/*
* Mentalis.org Security Library
*
* Copyright © 2002-2005, The KPD-Team
* All rights reserved.
* http://www.mentalis.org/
*
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* - Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* - Neither the name of the KPD-Team, nor the names of its contributors
* may be used to endorse or promote products derived from this
* software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
* THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
* INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
*/
using System;
using System.Runtime.InteropServices;
namespace Org.Mentalis.Security.Certificates {
///
/// Defines the different hash type values.
///
public enum HashType : int {
/// The certificate will be hashed using the SHA1 algorithm.
SHA1 = SecurityConstants.CERT_SHA1_HASH_PROP_ID,
/// The certificate will be hashed using the MD5 algorithm.
MD5 = SecurityConstants.CERT_MD5_HASH_PROP_ID,
/// The certificate will be hashed using the default hashing algorithm.
Default = SecurityConstants.CERT_HASH_PROP_ID
}
///
/// Defines the different key usage values.
///
[Flags]
public enum KeyUsage : int {
/// The key can be used for data encipherment.
DataEncipherment = SecurityConstants.CERT_DATA_ENCIPHERMENT_KEY_USAGE,
/// The key can be used to sign data.
DigitalSignature = SecurityConstants.CERT_DIGITAL_SIGNATURE_KEY_USAGE,
/// The key can be used in key agreement algorithms.
KeyAgreement = SecurityConstants.CERT_KEY_AGREEMENT_KEY_USAGE,
/// The key can be used to sign certificates.
KeyCertSign = SecurityConstants.CERT_KEY_CERT_SIGN_KEY_USAGE,
/// The key can be used for key encipherment.
KeyEncipherment = SecurityConstants.CERT_KEY_ENCIPHERMENT_KEY_USAGE,
/// The key can be used for electronic non-repudiation.
NonRepudiation = SecurityConstants.CERT_NON_REPUDIATION_KEY_USAGE,
/// The key can be used to sign certificate revocation lists.
CrlSign = SecurityConstants.CERT_OFFLINE_CRL_SIGN_KEY_USAGE
}
///
/// Defines the different authentication type values.
///
public enum AuthType : int {
/// The certificate is a client certificate.
Client = SecurityConstants.AUTHTYPE_CLIENT, // used to validate a certificate that comes from a client
/// The certificate is a server certificate.
Server = SecurityConstants.AUTHTYPE_SERVER // used to validate a certificate that comes from a server
}
///
/// Defines the different certificate status values.
///
public enum CertificateStatus : int {
/// The certificate is valid.
ValidCertificate = 0,
/// A required certificate is not within its validity period.
Expired = SecurityConstants.CERT_E_EXPIRED,
/// The certificate's basic constraints are invalid or missing.
InvalidBasicConstraints = SecurityConstants.TRUST_E_BASIC_CONSTRAINTS,
/// A chain of certificates was not correctly created.
InvalidChain = SecurityConstants.CERT_E_CHAINING,
/// The validity periods of the certification chain do not nest correctly.
InvalidNesting = SecurityConstants.CERT_E_VALIDITYPERIODNESTING,
/// A certificate is being used for a non permitted purpose.
InvalidPurpose = SecurityConstants.CERT_E_PURPOSE,
/// A certificate that can only be used as an end-entity is being used as a CA or visa versa.
InvalidRole = SecurityConstants.CERT_E_ROLE,
/// The signature of the certificate cannot be verified.
InvalidSignature = SecurityConstants.TRUST_E_CERT_SIGNATURE,
/// The certificate's CN name does not match the passed value.
NoCNMatch = SecurityConstants.CERT_E_CN_NO_MATCH,
/// A certificate in the chain has been explicitly revoked by its issuer.
ParentRevoked = SecurityConstants.CERT_E_REVOKED,
/// The revocation process could not continue. The certificates could not be checked.
RevocationFailure = SecurityConstants.CERT_E_REVOCATION_FAILURE,
/// Since the revocation server was offline, the called function was not able to complete the revocation check.
RevocationServerOffline = SecurityConstants.CRYPT_E_REVOCATION_OFFLINE,
/// The certificate or signature has been revoked.
Revoked = SecurityConstants.CRYPT_E_REVOKED,
/// A certification chain processed correctly but terminated in a root certificate not trusted by the trust provider.
UntrustedRoot = SecurityConstants.CERT_E_UNTRUSTEDROOT,
/// The root certificate is a testing certificate and policy settings disallow test certificates.
UntrustedTestRoot = SecurityConstants.CERT_E_UNTRUSTEDTESTROOT,
/// The certificate is not valid for the requested usage.
WrongUsage = SecurityConstants.CERT_E_WRONG_USAGE,
/// The certificate is invalid.
OtherError = -1,
}
///
/// Defines the different certificate store values.
///
public enum CertificateStoreType : int {
/// The certificate store should be saved as a serializes store.
SerializedStore = SecurityConstants.CERT_STORE_SAVE_AS_STORE,
/// The certificate store should be saved as a signed PKCS7 message.
Pkcs7Message = SecurityConstants.CERT_STORE_SAVE_AS_PKCS7
}
///
/// Defines additional options for building a certificate chain.
///
public enum CertificateChainOptions : int {
/// The default chain options
Default = 0,
/// Revocation checking is done on the end certificate and only the end certificate.
RevocationCheckEndCert = SecurityConstants.CERT_CHAIN_REVOCATION_CHECK_END_CERT,
/// Revocation checking is done on all of the certificates in every chain.
RevocationCheckChain = SecurityConstants.CERT_CHAIN_REVOCATION_CHECK_CHAIN,
/// Revocation checking in done on all certificates in all of the chains except the root certificate.
RevocationCheckChainExcludeRoot = SecurityConstants.CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT,
/// When this flag is set, the end certificate is cached, which might speed up the chain-building process. By default, the end certificate is not cached and it would need to be verified each time a chain is built for it.
RevocationCacheEndCert = SecurityConstants.CERT_CHAIN_CACHE_END_CERT,
/// Revocation checking only accesses cached URLs and does not hit the wire to do any revocation URL retrieval. Supported on Windows Me, Windows 2000 and later.
RevocationCheckCacheOnly = SecurityConstants.CERT_CHAIN_REVOCATION_CHECK_CACHE_ONLY,
/// Uses only cached URLs in building a certificate chain. The Internet and Intranet are not searched for URL-based objects. Note, not applicable to revocation checking. Set CERT_CHAIN_REVOCATION_CHECK_CACHE_ONLY to use only cached URLs for revocation checking.
CacheOnlyUrlRetrieval = SecurityConstants.CERT_CHAIN_CACHE_ONLY_URL_RETRIEVAL,
/// For performance reasons, the second pass of chain building only considers potential chain paths that have quality greater than or equal to the highest quality determined during the first pass. The first pass only considers valid signature, complete chain and trusted roots to calculate chain quality. This flag can be set to disable this optimization and consider all potential chain paths during the second pass.
DisablePass1QualityFiltering = SecurityConstants.CERT_CHAIN_DISABLE_PASS1_QUALITY_FILTERING,
/// The default is to return only the highest quality chain path. Setting this flag will return the lower quality chains. These are returned in the chain context's cLowerQualityChainContext and rgpLowerQualityChainContext fields.
ReturnLowerQualityContexts = SecurityConstants.CERT_CHAIN_RETURN_LOWER_QUALITY_CONTEXTS,
/// Setting this flag inhibits the auto update of third party roots from the Windows Update Web Server.
DisableAuthRootAutoUpdate = SecurityConstants.CERT_CHAIN_DISABLE_AUTH_ROOT_AUTO_UPDATE,
}
///
/// Defines the different verificateion flags values.
///
///
/// You can specify more VerificationFlags at once by combining them with the OR operator.
///
[Flags]
public enum VerificationFlags : int {
/// No flags.
None = 0,
/// Ignore an invalid time.
IgnoreTimeNotValid = SecurityConstants.CERT_CHAIN_POLICY_IGNORE_NOT_TIME_VALID_FLAG,
/// Ignore an invalid time of the certificate trust list.
IgnoreCtlTimeNotValid = SecurityConstants.CERT_CHAIN_POLICY_IGNORE_CTL_NOT_TIME_VALID_FLAG,
/// Ignore an invalid time nesting.
IgnoreTimeNotNested = SecurityConstants.CERT_CHAIN_POLICY_IGNORE_NOT_TIME_NESTED_FLAG,
/// Ignore invalid basic contraints.
IgnoreInvalidBasicContraints = SecurityConstants.CERT_CHAIN_POLICY_IGNORE_INVALID_BASIC_CONSTRAINTS_FLAG,
/// Ignore all time checks.
IgnoreAllTimeChecks = SecurityConstants.CERT_CHAIN_POLICY_IGNORE_ALL_NOT_TIME_VALID_FLAGS,
/// Allow an unknown certificate authority.
AllowUnknownCA = SecurityConstants.CERT_CHAIN_POLICY_ALLOW_UNKNOWN_CA_FLAG,
/// Ignore the wrong usage of a certificate.
IgnoreWrongUsage = SecurityConstants.CERT_CHAIN_POLICY_IGNORE_WRONG_USAGE_FLAG,
/// Ignore an invalid name.
IgnoreInvalidName = SecurityConstants.CERT_CHAIN_POLICY_IGNORE_INVALID_NAME_FLAG,
/// Ignore an invalid policy.
IgnoreInvalidPolicy = SecurityConstants.CERT_CHAIN_POLICY_IGNORE_INVALID_POLICY_FLAG,
/// Ignore an unknown revocation status of the end certificate.
IgnoreEndRevUnknown = SecurityConstants.CERT_CHAIN_POLICY_IGNORE_END_REV_UNKNOWN_FLAG,
/// Ignore an unknown revocation status of the signer certificate.
IgnoreSignerRevUnknown = SecurityConstants.CERT_CHAIN_POLICY_IGNORE_CTL_SIGNER_REV_UNKNOWN_FLAG,
/// Ignore an unknown revocation status of the certificate authority.
IgnoreCARevUnknown = SecurityConstants.CERT_CHAIN_POLICY_IGNORE_CA_REV_UNKNOWN_FLAG,
/// Ignore an unknown revocation status of the root certificate.
IgnoreRootRevUnknown = SecurityConstants.CERT_CHAIN_POLICY_IGNORE_ROOT_REV_UNKNOWN_FLAG,
/// Ignore an unknown revocation status of any of the certificates.
IgnoreAllRevUnknown = SecurityConstants.CERT_CHAIN_POLICY_IGNORE_ALL_REV_UNKNOWN_FLAGS,
/// Allow a test root.
AllowTestroot = SecurityConstants.CERT_CHAIN_POLICY_ALLOW_TESTROOT_FLAG,
/// Trust a test root.
TrustTestroot = SecurityConstants.CERT_CHAIN_POLICY_TRUST_TESTROOT_FLAG
}
///
/// Specifies the location of the X.509 certificate store.
///
public enum StoreLocation {
/// The certificate store for the current service.
CurrentService = SecurityConstants.CERT_SYSTEM_STORE_CURRENT_SERVICE,
/// The certificate store for the currently logged-on user.
CurrentUser = SecurityConstants.CERT_SYSTEM_STORE_CURRENT_USER,
/// The certificate store for the currently logged-on group.
CurrentUserGroupPolicy = SecurityConstants.CERT_SYSTEM_STORE_CURRENT_USER_GROUP_POLICY,
/// The certificate store for the local computer.
LocalMachine = SecurityConstants.CERT_SYSTEM_STORE_LOCAL_MACHINE,
/// The certificate store for the local machine enterprise downloaded from a network setting.
LocalMachineEnterprise = SecurityConstants.CERT_SYSTEM_STORE_LOCAL_MACHINE_ENTERPRISE,
/// The certificate store for the local machine group policy downloaded from a network setting.
LocalMachineGroupPolicy = SecurityConstants.CERT_SYSTEM_STORE_LOCAL_MACHINE_GROUP_POLICY,
/// The certificate store for a specified service account; for example, an Alerter or the Event Log.
Services = SecurityConstants.CERT_SYSTEM_STORE_SERVICES,
/// The location is unknown.
Unknown = 0,
/// The certificate store for the users group of this computer.
Users = SecurityConstants.CERT_SYSTEM_STORE_CURRENT_USER
}
///
/// Defines a structure that represents one attribute of a relative distinguished name.
///
public struct NameAttribute {
///
/// Initializes a new instance.
///
/// The object identifier of the attribute.
/// The decoded value of the attribute.
public NameAttribute(string oid, string val) {
this.ObjectID = oid;
this.Value = val;
}
///
/// Determines whether the specified is equal to the current .
///
/// The Object to compare with the current Object.
/// true if the specified Object is equal to the current NameAttribute; otherwise, false.
public override bool Equals(object obj) {
try {
NameAttribute o = (NameAttribute)obj;
return (o.ObjectID == this.ObjectID) && (o.Value == this.Value);
} catch {
return false;
}
}
///
/// Serves as a hash function for a type, suitable for use in hashing algorithms and data structures like a hash table.
///
/// A hash code for the current Object.
public override int GetHashCode() {
if (this.ObjectID == null && this.Value == null)
return 0;
else if (this.ObjectID == null)
return this.Value.GetHashCode();
else if (this.Value == null)
return this.ObjectID.GetHashCode();
else
return this.Value.GetHashCode() ^ this.ObjectID.GetHashCode();
}
///
/// Returns a that represents the current .
///
/// A String that represents the current NameAttribute.
public override string ToString() {
if (ObjectID == null && Value == null)
return "N/A: N/A";
else if (ObjectID == null)
return "N/A: " + Value;
else if (Value == null)
return ObjectID + ": N/A";
else
return ObjectID + ": " + Value;
}
///
/// The object identifier of the attribute.
///
public string ObjectID;
///
/// The value of the attribute.
///
public string Value;
}
///
/// Represents an encoded certificate extension.
///
/// These extensions can be decoded with the Certificate.DecodeExtension() method.
public class Extension {
///
/// Initializes a new instance of the class.
///
/// The object identifier of the extension.
/// true if it is a critical extension, false otherwise.
/// A byte array that contains the encoded extension.
public Extension(string oid, bool critical, byte[] val) {
this.ObjectID = oid;
this.Critical = critical;
this.EncodedValue = val;
}
///
/// The object identifier of the extension.
///
public string ObjectID;
///
/// true if it is a critical extension, false otherwise.
///
public bool Critical;
///
/// A byte array that contains the encoded extension.
///
public byte[] EncodedValue;
}
///
/// Defines the different keyset locations.
///
public enum KeysetLocation : int {
/// The private keys are stored in the default location.
Default = 0,
/// The private keys are stored under local machine and not the current user.
LocalMachine = SecurityConstants.CRYPT_MACHINE_KEYSET,
/// The private keys are stored under the current user and not the local machine even if the PFX BLOB specifies they should go into local machine.
CurrentUser = SecurityConstants.CRYPT_USER_KEYSET
}
}