| OLD | NEW |
|---|
| (Empty) |
| 1 /* This Source Code Form is subject to the terms of the Mozilla Public | |
| 2 * License, v. 2.0. If a copy of the MPL was not distributed with this | |
| 3 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ | |
| 4 | |
| 5 /* | |
| 6 * cert.h - public data structures and prototypes for the certificate library | |
| 7 * | |
| 8 * $Id: cert.h,v 1.91 2012/09/28 16:05:02 wtc%google.com Exp $ | |
| 9 */ | |
| 10 | |
| 11 #ifndef _CERT_H_ | |
| 12 #define _CERT_H_ | |
| 13 | |
| 14 #include "utilrename.h" | |
| 15 #include "plarena.h" | |
| 16 #include "plhash.h" | |
| 17 #include "prlong.h" | |
| 18 #include "prlog.h" | |
| 19 | |
| 20 #include "seccomon.h" | |
| 21 #include "secdert.h" | |
| 22 #include "secoidt.h" | |
| 23 #include "keyt.h" | |
| 24 #include "certt.h" | |
| 25 | |
| 26 SEC_BEGIN_PROTOS | |
| 27 | |
| 28 /**************************************************************************** | |
| 29 * | |
| 30 * RFC1485 ascii to/from X.? RelativeDistinguishedName (aka CERTName) | |
| 31 * | |
| 32 ****************************************************************************/ | |
| 33 | |
| 34 /* | |
| 35 ** Convert an ascii RFC1485 encoded name into its CERTName equivalent. | |
| 36 */ | |
| 37 extern CERTName *CERT_AsciiToName(const char *string); | |
| 38 | |
| 39 /* | |
| 40 ** Convert an CERTName into its RFC1485 encoded equivalent. | |
| 41 ** Returns a string that must be freed with PORT_Free(). | |
| 42 ** This version produces a string for maximum human readability, | |
| 43 ** not for strict RFC compliance. | |
| 44 */ | |
| 45 extern char *CERT_NameToAscii(CERTName *name); | |
| 46 | |
| 47 /* | |
| 48 ** Convert an CERTName into its RFC1485 encoded equivalent. | |
| 49 ** Returns a string that must be freed with PORT_Free(). | |
| 50 ** Caller chooses encoding rules. | |
| 51 */ | |
| 52 extern char *CERT_NameToAsciiInvertible(CERTName *name, | |
| 53 CertStrictnessLevel strict); | |
| 54 | |
| 55 extern CERTAVA *CERT_CopyAVA(PLArenaPool *arena, CERTAVA *src); | |
| 56 | |
| 57 /* convert an OID to dotted-decimal representation */ | |
| 58 /* Returns a string that must be freed with PR_smprintf_free(). */ | |
| 59 extern char * CERT_GetOidString(const SECItem *oid); | |
| 60 | |
| 61 /* | |
| 62 ** Examine an AVA and return the tag that refers to it. The AVA tags are | |
| 63 ** defined as SEC_OID_AVA*. | |
| 64 */ | |
| 65 extern SECOidTag CERT_GetAVATag(CERTAVA *ava); | |
| 66 | |
| 67 /* | |
| 68 ** Compare two AVA's, returning the difference between them. | |
| 69 */ | |
| 70 extern SECComparison CERT_CompareAVA(const CERTAVA *a, const CERTAVA *b); | |
| 71 | |
| 72 /* | |
| 73 ** Create an RDN (relative-distinguished-name). The argument list is a | |
| 74 ** NULL terminated list of AVA's. | |
| 75 */ | |
| 76 extern CERTRDN *CERT_CreateRDN(PLArenaPool *arena, CERTAVA *avas, ...); | |
| 77 | |
| 78 /* | |
| 79 ** Make a copy of "src" storing it in "dest". | |
| 80 */ | |
| 81 extern SECStatus CERT_CopyRDN(PLArenaPool *arena, CERTRDN *dest, CERTRDN *src); | |
| 82 | |
| 83 /* | |
| 84 ** Destory an RDN object. | |
| 85 ** "rdn" the RDN to destroy | |
| 86 ** "freeit" if PR_TRUE then free the object as well as its sub-objects | |
| 87 */ | |
| 88 extern void CERT_DestroyRDN(CERTRDN *rdn, PRBool freeit); | |
| 89 | |
| 90 /* | |
| 91 ** Add an AVA to an RDN. | |
| 92 ** "rdn" the RDN to add to | |
| 93 ** "ava" the AVA to add | |
| 94 */ | |
| 95 extern SECStatus CERT_AddAVA(PLArenaPool *arena, CERTRDN *rdn, CERTAVA *ava); | |
| 96 | |
| 97 /* | |
| 98 ** Compare two RDN's, returning the difference between them. | |
| 99 */ | |
| 100 extern SECComparison CERT_CompareRDN(const CERTRDN *a, const CERTRDN *b); | |
| 101 | |
| 102 /* | |
| 103 ** Create an X.500 style name using a NULL terminated list of RDN's. | |
| 104 */ | |
| 105 extern CERTName *CERT_CreateName(CERTRDN *rdn, ...); | |
| 106 | |
| 107 /* | |
| 108 ** Make a copy of "src" storing it in "dest". Memory is allocated in | |
| 109 ** "dest" for each of the appropriate sub objects. Memory is not freed in | |
| 110 ** "dest" before allocation is done (use CERT_DestroyName(dest, PR_FALSE) to | |
| 111 ** do that). | |
| 112 */ | |
| 113 extern SECStatus CERT_CopyName(PLArenaPool *arena, CERTName *dest, CERTName *src
); | |
| 114 | |
| 115 /* | |
| 116 ** Destroy a Name object. | |
| 117 ** "name" the CERTName to destroy | |
| 118 ** "freeit" if PR_TRUE then free the object as well as its sub-objects | |
| 119 */ | |
| 120 extern void CERT_DestroyName(CERTName *name); | |
| 121 | |
| 122 /* | |
| 123 ** Add an RDN to a name. | |
| 124 ** "name" the name to add the RDN to | |
| 125 ** "rdn" the RDN to add to name | |
| 126 */ | |
| 127 extern SECStatus CERT_AddRDN(CERTName *name, CERTRDN *rdn); | |
| 128 | |
| 129 /* | |
| 130 ** Compare two names, returning the difference between them. | |
| 131 */ | |
| 132 extern SECComparison CERT_CompareName(const CERTName *a, const CERTName *b); | |
| 133 | |
| 134 /* | |
| 135 ** Convert a CERTName into something readable | |
| 136 */ | |
| 137 extern char *CERT_FormatName (CERTName *name); | |
| 138 | |
| 139 /* | |
| 140 ** Convert a der-encoded integer to a hex printable string form. | |
| 141 ** Perhaps this should be a SEC function but it's only used for certs. | |
| 142 */ | |
| 143 extern char *CERT_Hexify (SECItem *i, int do_colon); | |
| 144 | |
| 145 /* | |
| 146 ** Converts DER string (with explicit length) into zString, if destination | |
| 147 ** buffer is big enough to receive it. Does quoting and/or escaping as | |
| 148 ** specified in RFC 1485. Input string must be single or multi-byte DER | |
| 149 ** character set, (ASCII, UTF8, or ISO 8851-x) not a wide character set. | |
| 150 ** Returns SECSuccess or SECFailure with error code set. If output buffer | |
| 151 ** is too small, sets error code SEC_ERROR_OUTPUT_LEN. | |
| 152 */ | |
| 153 extern SECStatus | |
| 154 CERT_RFC1485_EscapeAndQuote(char *dst, int dstlen, char *src, int srclen); | |
| 155 | |
| 156 /****************************************************************************** | |
| 157 * | |
| 158 * Certificate handling operations | |
| 159 * | |
| 160 *****************************************************************************/ | |
| 161 | |
| 162 /* | |
| 163 ** Create a new validity object given two unix time values. | |
| 164 ** "notBefore" the time before which the validity is not valid | |
| 165 ** "notAfter" the time after which the validity is not valid | |
| 166 */ | |
| 167 extern CERTValidity *CERT_CreateValidity(PRTime notBefore, PRTime notAfter); | |
| 168 | |
| 169 /* | |
| 170 ** Destroy a validity object. | |
| 171 ** "v" the validity to destroy | |
| 172 ** "freeit" if PR_TRUE then free the object as well as its sub-objects | |
| 173 */ | |
| 174 extern void CERT_DestroyValidity(CERTValidity *v); | |
| 175 | |
| 176 /* | |
| 177 ** Copy the "src" object to "dest". Memory is allocated in "dest" for | |
| 178 ** each of the appropriate sub-objects. Memory in "dest" is not freed | |
| 179 ** before memory is allocated (use CERT_DestroyValidity(v, PR_FALSE) to do | |
| 180 ** that). | |
| 181 */ | |
| 182 extern SECStatus CERT_CopyValidity | |
| 183 (PLArenaPool *arena, CERTValidity *dest, CERTValidity *src); | |
| 184 | |
| 185 /* | |
| 186 ** The cert lib considers a cert or CRL valid if the "notBefore" time is | |
| 187 ** in the not-too-distant future, e.g. within the next 24 hours. This | |
| 188 ** prevents freshly issued certificates from being considered invalid | |
| 189 ** because the local system's time zone is incorrectly set. | |
| 190 ** The amount of "pending slop time" is adjustable by the application. | |
| 191 ** Units of SlopTime are seconds. Default is 86400 (24 hours). | |
| 192 ** Negative SlopTime values are not allowed. | |
| 193 */ | |
| 194 PRInt32 CERT_GetSlopTime(void); | |
| 195 | |
| 196 SECStatus CERT_SetSlopTime(PRInt32 slop); | |
| 197 | |
| 198 /* | |
| 199 ** Create a new certificate object. The result must be wrapped with an | |
| 200 ** CERTSignedData to create a signed certificate. | |
| 201 ** "serialNumber" the serial number | |
| 202 ** "issuer" the name of the certificate issuer | |
| 203 ** "validity" the validity period of the certificate | |
| 204 ** "req" the certificate request that prompted the certificate issuance | |
| 205 */ | |
| 206 extern CERTCertificate * | |
| 207 CERT_CreateCertificate (unsigned long serialNumber, CERTName *issuer, | |
| 208 CERTValidity *validity, CERTCertificateRequest *req); | |
| 209 | |
| 210 /* | |
| 211 ** Destroy a certificate object | |
| 212 ** "cert" the certificate to destroy | |
| 213 ** NOTE: certificate's are reference counted. This call decrements the | |
| 214 ** reference count, and if the result is zero, then the object is destroyed | |
| 215 ** and optionally freed. | |
| 216 */ | |
| 217 extern void CERT_DestroyCertificate(CERTCertificate *cert); | |
| 218 | |
| 219 /* | |
| 220 ** Make a shallow copy of a certificate "c". Just increments the | |
| 221 ** reference count on "c". | |
| 222 */ | |
| 223 extern CERTCertificate *CERT_DupCertificate(CERTCertificate *c); | |
| 224 | |
| 225 /* | |
| 226 ** Create a new certificate request. This result must be wrapped with an | |
| 227 ** CERTSignedData to create a signed certificate request. | |
| 228 ** "name" the subject name (who the certificate request is from) | |
| 229 ** "spki" describes/defines the public key the certificate is for | |
| 230 ** "attributes" if non-zero, some optional attribute data | |
| 231 */ | |
| 232 extern CERTCertificateRequest * | |
| 233 CERT_CreateCertificateRequest (CERTName *name, CERTSubjectPublicKeyInfo *spki, | |
| 234 SECItem **attributes); | |
| 235 | |
| 236 /* | |
| 237 ** Destroy a certificate-request object | |
| 238 ** "r" the certificate-request to destroy | |
| 239 ** "freeit" if PR_TRUE then free the object as well as its sub-objects | |
| 240 */ | |
| 241 extern void CERT_DestroyCertificateRequest(CERTCertificateRequest *r); | |
| 242 | |
| 243 /* | |
| 244 ** Start adding extensions to a certificate request. | |
| 245 */ | |
| 246 void * | |
| 247 CERT_StartCertificateRequestAttributes(CERTCertificateRequest *req); | |
| 248 | |
| 249 /* | |
| 250 ** Reformat the certificate extension list into a CertificateRequest | |
| 251 ** attribute list. | |
| 252 */ | |
| 253 SECStatus | |
| 254 CERT_FinishCertificateRequestAttributes(CERTCertificateRequest *req); | |
| 255 | |
| 256 /* | |
| 257 ** Extract the Extension Requests from a DER CertRequest attribute list. | |
| 258 */ | |
| 259 SECStatus | |
| 260 CERT_GetCertificateRequestExtensions(CERTCertificateRequest *req, | |
| 261 CERTCertExtension ***exts); | |
| 262 | |
| 263 /* | |
| 264 ** Extract a public key object from a certificate | |
| 265 */ | |
| 266 extern SECKEYPublicKey *CERT_ExtractPublicKey(CERTCertificate *cert); | |
| 267 | |
| 268 /* | |
| 269 ** Retrieve the Key Type associated with the cert we're dealing with | |
| 270 */ | |
| 271 | |
| 272 extern KeyType CERT_GetCertKeyType (CERTSubjectPublicKeyInfo *spki); | |
| 273 | |
| 274 /* | |
| 275 ** Initialize the certificate database. This is called to create | |
| 276 ** the initial list of certificates in the database. | |
| 277 */ | |
| 278 extern SECStatus CERT_InitCertDB(CERTCertDBHandle *handle); | |
| 279 | |
| 280 extern int CERT_GetDBContentVersion(CERTCertDBHandle *handle); | |
| 281 | |
| 282 /* | |
| 283 ** Default certificate database routines | |
| 284 */ | |
| 285 extern void CERT_SetDefaultCertDB(CERTCertDBHandle *handle); | |
| 286 | |
| 287 extern CERTCertDBHandle *CERT_GetDefaultCertDB(void); | |
| 288 | |
| 289 extern CERTCertList *CERT_GetCertChainFromCert(CERTCertificate *cert, | |
| 290 PRTime time, | |
| 291 SECCertUsage usage); | |
| 292 extern CERTCertificate * | |
| 293 CERT_NewTempCertificate (CERTCertDBHandle *handle, SECItem *derCert, | |
| 294 char *nickname, PRBool isperm, PRBool copyDER); | |
| 295 | |
| 296 | |
| 297 /****************************************************************************** | |
| 298 * | |
| 299 * X.500 Name handling operations | |
| 300 * | |
| 301 *****************************************************************************/ | |
| 302 | |
| 303 /* | |
| 304 ** Create an AVA (attribute-value-assertion) | |
| 305 ** "arena" the memory arena to alloc from | |
| 306 ** "kind" is one of SEC_OID_AVA_* | |
| 307 ** "valueType" is one of DER_PRINTABLE_STRING, DER_IA5_STRING, or | |
| 308 ** DER_T61_STRING | |
| 309 ** "value" is the null terminated string containing the value | |
| 310 */ | |
| 311 extern CERTAVA *CERT_CreateAVA | |
| 312 (PLArenaPool *arena, SECOidTag kind, int valueType, char *value); | |
| 313 | |
| 314 /* | |
| 315 ** Extract the Distinguished Name from a DER encoded certificate | |
| 316 ** "derCert" is the DER encoded certificate | |
| 317 ** "derName" is the SECItem that the name is returned in | |
| 318 */ | |
| 319 extern SECStatus CERT_NameFromDERCert(SECItem *derCert, SECItem *derName); | |
| 320 | |
| 321 /* | |
| 322 ** Extract the Issuers Distinguished Name from a DER encoded certificate | |
| 323 ** "derCert" is the DER encoded certificate | |
| 324 ** "derName" is the SECItem that the name is returned in | |
| 325 */ | |
| 326 extern SECStatus CERT_IssuerNameFromDERCert(SECItem *derCert, | |
| 327 SECItem *derName); | |
| 328 | |
| 329 extern SECItem * | |
| 330 CERT_EncodeGeneralName(CERTGeneralName *genName, SECItem *dest, | |
| 331 PLArenaPool *arena); | |
| 332 | |
| 333 extern CERTGeneralName * | |
| 334 CERT_DecodeGeneralName(PLArenaPool *reqArena, SECItem *encodedName, | |
| 335 CERTGeneralName *genName); | |
| 336 | |
| 337 | |
| 338 | |
| 339 /* | |
| 340 ** Generate a database search key for a certificate, based on the | |
| 341 ** issuer and serial number. | |
| 342 ** "arena" the memory arena to alloc from | |
| 343 ** "derCert" the DER encoded certificate | |
| 344 ** "key" the returned key | |
| 345 */ | |
| 346 extern SECStatus CERT_KeyFromDERCert(PLArenaPool *reqArena, SECItem *derCert, | |
| 347 SECItem *key); | |
| 348 | |
| 349 extern SECStatus CERT_KeyFromIssuerAndSN(PLArenaPool *arena, SECItem *issuer, | |
| 350 SECItem *sn, SECItem *key); | |
| 351 | |
| 352 extern SECStatus CERT_SerialNumberFromDERCert(SECItem *derCert, | |
| 353 SECItem *derName); | |
| 354 | |
| 355 | |
| 356 /* | |
| 357 ** Generate a database search key for a crl, based on the | |
| 358 ** issuer. | |
| 359 ** "arena" the memory arena to alloc from | |
| 360 ** "derCrl" the DER encoded crl | |
| 361 ** "key" the returned key | |
| 362 */ | |
| 363 extern SECStatus CERT_KeyFromDERCrl(PLArenaPool *arena, SECItem *derCrl, SECItem
*key); | |
| 364 | |
| 365 /* | |
| 366 ** Open the certificate database. Use callback to get name of database. | |
| 367 */ | |
| 368 extern SECStatus CERT_OpenCertDB(CERTCertDBHandle *handle, PRBool readOnly, | |
| 369 CERTDBNameFunc namecb, void *cbarg); | |
| 370 | |
| 371 /* Open the certificate database. Use given filename for database. */ | |
| 372 extern SECStatus CERT_OpenCertDBFilename(CERTCertDBHandle *handle, | |
| 373 char *certdbname, PRBool readOnly); | |
| 374 | |
| 375 /* | |
| 376 ** Open and initialize a cert database that is entirely in memory. This | |
| 377 ** can be used when the permanent database can not be opened or created. | |
| 378 */ | |
| 379 extern SECStatus CERT_OpenVolatileCertDB(CERTCertDBHandle *handle); | |
| 380 | |
| 381 /* | |
| 382 ** Extract the list of host names, host name patters, IP address strings | |
| 383 ** this cert is valid for. | |
| 384 ** This function does NOT return nicknames. | |
| 385 ** Type CERTCertNicknames is being used because it's a convenient | |
| 386 ** data structure to carry a list of strings and its count. | |
| 387 */ | |
| 388 extern CERTCertNicknames * | |
| 389 CERT_GetValidDNSPatternsFromCert(CERTCertificate *cert); | |
| 390 | |
| 391 /* | |
| 392 ** Check the hostname to make sure that it matches the shexp that | |
| 393 ** is given in the common name of the certificate. | |
| 394 */ | |
| 395 extern SECStatus CERT_VerifyCertName(CERTCertificate *cert, const char *hostname
); | |
| 396 | |
| 397 /* | |
| 398 ** Add a domain name to the list of names that the user has explicitly | |
| 399 ** allowed (despite cert name mismatches) for use with a server cert. | |
| 400 */ | |
| 401 extern SECStatus CERT_AddOKDomainName(CERTCertificate *cert, const char *hostnam
e); | |
| 402 | |
| 403 /* | |
| 404 ** Decode a DER encoded certificate into an CERTCertificate structure | |
| 405 ** "derSignedCert" is the DER encoded signed certificate | |
| 406 ** "copyDER" is true if the DER should be copied, false if the | |
| 407 ** existing copy should be referenced | |
| 408 ** "nickname" is the nickname to use in the database. If it is NULL | |
| 409 ** then a temporary nickname is generated. | |
| 410 */ | |
| 411 extern CERTCertificate * | |
| 412 CERT_DecodeDERCertificate (SECItem *derSignedCert, PRBool copyDER, char *nicknam
e); | |
| 413 /* | |
| 414 ** Decode a DER encoded CRL into a CERTSignedCrl structure | |
| 415 ** "derSignedCrl" is the DER encoded signed CRL. | |
| 416 ** "type" must be SEC_CRL_TYPE. | |
| 417 */ | |
| 418 #define SEC_CRL_TYPE 1 | |
| 419 #define SEC_KRL_TYPE 0 /* deprecated */ | |
| 420 | |
| 421 extern CERTSignedCrl * | |
| 422 CERT_DecodeDERCrl (PLArenaPool *arena, SECItem *derSignedCrl,int type); | |
| 423 | |
| 424 /* | |
| 425 * same as CERT_DecodeDERCrl, plus allow options to be passed in | |
| 426 */ | |
| 427 | |
| 428 extern CERTSignedCrl * | |
| 429 CERT_DecodeDERCrlWithFlags(PLArenaPool *narena, SECItem *derSignedCrl, | |
| 430 int type, PRInt32 options); | |
| 431 | |
| 432 /* CRL options to pass */ | |
| 433 | |
| 434 #define CRL_DECODE_DEFAULT_OPTIONS 0x00000000 | |
| 435 | |
| 436 /* when CRL_DECODE_DONT_COPY_DER is set, the DER is not copied . The | |
| 437 application must then keep derSignedCrl until it destroys the | |
| 438 CRL . Ideally, it should allocate derSignedCrl in an arena | |
| 439 and pass that arena in as the first argument to | |
| 440 CERT_DecodeDERCrlWithFlags */ | |
| 441 | |
| 442 #define CRL_DECODE_DONT_COPY_DER 0x00000001 | |
| 443 #define CRL_DECODE_SKIP_ENTRIES 0x00000002 | |
| 444 #define CRL_DECODE_KEEP_BAD_CRL 0x00000004 | |
| 445 #define CRL_DECODE_ADOPT_HEAP_DER 0x00000008 | |
| 446 | |
| 447 /* complete the decoding of a partially decoded CRL, ie. decode the | |
| 448 entries. Note that entries is an optional field in a CRL, so the | |
| 449 "entries" pointer in CERTCrlStr may still be NULL even after | |
| 450 function returns SECSuccess */ | |
| 451 | |
| 452 extern SECStatus CERT_CompleteCRLDecodeEntries(CERTSignedCrl* crl); | |
| 453 | |
| 454 /* Validate CRL then import it to the dbase. If there is already a CRL with the | |
| 455 * same CA in the dbase, it will be replaced if derCRL is more up to date. | |
| 456 * If the process successes, a CRL will be returned. Otherwise, a NULL will | |
| 457 * be returned. The caller should call PORT_GetError() for the exactly error | |
| 458 * code. | |
| 459 */ | |
| 460 extern CERTSignedCrl * | |
| 461 CERT_ImportCRL (CERTCertDBHandle *handle, SECItem *derCRL, char *url, | |
| 462 int type, void * wincx); | |
| 463 | |
| 464 extern void CERT_DestroyCrl (CERTSignedCrl *crl); | |
| 465 | |
| 466 /* this is a hint to flush the CRL cache. crlKey is the DER subject of | |
| 467 the issuer (CA). */ | |
| 468 void CERT_CRLCacheRefreshIssuer(CERTCertDBHandle* dbhandle, SECItem* crlKey); | |
| 469 | |
| 470 /* add the specified DER CRL object to the CRL cache. Doing so will allow | |
| 471 certificate verification functions (such as CERT_VerifyCertificate) | |
| 472 to automatically find and make use of this CRL object. | |
| 473 Once a CRL is added to the CRL cache, the application must hold on to | |
| 474 the object's memory, because the cache will reference it directly. The | |
| 475 application can only free the object after it calls CERT_UncacheCRL to | |
| 476 remove it from the CRL cache. | |
| 477 */ | |
| 478 SECStatus CERT_CacheCRL(CERTCertDBHandle* dbhandle, SECItem* newcrl); | |
| 479 | |
| 480 /* remove a previously added CRL object from the CRL cache. It is OK | |
| 481 for the application to free the memory after a successful removal | |
| 482 */ | |
| 483 SECStatus CERT_UncacheCRL(CERTCertDBHandle* dbhandle, SECItem* oldcrl); | |
| 484 | |
| 485 /* | |
| 486 ** Find a certificate in the database | |
| 487 ** "key" is the database key to look for | |
| 488 */ | |
| 489 extern CERTCertificate *CERT_FindCertByKey(CERTCertDBHandle *handle, SECItem *ke
y); | |
| 490 | |
| 491 /* | |
| 492 ** Find a certificate in the database by name | |
| 493 ** "name" is the distinguished name to look up | |
| 494 */ | |
| 495 extern CERTCertificate * | |
| 496 CERT_FindCertByName (CERTCertDBHandle *handle, SECItem *name); | |
| 497 | |
| 498 /* | |
| 499 ** Find a certificate in the database by name | |
| 500 ** "name" is the distinguished name to look up (in ascii) | |
| 501 */ | |
| 502 extern CERTCertificate * | |
| 503 CERT_FindCertByNameString (CERTCertDBHandle *handle, char *name); | |
| 504 | |
| 505 /* | |
| 506 ** Find a certificate in the database by name and keyid | |
| 507 ** "name" is the distinguished name to look up | |
| 508 ** "keyID" is the value of the subjectKeyID to match | |
| 509 */ | |
| 510 extern CERTCertificate * | |
| 511 CERT_FindCertByKeyID (CERTCertDBHandle *handle, SECItem *name, SECItem *keyID); | |
| 512 | |
| 513 /* | |
| 514 ** Generate a certificate key from the issuer and serialnumber, then look it | |
| 515 ** up in the database. Return the cert if found. | |
| 516 ** "issuerAndSN" is the issuer and serial number to look for | |
| 517 */ | |
| 518 extern CERTCertificate * | |
| 519 CERT_FindCertByIssuerAndSN (CERTCertDBHandle *handle, CERTIssuerAndSN *issuerAnd
SN); | |
| 520 | |
| 521 /* | |
| 522 ** Find a certificate in the database by a subject key ID | |
| 523 ** "subjKeyID" is the subject Key ID to look for | |
| 524 */ | |
| 525 extern CERTCertificate * | |
| 526 CERT_FindCertBySubjectKeyID (CERTCertDBHandle *handle, SECItem *subjKeyID); | |
| 527 | |
| 528 /* | |
| 529 ** Encode Certificate SKID (Subject Key ID) extension. | |
| 530 ** | |
| 531 */ | |
| 532 extern SECStatus | |
| 533 CERT_EncodeSubjectKeyID(PLArenaPool *arena, const SECItem* srcString, | |
| 534 SECItem *encodedValue); | |
| 535 | |
| 536 /* | |
| 537 ** Find a certificate in the database by a nickname | |
| 538 ** "nickname" is the ascii string nickname to look for | |
| 539 */ | |
| 540 extern CERTCertificate * | |
| 541 CERT_FindCertByNickname (CERTCertDBHandle *handle, const char *nickname); | |
| 542 | |
| 543 /* | |
| 544 ** Find a certificate in the database by a DER encoded certificate | |
| 545 ** "derCert" is the DER encoded certificate | |
| 546 */ | |
| 547 extern CERTCertificate * | |
| 548 CERT_FindCertByDERCert(CERTCertDBHandle *handle, SECItem *derCert); | |
| 549 | |
| 550 /* | |
| 551 ** Find a certificate in the database by a email address | |
| 552 ** "emailAddr" is the email address to look up | |
| 553 */ | |
| 554 CERTCertificate * | |
| 555 CERT_FindCertByEmailAddr(CERTCertDBHandle *handle, char *emailAddr); | |
| 556 | |
| 557 /* | |
| 558 ** Find a certificate in the database by a email address or nickname | |
| 559 ** "name" is the email address or nickname to look up | |
| 560 */ | |
| 561 CERTCertificate * | |
| 562 CERT_FindCertByNicknameOrEmailAddr(CERTCertDBHandle *handle, const char *name); | |
| 563 | |
| 564 /* | |
| 565 ** Find a certificate in the database by a email address or nickname | |
| 566 ** and require it to have the given usage. | |
| 567 ** "name" is the email address or nickname to look up | |
| 568 */ | |
| 569 CERTCertificate * | |
| 570 CERT_FindCertByNicknameOrEmailAddrForUsage(CERTCertDBHandle *handle, | |
| 571 const char *name, | |
| 572 SECCertUsage lookingForUsage); | |
| 573 | |
| 574 /* | |
| 575 ** Find a certificate in the database by a digest of a subject public key | |
| 576 ** "spkDigest" is the digest to look up | |
| 577 */ | |
| 578 extern CERTCertificate * | |
| 579 CERT_FindCertBySPKDigest(CERTCertDBHandle *handle, SECItem *spkDigest); | |
| 580 | |
| 581 /* | |
| 582 * Find the issuer of a cert | |
| 583 */ | |
| 584 CERTCertificate * | |
| 585 CERT_FindCertIssuer(CERTCertificate *cert, PRTime validTime, SECCertUsage usage)
; | |
| 586 | |
| 587 /* | |
| 588 ** Check the validity times of a certificate vs. time 't', allowing | |
| 589 ** some slop for broken clocks and stuff. | |
| 590 ** "cert" is the certificate to be checked | |
| 591 ** "t" is the time to check against | |
| 592 ** "allowOverride" if true then check to see if the invalidity has | |
| 593 ** been overridden by the user. | |
| 594 */ | |
| 595 extern SECCertTimeValidity CERT_CheckCertValidTimes(CERTCertificate *cert, | |
| 596 PRTime t, | |
| 597 PRBool allowOverride); | |
| 598 | |
| 599 /* | |
| 600 ** WARNING - this function is deprecated, and will either go away or have | |
| 601 ** a new API in the near future. | |
| 602 ** | |
| 603 ** Check the validity times of a certificate vs. the current time, allowing | |
| 604 ** some slop for broken clocks and stuff. | |
| 605 ** "cert" is the certificate to be checked | |
| 606 */ | |
| 607 extern SECStatus CERT_CertTimesValid(CERTCertificate *cert); | |
| 608 | |
| 609 /* | |
| 610 ** Extract the validity times from a certificate | |
| 611 ** "c" is the certificate | |
| 612 ** "notBefore" is the start of the validity period | |
| 613 ** "notAfter" is the end of the validity period | |
| 614 */ | |
| 615 extern SECStatus | |
| 616 CERT_GetCertTimes (CERTCertificate *c, PRTime *notBefore, PRTime *notAfter); | |
| 617 | |
| 618 /* | |
| 619 ** Extract the issuer and serial number from a certificate | |
| 620 */ | |
| 621 extern CERTIssuerAndSN *CERT_GetCertIssuerAndSN(PLArenaPool *, | |
| 622 CERTCertificate *); | |
| 623 | |
| 624 /* | |
| 625 ** verify the signature of a signed data object with a given certificate | |
| 626 ** "sd" the signed data object to be verified | |
| 627 ** "cert" the certificate to use to check the signature | |
| 628 */ | |
| 629 extern SECStatus CERT_VerifySignedData(CERTSignedData *sd, | |
| 630 CERTCertificate *cert, | |
| 631 PRTime t, | |
| 632 void *wincx); | |
| 633 /* | |
| 634 ** verify the signature of a signed data object with the given DER publickey | |
| 635 */ | |
| 636 extern SECStatus | |
| 637 CERT_VerifySignedDataWithPublicKeyInfo(CERTSignedData *sd, | |
| 638 CERTSubjectPublicKeyInfo *pubKeyInfo, | |
| 639 void *wincx); | |
| 640 | |
| 641 /* | |
| 642 ** verify the signature of a signed data object with a SECKEYPublicKey. | |
| 643 */ | |
| 644 extern SECStatus | |
| 645 CERT_VerifySignedDataWithPublicKey(CERTSignedData *sd, | |
| 646 SECKEYPublicKey *pubKey, void *wincx); | |
| 647 | |
| 648 /* | |
| 649 ** NEW FUNCTIONS with new bit-field-FIELD SECCertificateUsage - please use | |
| 650 ** verify a certificate by checking validity times against a certain time, | |
| 651 ** that we trust the issuer, and that the signature on the certificate is | |
| 652 ** valid. | |
| 653 ** "cert" the certificate to verify | |
| 654 ** "checkSig" only check signatures if true | |
| 655 */ | |
| 656 extern SECStatus | |
| 657 CERT_VerifyCertificate(CERTCertDBHandle *handle, CERTCertificate *cert, | |
| 658 PRBool checkSig, SECCertificateUsage requiredUsages, | |
| 659 PRTime t, void *wincx, CERTVerifyLog *log, | |
| 660 SECCertificateUsage* returnedUsages); | |
| 661 | |
| 662 /* same as above, but uses current time */ | |
| 663 extern SECStatus | |
| 664 CERT_VerifyCertificateNow(CERTCertDBHandle *handle, CERTCertificate *cert, | |
| 665 PRBool checkSig, SECCertificateUsage requiredUsages, | |
| 666 void *wincx, SECCertificateUsage* returnedUsages); | |
| 667 | |
| 668 /* | |
| 669 ** Verify that a CA cert can certify some (unspecified) leaf cert for a given | |
| 670 ** purpose. This is used by UI code to help identify where a chain may be | |
| 671 ** broken and why. This takes identical parameters to CERT_VerifyCert | |
| 672 */ | |
| 673 extern SECStatus | |
| 674 CERT_VerifyCACertForUsage(CERTCertDBHandle *handle, CERTCertificate *cert, | |
| 675 PRBool checkSig, SECCertUsage certUsage, PRTime t, | |
| 676 void *wincx, CERTVerifyLog *log); | |
| 677 | |
| 678 /* | |
| 679 ** OLD OBSOLETE FUNCTIONS with enum SECCertUsage - DO NOT USE FOR NEW CODE | |
| 680 ** verify a certificate by checking validity times against a certain time, | |
| 681 ** that we trust the issuer, and that the signature on the certificate is | |
| 682 ** valid. | |
| 683 ** "cert" the certificate to verify | |
| 684 ** "checkSig" only check signatures if true | |
| 685 */ | |
| 686 extern SECStatus | |
| 687 CERT_VerifyCert(CERTCertDBHandle *handle, CERTCertificate *cert, | |
| 688 PRBool checkSig, SECCertUsage certUsage, PRTime t, | |
| 689 void *wincx, CERTVerifyLog *log); | |
| 690 | |
| 691 /* same as above, but uses current time */ | |
| 692 extern SECStatus | |
| 693 CERT_VerifyCertNow(CERTCertDBHandle *handle, CERTCertificate *cert, | |
| 694 PRBool checkSig, SECCertUsage certUsage, void *wincx); | |
| 695 | |
| 696 SECStatus | |
| 697 CERT_VerifyCertChain(CERTCertDBHandle *handle, CERTCertificate *cert, | |
| 698 PRBool checkSig, SECCertUsage certUsage, PRTime t, | |
| 699 void *wincx, CERTVerifyLog *log); | |
| 700 | |
| 701 /* | |
| 702 ** Read a base64 ascii encoded DER certificate and convert it to our | |
| 703 ** internal format. | |
| 704 ** "certstr" is a null-terminated string containing the certificate | |
| 705 */ | |
| 706 extern CERTCertificate *CERT_ConvertAndDecodeCertificate(char *certstr); | |
| 707 | |
| 708 /* | |
| 709 ** Read a certificate in some foreign format, and convert it to our | |
| 710 ** internal format. | |
| 711 ** "certbuf" is the buffer containing the certificate | |
| 712 ** "certlen" is the length of the buffer | |
| 713 ** NOTE - currently supports netscape base64 ascii encoded raw certs | |
| 714 ** and netscape binary DER typed files. | |
| 715 */ | |
| 716 extern CERTCertificate *CERT_DecodeCertFromPackage(char *certbuf, int certlen); | |
| 717 | |
| 718 extern SECStatus | |
| 719 CERT_ImportCAChain (SECItem *certs, int numcerts, SECCertUsage certUsage); | |
| 720 | |
| 721 extern SECStatus | |
| 722 CERT_ImportCAChainTrusted(SECItem *certs, int numcerts, SECCertUsage certUsage); | |
| 723 | |
| 724 /* | |
| 725 ** Read a certificate chain in some foreign format, and pass it to a | |
| 726 ** callback function. | |
| 727 ** "certbuf" is the buffer containing the certificate | |
| 728 ** "certlen" is the length of the buffer | |
| 729 ** "f" is the callback function | |
| 730 ** "arg" is the callback argument | |
| 731 */ | |
| 732 typedef SECStatus (PR_CALLBACK *CERTImportCertificateFunc) | |
| 733 (void *arg, SECItem **certs, int numcerts); | |
| 734 | |
| 735 extern SECStatus | |
| 736 CERT_DecodeCertPackage(char *certbuf, int certlen, CERTImportCertificateFunc f, | |
| 737 void *arg); | |
| 738 | |
| 739 /* | |
| 740 ** Returns the value of an AVA. This was a formerly static | |
| 741 ** function that has been exposed due to the need to decode | |
| 742 ** and convert unicode strings to UTF8. | |
| 743 ** | |
| 744 ** XXX This function resides in certhtml.c, should it be | |
| 745 ** moved elsewhere? | |
| 746 */ | |
| 747 extern SECItem *CERT_DecodeAVAValue(const SECItem *derAVAValue); | |
| 748 | |
| 749 | |
| 750 | |
| 751 /* | |
| 752 ** extract various element strings from a distinguished name. | |
| 753 ** "name" the distinguished name | |
| 754 */ | |
| 755 | |
| 756 extern char *CERT_GetCertificateEmailAddress(CERTCertificate *cert); | |
| 757 | |
| 758 extern char *CERT_GetCertEmailAddress(CERTName *name); | |
| 759 | |
| 760 extern const char * CERT_GetFirstEmailAddress(CERTCertificate * cert); | |
| 761 | |
| 762 extern const char * CERT_GetNextEmailAddress(CERTCertificate * cert, | |
| 763 const char * prev); | |
| 764 | |
| 765 /* The return value must be freed with PORT_Free. */ | |
| 766 extern char *CERT_GetCommonName(CERTName *name); | |
| 767 | |
| 768 extern char *CERT_GetCountryName(CERTName *name); | |
| 769 | |
| 770 extern char *CERT_GetLocalityName(CERTName *name); | |
| 771 | |
| 772 extern char *CERT_GetStateName(CERTName *name); | |
| 773 | |
| 774 extern char *CERT_GetOrgName(CERTName *name); | |
| 775 | |
| 776 extern char *CERT_GetOrgUnitName(CERTName *name); | |
| 777 | |
| 778 extern char *CERT_GetDomainComponentName(CERTName *name); | |
| 779 | |
| 780 extern char *CERT_GetCertUid(CERTName *name); | |
| 781 | |
| 782 /* manipulate the trust parameters of a certificate */ | |
| 783 | |
| 784 extern SECStatus CERT_GetCertTrust(CERTCertificate *cert, CERTCertTrust *trust); | |
| 785 | |
| 786 extern SECStatus | |
| 787 CERT_ChangeCertTrust (CERTCertDBHandle *handle, CERTCertificate *cert, | |
| 788 CERTCertTrust *trust); | |
| 789 | |
| 790 extern SECStatus | |
| 791 CERT_ChangeCertTrustByUsage(CERTCertDBHandle *certdb, CERTCertificate *cert, | |
| 792 SECCertUsage usage); | |
| 793 | |
| 794 /************************************************************************* | |
| 795 * | |
| 796 * manipulate the extensions of a certificate | |
| 797 * | |
| 798 ************************************************************************/ | |
| 799 | |
| 800 /* | |
| 801 ** Set up a cert for adding X509v3 extensions. Returns an opaque handle | |
| 802 ** used by the next two routines. | |
| 803 ** "cert" is the certificate we are adding extensions to | |
| 804 */ | |
| 805 extern void *CERT_StartCertExtensions(CERTCertificate *cert); | |
| 806 | |
| 807 /* | |
| 808 ** Add an extension to a certificate. | |
| 809 ** "exthandle" is the handle returned by the previous function | |
| 810 ** "idtag" is the integer tag for the OID that should ID this extension | |
| 811 ** "value" is the value of the extension | |
| 812 ** "critical" is the critical extension flag | |
| 813 ** "copyData" is a flag indicating whether the value data should be | |
| 814 ** copied. | |
| 815 */ | |
| 816 extern SECStatus CERT_AddExtension (void *exthandle, int idtag, | |
| 817 SECItem *value, PRBool critical, PRBool copyData); | |
| 818 | |
| 819 extern SECStatus CERT_AddExtensionByOID (void *exthandle, SECItem *oid, | |
| 820 SECItem *value, PRBool critical, PRBool copyData); | |
| 821 | |
| 822 extern SECStatus CERT_EncodeAndAddExtension | |
| 823 (void *exthandle, int idtag, void *value, PRBool critical, | |
| 824 const SEC_ASN1Template *atemplate); | |
| 825 | |
| 826 extern SECStatus CERT_EncodeAndAddBitStrExtension | |
| 827 (void *exthandle, int idtag, SECItem *value, PRBool critical); | |
| 828 | |
| 829 | |
| 830 extern SECStatus | |
| 831 CERT_EncodeAltNameExtension(PLArenaPool *arena, CERTGeneralName *value, SECIte
m *encodedValue); | |
| 832 | |
| 833 | |
| 834 /* | |
| 835 ** Finish adding cert extensions. Does final processing on extension | |
| 836 ** data, putting it in the right format, and freeing any temporary | |
| 837 ** storage. | |
| 838 ** "exthandle" is the handle used to add extensions to a certificate | |
| 839 */ | |
| 840 extern SECStatus CERT_FinishExtensions(void *exthandle); | |
| 841 | |
| 842 /* | |
| 843 ** Merge an external list of extensions into a cert's extension list, adding one | |
| 844 ** only when its OID matches none of the cert's existing extensions. Call this | |
| 845 ** immediately before calling CERT_FinishExtensions(). | |
| 846 */ | |
| 847 SECStatus | |
| 848 CERT_MergeExtensions(void *exthandle, CERTCertExtension **exts); | |
| 849 | |
| 850 /* If the extension is found, return its criticality and value. | |
| 851 ** This allocate storage for the returning extension value. | |
| 852 */ | |
| 853 extern SECStatus CERT_GetExtenCriticality | |
| 854 (CERTCertExtension **extensions, int tag, PRBool *isCritical); | |
| 855 | |
| 856 extern void | |
| 857 CERT_DestroyOidSequence(CERTOidSequence *oidSeq); | |
| 858 | |
| 859 /**************************************************************************** | |
| 860 * | |
| 861 * DER encode and decode extension values | |
| 862 * | |
| 863 ****************************************************************************/ | |
| 864 | |
| 865 /* Encode the value of the basicConstraint extension. | |
| 866 ** arena - where to allocate memory for the encoded value. | |
| 867 ** value - extension value to encode | |
| 868 ** encodedValue - output encoded value | |
| 869 */ | |
| 870 extern SECStatus CERT_EncodeBasicConstraintValue | |
| 871 (PLArenaPool *arena, CERTBasicConstraints *value, SECItem *encodedValue); | |
| 872 | |
| 873 /* | |
| 874 ** Encode the value of the authorityKeyIdentifier extension. | |
| 875 */ | |
| 876 extern SECStatus CERT_EncodeAuthKeyID | |
| 877 (PLArenaPool *arena, CERTAuthKeyID *value, SECItem *encodedValue); | |
| 878 | |
| 879 /* | |
| 880 ** Encode the value of the crlDistributionPoints extension. | |
| 881 */ | |
| 882 extern SECStatus CERT_EncodeCRLDistributionPoints | |
| 883 (PLArenaPool *arena, CERTCrlDistributionPoints *value,SECItem *derValue); | |
| 884 | |
| 885 /* | |
| 886 ** Decodes a DER encoded basicConstaint extension value into a readable format | |
| 887 ** value - decoded value | |
| 888 ** encodedValue - value to decoded | |
| 889 */ | |
| 890 extern SECStatus CERT_DecodeBasicConstraintValue | |
| 891 (CERTBasicConstraints *value, SECItem *encodedValue); | |
| 892 | |
| 893 /* Decodes a DER encoded authorityKeyIdentifier extension value into a | |
| 894 ** readable format. | |
| 895 ** arena - where to allocate memory for the decoded value | |
| 896 ** encodedValue - value to be decoded | |
| 897 ** Returns a CERTAuthKeyID structure which contains the decoded value | |
| 898 */ | |
| 899 extern CERTAuthKeyID *CERT_DecodeAuthKeyID | |
| 900 (PLArenaPool *arena, SECItem *encodedValue); | |
| 901 | |
| 902 | |
| 903 /* Decodes a DER encoded crlDistributionPoints extension value into a | |
| 904 ** readable format. | |
| 905 ** arena - where to allocate memory for the decoded value | |
| 906 ** der - value to be decoded | |
| 907 ** Returns a CERTCrlDistributionPoints structure which contains the | |
| 908 ** decoded value | |
| 909 */ | |
| 910 extern CERTCrlDistributionPoints * CERT_DecodeCRLDistributionPoints | |
| 911 (PLArenaPool *arena, SECItem *der); | |
| 912 | |
| 913 /* Extract certain name type from a generalName */ | |
| 914 extern void *CERT_GetGeneralNameByType | |
| 915 (CERTGeneralName *genNames, CERTGeneralNameType type, PRBool derFormat); | |
| 916 | |
| 917 | |
| 918 extern CERTOidSequence * | |
| 919 CERT_DecodeOidSequence(SECItem *seqItem); | |
| 920 | |
| 921 | |
| 922 | |
| 923 | |
| 924 /**************************************************************************** | |
| 925 * | |
| 926 * Find extension values of a certificate | |
| 927 * | |
| 928 ***************************************************************************/ | |
| 929 | |
| 930 extern SECStatus CERT_FindCertExtension | |
| 931 (CERTCertificate *cert, int tag, SECItem *value); | |
| 932 | |
| 933 extern SECStatus CERT_FindNSCertTypeExtension | |
| 934 (CERTCertificate *cert, SECItem *value); | |
| 935 | |
| 936 extern char * CERT_FindNSStringExtension (CERTCertificate *cert, int oidtag); | |
| 937 | |
| 938 extern SECStatus CERT_FindIssuerCertExtension | |
| 939 (CERTCertificate *cert, int tag, SECItem *value); | |
| 940 | |
| 941 extern SECStatus CERT_FindCertExtensionByOID | |
| 942 (CERTCertificate *cert, SECItem *oid, SECItem *value); | |
| 943 | |
| 944 extern char *CERT_FindCertURLExtension (CERTCertificate *cert, int tag, | |
| 945 int catag); | |
| 946 | |
| 947 /* Returns the decoded value of the authKeyID extension. | |
| 948 ** Note that this uses passed in the arena to allocate storage for the result | |
| 949 */ | |
| 950 extern CERTAuthKeyID * CERT_FindAuthKeyIDExten (PLArenaPool *arena,CERTCertifica
te *cert); | |
| 951 | |
| 952 /* Returns the decoded value of the basicConstraint extension. | |
| 953 */ | |
| 954 extern SECStatus CERT_FindBasicConstraintExten | |
| 955 (CERTCertificate *cert, CERTBasicConstraints *value); | |
| 956 | |
| 957 /* Returns the decoded value of the crlDistributionPoints extension. | |
| 958 ** Note that the arena in cert is used to allocate storage for the result | |
| 959 */ | |
| 960 extern CERTCrlDistributionPoints * CERT_FindCRLDistributionPoints | |
| 961 (CERTCertificate *cert); | |
| 962 | |
| 963 /* Returns value of the keyUsage extension. This uses PR_Alloc to allocate | |
| 964 ** buffer for the decoded value. The caller should free up the storage | |
| 965 ** allocated in value->data. | |
| 966 */ | |
| 967 extern SECStatus CERT_FindKeyUsageExtension (CERTCertificate *cert, | |
| 968 SECItem *value); | |
| 969 | |
| 970 /* Return the decoded value of the subjectKeyID extension. The caller should | |
| 971 ** free up the storage allocated in retItem->data. | |
| 972 */ | |
| 973 extern SECStatus CERT_FindSubjectKeyIDExtension (CERTCertificate *cert, | |
| 974 SECItem *retItem); | |
| 975 | |
| 976 /* | |
| 977 ** If cert is a v3 certificate, and a critical keyUsage extension is included, | |
| 978 ** then check the usage against the extension value. If a non-critical | |
| 979 ** keyUsage extension is included, this will return SECSuccess without | |
| 980 ** checking, since the extension is an advisory field, not a restriction. | |
| 981 ** If cert is not a v3 certificate, this will return SECSuccess. | |
| 982 ** cert - certificate | |
| 983 ** usage - one of the x.509 v3 the Key Usage Extension flags | |
| 984 */ | |
| 985 extern SECStatus CERT_CheckCertUsage (CERTCertificate *cert, | |
| 986 unsigned char usage); | |
| 987 | |
| 988 /**************************************************************************** | |
| 989 * | |
| 990 * CRL v2 Extensions supported routines | |
| 991 * | |
| 992 ****************************************************************************/ | |
| 993 | |
| 994 extern SECStatus CERT_FindCRLExtensionByOID | |
| 995 (CERTCrl *crl, SECItem *oid, SECItem *value); | |
| 996 | |
| 997 extern SECStatus CERT_FindCRLExtension | |
| 998 (CERTCrl *crl, int tag, SECItem *value); | |
| 999 | |
| 1000 extern SECStatus | |
| 1001 CERT_FindInvalidDateExten (CERTCrl *crl, PRTime *value); | |
| 1002 | |
| 1003 /* | |
| 1004 ** Set up a crl for adding X509v3 extensions. Returns an opaque handle | |
| 1005 ** used by routines that take an exthandle (void*) argument . | |
| 1006 ** "crl" is the CRL we are adding extensions to | |
| 1007 */ | |
| 1008 extern void *CERT_StartCRLExtensions(CERTCrl *crl); | |
| 1009 | |
| 1010 /* | |
| 1011 ** Set up a crl entry for adding X509v3 extensions. Returns an opaque handle | |
| 1012 ** used by routines that take an exthandle (void*) argument . | |
| 1013 ** "crl" is the crl we are adding certs entries to | |
| 1014 ** "entry" is the crl entry we are adding extensions to | |
| 1015 */ | |
| 1016 extern void *CERT_StartCRLEntryExtensions(CERTCrl *crl, CERTCrlEntry *entry); | |
| 1017 | |
| 1018 extern CERTCertNicknames *CERT_GetCertNicknames (CERTCertDBHandle *handle, | |
| 1019 int what, void *wincx); | |
| 1020 | |
| 1021 /* | |
| 1022 ** Finds the crlNumber extension and decodes its value into 'value' | |
| 1023 */ | |
| 1024 extern SECStatus CERT_FindCRLNumberExten (PLArenaPool *arena, CERTCrl *crl, | |
| 1025 SECItem *value); | |
| 1026 | |
| 1027 extern SECStatus CERT_FindCRLEntryReasonExten (CERTCrlEntry *crlEntry, | |
| 1028 CERTCRLEntryReasonCode *value); | |
| 1029 | |
| 1030 extern void CERT_FreeNicknames(CERTCertNicknames *nicknames); | |
| 1031 | |
| 1032 extern PRBool CERT_CompareCerts(CERTCertificate *c1, CERTCertificate *c2); | |
| 1033 | |
| 1034 extern PRBool CERT_CompareCertsForRedirection(CERTCertificate *c1, | |
| 1035 CERTCertificate *c2); | |
| 1036 | |
| 1037 /* | |
| 1038 ** Generate an array of the Distinguished Names that the given cert database | |
| 1039 ** "trusts" | |
| 1040 */ | |
| 1041 extern CERTDistNames *CERT_GetSSLCACerts(CERTCertDBHandle *handle); | |
| 1042 | |
| 1043 extern void CERT_FreeDistNames(CERTDistNames *names); | |
| 1044 | |
| 1045 /* Duplicate distinguished name array */ | |
| 1046 extern CERTDistNames *CERT_DupDistNames(CERTDistNames *orig); | |
| 1047 | |
| 1048 /* | |
| 1049 ** Generate an array of Distinguished names from an array of nicknames | |
| 1050 */ | |
| 1051 extern CERTDistNames *CERT_DistNamesFromNicknames | |
| 1052 (CERTCertDBHandle *handle, char **nicknames, int nnames); | |
| 1053 | |
| 1054 /* | |
| 1055 ** Generate an array of Distinguished names from a list of certs. | |
| 1056 */ | |
| 1057 extern CERTDistNames *CERT_DistNamesFromCertList(CERTCertList *list); | |
| 1058 | |
| 1059 /* | |
| 1060 ** Generate a certificate chain from a certificate. | |
| 1061 */ | |
| 1062 extern CERTCertificateList * | |
| 1063 CERT_CertChainFromCert(CERTCertificate *cert, SECCertUsage usage, | |
| 1064 PRBool includeRoot); | |
| 1065 | |
| 1066 extern CERTCertificateList * | |
| 1067 CERT_CertListFromCert(CERTCertificate *cert); | |
| 1068 | |
| 1069 extern CERTCertificateList * | |
| 1070 CERT_DupCertList(const CERTCertificateList * oldList); | |
| 1071 | |
| 1072 extern void CERT_DestroyCertificateList(CERTCertificateList *list); | |
| 1073 | |
| 1074 /* | |
| 1075 ** is cert a user cert? i.e. does it have CERTDB_USER trust, | |
| 1076 ** i.e. a private key? | |
| 1077 */ | |
| 1078 PRBool CERT_IsUserCert(CERTCertificate* cert); | |
| 1079 | |
| 1080 /* is cert a newer than cert b? */ | |
| 1081 PRBool CERT_IsNewer(CERTCertificate *certa, CERTCertificate *certb); | |
| 1082 | |
| 1083 /* currently a stub for address book */ | |
| 1084 PRBool | |
| 1085 CERT_IsCertRevoked(CERTCertificate *cert); | |
| 1086 | |
| 1087 void | |
| 1088 CERT_DestroyCertArray(CERTCertificate **certs, unsigned int ncerts); | |
| 1089 | |
| 1090 /* convert an email address to lower case */ | |
| 1091 char *CERT_FixupEmailAddr(const char *emailAddr); | |
| 1092 | |
| 1093 /* decode string representation of trust flags into trust struct */ | |
| 1094 SECStatus | |
| 1095 CERT_DecodeTrustString(CERTCertTrust *trust, const char *trusts); | |
| 1096 | |
| 1097 /* encode trust struct into string representation of trust flags */ | |
| 1098 char * | |
| 1099 CERT_EncodeTrustString(CERTCertTrust *trust); | |
| 1100 | |
| 1101 /* find the next or prev cert in a subject list */ | |
| 1102 CERTCertificate * | |
| 1103 CERT_PrevSubjectCert(CERTCertificate *cert); | |
| 1104 CERTCertificate * | |
| 1105 CERT_NextSubjectCert(CERTCertificate *cert); | |
| 1106 | |
| 1107 /* | |
| 1108 * import a collection of certs into the temporary or permanent cert | |
| 1109 * database | |
| 1110 */ | |
| 1111 SECStatus | |
| 1112 CERT_ImportCerts(CERTCertDBHandle *certdb, SECCertUsage usage, | |
| 1113 unsigned int ncerts, SECItem **derCerts, | |
| 1114 CERTCertificate ***retCerts, PRBool keepCerts, | |
| 1115 PRBool caOnly, char *nickname); | |
| 1116 | |
| 1117 char * | |
| 1118 CERT_MakeCANickname(CERTCertificate *cert); | |
| 1119 | |
| 1120 PRBool | |
| 1121 CERT_IsCACert(CERTCertificate *cert, unsigned int *rettype); | |
| 1122 | |
| 1123 PRBool | |
| 1124 CERT_IsCADERCert(SECItem *derCert, unsigned int *rettype); | |
| 1125 | |
| 1126 PRBool | |
| 1127 CERT_IsRootDERCert(SECItem *derCert); | |
| 1128 | |
| 1129 SECStatus | |
| 1130 CERT_SaveSMimeProfile(CERTCertificate *cert, SECItem *emailProfile, | |
| 1131 SECItem *profileTime); | |
| 1132 | |
| 1133 /* | |
| 1134 * find the smime symmetric capabilities profile for a given cert | |
| 1135 */ | |
| 1136 SECItem * | |
| 1137 CERT_FindSMimeProfile(CERTCertificate *cert); | |
| 1138 | |
| 1139 SECStatus | |
| 1140 CERT_AddNewCerts(CERTCertDBHandle *handle); | |
| 1141 | |
| 1142 CERTCertificatePolicies * | |
| 1143 CERT_DecodeCertificatePoliciesExtension(SECItem *extnValue); | |
| 1144 | |
| 1145 void | |
| 1146 CERT_DestroyCertificatePoliciesExtension(CERTCertificatePolicies *policies); | |
| 1147 | |
| 1148 CERTCertificatePolicyMappings * | |
| 1149 CERT_DecodePolicyMappingsExtension(SECItem *encodedCertPolicyMaps); | |
| 1150 | |
| 1151 SECStatus | |
| 1152 CERT_DestroyPolicyMappingsExtension(CERTCertificatePolicyMappings *mappings); | |
| 1153 | |
| 1154 SECStatus | |
| 1155 CERT_DecodePolicyConstraintsExtension( | |
| 1156 CERTCertificatePolicyConstraints *decodedValue, SECItem *encodedValue); | |
| 1157 | |
| 1158 SECStatus CERT_DecodeInhibitAnyExtension | |
| 1159 (CERTCertificateInhibitAny *decodedValue, SECItem *extnValue); | |
| 1160 | |
| 1161 CERTUserNotice * | |
| 1162 CERT_DecodeUserNotice(SECItem *noticeItem); | |
| 1163 | |
| 1164 extern CERTGeneralName * | |
| 1165 CERT_DecodeAltNameExtension(PLArenaPool *reqArena, SECItem *EncodedAltName); | |
| 1166 | |
| 1167 extern CERTNameConstraints * | |
| 1168 CERT_DecodeNameConstraintsExtension(PLArenaPool *arena, | |
| 1169 SECItem *encodedConstraints); | |
| 1170 | |
| 1171 /* returns addr of a NULL termainated array of pointers to CERTAuthInfoAccess */ | |
| 1172 extern CERTAuthInfoAccess ** | |
| 1173 CERT_DecodeAuthInfoAccessExtension(PLArenaPool *reqArena, | |
| 1174 SECItem *encodedExtension); | |
| 1175 | |
| 1176 extern CERTPrivKeyUsagePeriod * | |
| 1177 CERT_DecodePrivKeyUsagePeriodExtension(PLArenaPool *arena, SECItem *extnValue); | |
| 1178 | |
| 1179 extern CERTGeneralName * | |
| 1180 CERT_GetNextGeneralName(CERTGeneralName *current); | |
| 1181 | |
| 1182 extern CERTGeneralName * | |
| 1183 CERT_GetPrevGeneralName(CERTGeneralName *current); | |
| 1184 | |
| 1185 CERTNameConstraint * | |
| 1186 CERT_GetNextNameConstraint(CERTNameConstraint *current); | |
| 1187 | |
| 1188 CERTNameConstraint * | |
| 1189 CERT_GetPrevNameConstraint(CERTNameConstraint *current); | |
| 1190 | |
| 1191 void | |
| 1192 CERT_DestroyUserNotice(CERTUserNotice *userNotice); | |
| 1193 | |
| 1194 typedef char * (* CERTPolicyStringCallback)(char *org, | |
| 1195 unsigned long noticeNumber, | |
| 1196 void *arg); | |
| 1197 void | |
| 1198 CERT_SetCAPolicyStringCallback(CERTPolicyStringCallback cb, void *cbarg); | |
| 1199 | |
| 1200 char * | |
| 1201 CERT_GetCertCommentString(CERTCertificate *cert); | |
| 1202 | |
| 1203 PRBool | |
| 1204 CERT_GovtApprovedBitSet(CERTCertificate *cert); | |
| 1205 | |
| 1206 SECStatus | |
| 1207 CERT_AddPermNickname(CERTCertificate *cert, char *nickname); | |
| 1208 | |
| 1209 CERTCertList * | |
| 1210 CERT_MatchUserCert(CERTCertDBHandle *handle, | |
| 1211 SECCertUsage usage, | |
| 1212 int nCANames, char **caNames, | |
| 1213 void *proto_win); | |
| 1214 | |
| 1215 CERTCertList * | |
| 1216 CERT_NewCertList(void); | |
| 1217 | |
| 1218 void | |
| 1219 CERT_DestroyCertList(CERTCertList *certs); | |
| 1220 | |
| 1221 /* remove the node and free the cert */ | |
| 1222 void | |
| 1223 CERT_RemoveCertListNode(CERTCertListNode *node); | |
| 1224 | |
| 1225 SECStatus | |
| 1226 CERT_AddCertToListTail(CERTCertList *certs, CERTCertificate *cert); | |
| 1227 | |
| 1228 SECStatus | |
| 1229 CERT_AddCertToListHead(CERTCertList *certs, CERTCertificate *cert); | |
| 1230 | |
| 1231 SECStatus | |
| 1232 CERT_AddCertToListTailWithData(CERTCertList *certs, CERTCertificate *cert, | |
| 1233 void *appData); | |
| 1234 | |
| 1235 SECStatus | |
| 1236 CERT_AddCertToListHeadWithData(CERTCertList *certs, CERTCertificate *cert, | |
| 1237 void *appData); | |
| 1238 | |
| 1239 typedef PRBool (* CERTSortCallback)(CERTCertificate *certa, | |
| 1240 CERTCertificate *certb, | |
| 1241 void *arg); | |
| 1242 SECStatus | |
| 1243 CERT_AddCertToListSorted(CERTCertList *certs, CERTCertificate *cert, | |
| 1244 CERTSortCallback f, void *arg); | |
| 1245 | |
| 1246 /* callback for CERT_AddCertToListSorted that sorts based on validity | |
| 1247 * period and a given time. | |
| 1248 */ | |
| 1249 PRBool | |
| 1250 CERT_SortCBValidity(CERTCertificate *certa, | |
| 1251 CERTCertificate *certb, | |
| 1252 void *arg); | |
| 1253 | |
| 1254 SECStatus | |
| 1255 CERT_CheckForEvilCert(CERTCertificate *cert); | |
| 1256 | |
| 1257 CERTGeneralName * | |
| 1258 CERT_GetCertificateNames(CERTCertificate *cert, PLArenaPool *arena); | |
| 1259 | |
| 1260 CERTGeneralName * | |
| 1261 CERT_GetConstrainedCertificateNames(CERTCertificate *cert, PLArenaPool *arena, | |
| 1262 PRBool includeSubjectCommonName); | |
| 1263 | |
| 1264 /* | |
| 1265 * Creates or adds to a list of all certs with a give subject name, sorted by | |
| 1266 * validity time, newest first. Invalid certs are considered older than | |
| 1267 * valid certs. If validOnly is set, do not include invalid certs on list. | |
| 1268 */ | |
| 1269 CERTCertList * | |
| 1270 CERT_CreateSubjectCertList(CERTCertList *certList, CERTCertDBHandle *handle, | |
| 1271 SECItem *name, PRTime sorttime, PRBool validOnly); | |
| 1272 | |
| 1273 /* | |
| 1274 * remove certs from a list that don't have keyUsage and certType | |
| 1275 * that match the given usage. | |
| 1276 */ | |
| 1277 SECStatus | |
| 1278 CERT_FilterCertListByUsage(CERTCertList *certList, SECCertUsage usage, | |
| 1279 PRBool ca); | |
| 1280 | |
| 1281 /* | |
| 1282 * check the key usage of a cert against a set of required values | |
| 1283 */ | |
| 1284 SECStatus | |
| 1285 CERT_CheckKeyUsage(CERTCertificate *cert, unsigned int requiredUsage); | |
| 1286 | |
| 1287 /* | |
| 1288 * return required key usage and cert type based on cert usage | |
| 1289 */ | |
| 1290 SECStatus | |
| 1291 CERT_KeyUsageAndTypeForCertUsage(SECCertUsage usage, | |
| 1292 PRBool ca, | |
| 1293 unsigned int *retKeyUsage, | |
| 1294 unsigned int *retCertType); | |
| 1295 /* | |
| 1296 * return required trust flags for various cert usages for CAs | |
| 1297 */ | |
| 1298 SECStatus | |
| 1299 CERT_TrustFlagsForCACertUsage(SECCertUsage usage, | |
| 1300 unsigned int *retFlags, | |
| 1301 SECTrustType *retTrustType); | |
| 1302 | |
| 1303 /* | |
| 1304 * Find all user certificates that match the given criteria. | |
| 1305 * | |
| 1306 * "handle" - database to search | |
| 1307 * "usage" - certificate usage to match | |
| 1308 * "oneCertPerName" - if set then only return the "best" cert per | |
| 1309 * name | |
| 1310 * "validOnly" - only return certs that are curently valid | |
| 1311 * "proto_win" - window handle passed to pkcs11 | |
| 1312 */ | |
| 1313 CERTCertList * | |
| 1314 CERT_FindUserCertsByUsage(CERTCertDBHandle *handle, | |
| 1315 SECCertUsage usage, | |
| 1316 PRBool oneCertPerName, | |
| 1317 PRBool validOnly, | |
| 1318 void *proto_win); | |
| 1319 | |
| 1320 /* | |
| 1321 * Find a user certificate that matchs the given criteria. | |
| 1322 * | |
| 1323 * "handle" - database to search | |
| 1324 * "nickname" - nickname to match | |
| 1325 * "usage" - certificate usage to match | |
| 1326 * "validOnly" - only return certs that are curently valid | |
| 1327 * "proto_win" - window handle passed to pkcs11 | |
| 1328 */ | |
| 1329 CERTCertificate * | |
| 1330 CERT_FindUserCertByUsage(CERTCertDBHandle *handle, | |
| 1331 const char *nickname, | |
| 1332 SECCertUsage usage, | |
| 1333 PRBool validOnly, | |
| 1334 void *proto_win); | |
| 1335 | |
| 1336 /* | |
| 1337 * Filter a list of certificates, removing those certs that do not have | |
| 1338 * one of the named CA certs somewhere in their cert chain. | |
| 1339 * | |
| 1340 * "certList" - the list of certificates to filter | |
| 1341 * "nCANames" - number of CA names | |
| 1342 * "caNames" - array of CA names in string(rfc 1485) form | |
| 1343 * "usage" - what use the certs are for, this is used when | |
| 1344 * selecting CA certs | |
| 1345 */ | |
| 1346 SECStatus | |
| 1347 CERT_FilterCertListByCANames(CERTCertList *certList, int nCANames, | |
| 1348 char **caNames, SECCertUsage usage); | |
| 1349 | |
| 1350 /* | |
| 1351 * Filter a list of certificates, removing those certs that aren't user certs | |
| 1352 */ | |
| 1353 SECStatus | |
| 1354 CERT_FilterCertListForUserCerts(CERTCertList *certList); | |
| 1355 | |
| 1356 /* | |
| 1357 * Collect the nicknames from all certs in a CertList. If the cert is not | |
| 1358 * valid, append a string to that nickname. | |
| 1359 * | |
| 1360 * "certList" - the list of certificates | |
| 1361 * "expiredString" - the string to append to the nickname of any expired cert | |
| 1362 * "notYetGoodString" - the string to append to the nickname of any cert | |
| 1363 * that is not yet valid | |
| 1364 */ | |
| 1365 CERTCertNicknames * | |
| 1366 CERT_NicknameStringsFromCertList(CERTCertList *certList, char *expiredString, | |
| 1367 char *notYetGoodString); | |
| 1368 | |
| 1369 /* | |
| 1370 * Extract the nickname from a nickmake string that may have either | |
| 1371 * expiredString or notYetGoodString appended. | |
| 1372 * | |
| 1373 * Args: | |
| 1374 * "namestring" - the string containing the nickname, and possibly | |
| 1375 * one of the validity label strings | |
| 1376 * "expiredString" - the expired validity label string | |
| 1377 * "notYetGoodString" - the not yet good validity label string | |
| 1378 * | |
| 1379 * Returns the raw nickname | |
| 1380 */ | |
| 1381 char * | |
| 1382 CERT_ExtractNicknameString(char *namestring, char *expiredString, | |
| 1383 char *notYetGoodString); | |
| 1384 | |
| 1385 /* | |
| 1386 * Given a certificate, return a string containing the nickname, and possibly | |
| 1387 * one of the validity strings, based on the current validity state of the | |
| 1388 * certificate. | |
| 1389 * | |
| 1390 * "arena" - arena to allocate returned string from. If NULL, then heap | |
| 1391 * is used. | |
| 1392 * "cert" - the cert to get nickname from | |
| 1393 * "expiredString" - the string to append to the nickname if the cert is | |
| 1394 * expired. | |
| 1395 * "notYetGoodString" - the string to append to the nickname if the cert is | |
| 1396 * not yet good. | |
| 1397 */ | |
| 1398 char * | |
| 1399 CERT_GetCertNicknameWithValidity(PLArenaPool *arena, CERTCertificate *cert, | |
| 1400 char *expiredString, char *notYetGoodString); | |
| 1401 | |
| 1402 /* | |
| 1403 * Return the string representation of a DER encoded distinguished name | |
| 1404 * "dername" - The DER encoded name to convert | |
| 1405 */ | |
| 1406 char * | |
| 1407 CERT_DerNameToAscii(SECItem *dername); | |
| 1408 | |
| 1409 /* | |
| 1410 * Supported usage values and types: | |
| 1411 * certUsageSSLClient | |
| 1412 * certUsageSSLServer | |
| 1413 * certUsageSSLServerWithStepUp | |
| 1414 * certUsageEmailSigner | |
| 1415 * certUsageEmailRecipient | |
| 1416 * certUsageObjectSigner | |
| 1417 */ | |
| 1418 | |
| 1419 CERTCertificate * | |
| 1420 CERT_FindMatchingCert(CERTCertDBHandle *handle, SECItem *derName, | |
| 1421 CERTCertOwner owner, SECCertUsage usage, | |
| 1422 PRBool preferTrusted, PRTime validTime, PRBool validOnly); | |
| 1423 | |
| 1424 /* | |
| 1425 * Acquire the global lock on the cert database. | |
| 1426 * This lock is currently used for the following operations: | |
| 1427 * adding or deleting a cert to either the temp or perm databases | |
| 1428 * converting a temp to perm or perm to temp | |
| 1429 * changing(maybe just adding?) the trust of a cert | |
| 1430 * adjusting the reference count of a cert | |
| 1431 */ | |
| 1432 void | |
| 1433 CERT_LockDB(CERTCertDBHandle *handle); | |
| 1434 | |
| 1435 /* | |
| 1436 * Free the global cert database lock. | |
| 1437 */ | |
| 1438 void | |
| 1439 CERT_UnlockDB(CERTCertDBHandle *handle); | |
| 1440 | |
| 1441 /* | |
| 1442 * Get the certificate status checking configuratino data for | |
| 1443 * the certificate database | |
| 1444 */ | |
| 1445 CERTStatusConfig * | |
| 1446 CERT_GetStatusConfig(CERTCertDBHandle *handle); | |
| 1447 | |
| 1448 /* | |
| 1449 * Set the certificate status checking information for the | |
| 1450 * database. The input structure becomes part of the certificate | |
| 1451 * database and will be freed by calling the 'Destroy' function in | |
| 1452 * the configuration object. | |
| 1453 */ | |
| 1454 void | |
| 1455 CERT_SetStatusConfig(CERTCertDBHandle *handle, CERTStatusConfig *config); | |
| 1456 | |
| 1457 | |
| 1458 | |
| 1459 /* | |
| 1460 * Acquire the cert reference count lock | |
| 1461 * There is currently one global lock for all certs, but I'm putting a cert | |
| 1462 * arg here so that it will be easy to make it per-cert in the future if | |
| 1463 * that turns out to be necessary. | |
| 1464 */ | |
| 1465 void | |
| 1466 CERT_LockCertRefCount(CERTCertificate *cert); | |
| 1467 | |
| 1468 /* | |
| 1469 * Free the cert reference count lock | |
| 1470 */ | |
| 1471 void | |
| 1472 CERT_UnlockCertRefCount(CERTCertificate *cert); | |
| 1473 | |
| 1474 /* | |
| 1475 * Acquire the cert trust lock | |
| 1476 * There is currently one global lock for all certs, but I'm putting a cert | |
| 1477 * arg here so that it will be easy to make it per-cert in the future if | |
| 1478 * that turns out to be necessary. | |
| 1479 */ | |
| 1480 void | |
| 1481 CERT_LockCertTrust(CERTCertificate *cert); | |
| 1482 | |
| 1483 /* | |
| 1484 * Free the cert trust lock | |
| 1485 */ | |
| 1486 void | |
| 1487 CERT_UnlockCertTrust(CERTCertificate *cert); | |
| 1488 | |
| 1489 /* | |
| 1490 * Digest the cert's subject public key using the specified algorithm. | |
| 1491 * The necessary storage for the digest data is allocated. If "fill" is | |
| 1492 * non-null, the data is put there, otherwise a SECItem is allocated. | |
| 1493 * Allocation from "arena" if it is non-null, heap otherwise. Any problem | |
| 1494 * results in a NULL being returned (and an appropriate error set). | |
| 1495 */ | |
| 1496 extern SECItem * | |
| 1497 CERT_GetSPKIDigest(PLArenaPool *arena, const CERTCertificate *cert, | |
| 1498 SECOidTag digestAlg, SECItem *fill); | |
| 1499 | |
| 1500 | |
| 1501 SECStatus CERT_CheckCRL(CERTCertificate* cert, CERTCertificate* issuer, | |
| 1502 const SECItem* dp, PRTime t, void* wincx); | |
| 1503 | |
| 1504 | |
| 1505 /* | |
| 1506 * Add a CERTNameConstraint to the CERTNameConstraint list | |
| 1507 */ | |
| 1508 extern CERTNameConstraint * | |
| 1509 CERT_AddNameConstraint(CERTNameConstraint *list, | |
| 1510 CERTNameConstraint *constraint); | |
| 1511 | |
| 1512 /* | |
| 1513 * Allocate space and copy CERTNameConstraint from src to dest. | |
| 1514 * Arena is used to allocate result(if dest eq NULL) and its members | |
| 1515 * SECItem data. | |
| 1516 */ | |
| 1517 extern CERTNameConstraint * | |
| 1518 CERT_CopyNameConstraint(PLArenaPool *arena, | |
| 1519 CERTNameConstraint *dest, | |
| 1520 CERTNameConstraint *src); | |
| 1521 | |
| 1522 /* | |
| 1523 * Verify name against all the constraints relevant to that type of | |
| 1524 * the name. | |
| 1525 */ | |
| 1526 extern SECStatus | |
| 1527 CERT_CheckNameSpace(PLArenaPool *arena, | |
| 1528 CERTNameConstraints *constraints, | |
| 1529 CERTGeneralName *currentName); | |
| 1530 | |
| 1531 /* | |
| 1532 * Extract and allocate the name constraints extension from the CA cert. | |
| 1533 */ | |
| 1534 extern SECStatus | |
| 1535 CERT_FindNameConstraintsExten(PLArenaPool *arena, | |
| 1536 CERTCertificate *cert, | |
| 1537 CERTNameConstraints **constraints); | |
| 1538 | |
| 1539 /* | |
| 1540 * Initialize a new GERTGeneralName fields (link) | |
| 1541 */ | |
| 1542 extern CERTGeneralName * | |
| 1543 CERT_NewGeneralName(PLArenaPool *arena, CERTGeneralNameType type); | |
| 1544 | |
| 1545 /* | |
| 1546 * PKIX extension encoding routines | |
| 1547 */ | |
| 1548 extern SECStatus | |
| 1549 CERT_EncodePolicyConstraintsExtension(PLArenaPool *arena, | |
| 1550 CERTCertificatePolicyConstraints *constr, | |
| 1551 SECItem *dest); | |
| 1552 extern SECStatus | |
| 1553 CERT_EncodeInhibitAnyExtension(PLArenaPool *arena, | |
| 1554 CERTCertificateInhibitAny *inhibitAny, | |
| 1555 SECItem *dest); | |
| 1556 extern SECStatus | |
| 1557 CERT_EncodePolicyMappingExtension(PLArenaPool *arena, | |
| 1558 CERTCertificatePolicyMappings *maps, | |
| 1559 SECItem *dest); | |
| 1560 | |
| 1561 extern SECStatus CERT_EncodeInfoAccessExtension(PLArenaPool *arena, | |
| 1562 CERTAuthInfoAccess **info, | |
| 1563 SECItem *dest); | |
| 1564 extern SECStatus | |
| 1565 CERT_EncodeUserNotice(PLArenaPool *arena, | |
| 1566 CERTUserNotice *notice, | |
| 1567 SECItem *dest); | |
| 1568 | |
| 1569 extern SECStatus | |
| 1570 CERT_EncodeDisplayText(PLArenaPool *arena, | |
| 1571 SECItem *text, | |
| 1572 SECItem *dest); | |
| 1573 | |
| 1574 extern SECStatus | |
| 1575 CERT_EncodeCertPoliciesExtension(PLArenaPool *arena, | |
| 1576 CERTPolicyInfo **info, | |
| 1577 SECItem *dest); | |
| 1578 extern SECStatus | |
| 1579 CERT_EncodeNoticeReference(PLArenaPool *arena, | |
| 1580 CERTNoticeReference *reference, | |
| 1581 SECItem *dest); | |
| 1582 | |
| 1583 /* | |
| 1584 * Returns a pointer to a static structure. | |
| 1585 */ | |
| 1586 extern const CERTRevocationFlags* | |
| 1587 CERT_GetPKIXVerifyNistRevocationPolicy(void); | |
| 1588 | |
| 1589 /* | |
| 1590 * Returns a pointer to a static structure. | |
| 1591 */ | |
| 1592 extern const CERTRevocationFlags* | |
| 1593 CERT_GetClassicOCSPEnabledSoftFailurePolicy(void); | |
| 1594 | |
| 1595 /* | |
| 1596 * Returns a pointer to a static structure. | |
| 1597 */ | |
| 1598 extern const CERTRevocationFlags* | |
| 1599 CERT_GetClassicOCSPEnabledHardFailurePolicy(void); | |
| 1600 | |
| 1601 /* | |
| 1602 * Returns a pointer to a static structure. | |
| 1603 */ | |
| 1604 extern const CERTRevocationFlags* | |
| 1605 CERT_GetClassicOCSPDisabledPolicy(void); | |
| 1606 | |
| 1607 /* | |
| 1608 * Verify a Cert with libpkix | |
| 1609 * paramsIn control the verification options. If a value isn't specified | |
| 1610 * in paramsIn, it reverts to the application default. | |
| 1611 * paramsOut specifies the parameters the caller would like to get back. | |
| 1612 * the caller may pass NULL, in which case no parameters are returned. | |
| 1613 */ | |
| 1614 extern SECStatus CERT_PKIXVerifyCert( | |
| 1615 CERTCertificate *cert, | |
| 1616 SECCertificateUsage usages, | |
| 1617 CERTValInParam *paramsIn, | |
| 1618 CERTValOutParam *paramsOut, | |
| 1619 void *wincx); | |
| 1620 | |
| 1621 /* Makes old cert validation APIs(CERT_VerifyCert, CERT_VerifyCertificate) | |
| 1622 * to use libpkix validation engine. The function should be called ones at | |
| 1623 * application initialization time. | |
| 1624 * Function is not thread safe.*/ | |
| 1625 extern SECStatus CERT_SetUsePKIXForValidation(PRBool enable); | |
| 1626 | |
| 1627 /* The function return PR_TRUE if cert validation should use | |
| 1628 * libpkix cert validation engine. */ | |
| 1629 extern PRBool CERT_GetUsePKIXForValidation(void); | |
| 1630 | |
| 1631 /* | |
| 1632 * Allocate a parameter container of type CERTRevocationFlags, | |
| 1633 * and allocate the inner arrays of the given sizes. | |
| 1634 * To cleanup call CERT_DestroyCERTRevocationFlags. | |
| 1635 */ | |
| 1636 extern CERTRevocationFlags * | |
| 1637 CERT_AllocCERTRevocationFlags( | |
| 1638 PRUint32 number_leaf_methods, PRUint32 number_leaf_pref_methods, | |
| 1639 PRUint32 number_chain_methods, PRUint32 number_chain_pref_methods); | |
| 1640 | |
| 1641 /* | |
| 1642 * Destroy the arrays inside flags, | |
| 1643 * and destroy the object pointed to by flags, too. | |
| 1644 */ | |
| 1645 extern void | |
| 1646 CERT_DestroyCERTRevocationFlags(CERTRevocationFlags *flags); | |
| 1647 | |
| 1648 SEC_END_PROTOS | |
| 1649 | |
| 1650 #endif /* _CERT_H_ */ | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 14249009:
Change the NSS and NSPR source tree to the new directory structure to be (Closed)
Base URL: svn://svn.chromium.org/chrome/trunk/deps/third_party/nss/