| OLD | NEW |
|---|
| (Empty) |
| 1 /* This Source Code Form is subject to the terms of the Mozilla Public | |
| 2 * License, v. 2.0. If a copy of the MPL was not distributed with this | |
| 3 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ | |
| 4 /* | |
| 5 * certi.h - private data structures for the certificate library | |
| 6 * | |
| 7 * $Id: certi.h,v 1.38 2012/12/06 17:56:57 wtc%google.com Exp $ | |
| 8 */ | |
| 9 #ifndef _CERTI_H_ | |
| 10 #define _CERTI_H_ | |
| 11 | |
| 12 #include "certt.h" | |
| 13 #include "nssrwlkt.h" | |
| 14 | |
| 15 /* | |
| 16 #define GLOBAL_RWLOCK 1 | |
| 17 */ | |
| 18 | |
| 19 #define DPC_RWLOCK 1 | |
| 20 | |
| 21 /* all definitions in this file are subject to change */ | |
| 22 | |
| 23 typedef struct OpaqueCRLFieldsStr OpaqueCRLFields; | |
| 24 typedef struct CRLEntryCacheStr CRLEntryCache; | |
| 25 typedef struct CRLDPCacheStr CRLDPCache; | |
| 26 typedef struct CRLIssuerCacheStr CRLIssuerCache; | |
| 27 typedef struct CRLCacheStr CRLCache; | |
| 28 typedef struct CachedCrlStr CachedCrl; | |
| 29 typedef struct NamedCRLCacheStr NamedCRLCache; | |
| 30 typedef struct NamedCRLCacheEntryStr NamedCRLCacheEntry; | |
| 31 | |
| 32 struct OpaqueCRLFieldsStr { | |
| 33 PRBool partial; | |
| 34 PRBool decodingError; | |
| 35 PRBool badEntries; | |
| 36 PRBool badDER; | |
| 37 PRBool badExtensions; | |
| 38 PRBool heapDER; | |
| 39 }; | |
| 40 | |
| 41 typedef struct PreAllocatorStr PreAllocator; | |
| 42 | |
| 43 struct PreAllocatorStr | |
| 44 { | |
| 45 PRSize len; | |
| 46 void* data; | |
| 47 PRSize used; | |
| 48 PRArenaPool* arena; | |
| 49 PRSize extra; | |
| 50 }; | |
| 51 | |
| 52 /* CRL entry cache. | |
| 53 This is the same as an entry plus the next/prev pointers for the hash table | |
| 54 */ | |
| 55 | |
| 56 struct CRLEntryCacheStr { | |
| 57 CERTCrlEntry entry; | |
| 58 CRLEntryCache *prev, *next; | |
| 59 }; | |
| 60 | |
| 61 #define CRL_CACHE_INVALID_CRLS 0x0001 /* this state will be set | |
| 62 if we have CRL objects with an invalid DER or signature. Can be | |
| 63 cleared if the invalid objects are deleted from the token */ | |
| 64 #define CRL_CACHE_LAST_FETCH_FAILED 0x0002 /* this state will be set | |
| 65 if the last CRL fetch encountered an error. Can be cleared if a | |
| 66 new fetch succeeds */ | |
| 67 | |
| 68 #define CRL_CACHE_OUT_OF_MEMORY 0x0004 /* this state will be set | |
| 69 if we don't have enough memory to build the hash table of entries */ | |
| 70 | |
| 71 typedef enum { | |
| 72 CRL_OriginToken = 0, /* CRL came from PKCS#11 token */ | |
| 73 CRL_OriginExplicit = 1 /* CRL was explicitly added to the cache, from RAM *
/ | |
| 74 } CRLOrigin; | |
| 75 | |
| 76 typedef enum { | |
| 77 dpcacheNoEntry = 0, /* no entry found for this SN */ | |
| 78 dpcacheFoundEntry = 1, /* entry found for this SN */ | |
| 79 dpcacheCallerError = 2, /* invalid args */ | |
| 80 dpcacheInvalidCacheError = 3, /* CRL in cache may be bad DER */ | |
| 81 /* or unverified */ | |
| 82 dpcacheEmpty = 4, /* no CRL in cache */ | |
| 83 dpcacheLookupError = 5 /* internal error */ | |
| 84 } dpcacheStatus; | |
| 85 | |
| 86 | |
| 87 struct CachedCrlStr { | |
| 88 CERTSignedCrl* crl; | |
| 89 CRLOrigin origin; | |
| 90 /* hash table of entries. We use a PLHashTable and pre-allocate the | |
| 91 required amount of memory in one shot, so that our allocator can | |
| 92 simply pass offsets into it when hashing. | |
| 93 | |
| 94 This won't work anymore when we support delta CRLs and iCRLs, because | |
| 95 the size of the hash table will vary over time. At that point, the best | |
| 96 solution will be to allocate large CRLEntry structures by modifying | |
| 97 the DER decoding template. The extra space would be for next/prev | |
| 98 pointers. This would allow entries from different CRLs to be mixed in | |
| 99 the same hash table. | |
| 100 */ | |
| 101 PLHashTable* entries; | |
| 102 PreAllocator* prebuffer; /* big pre-allocated buffer mentioned above */ | |
| 103 PRBool sigChecked; /* this CRL signature has already been checked */ | |
| 104 PRBool sigValid; /* signature verification status . | |
| 105 Only meaningful if checked is PR_TRUE . */ | |
| 106 PRBool unbuildable; /* Avoid using assosiated CRL is it fails | |
| 107 * a decoding step */ | |
| 108 }; | |
| 109 | |
| 110 /* CRL distribution point cache object | |
| 111 This is a cache of CRL entries for a given distribution point of an issuer | |
| 112 It is built from a collection of one full and 0 or more delta CRLs. | |
| 113 */ | |
| 114 | |
| 115 struct CRLDPCacheStr { | |
| 116 #ifdef DPC_RWLOCK | |
| 117 NSSRWLock* lock; | |
| 118 #else | |
| 119 PRLock* lock; | |
| 120 #endif | |
| 121 CERTCertificate* issuer; /* issuer cert | |
| 122 XXX there may be multiple issuer certs, | |
| 123 with different validity dates. Also | |
| 124 need to deal with SKID/AKID . See | |
| 125 bugzilla 217387, 233118 */ | |
| 126 SECItem* subject; /* DER of issuer subject */ | |
| 127 SECItem* distributionPoint; /* DER of distribution point. This may be | |
| 128 NULL when distribution points aren't | |
| 129 in use (ie. the CA has a single CRL). | |
| 130 Currently not used. */ | |
| 131 | |
| 132 /* array of full CRLs matching this distribution point */ | |
| 133 PRUint32 ncrls; /* total number of CRLs in crls */ | |
| 134 CachedCrl** crls; /* array of all matching CRLs */ | |
| 135 /* XCRL With iCRLs and multiple DPs, the CRL can be shared accross several | |
| 136 issuers. In the future, we'll need to globally recycle the CRL in a | |
| 137 separate list in order to avoid extra lookups, decodes, and copies */ | |
| 138 | |
| 139 /* pointers to good decoded CRLs used to build the cache */ | |
| 140 CachedCrl* selected; /* full CRL selected for use in the cache */ | |
| 141 #if 0 | |
| 142 /* for future use */ | |
| 143 PRInt32 numdeltas; /* number of delta CRLs used for the cache */ | |
| 144 CachedCrl** deltas; /* delta CRLs used for the cache */ | |
| 145 #endif | |
| 146 /* cache invalidity bitflag */ | |
| 147 PRUint16 invalid; /* this state will be set if either | |
| 148 CRL_CACHE_INVALID_CRLS or CRL_CACHE_LAST_FETCH_FAILED is set. | |
| 149 In those cases, all certs are considered to have unknown status. | |
| 150 The invalid state can only be cleared during an update if all | |
| 151 error states are cleared */ | |
| 152 PRBool refresh; /* manual refresh from tokens has been forced */ | |
| 153 PRBool mustchoose; /* trigger reselection algorithm, for case when | |
| 154 RAM CRL objects are dropped from the cache */ | |
| 155 PRTime lastfetch; /* time a CRL token fetch was last performed */ | |
| 156 PRTime lastcheck; /* time CRL token objects were last checked for | |
| 157 existence */ | |
| 158 }; | |
| 159 | |
| 160 /* CRL issuer cache object | |
| 161 This object tracks all the distribution point caches for a given issuer. | |
| 162 XCRL once we support multiple issuing distribution points, this object | |
| 163 will be a hash table. For now, it just holds the single CRL distribution | |
| 164 point cache structure. | |
| 165 */ | |
| 166 | |
| 167 struct CRLIssuerCacheStr { | |
| 168 SECItem* subject; /* DER of issuer subject */ | |
| 169 CRLDPCache* dpp; | |
| 170 #if 0 | |
| 171 /* XCRL for future use. | |
| 172 We don't need to lock at the moment because we only have one DP, | |
| 173 which gets created at the same time as this object */ | |
| 174 NSSRWLock* lock; | |
| 175 CRLDPCache** dps; | |
| 176 PLHashTable* distributionpoints; | |
| 177 CERTCertificate* issuer; | |
| 178 #endif | |
| 179 }; | |
| 180 | |
| 181 /* CRL revocation cache object | |
| 182 This object tracks all the issuer caches | |
| 183 */ | |
| 184 | |
| 185 struct CRLCacheStr { | |
| 186 #ifdef GLOBAL_RWLOCK | |
| 187 NSSRWLock* lock; | |
| 188 #else | |
| 189 PRLock* lock; | |
| 190 #endif | |
| 191 /* hash table of issuer to CRLIssuerCacheStr, | |
| 192 indexed by issuer DER subject */ | |
| 193 PLHashTable* issuers; | |
| 194 }; | |
| 195 | |
| 196 SECStatus InitCRLCache(void); | |
| 197 SECStatus ShutdownCRLCache(void); | |
| 198 | |
| 199 /* Returns a pointer to an environment-like string, a series of | |
| 200 ** null-terminated strings, terminated by a zero-length string. | |
| 201 ** This function is intended to be internal to NSS. | |
| 202 */ | |
| 203 extern char * cert_GetCertificateEmailAddresses(CERTCertificate *cert); | |
| 204 | |
| 205 /* | |
| 206 * These functions are used to map subjectKeyID extension values to certs | |
| 207 * and to keep track of the checks for user certificates in each slot | |
| 208 */ | |
| 209 SECStatus | |
| 210 cert_CreateSubjectKeyIDHashTable(void); | |
| 211 | |
| 212 SECStatus | |
| 213 cert_AddSubjectKeyIDMapping(SECItem *subjKeyID, CERTCertificate *cert); | |
| 214 | |
| 215 SECStatus | |
| 216 cert_UpdateSubjectKeyIDSlotCheck(SECItem *slotid, int series); | |
| 217 | |
| 218 int | |
| 219 cert_SubjectKeyIDSlotCheckSeries(SECItem *slotid); | |
| 220 | |
| 221 /* | |
| 222 * Call this function to remove an entry from the mapping table. | |
| 223 */ | |
| 224 SECStatus | |
| 225 cert_RemoveSubjectKeyIDMapping(SECItem *subjKeyID); | |
| 226 | |
| 227 SECStatus | |
| 228 cert_DestroySubjectKeyIDHashTable(void); | |
| 229 | |
| 230 SECItem* | |
| 231 cert_FindDERCertBySubjectKeyID(SECItem *subjKeyID); | |
| 232 | |
| 233 /* return maximum length of AVA value based on its type OID tag. */ | |
| 234 extern int cert_AVAOidTagToMaxLen(SECOidTag tag); | |
| 235 | |
| 236 /* Make an AVA, allocated from pool, from OID and DER encoded value */ | |
| 237 extern CERTAVA * CERT_CreateAVAFromRaw(PRArenaPool *pool, | |
| 238 const SECItem * OID, const SECItem * value); | |
| 239 | |
| 240 /* Make an AVA from binary input specified by SECItem */ | |
| 241 extern CERTAVA * CERT_CreateAVAFromSECItem(PRArenaPool *arena, SECOidTag kind, | |
| 242 int valueType, SECItem *value); | |
| 243 | |
| 244 /* | |
| 245 * get a DPCache object for the given issuer subject and dp | |
| 246 * Automatically creates the cache object if it doesn't exist yet. | |
| 247 */ | |
| 248 SECStatus AcquireDPCache(CERTCertificate* issuer, const SECItem* subject, | |
| 249 const SECItem* dp, int64 t, void* wincx, | |
| 250 CRLDPCache** dpcache, PRBool* writeLocked); | |
| 251 | |
| 252 /* check if a particular SN is in the CRL cache and return its entry */ | |
| 253 dpcacheStatus DPCache_Lookup(CRLDPCache* cache, SECItem* sn, | |
| 254 CERTCrlEntry** returned); | |
| 255 | |
| 256 /* release a DPCache object that was previously acquired */ | |
| 257 void ReleaseDPCache(CRLDPCache* dpcache, PRBool writeLocked); | |
| 258 | |
| 259 /* | |
| 260 * map Stan errors into NSS errors | |
| 261 * This function examines the stan error stack and automatically sets | |
| 262 * PORT_SetError(); to the appropriate SEC_ERROR value. | |
| 263 */ | |
| 264 void CERT_MapStanError(); | |
| 265 | |
| 266 /* Interface function for libpkix cert validation engine: | |
| 267 * cert_verify wrapper. */ | |
| 268 SECStatus | |
| 269 cert_VerifyCertChainPkix(CERTCertificate *cert, | |
| 270 PRBool checkSig, | |
| 271 SECCertUsage requiredUsage, | |
| 272 PRTime time, | |
| 273 void *wincx, | |
| 274 CERTVerifyLog *log, | |
| 275 PRBool *sigError, | |
| 276 PRBool *revoked); | |
| 277 | |
| 278 SECStatus cert_InitLocks(void); | |
| 279 | |
| 280 SECStatus cert_DestroyLocks(void); | |
| 281 | |
| 282 /* | |
| 283 * fill in nsCertType field of the cert based on the cert extension | |
| 284 */ | |
| 285 extern SECStatus cert_GetCertType(CERTCertificate *cert); | |
| 286 | |
| 287 /* | |
| 288 * compute and return the value of nsCertType for cert, but do not | |
| 289 * update the CERTCertificate. | |
| 290 */ | |
| 291 extern PRUint32 cert_ComputeCertType(CERTCertificate *cert); | |
| 292 | |
| 293 void cert_AddToVerifyLog(CERTVerifyLog *log,CERTCertificate *cert, | |
| 294 long errorCode, unsigned int depth, | |
| 295 void *arg); | |
| 296 | |
| 297 /* Insert a DER CRL into the CRL cache, and take ownership of it. | |
| 298 * | |
| 299 * cert_CacheCRLByGeneralName takes ownership of the memory in crl argument | |
| 300 * completely. crl must be freeable by SECITEM_FreeItem. It will be freed | |
| 301 * immediately if it is rejected from the CRL cache, or later during cache | |
| 302 * updates when a new crl is available, or at shutdown time. | |
| 303 * | |
| 304 * canonicalizedName represents the source of the CRL, a GeneralName. | |
| 305 * The format of the encoding is not restricted, but all callers of | |
| 306 * cert_CacheCRLByGeneralName and cert_FindCRLByGeneralName must use | |
| 307 * the same encoding. To facilitate X.500 name matching, a canonicalized | |
| 308 * encoding of the GeneralName should be used, if available. | |
| 309 */ | |
| 310 | |
| 311 SECStatus cert_CacheCRLByGeneralName(CERTCertDBHandle* dbhandle, SECItem* crl, | |
| 312 const SECItem* canonicalizedName); | |
| 313 | |
| 314 struct NamedCRLCacheStr { | |
| 315 PRLock* lock; | |
| 316 PLHashTable* entries; | |
| 317 }; | |
| 318 | |
| 319 /* NamedCRLCacheEntryStr is filled in by cert_CacheCRLByGeneralName, | |
| 320 * and read by cert_FindCRLByGeneralName */ | |
| 321 struct NamedCRLCacheEntryStr { | |
| 322 SECItem* canonicalizedName; | |
| 323 SECItem* crl; /* DER, kept only if CRL | |
| 324 * is successfully cached */ | |
| 325 PRBool inCRLCache; | |
| 326 PRTime successfulInsertionTime; /* insertion time */ | |
| 327 PRTime lastAttemptTime; /* time of last call to | |
| 328 cert_CacheCRLByGeneralName with this name */ | |
| 329 PRBool badDER; /* ASN.1 error */ | |
| 330 PRBool dupe; /* matching DER CRL already in CRL cache */ | |
| 331 PRBool unsupported; /* IDP, delta, any other reason */ | |
| 332 }; | |
| 333 | |
| 334 typedef enum { | |
| 335 certRevocationStatusRevoked = 0, | |
| 336 certRevocationStatusValid = 1, | |
| 337 certRevocationStatusUnknown = 2 | |
| 338 } CERTRevocationStatus; | |
| 339 | |
| 340 /* Returns detailed status of the cert(revStatus variable). Tells if | |
| 341 * issuer cache has OriginFetchedWithTimeout crl in it. */ | |
| 342 SECStatus | |
| 343 cert_CheckCertRevocationStatus(CERTCertificate* cert, CERTCertificate* issuer, | |
| 344 const SECItem* dp, PRTime t, void *wincx, | |
| 345 CERTRevocationStatus *revStatus, | |
| 346 CERTCRLEntryReasonCode *revReason); | |
| 347 | |
| 348 | |
| 349 SECStatus cert_AcquireNamedCRLCache(NamedCRLCache** returned); | |
| 350 | |
| 351 /* cert_FindCRLByGeneralName must be called only while the named cache is | |
| 352 * acquired, and the entry is only valid until cache is released. | |
| 353 */ | |
| 354 SECStatus cert_FindCRLByGeneralName(NamedCRLCache* ncc, | |
| 355 const SECItem* canonicalizedName, | |
| 356 NamedCRLCacheEntry** retEntry); | |
| 357 | |
| 358 SECStatus cert_ReleaseNamedCRLCache(NamedCRLCache* ncc); | |
| 359 | |
| 360 /* This is private for now. Maybe shoule be public. */ | |
| 361 CERTGeneralName * | |
| 362 cert_GetSubjectAltNameList(CERTCertificate *cert, PRArenaPool *arena); | |
| 363 | |
| 364 /* Count DNS names and IP addresses in a list of GeneralNames */ | |
| 365 PRUint32 | |
| 366 cert_CountDNSPatterns(CERTGeneralName *firstName); | |
| 367 | |
| 368 /* | |
| 369 * returns the trust status of the leaf certificate based on usage. | |
| 370 * If the leaf is explicitly untrusted, this function will fail and | |
| 371 * failedFlags will be set to the trust bit value that lead to the failure. | |
| 372 * If the leaf is trusted, isTrusted is set to true and the function returns | |
| 373 * SECSuccess. This function does not check if the cert is fit for a | |
| 374 * particular usage. | |
| 375 */ | |
| 376 SECStatus | |
| 377 cert_CheckLeafTrust(CERTCertificate *cert, | |
| 378 SECCertUsage usage, | |
| 379 unsigned int *failedFlags, | |
| 380 PRBool *isTrusted); | |
| 381 | |
| 382 #endif /* _CERTI_H_ */ | |
| 383 | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 14249009:
Change the NSS and NSPR source tree to the new directory structure to be (Closed)
Base URL: svn://svn.chromium.org/chrome/trunk/deps/third_party/nss/