implementation of strictcrlpolicy=ifuri
[strongswan.git] / src / libstrongswan / crypto / ca.h
1 /**
2 * @file ca.h
3 *
4 * @brief Interface of ca_info_t.
5 *
6 */
7
8 /*
9 * Copyright (C) 2007 Andreas Steffen
10 * Hochschule fuer Technik Rapperswil
11 *
12 * This program is free software; you can redistribute it and/or modify it
13 * under the terms of the GNU General Public License as published by the
14 * Free Software Foundation; either version 2 of the License, or (at your
15 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
19 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
20 * for more details.
21 */
22
23 #ifndef CA_H_
24 #define CA_H_
25
26 typedef struct ca_info_t ca_info_t;
27
28 #include <library.h>
29
30 #include <credential_store.h>
31
32 #include "x509.h"
33 #include "crl.h"
34
35 /**
36 * @brief X.509 certification authority information record
37 *
38 * @b Constructors:
39 * - ca_info_create()
40 *
41 * @ingroup transforms
42 */
43 struct ca_info_t {
44
45 /**
46 * @brief Compare two ca info records
47 *
48 * Comparison is done via the keyid of the ca certificate
49 *
50 * @param this first ca info object
51 * @param that second ca info objct
52 * @return TRUE if a match is found
53 */
54 bool (*equals) (const ca_info_t *this, const ca_info_t* that);
55
56 /**
57 * @brief If the ca info record has the same name then release the name and URIs
58 *
59 * @param this ca info object
60 * @return TRUE if a match is found
61 */
62 bool (*equals_name_release_info) (ca_info_t *this, const char *name);
63
64 /**
65 * @brief Checks if a certificate was issued by this ca
66 *
67 * @param this ca info object
68 * @param cert certificate to be checked
69 * @return TRUE if the issuing ca has been found
70 */
71 bool (*is_cert_issuer) (ca_info_t *this, const x509_t *cert);
72
73 /**
74 * @brief Checks if a crl was issued by this ca
75 *
76 * @param this ca info object
77 * @param crl crl to be checked
78 * @return TRUE if the issuing ca has been found
79 */
80 bool (*is_crl_issuer) (ca_info_t *this, const crl_t *crl);
81
82 /**
83 * @brief Checks if the ca enforces a strict crl policy
84 *
85 * @param this ca info object
86 * @return TRUE if the crl policy is strict
87 */
88 bool (*is_strict) (ca_info_t *this);
89
90 /**
91 * @brief Merges info from a secondary ca info object
92 *
93 * @param this primary ca info object
94 * @param that secondary ca info object
95 */
96 void (*add_info) (ca_info_t *this, const ca_info_t *that);
97
98 /**
99 * @brief Adds a new or replaces an obsoleted CRL
100 *
101 * @param this ca info object
102 * @param crl crl to be added
103 */
104 void (*add_crl) (ca_info_t *this, crl_t *crl);
105
106 /**
107 * @brief Does the CA have a CRL?
108 *
109 * @param this ca info object
110 * @return TRUE if crl is available
111 */
112 bool (*has_crl) (ca_info_t *this);
113
114 /**
115 * @brief Does the CA have OCSP certinfos?
116 *
117 * @param this ca info object
118 * @return TRUE if there are any certinfos
119 */
120 bool (*has_certinfos) (ca_info_t *this);
121
122 /**
123 * @brief Print the CA info onto the console
124 *
125 * @param this ca info object
126 * @param out output stream
127 * @param utc TRUE - utc
128 FALSE - local time
129 */
130 void (*list) (ca_info_t *this, FILE *out, bool utc);
131
132 /**
133 * @brief List the CRL onto the console
134 *
135 * @param this ca info object
136 * @param out output stream
137 * @param utc TRUE - utc
138 FALSE - local time
139 */
140 void (*list_crl) (ca_info_t *this, FILE *out, bool utc);
141
142 /**
143 * @brief List the OCSP certinfos onto the console
144 *
145 * @param this ca info object
146 * @param out output stream
147 * @param utc TRUE - utc
148 FALSE - local time
149 */
150 void (*list_certinfos) (ca_info_t *this, FILE *out, bool utc);
151
152 /**
153 * @brief Adds a CRL URI to a list
154 *
155 * @param this ca info object
156 * @param uri crl uri to be added
157 */
158 void (*add_crluri) (ca_info_t *this, chunk_t uri);
159
160 /**
161 * @brief Adds a OCSP URI to a list
162 *
163 * @param this ca info object
164 * @param uri ocsp uri to be added
165 */
166 void (*add_ocspuri) (ca_info_t *this, chunk_t uri);
167
168 /**
169 * @brief Get the ca certificate
170 *
171 * @param this ca info object
172 * @return ca certificate
173 */
174 x509_t* (*get_certificate) (ca_info_t *this);
175
176 /**
177 * @brief Verify the status of a certificate by CRL
178 *
179 * @param this ca info object
180 * @param certinfo detailed certificate status information
181 * @param crl_dir directory where fetched crls should be stored
182 * @return certificate status
183 */
184 cert_status_t (*verify_by_crl) (ca_info_t *this, certinfo_t *certinfo, const char *crl_dir);
185
186 /**
187 * @brief Verify the status of a certificate by OCSP
188 *
189 * @param this ca info object
190 * @param certinfo detailed certificate status information
191 * @param credentials credential store needed for trust path verification
192 * @return certificate status
193 */
194 cert_status_t (*verify_by_ocsp) (ca_info_t* this, certinfo_t* certinfo, credential_store_t* credentials);
195
196 /**
197 * @brief Purge the OCSP certinfos of a ca info record
198 *
199 * @param this ca info object
200 */
201 void (*purge_ocsp) (ca_info_t *this);
202
203 /**
204 * @brief Destroys a ca info record
205 *
206 * @param this ca info to destroy
207 */
208 void (*destroy) (ca_info_t *this);
209 };
210
211 /**
212 * @brief Set ca info options
213 *
214 * @param cache TRUE if crls shall be cached by storing them
215 * @param interval crl_check_interval to be set in seconds
216 *
217 * @ingroup crypto
218 */
219 void ca_info_set_options(strict_t strict, bool cache, u_int interval);
220
221 /**
222 * @brief Create a ca info record
223 *
224 * @param name name of the ca info record
225 * @param cacert path to the ca certificate
226 * @return created ca_info_t, or NULL if invalid.
227 *
228 * @ingroup crypto
229 */
230 ca_info_t *ca_info_create(const char *name, x509_t *cacert);
231
232 #endif /* CA_H_ */