merged the modularization branch (credentials) back to trunk
This commit is contained in:
Martin Willi
@@ -0,0 +1,356 @@
|
||||
/*
|
||||
* Copyright (C) 2007 Martin Willi
|
||||
* Hochschule fuer Technik Rapperswil
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*
|
||||
* $Id$
|
||||
*/
|
||||
|
||||
|
||||
#include "auth_info.h"
|
||||
|
||||
#include <daemon.h>
|
||||
#include <utils/linked_list.h>
|
||||
#include <utils/identification.h>
|
||||
#include <credentials/certificates/certificate.h>
|
||||
|
||||
ENUM(auth_item_names, AUTHN_CA_CERT, AUTHZ_AC_GROUP,
|
||||
"AUTHN_CA_CERT",
|
||||
"AUTHN_IM_CERT",
|
||||
"AUTHN_SUBJECT_CERT",
|
||||
"AUTHZ_PUBKEY",
|
||||
"AUTHZ_PSK",
|
||||
"AUTHZ_EAP",
|
||||
"AUTHZ_CA_CERT",
|
||||
"AUTHZ_IM_CERT",
|
||||
"AUTHZ_SUBJECT_CERT",
|
||||
"AUTHZ_CRL_VALIDATION",
|
||||
"AUTHZ_OCSP_VALIDATION",
|
||||
"AUTHZ_AC_GROUP",
|
||||
);
|
||||
|
||||
typedef struct private_auth_info_t private_auth_info_t;
|
||||
|
||||
/**
|
||||
* private data of item_set
|
||||
*/
|
||||
struct private_auth_info_t {
|
||||
|
||||
/**
|
||||
* public functions
|
||||
*/
|
||||
auth_info_t public;
|
||||
|
||||
/**
|
||||
* list of item_t's
|
||||
*/
|
||||
linked_list_t *items;
|
||||
};
|
||||
|
||||
typedef struct item_t item_t;
|
||||
|
||||
struct item_t {
|
||||
/** type of this item */
|
||||
auth_item_t type;
|
||||
/** associated privlege value, if any */
|
||||
void *value;
|
||||
};
|
||||
|
||||
/**
|
||||
* implements item_enumerator_t.enumerate
|
||||
*/
|
||||
static bool item_filter(void *data, item_t **item, auth_item_t *type,
|
||||
void *unused, void **value)
|
||||
{
|
||||
*type = (*item)->type;
|
||||
*value = (*item)->value;
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
/**
|
||||
* Implementation of auth_info_t.create_item_enumerator.
|
||||
*/
|
||||
static enumerator_t* create_item_enumerator(private_auth_info_t *this)
|
||||
{
|
||||
return enumerator_create_filter(this->items->create_enumerator(this->items),
|
||||
(void*)item_filter, NULL, NULL);
|
||||
}
|
||||
|
||||
/**
|
||||
* Implementation of auth_info_t.get_item.
|
||||
*/
|
||||
static bool get_item(private_auth_info_t *this, auth_item_t type, void** value)
|
||||
{
|
||||
enumerator_t *enumerator;
|
||||
void *current_value;
|
||||
auth_item_t current_type;
|
||||
bool found = FALSE;
|
||||
|
||||
enumerator = create_item_enumerator(this);
|
||||
while (enumerator->enumerate(enumerator, ¤t_type, ¤t_value))
|
||||
{
|
||||
if (type == current_type)
|
||||
{
|
||||
*value = current_value;
|
||||
found = TRUE;
|
||||
break;
|
||||
}
|
||||
}
|
||||
enumerator->destroy(enumerator);
|
||||
return found;
|
||||
}
|
||||
|
||||
/**
|
||||
* Implementation of auth_info_t.add_item.
|
||||
*/
|
||||
static void add_item(private_auth_info_t *this, auth_item_t type, void *value)
|
||||
{
|
||||
item_t *item = malloc_thing(item_t);
|
||||
|
||||
item->type = type;
|
||||
switch (type)
|
||||
{
|
||||
case AUTHZ_PUBKEY:
|
||||
{
|
||||
public_key_t *key = (public_key_t*)value;
|
||||
|
||||
item->value = key->get_ref(key);
|
||||
break;
|
||||
}
|
||||
case AUTHZ_PSK:
|
||||
{
|
||||
shared_key_t *key = (shared_key_t*)value;
|
||||
|
||||
item->value = key->get_ref(key);
|
||||
break;
|
||||
}
|
||||
case AUTHN_CA_CERT:
|
||||
case AUTHN_IM_CERT:
|
||||
case AUTHN_SUBJECT_CERT:
|
||||
case AUTHZ_CA_CERT:
|
||||
case AUTHZ_IM_CERT:
|
||||
case AUTHZ_SUBJECT_CERT:
|
||||
{
|
||||
certificate_t *cert = (certificate_t*)value;
|
||||
|
||||
item->value = cert->get_ref(cert);
|
||||
break;
|
||||
}
|
||||
case AUTHZ_CRL_VALIDATION:
|
||||
case AUTHZ_OCSP_VALIDATION:
|
||||
{
|
||||
cert_validation_t *validation = malloc_thing(cert_validation_t);
|
||||
|
||||
*validation = *(cert_validation_t*)value;
|
||||
item->value = validation;
|
||||
break;
|
||||
}
|
||||
case AUTHZ_EAP:
|
||||
{
|
||||
eap_method_t *method = malloc_thing(eap_method_t);
|
||||
|
||||
*method = *(eap_method_t*)value;
|
||||
item->value = method;
|
||||
break;
|
||||
}
|
||||
case AUTHZ_AC_GROUP:
|
||||
{
|
||||
identification_t *id = (identification_t*)value;
|
||||
|
||||
item->value = id->clone(id);
|
||||
break;
|
||||
}
|
||||
}
|
||||
this->items->insert_last(this->items, item);
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Implementation of auth_info_t.complies.
|
||||
*/
|
||||
static bool complies(private_auth_info_t *this, auth_info_t *constraints)
|
||||
{
|
||||
enumerator_t *enumerator;
|
||||
bool success = TRUE;
|
||||
auth_item_t type;
|
||||
void *value;
|
||||
|
||||
enumerator = constraints->create_item_enumerator(constraints);
|
||||
while (enumerator->enumerate(enumerator, &type, &value))
|
||||
{
|
||||
switch (type)
|
||||
{
|
||||
case AUTHN_CA_CERT:
|
||||
case AUTHN_IM_CERT:
|
||||
case AUTHN_SUBJECT_CERT:
|
||||
{ /* skip non-authorization tokens */
|
||||
continue;
|
||||
}
|
||||
case AUTHZ_CRL_VALIDATION:
|
||||
case AUTHZ_OCSP_VALIDATION:
|
||||
{
|
||||
cert_validation_t *valid;
|
||||
|
||||
/* OCSP validation is also sufficient for CRL constraint, but
|
||||
* not vice-versa */
|
||||
if (!get_item(this, type, (void**)&valid) &&
|
||||
type == AUTHZ_CRL_VALIDATION &&
|
||||
!get_item(this, AUTHZ_OCSP_VALIDATION, (void**)&valid))
|
||||
{
|
||||
DBG1(DBG_CFG, "constraint check failed: %N requires at "
|
||||
"least %N, but no check done", auth_item_names, type,
|
||||
cert_validation_names, *(cert_validation_t*)value);
|
||||
success = FALSE;
|
||||
break;
|
||||
}
|
||||
switch (*(cert_validation_t*)value)
|
||||
{
|
||||
case VALIDATION_SKIPPED:
|
||||
if (*valid == VALIDATION_SKIPPED)
|
||||
{
|
||||
break;
|
||||
} /* FALL */
|
||||
case VALIDATION_GOOD:
|
||||
if (*valid == VALIDATION_GOOD)
|
||||
{
|
||||
break;
|
||||
} /* FALL */
|
||||
default:
|
||||
DBG1(DBG_CFG, "constraint check failed: %N is %N, but "
|
||||
"requires at least %N", auth_item_names, type,
|
||||
cert_validation_names, *valid,
|
||||
cert_validation_names, *(cert_validation_t*)value);
|
||||
success = FALSE;
|
||||
break;
|
||||
}
|
||||
break;
|
||||
}
|
||||
case AUTHZ_PUBKEY:
|
||||
case AUTHZ_PSK:
|
||||
case AUTHZ_IM_CERT:
|
||||
case AUTHZ_SUBJECT_CERT:
|
||||
case AUTHZ_EAP:
|
||||
case AUTHZ_AC_GROUP:
|
||||
DBG1(DBG_CFG, "constraint check %N not implemented!",
|
||||
auth_item_names, type);
|
||||
success = FALSE;
|
||||
break;
|
||||
case AUTHZ_CA_CERT:
|
||||
{
|
||||
certificate_t *cert;
|
||||
|
||||
if (!get_item(this, AUTHZ_CA_CERT, (void**)&cert) ||
|
||||
!cert->equals(cert, (certificate_t*)value))
|
||||
{
|
||||
cert = (certificate_t*)value;
|
||||
DBG1(DBG_CFG, "constraint check failed: peer not "
|
||||
"authenticated by CA '%D'.", cert->get_issuer(cert));
|
||||
success = FALSE;
|
||||
}
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (!success)
|
||||
{
|
||||
break;
|
||||
}
|
||||
}
|
||||
enumerator->destroy(enumerator);
|
||||
return success;
|
||||
}
|
||||
|
||||
/**
|
||||
* Implementation of auth_info_t.merge.
|
||||
*/
|
||||
static void merge(private_auth_info_t *this, private_auth_info_t *other)
|
||||
{
|
||||
item_t *item;
|
||||
|
||||
while (other->items->remove_first(other->items, (void**)&item) == SUCCESS)
|
||||
{
|
||||
this->items->insert_last(this->items, item);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Implementation of auth_info_t.destroy
|
||||
*/
|
||||
static void destroy(private_auth_info_t *this)
|
||||
{
|
||||
item_t *item;
|
||||
|
||||
while (this->items->remove_last(this->items, (void**)&item) == SUCCESS)
|
||||
{
|
||||
switch (item->type)
|
||||
{
|
||||
case AUTHZ_PUBKEY:
|
||||
{
|
||||
public_key_t *key = (public_key_t*)item->value;
|
||||
key->destroy(key);
|
||||
break;
|
||||
}
|
||||
case AUTHZ_PSK:
|
||||
{
|
||||
shared_key_t *key = (shared_key_t*)item->value;
|
||||
key->destroy(key);
|
||||
break;
|
||||
}
|
||||
case AUTHN_CA_CERT:
|
||||
case AUTHN_IM_CERT:
|
||||
case AUTHN_SUBJECT_CERT:
|
||||
case AUTHZ_CA_CERT:
|
||||
case AUTHZ_IM_CERT:
|
||||
case AUTHZ_SUBJECT_CERT:
|
||||
{
|
||||
certificate_t *cert = (certificate_t*)item->value;
|
||||
cert->destroy(cert);
|
||||
break;
|
||||
}
|
||||
case AUTHZ_CRL_VALIDATION:
|
||||
case AUTHZ_OCSP_VALIDATION:
|
||||
case AUTHZ_EAP:
|
||||
{
|
||||
free(item->value);
|
||||
break;
|
||||
}
|
||||
case AUTHZ_AC_GROUP:
|
||||
{
|
||||
identification_t *id = (identification_t*)item->value;
|
||||
id->destroy(id);
|
||||
break;
|
||||
}
|
||||
}
|
||||
free(item);
|
||||
}
|
||||
this->items->destroy(this->items);
|
||||
free(this);
|
||||
}
|
||||
|
||||
/*
|
||||
* see header file
|
||||
*/
|
||||
auth_info_t *auth_info_create()
|
||||
{
|
||||
private_auth_info_t *this = malloc_thing(private_auth_info_t);
|
||||
|
||||
this->public.add_item = (void(*)(auth_info_t*, auth_item_t type, void *value))add_item;
|
||||
this->public.get_item = (bool(*)(auth_info_t*, auth_item_t type, void **value))get_item;
|
||||
this->public.create_item_enumerator = (enumerator_t*(*)(auth_info_t*))create_item_enumerator;
|
||||
this->public.complies = (bool(*)(auth_info_t*, auth_info_t *))complies;
|
||||
this->public.merge = (void(*)(auth_info_t*, auth_info_t *other))merge;
|
||||
this->public.destroy = (void(*)(auth_info_t*))destroy;
|
||||
|
||||
this->items = linked_list_create();
|
||||
|
||||
return &this->public;
|
||||
}
|
||||
|
||||
@@ -0,0 +1,158 @@
|
||||
/*
|
||||
* Copyright (C) 2007 Martin Willi
|
||||
* Hochschule fuer Technik Rapperswil
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*/
|
||||
|
||||
/**
|
||||
* @defgroup auth_info auth_info
|
||||
* @{ @ingroup ccredentials
|
||||
*/
|
||||
|
||||
#ifndef AUTH_INFO_H_
|
||||
#define AUTH_INFO_H_
|
||||
|
||||
#include <utils/enumerator.h>
|
||||
|
||||
typedef struct auth_info_t auth_info_t;
|
||||
typedef enum auth_item_t auth_item_t;
|
||||
|
||||
/**
|
||||
* Authentication/Authorization process helper item.
|
||||
*
|
||||
* For the authentication process, further information may be needed. These
|
||||
* items are defined as auth_item_t and have a AUTHN prefix.
|
||||
* The authentication process returns important data for the authorization
|
||||
* process, these items are defined with a AUTHZ prefix.
|
||||
* Authentication uses AUTHN items and creates AUTHZ items during authentication,
|
||||
* authorization reads AUTHZ values to give out privileges.
|
||||
*
|
||||
* +---+ +---------------------+
|
||||
* | A | | A |
|
||||
* | u | | u +-----------+ |
|
||||
* | t | | t | Required | |
|
||||
* | h | | h | auth_info | |
|
||||
* | e | | o +-----------+ |
|
||||
* | n | | r | |
|
||||
* +-----------+ | t | | i | |
|
||||
* | Provided | | i | | z V |
|
||||
* | auth_info |--| c |-------------| a ----> match? ----|------->
|
||||
* +-----------+ | a | | t |
|
||||
* | t | | i |
|
||||
* | i | | o |
|
||||
* | o | | n |
|
||||
* | n | | |
|
||||
* +---+ +---------------------+
|
||||
*/
|
||||
enum auth_item_t {
|
||||
|
||||
/*
|
||||
* items provided to authentication process
|
||||
*/
|
||||
|
||||
/** CA certificate to use for authentication, value is certificate_t* */
|
||||
AUTHN_CA_CERT,
|
||||
/** intermediate certificate, value is certificate_t* */
|
||||
AUTHN_IM_CERT,
|
||||
/** certificate for trustchain verification, value is certificate_t* */
|
||||
AUTHN_SUBJECT_CERT,
|
||||
|
||||
/*
|
||||
* item provided to authorization process
|
||||
*/
|
||||
|
||||
/** subject has been authenticated by public key, value is public_key_t* */
|
||||
AUTHZ_PUBKEY,
|
||||
/** subject has ben authenticated using preshared secrets, value is shared_key_t* */
|
||||
AUTHZ_PSK,
|
||||
/** subject has been authenticated using EAP, value is eap_method_t */
|
||||
AUTHZ_EAP,
|
||||
/** certificate authority, value is certificate_t* */
|
||||
AUTHZ_CA_CERT,
|
||||
/** intermediate certificate in trustchain, value is certificate_t* */
|
||||
AUTHZ_IM_CERT,
|
||||
/** subject certificate, value is certificate_t* */
|
||||
AUTHZ_SUBJECT_CERT,
|
||||
/** result of a CRL validation, value is cert_validation_t */
|
||||
AUTHZ_CRL_VALIDATION,
|
||||
/** result of a OCSP validation, value is cert_validation_t */
|
||||
AUTHZ_OCSP_VALIDATION,
|
||||
/** subject is in attribute certificate group, value is identification_t* */
|
||||
AUTHZ_AC_GROUP,
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* enum name for auth_item_t.
|
||||
*/
|
||||
extern enum_name_t *auth_item_names;
|
||||
|
||||
/**
|
||||
* The auth_info class contains auth_item_t's used for AA.
|
||||
*
|
||||
* A auth_info allows the separation of authentication and authorization.
|
||||
*/
|
||||
struct auth_info_t {
|
||||
|
||||
/**
|
||||
* Add an item to the set.
|
||||
*
|
||||
* @param type auth_info type
|
||||
* @param value associated value to auth_info type, if any
|
||||
*/
|
||||
void (*add_item)(auth_info_t *this, auth_item_t type, void *value);
|
||||
|
||||
/**
|
||||
* Get an item.
|
||||
*
|
||||
* @param type auth_info type to get
|
||||
* @param value pointer to a pointer receiving item
|
||||
* @return bool if item has been found
|
||||
*/
|
||||
bool (*get_item)(auth_info_t *this, auth_item_t type, void **value);
|
||||
|
||||
/**
|
||||
* Create an enumerator over all items.
|
||||
*
|
||||
* @return enumerator over (auth_item_t type, void *value)
|
||||
*/
|
||||
enumerator_t* (*create_item_enumerator)(auth_info_t *this);
|
||||
|
||||
/**
|
||||
* Check if this fulfills a set of required constraints.
|
||||
*
|
||||
* @param constraints required authorization infos
|
||||
* @return TRUE if this complies with constraints
|
||||
*/
|
||||
bool (*complies)(auth_info_t *this, auth_info_t *constraints);
|
||||
|
||||
/**
|
||||
* Merge items from other into this.
|
||||
*
|
||||
* Items do not get cloned, but moved from other to this.
|
||||
*
|
||||
* @param other items to read for merge
|
||||
*/
|
||||
void (*merge)(auth_info_t *this, auth_info_t *other);
|
||||
|
||||
/**
|
||||
* Destroy a auth_info instance with all associated values.
|
||||
*/
|
||||
void (*destroy)(auth_info_t *this);
|
||||
};
|
||||
|
||||
/**
|
||||
* Create a auth_info instance.
|
||||
*/
|
||||
auth_info_t *auth_info_create();
|
||||
|
||||
#endif /* AUTH_INFO_H_ @}*/
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,187 @@
|
||||
/*
|
||||
* Copyright (C) 2007-2008 Martin Willi
|
||||
* Hochschule fuer Technik Rapperswil
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*
|
||||
* $Id$
|
||||
*/
|
||||
|
||||
/**
|
||||
* @defgroup credential_manager credential_manager
|
||||
* @{ @ingroup ccredentials
|
||||
*/
|
||||
|
||||
#ifndef CREDENTIAL_MANAGER_H_
|
||||
#define CREDENTIAL_MANAGER_H_
|
||||
|
||||
#include <utils/identification.h>
|
||||
#include <utils/enumerator.h>
|
||||
#include <credentials/auth_info.h>
|
||||
#include <credentials/credential_set.h>
|
||||
#include <credentials/keys/private_key.h>
|
||||
#include <credentials/keys/shared_key.h>
|
||||
#include <credentials/certificates/certificate.h>
|
||||
|
||||
typedef struct credential_manager_t credential_manager_t;
|
||||
|
||||
/**
|
||||
* Manages credentials using credential_sets.
|
||||
*
|
||||
* The credential manager is the entry point of the credential framework. It
|
||||
* uses so called "sets" to access credentials in a modular fashion, these
|
||||
* are implemented through the credential_set_t interface.
|
||||
* The manager additionally does trust chain verification and trust status
|
||||
* chaching. A set may call the managers methods if it needs credentials itself,
|
||||
* the manager uses recursive locking.
|
||||
*
|
||||
* @verbatim
|
||||
|
||||
+-------+ +----------------+
|
||||
| A | | | +------------------+
|
||||
| u | -----> | | ------> | +------------------+
|
||||
| t | | credential- | | | +------------------+
|
||||
| h | -----> | manager | ------> +--| | credential- | => IPC
|
||||
| e | | | +--| sets |
|
||||
| n | +--> | | ------> +------------------+
|
||||
| t | | | | |
|
||||
| i | | | | |
|
||||
| c | | +----------------+ |
|
||||
| a | | |
|
||||
| t | +----------------------------------------------+
|
||||
| o | may be recursive
|
||||
| r |
|
||||
+-------+
|
||||
|
||||
@endverbatim
|
||||
*
|
||||
* Synchronization is done completely in the manager, so the sets don't have
|
||||
* to worry about it. The locking mechanism is reentrant save, so sets can
|
||||
* call the manager.
|
||||
*/
|
||||
struct credential_manager_t {
|
||||
|
||||
/**
|
||||
* Create an enumerator over all certificates.
|
||||
*
|
||||
* @param cert kind of certificate
|
||||
* @param key kind of key in certificate
|
||||
* @param id subject this certificate belongs to
|
||||
* @param trusted TRUE to list trusted certificates only
|
||||
* @return enumerator over the certificates
|
||||
*/
|
||||
enumerator_t *(*create_cert_enumerator)(credential_manager_t *this,
|
||||
certificate_type_t cert, key_type_t key,
|
||||
identification_t *id, bool trusted);
|
||||
/**
|
||||
* Create an enumerator over all shared keys.
|
||||
*
|
||||
* The enumerator enumerates over:
|
||||
* shared_key_t*, id_match_t me, id_match_t other
|
||||
* But must accepts values for the id_matches.
|
||||
*
|
||||
* @param type kind of requested shared key
|
||||
* @param first first subject between key is shared
|
||||
* @param second second subject between key is shared
|
||||
* @return enumerator over shared keys
|
||||
*/
|
||||
enumerator_t *(*create_shared_enumerator)(credential_manager_t *this,
|
||||
shared_key_type_t type,
|
||||
identification_t *first, identification_t *second);
|
||||
/**
|
||||
* Create an enumerator over all Certificate Distribution Points.
|
||||
*
|
||||
* @param type kind of certificate the point distributes
|
||||
* @param id identification of the distributed certificate
|
||||
* @return enumerator of CDPs as char*
|
||||
*/
|
||||
enumerator_t *(*create_cdp_enumerator)(credential_manager_t *this,
|
||||
credential_type_t type, identification_t *id);
|
||||
/**
|
||||
* Get a trusted or untrusted certificate.
|
||||
*
|
||||
* @param cert kind of certificate
|
||||
* @param key kind of key in certificate
|
||||
* @param id subject this certificate belongs to
|
||||
* @param trusted TRUE to get a trusted certificate only
|
||||
* @return certificate, if found, NULL otherwise
|
||||
*/
|
||||
certificate_t *(*get_cert)(credential_manager_t *this,
|
||||
certificate_type_t cert, key_type_t key,
|
||||
identification_t *id, bool trusted);
|
||||
/**
|
||||
* Get the best matching shared key for two IDs.
|
||||
*
|
||||
* @param type kind of requested shared key
|
||||
* @param me own identity
|
||||
* @param other peers identity
|
||||
* @param auth auth_info helper
|
||||
* @return shared_key_t, NULL if none found
|
||||
*/
|
||||
shared_key_t *(*get_shared)(credential_manager_t *this, shared_key_type_t type,
|
||||
identification_t *me, identification_t *other);
|
||||
/**
|
||||
* Get a private key to create a signature.
|
||||
*
|
||||
* The get_private() method gets a secret private key identified by either
|
||||
* the keyid itself or an id the key belongs to.
|
||||
* The auth parameter contains additional information, such as receipients
|
||||
* trusted CA certs. Auth gets filled with subject and CA certificates
|
||||
* needed to validate a created signature.
|
||||
*
|
||||
* @param type type of the key to get
|
||||
* @param id identification the key belongs to
|
||||
* @param auth auth_info helper, including trusted CA certificates
|
||||
* @return private_key_t, NULL if none found
|
||||
*/
|
||||
private_key_t* (*get_private)(credential_manager_t *this, key_type_t type,
|
||||
identification_t *id, auth_info_t *auth);
|
||||
/**
|
||||
* Get a public key to verify a signature.
|
||||
*
|
||||
* The get_public() method gets a trusted public key to verify a signature
|
||||
* of id. The auth parameter contains additional authentication infos,
|
||||
* e.g. peer and intermediate certificates.
|
||||
*
|
||||
* @param type type of key to get
|
||||
* @param id identification the key belongs to
|
||||
* @param auth auth_info helper, including certificates to verify key
|
||||
* @return public_key_t, NULL if none found
|
||||
*/
|
||||
public_key_t* (*get_public)(credential_manager_t *this, key_type_t type,
|
||||
identification_t *id, auth_info_t *auth);
|
||||
|
||||
/**
|
||||
* Register a credential set to the manager.
|
||||
*
|
||||
* @param set set to register
|
||||
*/
|
||||
void (*add_set)(credential_manager_t *this, credential_set_t *set);
|
||||
|
||||
/**
|
||||
* Unregister a credential set from the manager.
|
||||
*
|
||||
* @param set set to unregister
|
||||
*/
|
||||
void (*remove_set)(credential_manager_t *this, credential_set_t *set);
|
||||
|
||||
/**
|
||||
* Destroy a credential_manager instance.
|
||||
*/
|
||||
void (*destroy)(credential_manager_t *this);
|
||||
};
|
||||
|
||||
/**
|
||||
* Create a credential_manager instance.
|
||||
*/
|
||||
credential_manager_t *credential_manager_create();
|
||||
|
||||
#endif /* CREDENTIAL_MANAGER_H_ @} */
|
||||
@@ -0,0 +1,93 @@
|
||||
/*
|
||||
* Copyright (C) 2007 Martin Willi
|
||||
* Hochschule fuer Technik Rapperswil
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*
|
||||
* $Id$
|
||||
*/
|
||||
|
||||
/**
|
||||
* @defgroup credential_set credential_set
|
||||
* @{ @ingroup ccredentials
|
||||
*/
|
||||
|
||||
#ifndef CREDENTIAL_SET_H_
|
||||
#define CREDENTIAL_SET_H_
|
||||
|
||||
#include <credentials/keys/public_key.h>
|
||||
#include <credentials/keys/shared_key.h>
|
||||
#include <credentials/certificates/certificate.h>
|
||||
|
||||
typedef struct credential_set_t credential_set_t;
|
||||
|
||||
/**
|
||||
* A set of credentials.
|
||||
*
|
||||
* Contains private keys, shared keys and different kinds of certificates.
|
||||
* Enumerators are used because queries might return multiple matches.
|
||||
* Filter parameters restrict enumeration over specific items only.
|
||||
* See credential_manager_t for an overview of the credential framework.
|
||||
*/
|
||||
struct credential_set_t {
|
||||
|
||||
/**
|
||||
* Create an enumerator over private keys (private_key_t).
|
||||
*
|
||||
* The id is either a key identifier of the requested key, or an identity
|
||||
* of the key owner.
|
||||
*
|
||||
* @param type type of requested private key
|
||||
* @param id key identifier/owner
|
||||
* @return enumerator over private_key_t's.
|
||||
*/
|
||||
enumerator_t *(*create_private_enumerator)(credential_set_t *this,
|
||||
key_type_t type, identification_t *id);
|
||||
/**
|
||||
* Create an enumerator over certificates (certificate_t).
|
||||
*
|
||||
* @param cert kind of certificate
|
||||
* @param key kind of key in certificate
|
||||
* @param id identity (subject) this certificate belongs to
|
||||
* @param trusted whether the certificate must be trustworthy
|
||||
* @return enumerator as described above
|
||||
*/
|
||||
enumerator_t *(*create_cert_enumerator)(credential_set_t *this,
|
||||
certificate_type_t cert, key_type_t key,
|
||||
identification_t *id, bool trusted);
|
||||
/**
|
||||
* Create an enumerator over shared keys (shared_key_t).
|
||||
*
|
||||
* The enumerator enumerates over:
|
||||
* shared_key_t*, id_match_t me, id_match_t other
|
||||
* But must accept NULL values for the id_matches.
|
||||
*
|
||||
* @param type kind of requested shared key
|
||||
* @param me own identity
|
||||
* @param other other identity who owns that secret
|
||||
* @return enumerator as described above
|
||||
*/
|
||||
enumerator_t *(*create_shared_enumerator)(credential_set_t *this,
|
||||
shared_key_type_t type,
|
||||
identification_t *me, identification_t *other);
|
||||
|
||||
/**
|
||||
* Create an enumerator over certificate distribution points.
|
||||
*
|
||||
* @param type type of the certificate to get a CDP
|
||||
* @param id identification of the distributed certificate
|
||||
* @return an enumerator over CDPs as char*
|
||||
*/
|
||||
enumerator_t *(*create_cdp_enumerator)(credential_set_t *this,
|
||||
certificate_type_t type, identification_t *id);
|
||||
};
|
||||
|
||||
#endif /* CREDENTIAL_SET_H_ @} */
|
||||
Reference in New Issue
Block a user