x509.hpp

/* Copyright 2017 - 2024 R. Thomas
 * Copyright 2017 - 2024 Quarkslab
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#ifndef LIEF_PE_X509_H
#define LIEF_PE_X509_H
#include <array>
#include <memory>
#include <vector>
 
#include "LIEF/Object.hpp"
#include "LIEF/visibility.h"
 
#include "LIEF/PE/enums.hpp"
 
#include "LIEF/PE/signature/types.hpp"
 
#include "LIEF/enums.hpp"
 
struct mbedtls_x509_crt;
 
namespace LIEF {
namespace PE {
 
class Parser;
class SignatureParser;
class Signature;
 
class RsaInfo;
 
class LIEF_API x509 : public Object {
 
  friend class Parser;
  friend class SignatureParser;
  friend class Signature;
 
  public:
  using date_t = std::array<int32_t, 6>;
 
  using certificates_t = std::vector<x509>;
 
  static certificates_t parse(const std::string& path);
 
  static certificates_t parse(const std::vector<uint8_t>& content);
 
  static bool check_time(const date_t& before, const date_t& after);
 
  static bool time_is_past(const date_t& to);
 
  static bool time_is_future(const date_t& from);
 
  enum class KEY_TYPES : uint32_t {
    NONE = 0,    
    RSA,         
    ECKEY,       
    ECKEY_DH,    
    ECDSA,       
    RSA_ALT,     
    RSASSA_PSS,  
  };
 
  enum class VERIFICATION_FLAGS : uint32_t {
    OK                     = 0,       
    BADCERT_EXPIRED        = 1 << 0,  
    BADCERT_REVOKED        = 1 << 1,  
    BADCERT_CN_MISMATCH    = 1 << 2,  
    BADCERT_NOT_TRUSTED    = 1 << 3,  
    BADCRL_NOT_TRUSTED     = 1 << 4,  
    BADCRL_EXPIRED         = 1 << 5,  
    BADCERT_MISSING        = 1 << 6,  
    BADCERT_SKIP_VERIFY    = 1 << 7,  
    BADCERT_OTHER          = 1 << 8,  
    BADCERT_FUTURE         = 1 << 9,  
    BADCRL_FUTURE          = 1 << 10, 
    BADCERT_KEY_USAGE      = 1 << 11, 
    BADCERT_EXT_KEY_USAGE  = 1 << 12, 
    BADCERT_NS_CERT_TYPE   = 1 << 13, 
    BADCERT_BAD_MD         = 1 << 14, 
    BADCERT_BAD_PK         = 1 << 15, 
    BADCERT_BAD_KEY        = 1 << 16, 
    BADCRL_BAD_MD          = 1 << 17, 
    BADCRL_BAD_PK          = 1 << 18, 
    BADCRL_BAD_KEY         = 1 << 19, 
  };
 
  enum class KEY_USAGE : uint32_t {
    DIGITAL_SIGNATURE = 0, 
    NON_REPUDIATION,       
    KEY_ENCIPHERMENT,      
    DATA_ENCIPHERMENT,     
    KEY_AGREEMENT,         
    KEY_CERT_SIGN,         
    CRL_SIGN,              
    ENCIPHER_ONLY,         
    DECIPHER_ONLY,         
  };
 
  x509(mbedtls_x509_crt* ca);
  x509(const x509& other);
  x509& operator=(x509 other);
  void swap(x509& other);
 
  uint32_t version() const;
 
  std::vector<uint8_t> serial_number() const;
 
  oid_t signature_algorithm() const;
 
  date_t valid_from() const;
 
  date_t valid_to() const;
 
  std::string issuer() const;
 
  std::string subject() const;
 
  bool check_signature(const std::vector<uint8_t>& hash,
                       const std::vector<uint8_t>& signature, ALGORITHMS digest) const;
 
  std::vector<uint8_t> raw() const;
 
  KEY_TYPES key_type() const;
 
  std::unique_ptr<RsaInfo> rsa_info() const;
 
  VERIFICATION_FLAGS verify(const x509& ca) const;
 
  VERIFICATION_FLAGS is_trusted_by(const std::vector<x509>& ca) const;
 
  std::vector<oid_t> certificate_policies() const;
 
  std::vector<KEY_USAGE> key_usage() const;
 
  std::vector<oid_t> ext_key_usage() const;
 
  bool is_ca() const;
 
  std::vector<uint8_t> signature() const;
 
  void accept(Visitor& visitor) const override;
 
  ~x509() override;
 
  LIEF_API friend std::ostream& operator<<(std::ostream& os, const x509& x509_cert);
 
  private:
  x509();
  mbedtls_x509_crt* x509_cert_ = nullptr;
 
};
 
}
}
 
ENABLE_BITMASK_OPERATORS(LIEF::PE::x509::VERIFICATION_FLAGS)
 
#endif