05ba9a343bd7dfe86c55bd370f8ce33c6bcdc3a2
3 * $Id: key.h,v 1.10 2004/04/08 01:02:49 mdw Exp $
5 * Simple key management
7 * (c) 1999 Straylight/Edgeware
10 /*----- Licensing notice --------------------------------------------------*
12 * This file is part of Catacomb.
14 * Catacomb is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU Library General Public License as
16 * published by the Free Software Foundation; either version 2 of the
17 * License, or (at your option) any later version.
19 * Catacomb is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU Library General Public License for more details.
24 * You should have received a copy of the GNU Library General Public
25 * License along with Catacomb; if not, write to the Free
26 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
30 /*----- Revision history --------------------------------------------------*
33 * Revision 1.10 2004/04/08 01:02:49 mdw
36 * Revision 1.9 2001/06/22 19:37:59 mdw
37 * New interface to enquire whether a key has expired.
39 * Revision 1.8 2001/02/03 11:57:38 mdw
40 * Allow creating keyfiles with no file attached.
42 * Revision 1.7 2000/12/06 20:33:27 mdw
43 * Make flags be macros rather than enumerations, to ensure that they're
46 * Revision 1.6 2000/06/17 11:27:43 mdw
47 * Add key fetching interface.
49 * Revision 1.5 2000/02/12 18:55:40 mdw
50 * Make it all compile properly.
52 * Revision 1.4 2000/02/12 18:21:02 mdw
53 * Overhaul of key management (again).
55 * Revision 1.3 1999/12/22 15:47:48 mdw
56 * Major key-management revision.
58 * Revision 1.2 1999/12/10 23:29:48 mdw
59 * Change header file guard names.
61 * Revision 1.1 1999/09/03 08:41:12 mdw
66 #ifndef CATACOMB_KEY_H
67 #define CATACOMB_KEY_H
73 /*----- Header files ------------------------------------------------------*/
78 #include <mLib/bits.h>
79 #include <mLib/dstr.h>
80 #include <mLib/hash.h>
83 #ifndef CATACOMB_KEY_DATA_H
84 # include "key-data.h"
87 #ifndef CATACOMB_GHASH_H
95 /*----- Data structures ---------------------------------------------------*/
97 /* --- Key attributes --- *
99 * Each attribute is stored as a symbol in a symbol table. The value is
100 * the plain (not url-encoded) text to be written to the the file. If the
101 * value is binary data, then by this point it's base-64 encoded.
104 typedef struct key_attr
{
105 sym_base _b
; /* Symbol table data */
106 char *p
; /* Pointer to attribute value */
109 /* --- Main key structure --- *
111 * Each key is stored in two symbol tables, one indexed by keyid, and the
112 * other indexed by type. Because many keys can have the same type, the type
113 * table contains a list of keys, sorted in descending order of expiry.
118 /* --- Hashtable management --- */
120 hash_base _b
; /* Symbol table data */
121 struct key
*next
; /* Next key of the same type */
123 /* --- Basic key attributes --- */
125 uint32 id
; /* Key id used to name it */
126 char *tag
; /* Textual tag name */
127 char *type
; /* Textual key type */
128 time_t exp
, del
; /* Expiry times for keys */
130 /* --- The key data itself --- */
132 key_data k
; /* The actual key data */
134 /* --- Other attributes and commentary --- */
136 sym_table a
; /* Hashtable of key attributes */
137 char *c
; /* Any additional comments */
140 /* --- The keys-by-type entries --- */
142 typedef struct key_ref
{
143 sym_base _b
; /* Symbol table data */
144 key
*k
; /* Pointer to first key in list */
147 /* --- A key file --- */
149 typedef struct key_file
{
150 FILE *fp
; /* File pointer open on file */
151 char *name
; /* Filename used to create it */
152 unsigned f
; /* Various useful flags */
153 hash_table byid
; /* Table of keys by keyid */
154 sym_table bytype
; /* Table of keys by type */
155 sym_table bytag
; /* Table of keys by tag */
156 size_t idload
; /* Loading on id table */
159 /* --- Key file flags --- */
161 #define KF_WRITE 1u /* File opened for writing */
162 #define KF_MODIFIED 2u /* File has been modified */
164 /* --- Iterating over keys --- *
166 * Both of these are simple symbol table iterators, but they're made distinct
167 * types for the dubious benefits that type safety brings.
170 typedef struct { hash_iter i
; time_t t
; } key_iter
;
171 typedef struct { sym_iter i
; } key_attriter
;
173 /* --- Key fetching --- */
175 typedef struct key_fetchdef
{
176 char *name
; /* Name of item */
177 size_t off
; /* Offset into target structure */
178 unsigned e
; /* Flags for the item */
179 const struct key_fetchdef
*kf
; /* Substructure pointer */
182 /* --- File opening options --- */
184 #define KOPEN_READ 0u
185 #define KOPEN_WRITE 1u
186 #define KOPEN_MASK 0xff
187 #define KOPEN_NOFILE 0x100
189 /* --- Various other magic numbers --- */
191 #define KEXP_FOREVER ((time_t)-1) /* Never expire this key */
192 #define KEXP_EXPIRE ((time_t)-2) /* Expire this key when unused */
194 /* --- Key error codes --- */
197 KERR_OK
= 0, /* No error */
198 KERR_BADTAG
= -1, /* Malformed tag string */
199 KERR_BADTYPE
= -2, /* Malformed type string */
200 KERR_BADCOMMENT
= -3, /* Malformed comment string */
201 KERR_DUPID
= -4, /* Duplicate keyid */
202 KERR_DUPTAG
= -5, /* Duplicate key tag string */
203 KERR_READONLY
= -6, /* Key file is read-only */
204 KERR_WILLEXPIRE
= -7, /* Key will eventually expire */
205 KERR_EXPIRED
= -8, /* Key has already expired */
206 KERR_BADFLAGS
= -9, /* Error in flags string */
207 KERR_BADPASS
= -10, /* Error decrypting locked key */
208 KERR_WRONGTYPE
= -11, /* Key has incorrect type */
209 KERR_NOTFOUND
= -12, /* Key couldn't be found */
210 KERR_BADATTR
= -13, /* Malformed attribute name */
211 KERR_MAX
/* Largest possible error */
214 /* --- Write error codes --- */
217 KWRITE_OK
, /* Everything went fine */
218 KWRITE_FAIL
= -1, /* Close attempt failed */
219 KWRITE_BROKEN
= -2 /* Key ring needs manual fixing */
222 /* --- Error reporting functions for @key_merge@ and @key_open@ --- */
224 typedef void key_reporter(const char */
*file*/
, int /*line*/,
225 const char */
*err*/
, void */
*p*/
);
227 /* --- Macros for testing expiry --- */
229 #define KEY_EXPIRED(now, exp) \
230 ((exp) == KEXP_EXPIRE || ((exp) != KEXP_FOREVER && (exp) < (now)))
232 /*----- Reading and writing keys and files --------------------------------*/
234 /* --- @key_merge@ --- *
236 * Arguments: @key_file *f@ = pointer to file structure
237 * @const char *file@ = name of file (for error messages)
238 * @FILE *fp@ = file handle to read from
239 * @key_reporter *rep@ = error reporting function
240 * @void *arg@ = argument for function
242 * Returns: Error code (one of the @KERR@ constants).
244 * Use: Reads keys from a file, and inserts them into the file.
247 extern int key_merge(key_file */
*f*/
, const char */
*file*/
, FILE */
*fp*/
,
248 key_reporter */
*rep*/
, void */
*arg*/
);
250 /* --- @key_extract@ --- *
252 * Arguments: @key_file *f@ = pointer to file structure
253 * @key *k@ = key to extract
254 * @FILE *fp@ = file to write on
255 * @const key_filter *kf@ = pointer to key selection block
257 * Returns: Zero if OK, EOF on error.
259 * Use: Extracts a key to an ouptut file.
262 extern int key_extract(key_file */
*f*/
, key */
*k*/
, FILE */
*fp*/
,
263 const key_filter */
*kf*/
);
265 /* --- @key_open@ --- *
267 * Arguments: @key_file *f@ = pointer to file structure to initialize
268 * @const char *file@ = pointer to the file name
269 * @unsigned how@ = opening options (@KOPEN_*@).
270 * @key_reporter *rep@ = error reporting function
271 * @void *arg@ = argument for function
273 * Returns: Zero if it worked, nonzero otherwise.
275 * Use: Opens a key file, reads its contents, and stores them in a
276 * structure. The file is locked appropriately until closed
277 * using @key_close@. On an error, everything is cleared away
278 * tidily. If the file is opened with @KOPEN_WRITE@, it's
279 * created if necessary, with read and write permissions for its
283 extern int key_open(key_file */
*f*/
, const char */
*file*/
, unsigned /*how*/,
284 key_reporter */
*rep*/
, void */
*arg*/
);
286 /* --- @key_close@ --- *
288 * Arguments: @key_file *f@ = pointer to key file block
290 * Returns: A @KWRITE_@ code indicating how it went.
292 * Use: Frees all the key data, writes any changes. Make sure that
293 * all hell breaks loose if this returns @KWRITE_BROKEN@.
296 extern int key_close(key_file */
*f*/
);
298 /* --- @key_save@ --- *
300 * Arguments: @key_file *f@ = pointer to key file block
302 * Returns: A @KWRITE_@ code indicating how well it worked.
304 * Use: Writes a key file's data back to the actual file. This code
305 * is extremely careful about error handling. It should usually
306 * be able to back out somewhere sensible, but it can tell when
307 * it's got itself into a real pickle and starts leaving well
310 * Callers, please make sure that you ring alarm bells when this
311 * function returns @KWRITE_BROKEN@.
314 extern int key_save(key_file */
*f*/
);
316 /* --- @key_lockfile@ --- *
318 * Arguments: @key_file *f@ = pointer to file structure to initialize
319 * @const char *file@ = pointer to the file name
320 * @unsigned how@ = opening options (@KOPEN_*@).
322 * Returns: Zero if it worked, nonzero otherwise.
324 * Use: Opens a keyfile and stores the information needed for
325 * continued access in the structure.
327 * If the file is opened with @KOPEN_WRITE@, it's created if
328 * necessary with read and write permissions for owner only, and
329 * locked for update while it's open.
331 * This is a system-dependent routine, and only really intended
332 * for the private use of @key_open@.
335 extern int key_lockfile(key_file */
*f*/
, const char */
*file*/
,
338 /*----- Creating and manipulating keys ------------------------------------*/
342 * Arguments: @key_file *f@ = pointer to key file
343 * @uint32 id@ = keyid to set
344 * @const char *type@ = the type of this key
345 * @time_t exp@ = when the key expires
346 * @int *err@ = where to store the error condition
348 * Returns: Key block containing new data, or null if it couldn't be
351 * Use: Attaches a new key to a key file. You must have a writable
352 * key file for this to work.
354 * The type is a key type string. This interface doesn't care
355 * about how type strings are formatted: it just treats them as
356 * opaque gobs of text. Clients are advised to choose some
357 * standard for representing key types, though.
359 * The expiry time should either be a time in the future, or the
360 * magic value @KEXP_FOREVER@ which means `never expire this
361 * key'. Be careful with `forever' keys. If I were you, I'd
362 * use a more sophisticated key management system than this for
365 * You have to set the actual key yourself.
368 extern key
*key_new(key_file */
*f*/
, uint32
/*id*/, const char */
*type*/
,
369 time_t /*exp*/, int */
*err*/
);
371 /* --- @key_delete@ --- *
373 * Arguments: @key_file *f@ = pointer to file block
374 * @key *k@ = key to delete
376 * Returns: Error code (one of the @KERR@ constants).
378 * Use: Removes the given key from the list. The key file must be
379 * writable. (Due to the horridness of the data structures,
380 * deleted keys aren't actually removed, just marked so that
381 * they can't be looked up or iterated over. One upshot of
382 * this is that they don't get written back to the file when
386 extern int key_delete(key_file */
*f*/
, key */
*k*/
);
388 /* --- @key_expired@ --- *
390 * Arguments: @key *k@ = pointer to key block
392 * Returns: Zero if the key is OK, nonzero if it's expired.
395 int key_expired(key */
*k*/
);
397 /* --- @key_expire@ --- *
399 * Arguments: @key_file *f@ = pointer to file block
400 * @key *k@ = pointer to key block
402 * Returns: Error code (one of the @KERR@ constants).
404 * Use: Immediately marks the key as expired. It may be removed
405 * immediately, if it is no longer required, and will be removed
406 * by a tidy operation when it is no longer required. The key
407 * file must be writable.
410 extern int key_expire(key_file */
*f*/
, key */
*k*/
);
412 /* --- @key_used@ --- *
414 * Arguments: @key_file *f@ = pointer to key file
415 * @key *k@ = pointer to key block
416 * @time_t t@ = when key can be removed
418 * Returns: Zero if OK, nonzero on failure.
420 * Use: Marks a key as being required until a given time. Even
421 * though the key may expire before then (and won't be returned
422 * by type after that time), it will still be available when
423 * requested explicitly by id. The key file must be writable.
425 * The only (current) reason for failure is attempting to use
426 * a key which can expire for something which can't.
429 extern int key_used(key_file */
*f*/
, key */
*k*/
, time_t /*t*/);
431 /* --- @key_fingerprint@ --- *
433 * Arguments: @key *k@ = the key to fingerprint
434 * @ghash *h@ = the hash to use
435 * @const key_filter *kf@ = filter to apply
437 * Returns: Nonzero if the key slightly matched the filter.
439 * Use: Updates the hash context with the key contents.
442 extern int key_fingerprint(key */
*k*/
, ghash */
*h*/
,
443 const key_filter */
*kf*/
);
445 /*----- Setting and reading attributes ------------------------------------*/
447 /* --- @key_chkident@ --- *
449 * Arguments: @const char *p@ = pointer to a type string
451 * Returns: Zero if OK, -1 on error.
453 * Use: Checks whether an identification component string is OK.
456 extern int key_chkident(const char */
*p*/
);
458 /* --- @key_chkcomment@ --- *
460 * Arguments: @const char *p@ = pointer to a comment string
462 * Returns: Zero if OK, -1 on error.
464 * Use: Checks whether a comment string is OK.
467 extern int key_chkcomment(const char */
*p*/
);
469 /* --- @key_setcomment@ --- *
471 * Arguments: @key_file *f@ = pointer to key file block
472 * @key *k@ = pointer to key block
473 * @const char *c@ = pointer to comment to set, or zero
475 * Returns: Error code (one of the @KERR@ constants).
477 * Use: Replaces the key's current comment with a new one.
480 extern int key_setcomment(key_file */
*f*/
, key */
*k*/
, const char */
*c*/
);
482 /* --- @key_settag@ --- *
484 * Arguments: @key_file *f@ = pointer to key file block
485 * @key *k@ = pointer to key block
486 * @const char *tag@ = pointer to comment to set, or zero
488 * Returns: Error code (one of the @KERR@ constants).
490 * Use: Replaces the key's current tag with a new one.
493 extern int key_settag(key_file */
*f*/
, key */
*k*/
, const char */
*tag*/
);
495 /* --- @key_fulltag@ --- *
497 * Arguments: @key *k@ = pointer to key
498 * @dstr *d@ = pointer to destination string
502 * Use: Emits the key's full tag, which has the form
503 * `ID:TYPE[:TAG]'. This is used in the textual file format,
504 * and to identify passphrases for locked keys.
507 extern void key_fulltag(key */
*k*/
, dstr */
*d*/
);
509 /* --- @key_qtag@ --- *
511 * Arguments: @key_file *f@ = key file to find a key from
512 * @const char *tag@ = pointer to tag string
513 * @dstr *d@ = pointer to string for full tag name
514 * @key **k@ = where to store the key pointer
515 * @key_data **kd@ = where to store the key data pointer
517 * Returns: Zero if OK, nonzero if it failed.
519 * Use: Performs a full lookup on a qualified tag name. The tag is
520 * qualified by the names of subkeys, separated by dots. Hence,
521 * a qualified tag is ID|TAG[.TAG...]. The various result
522 * pointers can be null to indicate that the result isn't
526 extern int key_qtag(key_file */
*f*/
, const char */
*tag*/
,
527 dstr */
*d*/
, key
**/
*k*/
, key_data
**/
*kd*/
);
529 /* --- @key_getattr@ --- *
531 * Arguments: @key_file *f@ = pointer to file
532 * @key *k@ = pointer to key
533 * @const char *n@ = pointer to attribute name
535 * Returns: Pointer to attribute value, or null if not found.
537 * Use: Returns the value of a key attribute.
540 extern const char *key_getattr(key_file */
*f*/
, key */
*k*/
,
543 /* --- @key_putattr@ --- *
545 * Arguments: @key_file *f@ = pointer to file
546 * @key *k@ = pointer to key
547 * @const char *n@ = pointer to attribute name
548 * @const char *v@ = pointer to attribute value or null
550 * Returns: Error code (one of the @KERR@ constants).
552 * Use: Inserts an attribute on a key. If an attribute with the same
553 * name already exists, it is deleted. Setting a null value
554 * removes the attribute.
557 extern int key_putattr(key_file */
*f*/
, key */
*k*/
,
558 const char */
*n*/
, const char */
*v*/
);
560 /* --- @key_mkattriter@ --- *
562 * Arguments: @key_attriter *i@ = pointer to attribute iterator
563 * @key *k@ = pointer to key
567 * Use: Initializes an attribute iterator. The attributes are
568 * returned by @key_nextattr@.
571 extern void key_mkattriter(key_attriter */
*i*/
, key */
*k*/
);
573 /* --- @key_nextattr@ --- *
575 * Arguments: @key_attriter *i@ = pointer to attribute iterator
576 * @const char **n, **v@ = pointers to name and value
578 * Returns: Zero if no attribute available, or nonzero if returned OK.
580 * Use: Returns the next attribute.
583 extern int key_nextattr(key_attriter */
*i*/
,
584 const char **/
*n*/
, const char **/
*v*/
);
586 /*----- Searching and iterating -------------------------------------------*/
588 /* --- @key_bytype@ --- *
590 * Arguments: @key_file *f@ = key file we want a key from
591 * @const char *type@ = type string for desired key
593 * Returns: Pointer to the best key to use, or null.
595 * Use: Looks up a key by its type. Returns the key with the latest
596 * expiry time. This function will not return an expired key.
599 extern key
*key_bytype(key_file */
*f*/
, const char */
*type*/
);
601 /* --- @key_byid@ --- *
603 * Arguments: @key_file *f@ = key file to find a key from
604 * @uint32 id@ = id to look for
606 * Returns: Key with matching id.
608 * Use: Returns a key given its id. This function will return an
609 * expired key, but not a deleted one.
612 extern key
*key_byid(key_file */
*f*/
, uint32
/*id*/);
614 /* --- @key_bytag@ --- *
616 * Arguments: @key_file *f@ = key file to find a key from
617 * @const char *tag@ = pointer to tag string
619 * Returns: Key with matching id or tag.
621 * Use: Returns a key given its tag or id. This function will return
622 * an expired key, but not a deleted one.
625 extern key
*key_bytag(key_file */
*f*/
, const char */
*tag*/
);
627 /* --- @key_mkiter@ --- *
629 * Arguments: @key_iter *i@ = pointer to iterator object
630 * @key_file *f@ = pointer to file structure
634 * Use: Initializes a key iterator. The keys are returned by
638 extern void key_mkiter(key_iter */
*i*/
, key_file */
*f*/
);
640 /* --- @key_next@ --- *
642 * Arguments: @key_iter *i@ = pointer to iterator object
644 * Returns: Pointer to next key, or null.
646 * Use: Returns the next key in some arbitrary sequence.
649 extern key
*key_next(key_iter */
*i*/
);
651 /*----- Fetching key data conveniently ------------------------------------*/
653 /* --- @key_fetchinit@ --- *
655 * Arguments: @const key_fetchdef *kf@ = pointer to base definition
656 * @key_packstruct *kps@ = pointer to destination packing def
657 * @void *p@ = pointer to destination block
659 * Returns: Pointer to packing definition.
661 * Use: Initializes a packing definition (@key_packdef@ structure).
662 * If @kps@ is null on entry, an appropriately sized block is
663 * allocated automatically. Otherwise it must be large enough.
666 extern key_packdef
*key_fetchinit(const key_fetchdef */
*kf*/
,
667 key_packstruct */
*kp*/
, void */
*p*/
);
669 /* --- @key_fetch@ --- *
671 * Arguments: @key_packdef *kp@ = pointer to packing structure
672 * @key *k@ = key file containing desired key
674 * Returns: Error code, or zero.
676 * Use: Fetches an unpacked key from a packed one.
679 extern int key_fetch(key_packdef */
*kp*/
, key */
*k*/
);
681 /* --- @key_fetchbyname@ --- *
683 * Arguments: @key_packdef *kp@ = pointer to packing structure
684 * @key_file *kf@ = key file containing desired key
685 * @const char *tag@ = user's tag describing the key
687 * Returns: Error code, or zero.
689 * Use: Fetches a named key from a key file and unpacks it
693 extern int key_fetchbyname(key_packdef */
*kp*/
,
694 key_file */
*kf*/
, const char */
*tag*/
);
696 /* --- @key_fetchdone@ --- *
698 * Arguments: @key_packdef *kp@ = pointer to packing structure
702 * Use: Frees a packing structure. If the structure was allocated by
703 * @key_fetchinit@ then it is freed.
706 extern void key_fetchdone(key_packdef */
*kp*/
);
708 /*----- Other functions ---------------------------------------------------*/
710 /* --- @key_moan@ --- *
712 * Arguments: @const char *file@ = name of the file
713 * @int line@ = line number in file
714 * @const char *msg@ = error message
715 * @void *p@ = argument pointer
719 * Use: Reports an error message about loading a key file.
722 extern void key_moan(const char */
*file*/
, int /*line*/,
723 const char */
*msg*/
, void */
*p*/
);
725 /* --- @key_strerror@ --- *
727 * Arguments: @int err@ = error code from @key_new@
729 * Returns: Pointer to error string.
731 * Use: Translates a @KERR@ error code into a human-readable string.
734 extern const char *key_strerror(int /*err*/);
736 /*----- That's all, folks -------------------------------------------------*/