asn.h

00001 /* asn.h
00002  *
00003  * Copyright (C) 2006-2017 wolfSSL Inc.
00004  *
00005  * This file is part of wolfSSL.
00006  *
00007  * wolfSSL is free software; you can redistribute it and/or modify
00008  * it under the terms of the GNU General Public License as published by
00009  * the Free Software Foundation; either version 2 of the License, or
00010  * (at your option) any later version.
00011  *
00012  * wolfSSL is distributed in the hope that it will be useful,
00013  * but WITHOUT ANY WARRANTY; without even the implied warranty of
00014  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
00015  * GNU General Public License for more details.
00016  *
00017  * You should have received a copy of the GNU General Public License
00018  * along with this program; if not, write to the Free Software
00019  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
00020  */
00021 
00022 /*!
00023     \file wolfssl/wolfcrypt/asn.h
00024 */
00025 
00026 #ifndef WOLF_CRYPT_ASN_H
00027 #define WOLF_CRYPT_ASN_H
00028 
00029 #include <wolfcrypt/types.h>
00030 
00031 #ifndef NO_ASN
00032 
00033 
00034 #if !defined(NO_ASN_TIME) && defined(NO_TIME_H)
00035     #define NO_ASN_TIME /* backwards compatibility with NO_TIME_H */
00036 #endif
00037 
00038 #include <wolfcrypt/integer.h>
00039 
00040 /* fips declare of RsaPrivateKeyDecode @wc_fips */
00041 #if defined(HAVE_FIPS) && !defined(NO_RSA) && \
00042     (!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2))
00043     #include <cyassl/ctaocrypt/rsa.h>
00044 #endif
00045 
00046 #ifndef NO_DH
00047     #include <wolfcrypt/dh.h>
00048 #endif
00049 #ifndef NO_DSA
00050     #include <wolfcrypt/dsa.h>
00051 #endif
00052 #ifndef NO_SHA
00053     #include <wolfcrypt/sha.h>
00054 #endif
00055 #ifndef NO_MD5
00056     #include <wolfcrypt/md5.h>
00057 #endif
00058 #include <wolfcrypt/sha256.h>
00059 #include <wolfcrypt/asn_public.h>   /* public interface */
00060 
00061 
00062 #ifdef __cplusplus
00063     extern "C" {
00064 #endif
00065 
00066 enum {
00067     ISSUER  = 0,
00068     SUBJECT = 1,
00069 
00070     EXTERNAL_SERIAL_SIZE = 32,
00071 
00072     BEFORE  = 0,
00073     AFTER   = 1
00074 };
00075 
00076 /* ASN Tags   */
00077 enum ASN_Tags {
00078     ASN_BOOLEAN           = 0x01,
00079     ASN_INTEGER           = 0x02,
00080     ASN_BIT_STRING        = 0x03,
00081     ASN_OCTET_STRING      = 0x04,
00082     ASN_TAG_NULL          = 0x05,
00083     ASN_OBJECT_ID         = 0x06,
00084     ASN_ENUMERATED        = 0x0a,
00085     ASN_UTF8STRING        = 0x0c,
00086     ASN_SEQUENCE          = 0x10,
00087     ASN_SET               = 0x11,
00088     ASN_UTC_TIME          = 0x17,
00089     ASN_OTHER_TYPE        = 0x00,
00090     ASN_RFC822_TYPE       = 0x01,
00091     ASN_DNS_TYPE          = 0x02,
00092     ASN_DIR_TYPE          = 0x04,
00093     ASN_URI_TYPE          = 0x06, /* the value 6 is from GeneralName OID */
00094     ASN_GENERALIZED_TIME  = 0x18,
00095     CRL_EXTENSIONS        = 0xa0,
00096     ASN_EXTENSIONS        = 0xa3,
00097     ASN_LONG_LENGTH       = 0x80,
00098     ASN_INDEF_LENGTH      = 0x80,
00099 
00100     /* ASN_Flags - Bitmask */
00101     ASN_CONSTRUCTED       = 0x20,
00102     ASN_CONTEXT_SPECIFIC  = 0x80,
00103 };
00104 
00105 #define ASN_UTC_TIME_SIZE 14
00106 #define ASN_GENERALIZED_TIME_SIZE 16
00107 
00108 enum DN_Tags {
00109     ASN_COMMON_NAME   = 0x03,   /* CN */
00110     ASN_SUR_NAME      = 0x04,   /* SN */
00111     ASN_SERIAL_NUMBER = 0x05,   /* serialNumber */
00112     ASN_COUNTRY_NAME  = 0x06,   /* C  */
00113     ASN_LOCALITY_NAME = 0x07,   /* L  */
00114     ASN_STATE_NAME    = 0x08,   /* ST */
00115     ASN_ORG_NAME      = 0x0a,   /* O  */
00116     ASN_ORGUNIT_NAME  = 0x0b,    /* OU */
00117     ASN_EMAIL_NAME    = 0x98,    /* not oid number there is 97 in 2.5.4.0-97 */
00118 
00119     /* pilot attribute types
00120      * OID values of 0.9.2342.19200300.100.1.* */
00121     ASN_USER_ID          = 0x01, /* UID */
00122     ASN_DOMAIN_COMPONENT = 0x19  /* DC */
00123 };
00124 
00125 /* DN Tag Strings */
00126 #define WOLFSSL_COMMON_NAME      "/CN="
00127 #define WOLFSSL_SUR_NAME         "/SN="
00128 #define WOLFSSL_SERIAL_NUMBER    "/serialNumber="
00129 #define WOLFSSL_COUNTRY_NAME     "/C="
00130 #define WOLFSSL_LOCALITY_NAME    "/L="
00131 #define WOLFSSL_STATE_NAME       "/ST="
00132 #define WOLFSSL_ORG_NAME         "/O="
00133 #define WOLFSSL_ORGUNIT_NAME     "/OU="
00134 #define WOLFSSL_DOMAIN_COMPONENT "/DC="
00135 
00136 enum ECC_TYPES {
00137     ECC_PREFIX_0 = 160,
00138     ECC_PREFIX_1 = 161
00139 };
00140 
00141 enum Misc_ASN {
00142     ASN_NAME_MAX        = 256,
00143     MAX_SALT_SIZE       =  64,     /* MAX PKCS Salt length */
00144     MAX_IV_SIZE         =  64,     /* MAX PKCS Iv length */
00145     ASN_BOOL_SIZE       =   2,     /* including type */
00146     ASN_ECC_HEADER_SZ   =   2,     /* String type + 1 byte len */
00147     ASN_ECC_CONTEXT_SZ  =   2,     /* Content specific type + 1 byte len */
00148 #ifdef NO_SHA
00149     KEYID_SIZE          = WC_SHA256_DIGEST_SIZE,
00150 #else
00151     KEYID_SIZE          = WC_SHA_DIGEST_SIZE,
00152 #endif
00153     RSA_INTS            =   8,     /* RSA ints in private key */
00154     DSA_INTS            =   5,     /* DSA ints in private key */
00155     MIN_DATE_SIZE       =  13,
00156     MAX_DATE_SIZE       =  32,
00157     ASN_GEN_TIME_SZ     =  15,     /* 7 numbers * 2 + Zulu tag */
00158     MAX_ENCODED_SIG_SZ  = 512,
00159     MAX_SIG_SZ          = 256,
00160     MAX_ALGO_SZ         =  20,
00161     MAX_SHORT_SZ        =   6,     /* asn int + byte len + 4 byte length */
00162     MAX_SEQ_SZ          =   5,     /* enum(seq | con) + length(4) */
00163     MAX_SET_SZ          =   5,     /* enum(set | con) + length(4) */
00164     MAX_OCTET_STR_SZ    =   5,     /* enum(set | con) + length(4) */
00165     MAX_EXP_SZ          =   5,     /* enum(contextspec|con|exp) + length(4) */
00166     MAX_PRSTR_SZ        =   5,     /* enum(prstr) + length(4) */
00167     MAX_VERSION_SZ      =   5,     /* enum + id + version(byte) + (header(2))*/
00168     MAX_ENCODED_DIG_SZ  =  73,     /* sha512 + enum(bit or octet) + length(4) */
00169     MAX_RSA_INT_SZ      = 517,     /* RSA raw sz 4096 for bits + tag + len(4) */
00170     MAX_NTRU_KEY_SZ     = 610,     /* NTRU 112 bit public key */
00171     MAX_NTRU_ENC_SZ     = 628,     /* NTRU 112 bit DER public encoding */
00172     MAX_LENGTH_SZ       =   4,     /* Max length size for DER encoding */
00173     MAX_RSA_E_SZ        =  16,     /* Max RSA public e size */
00174     MAX_CA_SZ           =  32,     /* Max encoded CA basic constraint length */
00175     MAX_SN_SZ           =  35,     /* Max encoded serial number (INT) length */
00176     MAX_DER_DIGEST_SZ   = MAX_ENCODED_DIG_SZ + MAX_ALGO_SZ + MAX_SEQ_SZ, /* Maximum DER digest size */
00177 #ifdef WOLFSSL_CERT_GEN
00178     #ifdef WOLFSSL_CERT_REQ
00179                           /* Max encoded cert req attributes length */
00180         MAX_ATTRIB_SZ   = MAX_SEQ_SZ * 3 + (11 + MAX_SEQ_SZ) * 2 +
00181                           MAX_PRSTR_SZ + CTC_NAME_SIZE, /* 11 is the OID size */
00182     #endif
00183     #if defined(WOLFSSL_ALT_NAMES) || defined(WOLFSSL_CERT_EXT)
00184         MAX_EXTENSIONS_SZ   = 1 + MAX_LENGTH_SZ + CTC_MAX_ALT_SIZE,
00185     #else
00186         MAX_EXTENSIONS_SZ   = 1 + MAX_LENGTH_SZ + MAX_CA_SZ,
00187     #endif
00188                                    /* Max total extensions, id + len + others */
00189 #endif
00190 #if defined(WOLFSSL_CERT_EXT) || defined(OPENSSL_EXTRA)
00191     MAX_OID_SZ          = 32,      /* Max DER length of OID*/
00192     MAX_OID_STRING_SZ   = 64,      /* Max string length representation of OID*/
00193 #endif
00194 #ifdef WOLFSSL_CERT_EXT
00195     MAX_KID_SZ          = 45,      /* Max encoded KID length (SHA-256 case) */
00196     MAX_KEYUSAGE_SZ     = 18,      /* Max encoded Key Usage length */
00197     MAX_EXTKEYUSAGE_SZ  = 12 + (6 * (8 + 2)) +
00198                           CTC_MAX_EKU_OID_SZ, /* Max encoded ExtKeyUsage
00199                         (SEQ/LEN + OBJID + OCTSTR/LEN + SEQ + (6 * (SEQ + OID))) */
00200     MAX_CERTPOL_NB      = CTC_MAX_CERTPOL_NB,/* Max number of Cert Policy */
00201     MAX_CERTPOL_SZ      = CTC_MAX_CERTPOL_SZ,
00202 #endif
00203     MAX_NAME_ENTRIES    = 5,       /* extra entries added to x509 name struct */
00204     OCSP_NONCE_EXT_SZ   = 35,      /* OCSP Nonce Extension size */
00205     MAX_OCSP_EXT_SZ     = 58,      /* Max OCSP Extension length */
00206     MAX_OCSP_NONCE_SZ   = 16,      /* OCSP Nonce size           */
00207     EIGHTK_BUF          = 8192,    /* Tmp buffer size           */
00208     MAX_PUBLIC_KEY_SZ   = MAX_NTRU_ENC_SZ + MAX_ALGO_SZ + MAX_SEQ_SZ * 2,
00209                                    /* use bigger NTRU size */
00210 #ifdef WOLFSSL_ENCRYPTED_KEYS
00211     HEADER_ENCRYPTED_KEY_SIZE = 88,/* Extra header size for encrypted key */
00212 #else
00213     HEADER_ENCRYPTED_KEY_SIZE = 0,
00214 #endif
00215     TRAILING_ZERO       = 1,       /* Used for size of zero pad */
00216     MIN_VERSION_SZ      = 3,       /* Min bytes needed for GetMyVersion */
00217 #if defined(OPENSSL_ALL)  || defined(WOLFSSL_MYSQL_COMPATIBLE) || defined(WOLFSSL_NGINX) || \
00218     defined(WOLFSSL_HAPROXY) || defined(OPENSSL_EXTRA)
00219     MAX_TIME_STRING_SZ  = 25,      /* Max length of formatted time string */
00220 #endif
00221 
00222     PKCS5_SALT_SZ       = 8,
00223 
00224     PEM_LINE_LEN       = 80,       /* PEM line max + fudge */
00225 };
00226 
00227 
00228 enum Oid_Types {
00229     oidHashType         = 0,
00230     oidSigType          = 1,
00231     oidKeyType          = 2,
00232     oidCurveType        = 3,
00233     oidBlkType          = 4,
00234     oidOcspType         = 5,
00235     oidCertExtType      = 6,
00236     oidCertAuthInfoType = 7,
00237     oidCertPolicyType   = 8,
00238     oidCertAltNameType  = 9,
00239     oidCertKeyUseType   = 10,
00240     oidKdfType          = 11,
00241     oidKeyWrapType      = 12,
00242     oidCmsKeyAgreeType  = 13,
00243     oidPBEType          = 14,
00244     oidHmacType         = 15,
00245     oidIgnoreType
00246 };
00247 
00248 
00249 enum Hash_Sum  {
00250     MD2h    = 646,
00251     MD5h    = 649,
00252     SHAh    =  88,
00253     SHA224h = 417,
00254     SHA256h = 414,
00255     SHA384h = 415,
00256     SHA512h = 416
00257 };
00258 
00259 
00260 #if !defined(NO_DES3) || !defined(NO_AES)
00261 enum Block_Sum {
00262 #ifdef WOLFSSL_AES_128
00263     AES128CBCb = 414,
00264 #endif
00265 #ifdef WOLFSSL_AES_192
00266     AES192CBCb = 434,
00267 #endif
00268 #ifdef WOLFSSL_AES_256
00269     AES256CBCb = 454,
00270 #endif
00271 #ifndef NO_DES3
00272     DESb       = 69,
00273     DES3b      = 652
00274 #endif
00275 };
00276 #endif /* !NO_DES3 || !NO_AES */
00277 
00278 
00279 enum Key_Sum {
00280     DSAk     = 515,
00281     RSAk     = 645,
00282     NTRUk    = 274,
00283     ECDSAk   = 518,
00284     ED25519k = 256
00285 };
00286 
00287 
00288 #ifndef NO_AES
00289 enum KeyWrap_Sum {
00290 #ifdef WOLFSSL_AES_128
00291     AES128_WRAP = 417,
00292 #endif
00293 #ifdef WOLFSSL_AES_192
00294     AES192_WRAP = 437,
00295 #endif
00296 #ifdef WOLFSSL_AES_256
00297     AES256_WRAP = 457
00298 #endif
00299 };
00300 #endif /* !NO_AES */
00301 
00302 enum Key_Agree {
00303     dhSinglePass_stdDH_sha1kdf_scheme   = 464,
00304     dhSinglePass_stdDH_sha224kdf_scheme = 188,
00305     dhSinglePass_stdDH_sha256kdf_scheme = 189,
00306     dhSinglePass_stdDH_sha384kdf_scheme = 190,
00307     dhSinglePass_stdDH_sha512kdf_scheme = 191,
00308 };
00309 
00310 
00311 enum Ecc_Sum {
00312     ECC_SECP112R1_OID = 182,
00313     ECC_SECP112R2_OID = 183,
00314     ECC_SECP128R1_OID = 204,
00315     ECC_SECP128R2_OID = 205,
00316     ECC_SECP160R1_OID = 184,
00317     ECC_SECP160R2_OID = 206,
00318     ECC_SECP160K1_OID = 185,
00319     ECC_BRAINPOOLP160R1_OID = 98,
00320     ECC_SECP192R1_OID = 520,
00321     ECC_PRIME192V2_OID = 521,
00322     ECC_PRIME192V3_OID = 522,
00323     ECC_SECP192K1_OID = 207,
00324     ECC_BRAINPOOLP192R1_OID = 100,
00325     ECC_SECP224R1_OID = 209,
00326     ECC_SECP224K1_OID = 208,
00327     ECC_BRAINPOOLP224R1_OID = 102,
00328     ECC_PRIME239V1_OID = 523,
00329     ECC_PRIME239V2_OID = 524,
00330     ECC_PRIME239V3_OID = 525,
00331     ECC_SECP256R1_OID = 526,
00332     ECC_SECP256K1_OID = 186,
00333     ECC_BRAINPOOLP256R1_OID = 104,
00334     ECC_X25519_OID = 365,
00335     ECC_ED25519_OID = 256,
00336     ECC_BRAINPOOLP320R1_OID = 106,
00337     ECC_SECP384R1_OID = 210,
00338     ECC_BRAINPOOLP384R1_OID = 108,
00339     ECC_BRAINPOOLP512R1_OID = 110,
00340     ECC_SECP521R1_OID = 211,
00341 };
00342 
00343 
00344 enum KDF_Sum {
00345     PBKDF2_OID = 660
00346 };
00347 
00348 
00349 enum HMAC_Sum {
00350     HMAC_SHA224_OID = 652,
00351     HMAC_SHA256_OID = 653,
00352     HMAC_SHA384_OID = 654,
00353     HMAC_SHA512_OID = 655
00354 };
00355 
00356 
00357 enum Extensions_Sum {
00358     BASIC_CA_OID    = 133,
00359     ALT_NAMES_OID   = 131,
00360     CRL_DIST_OID    = 145,
00361     AUTH_INFO_OID   = 69, /* id-pe 1 */
00362     AUTH_KEY_OID    = 149,
00363     SUBJ_KEY_OID    = 128,
00364     CERT_POLICY_OID = 146,
00365     KEY_USAGE_OID   = 129,  /* 2.5.29.15 */
00366     INHIBIT_ANY_OID = 168,  /* 2.5.29.54 */
00367     EXT_KEY_USAGE_OID         = 151, /* 2.5.29.37 */
00368     NAME_CONS_OID             = 144, /* 2.5.29.30 */
00369     PRIV_KEY_USAGE_PERIOD_OID = 130, /* 2.5.29.16 */
00370     SUBJECT_INFO_ACCESS       = 79,  /* id-pe 11 */
00371     POLICY_MAP_OID            = 147,
00372     POLICY_CONST_OID          = 150,
00373     ISSUE_ALT_NAMES_OID       = 132,
00374     TLS_FEATURE_OID           = 92   /* id-pe 24 */
00375 };
00376 
00377 enum CertificatePolicy_Sum {
00378     CP_ANY_OID      = 146  /* id-ce 32 0 */
00379 };
00380 
00381 enum SepHardwareName_Sum {
00382     HW_NAME_OID     = 79   /* 1.3.6.1.5.5.7.8.4 from RFC 4108*/
00383 };
00384 
00385 enum AuthInfo_Sum {
00386     AIA_OCSP_OID      = 116, /* 1.3.6.1.5.5.7.48.1 */
00387     AIA_CA_ISSUER_OID = 117  /* 1.3.6.1.5.5.7.48.2 */
00388 };
00389 
00390 enum ExtKeyUsage_Sum { /* From RFC 5280 */
00391     EKU_ANY_OID         = 151, /* 2.5.29.37.0, anyExtendedKeyUsage         */
00392     EKU_SERVER_AUTH_OID = 71,  /* 1.3.6.1.5.5.7.3.1, id-kp-serverAuth      */
00393     EKU_CLIENT_AUTH_OID = 72,  /* 1.3.6.1.5.5.7.3.2, id-kp-clientAuth      */
00394     EKU_CODESIGNING_OID = 73,  /* 1.3.6.1.5.5.7.3.3, id-kp-codeSigning     */
00395     EKU_EMAILPROTECT_OID = 74, /* 1.3.6.1.5.5.7.3.4, id-kp-emailProtection */
00396     EKU_TIMESTAMP_OID   = 78,  /* 1.3.6.1.5.5.7.3.8, id-kp-timeStamping    */
00397     EKU_OCSP_SIGN_OID   = 79   /* 1.3.6.1.5.5.7.3.9, id-kp-OCSPSigning     */
00398 };
00399 
00400 
00401 enum VerifyType {
00402     NO_VERIFY   = 0,
00403     VERIFY      = 1,
00404     VERIFY_CRL  = 2,
00405     VERIFY_OCSP = 3
00406 };
00407 
00408 #ifdef WOLFSSL_CERT_EXT
00409 enum KeyIdType {
00410     SKID_TYPE = 0,
00411     AKID_TYPE = 1
00412 };
00413 #endif
00414 
00415 /* Key usage extension bits (based on RFC 5280) */
00416 #define KEYUSE_DIGITAL_SIG    0x0080
00417 #define KEYUSE_CONTENT_COMMIT 0x0040
00418 #define KEYUSE_KEY_ENCIPHER   0x0020
00419 #define KEYUSE_DATA_ENCIPHER  0x0010
00420 #define KEYUSE_KEY_AGREE      0x0008
00421 #define KEYUSE_KEY_CERT_SIGN  0x0004
00422 #define KEYUSE_CRL_SIGN       0x0002
00423 #define KEYUSE_ENCIPHER_ONLY  0x0001
00424 #define KEYUSE_DECIPHER_ONLY  0x8000
00425 
00426 /* Extended Key Usage bits (internal mapping only) */
00427 #define EXTKEYUSE_USER        0x80
00428 #define EXTKEYUSE_OCSP_SIGN   0x40
00429 #define EXTKEYUSE_TIMESTAMP   0x20
00430 #define EXTKEYUSE_EMAILPROT   0x10
00431 #define EXTKEYUSE_CODESIGN    0x08
00432 #define EXTKEYUSE_CLIENT_AUTH 0x04
00433 #define EXTKEYUSE_SERVER_AUTH 0x02
00434 #define EXTKEYUSE_ANY         0x01
00435 
00436 typedef struct DNS_entry   DNS_entry;
00437 
00438 struct DNS_entry {
00439     DNS_entry* next;   /* next on DNS list */
00440     int        type;   /* i.e. ASN_DNS_TYPE */
00441     int        len;    /* actual DNS len */
00442     char*      name;   /* actual DNS name */
00443 };
00444 
00445 
00446 typedef struct Base_entry  Base_entry;
00447 
00448 struct Base_entry {
00449     Base_entry* next;   /* next on name base list */
00450     char*       name;   /* actual name base */
00451     int         nameSz; /* name length */
00452     byte        type;   /* Name base type (DNS or RFC822) */
00453 };
00454 
00455 #define DOMAIN_COMPONENT_MAX 10
00456 
00457 struct DecodedName {
00458     char*   fullName;
00459     int     fullNameLen;
00460     int     entryCount;
00461     int     cnIdx;
00462     int     cnLen;
00463     int     snIdx;
00464     int     snLen;
00465     int     cIdx;
00466     int     cLen;
00467     int     lIdx;
00468     int     lLen;
00469     int     stIdx;
00470     int     stLen;
00471     int     oIdx;
00472     int     oLen;
00473     int     ouIdx;
00474     int     ouLen;
00475     int     emailIdx;
00476     int     emailLen;
00477     int     uidIdx;
00478     int     uidLen;
00479     int     serialIdx;
00480     int     serialLen;
00481     int     dcIdx[DOMAIN_COMPONENT_MAX];
00482     int     dcLen[DOMAIN_COMPONENT_MAX];
00483     int     dcNum;
00484     int     dcMode;
00485 };
00486 
00487 enum SignatureState {
00488     SIG_STATE_BEGIN,
00489     SIG_STATE_HASH,
00490     SIG_STATE_KEY,
00491     SIG_STATE_DO,
00492     SIG_STATE_CHECK,
00493 };
00494 
00495 
00496 #ifdef HAVE_PK_CALLBACKS
00497 #ifdef HAVE_ECC
00498     typedef int (*wc_CallbackEccVerify)(
00499            const unsigned char* sig, unsigned int sigSz,
00500            const unsigned char* hash, unsigned int hashSz,
00501            const unsigned char* keyDer, unsigned int keySz,
00502            int* result, void* ctx);
00503 #endif
00504 #ifndef NO_RSA
00505     typedef int (*wc_CallbackRsaVerify)(
00506            unsigned char* sig, unsigned int sigSz,
00507            unsigned char** out,
00508            const unsigned char* keyDer, unsigned int keySz,
00509            void* ctx);
00510 #endif
00511 #endif /* HAVE_PK_CALLBACKS */
00512 
00513 struct SignatureCtx {
00514     void* heap;
00515     byte* digest;
00516 #ifndef NO_RSA
00517     byte* out;
00518     byte* plain;
00519 #endif
00520 #if defined(HAVE_ECC) || defined(HAVE_ED25519)
00521     int verify;
00522 #endif
00523     union {
00524     #ifndef NO_RSA
00525         struct RsaKey*      rsa;
00526     #endif
00527     #ifdef HAVE_ECC
00528         struct ecc_key*     ecc;
00529     #endif
00530     #ifdef HAVE_ED25519
00531         struct ed25519_key* ed25519;
00532     #endif
00533         void* ptr;
00534     } key;
00535     int devId;
00536     int state;
00537     int typeH;
00538     int digestSz;
00539     word32 keyOID;
00540 #ifdef WOLFSSL_ASYNC_CRYPT
00541     WC_ASYNC_DEV* asyncDev;
00542     void* asyncCtx;
00543 #endif
00544 
00545 #ifdef HAVE_PK_CALLBACKS
00546 #ifdef HAVE_ECC
00547     wc_CallbackEccVerify pkCbEcc;
00548     void* pkCtxEcc;
00549 #endif
00550 #ifndef NO_RSA
00551     wc_CallbackRsaVerify pkCbRsa;
00552     void* pkCtxRsa;
00553 #endif
00554 #endif /* HAVE_PK_CALLBACKS */
00555 };
00556 
00557 enum CertSignState {
00558     CERTSIGN_STATE_BEGIN,
00559     CERTSIGN_STATE_DIGEST,
00560     CERTSIGN_STATE_ENCODE,
00561     CERTSIGN_STATE_DO,
00562 };
00563 
00564 struct CertSignCtx {
00565     byte* sig;
00566     byte* digest;
00567     #ifndef NO_RSA
00568         byte* encSig;
00569         int encSigSz;
00570     #endif
00571     int state; /* enum CertSignState */
00572 };
00573 
00574 
00575 typedef struct DecodedCert DecodedCert;
00576 typedef struct DecodedName DecodedName;
00577 typedef struct Signer      Signer;
00578 #ifdef WOLFSSL_TRUST_PEER_CERT
00579 typedef struct TrustedPeerCert TrustedPeerCert;
00580 #endif /* WOLFSSL_TRUST_PEER_CERT */
00581 typedef struct SignatureCtx SignatureCtx;
00582 typedef struct CertSignCtx  CertSignCtx;
00583 
00584 
00585 struct DecodedCert {
00586     byte*   publicKey;
00587     word32  pubKeySize;
00588     int     pubKeyStored;
00589     word32  certBegin;               /* offset to start of cert          */
00590     word32  sigIndex;                /* offset to start of signature     */
00591     word32  sigLength;               /* length of signature              */
00592     word32  signatureOID;            /* sum of algorithm object id       */
00593     word32  keyOID;                  /* sum of key algo  object id       */
00594     int     version;                 /* cert version, 1 or 3             */
00595     DNS_entry* altNames;             /* alt names list of dns entries    */
00596 #ifndef IGNORE_NAME_CONSTRAINTS
00597     DNS_entry* altEmailNames;        /* alt names list of RFC822 entries */
00598     Base_entry* permittedNames;      /* Permitted name bases             */
00599     Base_entry* excludedNames;       /* Excluded name bases              */
00600 #endif /* IGNORE_NAME_CONSTRAINTS */
00601     byte    subjectHash[KEYID_SIZE]; /* hash of all Names                */
00602     byte    issuerHash[KEYID_SIZE];  /* hash of all Names                */
00603 #ifdef HAVE_OCSP
00604     byte    issuerKeyHash[KEYID_SIZE]; /* hash of the public Key         */
00605 #endif /* HAVE_OCSP */
00606     byte*   signature;               /* not owned, points into raw cert  */
00607     char*   subjectCN;               /* CommonName                       */
00608     int     subjectCNLen;            /* CommonName Length                */
00609     char    subjectCNEnc;            /* CommonName Encoding              */
00610     char    issuer[ASN_NAME_MAX];    /* full name including common name  */
00611     char    subject[ASN_NAME_MAX];   /* full name including common name  */
00612     int     verify;                  /* Default to yes, but could be off */
00613     byte*   source;                  /* byte buffer holder cert, NOT owner */
00614     word32  srcIdx;                  /* current offset into buffer       */
00615     word32  maxIdx;                  /* max offset based on init size    */
00616     void*   heap;                    /* for user memory overrides        */
00617     byte    serial[EXTERNAL_SERIAL_SIZE];  /* raw serial number          */
00618     int     serialSz;                /* raw serial bytes stored */
00619     byte*   extensions;              /* not owned, points into raw cert  */
00620     int     extensionsSz;            /* length of cert extensions */
00621     word32  extensionsIdx;           /* if want to go back and parse later */
00622     byte*   extAuthInfo;             /* Authority Information Access URI */
00623     int     extAuthInfoSz;           /* length of the URI                */
00624     byte*   extCrlInfo;              /* CRL Distribution Points          */
00625     int     extCrlInfoSz;            /* length of the URI                */
00626     byte    extSubjKeyId[KEYID_SIZE]; /* Subject Key ID                  */
00627     byte    extAuthKeyId[KEYID_SIZE]; /* Authority Key ID                */
00628     byte    pathLength;              /* CA basic constraint path length  */
00629     word16  extKeyUsage;             /* Key usage bitfield               */
00630     byte    extExtKeyUsage;          /* Extended Key usage bitfield      */
00631 
00632 #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
00633     byte*   extExtKeyUsageSrc;
00634     word32  extExtKeyUsageSz;
00635     word32  extExtKeyUsageCount;
00636     byte*   extAuthKeyIdSrc;
00637     word32  extAuthKeyIdSz;
00638     byte*   extSubjKeyIdSrc;
00639     word32  extSubjKeyIdSz;
00640 #endif
00641 
00642 #if defined(HAVE_ECC) || defined(HAVE_ED25519)
00643     word32  pkCurveOID;           /* Public Key's curve OID */
00644 #endif /* HAVE_ECC */
00645     byte*   beforeDate;
00646     int     beforeDateLen;
00647     byte*   afterDate;
00648     int     afterDateLen;
00649 #ifdef HAVE_PKCS7
00650     byte*   issuerRaw;               /* pointer to issuer inside source */
00651     int     issuerRawLen;
00652 #endif
00653 #ifndef IGNORE_NAME_CONSTRAINT
00654     byte*   subjectRaw;               /* pointer to subject inside source */
00655     int     subjectRawLen;
00656 #endif
00657 #ifdef WOLFSSL_CERT_GEN
00658     /* easy access to subject info for other sign */
00659     char*   subjectSN;
00660     int     subjectSNLen;
00661     char    subjectSNEnc;
00662     char*   subjectC;
00663     int     subjectCLen;
00664     char    subjectCEnc;
00665     char*   subjectL;
00666     int     subjectLLen;
00667     char    subjectLEnc;
00668     char*   subjectST;
00669     int     subjectSTLen;
00670     char    subjectSTEnc;
00671     char*   subjectO;
00672     int     subjectOLen;
00673     char    subjectOEnc;
00674     char*   subjectOU;
00675     int     subjectOULen;
00676     char    subjectOUEnc;
00677     char*   subjectEmail;
00678     int     subjectEmailLen;
00679 #endif /* WOLFSSL_CERT_GEN */
00680 #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
00681     DecodedName issuerName;
00682     DecodedName subjectName;
00683 #endif /* OPENSSL_EXTRA */
00684 #ifdef WOLFSSL_SEP
00685     int     deviceTypeSz;
00686     byte*   deviceType;
00687     int     hwTypeSz;
00688     byte*   hwType;
00689     int     hwSerialNumSz;
00690     byte*   hwSerialNum;
00691 #endif /* WOLFSSL_SEP */
00692 #ifdef WOLFSSL_CERT_EXT
00693     char    extCertPolicies[MAX_CERTPOL_NB][MAX_CERTPOL_SZ];
00694     int     extCertPoliciesNb;
00695 #endif /* WOLFSSL_CERT_EXT */
00696 
00697     Signer* ca;
00698     SignatureCtx sigCtx;
00699 
00700     /* Option Bits */
00701     byte subjectCNStored : 1;      /* have we saved a copy we own */
00702     byte extSubjKeyIdSet : 1;      /* Set when the SKID was read from cert */
00703     byte extAuthKeyIdSet : 1;      /* Set when the AKID was read from cert */
00704 #ifndef IGNORE_NAME_CONSTRAINTS
00705     byte extNameConstraintSet : 1;
00706 #endif
00707     byte isCA : 1;                 /* CA basic constraint true */
00708     byte pathLengthSet : 1;        /* CA basic const path length set */
00709     byte weOwnAltNames : 1;        /* altNames haven't been given to copy */
00710     byte extKeyUsageSet : 1;
00711     byte extExtKeyUsageSet : 1;    /* Extended Key Usage set */
00712     byte extCRLdistSet : 1;
00713     byte extAuthInfoSet : 1;
00714     byte extBasicConstSet : 1;
00715     byte extSubjAltNameSet : 1;
00716     byte inhibitAnyOidSet : 1;
00717 #ifdef WOLFSSL_SEP
00718     byte extCertPolicySet : 1;
00719 #endif
00720 #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
00721     byte extCRLdistCrit : 1;
00722     byte extAuthInfoCrit : 1;
00723     byte extBasicConstCrit : 1;
00724     byte extSubjAltNameCrit : 1;
00725     byte extAuthKeyIdCrit : 1;
00726     #ifndef IGNORE_NAME_CONSTRAINTS
00727         byte extNameConstraintCrit : 1;
00728     #endif
00729     byte extSubjKeyIdCrit : 1;
00730     byte extKeyUsageCrit : 1;
00731     byte extExtKeyUsageCrit : 1;
00732 #endif /* OPENSSL_EXTRA */
00733 #ifdef WOLFSSL_SEP
00734     byte extCertPolicyCrit : 1;
00735 #endif
00736 
00737 };
00738 
00739 
00740 #ifdef NO_SHA
00741     #define SIGNER_DIGEST_SIZE WC_SHA256_DIGEST_SIZE
00742 #else
00743     #define SIGNER_DIGEST_SIZE WC_SHA_DIGEST_SIZE
00744 #endif
00745 
00746 /* CA Signers */
00747 /* if change layout change PERSIST_CERT_CACHE functions too */
00748 struct Signer {
00749     word32  pubKeySize;
00750     word32  keyOID;                  /* key type */
00751     word16  keyUsage;
00752     byte    pathLength;
00753     byte    pathLengthSet;
00754     byte*   publicKey;
00755     int     nameLen;
00756     char*   name;                    /* common name */
00757 #ifndef IGNORE_NAME_CONSTRAINTS
00758         Base_entry* permittedNames;
00759         Base_entry* excludedNames;
00760 #endif /* IGNORE_NAME_CONSTRAINTS */
00761     byte    subjectNameHash[SIGNER_DIGEST_SIZE];
00762                                      /* sha hash of names in certificate */
00763     #ifndef NO_SKID
00764         byte    subjectKeyIdHash[SIGNER_DIGEST_SIZE];
00765                                      /* sha hash of names in certificate */
00766     #endif
00767 #ifdef WOLFSSL_SIGNER_DER_CERT
00768     DerBuffer* derCert;
00769 #endif
00770     Signer* next;
00771 };
00772 
00773 
00774 #ifdef WOLFSSL_TRUST_PEER_CERT
00775 /* used for having trusted peer certs rather then CA */
00776 struct TrustedPeerCert {
00777     int     nameLen;
00778     char*   name;                    /* common name */
00779     #ifndef IGNORE_NAME_CONSTRAINTS
00780         Base_entry* permittedNames;
00781         Base_entry* excludedNames;
00782     #endif /* IGNORE_NAME_CONSTRAINTS */
00783     byte    subjectNameHash[SIGNER_DIGEST_SIZE];
00784                                      /* sha hash of names in certificate */
00785     #ifndef NO_SKID
00786         byte    subjectKeyIdHash[SIGNER_DIGEST_SIZE];
00787                                      /* sha hash of names in certificate */
00788     #endif
00789     word32 sigLen;
00790     byte*  sig;
00791     struct TrustedPeerCert* next;
00792 };
00793 #endif /* WOLFSSL_TRUST_PEER_CERT */
00794 
00795 
00796 /* for testing or custom openssl wrappers */
00797 #if defined(WOLFSSL_TEST_CERT) || defined(OPENSSL_EXTRA) || \
00798     defined(OPENSSL_EXTRA_X509_SMALL)
00799     #define WOLFSSL_ASN_API WOLFSSL_API
00800 #else
00801     #define WOLFSSL_ASN_API WOLFSSL_LOCAL
00802 #endif
00803 
00804 WOLFSSL_ASN_API int wc_BerToDer(const byte* ber, word32 berSz, byte* der,
00805                                 word32* derSz);
00806 
00807 WOLFSSL_ASN_API void FreeAltNames(DNS_entry*, void*);
00808 #ifndef IGNORE_NAME_CONSTRAINTS
00809     WOLFSSL_ASN_API void FreeNameSubtrees(Base_entry*, void*);
00810 #endif /* IGNORE_NAME_CONSTRAINTS */
00811 WOLFSSL_ASN_API void InitDecodedCert(DecodedCert*, byte*, word32, void*);
00812 WOLFSSL_ASN_API void FreeDecodedCert(DecodedCert*);
00813 WOLFSSL_ASN_API int  ParseCert(DecodedCert*, int type, int verify, void* cm);
00814 
00815 WOLFSSL_LOCAL int DecodePolicyOID(char *o, word32 oSz, byte *in, word32 inSz);
00816 WOLFSSL_LOCAL int ParseCertRelative(DecodedCert*,int type,int verify,void* cm);
00817 WOLFSSL_LOCAL int DecodeToKey(DecodedCert*, int verify);
00818 
00819 WOLFSSL_LOCAL const byte* OidFromId(word32 id, word32 type, word32* oidSz);
00820 WOLFSSL_LOCAL Signer* MakeSigner(void*);
00821 WOLFSSL_LOCAL void    FreeSigner(Signer*, void*);
00822 WOLFSSL_LOCAL void    FreeSignerTable(Signer**, int, void*);
00823 #ifdef WOLFSSL_TRUST_PEER_CERT
00824 WOLFSSL_LOCAL void    FreeTrustedPeer(TrustedPeerCert*, void*);
00825 WOLFSSL_LOCAL void    FreeTrustedPeerTable(TrustedPeerCert**, int, void*);
00826 #endif /* WOLFSSL_TRUST_PEER_CERT */
00827 
00828 WOLFSSL_ASN_API int ToTraditional(byte* buffer, word32 length);
00829 WOLFSSL_LOCAL int ToTraditionalInline(const byte* input, word32* inOutIdx,
00830                                       word32 length);
00831 WOLFSSL_LOCAL int ToTraditionalEnc(byte* buffer, word32 length,const char*,int);
00832 WOLFSSL_ASN_API int UnTraditionalEnc(byte* key, word32 keySz, byte* out,
00833         word32* outSz, const char* password, int passwordSz, int vPKCS,
00834         int vAlgo, byte* salt, word32 saltSz, int itt, WC_RNG* rng, void* heap);
00835 WOLFSSL_LOCAL int DecryptContent(byte* input, word32 sz,const char* psw,int pswSz);
00836 WOLFSSL_LOCAL int EncryptContent(byte* input, word32 sz, byte* out, word32* outSz,
00837         const char* password,int passwordSz, int vPKCS, int vAlgo,
00838         byte* salt, word32 saltSz, int itt, WC_RNG* rng, void* heap);
00839 WOLFSSL_LOCAL int wc_GetKeyOID(byte* key, word32 keySz, const byte** curveOID,
00840         word32* oidSz, int* algoID, void* heap);
00841 
00842 typedef struct tm wolfssl_tm;
00843 #if defined(OPENSSL_ALL) || defined(WOLFSSL_MYSQL_COMPATIBLE) || defined(OPENSSL_EXTRA) || \
00844     defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY)
00845 WOLFSSL_LOCAL int GetTimeString(byte* date, int format, char* buf, int len);
00846 #endif
00847 WOLFSSL_LOCAL int ExtractDate(const unsigned char* date, unsigned char format,
00848                                                  wolfssl_tm* certTime, int* idx);
00849 WOLFSSL_LOCAL int ValidateDate(const byte* date, byte format, int dateType);
00850 
00851 /* ASN.1 helper functions */
00852 #ifdef WOLFSSL_CERT_GEN
00853 WOLFSSL_ASN_API int SetName(byte* output, word32 outputSz, CertName* name);
00854 #endif
00855 WOLFSSL_LOCAL int GetShortInt(const byte* input, word32* inOutIdx, int* number,
00856                               word32 maxIdx);
00857 WOLFSSL_LOCAL char* GetSigName(int oid);
00858 WOLFSSL_LOCAL int GetLength(const byte* input, word32* inOutIdx, int* len,
00859                            word32 maxIdx);
00860 WOLFSSL_LOCAL int GetSequence(const byte* input, word32* inOutIdx, int* len,
00861                              word32 maxIdx);
00862 WOLFSSL_LOCAL int GetSet(const byte* input, word32* inOutIdx, int* len,
00863                         word32 maxIdx);
00864 WOLFSSL_LOCAL int GetMyVersion(const byte* input, word32* inOutIdx,
00865                               int* version, word32 maxIdx);
00866 WOLFSSL_LOCAL int GetInt(mp_int* mpi, const byte* input, word32* inOutIdx,
00867                         word32 maxIdx);
00868 #ifdef HAVE_OID_ENCODING
00869     WOLFSSL_LOCAL int EncodeObjectId(const word16* in, word32 inSz,
00870         byte* out, word32* outSz);
00871 #endif
00872 #ifdef HAVE_OID_DECODING
00873     WOLFSSL_LOCAL int DecodeObjectId(const byte* in, word32 inSz,
00874         word16* out, word32* outSz);
00875 #endif
00876 WOLFSSL_LOCAL int GetObjectId(const byte* input, word32* inOutIdx, word32* oid,
00877                               word32 oidType, word32 maxIdx);
00878 WOLFSSL_LOCAL int GetAlgoId(const byte* input, word32* inOutIdx, word32* oid,
00879                            word32 oidType, word32 maxIdx);
00880 WOLFSSL_LOCAL word32 SetLength(word32 length, byte* output);
00881 WOLFSSL_LOCAL word32 SetSequence(word32 len, byte* output);
00882 WOLFSSL_LOCAL word32 SetOctetString(word32 len, byte* output);
00883 WOLFSSL_LOCAL word32 SetImplicit(byte tag,byte number,word32 len,byte* output);
00884 WOLFSSL_LOCAL word32 SetExplicit(byte number, word32 len, byte* output);
00885 WOLFSSL_LOCAL word32 SetSet(word32 len, byte* output);
00886 WOLFSSL_LOCAL word32 SetAlgoID(int algoOID,byte* output,int type,int curveSz);
00887 WOLFSSL_LOCAL int SetMyVersion(word32 version, byte* output, int header);
00888 WOLFSSL_LOCAL int SetSerialNumber(const byte* sn, word32 snSz, byte* output,
00889     int maxSnSz);
00890 WOLFSSL_LOCAL int GetSerialNumber(const byte* input, word32* inOutIdx,
00891     byte* serial, int* serialSz, word32 maxIdx);
00892 WOLFSSL_LOCAL int GetNameHash(const byte* source, word32* idx, byte* hash,
00893                              int maxIdx);
00894 WOLFSSL_LOCAL int wc_CheckPrivateKey(byte* key, word32 keySz, DecodedCert* der);
00895 WOLFSSL_LOCAL int RsaPublicKeyDerSize(RsaKey* key, int with_header);
00896 
00897 #ifdef HAVE_ECC
00898     /* ASN sig helpers */
00899     WOLFSSL_LOCAL int StoreECC_DSA_Sig(byte* out, word32* outLen, mp_int* r,
00900                                       mp_int* s);
00901     WOLFSSL_LOCAL int DecodeECC_DSA_Sig(const byte* sig, word32 sigLen,
00902                                        mp_int* r, mp_int* s);
00903 #endif
00904 
00905 WOLFSSL_LOCAL void InitSignatureCtx(SignatureCtx* sigCtx, void* heap, int devId);
00906 WOLFSSL_LOCAL void FreeSignatureCtx(SignatureCtx* sigCtx);
00907 
00908 #ifndef NO_CERTS
00909 
00910 WOLFSSL_LOCAL int PemToDer(const unsigned char* buff, long sz, int type,
00911                           DerBuffer** pDer, void* heap, EncryptedInfo* info,
00912                           int* eccKey);
00913 WOLFSSL_LOCAL int AllocDer(DerBuffer** der, word32 length, int type, void* heap);
00914 WOLFSSL_LOCAL void FreeDer(DerBuffer** der);
00915 
00916 #endif /* !NO_CERTS */
00917 
00918 #ifdef WOLFSSL_CERT_GEN
00919 
00920 enum cert_enums {
00921     NAME_ENTRIES    =  8,
00922     JOINT_LEN       =  2,
00923     EMAIL_JOINT_LEN =  9,
00924     PILOT_JOINT_LEN =  10,
00925     RSA_KEY         = 10,
00926     NTRU_KEY        = 11,
00927     ECC_KEY         = 12,
00928     ED25519_KEY     = 13
00929 };
00930 
00931 #endif /* WOLFSSL_CERT_GEN */
00932 
00933 
00934 
00935 /* for pointer use */
00936 typedef struct CertStatus CertStatus;
00937 
00938 #ifdef HAVE_OCSP
00939 
00940 enum Ocsp_Response_Status {
00941     OCSP_SUCCESSFUL        = 0, /* Response has valid confirmations */
00942     OCSP_MALFORMED_REQUEST = 1, /* Illegal confirmation request */
00943     OCSP_INTERNAL_ERROR    = 2, /* Internal error in issuer */
00944     OCSP_TRY_LATER         = 3, /* Try again later */
00945     OCSP_SIG_REQUIRED      = 5, /* Must sign the request (4 is skipped) */
00946     OCSP_UNAUTHROIZED      = 6  /* Request unauthorized */
00947 };
00948 
00949 
00950 enum Ocsp_Cert_Status {
00951     CERT_GOOD    = 0,
00952     CERT_REVOKED = 1,
00953     CERT_UNKNOWN = 2
00954 };
00955 
00956 
00957 enum Ocsp_Sums {
00958     OCSP_BASIC_OID = 117,
00959     OCSP_NONCE_OID = 118
00960 };
00961 
00962 #ifdef OPENSSL_EXTRA
00963 enum Ocsp_Verify_Error {
00964     OCSP_VERIFY_ERROR_NONE = 0,
00965     OCSP_BAD_ISSUER = 1
00966 };
00967 #endif
00968 
00969 
00970 typedef struct OcspRequest  OcspRequest;
00971 typedef struct OcspResponse OcspResponse;
00972 
00973 
00974 struct CertStatus {
00975     CertStatus* next;
00976 
00977     byte serial[EXTERNAL_SERIAL_SIZE];
00978     int serialSz;
00979 
00980     int status;
00981 
00982     byte thisDate[MAX_DATE_SIZE];
00983     byte nextDate[MAX_DATE_SIZE];
00984     byte thisDateFormat;
00985     byte nextDateFormat;
00986 #if defined(OPENSSL_ALL) || defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY)
00987     byte* thisDateAsn;
00988     byte* nextDateAsn;
00989 #endif
00990 
00991     byte*  rawOcspResponse;
00992     word32 rawOcspResponseSz;
00993 };
00994 
00995 
00996 struct OcspResponse {
00997     int     responseStatus;  /* return code from Responder */
00998 
00999     byte*   response;        /* Pointer to beginning of OCSP Response */
01000     word32  responseSz;      /* length of the OCSP Response */
01001 
01002     byte    producedDate[MAX_DATE_SIZE];
01003                              /* Date at which this response was signed */
01004     byte    producedDateFormat; /* format of the producedDate */
01005     byte*   issuerHash;
01006     byte*   issuerKeyHash;
01007 
01008     byte*   cert;
01009     word32  certSz;
01010 
01011     byte*   sig;             /* Pointer to sig in source */
01012     word32  sigSz;           /* Length in octets for the sig */
01013     word32  sigOID;          /* OID for hash used for sig */
01014 
01015     CertStatus* status;      /* certificate status to fill out */
01016 
01017     byte*   nonce;           /* pointer to nonce inside ASN.1 response */
01018     int     nonceSz;         /* length of the nonce string */
01019 
01020     byte*   source;          /* pointer to source buffer, not owned */
01021     word32  maxIdx;          /* max offset based on init size */
01022 
01023 #ifdef OPENSSL_EXTRA
01024     int     verifyError;
01025 #endif
01026 };
01027 
01028 
01029 struct OcspRequest {
01030     byte   issuerHash[KEYID_SIZE];
01031     byte   issuerKeyHash[KEYID_SIZE];
01032     byte*  serial;   /* copy of the serial number in source cert */
01033     int    serialSz;
01034     byte*  url;      /* copy of the extAuthInfo in source cert */
01035     int    urlSz;
01036 
01037     byte   nonce[MAX_OCSP_NONCE_SZ];
01038     int    nonceSz;
01039     void*  heap;
01040     void*  ssl;
01041 };
01042 
01043 
01044 WOLFSSL_LOCAL void InitOcspResponse(OcspResponse*, CertStatus*, byte*, word32);
01045 WOLFSSL_LOCAL int  OcspResponseDecode(OcspResponse*, void*, void* heap, int);
01046 
01047 WOLFSSL_LOCAL int    InitOcspRequest(OcspRequest*, DecodedCert*, byte, void*);
01048 WOLFSSL_LOCAL void   FreeOcspRequest(OcspRequest*);
01049 WOLFSSL_LOCAL int    EncodeOcspRequest(OcspRequest*, byte*, word32);
01050 WOLFSSL_LOCAL word32 EncodeOcspRequestExtensions(OcspRequest*, byte*, word32);
01051 
01052 
01053 WOLFSSL_LOCAL int  CompareOcspReqResp(OcspRequest*, OcspResponse*);
01054 
01055 
01056 #endif /* HAVE_OCSP */
01057 
01058 
01059 /* for pointer use */
01060 typedef struct RevokedCert RevokedCert;
01061 
01062 #ifdef HAVE_CRL
01063 
01064 struct RevokedCert {
01065     byte         serialNumber[EXTERNAL_SERIAL_SIZE];
01066     int          serialSz;
01067     RevokedCert* next;
01068 };
01069 
01070 typedef struct DecodedCRL DecodedCRL;
01071 
01072 struct DecodedCRL {
01073     word32  certBegin;               /* offset to start of cert          */
01074     word32  sigIndex;                /* offset to start of signature     */
01075     word32  sigLength;               /* length of signature              */
01076     word32  signatureOID;            /* sum of algorithm object id       */
01077     byte*   signature;               /* pointer into raw source, not owned */
01078     byte    issuerHash[SIGNER_DIGEST_SIZE]; /* issuer hash               */
01079     byte    crlHash[SIGNER_DIGEST_SIZE]; /* raw crl data hash            */
01080     byte    lastDate[MAX_DATE_SIZE]; /* last date updated  */
01081     byte    nextDate[MAX_DATE_SIZE]; /* next update date   */
01082     byte    lastDateFormat;          /* format of last date */
01083     byte    nextDateFormat;          /* format of next date */
01084     RevokedCert* certs;              /* revoked cert list  */
01085     int          totalCerts;         /* number on list     */
01086     void*   heap;
01087 };
01088 
01089 WOLFSSL_LOCAL void InitDecodedCRL(DecodedCRL*, void* heap);
01090 WOLFSSL_LOCAL int VerifyCRL_Signature(SignatureCtx* sigCtx,
01091                                       const byte* toBeSigned, word32 tbsSz,
01092                                       const byte* signature, word32 sigSz,
01093                                       word32 signatureOID, Signer *ca,
01094                                       void* heap);
01095 WOLFSSL_LOCAL int  ParseCRL(DecodedCRL*, const byte* buff, word32 sz, void* cm);
01096 WOLFSSL_LOCAL void FreeDecodedCRL(DecodedCRL*);
01097 
01098 
01099 #endif /* HAVE_CRL */
01100 
01101 
01102 #ifdef __cplusplus
01103     } /* extern "C" */
01104 #endif
01105 
01106 #endif /* !NO_ASN */
01107 
01108 
01109 #if !defined(NO_ASN) || !defined(NO_PWDBASED)
01110 
01111 #ifndef MAX_KEY_SIZE
01112     #define MAX_KEY_SIZE    64  /* MAX PKCS Key length */
01113 #endif
01114 #ifndef MAX_UNICODE_SZ
01115     #define MAX_UNICODE_SZ  256
01116 #endif
01117 
01118 enum PBESTypes {
01119     PBE_MD5_DES      = 0,
01120     PBE_SHA1_RC4_128 = 1,
01121     PBE_SHA1_DES     = 2,
01122     PBE_SHA1_DES3    = 3,
01123     PBE_AES256_CBC   = 4,
01124 
01125     PBE_SHA1_RC4_128_SUM = 657,
01126     PBE_SHA1_DES3_SUM    = 659,
01127     PBES2            = 13       /* algo ID */
01128 };
01129 
01130 enum PKCSTypes {
01131     PKCS5v2             =   6,     /* PKCS #5 v2.0 */
01132     PKCS12v1            =  12,     /* PKCS #12 */
01133     PKCS5               =   5,     /* PKCS oid tag */
01134     PKCS8v0             =   0,     /* default PKCS#8 version */
01135 };
01136 
01137 #endif /* !NO_ASN || !NO_PWDBASED */
01138 
01139 #endif /* WOLF_CRYPT_ASN_H */
01140