Mario Fetka
110 lines
3.8 KiB
C
110 lines
3.8 KiB
C
/****************************************************************************
|
|
* <Novell-copyright>
|
|
* Copyright (c) 2001 Novell, Inc. All Rights Reserved.
|
|
*
|
|
* This program is free software; you can redistribute it and/or
|
|
* modify it under the terms of version 2 of the GNU General Public License
|
|
* as published by the Free Software Foundation.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program; if not, contact Novell, Inc.
|
|
*
|
|
* To contact Novell about this file by physical or electronic mail, you
|
|
* may find current contact information at www.novell.com.
|
|
* </Novell-copyright>
|
|
****************************************************************************/
|
|
|
|
#ifndef BONGO_ACME_H
|
|
#define BONGO_ACME_H
|
|
|
|
#include <stddef.h>
|
|
#include <sys/types.h>
|
|
#include <time.h>
|
|
|
|
#ifdef __cplusplus
|
|
extern "C" {
|
|
#endif
|
|
|
|
#define BONGO_ACME_URL_SIZE 2048
|
|
#define BONGO_ACME_ERROR_SIZE 1024
|
|
|
|
typedef struct BongoAcmeConfiguration {
|
|
const char *directory_url;
|
|
const char *contact_email;
|
|
const char *profile;
|
|
const char *challenge_type;
|
|
const char *challenge_directory;
|
|
const char *dns_provider_config_path;
|
|
const char *account_key_path;
|
|
const char *candidate_key_path;
|
|
const char *candidate_certificate_path;
|
|
const char *certificate_path;
|
|
const char *private_key_path;
|
|
const char *ca_file;
|
|
int terms_of_service_agreed;
|
|
unsigned int certificate_key_bits;
|
|
int connect_timeout_seconds;
|
|
int operation_timeout_seconds;
|
|
unsigned int dns_ttl_seconds;
|
|
int dns_propagation_timeout_seconds;
|
|
int dns_poll_interval_seconds;
|
|
int ari_min_check_seconds;
|
|
int ari_max_check_seconds;
|
|
int fallback_renewal_percent;
|
|
} BongoAcmeConfiguration;
|
|
|
|
typedef struct BongoAcmeReport {
|
|
int certificate_renewed;
|
|
int ari_supported;
|
|
int ari_used;
|
|
time_t next_check;
|
|
time_t retry_after;
|
|
time_t certificate_not_after;
|
|
char explanation_url[BONGO_ACME_URL_SIZE];
|
|
} BongoAcmeReport;
|
|
|
|
/*
|
|
* Complete one RFC 8555 / RFC 9773 maintenance pass. A return value of one
|
|
* means the pass completed (including "not due yet"); zero means a retryable
|
|
* or permanent error described in error. The caller must persist and honor
|
|
* report.next_check even when the return value is zero.
|
|
*/
|
|
int BongoAcmeMaintain(const BongoAcmeConfiguration *configuration,
|
|
const char *const *dns_names, size_t dns_name_count,
|
|
int force_renewal, BongoAcmeReport *report,
|
|
char *error, size_t error_size);
|
|
|
|
/*
|
|
* Inspect a PEM certificate using a lifetime-relative fallback schedule.
|
|
* Returns 1 when renewal is due, 0 when it is not due, and -1 on error.
|
|
*/
|
|
int BongoAcmeCertificateNeedsRenewal(
|
|
const char *certificate_path, const char *const *dns_names,
|
|
size_t dns_name_count, int fallback_renewal_percent, time_t now,
|
|
time_t *not_after, time_t *fallback_renewal_time,
|
|
char *error, size_t error_size);
|
|
|
|
/* RFC 9773 certificate identifier: base64url(AKI).base64url(serial). */
|
|
int BongoAcmeCertificateIdentifier(const char *certificate_path,
|
|
char **identifier,
|
|
char *error, size_t error_size);
|
|
|
|
/* Atomically deploy the validated candidate. Must be called with root euid. */
|
|
int BongoAcmeInstallCandidate(const BongoAcmeConfiguration *configuration,
|
|
uid_t owner, gid_t service_group,
|
|
char *error, size_t error_size);
|
|
|
|
/* Binary-safe unpadded RFC 4648 base64url helper. */
|
|
char *BongoAcmeBase64UrlEncode(const void *data, size_t length);
|
|
|
|
#ifdef __cplusplus
|
|
}
|
|
#endif
|
|
|
|
#endif
|