |
| wolfSSL | 15:117db924cf7c | 835 | WOLFSSL_LOCAL int DecryptContent(byte* input, word32 sz,const char* psw,int pswSz); |
| wolfSSL | 15:117db924cf7c | 836 | WOLFSSL_LOCAL int EncryptContent(byte* input, word32 sz, byte* out, word32* outSz, |
| wolfSSL | 15:117db924cf7c | 837 | const char* password,int passwordSz, int vPKCS, int vAlgo, |
| wolfSSL | 15:117db924cf7c | 838 | byte* salt, word32 saltSz, int itt, WC_RNG* rng, void* heap); |
| wolfSSL | 15:117db924cf7c | 839 | WOLFSSL_LOCAL int wc_GetKeyOID(byte* key, word32 keySz, const byte** curveOID, |
| wolfSSL | 15:117db924cf7c | 840 | word32* oidSz, int* algoID, void* heap); |
| wolfSSL | 15:117db924cf7c | 841 | |
| wolfSSL | 15:117db924cf7c | 842 | typedef struct tm wolfssl_tm; |
| wolfSSL | 15:117db924cf7c | 843 | #if defined(OPENSSL_ALL) || defined(WOLFSSL_MYSQL_COMPATIBLE) || defined(OPENSSL_EXTRA) || \ |
| wolfSSL | 15:117db924cf7c | 844 | defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY) |
| wolfSSL | 15:117db924cf7c | 845 | WOLFSSL_LOCAL int GetTimeString(byte* date, int format, char* buf, int len); |
| wolfSSL | 15:117db924cf7c | 846 | #endif |
| wolfSSL | 15:117db924cf7c | 847 | WOLFSSL_LOCAL int ExtractDate(const unsigned char* date, unsigned char format, |
| wolfSSL | 15:117db924cf7c | 848 | wolfssl_tm* certTime, int* idx); |
| wolfSSL | 15:117db924cf7c | 849 | WOLFSSL_LOCAL int ValidateDate(const byte* date, byte format, int dateType); |
| wolfSSL | 15:117db924cf7c | 850 | |
| wolfSSL | 15:117db924cf7c | 851 | /* ASN.1 helper functions */ |
| wolfSSL | 15:117db924cf7c | 852 | #ifdef WOLFSSL_CERT_GEN |
| wolfSSL | 15:117db924cf7c | 853 | WOLFSSL_ASN_API int SetName(byte* output, word32 outputSz, CertName* name); |
| wolfSSL | 15:117db924cf7c | 854 | #endif |
| wolfSSL | 15:117db924cf7c | 855 | WOLFSSL_LOCAL int GetShortInt(const byte* input, word32* inOutIdx, int* number, |
| wolfSSL | 15:117db924cf7c | 856 | word32 maxIdx); |
| wolfSSL | 15:117db924cf7c | 857 | WOLFSSL_LOCAL char* GetSigName(int oid); |
| wolfSSL | 15:117db924cf7c | 858 | WOLFSSL_LOCAL int GetLength(const byte* input, word32* inOutIdx, int* len, |
| wolfSSL | 15:117db924cf7c | 859 | word32 maxIdx); |
| wolfSSL | 15:117db924cf7c | 860 | WOLFSSL_LOCAL int GetSequence(const byte* input, word32* inOutIdx, int* len, |
| wolfSSL | 15:117db924cf7c | 861 | word32 maxIdx); |
| wolfSSL | 15:117db924cf7c | 862 | WOLFSSL_LOCAL int GetSet(const byte* input, word32* inOutIdx, int* len, |
| wolfSSL | 15:117db924cf7c | 863 | word32 maxIdx); |
| wolfSSL | 15:117db924cf7c | 864 | WOLFSSL_LOCAL int GetMyVersion(const byte* input, word32* inOutIdx, |
| wolfSSL | 15:117db924cf7c | 865 | int* version, word32 maxIdx); |
| wolfSSL | 15:117db924cf7c | 866 | WOLFSSL_LOCAL int GetInt(mp_int* mpi, const byte* input, word32* inOutIdx, |
| wolfSSL | 15:117db924cf7c | 867 | word32 maxIdx); |
| wolfSSL | 15:117db924cf7c | 868 | #ifdef HAVE_OID_ENCODING |
| wolfSSL | 15:117db924cf7c | 869 | WOLFSSL_LOCAL int EncodeObjectId(const word16* in, word32 inSz, |
| wolfSSL | 15:117db924cf7c | 870 | byte* out, word32* outSz); |
| wolfSSL | 15:117db924cf7c | 871 | #endif |
| wolfSSL | 15:117db924cf7c | 872 | #ifdef HAVE_OID_DECODING |
| wolfSSL | 15:117db924cf7c | 873 | WOLFSSL_LOCAL int DecodeObjectId(const byte* in, word32 inSz, |
| wolfSSL | 15:117db924cf7c | 874 | word16* out, word32* outSz); |
| wolfSSL | 15:117db924cf7c | 875 | #endif |
| wolfSSL | 15:117db924cf7c | 876 | WOLFSSL_LOCAL int GetObjectId(const byte* input, word32* inOutIdx, word32* oid, |
| wolfSSL | 15:117db924cf7c | 877 | word32 oidType, word32 maxIdx); |
| wolfSSL | 15:117db924cf7c | 878 | WOLFSSL_LOCAL int GetAlgoId(const byte* input, word32* inOutIdx, word32* oid, |
| wolfSSL | 15:117db924cf7c | 879 | word32 oidType, word32 maxIdx); |
| wolfSSL | 15:117db924cf7c | 880 | WOLFSSL_LOCAL word32 SetLength(word32 length, byte* output); |
| wolfSSL | 15:117db924cf7c | 881 | WOLFSSL_LOCAL word32 SetSequence(word32 len, byte* output); |
| wolfSSL | 15:117db924cf7c | 882 | WOLFSSL_LOCAL word32 SetOctetString(word32 len, byte* output); |
| wolfSSL | 15:117db924cf7c | 883 | WOLFSSL_LOCAL word32 SetImplicit(byte tag,byte number,word32 len,byte* output); |
| wolfSSL | 15:117db924cf7c | 884 | WOLFSSL_LOCAL word32 SetExplicit(byte number, word32 len, byte* output); |
| wolfSSL | 15:117db924cf7c | 885 | WOLFSSL_LOCAL word32 SetSet(word32 len, byte* output); |
| wolfSSL | 15:117db924cf7c | 886 | WOLFSSL_LOCAL word32 SetAlgoID(int algoOID,byte* output,int type,int curveSz); |
| wolfSSL | 15:117db924cf7c | 887 | WOLFSSL_LOCAL int SetMyVersion(word32 version, byte* output, int header); |
| wolfSSL | 15:117db924cf7c | 888 | WOLFSSL_LOCAL int SetSerialNumber(const byte* sn, word32 snSz, byte* output, |
| wolfSSL | 15:117db924cf7c | 889 | int maxSnSz); |
| wolfSSL | 15:117db924cf7c | 890 | WOLFSSL_LOCAL int GetSerialNumber(const byte* input, word32* inOutIdx, |
| wolfSSL | 15:117db924cf7c | 891 | byte* serial, int* serialSz, word32 maxIdx); |
| wolfSSL | 15:117db924cf7c | 892 | WOLFSSL_LOCAL int GetNameHash(const byte* source, word32* idx, byte* hash, |
| wolfSSL | 15:117db924cf7c | 893 | int maxIdx); |
| wolfSSL | 15:117db924cf7c | 894 | WOLFSSL_LOCAL int wc_CheckPrivateKey(byte* key, word32 keySz, DecodedCert* der); |
| wolfSSL | 15:117db924cf7c | 895 | WOLFSSL_LOCAL int RsaPublicKeyDerSize(RsaKey* key, int with_header); |
| wolfSSL | 15:117db924cf7c | 896 | |
| wolfSSL | 15:117db924cf7c | 897 | #ifdef HAVE_ECC |
| wolfSSL | 15:117db924cf7c | 898 | /* ASN sig helpers */ |
| wolfSSL | 15:117db924cf7c | 899 | WOLFSSL_LOCAL int StoreECC_DSA_Sig(byte* out, word32* outLen, mp_int* r, |
| wolfSSL | 15:117db924cf7c | 900 | mp_int* s); |
| wolfSSL | 15:117db924cf7c | 901 | WOLFSSL_LOCAL int DecodeECC_DSA_Sig(const byte* sig, word32 sigLen, |
| wolfSSL | 15:117db924cf7c | 902 | mp_int* r, mp_int* s); |
| wolfSSL | 15:117db924cf7c | 903 | #endif |
| wolfSSL | 15:117db924cf7c | 904 | |
| wolfSSL | 15:117db924cf7c | 905 | WOLFSSL_LOCAL void InitSignatureCtx(SignatureCtx* sigCtx, void* heap, int devId); |
| wolfSSL | 15:117db924cf7c | 906 | WOLFSSL_LOCAL void FreeSignatureCtx(SignatureCtx* sigCtx); |
| wolfSSL | 15:117db924cf7c | 907 | |
| wolfSSL | 15:117db924cf7c | 908 | #ifndef NO_CERTS |
| wolfSSL | 15:117db924cf7c | 909 | |
| wolfSSL | 15:117db924cf7c | 910 | WOLFSSL_LOCAL int PemToDer(const unsigned char* buff, long sz, int type, |
| wolfSSL | 15:117db924cf7c | 911 | DerBuffer** pDer, void* heap, EncryptedInfo* info, |
| wolfSSL | 15:117db924cf7c | 912 | int* eccKey); |
| wolfSSL | 15:117db924cf7c | 913 | WOLFSSL_LOCAL int AllocDer(DerBuffer** der, word32 length, int type, void* heap); |
| wolfSSL | 15:117db924cf7c | 914 | WOLFSSL_LOCAL void FreeDer(DerBuffer** der); |
| wolfSSL | 15:117db924cf7c | 915 | |
| wolfSSL | 15:117db924cf7c | 916 | #endif /* !NO_CERTS */ |
| wolfSSL | 15:117db924cf7c | 917 | |
| wolfSSL | 15:117db924cf7c | 918 | #ifdef WOLFSSL_CERT_GEN |
| wolfSSL | 15:117db924cf7c | 919 | |
| wolfSSL | 15:117db924cf7c | 920 | enum cert_enums { |
| wolfSSL | 15:117db924cf7c | 921 | NAME_ENTRIES = 8, |
| wolfSSL | 15:117db924cf7c | 922 | JOINT_LEN = 2, |
| wolfSSL | 15:117db924cf7c | 923 | EMAIL_JOINT_LEN = 9, |
| wolfSSL | 15:117db924cf7c | 924 | PILOT_JOINT_LEN = 10, |
| wolfSSL | 15:117db924cf7c | 925 | RSA_KEY = 10, |
| wolfSSL | 15:117db924cf7c | 926 | NTRU_KEY = 11, |
| wolfSSL | 15:117db924cf7c | 927 | ECC_KEY = 12, |
| wolfSSL | 15:117db924cf7c | 928 | ED25519_KEY = 13 |
| wolfSSL | 15:117db924cf7c | 929 | }; |
| wolfSSL | 15:117db924cf7c | 930 | |
| wolfSSL | 15:117db924cf7c | 931 | #endif /* WOLFSSL_CERT_GEN */ |
| wolfSSL | 15:117db924cf7c | 932 | |
| wolfSSL | 15:117db924cf7c | 933 | |
| wolfSSL | 15:117db924cf7c | 934 | |
| wolfSSL | 15:117db924cf7c | 935 | /* for pointer use */ |
| wolfSSL | 15:117db924cf7c | 936 | typedef struct CertStatus CertStatus; |
| wolfSSL | 15:117db924cf7c | 937 | |
| wolfSSL | 15:117db924cf7c | 938 | #ifdef HAVE_OCSP |
| wolfSSL | 15:117db924cf7c | 939 | |
| wolfSSL | 15:117db924cf7c | 940 | enum Ocsp_Response_Status { |
| wolfSSL | 15:117db924cf7c | 941 | OCSP_SUCCESSFUL = 0, /* Response has valid confirmations */ |
| wolfSSL | 15:117db924cf7c | 942 | OCSP_MALFORMED_REQUEST = 1, /* Illegal confirmation request */ |
| wolfSSL | 15:117db924cf7c | 943 | OCSP_INTERNAL_ERROR = 2, /* Internal error in issuer */ |
| wolfSSL | 15:117db924cf7c | 944 | OCSP_TRY_LATER = 3, /* Try again later */ |
| wolfSSL | 15:117db924cf7c | 945 | OCSP_SIG_REQUIRED = 5, /* Must sign the request (4 is skipped) */ |
| wolfSSL | 15:117db924cf7c | 946 | OCSP_UNAUTHROIZED = 6 /* Request unauthorized */ |
| wolfSSL | 15:117db924cf7c | 947 | }; |
| wolfSSL | 15:117db924cf7c | 948 | |
| wolfSSL | 15:117db924cf7c | 949 | |
| wolfSSL | 15:117db924cf7c | 950 | enum Ocsp_Cert_Status { |
| wolfSSL | 15:117db924cf7c | 951 | CERT_GOOD = 0, |
| wolfSSL | 15:117db924cf7c | 952 | CERT_REVOKED = 1, |
| wolfSSL | 15:117db924cf7c | 953 | CERT_UNKNOWN = 2 |
| wolfSSL | 15:117db924cf7c | 954 | }; |
| wolfSSL | 15:117db924cf7c | 955 | |
| wolfSSL | 15:117db924cf7c | 956 | |
| wolfSSL | 15:117db924cf7c | 957 | enum Ocsp_Sums { |
| wolfSSL | 15:117db924cf7c | 958 | OCSP_BASIC_OID = 117, |
| wolfSSL | 15:117db924cf7c | 959 | OCSP_NONCE_OID = 118 |
| wolfSSL | 15:117db924cf7c | 960 | }; |
| wolfSSL | 15:117db924cf7c | 961 | |
| wolfSSL | 15:117db924cf7c | 962 | #ifdef OPENSSL_EXTRA |
| wolfSSL | 15:117db924cf7c | 963 | enum Ocsp_Verify_Error { |
| wolfSSL | 15:117db924cf7c | 964 | OCSP_VERIFY_ERROR_NONE = 0, |
| wolfSSL | 15:117db924cf7c | 965 | OCSP_BAD_ISSUER = 1 |
| wolfSSL | 15:117db924cf7c | 966 | }; |
| wolfSSL | 15:117db924cf7c | 967 | #endif |
| wolfSSL | 15:117db924cf7c | 968 | |
| wolfSSL | 15:117db924cf7c | 969 | |
| wolfSSL | 15:117db924cf7c | 970 | typedef struct OcspRequest OcspRequest; |
| wolfSSL | 15:117db924cf7c | 971 | typedef struct OcspResponse OcspResponse; |
| wolfSSL | 15:117db924cf7c | 972 | |
| wolfSSL | 15:117db924cf7c | 973 | |
| wolfSSL | 15:117db924cf7c | 974 | struct CertStatus { |
| wolfSSL | 15:117db924cf7c | 975 | CertStatus* next; |
| wolfSSL | 15:117db924cf7c | 976 | |
| wolfSSL | 15:117db924cf7c | 977 | byte serial[EXTERNAL_SERIAL_SIZE]; |
| wolfSSL | 15:117db924cf7c | 978 | int serialSz; |
| wolfSSL | 15:117db924cf7c | 979 | |
| wolfSSL | 15:117db924cf7c | 980 | int status; |
| wolfSSL | 15:117db924cf7c | 981 | |
| wolfSSL | 15:117db924cf7c | 982 | byte thisDate[MAX_DATE_SIZE]; |
| wolfSSL | 15:117db924cf7c | 983 | byte nextDate[MAX_DATE_SIZE]; |
| wolfSSL | 15:117db924cf7c | 984 | byte thisDateFormat; |
| wolfSSL | 15:117db924cf7c | 985 | byte nextDateFormat; |
| wolfSSL | 15:117db924cf7c | 986 | #if defined(OPENSSL_ALL) || defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY) |
| wolfSSL | 15:117db924cf7c | 987 | byte* thisDateAsn; |
| wolfSSL | 15:117db924cf7c | 988 | byte* nextDateAsn; |
| wolfSSL | 15:117db924cf7c | 989 | #endif |
| wolfSSL | 15:117db924cf7c | 990 | |
| wolfSSL | 15:117db924cf7c | 991 | byte* rawOcspResponse; |
| wolfSSL | 15:117db924cf7c | 992 | word32 rawOcspResponseSz; |
| wolfSSL | 15:117db924cf7c | 993 | }; |
| wolfSSL | 15:117db924cf7c | 994 | |
| wolfSSL | 15:117db924cf7c | 995 | |
| wolfSSL | 15:117db924cf7c | 996 | struct OcspResponse { |
| wolfSSL | 15:117db924cf7c | 997 | int responseStatus; /* return code from Responder */ |
| wolfSSL | 15:117db924cf7c | 998 | |
| wolfSSL | 15:117db924cf7c | 999 | byte* response; /* Pointer to beginning of OCSP Response */ |
| wolfSSL | 15:117db924cf7c | 1000 | word32 responseSz; /* length of the OCSP Response */ |
| wolfSSL | 15:117db924cf7c | 1001 | |
| wolfSSL | 15:117db924cf7c | 1002 | byte producedDate[MAX_DATE_SIZE]; |
| wolfSSL | 15:117db924cf7c | 1003 | /* Date at which this response was signed */ |
| wolfSSL | 15:117db924cf7c | 1004 | byte producedDateFormat; /* format of the producedDate */ |
| wolfSSL | 15:117db924cf7c | 1005 | byte* issuerHash; |
| wolfSSL | 15:117db924cf7c | 1006 | byte* issuerKeyHash; |
| wolfSSL | 15:117db924cf7c | 1007 | |
| wolfSSL | 15:117db924cf7c | 1008 | byte* cert; |
| wolfSSL | 15:117db924cf7c | 1009 | word32 certSz; |
| wolfSSL | 15:117db924cf7c | 1010 | |
| wolfSSL | 15:117db924cf7c | 1011 | byte* sig; /* Pointer to sig in source */ |
| wolfSSL | 15:117db924cf7c | 1012 | word32 sigSz; /* Length in octets for the sig */ |
| wolfSSL | 15:117db924cf7c | 1013 | word32 sigOID; /* OID for hash used for sig */ |
| wolfSSL | 15:117db924cf7c | 1014 | |
| wolfSSL | 15:117db924cf7c | 1015 | CertStatus* status; /* certificate status to fill out */ |
| wolfSSL | 15:117db924cf7c | 1016 | |
| wolfSSL | 15:117db924cf7c | 1017 | byte* nonce; /* pointer to nonce inside ASN.1 response */ |
| wolfSSL | 15:117db924cf7c | 1018 | int nonceSz; /* length of the nonce string */ |
| wolfSSL | 15:117db924cf7c | 1019 | |
| wolfSSL | 15:117db924cf7c | 1020 | byte* source; /* pointer to source buffer, not owned */ |
| wolfSSL | 15:117db924cf7c | 1021 | word32 maxIdx; /* max offset based on init size */ |
| wolfSSL | 15:117db924cf7c | 1022 | |
| wolfSSL | 15:117db924cf7c | 1023 | #ifdef OPENSSL_EXTRA |
| wolfSSL | 15:117db924cf7c | 1024 | int verifyError; |
| wolfSSL | 15:117db924cf7c | 1025 | #endif |
| wolfSSL | 15:117db924cf7c | 1026 | }; |
| wolfSSL | 15:117db924cf7c | 1027 | |
| wolfSSL | 15:117db924cf7c | 1028 | |
| wolfSSL | 15:117db924cf7c | 1029 | struct OcspRequest { |
| wolfSSL | 15:117db924cf7c | 1030 | byte issuerHash[KEYID_SIZE]; |
| wolfSSL | 15:117db924cf7c | 1031 | byte issuerKeyHash[KEYID_SIZE]; |
| wolfSSL | 15:117db924cf7c | 1032 | byte* serial; /* copy of the serial number in source cert */ |
| wolfSSL | 15:117db924cf7c | 1033 | int serialSz; |
| wolfSSL | 15:117db924cf7c | 1034 | byte* url; /* copy of the extAuthInfo in source cert */ |
| wolfSSL | 15:117db924cf7c | 1035 | int urlSz; |
| wolfSSL | 15:117db924cf7c | 1036 | |
| wolfSSL | 15:117db924cf7c | 1037 | byte nonce[MAX_OCSP_NONCE_SZ]; |
| wolfSSL | 15:117db924cf7c | 1038 | int nonceSz; |
| wolfSSL | 15:117db924cf7c | 1039 | void* heap; |
| wolfSSL | 15:117db924cf7c | 1040 | void* ssl; |
| wolfSSL | 15:117db924cf7c | 1041 | }; |
| wolfSSL | 15:117db924cf7c | 1042 | |
| wolfSSL | 15:117db924cf7c | 1043 | |
| wolfSSL | 15:117db924cf7c | 1044 | WOLFSSL_LOCAL void InitOcspResponse(OcspResponse*, CertStatus*, byte*, word32); |
| wolfSSL | 15:117db924cf7c | 1045 | WOLFSSL_LOCAL int OcspResponseDecode(OcspResponse*, void*, void* heap, int); |
| wolfSSL | 15:117db924cf7c | 1046 | |
| wolfSSL | 15:117db924cf7c | 1047 | WOLFSSL_LOCAL int InitOcspRequest(OcspRequest*, DecodedCert*, byte, void*); |
| wolfSSL | 15:117db924cf7c | 1048 | WOLFSSL_LOCAL void FreeOcspRequest(OcspRequest*); |
| wolfSSL | 15:117db924cf7c | 1049 | WOLFSSL_LOCAL int EncodeOcspRequest(OcspRequest*, byte*, word32); |
| wolfSSL | 15:117db924cf7c | 1050 | WOLFSSL_LOCAL word32 EncodeOcspRequestExtensions(OcspRequest*, byte*, word32); |
| wolfSSL | 15:117db924cf7c | 1051 | |
| wolfSSL | 15:117db924cf7c | 1052 | |
| wolfSSL | 15:117db924cf7c | 1053 | WOLFSSL_LOCAL int CompareOcspReqResp(OcspRequest*, OcspResponse*); |
| wolfSSL | 15:117db924cf7c | 1054 | |
| wolfSSL | 15:117db924cf7c | 1055 | |
| wolfSSL | 15:117db924cf7c | 1056 | #endif /* HAVE_OCSP */ |
| wolfSSL | 15:117db924cf7c | 1057 | |
| wolfSSL | 15:117db924cf7c | 1058 | |
| wolfSSL | 15:117db924cf7c | 1059 | /* for pointer use */ |
| wolfSSL | 15:117db924cf7c | 1060 | typedef struct RevokedCert RevokedCert; |
| wolfSSL | 15:117db924cf7c | 1061 | |
| wolfSSL | 15:117db924cf7c | 1062 | #ifdef HAVE_CRL |
| wolfSSL | 15:117db924cf7c | 1063 | |
| wolfSSL | 15:117db924cf7c | 1064 | struct RevokedCert { |
| wolfSSL | 15:117db924cf7c | 1065 | byte serialNumber[EXTERNAL_SERIAL_SIZE]; |
| wolfSSL | 15:117db924cf7c | 1066 | int serialSz; |
| wolfSSL | 15:117db924cf7c | 1067 | RevokedCert* next; |
| wolfSSL | 15:117db924cf7c | 1068 | }; |
| wolfSSL | 15:117db924cf7c | 1069 | |
| wolfSSL | 15:117db924cf7c | 1070 | typedef struct DecodedCRL DecodedCRL; |
| wolfSSL | 15:117db924cf7c | 1071 | |
| wolfSSL | 15:117db924cf7c | 1072 | struct DecodedCRL { |
| wolfSSL | 15:117db924cf7c | 1073 | word32 certBegin; /* offset to start of cert */ |
| wolfSSL | 15:117db924cf7c | 1074 | word32 sigIndex; /* offset to start of signature */ |
| wolfSSL | 15:117db924cf7c | 1075 | word32 sigLength; /* length of signature */ |
| wolfSSL | 15:117db924cf7c | 1076 | word32 signatureOID; /* sum of algorithm object id */ |
| wolfSSL | 15:117db924cf7c | 1077 | byte* signature; /* pointer into raw source, not owned */ |
| wolfSSL | 15:117db924cf7c | 1078 | byte issuerHash[SIGNER_DIGEST_SIZE]; /* issuer hash */ |
| wolfSSL | 15:117db924cf7c | 1079 | byte crlHash[SIGNER_DIGEST_SIZE]; /* raw crl data hash */ |
| wolfSSL | 15:117db924cf7c | 1080 | byte lastDate[MAX_DATE_SIZE]; /* last date updated */ |
| wolfSSL | 15:117db924cf7c | 1081 | byte nextDate[MAX_DATE_SIZE]; /* next update date */ |
| wolfSSL | 15:117db924cf7c | 1082 | byte lastDateFormat; /* format of last date */ |
| wolfSSL | 15:117db924cf7c | 1083 | byte nextDateFormat; /* format of next date */ |
| wolfSSL | 15:117db924cf7c | 1084 | RevokedCert* certs; /* revoked cert list */ |
| wolfSSL | 15:117db924cf7c | 1085 | int totalCerts; /* number on list */ |
| wolfSSL | 15:117db924cf7c | 1086 | void* heap; |
| wolfSSL | 15:117db924cf7c | 1087 | }; |
| wolfSSL | 15:117db924cf7c | 1088 | |
| wolfSSL | 15:117db924cf7c | 1089 | WOLFSSL_LOCAL void InitDecodedCRL(DecodedCRL*, void* heap); |
| wolfSSL | 15:117db924cf7c | 1090 | WOLFSSL_LOCAL int VerifyCRL_Signature(SignatureCtx* sigCtx, |
| wolfSSL | 15:117db924cf7c | 1091 | const byte* toBeSigned, word32 tbsSz, |
| wolfSSL | 15:117db924cf7c | 1092 | const byte* signature, word32 sigSz, |
| wolfSSL | 15:117db924cf7c | 1093 | word32 signatureOID, Signer *ca, |
| wolfSSL | 15:117db924cf7c | 1094 | void* heap); |
| wolfSSL | 15:117db924cf7c | 1095 | WOLFSSL_LOCAL int ParseCRL(DecodedCRL*, const byte* buff, word32 sz, void* cm); |
| wolfSSL | 15:117db924cf7c | 1096 | WOLFSSL_LOCAL void FreeDecodedCRL(DecodedCRL*); |
| wolfSSL | 15:117db924cf7c | 1097 | |
| wolfSSL | 15:117db924cf7c | 1098 | |
| wolfSSL | 15:117db924cf7c | 1099 | #endif /* HAVE_CRL */ |
| wolfSSL | 15:117db924cf7c | 1100 | |
| wolfSSL | 15:117db924cf7c | 1101 | |
| wolfSSL | 15:117db924cf7c | 1102 | #ifdef __cplusplus |
| wolfSSL | 15:117db924cf7c | 1103 | } /* extern "C" */ |
| wolfSSL | 15:117db924cf7c | 1104 | #endif |
| wolfSSL | 15:117db924cf7c | 1105 | |
| wolfSSL | 15:117db924cf7c | 1106 | #endif /* !NO_ASN */ |
| wolfSSL | 15:117db924cf7c | 1107 | |
| wolfSSL | 15:117db924cf7c | 1108 | |
| wolfSSL | 15:117db924cf7c | 1109 | #if !defined(NO_ASN) || !defined(NO_PWDBASED) |
| wolfSSL | 15:117db924cf7c | 1110 | |
| wolfSSL | 15:117db924cf7c | 1111 | #ifndef MAX_KEY_SIZE |
| wolfSSL | 15:117db924cf7c | 1112 | #define MAX_KEY_SIZE 64 /* MAX PKCS Key length */ |
| wolfSSL | 15:117db924cf7c | 1113 | #endif |
| wolfSSL | 15:117db924cf7c | 1114 | #ifndef MAX_UNICODE_SZ |
| wolfSSL | 15:117db924cf7c | 1115 | #define MAX_UNICODE_SZ 256 |
| wolfSSL | 15:117db924cf7c | 1116 | #endif |
| wolfSSL | 15:117db924cf7c | 1117 | |
| wolfSSL | 15:117db924cf7c | 1118 | enum PBESTypes { |
| wolfSSL | 15:117db924cf7c | 1119 | PBE_MD5_DES = 0, |
| wolfSSL | 15:117db924cf7c | 1120 | PBE_SHA1_RC4_128 = 1, |
| wolfSSL | 15:117db924cf7c | 1121 | PBE_SHA1_DES = 2, |
| wolfSSL | 15:117db924cf7c | 1122 | PBE_SHA1_DES3 = 3, |
| wolfSSL | 15:117db924cf7c | 1123 | PBE_AES256_CBC = 4, |
| wolfSSL | 15:117db924cf7c | 1124 | |
| wolfSSL | 15:117db924cf7c | 1125 | PBE_SHA1_RC4_128_SUM = 657, |
| wolfSSL | 15:117db924cf7c | 1126 | PBE_SHA1_DES3_SUM = 659, |
| wolfSSL | 15:117db924cf7c | 1127 | PBES2 = 13 /* algo ID */ |
| wolfSSL | 15:117db924cf7c | 1128 | }; |
| wolfSSL | 15:117db924cf7c | 1129 | |
| wolfSSL | 15:117db924cf7c | 1130 | enum PKCSTypes { |
| wolfSSL | 15:117db924cf7c | 1131 | PKCS5v2 = 6, /* PKCS #5 v2.0 */ |
| wolfSSL | 15:117db924cf7c | 1132 | PKCS12v1 = 12, /* PKCS #12 */ |
| wolfSSL | 15:117db924cf7c | 1133 | PKCS5 = 5, /* PKCS oid tag */ |
| wolfSSL | 15:117db924cf7c | 1134 | PKCS8v0 = 0, /* default PKCS#8 version */ |
| wolfSSL | 15:117db924cf7c | 1135 | }; |
| wolfSSL | 15:117db924cf7c | 1136 | |
| wolfSSL | 15:117db924cf7c | 1137 | #endif /* !NO_ASN || !NO_PWDBASED */ |
| wolfSSL | 15:117db924cf7c | 1138 | |
| wolfSSL | 15:117db924cf7c | 1139 | #endif /* WOLF_CRYPT_ASN_H */ |
| wolfSSL | 15:117db924cf7c | 1140 |