Paul Bakker | bdb912d | 2012-02-13 23:11:30 +0000 | [diff] [blame] | 1 | /** |
| 2 | * \file x509write.h |
| 3 | * |
| 4 | * \brief X509 buffer writing functionality |
| 5 | * |
Paul Bakker | 407a0da | 2013-06-27 14:29:21 +0200 | [diff] [blame] | 6 | * Copyright (C) 2006-2013, Brainspark B.V. |
Paul Bakker | bdb912d | 2012-02-13 23:11:30 +0000 | [diff] [blame] | 7 | * |
| 8 | * This file is part of PolarSSL (http://www.polarssl.org) |
| 9 | * Lead Maintainer: Paul Bakker <polarssl_maintainer at polarssl.org> |
| 10 | * |
| 11 | * All rights reserved. |
| 12 | * |
| 13 | * This program is free software; you can redistribute it and/or modify |
| 14 | * it under the terms of the GNU General Public License as published by |
| 15 | * the Free Software Foundation; either version 2 of the License, or |
| 16 | * (at your option) any later version. |
| 17 | * |
| 18 | * This program is distributed in the hope that it will be useful, |
| 19 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 20 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 21 | * GNU General Public License for more details. |
| 22 | * |
| 23 | * You should have received a copy of the GNU General Public License along |
| 24 | * with this program; if not, write to the Free Software Foundation, Inc., |
| 25 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. |
| 26 | */ |
| 27 | #ifndef POLARSSL_X509_WRITE_H |
| 28 | #define POLARSSL_X509_WRITE_H |
| 29 | |
Paul Bakker | bc956d9 | 2013-04-19 14:51:29 +0200 | [diff] [blame] | 30 | #include "config.h" |
| 31 | |
Paul Bakker | fde4270 | 2013-08-25 14:47:27 +0200 | [diff] [blame] | 32 | #include "x509.h" |
Paul Bakker | bdb912d | 2012-02-13 23:11:30 +0000 | [diff] [blame] | 33 | |
Paul Bakker | f677466 | 2013-08-25 11:47:51 +0200 | [diff] [blame] | 34 | /** |
| 35 | * \addtogroup x509_module |
| 36 | * \{ |
| 37 | */ |
| 38 | |
| 39 | /** |
| 40 | * \name X509 Write Error codes |
| 41 | * \{ |
| 42 | */ |
Paul Bakker | 0e06c0f | 2013-08-25 11:21:30 +0200 | [diff] [blame] | 43 | #define POLARSSL_ERR_X509WRITE_UNKNOWN_OID -0x5F80 /**< Requested OID is unknown. */ |
| 44 | #define POLARSSL_ERR_X509WRITE_BAD_INPUT_DATA -0x5F00 /**< Failed to allocate memory. */ |
| 45 | #define POLARSSL_ERR_X509WRITE_MALLOC_FAILED -0x5E80 /**< Failed to allocate memory. */ |
Paul Bakker | f677466 | 2013-08-25 11:47:51 +0200 | [diff] [blame] | 46 | /* \} name */ |
| 47 | /* \} addtogroup x509_module */ |
Paul Bakker | 8eabfc1 | 2013-08-25 10:18:25 +0200 | [diff] [blame] | 48 | |
Paul Bakker | 407a0da | 2013-06-27 14:29:21 +0200 | [diff] [blame] | 49 | #ifdef __cplusplus |
| 50 | extern "C" { |
| 51 | #endif |
| 52 | |
Paul Bakker | f677466 | 2013-08-25 11:47:51 +0200 | [diff] [blame] | 53 | /** |
| 54 | * \addtogroup x509_module |
| 55 | * \{ |
| 56 | */ |
| 57 | |
| 58 | /** |
| 59 | * \name Structures for writing X.509 CSRs (Certificate Signing Request) |
| 60 | * \{ |
| 61 | */ |
| 62 | |
| 63 | /** |
| 64 | * Container for CSR named objects |
| 65 | */ |
Paul Bakker | bdb912d | 2012-02-13 23:11:30 +0000 | [diff] [blame] | 66 | typedef struct _x509_req_name |
| 67 | { |
| 68 | char oid[128]; |
| 69 | char name[128]; |
| 70 | |
| 71 | struct _x509_req_name *next; |
| 72 | } |
| 73 | x509_req_name; |
| 74 | |
Paul Bakker | f677466 | 2013-08-25 11:47:51 +0200 | [diff] [blame] | 75 | /** |
| 76 | * Container for a CSR |
| 77 | */ |
Paul Bakker | 82e2945 | 2013-08-25 11:01:31 +0200 | [diff] [blame] | 78 | typedef struct _x509_csr |
Paul Bakker | 8eabfc1 | 2013-08-25 10:18:25 +0200 | [diff] [blame] | 79 | { |
| 80 | rsa_context *rsa; |
| 81 | x509_req_name *subject; |
| 82 | md_type_t md_alg; |
Paul Bakker | e5eae76 | 2013-08-26 12:05:14 +0200 | [diff] [blame] | 83 | asn1_named_data *extensions; |
Paul Bakker | 8eabfc1 | 2013-08-25 10:18:25 +0200 | [diff] [blame] | 84 | } |
Paul Bakker | 82e2945 | 2013-08-25 11:01:31 +0200 | [diff] [blame] | 85 | x509_csr; |
Paul Bakker | 8eabfc1 | 2013-08-25 10:18:25 +0200 | [diff] [blame] | 86 | |
Paul Bakker | 9397dcb | 2013-09-06 09:55:26 +0200 | [diff] [blame^] | 87 | #define X509_CRT_VERSION_1 0 |
| 88 | #define X509_CRT_VERSION_2 1 |
| 89 | #define X509_CRT_VERSION_3 2 |
| 90 | |
| 91 | #define X509_RFC5280_MAX_SERIAL_LEN 32 |
| 92 | #define X509_RFC5280_UTC_TIME_LEN 15 |
| 93 | |
| 94 | /** |
| 95 | * Container for writing a certificate (CRT) |
| 96 | */ |
| 97 | typedef struct _x509write_cert |
| 98 | { |
| 99 | int version; |
| 100 | mpi serial; |
| 101 | rsa_context *subject_key; |
| 102 | rsa_context *issuer_key; |
| 103 | x509_req_name *subject; |
| 104 | x509_req_name *issuer; |
| 105 | md_type_t md_alg; |
| 106 | char not_before[X509_RFC5280_UTC_TIME_LEN + 1]; |
| 107 | char not_after[X509_RFC5280_UTC_TIME_LEN + 1]; |
| 108 | asn1_named_data *extensions; |
| 109 | } |
| 110 | x509write_cert; |
| 111 | |
Paul Bakker | f677466 | 2013-08-25 11:47:51 +0200 | [diff] [blame] | 112 | /* \} addtogroup x509_module */ |
| 113 | |
| 114 | /** |
| 115 | * \brief Initialize a CSR context |
| 116 | * |
| 117 | * \param ctx CSR context to initialize |
| 118 | */ |
Paul Bakker | 82e2945 | 2013-08-25 11:01:31 +0200 | [diff] [blame] | 119 | void x509write_csr_init( x509_csr *ctx ); |
Paul Bakker | f677466 | 2013-08-25 11:47:51 +0200 | [diff] [blame] | 120 | |
| 121 | /** |
| 122 | * \brief Set the subject name for a CSR |
| 123 | * Subject names should contain a comma-separated list |
| 124 | * of OID types and values: |
| 125 | * e.g. "C=NL,O=Offspark,CN=PolarSSL Server 1" |
| 126 | * |
| 127 | * \param ctx CSR context to use |
| 128 | * \param subject_name subject name to set |
| 129 | * |
| 130 | * \return 0 if subject name was parsed successfully, or |
| 131 | * a specific error code |
| 132 | */ |
Paul Bakker | 82e2945 | 2013-08-25 11:01:31 +0200 | [diff] [blame] | 133 | int x509write_csr_set_subject_name( x509_csr *ctx, char *subject_name ); |
Paul Bakker | f677466 | 2013-08-25 11:47:51 +0200 | [diff] [blame] | 134 | |
| 135 | /** |
| 136 | * \brief Set the RSA key for a CSR (public key will be included, |
| 137 | * private key used to sign the CSR when writing it) |
| 138 | * |
| 139 | * \param ctx CSR context to use |
| 140 | * \param rsa RSA key to include |
| 141 | */ |
Paul Bakker | 82e2945 | 2013-08-25 11:01:31 +0200 | [diff] [blame] | 142 | void x509write_csr_set_rsa_key( x509_csr *ctx, rsa_context *rsa ); |
Paul Bakker | f677466 | 2013-08-25 11:47:51 +0200 | [diff] [blame] | 143 | |
| 144 | /** |
| 145 | * \brief Set the MD algorithm to use for the signature |
| 146 | * (e.g. POLARSSL_MD_SHA1) |
| 147 | * |
| 148 | * \param ctx CSR context to use |
| 149 | * \param md_ald MD algorithm to use |
| 150 | */ |
Paul Bakker | 82e2945 | 2013-08-25 11:01:31 +0200 | [diff] [blame] | 151 | void x509write_csr_set_md_alg( x509_csr *ctx, md_type_t md_alg ); |
Paul Bakker | f677466 | 2013-08-25 11:47:51 +0200 | [diff] [blame] | 152 | |
| 153 | /** |
Paul Bakker | fde4270 | 2013-08-25 14:47:27 +0200 | [diff] [blame] | 154 | * \brief Set the Key Usage Extension flags |
| 155 | * (e.g. KU_DIGITAL_SIGNATURE | KU_KEY_CERT_SIGN) |
| 156 | * |
| 157 | * \param ctx CSR context to use |
Paul Bakker | 1c0e550 | 2013-08-26 13:41:01 +0200 | [diff] [blame] | 158 | * \param key_usage key usage flags to set |
Paul Bakker | e5eae76 | 2013-08-26 12:05:14 +0200 | [diff] [blame] | 159 | * |
| 160 | * \return 0 if successful, or POLARSSL_ERR_X509WRITE_MALLOC_FAILED |
Paul Bakker | fde4270 | 2013-08-25 14:47:27 +0200 | [diff] [blame] | 161 | */ |
Paul Bakker | e5eae76 | 2013-08-26 12:05:14 +0200 | [diff] [blame] | 162 | int x509write_csr_set_key_usage( x509_csr *ctx, unsigned char key_usage ); |
Paul Bakker | fde4270 | 2013-08-25 14:47:27 +0200 | [diff] [blame] | 163 | |
| 164 | /** |
Paul Bakker | 1c0e550 | 2013-08-26 13:41:01 +0200 | [diff] [blame] | 165 | * \brief Set the Netscape Cert Type flags |
| 166 | * (e.g. NS_CERT_TYPE_SSL_CLIENT | NS_CERT_TYPE_EMAIL) |
| 167 | * |
| 168 | * \param ctx CSR context to use |
| 169 | * \param ns_cert_type Netscape Cert Type flags to set |
| 170 | * |
| 171 | * \return 0 if successful, or POLARSSL_ERR_X509WRITE_MALLOC_FAILED |
| 172 | */ |
| 173 | int x509write_csr_set_ns_cert_type( x509_csr *ctx, unsigned char ns_cert_type ); |
| 174 | |
| 175 | /** |
| 176 | * \brief Generic function to add to or replace an extension in the CSR |
| 177 | * |
| 178 | * \param ctx CSR context to use |
| 179 | * \param oid OID of the extension |
| 180 | * \param oid_len length of the OID |
| 181 | * \param val value of the extension OCTET STRING |
| 182 | * \param val_len length of the value data |
| 183 | * |
| 184 | * \return 0 if successful, or a POLARSSL_ERR_X509WRITE_MALLOC_FAILED |
| 185 | */ |
| 186 | int x509write_csr_set_extension( x509_csr *ctx, |
| 187 | const char *oid, size_t oid_len, |
| 188 | const unsigned char *val, size_t val_len ); |
| 189 | |
| 190 | /** |
Paul Bakker | f677466 | 2013-08-25 11:47:51 +0200 | [diff] [blame] | 191 | * \brief Free the contents of a CSR context |
| 192 | * |
| 193 | * \param ctx CSR context to free |
| 194 | */ |
Paul Bakker | 82e2945 | 2013-08-25 11:01:31 +0200 | [diff] [blame] | 195 | void x509write_csr_free( x509_csr *ctx ); |
Paul Bakker | 8eabfc1 | 2013-08-25 10:18:25 +0200 | [diff] [blame] | 196 | |
Paul Bakker | f677466 | 2013-08-25 11:47:51 +0200 | [diff] [blame] | 197 | /** |
Paul Bakker | 9397dcb | 2013-09-06 09:55:26 +0200 | [diff] [blame^] | 198 | * \brief Initialize a CRT writing context |
| 199 | * |
| 200 | * \param ctx CRT context to initialize |
| 201 | */ |
| 202 | void x509write_crt_init( x509write_cert *ctx ); |
| 203 | |
| 204 | /** |
| 205 | * \brief Set the verion for a Certificate |
| 206 | * Default: X509_CRT_VERSION_3 |
| 207 | * |
| 208 | * \param ctx CRT context to use |
| 209 | * \param version version to set (X509_CRT_VERSION_1, X509_CRT_VERSION_2 or |
| 210 | * X509_CRT_VERSION_3) |
| 211 | */ |
| 212 | void x509write_crt_set_version( x509write_cert *ctx, int version ); |
| 213 | |
| 214 | /** |
| 215 | * \brief Set the serial number for a Certificate. |
| 216 | * |
| 217 | * \param ctx CRT context to use |
| 218 | * \param serial serial number to set |
| 219 | * |
| 220 | * \return 0 if successful |
| 221 | */ |
| 222 | int x509write_crt_set_serial( x509write_cert *ctx, const mpi *serial ); |
| 223 | |
| 224 | /** |
| 225 | * \brief Set the validity period for a Certificate |
| 226 | * Timestamps should be in string format for UTC timezone |
| 227 | * i.e. "YYYYMMDDhhmmss" |
| 228 | * e.g. "20131231235959" for December 31st 2013 |
| 229 | * at 23:59:59 |
| 230 | * |
| 231 | * \param ctx CRT context to use |
| 232 | * \param not_before not_before timestamp |
| 233 | * \param not_after not_after timestamp |
| 234 | * |
| 235 | * \return 0 if timestamp was parsed successfully, or |
| 236 | * a specific error code |
| 237 | */ |
| 238 | int x509write_crt_set_validity( x509write_cert *ctx, char *not_before, |
| 239 | char *not_after ); |
| 240 | |
| 241 | /** |
| 242 | * \brief Set the issuer name for a Certificate |
| 243 | * Issuer names should contain a comma-separated list |
| 244 | * of OID types and values: |
| 245 | * e.g. "C=NL,O=Offspark,CN=PolarSSL CA" |
| 246 | * |
| 247 | * \param ctx CRT context to use |
| 248 | * \param issuer_name issuer name to set |
| 249 | * |
| 250 | * \return 0 if issuer name was parsed successfully, or |
| 251 | * a specific error code |
| 252 | */ |
| 253 | int x509write_crt_set_issuer_name( x509write_cert *ctx, char *issuer_name ); |
| 254 | |
| 255 | /** |
| 256 | * \brief Set the subject name for a Certificate |
| 257 | * Subject names should contain a comma-separated list |
| 258 | * of OID types and values: |
| 259 | * e.g. "C=NL,O=Offspark,CN=PolarSSL Server 1" |
| 260 | * |
| 261 | * \param ctx CRT context to use |
| 262 | * \param subject_name subject name to set |
| 263 | * |
| 264 | * \return 0 if subject name was parsed successfully, or |
| 265 | * a specific error code |
| 266 | */ |
| 267 | int x509write_crt_set_subject_name( x509write_cert *ctx, char *subject_name ); |
| 268 | |
| 269 | /** |
| 270 | * \brief Set the subject public key for the certificate |
| 271 | * |
| 272 | * \param ctx CRT context to use |
| 273 | * \param rsa RSA public key to include |
| 274 | */ |
| 275 | void x509write_crt_set_subject_key( x509write_cert *ctx, rsa_context *rsa ); |
| 276 | |
| 277 | /** |
| 278 | * \brief Set the issuer key used for signing the certificate |
| 279 | * |
| 280 | * \param ctx CRT context to use |
| 281 | * \param rsa RSA key to sign with |
| 282 | */ |
| 283 | void x509write_crt_set_issuer_key( x509write_cert *ctx, rsa_context *rsa ); |
| 284 | |
| 285 | /** |
| 286 | * \brief Set the MD algorithm to use for the signature |
| 287 | * (e.g. POLARSSL_MD_SHA1) |
| 288 | * |
| 289 | * \param ctx CRT context to use |
| 290 | * \param md_ald MD algorithm to use |
| 291 | */ |
| 292 | void x509write_crt_set_md_alg( x509write_cert *ctx, md_type_t md_alg ); |
| 293 | |
| 294 | /** |
| 295 | * \brief Free the contents of a CRT write context |
| 296 | * |
| 297 | * \param ctx CRT context to free |
| 298 | */ |
| 299 | void x509write_crt_free( x509write_cert *ctx ); |
| 300 | |
| 301 | /** |
| 302 | * \brief Write a built up certificate to a X509 DER structure |
| 303 | * Note: data is written at the end of the buffer! Use the |
| 304 | * return value to determine where you should start |
| 305 | * using the buffer |
| 306 | * |
| 307 | * \param crt certificate to write away |
| 308 | * \param buf buffer to write to |
| 309 | * \param size size of the buffer |
| 310 | * |
| 311 | * \return length of data written if successful, or a specific |
| 312 | * error code |
| 313 | */ |
| 314 | int x509write_crt_der( x509write_cert *ctx, unsigned char *buf, size_t size ); |
| 315 | |
| 316 | /** |
Paul Bakker | f677466 | 2013-08-25 11:47:51 +0200 | [diff] [blame] | 317 | * \brief Write a RSA public key to a PKCS#1 DER structure |
| 318 | * Note: data is written at the end of the buffer! Use the |
| 319 | * return value to determine where you should start |
| 320 | * using the buffer |
| 321 | * |
| 322 | * \param rsa RSA to write away |
| 323 | * \param buf buffer to write to |
| 324 | * \param size size of the buffer |
| 325 | * |
| 326 | * \return length of data written if successful, or a specific |
| 327 | * error code |
| 328 | */ |
Paul Bakker | 82e2945 | 2013-08-25 11:01:31 +0200 | [diff] [blame] | 329 | int x509write_pubkey_der( rsa_context *rsa, unsigned char *buf, size_t size ); |
Paul Bakker | f677466 | 2013-08-25 11:47:51 +0200 | [diff] [blame] | 330 | |
| 331 | /** |
| 332 | * \brief Write a RSA key to a PKCS#1 DER structure |
| 333 | * Note: data is written at the end of the buffer! Use the |
| 334 | * return value to determine where you should start |
| 335 | * using the buffer |
| 336 | * |
| 337 | * \param rsa RSA to write away |
| 338 | * \param buf buffer to write to |
| 339 | * \param size size of the buffer |
| 340 | * |
| 341 | * \return length of data written if successful, or a specific |
| 342 | * error code |
| 343 | */ |
Paul Bakker | 82e2945 | 2013-08-25 11:01:31 +0200 | [diff] [blame] | 344 | int x509write_key_der( rsa_context *rsa, unsigned char *buf, size_t size ); |
Paul Bakker | f677466 | 2013-08-25 11:47:51 +0200 | [diff] [blame] | 345 | |
| 346 | /** |
| 347 | * \brief Write a CSR (Certificate Signing Request) to a |
| 348 | * DER structure |
| 349 | * Note: data is written at the end of the buffer! Use the |
| 350 | * return value to determine where you should start |
| 351 | * using the buffer |
| 352 | * |
| 353 | * \param rsa CSR to write away |
| 354 | * \param buf buffer to write to |
| 355 | * \param size size of the buffer |
| 356 | * |
| 357 | * \return length of data written if successful, or a specific |
| 358 | * error code |
| 359 | */ |
Paul Bakker | 82e2945 | 2013-08-25 11:01:31 +0200 | [diff] [blame] | 360 | int x509write_csr_der( x509_csr *ctx, unsigned char *buf, size_t size ); |
Paul Bakker | bdb912d | 2012-02-13 23:11:30 +0000 | [diff] [blame] | 361 | |
Paul Bakker | 135f1e9 | 2013-08-26 16:54:13 +0200 | [diff] [blame] | 362 | #if defined(POLARSSL_BASE64_C) |
| 363 | /** |
Paul Bakker | 9397dcb | 2013-09-06 09:55:26 +0200 | [diff] [blame^] | 364 | * \brief Write a built up certificate to a X509 PEM string |
| 365 | * |
| 366 | * \param crt certificate to write away |
| 367 | * \param buf buffer to write to |
| 368 | * \param size size of the buffer |
| 369 | * |
| 370 | * \return 0 successful, or a specific error code |
| 371 | */ |
| 372 | int x509write_crt_pem( x509write_cert *ctx, unsigned char *buf, size_t size ); |
| 373 | |
| 374 | /** |
Paul Bakker | f3df61a | 2013-08-26 17:22:23 +0200 | [diff] [blame] | 375 | * \brief Write a RSA public key to a PKCS#1 PEM string |
| 376 | * |
| 377 | * \param rsa RSA to write away |
| 378 | * \param buf buffer to write to |
| 379 | * \param size size of the buffer |
| 380 | * |
| 381 | * \return 0 successful, or a specific error code |
| 382 | */ |
| 383 | int x509write_pubkey_pem( rsa_context *rsa, unsigned char *buf, size_t size ); |
| 384 | |
| 385 | /** |
| 386 | * \brief Write a RSA key to a PKCS#1 PEM string |
| 387 | * |
| 388 | * \param rsa RSA to write away |
| 389 | * \param buf buffer to write to |
| 390 | * \param size size of the buffer |
| 391 | * |
| 392 | * \return 0 successful, or a specific error code |
| 393 | */ |
| 394 | int x509write_key_pem( rsa_context *rsa, unsigned char *buf, size_t size ); |
| 395 | |
| 396 | /** |
Paul Bakker | 135f1e9 | 2013-08-26 16:54:13 +0200 | [diff] [blame] | 397 | * \brief Write a CSR (Certificate Signing Request) to a |
| 398 | * PEM string |
| 399 | * |
| 400 | * \param rsa CSR to write away |
| 401 | * \param buf buffer to write to |
| 402 | * \param size size of the buffer |
| 403 | * |
| 404 | * \return 0 successful, or a specific error code |
| 405 | */ |
| 406 | int x509write_csr_pem( x509_csr *ctx, unsigned char *buf, size_t size ); |
| 407 | #endif /* POLARSSL_BASE64_C */ |
| 408 | |
Paul Bakker | 407a0da | 2013-06-27 14:29:21 +0200 | [diff] [blame] | 409 | #ifdef __cplusplus |
| 410 | } |
| 411 | #endif |
| 412 | |
Paul Bakker | bdb912d | 2012-02-13 23:11:30 +0000 | [diff] [blame] | 413 | #endif /* POLARSSL_X509_WRITE_H */ |