Annotation of embedaddon/strongswan/src/libstrongswan/credentials/auth_cfg.h, revision 1.1
1.1 ! misho 1: /*
! 2: * Copyright (C) 2008-2015 Tobias Brunner
! 3: * Copyright (C) 2007-2009 Martin Willi
! 4: * HSR Hochschule fuer Technik Rapperswil
! 5: *
! 6: * This program is free software; you can redistribute it and/or modify it
! 7: * under the terms of the GNU General Public License as published by the
! 8: * Free Software Foundation; either version 2 of the License, or (at your
! 9: * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
! 10: *
! 11: * This program is distributed in the hope that it will be useful, but
! 12: * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
! 13: * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
! 14: * for more details.
! 15: */
! 16:
! 17: /**
! 18: * @defgroup auth_cfg auth_cfg
! 19: * @{ @ingroup credentials
! 20: */
! 21:
! 22: #ifndef AUTH_CFG_H_
! 23: #define AUTH_CFG_H_
! 24:
! 25: #include <collections/enumerator.h>
! 26:
! 27: typedef struct auth_cfg_t auth_cfg_t;
! 28: typedef enum auth_rule_t auth_rule_t;
! 29: typedef enum auth_class_t auth_class_t;
! 30:
! 31: /**
! 32: * Class of authentication to use. This is different to auth_method_t in that
! 33: * it does not specify a method, but a class of acceptable methods. The found
! 34: * certificate finally dictates which method is used.
! 35: */
! 36: enum auth_class_t {
! 37: /** any class acceptable */
! 38: AUTH_CLASS_ANY = 0,
! 39: /** authentication using public keys (RSA, ECDSA) */
! 40: AUTH_CLASS_PUBKEY = 1,
! 41: /** authentication using a pre-shared secrets */
! 42: AUTH_CLASS_PSK = 2,
! 43: /** authentication using EAP */
! 44: AUTH_CLASS_EAP = 3,
! 45: /** authentication using IKEv1 XAUTH */
! 46: AUTH_CLASS_XAUTH = 4,
! 47: };
! 48:
! 49: /**
! 50: * enum strings for auth_class_t
! 51: */
! 52: extern enum_name_t *auth_class_names;
! 53:
! 54: /**
! 55: * Authentication config to use during authentication process.
! 56: *
! 57: * Each authentication config contains a set of rules. These rule-sets are used
! 58: * in two ways:
! 59: * - For configs specifying local authentication behavior, the rules define
! 60: * which authentication method in which way.
! 61: * - For configs specifying remote peer authentication, the rules define
! 62: * constraints the peer has to fulfill.
! 63: *
! 64: * Additionally to the rules, there is a set of helper items. These are used
! 65: * to transport credentials during the authentication process.
! 66: */
! 67: enum auth_rule_t {
! 68: /** identity to use for IKEv2 authentication exchange, identification_t* */
! 69: AUTH_RULE_IDENTITY,
! 70: /** if TRUE don't send IDr as initiator, but verify the identity after
! 71: * receiving IDr (but also verify it against subjectAltNames), bool */
! 72: AUTH_RULE_IDENTITY_LOOSE,
! 73: /** authentication class, auth_class_t */
! 74: AUTH_RULE_AUTH_CLASS,
! 75: /** AAA-backend identity for EAP methods supporting it, identification_t* */
! 76: AUTH_RULE_AAA_IDENTITY,
! 77: /** EAP identity to use within EAP-Identity exchange, identification_t* */
! 78: AUTH_RULE_EAP_IDENTITY,
! 79: /** EAP type to propose for peer authentication, eap_type_t */
! 80: AUTH_RULE_EAP_TYPE,
! 81: /** EAP vendor for vendor specific type, uint32_t */
! 82: AUTH_RULE_EAP_VENDOR,
! 83: /** XAUTH backend name to use, char* */
! 84: AUTH_RULE_XAUTH_BACKEND,
! 85: /** XAuth identity to use or require, identification_t* */
! 86: AUTH_RULE_XAUTH_IDENTITY,
! 87: /** subject of certificate authority, identification_t* */
! 88: AUTH_RULE_CA_IDENTITY,
! 89: /** certificate authority, certificate_t* */
! 90: AUTH_RULE_CA_CERT,
! 91: /** intermediate certificate in trustchain, certificate_t* */
! 92: AUTH_RULE_IM_CERT,
! 93: /** subject certificate, certificate_t* */
! 94: AUTH_RULE_SUBJECT_CERT,
! 95: /** result of a CRL validation, cert_validation_t */
! 96: AUTH_RULE_CRL_VALIDATION,
! 97: /** result of a OCSP validation, cert_validation_t */
! 98: AUTH_RULE_OCSP_VALIDATION,
! 99: /** CRL/OCSP validation is disabled, bool */
! 100: AUTH_RULE_CERT_VALIDATION_SUSPENDED,
! 101: /** subject is member of a group, identification_t*
! 102: * The group membership constraint is fulfilled if the subject is member of
! 103: * one group defined in the constraints. */
! 104: AUTH_RULE_GROUP,
! 105: /** required RSA public key strength, u_int in bits */
! 106: AUTH_RULE_RSA_STRENGTH,
! 107: /** required ECDSA public key strength, u_int in bits */
! 108: AUTH_RULE_ECDSA_STRENGTH,
! 109: /** required BLISS public key strength, u_int in bits */
! 110: AUTH_RULE_BLISS_STRENGTH,
! 111: /** required signature scheme, signature_params_t* */
! 112: AUTH_RULE_SIGNATURE_SCHEME,
! 113: /** required signature scheme for IKE authentication, signature_params_t* */
! 114: AUTH_RULE_IKE_SIGNATURE_SCHEME,
! 115: /** certificatePolicy constraint, numerical OID as char* */
! 116: AUTH_RULE_CERT_POLICY,
! 117:
! 118: /** intermediate certificate, certificate_t* */
! 119: AUTH_HELPER_IM_CERT,
! 120: /** subject certificate, certificate_t* */
! 121: AUTH_HELPER_SUBJECT_CERT,
! 122: /** Hash and URL of a intermediate certificate, char* */
! 123: AUTH_HELPER_IM_HASH_URL,
! 124: /** Hash and URL of a end-entity certificate, char* */
! 125: AUTH_HELPER_SUBJECT_HASH_URL,
! 126: /** revocation certificate (CRL, OCSP), certificate_t* */
! 127: AUTH_HELPER_REVOCATION_CERT,
! 128: /** attribute certificate for authorization decisions, certificate_t */
! 129: AUTH_HELPER_AC_CERT,
! 130:
! 131: /** helper to determine the number of elements in this enum */
! 132: AUTH_RULE_MAX,
! 133: };
! 134:
! 135: /**
! 136: * enum name for auth_rule_t.
! 137: */
! 138: extern enum_name_t *auth_rule_names;
! 139:
! 140: /**
! 141: * Authentication/Authorization round.
! 142: *
! 143: * RFC4739 defines multiple authentication rounds. This class defines such
! 144: * a round from a configuration perspective, either for the local or the remote
! 145: * peer. Local configs are called "rulesets". They define how we authenticate.
! 146: * Remote peer configs are called "constraints". They define what is needed to
! 147: * complete the authentication round successfully.
! 148: *
! 149: * @verbatim
! 150:
! 151: [Repeat for each configuration]
! 152: +--------------------------------------------------+
! 153: | |
! 154: | |
! 155: | +----------+ IKE_AUTH +--------- + |
! 156: | | config | -----------> | | |
! 157: | | ruleset | | | |
! 158: | +----------+ [ <----------- ] | | |
! 159: | [ optional EAP ] | Peer | |
! 160: | +----------+ [ -----------> ] | | |
! 161: | | config | | | |
! 162: | | constr. | <----------- | | |
! 163: | +----------+ IKE_AUTH +--------- + |
! 164: | |
! 165: | |
! 166: +--------------------------------------------------+
! 167:
! 168: @endverbatim
! 169: *
! 170: * Values for each item are either pointers (casted to void*) or short
! 171: * integers (use uintptr_t cast).
! 172: */
! 173: struct auth_cfg_t {
! 174:
! 175: /**
! 176: * Add a rule to the set.
! 177: *
! 178: * Rules we expect only once (e.g. identities) implicitly replace previous
! 179: * rules of the same type (but pointers to previous values will remain
! 180: * valid until the auth_cfg_t object is destroyed).
! 181: * Rules that may occur multiple times (e.g. CA certificates) are inserted
! 182: * so that they can be enumerated in the order in which they were added.
! 183: * For these get() will return the value added first.
! 184: *
! 185: * @param rule rule type
! 186: * @param ... associated value to rule
! 187: */
! 188: void (*add)(auth_cfg_t *this, auth_rule_t rule, ...);
! 189:
! 190: /**
! 191: * Add public key and signature scheme constraints to the set.
! 192: *
! 193: * @param constraints constraints string (e.g. "rsa-sha384")
! 194: * @param ike whether to add/parse constraints for IKE signatures
! 195: */
! 196: void (*add_pubkey_constraints)(auth_cfg_t *this, char *constraints,
! 197: bool ike);
! 198:
! 199: /**
! 200: * Get a rule value.
! 201: *
! 202: * For rules we expect only once the latest value is returned.
! 203: *
! 204: * @param rule rule type
! 205: * @return rule or NULL (or an appropriate default) if not found
! 206: */
! 207: void* (*get)(auth_cfg_t *this, auth_rule_t rule);
! 208:
! 209: /**
! 210: * Create an enumerator over added rules.
! 211: *
! 212: * Refer to add() regarding the order in which rules are enumerated.
! 213: * For rules we expect only once the latest value is enumerated only.
! 214: *
! 215: * @return enumerator over (auth_rule_t, union{void*,uintpr_t})
! 216: */
! 217: enumerator_t* (*create_enumerator)(auth_cfg_t *this);
! 218:
! 219: /**
! 220: * Replace a rule at enumerator position.
! 221: *
! 222: * @param pos enumerator position
! 223: * @param rule rule type
! 224: * @param ... associated value to rule
! 225: */
! 226: void (*replace)(auth_cfg_t *this, enumerator_t *pos,
! 227: auth_rule_t rule, ...);
! 228:
! 229: /**
! 230: * Check if a used config fulfills a set of configured constraints.
! 231: *
! 232: * @param constraints required authorization rules
! 233: * @param log_error whether to log compliance errors
! 234: * @return TRUE if this complies with constraints
! 235: */
! 236: bool (*complies)(auth_cfg_t *this, auth_cfg_t *constraints, bool log_error);
! 237:
! 238: /**
! 239: * Merge items from other into this.
! 240: *
! 241: * @param other items to read for merge
! 242: * @param copy TRUE to copy items, FALSE to move them
! 243: */
! 244: void (*merge)(auth_cfg_t *this, auth_cfg_t *other, bool copy);
! 245:
! 246: /**
! 247: * Purge all rules in a config.
! 248: *
! 249: * @param keep_ca whether to keep AUTH_RULE_CA_CERT entries
! 250: */
! 251: void (*purge)(auth_cfg_t *this, bool keep_ca);
! 252:
! 253: /**
! 254: * Check two configs for equality.
! 255: *
! 256: * For rules we expect only once the latest value is compared only.
! 257: *
! 258: * @param other other config to compare against this
! 259: * @return TRUE if auth infos identical
! 260: */
! 261: bool (*equals)(auth_cfg_t *this, auth_cfg_t *other);
! 262:
! 263: /**
! 264: * Clone an authentication config, including all rules.
! 265: *
! 266: * @return cloned configuration
! 267: */
! 268: auth_cfg_t* (*clone)(auth_cfg_t *this);
! 269:
! 270: /**
! 271: * Destroy a config with all associated rules/values.
! 272: */
! 273: void (*destroy)(auth_cfg_t *this);
! 274: };
! 275:
! 276: /**
! 277: * Create a authentication config.
! 278: */
! 279: auth_cfg_t *auth_cfg_create();
! 280:
! 281: #endif /** AUTH_CFG_H_ @}*/
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to auth_cfg.h CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / strongswan / src / libstrongswan / credentials