| OLD | NEW |
|---|
| (Empty) |
| 1 /* This Source Code Form is subject to the terms of the Mozilla Public | |
| 2 * License, v. 2.0. If a copy of the MPL was not distributed with this | |
| 3 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ | |
| 4 | |
| 5 #ifndef NSSPKIT_H | |
| 6 #define NSSPKIT_H | |
| 7 | |
| 8 #ifdef DEBUG | |
| 9 static const char NSSPKIT_CVS_ID[] = "@(#) $RCSfile: nsspkit.h,v $ $Revision: 1.
9 $ $Date: 2012/04/25 14:50:07 $"; | |
| 10 #endif /* DEBUG */ | |
| 11 | |
| 12 /* | |
| 13 * nsspkit.h | |
| 14 * | |
| 15 * This file defines the types of the top-level PKI objects. | |
| 16 */ | |
| 17 | |
| 18 #ifndef NSSBASET_H | |
| 19 #include "nssbaset.h" | |
| 20 #endif /* NSSBASET_H */ | |
| 21 | |
| 22 PR_BEGIN_EXTERN_C | |
| 23 | |
| 24 /* | |
| 25 * NSSCertificate | |
| 26 * | |
| 27 * This is the public representation of a Certificate. The certificate | |
| 28 * may be one found on a smartcard or other token, one decoded from data | |
| 29 * received as part of a protocol, one constructed from constituent | |
| 30 * parts, etc. Usually it is associated with ("in") a trust domain; as | |
| 31 * it can be verified only within a trust domain. The underlying type | |
| 32 * of certificate may be of any supported standard, e.g. PKIX, PGP, etc. | |
| 33 * | |
| 34 * People speak of "verifying (with) the server's, or correspondant's, | |
| 35 * certificate"; for simple operations we support that simplification | |
| 36 * by implementing public-key crypto operations as methods on this type. | |
| 37 */ | |
| 38 | |
| 39 struct NSSCertificateStr; | |
| 40 typedef struct NSSCertificateStr NSSCertificate; | |
| 41 | |
| 42 /* | |
| 43 * NSSUserCertificate | |
| 44 * | |
| 45 * A ``User'' certificate is one for which the private key is available. | |
| 46 * People speak of "using my certificate to sign my email" and "using | |
| 47 * my certificate to authenticate to (or login to) the server"; for | |
| 48 * simple operations, we support that simplification by implementing | |
| 49 * private-key crypto operations as methods on this type. | |
| 50 * | |
| 51 * The current design only weakly distinguishes between certificates | |
| 52 * and user certificates: as far as the compiler goes they're | |
| 53 * interchangeable; debug libraries only have one common pointer-tracker; | |
| 54 * etc. However, attempts to do private-key operations on a certificate | |
| 55 * for which the private key is not available will fail. | |
| 56 * | |
| 57 * Open design question: should these types be more firmly separated? | |
| 58 */ | |
| 59 | |
| 60 typedef NSSCertificate NSSUserCertificate; | |
| 61 | |
| 62 /* | |
| 63 * NSSPrivateKey | |
| 64 * | |
| 65 * This is the public representation of a Private Key. In general, | |
| 66 * the actual value of the key is not available, but operations may | |
| 67 * be performed with it. | |
| 68 */ | |
| 69 | |
| 70 struct NSSPrivateKeyStr; | |
| 71 typedef struct NSSPrivateKeyStr NSSPrivateKey; | |
| 72 | |
| 73 /* | |
| 74 * NSSPublicKey | |
| 75 * | |
| 76 */ | |
| 77 | |
| 78 struct NSSPublicKeyStr; | |
| 79 typedef struct NSSPublicKeyStr NSSPublicKey; | |
| 80 | |
| 81 /* | |
| 82 * NSSSymmetricKey | |
| 83 * | |
| 84 */ | |
| 85 | |
| 86 struct NSSSymmetricKeyStr; | |
| 87 typedef struct NSSSymmetricKeyStr NSSSymmetricKey; | |
| 88 | |
| 89 /* | |
| 90 * NSSTrustDomain | |
| 91 * | |
| 92 * A Trust Domain is the field in which certificates may be validated. | |
| 93 * A trust domain will generally have one or more cryptographic modules | |
| 94 * open; these modules perform the cryptographic operations, and | |
| 95 * provide the basic "root" trust information from which the trust in | |
| 96 * a specific certificate or key depends. | |
| 97 * | |
| 98 * A client program, or a simple server, would typically have one | |
| 99 * trust domain. A server supporting multiple "virtual servers" might | |
| 100 * have a separate trust domain for each virtual server. The separate | |
| 101 * trust domains might share some modules (e.g., a hardware crypto | |
| 102 * accelerator) but not others (e.g., the tokens storing the different | |
| 103 * servers' private keys, or the databases with each server's trusted | |
| 104 * root certificates). | |
| 105 * | |
| 106 * This object descends from the "permananet database" in the old code. | |
| 107 */ | |
| 108 | |
| 109 struct NSSTrustDomainStr; | |
| 110 typedef struct NSSTrustDomainStr NSSTrustDomain; | |
| 111 | |
| 112 /* | |
| 113 * NSSCryptoContext | |
| 114 * | |
| 115 * A Crypto Context is a short-term, "helper" object which is used | |
| 116 * for the lifetime of one ongoing "crypto operation." Such an | |
| 117 * operation may be the creation of a signed message, the use of an | |
| 118 * TLS socket connection, etc. Each crypto context is "in" a | |
| 119 * specific trust domain, and it may have associated with it a | |
| 120 * distinguished certificate, public key, private key, and/or | |
| 121 * symmetric key. It can also temporarily hold and use temporary | |
| 122 * data (e.g. intermediate certificates) which is not stored | |
| 123 * permanently in the trust domain. | |
| 124 * | |
| 125 * In OO terms, this interface inherits interfaces from the trust | |
| 126 * domain, the certificates, and the keys. It also provides | |
| 127 * streaming crypto operations. | |
| 128 * | |
| 129 * This object descends from the "temporary database" concept in the | |
| 130 * old code, but it has changed a lot as a result of what we've | |
| 131 * learned. | |
| 132 */ | |
| 133 | |
| 134 typedef struct NSSCryptoContextStr NSSCryptoContext; | |
| 135 | |
| 136 /* | |
| 137 * fgmr others | |
| 138 */ | |
| 139 | |
| 140 /* | |
| 141 * OBJECT IDENTIFIER | |
| 142 * | |
| 143 * This is the basic OID that crops up everywhere. | |
| 144 */ | |
| 145 | |
| 146 struct NSSOIDStr; /* unused opaque structure */ | |
| 147 typedef struct NSSOIDStr NSSOID; | |
| 148 | |
| 149 /* | |
| 150 * NSSTime | |
| 151 * | |
| 152 * Unfortunately, we need an "exceptional" value to indicate | |
| 153 * an error upon return, or "no value" on input. Note that zero | |
| 154 * is a perfectly valid value for both time_t and PRTime. | |
| 155 * | |
| 156 * If we were to create a "range" object, with two times for | |
| 157 * Not Before and Not After, we would have an obvious place for | |
| 158 * the somewhat arbitrary logic involved in comparing them. | |
| 159 * | |
| 160 * Failing that, let's have an NSSTime_CompareRanges function. | |
| 161 */ | |
| 162 | |
| 163 struct NSSTimeStr; | |
| 164 typedef struct NSSTimeStr NSSTime; | |
| 165 | |
| 166 struct NSSTrustStr; | |
| 167 typedef struct NSSTrustStr NSSTrust; | |
| 168 | |
| 169 /* | |
| 170 * NSSUsage | |
| 171 * | |
| 172 * This is trickier than originally planned; I'll write up a | |
| 173 * doc on it. | |
| 174 * | |
| 175 * We'd still like nsspki.h to have a list of common usages, | |
| 176 * e.g.: | |
| 177 * | |
| 178 * extern const NSSUsage *NSSUsage_ClientAuth; | |
| 179 * extern const NSSUsage *NSSUsage_ServerAuth; | |
| 180 * extern const NSSUsage *NSSUsage_SignEmail; | |
| 181 * extern const NSSUsage *NSSUsage_EncryptEmail; | |
| 182 * etc. | |
| 183 */ | |
| 184 | |
| 185 struct NSSUsageStr; | |
| 186 typedef struct NSSUsageStr NSSUsage; | |
| 187 | |
| 188 /* | |
| 189 * NSSPolicies | |
| 190 * | |
| 191 * Placeholder, for now. | |
| 192 */ | |
| 193 | |
| 194 struct NSSPoliciesStr; | |
| 195 typedef struct NSSPoliciesStr NSSPolicies; | |
| 196 | |
| 197 /* | |
| 198 * NSSAlgorithmAndParameters | |
| 199 * | |
| 200 * Algorithm is an OID | |
| 201 * Parameters depend on the algorithm | |
| 202 */ | |
| 203 | |
| 204 struct NSSAlgorithmAndParametersStr; | |
| 205 typedef struct NSSAlgorithmAndParametersStr NSSAlgorithmAndParameters; | |
| 206 | |
| 207 /* | |
| 208 * NSSCallback | |
| 209 * | |
| 210 * At minimum, a "challenge" method and a closure argument. | |
| 211 * Usually the challenge will just be prompting for a password. | |
| 212 * How OO do we want to make it? | |
| 213 */ | |
| 214 | |
| 215 typedef struct NSSCallbackStr NSSCallback; | |
| 216 | |
| 217 struct NSSCallbackStr { | |
| 218 /* Prompt for a password to initialize a slot. */ | |
| 219 PRStatus (* getInitPW)(NSSUTF8 *slotName, void *arg, | |
| 220 NSSUTF8 **ssoPW, NSSUTF8 **userPW); | |
| 221 /* Prompt for oldPW and newPW in order to change the | |
| 222 * password on a slot. | |
| 223 */ | |
| 224 PRStatus (* getNewPW)(NSSUTF8 *slotName, PRUint32 *retries, void *arg, | |
| 225 NSSUTF8 **oldPW, NSSUTF8 **newPW); | |
| 226 /* Prompt for slot password. */ | |
| 227 PRStatus (* getPW)(NSSUTF8 *slotName, PRUint32 *retries, void *arg, | |
| 228 NSSUTF8 **password); | |
| 229 void *arg; | |
| 230 }; | |
| 231 | |
| 232 /* set errors - user cancelled, ... */ | |
| 233 | |
| 234 typedef PRUint32 NSSOperations; | |
| 235 /* 1) Do we want these to be preprocessor definitions or constants? */ | |
| 236 /* 2) What is the correct and complete list? */ | |
| 237 | |
| 238 #define NSSOperations_ENCRYPT 0x0001 | |
| 239 #define NSSOperations_DECRYPT 0x0002 | |
| 240 #define NSSOperations_WRAP 0x0004 | |
| 241 #define NSSOperations_UNWRAP 0x0008 | |
| 242 #define NSSOperations_SIGN 0x0010 | |
| 243 #define NSSOperations_SIGN_RECOVER 0x0020 | |
| 244 #define NSSOperations_VERIFY 0x0040 | |
| 245 #define NSSOperations_VERIFY_RECOVER 0x0080 | |
| 246 | |
| 247 struct NSSPKIXCertificateStr; | |
| 248 | |
| 249 PR_END_EXTERN_C | |
| 250 | |
| 251 #endif /* NSSPKIT_H */ | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 14249009:
Change the NSS and NSPR source tree to the new directory structure to be (Closed)
Base URL: svn://svn.chromium.org/chrome/trunk/deps/third_party/nss/