1 /*
2  * Copyright (C) the libgit2 contributors. All rights reserved.
3  *
4  * This file is part of libgit2, distributed under the GNU GPL v2 with
5  * a Linking Exception. For full terms see the included COPYING file.
6  */
7 #ifndef INCLUDE_git_cert_h__
8 #define INCLUDE_git_cert_h__
9 
10 #include "common.h"
11 
12 /**
13  * @file git2/cert.h
14  * @brief Git certificate objects
15  * @defgroup git_cert Certificate objects
16  * @ingroup Git
17  * @{
18  */
19 GIT_BEGIN_DECL
20 
21 /**
22  * Type of host certificate structure that is passed to the check callback
23  */
24 typedef enum git_cert_t {
25 	/**
26 	 * No information about the certificate is available. This may
27 	 * happen when using curl.
28 	 */
29 	GIT_CERT_NONE,
30 	/**
31 	 * The `data` argument to the callback will be a pointer to
32 	 * the DER-encoded data.
33 	 */
34 	GIT_CERT_X509,
35 	/**
36 	 * The `data` argument to the callback will be a pointer to a
37 	 * `git_cert_hostkey` structure.
38 	 */
39 	GIT_CERT_HOSTKEY_LIBSSH2,
40 	/**
41 	 * The `data` argument to the callback will be a pointer to a
42 	 * `git_strarray` with `name:content` strings containing
43 	 * information about the certificate. This is used when using
44 	 * curl.
45 	 */
46 	GIT_CERT_STRARRAY,
47 } git_cert_t;
48 
49 /**
50  * Parent type for `git_cert_hostkey` and `git_cert_x509`.
51  */
52 struct git_cert {
53 	/**
54 	 * Type of certificate. A `GIT_CERT_` value.
55 	 */
56 	git_cert_t cert_type;
57 };
58 
59 /**
60  * Callback for the user's custom certificate checks.
61  *
62  * @param cert The host certificate
63  * @param valid Whether the libgit2 checks (OpenSSL or WinHTTP) think
64  * this certificate is valid
65  * @param host Hostname of the host libgit2 connected to
66  * @param payload Payload provided by the caller
67  * @return 0 to proceed with the connection, < 0 to fail the connection
68  *         or > 0 to indicate that the callback refused to act and that
69  *         the existing validity determination should be honored
70  */
71 typedef int GIT_CALLBACK(git_transport_certificate_check_cb)(git_cert *cert, int valid, const char *host, void *payload);
72 
73 /**
74  * Type of SSH host fingerprint
75  */
76 typedef enum {
77 	/** MD5 is available */
78 	GIT_CERT_SSH_MD5 = (1 << 0),
79 	/** SHA-1 is available */
80 	GIT_CERT_SSH_SHA1 = (1 << 1),
81 	/** SHA-256 is available */
82 	GIT_CERT_SSH_SHA256 = (1 << 2),
83 	/** Raw hostkey is available */
84 	GIT_CERT_SSH_RAW = (1 << 3),
85 } git_cert_ssh_t;
86 
87 typedef enum {
88 	/** The raw key is of an unknown type. */
89 	GIT_CERT_SSH_RAW_TYPE_UNKNOWN = 0,
90 	/** The raw key is an RSA key. */
91 	GIT_CERT_SSH_RAW_TYPE_RSA = 1,
92 	/** The raw key is a DSS key. */
93 	GIT_CERT_SSH_RAW_TYPE_DSS = 2,
94 	/** The raw key is a ECDSA 256 key. */
95 	GIT_CERT_SSH_RAW_TYPE_KEY_ECDSA_256 = 3,
96 	/** The raw key is a ECDSA 384 key. */
97 	GIT_CERT_SSH_RAW_TYPE_KEY_ECDSA_384 = 4,
98 	/** The raw key is a ECDSA 521 key. */
99 	GIT_CERT_SSH_RAW_TYPE_KEY_ECDSA_521 = 5,
100 	/** The raw key is a ED25519 key. */
101 	GIT_CERT_SSH_RAW_TYPE_KEY_ED25519 = 6
102 } git_cert_ssh_raw_type_t;
103 
104 /**
105  * Hostkey information taken from libssh2
106  */
107 typedef struct {
108 	git_cert parent; /**< The parent cert */
109 
110 	/**
111 	 * A bitmask containing the available fields.
112 	 */
113 	git_cert_ssh_t type;
114 
115 	/**
116 	 * Hostkey hash. If `type` has `GIT_CERT_SSH_MD5` set, this will
117 	 * have the MD5 hash of the hostkey.
118 	 */
119 	unsigned char hash_md5[16];
120 
121 	/**
122 	 * Hostkey hash. If `type` has `GIT_CERT_SSH_SHA1` set, this will
123 	 * have the SHA-1 hash of the hostkey.
124 	 */
125 	unsigned char hash_sha1[20];
126 
127 	/**
128 	 * Hostkey hash. If `type` has `GIT_CERT_SSH_SHA256` set, this will
129 	 * have the SHA-256 hash of the hostkey.
130 	 */
131 	unsigned char hash_sha256[32];
132 
133 	/**
134 	 * Raw hostkey type. If `type` has `GIT_CERT_SSH_RAW` set, this will
135 	 * have the type of the raw hostkey.
136 	 */
137 	git_cert_ssh_raw_type_t raw_type;
138 
139 	/**
140 	 * Pointer to the raw hostkey. If `type` has `GIT_CERT_SSH_RAW` set,
141 	 * this will have the raw contents of the hostkey.
142 	 */
143 	const char *hostkey;
144 
145 	/**
146 	 * Raw hostkey length. If `type` has `GIT_CERT_SSH_RAW` set, this will
147 	 * have the length of the raw contents of the hostkey.
148 	 */
149 	size_t hostkey_len;
150 } git_cert_hostkey;
151 
152 /**
153  * X.509 certificate information
154  */
155 typedef struct {
156 	git_cert parent; /**< The parent cert */
157 
158 	/**
159 	 * Pointer to the X.509 certificate data
160 	 */
161 	void *data;
162 
163 	/**
164 	 * Length of the memory block pointed to by `data`.
165 	 */
166 	size_t len;
167 } git_cert_x509;
168 
169 /** @} */
170 GIT_END_DECL
171 #endif
172