Go to the documentation of this file.
25 #ifndef BR_BEARSSL_X509_H__
26 #define BR_BEARSSL_X509_H__
130 #define BR_ERR_X509_OK 32
133 #define BR_ERR_X509_INVALID_VALUE 33
136 #define BR_ERR_X509_TRUNCATED 34
139 #define BR_ERR_X509_EMPTY_CHAIN 35
143 #define BR_ERR_X509_INNER_TRUNC 36
147 #define BR_ERR_X509_BAD_TAG_CLASS 37
150 #define BR_ERR_X509_BAD_TAG_VALUE 38
153 #define BR_ERR_X509_INDEFINITE_LENGTH 39
156 #define BR_ERR_X509_EXTRA_ELEMENT 40
159 #define BR_ERR_X509_UNEXPECTED 41
163 #define BR_ERR_X509_NOT_CONSTRUCTED 42
167 #define BR_ERR_X509_NOT_PRIMITIVE 43
171 #define BR_ERR_X509_PARTIAL_BYTE 44
174 #define BR_ERR_X509_BAD_BOOLEAN 45
177 #define BR_ERR_X509_OVERFLOW 46
180 #define BR_ERR_X509_BAD_DN 47
183 #define BR_ERR_X509_BAD_TIME 48
187 #define BR_ERR_X509_UNSUPPORTED 49
190 #define BR_ERR_X509_LIMIT_EXCEEDED 50
193 #define BR_ERR_X509_WRONG_KEY_TYPE 51
196 #define BR_ERR_X509_BAD_SIGNATURE 52
199 #define BR_ERR_X509_TIME_UNKNOWN 53
202 #define BR_ERR_X509_EXPIRED 54
205 #define BR_ERR_X509_DN_MISMATCH 55
208 #define BR_ERR_X509_BAD_SERVER_NAME 56
211 #define BR_ERR_X509_CRITICAL_EXTENSION 57
214 #define BR_ERR_X509_NOT_CA 58
217 #define BR_ERR_X509_FORBIDDEN_KEY_USAGE 59
220 #define BR_ERR_X509_WEAK_PUBLIC_KEY 60
223 #define BR_ERR_X509_NOT_TRUSTED 62
271 #define BR_X509_TA_CA 0x0001
284 #define BR_KEYTYPE_RSA 1
286 #define BR_KEYTYPE_EC 2
297 #define BR_KEYTYPE_KEYX 0x10
307 #define BR_KEYTYPE_SIGN 0x20
391 const char *server_name);
399 void (*
start_cert)(
const br_x509_class **ctx, uint32_t length);
417 void (*
append)(
const br_x509_class **ctx,
418 const unsigned char *buf,
size_t len);
467 const br_x509_class *
const *ctx,
unsigned *usages);
482 #ifndef BR_DOXYGEN_IGNORE
525 #ifndef BR_DOXYGEN_IGNORE
554 #define BR_X509_BUFSIZE_KEY 520
555 #define BR_X509_BUFSIZE_SIG 512
640 #ifndef BR_DOXYGEN_IGNORE
648 const unsigned char *ip;
650 uint32_t dp_stack[32];
651 uint32_t rp_stack[32];
655 const char *server_name;
658 unsigned char key_usages;
661 uint32_t days, seconds;
665 uint32_t cert_length;
673 const unsigned char *hbuf;
677 unsigned char pad[256];
680 unsigned char ee_pkey_data[BR_X509_BUFSIZE_KEY];
683 unsigned char pkey_data[BR_X509_BUFSIZE_KEY];
688 unsigned char cert_signer_key_type;
689 uint16_t cert_sig_hash_oid;
690 unsigned char cert_sig_hash_len;
693 unsigned char cert_sig[BR_X509_BUFSIZE_SIG];
694 uint16_t cert_sig_len;
697 int16_t min_rsa_size;
701 size_t trust_anchors_num;
706 unsigned char do_mhash;
708 unsigned char tbs_hash[64];
713 unsigned char do_dn_hash;
714 const br_hash_class *dn_hash_impl;
716 unsigned char current_dn_hash[64];
717 unsigned char next_dn_hash[64];
718 unsigned char saved_dn_hash[64];
724 size_t num_name_elts;
758 const br_hash_class *dn_hash_impl,
780 int id,
const br_hash_class *impl)
825 ctx->iecdsa = iecdsa;
870 uint32_t days, uint32_t seconds)
873 ctx->seconds = seconds;
892 ctx->min_rsa_size = (int16_t)(byte_length - 128);
911 ctx->name_elts = elts;
912 ctx->num_name_elts = num_elts;
926 #ifndef BR_DOXYGEN_IGNORE
934 const unsigned char *ip;
936 uint32_t dp_stack[32];
937 uint32_t rp_stack[32];
941 unsigned char pad[256];
944 unsigned char decoded;
947 uint32_t notbefore_days, notbefore_seconds;
948 uint32_t notafter_days, notafter_seconds;
956 unsigned char copy_dn;
958 void (*append_dn)(
void *ctx,
const void *buf,
size_t len);
961 const unsigned char *hbuf;
965 unsigned char pkey_data[BR_X509_BUFSIZE_KEY];
968 unsigned char signer_key_type;
969 unsigned char signer_hash_id;
988 void (*append_dn)(
void *ctx,
const void *buf,
size_t len),
989 void *append_dn_ctx);
1002 const void *data,
size_t len);
1019 if (ctx->decoded && ctx->err == 0) {
1039 if (ctx->err != 0) {
1042 if (!ctx->decoded) {
1077 return ctx->signer_key_type;
1092 return ctx->signer_hash_id;
1115 #ifndef BR_DOXYGEN_IGNORE
1126 const unsigned char *ip;
1128 uint32_t dp_stack[32];
1129 uint32_t rp_stack[32];
1133 const unsigned char *hbuf;
1137 unsigned char pad[256];
1140 unsigned char key_type;
1145 unsigned char key_data[3 * BR_X509_BUFSIZE_SIG];
1167 const void *data,
size_t len);
1182 if (ctx->err != 0) {
1185 if (ctx->key_type == 0) {
1203 if (ctx->err == 0) {
1204 return ctx->key_type;
1225 return &ctx->key.rsa;
1246 return &ctx->key.ec;
1381 #define BR_ENCODE_PEM_RSA_RAW "RSA PRIVATE KEY"
1386 #define BR_ENCODE_PEM_EC_RAW "EC PRIVATE KEY"
1391 #define BR_ENCODE_PEM_PKCS8 "PRIVATE KEY"
Type for receiving a name element.
Definition: bearssl_x509.h:571
void(* append)(const br_x509_class **ctx, const unsigned char *buf, size_t len)
Receive some bytes for the current certificate.
Definition: bearssl_x509.h:417
int status
Decoding status.
Definition: bearssl_x509.h:624
RSA public key.
Definition: bearssl_rsa.h:161
Distinguished Name (X.500) structure.
Definition: bearssl_x509.h:245
Aggregate context for configurable hash function support.
Definition: bearssl_hash.h:1077
The "known key" X.509 engine structure.
Definition: bearssl_x509.h:479
const br_x509_class * vtable
Reference to the context vtable.
Definition: bearssl_x509.h:481
unsigned flags
Anchor flags (e.g. BR_X509_TA_CA).
Definition: bearssl_x509.h:259
size_t data_len
The DER-encoded certificate length (in bytes).
Definition: bearssl_x509.h:1102
Trust anchor structure.
Definition: bearssl_x509.h:255
unsigned char key_type
Key type: BR_KEYTYPE_RSA or BR_KEYTYPE_EC
Definition: bearssl_x509.h:230
unsigned(* end_chain)(const br_x509_class **ctx)
Finish the chain.
Definition: bearssl_x509.h:441
size_t context_size
X.509 context size, in bytes.
Definition: bearssl_x509.h:373
Type for an X.509 certificate (DER-encoded).
Definition: bearssl_x509.h:1098
unsigned char * data
Encoded DN data.
Definition: bearssl_x509.h:247
br_ec_public_key ec
EC public key.
Definition: bearssl_x509.h:236
Structure for an EC private key.
Definition: bearssl_ec.h:258
br_x500_name dn
Encoded DN (X.500 name).
Definition: bearssl_x509.h:257
br_rsa_public_key rsa
RSA public key.
Definition: bearssl_x509.h:234
The "minimal" X.509 engine structure.
Definition: bearssl_x509.h:637
Multi-hasher context structure.
Definition: bearssl_hash.h:1107
size_t len
Encoded DN length (in bytes).
Definition: bearssl_x509.h:249
size_t len
Length (in bytes) of the destination buffer.
Definition: bearssl_x509.h:614
br_x509_pkey pkey
Anchor public key.
Definition: bearssl_x509.h:261
Class type for an X.509 engine.
Definition: bearssl_x509.h:369
void(* start_cert)(const br_x509_class **ctx, uint32_t length)
Start a new certificate.
Definition: bearssl_x509.h:399
void(* start_chain)(const br_x509_class **ctx, const char *server_name)
Start a new chain.
Definition: bearssl_x509.h:390
Aggregate structure for public keys.
Definition: bearssl_x509.h:228
void(* end_cert)(const br_x509_class **ctx)
Finish the current certificate.
Definition: bearssl_x509.h:428
X.509 decoder context.
Definition: bearssl_x509.h:924
const br_x509_class * vtable
Definition: bearssl_x509.h:638
const unsigned char * oid
Element OID.
Definition: bearssl_x509.h:602
RSA private key.
Definition: bearssl_rsa.h:181
char * buf
Destination buffer.
Definition: bearssl_x509.h:607
Structure for an EC public key.
Definition: bearssl_ec.h:241
unsigned char * data
The DER-encoded certificate data.
Definition: bearssl_x509.h:1100
Type for an EC implementation.
Definition: bearssl_ec.h:270
Private key decoder context.
Definition: bearssl_x509.h:1114