| 1 | /* |
| 2 | * X.509 certificate related helpers |
| 3 | * |
| 4 | * Copyright (c) 2024 Dorjoy Chowdhury <dorjoychy111@gmail.com> |
| 5 | * |
| 6 | * This work is licensed under the terms of the GNU GPL, version 2 or |
| 7 | * (at your option) any later version. See the COPYING file in the |
| 8 | * top-level directory. |
| 9 | */ |
| 10 | |
| 11 | #ifndef QCRYPTO_X509_UTILS_H |
| 12 | #define QCRYPTO_X509_UTILS_H |
| 13 | |
| 14 | #include "crypto/hash.h" |
| 15 | |
| 16 | int qcrypto_get_x509_cert_fingerprint(uint8_t *cert, size_t size, |
| 17 | QCryptoHashAlgo hash, |
| 18 | uint8_t *result, |
| 19 | size_t *resultlen, |
| 20 | Error **errp); |
| 21 | |
| 22 | /** |
| 23 | * qcrypto_x509_convert_cert_der |
| 24 | * @cert: pointer to the raw certificate data in PEM format |
| 25 | * @size: size of the certificate |
| 26 | * @result: output location for the allocated buffer for the certificate |
| 27 | * in DER format |
| 28 | * (the function allocates memory which must be freed by the caller) |
| 29 | * @resultlen: pointer to the size of the buffer (will be updated with the |
| 30 | * actual size of the DER-encoded certificate) |
| 31 | * @errp: error pointer |
| 32 | * |
| 33 | * Convert the given @cert from PEM to DER format. |
| 34 | * |
| 35 | * Returns: 0 on success, |
| 36 | * -1 on error. |
| 37 | */ |
| 38 | int qcrypto_x509_convert_cert_der(uint8_t *cert, size_t size, |
| 39 | uint8_t **result, |
| 40 | size_t *resultlen, |
| 41 | Error **errp); |
| 42 | |
| 43 | /** |
| 44 | * qcrypto_x509_check_cert_times |
| 45 | * @cert: pointer to the raw certificate data |
| 46 | * @size: size of the certificate |
| 47 | * @errp: error pointer |
| 48 | * |
| 49 | * Check whether the activation and expiration times of @cert |
| 50 | * are valid at the current time. |
| 51 | * |
| 52 | * Returns: 0 if the certificate times are valid, |
| 53 | * -1 on error. |
| 54 | */ |
| 55 | int qcrypto_x509_check_cert_times(uint8_t *cert, size_t size, Error **errp); |
| 56 | |
| 57 | /** |
| 58 | * qcrypto_x509_get_cert_key_id |
| 59 | * @cert: pointer to the raw certificate data |
| 60 | * @size: size of the certificate |
| 61 | * @hash_alg: the hash algorithm flag |
| 62 | * @result: output location for the allocated buffer for key ID |
| 63 | * (the function allocates memory which must be freed by the caller) |
| 64 | * @resultlen: pointer to the size of the buffer |
| 65 | * (will be updated with the actual size of key id) |
| 66 | * @errp: error pointer |
| 67 | * |
| 68 | * Retrieve the key ID from the @cert based on the specified @hash_alg. |
| 69 | * |
| 70 | * Returns: 0 if key ID was successfully stored in @result, |
| 71 | * -1 on error. |
| 72 | */ |
| 73 | int qcrypto_x509_get_cert_key_id(uint8_t *cert, size_t size, |
| 74 | QCryptoHashAlgo hash_alg, |
| 75 | uint8_t **result, |
| 76 | size_t *resultlen, |
| 77 | Error **errp); |
| 78 | |
| 79 | /** |
| 80 | * qcrypto_x509_check_ecc_curve_p521 |
| 81 | * @cert: pointer to the raw certificate data |
| 82 | * @size: size of the certificate |
| 83 | * @errp: error pointer |
| 84 | * |
| 85 | * Determine whether the ECC public key in the given certificate uses the P-521 |
| 86 | * curve. |
| 87 | * |
| 88 | * Returns: 0 if ECC public key does not use P521 curve. |
| 89 | * 1 if ECC public key uses P521 curve. |
| 90 | * -1 on error. |
| 91 | */ |
| 92 | int qcrypto_x509_check_ecc_curve_p521(uint8_t *cert, size_t size, Error **errp); |
| 93 | |
| 94 | /** |
| 95 | * qcrypto_pkcs7_convert_sig_pem |
| 96 | * @sig: pointer to the PKCS#7 signature in DER format |
| 97 | * @sig_size: size of the signature |
| 98 | * @result: output location for the allocated buffer for the signature in |
| 99 | * PEM format |
| 100 | * (the function allocates memory which must be freed by the caller) |
| 101 | * @resultlen: pointer to the size of the buffer |
| 102 | * (will be updated with the actual size of the PEM-encoded |
| 103 | * signature) |
| 104 | * @errp: error pointer |
| 105 | * |
| 106 | * Convert given PKCS#7 @sig from DER to PEM format. |
| 107 | * |
| 108 | * Returns: 0 if PEM-encoded signature was successfully stored in @result, |
| 109 | * -1 on error. |
| 110 | */ |
| 111 | int qcrypto_pkcs7_convert_sig_pem(uint8_t *sig, size_t sig_size, |
| 112 | uint8_t **result, |
| 113 | size_t *resultlen, |
| 114 | Error **errp); |
| 115 | |
| 116 | /** |
| 117 | * qcrypto_x509_verify_sig |
| 118 | * @cert: pointer to the raw certificate data |
| 119 | * @cert_size: size of the certificate |
| 120 | * @comp: pointer to the component to be verified |
| 121 | * @comp_size: size of the component |
| 122 | * @sig: pointer to the signature |
| 123 | * @sig_size: size of the signature |
| 124 | * @errp: error pointer |
| 125 | * |
| 126 | * Verify the provided @comp against the @sig and @cert. |
| 127 | * |
| 128 | * Returns: 0 on success, |
| 129 | * -1 on error. |
| 130 | */ |
| 131 | int qcrypto_x509_verify_sig(uint8_t *cert, size_t cert_size, |
| 132 | uint8_t *comp, size_t comp_size, |
| 133 | uint8_t *sig, size_t sig_size, Error **errp); |
| 134 | |
| 135 | #endif |