src/libstrongswan/crypto/ca.h

   1 /**
   2  * @file ca.h
   3  *
   4  * @brief Interface of ca_info_t.
   5  *
   6  */
   7
   8 /*
   9  * Copyright (C) 2007 Andreas Steffen
  10  * Hochschule fuer Technik Rapperswil
  11  *
  12  * This program is free software; you can redistribute it and/or modify it
  13  * under the terms of the GNU General Public License as published by the
  14  * Free Software Foundation; either version 2 of the License, or (at your
  15  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  16  *
  17  * This program is distributed in the hope that it will be useful, but
  18  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  19  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  20  * for more details.
  21  */
  22
  23 #ifndef CA_H_
  24 #define CA_H_
  25
  26 typedef struct ca_info_t ca_info_t;
  27
  28 #include <library.h>
  29
  30 #include <credential_store.h>
  31
  32 #include "x509.h"
  33 #include "crl.h"
  34
  35 /**
  36  * @brief X.509 certification authority information record
  37  *
  38  * @b Constructors:
  39  *  - ca_info_create()
  40  *
  41  * @ingroup transforms
  42  */
  43 struct ca_info_t {
  44
  45         /**
  46          * @brief Compare two ca info records
  47          *
  48          * Comparison is done via the keyid of the ca certificate
  49      *
  50          * @param this                  first ca info object
  51          * @param that                  second ca info objct
  52          * @return                              TRUE if a match is found
  53          */
  54         bool (*equals) (const ca_info_t *this, const ca_info_t* that);
  55
  56         /**
  57          * @brief If the ca info record has the same name then release the name and URIs
  58          *
  59          * @param this                  ca info object
  60          * @return                              TRUE if a match is found
  61          */
  62         bool (*equals_name_release_info) (ca_info_t *this, const char *name);
  63
  64         /**
  65          * @brief Checks if a certificate was issued by this ca
  66          *
  67          * @param this                  ca info object
  68          * @param cert                  certificate to be checked
  69          * @return                              TRUE if the issuing ca has been found
  70          */
  71         bool (*is_cert_issuer) (ca_info_t *this, const x509_t *cert);
  72
  73         /**
  74          * @brief Checks if a crl was issued by this ca
  75          *
  76          * @param this                  ca info object
  77          * @param crl                   crl to be checked
  78          * @return                              TRUE if the issuing ca has been found
  79          */
  80         bool (*is_crl_issuer) (ca_info_t *this, const crl_t *crl);
  81
  82         /**
  83          * @brief Checks if the ca enforces a strict crl policy
  84          *
  85          * @param this                  ca info object
  86          * @return                              TRUE if the crl policy is strict
  87          */
  88         bool (*is_strict) (ca_info_t *this);
  89
  90         /**
  91          * @brief Merges info from a secondary ca info object
  92          *
  93          * @param this                  primary ca info object
  94          * @param that                  secondary ca info object
  95          */
  96         void (*add_info) (ca_info_t *this, const ca_info_t *that);
  97
  98         /**
  99          * @brief Adds a new or replaces an obsoleted CRL
 100          *
 101          * @param this                  ca info object
 102          * @param crl                   crl to be added
 103          */
 104         void (*add_crl) (ca_info_t *this, crl_t *crl);
 105
 106         /**
 107          * @brief Does the CA have a CRL?
 108          *
 109          * @param this                  ca info object
 110          * @return                              TRUE if crl is available
 111          */
 112         bool (*has_crl) (ca_info_t *this);
 113
 114         /**
 115          * @brief Does the CA have OCSP certinfos?
 116          *
 117          * @param this                  ca info object
 118          * @return                              TRUE if there are any certinfos
 119          */
 120         bool (*has_certinfos) (ca_info_t *this);
 121
 122         /**
 123          * @brief Print the CA info onto the console
 124          *
 125          * @param this                  ca info object
 126          * @param out                   output stream
 127          * @param utc                   TRUE -  utc
 128                                                         FALSE - local time
 129          */
 130         void (*list) (ca_info_t *this, FILE *out, bool utc);
 131
 132         /**
 133          * @brief List the CRL onto the console
 134          *
 135          * @param this                  ca info object
 136          * @param out                   output stream
 137          * @param utc                   TRUE -  utc
 138                                                         FALSE - local time
 139          */
 140         void (*list_crl) (ca_info_t *this, FILE *out, bool utc);
 141
 142         /**
 143          * @brief List the OCSP certinfos onto the console
 144          *
 145          * @param this                  ca info object
 146          * @param out                   output stream
 147          * @param utc                   TRUE -  utc
 148                                                         FALSE - local time
 149          */
 150         void (*list_certinfos) (ca_info_t *this, FILE *out, bool utc);
 151
 152         /**
 153          * @brief Adds a CRL URI to a list
 154          *
 155          * @param this                  ca info object
 156          * @param uri                   crl uri to be added
 157          */
 158         void (*add_crluri) (ca_info_t *this, chunk_t uri);
 159
 160         /**
 161          * @brief Adds a OCSP URI to a list
 162          *
 163          * @param this                  ca info object
 164          * @param uri                   ocsp uri to be added
 165          */
 166         void (*add_ocspuri) (ca_info_t *this, chunk_t uri);
 167
 168         /**
 169          * @brief Get the ca certificate
 170          *
 171          * @param this                  ca info object
 172          * @return                              ca certificate
 173          */
 174         x509_t* (*get_certificate) (ca_info_t *this);
 175
 176         /**
 177          * @brief Verify the status of a certificate by CRL
 178          *
 179          * @param this                  ca info object
 180          * @param certinfo              detailed certificate status information
 181          * @param crl_dir               directory where fetched crls should be stored
 182          * @return                              certificate status
 183          */
 184         cert_status_t (*verify_by_crl) (ca_info_t *this, certinfo_t *certinfo, const char *crl_dir);
 185
 186         /**
 187          * @brief Verify the status of a certificate by OCSP
 188          *
 189          * @param this                  ca info object
 190          * @param certinfo              detailed certificate status information
 191          * @param credentials   credential store needed for trust path verification
 192          * @return                              certificate status
 193          */
 194         cert_status_t (*verify_by_ocsp) (ca_info_t* this, certinfo_t* certinfo, credential_store_t* credentials);
 195
 196         /**
 197          * @brief Purge the OCSP certinfos of a ca info record
 198          *
 199          * @param this                  ca info object
 200          */
 201         void (*purge_ocsp) (ca_info_t *this);
 202
 203         /**
 204          * @brief Destroys a ca info record
 205          *
 206          * @param this                  ca info to destroy
 207          */
 208         void (*destroy) (ca_info_t *this);
 209 };
 210
 211 /**
 212  * @brief Set ca info options
 213  *
 214  * @param cache         TRUE if crls shall be cached by storing them
 215  * @param interval      crl_check_interval to be set in seconds
 216  *
 217  * @ingroup crypto
 218  */
 219 void ca_info_set_options(strict_t strict, bool cache, u_int interval);
 220
 221 /**
 222  * @brief Create a ca info record
 223  *
 224  * @param name          name of the ca info record
 225  * @param cacert        path to the ca certificate
 226  * @return                      created ca_info_t, or NULL if invalid.
 227  *
 228  * @ingroup crypto
 229  */
 230 ca_info_t *ca_info_create(const char *name, x509_t *cacert);
 231
 232 #endif /* CA_H_ */