src/libstrongswan/crypto/ca.h

   1 /**
   2  * @file ca.h
   3  *
   4  * @brief Interface of ca_info_t.
   5  *
   6  */
   7
   8 /*
   9  * Copyright (C) 2007 Andreas Steffen
  10  * Hochschule fuer Technik Rapperswil
  11  *
  12  * This program is free software; you can redistribute it and/or modify it
  13  * under the terms of the GNU General Public License as published by the
  14  * Free Software Foundation; either version 2 of the License, or (at your
  15  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  16  *
  17  * This program is distributed in the hope that it will be useful, but
  18  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  19  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  20  * for more details.
  21  */
  22
  23 #ifndef CA_H_
  24 #define CA_H_
  25
  26 typedef struct ca_info_t ca_info_t;
  27
  28 #include <library.h>
  29
  30 #include "x509.h"
  31 #include "crl.h"
  32
  33 #define MAX_CA_PATH_LEN         7
  34
  35 /*forward declaration */
  36 struct credential_store_t;
  37
  38 /**
  39  * @brief X.509 certification authority information record
  40  *
  41  * @b Constructors:
  42  *  - ca_info_create()
  43  *
  44  * @ingroup transforms
  45  */
  46 struct ca_info_t {
  47
  48         /**
  49          * @brief Compare two ca info records
  50          *
  51          * Comparison is done via the keyid of the ca certificate
  52      *
  53          * @param this                  first ca info object
  54          * @param that                  second ca info objct
  55          * @return                              TRUE if a match is found
  56          */
  57         bool (*equals) (const ca_info_t *this, const ca_info_t* that);
  58
  59         /**
  60          * @brief If the ca info record has the same name then release the name and URIs
  61          *
  62          * @param this                  ca info object
  63          * @return                              TRUE if a match is found
  64          */
  65         bool (*equals_name_release_info) (ca_info_t *this, const char *name);
  66
  67         /**
  68          * @brief Checks if a certificate was issued by this ca
  69          *
  70          * @param this                  ca info object
  71          * @param cert                  certificate to be checked
  72          * @return                              TRUE if the issuing ca has been found
  73          */
  74         bool (*is_cert_issuer) (ca_info_t *this, const x509_t *cert);
  75
  76         /**
  77          * @brief Checks if a crl was issued by this ca
  78          *
  79          * @param this                  ca info object
  80          * @param crl                   crl to be checked
  81          * @return                              TRUE if the issuing ca has been found
  82          */
  83         bool (*is_crl_issuer) (ca_info_t *this, const crl_t *crl);
  84
  85         /**
  86          * @brief Checks if the ca certificate has the isCA flag set
  87          *
  88          * @param this                  ca info object
  89          * @return                              TRUE if the isCA flag is set
  90          */
  91         bool (*is_ca) (ca_info_t *this);
  92
  93         /**
  94          * @brief Checks if the ca enforces a strict crl policy
  95          *
  96          * @param this                  ca info object
  97          * @return                              TRUE if the crl policy is strict
  98          */
  99         bool (*is_strict) (ca_info_t *this);
 100
 101         /**
 102          * @brief Merges info from a secondary ca info object
 103          *
 104          * @param this                  primary ca info object
 105          * @param that                  secondary ca info object
 106          */
 107         void (*add_info) (ca_info_t *this, const ca_info_t *that);
 108
 109         /**
 110          * @brief Adds a new or replaces an obsoleted CRL
 111          *
 112          * @param this                  ca info object
 113          * @param crl                   crl to be added
 114          */
 115         void (*add_crl) (ca_info_t *this, crl_t *crl);
 116
 117         /**
 118          * @brief Does the CA have a CRL?
 119          *
 120          * @param this                  ca info object
 121          * @return                              TRUE if crl is available
 122          */
 123         bool (*has_crl) (ca_info_t *this);
 124
 125         /**
 126          * @brief Does the CA have OCSP certinfos?
 127          *
 128          * @param this                  ca info object
 129          * @return                              TRUE if there are any certinfos
 130          */
 131         bool (*has_certinfos) (ca_info_t *this);
 132
 133         /**
 134          * @brief Print the CA info onto the console
 135          *
 136          * @param this                  ca info object
 137          * @param out                   output stream
 138          * @param utc                   TRUE -  utc
 139                                                         FALSE - local time
 140          */
 141         void (*list) (ca_info_t *this, FILE *out, bool utc);
 142
 143         /**
 144          * @brief List the CRL onto the console
 145          *
 146          * @param this                  ca info object
 147          * @param out                   output stream
 148          * @param utc                   TRUE -  utc
 149                                                         FALSE - local time
 150          */
 151         void (*list_crl) (ca_info_t *this, FILE *out, bool utc);
 152
 153         /**
 154          * @brief List the OCSP certinfos onto the console
 155          *
 156          * @param this                  ca info object
 157          * @param out                   output stream
 158          * @param utc                   TRUE -  utc
 159                                                         FALSE - local time
 160          */
 161         void (*list_certinfos) (ca_info_t *this, FILE *out, bool utc);
 162
 163         /**
 164          * @brief Adds a CRL URI to a list
 165          *
 166          * @param this                  ca info object
 167          * @param uri                   crl uri to be added
 168          */
 169         void (*add_crluri) (ca_info_t *this, chunk_t uri);
 170
 171         /**
 172          * @brief Adds a OCSP URI to a list
 173          *
 174          * @param this                  ca info object
 175          * @param uri                   ocsp uri to be added
 176          */
 177         void (*add_ocspuri) (ca_info_t *this, chunk_t uri);
 178
 179         /**
 180          * @brief Get the ca certificate
 181          *
 182          * @param this                  ca info object
 183          * @return                              ca certificate
 184          */
 185         x509_t* (*get_certificate) (ca_info_t *this);
 186
 187         /**
 188          * @brief Verify the status of a certificate by CRL
 189          *
 190          * @param this                  ca info object
 191          * @param certinfo              detailed certificate status information
 192          * @param crl_dir               directory where fetched crls should be stored
 193          * @return                              certificate status
 194          */
 195         cert_status_t (*verify_by_crl) (ca_info_t *this, certinfo_t *certinfo, const char *crl_dir);
 196
 197         /**
 198          * @brief Verify the status of a certificate by OCSP
 199          *
 200          * @param this                  ca info object
 201          * @param certinfo              detailed certificate status information
 202          * @param credentials   credential store needed for trust path verification
 203          * @return                              certificate status
 204          */
 205         cert_status_t (*verify_by_ocsp) (ca_info_t* this, certinfo_t* certinfo, struct credential_store_t* credentials);
 206
 207         /**
 208          * @brief Purge the OCSP certinfos of a ca info record
 209          *
 210          * @param this                  ca info object
 211          */
 212         void (*purge_ocsp) (ca_info_t *this);
 213
 214         /**
 215          * @brief Destroys a ca info record
 216          *
 217          * @param this                  ca info to destroy
 218          */
 219         void (*destroy) (ca_info_t *this);
 220 };
 221
 222 /**
 223  * @brief Set ca info options
 224  *
 225  * @param cache         TRUE if crls shall be cached by storing them
 226  * @param interval      crl_check_interval to be set in seconds
 227  *
 228  * @ingroup crypto
 229  */
 230 void ca_info_set_options(strict_t strict, bool cache, u_int interval);
 231
 232 /**
 233  * @brief Create a ca info record
 234  *
 235  * @param name          name of the ca info record
 236  * @param cacert        path to the ca certificate
 237  * @return                      created ca_info_t, or NULL if invalid.
 238  *
 239  * @ingroup crypto
 240  */
 241 ca_info_t *ca_info_create(const char *name, x509_t *cacert);
 242
 243 #endif /* CA_H_ */