00001 #ifndef __CRYPTO_X509CHAIN_H__
00002 #define __CRYPTO_X509CHAIN_H__
00003
00004
00005
00006
00007
00008
00009
00010
00011
00012
00013
00014
00015
00016
00017
00018
00019
00020
00021
00022
00023
00024
00025
00026
00027
00028
00029
00030
00031
00032
00033
00034
00035
00036
00037 #include "XrdSut/XrdSutBucket.hh"
00038 #include "XrdCrypto/XrdCryptoX509.hh"
00039 #include "XrdCrypto/XrdCryptoX509Crl.hh"
00040
00041
00042
00043
00044
00045
00046
00047
00048
00049
00050
00051 typedef struct {
00052 int opt;
00053 int when;
00054 int pathlen;
00055 XrdCryptoX509Crl *crl;
00056 } x509ChainVerifyOpt_t;
00057
00058 const int kOptsCheckSelfSigned = 0x2;
00059 const int kOptsCheckSubCA = 0x4;
00060
00061
00062
00063
00064 class XrdCryptoX509ChainNode {
00065
00066 private:
00067 XrdCryptoX509 *cert;
00068 XrdCryptoX509ChainNode *next;
00069 public:
00070 XrdCryptoX509ChainNode(XrdCryptoX509 *c = 0, XrdCryptoX509ChainNode *n = 0)
00071 { cert = c; next = n;}
00072 virtual ~XrdCryptoX509ChainNode() { }
00073
00074 XrdCryptoX509 *Cert() const { return cert; }
00075 XrdCryptoX509ChainNode *Next() const { return next; }
00076
00077 void SetNext(XrdCryptoX509ChainNode *n) { next = n; }
00078 };
00079
00080 class XrdCryptoX509Chain {
00081
00082 enum ESearchMode { kExact = 0, kBegin = 1, kEnd = 2 };
00083
00084 public:
00085 XrdCryptoX509Chain(XrdCryptoX509 *c = 0);
00086 XrdCryptoX509Chain(XrdCryptoX509Chain *ch);
00087 virtual ~XrdCryptoX509Chain();
00088
00089
00090 enum ECAStatus { kUnknown = 0, kAbsent, kInvalid, kValid};
00091
00092
00093 enum EX509ChainErr { kNone = 0, kInconsistent, kTooMany, kNoCA,
00094 kNoCertificate, kInvalidType, kInvalidNames,
00095 kRevoked, kExpired, kMissingExtension,
00096 kVerifyFail, kInvalidSign, kCANotAutoSigned,
00097 kNoEEC, kTooManyEEC, kInvalidProxy };
00098
00099
00100 const char *X509ChainError(EX509ChainErr e);
00101 const char *LastError() const { return lastError.c_str(); }
00102
00103
00104 void Dump();
00105
00106
00107 int Size() const { return size; }
00108 XrdCryptoX509 *End() const { return end->Cert(); }
00109 ECAStatus StatusCA() const { return statusCA; }
00110 const char *CAname();
00111 const char *EECname();
00112 const char *CAhash();
00113 const char *EEChash();
00114 XrdCryptoX509 *EffCA() const { return effca ? effca->Cert() : (XrdCryptoX509 *)0; }
00115
00116
00117 void InsertAfter(XrdCryptoX509 *c, XrdCryptoX509 *cp);
00118 void PutInFront(XrdCryptoX509 *c);
00119 void PushBack(XrdCryptoX509 *c);
00120 void Remove(XrdCryptoX509 *c);
00121 bool CheckCA(bool checkselfsigned = 1);
00122 void Cleanup(bool keepCA = 0);
00123 void SetStatusCA(ECAStatus st) { statusCA = st; }
00124
00125
00126 XrdCryptoX509 *SearchByIssuer(const char *issuer,
00127 ESearchMode mode = kExact);
00128 XrdCryptoX509 *SearchBySubject(const char *subject,
00129 ESearchMode mode = kExact);
00130
00131
00132 virtual int CheckValidity(bool outatfirst = 1, int when = 0);
00133
00134
00135 virtual int Reorder();
00136
00137
00138 virtual bool Verify(EX509ChainErr &e, x509ChainVerifyOpt_t *vopt = 0);
00139
00140
00141 XrdCryptoX509 *Begin();
00142 XrdCryptoX509 *Next();
00143
00144 protected:
00145
00146
00147 XrdCryptoX509ChainNode *begin;
00148 XrdCryptoX509ChainNode *current;
00149 XrdCryptoX509ChainNode *end;
00150 XrdCryptoX509ChainNode *previous;
00151 XrdCryptoX509ChainNode *effca;
00152 int size;
00153 XrdOucString lastError;
00154 XrdOucString caname;
00155 XrdOucString eecname;
00156 XrdOucString cahash;
00157 XrdOucString eechash;
00158 ECAStatus statusCA;
00159
00160 XrdCryptoX509ChainNode *Find(XrdCryptoX509 *c);
00161 XrdCryptoX509ChainNode *FindIssuer(const char *issuer,
00162 ESearchMode mode = kExact,
00163 XrdCryptoX509ChainNode **p = 0);
00164 XrdCryptoX509ChainNode *FindSubject(const char *subject,
00165 ESearchMode mode = kExact,
00166 XrdCryptoX509ChainNode **p = 0);
00167 void SetEffectiveCA();
00168 bool Verify(EX509ChainErr &e, const char *msg,
00169 XrdCryptoX509::EX509Type type, int when,
00170 XrdCryptoX509 *xcer, XrdCryptoX509 *xsig,
00171 XrdCryptoX509Crl *crl = 0);
00172
00173 };
00174
00175 #endif