2N/A/*
2N/A * CDDL HEADER START
2N/A *
2N/A * The contents of this file are subject to the terms of the
2N/A * Common Development and Distribution License (the "License").
2N/A * You may not use this file except in compliance with the License.
2N/A *
2N/A * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
2N/A * or http://www.opensolaris.org/os/licensing.
2N/A * See the License for the specific language governing permissions
2N/A * and limitations under the License.
2N/A *
2N/A * When distributing Covered Code, include this CDDL HEADER in each
2N/A * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
2N/A * If applicable, add the following below this CDDL HEADER, with the
2N/A * fields enclosed by brackets "[]" replaced with your own identifying
2N/A * information: Portions Copyright [yyyy] [name of copyright owner]
2N/A *
2N/A * CDDL HEADER END
2N/A *
2N/A * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
2N/A */
2N/A#ifndef _KMFPOLICY_H
2N/A#define _KMFPOLICY_H
2N/A
2N/A#include <kmfapi.h>
2N/A#include <kmfmapper.h>
2N/A#include <libxml/tree.h>
2N/A#include <libxml/parser.h>
2N/A
2N/A#ifdef __cplusplus
2N/Aextern "C" {
2N/A#endif
2N/A
2N/Atypedef struct {
2N/A char *name;
2N/A char *serial;
2N/A}KMF_RESP_CERT_POLICY;
2N/A
2N/Atypedef struct {
2N/A char *responderURI;
2N/A char *proxy;
2N/A boolean_t uri_from_cert;
2N/A char *response_lifetime;
2N/A boolean_t ignore_response_sign;
2N/A}KMF_OCSP_BASIC_POLICY;
2N/A
2N/Atypedef struct {
2N/A KMF_OCSP_BASIC_POLICY basic;
2N/A KMF_RESP_CERT_POLICY resp_cert;
2N/A boolean_t has_resp_cert;
2N/A}KMF_OCSP_POLICY;
2N/A
2N/Atypedef struct {
2N/A char *basefilename;
2N/A char *directory;
2N/A char *proxy;
2N/A boolean_t get_crl_uri;
2N/A boolean_t ignore_crl_sign;
2N/A boolean_t ignore_crl_date;
2N/A}KMF_CRL_POLICY;
2N/A
2N/Atypedef struct {
2N/A KMF_OCSP_POLICY ocsp_info;
2N/A KMF_CRL_POLICY crl_info;
2N/A}KMF_VALIDATION_POLICY;
2N/A
2N/Atypedef struct {
2N/A int eku_count;
2N/A KMF_OID *ekulist;
2N/A}KMF_EKU_POLICY;
2N/A
2N/A#define KMF_REVOCATION_METHOD_CRL 0x1
2N/A#define KMF_REVOCATION_METHOD_OCSP 0x2
2N/A
2N/Atypedef struct {
2N/A char *name;
2N/A KMF_VALIDATION_POLICY validation_info;
2N/A KMF_EKU_POLICY eku_set;
2N/A KMF_MAPPER_RECORD mapper; /* kmfmapper.h */
2N/A uint32_t ku_bits;
2N/A boolean_t ignore_date;
2N/A boolean_t ignore_unknown_ekus;
2N/A boolean_t ignore_trust_anchor;
2N/A char *validity_adjusttime;
2N/A char *ta_name;
2N/A char *ta_serial;
2N/A uint32_t revocation;
2N/A} KMF_POLICY_RECORD;
2N/A
2N/A
2N/A/*
2N/A * Short cut for ocsp_info and etc.
2N/A */
2N/A#define VAL_OCSP validation_info.ocsp_info
2N/A
2N/A#define VAL_OCSP_BASIC VAL_OCSP.basic
2N/A#define VAL_OCSP_RESPONDER_URI VAL_OCSP_BASIC.responderURI
2N/A#define VAL_OCSP_PROXY VAL_OCSP_BASIC.proxy
2N/A#define VAL_OCSP_URI_FROM_CERT VAL_OCSP_BASIC.uri_from_cert
2N/A#define VAL_OCSP_RESP_LIFETIME VAL_OCSP_BASIC.response_lifetime
2N/A#define VAL_OCSP_IGNORE_RESP_SIGN VAL_OCSP_BASIC.ignore_response_sign
2N/A
2N/A#define VAL_OCSP_RESP_CERT VAL_OCSP.resp_cert
2N/A#define VAL_OCSP_RESP_CERT_NAME VAL_OCSP_RESP_CERT.name
2N/A#define VAL_OCSP_RESP_CERT_SERIAL VAL_OCSP_RESP_CERT.serial
2N/A
2N/A/*
2N/A * Short cut for crl_info and etc.
2N/A */
2N/A#define VAL_CRL validation_info.crl_info
2N/A#define VAL_CRL_BASEFILENAME validation_info.crl_info.basefilename
2N/A#define VAL_CRL_DIRECTORY validation_info.crl_info.directory
2N/A#define VAL_CRL_GET_URI validation_info.crl_info.get_crl_uri
2N/A#define VAL_CRL_PROXY validation_info.crl_info.proxy
2N/A#define VAL_CRL_IGNORE_SIGN validation_info.crl_info.ignore_crl_sign
2N/A#define VAL_CRL_IGNORE_DATE validation_info.crl_info.ignore_crl_date
2N/A
2N/A/*
2N/A * Policy related constant definitions.
2N/A */
2N/A#define KMF_POLICY_DTD "/usr/share/lib/xml/dtd/kmfpolicy.dtd"
2N/A#define KMF_DEFAULT_POLICY_FILE "/etc/security/kmfpolicy.xml"
2N/A
2N/A#define KMF_DEFAULT_POLICY_NAME "default"
2N/A
2N/A#define KMF_POLICY_ROOT "kmf-policy-db"
2N/A
2N/A#define KULOWBIT 7
2N/A#define KUHIGHBIT 15
2N/A
2N/A#define KMF_POLICY_ELEMENT "kmf-policy"
2N/A#define KMF_POLICY_NAME_ATTR "name"
2N/A#define KMF_OPTIONS_IGNORE_DATE_ATTR "ignore-date"
2N/A#define KMF_OPTIONS_IGNORE_UNKNOWN_EKUS "ignore-unknown-eku"
2N/A#define KMF_OPTIONS_IGNORE_TRUST_ANCHOR "ignore-trust-anchor"
2N/A#define KMF_OPTIONS_VALIDITY_ADJUSTTIME "validity-adjusttime"
2N/A#define KMF_POLICY_TA_NAME_ATTR "ta-name"
2N/A#define KMF_POLICY_TA_SERIAL_ATTR "ta-serial"
2N/A
2N/A#define KMF_VALIDATION_METHODS_ELEMENT "validation-methods"
2N/A
2N/A#define KMF_OCSP_ELEMENT "ocsp"
2N/A#define KMF_OCSP_BASIC_ELEMENT "ocsp-basic"
2N/A#define KMF_OCSP_RESPONDER_ATTR "responder"
2N/A#define KMF_OCSP_PROXY_ATTR "proxy"
2N/A#define KMF_OCSP_URI_ATTR "uri-from-cert"
2N/A#define KMF_OCSP_RESPONSE_LIFETIME_ATTR "response-lifetime"
2N/A#define KMF_OCSP_IGNORE_SIGN_ATTR "ignore-response-sign"
2N/A#define KMF_OCSP_RESPONDER_CERT_ELEMENT "responder-cert"
2N/A
2N/A#define KMF_CERT_NAME_ATTR "name"
2N/A#define KMF_CERT_SERIAL_ATTR "serial"
2N/A
2N/A#define KMF_CRL_ELEMENT "crl"
2N/A#define KMF_CRL_BASENAME_ATTR "basefilename"
2N/A#define KMF_CRL_DIRECTORY_ATTR "directory"
2N/A#define KMF_CRL_GET_URI_ATTR "get-crl-uri"
2N/A#define KMF_CRL_PROXY_ATTR "proxy"
2N/A#define KMF_CRL_IGNORE_SIGN_ATTR "ignore-crl-sign"
2N/A#define KMF_CRL_IGNORE_DATE_ATTR "ignore-crl-date"
2N/A
2N/A#define KMF_KEY_USAGE_SET_ELEMENT "key-usage-set"
2N/A#define KMF_KEY_USAGE_ELEMENT "key-usage"
2N/A#define KMF_KEY_USAGE_USE_ATTR "use"
2N/A
2N/A#define KMF_EKU_ELEMENT "ext-key-usage"
2N/A#define KMF_EKU_NAME_ELEMENT "eku-name"
2N/A#define KMF_EKU_NAME_ATTR "name"
2N/A#define KMF_EKU_OID_ELEMENT "eku-oid"
2N/A#define KMF_EKU_OID_ATTR "oid"
2N/A
2N/A#define KMF_CERT_MAPPER_ELEMENT "cert-to-name-mapping"
2N/A#define KMF_CERT_MAPPER_NAME_ATTR "mapper-name"
2N/A#define KMF_CERT_MAPPER_DIR_ATTR "mapper-directory"
2N/A#define KMF_CERT_MAPPER_PATH_ATTR "mapper-pathname"
2N/A#define KMF_CERT_MAPPER_OPTIONS_ATTR "mapper-options"
2N/A
2N/A#define TMPFILE_TEMPLATE "policyXXXXXX"
2N/A
2N/Aextern int parsePolicyElement(xmlNodePtr, KMF_POLICY_RECORD *);
2N/A
2N/Aextern KMF_RETURN kmf_get_policy(char *, char *, KMF_POLICY_RECORD *);
2N/Aextern KMF_RETURN kmf_add_policy_to_db(KMF_POLICY_RECORD *, char *, boolean_t);
2N/Aextern KMF_RETURN kmf_delete_policy_from_db(char *, char *);
2N/Aextern KMF_RETURN kmf_verify_policy(KMF_POLICY_RECORD *);
2N/A
2N/Aextern void kmf_free_policy_record(KMF_POLICY_RECORD *);
2N/Aextern void kmf_free_eku_policy(KMF_EKU_POLICY *);
2N/A
2N/A#ifdef __cplusplus
2N/A}
2N/A#endif
2N/A#endif /* _KMFPOLICY_H */