1/*
2 * Copyright (C) 2003-2016 Free Software Foundation, Inc.
3 * Copyright (C) 2015-2016 Red Hat, Inc.
4 *
5 * Author: Nikos Mavrogiannopoulos
6 *
7 * This file is part of GnuTLS.
8 *
9 * The GnuTLS is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU Lesser General Public License
11 * as published by the Free Software Foundation; either version 2.1 of
12 * the License, or (at your option) any later version.
13 *
14 * This library is distributed in the hope that it will be useful, but
15 * WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17 * Lesser General Public License for more details.
18 *
19 * You should have received a copy of the GNU Lesser General Public License
20 * along with this program. If not, see <http://www.gnu.org/licenses/>
21 *
22 */
23
24/* This file contains the types and prototypes for the X.509
25 * certificate and CRL handling functions.
26 */
27
28#ifndef GNUTLS_X509_H
29#define GNUTLS_X509_H
30
31#include <gnutls/gnutls.h>
32
33/* *INDENT-OFF* */
34#ifdef __cplusplus
35extern "C" {
36#endif
37/* *INDENT-ON* */
38
39/* Some OIDs usually found in Distinguished names, or
40 * in Subject Directory Attribute extensions.
41 */
42#define GNUTLS_OID_X520_COUNTRY_NAME "2.5.4.6"
43#define GNUTLS_OID_X520_ORGANIZATION_NAME "2.5.4.10"
44#define GNUTLS_OID_X520_ORGANIZATIONAL_UNIT_NAME "2.5.4.11"
45#define GNUTLS_OID_X520_COMMON_NAME "2.5.4.3"
46#define GNUTLS_OID_X520_LOCALITY_NAME "2.5.4.7"
47#define GNUTLS_OID_X520_STATE_OR_PROVINCE_NAME "2.5.4.8"
48
49#define GNUTLS_OID_X520_INITIALS "2.5.4.43"
50#define GNUTLS_OID_X520_GENERATION_QUALIFIER "2.5.4.44"
51#define GNUTLS_OID_X520_SURNAME "2.5.4.4"
52#define GNUTLS_OID_X520_GIVEN_NAME "2.5.4.42"
53#define GNUTLS_OID_X520_TITLE "2.5.4.12"
54#define GNUTLS_OID_X520_DN_QUALIFIER "2.5.4.46"
55#define GNUTLS_OID_X520_PSEUDONYM "2.5.4.65"
56#define GNUTLS_OID_X520_POSTALCODE "2.5.4.17"
57#define GNUTLS_OID_X520_NAME "2.5.4.41"
58
59#define GNUTLS_OID_LDAP_DC "0.9.2342.19200300.100.1.25"
60#define GNUTLS_OID_LDAP_UID "0.9.2342.19200300.100.1.1"
61
62/* The following should not be included in DN.
63 */
64#define GNUTLS_OID_PKCS9_EMAIL "1.2.840.113549.1.9.1"
65
66#define GNUTLS_OID_PKIX_DATE_OF_BIRTH "1.3.6.1.5.5.7.9.1"
67#define GNUTLS_OID_PKIX_PLACE_OF_BIRTH "1.3.6.1.5.5.7.9.2"
68#define GNUTLS_OID_PKIX_GENDER "1.3.6.1.5.5.7.9.3"
69#define GNUTLS_OID_PKIX_COUNTRY_OF_CITIZENSHIP "1.3.6.1.5.5.7.9.4"
70#define GNUTLS_OID_PKIX_COUNTRY_OF_RESIDENCE "1.3.6.1.5.5.7.9.5"
71
72/* Key purpose Object Identifiers.
73 */
74#define GNUTLS_KP_TLS_WWW_SERVER "1.3.6.1.5.5.7.3.1"
75#define GNUTLS_KP_TLS_WWW_CLIENT "1.3.6.1.5.5.7.3.2"
76#define GNUTLS_KP_CODE_SIGNING "1.3.6.1.5.5.7.3.3"
77#define GNUTLS_KP_MS_SMART_CARD_LOGON "1.3.6.1.4.1.311.20.2.2"
78#define GNUTLS_KP_EMAIL_PROTECTION "1.3.6.1.5.5.7.3.4"
79#define GNUTLS_KP_TIME_STAMPING "1.3.6.1.5.5.7.3.8"
80#define GNUTLS_KP_OCSP_SIGNING "1.3.6.1.5.5.7.3.9"
81#define GNUTLS_KP_IPSEC_IKE "1.3.6.1.5.5.7.3.17"
82#define GNUTLS_KP_ANY "2.5.29.37.0"
83
84#define GNUTLS_KP_FLAG_DISALLOW_ANY 1
85
86#define GNUTLS_OID_AIA "1.3.6.1.5.5.7.1.1"
87#define GNUTLS_OID_AD_OCSP "1.3.6.1.5.5.7.48.1"
88#define GNUTLS_OID_AD_CAISSUERS "1.3.6.1.5.5.7.48.2"
89
90#define GNUTLS_FSAN_SET 0
91#define GNUTLS_FSAN_APPEND 1
92#define GNUTLS_FSAN_ENCODE_OCTET_STRING (1<<1)
93#define GNUTLS_FSAN_ENCODE_UTF8_STRING (1<<2)
94
95#define GNUTLS_X509EXT_OID_SUBJECT_KEY_ID "2.5.29.14"
96#define GNUTLS_X509EXT_OID_KEY_USAGE "2.5.29.15"
97#define GNUTLS_X509EXT_OID_PRIVATE_KEY_USAGE_PERIOD "2.5.29.16"
98#define GNUTLS_X509EXT_OID_SAN "2.5.29.17"
99#define GNUTLS_X509EXT_OID_IAN "2.5.29.18"
100#define GNUTLS_X509EXT_OID_BASIC_CONSTRAINTS "2.5.29.19"
101#define GNUTLS_X509EXT_OID_NAME_CONSTRAINTS "2.5.29.30"
102#define GNUTLS_X509EXT_OID_CRL_DIST_POINTS "2.5.29.31"
103#define GNUTLS_X509EXT_OID_CRT_POLICY "2.5.29.32"
104#define GNUTLS_X509EXT_OID_AUTHORITY_KEY_ID "2.5.29.35"
105#define GNUTLS_X509EXT_OID_EXTENDED_KEY_USAGE "2.5.29.37"
106#define GNUTLS_X509EXT_OID_AUTHORITY_INFO_ACCESS "1.3.6.1.5.5.7.1.1"
107#define GNUTLS_X509EXT_OID_PROXY_CRT_INFO "1.3.6.1.5.5.7.1.14"
108#define GNUTLS_X509EXT_OID_TLSFEATURES "1.3.6.1.5.5.7.1.24"
109
110/* Certificate handling functions.
111 */
112
113/**
114 * gnutls_certificate_import_flags:
115 * @GNUTLS_X509_CRT_LIST_IMPORT_FAIL_IF_EXCEED: Fail if the
116 * certificates in the buffer are more than the space allocated for
117 * certificates. The error code will be %GNUTLS_E_SHORT_MEMORY_BUFFER.
118 * @GNUTLS_X509_CRT_LIST_FAIL_IF_UNSORTED: Fail if the certificates
119 * in the buffer are not ordered starting from subject to issuer.
120 * The error code will be %GNUTLS_E_CERTIFICATE_LIST_UNSORTED.
121 * @GNUTLS_X509_CRT_LIST_SORT: Sort the certificate chain if unsorted.
122 *
123 * Enumeration of different certificate import flags.
124 */
125typedef enum gnutls_certificate_import_flags {
126 GNUTLS_X509_CRT_LIST_IMPORT_FAIL_IF_EXCEED = 1,
127 GNUTLS_X509_CRT_LIST_FAIL_IF_UNSORTED = 1<<1,
128 GNUTLS_X509_CRT_LIST_SORT = 1<<2
129} gnutls_certificate_import_flags;
130
131int gnutls_x509_crt_init(gnutls_x509_crt_t * cert);
132void gnutls_x509_crt_deinit(gnutls_x509_crt_t cert);
133
134unsigned gnutls_x509_crt_equals(gnutls_x509_crt_t cert1, gnutls_x509_crt_t cert2);
135unsigned gnutls_x509_crt_equals2(gnutls_x509_crt_t cert1, gnutls_datum_t * der);
136
137int gnutls_x509_crt_import(gnutls_x509_crt_t cert,
138 const gnutls_datum_t * data,
139 gnutls_x509_crt_fmt_t format);
140int gnutls_x509_crt_list_import2(gnutls_x509_crt_t ** certs,
141 unsigned int *size,
142 const gnutls_datum_t * data,
143 gnutls_x509_crt_fmt_t format,
144 unsigned int flags);
145int gnutls_x509_crt_list_import(gnutls_x509_crt_t * certs,
146 unsigned int *cert_max,
147 const gnutls_datum_t * data,
148 gnutls_x509_crt_fmt_t format,
149 unsigned int flags);
150
151int gnutls_x509_crt_import_url(gnutls_x509_crt_t crt,
152 const char *url, unsigned int flags
153 /* GNUTLS_PKCS11_OBJ_FLAG_* */
154 );
155
156int gnutls_x509_crt_export(gnutls_x509_crt_t cert,
157 gnutls_x509_crt_fmt_t format,
158 void *output_data, size_t * output_data_size);
159int gnutls_x509_crt_export2(gnutls_x509_crt_t cert,
160 gnutls_x509_crt_fmt_t format,
161 gnutls_datum_t * out);
162int gnutls_x509_crt_get_private_key_usage_period(gnutls_x509_crt_t
163 cert,
164 time_t *
165 activation,
166 time_t *
167 expiration, unsigned int
168 *critical);
169
170int gnutls_x509_crt_get_issuer_dn(gnutls_x509_crt_t cert,
171 char *buf, size_t * buf_size);
172int gnutls_x509_crt_get_issuer_dn2(gnutls_x509_crt_t cert,
173 gnutls_datum_t * dn);
174int gnutls_x509_crt_get_issuer_dn3(gnutls_x509_crt_t cert,
175 gnutls_datum_t * dn, unsigned flags);
176int gnutls_x509_crt_get_issuer_dn_oid(gnutls_x509_crt_t cert,
177 unsigned indx, void *oid,
178 size_t * oid_size);
179int gnutls_x509_crt_get_issuer_dn_by_oid(gnutls_x509_crt_t cert,
180 const char *oid, unsigned indx,
181 unsigned int raw_flag,
182 void *buf, size_t * buf_size);
183
184int gnutls_x509_crt_get_dn(gnutls_x509_crt_t cert, char *buf,
185 size_t * buf_size);
186int gnutls_x509_crt_get_dn2(gnutls_x509_crt_t cert, gnutls_datum_t * dn);
187int gnutls_x509_crt_get_dn3(gnutls_x509_crt_t cert, gnutls_datum_t * dn, unsigned flags);
188
189int gnutls_x509_crt_get_dn_oid(gnutls_x509_crt_t cert, unsigned indx,
190 void *oid, size_t * oid_size);
191int gnutls_x509_crt_get_dn_by_oid(gnutls_x509_crt_t cert,
192 const char *oid, unsigned indx,
193 unsigned int raw_flag, void *buf,
194 size_t * buf_size);
195unsigned gnutls_x509_crt_check_hostname(gnutls_x509_crt_t cert,
196 const char *hostname);
197unsigned gnutls_x509_crt_check_hostname2(gnutls_x509_crt_t cert,
198 const char *hostname, unsigned int flags);
199unsigned
200gnutls_x509_crt_check_email(gnutls_x509_crt_t cert,
201 const char *email, unsigned int flags);
202
203int gnutls_x509_crt_get_signature_algorithm(gnutls_x509_crt_t cert);
204int gnutls_x509_crt_get_signature(gnutls_x509_crt_t cert,
205 char *sig, size_t * sizeof_sig);
206int gnutls_x509_crt_get_version(gnutls_x509_crt_t cert);
207
208int gnutls_x509_crt_get_pk_oid(gnutls_x509_crt_t cert, char *oid, size_t *oid_size);
209int gnutls_x509_crt_get_signature_oid(gnutls_x509_crt_t cert, char *oid, size_t *oid_size);
210
211/**
212 * gnutls_keyid_flags_t:
213 * @GNUTLS_KEYID_USE_SHA1: Use SHA1 as the key ID algorithm (default).
214 * @GNUTLS_KEYID_USE_SHA256: Use SHA256 as the key ID algorithm.
215 * @GNUTLS_KEYID_USE_BEST_KNOWN: Use the best known algorithm to calculate key ID. Using that option will make your program behavior depend on the version of gnutls linked with. That option has a cap of 64-bytes key IDs.
216 *
217 * Enumeration of different flags for the key ID functions.
218
219 */
220typedef enum {
221 GNUTLS_KEYID_USE_SHA1 = 0,
222 GNUTLS_KEYID_USE_SHA256 = (1<<0),
223 GNUTLS_KEYID_USE_BEST_KNOWN = (1<<30)
224} gnutls_keyid_flags_t;
225int gnutls_x509_crt_get_key_id(gnutls_x509_crt_t crt,
226 unsigned int flags,
227 unsigned char *output_data,
228 size_t * output_data_size);
229
230int gnutls_x509_crt_set_private_key_usage_period(gnutls_x509_crt_t
231 crt,
232 time_t activation,
233 time_t expiration);
234int gnutls_x509_crt_set_authority_key_id(gnutls_x509_crt_t cert,
235 const void *id, size_t id_size);
236int gnutls_x509_crt_get_authority_key_id(gnutls_x509_crt_t cert,
237 void *id,
238 size_t * id_size,
239 unsigned int *critical);
240int gnutls_x509_crt_get_authority_key_gn_serial(gnutls_x509_crt_t
241 cert,
242 unsigned int seq,
243 void *alt,
244 size_t * alt_size,
245 unsigned int
246 *alt_type,
247 void *serial,
248 size_t *
249 serial_size, unsigned int
250 *critical);
251
252int gnutls_x509_crt_get_subject_key_id(gnutls_x509_crt_t cert,
253 void *ret,
254 size_t * ret_size,
255 unsigned int *critical);
256
257int gnutls_x509_crt_get_subject_unique_id(gnutls_x509_crt_t crt,
258 char *buf, size_t * buf_size);
259
260int gnutls_x509_crt_get_issuer_unique_id(gnutls_x509_crt_t crt,
261 char *buf, size_t * buf_size);
262
263void gnutls_x509_crt_set_pin_function(gnutls_x509_crt_t crt,
264 gnutls_pin_callback_t fn,
265 void *userdata);
266
267 /**
268 * gnutls_info_access_what_t:
269 * @GNUTLS_IA_ACCESSMETHOD_OID: Get accessMethod OID.
270 * @GNUTLS_IA_ACCESSLOCATION_GENERALNAME_TYPE: Get accessLocation name type.
271 * @GNUTLS_IA_URI: Get accessLocation URI value.
272 * @GNUTLS_IA_OCSP_URI: get accessLocation URI value for OCSP.
273 * @GNUTLS_IA_CAISSUERS_URI: get accessLocation URI value for caIssuers.
274 *
275 * Enumeration of types for the @what parameter of
276 * gnutls_x509_crt_get_authority_info_access().
277 */
278typedef enum gnutls_info_access_what_t {
279 GNUTLS_IA_ACCESSMETHOD_OID = 1,
280 GNUTLS_IA_ACCESSLOCATION_GENERALNAME_TYPE = 2,
281 /* use 100-108 for the generalName types, populate as needed */
282 GNUTLS_IA_URI = 106,
283 /* quick-access variants that match both OID and name type. */
284 GNUTLS_IA_UNKNOWN = 10000,
285 GNUTLS_IA_OCSP_URI = 10006,
286 GNUTLS_IA_CAISSUERS_URI = 10106
287} gnutls_info_access_what_t;
288
289int gnutls_x509_crt_get_authority_info_access(gnutls_x509_crt_t
290 crt,
291 unsigned int seq,
292 int what,
293 gnutls_datum_t *
294 data, unsigned int
295 *critical);
296
297typedef struct gnutls_name_constraints_st *gnutls_x509_name_constraints_t;
298
299unsigned gnutls_x509_name_constraints_check(gnutls_x509_name_constraints_t nc,
300 gnutls_x509_subject_alt_name_t type,
301 const gnutls_datum_t * name);
302unsigned gnutls_x509_name_constraints_check_crt(gnutls_x509_name_constraints_t nc,
303 gnutls_x509_subject_alt_name_t type,
304 gnutls_x509_crt_t crt);
305
306int gnutls_x509_name_constraints_init(gnutls_x509_name_constraints_t *nc);
307void gnutls_x509_name_constraints_deinit(gnutls_x509_name_constraints_t nc);
308
309#define GNUTLS_EXT_FLAG_APPEND 1
310
311#define GNUTLS_NAME_CONSTRAINTS_FLAG_APPEND GNUTLS_EXT_FLAG_APPEND
312int gnutls_x509_crt_get_name_constraints(gnutls_x509_crt_t crt,
313 gnutls_x509_name_constraints_t nc,
314 unsigned int flags,
315 unsigned int *critical);
316int gnutls_x509_name_constraints_add_permitted(gnutls_x509_name_constraints_t nc,
317 gnutls_x509_subject_alt_name_t type,
318 const gnutls_datum_t * name);
319int gnutls_x509_name_constraints_add_excluded(gnutls_x509_name_constraints_t nc,
320 gnutls_x509_subject_alt_name_t type,
321 const gnutls_datum_t * name);
322int gnutls_x509_crt_set_name_constraints(gnutls_x509_crt_t crt,
323 gnutls_x509_name_constraints_t nc,
324 unsigned int critical);
325int gnutls_x509_name_constraints_get_permitted(gnutls_x509_name_constraints_t nc,
326 unsigned idx,
327 unsigned *type, gnutls_datum_t * name);
328int gnutls_x509_name_constraints_get_excluded(gnutls_x509_name_constraints_t nc,
329 unsigned idx,
330 unsigned *type, gnutls_datum_t * name);
331int gnutls_x509_cidr_to_rfc5280(const char *cidr, gnutls_datum_t *cidr_rfc5280);
332
333
334#define GNUTLS_CRL_REASON_SUPERSEEDED GNUTLS_CRL_REASON_SUPERSEDED,
335 /**
336 * gnutls_x509_crl_reason_flags_t:
337 * @GNUTLS_CRL_REASON_PRIVILEGE_WITHDRAWN: The privileges were withdrawn from the owner.
338 * @GNUTLS_CRL_REASON_CERTIFICATE_HOLD: The certificate is on hold.
339 * @GNUTLS_CRL_REASON_CESSATION_OF_OPERATION: The end-entity is no longer operating.
340 * @GNUTLS_CRL_REASON_SUPERSEDED: There is a newer certificate of the owner.
341 * @GNUTLS_CRL_REASON_AFFILIATION_CHANGED: The end-entity affiliation has changed.
342 * @GNUTLS_CRL_REASON_CA_COMPROMISE: The CA was compromised.
343 * @GNUTLS_CRL_REASON_KEY_COMPROMISE: The certificate's key was compromised.
344 * @GNUTLS_CRL_REASON_UNUSED: The key was never used.
345 * @GNUTLS_CRL_REASON_AA_COMPROMISE: AA compromised.
346 *
347 * Enumeration of types for the CRL revocation reasons.
348 */
349typedef enum gnutls_x509_crl_reason_flags_t {
350 GNUTLS_CRL_REASON_UNSPECIFIED = 0,
351 GNUTLS_CRL_REASON_PRIVILEGE_WITHDRAWN = 1,
352 GNUTLS_CRL_REASON_CERTIFICATE_HOLD = 2,
353 GNUTLS_CRL_REASON_CESSATION_OF_OPERATION = 4,
354 GNUTLS_CRL_REASON_SUPERSEDED = 8,
355 GNUTLS_CRL_REASON_AFFILIATION_CHANGED = 16,
356 GNUTLS_CRL_REASON_CA_COMPROMISE = 32,
357 GNUTLS_CRL_REASON_KEY_COMPROMISE = 64,
358 GNUTLS_CRL_REASON_UNUSED = 128,
359 GNUTLS_CRL_REASON_AA_COMPROMISE = 32768
360} gnutls_x509_crl_reason_flags_t;
361
362int gnutls_x509_crt_get_crl_dist_points(gnutls_x509_crt_t cert,
363 unsigned int seq,
364 void *ret,
365 size_t * ret_size,
366 unsigned int *reason_flags,
367 unsigned int *critical);
368int gnutls_x509_crt_set_crl_dist_points2(gnutls_x509_crt_t crt,
369 gnutls_x509_subject_alt_name_t
370 type, const void *data,
371 unsigned int data_size,
372 unsigned int reason_flags);
373int gnutls_x509_crt_set_crl_dist_points(gnutls_x509_crt_t crt,
374 gnutls_x509_subject_alt_name_t
375 type,
376 const void *data_string,
377 unsigned int reason_flags);
378int gnutls_x509_crt_cpy_crl_dist_points(gnutls_x509_crt_t dst,
379 gnutls_x509_crt_t src);
380
381int gnutls_x509_crl_sign2(gnutls_x509_crl_t crl,
382 gnutls_x509_crt_t issuer,
383 gnutls_x509_privkey_t issuer_key,
384 gnutls_digest_algorithm_t dig,
385 unsigned int flags);
386
387time_t gnutls_x509_crt_get_activation_time(gnutls_x509_crt_t cert);
388
389#define GNUTLS_X509_NO_WELL_DEFINED_EXPIRATION ((time_t)4294197631)
390
391time_t gnutls_x509_crt_get_expiration_time(gnutls_x509_crt_t cert);
392int gnutls_x509_crt_get_serial(gnutls_x509_crt_t cert,
393 void *result, size_t * result_size);
394
395int gnutls_x509_crt_get_pk_algorithm(gnutls_x509_crt_t cert,
396 unsigned int *bits);
397int gnutls_x509_crt_get_pk_rsa_raw(gnutls_x509_crt_t crt,
398 gnutls_datum_t * m, gnutls_datum_t * e);
399int gnutls_x509_crt_get_pk_dsa_raw(gnutls_x509_crt_t crt,
400 gnutls_datum_t * p,
401 gnutls_datum_t * q,
402 gnutls_datum_t * g, gnutls_datum_t * y);
403int gnutls_x509_crt_get_pk_ecc_raw(gnutls_x509_crt_t crt,
404 gnutls_ecc_curve_t * curve,
405 gnutls_datum_t * x,
406 gnutls_datum_t * y);
407
408int gnutls_x509_crt_get_subject_alt_name(gnutls_x509_crt_t cert,
409 unsigned int seq,
410 void *san,
411 size_t * san_size,
412 unsigned int *critical);
413int gnutls_x509_crt_get_subject_alt_name2(gnutls_x509_crt_t cert,
414 unsigned int seq,
415 void *san,
416 size_t * san_size,
417 unsigned int *san_type,
418 unsigned int *critical);
419
420int gnutls_x509_crt_get_subject_alt_othername_oid(gnutls_x509_crt_t
421 cert,
422 unsigned int seq,
423 void *oid,
424 size_t * oid_size);
425
426int gnutls_x509_crt_get_issuer_alt_name(gnutls_x509_crt_t cert,
427 unsigned int seq,
428 void *ian,
429 size_t * ian_size,
430 unsigned int *critical);
431int gnutls_x509_crt_get_issuer_alt_name2(gnutls_x509_crt_t cert,
432 unsigned int seq,
433 void *ian,
434 size_t * ian_size,
435 unsigned int *ian_type,
436 unsigned int *critical);
437
438int gnutls_x509_crt_get_issuer_alt_othername_oid(gnutls_x509_crt_t
439 cert,
440 unsigned int seq,
441 void *ret,
442 size_t * ret_size);
443
444int gnutls_x509_crt_get_ca_status(gnutls_x509_crt_t cert,
445 unsigned int *critical);
446int gnutls_x509_crt_get_basic_constraints(gnutls_x509_crt_t cert,
447 unsigned int *critical,
448 unsigned int *ca, int *pathlen);
449
450/* The key_usage flags are defined in gnutls.h. They are the
451 * GNUTLS_KEY_* definitions.
452 */
453int gnutls_x509_crt_get_key_usage(gnutls_x509_crt_t cert,
454 unsigned int *key_usage,
455 unsigned int *critical);
456int gnutls_x509_crt_set_key_usage(gnutls_x509_crt_t crt,
457 unsigned int usage);
458int gnutls_x509_crt_set_authority_info_access(gnutls_x509_crt_t
459 crt, int what,
460 gnutls_datum_t * data);
461
462int gnutls_x509_crt_get_proxy(gnutls_x509_crt_t cert,
463 unsigned int *critical,
464 int *pathlen,
465 char **policyLanguage,
466 char **policy, size_t * sizeof_policy);
467
468
469typedef struct gnutls_x509_tlsfeatures_st *gnutls_x509_tlsfeatures_t;
470
471int gnutls_x509_tlsfeatures_init(gnutls_x509_tlsfeatures_t *features);
472void gnutls_x509_tlsfeatures_deinit(gnutls_x509_tlsfeatures_t);
473int gnutls_x509_tlsfeatures_get(gnutls_x509_tlsfeatures_t f, unsigned idx, unsigned int *feature);
474
475int gnutls_x509_crt_set_tlsfeatures(gnutls_x509_crt_t crt,
476 gnutls_x509_tlsfeatures_t features);
477
478int gnutls_x509_crt_get_tlsfeatures(gnutls_x509_crt_t cert,
479 gnutls_x509_tlsfeatures_t features,
480 unsigned int flags,
481 unsigned int *critical);
482
483unsigned gnutls_x509_tlsfeatures_check_crt(gnutls_x509_tlsfeatures_t feat,
484 gnutls_x509_crt_t crt);
485
486
487#define GNUTLS_MAX_QUALIFIERS 8
488
489 /**
490 * gnutls_x509_qualifier_t:
491 * @GNUTLS_X509_QUALIFIER_UNKNOWN: Unknown qualifier.
492 * @GNUTLS_X509_QUALIFIER_URI: A URL
493 * @GNUTLS_X509_QUALIFIER_NOICE: A text notice.
494 *
495 * Enumeration of types for the X.509 qualifiers, of the certificate policy extension.
496 */
497typedef enum gnutls_x509_qualifier_t {
498 GNUTLS_X509_QUALIFIER_UNKNOWN = 0, GNUTLS_X509_QUALIFIER_URI,
499 GNUTLS_X509_QUALIFIER_NOTICE
500} gnutls_x509_qualifier_t;
501
502typedef struct gnutls_x509_policy_st {
503 char *oid;
504 unsigned int qualifiers;
505 struct {
506 gnutls_x509_qualifier_t type;
507 char *data;
508 unsigned int size;
509 } qualifier[GNUTLS_MAX_QUALIFIERS];
510} gnutls_x509_policy_st;
511
512void gnutls_x509_policy_release(struct gnutls_x509_policy_st
513 *policy);
514int gnutls_x509_crt_get_policy(gnutls_x509_crt_t crt, unsigned indx, struct gnutls_x509_policy_st
515 *policy, unsigned int *critical);
516int gnutls_x509_crt_set_policy(gnutls_x509_crt_t crt, const struct gnutls_x509_policy_st
517 *policy, unsigned int critical);
518
519int gnutls_x509_dn_oid_known(const char *oid);
520
521#define GNUTLS_X509_DN_OID_RETURN_OID 1
522const char *gnutls_x509_dn_oid_name(const char *oid, unsigned int flags);
523
524 /* Read extensions by OID. */
525int gnutls_x509_crt_get_extension_oid(gnutls_x509_crt_t cert,
526 unsigned indx, void *oid,
527 size_t * oid_size);
528int gnutls_x509_crt_get_extension_by_oid(gnutls_x509_crt_t cert,
529 const char *oid, unsigned indx,
530 void *buf,
531 size_t * buf_size,
532 unsigned int *critical);
533
534int gnutls_x509_crq_get_signature_algorithm(gnutls_x509_crq_t crq);
535int
536gnutls_x509_crq_get_extension_by_oid2(gnutls_x509_crq_t crq,
537 const char *oid, unsigned indx,
538 gnutls_datum_t *output,
539 unsigned int *critical);
540
541 /* Read extensions by sequence number. */
542int gnutls_x509_crt_get_extension_info(gnutls_x509_crt_t cert,
543 unsigned indx, void *oid,
544 size_t * oid_size,
545 unsigned int *critical);
546int gnutls_x509_crt_get_extension_data(gnutls_x509_crt_t cert,
547 unsigned indx, void *data,
548 size_t * sizeof_data);
549int
550gnutls_x509_crt_get_extension_data2(gnutls_x509_crt_t cert,
551 unsigned indx, gnutls_datum_t * data);
552
553
554int gnutls_x509_crt_set_extension_by_oid(gnutls_x509_crt_t crt,
555 const char *oid,
556 const void *buf,
557 size_t sizeof_buf,
558 unsigned int critical);
559
560/* X.509 Certificate writing.
561 */
562int gnutls_x509_crt_set_dn(gnutls_x509_crt_t crt, const char *dn,
563 const char **err);
564
565int gnutls_x509_crt_set_dn_by_oid(gnutls_x509_crt_t crt,
566 const char *oid,
567 unsigned int raw_flag,
568 const void *name,
569 unsigned int sizeof_name);
570int gnutls_x509_crt_set_issuer_dn_by_oid(gnutls_x509_crt_t crt,
571 const char *oid,
572 unsigned int raw_flag,
573 const void *name,
574 unsigned int sizeof_name);
575int gnutls_x509_crt_set_issuer_dn(gnutls_x509_crt_t crt,
576 const char *dn, const char **err);
577
578int gnutls_x509_crt_set_version(gnutls_x509_crt_t crt,
579 unsigned int version);
580int gnutls_x509_crt_set_key(gnutls_x509_crt_t crt,
581 gnutls_x509_privkey_t key);
582int gnutls_x509_crt_set_ca_status(gnutls_x509_crt_t crt, unsigned int ca);
583int gnutls_x509_crt_set_basic_constraints(gnutls_x509_crt_t crt,
584 unsigned int ca,
585 int pathLenConstraint);
586
587int
588gnutls_x509_crt_set_subject_unique_id(gnutls_x509_crt_t cert, const void *id,
589 size_t id_size);
590int
591gnutls_x509_crt_set_issuer_unique_id(gnutls_x509_crt_t cert, const void *id,
592 size_t id_size);
593
594int gnutls_x509_crt_set_subject_alternative_name(gnutls_x509_crt_t
595 crt,
596 gnutls_x509_subject_alt_name_t
597 type, const char
598 *data_string);
599int gnutls_x509_crt_set_subject_alt_name(gnutls_x509_crt_t crt,
600 gnutls_x509_subject_alt_name_t
601 type, const void *data,
602 unsigned int data_size,
603 unsigned int flags);
604
605int
606gnutls_x509_crt_set_subject_alt_othername(gnutls_x509_crt_t crt,
607 const char *oid,
608 const void *data,
609 unsigned int data_size,
610 unsigned int flags);
611
612int gnutls_x509_crt_set_issuer_alt_name(gnutls_x509_crt_t crt,
613 gnutls_x509_subject_alt_name_t
614 type, const void *data,
615 unsigned int data_size,
616 unsigned int flags);
617
618int
619gnutls_x509_crt_set_issuer_alt_othername(gnutls_x509_crt_t crt,
620 const char *oid,
621 const void *data,
622 unsigned int data_size,
623 unsigned int flags);
624
625int gnutls_x509_crt_sign(gnutls_x509_crt_t crt,
626 gnutls_x509_crt_t issuer,
627 gnutls_x509_privkey_t issuer_key);
628int gnutls_x509_crt_sign2(gnutls_x509_crt_t crt,
629 gnutls_x509_crt_t issuer,
630 gnutls_x509_privkey_t issuer_key,
631 gnutls_digest_algorithm_t dig,
632 unsigned int flags);
633int gnutls_x509_crt_set_activation_time(gnutls_x509_crt_t cert,
634 time_t act_time);
635int gnutls_x509_crt_set_expiration_time(gnutls_x509_crt_t cert,
636 time_t exp_time);
637int gnutls_x509_crt_set_serial(gnutls_x509_crt_t cert,
638 const void *serial, size_t serial_size);
639
640int gnutls_x509_crt_set_subject_key_id(gnutls_x509_crt_t cert,
641 const void *id, size_t id_size);
642
643int gnutls_x509_crt_set_proxy_dn(gnutls_x509_crt_t crt,
644 gnutls_x509_crt_t eecrt,
645 unsigned int raw_flag,
646 const void *name,
647 unsigned int sizeof_name);
648int gnutls_x509_crt_set_proxy(gnutls_x509_crt_t crt,
649 int pathLenConstraint,
650 const char *policyLanguage,
651 const char *policy, size_t sizeof_policy);
652
653int gnutls_x509_crt_print(gnutls_x509_crt_t cert,
654 gnutls_certificate_print_formats_t
655 format, gnutls_datum_t * out);
656int gnutls_x509_crl_print(gnutls_x509_crl_t crl,
657 gnutls_certificate_print_formats_t
658 format, gnutls_datum_t * out);
659
660 /* Access to internal Certificate fields.
661 */
662int gnutls_x509_crt_get_raw_issuer_dn(gnutls_x509_crt_t cert,
663 gnutls_datum_t * start);
664int gnutls_x509_crt_get_raw_dn(gnutls_x509_crt_t cert,
665 gnutls_datum_t * start);
666
667/* RDN handling.
668 */
669int gnutls_x509_rdn_get(const gnutls_datum_t * idn,
670 char *buf, size_t * sizeof_buf);
671int
672gnutls_x509_rdn_get2(const gnutls_datum_t * idn,
673 gnutls_datum_t *str, unsigned flags);
674
675int gnutls_x509_rdn_get_oid(const gnutls_datum_t * idn,
676 unsigned indx, void *buf, size_t * sizeof_buf);
677
678int gnutls_x509_rdn_get_by_oid(const gnutls_datum_t * idn,
679 const char *oid, unsigned indx,
680 unsigned int raw_flag, void *buf,
681 size_t * sizeof_buf);
682
683typedef struct gnutls_x509_dn_st *gnutls_x509_dn_t;
684
685typedef struct gnutls_x509_ava_st {
686 gnutls_datum_t oid;
687 gnutls_datum_t value;
688 unsigned long value_tag;
689} gnutls_x509_ava_st;
690
691int gnutls_x509_crt_get_subject(gnutls_x509_crt_t cert,
692 gnutls_x509_dn_t * dn);
693int gnutls_x509_crt_get_issuer(gnutls_x509_crt_t cert,
694 gnutls_x509_dn_t * dn);
695int gnutls_x509_dn_get_rdn_ava(gnutls_x509_dn_t dn, int irdn,
696 int iava, gnutls_x509_ava_st * ava);
697
698int gnutls_x509_dn_get_str(gnutls_x509_dn_t dn, gnutls_datum_t *str);
699
700#define GNUTLS_X509_DN_FLAG_COMPAT 1
701int gnutls_x509_dn_get_str2(gnutls_x509_dn_t dn, gnutls_datum_t *str, unsigned flags);
702
703int
704gnutls_x509_dn_set_str(gnutls_x509_dn_t dn, const char *str, const char **err);
705
706int gnutls_x509_dn_init(gnutls_x509_dn_t * dn);
707
708int gnutls_x509_dn_import(gnutls_x509_dn_t dn,
709 const gnutls_datum_t * data);
710
711int gnutls_x509_dn_export(gnutls_x509_dn_t dn,
712 gnutls_x509_crt_fmt_t format,
713 void *output_data, size_t * output_data_size);
714int gnutls_x509_dn_export2(gnutls_x509_dn_t dn,
715 gnutls_x509_crt_fmt_t format,
716 gnutls_datum_t * out);
717
718void gnutls_x509_dn_deinit(gnutls_x509_dn_t dn);
719
720
721/* CRL handling functions.
722 */
723int gnutls_x509_crl_init(gnutls_x509_crl_t * crl);
724void gnutls_x509_crl_deinit(gnutls_x509_crl_t crl);
725
726int gnutls_x509_crl_import(gnutls_x509_crl_t crl,
727 const gnutls_datum_t * data,
728 gnutls_x509_crt_fmt_t format);
729int gnutls_x509_crl_export(gnutls_x509_crl_t crl,
730 gnutls_x509_crt_fmt_t format,
731 void *output_data, size_t * output_data_size);
732int gnutls_x509_crl_export2(gnutls_x509_crl_t crl,
733 gnutls_x509_crt_fmt_t format,
734 gnutls_datum_t * out);
735
736int
737gnutls_x509_crl_get_raw_issuer_dn(gnutls_x509_crl_t crl,
738 gnutls_datum_t * dn);
739
740int gnutls_x509_crl_get_issuer_dn(gnutls_x509_crl_t crl,
741 char *buf, size_t * sizeof_buf);
742int gnutls_x509_crl_get_issuer_dn2(gnutls_x509_crl_t crl,
743 gnutls_datum_t * dn);
744int gnutls_x509_crl_get_issuer_dn3(gnutls_x509_crl_t crl,
745 gnutls_datum_t * dn, unsigned flags);
746
747int gnutls_x509_crl_get_issuer_dn_by_oid(gnutls_x509_crl_t crl,
748 const char *oid, unsigned indx,
749 unsigned int raw_flag,
750 void *buf, size_t * sizeof_buf);
751int gnutls_x509_crl_get_dn_oid(gnutls_x509_crl_t crl, unsigned indx,
752 void *oid, size_t * sizeof_oid);
753
754int gnutls_x509_crl_get_signature_algorithm(gnutls_x509_crl_t crl);
755int gnutls_x509_crl_get_signature(gnutls_x509_crl_t crl,
756 char *sig, size_t * sizeof_sig);
757int gnutls_x509_crl_get_version(gnutls_x509_crl_t crl);
758
759int gnutls_x509_crl_get_signature_oid(gnutls_x509_crl_t crl, char *oid, size_t *oid_size);
760
761time_t gnutls_x509_crl_get_this_update(gnutls_x509_crl_t crl);
762time_t gnutls_x509_crl_get_next_update(gnutls_x509_crl_t crl);
763
764int gnutls_x509_crl_get_crt_count(gnutls_x509_crl_t crl);
765int gnutls_x509_crl_get_crt_serial(gnutls_x509_crl_t crl, unsigned indx,
766 unsigned char *serial,
767 size_t * serial_size, time_t * t);
768
769typedef struct gnutls_x509_crl_iter * gnutls_x509_crl_iter_t;
770
771int gnutls_x509_crl_iter_crt_serial(gnutls_x509_crl_t crl,
772 gnutls_x509_crl_iter_t *,
773 unsigned char *serial,
774 size_t * serial_size, time_t * t);
775
776void gnutls_x509_crl_iter_deinit(gnutls_x509_crl_iter_t);
777
778#define gnutls_x509_crl_get_certificate_count gnutls_x509_crl_get_crt_count
779#define gnutls_x509_crl_get_certificate gnutls_x509_crl_get_crt_serial
780
781unsigned gnutls_x509_crl_check_issuer(gnutls_x509_crl_t crl,
782 gnutls_x509_crt_t issuer);
783
784int gnutls_x509_crl_list_import2(gnutls_x509_crl_t ** crls,
785 unsigned int *size,
786 const gnutls_datum_t * data,
787 gnutls_x509_crt_fmt_t format,
788 unsigned int flags);
789
790int gnutls_x509_crl_list_import(gnutls_x509_crl_t * crls,
791 unsigned int *crl_max,
792 const gnutls_datum_t * data,
793 gnutls_x509_crt_fmt_t format,
794 unsigned int flags);
795/* CRL writing.
796 */
797int gnutls_x509_crl_set_version(gnutls_x509_crl_t crl,
798 unsigned int version);
799int gnutls_x509_crl_set_this_update(gnutls_x509_crl_t crl,
800 time_t act_time);
801int gnutls_x509_crl_set_next_update(gnutls_x509_crl_t crl,
802 time_t exp_time);
803int gnutls_x509_crl_set_crt_serial(gnutls_x509_crl_t crl,
804 const void *serial,
805 size_t serial_size,
806 time_t revocation_time);
807int gnutls_x509_crl_set_crt(gnutls_x509_crl_t crl,
808 gnutls_x509_crt_t crt, time_t revocation_time);
809
810int gnutls_x509_crl_get_authority_key_id(gnutls_x509_crl_t crl,
811 void *id,
812 size_t * id_size,
813 unsigned int *critical);
814int gnutls_x509_crl_get_authority_key_gn_serial(gnutls_x509_crl_t
815 crl,
816 unsigned int seq,
817 void *alt,
818 size_t * alt_size,
819 unsigned int
820 *alt_type,
821 void *serial,
822 size_t *
823 serial_size, unsigned int
824 *critical);
825
826int gnutls_x509_crl_get_number(gnutls_x509_crl_t crl, void *ret,
827 size_t * ret_size, unsigned int *critical);
828
829int gnutls_x509_crl_get_extension_oid(gnutls_x509_crl_t crl,
830 unsigned indx, void *oid,
831 size_t * sizeof_oid);
832
833int gnutls_x509_crl_get_extension_info(gnutls_x509_crl_t crl,
834 unsigned indx, void *oid,
835 size_t * sizeof_oid,
836 unsigned int *critical);
837
838int gnutls_x509_crl_get_extension_data(gnutls_x509_crl_t crl,
839 unsigned indx, void *data,
840 size_t * sizeof_data);
841int
842gnutls_x509_crl_get_extension_data2(gnutls_x509_crl_t crl,
843 unsigned indx, gnutls_datum_t * data);
844
845int gnutls_x509_crl_set_authority_key_id(gnutls_x509_crl_t crl,
846 const void *id, size_t id_size);
847
848int gnutls_x509_crl_set_number(gnutls_x509_crl_t crl,
849 const void *nr, size_t nr_size);
850
851
852/* X.509 Certificate verification functions.
853 */
854
855/**
856 * gnutls_certificate_verify_flags:
857 * @GNUTLS_VERIFY_DISABLE_CA_SIGN: If set a signer does not have to be
858 * a certificate authority. This flag should normally be disabled,
859 * unless you know what this means.
860 * @GNUTLS_VERIFY_DISABLE_TRUSTED_TIME_CHECKS: If set a signer in the trusted
861 * list is never checked for expiration or activation.
862 * @GNUTLS_VERIFY_DO_NOT_ALLOW_X509_V1_CA_CRT: Do not allow trusted CA
863 * certificates that have version 1. This option is to be used
864 * to deprecate all certificates of version 1.
865 * @GNUTLS_VERIFY_DO_NOT_ALLOW_SAME: If a certificate is not signed by
866 * anyone trusted but exists in the trusted CA list do not treat it
867 * as trusted.
868 * @GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN: A certificate chain is tolerated
869 * if unsorted (the case with many TLS servers out there). This is the
870 * default since GnuTLS 3.1.4.
871 * @GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Do not tolerate an unsorted
872 * certificate chain.
873 * @GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT: Allow CA certificates that
874 * have version 1 (both root and intermediate). This might be
875 * dangerous since those haven't the basicConstraints
876 * extension.
877 * @GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD2: Allow certificates to be signed
878 * using the broken MD2 algorithm.
879 * @GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD5: Allow certificates to be signed
880 * using the broken MD5 algorithm.
881 * @GNUTLS_VERIFY_ALLOW_BROKEN: Allow certificates to be signed
882 * using any broken algorithm.
883 * @GNUTLS_VERIFY_DISABLE_TIME_CHECKS: Disable checking of activation
884 * and expiration validity periods of certificate chains. Don't set
885 * this unless you understand the security implications.
886 * @GNUTLS_VERIFY_DISABLE_CRL_CHECKS: Disable checking for validity
887 * using certificate revocation lists or the available OCSP data.
888 * @GNUTLS_VERIFY_DO_NOT_ALLOW_WILDCARDS: When including a hostname
889 * check in the verification, do not consider any wildcards.
890 * @GNUTLS_VERIFY_USE_TLS1_RSA: This indicates that a (raw) RSA signature is provided
891 * as in the TLS 1.0 protocol. Not all functions accept this flag.
892 *
893 * Enumeration of different certificate verify flags. Additional
894 * verification profiles can be set using GNUTLS_PROFILE_TO_VFLAGS()
895 * and %gnutls_certificate_verification_profiles_t.
896 */
897typedef enum gnutls_certificate_verify_flags {
898 GNUTLS_VERIFY_DISABLE_CA_SIGN = 1 << 0,
899 GNUTLS_VERIFY_DO_NOT_ALLOW_SAME = 1 << 2,
900 GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT = 1 << 3,
901 GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD2 = 1 << 4,
902 GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD5 = 1 << 5,
903 GNUTLS_VERIFY_DISABLE_TIME_CHECKS = 1 << 6,
904 GNUTLS_VERIFY_DISABLE_TRUSTED_TIME_CHECKS = 1 << 7,
905 GNUTLS_VERIFY_DO_NOT_ALLOW_X509_V1_CA_CRT = 1 << 8,
906 GNUTLS_VERIFY_DISABLE_CRL_CHECKS = 1 << 9,
907 GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN = 1 << 10,
908 GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN = 1 << 11,
909 GNUTLS_VERIFY_DO_NOT_ALLOW_WILDCARDS = 1 << 12,
910 GNUTLS_VERIFY_USE_TLS1_RSA = 1 << 13
911 /* cannot exceed 2^24 due to GNUTLS_PROFILE_TO_VFLAGS() */
912} gnutls_certificate_verify_flags;
913
914#define GNUTLS_VERIFY_ALLOW_BROKEN (GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD2|GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD5)
915
916/**
917 * gnutls_certificate_verification_profiles_t:
918 * @GNUTLS_PROFILE_VERY_WEAK: A verification profile that
919 * corresponds to @GNUTLS_SEC_PARAM_VERY_WEAK (64 bits)
920 * @GNUTLS_PROFILE_LOW: A verification profile that
921 * corresponds to @GNUTLS_SEC_PARAM_LOW (80 bits)
922 * @GNUTLS_PROFILE_LEGACY: A verification profile that
923 * corresponds to @GNUTLS_SEC_PARAM_LEGACY (96 bits)
924 * @GNUTLS_PROFILE_MEDIUM: A verification profile that
925 * corresponds to @GNUTLS_SEC_PARAM_MEDIUM (112 bits)
926 * @GNUTLS_PROFILE_HIGH: A verification profile that
927 * corresponds to @GNUTLS_SEC_PARAM_HIGH (128 bits)
928 * @GNUTLS_PROFILE_ULTRA: A verification profile that
929 * corresponds to @GNUTLS_SEC_PARAM_ULTRA (256 bits)
930% * @GNUTLS_PROFILE_SUITEB128: A verification profile that
931 * applies the SUITEB128 rules
932 * @GNUTLS_PROFILE_SUITEB192: A verification profile that
933 * applies the SUITEB192 rules
934 *
935 * Enumeration of different certificate verification profiles.
936 */
937typedef enum gnutls_certificate_verification_profiles_t {
938 GNUTLS_PROFILE_VERY_WEAK = 1,
939 GNUTLS_PROFILE_LOW = 2,
940 GNUTLS_PROFILE_LEGACY = 4,
941 GNUTLS_PROFILE_MEDIUM = 5,
942 GNUTLS_PROFILE_HIGH = 6,
943 GNUTLS_PROFILE_ULTRA = 7,
944
945 GNUTLS_PROFILE_SUITEB128=32,
946 GNUTLS_PROFILE_SUITEB192=33
947 /*GNUTLS_PROFILE_MAX=255*/
948} gnutls_certificate_verification_profiles_t;
949
950#define GNUTLS_PROFILE_TO_VFLAGS(x) \
951 (((unsigned)x)<<24)
952
953#define GNUTLS_VFLAGS_PROFILE_MASK (0xff000000)
954
955#define GNUTLS_VFLAGS_TO_PROFILE(x) \
956 ((((unsigned)x)>>24)&0xff)
957
958
959unsigned gnutls_x509_crt_check_issuer(gnutls_x509_crt_t cert,
960 gnutls_x509_crt_t issuer);
961
962int gnutls_x509_crt_list_verify(const gnutls_x509_crt_t *
963 cert_list, unsigned cert_list_length,
964 const gnutls_x509_crt_t * CA_list,
965 unsigned CA_list_length,
966 const gnutls_x509_crl_t * CRL_list,
967 unsigned CRL_list_length,
968 unsigned int flags, unsigned int *verify);
969
970int gnutls_x509_crt_verify(gnutls_x509_crt_t cert,
971 const gnutls_x509_crt_t * CA_list,
972 unsigned CA_list_length, unsigned int flags,
973 unsigned int *verify);
974int gnutls_x509_crl_verify(gnutls_x509_crl_t crl,
975 const gnutls_x509_crt_t * CA_list,
976 unsigned CA_list_length, unsigned int flags,
977 unsigned int *verify);
978
979int
980gnutls_x509_crt_verify_data2(gnutls_x509_crt_t crt,
981 gnutls_sign_algorithm_t algo,
982 unsigned int flags,
983 const gnutls_datum_t * data,
984 const gnutls_datum_t * signature);
985
986int gnutls_x509_crt_check_revocation(gnutls_x509_crt_t cert,
987 const gnutls_x509_crl_t *
988 crl_list, unsigned crl_list_length);
989
990int gnutls_x509_crt_get_fingerprint(gnutls_x509_crt_t cert,
991 gnutls_digest_algorithm_t algo,
992 void *buf, size_t * buf_size);
993
994int gnutls_x509_crt_get_key_purpose_oid(gnutls_x509_crt_t cert,
995 unsigned indx, void *oid,
996 size_t * oid_size,
997 unsigned int *critical);
998int gnutls_x509_crt_set_key_purpose_oid(gnutls_x509_crt_t cert,
999 const void *oid,
1000 unsigned int critical);
1001
1002unsigned gnutls_x509_crt_check_key_purpose(gnutls_x509_crt_t cert,
1003 const char *purpose, unsigned flags);
1004
1005/* Private key handling.
1006 */
1007
1008/* Flags for the gnutls_x509_privkey_export_pkcs8() function.
1009 */
1010
1011#define GNUTLS_PKCS8_PLAIN GNUTLS_PKCS_PLAIN
1012#define GNUTLS_PKCS8_USE_PKCS12_3DES GNUTLS_PKCS_PKCS12_3DES
1013#define GNUTLS_PKCS8_USE_PKCS12_ARCFOUR GNUTLS_PKCS_PKCS12_ARCFOUR
1014#define GNUTLS_PKCS8_USE_PKCS12_RC2_40 GNUTLS_PKCS_PKCS12_RC2_40
1015
1016/**
1017 * gnutls_pkcs_encrypt_flags_t:
1018 * @GNUTLS_PKCS_PLAIN: Unencrypted private key.
1019 * @GNUTLS_PKCS_NULL_PASSWORD: Some schemas distinguish between an empty and a NULL password.
1020 * @GNUTLS_PKCS_PKCS12_3DES: PKCS-12 3DES.
1021 * @GNUTLS_PKCS_PKCS12_ARCFOUR: PKCS-12 ARCFOUR.
1022 * @GNUTLS_PKCS_PKCS12_RC2_40: PKCS-12 RC2-40.
1023 * @GNUTLS_PKCS_PBES2_3DES: PBES2 3DES.
1024 * @GNUTLS_PKCS_PBES2_AES_128: PBES2 AES-128.
1025 * @GNUTLS_PKCS_PBES2_AES_192: PBES2 AES-192.
1026 * @GNUTLS_PKCS_PBES2_AES_256: PBES2 AES-256.
1027 * @GNUTLS_PKCS_PBES2_DES: PBES2 single DES.
1028 * @GNUTLS_PKCS_PBES2_DES_MD5: PBES1 with single DES; for compatibility with openssl only.
1029 *
1030 * Enumeration of different PKCS encryption flags.
1031 */
1032typedef enum gnutls_pkcs_encrypt_flags_t {
1033 GNUTLS_PKCS_PLAIN = 1,
1034 GNUTLS_PKCS_PKCS12_3DES = 1<<1,
1035 GNUTLS_PKCS_PKCS12_ARCFOUR = 1<<2,
1036 GNUTLS_PKCS_PKCS12_RC2_40 = 1<<3,
1037 GNUTLS_PKCS_PBES2_3DES = 1<<4,
1038 GNUTLS_PKCS_PBES2_AES_128 = 1<<5,
1039 GNUTLS_PKCS_PBES2_AES_192 = 1<<6,
1040 GNUTLS_PKCS_PBES2_AES_256 = 1<<7,
1041 GNUTLS_PKCS_NULL_PASSWORD = 1<<8,
1042 GNUTLS_PKCS_PBES2_DES = 1<<9,
1043 GNUTLS_PKCS_PBES1_DES_MD5 = 1<<10
1044} gnutls_pkcs_encrypt_flags_t;
1045
1046#define GNUTLS_PKCS_CIPHER_MASK(x) ((x)&(~(GNUTLS_PKCS_NULL_PASSWORD)))
1047
1048#define GNUTLS_PKCS_USE_PKCS12_3DES GNUTLS_PKCS_PKCS12_3DES
1049#define GNUTLS_PKCS_USE_PKCS12_ARCFOUR GNUTLS_PKCS_PKCS12_ARCFOUR
1050#define GNUTLS_PKCS_USE_PKCS12_RC2_40 GNUTLS_PKCS_PKCS12_RC2_40
1051#define GNUTLS_PKCS_USE_PBES2_3DES GNUTLS_PKCS_PBES2_3DES
1052#define GNUTLS_PKCS_USE_PBES2_AES_128 GNUTLS_PKCS_PBES2_AES_128
1053#define GNUTLS_PKCS_USE_PBES2_AES_192 GNUTLS_PKCS_PBES2_AES_192
1054#define GNUTLS_PKCS_USE_PBES2_AES_256 GNUTLS_PKCS_PBES2_AES_256
1055
1056const char *gnutls_pkcs_schema_get_name(unsigned int schema);
1057const char *gnutls_pkcs_schema_get_oid(unsigned int schema);
1058
1059int gnutls_x509_privkey_init(gnutls_x509_privkey_t * key);
1060void gnutls_x509_privkey_deinit(gnutls_x509_privkey_t key);
1061gnutls_sec_param_t
1062gnutls_x509_privkey_sec_param(gnutls_x509_privkey_t key);
1063
1064void gnutls_x509_privkey_set_pin_function(gnutls_x509_privkey_t key,
1065 gnutls_pin_callback_t fn,
1066 void *userdata);
1067
1068int gnutls_x509_privkey_cpy(gnutls_x509_privkey_t dst,
1069 gnutls_x509_privkey_t src);
1070int gnutls_x509_privkey_import(gnutls_x509_privkey_t key,
1071 const gnutls_datum_t * data,
1072 gnutls_x509_crt_fmt_t format);
1073int gnutls_x509_privkey_import_pkcs8(gnutls_x509_privkey_t key,
1074 const gnutls_datum_t * data,
1075 gnutls_x509_crt_fmt_t format,
1076 const char *password,
1077 unsigned int flags);
1078int gnutls_x509_privkey_import_openssl(gnutls_x509_privkey_t key,
1079 const gnutls_datum_t * data,
1080 const char *password);
1081
1082int
1083gnutls_pkcs8_info(const gnutls_datum_t * data, gnutls_x509_crt_fmt_t format,
1084 unsigned int *schema, unsigned int *cipher,
1085 void *salt, unsigned int *salt_size,
1086 unsigned int *iter_count, char **oid);
1087
1088int gnutls_x509_privkey_import2(gnutls_x509_privkey_t key,
1089 const gnutls_datum_t * data,
1090 gnutls_x509_crt_fmt_t format,
1091 const char *password, unsigned int flags);
1092
1093int gnutls_x509_privkey_import_rsa_raw(gnutls_x509_privkey_t key,
1094 const gnutls_datum_t * m,
1095 const gnutls_datum_t * e,
1096 const gnutls_datum_t * d,
1097 const gnutls_datum_t * p,
1098 const gnutls_datum_t * q,
1099 const gnutls_datum_t * u);
1100int gnutls_x509_privkey_import_rsa_raw2(gnutls_x509_privkey_t key,
1101 const gnutls_datum_t * m,
1102 const gnutls_datum_t * e,
1103 const gnutls_datum_t * d,
1104 const gnutls_datum_t * p,
1105 const gnutls_datum_t * q,
1106 const gnutls_datum_t * u,
1107 const gnutls_datum_t * e1,
1108 const gnutls_datum_t * e2);
1109int gnutls_x509_privkey_import_ecc_raw(gnutls_x509_privkey_t key,
1110 gnutls_ecc_curve_t curve,
1111 const gnutls_datum_t * x,
1112 const gnutls_datum_t * y,
1113 const gnutls_datum_t * k);
1114
1115int gnutls_x509_privkey_fix(gnutls_x509_privkey_t key);
1116
1117int gnutls_x509_privkey_export_dsa_raw(gnutls_x509_privkey_t key,
1118 gnutls_datum_t * p,
1119 gnutls_datum_t * q,
1120 gnutls_datum_t * g,
1121 gnutls_datum_t * y,
1122 gnutls_datum_t * x);
1123int gnutls_x509_privkey_import_dsa_raw(gnutls_x509_privkey_t key,
1124 const gnutls_datum_t * p,
1125 const gnutls_datum_t * q,
1126 const gnutls_datum_t * g,
1127 const gnutls_datum_t * y,
1128 const gnutls_datum_t * x);
1129
1130int gnutls_x509_privkey_get_pk_algorithm(gnutls_x509_privkey_t key);
1131int gnutls_x509_privkey_get_pk_algorithm2(gnutls_x509_privkey_t
1132 key, unsigned int *bits);
1133int gnutls_x509_privkey_get_key_id(gnutls_x509_privkey_t key,
1134 unsigned int flags,
1135 unsigned char *output_data,
1136 size_t * output_data_size);
1137
1138int gnutls_x509_privkey_generate(gnutls_x509_privkey_t key,
1139 gnutls_pk_algorithm_t algo,
1140 unsigned int bits, unsigned int flags);
1141
1142void gnutls_x509_privkey_set_flags(gnutls_x509_privkey_t key, unsigned int flags);
1143
1144/**
1145 * gnutls_keygen_types_t:
1146 * @GNUTLS_KEYGEN_SEED: Specifies the seed to be used in key generation.
1147 * @GNUTLS_KEYGEN_DIGEST: The size field specifies the hash algorithm to be used in key generation.
1148 *
1149 * Enumeration of different key exchange algorithms.
1150 */
1151typedef enum {
1152 GNUTLS_KEYGEN_SEED = 1,
1153 GNUTLS_KEYGEN_DIGEST = 2,
1154} gnutls_keygen_types_t;
1155
1156typedef struct {
1157 gnutls_keygen_types_t type;
1158 unsigned char *data;
1159 unsigned int size;
1160} gnutls_keygen_data_st;
1161
1162int
1163gnutls_x509_privkey_generate2(gnutls_x509_privkey_t key,
1164 gnutls_pk_algorithm_t algo, unsigned int bits,
1165 unsigned int flags, const gnutls_keygen_data_st *data, unsigned data_size);
1166
1167int gnutls_x509_privkey_verify_seed(gnutls_x509_privkey_t key, gnutls_digest_algorithm_t, const void *seed, size_t seed_size);
1168int gnutls_x509_privkey_get_seed(gnutls_x509_privkey_t key, gnutls_digest_algorithm_t*, void *seed, size_t *seed_size);
1169
1170int gnutls_x509_privkey_verify_params(gnutls_x509_privkey_t key);
1171
1172int gnutls_x509_privkey_export(gnutls_x509_privkey_t key,
1173 gnutls_x509_crt_fmt_t format,
1174 void *output_data,
1175 size_t * output_data_size);
1176int gnutls_x509_privkey_export2(gnutls_x509_privkey_t key,
1177 gnutls_x509_crt_fmt_t format,
1178 gnutls_datum_t * out);
1179int gnutls_x509_privkey_export_pkcs8(gnutls_x509_privkey_t key,
1180 gnutls_x509_crt_fmt_t format,
1181 const char *password,
1182 unsigned int flags,
1183 void *output_data,
1184 size_t * output_data_size);
1185int gnutls_x509_privkey_export2_pkcs8(gnutls_x509_privkey_t key,
1186 gnutls_x509_crt_fmt_t format,
1187 const char *password,
1188 unsigned int flags,
1189 gnutls_datum_t * out);
1190int gnutls_x509_privkey_export_rsa_raw2(gnutls_x509_privkey_t key,
1191 gnutls_datum_t * m,
1192 gnutls_datum_t * e,
1193 gnutls_datum_t * d,
1194 gnutls_datum_t * p,
1195 gnutls_datum_t * q,
1196 gnutls_datum_t * u,
1197 gnutls_datum_t * e1,
1198 gnutls_datum_t * e2);
1199int gnutls_x509_privkey_export_rsa_raw(gnutls_x509_privkey_t key,
1200 gnutls_datum_t * m,
1201 gnutls_datum_t * e,
1202 gnutls_datum_t * d,
1203 gnutls_datum_t * p,
1204 gnutls_datum_t * q,
1205 gnutls_datum_t * u);
1206int gnutls_x509_privkey_export_ecc_raw(gnutls_x509_privkey_t key,
1207 gnutls_ecc_curve_t * curve,
1208 gnutls_datum_t * x,
1209 gnutls_datum_t * y,
1210 gnutls_datum_t * k);
1211
1212int gnutls_x509_privkey_sign_data(gnutls_x509_privkey_t key,
1213 gnutls_digest_algorithm_t digest,
1214 unsigned int flags,
1215 const gnutls_datum_t * data,
1216 void *signature,
1217 size_t * signature_size);
1218
1219/* Certificate request stuff.
1220 */
1221
1222int gnutls_x509_crq_sign2(gnutls_x509_crq_t crq,
1223 gnutls_x509_privkey_t key,
1224 gnutls_digest_algorithm_t dig,
1225 unsigned int flags);
1226
1227int gnutls_x509_crq_print(gnutls_x509_crq_t crq,
1228 gnutls_certificate_print_formats_t
1229 format, gnutls_datum_t * out);
1230
1231int gnutls_x509_crq_verify(gnutls_x509_crq_t crq, unsigned int flags);
1232
1233int gnutls_x509_crq_init(gnutls_x509_crq_t * crq);
1234void gnutls_x509_crq_deinit(gnutls_x509_crq_t crq);
1235int gnutls_x509_crq_import(gnutls_x509_crq_t crq,
1236 const gnutls_datum_t * data,
1237 gnutls_x509_crt_fmt_t format);
1238
1239int gnutls_x509_crq_get_private_key_usage_period(gnutls_x509_crq_t
1240 cert,
1241 time_t *
1242 activation,
1243 time_t *
1244 expiration, unsigned int
1245 *critical);
1246
1247int gnutls_x509_crq_get_dn(gnutls_x509_crq_t crq, char *buf,
1248 size_t * sizeof_buf);
1249int gnutls_x509_crq_get_dn2(gnutls_x509_crq_t crq, gnutls_datum_t * dn);
1250int gnutls_x509_crq_get_dn3(gnutls_x509_crq_t crq, gnutls_datum_t * dn, unsigned flags);
1251int gnutls_x509_crq_get_dn_oid(gnutls_x509_crq_t crq, unsigned indx,
1252 void *oid, size_t * sizeof_oid);
1253int gnutls_x509_crq_get_dn_by_oid(gnutls_x509_crq_t crq,
1254 const char *oid, unsigned indx,
1255 unsigned int raw_flag, void *buf,
1256 size_t * sizeof_buf);
1257int gnutls_x509_crq_set_dn(gnutls_x509_crq_t crq, const char *dn,
1258 const char **err);
1259int gnutls_x509_crq_set_dn_by_oid(gnutls_x509_crq_t crq,
1260 const char *oid,
1261 unsigned int raw_flag,
1262 const void *data,
1263 unsigned int sizeof_data);
1264int gnutls_x509_crq_set_version(gnutls_x509_crq_t crq,
1265 unsigned int version);
1266int gnutls_x509_crq_get_version(gnutls_x509_crq_t crq);
1267int gnutls_x509_crq_set_key(gnutls_x509_crq_t crq,
1268 gnutls_x509_privkey_t key);
1269
1270int
1271gnutls_x509_crq_set_extension_by_oid(gnutls_x509_crq_t crq,
1272 const char *oid, const void *buf,
1273 size_t sizeof_buf,
1274 unsigned int critical);
1275
1276int gnutls_x509_crq_set_challenge_password(gnutls_x509_crq_t crq,
1277 const char *pass);
1278int gnutls_x509_crq_get_challenge_password(gnutls_x509_crq_t crq,
1279 char *pass,
1280 size_t * sizeof_pass);
1281
1282int gnutls_x509_crq_set_attribute_by_oid(gnutls_x509_crq_t crq,
1283 const char *oid,
1284 void *buf, size_t sizeof_buf);
1285int gnutls_x509_crq_get_attribute_by_oid(gnutls_x509_crq_t crq,
1286 const char *oid, unsigned indx,
1287 void *buf, size_t * sizeof_buf);
1288
1289int gnutls_x509_crq_export(gnutls_x509_crq_t crq,
1290 gnutls_x509_crt_fmt_t format,
1291 void *output_data, size_t * output_data_size);
1292int gnutls_x509_crq_export2(gnutls_x509_crq_t crq,
1293 gnutls_x509_crt_fmt_t format,
1294 gnutls_datum_t * out);
1295
1296int gnutls_x509_crt_set_crq(gnutls_x509_crt_t crt, gnutls_x509_crq_t crq);
1297int gnutls_x509_crt_set_crq_extensions(gnutls_x509_crt_t crt,
1298 gnutls_x509_crq_t crq);
1299
1300int
1301gnutls_x509_crt_set_crq_extension_by_oid(gnutls_x509_crt_t crt,
1302 gnutls_x509_crq_t crq, const char *oid,
1303 unsigned flags);
1304
1305int gnutls_x509_crq_set_private_key_usage_period(gnutls_x509_crq_t
1306 crq,
1307 time_t activation,
1308 time_t expiration);
1309int gnutls_x509_crq_set_key_rsa_raw(gnutls_x509_crq_t crq,
1310 const gnutls_datum_t * m,
1311 const gnutls_datum_t * e);
1312int gnutls_x509_crq_set_subject_alt_name(gnutls_x509_crq_t crq,
1313 gnutls_x509_subject_alt_name_t
1314 nt, const void *data,
1315 unsigned int data_size,
1316 unsigned int flags);
1317
1318int
1319gnutls_x509_crq_set_subject_alt_othername(gnutls_x509_crq_t crq,
1320 const char *oid,
1321 const void *data,
1322 unsigned int data_size,
1323 unsigned int flags);
1324
1325int gnutls_x509_crq_set_key_usage(gnutls_x509_crq_t crq,
1326 unsigned int usage);
1327int gnutls_x509_crq_set_basic_constraints(gnutls_x509_crq_t crq,
1328 unsigned int ca,
1329 int pathLenConstraint);
1330int gnutls_x509_crq_set_key_purpose_oid(gnutls_x509_crq_t crq,
1331 const void *oid,
1332 unsigned int critical);
1333int gnutls_x509_crq_get_key_purpose_oid(gnutls_x509_crq_t crq,
1334 unsigned indx, void *oid,
1335 size_t * sizeof_oid,
1336 unsigned int *critical);
1337
1338int gnutls_x509_crq_get_extension_data(gnutls_x509_crq_t crq,
1339 unsigned indx, void *data,
1340 size_t * sizeof_data);
1341int
1342gnutls_x509_crq_get_extension_data2(gnutls_x509_crq_t crq,
1343 unsigned indx,
1344 gnutls_datum_t * data);
1345int gnutls_x509_crq_get_extension_info(gnutls_x509_crq_t crq,
1346 unsigned indx, void *oid,
1347 size_t * sizeof_oid,
1348 unsigned int *critical);
1349int gnutls_x509_crq_get_attribute_data(gnutls_x509_crq_t crq,
1350 unsigned indx, void *data,
1351 size_t * sizeof_data);
1352int gnutls_x509_crq_get_attribute_info(gnutls_x509_crq_t crq,
1353 unsigned indx, void *oid,
1354 size_t * sizeof_oid);
1355int gnutls_x509_crq_get_pk_algorithm(gnutls_x509_crq_t crq,
1356 unsigned int *bits);
1357
1358int gnutls_x509_crq_get_signature_oid(gnutls_x509_crq_t crq, char *oid, size_t *oid_size);
1359int gnutls_x509_crq_get_pk_oid(gnutls_x509_crq_t crq, char *oid, size_t *oid_size);
1360
1361int gnutls_x509_crq_get_key_id(gnutls_x509_crq_t crq,
1362 unsigned int flags,
1363 unsigned char *output_data,
1364 size_t * output_data_size);
1365int gnutls_x509_crq_get_key_rsa_raw(gnutls_x509_crq_t crq,
1366 gnutls_datum_t * m,
1367 gnutls_datum_t * e);
1368
1369int gnutls_x509_crq_get_key_usage(gnutls_x509_crq_t crq,
1370 unsigned int *key_usage,
1371 unsigned int *critical);
1372int gnutls_x509_crq_get_basic_constraints(gnutls_x509_crq_t crq,
1373 unsigned int *critical,
1374 unsigned int *ca, int *pathlen);
1375int gnutls_x509_crq_get_subject_alt_name(gnutls_x509_crq_t crq,
1376 unsigned int seq,
1377 void *ret,
1378 size_t * ret_size,
1379 unsigned int *ret_type,
1380 unsigned int *critical);
1381int gnutls_x509_crq_get_subject_alt_othername_oid(gnutls_x509_crq_t
1382 crq,
1383 unsigned int seq,
1384 void *ret,
1385 size_t * ret_size);
1386
1387int gnutls_x509_crq_get_extension_by_oid(gnutls_x509_crq_t crq,
1388 const char *oid, unsigned indx,
1389 void *buf,
1390 size_t * sizeof_buf,
1391 unsigned int *critical);
1392
1393int gnutls_x509_crq_get_tlsfeatures(gnutls_x509_crq_t crq,
1394 gnutls_x509_tlsfeatures_t features,
1395 unsigned flags,
1396 unsigned int *critical);
1397int gnutls_x509_crq_set_tlsfeatures(gnutls_x509_crq_t crq,
1398 gnutls_x509_tlsfeatures_t features);
1399
1400int
1401gnutls_x509_crt_get_extension_by_oid2(gnutls_x509_crt_t cert,
1402 const char *oid, unsigned indx,
1403 gnutls_datum_t *output,
1404 unsigned int *critical);
1405
1406typedef struct gnutls_x509_trust_list_st *gnutls_x509_trust_list_t;
1407typedef struct gnutls_x509_trust_list_iter *gnutls_x509_trust_list_iter_t;
1408
1409int
1410gnutls_x509_trust_list_init(gnutls_x509_trust_list_t * list,
1411 unsigned int size);
1412
1413void
1414gnutls_x509_trust_list_deinit(gnutls_x509_trust_list_t list,
1415 unsigned int all);
1416
1417int gnutls_x509_trust_list_get_issuer(gnutls_x509_trust_list_t
1418 list, gnutls_x509_crt_t cert,
1419 gnutls_x509_crt_t * issuer,
1420 unsigned int flags);
1421
1422int gnutls_x509_trust_list_get_issuer_by_dn(gnutls_x509_trust_list_t list,
1423 const gnutls_datum_t *dn,
1424 gnutls_x509_crt_t *issuer,
1425 unsigned int flags);
1426
1427int gnutls_x509_trust_list_get_issuer_by_subject_key_id(gnutls_x509_trust_list_t list,
1428 const gnutls_datum_t *dn,
1429 const gnutls_datum_t *spki,
1430 gnutls_x509_crt_t *issuer,
1431 unsigned int flags);
1432/**
1433 * gnutls_trust_list_flags_t:
1434 * @GNUTLS_TL_VERIFY_CRL: If any CRLs are provided they will be verified for validity
1435 * prior to be added. The CA certificates that will be used for verification are the
1436 * ones already added in the trusted list.
1437 * @GNUTLS_TL_USE_IN_TLS: Internal flag used by GnuTLS. If provided the trust list
1438 * structure will cache a copy of CA DNs to be used in the certificate request
1439 * TLS message.
1440 * @GNUTLS_TL_NO_DUPLICATES: If this flag is specified, a function adding certificates
1441 * will check and eliminate any duplicates.
1442 * @GNUTLS_TL_NO_DUPLICATE_KEY: If this flag is specified, a certificate sharing the
1443 * same key as a previously added on will not be added.
1444 * @GNUTLS_TL_GET_COPY: The semantics of this flag are documented to the functions which
1445 * are applicable. In general, on returned value, the function will provide a copy
1446 * if this flag is provided, rather than a pointer to internal data.
1447 *
1448 * Enumeration of different certificate trust list flags.
1449 */
1450typedef enum gnutls_trust_list_flags_t {
1451 GNUTLS_TL_VERIFY_CRL = 1,
1452#define GNUTLS_TL_VERIFY_CRL 1
1453 GNUTLS_TL_USE_IN_TLS = (1<<1),
1454#define GNUTLS_TL_USE_IN_TLS (1<<1)
1455 GNUTLS_TL_NO_DUPLICATES = (1<<2),
1456#define GNUTLS_TL_NO_DUPLICATES (1<<2)
1457 GNUTLS_TL_NO_DUPLICATE_KEY = (1<<3),
1458#define GNUTLS_TL_NO_DUPLICATE_KEY (1<<3)
1459 GNUTLS_TL_GET_COPY = (1<<4)
1460#define GNUTLS_TL_GET_COPY (1<<4)
1461} gnutls_trust_list_flags_t;
1462
1463int
1464gnutls_x509_trust_list_add_cas(gnutls_x509_trust_list_t list,
1465 const gnutls_x509_crt_t * clist,
1466 unsigned clist_size, unsigned int flags);
1467int gnutls_x509_trust_list_remove_cas(gnutls_x509_trust_list_t
1468 list,
1469 const gnutls_x509_crt_t *
1470 clist, unsigned clist_size);
1471
1472int gnutls_x509_trust_list_add_named_crt(gnutls_x509_trust_list_t
1473 list,
1474 gnutls_x509_crt_t cert,
1475 const void *name,
1476 size_t name_size,
1477 unsigned int flags);
1478
1479int
1480gnutls_x509_trust_list_add_crls(gnutls_x509_trust_list_t list,
1481 const gnutls_x509_crl_t *
1482 crl_list, unsigned crl_size,
1483 unsigned int flags,
1484 unsigned int verification_flags);
1485
1486
1487int
1488gnutls_x509_trust_list_iter_get_ca(gnutls_x509_trust_list_t list,
1489 gnutls_x509_trust_list_iter_t *iter,
1490 gnutls_x509_crt_t *crt);
1491
1492void gnutls_x509_trust_list_iter_deinit(gnutls_x509_trust_list_iter_t iter);
1493
1494typedef int gnutls_verify_output_function(gnutls_x509_crt_t cert, gnutls_x509_crt_t issuer, /* The issuer if verification failed
1495 * because of him. might be null.
1496 */
1497 gnutls_x509_crl_t crl, /* The CRL that caused verification failure
1498 * if any. Might be null.
1499 */
1500 unsigned int
1501 verification_output);
1502
1503int gnutls_x509_trust_list_verify_named_crt
1504 (gnutls_x509_trust_list_t list, gnutls_x509_crt_t cert,
1505 const void *name, size_t name_size, unsigned int flags,
1506 unsigned int *verify, gnutls_verify_output_function func);
1507
1508int
1509gnutls_x509_trust_list_verify_crt2(gnutls_x509_trust_list_t list,
1510 gnutls_x509_crt_t * cert_list,
1511 unsigned int cert_list_size,
1512 gnutls_typed_vdata_st * data,
1513 unsigned int elements,
1514 unsigned int flags,
1515 unsigned int *voutput,
1516 gnutls_verify_output_function func);
1517
1518int
1519gnutls_x509_trust_list_verify_crt(gnutls_x509_trust_list_t list,
1520 gnutls_x509_crt_t * cert_list,
1521 unsigned int cert_list_size,
1522 unsigned int flags,
1523 unsigned int *verify,
1524 gnutls_verify_output_function func);
1525
1526 /* trust list convenience functions */
1527int
1528gnutls_x509_trust_list_add_trust_mem(gnutls_x509_trust_list_t
1529 list,
1530 const gnutls_datum_t * cas,
1531 const gnutls_datum_t * crls,
1532 gnutls_x509_crt_fmt_t type,
1533 unsigned int tl_flags,
1534 unsigned int tl_vflags);
1535
1536int
1537gnutls_x509_trust_list_add_trust_file(gnutls_x509_trust_list_t
1538 list, const char *ca_file,
1539 const char *crl_file,
1540 gnutls_x509_crt_fmt_t type,
1541 unsigned int tl_flags,
1542 unsigned int tl_vflags);
1543
1544int
1545gnutls_x509_trust_list_add_trust_dir(gnutls_x509_trust_list_t list,
1546 const char *ca_dir,
1547 const char *crl_dir,
1548 gnutls_x509_crt_fmt_t type,
1549 unsigned int tl_flags,
1550 unsigned int tl_vflags);
1551
1552int
1553gnutls_x509_trust_list_remove_trust_file(gnutls_x509_trust_list_t
1554 list,
1555 const char *ca_file,
1556 gnutls_x509_crt_fmt_t type);
1557
1558int
1559gnutls_x509_trust_list_remove_trust_mem(gnutls_x509_trust_list_t
1560 list,
1561 const gnutls_datum_t *
1562 cas, gnutls_x509_crt_fmt_t type);
1563
1564int
1565gnutls_x509_trust_list_add_system_trust(gnutls_x509_trust_list_t
1566 list,
1567 unsigned int tl_flags,
1568 unsigned int tl_vflags);
1569
1570void gnutls_certificate_set_trust_list
1571 (gnutls_certificate_credentials_t res,
1572 gnutls_x509_trust_list_t tlist, unsigned flags);
1573void gnutls_certificate_get_trust_list
1574 (gnutls_certificate_credentials_t res,
1575 gnutls_x509_trust_list_t *tlist);
1576
1577typedef struct gnutls_x509_ext_st {
1578 char *oid;
1579 unsigned int critical;
1580 gnutls_datum_t data;
1581} gnutls_x509_ext_st;
1582
1583void gnutls_x509_ext_deinit(gnutls_x509_ext_st *ext);
1584
1585int
1586gnutls_x509_ext_print(gnutls_x509_ext_st *exts, unsigned int exts_size,
1587 gnutls_certificate_print_formats_t format,
1588 gnutls_datum_t * out);
1589
1590#include <gnutls/pkcs7.h>
1591
1592/* *INDENT-OFF* */
1593#ifdef __cplusplus
1594}
1595#endif
1596/* *INDENT-ON* */
1597#endif /* GNUTLS_X509_H */
1598