123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718 |
- /* asn.h
- *
- * Copyright (C) 2006-2014 wolfSSL Inc.
- *
- * This file is part of CyaSSL.
- *
- * CyaSSL is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * CyaSSL is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
- */
- #ifndef NO_ASN
- #ifndef CTAO_CRYPT_ASN_H
- #define CTAO_CRYPT_ASN_H
- #include <cyassl/ctaocrypt/types.h>
- #include <cyassl/ctaocrypt/rsa.h>
- #include <cyassl/ctaocrypt/dh.h>
- #include <cyassl/ctaocrypt/dsa.h>
- #include <cyassl/ctaocrypt/sha.h>
- #include <cyassl/ctaocrypt/md5.h>
- #include <cyassl/ctaocrypt/asn_public.h> /* public interface */
- #ifdef HAVE_ECC
- #include <cyassl/ctaocrypt/ecc.h>
- #endif
- #ifdef __cplusplus
- extern "C" {
- #endif
- enum {
- ISSUER = 0,
- SUBJECT = 1,
- EXTERNAL_SERIAL_SIZE = 32,
- BEFORE = 0,
- AFTER = 1
- };
- /* ASN Tags */
- enum ASN_Tags {
- ASN_BOOLEAN = 0x01,
- ASN_INTEGER = 0x02,
- ASN_BIT_STRING = 0x03,
- ASN_OCTET_STRING = 0x04,
- ASN_TAG_NULL = 0x05,
- ASN_OBJECT_ID = 0x06,
- ASN_ENUMERATED = 0x0a,
- ASN_UTF8STRING = 0x0c,
- ASN_SEQUENCE = 0x10,
- ASN_SET = 0x11,
- ASN_UTC_TIME = 0x17,
- ASN_OTHER_TYPE = 0x00,
- ASN_RFC822_TYPE = 0x01,
- ASN_DNS_TYPE = 0x02,
- ASN_DIR_TYPE = 0x04,
- ASN_GENERALIZED_TIME = 0x18,
- CRL_EXTENSIONS = 0xa0,
- ASN_EXTENSIONS = 0xa3,
- ASN_LONG_LENGTH = 0x80
- };
- enum ASN_Flags{
- ASN_CONSTRUCTED = 0x20,
- ASN_CONTEXT_SPECIFIC = 0x80
- };
- enum DN_Tags {
- ASN_COMMON_NAME = 0x03, /* CN */
- ASN_SUR_NAME = 0x04, /* SN */
- ASN_SERIAL_NUMBER = 0x05, /* serialNumber */
- ASN_COUNTRY_NAME = 0x06, /* C */
- ASN_LOCALITY_NAME = 0x07, /* L */
- ASN_STATE_NAME = 0x08, /* ST */
- ASN_ORG_NAME = 0x0a, /* O */
- ASN_ORGUNIT_NAME = 0x0b /* OU */
- };
- enum PBES {
- PBE_MD5_DES = 0,
- PBE_SHA1_DES = 1,
- PBE_SHA1_DES3 = 2,
- PBE_SHA1_RC4_128 = 3,
- PBES2 = 13 /* algo ID */
- };
- enum ENCRYPTION_TYPES {
- DES_TYPE = 0,
- DES3_TYPE = 1,
- RC4_TYPE = 2
- };
- enum ECC_TYPES {
- ECC_PREFIX_0 = 160,
- ECC_PREFIX_1 = 161
- };
- enum Misc_ASN {
- ASN_NAME_MAX = 256,
- MAX_SALT_SIZE = 64, /* MAX PKCS Salt length */
- MAX_IV_SIZE = 64, /* MAX PKCS Iv length */
- MAX_KEY_SIZE = 64, /* MAX PKCS Key length */
- PKCS5 = 5, /* PKCS oid tag */
- PKCS5v2 = 6, /* PKCS #5 v2.0 */
- PKCS12 = 12, /* PKCS #12 */
- MAX_UNICODE_SZ = 256,
- ASN_BOOL_SIZE = 2, /* including type */
- ASN_ECC_HEADER_SZ = 2, /* String type + 1 byte len */
- ASN_ECC_CONTEXT_SZ = 2, /* Content specific type + 1 byte len */
- SHA_SIZE = 20,
- RSA_INTS = 8, /* RSA ints in private key */
- MIN_DATE_SIZE = 13,
- MAX_DATE_SIZE = 32,
- ASN_GEN_TIME_SZ = 15, /* 7 numbers * 2 + Zulu tag */
- MAX_ENCODED_SIG_SZ = 512,
- MAX_SIG_SZ = 256,
- MAX_ALGO_SZ = 20,
- MAX_SEQ_SZ = 5, /* enum(seq | con) + length(4) */
- MAX_SET_SZ = 5, /* enum(set | con) + length(4) */
- MAX_OCTET_STR_SZ = 5, /* enum(set | con) + length(4) */
- MAX_EXP_SZ = 5, /* enum(contextspec|con|exp) + length(4) */
- MAX_PRSTR_SZ = 5, /* enum(prstr) + length(4) */
- MAX_VERSION_SZ = 5, /* enum + id + version(byte) + (header(2))*/
- MAX_ENCODED_DIG_SZ = 73, /* sha512 + enum(bit or octet) + legnth(4) */
- MAX_RSA_INT_SZ = 517, /* RSA raw sz 4096 for bits + tag + len(4) */
- MAX_NTRU_KEY_SZ = 610, /* NTRU 112 bit public key */
- MAX_NTRU_ENC_SZ = 628, /* NTRU 112 bit DER public encoding */
- MAX_LENGTH_SZ = 4, /* Max length size for DER encoding */
- MAX_RSA_E_SZ = 16, /* Max RSA public e size */
- MAX_CA_SZ = 32, /* Max encoded CA basic constraint length */
- MAX_SN_SZ = 35, /* Max encoded serial number (INT) length */
- #ifdef CYASSL_CERT_GEN
- #ifdef CYASSL_CERT_REQ
- /* Max encoded cert req attributes length */
- MAX_ATTRIB_SZ = MAX_SEQ_SZ * 3 + (11 + MAX_SEQ_SZ) * 2 +
- MAX_PRSTR_SZ + CTC_NAME_SIZE, /* 11 is the OID size */
- #endif
- #ifdef CYASSL_ALT_NAMES
- MAX_EXTENSIONS_SZ = 1 + MAX_LENGTH_SZ + CTC_MAX_ALT_SIZE,
- #else
- MAX_EXTENSIONS_SZ = 1 + MAX_LENGTH_SZ + MAX_CA_SZ,
- #endif
- /* Max total extensions, id + len + others */
- #endif
- MAX_OCSP_EXT_SZ = 58, /* Max OCSP Extension length */
- MAX_OCSP_NONCE_SZ = 18, /* OCSP Nonce size */
- EIGHTK_BUF = 8192, /* Tmp buffer size */
- MAX_PUBLIC_KEY_SZ = MAX_NTRU_ENC_SZ + MAX_ALGO_SZ + MAX_SEQ_SZ * 2
- /* use bigger NTRU size */
- };
- enum Oid_Types {
- hashType = 0,
- sigType = 1,
- keyType = 2,
- curveType = 3,
- blkType = 4
- };
- enum Hash_Sum {
- MD2h = 646,
- MD5h = 649,
- SHAh = 88,
- SHA256h = 414,
- SHA384h = 415,
- SHA512h = 416
- };
- enum Block_Sum {
- DESb = 69,
- DES3b = 652
- };
- enum Key_Sum {
- DSAk = 515,
- RSAk = 645,
- NTRUk = 274,
- ECDSAk = 518
- };
- enum Ecc_Sum {
- ECC_256R1 = 526,
- ECC_384R1 = 210,
- ECC_521R1 = 211,
- ECC_160R1 = 184,
- ECC_192R1 = 520,
- ECC_224R1 = 209
- };
- enum KDF_Sum {
- PBKDF2_OID = 660
- };
- enum Extensions_Sum {
- BASIC_CA_OID = 133,
- ALT_NAMES_OID = 131,
- CRL_DIST_OID = 145,
- AUTH_INFO_OID = 69,
- CA_ISSUER_OID = 117,
- AUTH_KEY_OID = 149,
- SUBJ_KEY_OID = 128,
- CERT_POLICY_OID = 146,
- KEY_USAGE_OID = 129, /* 2.5.29.15 */
- INHIBIT_ANY_OID = 168, /* 2.5.29.54 */
- EXT_KEY_USAGE_OID = 151, /* 2.5.29.37 */
- NAME_CONS_OID = 144 /* 2.5.29.30 */
- };
- enum CertificatePolicy_Sum {
- CP_ANY_OID = 146 /* id-ce 32 0 */
- };
- enum SepHardwareName_Sum {
- HW_NAME_OID = 79 /* 1.3.6.1.5.5.7.8.4 from RFC 4108*/
- };
- enum AuthInfo_Sum {
- AIA_OCSP_OID = 116, /* 1.3.6.1.5.5.7.48.1 */
- AIA_CA_ISSUER_OID = 117 /* 1.3.6.1.5.5.7.48.2 */
- };
- enum ExtKeyUsage_Sum { /* From RFC 5280 */
- EKU_ANY_OID = 151, /* 2.5.29.37.0, anyExtendedKeyUsage */
- EKU_SERVER_AUTH_OID = 71, /* 1.3.6.1.5.5.7.3.1, id-kp-serverAuth */
- EKU_CLIENT_AUTH_OID = 72, /* 1.3.6.1.5.5.7.3.2, id-kp-clientAuth */
- EKU_OCSP_SIGN_OID = 79 /* 1.3.6.1.5.5.7.3.9, OCSPSigning */
- };
- enum VerifyType {
- NO_VERIFY = 0,
- VERIFY = 1
- };
- /* Key usage extension bits */
- #define KEYUSE_DIGITAL_SIG 0x0100
- #define KEYUSE_CONTENT_COMMIT 0x0080
- #define KEYUSE_KEY_ENCIPHER 0x0040
- #define KEYUSE_DATA_ENCIPHER 0x0020
- #define KEYUSE_KEY_AGREE 0x0010
- #define KEYUSE_KEY_CERT_SIGN 0x0008
- #define KEYUSE_CRL_SIGN 0x0004
- #define KEYUSE_ENCIPHER_ONLY 0x0002
- #define KEYUSE_DECIPHER_ONLY 0x0001
- #define EXTKEYUSE_ANY 0x08
- #define EXTKEYUSE_OCSP_SIGN 0x04
- #define EXTKEYUSE_CLIENT_AUTH 0x02
- #define EXTKEYUSE_SERVER_AUTH 0x01
- typedef struct DNS_entry DNS_entry;
- struct DNS_entry {
- DNS_entry* next; /* next on DNS list */
- char* name; /* actual DNS name */
- };
- typedef struct Base_entry Base_entry;
- struct Base_entry {
- Base_entry* next; /* next on name base list */
- char* name; /* actual name base */
- int nameSz; /* name length */
- byte type; /* Name base type (DNS or RFC822) */
- };
- struct DecodedName {
- char* fullName;
- int fullNameLen;
- int entryCount;
- int cnIdx;
- int cnLen;
- int snIdx;
- int snLen;
- int cIdx;
- int cLen;
- int lIdx;
- int lLen;
- int stIdx;
- int stLen;
- int oIdx;
- int oLen;
- int ouIdx;
- int ouLen;
- int emailIdx;
- int emailLen;
- int uidIdx;
- int uidLen;
- int serialIdx;
- int serialLen;
- };
- typedef struct DecodedCert DecodedCert;
- typedef struct DecodedName DecodedName;
- typedef struct Signer Signer;
- struct DecodedCert {
- byte* publicKey;
- word32 pubKeySize;
- int pubKeyStored;
- word32 certBegin; /* offset to start of cert */
- word32 sigIndex; /* offset to start of signature */
- word32 sigLength; /* length of signature */
- word32 signatureOID; /* sum of algorithm object id */
- word32 keyOID; /* sum of key algo object id */
- int version; /* cert version, 1 or 3 */
- DNS_entry* altNames; /* alt names list of dns entries */
- #ifndef IGNORE_NAME_CONSTRAINTS
- DNS_entry* altEmailNames; /* alt names list of RFC822 entries */
- Base_entry* permittedNames; /* Permitted name bases */
- Base_entry* excludedNames; /* Excluded name bases */
- #endif /* IGNORE_NAME_CONSTRAINTS */
- byte subjectHash[SHA_SIZE]; /* hash of all Names */
- byte issuerHash[SHA_SIZE]; /* hash of all Names */
- #ifdef HAVE_OCSP
- byte issuerKeyHash[SHA_SIZE]; /* hash of the public Key */
- #endif /* HAVE_OCSP */
- byte* signature; /* not owned, points into raw cert */
- char* subjectCN; /* CommonName */
- int subjectCNLen; /* CommonName Length */
- char subjectCNEnc; /* CommonName Encoding */
- int subjectCNStored; /* have we saved a copy we own */
- char issuer[ASN_NAME_MAX]; /* full name including common name */
- char subject[ASN_NAME_MAX]; /* full name including common name */
- int verify; /* Default to yes, but could be off */
- byte* source; /* byte buffer holder cert, NOT owner */
- word32 srcIdx; /* current offset into buffer */
- word32 maxIdx; /* max offset based on init size */
- void* heap; /* for user memory overrides */
- byte serial[EXTERNAL_SERIAL_SIZE]; /* raw serial number */
- int serialSz; /* raw serial bytes stored */
- byte* extensions; /* not owned, points into raw cert */
- int extensionsSz; /* length of cert extensions */
- word32 extensionsIdx; /* if want to go back and parse later */
- byte* extAuthInfo; /* Authority Information Access URI */
- int extAuthInfoSz; /* length of the URI */
- byte* extCrlInfo; /* CRL Distribution Points */
- int extCrlInfoSz; /* length of the URI */
- byte extSubjKeyId[SHA_SIZE]; /* Subject Key ID */
- byte extSubjKeyIdSet; /* Set when the SKID was read from cert */
- byte extAuthKeyId[SHA_SIZE]; /* Authority Key ID */
- byte extAuthKeyIdSet; /* Set when the AKID was read from cert */
- #ifndef IGNORE_NAME_CONSTRAINTS
- byte extNameConstraintSet;
- #endif /* IGNORE_NAME_CONSTRAINTS */
- byte isCA; /* CA basic constraint true */
- byte extKeyUsageSet;
- word16 extKeyUsage; /* Key usage bitfield */
- byte extExtKeyUsageSet; /* Extended Key Usage */
- byte extExtKeyUsage; /* Extended Key usage bitfield */
- #ifdef OPENSSL_EXTRA
- byte extBasicConstSet;
- byte extBasicConstCrit;
- byte extBasicConstPlSet;
- word32 pathLength; /* CA basic constraint path length, opt */
- byte extSubjAltNameSet;
- byte extSubjAltNameCrit;
- byte extAuthKeyIdCrit;
- #ifndef IGNORE_NAME_CONSTRAINTS
- byte extNameConstraintCrit;
- #endif /* IGNORE_NAME_CONSTRAINTS */
- byte extSubjKeyIdCrit;
- byte extKeyUsageCrit;
- byte extExtKeyUsageCrit;
- byte* extExtKeyUsageSrc;
- word32 extExtKeyUsageSz;
- word32 extExtKeyUsageCount;
- byte* extAuthKeyIdSrc;
- word32 extAuthKeyIdSz;
- byte* extSubjKeyIdSrc;
- word32 extSubjKeyIdSz;
- #endif
- #ifdef HAVE_ECC
- word32 pkCurveOID; /* Public Key's curve OID */
- #endif /* HAVE_ECC */
- byte* beforeDate;
- int beforeDateLen;
- byte* afterDate;
- int afterDateLen;
- #ifdef HAVE_PKCS7
- byte* issuerRaw; /* pointer to issuer inside source */
- int issuerRawLen;
- #endif
- #ifndef IGNORE_NAME_CONSTRAINT
- byte* subjectRaw; /* pointer to subject inside source */
- int subjectRawLen;
- #endif
- #if defined(CYASSL_CERT_GEN)
- /* easy access to subject info for other sign */
- char* subjectSN;
- int subjectSNLen;
- char subjectSNEnc;
- char* subjectC;
- int subjectCLen;
- char subjectCEnc;
- char* subjectL;
- int subjectLLen;
- char subjectLEnc;
- char* subjectST;
- int subjectSTLen;
- char subjectSTEnc;
- char* subjectO;
- int subjectOLen;
- char subjectOEnc;
- char* subjectOU;
- int subjectOULen;
- char subjectOUEnc;
- char* subjectEmail;
- int subjectEmailLen;
- #endif /* CYASSL_CERT_GEN */
- #ifdef OPENSSL_EXTRA
- DecodedName issuerName;
- DecodedName subjectName;
- #endif /* OPENSSL_EXTRA */
- #ifdef CYASSL_SEP
- int deviceTypeSz;
- byte* deviceType;
- int hwTypeSz;
- byte* hwType;
- int hwSerialNumSz;
- byte* hwSerialNum;
- #ifdef OPENSSL_EXTRA
- byte extCertPolicySet;
- byte extCertPolicyCrit;
- #endif /* OPENSSL_EXTRA */
- #endif /* CYASSL_SEP */
- };
- #ifdef SHA_DIGEST_SIZE
- #define SIGNER_DIGEST_SIZE SHA_DIGEST_SIZE
- #else
- #define SIGNER_DIGEST_SIZE 20
- #endif
- /* CA Signers */
- /* if change layout change PERSIST_CERT_CACHE functions too */
- struct Signer {
- word32 pubKeySize;
- word32 keyOID; /* key type */
- word16 keyUsage;
- byte* publicKey;
- int nameLen;
- char* name; /* common name */
- #ifndef IGNORE_NAME_CONSTRAINTS
- Base_entry* permittedNames;
- Base_entry* excludedNames;
- #endif /* IGNORE_NAME_CONSTRAINTS */
- byte subjectNameHash[SIGNER_DIGEST_SIZE];
- /* sha hash of names in certificate */
- #ifndef NO_SKID
- byte subjectKeyIdHash[SIGNER_DIGEST_SIZE];
- /* sha hash of names in certificate */
- #endif
- Signer* next;
- };
- /* not for public consumption but may use for testing sometimes */
- #ifdef CYASSL_TEST_CERT
- #define CYASSL_TEST_API CYASSL_API
- #else
- #define CYASSL_TEST_API CYASSL_LOCAL
- #endif
- CYASSL_TEST_API void FreeAltNames(DNS_entry*, void*);
- #ifndef IGNORE_NAME_CONSTRAINTS
- CYASSL_TEST_API void FreeNameSubtrees(Base_entry*, void*);
- #endif /* IGNORE_NAME_CONSTRAINTS */
- CYASSL_TEST_API void InitDecodedCert(DecodedCert*, byte*, word32, void*);
- CYASSL_TEST_API void FreeDecodedCert(DecodedCert*);
- CYASSL_TEST_API int ParseCert(DecodedCert*, int type, int verify, void* cm);
- CYASSL_LOCAL int ParseCertRelative(DecodedCert*, int type, int verify,void* cm);
- CYASSL_LOCAL int DecodeToKey(DecodedCert*, int verify);
- CYASSL_LOCAL Signer* MakeSigner(void*);
- CYASSL_LOCAL void FreeSigner(Signer*, void*);
- CYASSL_LOCAL void FreeSignerTable(Signer**, int, void*);
- CYASSL_LOCAL int ToTraditional(byte* buffer, word32 length);
- CYASSL_LOCAL int ToTraditionalEnc(byte* buffer, word32 length,const char*, int);
- CYASSL_LOCAL int ValidateDate(const byte* date, byte format, int dateType);
- /* ASN.1 helper functions */
- CYASSL_LOCAL int GetLength(const byte* input, word32* inOutIdx, int* len,
- word32 maxIdx);
- CYASSL_LOCAL int GetSequence(const byte* input, word32* inOutIdx, int* len,
- word32 maxIdx);
- CYASSL_LOCAL int GetSet(const byte* input, word32* inOutIdx, int* len,
- word32 maxIdx);
- CYASSL_LOCAL int GetMyVersion(const byte* input, word32* inOutIdx,
- int* version);
- CYASSL_LOCAL int GetInt(mp_int* mpi, const byte* input, word32* inOutIdx,
- word32 maxIdx);
- CYASSL_LOCAL int GetAlgoId(const byte* input, word32* inOutIdx, word32* oid,
- word32 maxIdx);
- CYASSL_LOCAL word32 SetLength(word32 length, byte* output);
- CYASSL_LOCAL word32 SetSequence(word32 len, byte* output);
- CYASSL_LOCAL word32 SetOctetString(word32 len, byte* output);
- CYASSL_LOCAL word32 SetImplicit(byte tag, byte number, word32 len,byte* output);
- CYASSL_LOCAL word32 SetExplicit(byte number, word32 len, byte* output);
- CYASSL_LOCAL word32 SetSet(word32 len, byte* output);
- CYASSL_LOCAL word32 SetAlgoID(int algoOID, byte* output, int type, int curveSz);
- CYASSL_LOCAL int SetMyVersion(word32 version, byte* output, int header);
- CYASSL_LOCAL int SetSerialNumber(const byte* sn, word32 snSz, byte* output);
- CYASSL_LOCAL int GetNameHash(const byte* source, word32* idx, byte* hash,
- int maxIdx);
- #ifdef HAVE_ECC
- /* ASN sig helpers */
- CYASSL_LOCAL int StoreECC_DSA_Sig(byte* out, word32* outLen, mp_int* r,
- mp_int* s);
- CYASSL_LOCAL int DecodeECC_DSA_Sig(const byte* sig, word32 sigLen,
- mp_int* r, mp_int* s);
- #endif
- #ifdef CYASSL_CERT_GEN
- enum cert_enums {
- NAME_ENTRIES = 8,
- JOINT_LEN = 2,
- EMAIL_JOINT_LEN = 9,
- RSA_KEY = 10,
- NTRU_KEY = 11,
- ECC_KEY = 12
- };
- #ifndef CYASSL_PEMCERT_TODER_DEFINED
- #ifndef NO_FILESYSTEM
- /* forward from CyaSSL */
- CYASSL_API
- int CyaSSL_PemCertToDer(const char* fileName, unsigned char* derBuf, int derSz);
- #define CYASSL_PEMCERT_TODER_DEFINED
- #endif
- #endif
- #endif /* CYASSL_CERT_GEN */
- /* for pointer use */
- typedef struct CertStatus CertStatus;
- #ifdef HAVE_OCSP
- enum Ocsp_Response_Status {
- OCSP_SUCCESSFUL = 0, /* Response has valid confirmations */
- OCSP_MALFORMED_REQUEST = 1, /* Illegal confirmation request */
- OCSP_INTERNAL_ERROR = 2, /* Internal error in issuer */
- OCSP_TRY_LATER = 3, /* Try again later */
- OCSP_SIG_REQUIRED = 5, /* Must sign the request (4 is skipped) */
- OCSP_UNAUTHROIZED = 6 /* Request unauthorized */
- };
- enum Ocsp_Cert_Status {
- CERT_GOOD = 0,
- CERT_REVOKED = 1,
- CERT_UNKNOWN = 2
- };
- enum Ocsp_Sums {
- OCSP_BASIC_OID = 117,
- OCSP_NONCE_OID = 118
- };
- typedef struct OcspRequest OcspRequest;
- typedef struct OcspResponse OcspResponse;
- struct CertStatus {
- CertStatus* next;
- byte serial[EXTERNAL_SERIAL_SIZE];
- int serialSz;
- int status;
- byte thisDate[MAX_DATE_SIZE];
- byte nextDate[MAX_DATE_SIZE];
- byte thisDateFormat;
- byte nextDateFormat;
- };
- struct OcspResponse {
- int responseStatus; /* return code from Responder */
- byte* response; /* Pointer to beginning of OCSP Response */
- word32 responseSz; /* length of the OCSP Response */
- byte producedDate[MAX_DATE_SIZE];
- /* Date at which this response was signed */
- byte producedDateFormat; /* format of the producedDate */
- byte* issuerHash;
- byte* issuerKeyHash;
- byte* cert;
- word32 certSz;
- byte* sig; /* Pointer to sig in source */
- word32 sigSz; /* Length in octets for the sig */
- word32 sigOID; /* OID for hash used for sig */
- CertStatus* status; /* certificate status to fill out */
- byte* nonce; /* pointer to nonce inside ASN.1 response */
- int nonceSz; /* length of the nonce string */
- byte* source; /* pointer to source buffer, not owned */
- word32 maxIdx; /* max offset based on init size */
- };
- struct OcspRequest {
- DecodedCert* cert;
- byte useNonce;
- byte nonce[MAX_OCSP_NONCE_SZ];
- int nonceSz;
- byte* issuerHash; /* pointer to issuerHash in source cert */
- byte* issuerKeyHash; /* pointer to issuerKeyHash in source cert */
- byte* serial; /* pointer to serial number in source cert */
- int serialSz; /* length of the serial number */
- byte* dest; /* pointer to the destination ASN.1 buffer */
- word32 destSz; /* length of the destination buffer */
- };
- CYASSL_LOCAL void InitOcspResponse(OcspResponse*, CertStatus*, byte*, word32);
- CYASSL_LOCAL int OcspResponseDecode(OcspResponse*);
- CYASSL_LOCAL void InitOcspRequest(OcspRequest*, DecodedCert*,
- byte, byte*, word32);
- CYASSL_LOCAL int EncodeOcspRequest(OcspRequest*);
- CYASSL_LOCAL int CompareOcspReqResp(OcspRequest*, OcspResponse*);
- #endif /* HAVE_OCSP */
- /* for pointer use */
- typedef struct RevokedCert RevokedCert;
- #ifdef HAVE_CRL
- struct RevokedCert {
- byte serialNumber[EXTERNAL_SERIAL_SIZE];
- int serialSz;
- RevokedCert* next;
- };
- typedef struct DecodedCRL DecodedCRL;
- struct DecodedCRL {
- word32 certBegin; /* offset to start of cert */
- word32 sigIndex; /* offset to start of signature */
- word32 sigLength; /* length of signature */
- word32 signatureOID; /* sum of algorithm object id */
- byte* signature; /* pointer into raw source, not owned */
- byte issuerHash[SHA_DIGEST_SIZE]; /* issuer hash */
- byte crlHash[SHA_DIGEST_SIZE]; /* raw crl data hash */
- byte lastDate[MAX_DATE_SIZE]; /* last date updated */
- byte nextDate[MAX_DATE_SIZE]; /* next update date */
- byte lastDateFormat; /* format of last date */
- byte nextDateFormat; /* format of next date */
- RevokedCert* certs; /* revoked cert list */
- int totalCerts; /* number on list */
- };
- CYASSL_LOCAL void InitDecodedCRL(DecodedCRL*);
- CYASSL_LOCAL int ParseCRL(DecodedCRL*, const byte* buff, word32 sz, void* cm);
- CYASSL_LOCAL void FreeDecodedCRL(DecodedCRL*);
- #endif /* HAVE_CRL */
- #ifdef __cplusplus
- } /* extern "C" */
- #endif
- #endif /* CTAO_CRYPT_ASN_H */
- #endif /* !NO_ASN */
|