| OLD | NEW |
|---|
| (Empty) |
| 1 /* This Source Code Form is subject to the terms of the Mozilla Public | |
| 2 * License, v. 2.0. If a copy of the MPL was not distributed with this | |
| 3 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ | |
| 4 /* | |
| 5 * certt.h - public data structures for the certificate library | |
| 6 * | |
| 7 * $Id: certt.h,v 1.58 2013/01/07 03:56:12 ryan.sleevi%gmail.com Exp $ | |
| 8 */ | |
| 9 #ifndef _CERTT_H_ | |
| 10 #define _CERTT_H_ | |
| 11 | |
| 12 #include "prclist.h" | |
| 13 #include "pkcs11t.h" | |
| 14 #include "seccomon.h" | |
| 15 #include "secmodt.h" | |
| 16 #include "secoidt.h" | |
| 17 #include "plarena.h" | |
| 18 #include "prcvar.h" | |
| 19 #include "nssilock.h" | |
| 20 #include "prio.h" | |
| 21 #include "prmon.h" | |
| 22 | |
| 23 /* Stan data types */ | |
| 24 struct NSSCertificateStr; | |
| 25 struct NSSTrustDomainStr; | |
| 26 | |
| 27 /* Non-opaque objects */ | |
| 28 typedef struct CERTAVAStr CERTAVA; | |
| 29 typedef struct CERTAttributeStr CERTAttribute; | |
| 30 typedef struct CERTAuthInfoAccessStr CERTAuthInfoAccess; | |
| 31 typedef struct CERTAuthKeyIDStr CERTAuthKeyID; | |
| 32 typedef struct CERTBasicConstraintsStr CERTBasicConstraints; | |
| 33 typedef struct NSSTrustDomainStr CERTCertDBHandle; | |
| 34 typedef struct CERTCertExtensionStr CERTCertExtension; | |
| 35 typedef struct CERTCertKeyStr CERTCertKey; | |
| 36 typedef struct CERTCertListStr CERTCertList; | |
| 37 typedef struct CERTCertListNodeStr CERTCertListNode; | |
| 38 typedef struct CERTCertNicknamesStr CERTCertNicknames; | |
| 39 typedef struct CERTCertTrustStr CERTCertTrust; | |
| 40 typedef struct CERTCertificateStr CERTCertificate; | |
| 41 typedef struct CERTCertificateListStr CERTCertificateList; | |
| 42 typedef struct CERTCertificateRequestStr CERTCertificateRequest; | |
| 43 typedef struct CERTCrlStr CERTCrl; | |
| 44 typedef struct CERTCrlDistributionPointsStr CERTCrlDistributionPoints; | |
| 45 typedef struct CERTCrlEntryStr CERTCrlEntry; | |
| 46 typedef struct CERTCrlHeadNodeStr CERTCrlHeadNode; | |
| 47 typedef struct CERTCrlKeyStr CERTCrlKey; | |
| 48 typedef struct CERTCrlNodeStr CERTCrlNode; | |
| 49 typedef struct CERTDERCertsStr CERTDERCerts; | |
| 50 typedef struct CERTDistNamesStr CERTDistNames; | |
| 51 typedef struct CERTGeneralNameStr CERTGeneralName; | |
| 52 typedef struct CERTGeneralNameListStr CERTGeneralNameList; | |
| 53 typedef struct CERTIssuerAndSNStr CERTIssuerAndSN; | |
| 54 typedef struct CERTNameStr CERTName; | |
| 55 typedef struct CERTNameConstraintStr CERTNameConstraint; | |
| 56 typedef struct CERTNameConstraintsStr CERTNameConstraints; | |
| 57 typedef struct CERTOKDomainNameStr CERTOKDomainName; | |
| 58 typedef struct CERTPrivKeyUsagePeriodStr CERTPrivKeyUsagePeriod; | |
| 59 typedef struct CERTPublicKeyAndChallengeStr CERTPublicKeyAndChallenge; | |
| 60 typedef struct CERTRDNStr CERTRDN; | |
| 61 typedef struct CERTSignedCrlStr CERTSignedCrl; | |
| 62 typedef struct CERTSignedDataStr CERTSignedData; | |
| 63 typedef struct CERTStatusConfigStr CERTStatusConfig; | |
| 64 typedef struct CERTSubjectListStr CERTSubjectList; | |
| 65 typedef struct CERTSubjectNodeStr CERTSubjectNode; | |
| 66 typedef struct CERTSubjectPublicKeyInfoStr CERTSubjectPublicKeyInfo; | |
| 67 typedef struct CERTValidityStr CERTValidity; | |
| 68 typedef struct CERTVerifyLogStr CERTVerifyLog; | |
| 69 typedef struct CERTVerifyLogNodeStr CERTVerifyLogNode; | |
| 70 typedef struct CRLDistributionPointStr CRLDistributionPoint; | |
| 71 | |
| 72 /* CRL extensions type */ | |
| 73 typedef unsigned long CERTCrlNumber; | |
| 74 | |
| 75 /* | |
| 76 ** An X.500 AVA object | |
| 77 */ | |
| 78 struct CERTAVAStr { | |
| 79 SECItem type; | |
| 80 SECItem value; | |
| 81 }; | |
| 82 | |
| 83 /* | |
| 84 ** An X.500 RDN object | |
| 85 */ | |
| 86 struct CERTRDNStr { | |
| 87 CERTAVA **avas; | |
| 88 }; | |
| 89 | |
| 90 /* | |
| 91 ** An X.500 name object | |
| 92 */ | |
| 93 struct CERTNameStr { | |
| 94 PLArenaPool *arena; | |
| 95 CERTRDN **rdns; | |
| 96 }; | |
| 97 | |
| 98 /* | |
| 99 ** An X.509 validity object | |
| 100 */ | |
| 101 struct CERTValidityStr { | |
| 102 PLArenaPool *arena; | |
| 103 SECItem notBefore; | |
| 104 SECItem notAfter; | |
| 105 }; | |
| 106 | |
| 107 /* | |
| 108 * A serial number and issuer name, which is used as a database key | |
| 109 */ | |
| 110 struct CERTCertKeyStr { | |
| 111 SECItem serialNumber; | |
| 112 SECItem derIssuer; | |
| 113 }; | |
| 114 | |
| 115 /* | |
| 116 ** A signed data object. Used to implement the "signed" macro used | |
| 117 ** in the X.500 specs. | |
| 118 */ | |
| 119 struct CERTSignedDataStr { | |
| 120 SECItem data; | |
| 121 SECAlgorithmID signatureAlgorithm; | |
| 122 SECItem signature; | |
| 123 }; | |
| 124 | |
| 125 /* | |
| 126 ** An X.509 subject-public-key-info object | |
| 127 */ | |
| 128 struct CERTSubjectPublicKeyInfoStr { | |
| 129 PLArenaPool *arena; | |
| 130 SECAlgorithmID algorithm; | |
| 131 SECItem subjectPublicKey; | |
| 132 }; | |
| 133 | |
| 134 struct CERTPublicKeyAndChallengeStr { | |
| 135 SECItem spki; | |
| 136 SECItem challenge; | |
| 137 }; | |
| 138 | |
| 139 struct CERTCertTrustStr { | |
| 140 unsigned int sslFlags; | |
| 141 unsigned int emailFlags; | |
| 142 unsigned int objectSigningFlags; | |
| 143 }; | |
| 144 | |
| 145 /* | |
| 146 * defined the types of trust that exist | |
| 147 */ | |
| 148 typedef enum SECTrustTypeEnum { | |
| 149 trustSSL = 0, | |
| 150 trustEmail = 1, | |
| 151 trustObjectSigning = 2, | |
| 152 trustTypeNone = 3 | |
| 153 } SECTrustType; | |
| 154 | |
| 155 #define SEC_GET_TRUST_FLAGS(trust,type) \ | |
| 156 (((type)==trustSSL)?((trust)->sslFlags): \ | |
| 157 (((type)==trustEmail)?((trust)->emailFlags): \ | |
| 158 (((type)==trustObjectSigning)?((trust)->objectSigningFlags):0))) | |
| 159 | |
| 160 /* | |
| 161 ** An X.509.3 certificate extension | |
| 162 */ | |
| 163 struct CERTCertExtensionStr { | |
| 164 SECItem id; | |
| 165 SECItem critical; | |
| 166 SECItem value; | |
| 167 }; | |
| 168 | |
| 169 struct CERTSubjectNodeStr { | |
| 170 struct CERTSubjectNodeStr *next; | |
| 171 struct CERTSubjectNodeStr *prev; | |
| 172 SECItem certKey; | |
| 173 SECItem keyID; | |
| 174 }; | |
| 175 | |
| 176 struct CERTSubjectListStr { | |
| 177 PLArenaPool *arena; | |
| 178 int ncerts; | |
| 179 char *emailAddr; | |
| 180 CERTSubjectNode *head; | |
| 181 CERTSubjectNode *tail; /* do we need tail? */ | |
| 182 void *entry; | |
| 183 }; | |
| 184 | |
| 185 /* | |
| 186 ** An X.509 certificate object (the unsigned form) | |
| 187 */ | |
| 188 struct CERTCertificateStr { | |
| 189 /* the arena is used to allocate any data structures that have the same | |
| 190 * lifetime as the cert. This is all stuff that hangs off of the cert | |
| 191 * structure, and is all freed at the same time. I is used when the | |
| 192 * cert is decoded, destroyed, and at some times when it changes | |
| 193 * state | |
| 194 */ | |
| 195 PLArenaPool *arena; | |
| 196 | |
| 197 /* The following fields are static after the cert has been decoded */ | |
| 198 char *subjectName; | |
| 199 char *issuerName; | |
| 200 CERTSignedData signatureWrap; /* XXX */ | |
| 201 SECItem derCert; /* original DER for the cert */ | |
| 202 SECItem derIssuer; /* DER for issuer name */ | |
| 203 SECItem derSubject; /* DER for subject name */ | |
| 204 SECItem derPublicKey; /* DER for the public key */ | |
| 205 SECItem certKey; /* database key for this cert */ | |
| 206 SECItem version; | |
| 207 SECItem serialNumber; | |
| 208 SECAlgorithmID signature; | |
| 209 CERTName issuer; | |
| 210 CERTValidity validity; | |
| 211 CERTName subject; | |
| 212 CERTSubjectPublicKeyInfo subjectPublicKeyInfo; | |
| 213 SECItem issuerID; | |
| 214 SECItem subjectID; | |
| 215 CERTCertExtension **extensions; | |
| 216 char *emailAddr; | |
| 217 CERTCertDBHandle *dbhandle; | |
| 218 SECItem subjectKeyID; /* x509v3 subject key identifier */ | |
| 219 PRBool keyIDGenerated; /* was the keyid generated? */ | |
| 220 unsigned int keyUsage; /* what uses are allowed for this cert */ | |
| 221 unsigned int rawKeyUsage; /* value of the key usage extension */ | |
| 222 PRBool keyUsagePresent; /* was the key usage extension present */ | |
| 223 PRUint32 nsCertType; /* value of the ns cert type extension */ | |
| 224 /* must be 32-bit for PR_ATOMIC_SET */ | |
| 225 | |
| 226 /* these values can be set by the application to bypass certain checks | |
| 227 * or to keep the cert in memory for an entire session. | |
| 228 * XXX - need an api to set these | |
| 229 */ | |
| 230 PRBool keepSession; /* keep this cert for entire session*/ | |
| 231 PRBool timeOK; /* is the bad validity time ok? */ | |
| 232 CERTOKDomainName *domainOK; /* these domain names are ok */ | |
| 233 | |
| 234 /* | |
| 235 * these values can change when the cert changes state. These state | |
| 236 * changes include transitions from temp to perm or vice-versa, and | |
| 237 * changes of trust flags | |
| 238 */ | |
| 239 PRBool isperm; | |
| 240 PRBool istemp; | |
| 241 char *nickname; | |
| 242 char *dbnickname; | |
| 243 struct NSSCertificateStr *nssCertificate; /* This is Stan stuff. */ | |
| 244 CERTCertTrust *trust; | |
| 245 | |
| 246 /* the reference count is modified whenever someone looks up, dups | |
| 247 * or destroys a certificate | |
| 248 */ | |
| 249 int referenceCount; | |
| 250 | |
| 251 /* The subject list is a list of all certs with the same subject name. | |
| 252 * It can be modified any time a cert is added or deleted from either | |
| 253 * the in-memory(temporary) or on-disk(permanent) database. | |
| 254 */ | |
| 255 CERTSubjectList *subjectList; | |
| 256 | |
| 257 /* these belong in the static section, but are here to maintain | |
| 258 * the structure's integrity | |
| 259 */ | |
| 260 CERTAuthKeyID * authKeyID; /* x509v3 authority key identifier */ | |
| 261 PRBool isRoot; /* cert is the end of a chain */ | |
| 262 | |
| 263 /* these fields are used by client GUI code to keep track of ssl sockets | |
| 264 * that are blocked waiting on GUI feedback related to this cert. | |
| 265 * XXX - these should be moved into some sort of application specific | |
| 266 * data structure. They are only used by the browser right now. | |
| 267 */ | |
| 268 union { | |
| 269 void* apointer; /* was struct SECSocketNode* authsocketlist */ | |
| 270 struct { | |
| 271 unsigned int hasUnsupportedCriticalExt :1; | |
| 272 /* add any new option bits needed here */ | |
| 273 } bits; | |
| 274 } options; | |
| 275 int series; /* was int authsocketcount; record the series of the pkcs11ID */ | |
| 276 | |
| 277 /* This is PKCS #11 stuff. */ | |
| 278 PK11SlotInfo *slot; /*if this cert came of a token, which is it*/ | |
| 279 CK_OBJECT_HANDLE pkcs11ID; /*and which object on that token is it */ | |
| 280 PRBool ownSlot; /*true if the cert owns the slot reference */ | |
| 281 }; | |
| 282 #define SEC_CERTIFICATE_VERSION_1 0 /* default created */ | |
| 283 #define SEC_CERTIFICATE_VERSION_2 1 /* v2 */ | |
| 284 #define SEC_CERTIFICATE_VERSION_3 2 /* v3 extensions */ | |
| 285 | |
| 286 #define SEC_CRL_VERSION_1 0 /* default */ | |
| 287 #define SEC_CRL_VERSION_2 1 /* v2 extensions */ | |
| 288 | |
| 289 /* | |
| 290 * used to identify class of cert in mime stream code | |
| 291 */ | |
| 292 #define SEC_CERT_CLASS_CA 1 | |
| 293 #define SEC_CERT_CLASS_SERVER 2 | |
| 294 #define SEC_CERT_CLASS_USER 3 | |
| 295 #define SEC_CERT_CLASS_EMAIL 4 | |
| 296 | |
| 297 struct CERTDERCertsStr { | |
| 298 PLArenaPool *arena; | |
| 299 int numcerts; | |
| 300 SECItem *rawCerts; | |
| 301 }; | |
| 302 | |
| 303 /* | |
| 304 ** A PKCS ? Attribute | |
| 305 ** XXX this is duplicated through out the code, it *should* be moved | |
| 306 ** to a central location. Where would be appropriate? | |
| 307 */ | |
| 308 struct CERTAttributeStr { | |
| 309 SECItem attrType; | |
| 310 SECItem **attrValue; | |
| 311 }; | |
| 312 | |
| 313 /* | |
| 314 ** A PKCS#10 certificate-request object (the unsigned form) | |
| 315 */ | |
| 316 struct CERTCertificateRequestStr { | |
| 317 PLArenaPool *arena; | |
| 318 SECItem version; | |
| 319 CERTName subject; | |
| 320 CERTSubjectPublicKeyInfo subjectPublicKeyInfo; | |
| 321 CERTAttribute **attributes; | |
| 322 }; | |
| 323 #define SEC_CERTIFICATE_REQUEST_VERSION 0 /* what we *create* */ | |
| 324 | |
| 325 | |
| 326 /* | |
| 327 ** A certificate list object. | |
| 328 */ | |
| 329 struct CERTCertificateListStr { | |
| 330 SECItem *certs; | |
| 331 int len; /* number of certs */ | |
| 332 PLArenaPool *arena; | |
| 333 }; | |
| 334 | |
| 335 struct CERTCertListNodeStr { | |
| 336 PRCList links; | |
| 337 CERTCertificate *cert; | |
| 338 void *appData; | |
| 339 }; | |
| 340 | |
| 341 struct CERTCertListStr { | |
| 342 PRCList list; | |
| 343 PLArenaPool *arena; | |
| 344 }; | |
| 345 | |
| 346 #define CERT_LIST_HEAD(l) ((CERTCertListNode *)PR_LIST_HEAD(&l->list)) | |
| 347 #define CERT_LIST_NEXT(n) ((CERTCertListNode *)n->links.next) | |
| 348 #define CERT_LIST_END(n,l) (((void *)n) == ((void *)&l->list)) | |
| 349 #define CERT_LIST_EMPTY(l) CERT_LIST_END(CERT_LIST_HEAD(l), l) | |
| 350 | |
| 351 struct CERTCrlEntryStr { | |
| 352 SECItem serialNumber; | |
| 353 SECItem revocationDate; | |
| 354 CERTCertExtension **extensions; | |
| 355 }; | |
| 356 | |
| 357 struct CERTCrlStr { | |
| 358 PLArenaPool *arena; | |
| 359 SECItem version; | |
| 360 SECAlgorithmID signatureAlg; | |
| 361 SECItem derName; | |
| 362 CERTName name; | |
| 363 SECItem lastUpdate; | |
| 364 SECItem nextUpdate; /* optional for x.509 CRL */ | |
| 365 CERTCrlEntry **entries; | |
| 366 CERTCertExtension **extensions; | |
| 367 /* can't add anything there for binary backwards compatibility reasons */ | |
| 368 }; | |
| 369 | |
| 370 struct CERTCrlKeyStr { | |
| 371 SECItem derName; | |
| 372 SECItem dummy; /* The decoder can not skip a primitive, | |
| 373 this serves as a place holder for the | |
| 374 decoder to finish its task only | |
| 375 */ | |
| 376 }; | |
| 377 | |
| 378 struct CERTSignedCrlStr { | |
| 379 PLArenaPool *arena; | |
| 380 CERTCrl crl; | |
| 381 void *reserved1; | |
| 382 PRBool reserved2; | |
| 383 PRBool isperm; | |
| 384 PRBool istemp; | |
| 385 int referenceCount; | |
| 386 CERTCertDBHandle *dbhandle; | |
| 387 CERTSignedData signatureWrap; /* XXX */ | |
| 388 char *url; | |
| 389 SECItem *derCrl; | |
| 390 PK11SlotInfo *slot; | |
| 391 CK_OBJECT_HANDLE pkcs11ID; | |
| 392 void* opaque; /* do not touch */ | |
| 393 }; | |
| 394 | |
| 395 | |
| 396 struct CERTCrlHeadNodeStr { | |
| 397 PLArenaPool *arena; | |
| 398 CERTCertDBHandle *dbhandle; | |
| 399 CERTCrlNode *first; | |
| 400 CERTCrlNode *last; | |
| 401 }; | |
| 402 | |
| 403 | |
| 404 struct CERTCrlNodeStr { | |
| 405 CERTCrlNode *next; | |
| 406 int type; | |
| 407 CERTSignedCrl *crl; | |
| 408 }; | |
| 409 | |
| 410 | |
| 411 /* | |
| 412 * Array of X.500 Distinguished Names | |
| 413 */ | |
| 414 struct CERTDistNamesStr { | |
| 415 PLArenaPool *arena; | |
| 416 int nnames; | |
| 417 SECItem *names; | |
| 418 void *head; /* private */ | |
| 419 }; | |
| 420 | |
| 421 | |
| 422 #define NS_CERT_TYPE_SSL_CLIENT (0x80) /* bit 0 */ | |
| 423 #define NS_CERT_TYPE_SSL_SERVER (0x40) /* bit 1 */ | |
| 424 #define NS_CERT_TYPE_EMAIL (0x20) /* bit 2 */ | |
| 425 #define NS_CERT_TYPE_OBJECT_SIGNING (0x10) /* bit 3 */ | |
| 426 #define NS_CERT_TYPE_RESERVED (0x08) /* bit 4 */ | |
| 427 #define NS_CERT_TYPE_SSL_CA (0x04) /* bit 5 */ | |
| 428 #define NS_CERT_TYPE_EMAIL_CA (0x02) /* bit 6 */ | |
| 429 #define NS_CERT_TYPE_OBJECT_SIGNING_CA (0x01) /* bit 7 */ | |
| 430 | |
| 431 #define EXT_KEY_USAGE_TIME_STAMP (0x8000) | |
| 432 #define EXT_KEY_USAGE_STATUS_RESPONDER (0x4000) | |
| 433 | |
| 434 #define NS_CERT_TYPE_APP ( NS_CERT_TYPE_SSL_CLIENT | \ | |
| 435 NS_CERT_TYPE_SSL_SERVER | \ | |
| 436 NS_CERT_TYPE_EMAIL | \ | |
| 437 NS_CERT_TYPE_OBJECT_SIGNING ) | |
| 438 | |
| 439 #define NS_CERT_TYPE_CA ( NS_CERT_TYPE_SSL_CA | \ | |
| 440 NS_CERT_TYPE_EMAIL_CA | \ | |
| 441 NS_CERT_TYPE_OBJECT_SIGNING_CA | \ | |
| 442 EXT_KEY_USAGE_STATUS_RESPONDER ) | |
| 443 typedef enum SECCertUsageEnum { | |
| 444 certUsageSSLClient = 0, | |
| 445 certUsageSSLServer = 1, | |
| 446 certUsageSSLServerWithStepUp = 2, | |
| 447 certUsageSSLCA = 3, | |
| 448 certUsageEmailSigner = 4, | |
| 449 certUsageEmailRecipient = 5, | |
| 450 certUsageObjectSigner = 6, | |
| 451 certUsageUserCertImport = 7, | |
| 452 certUsageVerifyCA = 8, | |
| 453 certUsageProtectedObjectSigner = 9, | |
| 454 certUsageStatusResponder = 10, | |
| 455 certUsageAnyCA = 11 | |
| 456 } SECCertUsage; | |
| 457 | |
| 458 typedef PRInt64 SECCertificateUsage; | |
| 459 | |
| 460 #define certificateUsageCheckAllUsages (0x0000) | |
| 461 #define certificateUsageSSLClient (0x0001) | |
| 462 #define certificateUsageSSLServer (0x0002) | |
| 463 #define certificateUsageSSLServerWithStepUp (0x0004) | |
| 464 #define certificateUsageSSLCA (0x0008) | |
| 465 #define certificateUsageEmailSigner (0x0010) | |
| 466 #define certificateUsageEmailRecipient (0x0020) | |
| 467 #define certificateUsageObjectSigner (0x0040) | |
| 468 #define certificateUsageUserCertImport (0x0080) | |
| 469 #define certificateUsageVerifyCA (0x0100) | |
| 470 #define certificateUsageProtectedObjectSigner (0x0200) | |
| 471 #define certificateUsageStatusResponder (0x0400) | |
| 472 #define certificateUsageAnyCA (0x0800) | |
| 473 | |
| 474 #define certificateUsageHighest certificateUsageAnyCA | |
| 475 | |
| 476 /* | |
| 477 * Does the cert belong to the user, a peer, or a CA. | |
| 478 */ | |
| 479 typedef enum CERTCertOwnerEnum { | |
| 480 certOwnerUser = 0, | |
| 481 certOwnerPeer = 1, | |
| 482 certOwnerCA = 2 | |
| 483 } CERTCertOwner; | |
| 484 | |
| 485 /* | |
| 486 * This enum represents the state of validity times of a certificate | |
| 487 */ | |
| 488 typedef enum SECCertTimeValidityEnum { | |
| 489 secCertTimeValid = 0, | |
| 490 secCertTimeExpired = 1, | |
| 491 secCertTimeNotValidYet = 2, | |
| 492 secCertTimeUndetermined = 3 /* validity could not be decoded from the | |
| 493 cert, most likely because it was NULL */ | |
| 494 } SECCertTimeValidity; | |
| 495 | |
| 496 /* | |
| 497 * This is used as return status in functions that compare the validity | |
| 498 * periods of two certificates A and B, currently only | |
| 499 * CERT_CompareValidityTimes. | |
| 500 */ | |
| 501 | |
| 502 typedef enum CERTCompareValidityStatusEnum | |
| 503 { | |
| 504 certValidityUndetermined = 0, /* the function is unable to select one cert | |
| 505 over another */ | |
| 506 certValidityChooseB = 1, /* cert B should be preferred */ | |
| 507 certValidityEqual = 2, /* both certs have the same validity period */ | |
| 508 certValidityChooseA = 3 /* cert A should be preferred */ | |
| 509 } CERTCompareValidityStatus; | |
| 510 | |
| 511 /* | |
| 512 * Interface for getting certificate nickname strings out of the database | |
| 513 */ | |
| 514 | |
| 515 /* these are values for the what argument below */ | |
| 516 #define SEC_CERT_NICKNAMES_ALL 1 | |
| 517 #define SEC_CERT_NICKNAMES_USER 2 | |
| 518 #define SEC_CERT_NICKNAMES_SERVER 3 | |
| 519 #define SEC_CERT_NICKNAMES_CA 4 | |
| 520 | |
| 521 struct CERTCertNicknamesStr { | |
| 522 PLArenaPool *arena; | |
| 523 void *head; | |
| 524 int numnicknames; | |
| 525 char **nicknames; | |
| 526 int what; | |
| 527 int totallen; | |
| 528 }; | |
| 529 | |
| 530 struct CERTIssuerAndSNStr { | |
| 531 SECItem derIssuer; | |
| 532 CERTName issuer; | |
| 533 SECItem serialNumber; | |
| 534 }; | |
| 535 | |
| 536 | |
| 537 /* X.509 v3 Key Usage Extension flags */ | |
| 538 #define KU_DIGITAL_SIGNATURE (0x80) /* bit 0 */ | |
| 539 #define KU_NON_REPUDIATION (0x40) /* bit 1 */ | |
| 540 #define KU_KEY_ENCIPHERMENT (0x20) /* bit 2 */ | |
| 541 #define KU_DATA_ENCIPHERMENT (0x10) /* bit 3 */ | |
| 542 #define KU_KEY_AGREEMENT (0x08) /* bit 4 */ | |
| 543 #define KU_KEY_CERT_SIGN (0x04) /* bit 5 */ | |
| 544 #define KU_CRL_SIGN (0x02) /* bit 6 */ | |
| 545 #define KU_ENCIPHER_ONLY (0x01) /* bit 7 */ | |
| 546 #define KU_ALL (KU_DIGITAL_SIGNATURE | \ | |
| 547 KU_NON_REPUDIATION | \ | |
| 548 KU_KEY_ENCIPHERMENT | \ | |
| 549 KU_DATA_ENCIPHERMENT | \ | |
| 550 KU_KEY_AGREEMENT | \ | |
| 551 KU_KEY_CERT_SIGN | \ | |
| 552 KU_CRL_SIGN | \ | |
| 553 KU_ENCIPHER_ONLY) | |
| 554 | |
| 555 /* This value will not occur in certs. It is used internally for the case | |
| 556 * when either digital signature or non-repudiation is the correct value. | |
| 557 */ | |
| 558 #define KU_DIGITAL_SIGNATURE_OR_NON_REPUDIATION (0x2000) | |
| 559 | |
| 560 /* This value will not occur in certs. It is used internally for the case | |
| 561 * when the key type is not know ahead of time and either key agreement or | |
| 562 * key encipherment are the correct value based on key type | |
| 563 */ | |
| 564 #define KU_KEY_AGREEMENT_OR_ENCIPHERMENT (0x4000) | |
| 565 | |
| 566 /* internal bits that do not match bits in the x509v3 spec, but are used | |
| 567 * for similar purposes | |
| 568 */ | |
| 569 #define KU_NS_GOVT_APPROVED (0x8000) /*don't make part of KU_ALL!*/ | |
| 570 /* | |
| 571 * x.509 v3 Basic Constraints Extension | |
| 572 * If isCA is false, the pathLenConstraint is ignored. | |
| 573 * Otherwise, the following pathLenConstraint values will apply: | |
| 574 * < 0 - there is no limit to the certificate path | |
| 575 * 0 - CA can issues end-entity certificates only | |
| 576 * > 0 - the number of certificates in the certificate path is | |
| 577 * limited to this number | |
| 578 */ | |
| 579 #define CERT_UNLIMITED_PATH_CONSTRAINT -2 | |
| 580 | |
| 581 struct CERTBasicConstraintsStr { | |
| 582 PRBool isCA; /* on if is CA */ | |
| 583 int pathLenConstraint; /* maximum number of certificates that c
an be | |
| 584 in the cert path. Only applies to a
CA | |
| 585 certificate; otherwise, it's ignored. | |
| 586 */ | |
| 587 }; | |
| 588 | |
| 589 /* Maximum length of a certificate chain */ | |
| 590 #define CERT_MAX_CERT_CHAIN 20 | |
| 591 | |
| 592 #define CERT_MAX_SERIAL_NUMBER_BYTES 20 /* from RFC 3280 */ | |
| 593 #define CERT_MAX_DN_BYTES 4096 /* arbitrary */ | |
| 594 | |
| 595 /* x.509 v3 Reason Flags, used in CRLDistributionPoint Extension */ | |
| 596 #define RF_UNUSED (0x80) /* bit 0 */ | |
| 597 #define RF_KEY_COMPROMISE (0x40) /* bit 1 */ | |
| 598 #define RF_CA_COMPROMISE (0x20) /* bit 2 */ | |
| 599 #define RF_AFFILIATION_CHANGED (0x10) /* bit 3 */ | |
| 600 #define RF_SUPERSEDED (0x08) /* bit 4 */ | |
| 601 #define RF_CESSATION_OF_OPERATION (0x04) /* bit 5 */ | |
| 602 #define RF_CERTIFICATE_HOLD (0x02) /* bit 6 */ | |
| 603 | |
| 604 /* enum for CRL Entry Reason Code */ | |
| 605 typedef enum CERTCRLEntryReasonCodeEnum { | |
| 606 crlEntryReasonUnspecified = 0, | |
| 607 crlEntryReasonKeyCompromise = 1, | |
| 608 crlEntryReasonCaCompromise = 2, | |
| 609 crlEntryReasonAffiliationChanged = 3, | |
| 610 crlEntryReasonSuperseded = 4, | |
| 611 crlEntryReasonCessationOfOperation = 5, | |
| 612 crlEntryReasoncertificatedHold = 6, | |
| 613 crlEntryReasonRemoveFromCRL = 8, | |
| 614 crlEntryReasonPrivilegeWithdrawn = 9, | |
| 615 crlEntryReasonAaCompromise = 10 | |
| 616 } CERTCRLEntryReasonCode; | |
| 617 | |
| 618 /* If we needed to extract the general name field, use this */ | |
| 619 /* General Name types */ | |
| 620 typedef enum CERTGeneralNameTypeEnum { | |
| 621 certOtherName = 1, | |
| 622 certRFC822Name = 2, | |
| 623 certDNSName = 3, | |
| 624 certX400Address = 4, | |
| 625 certDirectoryName = 5, | |
| 626 certEDIPartyName = 6, | |
| 627 certURI = 7, | |
| 628 certIPAddress = 8, | |
| 629 certRegisterID = 9 | |
| 630 } CERTGeneralNameType; | |
| 631 | |
| 632 | |
| 633 typedef struct OtherNameStr { | |
| 634 SECItem name; | |
| 635 SECItem oid; | |
| 636 }OtherName; | |
| 637 | |
| 638 | |
| 639 | |
| 640 struct CERTGeneralNameStr { | |
| 641 CERTGeneralNameType type; /* name type */ | |
| 642 union { | |
| 643 CERTName directoryName; /* distinguish name */ | |
| 644 OtherName OthName; /* Other Name */ | |
| 645 SECItem other; /* the rest of the name forms */ | |
| 646 }name; | |
| 647 SECItem derDirectoryName; /* this is saved to simplify directory n
ame | |
| 648 comparison */ | |
| 649 PRCList l; | |
| 650 }; | |
| 651 | |
| 652 struct CERTGeneralNameListStr { | |
| 653 PLArenaPool *arena; | |
| 654 CERTGeneralName *name; | |
| 655 int refCount; | |
| 656 int len; | |
| 657 PZLock *lock; | |
| 658 }; | |
| 659 | |
| 660 struct CERTNameConstraintStr { | |
| 661 CERTGeneralName name; | |
| 662 SECItem DERName; | |
| 663 SECItem min; | |
| 664 SECItem max; | |
| 665 PRCList l; | |
| 666 }; | |
| 667 | |
| 668 | |
| 669 struct CERTNameConstraintsStr { | |
| 670 CERTNameConstraint *permited; | |
| 671 CERTNameConstraint *excluded; | |
| 672 SECItem **DERPermited; | |
| 673 SECItem **DERExcluded; | |
| 674 }; | |
| 675 | |
| 676 | |
| 677 /* Private Key Usage Period extension struct. */ | |
| 678 struct CERTPrivKeyUsagePeriodStr { | |
| 679 SECItem notBefore; | |
| 680 SECItem notAfter; | |
| 681 PLArenaPool *arena; | |
| 682 }; | |
| 683 | |
| 684 /* X.509 v3 Authority Key Identifier extension. For the authority certificate | |
| 685 issuer field, we only support URI now. | |
| 686 */ | |
| 687 struct CERTAuthKeyIDStr { | |
| 688 SECItem keyID; /* unique key identifier */ | |
| 689 CERTGeneralName *authCertIssuer; /* CA's issuer name. End with a NULL */ | |
| 690 SECItem authCertSerialNumber; /* CA's certificate serial number */ | |
| 691 SECItem **DERAuthCertIssuer; /* This holds the DER encoded format of | |
| 692 the authCertIssuer field. It is used | |
| 693 by the encoding engine. It should be | |
| 694 used as a read only field by the call
er. | |
| 695 */ | |
| 696 }; | |
| 697 | |
| 698 /* x.509 v3 CRL Distributeion Point */ | |
| 699 | |
| 700 /* | |
| 701 * defined the types of CRL Distribution points | |
| 702 */ | |
| 703 typedef enum DistributionPointTypesEnum { | |
| 704 generalName = 1, /* only support this for now */ | |
| 705 relativeDistinguishedName = 2 | |
| 706 } DistributionPointTypes; | |
| 707 | |
| 708 struct CRLDistributionPointStr { | |
| 709 DistributionPointTypes distPointType; | |
| 710 union { | |
| 711 CERTGeneralName *fullName; | |
| 712 CERTRDN relativeName; | |
| 713 } distPoint; | |
| 714 SECItem reasons; | |
| 715 CERTGeneralName *crlIssuer; | |
| 716 | |
| 717 /* Reserved for internal use only*/ | |
| 718 SECItem derDistPoint; | |
| 719 SECItem derRelativeName; | |
| 720 SECItem **derCrlIssuer; | |
| 721 SECItem **derFullName; | |
| 722 SECItem bitsmap; | |
| 723 }; | |
| 724 | |
| 725 struct CERTCrlDistributionPointsStr { | |
| 726 CRLDistributionPoint **distPoints; | |
| 727 }; | |
| 728 | |
| 729 /* | |
| 730 * This structure is used to keep a log of errors when verifying | |
| 731 * a cert chain. This allows multiple errors to be reported all at | |
| 732 * once. | |
| 733 */ | |
| 734 struct CERTVerifyLogNodeStr { | |
| 735 CERTCertificate *cert; /* what cert had the error */ | |
| 736 long error; /* what error was it? */ | |
| 737 unsigned int depth; /* how far up the chain are we */ | |
| 738 void *arg; /* error specific argument */ | |
| 739 struct CERTVerifyLogNodeStr *next; /* next in the list */ | |
| 740 struct CERTVerifyLogNodeStr *prev; /* next in the list */ | |
| 741 }; | |
| 742 | |
| 743 | |
| 744 struct CERTVerifyLogStr { | |
| 745 PLArenaPool *arena; | |
| 746 unsigned int count; | |
| 747 struct CERTVerifyLogNodeStr *head; | |
| 748 struct CERTVerifyLogNodeStr *tail; | |
| 749 }; | |
| 750 | |
| 751 | |
| 752 struct CERTOKDomainNameStr { | |
| 753 CERTOKDomainName *next; | |
| 754 char name[1]; /* actual length may be longer. */ | |
| 755 }; | |
| 756 | |
| 757 | |
| 758 typedef SECStatus (PR_CALLBACK *CERTStatusChecker) (CERTCertDBHandle *handle, | |
| 759 CERTCertificate *cert, | |
| 760 PRTime time, | |
| 761 void *pwArg); | |
| 762 | |
| 763 typedef SECStatus (PR_CALLBACK *CERTStatusDestroy) (CERTStatusConfig *handle); | |
| 764 | |
| 765 struct CERTStatusConfigStr { | |
| 766 CERTStatusChecker statusChecker; /* NULL means no checking enabled */ | |
| 767 CERTStatusDestroy statusDestroy; /* enabled or no, will clean up */ | |
| 768 void *statusContext; /* cx specific to checking protocol */ | |
| 769 }; | |
| 770 | |
| 771 struct CERTAuthInfoAccessStr { | |
| 772 SECItem method; | |
| 773 SECItem derLocation; | |
| 774 CERTGeneralName *location; /* decoded location */ | |
| 775 }; | |
| 776 | |
| 777 | |
| 778 /* This is the typedef for the callback passed to CERT_OpenCertDB() */ | |
| 779 /* callback to return database name based on version number */ | |
| 780 typedef char * (*CERTDBNameFunc)(void *arg, int dbVersion); | |
| 781 | |
| 782 /* | |
| 783 * types of cert packages that we can decode | |
| 784 */ | |
| 785 typedef enum CERTPackageTypeEnum { | |
| 786 certPackageNone = 0, | |
| 787 certPackageCert = 1, | |
| 788 certPackagePKCS7 = 2, | |
| 789 certPackageNSCertSeq = 3, | |
| 790 certPackageNSCertWrap = 4 | |
| 791 } CERTPackageType; | |
| 792 | |
| 793 /* | |
| 794 * these types are for the PKIX Certificate Policies extension | |
| 795 */ | |
| 796 typedef struct { | |
| 797 SECOidTag oid; | |
| 798 SECItem qualifierID; | |
| 799 SECItem qualifierValue; | |
| 800 } CERTPolicyQualifier; | |
| 801 | |
| 802 typedef struct { | |
| 803 SECOidTag oid; | |
| 804 SECItem policyID; | |
| 805 CERTPolicyQualifier **policyQualifiers; | |
| 806 } CERTPolicyInfo; | |
| 807 | |
| 808 typedef struct { | |
| 809 PLArenaPool *arena; | |
| 810 CERTPolicyInfo **policyInfos; | |
| 811 } CERTCertificatePolicies; | |
| 812 | |
| 813 typedef struct { | |
| 814 SECItem organization; | |
| 815 SECItem **noticeNumbers; | |
| 816 } CERTNoticeReference; | |
| 817 | |
| 818 typedef struct { | |
| 819 PLArenaPool *arena; | |
| 820 CERTNoticeReference noticeReference; | |
| 821 SECItem derNoticeReference; | |
| 822 SECItem displayText; | |
| 823 } CERTUserNotice; | |
| 824 | |
| 825 typedef struct { | |
| 826 PLArenaPool *arena; | |
| 827 SECItem **oids; | |
| 828 } CERTOidSequence; | |
| 829 | |
| 830 /* | |
| 831 * these types are for the PKIX Policy Mappings extension | |
| 832 */ | |
| 833 typedef struct { | |
| 834 SECItem issuerDomainPolicy; | |
| 835 SECItem subjectDomainPolicy; | |
| 836 } CERTPolicyMap; | |
| 837 | |
| 838 typedef struct { | |
| 839 PLArenaPool *arena; | |
| 840 CERTPolicyMap **policyMaps; | |
| 841 } CERTCertificatePolicyMappings; | |
| 842 | |
| 843 /* | |
| 844 * these types are for the PKIX inhibitAnyPolicy extension | |
| 845 */ | |
| 846 typedef struct { | |
| 847 SECItem inhibitAnySkipCerts; | |
| 848 } CERTCertificateInhibitAny; | |
| 849 | |
| 850 /* | |
| 851 * these types are for the PKIX Policy Constraints extension | |
| 852 */ | |
| 853 typedef struct { | |
| 854 SECItem explicitPolicySkipCerts; | |
| 855 SECItem inhibitMappingSkipCerts; | |
| 856 } CERTCertificatePolicyConstraints; | |
| 857 | |
| 858 /* | |
| 859 * These types are for the validate chain callback param. | |
| 860 * | |
| 861 * CERTChainVerifyCallback is an application-supplied callback that can be used | |
| 862 * to augment libpkix's certificate chain validation with additional | |
| 863 * application-specific checks. It may be called multiple times if there are | |
| 864 * multiple potentially-valid paths for the certificate being validated. This | |
| 865 * callback is called before revocation checking is done on the certificates in | |
| 866 * the given chain. | |
| 867 * | |
| 868 * - isValidChainArg contains the application-provided opaque argument | |
| 869 * - currentChain is the currently validated chain. It is ordered with the leaf | |
| 870 * certificate at the head and the trust anchor at the tail. | |
| 871 * | |
| 872 * The callback should set *chainOK = PR_TRUE and return SECSuccess if the | |
| 873 * certificate chain is acceptable. It should set *chainOK = PR_FALSE and | |
| 874 * return SECSuccess if the chain is unacceptable, to indicate that the given | |
| 875 * chain is bad and path building should continue. It should return SECFailure | |
| 876 * to indicate an fatal error that will cause path validation to fail | |
| 877 * immediately. | |
| 878 */ | |
| 879 typedef SECStatus (*CERTChainVerifyCallbackFunc) | |
| 880 (void *isChainValidArg, | |
| 881 const CERTCertList *currentChain, | |
| 882 PRBool *chainOK); | |
| 883 | |
| 884 /* | |
| 885 * Note: If extending this structure, it will be necessary to change the | |
| 886 * associated CERTValParamInType | |
| 887 */ | |
| 888 typedef struct { | |
| 889 CERTChainVerifyCallbackFunc isChainValid; | |
| 890 void *isChainValidArg; | |
| 891 } CERTChainVerifyCallback; | |
| 892 | |
| 893 /* | |
| 894 * these types are for the CERT_PKIX* Verification functions | |
| 895 * These are all optional parameters. | |
| 896 */ | |
| 897 | |
| 898 typedef enum { | |
| 899 cert_pi_end = 0, /* SPECIAL: signifies end of array of | |
| 900 * CERTValParam* */ | |
| 901 cert_pi_nbioContext = 1, /* specify a non-blocking IO context used to | |
| 902 * resume a session. If this argument is | |
| 903 * specified, no other arguments should be. | |
| 904 * Specified in value.pointer.p. If the | |
| 905 * operation completes the context will be | |
| 906 * freed. */ | |
| 907 cert_pi_nbioAbort = 2, /* specify a non-blocking IO context for an | |
| 908 * existing operation which the caller wants | |
| 909 * to abort. If this argument is | |
| 910 * specified, no other arguments should be. | |
| 911 * Specified in value.pointer.p. If the | |
| 912 * operation succeeds the context will be | |
| 913 * freed. */ | |
| 914 cert_pi_certList = 3, /* specify the chain to validate against. If | |
| 915 * this value is given, then the path | |
| 916 * construction step in the validation is | |
| 917 * skipped. Specified in value.pointer.chain */ | |
| 918 cert_pi_policyOID = 4, /* validate certificate for policy OID. | |
| 919 * Specified in value.array.oids. Cert must | |
| 920 * be good for at least one OID in order | |
| 921 * to validate. Default is that the user is not | |
| 922 * concerned about certificate policy. */ | |
| 923 cert_pi_policyFlags = 5, /* flags for each policy specified in policyOID. | |
| 924 * Specified in value.scalar.ul. Policy flags | |
| 925 * apply to all specified oids. | |
| 926 * Use CERT_POLICY_FLAG_* macros below. If not | |
| 927 * specified policy flags default to 0 */ | |
| 928 cert_pi_keyusage = 6, /* specify what the keyusages the certificate | |
| 929 * will be evaluated against, specified in | |
| 930 * value.scalar.ui. The cert must validate for | |
| 931 * at least one of the specified key usages. | |
| 932 * Values match the KU_ bit flags defined | |
| 933 * in this file. Default is derived from | |
| 934 * the 'usages' function argument */ | |
| 935 cert_pi_extendedKeyusage= 7, /* specify what the required extended key | |
| 936 * usage of the certificate. Specified as | |
| 937 * an array of oidTags in value.array.oids. | |
| 938 * The cert must validate for at least one | |
| 939 * of the specified extended key usages. | |
| 940 * If not specified, no extended key usages | |
| 941 * will be checked. */ | |
| 942 cert_pi_date = 8, /* validate certificate is valid as of date | |
| 943 * specified in value.scalar.time. A special | |
| 944 * value '0' indicates 'now'. default is '0' */ | |
| 945 cert_pi_revocationFlags = 9, /* Specify what revocation checking to do. | |
| 946 * See CERT_REV_FLAG_* macros below | |
| 947 * Set in value.pointer.revocation */ | |
| 948 cert_pi_certStores = 10,/* Bitmask of Cert Store flags (see below) | |
| 949 * Set in value.scalar.ui */ | |
| 950 cert_pi_trustAnchors = 11,/* Specify the list of trusted roots to | |
| 951 * validate against. | |
| 952 * The default set of trusted roots, these are | |
| 953 * root CA certs from libnssckbi.so or CA | |
| 954 * certs trusted by user, are used in any of | |
| 955 * the following cases: | |
| 956 * * when the parameter is not set. | |
| 957 * * when the list of trust anchors is empt
y. | |
| 958 * Note that this handling can be further altere
d by altering the | |
| 959 * cert_pi_useOnlyTrustAnchors flag | |
| 960 * Specified in value.pointer.chain */ | |
| 961 cert_pi_useAIACertFetch = 12, /* Enables cert fetching using AIA extension. | |
| 962 * In NSS 3.12.1 or later. Default is off. | |
| 963 * Value is in value.scalar.b */ | |
| 964 cert_pi_chainVerifyCallback = 13, | |
| 965 /* The callback container for doing extra | |
| 966 * validation on the currently calculated chain. | |
| 967 * Value is in value.pointer.chainVerifyCallback
*/ | |
| 968 cert_pi_useOnlyTrustAnchors = 14,/* If true, disables trusting any | |
| 969 * certificates other than the ones passed in vi
a cert_pi_trustAnchors. | |
| 970 * If false, then the certificates specified via
cert_pi_trustAnchors | |
| 971 * will be combined with the pre-existing truste
d roots, but only for | |
| 972 * the certificate validation being performed. | |
| 973 * If no value has been supplied via cert_pi_tru
stAnchors, this has no | |
| 974 * effect. | |
| 975 * The default value is true, meaning if this is
not supplied, only | |
| 976 * trust anchors supplied via cert_pi_trustAncho
rs are trusted. | |
| 977 * Specified in value.scalar.b */ | |
| 978 cert_pi_max /* SPECIAL: signifies maximum allowed value, | |
| 979 * can increase in future releases */ | |
| 980 } CERTValParamInType; | |
| 981 | |
| 982 /* | |
| 983 * for all out parameters: | |
| 984 * out parameters are only returned if the caller asks for them in | |
| 985 * the CERTValOutParam array. Caller is responsible for the CERTValOutParam | |
| 986 * array itself. The pkix verify function will allocate and other arrays | |
| 987 * pointers, or objects. The Caller is responsible for freeing those results. | |
| 988 * If SECWouldBlock is returned, only cert_pi_nbioContext is returned. | |
| 989 */ | |
| 990 typedef enum { | |
| 991 cert_po_end = 0, /* SPECIAL: signifies end of array of | |
| 992 * CERTValParam* */ | |
| 993 cert_po_nbioContext = 1, /* Return a nonblocking context. If no | |
| 994 * non-blocking context is specified, then | |
| 995 * blocking IO will be used. | |
| 996 * Returned in value.pointer.p. The context is | |
| 997 * freed after an abort or a complete operation. | |
| 998 * This value is only returned on SECWouldBlock. | |
| 999 */ | |
| 1000 cert_po_trustAnchor = 2, /* Return the trust anchor for the chain that | |
| 1001 * was validated. Returned in | |
| 1002 * value.pointer.cert, this value is only | |
| 1003 * returned on SECSuccess. */ | |
| 1004 cert_po_certList = 3, /* Return the entire chain that was validated. | |
| 1005 * Returned in value.pointer.certList. If no | |
| 1006 * chain could be constructed, this value | |
| 1007 * would be NULL. */ | |
| 1008 cert_po_policyOID = 4, /* Return the policies that were found to be | |
| 1009 * valid. Returned in value.array.oids as an | |
| 1010 * array. This is only returned on | |
| 1011 * SECSuccess. */ | |
| 1012 cert_po_errorLog = 5, /* Return a log of problems with the chain. | |
| 1013 * Returned in value.pointer.log */ | |
| 1014 cert_po_usages = 6, /* Return what usages the certificate is valid | |
| 1015 for. Returned in value.scalar.usages */ | |
| 1016 cert_po_keyUsage = 7, /* Return what key usages the certificate | |
| 1017 * is valid for. | |
| 1018 * Returned in value.scalar.usage */ | |
| 1019 cert_po_extendedKeyusage= 8, /* Return what extended key usages the | |
| 1020 * certificate is valid for. | |
| 1021 * Returned in value.array.oids */ | |
| 1022 cert_po_max /* SPECIAL: signifies maximum allowed value, | |
| 1023 * can increase in future releases */ | |
| 1024 | |
| 1025 } CERTValParamOutType; | |
| 1026 | |
| 1027 typedef enum { | |
| 1028 cert_revocation_method_crl = 0, | |
| 1029 cert_revocation_method_ocsp, | |
| 1030 cert_revocation_method_count | |
| 1031 } CERTRevocationMethodIndex; | |
| 1032 | |
| 1033 | |
| 1034 /* | |
| 1035 * The following flags are supposed to be used to control bits in | |
| 1036 * each integer contained in the array pointed to be: | |
| 1037 * CERTRevocationTests.cert_rev_flags_per_method | |
| 1038 * All Flags are prefixed by CERT_REV_M_, where _M_ indicates | |
| 1039 * this is a method dependent flag. | |
| 1040 */ | |
| 1041 | |
| 1042 /* | |
| 1043 * Whether or not to use a method for revocation testing. | |
| 1044 * If set to "do not test", then all other flags are ignored. | |
| 1045 */ | |
| 1046 #define CERT_REV_M_DO_NOT_TEST_USING_THIS_METHOD 0L | |
| 1047 #define CERT_REV_M_TEST_USING_THIS_METHOD 1L | |
| 1048 | |
| 1049 /* | |
| 1050 * Whether or not NSS is allowed to attempt to fetch fresh information | |
| 1051 * from the network. | |
| 1052 * (Although fetching will never happen if fresh information for the | |
| 1053 * method is already locally available.) | |
| 1054 */ | |
| 1055 #define CERT_REV_M_ALLOW_NETWORK_FETCHING 0L | |
| 1056 #define CERT_REV_M_FORBID_NETWORK_FETCHING 2L | |
| 1057 | |
| 1058 /* | |
| 1059 * Example for an implicit default source: | |
| 1060 * The globally configured default OCSP responder. | |
| 1061 * IGNORE means: | |
| 1062 * ignore the implicit default source, whether it's configured or not. | |
| 1063 * ALLOW means: | |
| 1064 * if an implicit default source is configured, | |
| 1065 * then it overrides any available or missing source in the cert. | |
| 1066 * if no implicit default source is configured, | |
| 1067 * then we continue to use what's available (or not available) | |
| 1068 * in the certs. | |
| 1069 */ | |
| 1070 #define CERT_REV_M_ALLOW_IMPLICIT_DEFAULT_SOURCE 0L | |
| 1071 #define CERT_REV_M_IGNORE_IMPLICIT_DEFAULT_SOURCE 4L | |
| 1072 | |
| 1073 /* | |
| 1074 * Defines the behavior if no fresh information is available, | |
| 1075 * fetching from the network is allowed, but the source of revocation | |
| 1076 * information is unknown (even after considering implicit sources, | |
| 1077 * if allowed by other flags). | |
| 1078 * SKIPT_TEST means: | |
| 1079 * We ignore that no fresh information is available and | |
| 1080 * skip this test. | |
| 1081 * REQUIRE_INFO means: | |
| 1082 * We still require that fresh information is available. | |
| 1083 * Other flags define what happens on missing fresh info. | |
| 1084 */ | |
| 1085 #define CERT_REV_M_SKIP_TEST_ON_MISSING_SOURCE 0L | |
| 1086 #define CERT_REV_M_REQUIRE_INFO_ON_MISSING_SOURCE 8L | |
| 1087 | |
| 1088 /* | |
| 1089 * Defines the behavior if we are unable to obtain fresh information. | |
| 1090 * INGORE means: | |
| 1091 * Return "cert status unknown" | |
| 1092 * FAIL means: | |
| 1093 * Return "cert revoked". | |
| 1094 */ | |
| 1095 #define CERT_REV_M_IGNORE_MISSING_FRESH_INFO 0L | |
| 1096 #define CERT_REV_M_FAIL_ON_MISSING_FRESH_INFO 16L | |
| 1097 | |
| 1098 /* | |
| 1099 * What should happen if we were able to find fresh information using | |
| 1100 * this method, and the data indicated the cert is good? | |
| 1101 * STOP_TESTING means: | |
| 1102 * Our success is sufficient, do not continue testing | |
| 1103 * other methods. | |
| 1104 * CONTINUE_TESTING means: | |
| 1105 * We will continue and test the next allowed | |
| 1106 * specified method. | |
| 1107 */ | |
| 1108 #define CERT_REV_M_STOP_TESTING_ON_FRESH_INFO 0L | |
| 1109 #define CERT_REV_M_CONTINUE_TESTING_ON_FRESH_INFO 32L | |
| 1110 | |
| 1111 /* | |
| 1112 * The following flags are supposed to be used to control bits in | |
| 1113 * CERTRevocationTests.cert_rev_method_independent_flags | |
| 1114 * All Flags are prefixed by CERT_REV_M_, where _M_ indicates | |
| 1115 * this is a method independent flag. | |
| 1116 */ | |
| 1117 | |
| 1118 /* | |
| 1119 * This defines the order to checking. | |
| 1120 * EACH_METHOD_SEPARATELY means: | |
| 1121 * Do all tests related to a particular allowed method | |
| 1122 * (both local information and network fetching) in a single step. | |
| 1123 * Only after testing for a particular method is done, | |
| 1124 * then switching to the next method will happen. | |
| 1125 * ALL_LOCAL_INFORMATION_FIRST means: | |
| 1126 * Start by testing the information for all allowed methods | |
| 1127 * which are already locally available. Only after that is done | |
| 1128 * consider to fetch from the network (as allowed by other flags). | |
| 1129 */ | |
| 1130 #define CERT_REV_MI_TEST_EACH_METHOD_SEPARATELY 0L | |
| 1131 #define CERT_REV_MI_TEST_ALL_LOCAL_INFORMATION_FIRST 1L | |
| 1132 | |
| 1133 /* | |
| 1134 * Use this flag to specify that it's necessary that fresh information | |
| 1135 * is available for at least one of the allowed methods, but it's | |
| 1136 * irrelevant which of the mechanisms succeeded. | |
| 1137 * NO_OVERALL_INFO_REQUIREMENT means: | |
| 1138 * We strictly follow the requirements for each individual method. | |
| 1139 * REQUIRE_SOME_FRESH_INFO_AVAILABLE means: | |
| 1140 * After the individual tests have been executed, we must have | |
| 1141 * been able to find fresh information using at least one method. | |
| 1142 * If we were unable to find fresh info, it's a failure. | |
| 1143 * This setting overrides the CERT_REV_M_FAIL_ON_MISSING_FRESH_INFO | |
| 1144 * flag on all methods. | |
| 1145 */ | |
| 1146 #define CERT_REV_MI_NO_OVERALL_INFO_REQUIREMENT 0L | |
| 1147 #define CERT_REV_MI_REQUIRE_SOME_FRESH_INFO_AVAILABLE 2L | |
| 1148 | |
| 1149 | |
| 1150 typedef struct { | |
| 1151 /* | |
| 1152 * The size of the array that cert_rev_flags_per_method points to, | |
| 1153 * meaning, the number of methods that are known and defined | |
| 1154 * by the caller. | |
| 1155 */ | |
| 1156 PRUint32 number_of_defined_methods; | |
| 1157 | |
| 1158 /* | |
| 1159 * A pointer to an array of integers. | |
| 1160 * Each integer defines revocation checking for a single method, | |
| 1161 * by having individual CERT_REV_M_* bits set or not set. | |
| 1162 * The meaning of index numbers into this array are defined by | |
| 1163 * enum CERTRevocationMethodIndex | |
| 1164 * The size of the array must be specified by the caller in the separate | |
| 1165 * variable number_of_defined_methods. | |
| 1166 * The size of the array may be smaller than | |
| 1167 * cert_revocation_method_count, it can happen if a caller | |
| 1168 * is not yet aware of the latest revocation methods | |
| 1169 * (or does not want to use them). | |
| 1170 */ | |
| 1171 PRUint64 *cert_rev_flags_per_method; | |
| 1172 | |
| 1173 /* | |
| 1174 * How many preferred methods are specified? | |
| 1175 * This is equivalent to the size of the array that | |
| 1176 * preferred_revocation_methods points to. | |
| 1177 * It's allowed to set this value to zero, | |
| 1178 * then NSS will decide which methods to prefer. | |
| 1179 */ | |
| 1180 PRUint32 number_of_preferred_methods; | |
| 1181 | |
| 1182 /* Array that may specify an optional order of preferred methods. | |
| 1183 * Each array entry shall contain a method identifier as defined | |
| 1184 * by CERTRevocationMethodIndex. | |
| 1185 * The entry at index [0] specifies the method with highest preferrence. | |
| 1186 * These methods will be tested first for locally available information. | |
| 1187 * Methods allowed for downloading will be attempted in the same order. | |
| 1188 */ | |
| 1189 CERTRevocationMethodIndex *preferred_methods; | |
| 1190 | |
| 1191 /* | |
| 1192 * An integer which defines certain aspects of revocation checking | |
| 1193 * (independent of individual methods) by having individual | |
| 1194 * CERT_REV_MI_* bits set or not set. | |
| 1195 */ | |
| 1196 PRUint64 cert_rev_method_independent_flags; | |
| 1197 } CERTRevocationTests; | |
| 1198 | |
| 1199 typedef struct { | |
| 1200 CERTRevocationTests leafTests; | |
| 1201 CERTRevocationTests chainTests; | |
| 1202 } CERTRevocationFlags; | |
| 1203 | |
| 1204 typedef struct CERTValParamInValueStr { | |
| 1205 union { | |
| 1206 PRBool b; | |
| 1207 PRInt32 i; | |
| 1208 PRUint32 ui; | |
| 1209 PRInt64 l; | |
| 1210 PRUint64 ul; | |
| 1211 PRTime time; | |
| 1212 } scalar; | |
| 1213 union { | |
| 1214 const void* p; | |
| 1215 const char* s; | |
| 1216 const CERTCertificate* cert; | |
| 1217 const CERTCertList *chain; | |
| 1218 const CERTRevocationFlags *revocation; | |
| 1219 const CERTChainVerifyCallback *chainVerifyCallback; | |
| 1220 } pointer; | |
| 1221 union { | |
| 1222 const PRInt32 *pi; | |
| 1223 const PRUint32 *pui; | |
| 1224 const PRInt64 *pl; | |
| 1225 const PRUint64 *pul; | |
| 1226 const SECOidTag *oids; | |
| 1227 } array; | |
| 1228 int arraySize; | |
| 1229 } CERTValParamInValue; | |
| 1230 | |
| 1231 | |
| 1232 typedef struct CERTValParamOutValueStr { | |
| 1233 union { | |
| 1234 PRBool b; | |
| 1235 PRInt32 i; | |
| 1236 PRUint32 ui; | |
| 1237 PRInt64 l; | |
| 1238 PRUint64 ul; | |
| 1239 SECCertificateUsage usages; | |
| 1240 } scalar; | |
| 1241 union { | |
| 1242 void* p; | |
| 1243 char* s; | |
| 1244 CERTVerifyLog *log; | |
| 1245 CERTCertificate* cert; | |
| 1246 CERTCertList *chain; | |
| 1247 } pointer; | |
| 1248 union { | |
| 1249 void *p; | |
| 1250 SECOidTag *oids; | |
| 1251 } array; | |
| 1252 int arraySize; | |
| 1253 } CERTValParamOutValue; | |
| 1254 | |
| 1255 typedef struct { | |
| 1256 CERTValParamInType type; | |
| 1257 CERTValParamInValue value; | |
| 1258 } CERTValInParam; | |
| 1259 | |
| 1260 typedef struct { | |
| 1261 CERTValParamOutType type; | |
| 1262 CERTValParamOutValue value; | |
| 1263 } CERTValOutParam; | |
| 1264 | |
| 1265 /* | |
| 1266 * Levels of standards conformance strictness for CERT_NameToAsciiInvertible | |
| 1267 */ | |
| 1268 typedef enum CertStrictnessLevels { | |
| 1269 CERT_N2A_READABLE = 0, /* maximum human readability */ | |
| 1270 CERT_N2A_STRICT = 10, /* strict RFC compliance */ | |
| 1271 CERT_N2A_INVERTIBLE = 20 /* maximum invertibility, | |
| 1272 all DirectoryStrings encoded in hex */ | |
| 1273 } CertStrictnessLevel; | |
| 1274 | |
| 1275 /* | |
| 1276 * policy flag defines | |
| 1277 */ | |
| 1278 #define CERT_POLICY_FLAG_NO_MAPPING 1 | |
| 1279 #define CERT_POLICY_FLAG_EXPLICIT 2 | |
| 1280 #define CERT_POLICY_FLAG_NO_ANY 4 | |
| 1281 | |
| 1282 /* | |
| 1283 * CertStore flags | |
| 1284 */ | |
| 1285 #define CERT_ENABLE_LDAP_FETCH 1 | |
| 1286 #define CERT_ENABLE_HTTP_FETCH 2 | |
| 1287 | |
| 1288 /* This functin pointer type may be used for any function that takes | |
| 1289 * a CERTCertificate * and returns an allocated string, which must be | |
| 1290 * freed by a call to PORT_Free. | |
| 1291 */ | |
| 1292 typedef char * (*CERT_StringFromCertFcn)(CERTCertificate *cert); | |
| 1293 | |
| 1294 /* XXX Lisa thinks the template declarations belong in cert.h, not here? */ | |
| 1295 | |
| 1296 #include "secasn1t.h" /* way down here because I expect template stuff to | |
| 1297 * move out of here anyway */ | |
| 1298 | |
| 1299 SEC_BEGIN_PROTOS | |
| 1300 | |
| 1301 extern const SEC_ASN1Template CERT_CertificateRequestTemplate[]; | |
| 1302 extern const SEC_ASN1Template CERT_CertificateTemplate[]; | |
| 1303 extern const SEC_ASN1Template SEC_SignedCertificateTemplate[]; | |
| 1304 extern const SEC_ASN1Template CERT_CertExtensionTemplate[]; | |
| 1305 extern const SEC_ASN1Template CERT_SequenceOfCertExtensionTemplate[]; | |
| 1306 extern const SEC_ASN1Template SECKEY_PublicKeyTemplate[]; | |
| 1307 extern const SEC_ASN1Template CERT_SubjectPublicKeyInfoTemplate[]; | |
| 1308 extern const SEC_ASN1Template CERT_TimeChoiceTemplate[]; | |
| 1309 extern const SEC_ASN1Template CERT_ValidityTemplate[]; | |
| 1310 extern const SEC_ASN1Template CERT_PublicKeyAndChallengeTemplate[]; | |
| 1311 extern const SEC_ASN1Template SEC_CertSequenceTemplate[]; | |
| 1312 | |
| 1313 extern const SEC_ASN1Template CERT_IssuerAndSNTemplate[]; | |
| 1314 extern const SEC_ASN1Template CERT_NameTemplate[]; | |
| 1315 extern const SEC_ASN1Template CERT_SetOfSignedCrlTemplate[]; | |
| 1316 extern const SEC_ASN1Template CERT_RDNTemplate[]; | |
| 1317 extern const SEC_ASN1Template CERT_SignedDataTemplate[]; | |
| 1318 extern const SEC_ASN1Template CERT_CrlTemplate[]; | |
| 1319 extern const SEC_ASN1Template CERT_SignedCrlTemplate[]; | |
| 1320 | |
| 1321 /* | |
| 1322 ** XXX should the attribute stuff be centralized for all of ns/security? | |
| 1323 */ | |
| 1324 extern const SEC_ASN1Template CERT_AttributeTemplate[]; | |
| 1325 extern const SEC_ASN1Template CERT_SetOfAttributeTemplate[]; | |
| 1326 | |
| 1327 /* These functions simply return the address of the above-declared templates. | |
| 1328 ** This is necessary for Windows DLLs. Sigh. | |
| 1329 */ | |
| 1330 SEC_ASN1_CHOOSER_DECLARE(CERT_CertificateRequestTemplate) | |
| 1331 SEC_ASN1_CHOOSER_DECLARE(CERT_CertificateTemplate) | |
| 1332 SEC_ASN1_CHOOSER_DECLARE(CERT_CrlTemplate) | |
| 1333 SEC_ASN1_CHOOSER_DECLARE(CERT_IssuerAndSNTemplate) | |
| 1334 SEC_ASN1_CHOOSER_DECLARE(CERT_NameTemplate) | |
| 1335 SEC_ASN1_CHOOSER_DECLARE(CERT_SequenceOfCertExtensionTemplate) | |
| 1336 SEC_ASN1_CHOOSER_DECLARE(CERT_SetOfSignedCrlTemplate) | |
| 1337 SEC_ASN1_CHOOSER_DECLARE(CERT_SignedDataTemplate) | |
| 1338 SEC_ASN1_CHOOSER_DECLARE(CERT_SubjectPublicKeyInfoTemplate) | |
| 1339 SEC_ASN1_CHOOSER_DECLARE(SEC_SignedCertificateTemplate) | |
| 1340 SEC_ASN1_CHOOSER_DECLARE(CERT_SignedCrlTemplate) | |
| 1341 SEC_ASN1_CHOOSER_DECLARE(CERT_TimeChoiceTemplate) | |
| 1342 | |
| 1343 SEC_END_PROTOS | |
| 1344 | |
| 1345 #endif /* _CERTT_H_ */ | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 14249009:
Change the NSS and NSPR source tree to the new directory structure to be (Closed)
Base URL: svn://svn.chromium.org/chrome/trunk/deps/third_party/nss/