mirror of
https://github.com/haproxy/haproxy.git
synced 2026-05-21 09:25:29 -04:00
c9e76e5bb1
New jws_b64_hmac_signature() duplicates the same functionality as jws_b64_signature(), but for the use case of HMAC signing. Intended to be used for ACME EAB. OpenSSL allows to use EVP_PKEY for HMAC functionality, so jws_b64_signature() could be reused, but the problem is that although isn't deprecated it was removed in BoringSSL, and was removed (due to BoringSSL roots) but then readded back in AWS-LC, because of "legacy clients" (citing them), for that reason alone I say that having a dedicated function for hmac is better, HMAC() macro seems to be widely supported unlike other ways of doing same thing. Another alternative would be to use EVP_MD API, but it was introduced in OpenSSL 3.0, so not as widely supported.
19 lines
979 B
C
19 lines
979 B
C
/* SPDX-License-Identifier: LGPL-2.1-or-later */
|
|
|
|
#ifndef _HAPROXY_JWK_H_
|
|
#define _HAPROXY_JWK_H_
|
|
|
|
#include <haproxy/openssl-compat.h>
|
|
#include <haproxy/jwt-t.h>
|
|
|
|
size_t bn2base64url(const BIGNUM *bn, char *dst, size_t dsize);
|
|
size_t EVP_PKEY_to_pub_jwk(EVP_PKEY *pkey, char *dst, size_t dsize);
|
|
enum jwt_alg EVP_PKEY_to_jws_alg(EVP_PKEY *pkey);
|
|
size_t jws_b64_payload(char *payload, char *dst, size_t dsize);
|
|
size_t jws_b64_protected(enum jwt_alg alg, char *kid, char *jwk, char *nonce, char *url, char *dst, size_t dsize);
|
|
size_t jws_b64_hmac_signature(char *key, size_t key_len, enum jwt_alg alg, char *b64protected, char *b64payload, char *dst, size_t dsize);
|
|
size_t jws_b64_signature(EVP_PKEY *pkey, enum jwt_alg alg, char *b64protected, char *b64payload, char *dst, size_t dsize);
|
|
size_t jws_flattened(char *protected, char *payload, char *signature, char *dst, size_t dsize);
|
|
size_t jws_thumbprint(EVP_PKEY *pkey, char *dst, size_t dsize);
|
|
|
|
#endif /* ! _HAPROXY_JWK_H_ */
|