/*

 * Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved.

 *

 * Licensed under the OpenSSL license (the "License").  You may not use

 * this file except in compliance with the License.  You can obtain a copy

 * in the file LICENSE in the source distribution or at

 * https://www.openssl.org/source/license.html

 */

#include "internal/refcount.h"

/* Internal X509 structures and functions: not for application use */

/* Note: unless otherwise stated a field pointer is mandatory and should

 * never be set to NULL: the ASN.1 code and accessors rely on mandatory

 * fields never being NULL.

 */

/*

 * name entry structure, equivalent to AttributeTypeAndValue defined

 * in RFC5280 et al.

 */

struct X509_name_entry_st {

    ASN1_OBJECT *object;        /* AttributeType */

    ASN1_STRING *value;         /* AttributeValue */

    int set;                    /* index of RDNSequence for this entry */

    int size;                   /* temp variable */

};

/* Name from RFC 5280. */

struct X509_name_st {

    STACK_OF(X509_NAME_ENTRY) *entries; /* DN components */

    int modified;               /* true if 'bytes' needs to be built */

    BUF_MEM *bytes;             /* cached encoding: cannot be NULL */

    /* canonical encoding used for rapid Name comparison */

    unsigned char *canon_enc;

    int canon_enclen;

} /* X509_NAME */ ;

/* Signature info structure */

struct x509_sig_info_st {

    /* NID of message digest */

    int mdnid;

    /* NID of public key algorithm */

    int pknid;

    /* Security bits */

    int secbits;

    /* Various flags */

    uint32_t flags;

};

/* PKCS#10 certificate request */

struct X509_req_info_st {

    ASN1_ENCODING enc;          /* cached encoding of signed part */

    ASN1_INTEGER *version;      /* version, defaults to v1(0) so can be NULL */

    X509_NAME *subject;         /* certificate request DN */

    X509_PUBKEY *pubkey;        /* public key of request */

    /*

     * Zero or more attributes.

     * NB: although attributes is a mandatory field some broken

     * encodings omit it so this may be NULL in that case.

     */

    STACK_OF(X509_ATTRIBUTE) *attributes;

};

struct X509_req_st {

    X509_REQ_INFO req_info;     /* signed certificate request data */

    X509_ALGOR sig_alg;         /* signature algorithm */

    ASN1_BIT_STRING *signature; /* signature */

    CRYPTO_REF_COUNT references;

    CRYPTO_RWLOCK *lock;

};

struct X509_crl_info_st {

    ASN1_INTEGER *version;      /* version: defaults to v1(0) so may be NULL */

    X509_ALGOR sig_alg;         /* signature algorithm */

    X509_NAME *issuer;          /* CRL issuer name */

    ASN1_TIME *lastUpdate;      /* lastUpdate field */

    ASN1_TIME *nextUpdate;      /* nextUpdate field: optional */

    STACK_OF(X509_REVOKED) *revoked;        /* revoked entries: optional */

    STACK_OF(X509_EXTENSION) *extensions;   /* extensions: optional */

    ASN1_ENCODING enc;                      /* encoding of signed portion of CRL */

};

struct X509_crl_st {

    X509_CRL_INFO crl;          /* signed CRL data */

    X509_ALGOR sig_alg;         /* CRL signature algorithm */

    ASN1_BIT_STRING signature;  /* CRL signature */

    CRYPTO_REF_COUNT references;

    int flags;

    /*

     * Cached copies of decoded extension values, since extensions

     * are optional any of these can be NULL.

     */

    AUTHORITY_KEYID *akid;

    ISSUING_DIST_POINT *idp;

    /* Convenient breakdown of IDP */

    int idp_flags;

    int idp_reasons;

    /* CRL and base CRL numbers for delta processing */

    ASN1_INTEGER *crl_number;

    ASN1_INTEGER *base_crl_number;

    STACK_OF(GENERAL_NAMES) *issuers;

    /* hash of CRL */

    unsigned char sha1_hash[SHA_DIGEST_LENGTH];

    /* alternative method to handle this CRL */

    const X509_CRL_METHOD *meth;

    void *meth_data;

    CRYPTO_RWLOCK *lock;

};

struct x509_revoked_st {

    ASN1_INTEGER serialNumber; /* revoked entry serial number */

    ASN1_TIME *revocationDate;  /* revocation date */

    STACK_OF(X509_EXTENSION) *extensions;   /* CRL entry extensions: optional */

    /* decoded value of CRLissuer extension: set if indirect CRL */

    STACK_OF(GENERAL_NAME) *issuer;

    /* revocation reason: set to CRL_REASON_NONE if reason extension absent */

    int reason;

    /*

     * CRL entries are reordered for faster lookup of serial numbers. This

     * field contains the original load sequence for this entry.

     */

    int sequence;

};

/*

 * This stuff is certificate "auxiliary info": it contains details which are

 * useful in certificate stores and databases. When used this is tagged onto

 * the end of the certificate itself. OpenSSL specific structure not defined

 * in any RFC.

 */

struct x509_cert_aux_st {

    STACK_OF(ASN1_OBJECT) *trust; /* trusted uses */

    STACK_OF(ASN1_OBJECT) *reject; /* rejected uses */

    ASN1_UTF8STRING *alias;     /* "friendly name" */

    ASN1_OCTET_STRING *keyid;   /* key id of private key */

    STACK_OF(X509_ALGOR) *other; /* other unspecified info */

};

struct x509_cinf_st {

    ASN1_INTEGER *version;      /* [ 0 ] default of v1 */

    ASN1_INTEGER serialNumber;

    X509_ALGOR signature;

    X509_NAME *issuer;

    X509_VAL validity;

    X509_NAME *subject;

    X509_PUBKEY *key;

    ASN1_BIT_STRING *issuerUID; /* [ 1 ] optional in v2 */

    ASN1_BIT_STRING *subjectUID; /* [ 2 ] optional in v2 */

    STACK_OF(X509_EXTENSION) *extensions; /* [ 3 ] optional in v3 */

    ASN1_ENCODING enc;

};

struct x509_st {

    X509_CINF cert_info;

    X509_ALGOR sig_alg;

    ASN1_BIT_STRING signature;

    X509_SIG_INFO siginf;

    CRYPTO_REF_COUNT references;

    CRYPTO_EX_DATA ex_data;

    /* These contain copies of various extension values */

    long ex_pathlen;

    long ex_pcpathlen;

    uint32_t ex_flags;

    uint32_t ex_kusage;

    uint32_t ex_xkusage;

    uint32_t ex_nscert;

    ASN1_OCTET_STRING *skid;

    AUTHORITY_KEYID *akid;

    X509_POLICY_CACHE *policy_cache;

    STACK_OF(DIST_POINT) *crldp;

    STACK_OF(GENERAL_NAME) *altname;

    NAME_CONSTRAINTS *nc;

#ifndef OPENSSL_NO_RFC3779

    STACK_OF(IPAddressFamily) *rfc3779_addr;

    struct ASIdentifiers_st *rfc3779_asid;

# endif

    unsigned char sha1_hash[SHA_DIGEST_LENGTH];

    X509_CERT_AUX *aux;

    CRYPTO_RWLOCK *lock;

    volatile int ex_cached;

} /* X509 */ ;

/*

 * This is a used when verifying cert chains.  Since the gathering of the

 * cert chain can take some time (and have to be 'retried', this needs to be

 * kept and passed around.

 */

struct x509_store_ctx_st {      /* X509_STORE_CTX */

    X509_STORE *ctx;

    /* The following are set by the caller */

    /* The cert to check */

    X509 *cert;

    /* chain of X509s - untrusted - passed in */

    STACK_OF(X509) *untrusted;

    /* set of CRLs passed in */

    STACK_OF(X509_CRL) *crls;

    X509_VERIFY_PARAM *param;

    /* Other info for use with get_issuer() */

    void *other_ctx;

    /* Callbacks for various operations */

    /* called to verify a certificate */

    int (*verify) (X509_STORE_CTX *ctx);

    /* error callback */

    int (*verify_cb) (int ok, X509_STORE_CTX *ctx);

    /* get issuers cert from ctx */

    int (*get_issuer) (X509 **issuer, X509_STORE_CTX *ctx, X509 *x);

    /* check issued */

    int (*check_issued) (X509_STORE_CTX *ctx, X509 *x, X509 *issuer);

    /* Check revocation status of chain */

    int (*check_revocation) (X509_STORE_CTX *ctx);

    /* retrieve CRL */

    int (*get_crl) (X509_STORE_CTX *ctx, X509_CRL **crl, X509 *x);

    /* Check CRL validity */

    int (*check_crl) (X509_STORE_CTX *ctx, X509_CRL *crl);

    /* Check certificate against CRL */

    int (*cert_crl) (X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x);

    /* Check policy status of the chain */

    int (*check_policy) (X509_STORE_CTX *ctx);

    STACK_OF(X509) *(*lookup_certs) (X509_STORE_CTX *ctx, X509_NAME *nm);

    STACK_OF(X509_CRL) *(*lookup_crls) (X509_STORE_CTX *ctx, X509_NAME *nm);

    int (*cleanup) (X509_STORE_CTX *ctx);

    /* The following is built up */

    /* if 0, rebuild chain */

    int valid;

    /* number of untrusted certs */

    int num_untrusted;

    /* chain of X509s - built up and trusted */

    STACK_OF(X509) *chain;

    /* Valid policy tree */

    X509_POLICY_TREE *tree;

    /* Require explicit policy value */

    int explicit_policy;

    /* When something goes wrong, this is why */

    int error_depth;

    int error;

    X509 *current_cert;

    /* cert currently being tested as valid issuer */

    X509 *current_issuer;

    /* current CRL */

    X509_CRL *current_crl;

    /* score of current CRL */

    int current_crl_score;

    /* Reason mask */

    unsigned int current_reasons;

    /* For CRL path validation: parent context */

    X509_STORE_CTX *parent;

    CRYPTO_EX_DATA ex_data;

    SSL_DANE *dane;

    /* signed via bare TA public key, rather than CA certificate */

    int bare_ta_signed;

};

/* PKCS#8 private key info structure */

struct pkcs8_priv_key_info_st {

    ASN1_INTEGER *version;

    X509_ALGOR *pkeyalg;

    ASN1_OCTET_STRING *pkey;

    STACK_OF(X509_ATTRIBUTE) *attributes;

};

struct X509_sig_st {

    X509_ALGOR *algor;

    ASN1_OCTET_STRING *digest;

};

struct x509_object_st {

    /* one of the above types */

    X509_LOOKUP_TYPE type;

    union {

        char *ptr;

        X509 *x509;

        X509_CRL *crl;

        EVP_PKEY *pkey;

    } data;

};

int a2i_ipadd(unsigned char *ipout, const char *ipasc);

int x509_set1_time(ASN1_TIME **ptm, const ASN1_TIME *tm);

void x509_init_sig_info(X509 *x);