include/gnutls/x509.h

0001 /*
0002  * Copyright (C) 2003-2016 Free Software Foundation, Inc.
0003  * Copyright (C) 2015-2016 Red Hat, Inc.
0004  *
0005  * Author: Nikos Mavrogiannopoulos
0006  *
0007  * This file is part of GnuTLS.
0008  *
0009  * The GnuTLS is free software; you can redistribute it and/or
0010  * modify it under the terms of the GNU Lesser General Public License
0011  * as published by the Free Software Foundation; either version 2.1 of
0012  * the License, or (at your option) any later version.
0013  *
0014  * This library is distributed in the hope that it will be useful, but
0015  * WITHOUT ANY WARRANTY; without even the implied warranty of
0016  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
0017  * Lesser General Public License for more details.
0018  *
0019  * You should have received a copy of the GNU Lesser General Public License
0020  * along with this program.  If not, see <https://www.gnu.org/licenses/>
0021  *
0022  */
0023
0024 /* This file contains the types and prototypes for the X.509
0025  * certificate and CRL handling functions.
0026  */
0027
0028 #ifndef GNUTLS_X509_H
0029 #define GNUTLS_X509_H
0030
0031 #include <gnutls/gnutls.h>
0032
0033 #ifdef __cplusplus
0034 extern "C" {
0035 #endif
0036
0037 /* Some OIDs usually found in Distinguished names, or
0038  * in Subject Directory Attribute extensions.
0039  */
0040 #define GNUTLS_OID_X520_COUNTRY_NAME "2.5.4.6"
0041 #define GNUTLS_OID_X520_ORGANIZATION_NAME "2.5.4.10"
0042 #define GNUTLS_OID_X520_ORGANIZATIONAL_UNIT_NAME "2.5.4.11"
0043 #define GNUTLS_OID_X520_COMMON_NAME "2.5.4.3"
0044 #define GNUTLS_OID_X520_LOCALITY_NAME "2.5.4.7"
0045 #define GNUTLS_OID_X520_STATE_OR_PROVINCE_NAME "2.5.4.8"
0046
0047 #define GNUTLS_OID_X520_INITIALS "2.5.4.43"
0048 #define GNUTLS_OID_X520_GENERATION_QUALIFIER "2.5.4.44"
0049 #define GNUTLS_OID_X520_SURNAME "2.5.4.4"
0050 #define GNUTLS_OID_X520_GIVEN_NAME "2.5.4.42"
0051 #define GNUTLS_OID_X520_TITLE "2.5.4.12"
0052 #define GNUTLS_OID_X520_DN_QUALIFIER "2.5.4.46"
0053 #define GNUTLS_OID_X520_PSEUDONYM "2.5.4.65"
0054 #define GNUTLS_OID_X520_POSTALCODE "2.5.4.17"
0055 #define GNUTLS_OID_X520_NAME "2.5.4.41"
0056
0057 #define GNUTLS_OID_LDAP_DC "0.9.2342.19200300.100.1.25"
0058 #define GNUTLS_OID_LDAP_UID "0.9.2342.19200300.100.1.1"
0059
0060 /* The following should not be included in DN.
0061  */
0062 #define GNUTLS_OID_PKCS9_EMAIL "1.2.840.113549.1.9.1"
0063
0064 #define GNUTLS_OID_PKIX_DATE_OF_BIRTH "1.3.6.1.5.5.7.9.1"
0065 #define GNUTLS_OID_PKIX_PLACE_OF_BIRTH "1.3.6.1.5.5.7.9.2"
0066 #define GNUTLS_OID_PKIX_GENDER "1.3.6.1.5.5.7.9.3"
0067 #define GNUTLS_OID_PKIX_COUNTRY_OF_CITIZENSHIP "1.3.6.1.5.5.7.9.4"
0068 #define GNUTLS_OID_PKIX_COUNTRY_OF_RESIDENCE "1.3.6.1.5.5.7.9.5"
0069
0070 /* Key purpose Object Identifiers.
0071  */
0072 #define GNUTLS_KP_TLS_WWW_SERVER "1.3.6.1.5.5.7.3.1"
0073 #define GNUTLS_KP_TLS_WWW_CLIENT "1.3.6.1.5.5.7.3.2"
0074 #define GNUTLS_KP_CODE_SIGNING "1.3.6.1.5.5.7.3.3"
0075 #define GNUTLS_KP_MS_SMART_CARD_LOGON "1.3.6.1.4.1.311.20.2.2"
0076 #define GNUTLS_KP_EMAIL_PROTECTION "1.3.6.1.5.5.7.3.4"
0077 #define GNUTLS_KP_TIME_STAMPING "1.3.6.1.5.5.7.3.8"
0078 #define GNUTLS_KP_OCSP_SIGNING "1.3.6.1.5.5.7.3.9"
0079 #define GNUTLS_KP_IPSEC_IKE "1.3.6.1.5.5.7.3.17"
0080 #define GNUTLS_KP_ANY "2.5.29.37.0"
0081
0082 #define GNUTLS_KP_FLAG_DISALLOW_ANY 1
0083
0084 #define GNUTLS_OID_AIA "1.3.6.1.5.5.7.1.1"
0085 #define GNUTLS_OID_AD_OCSP "1.3.6.1.5.5.7.48.1"
0086 #define GNUTLS_OID_AD_CAISSUERS "1.3.6.1.5.5.7.48.2"
0087
0088 #define GNUTLS_FSAN_SET 0
0089 #define GNUTLS_FSAN_APPEND 1
0090 #define GNUTLS_FSAN_ENCODE_OCTET_STRING (1 << 1)
0091 #define GNUTLS_FSAN_ENCODE_UTF8_STRING (1 << 2)
0092
0093 #define GNUTLS_X509EXT_OID_SUBJECT_KEY_ID "2.5.29.14"
0094 #define GNUTLS_X509EXT_OID_KEY_USAGE "2.5.29.15"
0095 #define GNUTLS_X509EXT_OID_PRIVATE_KEY_USAGE_PERIOD "2.5.29.16"
0096 #define GNUTLS_X509EXT_OID_SAN "2.5.29.17"
0097 #define GNUTLS_X509EXT_OID_IAN "2.5.29.18"
0098 #define GNUTLS_X509EXT_OID_BASIC_CONSTRAINTS "2.5.29.19"
0099 #define GNUTLS_X509EXT_OID_NAME_CONSTRAINTS "2.5.29.30"
0100 #define GNUTLS_X509EXT_OID_CRL_DIST_POINTS "2.5.29.31"
0101 #define GNUTLS_X509EXT_OID_CRT_POLICY "2.5.29.32"
0102 #define GNUTLS_X509EXT_OID_AUTHORITY_KEY_ID "2.5.29.35"
0103 #define GNUTLS_X509EXT_OID_EXTENDED_KEY_USAGE "2.5.29.37"
0104 #define GNUTLS_X509EXT_OID_INHIBIT_ANYPOLICY "2.5.29.52"
0105 #define GNUTLS_X509EXT_OID_AUTHORITY_INFO_ACCESS "1.3.6.1.5.5.7.1.1"
0106 #define GNUTLS_X509EXT_OID_PROXY_CRT_INFO "1.3.6.1.5.5.7.1.14"
0107 #define GNUTLS_X509EXT_OID_TLSFEATURES "1.3.6.1.5.5.7.1.24"
0108 #define GNUTLS_X509EXT_OID_CT_SCT_V1 "1.3.6.1.4.1.11129.2.4.2"
0109
0110 #define GNUTLS_X509_OID_POLICY_ANY "2.5.29.54"
0111
0112 /* Certificate handling functions.
0113  */
0114
0115 /**
0116  * gnutls_certificate_import_flags:
0117  * @GNUTLS_X509_CRT_LIST_IMPORT_FAIL_IF_EXCEED: Fail if the
0118  *   certificates in the buffer are more than the space allocated for
0119  *   certificates. The error code will be %GNUTLS_E_SHORT_MEMORY_BUFFER.
0120  * @GNUTLS_X509_CRT_LIST_FAIL_IF_UNSORTED: Fail if the certificates
0121  *   in the buffer are not ordered starting from subject to issuer.
0122  *   The error code will be %GNUTLS_E_CERTIFICATE_LIST_UNSORTED.
0123  * @GNUTLS_X509_CRT_LIST_SORT: Sort the certificate chain if unsorted.
0124  *
0125  * Enumeration of different certificate import flags.
0126  */
0127 typedef enum gnutls_certificate_import_flags {
0128     GNUTLS_X509_CRT_LIST_IMPORT_FAIL_IF_EXCEED = 1,
0129     GNUTLS_X509_CRT_LIST_FAIL_IF_UNSORTED = 1 << 1,
0130     GNUTLS_X509_CRT_LIST_SORT = 1 << 2
0131 } gnutls_certificate_import_flags;
0132
0133 int gnutls_x509_crt_init(gnutls_x509_crt_t *cert);
0134 void gnutls_x509_crt_deinit(gnutls_x509_crt_t cert);
0135
0136 /**
0137  * gnutls_certificate_import_flags:
0138  * @GNUTLS_X509_CRT_FLAG_IGNORE_SANITY: Ignore any sanity checks at the
0139  *   import of the certificate; i.e., ignore checks such as version/field
0140  *   matching and strict time field checks. Intended to be used for debugging.
0141  *
0142  * Enumeration of different certificate flags.
0143  */
0144 typedef enum gnutls_x509_crt_flags {
0145     GNUTLS_X509_CRT_FLAG_IGNORE_SANITY = 1
0146 } gnutls_x509_crt_flags;
0147 void gnutls_x509_crt_set_flags(gnutls_x509_crt_t cert, unsigned flags);
0148
0149 unsigned gnutls_x509_crt_equals(gnutls_x509_crt_t cert1,
0150                 gnutls_x509_crt_t cert2);
0151 unsigned gnutls_x509_crt_equals2(gnutls_x509_crt_t cert1,
0152                  const gnutls_datum_t *der);
0153
0154 int gnutls_x509_crt_import(gnutls_x509_crt_t cert, const gnutls_datum_t *data,
0155                gnutls_x509_crt_fmt_t format);
0156 int gnutls_x509_crt_list_import2(gnutls_x509_crt_t **certs, unsigned int *size,
0157                  const gnutls_datum_t *data,
0158                  gnutls_x509_crt_fmt_t format,
0159                  unsigned int flags);
0160 int gnutls_x509_crt_list_import(gnutls_x509_crt_t *certs,
0161                 unsigned int *cert_max,
0162                 const gnutls_datum_t *data,
0163                 gnutls_x509_crt_fmt_t format,
0164                 unsigned int flags);
0165
0166 int gnutls_x509_crt_import_url(gnutls_x509_crt_t crt, const char *url,
0167                    unsigned int flags
0168                    /* GNUTLS_PKCS11_OBJ_FLAG_* */
0169 );
0170
0171 int gnutls_x509_crt_list_import_url(gnutls_x509_crt_t **certs,
0172                     unsigned int *size, const char *url,
0173                     gnutls_pin_callback_t pin_fn,
0174                     void *pin_fn_userdata, unsigned int flags);
0175
0176 int gnutls_x509_crt_export(gnutls_x509_crt_t cert, gnutls_x509_crt_fmt_t format,
0177                void *output_data, size_t *output_data_size);
0178 int gnutls_x509_crt_export2(gnutls_x509_crt_t cert,
0179                 gnutls_x509_crt_fmt_t format, gnutls_datum_t *out);
0180 int gnutls_x509_crt_get_private_key_usage_period(gnutls_x509_crt_t cert,
0181                          time_t *activation,
0182                          time_t *expiration,
0183                          unsigned int *critical);
0184
0185 int gnutls_x509_crt_get_issuer_dn(gnutls_x509_crt_t cert, char *buf,
0186                   size_t *buf_size);
0187 int gnutls_x509_crt_get_issuer_dn2(gnutls_x509_crt_t cert, gnutls_datum_t *dn);
0188 int gnutls_x509_crt_get_issuer_dn3(gnutls_x509_crt_t cert, gnutls_datum_t *dn,
0189                    unsigned flags);
0190 int gnutls_x509_crt_get_issuer_dn_oid(gnutls_x509_crt_t cert, unsigned indx,
0191                       void *oid, size_t *oid_size);
0192 int gnutls_x509_crt_get_issuer_dn_by_oid(gnutls_x509_crt_t cert,
0193                      const char *oid, unsigned indx,
0194                      unsigned int raw_flag, void *buf,
0195                      size_t *buf_size);
0196
0197 int gnutls_x509_crt_get_dn(gnutls_x509_crt_t cert, char *buf, size_t *buf_size);
0198 int gnutls_x509_crt_get_dn2(gnutls_x509_crt_t cert, gnutls_datum_t *dn);
0199 int gnutls_x509_crt_get_dn3(gnutls_x509_crt_t cert, gnutls_datum_t *dn,
0200                 unsigned flags);
0201
0202 int gnutls_x509_crt_get_dn_oid(gnutls_x509_crt_t cert, unsigned indx, void *oid,
0203                    size_t *oid_size);
0204 int gnutls_x509_crt_get_dn_by_oid(gnutls_x509_crt_t cert, const char *oid,
0205                   unsigned indx, unsigned int raw_flag,
0206                   void *buf, size_t *buf_size);
0207 unsigned gnutls_x509_crt_check_hostname(gnutls_x509_crt_t cert,
0208                     const char *hostname);
0209 unsigned gnutls_x509_crt_check_hostname2(gnutls_x509_crt_t cert,
0210                      const char *hostname,
0211                      unsigned int flags);
0212 unsigned gnutls_x509_crt_check_email(gnutls_x509_crt_t cert, const char *email,
0213                      unsigned int flags);
0214
0215 unsigned gnutls_x509_crt_check_ip(gnutls_x509_crt_t cert,
0216                   const unsigned char *ip, unsigned int ip_size,
0217                   unsigned int flags);
0218
0219 int gnutls_x509_crt_get_signature_algorithm(gnutls_x509_crt_t cert);
0220 int gnutls_x509_crt_get_signature(gnutls_x509_crt_t cert, char *sig,
0221                   size_t *sizeof_sig);
0222 int gnutls_x509_crt_get_version(gnutls_x509_crt_t cert);
0223
0224 int gnutls_x509_crt_get_pk_oid(gnutls_x509_crt_t cert, char *oid,
0225                    size_t *oid_size);
0226 int gnutls_x509_crt_get_signature_oid(gnutls_x509_crt_t cert, char *oid,
0227                       size_t *oid_size);
0228
0229 /**
0230  * gnutls_keyid_flags_t:
0231  * @GNUTLS_KEYID_USE_SHA1: Use SHA1 as the key ID algorithm (default).
0232  * @GNUTLS_KEYID_USE_SHA256: Use SHA256 as the key ID algorithm.
0233  * @GNUTLS_KEYID_USE_SHA512: Use SHA512 as the key ID algorithm.
0234  * @GNUTLS_KEYID_USE_BEST_KNOWN: Use the best known algorithm to calculate key ID. Using that option will make your program behavior depend on the version of gnutls linked with. That option has a cap of 64-bytes key IDs.
0235  *
0236  * Enumeration of different flags for the key ID functions.
0237
0238  */
0239 typedef enum {
0240     GNUTLS_KEYID_USE_SHA1 = 0,
0241     GNUTLS_KEYID_USE_SHA256 = (1 << 0),
0242     GNUTLS_KEYID_USE_SHA512 = (1 << 1),
0243     GNUTLS_KEYID_USE_BEST_KNOWN = (1 << 30)
0244 } gnutls_keyid_flags_t;
0245 int gnutls_x509_crt_get_key_id(gnutls_x509_crt_t crt, unsigned int flags,
0246                    unsigned char *output_data,
0247                    size_t *output_data_size);
0248
0249 int gnutls_x509_crt_set_private_key_usage_period(gnutls_x509_crt_t crt,
0250                          time_t activation,
0251                          time_t expiration);
0252 int gnutls_x509_crt_set_authority_key_id(gnutls_x509_crt_t cert, const void *id,
0253                      size_t id_size);
0254 int gnutls_x509_crt_get_authority_key_id(gnutls_x509_crt_t cert, void *id,
0255                      size_t *id_size,
0256                      unsigned int *critical);
0257 int gnutls_x509_crt_get_authority_key_gn_serial(
0258     gnutls_x509_crt_t cert, unsigned int seq, void *alt, size_t *alt_size,
0259     unsigned int *alt_type, void *serial, size_t *serial_size,
0260     unsigned int *critical);
0261
0262 int gnutls_x509_crt_get_subject_key_id(gnutls_x509_crt_t cert, void *ret,
0263                        size_t *ret_size,
0264                        unsigned int *critical);
0265
0266 int gnutls_x509_crt_get_subject_unique_id(gnutls_x509_crt_t crt, char *buf,
0267                       size_t *buf_size);
0268
0269 int gnutls_x509_crt_get_issuer_unique_id(gnutls_x509_crt_t crt, char *buf,
0270                      size_t *buf_size);
0271
0272 void gnutls_x509_crt_set_pin_function(gnutls_x509_crt_t crt,
0273                       gnutls_pin_callback_t fn, void *userdata);
0274
0275 /**
0276    * gnutls_info_access_what_t:
0277    * @GNUTLS_IA_ACCESSMETHOD_OID: Get accessMethod OID.
0278    * @GNUTLS_IA_ACCESSLOCATION_GENERALNAME_TYPE: Get accessLocation name type.
0279    * @GNUTLS_IA_URI: Get accessLocation URI value.
0280    * @GNUTLS_IA_OCSP_URI: get accessLocation URI value for OCSP.
0281    * @GNUTLS_IA_CAISSUERS_URI: get accessLocation URI value for caIssuers.
0282    *
0283    * Enumeration of types for the @what parameter of
0284    * gnutls_x509_crt_get_authority_info_access().
0285    */
0286 typedef enum gnutls_info_access_what_t {
0287     GNUTLS_IA_ACCESSMETHOD_OID = 1,
0288     GNUTLS_IA_ACCESSLOCATION_GENERALNAME_TYPE = 2,
0289     /* use 100-108 for the generalName types, populate as needed */
0290     GNUTLS_IA_URI = 106,
0291     /* quick-access variants that match both OID and name type. */
0292     GNUTLS_IA_UNKNOWN = 10000,
0293     GNUTLS_IA_OCSP_URI = 10006,
0294     GNUTLS_IA_CAISSUERS_URI = 10106
0295 } gnutls_info_access_what_t;
0296
0297 int gnutls_x509_crt_get_authority_info_access(gnutls_x509_crt_t crt,
0298                           unsigned int seq, int what,
0299                           gnutls_datum_t *data,
0300                           unsigned int *critical);
0301
0302 typedef struct gnutls_name_constraints_st *gnutls_x509_name_constraints_t;
0303
0304 unsigned gnutls_x509_name_constraints_check(gnutls_x509_name_constraints_t nc,
0305                         gnutls_x509_subject_alt_name_t type,
0306                         const gnutls_datum_t *name);
0307 unsigned
0308 gnutls_x509_name_constraints_check_crt(gnutls_x509_name_constraints_t nc,
0309                        gnutls_x509_subject_alt_name_t type,
0310                        gnutls_x509_crt_t crt);
0311
0312 int gnutls_x509_name_constraints_init(gnutls_x509_name_constraints_t *nc);
0313 void gnutls_x509_name_constraints_deinit(gnutls_x509_name_constraints_t nc);
0314
0315 #define GNUTLS_EXT_FLAG_APPEND 1
0316
0317 #define GNUTLS_NAME_CONSTRAINTS_FLAG_APPEND GNUTLS_EXT_FLAG_APPEND
0318 int gnutls_x509_crt_get_name_constraints(gnutls_x509_crt_t crt,
0319                      gnutls_x509_name_constraints_t nc,
0320                      unsigned int flags,
0321                      unsigned int *critical);
0322 int gnutls_x509_name_constraints_add_permitted(
0323     gnutls_x509_name_constraints_t nc, gnutls_x509_subject_alt_name_t type,
0324     const gnutls_datum_t *name);
0325 int gnutls_x509_name_constraints_add_excluded(
0326     gnutls_x509_name_constraints_t nc, gnutls_x509_subject_alt_name_t type,
0327     const gnutls_datum_t *name);
0328 int gnutls_x509_crt_set_name_constraints(gnutls_x509_crt_t crt,
0329                      gnutls_x509_name_constraints_t nc,
0330                      unsigned int critical);
0331 int gnutls_x509_name_constraints_get_permitted(gnutls_x509_name_constraints_t nc,
0332                            unsigned idx, unsigned *type,
0333                            gnutls_datum_t *name);
0334 int gnutls_x509_name_constraints_get_excluded(gnutls_x509_name_constraints_t nc,
0335                           unsigned idx, unsigned *type,
0336                           gnutls_datum_t *name);
0337 int gnutls_x509_cidr_to_rfc5280(const char *cidr, gnutls_datum_t *cidr_rfc5280);
0338
0339 #define GNUTLS_CRL_REASON_SUPERSEEDED GNUTLS_CRL_REASON_SUPERSEDED,
0340 /**
0341    * gnutls_x509_crl_reason_flags_t:
0342    * @GNUTLS_CRL_REASON_PRIVILEGE_WITHDRAWN: The privileges were withdrawn from the owner.
0343    * @GNUTLS_CRL_REASON_CERTIFICATE_HOLD: The certificate is on hold.
0344    * @GNUTLS_CRL_REASON_CESSATION_OF_OPERATION: The end-entity is no longer operating.
0345    * @GNUTLS_CRL_REASON_SUPERSEDED: There is a newer certificate of the owner.
0346    * @GNUTLS_CRL_REASON_AFFILIATION_CHANGED: The end-entity affiliation has changed.
0347    * @GNUTLS_CRL_REASON_CA_COMPROMISE: The CA was compromised.
0348    * @GNUTLS_CRL_REASON_KEY_COMPROMISE: The certificate's key was compromised.
0349    * @GNUTLS_CRL_REASON_UNUSED: The key was never used.
0350    * @GNUTLS_CRL_REASON_AA_COMPROMISE: AA compromised.
0351    *
0352    * Enumeration of types for the CRL revocation reasons.
0353    */
0354 typedef enum gnutls_x509_crl_reason_flags_t {
0355     GNUTLS_CRL_REASON_UNSPECIFIED = 0,
0356     GNUTLS_CRL_REASON_PRIVILEGE_WITHDRAWN = 1,
0357     GNUTLS_CRL_REASON_CERTIFICATE_HOLD = 2,
0358     GNUTLS_CRL_REASON_CESSATION_OF_OPERATION = 4,
0359     GNUTLS_CRL_REASON_SUPERSEDED = 8,
0360     GNUTLS_CRL_REASON_AFFILIATION_CHANGED = 16,
0361     GNUTLS_CRL_REASON_CA_COMPROMISE = 32,
0362     GNUTLS_CRL_REASON_KEY_COMPROMISE = 64,
0363     GNUTLS_CRL_REASON_UNUSED = 128,
0364     GNUTLS_CRL_REASON_AA_COMPROMISE = 32768
0365 } gnutls_x509_crl_reason_flags_t;
0366
0367 int gnutls_x509_crt_get_crl_dist_points(gnutls_x509_crt_t cert,
0368                     unsigned int seq, void *ret,
0369                     size_t *ret_size,
0370                     unsigned int *reason_flags,
0371                     unsigned int *critical);
0372 int gnutls_x509_crt_set_crl_dist_points2(gnutls_x509_crt_t crt,
0373                      gnutls_x509_subject_alt_name_t type,
0374                      const void *data,
0375                      unsigned int data_size,
0376                      unsigned int reason_flags);
0377 int gnutls_x509_crt_set_crl_dist_points(gnutls_x509_crt_t crt,
0378                     gnutls_x509_subject_alt_name_t type,
0379                     const void *data_string,
0380                     unsigned int reason_flags);
0381 int gnutls_x509_crt_cpy_crl_dist_points(gnutls_x509_crt_t dst,
0382                     gnutls_x509_crt_t src);
0383
0384 int gnutls_x509_crl_sign(gnutls_x509_crl_t crl, gnutls_x509_crt_t issuer,
0385              gnutls_x509_privkey_t issuer_key);
0386
0387 int gnutls_x509_crl_sign2(gnutls_x509_crl_t crl, gnutls_x509_crt_t issuer,
0388               gnutls_x509_privkey_t issuer_key,
0389               gnutls_digest_algorithm_t dig, unsigned int flags);
0390
0391 time_t gnutls_x509_crt_get_activation_time(gnutls_x509_crt_t cert);
0392
0393 /* This macro is deprecated and defunc; do not use */
0394 #define GNUTLS_X509_NO_WELL_DEFINED_EXPIRATION ((time_t)4294197631)
0395
0396 time_t gnutls_x509_crt_get_expiration_time(gnutls_x509_crt_t cert);
0397 int gnutls_x509_crt_get_serial(gnutls_x509_crt_t cert, void *result,
0398                    size_t *result_size);
0399
0400 typedef struct gnutls_x509_spki_st *gnutls_x509_spki_t;
0401
0402 int gnutls_x509_spki_init(gnutls_x509_spki_t *spki);
0403 void gnutls_x509_spki_deinit(gnutls_x509_spki_t spki);
0404
0405 int gnutls_x509_spki_get_rsa_pss_params(gnutls_x509_spki_t spki,
0406                     gnutls_digest_algorithm_t *dig,
0407                     unsigned int *salt_size);
0408
0409 void gnutls_x509_spki_set_rsa_pss_params(gnutls_x509_spki_t spki,
0410                      gnutls_digest_algorithm_t dig,
0411                      unsigned int salt_size);
0412
0413 int gnutls_x509_spki_set_rsa_oaep_params(gnutls_x509_spki_t spki,
0414                      gnutls_digest_algorithm_t dig,
0415                      const gnutls_datum_t *label);
0416
0417 int gnutls_x509_spki_get_rsa_oaep_params(gnutls_x509_spki_t spki,
0418                      gnutls_digest_algorithm_t *dig,
0419                      gnutls_datum_t *label);
0420
0421 int gnutls_x509_crt_get_pk_algorithm(gnutls_x509_crt_t cert,
0422                      unsigned int *bits);
0423 int gnutls_x509_crt_set_spki(gnutls_x509_crt_t crt,
0424                  const gnutls_x509_spki_t spki, unsigned int flags);
0425 int gnutls_x509_crt_get_spki(gnutls_x509_crt_t cert, gnutls_x509_spki_t spki,
0426                  unsigned int flags);
0427
0428 int gnutls_x509_crt_get_pk_rsa_raw(gnutls_x509_crt_t crt, gnutls_datum_t *m,
0429                    gnutls_datum_t *e);
0430 int gnutls_x509_crt_get_pk_dsa_raw(gnutls_x509_crt_t crt, gnutls_datum_t *p,
0431                    gnutls_datum_t *q, gnutls_datum_t *g,
0432                    gnutls_datum_t *y);
0433 int gnutls_x509_crt_get_pk_ecc_raw(gnutls_x509_crt_t crt,
0434                    gnutls_ecc_curve_t *curve, gnutls_datum_t *x,
0435                    gnutls_datum_t *y);
0436 int gnutls_x509_crt_get_pk_gost_raw(gnutls_x509_crt_t crt,
0437                     gnutls_ecc_curve_t *curve,
0438                     gnutls_digest_algorithm_t *digest,
0439                     gnutls_gost_paramset_t *paramset,
0440                     gnutls_datum_t *x, gnutls_datum_t *y);
0441
0442 int gnutls_x509_crt_get_subject_alt_name(gnutls_x509_crt_t cert,
0443                      unsigned int seq, void *san,
0444                      size_t *san_size,
0445                      unsigned int *critical);
0446 int gnutls_x509_crt_get_subject_alt_name2(gnutls_x509_crt_t cert,
0447                       unsigned int seq, void *san,
0448                       size_t *san_size,
0449                       unsigned int *san_type,
0450                       unsigned int *critical);
0451
0452 int gnutls_x509_crt_get_subject_alt_othername_oid(gnutls_x509_crt_t cert,
0453                           unsigned int seq, void *oid,
0454                           size_t *oid_size);
0455
0456 int gnutls_x509_crt_get_issuer_alt_name(gnutls_x509_crt_t cert,
0457                     unsigned int seq, void *ian,
0458                     size_t *ian_size,
0459                     unsigned int *critical);
0460 int gnutls_x509_crt_get_issuer_alt_name2(gnutls_x509_crt_t cert,
0461                      unsigned int seq, void *ian,
0462                      size_t *ian_size,
0463                      unsigned int *ian_type,
0464                      unsigned int *critical);
0465
0466 int gnutls_x509_crt_get_issuer_alt_othername_oid(gnutls_x509_crt_t cert,
0467                          unsigned int seq, void *ret,
0468                          size_t *ret_size);
0469
0470 int gnutls_x509_crt_get_ca_status(gnutls_x509_crt_t cert,
0471                   unsigned int *critical);
0472 int gnutls_x509_crt_get_basic_constraints(gnutls_x509_crt_t cert,
0473                       unsigned int *critical,
0474                       unsigned int *ca, int *pathlen);
0475
0476 /* The key_usage flags are defined in gnutls.h. They are the
0477  * GNUTLS_KEY_* definitions.
0478  */
0479 int gnutls_x509_crt_get_key_usage(gnutls_x509_crt_t cert,
0480                   unsigned int *key_usage,
0481                   unsigned int *critical);
0482 int gnutls_x509_crt_set_key_usage(gnutls_x509_crt_t crt, unsigned int usage);
0483 int gnutls_x509_crt_set_authority_info_access(gnutls_x509_crt_t crt, int what,
0484                           gnutls_datum_t *data);
0485
0486 int gnutls_x509_crt_get_inhibit_anypolicy(gnutls_x509_crt_t cert,
0487                       unsigned int *skipcerts,
0488                       unsigned int *critical);
0489 int gnutls_x509_crt_set_inhibit_anypolicy(gnutls_x509_crt_t crt,
0490                       unsigned int skipcerts);
0491
0492 int gnutls_x509_crt_get_proxy(gnutls_x509_crt_t cert, unsigned int *critical,
0493                   int *pathlen, char **policyLanguage,
0494                   char **policy, size_t *sizeof_policy);
0495
0496 typedef struct gnutls_x509_tlsfeatures_st *gnutls_x509_tlsfeatures_t;
0497
0498 int gnutls_x509_tlsfeatures_init(gnutls_x509_tlsfeatures_t *features);
0499 void gnutls_x509_tlsfeatures_deinit(gnutls_x509_tlsfeatures_t);
0500 int gnutls_x509_tlsfeatures_get(gnutls_x509_tlsfeatures_t f, unsigned idx,
0501                 unsigned int *feature);
0502
0503 int gnutls_x509_crt_set_tlsfeatures(gnutls_x509_crt_t crt,
0504                     gnutls_x509_tlsfeatures_t features);
0505
0506 int gnutls_x509_crt_get_tlsfeatures(gnutls_x509_crt_t cert,
0507                     gnutls_x509_tlsfeatures_t features,
0508                     unsigned int flags, unsigned int *critical);
0509
0510 unsigned gnutls_x509_tlsfeatures_check_crt(gnutls_x509_tlsfeatures_t feat,
0511                        gnutls_x509_crt_t crt);
0512
0513 #define GNUTLS_MAX_QUALIFIERS 8
0514
0515 /**
0516    * gnutls_x509_qualifier_t:
0517    * @GNUTLS_X509_QUALIFIER_UNKNOWN: Unknown qualifier.
0518    * @GNUTLS_X509_QUALIFIER_URI: A URL
0519    * @GNUTLS_X509_QUALIFIER_NOICE: A text notice.
0520    *
0521    * Enumeration of types for the X.509 qualifiers, of the certificate policy extension.
0522    */
0523 typedef enum gnutls_x509_qualifier_t {
0524     GNUTLS_X509_QUALIFIER_UNKNOWN = 0,
0525     GNUTLS_X509_QUALIFIER_URI,
0526     GNUTLS_X509_QUALIFIER_NOTICE
0527 } gnutls_x509_qualifier_t;
0528
0529 typedef struct gnutls_x509_policy_st {
0530     char *oid;
0531     unsigned int qualifiers;
0532     struct {
0533         gnutls_x509_qualifier_t type;
0534         char *data;
0535         unsigned int size;
0536     } qualifier[GNUTLS_MAX_QUALIFIERS];
0537 } gnutls_x509_policy_st;
0538
0539 void gnutls_x509_policy_release(struct gnutls_x509_policy_st *policy);
0540 int gnutls_x509_crt_get_policy(gnutls_x509_crt_t crt, unsigned indx,
0541                    struct gnutls_x509_policy_st *policy,
0542                    unsigned int *critical);
0543 int gnutls_x509_crt_set_policy(gnutls_x509_crt_t crt,
0544                    const struct gnutls_x509_policy_st *policy,
0545                    unsigned int critical);
0546
0547 int gnutls_x509_dn_oid_known(const char *oid);
0548
0549 #define GNUTLS_X509_DN_OID_RETURN_OID 1
0550 const char *gnutls_x509_dn_oid_name(const char *oid, unsigned int flags);
0551
0552 /* Read extensions by OID. */
0553 int gnutls_x509_crt_get_extension_oid(gnutls_x509_crt_t cert, unsigned indx,
0554                       void *oid, size_t *oid_size);
0555 int gnutls_x509_crt_get_extension_by_oid(gnutls_x509_crt_t cert,
0556                      const char *oid, unsigned indx,
0557                      void *buf, size_t *buf_size,
0558                      unsigned int *critical);
0559
0560 int gnutls_x509_crq_get_signature_algorithm(gnutls_x509_crq_t crq);
0561 int gnutls_x509_crq_get_extension_by_oid2(gnutls_x509_crq_t crq,
0562                       const char *oid, unsigned indx,
0563                       gnutls_datum_t *output,
0564                       unsigned int *critical);
0565
0566 /* Read extensions by sequence number. */
0567 int gnutls_x509_crt_get_extension_info(gnutls_x509_crt_t cert, unsigned indx,
0568                        void *oid, size_t *oid_size,
0569                        unsigned int *critical);
0570 int gnutls_x509_crt_get_extension_data(gnutls_x509_crt_t cert, unsigned indx,
0571                        void *data, size_t *sizeof_data);
0572 int gnutls_x509_crt_get_extension_data2(gnutls_x509_crt_t cert, unsigned indx,
0573                     gnutls_datum_t *data);
0574
0575 int gnutls_x509_crt_set_extension_by_oid(gnutls_x509_crt_t crt, const char *oid,
0576                      const void *buf, size_t sizeof_buf,
0577                      unsigned int critical);
0578
0579 /* X.509 Certificate writing.
0580  */
0581 int gnutls_x509_crt_set_dn(gnutls_x509_crt_t crt, const char *dn,
0582                const char **err);
0583
0584 int gnutls_x509_crt_set_dn_by_oid(gnutls_x509_crt_t crt, const char *oid,
0585                   unsigned int raw_flag, const void *name,
0586                   unsigned int sizeof_name);
0587 int gnutls_x509_crt_set_issuer_dn_by_oid(gnutls_x509_crt_t crt, const char *oid,
0588                      unsigned int raw_flag,
0589                      const void *name,
0590                      unsigned int sizeof_name);
0591 int gnutls_x509_crt_set_issuer_dn(gnutls_x509_crt_t crt, const char *dn,
0592                   const char **err);
0593
0594 int gnutls_x509_crt_set_version(gnutls_x509_crt_t crt, unsigned int version);
0595 int gnutls_x509_crt_set_key(gnutls_x509_crt_t crt, gnutls_x509_privkey_t key);
0596 int gnutls_x509_crt_set_ca_status(gnutls_x509_crt_t crt, unsigned int ca);
0597 int gnutls_x509_crt_set_basic_constraints(gnutls_x509_crt_t crt,
0598                       unsigned int ca,
0599                       int pathLenConstraint);
0600
0601 int gnutls_x509_crt_set_subject_unique_id(gnutls_x509_crt_t cert,
0602                       const void *id, size_t id_size);
0603 int gnutls_x509_crt_set_issuer_unique_id(gnutls_x509_crt_t cert, const void *id,
0604                      size_t id_size);
0605
0606 int gnutls_x509_crt_set_subject_alternative_name(
0607     gnutls_x509_crt_t crt, gnutls_x509_subject_alt_name_t type,
0608     const char *data_string);
0609 int gnutls_x509_crt_set_subject_alt_name(gnutls_x509_crt_t crt,
0610                      gnutls_x509_subject_alt_name_t type,
0611                      const void *data,
0612                      unsigned int data_size,
0613                      unsigned int flags);
0614
0615 int gnutls_x509_crt_set_subject_alt_othername(gnutls_x509_crt_t crt,
0616                           const char *oid, const void *data,
0617                           unsigned int data_size,
0618                           unsigned int flags);
0619
0620 int gnutls_x509_crt_set_issuer_alt_name(gnutls_x509_crt_t crt,
0621                     gnutls_x509_subject_alt_name_t type,
0622                     const void *data,
0623                     unsigned int data_size,
0624                     unsigned int flags);
0625
0626 int gnutls_x509_crt_set_issuer_alt_othername(gnutls_x509_crt_t crt,
0627                          const char *oid, const void *data,
0628                          unsigned int data_size,
0629                          unsigned int flags);
0630
0631 int gnutls_x509_crt_sign(gnutls_x509_crt_t crt, gnutls_x509_crt_t issuer,
0632              gnutls_x509_privkey_t issuer_key);
0633 int gnutls_x509_crt_sign2(gnutls_x509_crt_t crt, gnutls_x509_crt_t issuer,
0634               gnutls_x509_privkey_t issuer_key,
0635               gnutls_digest_algorithm_t dig, unsigned int flags);
0636 int gnutls_x509_crt_set_activation_time(gnutls_x509_crt_t cert,
0637                     time_t act_time);
0638 int gnutls_x509_crt_set_expiration_time(gnutls_x509_crt_t cert,
0639                     time_t exp_time);
0640 int gnutls_x509_crt_set_serial(gnutls_x509_crt_t cert, const void *serial,
0641                    size_t serial_size);
0642
0643 int gnutls_x509_crt_set_subject_key_id(gnutls_x509_crt_t cert, const void *id,
0644                        size_t id_size);
0645
0646 int gnutls_x509_crt_set_proxy_dn(gnutls_x509_crt_t crt, gnutls_x509_crt_t eecrt,
0647                  unsigned int raw_flag, const void *name,
0648                  unsigned int sizeof_name);
0649 int gnutls_x509_crt_set_proxy(gnutls_x509_crt_t crt, int pathLenConstraint,
0650                   const char *policyLanguage, const char *policy,
0651                   size_t sizeof_policy);
0652
0653 int gnutls_x509_crt_print(gnutls_x509_crt_t cert,
0654               gnutls_certificate_print_formats_t format,
0655               gnutls_datum_t *out);
0656 int gnutls_x509_crl_print(gnutls_x509_crl_t crl,
0657               gnutls_certificate_print_formats_t format,
0658               gnutls_datum_t *out);
0659
0660 /* Access to internal Certificate fields.
0661      */
0662 int gnutls_x509_crt_get_raw_issuer_dn(gnutls_x509_crt_t cert,
0663                       gnutls_datum_t *start);
0664 int gnutls_x509_crt_get_raw_dn(gnutls_x509_crt_t cert, gnutls_datum_t *start);
0665
0666 /* RDN handling.
0667  */
0668 int gnutls_x509_rdn_get(const gnutls_datum_t *idn, char *buf,
0669             size_t *sizeof_buf);
0670 int gnutls_x509_rdn_get2(const gnutls_datum_t *idn, gnutls_datum_t *str,
0671              unsigned flags);
0672
0673 int gnutls_x509_rdn_get_oid(const gnutls_datum_t *idn, unsigned indx, void *buf,
0674                 size_t *sizeof_buf);
0675
0676 int gnutls_x509_rdn_get_by_oid(const gnutls_datum_t *idn, const char *oid,
0677                    unsigned indx, unsigned int raw_flag, void *buf,
0678                    size_t *sizeof_buf);
0679
0680 typedef struct gnutls_x509_dn_st *gnutls_x509_dn_t;
0681
0682 typedef struct gnutls_x509_ava_st {
0683     gnutls_datum_t oid;
0684     gnutls_datum_t value;
0685     unsigned long value_tag;
0686 } gnutls_x509_ava_st;
0687
0688 int gnutls_x509_crt_get_subject(gnutls_x509_crt_t cert, gnutls_x509_dn_t *dn);
0689 int gnutls_x509_crt_get_issuer(gnutls_x509_crt_t cert, gnutls_x509_dn_t *dn);
0690 int gnutls_x509_dn_get_rdn_ava(gnutls_x509_dn_t dn, int irdn, int iava,
0691                    gnutls_x509_ava_st *ava);
0692
0693 int gnutls_x509_dn_get_str(gnutls_x509_dn_t dn, gnutls_datum_t *str);
0694
0695 #define GNUTLS_X509_DN_FLAG_COMPAT 1
0696 int gnutls_x509_dn_get_str2(gnutls_x509_dn_t dn, gnutls_datum_t *str,
0697                 unsigned flags);
0698
0699 int gnutls_x509_dn_set_str(gnutls_x509_dn_t dn, const char *str,
0700                const char **err);
0701
0702 int gnutls_x509_dn_init(gnutls_x509_dn_t *dn);
0703
0704 int gnutls_x509_dn_import(gnutls_x509_dn_t dn, const gnutls_datum_t *data);
0705
0706 int gnutls_x509_dn_export(gnutls_x509_dn_t dn, gnutls_x509_crt_fmt_t format,
0707               void *output_data, size_t *output_data_size);
0708 int gnutls_x509_dn_export2(gnutls_x509_dn_t dn, gnutls_x509_crt_fmt_t format,
0709                gnutls_datum_t *out);
0710
0711 void gnutls_x509_dn_deinit(gnutls_x509_dn_t dn);
0712
0713 /* CRL handling functions.
0714  */
0715 int gnutls_x509_crl_init(gnutls_x509_crl_t *crl);
0716 void gnutls_x509_crl_deinit(gnutls_x509_crl_t crl);
0717
0718 int gnutls_x509_crl_import(gnutls_x509_crl_t crl, const gnutls_datum_t *data,
0719                gnutls_x509_crt_fmt_t format);
0720 int gnutls_x509_crl_export(gnutls_x509_crl_t crl, gnutls_x509_crt_fmt_t format,
0721                void *output_data, size_t *output_data_size);
0722 int gnutls_x509_crl_export2(gnutls_x509_crl_t crl, gnutls_x509_crt_fmt_t format,
0723                 gnutls_datum_t *out);
0724
0725 int gnutls_x509_crl_get_raw_issuer_dn(gnutls_x509_crl_t crl,
0726                       gnutls_datum_t *dn);
0727
0728 int gnutls_x509_crl_get_issuer_dn(gnutls_x509_crl_t crl, char *buf,
0729                   size_t *sizeof_buf);
0730 int gnutls_x509_crl_get_issuer_dn2(gnutls_x509_crl_t crl, gnutls_datum_t *dn);
0731 int gnutls_x509_crl_get_issuer_dn3(gnutls_x509_crl_t crl, gnutls_datum_t *dn,
0732                    unsigned flags);
0733
0734 int gnutls_x509_crl_get_issuer_dn_by_oid(gnutls_x509_crl_t crl, const char *oid,
0735                      unsigned indx, unsigned int raw_flag,
0736                      void *buf, size_t *sizeof_buf);
0737 int gnutls_x509_crl_get_dn_oid(gnutls_x509_crl_t crl, unsigned indx, void *oid,
0738                    size_t *sizeof_oid);
0739
0740 int gnutls_x509_crl_get_signature_algorithm(gnutls_x509_crl_t crl);
0741 int gnutls_x509_crl_get_signature(gnutls_x509_crl_t crl, char *sig,
0742                   size_t *sizeof_sig);
0743 int gnutls_x509_crl_get_version(gnutls_x509_crl_t crl);
0744
0745 int gnutls_x509_crl_get_signature_oid(gnutls_x509_crl_t crl, char *oid,
0746                       size_t *oid_size);
0747
0748 time_t gnutls_x509_crl_get_this_update(gnutls_x509_crl_t crl);
0749 time_t gnutls_x509_crl_get_next_update(gnutls_x509_crl_t crl);
0750
0751 int gnutls_x509_crl_get_crt_count(gnutls_x509_crl_t crl);
0752 int gnutls_x509_crl_get_crt_serial(gnutls_x509_crl_t crl, unsigned indx,
0753                    unsigned char *serial, size_t *serial_size,
0754                    time_t *t);
0755
0756 typedef struct gnutls_x509_crl_iter *gnutls_x509_crl_iter_t;
0757
0758 int gnutls_x509_crl_iter_crt_serial(gnutls_x509_crl_t crl,
0759                     gnutls_x509_crl_iter_t *,
0760                     unsigned char *serial, size_t *serial_size,
0761                     time_t *t);
0762
0763 void gnutls_x509_crl_iter_deinit(gnutls_x509_crl_iter_t);
0764
0765 #define gnutls_x509_crl_get_certificate_count gnutls_x509_crl_get_crt_count
0766 #define gnutls_x509_crl_get_certificate gnutls_x509_crl_get_crt_serial
0767
0768 unsigned gnutls_x509_crl_check_issuer(gnutls_x509_crl_t crl,
0769                       gnutls_x509_crt_t issuer);
0770
0771 int gnutls_x509_crl_list_import2(gnutls_x509_crl_t **crls, unsigned int *size,
0772                  const gnutls_datum_t *data,
0773                  gnutls_x509_crt_fmt_t format,
0774                  unsigned int flags);
0775
0776 int gnutls_x509_crl_list_import(gnutls_x509_crl_t *crls, unsigned int *crl_max,
0777                 const gnutls_datum_t *data,
0778                 gnutls_x509_crt_fmt_t format,
0779                 unsigned int flags);
0780 /* CRL writing.
0781  */
0782 int gnutls_x509_crl_set_version(gnutls_x509_crl_t crl, unsigned int version);
0783 int gnutls_x509_crl_set_this_update(gnutls_x509_crl_t crl, time_t act_time);
0784 int gnutls_x509_crl_set_next_update(gnutls_x509_crl_t crl, time_t exp_time);
0785 int gnutls_x509_crl_set_crt_serial(gnutls_x509_crl_t crl, const void *serial,
0786                    size_t serial_size, time_t revocation_time);
0787 int gnutls_x509_crl_set_crt(gnutls_x509_crl_t crl, gnutls_x509_crt_t crt,
0788                 time_t revocation_time);
0789
0790 int gnutls_x509_crl_get_authority_key_id(gnutls_x509_crl_t crl, void *id,
0791                      size_t *id_size,
0792                      unsigned int *critical);
0793 int gnutls_x509_crl_get_authority_key_gn_serial(
0794     gnutls_x509_crl_t crl, unsigned int seq, void *alt, size_t *alt_size,
0795     unsigned int *alt_type, void *serial, size_t *serial_size,
0796     unsigned int *critical);
0797
0798 int gnutls_x509_crl_get_number(gnutls_x509_crl_t crl, void *ret,
0799                    size_t *ret_size, unsigned int *critical);
0800
0801 int gnutls_x509_crl_get_extension_oid(gnutls_x509_crl_t crl, unsigned indx,
0802                       void *oid, size_t *sizeof_oid);
0803
0804 int gnutls_x509_crl_get_extension_info(gnutls_x509_crl_t crl, unsigned indx,
0805                        void *oid, size_t *sizeof_oid,
0806                        unsigned int *critical);
0807
0808 int gnutls_x509_crl_get_extension_data(gnutls_x509_crl_t crl, unsigned indx,
0809                        void *data, size_t *sizeof_data);
0810 int gnutls_x509_crl_get_extension_data2(gnutls_x509_crl_t crl, unsigned indx,
0811                     gnutls_datum_t *data);
0812
0813 int gnutls_x509_crl_set_authority_key_id(gnutls_x509_crl_t crl, const void *id,
0814                      size_t id_size);
0815
0816 int gnutls_x509_crl_set_number(gnutls_x509_crl_t crl, const void *nr,
0817                    size_t nr_size);
0818
0819 /* X.509 Certificate verification functions.
0820  */
0821
0822 /**
0823  * gnutls_certificate_verify_flags:
0824  * @GNUTLS_VERIFY_DISABLE_CA_SIGN: If set a signer does not have to be
0825  *   a certificate authority. This flag should normally be disabled,
0826  *   unless you know what this means.
0827  * @GNUTLS_VERIFY_DISABLE_TRUSTED_TIME_CHECKS: If set a signer in the trusted
0828  *   list is never checked for expiration or activation.
0829  * @GNUTLS_VERIFY_DO_NOT_ALLOW_X509_V1_CA_CRT: Do not allow trusted CA
0830  *   certificates that have version 1.  This option is to be used
0831  *   to deprecate all certificates of version 1.
0832  * @GNUTLS_VERIFY_DO_NOT_ALLOW_SAME: If a certificate is not signed by
0833  *   anyone trusted but exists in the trusted CA list do not treat it
0834  *   as trusted.
0835  * @GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN: A certificate chain is tolerated
0836  *   if unsorted (the case with many TLS servers out there). This is the
0837  *   default since GnuTLS 3.1.4.
0838  * @GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Do not tolerate an unsorted
0839  *   certificate chain.
0840  * @GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT: Allow CA certificates that
0841  *   have version 1 (both root and intermediate). This might be
0842  *   dangerous since those haven't the basicConstraints
0843  *   extension.
0844  * @GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD2: Allow certificates to be signed
0845  *   using the broken MD2 algorithm.
0846  * @GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD5: Allow certificates to be signed
0847  *   using the broken MD5 algorithm.
0848  * @GNUTLS_VERIFY_ALLOW_SIGN_WITH_SHA1: Allow certificates to be signed
0849  *   using the broken SHA1 hash algorithm.
0850  * @GNUTLS_VERIFY_ALLOW_BROKEN: Allow certificates to be signed
0851  *   using any broken algorithm.
0852  * @GNUTLS_VERIFY_DISABLE_TIME_CHECKS: Disable checking of activation
0853  *   and expiration validity periods of certificate chains. Don't set
0854  *   this unless you understand the security implications.
0855  * @GNUTLS_VERIFY_DISABLE_CRL_CHECKS: Disable checking for validity
0856  *   using certificate revocation lists or the available OCSP data.
0857  * @GNUTLS_VERIFY_DO_NOT_ALLOW_WILDCARDS: When including a hostname
0858  *   check in the verification, do not consider any wildcards.
0859  * @GNUTLS_VERIFY_DO_NOT_ALLOW_IP_MATCHES: When verifying a hostname
0860  *   prevent textual IP addresses from matching IP addresses in the
0861  *   certificate. Treat the input only as a DNS name.
0862  * @GNUTLS_VERIFY_USE_TLS1_RSA: This indicates that a (raw) RSA signature is provided
0863  *   as in the TLS 1.0 protocol. Not all functions accept this flag.
0864  * @GNUTLS_VERIFY_IGNORE_UNKNOWN_CRIT_EXTENSIONS: This signals the verification
0865  *   process, not to fail on unknown critical extensions.
0866  * @GNUTLS_VERIFY_RSA_PSS_FIXED_SALT_LENGTH: Disallow RSA-PSS signatures made
0867  *   with mismatching salt length with digest length, as mandated in RFC 8446
0868  *   4.2.3.
0869  *
0870  * Enumeration of different certificate verify flags. Additional
0871  * verification profiles can be set using GNUTLS_PROFILE_TO_VFLAGS()
0872  * and %gnutls_certificate_verification_profiles_t.
0873  */
0874 typedef enum gnutls_certificate_verify_flags {
0875     GNUTLS_VERIFY_DISABLE_CA_SIGN = 1 << 0,
0876     GNUTLS_VERIFY_DO_NOT_ALLOW_IP_MATCHES = 1 << 1,
0877     GNUTLS_VERIFY_DO_NOT_ALLOW_SAME = 1 << 2,
0878     GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT = 1 << 3,
0879     GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD2 = 1 << 4,
0880     GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD5 = 1 << 5,
0881     GNUTLS_VERIFY_DISABLE_TIME_CHECKS = 1 << 6,
0882     GNUTLS_VERIFY_DISABLE_TRUSTED_TIME_CHECKS = 1 << 7,
0883     GNUTLS_VERIFY_DO_NOT_ALLOW_X509_V1_CA_CRT = 1 << 8,
0884     GNUTLS_VERIFY_DISABLE_CRL_CHECKS = 1 << 9,
0885     GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN = 1 << 10,
0886     GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN = 1 << 11,
0887     GNUTLS_VERIFY_DO_NOT_ALLOW_WILDCARDS = 1 << 12,
0888     GNUTLS_VERIFY_USE_TLS1_RSA = 1 << 13,
0889     GNUTLS_VERIFY_IGNORE_UNKNOWN_CRIT_EXTENSIONS = 1 << 14,
0890     GNUTLS_VERIFY_ALLOW_SIGN_WITH_SHA1 = 1 << 15,
0891     GNUTLS_VERIFY_RSA_PSS_FIXED_SALT_LENGTH = 1 << 16
0892     /* cannot exceed 2^24 due to GNUTLS_PROFILE_TO_VFLAGS() */
0893 } gnutls_certificate_verify_flags;
0894
0895 #define GNUTLS_VERIFY_ALLOW_BROKEN \
0896     (GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD2 | GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD5)
0897
0898 /**
0899  * gnutls_certificate_verification_profiles_t:
0900  * @GNUTLS_PROFILE_UNKNOWN: An invalid/unknown profile.
0901  * @GNUTLS_PROFILE_VERY_WEAK: A verification profile that
0902  *  corresponds to @GNUTLS_SEC_PARAM_VERY_WEAK (64 bits)
0903  * @GNUTLS_PROFILE_LOW: A verification profile that
0904  *  corresponds to @GNUTLS_SEC_PARAM_LOW (80 bits)
0905  * @GNUTLS_PROFILE_LEGACY: A verification profile that
0906  *  corresponds to @GNUTLS_SEC_PARAM_LEGACY (96 bits)
0907  * @GNUTLS_PROFILE_MEDIUM: A verification profile that
0908  *  corresponds to @GNUTLS_SEC_PARAM_MEDIUM (112 bits)
0909  * @GNUTLS_PROFILE_HIGH: A verification profile that
0910  *  corresponds to @GNUTLS_SEC_PARAM_HIGH (128 bits)
0911  * @GNUTLS_PROFILE_ULTRA: A verification profile that
0912  *  corresponds to @GNUTLS_SEC_PARAM_ULTRA (192 bits)
0913  * @GNUTLS_PROFILE_FUTURE: A verification profile that
0914  *  corresponds to @GNUTLS_SEC_PARAM_FUTURE (256 bits)
0915  * @GNUTLS_PROFILE_SUITEB128: A verification profile that
0916  *  applies the SUITEB128 rules
0917  * @GNUTLS_PROFILE_SUITEB192: A verification profile that
0918  *  applies the SUITEB192 rules
0919  *
0920  * Enumeration of different certificate verification profiles.
0921  */
0922 typedef enum gnutls_certificate_verification_profiles_t {
0923     GNUTLS_PROFILE_UNKNOWN = 0,
0924     GNUTLS_PROFILE_VERY_WEAK = 1,
0925     GNUTLS_PROFILE_LOW = 2,
0926     GNUTLS_PROFILE_LEGACY = 4,
0927     GNUTLS_PROFILE_MEDIUM = 5,
0928     GNUTLS_PROFILE_HIGH = 6,
0929     GNUTLS_PROFILE_ULTRA = 7,
0930     GNUTLS_PROFILE_FUTURE = 8,
0931
0932     GNUTLS_PROFILE_SUITEB128 = 32,
0933     GNUTLS_PROFILE_SUITEB192 = 33
0934     /*GNUTLS_PROFILE_MAX=255 */
0935 } gnutls_certificate_verification_profiles_t;
0936
0937 #define GNUTLS_PROFILE_TO_VFLAGS(x) (((unsigned)x) << 24)
0938
0939 #define GNUTLS_VFLAGS_PROFILE_MASK (0xff000000)
0940
0941 #define GNUTLS_VFLAGS_TO_PROFILE(x) ((((unsigned)x) >> 24) & 0xff)
0942
0943 const char *gnutls_certificate_verification_profile_get_name(
0944     gnutls_certificate_verification_profiles_t id) __GNUTLS_CONST__;
0945 gnutls_certificate_verification_profiles_t
0946 gnutls_certificate_verification_profile_get_id(const char *name)
0947     __GNUTLS_CONST__;
0948
0949 unsigned gnutls_x509_crt_check_issuer(gnutls_x509_crt_t cert,
0950                       gnutls_x509_crt_t issuer);
0951
0952 int gnutls_x509_crt_list_verify(const gnutls_x509_crt_t *cert_list,
0953                 unsigned cert_list_length,
0954                 const gnutls_x509_crt_t *CA_list,
0955                 unsigned CA_list_length,
0956                 const gnutls_x509_crl_t *CRL_list,
0957                 unsigned CRL_list_length, unsigned int flags,
0958                 unsigned int *verify);
0959
0960 int gnutls_x509_crt_verify(gnutls_x509_crt_t cert,
0961                const gnutls_x509_crt_t *CA_list,
0962                unsigned CA_list_length, unsigned int flags,
0963                unsigned int *verify);
0964 int gnutls_x509_crl_verify(gnutls_x509_crl_t crl,
0965                const gnutls_x509_crt_t *CA_list,
0966                unsigned CA_list_length, unsigned int flags,
0967                unsigned int *verify);
0968
0969 int gnutls_x509_crt_verify_data2(gnutls_x509_crt_t crt,
0970                  gnutls_sign_algorithm_t algo,
0971                  unsigned int flags, const gnutls_datum_t *data,
0972                  const gnutls_datum_t *signature);
0973
0974 int gnutls_x509_crt_check_revocation(gnutls_x509_crt_t cert,
0975                      const gnutls_x509_crl_t *crl_list,
0976                      unsigned crl_list_length);
0977
0978 int gnutls_x509_crt_get_fingerprint(gnutls_x509_crt_t cert,
0979                     gnutls_digest_algorithm_t algo, void *buf,
0980                     size_t *buf_size);
0981
0982 int gnutls_x509_crt_get_key_purpose_oid(gnutls_x509_crt_t cert, unsigned indx,
0983                     void *oid, size_t *oid_size,
0984                     unsigned int *critical);
0985 int gnutls_x509_crt_set_key_purpose_oid(gnutls_x509_crt_t cert, const void *oid,
0986                     unsigned int critical);
0987
0988 unsigned gnutls_x509_crt_check_key_purpose(gnutls_x509_crt_t cert,
0989                        const char *purpose, unsigned flags);
0990
0991 /* Private key handling.
0992  */
0993
0994 /* Flags for the gnutls_x509_privkey_export_pkcs8() function.
0995  */
0996
0997 #define GNUTLS_PKCS8_PLAIN GNUTLS_PKCS_PLAIN
0998 #define GNUTLS_PKCS8_USE_PKCS12_3DES GNUTLS_PKCS_PKCS12_3DES
0999 #define GNUTLS_PKCS8_USE_PKCS12_ARCFOUR GNUTLS_PKCS_PKCS12_ARCFOUR
1000 #define GNUTLS_PKCS8_USE_PKCS12_RC2_40 GNUTLS_PKCS_PKCS12_RC2_40
1001
1002 /**
1003  * gnutls_pkcs_encrypt_flags_t:
1004  * @GNUTLS_PKCS_PLAIN: Unencrypted private key.
1005  * @GNUTLS_PKCS_NULL_PASSWORD: Some schemas distinguish between an empty and a NULL password.
1006  * @GNUTLS_PKCS_PKCS12_3DES: PKCS-12 3DES.
1007  * @GNUTLS_PKCS_PKCS12_ARCFOUR: PKCS-12 ARCFOUR.
1008  * @GNUTLS_PKCS_PKCS12_RC2_40: PKCS-12 RC2-40.
1009  * @GNUTLS_PKCS_PBES2_3DES: PBES2 3DES.
1010  * @GNUTLS_PKCS_PBES2_AES_128: PBES2 AES-128.
1011  * @GNUTLS_PKCS_PBES2_AES_192: PBES2 AES-192.
1012  * @GNUTLS_PKCS_PBES2_AES_256: PBES2 AES-256.
1013  * @GNUTLS_PKCS_PBES2_DES: PBES2 single DES.
1014  * @GNUTLS_PKCS_PBES1_DES_MD5: PBES1 with single DES; for compatibility with openssl only.
1015  * @GNUTLS_PKCS_PBES1_DES_SHA1: PBES1 with single DES; for compatibility purposes only.
1016  * @GNUTLS_PKCS_PBES2_GOST_TC26Z: PBES2 GOST 28147-89 CFB with TC26-Z S-box.
1017  * @GNUTLS_PKCS_PBES2_GOST_CPA: PBES2 GOST 28147-89 CFB with CryptoPro-A S-box.
1018  * @GNUTLS_PKCS_PBES2_GOST_CPB: PBES2 GOST 28147-89 CFB with CryptoPro-B S-box.
1019  * @GNUTLS_PKCS_PBES2_GOST_CPC: PBES2 GOST 28147-89 CFB with CryptoPro-C S-box.
1020  * @GNUTLS_PKCS_PBES2_GOST_CPD: PBES2 GOST 28147-89 CFB with CryptoPro-D S-box.
1021  * @GNUTLS_PKCS_MLDSA_SEED: Emit seed as an ML-DSA private key.
1022  * @GNUTLS_PKCS_MLDSA_EXPANDED: Emit an expanded ML-DSA private key.
1023  *
1024  * Enumeration of different PKCS encryption flags.
1025  */
1026 typedef enum gnutls_pkcs_encrypt_flags_t {
1027     GNUTLS_PKCS_PLAIN = 1,
1028     GNUTLS_PKCS_PKCS12_3DES = 1 << 1,
1029     GNUTLS_PKCS_PKCS12_ARCFOUR = 1 << 2,
1030     GNUTLS_PKCS_PKCS12_RC2_40 = 1 << 3,
1031     GNUTLS_PKCS_PBES2_3DES = 1 << 4,
1032     GNUTLS_PKCS_PBES2_AES_128 = 1 << 5,
1033     GNUTLS_PKCS_PBES2_AES_192 = 1 << 6,
1034     GNUTLS_PKCS_PBES2_AES_256 = 1 << 7,
1035     GNUTLS_PKCS_NULL_PASSWORD = 1 << 8,
1036     GNUTLS_PKCS_PBES2_DES = 1 << 9,
1037     GNUTLS_PKCS_PBES1_DES_MD5 = 1 << 10,
1038     GNUTLS_PKCS_PBES2_GOST_TC26Z = 1 << 11,
1039     GNUTLS_PKCS_PBES2_GOST_CPA = 1 << 12,
1040     GNUTLS_PKCS_PBES2_GOST_CPB = 1 << 13,
1041     GNUTLS_PKCS_PBES2_GOST_CPC = 1 << 14,
1042     GNUTLS_PKCS_PBES2_GOST_CPD = 1 << 15,
1043     GNUTLS_PKCS_PBES1_DES_SHA1 = 1 << 16,
1044     GNUTLS_PKCS_MLDSA_SEED = 1 << 17,
1045     GNUTLS_PKCS_MLDSA_EXPANDED = 1 << 18,
1046 } gnutls_pkcs_encrypt_flags_t;
1047
1048 #define GNUTLS_PKCS_CIPHER_MASK(x) ((x) & (~(GNUTLS_PKCS_NULL_PASSWORD)))
1049
1050 #define GNUTLS_PKCS_USE_PKCS12_3DES GNUTLS_PKCS_PKCS12_3DES
1051 #define GNUTLS_PKCS_USE_PKCS12_ARCFOUR GNUTLS_PKCS_PKCS12_ARCFOUR
1052 #define GNUTLS_PKCS_USE_PKCS12_RC2_40 GNUTLS_PKCS_PKCS12_RC2_40
1053 #define GNUTLS_PKCS_USE_PBES2_3DES GNUTLS_PKCS_PBES2_3DES
1054 #define GNUTLS_PKCS_USE_PBES2_AES_128 GNUTLS_PKCS_PBES2_AES_128
1055 #define GNUTLS_PKCS_USE_PBES2_AES_192 GNUTLS_PKCS_PBES2_AES_192
1056 #define GNUTLS_PKCS_USE_PBES2_AES_256 GNUTLS_PKCS_PBES2_AES_256
1057 #define GNUTLS_PKCS_USE_PBES2_GOST_TC26Z GNUTLS_PKCS_PBES2_GOST_TC26Z
1058 #define GNUTLS_PKCS_USE_PBES2_GOST_CPA GNUTLS_PKCS_PBES2_GOST_CPA
1059 #define GNUTLS_PKCS_USE_PBES2_GOST_CPB GNUTLS_PKCS_PBES2_GOST_CPB
1060 #define GNUTLS_PKCS_USE_PBES2_GOST_CPC GNUTLS_PKCS_PBES2_GOST_CPC
1061 #define GNUTLS_PKCS_USE_PBES2_GOST_CPD GNUTLS_PKCS_PBES2_GOST_CPD
1062
1063 const char *gnutls_pkcs_schema_get_name(unsigned int schema);
1064 const char *gnutls_pkcs_schema_get_oid(unsigned int schema);
1065
1066 int gnutls_x509_privkey_init(gnutls_x509_privkey_t *key);
1067 void gnutls_x509_privkey_deinit(gnutls_x509_privkey_t key);
1068 gnutls_sec_param_t gnutls_x509_privkey_sec_param(gnutls_x509_privkey_t key);
1069
1070 void gnutls_x509_privkey_set_pin_function(gnutls_x509_privkey_t key,
1071                       gnutls_pin_callback_t fn,
1072                       void *userdata);
1073
1074 int gnutls_x509_privkey_cpy(gnutls_x509_privkey_t dst,
1075                 gnutls_x509_privkey_t src);
1076 int gnutls_x509_privkey_import(gnutls_x509_privkey_t key,
1077                    const gnutls_datum_t *data,
1078                    gnutls_x509_crt_fmt_t format);
1079 int gnutls_x509_privkey_import_pkcs8(gnutls_x509_privkey_t key,
1080                      const gnutls_datum_t *data,
1081                      gnutls_x509_crt_fmt_t format,
1082                      const char *password, unsigned int flags);
1083 int gnutls_x509_privkey_import_openssl(gnutls_x509_privkey_t key,
1084                        const gnutls_datum_t *data,
1085                        const char *password);
1086
1087 int gnutls_pkcs8_info(const gnutls_datum_t *data, gnutls_x509_crt_fmt_t format,
1088               unsigned int *schema, unsigned int *cipher, void *salt,
1089               unsigned int *salt_size, unsigned int *iter_count,
1090               char **oid);
1091
1092 int gnutls_x509_privkey_import2(gnutls_x509_privkey_t key,
1093                 const gnutls_datum_t *data,
1094                 gnutls_x509_crt_fmt_t format,
1095                 const char *password, unsigned int flags);
1096
1097 int gnutls_x509_privkey_import_rsa_raw(gnutls_x509_privkey_t key,
1098                        const gnutls_datum_t *m,
1099                        const gnutls_datum_t *e,
1100                        const gnutls_datum_t *d,
1101                        const gnutls_datum_t *p,
1102                        const gnutls_datum_t *q,
1103                        const gnutls_datum_t *u);
1104 int gnutls_x509_privkey_import_rsa_raw2(
1105     gnutls_x509_privkey_t key, const gnutls_datum_t *m,
1106     const gnutls_datum_t *e, const gnutls_datum_t *d,
1107     const gnutls_datum_t *p, const gnutls_datum_t *q,
1108     const gnutls_datum_t *u, const gnutls_datum_t *e1,
1109     const gnutls_datum_t *e2);
1110 int gnutls_x509_privkey_import_ecc_raw(gnutls_x509_privkey_t key,
1111                        gnutls_ecc_curve_t curve,
1112                        const gnutls_datum_t *x,
1113                        const gnutls_datum_t *y,
1114                        const gnutls_datum_t *k);
1115 int gnutls_x509_privkey_import_gost_raw(gnutls_x509_privkey_t key,
1116                     gnutls_ecc_curve_t curve,
1117                     gnutls_digest_algorithm_t digest,
1118                     gnutls_gost_paramset_t paramset,
1119                     const gnutls_datum_t *x,
1120                     const gnutls_datum_t *y,
1121                     const gnutls_datum_t *k);
1122
1123 int gnutls_x509_privkey_fix(gnutls_x509_privkey_t key);
1124
1125 int gnutls_x509_privkey_export_dsa_raw(gnutls_x509_privkey_t key,
1126                        gnutls_datum_t *p, gnutls_datum_t *q,
1127                        gnutls_datum_t *g, gnutls_datum_t *y,
1128                        gnutls_datum_t *x);
1129 int gnutls_x509_privkey_import_dsa_raw(gnutls_x509_privkey_t key,
1130                        const gnutls_datum_t *p,
1131                        const gnutls_datum_t *q,
1132                        const gnutls_datum_t *g,
1133                        const gnutls_datum_t *y,
1134                        const gnutls_datum_t *x);
1135 int gnutls_x509_privkey_import_dh_raw(gnutls_x509_privkey_t key,
1136                       const gnutls_dh_params_t params,
1137                       const gnutls_datum_t *y,
1138                       const gnutls_datum_t *x);
1139
1140 int gnutls_x509_privkey_get_pk_algorithm(gnutls_x509_privkey_t key);
1141 int gnutls_x509_privkey_get_pk_algorithm2(gnutls_x509_privkey_t key,
1142                       unsigned int *bits);
1143 int gnutls_x509_privkey_get_spki(gnutls_x509_privkey_t key,
1144                  gnutls_x509_spki_t spki, unsigned int flags);
1145 int gnutls_x509_privkey_set_spki(gnutls_x509_privkey_t key,
1146                  const gnutls_x509_spki_t spki,
1147                  unsigned int flags);
1148
1149 int gnutls_x509_privkey_get_key_id(gnutls_x509_privkey_t key,
1150                    unsigned int flags,
1151                    unsigned char *output_data,
1152                    size_t *output_data_size);
1153
1154 int gnutls_x509_privkey_generate(gnutls_x509_privkey_t key,
1155                  gnutls_pk_algorithm_t algo, unsigned int bits,
1156                  unsigned int flags);
1157
1158 void gnutls_x509_privkey_set_flags(gnutls_x509_privkey_t key,
1159                    unsigned int flags);
1160
1161 /**
1162  * gnutls_keygen_types_t:
1163  * @GNUTLS_KEYGEN_SEED: Specifies the seed to be used in key generation.
1164  * @GNUTLS_KEYGEN_DIGEST: The size field specifies the hash algorithm to be used in key generation.
1165  * @GNUTLS_KEYGEN_SPKI: data points to a %gnutls_x509_spki_t structure; it is not used after the key generation call.
1166  * @GNUTLS_KEYGEN_DH: data points to a %gnutls_dh_params_t structure; it is not used after the key generation call.
1167  *
1168  * Enumeration of different key generation data options.
1169  */
1170 typedef enum {
1171     GNUTLS_KEYGEN_SEED = 1,
1172     GNUTLS_KEYGEN_DIGEST = 2,
1173     GNUTLS_KEYGEN_SPKI = 3,
1174     GNUTLS_KEYGEN_DH = 4
1175 } gnutls_keygen_types_t;
1176
1177 typedef struct {
1178     gnutls_keygen_types_t type;
1179     unsigned char *data;
1180     unsigned int size;
1181 } gnutls_keygen_data_st;
1182
1183 int gnutls_x509_privkey_generate2(gnutls_x509_privkey_t key,
1184                   gnutls_pk_algorithm_t algo, unsigned int bits,
1185                   unsigned int flags,
1186                   const gnutls_keygen_data_st *data,
1187                   unsigned data_size);
1188
1189 int gnutls_x509_privkey_verify_seed(gnutls_x509_privkey_t key,
1190                     gnutls_digest_algorithm_t, const void *seed,
1191                     size_t seed_size);
1192 int gnutls_x509_privkey_get_seed(gnutls_x509_privkey_t key,
1193                  gnutls_digest_algorithm_t *, void *seed,
1194                  size_t *seed_size);
1195
1196 int gnutls_x509_privkey_verify_params(gnutls_x509_privkey_t key);
1197
1198 int gnutls_x509_privkey_export(gnutls_x509_privkey_t key,
1199                    gnutls_x509_crt_fmt_t format, void *output_data,
1200                    size_t *output_data_size);
1201 int gnutls_x509_privkey_export2(gnutls_x509_privkey_t key,
1202                 gnutls_x509_crt_fmt_t format,
1203                 gnutls_datum_t *out);
1204 int gnutls_x509_privkey_export_pkcs8(gnutls_x509_privkey_t key,
1205                      gnutls_x509_crt_fmt_t format,
1206                      const char *password, unsigned int flags,
1207                      void *output_data,
1208                      size_t *output_data_size);
1209 int gnutls_x509_privkey_export2_pkcs8(gnutls_x509_privkey_t key,
1210                       gnutls_x509_crt_fmt_t format,
1211                       const char *password, unsigned int flags,
1212                       gnutls_datum_t *out);
1213 int gnutls_x509_privkey_export_rsa_raw2(gnutls_x509_privkey_t key,
1214                     gnutls_datum_t *m, gnutls_datum_t *e,
1215                     gnutls_datum_t *d, gnutls_datum_t *p,
1216                     gnutls_datum_t *q, gnutls_datum_t *u,
1217                     gnutls_datum_t *e1, gnutls_datum_t *e2);
1218 int gnutls_x509_privkey_export_rsa_raw(gnutls_x509_privkey_t key,
1219                        gnutls_datum_t *m, gnutls_datum_t *e,
1220                        gnutls_datum_t *d, gnutls_datum_t *p,
1221                        gnutls_datum_t *q, gnutls_datum_t *u);
1222 int gnutls_x509_privkey_export_ecc_raw(gnutls_x509_privkey_t key,
1223                        gnutls_ecc_curve_t *curve,
1224                        gnutls_datum_t *x, gnutls_datum_t *y,
1225                        gnutls_datum_t *k);
1226 int gnutls_x509_privkey_export_gost_raw(gnutls_x509_privkey_t key,
1227                     gnutls_ecc_curve_t *curve,
1228                     gnutls_digest_algorithm_t *digest,
1229                     gnutls_gost_paramset_t *paramset,
1230                     gnutls_datum_t *x, gnutls_datum_t *y,
1231                     gnutls_datum_t *k);
1232
1233 int gnutls_x509_privkey_sign_data(gnutls_x509_privkey_t key,
1234                   gnutls_digest_algorithm_t digest,
1235                   unsigned int flags,
1236                   const gnutls_datum_t *data, void *signature,
1237                   size_t *signature_size);
1238
1239 /* Certificate request stuff.
1240  */
1241 int gnutls_x509_crq_sign(gnutls_x509_crq_t crq, gnutls_x509_privkey_t key);
1242
1243 int gnutls_x509_crq_sign2(gnutls_x509_crq_t crq, gnutls_x509_privkey_t key,
1244               gnutls_digest_algorithm_t dig, unsigned int flags);
1245
1246 int gnutls_x509_crq_print(gnutls_x509_crq_t crq,
1247               gnutls_certificate_print_formats_t format,
1248               gnutls_datum_t *out);
1249
1250 int gnutls_x509_crq_verify(gnutls_x509_crq_t crq, unsigned int flags);
1251
1252 int gnutls_x509_crq_init(gnutls_x509_crq_t *crq);
1253 void gnutls_x509_crq_deinit(gnutls_x509_crq_t crq);
1254 int gnutls_x509_crq_import(gnutls_x509_crq_t crq, const gnutls_datum_t *data,
1255                gnutls_x509_crt_fmt_t format);
1256
1257 int gnutls_x509_crq_get_private_key_usage_period(gnutls_x509_crq_t cert,
1258                          time_t *activation,
1259                          time_t *expiration,
1260                          unsigned int *critical);
1261
1262 int gnutls_x509_crq_get_dn(gnutls_x509_crq_t crq, char *buf,
1263                size_t *sizeof_buf);
1264 int gnutls_x509_crq_get_dn2(gnutls_x509_crq_t crq, gnutls_datum_t *dn);
1265 int gnutls_x509_crq_get_dn3(gnutls_x509_crq_t crq, gnutls_datum_t *dn,
1266                 unsigned flags);
1267 int gnutls_x509_crq_get_dn_oid(gnutls_x509_crq_t crq, unsigned indx, void *oid,
1268                    size_t *sizeof_oid);
1269 int gnutls_x509_crq_get_dn_by_oid(gnutls_x509_crq_t crq, const char *oid,
1270                   unsigned indx, unsigned int raw_flag,
1271                   void *buf, size_t *sizeof_buf);
1272 int gnutls_x509_crq_set_dn(gnutls_x509_crq_t crq, const char *dn,
1273                const char **err);
1274 int gnutls_x509_crq_set_dn_by_oid(gnutls_x509_crq_t crq, const char *oid,
1275                   unsigned int raw_flag, const void *data,
1276                   unsigned int sizeof_data);
1277 int gnutls_x509_crq_set_version(gnutls_x509_crq_t crq, unsigned int version);
1278 int gnutls_x509_crq_get_version(gnutls_x509_crq_t crq);
1279 int gnutls_x509_crq_set_key(gnutls_x509_crq_t crq, gnutls_x509_privkey_t key);
1280
1281 int gnutls_x509_crq_set_extension_by_oid(gnutls_x509_crq_t crq, const char *oid,
1282                      const void *buf, size_t sizeof_buf,
1283                      unsigned int critical);
1284
1285 int gnutls_x509_crq_set_challenge_password(gnutls_x509_crq_t crq,
1286                        const char *pass);
1287 int gnutls_x509_crq_get_challenge_password(gnutls_x509_crq_t crq, char *pass,
1288                        size_t *sizeof_pass);
1289
1290 int gnutls_x509_crq_set_attribute_by_oid(gnutls_x509_crq_t crq, const char *oid,
1291                      void *buf, size_t sizeof_buf);
1292 int gnutls_x509_crq_get_attribute_by_oid(gnutls_x509_crq_t crq, const char *oid,
1293                      unsigned indx, void *buf,
1294                      size_t *sizeof_buf);
1295
1296 int gnutls_x509_crq_export(gnutls_x509_crq_t crq, gnutls_x509_crt_fmt_t format,
1297                void *output_data, size_t *output_data_size);
1298 int gnutls_x509_crq_export2(gnutls_x509_crq_t crq, gnutls_x509_crt_fmt_t format,
1299                 gnutls_datum_t *out);
1300
1301 int gnutls_x509_crt_set_crq(gnutls_x509_crt_t crt, gnutls_x509_crq_t crq);
1302 int gnutls_x509_crt_set_crq_extensions(gnutls_x509_crt_t crt,
1303                        gnutls_x509_crq_t crq);
1304
1305 int gnutls_x509_crt_set_crq_extension_by_oid(gnutls_x509_crt_t crt,
1306                          gnutls_x509_crq_t crq,
1307                          const char *oid, unsigned flags);
1308
1309 int gnutls_x509_crq_set_private_key_usage_period(gnutls_x509_crq_t crq,
1310                          time_t activation,
1311                          time_t expiration);
1312 int gnutls_x509_crq_set_key_rsa_raw(gnutls_x509_crq_t crq,
1313                     const gnutls_datum_t *m,
1314                     const gnutls_datum_t *e);
1315 int gnutls_x509_crq_set_subject_alt_name(gnutls_x509_crq_t crq,
1316                      gnutls_x509_subject_alt_name_t nt,
1317                      const void *data,
1318                      unsigned int data_size,
1319                      unsigned int flags);
1320
1321 int gnutls_x509_crq_set_subject_alt_othername(gnutls_x509_crq_t crq,
1322                           const char *oid, const void *data,
1323                           unsigned int data_size,
1324                           unsigned int flags);
1325
1326 int gnutls_x509_crq_set_key_usage(gnutls_x509_crq_t crq, unsigned int usage);
1327 int gnutls_x509_crq_set_basic_constraints(gnutls_x509_crq_t crq,
1328                       unsigned int ca,
1329                       int pathLenConstraint);
1330 int gnutls_x509_crq_set_key_purpose_oid(gnutls_x509_crq_t crq, const void *oid,
1331                     unsigned int critical);
1332 int gnutls_x509_crq_get_key_purpose_oid(gnutls_x509_crq_t crq, unsigned indx,
1333                     void *oid, size_t *sizeof_oid,
1334                     unsigned int *critical);
1335
1336 int gnutls_x509_crq_get_extension_data(gnutls_x509_crq_t crq, unsigned indx,
1337                        void *data, size_t *sizeof_data);
1338 int gnutls_x509_crq_get_extension_data2(gnutls_x509_crq_t crq, unsigned indx,
1339                     gnutls_datum_t *data);
1340 int gnutls_x509_crq_get_extension_info(gnutls_x509_crq_t crq, unsigned indx,
1341                        void *oid, size_t *sizeof_oid,
1342                        unsigned int *critical);
1343 int gnutls_x509_crq_get_attribute_data(gnutls_x509_crq_t crq, unsigned indx,
1344                        void *data, size_t *sizeof_data);
1345 int gnutls_x509_crq_get_attribute_info(gnutls_x509_crq_t crq, unsigned indx,
1346                        void *oid, size_t *sizeof_oid);
1347 int gnutls_x509_crq_get_pk_algorithm(gnutls_x509_crq_t crq, unsigned int *bits);
1348 int gnutls_x509_crq_get_spki(gnutls_x509_crq_t crq, gnutls_x509_spki_t spki,
1349                  unsigned int flags);
1350
1351 int gnutls_x509_crq_set_spki(gnutls_x509_crq_t crq,
1352                  const gnutls_x509_spki_t spki, unsigned int flags);
1353
1354 int gnutls_x509_crq_get_signature_oid(gnutls_x509_crq_t crq, char *oid,
1355                       size_t *oid_size);
1356 int gnutls_x509_crq_get_pk_oid(gnutls_x509_crq_t crq, char *oid,
1357                    size_t *oid_size);
1358
1359 int gnutls_x509_crq_get_key_id(gnutls_x509_crq_t crq, unsigned int flags,
1360                    unsigned char *output_data,
1361                    size_t *output_data_size);
1362 int gnutls_x509_crq_get_key_rsa_raw(gnutls_x509_crq_t crq, gnutls_datum_t *m,
1363                     gnutls_datum_t *e);
1364
1365 int gnutls_x509_crq_get_key_usage(gnutls_x509_crq_t crq,
1366                   unsigned int *key_usage,
1367                   unsigned int *critical);
1368 int gnutls_x509_crq_get_basic_constraints(gnutls_x509_crq_t crq,
1369                       unsigned int *critical,
1370                       unsigned int *ca, int *pathlen);
1371 int gnutls_x509_crq_get_subject_alt_name(gnutls_x509_crq_t crq,
1372                      unsigned int seq, void *ret,
1373                      size_t *ret_size,
1374                      unsigned int *ret_type,
1375                      unsigned int *critical);
1376 int gnutls_x509_crq_get_subject_alt_othername_oid(gnutls_x509_crq_t crq,
1377                           unsigned int seq, void *ret,
1378                           size_t *ret_size);
1379
1380 int gnutls_x509_crq_get_extension_by_oid(gnutls_x509_crq_t crq, const char *oid,
1381                      unsigned indx, void *buf,
1382                      size_t *sizeof_buf,
1383                      unsigned int *critical);
1384
1385 int gnutls_x509_crq_get_tlsfeatures(gnutls_x509_crq_t crq,
1386                     gnutls_x509_tlsfeatures_t features,
1387                     unsigned flags, unsigned int *critical);
1388 int gnutls_x509_crq_set_tlsfeatures(gnutls_x509_crq_t crq,
1389                     gnutls_x509_tlsfeatures_t features);
1390
1391 int gnutls_x509_crt_get_extension_by_oid2(gnutls_x509_crt_t cert,
1392                       const char *oid, unsigned indx,
1393                       gnutls_datum_t *output,
1394                       unsigned int *critical);
1395
1396 typedef struct gnutls_x509_trust_list_st *gnutls_x509_trust_list_t;
1397 typedef struct gnutls_x509_trust_list_iter *gnutls_x509_trust_list_iter_t;
1398
1399 int gnutls_x509_trust_list_init(gnutls_x509_trust_list_t *list,
1400                 unsigned int size);
1401
1402 void gnutls_x509_trust_list_deinit(gnutls_x509_trust_list_t list,
1403                    unsigned int all);
1404
1405 int gnutls_x509_trust_list_get_issuer(gnutls_x509_trust_list_t list,
1406                       gnutls_x509_crt_t cert,
1407                       gnutls_x509_crt_t *issuer,
1408                       unsigned int flags);
1409
1410 int gnutls_x509_trust_list_get_issuer_by_dn(gnutls_x509_trust_list_t list,
1411                         const gnutls_datum_t *dn,
1412                         gnutls_x509_crt_t *issuer,
1413                         unsigned int flags);
1414
1415 int gnutls_x509_trust_list_get_issuer_by_subject_key_id(
1416     gnutls_x509_trust_list_t list, const gnutls_datum_t *dn,
1417     const gnutls_datum_t *spki, gnutls_x509_crt_t *issuer,
1418     unsigned int flags);
1419 /**
1420  * gnutls_trust_list_flags_t:
1421  * @GNUTLS_TL_VERIFY_CRL: If any CRLs are provided they will be verified for validity
1422  *   prior to be added. The CA certificates that will be used for verification are the
1423  *   ones already added in the trusted list.
1424  * @GNUTLS_TL_USE_IN_TLS: Internal flag used by GnuTLS. If provided the trust list
1425  *   structure will cache a copy of CA DNs to be used in the certificate request
1426  *   TLS message.
1427  * @GNUTLS_TL_NO_DUPLICATES: If this flag is specified, a function adding certificates
1428  *   will check and eliminate any duplicates.
1429  * @GNUTLS_TL_NO_DUPLICATE_KEY: If this flag is specified, a certificate sharing the
1430  *   same key as a previously added on will not be added.
1431  * @GNUTLS_TL_GET_COPY: The semantics of this flag are documented to the functions which
1432  *   are applicable. In general, on returned value, the function will provide a copy
1433  *   if this flag is provided, rather than a pointer to internal data.
1434  * @GNUTLS_TL_FAIL_ON_INVALID_CRL: If an CRL is added which cannot be validated return
1435  *   an error instead of ignoring (must be used with %GNUTLS_TL_VERIFY_CRL).
1436  *
1437  * Enumeration of different certificate trust list flags.
1438  */
1439 typedef enum gnutls_trust_list_flags_t {
1440     GNUTLS_TL_VERIFY_CRL = 1,
1441 #define GNUTLS_TL_VERIFY_CRL 1
1442     GNUTLS_TL_USE_IN_TLS = (1 << 1),
1443 #define GNUTLS_TL_USE_IN_TLS (1 << 1)
1444     GNUTLS_TL_NO_DUPLICATES = (1 << 2),
1445 #define GNUTLS_TL_NO_DUPLICATES (1 << 2)
1446     GNUTLS_TL_NO_DUPLICATE_KEY = (1 << 3),
1447 #define GNUTLS_TL_NO_DUPLICATE_KEY (1 << 3)
1448     GNUTLS_TL_GET_COPY = (1 << 4),
1449 #define GNUTLS_TL_GET_COPY (1 << 4)
1450     GNUTLS_TL_FAIL_ON_INVALID_CRL = (1 << 5)
1451 #define GNUTLS_TL_FAIL_ON_INVALID_CRL (1 << 5)
1452 } gnutls_trust_list_flags_t;
1453
1454 int gnutls_x509_trust_list_add_cas(gnutls_x509_trust_list_t list,
1455                    const gnutls_x509_crt_t *clist,
1456                    unsigned clist_size, unsigned int flags);
1457 int gnutls_x509_trust_list_remove_cas(gnutls_x509_trust_list_t list,
1458                       const gnutls_x509_crt_t *clist,
1459                       unsigned clist_size);
1460
1461 int gnutls_x509_trust_list_add_named_crt(gnutls_x509_trust_list_t list,
1462                      gnutls_x509_crt_t cert,
1463                      const void *name, size_t name_size,
1464                      unsigned int flags);
1465
1466 int gnutls_x509_trust_list_add_crls(gnutls_x509_trust_list_t list,
1467                     const gnutls_x509_crl_t *crl_list,
1468                     unsigned crl_size, unsigned int flags,
1469                     unsigned int verification_flags);
1470
1471 int gnutls_x509_trust_list_iter_get_ca(gnutls_x509_trust_list_t list,
1472                        gnutls_x509_trust_list_iter_t *iter,
1473                        gnutls_x509_crt_t *crt);
1474
1475 void gnutls_x509_trust_list_iter_deinit(gnutls_x509_trust_list_iter_t iter);
1476
1477 typedef int gnutls_verify_output_function(
1478     gnutls_x509_crt_t cert, gnutls_x509_crt_t issuer,
1479     /* The issuer if verification failed
1480                        * because of him. might be null.
1481                        */
1482     gnutls_x509_crl_t crl, /* The CRL that caused verification failure
1483                                      * if any. Might be null.
1484                                      */
1485     unsigned int verification_output);
1486
1487 void gnutls_session_set_verify_output_function(
1488     gnutls_session_t session, gnutls_verify_output_function *func);
1489
1490 int gnutls_x509_trust_list_verify_named_crt(gnutls_x509_trust_list_t list,
1491                         gnutls_x509_crt_t cert,
1492                         const void *name, size_t name_size,
1493                         unsigned int flags,
1494                         unsigned int *verify,
1495                         gnutls_verify_output_function func);
1496
1497 int gnutls_x509_trust_list_verify_crt2(
1498     gnutls_x509_trust_list_t list, gnutls_x509_crt_t *cert_list,
1499     unsigned int cert_list_size, gnutls_typed_vdata_st *data,
1500     unsigned int elements, unsigned int flags, unsigned int *voutput,
1501     gnutls_verify_output_function func);
1502
1503 int gnutls_x509_trust_list_verify_crt(gnutls_x509_trust_list_t list,
1504                       gnutls_x509_crt_t *cert_list,
1505                       unsigned int cert_list_size,
1506                       unsigned int flags, unsigned int *verify,
1507                       gnutls_verify_output_function func);
1508
1509 /* trust list convenience functions */
1510 int gnutls_x509_trust_list_add_trust_mem(gnutls_x509_trust_list_t list,
1511                      const gnutls_datum_t *cas,
1512                      const gnutls_datum_t *crls,
1513                      gnutls_x509_crt_fmt_t type,
1514                      unsigned int tl_flags,
1515                      unsigned int tl_vflags);
1516
1517 int gnutls_x509_trust_list_add_trust_file(gnutls_x509_trust_list_t list,
1518                       const char *ca_file,
1519                       const char *crl_file,
1520                       gnutls_x509_crt_fmt_t type,
1521                       unsigned int tl_flags,
1522                       unsigned int tl_vflags);
1523
1524 int gnutls_x509_trust_list_add_trust_dir(gnutls_x509_trust_list_t list,
1525                      const char *ca_dir,
1526                      const char *crl_dir,
1527                      gnutls_x509_crt_fmt_t type,
1528                      unsigned int tl_flags,
1529                      unsigned int tl_vflags);
1530
1531 int gnutls_x509_trust_list_remove_trust_file(gnutls_x509_trust_list_t list,
1532                          const char *ca_file,
1533                          gnutls_x509_crt_fmt_t type);
1534
1535 int gnutls_x509_trust_list_remove_trust_mem(gnutls_x509_trust_list_t list,
1536                         const gnutls_datum_t *cas,
1537                         gnutls_x509_crt_fmt_t type);
1538
1539 int gnutls_x509_trust_list_add_system_trust(gnutls_x509_trust_list_t list,
1540                         unsigned int tl_flags,
1541                         unsigned int tl_vflags);
1542
1543 typedef int gnutls_x509_trust_list_getissuer_function(
1544     gnutls_x509_trust_list_t list, const gnutls_x509_crt_t cert,
1545     gnutls_x509_crt_t **issuers, unsigned int *issuers_size);
1546
1547 void gnutls_x509_trust_list_set_getissuer_function(
1548     gnutls_x509_trust_list_t tlist,
1549     gnutls_x509_trust_list_getissuer_function *func);
1550
1551 void gnutls_x509_trust_list_set_ptr(gnutls_x509_trust_list_t tlist, void *ptr);
1552
1553 void *gnutls_x509_trust_list_get_ptr(gnutls_x509_trust_list_t tlist);
1554
1555 void gnutls_certificate_set_trust_list(gnutls_certificate_credentials_t res,
1556                        gnutls_x509_trust_list_t tlist,
1557                        unsigned flags);
1558 void gnutls_certificate_get_trust_list(gnutls_certificate_credentials_t res,
1559                        gnutls_x509_trust_list_t *tlist);
1560
1561 typedef struct gnutls_x509_ext_st {
1562     char *oid;
1563     unsigned int critical;
1564     gnutls_datum_t data;
1565 } gnutls_x509_ext_st;
1566
1567 void gnutls_x509_ext_deinit(gnutls_x509_ext_st *ext);
1568
1569 int gnutls_x509_ext_print(gnutls_x509_ext_st *exts, unsigned int exts_size,
1570               gnutls_certificate_print_formats_t format,
1571               gnutls_datum_t *out);
1572
1573 #include <gnutls/pkcs7.h>
1574
1575 #ifdef __cplusplus
1576 }
1577 #endif
1578
1579 #endif /* GNUTLS_X509_H */