Support for using OS-native certificates for SSL client auth....

net/third_party/nss/ssl/ssl.h

 /*
  * This file contains prototypes for the public SSL functions.
  *
  * ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
  * 1.1 (the "License"); you may not use this file except in compliance with
  * the License. You may obtain a copy of the License at
  * http://www.mozilla.org/MPL/
@@ skipping 305 matching lines @@
 /*
  * Set the client side callback for SSL to retrieve user's private key
  * and certificate.
  *      fd - the file descriptor for the connection in question
  *      f - the application's callback that delivers the key and cert
  *      a - application specific data
  */
 SSL_IMPORT SECStatus SSL_GetClientAuthDataHook(PRFileDesc *fd, 
                                                SSLGetClientAuthData f, void *a);
 
+/*
+ * Prototype for SSL callback to get client auth data from the application,
+ * when using the underlying platform's cryptographic primitives. Returning
+ * SECFailure will cause the socket to send no client certificate.
+ *      arg - application passed argument
+ *      caNames - pointer to distinguished names of CAs that the server likes
+ *      pRetCerts - pointer to pointer to list of certs, with the first being
+ *                  the client cert, and any following being used for chain
+ *                  building
+ *      pRetKey - pointer to native key pointer, for return of key
+ *          - Windows: pointer to HCRYPTPROV
+ *          - Mac OS X: pointer to SecKeyRef
+ */
+typedef SECStatus (PR_CALLBACK *SSLGetPlatformClientAuthData)(void *arg,
+                                PRFileDesc *fd,
+                                CERTDistNames *caNames,
+                                CERTCertList **pRetCerts,/*return */
+                                void **pRetKey);/* return */
+
+/*
+ * Set the client side callback for SSL to retrieve user's private key
+ * and certificate.
+ *      fd - the file descriptor for the connection in question
+ *      f - the application's callback that delivers the key and cert
+ *      a - application specific data
+ */
+SSL_IMPORT SECStatus
+SSL_GetPlatformClientAuthDataHook(PRFileDesc *fd,
+                                  SSLGetPlatformClientAuthData f, void *a);
 
 /*
 ** SNI extension processing callback function.
 ** It is called when SSL socket receives SNI extension in ClientHello message.
 ** Upon this callback invocation, application is responsible to reconfigure the
 ** socket with the data for a particular server name.
 ** There are three potential outcomes of this function invocation:
 **    * application does not recognize the name or the type and wants the
 **    "unrecognized_name" alert be sent to the client. In this case the callback
 **    function must return SSL_SNI_SEND_ALERT status.
@@ skipping 365 matching lines @@
 ** Did the handshake with the peer negotiate the given extension?
 ** Output parameter valid only if function returns SECSuccess
 */
 SSL_IMPORT SECStatus SSL_HandshakeNegotiatedExtension(PRFileDesc * socket,
                                                       SSLExtensionType extId,
                                                       PRBool *yes);
 
 SEC_END_PROTOS
 
 #endif /* __ssl_h_ */