src/libstrongswan/crypto/x509.h

   1 /**
   2  * @file x509.h
   3  *
   4  * @brief Interface of x509_t.
   5  *
   6  */
   7
   8 /*
   9  * Copyright (C) 2000 Andreas Hess, Patric Lichtsteiner, Roger Wegmann
  10  * Copyright (C) 2001 Marco Bertossa, Andreas Schleiss
  11  * Copyright (C) 2002 Mario Strasser
  12  * Copyright (C) 2000-2004 Andreas Steffen, Zuercher Hochschule Winterthur
  13  * Copyright (C) 2006 Martin Willi, Andreas Steffen
  14  *
  15  * Hochschule fuer Technik Rapperswil
  16  *
  17  * This program is free software; you can redistribute it and/or modify it
  18  * under the terms of the GNU General Public License as published by the
  19  * Free Software Foundation; either version 2 of the License, or (at your
  20  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  21  *
  22  * This program is distributed in the hope that it will be useful, but
  23  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  24  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  25  * for more details.
  26  */
  27
  28 #ifndef X509_H_
  29 #define X509_H_
  30
  31 typedef struct x509_t x509_t;
  32
  33 #include <library.h>
  34 #include <crypto/rsa/rsa_public_key.h>
  35 #include <crypto/certinfo.h>
  36 #include <utils/identification.h>
  37 #include <utils/iterator.h>
  38 #include <utils/linked_list.h>
  39
  40 /* authority flags */
  41
  42 #define AUTH_NONE       0x00    /* no authorities */
  43 #define AUTH_CA         0x01    /* certification authority */
  44 #define AUTH_AA         0x02    /* authorization authority */
  45 #define AUTH_OCSP       0x04    /* ocsp signing authority */
  46
  47 /**
  48  * @brief X.509 certificate.
  49  *
  50  * @b Constructors:
  51  *  - x509_create_from_chunk()
  52  *  - x509_create_from_file()
  53  *
  54  * @ingroup crypto
  55  */
  56 struct x509_t {
  57
  58         /**
  59          * @brief Set trusted public key life.
  60          *
  61          * @param this                          calling object
  62          * @param until                         time until public key is trusted
  63          */
  64         void (*set_until) (x509_t *this, time_t until);
  65
  66         /**
  67          * @brief Get trusted public key life.
  68          *
  69          * @param this                          calling object
  70          * @return                                      time until public key is trusted
  71          */
  72         time_t (*get_until) (const x509_t *this);
  73
  74         /**
  75          * @brief Set the certificate status
  76          *
  77          * @param this                          calling object
  78          * @param status                        certificate status
  79          */
  80         void (*set_status) (x509_t *this, cert_status_t status);
  81
  82         /**
  83          * @brief Get the certificate status
  84          *
  85          * @param this                          calling object
  86          * @return                                      certificate status
  87          */
  88         cert_status_t (*get_status) (const x509_t *this);
  89
  90         /**
  91          * @brief Add authority flags
  92          *
  93          * @param this                          calling object
  94          * @param flag                          flags to be added
  95          */
  96         void (*add_authority_flags) (x509_t *this, u_int flags);
  97
  98         /**
  99          * @brief Get authority flags
 100          *
 101          * @param this                          calling object
 102          * @return                                      authority flags
 103          */
 104         u_int (*get_authority_flags) (x509_t *this);
 105
 106         /**
 107          * @brief Check a specific authority flag
 108          *
 109          * @param this                          calling object
 110          * @param flag                          flag to be checked
 111          * @return                                      TRUE if flag is present
 112          */
 113         bool (*has_authority_flag) (x509_t *this, u_int flag);
 114
 115         /**
 116          * @brief Get the DER-encoded X.509 certificate body
 117          *
 118          * @param this                          calling object
 119          * @return                                      DER-encoded X.509 certificate
 120          */
 121         chunk_t (*get_certificate) (const x509_t *this);
 122
 123         /**
 124          * @brief Get the RSA public key from the certificate.
 125          *
 126          * @param this                          calling object
 127          * @return                                      public_key
 128          */
 129         rsa_public_key_t *(*get_public_key) (const x509_t *this);
 130
 131         /**
 132          * @brief Get serial number from the certificate.
 133          *
 134          * @param this                          calling object
 135          * @return                                      serialNumber
 136          */
 137         chunk_t (*get_serialNumber) (const x509_t *this);
 138
 139         /**
 140          * @brief Get subjectKeyID from the certificate.
 141          *
 142          * @param this                          calling object
 143          * @return                                      subjectKeyID
 144          */
 145         chunk_t (*get_subjectKeyID) (const x509_t *this);
 146
 147         /**
 148          * @brief Get keyid from the certificate's public key.
 149          *
 150          * @param this                          calling object
 151          * @return                                      keyid
 152          */
 153         chunk_t (*get_keyid) (const x509_t *this);
 154
 155         /**
 156          * @brief Get the certificate issuer's ID.
 157          *
 158          * The resulting ID is always a identification_t
 159          * of type ID_DER_ASN1_DN.
 160          *
 161          * @param this                          calling object
 162          * @return                                      issuers ID
 163          */
 164         identification_t *(*get_issuer) (const x509_t *this);
 165
 166         /**
 167          * @brief Get the subjectDistinguisheName.
 168          *
 169          * The resulting ID is always a identification_t
 170          * of type ID_DER_ASN1_DN.
 171          *
 172          * @param this                          calling object
 173          * @return                                      subjects ID
 174          */
 175         identification_t *(*get_subject) (const x509_t *this);
 176
 177         /**
 178          * @brief Create an iterator for the crlDistributionPoints.
 179          *
 180          * @param this                          calling object
 181          * @return                                      iterator for crlDistributionPoints
 182          */
 183         iterator_t *(*create_crluri_iterator) (const x509_t *this);
 184
 185         /**
 186          * @brief Create an iterator for the ocspAccessLocations.
 187          *
 188          * @param this                          calling object
 189          * @return                                      iterator for ocspAccessLocations
 190          */
 191         iterator_t *(*create_ocspuri_iterator) (const x509_t *this);
 192
 193         /**
 194          * @brief Check if a certificate is trustworthy
 195          *
 196          * @param this                  calling object
 197          * @param signer                signer's RSA public key
 198          */
 199         bool (*verify) (const x509_t *this, const rsa_public_key_t *signer);
 200
 201         /**
 202          * @brief Compare two certificates.
 203          *
 204          * Comparison is done via the certificates signature.
 205          *
 206          * @param this                  first cert for compare
 207          * @param other                 second cert for compare
 208          * @return                              TRUE if signature is equal
 209          */
 210         bool (*equals) (const x509_t *this, const x509_t *that);
 211
 212         /**
 213          * @brief Checks if the certificate contains a subjectAltName equal to id.
 214          *
 215          * @param this                  certificate being examined
 216          * @param id                    id which is being compared to the subjectAltNames
 217          * @return                              TRUE if a match is found
 218          */
 219         bool (*equals_subjectAltName) (const x509_t *this, identification_t *id);
 220
 221         /**
 222          * @brief Checks if the subject of the other cert is the issuer of this cert.
 223          *
 224          * @param this                  certificate
 225          * @param issuer                potential issuer certificate
 226          * @return                              TRUE if issuer is found
 227          */
 228         bool (*is_issuer) (const x509_t *this, const x509_t *issuer);
 229
 230         /**
 231          * @brief Checks the validity interval of the certificate
 232          *
 233          * @param this                  certificate being examined
 234          * @param until                 until = min(until, notAfter)
 235          * @return                              NULL if the certificate is valid
 236          */
 237         err_t (*is_valid) (const x509_t *this, time_t *until);
 238
 239         /**
 240          * @brief Returns the CA basic constraints flag
 241          *
 242          * @param this                  certificate being examined
 243          * @return                              TRUE if the CA flag is set
 244          */
 245         bool (*is_ca) (const x509_t *this);
 246
 247         /**
 248          * @brief Returns the OCSPSigner extended key usage flag
 249          *
 250          * @param this                  certificate being examined
 251          * @return                              TRUE if the OCSPSigner flag is set
 252          */
 253         bool (*is_ocsp_signer) (const x509_t *this);
 254
 255         /**
 256          * @brief Checks if the certificate is self-signed (subject equals issuer)
 257          *
 258          * @param this                  certificate being examined
 259          * @return                              TRUE if self-signed
 260          */
 261         bool (*is_self_signed) (const x509_t *this);
 262
 263         /**
 264          * @brief Log the certificate info to out.
 265          *
 266          * @param this                  calling object
 267          * @param out                   stream to write to
 268          * @param utc                   TRUE for UTC times, FALSE for local time
 269          */
 270         void (*list)(x509_t *this, FILE *out, bool utc);
 271
 272         /**
 273          * @brief Destroys the certificate.
 274          *
 275          * @param this                  certificate to destroy
 276          */
 277         void (*destroy) (x509_t *this);
 278 };
 279
 280 /**
 281  * @brief Read a x509 certificate from a DER encoded blob.
 282  *
 283  * @param chunk         chunk containing DER encoded data
 284  * @return                      created x509_t certificate, or NULL if inv\ 1lid.
 285  *
 286  * @ingroup crypto
 287  */
 288 x509_t *x509_create_from_chunk(chunk_t chunk, u_int level);
 289
 290 /**
 291  * @brief Read a x509 certificate from a DER encoded file.
 292  *
 293  * @param filename      file containing DER encoded data
 294  * @param label         label describing kind of certificate
 295  * @return                      created x509_t certificate, or NULL if invalid.
 296  *
 297  * @ingroup crypto
 298  */
 299 x509_t *x509_create_from_file(const char *filename, const char *label);
 300
 301 /**
 302  * @brief Parses a DER encoded authorityKeyIdentifier
 303  *
 304  * @param blob                                  blob containing DER encoded data
 305  * @param level0                                indicates the current parsing level
 306  * @param authKeyID                             assigns the authorityKeyIdentifier
 307  * @param authKeySerialNumber   assigns the authKeySerialNumber
 308  *
 309  * @ingroup crypto
 310  */
 311 void parse_authorityKeyIdentifier(chunk_t blob, int level0, chunk_t *authKeyID, chunk_t *authKeySerialNumber);
 312
 313 /**
 314  * @brief Parses DER encoded generalNames
 315  *
 316  * @param blob                  blob containing DER encoded data
 317  * @param level0                indicates the current parsing level
 318  * @param implicit              implicit coding is used
 319  * @param list                  linked list of decoded generalNames
 320  *
 321  * @ingroup crypto
 322  */
 323 void parse_generalNames(chunk_t blob, int level0, bool implicit, linked_list_t *list);
 324
 325 #endif /* X509_H_ */