5d49bd06 |
/* |
e1cbc270 |
* Copyright (C) 2013-2019 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
* Copyright (C) 2011-2013 Sourcefire, Inc. |
5d49bd06 |
*
* Authors: aCaB
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 as
* published by the Free Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
* MA 02110-1301, USA.
*/
|
e5c6c1aa |
#ifndef __CRTMGR_H
#define __CRTMGR_H
#include <time.h>
#include "bignum.h"
|
a133cd8e |
typedef enum { CLI_HASHTYPE_ANY, /* used by crts added from .CRB rules */
CLI_SHA1RSA, |
288057e9 |
CLI_MD5RSA,
CLI_MD2RSA,
CLI_RSA,
CLI_SHA256RSA,
CLI_SHA384RSA,
CLI_SHA512RSA } cli_crt_hashtype;
typedef enum { VRFY_CODE,
VRFY_TIME } cli_vrfy_type; |
e5c6c1aa |
|
1d7f6b27 |
#ifndef CRT_RAWMAXLEN |
616c0259 |
#define CRT_RAWMAXLEN 64 |
1d7f6b27 |
#endif
|
8997495d |
typedef struct cli_crt_t { |
0f418a13 |
char *name; |
616c0259 |
uint8_t raw_subject[CRT_RAWMAXLEN];
uint8_t raw_issuer[CRT_RAWMAXLEN];
uint8_t raw_serial[CRT_RAWMAXLEN]; |
e5c6c1aa |
uint8_t subject[SHA1_HASH_SIZE];
uint8_t issuer[SHA1_HASH_SIZE]; |
a8e79d93 |
uint8_t serial[SHA1_HASH_SIZE]; |
46e06209 |
/* tbshash holds the hash we'll use for verification with data in the sig,
* so it must have at least enough space for the largest hash in
* cli_crt_hashtype */ |
7cf44f33 |
uint8_t tbshash[SHA512_HASH_SIZE]; |
e5c6c1aa |
mp_int n;
mp_int e;
mp_int sig;
time_t not_before;
time_t not_after;
cli_crt_hashtype hashtype; |
10243534 |
int certSign;
int codeSign;
int timeSign; |
278b2b28 |
int isBlacklisted; |
8997495d |
struct cli_crt_t *prev;
struct cli_crt_t *next; |
e5c6c1aa |
} cli_crt;
|
8997495d |
typedef struct {
cli_crt *crts; |
7bcfb2f3 |
unsigned int items; |
8997495d |
} crtmgr;
|
e5c6c1aa |
int cli_crt_init(cli_crt *x509);
void cli_crt_clear(cli_crt *x509); |
7bcfb2f3 |
void crtmgr_init(crtmgr *m); |
6bc5d0cb |
void crtmgr_free(crtmgr *m); |
8997495d |
int crtmgr_add(crtmgr *m, cli_crt *x509); |
5e84efeb |
cli_crt *crtmgr_lookup(crtmgr *m, cli_crt *x509); |
a133cd8e |
cli_crt *crtmgr_blacklist_lookup(crtmgr *m, cli_crt *x509);
cli_crt *crtmgr_whitelist_lookup(crtmgr *m, cli_crt *x509, int crb_crts_only); |
7bcfb2f3 |
void crtmgr_del(crtmgr *m, cli_crt *x509); |
2501f747 |
cli_crt *crtmgr_verify_crt(crtmgr *m, cli_crt *x509); |
f5092717 |
cli_crt *crtmgr_verify_pkcs7(crtmgr *m, const uint8_t *issuer, const uint8_t *serial, const void *signature, unsigned int signature_len, cli_crt_hashtype hashtype, const uint8_t *refhash, cli_vrfy_type vrfytype); |
a133cd8e |
int crtmgr_add_roots(struct cl_engine *engine, crtmgr *m, int exclude_bl_crts); |
8997495d |
|
e5c6c1aa |
#endif |