Return to sshsig.h CVS log

Up to [local] / src / usr.bin / ssh

Annotation of src/usr.bin/ssh/sshsig.h, Revision 1.3

1.1       djm         1: /*
                      2:  * Copyright (c) 2019 Google LLC
                      3:  *
                      4:  * Permission to use, copy, modify, and distribute this software for any
                      5:  * purpose with or without fee is hereby granted, provided that the above
                      6:  * copyright notice and this permission notice appear in all copies.
                      7:  *
                      8:  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
                      9:  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
                     10:  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
                     11:  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
                     12:  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
                     13:  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
                     14:  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
                     15:  */
                     16:
                     17: #ifndef SSHSIG_H
                     18: #define SSHSIG_H
                     19:
                     20: struct sshbuf;
                     21: struct sshkey;
1.3     ! djm        22: struct sshsigopt;
1.1       djm        23:
                     24: typedef int sshsig_signer(struct sshkey *, u_char **, size_t *,
                     25:     const u_char *, size_t, const char *, u_int, void *);
                     26:
1.2       djm        27: /* Buffer-oriented API */
                     28:
1.1       djm        29: /*
1.2       djm        30:  * Creates a detached SSH signature for a given buffer.
1.1       djm        31:  * Returns 0 on success or a negative SSH_ERR_* error code on failure.
                     32:  * out is populated with the detached signature, or NULL on failure.
                     33:  */
1.2       djm        34: int sshsig_signb(struct sshkey *key, const char *hashalg,
1.1       djm        35:     const struct sshbuf *message, const char *sig_namespace,
                     36:     struct sshbuf **out, sshsig_signer *signer, void *signer_ctx);
                     37:
                     38: /*
1.2       djm        39:  * Verifies that a detached signature is valid and optionally returns key
                     40:  * used to sign via argument.
                     41:  * Returns 0 on success or a negative SSH_ERR_* error code on failure.
                     42:  */
                     43: int sshsig_verifyb(struct sshbuf *signature,
                     44:     const struct sshbuf *message, const char *sig_namespace,
                     45:     struct sshkey **sign_keyp);
                     46:
                     47: /* File/FD-oriented API */
                     48:
                     49: /*
1.1       djm        50:  * Creates a detached SSH signature for a given file.
                     51:  * Returns 0 on success or a negative SSH_ERR_* error code on failure.
                     52:  * out is populated with the detached signature, or NULL on failure.
                     53:  */
                     54: int sshsig_sign_fd(struct sshkey *key, const char *hashalg,
                     55:     int fd, const char *sig_namespace, struct sshbuf **out,
                     56:     sshsig_signer *signer, void *signer_ctx);
                     57:
                     58: /*
                     59:  * Verifies that a detached signature over a file is valid and optionally
                     60:  * returns key used to sign via argument.
                     61:  * Returns 0 on success or a negative SSH_ERR_* error code on failure.
                     62:  */
                     63: int sshsig_verify_fd(struct sshbuf *signature, int fd,
                     64:     const char *sig_namespace, struct sshkey **sign_keyp);
1.2       djm        65:
                     66: /* Utility functions */
1.1       djm        67:
                     68: /*
                     69:  * Return a base64 encoded "ASCII armoured" version of a raw signature.
                     70:  */
                     71: int sshsig_armor(const struct sshbuf *blob, struct sshbuf **out);
                     72:
                     73: /*
                     74:  * Decode a base64 encoded armoured signature to a raw signature.
                     75:  */
                     76: int sshsig_dearmor(struct sshbuf *sig, struct sshbuf **out);
                     77:
                     78: /*
                     79:  * Checks whether a particular key/principal/namespace is permitted by
                     80:  * an allowed_keys file. Returns 0 on success.
                     81:  */
                     82: int sshsig_check_allowed_keys(const char *path, const struct sshkey *sign_key,
                     83:     const char *principal, const char *ns);
1.3     ! djm        84:
        !            85: /* Parse zero or more allowed_keys signature options */
        !            86: struct sshsigopt *sshsigopt_parse(const char *opts,
        !            87:     const char *path, u_long linenum, const char **errstrp);
        !            88:
        !            89: /* Free signature options */
        !            90: void sshsigopt_free(struct sshsigopt *opts);
1.1       djm        91:
                     92: #endif /* SSHSIG_H */