24 #define KRL_MAGIC "SSHKRL\n\0"
25 #define KRL_FORMAT_VERSION 1
28 #define KRL_SECTION_CERTIFICATES 1
29 #define KRL_SECTION_EXPLICIT_KEY 2
30 #define KRL_SECTION_FINGERPRINT_SHA1 3
31 #define KRL_SECTION_SIGNATURE 4
32 #define KRL_SECTION_FINGERPRINT_SHA256 5
35 #define KRL_SECTION_CERT_SERIAL_LIST 0x20
36 #define KRL_SECTION_CERT_SERIAL_RANGE 0x21
37 #define KRL_SECTION_CERT_SERIAL_BITMAP 0x22
38 #define KRL_SECTION_CERT_KEY_ID 0x23
44 struct ssh_krl *ssh_krl_init(
void);
45 void ssh_krl_free(
struct ssh_krl *krl);
46 void ssh_krl_set_version(
struct ssh_krl *krl, u_int64_t version);
47 int ssh_krl_set_comment(
struct ssh_krl *krl,
const char *comment);
48 int ssh_krl_revoke_cert_by_serial(
struct ssh_krl *krl,
49 const struct sshkey *ca_key, u_int64_t serial);
50 int ssh_krl_revoke_cert_by_serial_range(
struct ssh_krl *krl,
51 const struct sshkey *ca_key, u_int64_t lo, u_int64_t hi);
52 int ssh_krl_revoke_cert_by_key_id(
struct ssh_krl *krl,
53 const struct sshkey *ca_key,
const char *key_id);
54 int ssh_krl_revoke_key_explicit(
struct ssh_krl *krl,
const struct sshkey *key);
55 int ssh_krl_revoke_key_sha1(
struct ssh_krl *krl,
const u_char *p,
size_t len);
56 int ssh_krl_revoke_key_sha256(
struct ssh_krl *krl,
const u_char *p,
size_t len);
57 int ssh_krl_revoke_key(
struct ssh_krl *krl,
const struct sshkey *key);
58 int ssh_krl_to_blob(
struct ssh_krl *krl,
struct sshbuf *buf,
59 struct sshkey **sign_keys, u_int nsign_keys);
60 int ssh_krl_from_blob(
struct sshbuf *buf,
struct ssh_krl **krlp,
61 const struct sshkey **sign_ca_keys,
size_t nsign_ca_keys);
62 int ssh_krl_check_key(
struct ssh_krl *krl,
const struct sshkey *key);
63 int ssh_krl_file_contains_key(
const char *path,
const struct sshkey *key);
64 int krl_dump(
struct ssh_krl *krl, FILE *f);