| OLD | NEW |
|---|
| (Empty) |
| 1 /* This Source Code Form is subject to the terms of the Mozilla Public | |
| 2 * License, v. 2.0. If a copy of the MPL was not distributed with this | |
| 3 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ | |
| 4 | |
| 5 /* | |
| 6 * Interface to the PKCS7 implementation. | |
| 7 * | |
| 8 * $Id: secpkcs7.h,v 1.10 2012/11/27 22:48:08 bsmith%mozilla.com Exp $ | |
| 9 */ | |
| 10 | |
| 11 #ifndef _SECPKCS7_H_ | |
| 12 #define _SECPKCS7_H_ | |
| 13 | |
| 14 #include "seccomon.h" | |
| 15 | |
| 16 #include "secoidt.h" | |
| 17 #include "certt.h" | |
| 18 #include "keyt.h" | |
| 19 #include "hasht.h" | |
| 20 #include "pkcs7t.h" | |
| 21 | |
| 22 extern const SEC_ASN1Template sec_PKCS7ContentInfoTemplate[]; | |
| 23 | |
| 24 /************************************************************************/ | |
| 25 SEC_BEGIN_PROTOS | |
| 26 | |
| 27 /************************************************************************ | |
| 28 * Miscellaneous | |
| 29 ************************************************************************/ | |
| 30 | |
| 31 /* | |
| 32 * Returns the content type of the given contentInfo. | |
| 33 */ | |
| 34 extern SECOidTag SEC_PKCS7ContentType (SEC_PKCS7ContentInfo *cinfo); | |
| 35 | |
| 36 /* | |
| 37 * Destroy a PKCS7 contentInfo and all of its sub-pieces. | |
| 38 */ | |
| 39 extern void SEC_PKCS7DestroyContentInfo(SEC_PKCS7ContentInfo *contentInfo); | |
| 40 | |
| 41 /* | |
| 42 * Copy a PKCS7 contentInfo. A Destroy is needed on *each* copy. | |
| 43 */ | |
| 44 extern SEC_PKCS7ContentInfo * | |
| 45 SEC_PKCS7CopyContentInfo(SEC_PKCS7ContentInfo *contentInfo); | |
| 46 | |
| 47 /* | |
| 48 * Return a pointer to the actual content. In the case of those types | |
| 49 * which are encrypted, this returns the *plain* content. | |
| 50 */ | |
| 51 extern SECItem *SEC_PKCS7GetContent(SEC_PKCS7ContentInfo *cinfo); | |
| 52 | |
| 53 /************************************************************************ | |
| 54 * PKCS7 Decoding, Verification, etc.. | |
| 55 ************************************************************************/ | |
| 56 | |
| 57 extern SEC_PKCS7DecoderContext * | |
| 58 SEC_PKCS7DecoderStart(SEC_PKCS7DecoderContentCallback callback, | |
| 59 void *callback_arg, | |
| 60 SECKEYGetPasswordKey pwfn, void *pwfn_arg, | |
| 61 SEC_PKCS7GetDecryptKeyCallback decrypt_key_cb, | |
| 62 void *decrypt_key_cb_arg, | |
| 63 SEC_PKCS7DecryptionAllowedCallback decrypt_allowed_cb); | |
| 64 | |
| 65 extern SECStatus | |
| 66 SEC_PKCS7DecoderUpdate(SEC_PKCS7DecoderContext *p7dcx, | |
| 67 const char *buf, unsigned long len); | |
| 68 | |
| 69 extern SEC_PKCS7ContentInfo * | |
| 70 SEC_PKCS7DecoderFinish(SEC_PKCS7DecoderContext *p7dcx); | |
| 71 | |
| 72 | |
| 73 /* Abort the underlying ASN.1 stream & set an error */ | |
| 74 void SEC_PKCS7DecoderAbort(SEC_PKCS7DecoderContext *p7dcx, int error); | |
| 75 | |
| 76 extern SEC_PKCS7ContentInfo * | |
| 77 SEC_PKCS7DecodeItem(SECItem *p7item, | |
| 78 SEC_PKCS7DecoderContentCallback cb, void *cb_arg, | |
| 79 SECKEYGetPasswordKey pwfn, void *pwfn_arg, | |
| 80 SEC_PKCS7GetDecryptKeyCallback decrypt_key_cb, | |
| 81 void *decrypt_key_cb_arg, | |
| 82 SEC_PKCS7DecryptionAllowedCallback decrypt_allowed_cb); | |
| 83 | |
| 84 extern PRBool SEC_PKCS7ContainsCertsOrCrls(SEC_PKCS7ContentInfo *cinfo); | |
| 85 | |
| 86 /* checks to see if the contents of the content info is | |
| 87 * empty. it so, PR_TRUE is returned. PR_FALSE, otherwise. | |
| 88 * | |
| 89 * minLen is used to specify a minimum size. if content size <= minLen, | |
| 90 * content is assumed empty. | |
| 91 */ | |
| 92 extern PRBool | |
| 93 SEC_PKCS7IsContentEmpty(SEC_PKCS7ContentInfo *cinfo, unsigned int minLen); | |
| 94 | |
| 95 extern PRBool SEC_PKCS7ContentIsEncrypted(SEC_PKCS7ContentInfo *cinfo); | |
| 96 | |
| 97 /* | |
| 98 * If the PKCS7 content has a signature (not just *could* have a signature) | |
| 99 * return true; false otherwise. This can/should be called before calling | |
| 100 * VerifySignature, which will always indicate failure if no signature is | |
| 101 * present, but that does not mean there even was a signature! | |
| 102 * Note that the content itself can be empty (detached content was sent | |
| 103 * another way); it is the presence of the signature that matters. | |
| 104 */ | |
| 105 extern PRBool SEC_PKCS7ContentIsSigned(SEC_PKCS7ContentInfo *cinfo); | |
| 106 | |
| 107 /* | |
| 108 * SEC_PKCS7VerifySignature | |
| 109 * Look at a PKCS7 contentInfo and check if the signature is good. | |
| 110 * The verification checks that the signing cert is valid and trusted | |
| 111 * for the purpose specified by "certusage". | |
| 112 * | |
| 113 * In addition, if "keepcerts" is true, add any new certificates found | |
| 114 * into our local database. | |
| 115 */ | |
| 116 extern PRBool SEC_PKCS7VerifySignature(SEC_PKCS7ContentInfo *cinfo, | |
| 117 SECCertUsage certusage, | |
| 118 PRBool keepcerts); | |
| 119 | |
| 120 /* | |
| 121 * SEC_PKCS7VerifyDetachedSignature | |
| 122 * Look at a PKCS7 contentInfo and check if the signature matches | |
| 123 * a passed-in digest (calculated, supposedly, from detached contents). | |
| 124 * The verification checks that the signing cert is valid and trusted | |
| 125 * for the purpose specified by "certusage". | |
| 126 * | |
| 127 * In addition, if "keepcerts" is true, add any new certificates found | |
| 128 * into our local database. | |
| 129 */ | |
| 130 extern PRBool SEC_PKCS7VerifyDetachedSignature(SEC_PKCS7ContentInfo *cinfo, | |
| 131 SECCertUsage certusage, | |
| 132 const SECItem *detached_digest, | |
| 133 HASH_HashType digest_type, | |
| 134 PRBool keepcerts); | |
| 135 | |
| 136 /* | |
| 137 * SEC_PKCS7GetSignerCommonName, SEC_PKCS7GetSignerEmailAddress | |
| 138 * The passed-in contentInfo is espected to be Signed, and these | |
| 139 * functions return the specified portion of the full signer name. | |
| 140 * | |
| 141 * Returns a pointer to allocated memory, which must be freed. | |
| 142 * A NULL return value is an error. | |
| 143 */ | |
| 144 extern char *SEC_PKCS7GetSignerCommonName(SEC_PKCS7ContentInfo *cinfo); | |
| 145 extern char *SEC_PKCS7GetSignerEmailAddress(SEC_PKCS7ContentInfo *cinfo); | |
| 146 | |
| 147 /* | |
| 148 * Return the the signing time, in UTCTime format, of a PKCS7 contentInfo. | |
| 149 */ | |
| 150 extern SECItem *SEC_PKCS7GetSigningTime(SEC_PKCS7ContentInfo *cinfo); | |
| 151 | |
| 152 | |
| 153 /************************************************************************ | |
| 154 * PKCS7 Creation and Encoding. | |
| 155 ************************************************************************/ | |
| 156 | |
| 157 /* | |
| 158 * Start a PKCS7 signing context. | |
| 159 * | |
| 160 * "cert" is the cert that will be used to sign the data. It will be | |
| 161 * checked for validity. | |
| 162 * | |
| 163 * "certusage" describes the signing usage (e.g. certUsageEmailSigner) | |
| 164 * XXX Maybe SECCertUsage should be split so that our caller just says | |
| 165 * "email" and *we* add the "signing" part -- otherwise our caller | |
| 166 * could be lying about the usage; we do not want to allow encryption | |
| 167 * certs for signing or vice versa. | |
| 168 * | |
| 169 * "certdb" is the cert database to use for verifying the cert. | |
| 170 * It can be NULL if a default database is available (like in the client). | |
| 171 * | |
| 172 * "digestalg" names the digest algorithm (e.g. SEC_OID_SHA1). | |
| 173 * | |
| 174 * "digest" is the actual digest of the data. It must be provided in | |
| 175 * the case of detached data or NULL if the content will be included. | |
| 176 * | |
| 177 * The return value can be passed to functions which add things to | |
| 178 * it like attributes, then eventually to SEC_PKCS7Encode() or to | |
| 179 * SEC_PKCS7EncoderStart() to create the encoded data, and finally to | |
| 180 * SEC_PKCS7DestroyContentInfo(). | |
| 181 * | |
| 182 * An error results in a return value of NULL and an error set. | |
| 183 * (Retrieve specific errors via PORT_GetError()/XP_GetError().) | |
| 184 */ | |
| 185 extern SEC_PKCS7ContentInfo * | |
| 186 SEC_PKCS7CreateSignedData (CERTCertificate *cert, | |
| 187 SECCertUsage certusage, | |
| 188 CERTCertDBHandle *certdb, | |
| 189 SECOidTag digestalg, | |
| 190 SECItem *digest, | |
| 191 SECKEYGetPasswordKey pwfn, void *pwfn_arg); | |
| 192 | |
| 193 /* | |
| 194 * Create a PKCS7 certs-only container. | |
| 195 * | |
| 196 * "cert" is the (first) cert that will be included. | |
| 197 * | |
| 198 * "include_chain" specifies whether the entire chain for "cert" should | |
| 199 * be included. | |
| 200 * | |
| 201 * "certdb" is the cert database to use for finding the chain. | |
| 202 * It can be NULL in when "include_chain" is false, or when meaning | |
| 203 * use the default database. | |
| 204 * | |
| 205 * More certs and chains can be added via AddCertficate and AddCertChain. | |
| 206 * | |
| 207 * An error results in a return value of NULL and an error set. | |
| 208 * (Retrieve specific errors via PORT_GetError()/XP_GetError().) | |
| 209 */ | |
| 210 extern SEC_PKCS7ContentInfo * | |
| 211 SEC_PKCS7CreateCertsOnly (CERTCertificate *cert, | |
| 212 PRBool include_chain, | |
| 213 CERTCertDBHandle *certdb); | |
| 214 | |
| 215 /* | |
| 216 * Start a PKCS7 enveloping context. | |
| 217 * | |
| 218 * "cert" is the cert for the recipient. It will be checked for validity. | |
| 219 * | |
| 220 * "certusage" describes the encryption usage (e.g. certUsageEmailRecipient) | |
| 221 * XXX Maybe SECCertUsage should be split so that our caller just says | |
| 222 * "email" and *we* add the "recipient" part -- otherwise our caller | |
| 223 * could be lying about the usage; we do not want to allow encryption | |
| 224 * certs for signing or vice versa. | |
| 225 * | |
| 226 * "certdb" is the cert database to use for verifying the cert. | |
| 227 * It can be NULL if a default database is available (like in the client). | |
| 228 * | |
| 229 * "encalg" specifies the bulk encryption algorithm to use (e.g. SEC_OID_RC2). | |
| 230 * | |
| 231 * "keysize" specifies the bulk encryption key size, in bits. | |
| 232 * | |
| 233 * The return value can be passed to functions which add things to | |
| 234 * it like more recipients, then eventually to SEC_PKCS7Encode() or to | |
| 235 * SEC_PKCS7EncoderStart() to create the encoded data, and finally to | |
| 236 * SEC_PKCS7DestroyContentInfo(). | |
| 237 * | |
| 238 * An error results in a return value of NULL and an error set. | |
| 239 * (Retrieve specific errors via PORT_GetError()/XP_GetError().) | |
| 240 */ | |
| 241 extern SEC_PKCS7ContentInfo * | |
| 242 SEC_PKCS7CreateEnvelopedData (CERTCertificate *cert, | |
| 243 SECCertUsage certusage, | |
| 244 CERTCertDBHandle *certdb, | |
| 245 SECOidTag encalg, | |
| 246 int keysize, | |
| 247 SECKEYGetPasswordKey pwfn, void *pwfn_arg); | |
| 248 | |
| 249 /* | |
| 250 * XXX There will be a similar routine for creating signedAndEnvelopedData. | |
| 251 * But its parameters will be different and I have no plans to implement | |
| 252 * it any time soon because we have no current need for it. | |
| 253 */ | |
| 254 | |
| 255 /* | |
| 256 * Create an empty PKCS7 data content info. | |
| 257 * | |
| 258 * An error results in a return value of NULL and an error set. | |
| 259 * (Retrieve specific errors via PORT_GetError()/XP_GetError().) | |
| 260 */ | |
| 261 extern SEC_PKCS7ContentInfo *SEC_PKCS7CreateData (void); | |
| 262 | |
| 263 /* | |
| 264 * Create an empty PKCS7 encrypted content info. | |
| 265 * | |
| 266 * "algorithm" specifies the bulk encryption algorithm to use. | |
| 267 * | |
| 268 * An error results in a return value of NULL and an error set. | |
| 269 * (Retrieve specific errors via PORT_GetError()/XP_GetError().) | |
| 270 */ | |
| 271 extern SEC_PKCS7ContentInfo * | |
| 272 SEC_PKCS7CreateEncryptedData (SECOidTag algorithm, int keysize, | |
| 273 SECKEYGetPasswordKey pwfn, void *pwfn_arg); | |
| 274 | |
| 275 /* | |
| 276 * All of the following things return SECStatus to signal success or failure. | |
| 277 * Failure should have a more specific error status available via | |
| 278 * PORT_GetError()/XP_GetError(). | |
| 279 */ | |
| 280 | |
| 281 /* | |
| 282 * Add the specified attribute to the authenticated (i.e. signed) attributes | |
| 283 * of "cinfo" -- "oidtag" describes the attribute and "value" is the | |
| 284 * value to be associated with it. NOTE! "value" must already be encoded; | |
| 285 * no interpretation of "oidtag" is done. Also, it is assumed that this | |
| 286 * signedData has only one signer -- if we ever need to add attributes | |
| 287 * when there is more than one signature, we need a way to specify *which* | |
| 288 * signature should get the attribute. | |
| 289 * | |
| 290 * XXX Technically, a signed attribute can have multiple values; if/when | |
| 291 * we ever need to support an attribute which takes multiple values, we | |
| 292 * either need to change this interface or create an AddSignedAttributeValue | |
| 293 * which can be called subsequently, and would then append a value. | |
| 294 * | |
| 295 * "cinfo" should be of type signedData (the only kind of pkcs7 data | |
| 296 * that is allowed authenticated attributes); SECFailure will be returned | |
| 297 * if it is not. | |
| 298 */ | |
| 299 extern SECStatus SEC_PKCS7AddSignedAttribute (SEC_PKCS7ContentInfo *cinfo, | |
| 300 SECOidTag oidtag, | |
| 301 SECItem *value); | |
| 302 | |
| 303 /* | |
| 304 * Add "cert" and its entire chain to the set of certs included in "cinfo". | |
| 305 * | |
| 306 * "certdb" is the cert database to use for finding the chain. | |
| 307 * It can be NULL, meaning use the default database. | |
| 308 * | |
| 309 * "cinfo" should be of type signedData or signedAndEnvelopedData; | |
| 310 * SECFailure will be returned if it is not. | |
| 311 */ | |
| 312 extern SECStatus SEC_PKCS7AddCertChain (SEC_PKCS7ContentInfo *cinfo, | |
| 313 CERTCertificate *cert, | |
| 314 CERTCertDBHandle *certdb); | |
| 315 | |
| 316 /* | |
| 317 * Add "cert" to the set of certs included in "cinfo". | |
| 318 * | |
| 319 * "cinfo" should be of type signedData or signedAndEnvelopedData; | |
| 320 * SECFailure will be returned if it is not. | |
| 321 */ | |
| 322 extern SECStatus SEC_PKCS7AddCertificate (SEC_PKCS7ContentInfo *cinfo, | |
| 323 CERTCertificate *cert); | |
| 324 | |
| 325 /* | |
| 326 * Add another recipient to an encrypted message. | |
| 327 * | |
| 328 * "cinfo" should be of type envelopedData or signedAndEnvelopedData; | |
| 329 * SECFailure will be returned if it is not. | |
| 330 * | |
| 331 * "cert" is the cert for the recipient. It will be checked for validity. | |
| 332 * | |
| 333 * "certusage" describes the encryption usage (e.g. certUsageEmailRecipient) | |
| 334 * XXX Maybe SECCertUsage should be split so that our caller just says | |
| 335 * "email" and *we* add the "recipient" part -- otherwise our caller | |
| 336 * could be lying about the usage; we do not want to allow encryption | |
| 337 * certs for signing or vice versa. | |
| 338 * | |
| 339 * "certdb" is the cert database to use for verifying the cert. | |
| 340 * It can be NULL if a default database is available (like in the client). | |
| 341 */ | |
| 342 extern SECStatus SEC_PKCS7AddRecipient (SEC_PKCS7ContentInfo *cinfo, | |
| 343 CERTCertificate *cert, | |
| 344 SECCertUsage certusage, | |
| 345 CERTCertDBHandle *certdb); | |
| 346 | |
| 347 /* | |
| 348 * Add the signing time to the authenticated (i.e. signed) attributes | |
| 349 * of "cinfo". This is expected to be included in outgoing signed | |
| 350 * messages for email (S/MIME) but is likely useful in other situations. | |
| 351 * | |
| 352 * This should only be added once; a second call will either do | |
| 353 * nothing or replace an old signing time with a newer one. | |
| 354 * | |
| 355 * XXX This will probably just shove the current time into "cinfo" | |
| 356 * but it will not actually get signed until the entire item is | |
| 357 * processed for encoding. Is this (expected to be small) delay okay? | |
| 358 * | |
| 359 * "cinfo" should be of type signedData (the only kind of pkcs7 data | |
| 360 * that is allowed authenticated attributes); SECFailure will be returned | |
| 361 * if it is not. | |
| 362 */ | |
| 363 extern SECStatus SEC_PKCS7AddSigningTime (SEC_PKCS7ContentInfo *cinfo); | |
| 364 | |
| 365 /* | |
| 366 * Add the signer's symmetric capabilities to the authenticated | |
| 367 * (i.e. signed) attributes of "cinfo". This is expected to be | |
| 368 * included in outgoing signed messages for email (S/MIME). | |
| 369 * | |
| 370 * This can only be added once; a second call will return SECFailure. | |
| 371 * | |
| 372 * "cinfo" should be of type signedData or signedAndEnvelopedData; | |
| 373 * SECFailure will be returned if it is not. | |
| 374 */ | |
| 375 extern SECStatus SEC_PKCS7AddSymmetricCapabilities(SEC_PKCS7ContentInfo *cinfo); | |
| 376 | |
| 377 /* | |
| 378 * Mark that the signer's certificate and its issuing chain should | |
| 379 * be included in the encoded data. This is expected to be used | |
| 380 * in outgoing signed messages for email (S/MIME). | |
| 381 * | |
| 382 * "certdb" is the cert database to use for finding the chain. | |
| 383 * It can be NULL, meaning use the default database. | |
| 384 * | |
| 385 * "cinfo" should be of type signedData or signedAndEnvelopedData; | |
| 386 * SECFailure will be returned if it is not. | |
| 387 */ | |
| 388 extern SECStatus SEC_PKCS7IncludeCertChain (SEC_PKCS7ContentInfo *cinfo, | |
| 389 CERTCertDBHandle *certdb); | |
| 390 | |
| 391 | |
| 392 /* | |
| 393 * Set the content; it will be included and also hashed and/or encrypted | |
| 394 * as appropriate. This is for in-memory content (expected to be "small") | |
| 395 * that will be included in the PKCS7 object. All others should stream the | |
| 396 * content through when encoding (see SEC_PKCS7Encoder{Start,Update,Finish}). | |
| 397 * | |
| 398 * "buf" points to data of length "len"; it will be copied. | |
| 399 */ | |
| 400 extern SECStatus SEC_PKCS7SetContent (SEC_PKCS7ContentInfo *cinfo, | |
| 401 const char *buf, unsigned long len); | |
| 402 | |
| 403 /* | |
| 404 * Encode a PKCS7 object, in one shot. All necessary components | |
| 405 * of the object must already be specified. Either the data has | |
| 406 * already been included (via SetContent), or the data is detached, | |
| 407 * or there is no data at all (certs-only). | |
| 408 * | |
| 409 * "cinfo" specifies the object to be encoded. | |
| 410 * | |
| 411 * "outputfn" is where the encoded bytes will be passed. | |
| 412 * | |
| 413 * "outputarg" is an opaque argument to the above callback. | |
| 414 * | |
| 415 * "bulkkey" specifies the bulk encryption key to use. This argument | |
| 416 * can be NULL if no encryption is being done, or if the bulk key should | |
| 417 * be generated internally (usually the case for EnvelopedData but never | |
| 418 * for EncryptedData, which *must* provide a bulk encryption key). | |
| 419 * | |
| 420 * "pwfn" is a callback for getting the password which protects the | |
| 421 * private key of the signer. This argument can be NULL if it is known | |
| 422 * that no signing is going to be done. | |
| 423 * | |
| 424 * "pwfnarg" is an opaque argument to the above callback. | |
| 425 */ | |
| 426 extern SECStatus SEC_PKCS7Encode (SEC_PKCS7ContentInfo *cinfo, | |
| 427 SEC_PKCS7EncoderOutputCallback outputfn, | |
| 428 void *outputarg, | |
| 429 PK11SymKey *bulkkey, | |
| 430 SECKEYGetPasswordKey pwfn, | |
| 431 void *pwfnarg); | |
| 432 | |
| 433 /* | |
| 434 * Encode a PKCS7 object, in one shot. All necessary components | |
| 435 * of the object must already be specified. Either the data has | |
| 436 * already been included (via SetContent), or the data is detached, | |
| 437 * or there is no data at all (certs-only). The output, rather than | |
| 438 * being passed to an output function as is done above, is all put | |
| 439 * into a SECItem. | |
| 440 * | |
| 441 * "pool" specifies a pool from which to allocate the result. | |
| 442 * It can be NULL, in which case memory is allocated generically. | |
| 443 * | |
| 444 * "dest" specifies a SECItem in which to put the result data. | |
| 445 * It can be NULL, in which case the entire item is allocated, too. | |
| 446 * | |
| 447 * "cinfo" specifies the object to be encoded. | |
| 448 * | |
| 449 * "bulkkey" specifies the bulk encryption key to use. This argument | |
| 450 * can be NULL if no encryption is being done, or if the bulk key should | |
| 451 * be generated internally (usually the case for EnvelopedData but never | |
| 452 * for EncryptedData, which *must* provide a bulk encryption key). | |
| 453 * | |
| 454 * "pwfn" is a callback for getting the password which protects the | |
| 455 * private key of the signer. This argument can be NULL if it is known | |
| 456 * that no signing is going to be done. | |
| 457 * | |
| 458 * "pwfnarg" is an opaque argument to the above callback. | |
| 459 */ | |
| 460 extern SECItem *SEC_PKCS7EncodeItem (PLArenaPool *pool, | |
| 461 SECItem *dest, | |
| 462 SEC_PKCS7ContentInfo *cinfo, | |
| 463 PK11SymKey *bulkkey, | |
| 464 SECKEYGetPasswordKey pwfn, | |
| 465 void *pwfnarg); | |
| 466 | |
| 467 /* | |
| 468 * For those who want to simply point to the pkcs7 contentInfo ASN.1 | |
| 469 * template, and *not* call the encoding functions directly, the | |
| 470 * following function can be used -- after it is called, the entire | |
| 471 * PKCS7 contentInfo is ready to be encoded. | |
| 472 */ | |
| 473 extern SECStatus SEC_PKCS7PrepareForEncode (SEC_PKCS7ContentInfo *cinfo, | |
| 474 PK11SymKey *bulkkey, | |
| 475 SECKEYGetPasswordKey pwfn, | |
| 476 void *pwfnarg); | |
| 477 | |
| 478 /* | |
| 479 * Start the process of encoding a PKCS7 object. The first part of | |
| 480 * the encoded object will be passed to the output function right away; | |
| 481 * after that it is expected that SEC_PKCS7EncoderUpdate will be called, | |
| 482 * streaming in the actual content that is getting included as well as | |
| 483 * signed or encrypted (or both). | |
| 484 * | |
| 485 * "cinfo" specifies the object to be encoded. | |
| 486 * | |
| 487 * "outputfn" is where the encoded bytes will be passed. | |
| 488 * | |
| 489 * "outputarg" is an opaque argument to the above callback. | |
| 490 * | |
| 491 * "bulkkey" specifies the bulk encryption key to use. This argument | |
| 492 * can be NULL if no encryption is being done, or if the bulk key should | |
| 493 * be generated internally (usually the case for EnvelopedData but never | |
| 494 * for EncryptedData, which *must* provide a bulk encryption key). | |
| 495 * | |
| 496 * Returns an object to be passed to EncoderUpdate and EncoderFinish. | |
| 497 */ | |
| 498 extern SEC_PKCS7EncoderContext * | |
| 499 SEC_PKCS7EncoderStart (SEC_PKCS7ContentInfo *cinfo, | |
| 500 SEC_PKCS7EncoderOutputCallback outputfn, | |
| 501 void *outputarg, | |
| 502 PK11SymKey *bulkkey); | |
| 503 | |
| 504 /* | |
| 505 * Encode more contents, hashing and/or encrypting along the way. | |
| 506 */ | |
| 507 extern SECStatus SEC_PKCS7EncoderUpdate (SEC_PKCS7EncoderContext *p7ecx, | |
| 508 const char *buf, | |
| 509 unsigned long len); | |
| 510 | |
| 511 /* | |
| 512 * No more contents; finish the signature creation, if appropriate, | |
| 513 * and then the encoding. | |
| 514 * | |
| 515 * "pwfn" is a callback for getting the password which protects the | |
| 516 * signer's private key. This argument can be NULL if it is known | |
| 517 * that no signing is going to be done. | |
| 518 * | |
| 519 * "pwfnarg" is an opaque argument to the above callback. | |
| 520 */ | |
| 521 extern SECStatus SEC_PKCS7EncoderFinish (SEC_PKCS7EncoderContext *p7ecx, | |
| 522 SECKEYGetPasswordKey pwfn, | |
| 523 void *pwfnarg); | |
| 524 | |
| 525 /* Abort the underlying ASN.1 stream & set an error */ | |
| 526 void SEC_PKCS7EncoderAbort(SEC_PKCS7EncoderContext *p7dcx, int error); | |
| 527 | |
| 528 /* retrieve the algorithm ID used to encrypt the content info | |
| 529 * for encrypted and enveloped data. The SECAlgorithmID pointer | |
| 530 * returned needs to be freed as it is a copy of the algorithm | |
| 531 * id in the content info. | |
| 532 */ | |
| 533 extern SECAlgorithmID * | |
| 534 SEC_PKCS7GetEncryptionAlgorithm(SEC_PKCS7ContentInfo *cinfo); | |
| 535 | |
| 536 /* the content of an encrypted data content info is encrypted. | |
| 537 * it is assumed that for encrypted data, that the data has already | |
| 538 * been set and is in the "plainContent" field of the content info. | |
| 539 * | |
| 540 * cinfo is the content info to encrypt | |
| 541 * | |
| 542 * key is the key with which to perform the encryption. if the | |
| 543 * algorithm is a password based encryption algorithm, the | |
| 544 * key is actually a password which will be processed per | |
| 545 * PKCS #5. | |
| 546 * | |
| 547 * in the event of an error, SECFailure is returned. SECSuccess | |
| 548 * indicates a success. | |
| 549 */ | |
| 550 extern SECStatus | |
| 551 SEC_PKCS7EncryptContents(PLArenaPool *poolp, | |
| 552 SEC_PKCS7ContentInfo *cinfo, | |
| 553 SECItem *key, | |
| 554 void *wincx); | |
| 555 | |
| 556 /* the content of an encrypted data content info is decrypted. | |
| 557 * it is assumed that for encrypted data, that the data has already | |
| 558 * been set and is in the "encContent" field of the content info. | |
| 559 * | |
| 560 * cinfo is the content info to decrypt | |
| 561 * | |
| 562 * key is the key with which to perform the decryption. if the | |
| 563 * algorithm is a password based encryption algorithm, the | |
| 564 * key is actually a password which will be processed per | |
| 565 * PKCS #5. | |
| 566 * | |
| 567 * in the event of an error, SECFailure is returned. SECSuccess | |
| 568 * indicates a success. | |
| 569 */ | |
| 570 extern SECStatus | |
| 571 SEC_PKCS7DecryptContents(PLArenaPool *poolp, | |
| 572 SEC_PKCS7ContentInfo *cinfo, | |
| 573 SECItem *key, | |
| 574 void *wincx); | |
| 575 | |
| 576 /* retrieve the certificate list from the content info. the list | |
| 577 * is a pointer to the list in the content info. this should not | |
| 578 * be deleted or freed in any way short of calling | |
| 579 * SEC_PKCS7DestroyContentInfo | |
| 580 */ | |
| 581 extern SECItem ** | |
| 582 SEC_PKCS7GetCertificateList(SEC_PKCS7ContentInfo *cinfo); | |
| 583 | |
| 584 /* Returns the key length (in bits) of the algorithm used to encrypt | |
| 585 this object. Returns 0 if it's not encrypted, or the key length is | |
| 586 irrelevant. */ | |
| 587 extern int | |
| 588 SEC_PKCS7GetKeyLength(SEC_PKCS7ContentInfo *cinfo); | |
| 589 | |
| 590 | |
| 591 /************************************************************************/ | |
| 592 SEC_END_PROTOS | |
| 593 | |
| 594 #endif /* _SECPKCS7_H_ */ | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 14249009:
Change the NSS and NSPR source tree to the new directory structure to be (Closed)
Base URL: svn://svn.chromium.org/chrome/trunk/deps/third_party/nss/