136e94dc5SPeter Avalos /* 236e94dc5SPeter Avalos * Copyright (c) 2012 Damien Miller <djm@mindrot.org> 336e94dc5SPeter Avalos * 436e94dc5SPeter Avalos * Permission to use, copy, modify, and distribute this software for any 536e94dc5SPeter Avalos * purpose with or without fee is hereby granted, provided that the above 636e94dc5SPeter Avalos * copyright notice and this permission notice appear in all copies. 736e94dc5SPeter Avalos * 836e94dc5SPeter Avalos * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 936e94dc5SPeter Avalos * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 1036e94dc5SPeter Avalos * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 1136e94dc5SPeter Avalos * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 1236e94dc5SPeter Avalos * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 1336e94dc5SPeter Avalos * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 1436e94dc5SPeter Avalos * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 1536e94dc5SPeter Avalos */ 1636e94dc5SPeter Avalos 17*ba1276acSMatthew Dillon /* $OpenBSD: krl.h,v 1.10 2023/07/17 04:01:10 djm Exp $ */ 1836e94dc5SPeter Avalos 1936e94dc5SPeter Avalos #ifndef _KRL_H 2036e94dc5SPeter Avalos #define _KRL_H 2136e94dc5SPeter Avalos 2236e94dc5SPeter Avalos /* Functions to manage key revocation lists */ 2336e94dc5SPeter Avalos 2436e94dc5SPeter Avalos #define KRL_MAGIC "SSHKRL\n\0" 2536e94dc5SPeter Avalos #define KRL_FORMAT_VERSION 1 2636e94dc5SPeter Avalos 2736e94dc5SPeter Avalos /* KRL section types */ 2836e94dc5SPeter Avalos #define KRL_SECTION_CERTIFICATES 1 2936e94dc5SPeter Avalos #define KRL_SECTION_EXPLICIT_KEY 2 3036e94dc5SPeter Avalos #define KRL_SECTION_FINGERPRINT_SHA1 3 3136e94dc5SPeter Avalos #define KRL_SECTION_SIGNATURE 4 32664f4763Szrj #define KRL_SECTION_FINGERPRINT_SHA256 5 33*ba1276acSMatthew Dillon #define KRL_SECTION_EXTENSION 255 3436e94dc5SPeter Avalos 3536e94dc5SPeter Avalos /* KRL_SECTION_CERTIFICATES subsection types */ 3636e94dc5SPeter Avalos #define KRL_SECTION_CERT_SERIAL_LIST 0x20 3736e94dc5SPeter Avalos #define KRL_SECTION_CERT_SERIAL_RANGE 0x21 3836e94dc5SPeter Avalos #define KRL_SECTION_CERT_SERIAL_BITMAP 0x22 3936e94dc5SPeter Avalos #define KRL_SECTION_CERT_KEY_ID 0x23 40*ba1276acSMatthew Dillon #define KRL_SECTION_CERT_EXTENSION 0x39 4136e94dc5SPeter Avalos 42e9778795SPeter Avalos struct sshkey; 43e9778795SPeter Avalos struct sshbuf; 4436e94dc5SPeter Avalos struct ssh_krl; 4536e94dc5SPeter Avalos 4636e94dc5SPeter Avalos struct ssh_krl *ssh_krl_init(void); 4736e94dc5SPeter Avalos void ssh_krl_free(struct ssh_krl *krl); 4836e94dc5SPeter Avalos void ssh_krl_set_version(struct ssh_krl *krl, u_int64_t version); 49e9778795SPeter Avalos int ssh_krl_set_comment(struct ssh_krl *krl, const char *comment); 50e9778795SPeter Avalos int ssh_krl_revoke_cert_by_serial(struct ssh_krl *krl, 51e9778795SPeter Avalos const struct sshkey *ca_key, u_int64_t serial); 52e9778795SPeter Avalos int ssh_krl_revoke_cert_by_serial_range(struct ssh_krl *krl, 53e9778795SPeter Avalos const struct sshkey *ca_key, u_int64_t lo, u_int64_t hi); 54e9778795SPeter Avalos int ssh_krl_revoke_cert_by_key_id(struct ssh_krl *krl, 55e9778795SPeter Avalos const struct sshkey *ca_key, const char *key_id); 56e9778795SPeter Avalos int ssh_krl_revoke_key_explicit(struct ssh_krl *krl, const struct sshkey *key); 57664f4763Szrj int ssh_krl_revoke_key_sha1(struct ssh_krl *krl, const u_char *p, size_t len); 58664f4763Szrj int ssh_krl_revoke_key_sha256(struct ssh_krl *krl, const u_char *p, size_t len); 59e9778795SPeter Avalos int ssh_krl_revoke_key(struct ssh_krl *krl, const struct sshkey *key); 60*ba1276acSMatthew Dillon int ssh_krl_to_blob(struct ssh_krl *krl, struct sshbuf *buf); 61*ba1276acSMatthew Dillon int ssh_krl_from_blob(struct sshbuf *buf, struct ssh_krl **krlp); 62e9778795SPeter Avalos int ssh_krl_check_key(struct ssh_krl *krl, const struct sshkey *key); 63e9778795SPeter Avalos int ssh_krl_file_contains_key(const char *path, const struct sshkey *key); 640cbfa66cSDaniel Fojt int krl_dump(struct ssh_krl *krl, FILE *f); 6536e94dc5SPeter Avalos 6636e94dc5SPeter Avalos #endif /* _KRL_H */ 6736e94dc5SPeter Avalos 68