include/gnutls/x509.h

0001 /*
0002  * Copyright (C) 2003-2016 Free Software Foundation, Inc.
0003  * Copyright (C) 2015-2016 Red Hat, Inc.
0004  *
0005  * Author: Nikos Mavrogiannopoulos
0006  *
0007  * This file is part of GnuTLS.
0008  *
0009  * The GnuTLS is free software; you can redistribute it and/or
0010  * modify it under the terms of the GNU Lesser General Public License
0011  * as published by the Free Software Foundation; either version 2.1 of
0012  * the License, or (at your option) any later version.
0013  *
0014  * This library is distributed in the hope that it will be useful, but
0015  * WITHOUT ANY WARRANTY; without even the implied warranty of
0016  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
0017  * Lesser General Public License for more details.
0018  *
0019  * You should have received a copy of the GNU Lesser General Public License
0020  * along with this program.  If not, see <https://www.gnu.org/licenses/>
0021  *
0022  */
0023
0024 /* This file contains the types and prototypes for the X.509
0025  * certificate and CRL handling functions.
0026  */
0027
0028 #ifndef GNUTLS_X509_H
0029 #define GNUTLS_X509_H
0030
0031 #include <gnutls/gnutls.h>
0032
0033 #ifdef __cplusplus
0034 extern "C" {
0035 #endif
0036
0037 /* Some OIDs usually found in Distinguished names, or
0038  * in Subject Directory Attribute extensions.
0039  */
0040 #define GNUTLS_OID_X520_COUNTRY_NAME "2.5.4.6"
0041 #define GNUTLS_OID_X520_ORGANIZATION_NAME "2.5.4.10"
0042 #define GNUTLS_OID_X520_ORGANIZATIONAL_UNIT_NAME "2.5.4.11"
0043 #define GNUTLS_OID_X520_COMMON_NAME "2.5.4.3"
0044 #define GNUTLS_OID_X520_LOCALITY_NAME "2.5.4.7"
0045 #define GNUTLS_OID_X520_STATE_OR_PROVINCE_NAME "2.5.4.8"
0046
0047 #define GNUTLS_OID_X520_INITIALS "2.5.4.43"
0048 #define GNUTLS_OID_X520_GENERATION_QUALIFIER "2.5.4.44"
0049 #define GNUTLS_OID_X520_SURNAME "2.5.4.4"
0050 #define GNUTLS_OID_X520_GIVEN_NAME "2.5.4.42"
0051 #define GNUTLS_OID_X520_TITLE "2.5.4.12"
0052 #define GNUTLS_OID_X520_DN_QUALIFIER "2.5.4.46"
0053 #define GNUTLS_OID_X520_PSEUDONYM "2.5.4.65"
0054 #define GNUTLS_OID_X520_POSTALCODE "2.5.4.17"
0055 #define GNUTLS_OID_X520_NAME "2.5.4.41"
0056
0057 #define GNUTLS_OID_LDAP_DC "0.9.2342.19200300.100.1.25"
0058 #define GNUTLS_OID_LDAP_UID "0.9.2342.19200300.100.1.1"
0059
0060 /* The following should not be included in DN.
0061  */
0062 #define GNUTLS_OID_PKCS9_EMAIL "1.2.840.113549.1.9.1"
0063
0064 #define GNUTLS_OID_PKIX_DATE_OF_BIRTH "1.3.6.1.5.5.7.9.1"
0065 #define GNUTLS_OID_PKIX_PLACE_OF_BIRTH "1.3.6.1.5.5.7.9.2"
0066 #define GNUTLS_OID_PKIX_GENDER "1.3.6.1.5.5.7.9.3"
0067 #define GNUTLS_OID_PKIX_COUNTRY_OF_CITIZENSHIP "1.3.6.1.5.5.7.9.4"
0068 #define GNUTLS_OID_PKIX_COUNTRY_OF_RESIDENCE "1.3.6.1.5.5.7.9.5"
0069
0070 /* Key purpose Object Identifiers.
0071  */
0072 #define GNUTLS_KP_TLS_WWW_SERVER "1.3.6.1.5.5.7.3.1"
0073 #define GNUTLS_KP_TLS_WWW_CLIENT "1.3.6.1.5.5.7.3.2"
0074 #define GNUTLS_KP_CODE_SIGNING "1.3.6.1.5.5.7.3.3"
0075 #define GNUTLS_KP_MS_SMART_CARD_LOGON "1.3.6.1.4.1.311.20.2.2"
0076 #define GNUTLS_KP_EMAIL_PROTECTION "1.3.6.1.5.5.7.3.4"
0077 #define GNUTLS_KP_TIME_STAMPING "1.3.6.1.5.5.7.3.8"
0078 #define GNUTLS_KP_OCSP_SIGNING "1.3.6.1.5.5.7.3.9"
0079 #define GNUTLS_KP_IPSEC_IKE "1.3.6.1.5.5.7.3.17"
0080 #define GNUTLS_KP_ANY "2.5.29.37.0"
0081
0082 #define GNUTLS_KP_FLAG_DISALLOW_ANY 1
0083
0084 #define GNUTLS_OID_AIA "1.3.6.1.5.5.7.1.1"
0085 #define GNUTLS_OID_AD_OCSP "1.3.6.1.5.5.7.48.1"
0086 #define GNUTLS_OID_AD_CAISSUERS "1.3.6.1.5.5.7.48.2"
0087
0088 #define GNUTLS_FSAN_SET 0
0089 #define GNUTLS_FSAN_APPEND 1
0090 #define GNUTLS_FSAN_ENCODE_OCTET_STRING (1 << 1)
0091 #define GNUTLS_FSAN_ENCODE_UTF8_STRING (1 << 2)
0092
0093 #define GNUTLS_X509EXT_OID_SUBJECT_KEY_ID "2.5.29.14"
0094 #define GNUTLS_X509EXT_OID_KEY_USAGE "2.5.29.15"
0095 #define GNUTLS_X509EXT_OID_PRIVATE_KEY_USAGE_PERIOD "2.5.29.16"
0096 #define GNUTLS_X509EXT_OID_SAN "2.5.29.17"
0097 #define GNUTLS_X509EXT_OID_IAN "2.5.29.18"
0098 #define GNUTLS_X509EXT_OID_BASIC_CONSTRAINTS "2.5.29.19"
0099 #define GNUTLS_X509EXT_OID_NAME_CONSTRAINTS "2.5.29.30"
0100 #define GNUTLS_X509EXT_OID_CRL_DIST_POINTS "2.5.29.31"
0101 #define GNUTLS_X509EXT_OID_CRT_POLICY "2.5.29.32"
0102 #define GNUTLS_X509EXT_OID_AUTHORITY_KEY_ID "2.5.29.35"
0103 #define GNUTLS_X509EXT_OID_EXTENDED_KEY_USAGE "2.5.29.37"
0104 #define GNUTLS_X509EXT_OID_INHIBIT_ANYPOLICY "2.5.29.52"
0105 #define GNUTLS_X509EXT_OID_AUTHORITY_INFO_ACCESS "1.3.6.1.5.5.7.1.1"
0106 #define GNUTLS_X509EXT_OID_PROXY_CRT_INFO "1.3.6.1.5.5.7.1.14"
0107 #define GNUTLS_X509EXT_OID_TLSFEATURES "1.3.6.1.5.5.7.1.24"
0108 #define GNUTLS_X509EXT_OID_CT_SCT_V1 "1.3.6.1.4.1.11129.2.4.2"
0109
0110 #define GNUTLS_X509_OID_POLICY_ANY "2.5.29.54"
0111
0112 /* Certificate handling functions.
0113  */
0114
0115 /**
0116  * gnutls_certificate_import_flags:
0117  * @GNUTLS_X509_CRT_LIST_IMPORT_FAIL_IF_EXCEED: Fail if the
0118  *   certificates in the buffer are more than the space allocated for
0119  *   certificates. The error code will be %GNUTLS_E_SHORT_MEMORY_BUFFER.
0120  * @GNUTLS_X509_CRT_LIST_FAIL_IF_UNSORTED: Fail if the certificates
0121  *   in the buffer are not ordered starting from subject to issuer.
0122  *   The error code will be %GNUTLS_E_CERTIFICATE_LIST_UNSORTED.
0123  * @GNUTLS_X509_CRT_LIST_SORT: Sort the certificate chain if unsorted.
0124  *
0125  * Enumeration of different certificate import flags.
0126  */
0127 typedef enum gnutls_certificate_import_flags {
0128     GNUTLS_X509_CRT_LIST_IMPORT_FAIL_IF_EXCEED = 1,
0129     GNUTLS_X509_CRT_LIST_FAIL_IF_UNSORTED = 1 << 1,
0130     GNUTLS_X509_CRT_LIST_SORT = 1 << 2
0131 } gnutls_certificate_import_flags;
0132
0133 int gnutls_x509_crt_init(gnutls_x509_crt_t *cert);
0134 void gnutls_x509_crt_deinit(gnutls_x509_crt_t cert);
0135
0136 /**
0137  * gnutls_certificate_import_flags:
0138  * @GNUTLS_X509_CRT_FLAG_IGNORE_SANITY: Ignore any sanity checks at the
0139  *   import of the certificate; i.e., ignore checks such as version/field
0140  *   matching and strict time field checks. Intended to be used for debugging.
0141  *
0142  * Enumeration of different certificate flags.
0143  */
0144 typedef enum gnutls_x509_crt_flags {
0145     GNUTLS_X509_CRT_FLAG_IGNORE_SANITY = 1
0146 } gnutls_x509_crt_flags;
0147 void gnutls_x509_crt_set_flags(gnutls_x509_crt_t cert, unsigned flags);
0148
0149 unsigned gnutls_x509_crt_equals(gnutls_x509_crt_t cert1,
0150                 gnutls_x509_crt_t cert2);
0151 unsigned gnutls_x509_crt_equals2(gnutls_x509_crt_t cert1,
0152                  const gnutls_datum_t *der);
0153
0154 int gnutls_x509_crt_import(gnutls_x509_crt_t cert, const gnutls_datum_t *data,
0155                gnutls_x509_crt_fmt_t format);
0156 int gnutls_x509_crt_list_import2(gnutls_x509_crt_t **certs, unsigned int *size,
0157                  const gnutls_datum_t *data,
0158                  gnutls_x509_crt_fmt_t format,
0159                  unsigned int flags);
0160 int gnutls_x509_crt_list_import(gnutls_x509_crt_t *certs,
0161                 unsigned int *cert_max,
0162                 const gnutls_datum_t *data,
0163                 gnutls_x509_crt_fmt_t format,
0164                 unsigned int flags);
0165
0166 int gnutls_x509_crt_import_url(gnutls_x509_crt_t crt, const char *url,
0167                    unsigned int flags
0168                    /* GNUTLS_PKCS11_OBJ_FLAG_* */
0169 );
0170
0171 int gnutls_x509_crt_list_import_url(gnutls_x509_crt_t **certs,
0172                     unsigned int *size, const char *url,
0173                     gnutls_pin_callback_t pin_fn,
0174                     void *pin_fn_userdata, unsigned int flags);
0175
0176 int gnutls_x509_crt_export(gnutls_x509_crt_t cert, gnutls_x509_crt_fmt_t format,
0177                void *output_data, size_t *output_data_size);
0178 int gnutls_x509_crt_export2(gnutls_x509_crt_t cert,
0179                 gnutls_x509_crt_fmt_t format, gnutls_datum_t *out);
0180 int gnutls_x509_crt_get_private_key_usage_period(gnutls_x509_crt_t cert,
0181                          time_t *activation,
0182                          time_t *expiration,
0183                          unsigned int *critical);
0184
0185 int gnutls_x509_crt_get_issuer_dn(gnutls_x509_crt_t cert, char *buf,
0186                   size_t *buf_size);
0187 int gnutls_x509_crt_get_issuer_dn2(gnutls_x509_crt_t cert, gnutls_datum_t *dn);
0188 int gnutls_x509_crt_get_issuer_dn3(gnutls_x509_crt_t cert, gnutls_datum_t *dn,
0189                    unsigned flags);
0190 int gnutls_x509_crt_get_issuer_dn_oid(gnutls_x509_crt_t cert, unsigned indx,
0191                       void *oid, size_t *oid_size);
0192 int gnutls_x509_crt_get_issuer_dn_by_oid(gnutls_x509_crt_t cert,
0193                      const char *oid, unsigned indx,
0194                      unsigned int raw_flag, void *buf,
0195                      size_t *buf_size);
0196
0197 int gnutls_x509_crt_get_dn(gnutls_x509_crt_t cert, char *buf, size_t *buf_size);
0198 int gnutls_x509_crt_get_dn2(gnutls_x509_crt_t cert, gnutls_datum_t *dn);
0199 int gnutls_x509_crt_get_dn3(gnutls_x509_crt_t cert, gnutls_datum_t *dn,
0200                 unsigned flags);
0201
0202 int gnutls_x509_crt_get_dn_oid(gnutls_x509_crt_t cert, unsigned indx, void *oid,
0203                    size_t *oid_size);
0204 int gnutls_x509_crt_get_dn_by_oid(gnutls_x509_crt_t cert, const char *oid,
0205                   unsigned indx, unsigned int raw_flag,
0206                   void *buf, size_t *buf_size);
0207 unsigned gnutls_x509_crt_check_hostname(gnutls_x509_crt_t cert,
0208                     const char *hostname);
0209 unsigned gnutls_x509_crt_check_hostname2(gnutls_x509_crt_t cert,
0210                      const char *hostname,
0211                      unsigned int flags);
0212 unsigned gnutls_x509_crt_check_email(gnutls_x509_crt_t cert, const char *email,
0213                      unsigned int flags);
0214
0215 unsigned gnutls_x509_crt_check_ip(gnutls_x509_crt_t cert,
0216                   const unsigned char *ip, unsigned int ip_size,
0217                   unsigned int flags);
0218
0219 int gnutls_x509_crt_get_signature_algorithm(gnutls_x509_crt_t cert);
0220 int gnutls_x509_crt_get_signature(gnutls_x509_crt_t cert, char *sig,
0221                   size_t *sizeof_sig);
0222 int gnutls_x509_crt_get_version(gnutls_x509_crt_t cert);
0223
0224 int gnutls_x509_crt_get_pk_oid(gnutls_x509_crt_t cert, char *oid,
0225                    size_t *oid_size);
0226 int gnutls_x509_crt_get_signature_oid(gnutls_x509_crt_t cert, char *oid,
0227                       size_t *oid_size);
0228
0229 /**
0230  * gnutls_keyid_flags_t:
0231  * @GNUTLS_KEYID_USE_SHA1: Use SHA1 as the key ID algorithm (default).
0232  * @GNUTLS_KEYID_USE_SHA256: Use SHA256 as the key ID algorithm.
0233  * @GNUTLS_KEYID_USE_SHA512: Use SHA512 as the key ID algorithm.
0234  * @GNUTLS_KEYID_USE_BEST_KNOWN: Use the best known algorithm to calculate key ID. Using that option will make your program behavior depend on the version of gnutls linked with. That option has a cap of 64-bytes key IDs.
0235  *
0236  * Enumeration of different flags for the key ID functions.
0237
0238  */
0239 typedef enum {
0240     GNUTLS_KEYID_USE_SHA1 = 0,
0241     GNUTLS_KEYID_USE_SHA256 = (1 << 0),
0242     GNUTLS_KEYID_USE_SHA512 = (1 << 1),
0243     GNUTLS_KEYID_USE_BEST_KNOWN = (1 << 30)
0244 } gnutls_keyid_flags_t;
0245 int gnutls_x509_crt_get_key_id(gnutls_x509_crt_t crt, unsigned int flags,
0246                    unsigned char *output_data,
0247                    size_t *output_data_size);
0248
0249 int gnutls_x509_crt_set_private_key_usage_period(gnutls_x509_crt_t crt,
0250                          time_t activation,
0251                          time_t expiration);
0252 int gnutls_x509_crt_set_authority_key_id(gnutls_x509_crt_t cert, const void *id,
0253                      size_t id_size);
0254 int gnutls_x509_crt_get_authority_key_id(gnutls_x509_crt_t cert, void *id,
0255                      size_t *id_size,
0256                      unsigned int *critical);
0257 int gnutls_x509_crt_get_authority_key_gn_serial(
0258     gnutls_x509_crt_t cert, unsigned int seq, void *alt, size_t *alt_size,
0259     unsigned int *alt_type, void *serial, size_t *serial_size,
0260     unsigned int *critical);
0261
0262 int gnutls_x509_crt_get_subject_key_id(gnutls_x509_crt_t cert, void *ret,
0263                        size_t *ret_size,
0264                        unsigned int *critical);
0265
0266 int gnutls_x509_crt_get_subject_unique_id(gnutls_x509_crt_t crt, char *buf,
0267                       size_t *buf_size);
0268
0269 int gnutls_x509_crt_get_issuer_unique_id(gnutls_x509_crt_t crt, char *buf,
0270                      size_t *buf_size);
0271
0272 void gnutls_x509_crt_set_pin_function(gnutls_x509_crt_t crt,
0273                       gnutls_pin_callback_t fn, void *userdata);
0274
0275 /**
0276    * gnutls_info_access_what_t:
0277    * @GNUTLS_IA_ACCESSMETHOD_OID: Get accessMethod OID.
0278    * @GNUTLS_IA_ACCESSLOCATION_GENERALNAME_TYPE: Get accessLocation name type.
0279    * @GNUTLS_IA_URI: Get accessLocation URI value.
0280    * @GNUTLS_IA_OCSP_URI: get accessLocation URI value for OCSP.
0281    * @GNUTLS_IA_CAISSUERS_URI: get accessLocation URI value for caIssuers.
0282    *
0283    * Enumeration of types for the @what parameter of
0284    * gnutls_x509_crt_get_authority_info_access().
0285    */
0286 typedef enum gnutls_info_access_what_t {
0287     GNUTLS_IA_ACCESSMETHOD_OID = 1,
0288     GNUTLS_IA_ACCESSLOCATION_GENERALNAME_TYPE = 2,
0289     /* use 100-108 for the generalName types, populate as needed */
0290     GNUTLS_IA_URI = 106,
0291     /* quick-access variants that match both OID and name type. */
0292     GNUTLS_IA_UNKNOWN = 10000,
0293     GNUTLS_IA_OCSP_URI = 10006,
0294     GNUTLS_IA_CAISSUERS_URI = 10106
0295 } gnutls_info_access_what_t;
0296
0297 int gnutls_x509_crt_get_authority_info_access(gnutls_x509_crt_t crt,
0298                           unsigned int seq, int what,
0299                           gnutls_datum_t *data,
0300                           unsigned int *critical);
0301
0302 typedef struct gnutls_name_constraints_st *gnutls_x509_name_constraints_t;
0303
0304 unsigned gnutls_x509_name_constraints_check(gnutls_x509_name_constraints_t nc,
0305                         gnutls_x509_subject_alt_name_t type,
0306                         const gnutls_datum_t *name);
0307 unsigned
0308 gnutls_x509_name_constraints_check_crt(gnutls_x509_name_constraints_t nc,
0309                        gnutls_x509_subject_alt_name_t type,
0310                        gnutls_x509_crt_t crt);
0311
0312 int gnutls_x509_name_constraints_init(gnutls_x509_name_constraints_t *nc);
0313 void gnutls_x509_name_constraints_deinit(gnutls_x509_name_constraints_t nc);
0314
0315 #define GNUTLS_EXT_FLAG_APPEND 1
0316
0317 #define GNUTLS_NAME_CONSTRAINTS_FLAG_APPEND GNUTLS_EXT_FLAG_APPEND
0318 int gnutls_x509_crt_get_name_constraints(gnutls_x509_crt_t crt,
0319                      gnutls_x509_name_constraints_t nc,
0320                      unsigned int flags,
0321                      unsigned int *critical);
0322 int gnutls_x509_name_constraints_add_permitted(
0323     gnutls_x509_name_constraints_t nc, gnutls_x509_subject_alt_name_t type,
0324     const gnutls_datum_t *name);
0325 int gnutls_x509_name_constraints_add_excluded(
0326     gnutls_x509_name_constraints_t nc, gnutls_x509_subject_alt_name_t type,
0327     const gnutls_datum_t *name);
0328 int gnutls_x509_crt_set_name_constraints(gnutls_x509_crt_t crt,
0329                      gnutls_x509_name_constraints_t nc,
0330                      unsigned int critical);
0331 int gnutls_x509_name_constraints_get_permitted(gnutls_x509_name_constraints_t nc,
0332                            unsigned idx, unsigned *type,
0333                            gnutls_datum_t *name);
0334 int gnutls_x509_name_constraints_get_excluded(gnutls_x509_name_constraints_t nc,
0335                           unsigned idx, unsigned *type,
0336                           gnutls_datum_t *name);
0337 int gnutls_x509_cidr_to_rfc5280(const char *cidr, gnutls_datum_t *cidr_rfc5280);
0338
0339 #define GNUTLS_CRL_REASON_SUPERSEEDED GNUTLS_CRL_REASON_SUPERSEDED,
0340 /**
0341    * gnutls_x509_crl_reason_flags_t:
0342    * @GNUTLS_CRL_REASON_PRIVILEGE_WITHDRAWN: The privileges were withdrawn from the owner.
0343    * @GNUTLS_CRL_REASON_CERTIFICATE_HOLD: The certificate is on hold.
0344    * @GNUTLS_CRL_REASON_CESSATION_OF_OPERATION: The end-entity is no longer operating.
0345    * @GNUTLS_CRL_REASON_SUPERSEDED: There is a newer certificate of the owner.
0346    * @GNUTLS_CRL_REASON_AFFILIATION_CHANGED: The end-entity affiliation has changed.
0347    * @GNUTLS_CRL_REASON_CA_COMPROMISE: The CA was compromised.
0348    * @GNUTLS_CRL_REASON_KEY_COMPROMISE: The certificate's key was compromised.
0349    * @GNUTLS_CRL_REASON_UNUSED: The key was never used.
0350    * @GNUTLS_CRL_REASON_AA_COMPROMISE: AA compromised.
0351    *
0352    * Enumeration of types for the CRL revocation reasons.
0353    */
0354 typedef enum gnutls_x509_crl_reason_flags_t {
0355     GNUTLS_CRL_REASON_UNSPECIFIED = 0,
0356     GNUTLS_CRL_REASON_PRIVILEGE_WITHDRAWN = 1,
0357     GNUTLS_CRL_REASON_CERTIFICATE_HOLD = 2,
0358     GNUTLS_CRL_REASON_CESSATION_OF_OPERATION = 4,
0359     GNUTLS_CRL_REASON_SUPERSEDED = 8,
0360     GNUTLS_CRL_REASON_AFFILIATION_CHANGED = 16,
0361     GNUTLS_CRL_REASON_CA_COMPROMISE = 32,
0362     GNUTLS_CRL_REASON_KEY_COMPROMISE = 64,
0363     GNUTLS_CRL_REASON_UNUSED = 128,
0364     GNUTLS_CRL_REASON_AA_COMPROMISE = 32768
0365 } gnutls_x509_crl_reason_flags_t;
0366
0367 int gnutls_x509_crt_get_crl_dist_points(gnutls_x509_crt_t cert,
0368                     unsigned int seq, void *ret,
0369                     size_t *ret_size,
0370                     unsigned int *reason_flags,
0371                     unsigned int *critical);
0372 int gnutls_x509_crt_set_crl_dist_points2(gnutls_x509_crt_t crt,
0373                      gnutls_x509_subject_alt_name_t type,
0374                      const void *data,
0375                      unsigned int data_size,
0376                      unsigned int reason_flags);
0377 int gnutls_x509_crt_set_crl_dist_points(gnutls_x509_crt_t crt,
0378                     gnutls_x509_subject_alt_name_t type,
0379                     const void *data_string,
0380                     unsigned int reason_flags);
0381 int gnutls_x509_crt_cpy_crl_dist_points(gnutls_x509_crt_t dst,
0382                     gnutls_x509_crt_t src);
0383
0384 int gnutls_x509_crl_sign(gnutls_x509_crl_t crl, gnutls_x509_crt_t issuer,
0385              gnutls_x509_privkey_t issuer_key);
0386
0387 int gnutls_x509_crl_sign2(gnutls_x509_crl_t crl, gnutls_x509_crt_t issuer,
0388               gnutls_x509_privkey_t issuer_key,
0389               gnutls_digest_algorithm_t dig, unsigned int flags);
0390
0391 time_t gnutls_x509_crt_get_activation_time(gnutls_x509_crt_t cert);
0392
0393 /* This macro is deprecated and defunc; do not use */
0394 #define GNUTLS_X509_NO_WELL_DEFINED_EXPIRATION ((time_t)4294197631)
0395
0396 time_t gnutls_x509_crt_get_expiration_time(gnutls_x509_crt_t cert);
0397 int gnutls_x509_crt_get_serial(gnutls_x509_crt_t cert, void *result,
0398                    size_t *result_size);
0399
0400 typedef struct gnutls_x509_spki_st *gnutls_x509_spki_t;
0401
0402 int gnutls_x509_spki_init(gnutls_x509_spki_t *spki);
0403 void gnutls_x509_spki_deinit(gnutls_x509_spki_t spki);
0404
0405 int gnutls_x509_spki_get_rsa_pss_params(gnutls_x509_spki_t spki,
0406                     gnutls_digest_algorithm_t *dig,
0407                     unsigned int *salt_size);
0408
0409 void gnutls_x509_spki_set_rsa_pss_params(gnutls_x509_spki_t spki,
0410                      gnutls_digest_algorithm_t dig,
0411                      unsigned int salt_size);
0412
0413 int gnutls_x509_crt_get_pk_algorithm(gnutls_x509_crt_t cert,
0414                      unsigned int *bits);
0415 int gnutls_x509_crt_set_spki(gnutls_x509_crt_t crt,
0416                  const gnutls_x509_spki_t spki, unsigned int flags);
0417 int gnutls_x509_crt_get_spki(gnutls_x509_crt_t cert, gnutls_x509_spki_t spki,
0418                  unsigned int flags);
0419
0420 int gnutls_x509_crt_get_pk_rsa_raw(gnutls_x509_crt_t crt, gnutls_datum_t *m,
0421                    gnutls_datum_t *e);
0422 int gnutls_x509_crt_get_pk_dsa_raw(gnutls_x509_crt_t crt, gnutls_datum_t *p,
0423                    gnutls_datum_t *q, gnutls_datum_t *g,
0424                    gnutls_datum_t *y);
0425 int gnutls_x509_crt_get_pk_ecc_raw(gnutls_x509_crt_t crt,
0426                    gnutls_ecc_curve_t *curve, gnutls_datum_t *x,
0427                    gnutls_datum_t *y);
0428 int gnutls_x509_crt_get_pk_gost_raw(gnutls_x509_crt_t crt,
0429                     gnutls_ecc_curve_t *curve,
0430                     gnutls_digest_algorithm_t *digest,
0431                     gnutls_gost_paramset_t *paramset,
0432                     gnutls_datum_t *x, gnutls_datum_t *y);
0433
0434 int gnutls_x509_crt_get_subject_alt_name(gnutls_x509_crt_t cert,
0435                      unsigned int seq, void *san,
0436                      size_t *san_size,
0437                      unsigned int *critical);
0438 int gnutls_x509_crt_get_subject_alt_name2(gnutls_x509_crt_t cert,
0439                       unsigned int seq, void *san,
0440                       size_t *san_size,
0441                       unsigned int *san_type,
0442                       unsigned int *critical);
0443
0444 int gnutls_x509_crt_get_subject_alt_othername_oid(gnutls_x509_crt_t cert,
0445                           unsigned int seq, void *oid,
0446                           size_t *oid_size);
0447
0448 int gnutls_x509_crt_get_issuer_alt_name(gnutls_x509_crt_t cert,
0449                     unsigned int seq, void *ian,
0450                     size_t *ian_size,
0451                     unsigned int *critical);
0452 int gnutls_x509_crt_get_issuer_alt_name2(gnutls_x509_crt_t cert,
0453                      unsigned int seq, void *ian,
0454                      size_t *ian_size,
0455                      unsigned int *ian_type,
0456                      unsigned int *critical);
0457
0458 int gnutls_x509_crt_get_issuer_alt_othername_oid(gnutls_x509_crt_t cert,
0459                          unsigned int seq, void *ret,
0460                          size_t *ret_size);
0461
0462 int gnutls_x509_crt_get_ca_status(gnutls_x509_crt_t cert,
0463                   unsigned int *critical);
0464 int gnutls_x509_crt_get_basic_constraints(gnutls_x509_crt_t cert,
0465                       unsigned int *critical,
0466                       unsigned int *ca, int *pathlen);
0467
0468 /* The key_usage flags are defined in gnutls.h. They are the
0469  * GNUTLS_KEY_* definitions.
0470  */
0471 int gnutls_x509_crt_get_key_usage(gnutls_x509_crt_t cert,
0472                   unsigned int *key_usage,
0473                   unsigned int *critical);
0474 int gnutls_x509_crt_set_key_usage(gnutls_x509_crt_t crt, unsigned int usage);
0475 int gnutls_x509_crt_set_authority_info_access(gnutls_x509_crt_t crt, int what,
0476                           gnutls_datum_t *data);
0477
0478 int gnutls_x509_crt_get_inhibit_anypolicy(gnutls_x509_crt_t cert,
0479                       unsigned int *skipcerts,
0480                       unsigned int *critical);
0481 int gnutls_x509_crt_set_inhibit_anypolicy(gnutls_x509_crt_t crt,
0482                       unsigned int skipcerts);
0483
0484 int gnutls_x509_crt_get_proxy(gnutls_x509_crt_t cert, unsigned int *critical,
0485                   int *pathlen, char **policyLanguage,
0486                   char **policy, size_t *sizeof_policy);
0487
0488 typedef struct gnutls_x509_tlsfeatures_st *gnutls_x509_tlsfeatures_t;
0489
0490 int gnutls_x509_tlsfeatures_init(gnutls_x509_tlsfeatures_t *features);
0491 void gnutls_x509_tlsfeatures_deinit(gnutls_x509_tlsfeatures_t);
0492 int gnutls_x509_tlsfeatures_get(gnutls_x509_tlsfeatures_t f, unsigned idx,
0493                 unsigned int *feature);
0494
0495 int gnutls_x509_crt_set_tlsfeatures(gnutls_x509_crt_t crt,
0496                     gnutls_x509_tlsfeatures_t features);
0497
0498 int gnutls_x509_crt_get_tlsfeatures(gnutls_x509_crt_t cert,
0499                     gnutls_x509_tlsfeatures_t features,
0500                     unsigned int flags, unsigned int *critical);
0501
0502 unsigned gnutls_x509_tlsfeatures_check_crt(gnutls_x509_tlsfeatures_t feat,
0503                        gnutls_x509_crt_t crt);
0504
0505 #define GNUTLS_MAX_QUALIFIERS 8
0506
0507 /**
0508    * gnutls_x509_qualifier_t:
0509    * @GNUTLS_X509_QUALIFIER_UNKNOWN: Unknown qualifier.
0510    * @GNUTLS_X509_QUALIFIER_URI: A URL
0511    * @GNUTLS_X509_QUALIFIER_NOICE: A text notice.
0512    *
0513    * Enumeration of types for the X.509 qualifiers, of the certificate policy extension.
0514    */
0515 typedef enum gnutls_x509_qualifier_t {
0516     GNUTLS_X509_QUALIFIER_UNKNOWN = 0,
0517     GNUTLS_X509_QUALIFIER_URI,
0518     GNUTLS_X509_QUALIFIER_NOTICE
0519 } gnutls_x509_qualifier_t;
0520
0521 typedef struct gnutls_x509_policy_st {
0522     char *oid;
0523     unsigned int qualifiers;
0524     struct {
0525         gnutls_x509_qualifier_t type;
0526         char *data;
0527         unsigned int size;
0528     } qualifier[GNUTLS_MAX_QUALIFIERS];
0529 } gnutls_x509_policy_st;
0530
0531 void gnutls_x509_policy_release(struct gnutls_x509_policy_st *policy);
0532 int gnutls_x509_crt_get_policy(gnutls_x509_crt_t crt, unsigned indx,
0533                    struct gnutls_x509_policy_st *policy,
0534                    unsigned int *critical);
0535 int gnutls_x509_crt_set_policy(gnutls_x509_crt_t crt,
0536                    const struct gnutls_x509_policy_st *policy,
0537                    unsigned int critical);
0538
0539 int gnutls_x509_dn_oid_known(const char *oid);
0540
0541 #define GNUTLS_X509_DN_OID_RETURN_OID 1
0542 const char *gnutls_x509_dn_oid_name(const char *oid, unsigned int flags);
0543
0544 /* Read extensions by OID. */
0545 int gnutls_x509_crt_get_extension_oid(gnutls_x509_crt_t cert, unsigned indx,
0546                       void *oid, size_t *oid_size);
0547 int gnutls_x509_crt_get_extension_by_oid(gnutls_x509_crt_t cert,
0548                      const char *oid, unsigned indx,
0549                      void *buf, size_t *buf_size,
0550                      unsigned int *critical);
0551
0552 int gnutls_x509_crq_get_signature_algorithm(gnutls_x509_crq_t crq);
0553 int gnutls_x509_crq_get_extension_by_oid2(gnutls_x509_crq_t crq,
0554                       const char *oid, unsigned indx,
0555                       gnutls_datum_t *output,
0556                       unsigned int *critical);
0557
0558 /* Read extensions by sequence number. */
0559 int gnutls_x509_crt_get_extension_info(gnutls_x509_crt_t cert, unsigned indx,
0560                        void *oid, size_t *oid_size,
0561                        unsigned int *critical);
0562 int gnutls_x509_crt_get_extension_data(gnutls_x509_crt_t cert, unsigned indx,
0563                        void *data, size_t *sizeof_data);
0564 int gnutls_x509_crt_get_extension_data2(gnutls_x509_crt_t cert, unsigned indx,
0565                     gnutls_datum_t *data);
0566
0567 int gnutls_x509_crt_set_extension_by_oid(gnutls_x509_crt_t crt, const char *oid,
0568                      const void *buf, size_t sizeof_buf,
0569                      unsigned int critical);
0570
0571 /* X.509 Certificate writing.
0572  */
0573 int gnutls_x509_crt_set_dn(gnutls_x509_crt_t crt, const char *dn,
0574                const char **err);
0575
0576 int gnutls_x509_crt_set_dn_by_oid(gnutls_x509_crt_t crt, const char *oid,
0577                   unsigned int raw_flag, const void *name,
0578                   unsigned int sizeof_name);
0579 int gnutls_x509_crt_set_issuer_dn_by_oid(gnutls_x509_crt_t crt, const char *oid,
0580                      unsigned int raw_flag,
0581                      const void *name,
0582                      unsigned int sizeof_name);
0583 int gnutls_x509_crt_set_issuer_dn(gnutls_x509_crt_t crt, const char *dn,
0584                   const char **err);
0585
0586 int gnutls_x509_crt_set_version(gnutls_x509_crt_t crt, unsigned int version);
0587 int gnutls_x509_crt_set_key(gnutls_x509_crt_t crt, gnutls_x509_privkey_t key);
0588 int gnutls_x509_crt_set_ca_status(gnutls_x509_crt_t crt, unsigned int ca);
0589 int gnutls_x509_crt_set_basic_constraints(gnutls_x509_crt_t crt,
0590                       unsigned int ca,
0591                       int pathLenConstraint);
0592
0593 int gnutls_x509_crt_set_subject_unique_id(gnutls_x509_crt_t cert,
0594                       const void *id, size_t id_size);
0595 int gnutls_x509_crt_set_issuer_unique_id(gnutls_x509_crt_t cert, const void *id,
0596                      size_t id_size);
0597
0598 int gnutls_x509_crt_set_subject_alternative_name(
0599     gnutls_x509_crt_t crt, gnutls_x509_subject_alt_name_t type,
0600     const char *data_string);
0601 int gnutls_x509_crt_set_subject_alt_name(gnutls_x509_crt_t crt,
0602                      gnutls_x509_subject_alt_name_t type,
0603                      const void *data,
0604                      unsigned int data_size,
0605                      unsigned int flags);
0606
0607 int gnutls_x509_crt_set_subject_alt_othername(gnutls_x509_crt_t crt,
0608                           const char *oid, const void *data,
0609                           unsigned int data_size,
0610                           unsigned int flags);
0611
0612 int gnutls_x509_crt_set_issuer_alt_name(gnutls_x509_crt_t crt,
0613                     gnutls_x509_subject_alt_name_t type,
0614                     const void *data,
0615                     unsigned int data_size,
0616                     unsigned int flags);
0617
0618 int gnutls_x509_crt_set_issuer_alt_othername(gnutls_x509_crt_t crt,
0619                          const char *oid, const void *data,
0620                          unsigned int data_size,
0621                          unsigned int flags);
0622
0623 int gnutls_x509_crt_sign(gnutls_x509_crt_t crt, gnutls_x509_crt_t issuer,
0624              gnutls_x509_privkey_t issuer_key);
0625 int gnutls_x509_crt_sign2(gnutls_x509_crt_t crt, gnutls_x509_crt_t issuer,
0626               gnutls_x509_privkey_t issuer_key,
0627               gnutls_digest_algorithm_t dig, unsigned int flags);
0628 int gnutls_x509_crt_set_activation_time(gnutls_x509_crt_t cert,
0629                     time_t act_time);
0630 int gnutls_x509_crt_set_expiration_time(gnutls_x509_crt_t cert,
0631                     time_t exp_time);
0632 int gnutls_x509_crt_set_serial(gnutls_x509_crt_t cert, const void *serial,
0633                    size_t serial_size);
0634
0635 int gnutls_x509_crt_set_subject_key_id(gnutls_x509_crt_t cert, const void *id,
0636                        size_t id_size);
0637
0638 int gnutls_x509_crt_set_proxy_dn(gnutls_x509_crt_t crt, gnutls_x509_crt_t eecrt,
0639                  unsigned int raw_flag, const void *name,
0640                  unsigned int sizeof_name);
0641 int gnutls_x509_crt_set_proxy(gnutls_x509_crt_t crt, int pathLenConstraint,
0642                   const char *policyLanguage, const char *policy,
0643                   size_t sizeof_policy);
0644
0645 int gnutls_x509_crt_print(gnutls_x509_crt_t cert,
0646               gnutls_certificate_print_formats_t format,
0647               gnutls_datum_t *out);
0648 int gnutls_x509_crl_print(gnutls_x509_crl_t crl,
0649               gnutls_certificate_print_formats_t format,
0650               gnutls_datum_t *out);
0651
0652 /* Access to internal Certificate fields.
0653      */
0654 int gnutls_x509_crt_get_raw_issuer_dn(gnutls_x509_crt_t cert,
0655                       gnutls_datum_t *start);
0656 int gnutls_x509_crt_get_raw_dn(gnutls_x509_crt_t cert, gnutls_datum_t *start);
0657
0658 /* RDN handling.
0659  */
0660 int gnutls_x509_rdn_get(const gnutls_datum_t *idn, char *buf,
0661             size_t *sizeof_buf);
0662 int gnutls_x509_rdn_get2(const gnutls_datum_t *idn, gnutls_datum_t *str,
0663              unsigned flags);
0664
0665 int gnutls_x509_rdn_get_oid(const gnutls_datum_t *idn, unsigned indx, void *buf,
0666                 size_t *sizeof_buf);
0667
0668 int gnutls_x509_rdn_get_by_oid(const gnutls_datum_t *idn, const char *oid,
0669                    unsigned indx, unsigned int raw_flag, void *buf,
0670                    size_t *sizeof_buf);
0671
0672 typedef struct gnutls_x509_dn_st *gnutls_x509_dn_t;
0673
0674 typedef struct gnutls_x509_ava_st {
0675     gnutls_datum_t oid;
0676     gnutls_datum_t value;
0677     unsigned long value_tag;
0678 } gnutls_x509_ava_st;
0679
0680 int gnutls_x509_crt_get_subject(gnutls_x509_crt_t cert, gnutls_x509_dn_t *dn);
0681 int gnutls_x509_crt_get_issuer(gnutls_x509_crt_t cert, gnutls_x509_dn_t *dn);
0682 int gnutls_x509_dn_get_rdn_ava(gnutls_x509_dn_t dn, int irdn, int iava,
0683                    gnutls_x509_ava_st *ava);
0684
0685 int gnutls_x509_dn_get_str(gnutls_x509_dn_t dn, gnutls_datum_t *str);
0686
0687 #define GNUTLS_X509_DN_FLAG_COMPAT 1
0688 int gnutls_x509_dn_get_str2(gnutls_x509_dn_t dn, gnutls_datum_t *str,
0689                 unsigned flags);
0690
0691 int gnutls_x509_dn_set_str(gnutls_x509_dn_t dn, const char *str,
0692                const char **err);
0693
0694 int gnutls_x509_dn_init(gnutls_x509_dn_t *dn);
0695
0696 int gnutls_x509_dn_import(gnutls_x509_dn_t dn, const gnutls_datum_t *data);
0697
0698 int gnutls_x509_dn_export(gnutls_x509_dn_t dn, gnutls_x509_crt_fmt_t format,
0699               void *output_data, size_t *output_data_size);
0700 int gnutls_x509_dn_export2(gnutls_x509_dn_t dn, gnutls_x509_crt_fmt_t format,
0701                gnutls_datum_t *out);
0702
0703 void gnutls_x509_dn_deinit(gnutls_x509_dn_t dn);
0704
0705 /* CRL handling functions.
0706  */
0707 int gnutls_x509_crl_init(gnutls_x509_crl_t *crl);
0708 void gnutls_x509_crl_deinit(gnutls_x509_crl_t crl);
0709
0710 int gnutls_x509_crl_import(gnutls_x509_crl_t crl, const gnutls_datum_t *data,
0711                gnutls_x509_crt_fmt_t format);
0712 int gnutls_x509_crl_export(gnutls_x509_crl_t crl, gnutls_x509_crt_fmt_t format,
0713                void *output_data, size_t *output_data_size);
0714 int gnutls_x509_crl_export2(gnutls_x509_crl_t crl, gnutls_x509_crt_fmt_t format,
0715                 gnutls_datum_t *out);
0716
0717 int gnutls_x509_crl_get_raw_issuer_dn(gnutls_x509_crl_t crl,
0718                       gnutls_datum_t *dn);
0719
0720 int gnutls_x509_crl_get_issuer_dn(gnutls_x509_crl_t crl, char *buf,
0721                   size_t *sizeof_buf);
0722 int gnutls_x509_crl_get_issuer_dn2(gnutls_x509_crl_t crl, gnutls_datum_t *dn);
0723 int gnutls_x509_crl_get_issuer_dn3(gnutls_x509_crl_t crl, gnutls_datum_t *dn,
0724                    unsigned flags);
0725
0726 int gnutls_x509_crl_get_issuer_dn_by_oid(gnutls_x509_crl_t crl, const char *oid,
0727                      unsigned indx, unsigned int raw_flag,
0728                      void *buf, size_t *sizeof_buf);
0729 int gnutls_x509_crl_get_dn_oid(gnutls_x509_crl_t crl, unsigned indx, void *oid,
0730                    size_t *sizeof_oid);
0731
0732 int gnutls_x509_crl_get_signature_algorithm(gnutls_x509_crl_t crl);
0733 int gnutls_x509_crl_get_signature(gnutls_x509_crl_t crl, char *sig,
0734                   size_t *sizeof_sig);
0735 int gnutls_x509_crl_get_version(gnutls_x509_crl_t crl);
0736
0737 int gnutls_x509_crl_get_signature_oid(gnutls_x509_crl_t crl, char *oid,
0738                       size_t *oid_size);
0739
0740 time_t gnutls_x509_crl_get_this_update(gnutls_x509_crl_t crl);
0741 time_t gnutls_x509_crl_get_next_update(gnutls_x509_crl_t crl);
0742
0743 int gnutls_x509_crl_get_crt_count(gnutls_x509_crl_t crl);
0744 int gnutls_x509_crl_get_crt_serial(gnutls_x509_crl_t crl, unsigned indx,
0745                    unsigned char *serial, size_t *serial_size,
0746                    time_t *t);
0747
0748 typedef struct gnutls_x509_crl_iter *gnutls_x509_crl_iter_t;
0749
0750 int gnutls_x509_crl_iter_crt_serial(gnutls_x509_crl_t crl,
0751                     gnutls_x509_crl_iter_t *,
0752                     unsigned char *serial, size_t *serial_size,
0753                     time_t *t);
0754
0755 void gnutls_x509_crl_iter_deinit(gnutls_x509_crl_iter_t);
0756
0757 #define gnutls_x509_crl_get_certificate_count gnutls_x509_crl_get_crt_count
0758 #define gnutls_x509_crl_get_certificate gnutls_x509_crl_get_crt_serial
0759
0760 unsigned gnutls_x509_crl_check_issuer(gnutls_x509_crl_t crl,
0761                       gnutls_x509_crt_t issuer);
0762
0763 int gnutls_x509_crl_list_import2(gnutls_x509_crl_t **crls, unsigned int *size,
0764                  const gnutls_datum_t *data,
0765                  gnutls_x509_crt_fmt_t format,
0766                  unsigned int flags);
0767
0768 int gnutls_x509_crl_list_import(gnutls_x509_crl_t *crls, unsigned int *crl_max,
0769                 const gnutls_datum_t *data,
0770                 gnutls_x509_crt_fmt_t format,
0771                 unsigned int flags);
0772 /* CRL writing.
0773  */
0774 int gnutls_x509_crl_set_version(gnutls_x509_crl_t crl, unsigned int version);
0775 int gnutls_x509_crl_set_this_update(gnutls_x509_crl_t crl, time_t act_time);
0776 int gnutls_x509_crl_set_next_update(gnutls_x509_crl_t crl, time_t exp_time);
0777 int gnutls_x509_crl_set_crt_serial(gnutls_x509_crl_t crl, const void *serial,
0778                    size_t serial_size, time_t revocation_time);
0779 int gnutls_x509_crl_set_crt(gnutls_x509_crl_t crl, gnutls_x509_crt_t crt,
0780                 time_t revocation_time);
0781
0782 int gnutls_x509_crl_get_authority_key_id(gnutls_x509_crl_t crl, void *id,
0783                      size_t *id_size,
0784                      unsigned int *critical);
0785 int gnutls_x509_crl_get_authority_key_gn_serial(
0786     gnutls_x509_crl_t crl, unsigned int seq, void *alt, size_t *alt_size,
0787     unsigned int *alt_type, void *serial, size_t *serial_size,
0788     unsigned int *critical);
0789
0790 int gnutls_x509_crl_get_number(gnutls_x509_crl_t crl, void *ret,
0791                    size_t *ret_size, unsigned int *critical);
0792
0793 int gnutls_x509_crl_get_extension_oid(gnutls_x509_crl_t crl, unsigned indx,
0794                       void *oid, size_t *sizeof_oid);
0795
0796 int gnutls_x509_crl_get_extension_info(gnutls_x509_crl_t crl, unsigned indx,
0797                        void *oid, size_t *sizeof_oid,
0798                        unsigned int *critical);
0799
0800 int gnutls_x509_crl_get_extension_data(gnutls_x509_crl_t crl, unsigned indx,
0801                        void *data, size_t *sizeof_data);
0802 int gnutls_x509_crl_get_extension_data2(gnutls_x509_crl_t crl, unsigned indx,
0803                     gnutls_datum_t *data);
0804
0805 int gnutls_x509_crl_set_authority_key_id(gnutls_x509_crl_t crl, const void *id,
0806                      size_t id_size);
0807
0808 int gnutls_x509_crl_set_number(gnutls_x509_crl_t crl, const void *nr,
0809                    size_t nr_size);
0810
0811 /* X.509 Certificate verification functions.
0812  */
0813
0814 /**
0815  * gnutls_certificate_verify_flags:
0816  * @GNUTLS_VERIFY_DISABLE_CA_SIGN: If set a signer does not have to be
0817  *   a certificate authority. This flag should normally be disabled,
0818  *   unless you know what this means.
0819  * @GNUTLS_VERIFY_DISABLE_TRUSTED_TIME_CHECKS: If set a signer in the trusted
0820  *   list is never checked for expiration or activation.
0821  * @GNUTLS_VERIFY_DO_NOT_ALLOW_X509_V1_CA_CRT: Do not allow trusted CA
0822  *   certificates that have version 1.  This option is to be used
0823  *   to deprecate all certificates of version 1.
0824  * @GNUTLS_VERIFY_DO_NOT_ALLOW_SAME: If a certificate is not signed by
0825  *   anyone trusted but exists in the trusted CA list do not treat it
0826  *   as trusted.
0827  * @GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN: A certificate chain is tolerated
0828  *   if unsorted (the case with many TLS servers out there). This is the
0829  *   default since GnuTLS 3.1.4.
0830  * @GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Do not tolerate an unsorted
0831  *   certificate chain.
0832  * @GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT: Allow CA certificates that
0833  *   have version 1 (both root and intermediate). This might be
0834  *   dangerous since those haven't the basicConstraints
0835  *   extension.
0836  * @GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD2: Allow certificates to be signed
0837  *   using the broken MD2 algorithm.
0838  * @GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD5: Allow certificates to be signed
0839  *   using the broken MD5 algorithm.
0840  * @GNUTLS_VERIFY_ALLOW_SIGN_WITH_SHA1: Allow certificates to be signed
0841  *   using the broken SHA1 hash algorithm.
0842  * @GNUTLS_VERIFY_ALLOW_BROKEN: Allow certificates to be signed
0843  *   using any broken algorithm.
0844  * @GNUTLS_VERIFY_DISABLE_TIME_CHECKS: Disable checking of activation
0845  *   and expiration validity periods of certificate chains. Don't set
0846  *   this unless you understand the security implications.
0847  * @GNUTLS_VERIFY_DISABLE_CRL_CHECKS: Disable checking for validity
0848  *   using certificate revocation lists or the available OCSP data.
0849  * @GNUTLS_VERIFY_DO_NOT_ALLOW_WILDCARDS: When including a hostname
0850  *   check in the verification, do not consider any wildcards.
0851  * @GNUTLS_VERIFY_DO_NOT_ALLOW_IP_MATCHES: When verifying a hostname
0852  *   prevent textual IP addresses from matching IP addresses in the
0853  *   certificate. Treat the input only as a DNS name.
0854  * @GNUTLS_VERIFY_USE_TLS1_RSA: This indicates that a (raw) RSA signature is provided
0855  *   as in the TLS 1.0 protocol. Not all functions accept this flag.
0856  * @GNUTLS_VERIFY_IGNORE_UNKNOWN_CRIT_EXTENSIONS: This signals the verification
0857  *   process, not to fail on unknown critical extensions.
0858  * @GNUTLS_VERIFY_RSA_PSS_FIXED_SALT_LENGTH: Disallow RSA-PSS signatures made
0859  *   with mismatching salt length with digest length, as mandated in RFC 8446
0860  *   4.2.3.
0861  *
0862  * Enumeration of different certificate verify flags. Additional
0863  * verification profiles can be set using GNUTLS_PROFILE_TO_VFLAGS()
0864  * and %gnutls_certificate_verification_profiles_t.
0865  */
0866 typedef enum gnutls_certificate_verify_flags {
0867     GNUTLS_VERIFY_DISABLE_CA_SIGN = 1 << 0,
0868     GNUTLS_VERIFY_DO_NOT_ALLOW_IP_MATCHES = 1 << 1,
0869     GNUTLS_VERIFY_DO_NOT_ALLOW_SAME = 1 << 2,
0870     GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT = 1 << 3,
0871     GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD2 = 1 << 4,
0872     GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD5 = 1 << 5,
0873     GNUTLS_VERIFY_DISABLE_TIME_CHECKS = 1 << 6,
0874     GNUTLS_VERIFY_DISABLE_TRUSTED_TIME_CHECKS = 1 << 7,
0875     GNUTLS_VERIFY_DO_NOT_ALLOW_X509_V1_CA_CRT = 1 << 8,
0876     GNUTLS_VERIFY_DISABLE_CRL_CHECKS = 1 << 9,
0877     GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN = 1 << 10,
0878     GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN = 1 << 11,
0879     GNUTLS_VERIFY_DO_NOT_ALLOW_WILDCARDS = 1 << 12,
0880     GNUTLS_VERIFY_USE_TLS1_RSA = 1 << 13,
0881     GNUTLS_VERIFY_IGNORE_UNKNOWN_CRIT_EXTENSIONS = 1 << 14,
0882     GNUTLS_VERIFY_ALLOW_SIGN_WITH_SHA1 = 1 << 15,
0883     GNUTLS_VERIFY_RSA_PSS_FIXED_SALT_LENGTH = 1 << 16
0884     /* cannot exceed 2^24 due to GNUTLS_PROFILE_TO_VFLAGS() */
0885 } gnutls_certificate_verify_flags;
0886
0887 #define GNUTLS_VERIFY_ALLOW_BROKEN \
0888     (GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD2 | GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD5)
0889
0890 /**
0891  * gnutls_certificate_verification_profiles_t:
0892  * @GNUTLS_PROFILE_UNKNOWN: An invalid/unknown profile.
0893  * @GNUTLS_PROFILE_VERY_WEAK: A verification profile that
0894  *  corresponds to @GNUTLS_SEC_PARAM_VERY_WEAK (64 bits)
0895  * @GNUTLS_PROFILE_LOW: A verification profile that
0896  *  corresponds to @GNUTLS_SEC_PARAM_LOW (80 bits)
0897  * @GNUTLS_PROFILE_LEGACY: A verification profile that
0898  *  corresponds to @GNUTLS_SEC_PARAM_LEGACY (96 bits)
0899  * @GNUTLS_PROFILE_MEDIUM: A verification profile that
0900  *  corresponds to @GNUTLS_SEC_PARAM_MEDIUM (112 bits)
0901  * @GNUTLS_PROFILE_HIGH: A verification profile that
0902  *  corresponds to @GNUTLS_SEC_PARAM_HIGH (128 bits)
0903  * @GNUTLS_PROFILE_ULTRA: A verification profile that
0904  *  corresponds to @GNUTLS_SEC_PARAM_ULTRA (192 bits)
0905  * @GNUTLS_PROFILE_FUTURE: A verification profile that
0906  *  corresponds to @GNUTLS_SEC_PARAM_FUTURE (256 bits)
0907  * @GNUTLS_PROFILE_SUITEB128: A verification profile that
0908  *  applies the SUITEB128 rules
0909  * @GNUTLS_PROFILE_SUITEB192: A verification profile that
0910  *  applies the SUITEB192 rules
0911  *
0912  * Enumeration of different certificate verification profiles.
0913  */
0914 typedef enum gnutls_certificate_verification_profiles_t {
0915     GNUTLS_PROFILE_UNKNOWN = 0,
0916     GNUTLS_PROFILE_VERY_WEAK = 1,
0917     GNUTLS_PROFILE_LOW = 2,
0918     GNUTLS_PROFILE_LEGACY = 4,
0919     GNUTLS_PROFILE_MEDIUM = 5,
0920     GNUTLS_PROFILE_HIGH = 6,
0921     GNUTLS_PROFILE_ULTRA = 7,
0922     GNUTLS_PROFILE_FUTURE = 8,
0923
0924     GNUTLS_PROFILE_SUITEB128 = 32,
0925     GNUTLS_PROFILE_SUITEB192 = 33
0926     /*GNUTLS_PROFILE_MAX=255 */
0927 } gnutls_certificate_verification_profiles_t;
0928
0929 #define GNUTLS_PROFILE_TO_VFLAGS(x) (((unsigned)x) << 24)
0930
0931 #define GNUTLS_VFLAGS_PROFILE_MASK (0xff000000)
0932
0933 #define GNUTLS_VFLAGS_TO_PROFILE(x) ((((unsigned)x) >> 24) & 0xff)
0934
0935 const char *gnutls_certificate_verification_profile_get_name(
0936     gnutls_certificate_verification_profiles_t id) __GNUTLS_CONST__;
0937 gnutls_certificate_verification_profiles_t
0938 gnutls_certificate_verification_profile_get_id(const char *name)
0939     __GNUTLS_CONST__;
0940
0941 unsigned gnutls_x509_crt_check_issuer(gnutls_x509_crt_t cert,
0942                       gnutls_x509_crt_t issuer);
0943
0944 int gnutls_x509_crt_list_verify(const gnutls_x509_crt_t *cert_list,
0945                 unsigned cert_list_length,
0946                 const gnutls_x509_crt_t *CA_list,
0947                 unsigned CA_list_length,
0948                 const gnutls_x509_crl_t *CRL_list,
0949                 unsigned CRL_list_length, unsigned int flags,
0950                 unsigned int *verify);
0951
0952 int gnutls_x509_crt_verify(gnutls_x509_crt_t cert,
0953                const gnutls_x509_crt_t *CA_list,
0954                unsigned CA_list_length, unsigned int flags,
0955                unsigned int *verify);
0956 int gnutls_x509_crl_verify(gnutls_x509_crl_t crl,
0957                const gnutls_x509_crt_t *CA_list,
0958                unsigned CA_list_length, unsigned int flags,
0959                unsigned int *verify);
0960
0961 int gnutls_x509_crt_verify_data2(gnutls_x509_crt_t crt,
0962                  gnutls_sign_algorithm_t algo,
0963                  unsigned int flags, const gnutls_datum_t *data,
0964                  const gnutls_datum_t *signature);
0965
0966 int gnutls_x509_crt_check_revocation(gnutls_x509_crt_t cert,
0967                      const gnutls_x509_crl_t *crl_list,
0968                      unsigned crl_list_length);
0969
0970 int gnutls_x509_crt_get_fingerprint(gnutls_x509_crt_t cert,
0971                     gnutls_digest_algorithm_t algo, void *buf,
0972                     size_t *buf_size);
0973
0974 int gnutls_x509_crt_get_key_purpose_oid(gnutls_x509_crt_t cert, unsigned indx,
0975                     void *oid, size_t *oid_size,
0976                     unsigned int *critical);
0977 int gnutls_x509_crt_set_key_purpose_oid(gnutls_x509_crt_t cert, const void *oid,
0978                     unsigned int critical);
0979
0980 unsigned gnutls_x509_crt_check_key_purpose(gnutls_x509_crt_t cert,
0981                        const char *purpose, unsigned flags);
0982
0983 /* Private key handling.
0984  */
0985
0986 /* Flags for the gnutls_x509_privkey_export_pkcs8() function.
0987  */
0988
0989 #define GNUTLS_PKCS8_PLAIN GNUTLS_PKCS_PLAIN
0990 #define GNUTLS_PKCS8_USE_PKCS12_3DES GNUTLS_PKCS_PKCS12_3DES
0991 #define GNUTLS_PKCS8_USE_PKCS12_ARCFOUR GNUTLS_PKCS_PKCS12_ARCFOUR
0992 #define GNUTLS_PKCS8_USE_PKCS12_RC2_40 GNUTLS_PKCS_PKCS12_RC2_40
0993
0994 /**
0995  * gnutls_pkcs_encrypt_flags_t:
0996  * @GNUTLS_PKCS_PLAIN: Unencrypted private key.
0997  * @GNUTLS_PKCS_NULL_PASSWORD: Some schemas distinguish between an empty and a NULL password.
0998  * @GNUTLS_PKCS_PKCS12_3DES: PKCS-12 3DES.
0999  * @GNUTLS_PKCS_PKCS12_ARCFOUR: PKCS-12 ARCFOUR.
1000  * @GNUTLS_PKCS_PKCS12_RC2_40: PKCS-12 RC2-40.
1001  * @GNUTLS_PKCS_PBES2_3DES: PBES2 3DES.
1002  * @GNUTLS_PKCS_PBES2_AES_128: PBES2 AES-128.
1003  * @GNUTLS_PKCS_PBES2_AES_192: PBES2 AES-192.
1004  * @GNUTLS_PKCS_PBES2_AES_256: PBES2 AES-256.
1005  * @GNUTLS_PKCS_PBES2_DES: PBES2 single DES.
1006  * @GNUTLS_PKCS_PBES1_DES_MD5: PBES1 with single DES; for compatibility with openssl only.
1007  * @GNUTLS_PKCS_PBES2_GOST_TC26Z: PBES2 GOST 28147-89 CFB with TC26-Z S-box.
1008  * @GNUTLS_PKCS_PBES2_GOST_CPA: PBES2 GOST 28147-89 CFB with CryptoPro-A S-box.
1009  * @GNUTLS_PKCS_PBES2_GOST_CPB: PBES2 GOST 28147-89 CFB with CryptoPro-B S-box.
1010  * @GNUTLS_PKCS_PBES2_GOST_CPC: PBES2 GOST 28147-89 CFB with CryptoPro-C S-box.
1011  * @GNUTLS_PKCS_PBES2_GOST_CPD: PBES2 GOST 28147-89 CFB with CryptoPro-D S-box.
1012  *
1013  * Enumeration of different PKCS encryption flags.
1014  */
1015 typedef enum gnutls_pkcs_encrypt_flags_t {
1016     GNUTLS_PKCS_PLAIN = 1,
1017     GNUTLS_PKCS_PKCS12_3DES = 1 << 1,
1018     GNUTLS_PKCS_PKCS12_ARCFOUR = 1 << 2,
1019     GNUTLS_PKCS_PKCS12_RC2_40 = 1 << 3,
1020     GNUTLS_PKCS_PBES2_3DES = 1 << 4,
1021     GNUTLS_PKCS_PBES2_AES_128 = 1 << 5,
1022     GNUTLS_PKCS_PBES2_AES_192 = 1 << 6,
1023     GNUTLS_PKCS_PBES2_AES_256 = 1 << 7,
1024     GNUTLS_PKCS_NULL_PASSWORD = 1 << 8,
1025     GNUTLS_PKCS_PBES2_DES = 1 << 9,
1026     GNUTLS_PKCS_PBES1_DES_MD5 = 1 << 10,
1027     GNUTLS_PKCS_PBES2_GOST_TC26Z = 1 << 11,
1028     GNUTLS_PKCS_PBES2_GOST_CPA = 1 << 12,
1029     GNUTLS_PKCS_PBES2_GOST_CPB = 1 << 13,
1030     GNUTLS_PKCS_PBES2_GOST_CPC = 1 << 14,
1031     GNUTLS_PKCS_PBES2_GOST_CPD = 1 << 15
1032 } gnutls_pkcs_encrypt_flags_t;
1033
1034 #define GNUTLS_PKCS_CIPHER_MASK(x) ((x) & (~(GNUTLS_PKCS_NULL_PASSWORD)))
1035
1036 #define GNUTLS_PKCS_USE_PKCS12_3DES GNUTLS_PKCS_PKCS12_3DES
1037 #define GNUTLS_PKCS_USE_PKCS12_ARCFOUR GNUTLS_PKCS_PKCS12_ARCFOUR
1038 #define GNUTLS_PKCS_USE_PKCS12_RC2_40 GNUTLS_PKCS_PKCS12_RC2_40
1039 #define GNUTLS_PKCS_USE_PBES2_3DES GNUTLS_PKCS_PBES2_3DES
1040 #define GNUTLS_PKCS_USE_PBES2_AES_128 GNUTLS_PKCS_PBES2_AES_128
1041 #define GNUTLS_PKCS_USE_PBES2_AES_192 GNUTLS_PKCS_PBES2_AES_192
1042 #define GNUTLS_PKCS_USE_PBES2_AES_256 GNUTLS_PKCS_PBES2_AES_256
1043 #define GNUTLS_PKCS_USE_PBES2_GOST_TC26Z GNUTLS_PKCS_PBES2_GOST_TC26Z
1044 #define GNUTLS_PKCS_USE_PBES2_GOST_CPA GNUTLS_PKCS_PBES2_GOST_CPA
1045 #define GNUTLS_PKCS_USE_PBES2_GOST_CPB GNUTLS_PKCS_PBES2_GOST_CPB
1046 #define GNUTLS_PKCS_USE_PBES2_GOST_CPC GNUTLS_PKCS_PBES2_GOST_CPC
1047 #define GNUTLS_PKCS_USE_PBES2_GOST_CPD GNUTLS_PKCS_PBES2_GOST_CPD
1048
1049 const char *gnutls_pkcs_schema_get_name(unsigned int schema);
1050 const char *gnutls_pkcs_schema_get_oid(unsigned int schema);
1051
1052 int gnutls_x509_privkey_init(gnutls_x509_privkey_t *key);
1053 void gnutls_x509_privkey_deinit(gnutls_x509_privkey_t key);
1054 gnutls_sec_param_t gnutls_x509_privkey_sec_param(gnutls_x509_privkey_t key);
1055
1056 void gnutls_x509_privkey_set_pin_function(gnutls_x509_privkey_t key,
1057                       gnutls_pin_callback_t fn,
1058                       void *userdata);
1059
1060 int gnutls_x509_privkey_cpy(gnutls_x509_privkey_t dst,
1061                 gnutls_x509_privkey_t src);
1062 int gnutls_x509_privkey_import(gnutls_x509_privkey_t key,
1063                    const gnutls_datum_t *data,
1064                    gnutls_x509_crt_fmt_t format);
1065 int gnutls_x509_privkey_import_pkcs8(gnutls_x509_privkey_t key,
1066                      const gnutls_datum_t *data,
1067                      gnutls_x509_crt_fmt_t format,
1068                      const char *password, unsigned int flags);
1069 int gnutls_x509_privkey_import_openssl(gnutls_x509_privkey_t key,
1070                        const gnutls_datum_t *data,
1071                        const char *password);
1072
1073 int gnutls_pkcs8_info(const gnutls_datum_t *data, gnutls_x509_crt_fmt_t format,
1074               unsigned int *schema, unsigned int *cipher, void *salt,
1075               unsigned int *salt_size, unsigned int *iter_count,
1076               char **oid);
1077
1078 int gnutls_x509_privkey_import2(gnutls_x509_privkey_t key,
1079                 const gnutls_datum_t *data,
1080                 gnutls_x509_crt_fmt_t format,
1081                 const char *password, unsigned int flags);
1082
1083 int gnutls_x509_privkey_import_rsa_raw(gnutls_x509_privkey_t key,
1084                        const gnutls_datum_t *m,
1085                        const gnutls_datum_t *e,
1086                        const gnutls_datum_t *d,
1087                        const gnutls_datum_t *p,
1088                        const gnutls_datum_t *q,
1089                        const gnutls_datum_t *u);
1090 int gnutls_x509_privkey_import_rsa_raw2(
1091     gnutls_x509_privkey_t key, const gnutls_datum_t *m,
1092     const gnutls_datum_t *e, const gnutls_datum_t *d,
1093     const gnutls_datum_t *p, const gnutls_datum_t *q,
1094     const gnutls_datum_t *u, const gnutls_datum_t *e1,
1095     const gnutls_datum_t *e2);
1096 int gnutls_x509_privkey_import_ecc_raw(gnutls_x509_privkey_t key,
1097                        gnutls_ecc_curve_t curve,
1098                        const gnutls_datum_t *x,
1099                        const gnutls_datum_t *y,
1100                        const gnutls_datum_t *k);
1101 int gnutls_x509_privkey_import_gost_raw(gnutls_x509_privkey_t key,
1102                     gnutls_ecc_curve_t curve,
1103                     gnutls_digest_algorithm_t digest,
1104                     gnutls_gost_paramset_t paramset,
1105                     const gnutls_datum_t *x,
1106                     const gnutls_datum_t *y,
1107                     const gnutls_datum_t *k);
1108
1109 int gnutls_x509_privkey_fix(gnutls_x509_privkey_t key);
1110
1111 int gnutls_x509_privkey_export_dsa_raw(gnutls_x509_privkey_t key,
1112                        gnutls_datum_t *p, gnutls_datum_t *q,
1113                        gnutls_datum_t *g, gnutls_datum_t *y,
1114                        gnutls_datum_t *x);
1115 int gnutls_x509_privkey_import_dsa_raw(gnutls_x509_privkey_t key,
1116                        const gnutls_datum_t *p,
1117                        const gnutls_datum_t *q,
1118                        const gnutls_datum_t *g,
1119                        const gnutls_datum_t *y,
1120                        const gnutls_datum_t *x);
1121 int gnutls_x509_privkey_import_dh_raw(gnutls_x509_privkey_t key,
1122                       const gnutls_dh_params_t params,
1123                       const gnutls_datum_t *y,
1124                       const gnutls_datum_t *x);
1125
1126 int gnutls_x509_privkey_get_pk_algorithm(gnutls_x509_privkey_t key);
1127 int gnutls_x509_privkey_get_pk_algorithm2(gnutls_x509_privkey_t key,
1128                       unsigned int *bits);
1129 int gnutls_x509_privkey_get_spki(gnutls_x509_privkey_t key,
1130                  gnutls_x509_spki_t spki, unsigned int flags);
1131 int gnutls_x509_privkey_set_spki(gnutls_x509_privkey_t key,
1132                  const gnutls_x509_spki_t spki,
1133                  unsigned int flags);
1134
1135 int gnutls_x509_privkey_get_key_id(gnutls_x509_privkey_t key,
1136                    unsigned int flags,
1137                    unsigned char *output_data,
1138                    size_t *output_data_size);
1139
1140 int gnutls_x509_privkey_generate(gnutls_x509_privkey_t key,
1141                  gnutls_pk_algorithm_t algo, unsigned int bits,
1142                  unsigned int flags);
1143
1144 void gnutls_x509_privkey_set_flags(gnutls_x509_privkey_t key,
1145                    unsigned int flags);
1146
1147 /**
1148  * gnutls_keygen_types_t:
1149  * @GNUTLS_KEYGEN_SEED: Specifies the seed to be used in key generation.
1150  * @GNUTLS_KEYGEN_DIGEST: The size field specifies the hash algorithm to be used in key generation.
1151  * @GNUTLS_KEYGEN_SPKI: data points to a %gnutls_x509_spki_t structure; it is not used after the key generation call.
1152  * @GNUTLS_KEYGEN_DH: data points to a %gnutls_dh_params_t structure; it is not used after the key generation call.
1153  *
1154  * Enumeration of different key generation data options.
1155  */
1156 typedef enum {
1157     GNUTLS_KEYGEN_SEED = 1,
1158     GNUTLS_KEYGEN_DIGEST = 2,
1159     GNUTLS_KEYGEN_SPKI = 3,
1160     GNUTLS_KEYGEN_DH = 4
1161 } gnutls_keygen_types_t;
1162
1163 typedef struct {
1164     gnutls_keygen_types_t type;
1165     unsigned char *data;
1166     unsigned int size;
1167 } gnutls_keygen_data_st;
1168
1169 int gnutls_x509_privkey_generate2(gnutls_x509_privkey_t key,
1170                   gnutls_pk_algorithm_t algo, unsigned int bits,
1171                   unsigned int flags,
1172                   const gnutls_keygen_data_st *data,
1173                   unsigned data_size);
1174
1175 int gnutls_x509_privkey_verify_seed(gnutls_x509_privkey_t key,
1176                     gnutls_digest_algorithm_t, const void *seed,
1177                     size_t seed_size);
1178 int gnutls_x509_privkey_get_seed(gnutls_x509_privkey_t key,
1179                  gnutls_digest_algorithm_t *, void *seed,
1180                  size_t *seed_size);
1181
1182 int gnutls_x509_privkey_verify_params(gnutls_x509_privkey_t key);
1183
1184 int gnutls_x509_privkey_export(gnutls_x509_privkey_t key,
1185                    gnutls_x509_crt_fmt_t format, void *output_data,
1186                    size_t *output_data_size);
1187 int gnutls_x509_privkey_export2(gnutls_x509_privkey_t key,
1188                 gnutls_x509_crt_fmt_t format,
1189                 gnutls_datum_t *out);
1190 int gnutls_x509_privkey_export_pkcs8(gnutls_x509_privkey_t key,
1191                      gnutls_x509_crt_fmt_t format,
1192                      const char *password, unsigned int flags,
1193                      void *output_data,
1194                      size_t *output_data_size);
1195 int gnutls_x509_privkey_export2_pkcs8(gnutls_x509_privkey_t key,
1196                       gnutls_x509_crt_fmt_t format,
1197                       const char *password, unsigned int flags,
1198                       gnutls_datum_t *out);
1199 int gnutls_x509_privkey_export_rsa_raw2(gnutls_x509_privkey_t key,
1200                     gnutls_datum_t *m, gnutls_datum_t *e,
1201                     gnutls_datum_t *d, gnutls_datum_t *p,
1202                     gnutls_datum_t *q, gnutls_datum_t *u,
1203                     gnutls_datum_t *e1, gnutls_datum_t *e2);
1204 int gnutls_x509_privkey_export_rsa_raw(gnutls_x509_privkey_t key,
1205                        gnutls_datum_t *m, gnutls_datum_t *e,
1206                        gnutls_datum_t *d, gnutls_datum_t *p,
1207                        gnutls_datum_t *q, gnutls_datum_t *u);
1208 int gnutls_x509_privkey_export_ecc_raw(gnutls_x509_privkey_t key,
1209                        gnutls_ecc_curve_t *curve,
1210                        gnutls_datum_t *x, gnutls_datum_t *y,
1211                        gnutls_datum_t *k);
1212 int gnutls_x509_privkey_export_gost_raw(gnutls_x509_privkey_t key,
1213                     gnutls_ecc_curve_t *curve,
1214                     gnutls_digest_algorithm_t *digest,
1215                     gnutls_gost_paramset_t *paramset,
1216                     gnutls_datum_t *x, gnutls_datum_t *y,
1217                     gnutls_datum_t *k);
1218
1219 int gnutls_x509_privkey_sign_data(gnutls_x509_privkey_t key,
1220                   gnutls_digest_algorithm_t digest,
1221                   unsigned int flags,
1222                   const gnutls_datum_t *data, void *signature,
1223                   size_t *signature_size);
1224
1225 /* Certificate request stuff.
1226  */
1227 int gnutls_x509_crq_sign(gnutls_x509_crq_t crq, gnutls_x509_privkey_t key);
1228
1229 int gnutls_x509_crq_sign2(gnutls_x509_crq_t crq, gnutls_x509_privkey_t key,
1230               gnutls_digest_algorithm_t dig, unsigned int flags);
1231
1232 int gnutls_x509_crq_print(gnutls_x509_crq_t crq,
1233               gnutls_certificate_print_formats_t format,
1234               gnutls_datum_t *out);
1235
1236 int gnutls_x509_crq_verify(gnutls_x509_crq_t crq, unsigned int flags);
1237
1238 int gnutls_x509_crq_init(gnutls_x509_crq_t *crq);
1239 void gnutls_x509_crq_deinit(gnutls_x509_crq_t crq);
1240 int gnutls_x509_crq_import(gnutls_x509_crq_t crq, const gnutls_datum_t *data,
1241                gnutls_x509_crt_fmt_t format);
1242
1243 int gnutls_x509_crq_get_private_key_usage_period(gnutls_x509_crq_t cert,
1244                          time_t *activation,
1245                          time_t *expiration,
1246                          unsigned int *critical);
1247
1248 int gnutls_x509_crq_get_dn(gnutls_x509_crq_t crq, char *buf,
1249                size_t *sizeof_buf);
1250 int gnutls_x509_crq_get_dn2(gnutls_x509_crq_t crq, gnutls_datum_t *dn);
1251 int gnutls_x509_crq_get_dn3(gnutls_x509_crq_t crq, gnutls_datum_t *dn,
1252                 unsigned flags);
1253 int gnutls_x509_crq_get_dn_oid(gnutls_x509_crq_t crq, unsigned indx, void *oid,
1254                    size_t *sizeof_oid);
1255 int gnutls_x509_crq_get_dn_by_oid(gnutls_x509_crq_t crq, const char *oid,
1256                   unsigned indx, unsigned int raw_flag,
1257                   void *buf, size_t *sizeof_buf);
1258 int gnutls_x509_crq_set_dn(gnutls_x509_crq_t crq, const char *dn,
1259                const char **err);
1260 int gnutls_x509_crq_set_dn_by_oid(gnutls_x509_crq_t crq, const char *oid,
1261                   unsigned int raw_flag, const void *data,
1262                   unsigned int sizeof_data);
1263 int gnutls_x509_crq_set_version(gnutls_x509_crq_t crq, unsigned int version);
1264 int gnutls_x509_crq_get_version(gnutls_x509_crq_t crq);
1265 int gnutls_x509_crq_set_key(gnutls_x509_crq_t crq, gnutls_x509_privkey_t key);
1266
1267 int gnutls_x509_crq_set_extension_by_oid(gnutls_x509_crq_t crq, const char *oid,
1268                      const void *buf, size_t sizeof_buf,
1269                      unsigned int critical);
1270
1271 int gnutls_x509_crq_set_challenge_password(gnutls_x509_crq_t crq,
1272                        const char *pass);
1273 int gnutls_x509_crq_get_challenge_password(gnutls_x509_crq_t crq, char *pass,
1274                        size_t *sizeof_pass);
1275
1276 int gnutls_x509_crq_set_attribute_by_oid(gnutls_x509_crq_t crq, const char *oid,
1277                      void *buf, size_t sizeof_buf);
1278 int gnutls_x509_crq_get_attribute_by_oid(gnutls_x509_crq_t crq, const char *oid,
1279                      unsigned indx, void *buf,
1280                      size_t *sizeof_buf);
1281
1282 int gnutls_x509_crq_export(gnutls_x509_crq_t crq, gnutls_x509_crt_fmt_t format,
1283                void *output_data, size_t *output_data_size);
1284 int gnutls_x509_crq_export2(gnutls_x509_crq_t crq, gnutls_x509_crt_fmt_t format,
1285                 gnutls_datum_t *out);
1286
1287 int gnutls_x509_crt_set_crq(gnutls_x509_crt_t crt, gnutls_x509_crq_t crq);
1288 int gnutls_x509_crt_set_crq_extensions(gnutls_x509_crt_t crt,
1289                        gnutls_x509_crq_t crq);
1290
1291 int gnutls_x509_crt_set_crq_extension_by_oid(gnutls_x509_crt_t crt,
1292                          gnutls_x509_crq_t crq,
1293                          const char *oid, unsigned flags);
1294
1295 int gnutls_x509_crq_set_private_key_usage_period(gnutls_x509_crq_t crq,
1296                          time_t activation,
1297                          time_t expiration);
1298 int gnutls_x509_crq_set_key_rsa_raw(gnutls_x509_crq_t crq,
1299                     const gnutls_datum_t *m,
1300                     const gnutls_datum_t *e);
1301 int gnutls_x509_crq_set_subject_alt_name(gnutls_x509_crq_t crq,
1302                      gnutls_x509_subject_alt_name_t nt,
1303                      const void *data,
1304                      unsigned int data_size,
1305                      unsigned int flags);
1306
1307 int gnutls_x509_crq_set_subject_alt_othername(gnutls_x509_crq_t crq,
1308                           const char *oid, const void *data,
1309                           unsigned int data_size,
1310                           unsigned int flags);
1311
1312 int gnutls_x509_crq_set_key_usage(gnutls_x509_crq_t crq, unsigned int usage);
1313 int gnutls_x509_crq_set_basic_constraints(gnutls_x509_crq_t crq,
1314                       unsigned int ca,
1315                       int pathLenConstraint);
1316 int gnutls_x509_crq_set_key_purpose_oid(gnutls_x509_crq_t crq, const void *oid,
1317                     unsigned int critical);
1318 int gnutls_x509_crq_get_key_purpose_oid(gnutls_x509_crq_t crq, unsigned indx,
1319                     void *oid, size_t *sizeof_oid,
1320                     unsigned int *critical);
1321
1322 int gnutls_x509_crq_get_extension_data(gnutls_x509_crq_t crq, unsigned indx,
1323                        void *data, size_t *sizeof_data);
1324 int gnutls_x509_crq_get_extension_data2(gnutls_x509_crq_t crq, unsigned indx,
1325                     gnutls_datum_t *data);
1326 int gnutls_x509_crq_get_extension_info(gnutls_x509_crq_t crq, unsigned indx,
1327                        void *oid, size_t *sizeof_oid,
1328                        unsigned int *critical);
1329 int gnutls_x509_crq_get_attribute_data(gnutls_x509_crq_t crq, unsigned indx,
1330                        void *data, size_t *sizeof_data);
1331 int gnutls_x509_crq_get_attribute_info(gnutls_x509_crq_t crq, unsigned indx,
1332                        void *oid, size_t *sizeof_oid);
1333 int gnutls_x509_crq_get_pk_algorithm(gnutls_x509_crq_t crq, unsigned int *bits);
1334 int gnutls_x509_crq_get_spki(gnutls_x509_crq_t crq, gnutls_x509_spki_t spki,
1335                  unsigned int flags);
1336
1337 int gnutls_x509_crq_set_spki(gnutls_x509_crq_t crq,
1338                  const gnutls_x509_spki_t spki, unsigned int flags);
1339
1340 int gnutls_x509_crq_get_signature_oid(gnutls_x509_crq_t crq, char *oid,
1341                       size_t *oid_size);
1342 int gnutls_x509_crq_get_pk_oid(gnutls_x509_crq_t crq, char *oid,
1343                    size_t *oid_size);
1344
1345 int gnutls_x509_crq_get_key_id(gnutls_x509_crq_t crq, unsigned int flags,
1346                    unsigned char *output_data,
1347                    size_t *output_data_size);
1348 int gnutls_x509_crq_get_key_rsa_raw(gnutls_x509_crq_t crq, gnutls_datum_t *m,
1349                     gnutls_datum_t *e);
1350
1351 int gnutls_x509_crq_get_key_usage(gnutls_x509_crq_t crq,
1352                   unsigned int *key_usage,
1353                   unsigned int *critical);
1354 int gnutls_x509_crq_get_basic_constraints(gnutls_x509_crq_t crq,
1355                       unsigned int *critical,
1356                       unsigned int *ca, int *pathlen);
1357 int gnutls_x509_crq_get_subject_alt_name(gnutls_x509_crq_t crq,
1358                      unsigned int seq, void *ret,
1359                      size_t *ret_size,
1360                      unsigned int *ret_type,
1361                      unsigned int *critical);
1362 int gnutls_x509_crq_get_subject_alt_othername_oid(gnutls_x509_crq_t crq,
1363                           unsigned int seq, void *ret,
1364                           size_t *ret_size);
1365
1366 int gnutls_x509_crq_get_extension_by_oid(gnutls_x509_crq_t crq, const char *oid,
1367                      unsigned indx, void *buf,
1368                      size_t *sizeof_buf,
1369                      unsigned int *critical);
1370
1371 int gnutls_x509_crq_get_tlsfeatures(gnutls_x509_crq_t crq,
1372                     gnutls_x509_tlsfeatures_t features,
1373                     unsigned flags, unsigned int *critical);
1374 int gnutls_x509_crq_set_tlsfeatures(gnutls_x509_crq_t crq,
1375                     gnutls_x509_tlsfeatures_t features);
1376
1377 int gnutls_x509_crt_get_extension_by_oid2(gnutls_x509_crt_t cert,
1378                       const char *oid, unsigned indx,
1379                       gnutls_datum_t *output,
1380                       unsigned int *critical);
1381
1382 typedef struct gnutls_x509_trust_list_st *gnutls_x509_trust_list_t;
1383 typedef struct gnutls_x509_trust_list_iter *gnutls_x509_trust_list_iter_t;
1384
1385 int gnutls_x509_trust_list_init(gnutls_x509_trust_list_t *list,
1386                 unsigned int size);
1387
1388 void gnutls_x509_trust_list_deinit(gnutls_x509_trust_list_t list,
1389                    unsigned int all);
1390
1391 int gnutls_x509_trust_list_get_issuer(gnutls_x509_trust_list_t list,
1392                       gnutls_x509_crt_t cert,
1393                       gnutls_x509_crt_t *issuer,
1394                       unsigned int flags);
1395
1396 int gnutls_x509_trust_list_get_issuer_by_dn(gnutls_x509_trust_list_t list,
1397                         const gnutls_datum_t *dn,
1398                         gnutls_x509_crt_t *issuer,
1399                         unsigned int flags);
1400
1401 int gnutls_x509_trust_list_get_issuer_by_subject_key_id(
1402     gnutls_x509_trust_list_t list, const gnutls_datum_t *dn,
1403     const gnutls_datum_t *spki, gnutls_x509_crt_t *issuer,
1404     unsigned int flags);
1405 /**
1406  * gnutls_trust_list_flags_t:
1407  * @GNUTLS_TL_VERIFY_CRL: If any CRLs are provided they will be verified for validity
1408  *   prior to be added. The CA certificates that will be used for verification are the
1409  *   ones already added in the trusted list.
1410  * @GNUTLS_TL_USE_IN_TLS: Internal flag used by GnuTLS. If provided the trust list
1411  *   structure will cache a copy of CA DNs to be used in the certificate request
1412  *   TLS message.
1413  * @GNUTLS_TL_NO_DUPLICATES: If this flag is specified, a function adding certificates
1414  *   will check and eliminate any duplicates.
1415  * @GNUTLS_TL_NO_DUPLICATE_KEY: If this flag is specified, a certificate sharing the
1416  *   same key as a previously added on will not be added.
1417  * @GNUTLS_TL_GET_COPY: The semantics of this flag are documented to the functions which
1418  *   are applicable. In general, on returned value, the function will provide a copy
1419  *   if this flag is provided, rather than a pointer to internal data.
1420  * @GNUTLS_TL_FAIL_ON_INVALID_CRL: If an CRL is added which cannot be validated return
1421  *   an error instead of ignoring (must be used with %GNUTLS_TL_VERIFY_CRL).
1422  *
1423  * Enumeration of different certificate trust list flags.
1424  */
1425 typedef enum gnutls_trust_list_flags_t {
1426     GNUTLS_TL_VERIFY_CRL = 1,
1427 #define GNUTLS_TL_VERIFY_CRL 1
1428     GNUTLS_TL_USE_IN_TLS = (1 << 1),
1429 #define GNUTLS_TL_USE_IN_TLS (1 << 1)
1430     GNUTLS_TL_NO_DUPLICATES = (1 << 2),
1431 #define GNUTLS_TL_NO_DUPLICATES (1 << 2)
1432     GNUTLS_TL_NO_DUPLICATE_KEY = (1 << 3),
1433 #define GNUTLS_TL_NO_DUPLICATE_KEY (1 << 3)
1434     GNUTLS_TL_GET_COPY = (1 << 4),
1435 #define GNUTLS_TL_GET_COPY (1 << 4)
1436     GNUTLS_TL_FAIL_ON_INVALID_CRL = (1 << 5)
1437 #define GNUTLS_TL_FAIL_ON_INVALID_CRL (1 << 5)
1438 } gnutls_trust_list_flags_t;
1439
1440 int gnutls_x509_trust_list_add_cas(gnutls_x509_trust_list_t list,
1441                    const gnutls_x509_crt_t *clist,
1442                    unsigned clist_size, unsigned int flags);
1443 int gnutls_x509_trust_list_remove_cas(gnutls_x509_trust_list_t list,
1444                       const gnutls_x509_crt_t *clist,
1445                       unsigned clist_size);
1446
1447 int gnutls_x509_trust_list_add_named_crt(gnutls_x509_trust_list_t list,
1448                      gnutls_x509_crt_t cert,
1449                      const void *name, size_t name_size,
1450                      unsigned int flags);
1451
1452 int gnutls_x509_trust_list_add_crls(gnutls_x509_trust_list_t list,
1453                     const gnutls_x509_crl_t *crl_list,
1454                     unsigned crl_size, unsigned int flags,
1455                     unsigned int verification_flags);
1456
1457 int gnutls_x509_trust_list_iter_get_ca(gnutls_x509_trust_list_t list,
1458                        gnutls_x509_trust_list_iter_t *iter,
1459                        gnutls_x509_crt_t *crt);
1460
1461 void gnutls_x509_trust_list_iter_deinit(gnutls_x509_trust_list_iter_t iter);
1462
1463 typedef int gnutls_verify_output_function(
1464     gnutls_x509_crt_t cert, gnutls_x509_crt_t issuer,
1465     /* The issuer if verification failed
1466                        * because of him. might be null.
1467                        */
1468     gnutls_x509_crl_t crl, /* The CRL that caused verification failure
1469                                      * if any. Might be null.
1470                                      */
1471     unsigned int verification_output);
1472
1473 void gnutls_session_set_verify_output_function(
1474     gnutls_session_t session, gnutls_verify_output_function *func);
1475
1476 int gnutls_x509_trust_list_verify_named_crt(gnutls_x509_trust_list_t list,
1477                         gnutls_x509_crt_t cert,
1478                         const void *name, size_t name_size,
1479                         unsigned int flags,
1480                         unsigned int *verify,
1481                         gnutls_verify_output_function func);
1482
1483 int gnutls_x509_trust_list_verify_crt2(
1484     gnutls_x509_trust_list_t list, gnutls_x509_crt_t *cert_list,
1485     unsigned int cert_list_size, gnutls_typed_vdata_st *data,
1486     unsigned int elements, unsigned int flags, unsigned int *voutput,
1487     gnutls_verify_output_function func);
1488
1489 int gnutls_x509_trust_list_verify_crt(gnutls_x509_trust_list_t list,
1490                       gnutls_x509_crt_t *cert_list,
1491                       unsigned int cert_list_size,
1492                       unsigned int flags, unsigned int *verify,
1493                       gnutls_verify_output_function func);
1494
1495 /* trust list convenience functions */
1496 int gnutls_x509_trust_list_add_trust_mem(gnutls_x509_trust_list_t list,
1497                      const gnutls_datum_t *cas,
1498                      const gnutls_datum_t *crls,
1499                      gnutls_x509_crt_fmt_t type,
1500                      unsigned int tl_flags,
1501                      unsigned int tl_vflags);
1502
1503 int gnutls_x509_trust_list_add_trust_file(gnutls_x509_trust_list_t list,
1504                       const char *ca_file,
1505                       const char *crl_file,
1506                       gnutls_x509_crt_fmt_t type,
1507                       unsigned int tl_flags,
1508                       unsigned int tl_vflags);
1509
1510 int gnutls_x509_trust_list_add_trust_dir(gnutls_x509_trust_list_t list,
1511                      const char *ca_dir,
1512                      const char *crl_dir,
1513                      gnutls_x509_crt_fmt_t type,
1514                      unsigned int tl_flags,
1515                      unsigned int tl_vflags);
1516
1517 int gnutls_x509_trust_list_remove_trust_file(gnutls_x509_trust_list_t list,
1518                          const char *ca_file,
1519                          gnutls_x509_crt_fmt_t type);
1520
1521 int gnutls_x509_trust_list_remove_trust_mem(gnutls_x509_trust_list_t list,
1522                         const gnutls_datum_t *cas,
1523                         gnutls_x509_crt_fmt_t type);
1524
1525 int gnutls_x509_trust_list_add_system_trust(gnutls_x509_trust_list_t list,
1526                         unsigned int tl_flags,
1527                         unsigned int tl_vflags);
1528
1529 typedef int gnutls_x509_trust_list_getissuer_function(
1530     gnutls_x509_trust_list_t list, const gnutls_x509_crt_t cert,
1531     gnutls_x509_crt_t **issuers, unsigned int *issuers_size);
1532
1533 void gnutls_x509_trust_list_set_getissuer_function(
1534     gnutls_x509_trust_list_t tlist,
1535     gnutls_x509_trust_list_getissuer_function *func);
1536
1537 void gnutls_x509_trust_list_set_ptr(gnutls_x509_trust_list_t tlist, void *ptr);
1538
1539 void *gnutls_x509_trust_list_get_ptr(gnutls_x509_trust_list_t tlist);
1540
1541 void gnutls_certificate_set_trust_list(gnutls_certificate_credentials_t res,
1542                        gnutls_x509_trust_list_t tlist,
1543                        unsigned flags);
1544 void gnutls_certificate_get_trust_list(gnutls_certificate_credentials_t res,
1545                        gnutls_x509_trust_list_t *tlist);
1546
1547 typedef struct gnutls_x509_ext_st {
1548     char *oid;
1549     unsigned int critical;
1550     gnutls_datum_t data;
1551 } gnutls_x509_ext_st;
1552
1553 void gnutls_x509_ext_deinit(gnutls_x509_ext_st *ext);
1554
1555 int gnutls_x509_ext_print(gnutls_x509_ext_st *exts, unsigned int exts_size,
1556               gnutls_certificate_print_formats_t format,
1557               gnutls_datum_t *out);
1558
1559 #include <gnutls/pkcs7.h>
1560
1561 #ifdef __cplusplus
1562 }
1563 #endif
1564
1565 #endif /* GNUTLS_X509_H */