x509wrap.h

Go to the documentation of this file.

#ifndef QSC_X509_WRAP_H
#define QSC_X509_WRAP_H
 
#include "qsccommon.h"
#include "x509cert.h"
#include "x509certwrite.h"
#include "x509crl.h"
#include "x509csr.h"
#include "x509key.h"
#include "x509keywrite.h"
#include "x509name.h"
#include "x509pem.h"
#include "x509sigver.h"
#include "x509store.h"
#include "x509time.h"
#include "x509verify.h"
#include "tlscert.h"
#include "tlslimits.h"
 
QSC_CPLUSPLUS_ENABLED_START

#define QSC_X509W_CHAIN_MAX 8U

#define QSC_X509W_ANCHOR_MAX 16U

#define QSC_X509W_CRL_MAX 8U

#define QSC_X509W_VERIFY_BUFFER_SIZE QSC_X509_CERTIFICATE_WRITE_MAX

#define QSC_X509W_RESULT_MESSAGE_MAX 160U

typedef enum qsc_x509w_status_t
{
    QSC_X509W_STATUS_SUCCESS = 0,             
    QSC_X509W_STATUS_INVALID_INPUT = 1,       
    QSC_X509W_STATUS_IO_ERROR = 2,            
    QSC_X509W_STATUS_DECODE_ERROR = 3,        
    QSC_X509W_STATUS_CHAIN_BUILD_ERROR = 4,   
    QSC_X509W_STATUS_VERIFY_ERROR = 5,        
    QSC_X509W_STATUS_HOSTNAME_MISMATCH = 6,   
    QSC_X509W_STATUS_KEY_MISMATCH = 7,        
    QSC_X509W_STATUS_PURPOSE_REJECTED = 8,    
    QSC_X509W_STATUS_STORE_FULL = 9,          
    QSC_X509W_STATUS_BUFFER_TOO_SMALL = 10,   
    QSC_X509W_STATUS_NETWORK_ERROR = 11,      
    QSC_X509W_STATUS_UNSUPPORTED = 12,        
    QSC_X509W_STATUS_NOT_FOUND = 13,          
    QSC_X509W_STATUS_ENCODING_ERROR = 14,     
    QSC_X509W_STATUS_PROFILE_ERROR = 15,      
    QSC_X509W_STATUS_CALLBACK_ERROR = 16      
} qsc_x509w_status;

typedef enum qsc_x509w_stage_t
{
    QSC_X509W_STAGE_NONE = 0,             
    QSC_X509W_STAGE_LOAD = 1,             
    QSC_X509W_STAGE_PARSE = 2,            
    QSC_X509W_STAGE_CHAIN_BUILD = 3,      
    QSC_X509W_STAGE_TIME = 4,             
    QSC_X509W_STAGE_PURPOSE = 5,          
    QSC_X509W_STAGE_HOSTNAME = 6,         
    QSC_X509W_STAGE_KEY_MATCH = 7,        
    QSC_X509W_STAGE_REVOCATION = 8,       
    QSC_X509W_STAGE_TRUST = 9,            
    QSC_X509W_STAGE_EXPORT = 10,          
    QSC_X509W_STAGE_CONFIGURATION = 11    
} qsc_x509w_stage;

typedef enum qsc_x509w_certificate_role_t
{
    QSC_X509W_CERTIFICATE_ROLE_NONE = 0,          
    QSC_X509W_CERTIFICATE_ROLE_TLS_SERVER = 1,    
    QSC_X509W_CERTIFICATE_ROLE_TLS_CLIENT = 2,    
    QSC_X509W_CERTIFICATE_ROLE_CA = 3,            
    QSC_X509W_CERTIFICATE_ROLE_TRUST_ANCHOR = 4   
} qsc_x509w_certificate_role;

typedef enum qsc_x509w_profile_preset_t
{
    QSC_X509W_PROFILE_PRESET_TLS_SERVER = 1,          
    QSC_X509W_PROFILE_PRESET_TLS_CLIENT = 2,          
    QSC_X509W_PROFILE_PRESET_CA = 3,                  
    QSC_X509W_PROFILE_PRESET_STRICT_REVOCATION = 4,   
    QSC_X509W_PROFILE_PRESET_DEVELOPMENT = 5          
} qsc_x509w_profile_preset;

typedef enum qsc_x509w_revocation_mode_t
{
    QSC_X509W_REVOCATION_MODE_NONE = 0,                    
    QSC_X509W_REVOCATION_MODE_CRL_IF_PRESENT = 1,          
    QSC_X509W_REVOCATION_MODE_CRL_REQUIRED = 2,            
    QSC_X509W_REVOCATION_MODE_OCSP_IF_PRESENT = 3,         
    QSC_X509W_REVOCATION_MODE_OCSP_REQUIRED = 4,           
    QSC_X509W_REVOCATION_MODE_CRL_OR_OCSP_REQUIRED = 5,    
    QSC_X509W_REVOCATION_MODE_CRL_AND_OCSP_REQUIRED = 6    
} qsc_x509w_revocation_mode;

typedef enum qsc_x509w_locator_policy_t
{
    QSC_X509W_LOCATOR_POLICY_DISABLED = 0,          
    QSC_X509W_LOCATOR_POLICY_ALLOW_EMBEDDED = 1,    
    QSC_X509W_LOCATOR_POLICY_REQUIRE_EMBEDDED = 2   
} qsc_x509w_locator_policy;

typedef enum qsc_x509w_revocation_source_t
{
    QSC_X509W_REVOCATION_SOURCE_NONE = 0,   
    QSC_X509W_REVOCATION_SOURCE_CRL = 1,    
    QSC_X509W_REVOCATION_SOURCE_OCSP = 2    
} qsc_x509w_revocation_source;

typedef enum qsc_x509w_availability_t
{
    QSC_X509W_AVAILABILITY_UNSPECIFIED = 0,  
    QSC_X509W_AVAILABILITY_UNCHECKED = 1,    
    QSC_X509W_AVAILABILITY_AVAILABLE = 2,    
    QSC_X509W_AVAILABILITY_UNAVAILABLE = 3   
} qsc_x509w_availability;

typedef struct qsc_x509w_profile_t
{
    qsc_x509_verify_purpose purpose;                  
    const qsc_x509_time* validationtime;             
    const char* hostname;                            
    bool rejectunsupportedcriticalextensions;        
    bool requirehostname;                            
    qsc_x509w_revocation_mode revocationmode;        
    qsc_x509w_locator_policy aiaissuerpolicy;        
    qsc_x509w_locator_policy ocsppolicy;             
} qsc_x509w_profile;

typedef struct qsc_x509w_result_t
{
    qsc_x509w_status status;                         
    qsc_x509w_stage stage;                          
    qsc_x509_verify_status verifystatus;            
    qsc_x509_revocation_status revocationstatus;    
    qsc_x509w_revocation_source revocationsource;   
    qsc_x509w_availability aiaavailability;         
    qsc_x509w_availability ocspavailability;        
    size_t chainlength;                             
    size_t failuredepth;                            
    bool chainbuilt;                                
    bool hostnamechecked;                           
    bool hostnamevalid;                             
    bool keymatch;                                  
    bool purposevalid;                              
    bool timevalid;                                 
    bool aiahintpresent;                            
    bool ocsphintpresent;                           
    char message[QSC_X509W_RESULT_MESSAGE_MAX];     
} qsc_x509w_result;

typedef struct qsc_x509w_trust_store_t
{
    qsc_x509_trust_anchor anchors[QSC_X509W_ANCHOR_MAX];   
    qsc_x509_store store;                                  
    qsc_x509_crl crls[QSC_X509W_CRL_MAX];                  
    size_t crlcount;                                       
} qsc_x509w_trust_store;

typedef struct qsc_x509w_server_identity_t
{
    qsc_x509_certificate leaf;                                
    qsc_x509_certificate intermediates[QSC_X509W_CHAIN_MAX - 1U]; 
    size_t intermediatecount;                                 
    qsc_x509_private_key privatekey;                          
} qsc_x509w_server_identity;

typedef struct qsc_x509w_deployment_config_t
{
    const char* certificatechainpath;                 
    const char* privatekeypath;                       
    const char* trustanchorpath;                      
    const char* crlpath;                              
    const char* hostname;                             
    qsc_x509_verify_purpose purpose;                  
    bool requireclientauth;                           
    bool loadtrustanchors;                            
    bool loadcrls;                                    
    bool rejectunsupportedcriticalextensions;         
    bool requirerevocation;                           
} qsc_x509w_deployment_config;

typedef struct qsc_x509w_tls_bridge_t
{
    qsc_x509w_profile profile;                         
    const qsc_x509w_trust_store* truststore;          
    qsc_tls_qsc_x509_context context;                 
    qsc_tls_certificate_interface iface;              
    qsc_x509_time currenttime;                        
    uint8_t verifybuffer[QSC_X509W_VERIFY_BUFFER_SIZE]; 
    bool initialized;                                 
} qsc_x509w_tls_bridge;

typedef struct qsc_x509w_tls_local_certificate_t
{
    qsc_tls_certificate_view chain[QSC_TLS_CERTIFICATE_LIST_MAX_ENTRIES]; 
    uint8_t chainder[QSC_TLS_CERTIFICATE_LIST_MAX_ENTRIES][QSC_X509_CERTIFICATE_WRITE_MAX]; 
    size_t chainlength;                                                   
    qsc_tls_signature_scheme verifyscheme;                                
    uint8_t privatekeydata[QSC_TLS_MAX_SIGNING_PRIVATE_KEY_SIZE];        
    size_t privatekeylen;                                                 
} qsc_x509w_tls_local_certificate;

QSC_EXPORT_API void qsc_x509w_profile_initialize(qsc_x509w_profile* profile);

QSC_EXPORT_API void qsc_x509w_profile_apply_preset(qsc_x509w_profile* profile, qsc_x509w_profile_preset preset);

QSC_EXPORT_API void qsc_x509w_profile_set_tls_server_defaults(qsc_x509w_profile* profile);

QSC_EXPORT_API void qsc_x509w_profile_set_tls_client_defaults(qsc_x509w_profile* profile);

QSC_EXPORT_API void qsc_x509w_profile_set_ca_defaults(qsc_x509w_profile* profile);

QSC_EXPORT_API void qsc_x509w_profile_set_strict_revocation_defaults(qsc_x509w_profile* profile);

QSC_EXPORT_API void qsc_x509w_profile_set_development_defaults(qsc_x509w_profile* profile);

QSC_EXPORT_API void qsc_x509w_result_initialize(qsc_x509w_result* result);

QSC_EXPORT_API void qsc_x509w_trust_store_initialize(qsc_x509w_trust_store* store);

QSC_EXPORT_API void qsc_x509w_trust_store_clear(qsc_x509w_trust_store* store);

QSC_EXPORT_API void qsc_x509w_server_identity_initialize(qsc_x509w_server_identity* identity);

QSC_EXPORT_API void qsc_x509w_server_identity_clear(qsc_x509w_server_identity* identity);

QSC_EXPORT_API void qsc_x509w_deployment_config_initialize(qsc_x509w_deployment_config* config);

QSC_EXPORT_API void qsc_x509w_tls_bridge_initialize(qsc_x509w_tls_bridge* bridge);

QSC_EXPORT_API void qsc_x509w_tls_local_certificate_initialize(qsc_x509w_tls_local_certificate* localcert);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_current_utc_time(qsc_x509_time* currenttime);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_certificate_load_file(const char* path, qsc_x509_certificate* certificate);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_certificate_load_memory(const uint8_t* data, size_t datalen, qsc_x509_certificate* certificate);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_certificate_chain_load_file(const char* path, qsc_x509_certificate* certificates, size_t certificatecount, qsc_x509_chain* chain);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_certificate_chain_load_memory(const uint8_t* data, size_t datalen, qsc_x509_certificate* certificates, size_t certificatecount, qsc_x509_chain* chain);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_private_key_load_file(const char* path, qsc_x509_private_key* privatekey);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_private_key_load_memory(const uint8_t* data, size_t datalen, qsc_x509_private_key* privatekey);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_crl_load_file(const char* path, qsc_x509_crl* crl);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_crl_load_memory(const uint8_t* data, size_t datalen, qsc_x509_crl* crl);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_csr_load_file(const char* path, qsc_x509_csr* csr);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_csr_load_memory(const uint8_t* data, size_t datalen, qsc_x509_csr* csr);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_trust_store_add_anchor(qsc_x509w_trust_store* store, const qsc_x509_certificate* certificate, bool selfsigned);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_trust_store_add_anchor_bundle_memory(qsc_x509w_trust_store* store, const uint8_t* data, size_t datalen, bool selfsigned);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_trust_store_add_anchor_bundle_file(qsc_x509w_trust_store* store, const char* path, bool selfsigned);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_trust_store_add_anchor_file(qsc_x509w_trust_store* store, const char* path, bool selfsigned);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_trust_store_add_anchor_memory(qsc_x509w_trust_store* store, const uint8_t* data, size_t datalen, bool selfsigned);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_trust_store_add_crl(qsc_x509w_trust_store* store, const qsc_x509_crl* crl);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_trust_store_add_crl_file(qsc_x509w_trust_store* store, const char* path);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_trust_store_add_crl_memory(qsc_x509w_trust_store* store, const uint8_t* data, size_t datalen);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_server_identity_load_files(qsc_x509w_server_identity* identity, const char* certificatechainpath, const char* privatekeypath);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_server_identity_load_configuration(qsc_x509w_server_identity* identity, const qsc_x509w_deployment_config* config, qsc_x509w_result* result);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_trust_store_load_configuration(qsc_x509w_trust_store* store, const qsc_x509w_deployment_config* config, qsc_x509w_result* result);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_server_identity_get_chain(const qsc_x509w_server_identity* identity, qsc_x509_chain* chain);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_server_identity_validate(const qsc_x509w_server_identity* identity, const qsc_x509w_profile* profile, qsc_x509w_result* result);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_server_identity_verify(const qsc_x509w_server_identity* identity, const qsc_x509w_trust_store* store,
    const qsc_x509w_profile* profile, qsc_x509w_result* result);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_certificate_check_role(const qsc_x509_certificate* certificate, qsc_x509w_certificate_role role,
    const char* hostname, qsc_x509w_result* result);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_verify_peer_certificates(const qsc_x509_certificate* certificates, size_t certificatecount,
    const qsc_x509w_trust_store* store, const qsc_x509w_profile* profile, qsc_x509w_result* result);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_name_string(const qsc_x509_name* name, char* output, size_t outputlen, size_t* written);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_name_get_attribute_first(const qsc_x509_name* name, qsc_x509_name_attribute_type type, char* output, size_t outputlen, size_t* written);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_certificate_subject_string(const qsc_x509_certificate* certificate, char* output, size_t outputlen, size_t* written);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_certificate_issuer_string(const qsc_x509_certificate* certificate, char* output, size_t outputlen, size_t* written);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_certificate_subject_common_name(const qsc_x509_certificate* certificate, char* output, size_t outputlen, size_t* written);

QSC_EXPORT_API size_t qsc_x509w_certificate_subject_dns_name_count(const qsc_x509_certificate* certificate);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_certificate_subject_dns_name(const qsc_x509_certificate* certificate, size_t index, char* output, size_t outputlen, size_t* written);

QSC_EXPORT_API const char* qsc_x509w_revocation_mode_string(qsc_x509w_revocation_mode mode);

QSC_EXPORT_API const char* qsc_x509w_locator_policy_string(qsc_x509w_locator_policy policy);

QSC_EXPORT_API const char* qsc_x509w_revocation_source_string(qsc_x509w_revocation_source source);

QSC_EXPORT_API const char* qsc_x509w_availability_string(qsc_x509w_availability availability);

QSC_EXPORT_API const char* qsc_x509w_status_string(qsc_x509w_status status);

QSC_EXPORT_API const char* qsc_x509w_stage_string(qsc_x509w_stage stage);

QSC_EXPORT_API const char* qsc_x509w_verify_status_string(qsc_x509_verify_status status);

QSC_EXPORT_API const char* qsc_x509w_result_message(const qsc_x509w_result* result);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_certificate_export_der(const qsc_x509_certificate* certificate, uint8_t* output, size_t outputlen, size_t* written);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_certificate_export_pem(const qsc_x509_certificate* certificate, char* output, size_t outputlen, size_t* written);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_private_key_export_pkcs8_der(const qsc_x509_private_key* privatekey, bool includepublickey, uint8_t* output, size_t outputlen, size_t* written);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_private_key_export_pkcs8_pem(const qsc_x509_private_key* privatekey, bool includepublickey, char* output, size_t outputlen, size_t* written);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_csr_export_der(const qsc_x509_csr* csr, uint8_t* output, size_t outputlen, size_t* written);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_csr_export_pem(const qsc_x509_csr* csr, char* output, size_t outputlen, size_t* written);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_csr_create(qsc_x509_csr* csr, const qsc_x509_name* subject,
    const qsc_x509_subject_public_key_info* spki, const qsc_x509_algorithm_identifier* signaturealgorithm);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_csr_add_dns_name(qsc_x509_csr* csr, const char* dnsname);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_csr_sign_der(const qsc_x509_csr* csr, qsc_x509_certificate_sign_callback signcallback,
    void* context, uint8_t* output, size_t* outputlen);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_csr_sign_pem(const qsc_x509_csr* csr, qsc_x509_certificate_sign_callback signcallback,
    void* context, char* output, size_t* outputlen);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_csr_verify(const qsc_x509_csr* csr);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_certificate_issue_from_csr(const qsc_x509_csr* csr, const qsc_x509_certificate* issuer,
    const qsc_x509_algorithm_identifier* signaturealgorithm, const uint8_t* serialnumber, size_t serialnumberlen,
    const qsc_x509_validity* validity, uint32_t profile, uint32_t policyflags,
    qsc_x509_certificate_sign_callback signcallback, void* context, uint8_t* output, size_t* outputlen);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_tls_bridge_configure(qsc_x509w_tls_bridge* bridge, const qsc_x509w_trust_store* store,
    const qsc_x509w_profile* profile);

QSC_EXPORT_API bool qsc_x509w_tls_bridge_is_ready(const qsc_x509w_tls_bridge* bridge);

QSC_EXPORT_API const qsc_tls_certificate_interface* qsc_x509w_tls_bridge_get_interface(const qsc_x509w_tls_bridge* bridge);

QSC_EXPORT_API bool qsc_x509w_tls_local_certificate_is_ready(const qsc_x509w_tls_local_certificate* localcert);

QSC_EXPORT_API qsc_x509w_status qsc_x509w_tls_local_certificate_from_identity(const qsc_x509w_server_identity* identity, qsc_tls_signature_scheme verifyscheme, qsc_x509w_tls_local_certificate* localcert);
 
 
QSC_CPLUSPLUS_ENABLED_END
 
#endif