src/libstrongswan/credentials/certificates/certificate.h

   1 /*
   2  * Copyright (C) 2007-2008 Martin Willi
   3  * Hochschule fuer Technik Rapperswil
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  */
  15
  16 /**
  17  * @defgroup certificate certificate
  18  * @{ @ingroup certificates
  19  */
  20
  21 #ifndef CERTIFICATE_H_
  22 #define CERTIFICATE_H_
  23
  24 typedef struct certificate_t certificate_t;
  25 typedef enum certificate_type_t certificate_type_t;
  26 typedef enum cert_validation_t cert_validation_t;
  27
  28 #include <library.h>
  29 #include <utils/identification.h>
  30 #include <credentials/keys/public_key.h>
  31
  32 /**
  33  * Kind of a certificate_t
  34  */
  35 enum certificate_type_t {
  36         /** just any certificate */
  37         CERT_ANY,
  38         /** X.509 certificate */
  39         CERT_X509,
  40         /** X.509 certificate revocation list */
  41         CERT_X509_CRL,
  42         /** X.509 online certificate status protocol request */
  43         CERT_X509_OCSP_REQUEST,
  44         /** X.509 online certificate status protocol response */
  45         CERT_X509_OCSP_RESPONSE,
  46         /** X.509 attribute certificate */
  47         CERT_X509_AC,
  48         /** trusted, preinstalled public key */
  49         CERT_TRUSTED_PUBKEY,
  50         /** PGP certificate */
  51         CERT_GPG,
  52         /** Pluto cert_t (not a certificate_t), either x509 or PGP */
  53         CERT_PLUTO_CERT,
  54         /** Pluto x509acert_t (not a certificate_t), attribute certificate */
  55         CERT_PLUTO_AC,
  56         /** Pluto x509crl_t (not a certificate_t), certificate revocation list */
  57         CERT_PLUTO_CRL,
  58 };
  59
  60 /**
  61  * Enum names for certificate_type_t
  62  */
  63 extern enum_name_t *certificate_type_names;
  64
  65 /**
  66  * Result of a certificate validation.
  67  *
  68  * Order of values is relevant, sorted from good to bad.
  69  */
  70 enum cert_validation_t {
  71         /** certificate has been validated successfully */
  72         VALIDATION_GOOD = 0,
  73         /** validation has been skipped due to missing validation information */
  74         VALIDATION_SKIPPED,
  75         /** certificate has been validated, but check based on stale information */
  76         VALIDATION_STALE,
  77         /** validation failed due to a processing error */
  78         VALIDATION_FAILED,
  79         /** certificate has been revoked */
  80         VALIDATION_REVOKED,
  81 };
  82
  83 /**
  84  * Enum names for cert_validation_t
  85  */
  86 extern enum_name_t *cert_validation_names;
  87
  88 /**
  89  * An abstract certificate.
  90  *
  91  * A certificate designs a subject-issuer relationship. It may have an
  92  * associated public key.
  93  */
  94 struct certificate_t {
  95
  96         /**
  97          * Get the type of the certificate.
  98          *
  99          * @return                      certifcate type
 100          */
 101         certificate_type_t (*get_type)(certificate_t *this);
 102
 103         /**
 104          * Get the primary subject to which this certificate belongs.
 105          *
 106          * @return                      subject identity
 107          */
 108         identification_t* (*get_subject)(certificate_t *this);
 109
 110         /**
 111          * Check if certificate contains a subject ID.
 112          *
 113          * A certificate may contain additional subject identifiers, which are
 114          * not returned by get_subject (e.g. subjectAltNames)
 115          *
 116          * @param subject       subject identity
 117          * @return                      matching value of best match
 118          */
 119         id_match_t (*has_subject)(certificate_t *this, identification_t *subject);
 120
 121         /**
 122          * Get the issuer which signed this certificate.
 123          *
 124          * @return                      issuer identity
 125          */
 126         identification_t* (*get_issuer)(certificate_t *this);
 127
 128         /**
 129          * Check if certificate contains an issuer ID.
 130          *
 131          * A certificate may contain additional issuer identifiers, which are
 132          * not returned by get_issuer (e.g. issuerAltNames)
 133          *
 134          * @param subject       isser identity
 135          * @return                      matching value of best match
 136          */
 137         id_match_t (*has_issuer)(certificate_t *this, identification_t *issuer);
 138
 139         /**
 140          * Check if this certificate is issued and signed by a specific issuer.
 141          *
 142          * @param issuer        issuer's certificate
 143          * @return                      TRUE if certificate issued by issuer and trusted
 144          */
 145         bool (*issued_by)(certificate_t *this, certificate_t *issuer);
 146
 147         /**
 148          * Get the public key associated to this certificate.
 149          *
 150          * @return                      newly referenced public_key, NULL if none available
 151          */
 152         public_key_t* (*get_public_key)(certificate_t *this);
 153
 154         /**
 155          * Check the lifetime of the certificate.
 156          *
 157          * @param when                  check validity at a certain time (NULL for now)
 158          * @param not_before    receives certificates start of lifetime
 159          * @param not_after             receives certificates end of lifetime
 160          * @return                              TRUE if when between not_after and not_before
 161          */
 162         bool (*get_validity)(certificate_t *this, time_t *when,
 163                                                  time_t *not_before, time_t *not_after);
 164
 165         /**
 166          * Is this newer than that?
 167          *
 168          * @return                      TRUE if newer, FALSE otherwise
 169          */
 170         bool (*is_newer)(certificate_t *this, certificate_t *that);
 171
 172         /**
 173          * Get the certificate in an encoded form.
 174          *
 175          * @return                              allocated chunk of encoded cert
 176          */
 177         chunk_t (*get_encoding)(certificate_t *this);
 178
 179         /**
 180          * Check if two certificates are equal.
 181          *
 182          * @param other                 certificate to compair against this
 183          * @return                              TRUE if certificates are equal
 184          */
 185         bool (*equals)(certificate_t *this, certificate_t *other);
 186
 187         /**
 188          * Get a new reference to the certificate.
 189          *
 190          * @return                      this, with an increased refcount
 191          */
 192         certificate_t* (*get_ref)(certificate_t *this);
 193
 194         /**
 195          * Destroy a certificate.
 196          */
 197         void (*destroy)(certificate_t *this);
 198 };
 199
 200 #endif /** CERTIFICATE_H_ @}*/