private/XrdCrypto/XrdCryptoX509Chain.hh

0001 #ifndef __CRYPTO_X509CHAIN_H__
0002 #define __CRYPTO_X509CHAIN_H__
0003 /******************************************************************************/
0004 /*                                                                            */
0005 /*                   X r d C r y p t o X 5 0 9 C h a i n . h h                */
0006 /*                                                                            */
0007 /* (c) 2005 G. Ganis , CERN                                                   */
0008 /*                                                                            */
0009 /* This file is part of the XRootD software suite.                            */
0010 /*                                                                            */
0011 /* XRootD is free software: you can redistribute it and/or modify it under    */
0012 /* the terms of the GNU Lesser General Public License as published by the     */
0013 /* Free Software Foundation, either version 3 of the License, or (at your     */
0014 /* option) any later version.                                                 */
0015 /*                                                                            */
0016 /* XRootD is distributed in the hope that it will be useful, but WITHOUT      */
0017 /* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or      */
0018 /* FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public       */
0019 /* License for more details.                                                  */
0020 /*                                                                            */
0021 /* You should have received a copy of the GNU Lesser General Public License   */
0022 /* along with XRootD in a file called COPYING.LESSER (LGPL license) and file  */
0023 /* COPYING (GPL license).  If not, see <http://www.gnu.org/licenses/>.        */
0024 /*                                                                            */
0025 /* The copyright holder's institutional names and contributor's names may not */
0026 /* be used to endorse or promote products derived from this software without  */
0027 /* specific prior written permission of the institution or contributor.       */
0028 /*                                                                            */
0029 /******************************************************************************/
0030
0031 /* ************************************************************************** */
0032 /*                                                                            */
0033 /* Chain of X509 certificates.                                                */
0034 /*                                                                            */
0035 /* ************************************************************************** */
0036
0037 #include "XrdSut/XrdSutBucket.hh"
0038 #include "XrdCrypto/XrdCryptoX509.hh"
0039 #include "XrdCrypto/XrdCryptoX509Crl.hh"
0040
0041 // ---------------------------------------------------------------------------//
0042 //                                                                            //
0043 // XrdCryptoX509Chain                                                         //
0044 //                                                                            //
0045 // Light single-linked list for managing stacks of XrdCryptoX509* objects     //
0046 //                                                                            //
0047 // ---------------------------------------------------------------------------//
0048
0049 //
0050 // Description of options for verify
0051 typedef struct {
0052    int  opt;            // option container
0053    int  when;           // time of verification (UTC)
0054    int  pathlen;        // max allowed path length of chain
0055    XrdCryptoX509Crl *crl; // CRL
0056 } x509ChainVerifyOpt_t;
0057
0058 const int kOptsCheckSelfSigned = 0x2;    // CA ckecking option
0059 const int kOptsCheckSubCA      = 0x4;    // CA-SubCA case (no EEC)
0060
0061 //
0062 // Node definition
0063 //
0064 class XrdCryptoX509ChainNode {
0065
0066 private:
0067    XrdCryptoX509          *cert;
0068    XrdCryptoX509ChainNode *next;
0069 public:
0070    XrdCryptoX509ChainNode(XrdCryptoX509 *c = 0, XrdCryptoX509ChainNode *n = 0)
0071         { cert = c; next = n;}
0072    virtual ~XrdCryptoX509ChainNode() { }
0073
0074    XrdCryptoX509          *Cert() const { return cert; }
0075    XrdCryptoX509ChainNode *Next() const { return next; }
0076
0077    void SetNext(XrdCryptoX509ChainNode *n) { next = n; }
0078 };
0079
0080 class XrdCryptoX509Chain {
0081
0082    enum ESearchMode { kExact = 0, kBegin = 1, kEnd = 2 };
0083
0084 public:
0085    XrdCryptoX509Chain(XrdCryptoX509 *c = 0);
0086    XrdCryptoX509Chain(XrdCryptoX509Chain *ch);
0087    virtual ~XrdCryptoX509Chain();
0088
0089    // CA status
0090    enum ECAStatus { kUnknown = 0, kAbsent, kInvalid, kValid};
0091
0092    // Error codes
0093    enum EX509ChainErr { kNone = 0, kInconsistent, kTooMany, kNoCA,
0094                         kNoCertificate, kInvalidType, kInvalidNames,
0095                         kRevoked, kExpired, kMissingExtension,
0096                         kVerifyFail, kInvalidSign, kCANotAutoSigned,
0097                         kNoEEC, kTooManyEEC, kInvalidProxy };
0098
0099    // In case or error
0100    const char         *X509ChainError(EX509ChainErr e);
0101    const char         *LastError() const { return lastError.c_str(); }
0102
0103    // Dump content
0104    void Dump();
0105
0106    // Access information
0107    int                 Size() const { return size; }
0108    XrdCryptoX509      *End() const { return end->Cert(); }
0109    ECAStatus           StatusCA() const { return statusCA; }
0110    const char         *CAname();
0111    const char         *EECname();
0112    const char         *CAhash();
0113    const char         *EEChash();
0114    XrdCryptoX509      *EffCA() const { return effca ? effca->Cert() : (XrdCryptoX509 *)0; }
0115
0116    // Modifiers
0117    void                InsertAfter(XrdCryptoX509 *c, XrdCryptoX509 *cp);
0118    void                PutInFront(XrdCryptoX509 *c);
0119    void                PushBack(XrdCryptoX509 *c);
0120    void                Remove(XrdCryptoX509 *c);
0121    bool                CheckCA(bool checkselfsigned = 1);
0122    void                Cleanup(bool keepCA = 0);
0123    void                SetStatusCA(ECAStatus st) { statusCA = st; }
0124
0125    // Search
0126    XrdCryptoX509      *SearchByIssuer(const char *issuer,
0127                                       ESearchMode mode = kExact);
0128    XrdCryptoX509      *SearchBySubject(const char *subject,
0129                                        ESearchMode mode = kExact);
0130
0131    // Check validity in time
0132    virtual int         CheckValidity(bool outatfirst = 1, int when = 0);
0133
0134    // Reorder (C(n) issuer of C(n+1))
0135    virtual int         Reorder();
0136
0137    // Verify chain
0138    virtual bool        Verify(EX509ChainErr &e, x509ChainVerifyOpt_t *vopt = 0);
0139
0140    // Pseudo - iterator functionality
0141    XrdCryptoX509       *Begin();
0142    XrdCryptoX509       *Next();
0143
0144 protected:
0145
0146
0147    XrdCryptoX509ChainNode *begin;
0148    XrdCryptoX509ChainNode *current;
0149    XrdCryptoX509ChainNode *end;
0150    XrdCryptoX509ChainNode *previous;
0151    XrdCryptoX509ChainNode *effca;
0152    int                     size;
0153    XrdOucString            lastError;
0154    XrdOucString            caname;
0155    XrdOucString            eecname;
0156    XrdOucString            cahash;
0157    XrdOucString            eechash;
0158    ECAStatus               statusCA;
0159
0160    XrdCryptoX509ChainNode *Find(XrdCryptoX509 *c);
0161    XrdCryptoX509ChainNode *FindIssuer(const char *issuer,
0162                                       ESearchMode mode = kExact,
0163                                       XrdCryptoX509ChainNode **p = 0);
0164    XrdCryptoX509ChainNode *FindSubject(const char *subject,
0165                                        ESearchMode mode = kExact,
0166                                        XrdCryptoX509ChainNode **p = 0);
0167    void SetEffectiveCA();
0168    bool Verify(EX509ChainErr &e, const char *msg,
0169                XrdCryptoX509::EX509Type type, int when,
0170                XrdCryptoX509 *xcer, XrdCryptoX509 *xsig,
0171                XrdCryptoX509Crl *crl = 0);
0172
0173 };
0174
0175 #endif