blob: 0f55cfea0863e9e03117248b84e4487c8d853908 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
|
/*
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
* Common Development and Distribution License (the "License").
* You may not use this file except in compliance with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* or http://www.opensolaris.org/os/licensing.
* See the License for the specific language governing permissions
* and limitations under the License.
*
* When distributing Covered Code, include this CDDL HEADER in each
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
* If applicable, add the following below this CDDL HEADER, with the
* fields enclosed by brackets "[]" replaced with your own identifying
* information: Portions Copyright [yyyy] [name of copyright owner]
*
* CDDL HEADER END
*
* Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
*/
#ifndef _KMFPOLICY_H
#define _KMFPOLICY_H
#include <kmfapi.h>
#include <kmfmapper.h>
#include <libxml/tree.h>
#include <libxml/parser.h>
#ifdef __cplusplus
extern "C" {
#endif
typedef struct {
char *name;
char *serial;
}KMF_RESP_CERT_POLICY;
typedef struct {
char *responderURI;
char *proxy;
boolean_t uri_from_cert;
char *response_lifetime;
boolean_t ignore_response_sign;
}KMF_OCSP_BASIC_POLICY;
typedef struct {
KMF_OCSP_BASIC_POLICY basic;
KMF_RESP_CERT_POLICY resp_cert;
boolean_t has_resp_cert;
}KMF_OCSP_POLICY;
typedef struct {
char *basefilename;
char *directory;
char *proxy;
boolean_t get_crl_uri;
boolean_t ignore_crl_sign;
boolean_t ignore_crl_date;
}KMF_CRL_POLICY;
typedef struct {
KMF_OCSP_POLICY ocsp_info;
KMF_CRL_POLICY crl_info;
}KMF_VALIDATION_POLICY;
typedef struct {
int eku_count;
KMF_OID *ekulist;
}KMF_EKU_POLICY;
#define KMF_REVOCATION_METHOD_CRL 0x1
#define KMF_REVOCATION_METHOD_OCSP 0x2
typedef struct {
char *name;
KMF_VALIDATION_POLICY validation_info;
KMF_EKU_POLICY eku_set;
KMF_MAPPER_RECORD mapper; /* kmfmapper.h */
uint32_t ku_bits;
boolean_t ignore_date;
boolean_t ignore_unknown_ekus;
boolean_t ignore_trust_anchor;
char *validity_adjusttime;
char *ta_name;
char *ta_serial;
uint32_t revocation;
} KMF_POLICY_RECORD;
/*
* Short cut for ocsp_info and etc.
*/
#define VAL_OCSP validation_info.ocsp_info
#define VAL_OCSP_BASIC VAL_OCSP.basic
#define VAL_OCSP_RESPONDER_URI VAL_OCSP_BASIC.responderURI
#define VAL_OCSP_PROXY VAL_OCSP_BASIC.proxy
#define VAL_OCSP_URI_FROM_CERT VAL_OCSP_BASIC.uri_from_cert
#define VAL_OCSP_RESP_LIFETIME VAL_OCSP_BASIC.response_lifetime
#define VAL_OCSP_IGNORE_RESP_SIGN VAL_OCSP_BASIC.ignore_response_sign
#define VAL_OCSP_RESP_CERT VAL_OCSP.resp_cert
#define VAL_OCSP_RESP_CERT_NAME VAL_OCSP_RESP_CERT.name
#define VAL_OCSP_RESP_CERT_SERIAL VAL_OCSP_RESP_CERT.serial
/*
* Short cut for crl_info and etc.
*/
#define VAL_CRL validation_info.crl_info
#define VAL_CRL_BASEFILENAME validation_info.crl_info.basefilename
#define VAL_CRL_DIRECTORY validation_info.crl_info.directory
#define VAL_CRL_GET_URI validation_info.crl_info.get_crl_uri
#define VAL_CRL_PROXY validation_info.crl_info.proxy
#define VAL_CRL_IGNORE_SIGN validation_info.crl_info.ignore_crl_sign
#define VAL_CRL_IGNORE_DATE validation_info.crl_info.ignore_crl_date
/*
* Policy related constant definitions.
*/
#define KMF_POLICY_DTD "/usr/share/lib/xml/dtd/kmfpolicy.dtd"
#define KMF_DEFAULT_POLICY_FILE "/etc/security/kmfpolicy.xml"
#define KMF_DEFAULT_POLICY_NAME "default"
#define KMF_POLICY_ROOT "kmf-policy-db"
#define KULOWBIT 7
#define KUHIGHBIT 15
#define KMF_POLICY_ELEMENT "kmf-policy"
#define KMF_POLICY_NAME_ATTR "name"
#define KMF_OPTIONS_IGNORE_DATE_ATTR "ignore-date"
#define KMF_OPTIONS_IGNORE_UNKNOWN_EKUS "ignore-unknown-eku"
#define KMF_OPTIONS_IGNORE_TRUST_ANCHOR "ignore-trust-anchor"
#define KMF_OPTIONS_VALIDITY_ADJUSTTIME "validity-adjusttime"
#define KMF_POLICY_TA_NAME_ATTR "ta-name"
#define KMF_POLICY_TA_SERIAL_ATTR "ta-serial"
#define KMF_VALIDATION_METHODS_ELEMENT "validation-methods"
#define KMF_OCSP_ELEMENT "ocsp"
#define KMF_OCSP_BASIC_ELEMENT "ocsp-basic"
#define KMF_OCSP_RESPONDER_ATTR "responder"
#define KMF_OCSP_PROXY_ATTR "proxy"
#define KMF_OCSP_URI_ATTR "uri-from-cert"
#define KMF_OCSP_RESPONSE_LIFETIME_ATTR "response-lifetime"
#define KMF_OCSP_IGNORE_SIGN_ATTR "ignore-response-sign"
#define KMF_OCSP_RESPONDER_CERT_ELEMENT "responder-cert"
#define KMF_CERT_NAME_ATTR "name"
#define KMF_CERT_SERIAL_ATTR "serial"
#define KMF_CRL_ELEMENT "crl"
#define KMF_CRL_BASENAME_ATTR "basefilename"
#define KMF_CRL_DIRECTORY_ATTR "directory"
#define KMF_CRL_GET_URI_ATTR "get-crl-uri"
#define KMF_CRL_PROXY_ATTR "proxy"
#define KMF_CRL_IGNORE_SIGN_ATTR "ignore-crl-sign"
#define KMF_CRL_IGNORE_DATE_ATTR "ignore-crl-date"
#define KMF_KEY_USAGE_SET_ELEMENT "key-usage-set"
#define KMF_KEY_USAGE_ELEMENT "key-usage"
#define KMF_KEY_USAGE_USE_ATTR "use"
#define KMF_EKU_ELEMENT "ext-key-usage"
#define KMF_EKU_NAME_ELEMENT "eku-name"
#define KMF_EKU_NAME_ATTR "name"
#define KMF_EKU_OID_ELEMENT "eku-oid"
#define KMF_EKU_OID_ATTR "oid"
#define KMF_CERT_MAPPER_ELEMENT "cert-to-name-mapping"
#define KMF_CERT_MAPPER_NAME_ATTR "mapper-name"
#define KMF_CERT_MAPPER_DIR_ATTR "mapper-directory"
#define KMF_CERT_MAPPER_PATH_ATTR "mapper-pathname"
#define KMF_CERT_MAPPER_OPTIONS_ATTR "mapper-options"
#define TMPFILE_TEMPLATE "policyXXXXXX"
extern int parsePolicyElement(xmlNodePtr, KMF_POLICY_RECORD *);
extern KMF_RETURN kmf_get_policy(char *, char *, KMF_POLICY_RECORD *);
extern KMF_RETURN kmf_add_policy_to_db(KMF_POLICY_RECORD *, char *, boolean_t);
extern KMF_RETURN kmf_delete_policy_from_db(char *, char *);
extern KMF_RETURN kmf_verify_policy(KMF_POLICY_RECORD *);
extern void kmf_free_policy_record(KMF_POLICY_RECORD *);
extern void kmf_free_eku_policy(KMF_EKU_POLICY *);
#ifdef __cplusplus
}
#endif
#endif /* _KMFPOLICY_H */
|
