Back to home page

EIC code displayed by LXR
 
 

    

File indexing completed on 2025-09-13 08:59:12 

0001 /*
0002  * Copyright (C) 2003-2016 Free Software Foundation, Inc.
0003  * Copyright (C) 2015-2016 Red Hat, Inc.
0004  *
0005  * Author: Nikos Mavrogiannopoulos
0006  *
0007  * This file is part of GnuTLS.
0008  *
0009  * The GnuTLS is free software; you can redistribute it and/or
0010  * modify it under the terms of the GNU Lesser General Public License
0011  * as published by the Free Software Foundation; either version 2.1 of
0012  * the License, or (at your option) any later version.
0013  *
0014  * This library is distributed in the hope that it will be useful, but
0015  * WITHOUT ANY WARRANTY; without even the implied warranty of
0016  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
0017  * Lesser General Public License for more details.
0018  *
0019  * You should have received a copy of the GNU Lesser General Public License
0020  * along with this program.  If not, see <https://www.gnu.org/licenses/>
0021  *
0022  */
0023 
0024 /* This file contains the types and prototypes for the X.509
0025  * certificate and CRL handling functions.
0026  */
0027 
0028 #ifndef GNUTLS_X509_H
0029 #define GNUTLS_X509_H
0030 
0031 #include <gnutls/gnutls.h>
0032 
0033 #ifdef __cplusplus
0034 extern "C" {
0035 #endif
0036 
0037 /* Some OIDs usually found in Distinguished names, or
0038  * in Subject Directory Attribute extensions.
0039  */
0040 #define GNUTLS_OID_X520_COUNTRY_NAME "2.5.4.6"
0041 #define GNUTLS_OID_X520_ORGANIZATION_NAME "2.5.4.10"
0042 #define GNUTLS_OID_X520_ORGANIZATIONAL_UNIT_NAME "2.5.4.11"
0043 #define GNUTLS_OID_X520_COMMON_NAME "2.5.4.3"
0044 #define GNUTLS_OID_X520_LOCALITY_NAME "2.5.4.7"
0045 #define GNUTLS_OID_X520_STATE_OR_PROVINCE_NAME "2.5.4.8"
0046 
0047 #define GNUTLS_OID_X520_INITIALS "2.5.4.43"
0048 #define GNUTLS_OID_X520_GENERATION_QUALIFIER "2.5.4.44"
0049 #define GNUTLS_OID_X520_SURNAME "2.5.4.4"
0050 #define GNUTLS_OID_X520_GIVEN_NAME "2.5.4.42"
0051 #define GNUTLS_OID_X520_TITLE "2.5.4.12"
0052 #define GNUTLS_OID_X520_DN_QUALIFIER "2.5.4.46"
0053 #define GNUTLS_OID_X520_PSEUDONYM "2.5.4.65"
0054 #define GNUTLS_OID_X520_POSTALCODE "2.5.4.17"
0055 #define GNUTLS_OID_X520_NAME "2.5.4.41"
0056 
0057 #define GNUTLS_OID_LDAP_DC "0.9.2342.19200300.100.1.25"
0058 #define GNUTLS_OID_LDAP_UID "0.9.2342.19200300.100.1.1"
0059 
0060 /* The following should not be included in DN.
0061  */
0062 #define GNUTLS_OID_PKCS9_EMAIL "1.2.840.113549.1.9.1"
0063 
0064 #define GNUTLS_OID_PKIX_DATE_OF_BIRTH "1.3.6.1.5.5.7.9.1"
0065 #define GNUTLS_OID_PKIX_PLACE_OF_BIRTH "1.3.6.1.5.5.7.9.2"
0066 #define GNUTLS_OID_PKIX_GENDER "1.3.6.1.5.5.7.9.3"
0067 #define GNUTLS_OID_PKIX_COUNTRY_OF_CITIZENSHIP "1.3.6.1.5.5.7.9.4"
0068 #define GNUTLS_OID_PKIX_COUNTRY_OF_RESIDENCE "1.3.6.1.5.5.7.9.5"
0069 
0070 /* Key purpose Object Identifiers.
0071  */
0072 #define GNUTLS_KP_TLS_WWW_SERVER "1.3.6.1.5.5.7.3.1"
0073 #define GNUTLS_KP_TLS_WWW_CLIENT "1.3.6.1.5.5.7.3.2"
0074 #define GNUTLS_KP_CODE_SIGNING "1.3.6.1.5.5.7.3.3"
0075 #define GNUTLS_KP_MS_SMART_CARD_LOGON "1.3.6.1.4.1.311.20.2.2"
0076 #define GNUTLS_KP_EMAIL_PROTECTION "1.3.6.1.5.5.7.3.4"
0077 #define GNUTLS_KP_TIME_STAMPING "1.3.6.1.5.5.7.3.8"
0078 #define GNUTLS_KP_OCSP_SIGNING "1.3.6.1.5.5.7.3.9"
0079 #define GNUTLS_KP_IPSEC_IKE "1.3.6.1.5.5.7.3.17"
0080 #define GNUTLS_KP_ANY "2.5.29.37.0"
0081 
0082 #define GNUTLS_KP_FLAG_DISALLOW_ANY 1
0083 
0084 #define GNUTLS_OID_AIA "1.3.6.1.5.5.7.1.1"
0085 #define GNUTLS_OID_AD_OCSP "1.3.6.1.5.5.7.48.1"
0086 #define GNUTLS_OID_AD_CAISSUERS "1.3.6.1.5.5.7.48.2"
0087 
0088 #define GNUTLS_FSAN_SET 0
0089 #define GNUTLS_FSAN_APPEND 1
0090 #define GNUTLS_FSAN_ENCODE_OCTET_STRING (1 << 1)
0091 #define GNUTLS_FSAN_ENCODE_UTF8_STRING (1 << 2)
0092 
0093 #define GNUTLS_X509EXT_OID_SUBJECT_KEY_ID "2.5.29.14"
0094 #define GNUTLS_X509EXT_OID_KEY_USAGE "2.5.29.15"
0095 #define GNUTLS_X509EXT_OID_PRIVATE_KEY_USAGE_PERIOD "2.5.29.16"
0096 #define GNUTLS_X509EXT_OID_SAN "2.5.29.17"
0097 #define GNUTLS_X509EXT_OID_IAN "2.5.29.18"
0098 #define GNUTLS_X509EXT_OID_BASIC_CONSTRAINTS "2.5.29.19"
0099 #define GNUTLS_X509EXT_OID_NAME_CONSTRAINTS "2.5.29.30"
0100 #define GNUTLS_X509EXT_OID_CRL_DIST_POINTS "2.5.29.31"
0101 #define GNUTLS_X509EXT_OID_CRT_POLICY "2.5.29.32"
0102 #define GNUTLS_X509EXT_OID_AUTHORITY_KEY_ID "2.5.29.35"
0103 #define GNUTLS_X509EXT_OID_EXTENDED_KEY_USAGE "2.5.29.37"
0104 #define GNUTLS_X509EXT_OID_INHIBIT_ANYPOLICY "2.5.29.52"
0105 #define GNUTLS_X509EXT_OID_AUTHORITY_INFO_ACCESS "1.3.6.1.5.5.7.1.1"
0106 #define GNUTLS_X509EXT_OID_PROXY_CRT_INFO "1.3.6.1.5.5.7.1.14"
0107 #define GNUTLS_X509EXT_OID_TLSFEATURES "1.3.6.1.5.5.7.1.24"
0108 #define GNUTLS_X509EXT_OID_CT_SCT_V1 "1.3.6.1.4.1.11129.2.4.2"
0109 
0110 #define GNUTLS_X509_OID_POLICY_ANY "2.5.29.54"
0111 
0112 /* Certificate handling functions.
0113  */
0114 
0115 /**
0116  * gnutls_certificate_import_flags:
0117  * @GNUTLS_X509_CRT_LIST_IMPORT_FAIL_IF_EXCEED: Fail if the
0118  *   certificates in the buffer are more than the space allocated for
0119  *   certificates. The error code will be %GNUTLS_E_SHORT_MEMORY_BUFFER.
0120  * @GNUTLS_X509_CRT_LIST_FAIL_IF_UNSORTED: Fail if the certificates
0121  *   in the buffer are not ordered starting from subject to issuer.
0122  *   The error code will be %GNUTLS_E_CERTIFICATE_LIST_UNSORTED.
0123  * @GNUTLS_X509_CRT_LIST_SORT: Sort the certificate chain if unsorted.
0124  *
0125  * Enumeration of different certificate import flags.
0126  */
0127 typedef enum gnutls_certificate_import_flags {
0128     GNUTLS_X509_CRT_LIST_IMPORT_FAIL_IF_EXCEED = 1,
0129     GNUTLS_X509_CRT_LIST_FAIL_IF_UNSORTED = 1 << 1,
0130     GNUTLS_X509_CRT_LIST_SORT = 1 << 2
0131 } gnutls_certificate_import_flags;
0132 
0133 int gnutls_x509_crt_init(gnutls_x509_crt_t *cert);
0134 void gnutls_x509_crt_deinit(gnutls_x509_crt_t cert);
0135 
0136 /**
0137  * gnutls_certificate_import_flags:
0138  * @GNUTLS_X509_CRT_FLAG_IGNORE_SANITY: Ignore any sanity checks at the
0139  *   import of the certificate; i.e., ignore checks such as version/field
0140  *   matching and strict time field checks. Intended to be used for debugging.
0141  *
0142  * Enumeration of different certificate flags.
0143  */
0144 typedef enum gnutls_x509_crt_flags {
0145     GNUTLS_X509_CRT_FLAG_IGNORE_SANITY = 1
0146 } gnutls_x509_crt_flags;
0147 void gnutls_x509_crt_set_flags(gnutls_x509_crt_t cert, unsigned flags);
0148 
0149 unsigned gnutls_x509_crt_equals(gnutls_x509_crt_t cert1,
0150                 gnutls_x509_crt_t cert2);
0151 unsigned gnutls_x509_crt_equals2(gnutls_x509_crt_t cert1,
0152                  const gnutls_datum_t *der);
0153 
0154 int gnutls_x509_crt_import(gnutls_x509_crt_t cert, const gnutls_datum_t *data,
0155                gnutls_x509_crt_fmt_t format);
0156 int gnutls_x509_crt_list_import2(gnutls_x509_crt_t **certs, unsigned int *size,
0157                  const gnutls_datum_t *data,
0158                  gnutls_x509_crt_fmt_t format,
0159                  unsigned int flags);
0160 int gnutls_x509_crt_list_import(gnutls_x509_crt_t *certs,
0161                 unsigned int *cert_max,
0162                 const gnutls_datum_t *data,
0163                 gnutls_x509_crt_fmt_t format,
0164                 unsigned int flags);
0165 
0166 int gnutls_x509_crt_import_url(gnutls_x509_crt_t crt, const char *url,
0167                    unsigned int flags
0168                    /* GNUTLS_PKCS11_OBJ_FLAG_* */
0169 );
0170 
0171 int gnutls_x509_crt_list_import_url(gnutls_x509_crt_t **certs,
0172                     unsigned int *size, const char *url,
0173                     gnutls_pin_callback_t pin_fn,
0174                     void *pin_fn_userdata, unsigned int flags);
0175 
0176 int gnutls_x509_crt_export(gnutls_x509_crt_t cert, gnutls_x509_crt_fmt_t format,
0177                void *output_data, size_t *output_data_size);
0178 int gnutls_x509_crt_export2(gnutls_x509_crt_t cert,
0179                 gnutls_x509_crt_fmt_t format, gnutls_datum_t *out);
0180 int gnutls_x509_crt_get_private_key_usage_period(gnutls_x509_crt_t cert,
0181                          time_t *activation,
0182                          time_t *expiration,
0183                          unsigned int *critical);
0184 
0185 int gnutls_x509_crt_get_issuer_dn(gnutls_x509_crt_t cert, char *buf,
0186                   size_t *buf_size);
0187 int gnutls_x509_crt_get_issuer_dn2(gnutls_x509_crt_t cert, gnutls_datum_t *dn);
0188 int gnutls_x509_crt_get_issuer_dn3(gnutls_x509_crt_t cert, gnutls_datum_t *dn,
0189                    unsigned flags);
0190 int gnutls_x509_crt_get_issuer_dn_oid(gnutls_x509_crt_t cert, unsigned indx,
0191                       void *oid, size_t *oid_size);
0192 int gnutls_x509_crt_get_issuer_dn_by_oid(gnutls_x509_crt_t cert,
0193                      const char *oid, unsigned indx,
0194                      unsigned int raw_flag, void *buf,
0195                      size_t *buf_size);
0196 
0197 int gnutls_x509_crt_get_dn(gnutls_x509_crt_t cert, char *buf, size_t *buf_size);
0198 int gnutls_x509_crt_get_dn2(gnutls_x509_crt_t cert, gnutls_datum_t *dn);
0199 int gnutls_x509_crt_get_dn3(gnutls_x509_crt_t cert, gnutls_datum_t *dn,
0200                 unsigned flags);
0201 
0202 int gnutls_x509_crt_get_dn_oid(gnutls_x509_crt_t cert, unsigned indx, void *oid,
0203                    size_t *oid_size);
0204 int gnutls_x509_crt_get_dn_by_oid(gnutls_x509_crt_t cert, const char *oid,
0205                   unsigned indx, unsigned int raw_flag,
0206                   void *buf, size_t *buf_size);
0207 unsigned gnutls_x509_crt_check_hostname(gnutls_x509_crt_t cert,
0208                     const char *hostname);
0209 unsigned gnutls_x509_crt_check_hostname2(gnutls_x509_crt_t cert,
0210                      const char *hostname,
0211                      unsigned int flags);
0212 unsigned gnutls_x509_crt_check_email(gnutls_x509_crt_t cert, const char *email,
0213                      unsigned int flags);
0214 
0215 unsigned gnutls_x509_crt_check_ip(gnutls_x509_crt_t cert,
0216                   const unsigned char *ip, unsigned int ip_size,
0217                   unsigned int flags);
0218 
0219 int gnutls_x509_crt_get_signature_algorithm(gnutls_x509_crt_t cert);
0220 int gnutls_x509_crt_get_signature(gnutls_x509_crt_t cert, char *sig,
0221                   size_t *sizeof_sig);
0222 int gnutls_x509_crt_get_version(gnutls_x509_crt_t cert);
0223 
0224 int gnutls_x509_crt_get_pk_oid(gnutls_x509_crt_t cert, char *oid,
0225                    size_t *oid_size);
0226 int gnutls_x509_crt_get_signature_oid(gnutls_x509_crt_t cert, char *oid,
0227                       size_t *oid_size);
0228 
0229 /**
0230  * gnutls_keyid_flags_t:
0231  * @GNUTLS_KEYID_USE_SHA1: Use SHA1 as the key ID algorithm (default).
0232  * @GNUTLS_KEYID_USE_SHA256: Use SHA256 as the key ID algorithm.
0233  * @GNUTLS_KEYID_USE_SHA512: Use SHA512 as the key ID algorithm.
0234  * @GNUTLS_KEYID_USE_BEST_KNOWN: Use the best known algorithm to calculate key ID. Using that option will make your program behavior depend on the version of gnutls linked with. That option has a cap of 64-bytes key IDs.
0235  *
0236  * Enumeration of different flags for the key ID functions.
0237  
0238  */
0239 typedef enum {
0240     GNUTLS_KEYID_USE_SHA1 = 0,
0241     GNUTLS_KEYID_USE_SHA256 = (1 << 0),
0242     GNUTLS_KEYID_USE_SHA512 = (1 << 1),
0243     GNUTLS_KEYID_USE_BEST_KNOWN = (1 << 30)
0244 } gnutls_keyid_flags_t;
0245 int gnutls_x509_crt_get_key_id(gnutls_x509_crt_t crt, unsigned int flags,
0246                    unsigned char *output_data,
0247                    size_t *output_data_size);
0248 
0249 int gnutls_x509_crt_set_private_key_usage_period(gnutls_x509_crt_t crt,
0250                          time_t activation,
0251                          time_t expiration);
0252 int gnutls_x509_crt_set_authority_key_id(gnutls_x509_crt_t cert, const void *id,
0253                      size_t id_size);
0254 int gnutls_x509_crt_get_authority_key_id(gnutls_x509_crt_t cert, void *id,
0255                      size_t *id_size,
0256                      unsigned int *critical);
0257 int gnutls_x509_crt_get_authority_key_gn_serial(
0258     gnutls_x509_crt_t cert, unsigned int seq, void *alt, size_t *alt_size,
0259     unsigned int *alt_type, void *serial, size_t *serial_size,
0260     unsigned int *critical);
0261 
0262 int gnutls_x509_crt_get_subject_key_id(gnutls_x509_crt_t cert, void *ret,
0263                        size_t *ret_size,
0264                        unsigned int *critical);
0265 
0266 int gnutls_x509_crt_get_subject_unique_id(gnutls_x509_crt_t crt, char *buf,
0267                       size_t *buf_size);
0268 
0269 int gnutls_x509_crt_get_issuer_unique_id(gnutls_x509_crt_t crt, char *buf,
0270                      size_t *buf_size);
0271 
0272 void gnutls_x509_crt_set_pin_function(gnutls_x509_crt_t crt,
0273                       gnutls_pin_callback_t fn, void *userdata);
0274 
0275 /**
0276    * gnutls_info_access_what_t:
0277    * @GNUTLS_IA_ACCESSMETHOD_OID: Get accessMethod OID.
0278    * @GNUTLS_IA_ACCESSLOCATION_GENERALNAME_TYPE: Get accessLocation name type.
0279    * @GNUTLS_IA_URI: Get accessLocation URI value.
0280    * @GNUTLS_IA_OCSP_URI: get accessLocation URI value for OCSP.
0281    * @GNUTLS_IA_CAISSUERS_URI: get accessLocation URI value for caIssuers.
0282    *
0283    * Enumeration of types for the @what parameter of
0284    * gnutls_x509_crt_get_authority_info_access().
0285    */
0286 typedef enum gnutls_info_access_what_t {
0287     GNUTLS_IA_ACCESSMETHOD_OID = 1,
0288     GNUTLS_IA_ACCESSLOCATION_GENERALNAME_TYPE = 2,
0289     /* use 100-108 for the generalName types, populate as needed */
0290     GNUTLS_IA_URI = 106,
0291     /* quick-access variants that match both OID and name type. */
0292     GNUTLS_IA_UNKNOWN = 10000,
0293     GNUTLS_IA_OCSP_URI = 10006,
0294     GNUTLS_IA_CAISSUERS_URI = 10106
0295 } gnutls_info_access_what_t;
0296 
0297 int gnutls_x509_crt_get_authority_info_access(gnutls_x509_crt_t crt,
0298                           unsigned int seq, int what,
0299                           gnutls_datum_t *data,
0300                           unsigned int *critical);
0301 
0302 typedef struct gnutls_name_constraints_st *gnutls_x509_name_constraints_t;
0303 
0304 unsigned gnutls_x509_name_constraints_check(gnutls_x509_name_constraints_t nc,
0305                         gnutls_x509_subject_alt_name_t type,
0306                         const gnutls_datum_t *name);
0307 unsigned
0308 gnutls_x509_name_constraints_check_crt(gnutls_x509_name_constraints_t nc,
0309                        gnutls_x509_subject_alt_name_t type,
0310                        gnutls_x509_crt_t crt);
0311 
0312 int gnutls_x509_name_constraints_init(gnutls_x509_name_constraints_t *nc);
0313 void gnutls_x509_name_constraints_deinit(gnutls_x509_name_constraints_t nc);
0314 
0315 #define GNUTLS_EXT_FLAG_APPEND 1
0316 
0317 #define GNUTLS_NAME_CONSTRAINTS_FLAG_APPEND GNUTLS_EXT_FLAG_APPEND
0318 int gnutls_x509_crt_get_name_constraints(gnutls_x509_crt_t crt,
0319                      gnutls_x509_name_constraints_t nc,
0320                      unsigned int flags,
0321                      unsigned int *critical);
0322 int gnutls_x509_name_constraints_add_permitted(
0323     gnutls_x509_name_constraints_t nc, gnutls_x509_subject_alt_name_t type,
0324     const gnutls_datum_t *name);
0325 int gnutls_x509_name_constraints_add_excluded(
0326     gnutls_x509_name_constraints_t nc, gnutls_x509_subject_alt_name_t type,
0327     const gnutls_datum_t *name);
0328 int gnutls_x509_crt_set_name_constraints(gnutls_x509_crt_t crt,
0329                      gnutls_x509_name_constraints_t nc,
0330                      unsigned int critical);
0331 int gnutls_x509_name_constraints_get_permitted(gnutls_x509_name_constraints_t nc,
0332                            unsigned idx, unsigned *type,
0333                            gnutls_datum_t *name);
0334 int gnutls_x509_name_constraints_get_excluded(gnutls_x509_name_constraints_t nc,
0335                           unsigned idx, unsigned *type,
0336                           gnutls_datum_t *name);
0337 int gnutls_x509_cidr_to_rfc5280(const char *cidr, gnutls_datum_t *cidr_rfc5280);
0338 
0339 #define GNUTLS_CRL_REASON_SUPERSEEDED GNUTLS_CRL_REASON_SUPERSEDED,
0340 /**
0341    * gnutls_x509_crl_reason_flags_t:
0342    * @GNUTLS_CRL_REASON_PRIVILEGE_WITHDRAWN: The privileges were withdrawn from the owner.
0343    * @GNUTLS_CRL_REASON_CERTIFICATE_HOLD: The certificate is on hold.
0344    * @GNUTLS_CRL_REASON_CESSATION_OF_OPERATION: The end-entity is no longer operating.
0345    * @GNUTLS_CRL_REASON_SUPERSEDED: There is a newer certificate of the owner.
0346    * @GNUTLS_CRL_REASON_AFFILIATION_CHANGED: The end-entity affiliation has changed.
0347    * @GNUTLS_CRL_REASON_CA_COMPROMISE: The CA was compromised.
0348    * @GNUTLS_CRL_REASON_KEY_COMPROMISE: The certificate's key was compromised.
0349    * @GNUTLS_CRL_REASON_UNUSED: The key was never used.
0350    * @GNUTLS_CRL_REASON_AA_COMPROMISE: AA compromised.
0351    *
0352    * Enumeration of types for the CRL revocation reasons. 
0353    */
0354 typedef enum gnutls_x509_crl_reason_flags_t {
0355     GNUTLS_CRL_REASON_UNSPECIFIED = 0,
0356     GNUTLS_CRL_REASON_PRIVILEGE_WITHDRAWN = 1,
0357     GNUTLS_CRL_REASON_CERTIFICATE_HOLD = 2,
0358     GNUTLS_CRL_REASON_CESSATION_OF_OPERATION = 4,
0359     GNUTLS_CRL_REASON_SUPERSEDED = 8,
0360     GNUTLS_CRL_REASON_AFFILIATION_CHANGED = 16,
0361     GNUTLS_CRL_REASON_CA_COMPROMISE = 32,
0362     GNUTLS_CRL_REASON_KEY_COMPROMISE = 64,
0363     GNUTLS_CRL_REASON_UNUSED = 128,
0364     GNUTLS_CRL_REASON_AA_COMPROMISE = 32768
0365 } gnutls_x509_crl_reason_flags_t;
0366 
0367 int gnutls_x509_crt_get_crl_dist_points(gnutls_x509_crt_t cert,
0368                     unsigned int seq, void *ret,
0369                     size_t *ret_size,
0370                     unsigned int *reason_flags,
0371                     unsigned int *critical);
0372 int gnutls_x509_crt_set_crl_dist_points2(gnutls_x509_crt_t crt,
0373                      gnutls_x509_subject_alt_name_t type,
0374                      const void *data,
0375                      unsigned int data_size,
0376                      unsigned int reason_flags);
0377 int gnutls_x509_crt_set_crl_dist_points(gnutls_x509_crt_t crt,
0378                     gnutls_x509_subject_alt_name_t type,
0379                     const void *data_string,
0380                     unsigned int reason_flags);
0381 int gnutls_x509_crt_cpy_crl_dist_points(gnutls_x509_crt_t dst,
0382                     gnutls_x509_crt_t src);
0383 
0384 int gnutls_x509_crl_sign(gnutls_x509_crl_t crl, gnutls_x509_crt_t issuer,
0385              gnutls_x509_privkey_t issuer_key);
0386 
0387 int gnutls_x509_crl_sign2(gnutls_x509_crl_t crl, gnutls_x509_crt_t issuer,
0388               gnutls_x509_privkey_t issuer_key,
0389               gnutls_digest_algorithm_t dig, unsigned int flags);
0390 
0391 time_t gnutls_x509_crt_get_activation_time(gnutls_x509_crt_t cert);
0392 
0393 /* This macro is deprecated and defunc; do not use */
0394 #define GNUTLS_X509_NO_WELL_DEFINED_EXPIRATION ((time_t)4294197631)
0395 
0396 time_t gnutls_x509_crt_get_expiration_time(gnutls_x509_crt_t cert);
0397 int gnutls_x509_crt_get_serial(gnutls_x509_crt_t cert, void *result,
0398                    size_t *result_size);
0399 
0400 typedef struct gnutls_x509_spki_st *gnutls_x509_spki_t;
0401 
0402 int gnutls_x509_spki_init(gnutls_x509_spki_t *spki);
0403 void gnutls_x509_spki_deinit(gnutls_x509_spki_t spki);
0404 
0405 int gnutls_x509_spki_get_rsa_pss_params(gnutls_x509_spki_t spki,
0406                     gnutls_digest_algorithm_t *dig,
0407                     unsigned int *salt_size);
0408 
0409 void gnutls_x509_spki_set_rsa_pss_params(gnutls_x509_spki_t spki,
0410                      gnutls_digest_algorithm_t dig,
0411                      unsigned int salt_size);
0412 
0413 int gnutls_x509_spki_set_rsa_oaep_params(gnutls_x509_spki_t spki,
0414                      gnutls_digest_algorithm_t dig,
0415                      const gnutls_datum_t *label);
0416 
0417 int gnutls_x509_spki_get_rsa_oaep_params(gnutls_x509_spki_t spki,
0418                      gnutls_digest_algorithm_t *dig,
0419                      gnutls_datum_t *label);
0420 
0421 int gnutls_x509_crt_get_pk_algorithm(gnutls_x509_crt_t cert,
0422                      unsigned int *bits);
0423 int gnutls_x509_crt_set_spki(gnutls_x509_crt_t crt,
0424                  const gnutls_x509_spki_t spki, unsigned int flags);
0425 int gnutls_x509_crt_get_spki(gnutls_x509_crt_t cert, gnutls_x509_spki_t spki,
0426                  unsigned int flags);
0427 
0428 int gnutls_x509_crt_get_pk_rsa_raw(gnutls_x509_crt_t crt, gnutls_datum_t *m,
0429                    gnutls_datum_t *e);
0430 int gnutls_x509_crt_get_pk_dsa_raw(gnutls_x509_crt_t crt, gnutls_datum_t *p,
0431                    gnutls_datum_t *q, gnutls_datum_t *g,
0432                    gnutls_datum_t *y);
0433 int gnutls_x509_crt_get_pk_ecc_raw(gnutls_x509_crt_t crt,
0434                    gnutls_ecc_curve_t *curve, gnutls_datum_t *x,
0435                    gnutls_datum_t *y);
0436 int gnutls_x509_crt_get_pk_gost_raw(gnutls_x509_crt_t crt,
0437                     gnutls_ecc_curve_t *curve,
0438                     gnutls_digest_algorithm_t *digest,
0439                     gnutls_gost_paramset_t *paramset,
0440                     gnutls_datum_t *x, gnutls_datum_t *y);
0441 
0442 int gnutls_x509_crt_get_subject_alt_name(gnutls_x509_crt_t cert,
0443                      unsigned int seq, void *san,
0444                      size_t *san_size,
0445                      unsigned int *critical);
0446 int gnutls_x509_crt_get_subject_alt_name2(gnutls_x509_crt_t cert,
0447                       unsigned int seq, void *san,
0448                       size_t *san_size,
0449                       unsigned int *san_type,
0450                       unsigned int *critical);
0451 
0452 int gnutls_x509_crt_get_subject_alt_othername_oid(gnutls_x509_crt_t cert,
0453                           unsigned int seq, void *oid,
0454                           size_t *oid_size);
0455 
0456 int gnutls_x509_crt_get_issuer_alt_name(gnutls_x509_crt_t cert,
0457                     unsigned int seq, void *ian,
0458                     size_t *ian_size,
0459                     unsigned int *critical);
0460 int gnutls_x509_crt_get_issuer_alt_name2(gnutls_x509_crt_t cert,
0461                      unsigned int seq, void *ian,
0462                      size_t *ian_size,
0463                      unsigned int *ian_type,
0464                      unsigned int *critical);
0465 
0466 int gnutls_x509_crt_get_issuer_alt_othername_oid(gnutls_x509_crt_t cert,
0467                          unsigned int seq, void *ret,
0468                          size_t *ret_size);
0469 
0470 int gnutls_x509_crt_get_ca_status(gnutls_x509_crt_t cert,
0471                   unsigned int *critical);
0472 int gnutls_x509_crt_get_basic_constraints(gnutls_x509_crt_t cert,
0473                       unsigned int *critical,
0474                       unsigned int *ca, int *pathlen);
0475 
0476 /* The key_usage flags are defined in gnutls.h. They are the
0477  * GNUTLS_KEY_* definitions.
0478  */
0479 int gnutls_x509_crt_get_key_usage(gnutls_x509_crt_t cert,
0480                   unsigned int *key_usage,
0481                   unsigned int *critical);
0482 int gnutls_x509_crt_set_key_usage(gnutls_x509_crt_t crt, unsigned int usage);
0483 int gnutls_x509_crt_set_authority_info_access(gnutls_x509_crt_t crt, int what,
0484                           gnutls_datum_t *data);
0485 
0486 int gnutls_x509_crt_get_inhibit_anypolicy(gnutls_x509_crt_t cert,
0487                       unsigned int *skipcerts,
0488                       unsigned int *critical);
0489 int gnutls_x509_crt_set_inhibit_anypolicy(gnutls_x509_crt_t crt,
0490                       unsigned int skipcerts);
0491 
0492 int gnutls_x509_crt_get_proxy(gnutls_x509_crt_t cert, unsigned int *critical,
0493                   int *pathlen, char **policyLanguage,
0494                   char **policy, size_t *sizeof_policy);
0495 
0496 typedef struct gnutls_x509_tlsfeatures_st *gnutls_x509_tlsfeatures_t;
0497 
0498 int gnutls_x509_tlsfeatures_init(gnutls_x509_tlsfeatures_t *features);
0499 void gnutls_x509_tlsfeatures_deinit(gnutls_x509_tlsfeatures_t);
0500 int gnutls_x509_tlsfeatures_get(gnutls_x509_tlsfeatures_t f, unsigned idx,
0501                 unsigned int *feature);
0502 
0503 int gnutls_x509_crt_set_tlsfeatures(gnutls_x509_crt_t crt,
0504                     gnutls_x509_tlsfeatures_t features);
0505 
0506 int gnutls_x509_crt_get_tlsfeatures(gnutls_x509_crt_t cert,
0507                     gnutls_x509_tlsfeatures_t features,
0508                     unsigned int flags, unsigned int *critical);
0509 
0510 unsigned gnutls_x509_tlsfeatures_check_crt(gnutls_x509_tlsfeatures_t feat,
0511                        gnutls_x509_crt_t crt);
0512 
0513 #define GNUTLS_MAX_QUALIFIERS 8
0514 
0515 /**
0516    * gnutls_x509_qualifier_t:
0517    * @GNUTLS_X509_QUALIFIER_UNKNOWN: Unknown qualifier.
0518    * @GNUTLS_X509_QUALIFIER_URI: A URL
0519    * @GNUTLS_X509_QUALIFIER_NOICE: A text notice.
0520    *
0521    * Enumeration of types for the X.509 qualifiers, of the certificate policy extension. 
0522    */
0523 typedef enum gnutls_x509_qualifier_t {
0524     GNUTLS_X509_QUALIFIER_UNKNOWN = 0,
0525     GNUTLS_X509_QUALIFIER_URI,
0526     GNUTLS_X509_QUALIFIER_NOTICE
0527 } gnutls_x509_qualifier_t;
0528 
0529 typedef struct gnutls_x509_policy_st {
0530     char *oid;
0531     unsigned int qualifiers;
0532     struct {
0533         gnutls_x509_qualifier_t type;
0534         char *data;
0535         unsigned int size;
0536     } qualifier[GNUTLS_MAX_QUALIFIERS];
0537 } gnutls_x509_policy_st;
0538 
0539 void gnutls_x509_policy_release(struct gnutls_x509_policy_st *policy);
0540 int gnutls_x509_crt_get_policy(gnutls_x509_crt_t crt, unsigned indx,
0541                    struct gnutls_x509_policy_st *policy,
0542                    unsigned int *critical);
0543 int gnutls_x509_crt_set_policy(gnutls_x509_crt_t crt,
0544                    const struct gnutls_x509_policy_st *policy,
0545                    unsigned int critical);
0546 
0547 int gnutls_x509_dn_oid_known(const char *oid);
0548 
0549 #define GNUTLS_X509_DN_OID_RETURN_OID 1
0550 const char *gnutls_x509_dn_oid_name(const char *oid, unsigned int flags);
0551 
0552 /* Read extensions by OID. */
0553 int gnutls_x509_crt_get_extension_oid(gnutls_x509_crt_t cert, unsigned indx,
0554                       void *oid, size_t *oid_size);
0555 int gnutls_x509_crt_get_extension_by_oid(gnutls_x509_crt_t cert,
0556                      const char *oid, unsigned indx,
0557                      void *buf, size_t *buf_size,
0558                      unsigned int *critical);
0559 
0560 int gnutls_x509_crq_get_signature_algorithm(gnutls_x509_crq_t crq);
0561 int gnutls_x509_crq_get_extension_by_oid2(gnutls_x509_crq_t crq,
0562                       const char *oid, unsigned indx,
0563                       gnutls_datum_t *output,
0564                       unsigned int *critical);
0565 
0566 /* Read extensions by sequence number. */
0567 int gnutls_x509_crt_get_extension_info(gnutls_x509_crt_t cert, unsigned indx,
0568                        void *oid, size_t *oid_size,
0569                        unsigned int *critical);
0570 int gnutls_x509_crt_get_extension_data(gnutls_x509_crt_t cert, unsigned indx,
0571                        void *data, size_t *sizeof_data);
0572 int gnutls_x509_crt_get_extension_data2(gnutls_x509_crt_t cert, unsigned indx,
0573                     gnutls_datum_t *data);
0574 
0575 int gnutls_x509_crt_set_extension_by_oid(gnutls_x509_crt_t crt, const char *oid,
0576                      const void *buf, size_t sizeof_buf,
0577                      unsigned int critical);
0578 
0579 /* X.509 Certificate writing.
0580  */
0581 int gnutls_x509_crt_set_dn(gnutls_x509_crt_t crt, const char *dn,
0582                const char **err);
0583 
0584 int gnutls_x509_crt_set_dn_by_oid(gnutls_x509_crt_t crt, const char *oid,
0585                   unsigned int raw_flag, const void *name,
0586                   unsigned int sizeof_name);
0587 int gnutls_x509_crt_set_issuer_dn_by_oid(gnutls_x509_crt_t crt, const char *oid,
0588                      unsigned int raw_flag,
0589                      const void *name,
0590                      unsigned int sizeof_name);
0591 int gnutls_x509_crt_set_issuer_dn(gnutls_x509_crt_t crt, const char *dn,
0592                   const char **err);
0593 
0594 int gnutls_x509_crt_set_version(gnutls_x509_crt_t crt, unsigned int version);
0595 int gnutls_x509_crt_set_key(gnutls_x509_crt_t crt, gnutls_x509_privkey_t key);
0596 int gnutls_x509_crt_set_ca_status(gnutls_x509_crt_t crt, unsigned int ca);
0597 int gnutls_x509_crt_set_basic_constraints(gnutls_x509_crt_t crt,
0598                       unsigned int ca,
0599                       int pathLenConstraint);
0600 
0601 int gnutls_x509_crt_set_subject_unique_id(gnutls_x509_crt_t cert,
0602                       const void *id, size_t id_size);
0603 int gnutls_x509_crt_set_issuer_unique_id(gnutls_x509_crt_t cert, const void *id,
0604                      size_t id_size);
0605 
0606 int gnutls_x509_crt_set_subject_alternative_name(
0607     gnutls_x509_crt_t crt, gnutls_x509_subject_alt_name_t type,
0608     const char *data_string);
0609 int gnutls_x509_crt_set_subject_alt_name(gnutls_x509_crt_t crt,
0610                      gnutls_x509_subject_alt_name_t type,
0611                      const void *data,
0612                      unsigned int data_size,
0613                      unsigned int flags);
0614 
0615 int gnutls_x509_crt_set_subject_alt_othername(gnutls_x509_crt_t crt,
0616                           const char *oid, const void *data,
0617                           unsigned int data_size,
0618                           unsigned int flags);
0619 
0620 int gnutls_x509_crt_set_issuer_alt_name(gnutls_x509_crt_t crt,
0621                     gnutls_x509_subject_alt_name_t type,
0622                     const void *data,
0623                     unsigned int data_size,
0624                     unsigned int flags);
0625 
0626 int gnutls_x509_crt_set_issuer_alt_othername(gnutls_x509_crt_t crt,
0627                          const char *oid, const void *data,
0628                          unsigned int data_size,
0629                          unsigned int flags);
0630 
0631 int gnutls_x509_crt_sign(gnutls_x509_crt_t crt, gnutls_x509_crt_t issuer,
0632              gnutls_x509_privkey_t issuer_key);
0633 int gnutls_x509_crt_sign2(gnutls_x509_crt_t crt, gnutls_x509_crt_t issuer,
0634               gnutls_x509_privkey_t issuer_key,
0635               gnutls_digest_algorithm_t dig, unsigned int flags);
0636 int gnutls_x509_crt_set_activation_time(gnutls_x509_crt_t cert,
0637                     time_t act_time);
0638 int gnutls_x509_crt_set_expiration_time(gnutls_x509_crt_t cert,
0639                     time_t exp_time);
0640 int gnutls_x509_crt_set_serial(gnutls_x509_crt_t cert, const void *serial,
0641                    size_t serial_size);
0642 
0643 int gnutls_x509_crt_set_subject_key_id(gnutls_x509_crt_t cert, const void *id,
0644                        size_t id_size);
0645 
0646 int gnutls_x509_crt_set_proxy_dn(gnutls_x509_crt_t crt, gnutls_x509_crt_t eecrt,
0647                  unsigned int raw_flag, const void *name,
0648                  unsigned int sizeof_name);
0649 int gnutls_x509_crt_set_proxy(gnutls_x509_crt_t crt, int pathLenConstraint,
0650                   const char *policyLanguage, const char *policy,
0651                   size_t sizeof_policy);
0652 
0653 int gnutls_x509_crt_print(gnutls_x509_crt_t cert,
0654               gnutls_certificate_print_formats_t format,
0655               gnutls_datum_t *out);
0656 int gnutls_x509_crl_print(gnutls_x509_crl_t crl,
0657               gnutls_certificate_print_formats_t format,
0658               gnutls_datum_t *out);
0659 
0660 /* Access to internal Certificate fields.
0661      */
0662 int gnutls_x509_crt_get_raw_issuer_dn(gnutls_x509_crt_t cert,
0663                       gnutls_datum_t *start);
0664 int gnutls_x509_crt_get_raw_dn(gnutls_x509_crt_t cert, gnutls_datum_t *start);
0665 
0666 /* RDN handling.
0667  */
0668 int gnutls_x509_rdn_get(const gnutls_datum_t *idn, char *buf,
0669             size_t *sizeof_buf);
0670 int gnutls_x509_rdn_get2(const gnutls_datum_t *idn, gnutls_datum_t *str,
0671              unsigned flags);
0672 
0673 int gnutls_x509_rdn_get_oid(const gnutls_datum_t *idn, unsigned indx, void *buf,
0674                 size_t *sizeof_buf);
0675 
0676 int gnutls_x509_rdn_get_by_oid(const gnutls_datum_t *idn, const char *oid,
0677                    unsigned indx, unsigned int raw_flag, void *buf,
0678                    size_t *sizeof_buf);
0679 
0680 typedef struct gnutls_x509_dn_st *gnutls_x509_dn_t;
0681 
0682 typedef struct gnutls_x509_ava_st {
0683     gnutls_datum_t oid;
0684     gnutls_datum_t value;
0685     unsigned long value_tag;
0686 } gnutls_x509_ava_st;
0687 
0688 int gnutls_x509_crt_get_subject(gnutls_x509_crt_t cert, gnutls_x509_dn_t *dn);
0689 int gnutls_x509_crt_get_issuer(gnutls_x509_crt_t cert, gnutls_x509_dn_t *dn);
0690 int gnutls_x509_dn_get_rdn_ava(gnutls_x509_dn_t dn, int irdn, int iava,
0691                    gnutls_x509_ava_st *ava);
0692 
0693 int gnutls_x509_dn_get_str(gnutls_x509_dn_t dn, gnutls_datum_t *str);
0694 
0695 #define GNUTLS_X509_DN_FLAG_COMPAT 1
0696 int gnutls_x509_dn_get_str2(gnutls_x509_dn_t dn, gnutls_datum_t *str,
0697                 unsigned flags);
0698 
0699 int gnutls_x509_dn_set_str(gnutls_x509_dn_t dn, const char *str,
0700                const char **err);
0701 
0702 int gnutls_x509_dn_init(gnutls_x509_dn_t *dn);
0703 
0704 int gnutls_x509_dn_import(gnutls_x509_dn_t dn, const gnutls_datum_t *data);
0705 
0706 int gnutls_x509_dn_export(gnutls_x509_dn_t dn, gnutls_x509_crt_fmt_t format,
0707               void *output_data, size_t *output_data_size);
0708 int gnutls_x509_dn_export2(gnutls_x509_dn_t dn, gnutls_x509_crt_fmt_t format,
0709                gnutls_datum_t *out);
0710 
0711 void gnutls_x509_dn_deinit(gnutls_x509_dn_t dn);
0712 
0713 /* CRL handling functions.
0714  */
0715 int gnutls_x509_crl_init(gnutls_x509_crl_t *crl);
0716 void gnutls_x509_crl_deinit(gnutls_x509_crl_t crl);
0717 
0718 int gnutls_x509_crl_import(gnutls_x509_crl_t crl, const gnutls_datum_t *data,
0719                gnutls_x509_crt_fmt_t format);
0720 int gnutls_x509_crl_export(gnutls_x509_crl_t crl, gnutls_x509_crt_fmt_t format,
0721                void *output_data, size_t *output_data_size);
0722 int gnutls_x509_crl_export2(gnutls_x509_crl_t crl, gnutls_x509_crt_fmt_t format,
0723                 gnutls_datum_t *out);
0724 
0725 int gnutls_x509_crl_get_raw_issuer_dn(gnutls_x509_crl_t crl,
0726                       gnutls_datum_t *dn);
0727 
0728 int gnutls_x509_crl_get_issuer_dn(gnutls_x509_crl_t crl, char *buf,
0729                   size_t *sizeof_buf);
0730 int gnutls_x509_crl_get_issuer_dn2(gnutls_x509_crl_t crl, gnutls_datum_t *dn);
0731 int gnutls_x509_crl_get_issuer_dn3(gnutls_x509_crl_t crl, gnutls_datum_t *dn,
0732                    unsigned flags);
0733 
0734 int gnutls_x509_crl_get_issuer_dn_by_oid(gnutls_x509_crl_t crl, const char *oid,
0735                      unsigned indx, unsigned int raw_flag,
0736                      void *buf, size_t *sizeof_buf);
0737 int gnutls_x509_crl_get_dn_oid(gnutls_x509_crl_t crl, unsigned indx, void *oid,
0738                    size_t *sizeof_oid);
0739 
0740 int gnutls_x509_crl_get_signature_algorithm(gnutls_x509_crl_t crl);
0741 int gnutls_x509_crl_get_signature(gnutls_x509_crl_t crl, char *sig,
0742                   size_t *sizeof_sig);
0743 int gnutls_x509_crl_get_version(gnutls_x509_crl_t crl);
0744 
0745 int gnutls_x509_crl_get_signature_oid(gnutls_x509_crl_t crl, char *oid,
0746                       size_t *oid_size);
0747 
0748 time_t gnutls_x509_crl_get_this_update(gnutls_x509_crl_t crl);
0749 time_t gnutls_x509_crl_get_next_update(gnutls_x509_crl_t crl);
0750 
0751 int gnutls_x509_crl_get_crt_count(gnutls_x509_crl_t crl);
0752 int gnutls_x509_crl_get_crt_serial(gnutls_x509_crl_t crl, unsigned indx,
0753                    unsigned char *serial, size_t *serial_size,
0754                    time_t *t);
0755 
0756 typedef struct gnutls_x509_crl_iter *gnutls_x509_crl_iter_t;
0757 
0758 int gnutls_x509_crl_iter_crt_serial(gnutls_x509_crl_t crl,
0759                     gnutls_x509_crl_iter_t *,
0760                     unsigned char *serial, size_t *serial_size,
0761                     time_t *t);
0762 
0763 void gnutls_x509_crl_iter_deinit(gnutls_x509_crl_iter_t);
0764 
0765 #define gnutls_x509_crl_get_certificate_count gnutls_x509_crl_get_crt_count
0766 #define gnutls_x509_crl_get_certificate gnutls_x509_crl_get_crt_serial
0767 
0768 unsigned gnutls_x509_crl_check_issuer(gnutls_x509_crl_t crl,
0769                       gnutls_x509_crt_t issuer);
0770 
0771 int gnutls_x509_crl_list_import2(gnutls_x509_crl_t **crls, unsigned int *size,
0772                  const gnutls_datum_t *data,
0773                  gnutls_x509_crt_fmt_t format,
0774                  unsigned int flags);
0775 
0776 int gnutls_x509_crl_list_import(gnutls_x509_crl_t *crls, unsigned int *crl_max,
0777                 const gnutls_datum_t *data,
0778                 gnutls_x509_crt_fmt_t format,
0779                 unsigned int flags);
0780 /* CRL writing.
0781  */
0782 int gnutls_x509_crl_set_version(gnutls_x509_crl_t crl, unsigned int version);
0783 int gnutls_x509_crl_set_this_update(gnutls_x509_crl_t crl, time_t act_time);
0784 int gnutls_x509_crl_set_next_update(gnutls_x509_crl_t crl, time_t exp_time);
0785 int gnutls_x509_crl_set_crt_serial(gnutls_x509_crl_t crl, const void *serial,
0786                    size_t serial_size, time_t revocation_time);
0787 int gnutls_x509_crl_set_crt(gnutls_x509_crl_t crl, gnutls_x509_crt_t crt,
0788                 time_t revocation_time);
0789 
0790 int gnutls_x509_crl_get_authority_key_id(gnutls_x509_crl_t crl, void *id,
0791                      size_t *id_size,
0792                      unsigned int *critical);
0793 int gnutls_x509_crl_get_authority_key_gn_serial(
0794     gnutls_x509_crl_t crl, unsigned int seq, void *alt, size_t *alt_size,
0795     unsigned int *alt_type, void *serial, size_t *serial_size,
0796     unsigned int *critical);
0797 
0798 int gnutls_x509_crl_get_number(gnutls_x509_crl_t crl, void *ret,
0799                    size_t *ret_size, unsigned int *critical);
0800 
0801 int gnutls_x509_crl_get_extension_oid(gnutls_x509_crl_t crl, unsigned indx,
0802                       void *oid, size_t *sizeof_oid);
0803 
0804 int gnutls_x509_crl_get_extension_info(gnutls_x509_crl_t crl, unsigned indx,
0805                        void *oid, size_t *sizeof_oid,
0806                        unsigned int *critical);
0807 
0808 int gnutls_x509_crl_get_extension_data(gnutls_x509_crl_t crl, unsigned indx,
0809                        void *data, size_t *sizeof_data);
0810 int gnutls_x509_crl_get_extension_data2(gnutls_x509_crl_t crl, unsigned indx,
0811                     gnutls_datum_t *data);
0812 
0813 int gnutls_x509_crl_set_authority_key_id(gnutls_x509_crl_t crl, const void *id,
0814                      size_t id_size);
0815 
0816 int gnutls_x509_crl_set_number(gnutls_x509_crl_t crl, const void *nr,
0817                    size_t nr_size);
0818 
0819 /* X.509 Certificate verification functions.
0820  */
0821 
0822 /**
0823  * gnutls_certificate_verify_flags:
0824  * @GNUTLS_VERIFY_DISABLE_CA_SIGN: If set a signer does not have to be
0825  *   a certificate authority. This flag should normally be disabled,
0826  *   unless you know what this means.
0827  * @GNUTLS_VERIFY_DISABLE_TRUSTED_TIME_CHECKS: If set a signer in the trusted
0828  *   list is never checked for expiration or activation.
0829  * @GNUTLS_VERIFY_DO_NOT_ALLOW_X509_V1_CA_CRT: Do not allow trusted CA
0830  *   certificates that have version 1.  This option is to be used
0831  *   to deprecate all certificates of version 1.
0832  * @GNUTLS_VERIFY_DO_NOT_ALLOW_SAME: If a certificate is not signed by
0833  *   anyone trusted but exists in the trusted CA list do not treat it
0834  *   as trusted.
0835  * @GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN: A certificate chain is tolerated
0836  *   if unsorted (the case with many TLS servers out there). This is the
0837  *   default since GnuTLS 3.1.4.
0838  * @GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Do not tolerate an unsorted
0839  *   certificate chain.
0840  * @GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT: Allow CA certificates that
0841  *   have version 1 (both root and intermediate). This might be
0842  *   dangerous since those haven't the basicConstraints
0843  *   extension. 
0844  * @GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD2: Allow certificates to be signed
0845  *   using the broken MD2 algorithm.
0846  * @GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD5: Allow certificates to be signed
0847  *   using the broken MD5 algorithm.
0848  * @GNUTLS_VERIFY_ALLOW_SIGN_WITH_SHA1: Allow certificates to be signed
0849  *   using the broken SHA1 hash algorithm.
0850  * @GNUTLS_VERIFY_ALLOW_BROKEN: Allow certificates to be signed
0851  *   using any broken algorithm.
0852  * @GNUTLS_VERIFY_DISABLE_TIME_CHECKS: Disable checking of activation
0853  *   and expiration validity periods of certificate chains. Don't set
0854  *   this unless you understand the security implications.
0855  * @GNUTLS_VERIFY_DISABLE_CRL_CHECKS: Disable checking for validity
0856  *   using certificate revocation lists or the available OCSP data.
0857  * @GNUTLS_VERIFY_DO_NOT_ALLOW_WILDCARDS: When including a hostname
0858  *   check in the verification, do not consider any wildcards.
0859  * @GNUTLS_VERIFY_DO_NOT_ALLOW_IP_MATCHES: When verifying a hostname
0860  *   prevent textual IP addresses from matching IP addresses in the
0861  *   certificate. Treat the input only as a DNS name.
0862  * @GNUTLS_VERIFY_USE_TLS1_RSA: This indicates that a (raw) RSA signature is provided
0863  *   as in the TLS 1.0 protocol. Not all functions accept this flag.
0864  * @GNUTLS_VERIFY_IGNORE_UNKNOWN_CRIT_EXTENSIONS: This signals the verification
0865  *   process, not to fail on unknown critical extensions.
0866  * @GNUTLS_VERIFY_RSA_PSS_FIXED_SALT_LENGTH: Disallow RSA-PSS signatures made
0867  *   with mismatching salt length with digest length, as mandated in RFC 8446
0868  *   4.2.3.
0869  *
0870  * Enumeration of different certificate verify flags. Additional
0871  * verification profiles can be set using GNUTLS_PROFILE_TO_VFLAGS()
0872  * and %gnutls_certificate_verification_profiles_t.
0873  */
0874 typedef enum gnutls_certificate_verify_flags {
0875     GNUTLS_VERIFY_DISABLE_CA_SIGN = 1 << 0,
0876     GNUTLS_VERIFY_DO_NOT_ALLOW_IP_MATCHES = 1 << 1,
0877     GNUTLS_VERIFY_DO_NOT_ALLOW_SAME = 1 << 2,
0878     GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT = 1 << 3,
0879     GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD2 = 1 << 4,
0880     GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD5 = 1 << 5,
0881     GNUTLS_VERIFY_DISABLE_TIME_CHECKS = 1 << 6,
0882     GNUTLS_VERIFY_DISABLE_TRUSTED_TIME_CHECKS = 1 << 7,
0883     GNUTLS_VERIFY_DO_NOT_ALLOW_X509_V1_CA_CRT = 1 << 8,
0884     GNUTLS_VERIFY_DISABLE_CRL_CHECKS = 1 << 9,
0885     GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN = 1 << 10,
0886     GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN = 1 << 11,
0887     GNUTLS_VERIFY_DO_NOT_ALLOW_WILDCARDS = 1 << 12,
0888     GNUTLS_VERIFY_USE_TLS1_RSA = 1 << 13,
0889     GNUTLS_VERIFY_IGNORE_UNKNOWN_CRIT_EXTENSIONS = 1 << 14,
0890     GNUTLS_VERIFY_ALLOW_SIGN_WITH_SHA1 = 1 << 15,
0891     GNUTLS_VERIFY_RSA_PSS_FIXED_SALT_LENGTH = 1 << 16
0892     /* cannot exceed 2^24 due to GNUTLS_PROFILE_TO_VFLAGS() */
0893 } gnutls_certificate_verify_flags;
0894 
0895 #define GNUTLS_VERIFY_ALLOW_BROKEN \
0896     (GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD2 | GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD5)
0897 
0898 /**
0899  * gnutls_certificate_verification_profiles_t:
0900  * @GNUTLS_PROFILE_UNKNOWN: An invalid/unknown profile.
0901  * @GNUTLS_PROFILE_VERY_WEAK: A verification profile that
0902  *  corresponds to @GNUTLS_SEC_PARAM_VERY_WEAK (64 bits)
0903  * @GNUTLS_PROFILE_LOW: A verification profile that
0904  *  corresponds to @GNUTLS_SEC_PARAM_LOW (80 bits)
0905  * @GNUTLS_PROFILE_LEGACY: A verification profile that
0906  *  corresponds to @GNUTLS_SEC_PARAM_LEGACY (96 bits)
0907  * @GNUTLS_PROFILE_MEDIUM: A verification profile that
0908  *  corresponds to @GNUTLS_SEC_PARAM_MEDIUM (112 bits)
0909  * @GNUTLS_PROFILE_HIGH: A verification profile that
0910  *  corresponds to @GNUTLS_SEC_PARAM_HIGH (128 bits)
0911  * @GNUTLS_PROFILE_ULTRA: A verification profile that
0912  *  corresponds to @GNUTLS_SEC_PARAM_ULTRA (192 bits)
0913  * @GNUTLS_PROFILE_FUTURE: A verification profile that
0914  *  corresponds to @GNUTLS_SEC_PARAM_FUTURE (256 bits)
0915  * @GNUTLS_PROFILE_SUITEB128: A verification profile that
0916  *  applies the SUITEB128 rules
0917  * @GNUTLS_PROFILE_SUITEB192: A verification profile that
0918  *  applies the SUITEB192 rules
0919  *
0920  * Enumeration of different certificate verification profiles.
0921  */
0922 typedef enum gnutls_certificate_verification_profiles_t {
0923     GNUTLS_PROFILE_UNKNOWN = 0,
0924     GNUTLS_PROFILE_VERY_WEAK = 1,
0925     GNUTLS_PROFILE_LOW = 2,
0926     GNUTLS_PROFILE_LEGACY = 4,
0927     GNUTLS_PROFILE_MEDIUM = 5,
0928     GNUTLS_PROFILE_HIGH = 6,
0929     GNUTLS_PROFILE_ULTRA = 7,
0930     GNUTLS_PROFILE_FUTURE = 8,
0931 
0932     GNUTLS_PROFILE_SUITEB128 = 32,
0933     GNUTLS_PROFILE_SUITEB192 = 33
0934     /*GNUTLS_PROFILE_MAX=255 */
0935 } gnutls_certificate_verification_profiles_t;
0936 
0937 #define GNUTLS_PROFILE_TO_VFLAGS(x) (((unsigned)x) << 24)
0938 
0939 #define GNUTLS_VFLAGS_PROFILE_MASK (0xff000000)
0940 
0941 #define GNUTLS_VFLAGS_TO_PROFILE(x) ((((unsigned)x) >> 24) & 0xff)
0942 
0943 const char *gnutls_certificate_verification_profile_get_name(
0944     gnutls_certificate_verification_profiles_t id) __GNUTLS_CONST__;
0945 gnutls_certificate_verification_profiles_t
0946 gnutls_certificate_verification_profile_get_id(const char *name)
0947     __GNUTLS_CONST__;
0948 
0949 unsigned gnutls_x509_crt_check_issuer(gnutls_x509_crt_t cert,
0950                       gnutls_x509_crt_t issuer);
0951 
0952 int gnutls_x509_crt_list_verify(const gnutls_x509_crt_t *cert_list,
0953                 unsigned cert_list_length,
0954                 const gnutls_x509_crt_t *CA_list,
0955                 unsigned CA_list_length,
0956                 const gnutls_x509_crl_t *CRL_list,
0957                 unsigned CRL_list_length, unsigned int flags,
0958                 unsigned int *verify);
0959 
0960 int gnutls_x509_crt_verify(gnutls_x509_crt_t cert,
0961                const gnutls_x509_crt_t *CA_list,
0962                unsigned CA_list_length, unsigned int flags,
0963                unsigned int *verify);
0964 int gnutls_x509_crl_verify(gnutls_x509_crl_t crl,
0965                const gnutls_x509_crt_t *CA_list,
0966                unsigned CA_list_length, unsigned int flags,
0967                unsigned int *verify);
0968 
0969 int gnutls_x509_crt_verify_data2(gnutls_x509_crt_t crt,
0970                  gnutls_sign_algorithm_t algo,
0971                  unsigned int flags, const gnutls_datum_t *data,
0972                  const gnutls_datum_t *signature);
0973 
0974 int gnutls_x509_crt_check_revocation(gnutls_x509_crt_t cert,
0975                      const gnutls_x509_crl_t *crl_list,
0976                      unsigned crl_list_length);
0977 
0978 int gnutls_x509_crt_get_fingerprint(gnutls_x509_crt_t cert,
0979                     gnutls_digest_algorithm_t algo, void *buf,
0980                     size_t *buf_size);
0981 
0982 int gnutls_x509_crt_get_key_purpose_oid(gnutls_x509_crt_t cert, unsigned indx,
0983                     void *oid, size_t *oid_size,
0984                     unsigned int *critical);
0985 int gnutls_x509_crt_set_key_purpose_oid(gnutls_x509_crt_t cert, const void *oid,
0986                     unsigned int critical);
0987 
0988 unsigned gnutls_x509_crt_check_key_purpose(gnutls_x509_crt_t cert,
0989                        const char *purpose, unsigned flags);
0990 
0991 /* Private key handling.
0992  */
0993 
0994 /* Flags for the gnutls_x509_privkey_export_pkcs8() function.
0995  */
0996 
0997 #define GNUTLS_PKCS8_PLAIN GNUTLS_PKCS_PLAIN
0998 #define GNUTLS_PKCS8_USE_PKCS12_3DES GNUTLS_PKCS_PKCS12_3DES
0999 #define GNUTLS_PKCS8_USE_PKCS12_ARCFOUR GNUTLS_PKCS_PKCS12_ARCFOUR
1000 #define GNUTLS_PKCS8_USE_PKCS12_RC2_40 GNUTLS_PKCS_PKCS12_RC2_40
1001 
1002 /**
1003  * gnutls_pkcs_encrypt_flags_t:
1004  * @GNUTLS_PKCS_PLAIN: Unencrypted private key.
1005  * @GNUTLS_PKCS_NULL_PASSWORD: Some schemas distinguish between an empty and a NULL password.
1006  * @GNUTLS_PKCS_PKCS12_3DES: PKCS-12 3DES.
1007  * @GNUTLS_PKCS_PKCS12_ARCFOUR: PKCS-12 ARCFOUR.
1008  * @GNUTLS_PKCS_PKCS12_RC2_40: PKCS-12 RC2-40.
1009  * @GNUTLS_PKCS_PBES2_3DES: PBES2 3DES.
1010  * @GNUTLS_PKCS_PBES2_AES_128: PBES2 AES-128.
1011  * @GNUTLS_PKCS_PBES2_AES_192: PBES2 AES-192.
1012  * @GNUTLS_PKCS_PBES2_AES_256: PBES2 AES-256.
1013  * @GNUTLS_PKCS_PBES2_DES: PBES2 single DES.
1014  * @GNUTLS_PKCS_PBES1_DES_MD5: PBES1 with single DES; for compatibility with openssl only.
1015  * @GNUTLS_PKCS_PBES1_DES_SHA1: PBES1 with single DES; for compatibility purposes only.
1016  * @GNUTLS_PKCS_PBES2_GOST_TC26Z: PBES2 GOST 28147-89 CFB with TC26-Z S-box.
1017  * @GNUTLS_PKCS_PBES2_GOST_CPA: PBES2 GOST 28147-89 CFB with CryptoPro-A S-box.
1018  * @GNUTLS_PKCS_PBES2_GOST_CPB: PBES2 GOST 28147-89 CFB with CryptoPro-B S-box.
1019  * @GNUTLS_PKCS_PBES2_GOST_CPC: PBES2 GOST 28147-89 CFB with CryptoPro-C S-box.
1020  * @GNUTLS_PKCS_PBES2_GOST_CPD: PBES2 GOST 28147-89 CFB with CryptoPro-D S-box.
1021  *
1022  * Enumeration of different PKCS encryption flags.
1023  */
1024 typedef enum gnutls_pkcs_encrypt_flags_t {
1025     GNUTLS_PKCS_PLAIN = 1,
1026     GNUTLS_PKCS_PKCS12_3DES = 1 << 1,
1027     GNUTLS_PKCS_PKCS12_ARCFOUR = 1 << 2,
1028     GNUTLS_PKCS_PKCS12_RC2_40 = 1 << 3,
1029     GNUTLS_PKCS_PBES2_3DES = 1 << 4,
1030     GNUTLS_PKCS_PBES2_AES_128 = 1 << 5,
1031     GNUTLS_PKCS_PBES2_AES_192 = 1 << 6,
1032     GNUTLS_PKCS_PBES2_AES_256 = 1 << 7,
1033     GNUTLS_PKCS_NULL_PASSWORD = 1 << 8,
1034     GNUTLS_PKCS_PBES2_DES = 1 << 9,
1035     GNUTLS_PKCS_PBES1_DES_MD5 = 1 << 10,
1036     GNUTLS_PKCS_PBES2_GOST_TC26Z = 1 << 11,
1037     GNUTLS_PKCS_PBES2_GOST_CPA = 1 << 12,
1038     GNUTLS_PKCS_PBES2_GOST_CPB = 1 << 13,
1039     GNUTLS_PKCS_PBES2_GOST_CPC = 1 << 14,
1040     GNUTLS_PKCS_PBES2_GOST_CPD = 1 << 15,
1041     GNUTLS_PKCS_PBES1_DES_SHA1 = 1 << 16
1042 } gnutls_pkcs_encrypt_flags_t;
1043 
1044 #define GNUTLS_PKCS_CIPHER_MASK(x) ((x) & (~(GNUTLS_PKCS_NULL_PASSWORD)))
1045 
1046 #define GNUTLS_PKCS_USE_PKCS12_3DES GNUTLS_PKCS_PKCS12_3DES
1047 #define GNUTLS_PKCS_USE_PKCS12_ARCFOUR GNUTLS_PKCS_PKCS12_ARCFOUR
1048 #define GNUTLS_PKCS_USE_PKCS12_RC2_40 GNUTLS_PKCS_PKCS12_RC2_40
1049 #define GNUTLS_PKCS_USE_PBES2_3DES GNUTLS_PKCS_PBES2_3DES
1050 #define GNUTLS_PKCS_USE_PBES2_AES_128 GNUTLS_PKCS_PBES2_AES_128
1051 #define GNUTLS_PKCS_USE_PBES2_AES_192 GNUTLS_PKCS_PBES2_AES_192
1052 #define GNUTLS_PKCS_USE_PBES2_AES_256 GNUTLS_PKCS_PBES2_AES_256
1053 #define GNUTLS_PKCS_USE_PBES2_GOST_TC26Z GNUTLS_PKCS_PBES2_GOST_TC26Z
1054 #define GNUTLS_PKCS_USE_PBES2_GOST_CPA GNUTLS_PKCS_PBES2_GOST_CPA
1055 #define GNUTLS_PKCS_USE_PBES2_GOST_CPB GNUTLS_PKCS_PBES2_GOST_CPB
1056 #define GNUTLS_PKCS_USE_PBES2_GOST_CPC GNUTLS_PKCS_PBES2_GOST_CPC
1057 #define GNUTLS_PKCS_USE_PBES2_GOST_CPD GNUTLS_PKCS_PBES2_GOST_CPD
1058 
1059 const char *gnutls_pkcs_schema_get_name(unsigned int schema);
1060 const char *gnutls_pkcs_schema_get_oid(unsigned int schema);
1061 
1062 int gnutls_x509_privkey_init(gnutls_x509_privkey_t *key);
1063 void gnutls_x509_privkey_deinit(gnutls_x509_privkey_t key);
1064 gnutls_sec_param_t gnutls_x509_privkey_sec_param(gnutls_x509_privkey_t key);
1065 
1066 void gnutls_x509_privkey_set_pin_function(gnutls_x509_privkey_t key,
1067                       gnutls_pin_callback_t fn,
1068                       void *userdata);
1069 
1070 int gnutls_x509_privkey_cpy(gnutls_x509_privkey_t dst,
1071                 gnutls_x509_privkey_t src);
1072 int gnutls_x509_privkey_import(gnutls_x509_privkey_t key,
1073                    const gnutls_datum_t *data,
1074                    gnutls_x509_crt_fmt_t format);
1075 int gnutls_x509_privkey_import_pkcs8(gnutls_x509_privkey_t key,
1076                      const gnutls_datum_t *data,
1077                      gnutls_x509_crt_fmt_t format,
1078                      const char *password, unsigned int flags);
1079 int gnutls_x509_privkey_import_openssl(gnutls_x509_privkey_t key,
1080                        const gnutls_datum_t *data,
1081                        const char *password);
1082 
1083 int gnutls_pkcs8_info(const gnutls_datum_t *data, gnutls_x509_crt_fmt_t format,
1084               unsigned int *schema, unsigned int *cipher, void *salt,
1085               unsigned int *salt_size, unsigned int *iter_count,
1086               char **oid);
1087 
1088 int gnutls_x509_privkey_import2(gnutls_x509_privkey_t key,
1089                 const gnutls_datum_t *data,
1090                 gnutls_x509_crt_fmt_t format,
1091                 const char *password, unsigned int flags);
1092 
1093 int gnutls_x509_privkey_import_rsa_raw(gnutls_x509_privkey_t key,
1094                        const gnutls_datum_t *m,
1095                        const gnutls_datum_t *e,
1096                        const gnutls_datum_t *d,
1097                        const gnutls_datum_t *p,
1098                        const gnutls_datum_t *q,
1099                        const gnutls_datum_t *u);
1100 int gnutls_x509_privkey_import_rsa_raw2(
1101     gnutls_x509_privkey_t key, const gnutls_datum_t *m,
1102     const gnutls_datum_t *e, const gnutls_datum_t *d,
1103     const gnutls_datum_t *p, const gnutls_datum_t *q,
1104     const gnutls_datum_t *u, const gnutls_datum_t *e1,
1105     const gnutls_datum_t *e2);
1106 int gnutls_x509_privkey_import_ecc_raw(gnutls_x509_privkey_t key,
1107                        gnutls_ecc_curve_t curve,
1108                        const gnutls_datum_t *x,
1109                        const gnutls_datum_t *y,
1110                        const gnutls_datum_t *k);
1111 int gnutls_x509_privkey_import_gost_raw(gnutls_x509_privkey_t key,
1112                     gnutls_ecc_curve_t curve,
1113                     gnutls_digest_algorithm_t digest,
1114                     gnutls_gost_paramset_t paramset,
1115                     const gnutls_datum_t *x,
1116                     const gnutls_datum_t *y,
1117                     const gnutls_datum_t *k);
1118 
1119 int gnutls_x509_privkey_fix(gnutls_x509_privkey_t key);
1120 
1121 int gnutls_x509_privkey_export_dsa_raw(gnutls_x509_privkey_t key,
1122                        gnutls_datum_t *p, gnutls_datum_t *q,
1123                        gnutls_datum_t *g, gnutls_datum_t *y,
1124                        gnutls_datum_t *x);
1125 int gnutls_x509_privkey_import_dsa_raw(gnutls_x509_privkey_t key,
1126                        const gnutls_datum_t *p,
1127                        const gnutls_datum_t *q,
1128                        const gnutls_datum_t *g,
1129                        const gnutls_datum_t *y,
1130                        const gnutls_datum_t *x);
1131 int gnutls_x509_privkey_import_dh_raw(gnutls_x509_privkey_t key,
1132                       const gnutls_dh_params_t params,
1133                       const gnutls_datum_t *y,
1134                       const gnutls_datum_t *x);
1135 
1136 int gnutls_x509_privkey_get_pk_algorithm(gnutls_x509_privkey_t key);
1137 int gnutls_x509_privkey_get_pk_algorithm2(gnutls_x509_privkey_t key,
1138                       unsigned int *bits);
1139 int gnutls_x509_privkey_get_spki(gnutls_x509_privkey_t key,
1140                  gnutls_x509_spki_t spki, unsigned int flags);
1141 int gnutls_x509_privkey_set_spki(gnutls_x509_privkey_t key,
1142                  const gnutls_x509_spki_t spki,
1143                  unsigned int flags);
1144 
1145 int gnutls_x509_privkey_get_key_id(gnutls_x509_privkey_t key,
1146                    unsigned int flags,
1147                    unsigned char *output_data,
1148                    size_t *output_data_size);
1149 
1150 int gnutls_x509_privkey_generate(gnutls_x509_privkey_t key,
1151                  gnutls_pk_algorithm_t algo, unsigned int bits,
1152                  unsigned int flags);
1153 
1154 void gnutls_x509_privkey_set_flags(gnutls_x509_privkey_t key,
1155                    unsigned int flags);
1156 
1157 /**
1158  * gnutls_keygen_types_t:
1159  * @GNUTLS_KEYGEN_SEED: Specifies the seed to be used in key generation.
1160  * @GNUTLS_KEYGEN_DIGEST: The size field specifies the hash algorithm to be used in key generation.
1161  * @GNUTLS_KEYGEN_SPKI: data points to a %gnutls_x509_spki_t structure; it is not used after the key generation call.
1162  * @GNUTLS_KEYGEN_DH: data points to a %gnutls_dh_params_t structure; it is not used after the key generation call.
1163  *
1164  * Enumeration of different key generation data options.
1165  */
1166 typedef enum {
1167     GNUTLS_KEYGEN_SEED = 1,
1168     GNUTLS_KEYGEN_DIGEST = 2,
1169     GNUTLS_KEYGEN_SPKI = 3,
1170     GNUTLS_KEYGEN_DH = 4
1171 } gnutls_keygen_types_t;
1172 
1173 typedef struct {
1174     gnutls_keygen_types_t type;
1175     unsigned char *data;
1176     unsigned int size;
1177 } gnutls_keygen_data_st;
1178 
1179 int gnutls_x509_privkey_generate2(gnutls_x509_privkey_t key,
1180                   gnutls_pk_algorithm_t algo, unsigned int bits,
1181                   unsigned int flags,
1182                   const gnutls_keygen_data_st *data,
1183                   unsigned data_size);
1184 
1185 int gnutls_x509_privkey_verify_seed(gnutls_x509_privkey_t key,
1186                     gnutls_digest_algorithm_t, const void *seed,
1187                     size_t seed_size);
1188 int gnutls_x509_privkey_get_seed(gnutls_x509_privkey_t key,
1189                  gnutls_digest_algorithm_t *, void *seed,
1190                  size_t *seed_size);
1191 
1192 int gnutls_x509_privkey_verify_params(gnutls_x509_privkey_t key);
1193 
1194 int gnutls_x509_privkey_export(gnutls_x509_privkey_t key,
1195                    gnutls_x509_crt_fmt_t format, void *output_data,
1196                    size_t *output_data_size);
1197 int gnutls_x509_privkey_export2(gnutls_x509_privkey_t key,
1198                 gnutls_x509_crt_fmt_t format,
1199                 gnutls_datum_t *out);
1200 int gnutls_x509_privkey_export_pkcs8(gnutls_x509_privkey_t key,
1201                      gnutls_x509_crt_fmt_t format,
1202                      const char *password, unsigned int flags,
1203                      void *output_data,
1204                      size_t *output_data_size);
1205 int gnutls_x509_privkey_export2_pkcs8(gnutls_x509_privkey_t key,
1206                       gnutls_x509_crt_fmt_t format,
1207                       const char *password, unsigned int flags,
1208                       gnutls_datum_t *out);
1209 int gnutls_x509_privkey_export_rsa_raw2(gnutls_x509_privkey_t key,
1210                     gnutls_datum_t *m, gnutls_datum_t *e,
1211                     gnutls_datum_t *d, gnutls_datum_t *p,
1212                     gnutls_datum_t *q, gnutls_datum_t *u,
1213                     gnutls_datum_t *e1, gnutls_datum_t *e2);
1214 int gnutls_x509_privkey_export_rsa_raw(gnutls_x509_privkey_t key,
1215                        gnutls_datum_t *m, gnutls_datum_t *e,
1216                        gnutls_datum_t *d, gnutls_datum_t *p,
1217                        gnutls_datum_t *q, gnutls_datum_t *u);
1218 int gnutls_x509_privkey_export_ecc_raw(gnutls_x509_privkey_t key,
1219                        gnutls_ecc_curve_t *curve,
1220                        gnutls_datum_t *x, gnutls_datum_t *y,
1221                        gnutls_datum_t *k);
1222 int gnutls_x509_privkey_export_gost_raw(gnutls_x509_privkey_t key,
1223                     gnutls_ecc_curve_t *curve,
1224                     gnutls_digest_algorithm_t *digest,
1225                     gnutls_gost_paramset_t *paramset,
1226                     gnutls_datum_t *x, gnutls_datum_t *y,
1227                     gnutls_datum_t *k);
1228 
1229 int gnutls_x509_privkey_sign_data(gnutls_x509_privkey_t key,
1230                   gnutls_digest_algorithm_t digest,
1231                   unsigned int flags,
1232                   const gnutls_datum_t *data, void *signature,
1233                   size_t *signature_size);
1234 
1235 /* Certificate request stuff.
1236  */
1237 int gnutls_x509_crq_sign(gnutls_x509_crq_t crq, gnutls_x509_privkey_t key);
1238 
1239 int gnutls_x509_crq_sign2(gnutls_x509_crq_t crq, gnutls_x509_privkey_t key,
1240               gnutls_digest_algorithm_t dig, unsigned int flags);
1241 
1242 int gnutls_x509_crq_print(gnutls_x509_crq_t crq,
1243               gnutls_certificate_print_formats_t format,
1244               gnutls_datum_t *out);
1245 
1246 int gnutls_x509_crq_verify(gnutls_x509_crq_t crq, unsigned int flags);
1247 
1248 int gnutls_x509_crq_init(gnutls_x509_crq_t *crq);
1249 void gnutls_x509_crq_deinit(gnutls_x509_crq_t crq);
1250 int gnutls_x509_crq_import(gnutls_x509_crq_t crq, const gnutls_datum_t *data,
1251                gnutls_x509_crt_fmt_t format);
1252 
1253 int gnutls_x509_crq_get_private_key_usage_period(gnutls_x509_crq_t cert,
1254                          time_t *activation,
1255                          time_t *expiration,
1256                          unsigned int *critical);
1257 
1258 int gnutls_x509_crq_get_dn(gnutls_x509_crq_t crq, char *buf,
1259                size_t *sizeof_buf);
1260 int gnutls_x509_crq_get_dn2(gnutls_x509_crq_t crq, gnutls_datum_t *dn);
1261 int gnutls_x509_crq_get_dn3(gnutls_x509_crq_t crq, gnutls_datum_t *dn,
1262                 unsigned flags);
1263 int gnutls_x509_crq_get_dn_oid(gnutls_x509_crq_t crq, unsigned indx, void *oid,
1264                    size_t *sizeof_oid);
1265 int gnutls_x509_crq_get_dn_by_oid(gnutls_x509_crq_t crq, const char *oid,
1266                   unsigned indx, unsigned int raw_flag,
1267                   void *buf, size_t *sizeof_buf);
1268 int gnutls_x509_crq_set_dn(gnutls_x509_crq_t crq, const char *dn,
1269                const char **err);
1270 int gnutls_x509_crq_set_dn_by_oid(gnutls_x509_crq_t crq, const char *oid,
1271                   unsigned int raw_flag, const void *data,
1272                   unsigned int sizeof_data);
1273 int gnutls_x509_crq_set_version(gnutls_x509_crq_t crq, unsigned int version);
1274 int gnutls_x509_crq_get_version(gnutls_x509_crq_t crq);
1275 int gnutls_x509_crq_set_key(gnutls_x509_crq_t crq, gnutls_x509_privkey_t key);
1276 
1277 int gnutls_x509_crq_set_extension_by_oid(gnutls_x509_crq_t crq, const char *oid,
1278                      const void *buf, size_t sizeof_buf,
1279                      unsigned int critical);
1280 
1281 int gnutls_x509_crq_set_challenge_password(gnutls_x509_crq_t crq,
1282                        const char *pass);
1283 int gnutls_x509_crq_get_challenge_password(gnutls_x509_crq_t crq, char *pass,
1284                        size_t *sizeof_pass);
1285 
1286 int gnutls_x509_crq_set_attribute_by_oid(gnutls_x509_crq_t crq, const char *oid,
1287                      void *buf, size_t sizeof_buf);
1288 int gnutls_x509_crq_get_attribute_by_oid(gnutls_x509_crq_t crq, const char *oid,
1289                      unsigned indx, void *buf,
1290                      size_t *sizeof_buf);
1291 
1292 int gnutls_x509_crq_export(gnutls_x509_crq_t crq, gnutls_x509_crt_fmt_t format,
1293                void *output_data, size_t *output_data_size);
1294 int gnutls_x509_crq_export2(gnutls_x509_crq_t crq, gnutls_x509_crt_fmt_t format,
1295                 gnutls_datum_t *out);
1296 
1297 int gnutls_x509_crt_set_crq(gnutls_x509_crt_t crt, gnutls_x509_crq_t crq);
1298 int gnutls_x509_crt_set_crq_extensions(gnutls_x509_crt_t crt,
1299                        gnutls_x509_crq_t crq);
1300 
1301 int gnutls_x509_crt_set_crq_extension_by_oid(gnutls_x509_crt_t crt,
1302                          gnutls_x509_crq_t crq,
1303                          const char *oid, unsigned flags);
1304 
1305 int gnutls_x509_crq_set_private_key_usage_period(gnutls_x509_crq_t crq,
1306                          time_t activation,
1307                          time_t expiration);
1308 int gnutls_x509_crq_set_key_rsa_raw(gnutls_x509_crq_t crq,
1309                     const gnutls_datum_t *m,
1310                     const gnutls_datum_t *e);
1311 int gnutls_x509_crq_set_subject_alt_name(gnutls_x509_crq_t crq,
1312                      gnutls_x509_subject_alt_name_t nt,
1313                      const void *data,
1314                      unsigned int data_size,
1315                      unsigned int flags);
1316 
1317 int gnutls_x509_crq_set_subject_alt_othername(gnutls_x509_crq_t crq,
1318                           const char *oid, const void *data,
1319                           unsigned int data_size,
1320                           unsigned int flags);
1321 
1322 int gnutls_x509_crq_set_key_usage(gnutls_x509_crq_t crq, unsigned int usage);
1323 int gnutls_x509_crq_set_basic_constraints(gnutls_x509_crq_t crq,
1324                       unsigned int ca,
1325                       int pathLenConstraint);
1326 int gnutls_x509_crq_set_key_purpose_oid(gnutls_x509_crq_t crq, const void *oid,
1327                     unsigned int critical);
1328 int gnutls_x509_crq_get_key_purpose_oid(gnutls_x509_crq_t crq, unsigned indx,
1329                     void *oid, size_t *sizeof_oid,
1330                     unsigned int *critical);
1331 
1332 int gnutls_x509_crq_get_extension_data(gnutls_x509_crq_t crq, unsigned indx,
1333                        void *data, size_t *sizeof_data);
1334 int gnutls_x509_crq_get_extension_data2(gnutls_x509_crq_t crq, unsigned indx,
1335                     gnutls_datum_t *data);
1336 int gnutls_x509_crq_get_extension_info(gnutls_x509_crq_t crq, unsigned indx,
1337                        void *oid, size_t *sizeof_oid,
1338                        unsigned int *critical);
1339 int gnutls_x509_crq_get_attribute_data(gnutls_x509_crq_t crq, unsigned indx,
1340                        void *data, size_t *sizeof_data);
1341 int gnutls_x509_crq_get_attribute_info(gnutls_x509_crq_t crq, unsigned indx,
1342                        void *oid, size_t *sizeof_oid);
1343 int gnutls_x509_crq_get_pk_algorithm(gnutls_x509_crq_t crq, unsigned int *bits);
1344 int gnutls_x509_crq_get_spki(gnutls_x509_crq_t crq, gnutls_x509_spki_t spki,
1345                  unsigned int flags);
1346 
1347 int gnutls_x509_crq_set_spki(gnutls_x509_crq_t crq,
1348                  const gnutls_x509_spki_t spki, unsigned int flags);
1349 
1350 int gnutls_x509_crq_get_signature_oid(gnutls_x509_crq_t crq, char *oid,
1351                       size_t *oid_size);
1352 int gnutls_x509_crq_get_pk_oid(gnutls_x509_crq_t crq, char *oid,
1353                    size_t *oid_size);
1354 
1355 int gnutls_x509_crq_get_key_id(gnutls_x509_crq_t crq, unsigned int flags,
1356                    unsigned char *output_data,
1357                    size_t *output_data_size);
1358 int gnutls_x509_crq_get_key_rsa_raw(gnutls_x509_crq_t crq, gnutls_datum_t *m,
1359                     gnutls_datum_t *e);
1360 
1361 int gnutls_x509_crq_get_key_usage(gnutls_x509_crq_t crq,
1362                   unsigned int *key_usage,
1363                   unsigned int *critical);
1364 int gnutls_x509_crq_get_basic_constraints(gnutls_x509_crq_t crq,
1365                       unsigned int *critical,
1366                       unsigned int *ca, int *pathlen);
1367 int gnutls_x509_crq_get_subject_alt_name(gnutls_x509_crq_t crq,
1368                      unsigned int seq, void *ret,
1369                      size_t *ret_size,
1370                      unsigned int *ret_type,
1371                      unsigned int *critical);
1372 int gnutls_x509_crq_get_subject_alt_othername_oid(gnutls_x509_crq_t crq,
1373                           unsigned int seq, void *ret,
1374                           size_t *ret_size);
1375 
1376 int gnutls_x509_crq_get_extension_by_oid(gnutls_x509_crq_t crq, const char *oid,
1377                      unsigned indx, void *buf,
1378                      size_t *sizeof_buf,
1379                      unsigned int *critical);
1380 
1381 int gnutls_x509_crq_get_tlsfeatures(gnutls_x509_crq_t crq,
1382                     gnutls_x509_tlsfeatures_t features,
1383                     unsigned flags, unsigned int *critical);
1384 int gnutls_x509_crq_set_tlsfeatures(gnutls_x509_crq_t crq,
1385                     gnutls_x509_tlsfeatures_t features);
1386 
1387 int gnutls_x509_crt_get_extension_by_oid2(gnutls_x509_crt_t cert,
1388                       const char *oid, unsigned indx,
1389                       gnutls_datum_t *output,
1390                       unsigned int *critical);
1391 
1392 typedef struct gnutls_x509_trust_list_st *gnutls_x509_trust_list_t;
1393 typedef struct gnutls_x509_trust_list_iter *gnutls_x509_trust_list_iter_t;
1394 
1395 int gnutls_x509_trust_list_init(gnutls_x509_trust_list_t *list,
1396                 unsigned int size);
1397 
1398 void gnutls_x509_trust_list_deinit(gnutls_x509_trust_list_t list,
1399                    unsigned int all);
1400 
1401 int gnutls_x509_trust_list_get_issuer(gnutls_x509_trust_list_t list,
1402                       gnutls_x509_crt_t cert,
1403                       gnutls_x509_crt_t *issuer,
1404                       unsigned int flags);
1405 
1406 int gnutls_x509_trust_list_get_issuer_by_dn(gnutls_x509_trust_list_t list,
1407                         const gnutls_datum_t *dn,
1408                         gnutls_x509_crt_t *issuer,
1409                         unsigned int flags);
1410 
1411 int gnutls_x509_trust_list_get_issuer_by_subject_key_id(
1412     gnutls_x509_trust_list_t list, const gnutls_datum_t *dn,
1413     const gnutls_datum_t *spki, gnutls_x509_crt_t *issuer,
1414     unsigned int flags);
1415 /**
1416  * gnutls_trust_list_flags_t:
1417  * @GNUTLS_TL_VERIFY_CRL: If any CRLs are provided they will be verified for validity
1418  *   prior to be added. The CA certificates that will be used for verification are the
1419  *   ones already added in the trusted list.
1420  * @GNUTLS_TL_USE_IN_TLS: Internal flag used by GnuTLS. If provided the trust list
1421  *   structure will cache a copy of CA DNs to be used in the certificate request
1422  *   TLS message.
1423  * @GNUTLS_TL_NO_DUPLICATES: If this flag is specified, a function adding certificates
1424  *   will check and eliminate any duplicates.
1425  * @GNUTLS_TL_NO_DUPLICATE_KEY: If this flag is specified, a certificate sharing the
1426  *   same key as a previously added on will not be added.
1427  * @GNUTLS_TL_GET_COPY: The semantics of this flag are documented to the functions which
1428  *   are applicable. In general, on returned value, the function will provide a copy
1429  *   if this flag is provided, rather than a pointer to internal data.
1430  * @GNUTLS_TL_FAIL_ON_INVALID_CRL: If an CRL is added which cannot be validated return
1431  *   an error instead of ignoring (must be used with %GNUTLS_TL_VERIFY_CRL).
1432  *
1433  * Enumeration of different certificate trust list flags.
1434  */
1435 typedef enum gnutls_trust_list_flags_t {
1436     GNUTLS_TL_VERIFY_CRL = 1,
1437 #define GNUTLS_TL_VERIFY_CRL 1
1438     GNUTLS_TL_USE_IN_TLS = (1 << 1),
1439 #define GNUTLS_TL_USE_IN_TLS (1 << 1)
1440     GNUTLS_TL_NO_DUPLICATES = (1 << 2),
1441 #define GNUTLS_TL_NO_DUPLICATES (1 << 2)
1442     GNUTLS_TL_NO_DUPLICATE_KEY = (1 << 3),
1443 #define GNUTLS_TL_NO_DUPLICATE_KEY (1 << 3)
1444     GNUTLS_TL_GET_COPY = (1 << 4),
1445 #define GNUTLS_TL_GET_COPY (1 << 4)
1446     GNUTLS_TL_FAIL_ON_INVALID_CRL = (1 << 5)
1447 #define GNUTLS_TL_FAIL_ON_INVALID_CRL (1 << 5)
1448 } gnutls_trust_list_flags_t;
1449 
1450 int gnutls_x509_trust_list_add_cas(gnutls_x509_trust_list_t list,
1451                    const gnutls_x509_crt_t *clist,
1452                    unsigned clist_size, unsigned int flags);
1453 int gnutls_x509_trust_list_remove_cas(gnutls_x509_trust_list_t list,
1454                       const gnutls_x509_crt_t *clist,
1455                       unsigned clist_size);
1456 
1457 int gnutls_x509_trust_list_add_named_crt(gnutls_x509_trust_list_t list,
1458                      gnutls_x509_crt_t cert,
1459                      const void *name, size_t name_size,
1460                      unsigned int flags);
1461 
1462 int gnutls_x509_trust_list_add_crls(gnutls_x509_trust_list_t list,
1463                     const gnutls_x509_crl_t *crl_list,
1464                     unsigned crl_size, unsigned int flags,
1465                     unsigned int verification_flags);
1466 
1467 int gnutls_x509_trust_list_iter_get_ca(gnutls_x509_trust_list_t list,
1468                        gnutls_x509_trust_list_iter_t *iter,
1469                        gnutls_x509_crt_t *crt);
1470 
1471 void gnutls_x509_trust_list_iter_deinit(gnutls_x509_trust_list_iter_t iter);
1472 
1473 typedef int gnutls_verify_output_function(
1474     gnutls_x509_crt_t cert, gnutls_x509_crt_t issuer,
1475     /* The issuer if verification failed
1476                        * because of him. might be null.
1477                        */
1478     gnutls_x509_crl_t crl, /* The CRL that caused verification failure 
1479                                      * if any. Might be null.
1480                                      */
1481     unsigned int verification_output);
1482 
1483 void gnutls_session_set_verify_output_function(
1484     gnutls_session_t session, gnutls_verify_output_function *func);
1485 
1486 int gnutls_x509_trust_list_verify_named_crt(gnutls_x509_trust_list_t list,
1487                         gnutls_x509_crt_t cert,
1488                         const void *name, size_t name_size,
1489                         unsigned int flags,
1490                         unsigned int *verify,
1491                         gnutls_verify_output_function func);
1492 
1493 int gnutls_x509_trust_list_verify_crt2(
1494     gnutls_x509_trust_list_t list, gnutls_x509_crt_t *cert_list,
1495     unsigned int cert_list_size, gnutls_typed_vdata_st *data,
1496     unsigned int elements, unsigned int flags, unsigned int *voutput,
1497     gnutls_verify_output_function func);
1498 
1499 int gnutls_x509_trust_list_verify_crt(gnutls_x509_trust_list_t list,
1500                       gnutls_x509_crt_t *cert_list,
1501                       unsigned int cert_list_size,
1502                       unsigned int flags, unsigned int *verify,
1503                       gnutls_verify_output_function func);
1504 
1505 /* trust list convenience functions */
1506 int gnutls_x509_trust_list_add_trust_mem(gnutls_x509_trust_list_t list,
1507                      const gnutls_datum_t *cas,
1508                      const gnutls_datum_t *crls,
1509                      gnutls_x509_crt_fmt_t type,
1510                      unsigned int tl_flags,
1511                      unsigned int tl_vflags);
1512 
1513 int gnutls_x509_trust_list_add_trust_file(gnutls_x509_trust_list_t list,
1514                       const char *ca_file,
1515                       const char *crl_file,
1516                       gnutls_x509_crt_fmt_t type,
1517                       unsigned int tl_flags,
1518                       unsigned int tl_vflags);
1519 
1520 int gnutls_x509_trust_list_add_trust_dir(gnutls_x509_trust_list_t list,
1521                      const char *ca_dir,
1522                      const char *crl_dir,
1523                      gnutls_x509_crt_fmt_t type,
1524                      unsigned int tl_flags,
1525                      unsigned int tl_vflags);
1526 
1527 int gnutls_x509_trust_list_remove_trust_file(gnutls_x509_trust_list_t list,
1528                          const char *ca_file,
1529                          gnutls_x509_crt_fmt_t type);
1530 
1531 int gnutls_x509_trust_list_remove_trust_mem(gnutls_x509_trust_list_t list,
1532                         const gnutls_datum_t *cas,
1533                         gnutls_x509_crt_fmt_t type);
1534 
1535 int gnutls_x509_trust_list_add_system_trust(gnutls_x509_trust_list_t list,
1536                         unsigned int tl_flags,
1537                         unsigned int tl_vflags);
1538 
1539 typedef int gnutls_x509_trust_list_getissuer_function(
1540     gnutls_x509_trust_list_t list, const gnutls_x509_crt_t cert,
1541     gnutls_x509_crt_t **issuers, unsigned int *issuers_size);
1542 
1543 void gnutls_x509_trust_list_set_getissuer_function(
1544     gnutls_x509_trust_list_t tlist,
1545     gnutls_x509_trust_list_getissuer_function *func);
1546 
1547 void gnutls_x509_trust_list_set_ptr(gnutls_x509_trust_list_t tlist, void *ptr);
1548 
1549 void *gnutls_x509_trust_list_get_ptr(gnutls_x509_trust_list_t tlist);
1550 
1551 void gnutls_certificate_set_trust_list(gnutls_certificate_credentials_t res,
1552                        gnutls_x509_trust_list_t tlist,
1553                        unsigned flags);
1554 void gnutls_certificate_get_trust_list(gnutls_certificate_credentials_t res,
1555                        gnutls_x509_trust_list_t *tlist);
1556 
1557 typedef struct gnutls_x509_ext_st {
1558     char *oid;
1559     unsigned int critical;
1560     gnutls_datum_t data;
1561 } gnutls_x509_ext_st;
1562 
1563 void gnutls_x509_ext_deinit(gnutls_x509_ext_st *ext);
1564 
1565 int gnutls_x509_ext_print(gnutls_x509_ext_st *exts, unsigned int exts_size,
1566               gnutls_certificate_print_formats_t format,
1567               gnutls_datum_t *out);
1568 
1569 #include <gnutls/pkcs7.h>
1570 
1571 #ifdef __cplusplus
1572 }
1573 #endif
1574 
1575 #endif /* GNUTLS_X509_H */
[ Source navigation ] [ Diff markup ] [ Identifier search ] [ general search ]

This page was automatically generated by the 2.3.7 LXR engine.

The LXR team
Valid CSS 2.1! Valid HTML 4.01!