Estonian ID Card C-library
DigiDocVerify.h
1 #ifndef __DIGIDOC_VERIFY_H__
2 #define __DIGIDOC_VERIFY_H__
3 //==================================================
4 // FILE: DigiDocVerify.h
5 // PROJECT: Digi Doc
6 // DESCRIPTION: DigiDoc verification routines
7 // AUTHOR: Veiko Sinivee, S|E|B IT Partner Estonia
8 //==================================================
9 // Copyright (C) AS Sertifitseerimiskeskus
10 // This library is free software; you can redistribute it and/or
11 // modify it under the terms of the GNU Lesser General Public
12 // License as published by the Free Software Foundation; either
13 // version 2.1 of the License, or (at your option) any later version.
14 // This library is distributed in the hope that it will be useful,
15 // but WITHOUT ANY WARRANTY; without even the implied warranty of
16 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17 // Lesser General Public License for more details.
18 // GNU Lesser General Public Licence is available at
19 // http://www.gnu.org/copyleft/lesser.html
20 //==========< HISTORY >=============================
21 // 26.04.2006 Veiko Sinivee
22 // Creation
23 //==================================================
24 
25 #include "DigiDocDefs.h"
26 #include "DigiDocObj.h"
27 #include "DigiDocMem.h"
28 #include <openssl/x509.h>
29 #include <openssl/ocsp.h>
30 
31 //==========< XML generation routines >========================
32 
33 #ifdef __cplusplus
34 extern "C" {
35 #endif
36 
37 // Holds info of an xml element used in signature format
38 typedef struct XmlElemDef_st {
39  char* szTag; // element tag
40  char bMultiple; // 'Y' if multiple elements allowed, 'N' if not
41  void** pChildren; // list of children terminated by NULL
42 } XmlElemDef;
43 
44 // Holds info of an xml element used in signature format
45 typedef struct XmlElemInfo_st {
46  char* szId; // element tag
47  char* szTag; // element tag
48  void* pParent; // parent emenent info if exists
49  void** pChildren; // list of children terminated by NULL
50 } XmlElemInfo;
51 
52 int XmlElemInfo_new(XmlElemInfo **ppXi, const char* id, const char* tag);
53 
54 void XmlElemInfo_free(XmlElemInfo* pXi);
55 
56 int XmlElemInfo_countChildren(XmlElemInfo* pXi);
57 
58 int XmlElemInfo_addChild(XmlElemInfo* pParent, XmlElemInfo* pChild);
59 
60 XmlElemInfo* XmlElemInfo_getRootElem(XmlElemInfo* pElem);
61 
62 // verifies files signature
63 EXP_OPTION int verifyFileSignature(const char* szFileName, int nDigestType,
64  byte* pSigBuf, int nSigLen,
65  const char *certfile);
66 
67 
68 // Compares two byte arrays and returns 0 for OK
69 EXP_OPTION int compareByteArrays(const byte* dig1, int len1, const byte* dig2, int len2);
70 
71 // verifies one doc's check digests in this signature
72 EXP_OPTION int verifySigDocDigest(const SignedDoc* pSigDoc, const SignatureInfo* pSigInfo,
73  const DocInfo* pDocInfo, const char* szDataFile);
74 // verifies the mime digest of this doc in this signature
75 EXP_OPTION int verifySigDocMimeDigest(const SignedDoc* pSigDoc, const SignatureInfo* pSigInfo,
76  const DocInfo* pDocInfo, const char* szFileName);
77 
78 // verifies this one signature
79 EXP_OPTION int verifySignatureInfo(const SignedDoc* pSigDoc, const SignatureInfo* pSigInfo,
80  const char* signerCA, const char* szDataFile, int bUseCA);
81 
82 // verifies the whole document (returns on first err)
83 EXP_OPTION int verifySigDoc(const SignedDoc* pSigDoc, const char* signerCA,
84  const char** caFiles, const char* caPath, const char* notCert,
85  const char* szDataFile, int bUseCA);
86 
87 
88 // Verifies the certificates signed attributes
89 EXP_OPTION int verifySigCert(const SignatureInfo* pSigInfo);
90 
91 
92 // Verfies NotaryInfo signature
93 EXP_OPTION int verifyNotaryInfo(const SignedDoc* pSigDoc, const SignatureInfo* pSigInfo,
94  const NotaryInfo* pNotInfo,
95  const char ** caFiles, const char *CApath, const char* notCertFile);
96 
97 // Verifies the certificates signed attributes
98 EXP_OPTION int verifyNotCert(const SignatureInfo* pSigInfo, const NotaryInfo* pNotInfo);
99 
100 // Verfies NotaryInfo digest
101 EXP_OPTION int verifyNotaryDigest(const SignedDoc* pSigDoc, const NotaryInfo* pNotInfo);
102 
103 // verifies signed doc
104 EXP_OPTION int verifySigDocCERT(const SignedDoc* pSigDoc, const void* signerCA,
105  const X509** caCerts,
106  const char* caPath, const X509* notCert,
107  const char* szDataFile, int bUseCA);
108 
109 
110 // Verifies this signature
111  EXP_OPTION int verifySignatureInfoCERT(const SignedDoc* pSigDoc,
112  const SignatureInfo* pSigInfo,
113  const void* signerCACert, const char* szDataFile, int bUseCA);
114 
115 // Checks if the cert has been signed by this CA-cert
116 EXP_OPTION int isCertSignedByCERT(const X509* cert, const X509* caCert);
117 
118 
119 // Verfies NotaryInfo signature
120 EXP_OPTION int verifyNotaryInfoCERT(const SignedDoc* pSigDoc,
121  const SignatureInfo* pSigInfo,
122  const NotaryInfo* pNotInfo,
123  const X509** caCerts,
124  const char *CApath, const X509* notCert);
125 
126 //--------------------------------------------------
127 // Verfies NotaryInfo signature
128 // pSigDoc - signed doc object
129 // pNotInfo - NotaryInfo object
130 // caCerts - CA certificate pointer array terminated with NULL
131 // CApath - path to (directory) all certs
132 // notCertFile - Notary (e.g. OCSP responder) cert file
133 // pSigCa - signers ca cert
134 //--------------------------------------------------
135 EXP_OPTION int verifyNotaryInfoCERT2(const SignedDoc* pSigDoc,
136  const SignatureInfo* pSigInfo,
137  const NotaryInfo* pNotInfo,
138  const X509** caCerts, const char *CApath,
139  const X509* notCert, const X509* pSigCa);
140 
141 EXP_OPTION int verifySigDocSigPropDigest(const SignatureInfo* pSigInfo);
142 
143 // Calculates the digest of NotaryInfo
144 EXP_OPTION int calculateNotaryInfoDigest(const SignedDoc* pSigDoc,
145  const NotaryInfo* pNotInfo, byte* digBuf, int* digLen);
146 
147 int readTagContents(char** data, const char* fileName,
148  const char* tagName, int nAttrs,
149  const char** attNames, const char** attValues,
150  int withTags);
151 
152  X509_ALGOR* setSignAlgorithm(const EVP_MD * type);
153 
154 int setup_verifyCERT(X509_STORE **newX509_STORE,
155  const char *CApath,
156  const X509** certs);
157 
158 EXP_OPTION int verifyEstIDSignature(const byte* digest, int digestLen, int nDigestType,
159  byte* pSigBuf, int nSigLen, X509* cert);
160 EXP_OPTION int verifyEstIDSignature2(const byte* digest, int digestLen, int nDigestType,
161  byte* pSigBuf, int nSigLen, X509* cert);
162 
163 //===========================================================
164 // Checks and records the knowledge if one signature had
165 // missing xmlns problem
166 // pSigDoc - signed doc data
167 // returns 1 if at least one signature had this problem
168 //============================================================
169 EXP_OPTION int checkDdocWrongDigests(const SignedDoc* pSigDoc);
170 
171 
172 #ifdef __cplusplus
173 }
174 #endif
175 
176 #endif // __DIGIDOC_VERIFY_H__
177 
178 
SignatureInfo_st
Definition: DigiDocObj.h:154
NotaryInfo_sk
Definition: DigiDocObj.h:139
XmlElemInfo_st
Definition: DigiDocVerify.h:45
SignedDoc_st
Definition: DigiDocObj.h:177
XmlElemDef_st
Definition: DigiDocVerify.h:38
DocInfo_st
Definition: DigiDocObj.h:38