hitls_pki_types.h

/*
 * This file is part of the openHiTLS project.
 *
 * openHiTLS is licensed under the Mulan PSL v2.
 * You can use this software according to the terms and conditions of the Mulan PSL v2.
 * You may obtain a copy of Mulan PSL v2 at:
 *
 *     http://license.coscl.org.cn/MulanPSL2
 *
 * THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND,
 * EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO NON-INFRINGEMENT,
 * MERCHANTABILITY OR FIT FOR A PARTICULAR PURPOSE.
 * See the Mulan PSL v2 for more details.
 */
 
#ifndef HITLS_PKI_TYPES_H
#define HITLS_PKI_TYPES_H
 
#include <stdint.h>
#include <stdbool.h>
#include "bsl_obj.h"
#include "bsl_types.h"
#include "bsl_list.h"
#include "crypt_types.h"
 
#ifdef __cplusplus
extern "C" {
#endif
 
typedef void HITLS_PKI_LibCtx;
 
#define HITLS_X509_List BslList
 
#define HITLS_X509_VERSION_1 0
#define HITLS_X509_VERSION_2 1
#define HITLS_X509_VERSION_3 2
 
/* Key usage */
#define HITLS_X509_EXT_KU_DIGITAL_SIGN          0x0080
#define HITLS_X509_EXT_KU_NON_REPUDIATION       0x0040
#define HITLS_X509_EXT_KU_KEY_ENCIPHERMENT      0x0020
#define HITLS_X509_EXT_KU_DATA_ENCIPHERMENT     0x0010
#define HITLS_X509_EXT_KU_KEY_AGREEMENT         0x0008
#define HITLS_X509_EXT_KU_KEY_CERT_SIGN         0x0004
#define HITLS_X509_EXT_KU_CRL_SIGN              0x0002
#define HITLS_X509_EXT_KU_ENCIPHER_ONLY         0x0001
#define HITLS_X509_EXT_KU_DECIPHER_ONLY         0x8000
 
typedef enum {
    HITLS_X509_REF_UP = 0,             
 
    HITLS_X509_GET_ENCODELEN = 0x0100, 
    HITLS_X509_GET_ENCODE,             
    HITLS_X509_GET_PUBKEY,             
    HITLS_X509_GET_SIGNALG,            
    HITLS_X509_GET_SUBJECT_DN_STR,     
    HITLS_X509_GET_ISSUER_DN_STR,      
    HITLS_X509_GET_SERIALNUM_STR,      
    HITLS_X509_GET_BEFORE_TIME_STR,    
    HITLS_X509_GET_AFTER_TIME_STR,     
    HITLS_X509_GET_SUBJECT_DN,         
    HITLS_X509_GET_ISSUER_DN,          
    HITLS_X509_GET_VERSION,            
    HITLS_X509_GET_REVOKELIST,         
    HITLS_X509_GET_SERIALNUM,          
    HITLS_X509_GET_BEFORE_TIME,        
    HITLS_X509_GET_AFTER_TIME,         
    HITLS_X509_GET_SIGN_MDALG,         
    HITLS_X509_GET_ENCODE_SUBJECT_DN,  
    HITLS_X509_IS_SELF_SIGNED,         
    HITLS_X509_GET_SUBJECT_CN_STR,         
 
    HITLS_X509_SET_VERSION = 0x0200,   
    HITLS_X509_SET_SERIALNUM,          
    HITLS_X509_SET_BEFORE_TIME,        
    HITLS_X509_SET_AFTER_TIME,         
    HITLS_X509_SET_PUBKEY,             
    HITLS_X509_SET_SUBJECT_DN,         
    HITLS_X509_SET_ISSUER_DN,          
    HITLS_X509_SET_CSR_EXT,            
    HITLS_X509_ADD_SUBJECT_NAME,       
    HITLS_X509_CRL_ADD_REVOKED_CERT,   
 
    HITLS_X509_EXT_SET_SKI = 0x0400,            
    HITLS_X509_EXT_SET_AKI,                     
    HITLS_X509_EXT_SET_KUSAGE,                  
    HITLS_X509_EXT_SET_SAN,                     
    HITLS_X509_EXT_SET_BCONS,                   
    HITLS_X509_EXT_SET_EXKUSAGE,                
    HITLS_X509_EXT_SET_CRLNUMBER,               
    HITLS_X509_EXT_SET_GENERIC,                 
 
    HITLS_X509_EXT_GET_SKI = 0x0500,            
    HITLS_X509_EXT_GET_CRLNUMBER,               
    HITLS_X509_EXT_GET_AKI,                     
    HITLS_X509_EXT_GET_KUSAGE,                  
    HITLS_X509_EXT_GET_BCONS,                   
    HITLS_X509_EXT_GET_SAN,                     
    HITLS_X509_EXT_GET_GENERIC,                 
 
    HITLS_X509_EXT_CHECK_SKI = 0x0600,          
 
    HITLS_X509_CSR_GET_ATTRIBUTES = 0x0700,     
 
    HITLS_X509_SET_VFY_SM2_USER_ID = 0x800,             
} HITLS_X509_Cmd;
 
typedef enum {
    HITLS_X509_ATTR_SET_REQUESTED_EXTENSIONS = 0x0100,
    HITLS_X509_ATTR_GET_REQUESTED_EXTENSIONS = 0x0200,
} HITLS_X509_AttrCmd;

 
typedef enum {
    HITLS_X509_GN_EMAIL,  // rfc822Name                [1] IA5String
    HITLS_X509_GN_DNS,    // dNSName                   [2] IA5String
    HITLS_X509_GN_DNNAME, // directoryName             [4] Name
    HITLS_X509_GN_URI,    // uniformResourceIdentifier [6] IA5String
    HITLS_X509_GN_IP,     // iPAddress                 [7] Octet String
 
    // Other types are not supported yet
    HITLS_X509_GN_MAX
} HITLS_X509_GeneralNameType;
 
/* Distinguish name */
typedef struct {
    BslCid cid;
    uint8_t *data;
    uint32_t dataLen;
} HITLS_X509_DN;

typedef struct {
    HITLS_X509_GeneralNameType type;
    BSL_Buffer value;
} HITLS_X509_GeneralName;

typedef struct {
    bool critical;
    BSL_Buffer kid;       // keyIdentifier: optional
    BslList *issuerName;  // Not supported. authorityCertIssuer: optional, List of HITLS_X509_GeneralName
    BSL_Buffer serialNum; // Not supported. authorityCertSerialNumber: optional
} HITLS_X509_ExtAki;

typedef struct {
    bool critical;
    BSL_Buffer kid;
} HITLS_X509_ExtSki;

typedef struct {
    bool critical;
    uint32_t keyUsage;
} HITLS_X509_ExtKeyUsage;

typedef struct {
    bool critical;
    BslList *oidList; // Object Identifier: list of BSL_Buffer
} HITLS_X509_ExtExKeyUsage;

typedef struct {
    bool critical;
    BslList *names; // List of HITLS_X509_GeneralName
} HITLS_X509_ExtSan;

typedef struct {
    bool critical;
    bool isCa;          // Default to false.
    int32_t maxPathLen; // Greater than or equal to 0. -1: no check, 0: no intermediate certificate
} HITLS_X509_ExtBCons;

typedef struct {
    int32_t algId;    
    union {
        CRYPT_RSA_PssPara rsaPss;       
        BSL_Buffer sm2UserId;
    };
} HITLS_X509_SignAlgParam;

typedef struct {
    bool critical;        // Default to false.
    BSL_Buffer crlNumber; // crlNumber
} HITLS_X509_ExtCrlNumber;

typedef struct {
    bool critical;      
    BSL_Buffer oid;     
    BSL_Buffer value;   
} HITLS_X509_ExtGeneric;
 
typedef struct {
    bool critical;
    BSL_TIME time;
} HITLS_X509_RevokeExtTime;
 
typedef enum {
    HITLS_X509_CRL_SET_REVOKED_SERIALNUM = 0,       
    HITLS_X509_CRL_SET_REVOKED_REVOKE_TIME,         
    HITLS_X509_CRL_SET_REVOKED_INVALID_TIME,        
    HITLS_X509_CRL_SET_REVOKED_REASON,              
    HITLS_X509_CRL_SET_REVOKED_CERTISSUER,          
 
    HITLS_X509_CRL_GET_REVOKED_SERIALNUM = 0x0100,  
    HITLS_X509_CRL_GET_REVOKED_REVOKE_TIME,         
    HITLS_X509_CRL_GET_REVOKED_INVALID_TIME,        
    HITLS_X509_CRL_GET_REVOKED_REASON,              
    HITLS_X509_CRL_GET_REVOKED_CERTISSUER,          
} HITLS_X509_RevokeCmd;
 
#define HITLS_X509_REVOKED_REASON_UNSPECIFIED               0   
#define HITLS_X509_REVOKED_REASON_KEY_COMPROMISE            1   
#define HITLS_X509_REVOKED_REASON_CA_COMPROMISE             2   
#define HITLS_X509_REVOKED_REASON_AFFILIATION_CHANGED       3   
#define HITLS_X509_REVOKED_REASON_SUPERSEDED                4   
#define HITLS_X509_REVOKED_REASON_CESSATION_OF_OPERATION    5   
#define HITLS_X509_REVOKED_REASON_CERTIFICATE_HOLD          6   
#define HITLS_X509_REVOKED_REASON_REMOVE_FROM_CRL           8   
#define HITLS_X509_REVOKED_REASON_PRIVILEGE_WITHDRAWN       9   
#define HITLS_X509_REVOKED_REASON_AA_COMPROMISE             10  
 
typedef struct {
    bool critical;
    int32_t reason;
} HITLS_X509_RevokeExtReason;
 
typedef struct {
    bool critical;
    BslList *issuerName; // List of HITLS_X509_GeneralName
} HITLS_X509_RevokeExtCertIssuer;
 
typedef enum {
    HITLS_X509_EXT_TYPE_CSR,
} HITLS_X509_ExtType;
 
typedef enum {
    HITLS_X509_VFY_FLAG_CRL_ALL = 1,
    HITLS_X509_VFY_FLAG_CRL_DEV = 2,
    // not support certificate chains with a single trusted and non-self-signed certificate.
    HITLS_X509_VFY_FLAG_PARTIAL_CHAIN = 4,
} HITLS_X509_VFY_FLAGS;
 
typedef enum {
    HITLS_X509_VFY_PURPOSE_TLS_SERVER = 1,
    HITLS_X509_VFY_PURPOSE_TLS_CLIENT = 2,
    HITLS_X509_VFY_PURPOSE_EMAIL_SIGN = 3,
    HITLS_X509_VFY_PURPOSE_EMAIL_ENCRYPT = 4,
    HITLS_X509_VFY_PURPOSE_CODE_SIGN = 5,
    HITLS_X509_VFY_PURPOSE_OCSP_SIGN = 6,
    HITLS_X509_VFY_PURPOSE_TIMESTAMPING = 7,
    HITLS_X509_VFY_PURPOSE_ANY = 8
} HITLS_X509_VFY_PURPOSE;

typedef enum {
    HITLS_X509_STORECTX_SET_PARAM_DEPTH = 0x0,
    HITLS_X509_STORECTX_SET_PARAM_FLAGS,
    HITLS_X509_STORECTX_SET_TIME,
    HITLS_X509_STORECTX_SET_SECBITS,
    HITLS_X509_STORECTX_SET_PURPOSE,
    /* clear flag */
    HITLS_X509_STORECTX_CLR_PARAM_FLAGS,
    HITLS_X509_STORECTX_DEEP_COPY_SET_CA,
    HITLS_X509_STORECTX_SHALLOW_COPY_SET_CA,
    HITLS_X509_STORECTX_SET_CRL,
    HITLS_X509_STORECTX_SET_VFY_SM2_USERID,
    HITLS_X509_STORECTX_SET_VERIFY_CB,
    HITLS_X509_STORECTX_SET_USR_DATA,
    HITLS_X509_STORECTX_ADD_CA_PATH,       
    HITLS_X509_STORECTX_CLEAR_CRL,
    HITLS_X509_STORECTX_SET_DEFAULT_PATH,  
 
    HITLS_X509_STORECTX_REF_UP = 0x0100,
    HITLS_X509_STORECTX_GET_PARAM_DEPTH,
    HITLS_X509_STORECTX_GET_VERIFY_CB,
    HITLS_X509_STORECTX_GET_USR_DATA,
    HITLS_X509_STORECTX_GET_PARAM_FLAGS,
 
    /* New commands for the added fields */
    HITLS_X509_STORECTX_SET_ERROR = 0x0200,
    HITLS_X509_STORECTX_GET_ERROR,
    HITLS_X509_STORECTX_GET_CUR_CERT,
    /*
     * Indicates the depth of certificate chain verification, starting from 0, representing the entity certificate,
     * CA certificate,..., root certificate respectively.
     */
    HITLS_X509_STORECTX_SET_CUR_DEPTH,
    HITLS_X509_STORECTX_GET_CUR_DEPTH,
    HITLS_X509_STORECTX_GET_CERT_CHAIN,
 
    HITLS_X509_STORECTX_MAX
} HITLS_X509_StoreCtxCmd;
 
/* Flags for HITLS_X509_VerifyHostname */
#define HITLS_X509_FLAG_VFY_WITH_PARTIAL_WILDCARD   0x01  

#define HITLS_PKI_PRINT_DN_ONELINE     0
#define HITLS_PKI_PRINT_DN_MULTILINE   1
#define HITLS_PKI_PRINT_DN_RFC2253     2  // default flag

typedef enum {
    HITLS_PKI_SET_PRINT_FLAG,       // The default flag is rfc2253. Multi-threading is not supported.
 
    HITLS_PKI_PRINT_DNNAME,
    HITLS_PKI_PRINT_DNNAME_HASH,
 
    HITLS_PKI_PRINT_CERT,
    HITLS_PKI_PRINT_NEXTUPDATE,
    HITLS_PKI_PRINT_CSR,
    HITLS_PKI_PRINT_CRL,
    HITLS_PKI_PRINT_CERT_BRIEF,
} HITLS_PKI_PrintCmd;

typedef struct {
    BSL_Buffer *macPwd;
    BSL_Buffer *encPwd;
} HITLS_PKCS12_PwdParam;

typedef struct {
    uint32_t saltLen;
    uint32_t itCnt;
    uint32_t macId;
    uint8_t *pwd;
    uint32_t pwdLen;
} HITLS_PKCS12_KdfParam;
 
typedef struct {
    void *para;
    int32_t algId;
} HITLS_PKCS12_MacParam;

typedef struct {
    CRYPT_EncodeParam encParam;
    HITLS_PKCS12_MacParam macParam;
} HITLS_PKCS12_EncodeParam;
 
typedef enum {
    HITLS_PKCS12_GEN_LOCALKEYID = 0x01,          
    HITLS_PKCS12_SET_ENTITY_KEYBAG,             
    HITLS_PKCS12_SET_ENTITY_CERTBAG,            
    HITLS_PKCS12_ADD_CERTBAG,                   
    HITLS_PKCS12_GET_ENTITY_CERT,               
    HITLS_PKCS12_GET_ENTITY_KEY,                
    HITLS_PKCS12_GET_SECRETBAGS,                
    HITLS_PKCS12_ADD_SECRETBAG,                 
    HITLS_PKCS12_GET_ENTITY_CERTBAG,            
    HITLS_PKCS12_GET_ENTITY_KEYBAG,             
    HITLS_PKCS12_ADD_KEYBAG,                    
    HITLS_PKCS12_GET_KEYBAGS,                   
    HITLS_PKCS12_GET_CERTBAGS,                  
    HITLS_PKCS12_ADD_CRLBAG,                    
    HITLS_PKCS12_GET_CRLBAGS,                   
} HITLS_PKCS12_Cmd;
 
typedef enum {
    HITLS_PKCS12_BAG_ADD_ATTR,                  
    HITLS_PKCS12_BAG_GET_ATTR,                  
    HITLS_PKCS12_BAG_GET_VALUE,                 
    HITLS_PKCS12_BAG_GET_ID,                    
    HITLS_PKCS12_BAG_GET_TYPE,                  
} HITLS_PKCS12_BagCmd;
 
typedef enum {
    HITLS_CMS_ADD_CERT = 0,                  
    HITLS_CMS_ADD_CRL,                       
    
    HITLS_CMS_SET_MSG_MD          = 0x0101,           
} HITLS_CMS_Cmd;

typedef enum {
    HITLS_CMS_OPT_SIGN   = 0x01,  
    HITLS_CMS_OPT_VERIFY  = 0x02,  
} HITLS_CMS_Option;
 
#ifdef __cplusplus
}
#endif
 
#endif // HITLS_PKI_TYPES_H