add is_ca() method
[strongswan.git] / src / libstrongswan / crypto / ca.h
1 /**
2 * @file ca.h
3 *
4 * @brief Interface of ca_info_t.
5 *
6 */
7
8 /*
9 * Copyright (C) 2007 Andreas Steffen
10 * Hochschule fuer Technik Rapperswil
11 *
12 * This program is free software; you can redistribute it and/or modify it
13 * under the terms of the GNU General Public License as published by the
14 * Free Software Foundation; either version 2 of the License, or (at your
15 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
19 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
20 * for more details.
21 */
22
23 #ifndef CA_H_
24 #define CA_H_
25
26 typedef struct ca_info_t ca_info_t;
27
28 #include <library.h>
29
30 #include "x509.h"
31 #include "crl.h"
32
33 #define MAX_CA_PATH_LEN 7
34
35 /*forward declaration */
36 struct credential_store_t;
37
38 /**
39 * @brief X.509 certification authority information record
40 *
41 * @b Constructors:
42 * - ca_info_create()
43 *
44 * @ingroup transforms
45 */
46 struct ca_info_t {
47
48 /**
49 * @brief Compare two ca info records
50 *
51 * Comparison is done via the keyid of the ca certificate
52 *
53 * @param this first ca info object
54 * @param that second ca info objct
55 * @return TRUE if a match is found
56 */
57 bool (*equals) (const ca_info_t *this, const ca_info_t* that);
58
59 /**
60 * @brief If the ca info record has the same name then release the name and URIs
61 *
62 * @param this ca info object
63 * @return TRUE if a match is found
64 */
65 bool (*equals_name_release_info) (ca_info_t *this, const char *name);
66
67 /**
68 * @brief Checks if a certificate was issued by this ca
69 *
70 * @param this ca info object
71 * @param cert certificate to be checked
72 * @return TRUE if the issuing ca has been found
73 */
74 bool (*is_cert_issuer) (ca_info_t *this, const x509_t *cert);
75
76 /**
77 * @brief Checks if a crl was issued by this ca
78 *
79 * @param this ca info object
80 * @param crl crl to be checked
81 * @return TRUE if the issuing ca has been found
82 */
83 bool (*is_crl_issuer) (ca_info_t *this, const crl_t *crl);
84
85 /**
86 * @brief Checks if the ca certificate has the isCA flag set
87 *
88 * @param this ca info object
89 * @return TRUE if the isCA flag is set
90 */
91 bool (*is_ca) (ca_info_t *this);
92
93 /**
94 * @brief Checks if the ca enforces a strict crl policy
95 *
96 * @param this ca info object
97 * @return TRUE if the crl policy is strict
98 */
99 bool (*is_strict) (ca_info_t *this);
100
101 /**
102 * @brief Merges info from a secondary ca info object
103 *
104 * @param this primary ca info object
105 * @param that secondary ca info object
106 */
107 void (*add_info) (ca_info_t *this, const ca_info_t *that);
108
109 /**
110 * @brief Adds a new or replaces an obsoleted CRL
111 *
112 * @param this ca info object
113 * @param crl crl to be added
114 */
115 void (*add_crl) (ca_info_t *this, crl_t *crl);
116
117 /**
118 * @brief Does the CA have a CRL?
119 *
120 * @param this ca info object
121 * @return TRUE if crl is available
122 */
123 bool (*has_crl) (ca_info_t *this);
124
125 /**
126 * @brief Does the CA have OCSP certinfos?
127 *
128 * @param this ca info object
129 * @return TRUE if there are any certinfos
130 */
131 bool (*has_certinfos) (ca_info_t *this);
132
133 /**
134 * @brief Print the CA info onto the console
135 *
136 * @param this ca info object
137 * @param out output stream
138 * @param utc TRUE - utc
139 FALSE - local time
140 */
141 void (*list) (ca_info_t *this, FILE *out, bool utc);
142
143 /**
144 * @brief List the CRL onto the console
145 *
146 * @param this ca info object
147 * @param out output stream
148 * @param utc TRUE - utc
149 FALSE - local time
150 */
151 void (*list_crl) (ca_info_t *this, FILE *out, bool utc);
152
153 /**
154 * @brief List the OCSP certinfos onto the console
155 *
156 * @param this ca info object
157 * @param out output stream
158 * @param utc TRUE - utc
159 FALSE - local time
160 */
161 void (*list_certinfos) (ca_info_t *this, FILE *out, bool utc);
162
163 /**
164 * @brief Adds a CRL URI to a list
165 *
166 * @param this ca info object
167 * @param uri crl uri to be added
168 */
169 void (*add_crluri) (ca_info_t *this, chunk_t uri);
170
171 /**
172 * @brief Adds a OCSP URI to a list
173 *
174 * @param this ca info object
175 * @param uri ocsp uri to be added
176 */
177 void (*add_ocspuri) (ca_info_t *this, chunk_t uri);
178
179 /**
180 * @brief Get the ca certificate
181 *
182 * @param this ca info object
183 * @return ca certificate
184 */
185 x509_t* (*get_certificate) (ca_info_t *this);
186
187 /**
188 * @brief Verify the status of a certificate by CRL
189 *
190 * @param this ca info object
191 * @param certinfo detailed certificate status information
192 * @param crl_dir directory where fetched crls should be stored
193 * @return certificate status
194 */
195 cert_status_t (*verify_by_crl) (ca_info_t *this, certinfo_t *certinfo, const char *crl_dir);
196
197 /**
198 * @brief Verify the status of a certificate by OCSP
199 *
200 * @param this ca info object
201 * @param certinfo detailed certificate status information
202 * @param credentials credential store needed for trust path verification
203 * @return certificate status
204 */
205 cert_status_t (*verify_by_ocsp) (ca_info_t* this, certinfo_t* certinfo, struct credential_store_t* credentials);
206
207 /**
208 * @brief Purge the OCSP certinfos of a ca info record
209 *
210 * @param this ca info object
211 */
212 void (*purge_ocsp) (ca_info_t *this);
213
214 /**
215 * @brief Destroys a ca info record
216 *
217 * @param this ca info to destroy
218 */
219 void (*destroy) (ca_info_t *this);
220 };
221
222 /**
223 * @brief Set ca info options
224 *
225 * @param cache TRUE if crls shall be cached by storing them
226 * @param interval crl_check_interval to be set in seconds
227 *
228 * @ingroup crypto
229 */
230 void ca_info_set_options(strict_t strict, bool cache, u_int interval);
231
232 /**
233 * @brief Create a ca info record
234 *
235 * @param name name of the ca info record
236 * @param cacert path to the ca certificate
237 * @return created ca_info_t, or NULL if invalid.
238 *
239 * @ingroup crypto
240 */
241 ca_info_t *ca_info_create(const char *name, x509_t *cacert);
242
243 #endif /* CA_H_ */