xref: /onnv-gate/usr/src/lib/libkmf/include/kmfpolicy.h (revision 12611:d9f75b73c5fd)

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 *
 * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
 */
#ifndef _KMFPOLICY_H
#define	_KMFPOLICY_H

#include <kmfapi.h>
#include <kmfmapper.h>
#include <libxml/tree.h>
#include <libxml/parser.h>

#ifdef __cplusplus
extern "C" {
#endif

typedef struct {
	char		*name;
	char		*serial;
}KMF_RESP_CERT_POLICY;

typedef struct {
	char		*responderURI;
	char		*proxy;
	boolean_t 	uri_from_cert;
	char		*response_lifetime;
	boolean_t	ignore_response_sign;
}KMF_OCSP_BASIC_POLICY;

typedef struct {
	KMF_OCSP_BASIC_POLICY	basic;
	KMF_RESP_CERT_POLICY	resp_cert;
	boolean_t		has_resp_cert;
}KMF_OCSP_POLICY;

typedef struct {
	char *basefilename;
	char *directory;
	char *proxy;
	boolean_t get_crl_uri;
	boolean_t ignore_crl_sign;
	boolean_t ignore_crl_date;
}KMF_CRL_POLICY;

typedef struct {
	KMF_OCSP_POLICY	ocsp_info;
	KMF_CRL_POLICY	crl_info;
}KMF_VALIDATION_POLICY;

typedef struct {
	int		eku_count;
	KMF_OID		*ekulist;
}KMF_EKU_POLICY;

#define	KMF_REVOCATION_METHOD_CRL		0x1
#define	KMF_REVOCATION_METHOD_OCSP		0x2

typedef struct {
	char			*name;
	KMF_VALIDATION_POLICY	validation_info;
	KMF_EKU_POLICY		eku_set;
	KMF_MAPPER_RECORD	mapper; /* kmfmapper.h */
	uint32_t		ku_bits;
	boolean_t		ignore_date;
	boolean_t		ignore_unknown_ekus;
	boolean_t		ignore_trust_anchor;
	char			*validity_adjusttime;
	char			*ta_name;
	char			*ta_serial;
	uint32_t		revocation;
} KMF_POLICY_RECORD;


/*
 * Short cut for ocsp_info and etc.
 */
#define	VAL_OCSP			validation_info.ocsp_info

#define	VAL_OCSP_BASIC			VAL_OCSP.basic
#define	VAL_OCSP_RESPONDER_URI		VAL_OCSP_BASIC.responderURI
#define	VAL_OCSP_PROXY			VAL_OCSP_BASIC.proxy
#define	VAL_OCSP_URI_FROM_CERT		VAL_OCSP_BASIC.uri_from_cert
#define	VAL_OCSP_RESP_LIFETIME		VAL_OCSP_BASIC.response_lifetime
#define	VAL_OCSP_IGNORE_RESP_SIGN	VAL_OCSP_BASIC.ignore_response_sign

#define	VAL_OCSP_RESP_CERT		VAL_OCSP.resp_cert
#define	VAL_OCSP_RESP_CERT_NAME		VAL_OCSP_RESP_CERT.name
#define	VAL_OCSP_RESP_CERT_SERIAL	VAL_OCSP_RESP_CERT.serial

/*
 * Short cut for crl_info and etc.
 */
#define	VAL_CRL			validation_info.crl_info
#define	VAL_CRL_BASEFILENAME	validation_info.crl_info.basefilename
#define	VAL_CRL_DIRECTORY	validation_info.crl_info.directory
#define	VAL_CRL_GET_URI		validation_info.crl_info.get_crl_uri
#define	VAL_CRL_PROXY		validation_info.crl_info.proxy
#define	VAL_CRL_IGNORE_SIGN	validation_info.crl_info.ignore_crl_sign
#define	VAL_CRL_IGNORE_DATE	validation_info.crl_info.ignore_crl_date

/*
 * Policy related constant definitions.
 */
#define	KMF_POLICY_DTD		"/usr/share/lib/xml/dtd/kmfpolicy.dtd"
#define	KMF_DEFAULT_POLICY_FILE	"/etc/security/kmfpolicy.xml"

#define	KMF_DEFAULT_POLICY_NAME	"default"

#define	KMF_POLICY_ROOT	"kmf-policy-db"

#define	KULOWBIT	7
#define	KUHIGHBIT	15

#define	KMF_POLICY_ELEMENT		"kmf-policy"
#define	KMF_POLICY_NAME_ATTR		"name"
#define	KMF_OPTIONS_IGNORE_DATE_ATTR	"ignore-date"
#define	KMF_OPTIONS_IGNORE_UNKNOWN_EKUS	"ignore-unknown-eku"
#define	KMF_OPTIONS_IGNORE_TRUST_ANCHOR	"ignore-trust-anchor"
#define	KMF_OPTIONS_VALIDITY_ADJUSTTIME	"validity-adjusttime"
#define	KMF_POLICY_TA_NAME_ATTR		"ta-name"
#define	KMF_POLICY_TA_SERIAL_ATTR	"ta-serial"

#define	KMF_VALIDATION_METHODS_ELEMENT	"validation-methods"

#define	KMF_OCSP_ELEMENT		"ocsp"
#define	KMF_OCSP_BASIC_ELEMENT		"ocsp-basic"
#define	KMF_OCSP_RESPONDER_ATTR		"responder"
#define	KMF_OCSP_PROXY_ATTR		"proxy"
#define	KMF_OCSP_URI_ATTR		"uri-from-cert"
#define	KMF_OCSP_RESPONSE_LIFETIME_ATTR	"response-lifetime"
#define	KMF_OCSP_IGNORE_SIGN_ATTR	"ignore-response-sign"
#define	KMF_OCSP_RESPONDER_CERT_ELEMENT	"responder-cert"

#define	KMF_CERT_NAME_ATTR		"name"
#define	KMF_CERT_SERIAL_ATTR		"serial"

#define	KMF_CRL_ELEMENT			"crl"
#define	KMF_CRL_BASENAME_ATTR		"basefilename"
#define	KMF_CRL_DIRECTORY_ATTR		"directory"
#define	KMF_CRL_GET_URI_ATTR		"get-crl-uri"
#define	KMF_CRL_PROXY_ATTR		"proxy"
#define	KMF_CRL_IGNORE_SIGN_ATTR	"ignore-crl-sign"
#define	KMF_CRL_IGNORE_DATE_ATTR	"ignore-crl-date"

#define	KMF_KEY_USAGE_SET_ELEMENT	"key-usage-set"
#define	KMF_KEY_USAGE_ELEMENT		"key-usage"
#define	KMF_KEY_USAGE_USE_ATTR		"use"

#define	KMF_EKU_ELEMENT		"ext-key-usage"
#define	KMF_EKU_NAME_ELEMENT	"eku-name"
#define	KMF_EKU_NAME_ATTR	"name"
#define	KMF_EKU_OID_ELEMENT	"eku-oid"
#define	KMF_EKU_OID_ATTR	"oid"

#define	KMF_CERT_MAPPER_ELEMENT		"cert-to-name-mapping"
#define	KMF_CERT_MAPPER_NAME_ATTR	"mapper-name"
#define	KMF_CERT_MAPPER_DIR_ATTR	"mapper-directory"
#define	KMF_CERT_MAPPER_PATH_ATTR	"mapper-pathname"
#define	KMF_CERT_MAPPER_OPTIONS_ATTR	"mapper-options"

#define	TMPFILE_TEMPLATE	"policyXXXXXX"

extern int parsePolicyElement(xmlNodePtr, KMF_POLICY_RECORD *);

extern KMF_RETURN kmf_get_policy(char *, char *, KMF_POLICY_RECORD *);
extern KMF_RETURN kmf_add_policy_to_db(KMF_POLICY_RECORD *, char *, boolean_t);
extern KMF_RETURN kmf_delete_policy_from_db(char *, char *);
extern KMF_RETURN kmf_verify_policy(KMF_POLICY_RECORD *);

extern void kmf_free_policy_record(KMF_POLICY_RECORD *);
extern void kmf_free_eku_policy(KMF_EKU_POLICY *);

#ifdef __cplusplus
}
#endif
#endif /* _KMFPOLICY_H */