00001 #ifndef __CRYPTO_SSLX509_H__ 00002 #define __CRYPTO_SSLX509_H__ 00003 /******************************************************************************/ 00004 /* */ 00005 /* X r d C r y p t o s s l X 5 0 9 . h h */ 00006 /* */ 00007 /* (c) 2005 G. Ganis , CERN */ 00008 /* */ 00009 /* This file is part of the XRootD software suite. */ 00010 /* */ 00011 /* XRootD is free software: you can redistribute it and/or modify it under */ 00012 /* the terms of the GNU Lesser General Public License as published by the */ 00013 /* Free Software Foundation, either version 3 of the License, or (at your */ 00014 /* option) any later version. */ 00015 /* */ 00016 /* XRootD is distributed in the hope that it will be useful, but WITHOUT */ 00017 /* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or */ 00018 /* FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public */ 00019 /* License for more details. */ 00020 /* */ 00021 /* You should have received a copy of the GNU Lesser General Public License */ 00022 /* along with XRootD in a file called COPYING.LESSER (LGPL license) and file */ 00023 /* COPYING (GPL license). If not, see <http://www.gnu.org/licenses/>. */ 00024 /* */ 00025 /* The copyright holder's institutional names and contributor's names may not */ 00026 /* be used to endorse or promote products derived from this software without */ 00027 /* specific prior written permission of the institution or contributor. */ 00028 /* */ 00029 /******************************************************************************/ 00030 00031 /* ************************************************************************** */ 00032 /* */ 00033 /* OpenSSL implementation of XrdCryptoX509 */ 00034 /* */ 00035 /* ************************************************************************** */ 00036 00037 #include "XrdCrypto/XrdCryptoX509.hh" 00038 00039 #include <openssl/x509v3.h> 00040 #include <openssl/bio.h> 00041 #include <openssl/evp.h> 00042 00043 #if OPENSSL_VERSION_NUMBER >= 0x0090800f 00044 # define XRDGSI_CONST const 00045 #else 00046 # define XRDGSI_CONST 00047 #endif 00048 00049 // ---------------------------------------------------------------------------// 00050 // 00051 // OpenSSL X509 implementation 00052 // 00053 // ---------------------------------------------------------------------------// 00054 class XrdCryptosslX509 : public XrdCryptoX509 00055 { 00056 00057 public: 00058 XrdCryptosslX509(const char *cf, const char *kf = 0); 00059 XrdCryptosslX509(XrdSutBucket *bck); 00060 XrdCryptosslX509(X509 *cert); 00061 virtual ~XrdCryptosslX509(); 00062 00063 // Access underlying data (in opaque form: used in chains) 00064 XrdCryptoX509data Opaque() { return (XrdCryptoX509data)cert; } 00065 00066 // Dump extensions 00067 int DumpExtensions(bool dumpunknown = 0); 00068 00069 // Access certificate key 00070 XrdCryptoRSA *PKI() { return pki; } 00071 void SetPKI(XrdCryptoX509data pki); 00072 00073 // Export in form of bucket (for transfers) 00074 XrdSutBucket *Export(); 00075 00076 // Parent file 00077 const char *ParentFile() { return (const char *)(srcfile.c_str()); } 00078 00079 // Proxy type 00080 const char *ProxyType() const { return cpxytype[pxytype]; } 00081 00082 // Key strength 00083 int BitStrength() { return ((cert) ? EVP_PKEY_bits(X509_get_pubkey(cert)) : -1);} 00084 00085 // Serial number 00086 kXR_int64 SerialNumber(); 00087 XrdOucString SerialNumberString(); 00088 00089 // Validity 00090 time_t NotBefore(); // get begin-validity time in secs since Epoch 00091 time_t NotAfter(); // get end-validity time in secs since Epoch 00092 00093 // Relevant Names 00094 const char *Subject(); // get subject name 00095 const char *Issuer(); // get issuer name 00096 00097 // Relevant hashes 00098 const char *SubjectHash(int = 0); // get hash of subject name 00099 const char *IssuerHash(int = 0); // get hash of issuer name 00100 00101 // Check SANs 00102 virtual bool MatchesSAN(const char *, bool &); 00103 00104 // Retrieve a given extension if there (in opaque form) 00105 XrdCryptoX509data GetExtension(const char *oid); 00106 00107 // Verify signature 00108 bool Verify(XrdCryptoX509 *ref); 00109 00110 private: 00111 X509 *cert; // The certificate object 00112 time_t notbefore; // begin-validity time in secs since Epoch 00113 time_t notafter; // end-validity time in secs since Epoch 00114 XrdOucString subject; // subject; 00115 XrdOucString issuer; // issuer name; 00116 XrdOucString subjecthash; // Default hash of subject; 00117 XrdOucString issuerhash; // Default hash of issuer name; 00118 XrdOucString subjectoldhash; // Old (md5) hash of subject if v >= 1.0.0; 00119 XrdOucString issueroldhash; // Old (md5) hash of issuer name if v >= 1.0.0; 00120 XrdOucString srcfile; // source file name, if any; 00121 XrdSutBucket *bucket; // Bucket for export operations 00122 XrdCryptoRSA *pki; // PKI of the certificate 00123 int pxytype; // Type of proxy (RFC, gsi 3, legacy gsi 2) 00124 00125 int FillUnknownExt(XRDGSI_CONST unsigned char **pp, long length, bool dump = 0); 00126 int Asn1PrintInfo(int tag, int xclass, int constructed, int indent); 00127 void CertType(); 00128 00129 static const char *cpxytype[5]; // Names of types 00130 }; 00131 00132 #endif