00001 #ifndef __CRYPTO_X509_H__ 00002 #define __CRYPTO_X509_H__ 00003 /******************************************************************************/ 00004 /* */ 00005 /* X r d C r y p t o X 5 0 9 . h h */ 00006 /* */ 00007 /* (c) 2005 G. Ganis , CERN */ 00008 /* */ 00009 /* This file is part of the XRootD software suite. */ 00010 /* */ 00011 /* XRootD is free software: you can redistribute it and/or modify it under */ 00012 /* the terms of the GNU Lesser General Public License as published by the */ 00013 /* Free Software Foundation, either version 3 of the License, or (at your */ 00014 /* option) any later version. */ 00015 /* */ 00016 /* XRootD is distributed in the hope that it will be useful, but WITHOUT */ 00017 /* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or */ 00018 /* FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public */ 00019 /* License for more details. */ 00020 /* */ 00021 /* You should have received a copy of the GNU Lesser General Public License */ 00022 /* along with XRootD in a file called COPYING.LESSER (LGPL license) and file */ 00023 /* COPYING (GPL license). If not, see <http://www.gnu.org/licenses/>. */ 00024 /* */ 00025 /* The copyright holder's institutional names and contributor's names may not */ 00026 /* be used to endorse or promote products derived from this software without */ 00027 /* specific prior written permission of the institution or contributor. */ 00028 /* */ 00029 /******************************************************************************/ 00030 00031 /* ************************************************************************** */ 00032 /* */ 00033 /* Abstract interface for X509 certificates. */ 00034 /* Allows to plug-in modules based on different crypto implementation */ 00035 /* (OpenSSL, Botan, ...) */ 00036 /* */ 00037 /* ************************************************************************** */ 00038 00039 #include "XProtocol/XPtypes.hh" 00040 #include "XrdSut/XrdSutBucket.hh" 00041 #include "XrdCrypto/XrdCryptoRSA.hh" 00042 00043 typedef void * XrdCryptoX509data; 00044 00045 // ---------------------------------------------------------------------------// 00046 // 00047 // X509 interface 00048 // Describes one certificate 00049 // 00050 // ---------------------------------------------------------------------------// 00051 class XrdCryptoX509 { 00052 public: 00053 00054 // Certificate type 00055 enum EX509Type { kUnknown = -1, kCA = 0, kEEC = 1, kProxy = 2 }; 00056 EX509Type type; 00057 00058 00059 XrdCryptoX509() { type = kUnknown; } 00060 virtual ~XrdCryptoX509() { } 00061 00062 // Status 00063 virtual bool IsValid(int when = 0); // object correctly loaded 00064 virtual bool IsExpired(int when = 0); // Expired 00065 00066 // Access underlying data (in opaque form: used in chains) 00067 virtual XrdCryptoX509data Opaque(); 00068 00069 // Access certificate key 00070 virtual XrdCryptoRSA *PKI(); 00071 virtual void SetPKI(XrdCryptoX509data pki); 00072 00073 // Export in form of bucket (for transfers) 00074 virtual XrdSutBucket *Export(); 00075 00076 // Dump information 00077 virtual void Dump(); 00078 virtual int DumpExtensions(bool = 0); // extensions 00079 00080 const char *Type(EX509Type t = kUnknown) const 00081 { return ((t == kUnknown) ? ctype[type+1] : ctype[t+1]); } 00082 virtual const char *ParentFile(); 00083 virtual const char *ProxyType() const { return ""; } 00084 00085 // Key strength 00086 virtual int BitStrength(); 00087 00088 // Serial number 00089 virtual kXR_int64 SerialNumber(); 00090 virtual XrdOucString SerialNumberString(); 00091 00092 // Validity interval 00093 virtual time_t NotBefore(); // begin-validity time in secs since Epoch 00094 virtual time_t NotAfter(); // end-validity time in secs since Epoch 00095 00096 // Issuer of top certificate 00097 virtual const char *Issuer(); 00098 virtual const char *IssuerHash(int); // hash 00099 const char *IssuerHash() { return IssuerHash(0); } // hash 00100 00101 // Subject of bottom certificate 00102 virtual const char *Subject(); 00103 virtual const char *SubjectHash(int); // hash 00104 const char *SubjectHash() { return SubjectHash(0); } // hash 00105 00106 // Returns true if the certificate has a subject alt name which matches 00107 // the given hostnem. If it fals and hasSAN is false, there is no SAN extn. 00108 virtual bool MatchesSAN(const char * fqdn, bool &hasSAN) = 0; 00109 00110 // Retrieve a given extension if there (in opaque form) 00111 virtual XrdCryptoX509data GetExtension(const char *oid); 00112 00113 // Verify signature 00114 virtual bool Verify(XrdCryptoX509 *ref); 00115 00116 // Compare two hostnames, handling wildcards as appropriate. Necessary 00117 // for support for accepting connections where the remote X509 certificate 00118 // is a wildcard certificate. 00119 // 00120 // Returns true if the FQDN matches the specified pattern 00121 static bool MatchHostnames(const char *match_pattern, const char *fqdn); 00122 00123 private: 00124 00125 static const char *ctype[4]; // Names of types 00126 }; 00127 00128 #endif