mirror of
https://repo.dactyloidae.xyz/Dactyloidae/UXP.git
synced 2026-09-24 09:27:31 +09:00
Replace NSS with Pale Moon's
This commit is contained in:
wuggy
parent
ff1e5e48bf
commit
8c2e376f94
2870 changed files with 1762232 additions and 1374220 deletions
|
|
@ -9,6 +9,7 @@
|
|||
#include "secdert.h"
|
||||
#include "keythi.h"
|
||||
#include "certt.h"
|
||||
#include "pk11hpke.h"
|
||||
#include "pkcs11t.h"
|
||||
#include "secmodt.h"
|
||||
#include "seccomon.h"
|
||||
|
|
@ -267,6 +268,8 @@ CK_MECHANISM_TYPE PK11_MapSignKeyType(KeyType keyType);
|
|||
**********************************************************************/
|
||||
void PK11_FreeSymKey(PK11SymKey *key);
|
||||
PK11SymKey *PK11_ReferenceSymKey(PK11SymKey *symKey);
|
||||
PK11SymKey *PK11_ImportDataKey(PK11SlotInfo *slot, CK_MECHANISM_TYPE type, PK11Origin origin,
|
||||
CK_ATTRIBUTE_TYPE operation, SECItem *key, void *wincx);
|
||||
PK11SymKey *PK11_ImportSymKey(PK11SlotInfo *slot, CK_MECHANISM_TYPE type,
|
||||
PK11Origin origin, CK_ATTRIBUTE_TYPE operation, SECItem *key, void *wincx);
|
||||
PK11SymKey *PK11_ImportSymKeyWithFlags(PK11SlotInfo *slot,
|
||||
|
|
@ -354,6 +357,11 @@ void *PK11_GetSymKeyUserData(PK11SymKey *symKey);
|
|||
|
||||
SECStatus PK11_PubWrapSymKey(CK_MECHANISM_TYPE type, SECKEYPublicKey *pubKey,
|
||||
PK11SymKey *symKey, SECItem *wrappedKey);
|
||||
SECStatus PK11_PubWrapSymKeyWithMechanism(SECKEYPublicKey *pubKey,
|
||||
CK_MECHANISM_TYPE mechType,
|
||||
SECItem *param,
|
||||
PK11SymKey *symKey,
|
||||
SECItem *wrappedKey);
|
||||
SECStatus PK11_WrapSymKey(CK_MECHANISM_TYPE type, SECItem *params,
|
||||
PK11SymKey *wrappingKey, PK11SymKey *symKey, SECItem *wrappedKey);
|
||||
/* move a key to 'slot' optionally set the key attributes according to either
|
||||
|
|
@ -362,6 +370,25 @@ SECStatus PK11_WrapSymKey(CK_MECHANISM_TYPE type, SECItem *params,
|
|||
* currently ignored */
|
||||
PK11SymKey *PK11_MoveSymKey(PK11SlotInfo *slot, CK_ATTRIBUTE_TYPE operation,
|
||||
CK_FLAGS flags, PRBool perm, PK11SymKey *symKey);
|
||||
/*
|
||||
* To do joint operations, we often need two keys in the same slot.
|
||||
* Usually the PKCS #11 wrappers handle this correctly (like for PK11_WrapKey),
|
||||
* but sometimes the wrappers don't know about mechanism specific keys in
|
||||
* the Mechanism params. This function makes sure the two keys are in the
|
||||
* same slot by copying one or both of the keys into a common slot. This
|
||||
* functions makes sure the slot can handle the target mechanism. If the copy
|
||||
* is warranted, this function will prefer to move the movingKey first, then
|
||||
* the preferedKey. If the keys are moved, the new keys are returned in
|
||||
* newMovingKey and/or newPreferedKey. The application is responsible
|
||||
* for freeing those keys one the operation is complete.
|
||||
*/
|
||||
SECStatus PK11_SymKeysToSameSlot(CK_MECHANISM_TYPE mech,
|
||||
CK_ATTRIBUTE_TYPE preferedOperation,
|
||||
CK_ATTRIBUTE_TYPE movingOperation,
|
||||
PK11SymKey *preferedKey, PK11SymKey *movingKey,
|
||||
PK11SymKey **newPreferedKey,
|
||||
PK11SymKey **newMovingKey);
|
||||
|
||||
/*
|
||||
* derive a new key from the base key.
|
||||
* PK11_Derive returns a key which can do exactly one operation, and is
|
||||
|
|
@ -429,6 +456,13 @@ PK11SymKey *PK11_UnwrapSymKeyWithFlagsPerm(PK11SymKey *wrappingKey,
|
|||
*/
|
||||
PK11SymKey *PK11_PubUnwrapSymKey(SECKEYPrivateKey *key, SECItem *wrapppedKey,
|
||||
CK_MECHANISM_TYPE target, CK_ATTRIBUTE_TYPE operation, int keySize);
|
||||
PK11SymKey *PK11_PubUnwrapSymKeyWithMechanism(SECKEYPrivateKey *key,
|
||||
CK_MECHANISM_TYPE mechType,
|
||||
SECItem *param,
|
||||
SECItem *wrapppedKey,
|
||||
CK_MECHANISM_TYPE target,
|
||||
CK_ATTRIBUTE_TYPE operation,
|
||||
int keySize);
|
||||
PK11SymKey *PK11_PubUnwrapSymKeyWithFlagsPerm(SECKEYPrivateKey *wrappingKey,
|
||||
SECItem *wrappedKey, CK_MECHANISM_TYPE target,
|
||||
CK_ATTRIBUTE_TYPE operation, int keySize,
|
||||
|
|
@ -593,10 +627,20 @@ SECKEYPrivateKeyInfo *PK11_ExportPrivateKeyInfo(
|
|||
CERTCertificate *cert, void *wincx);
|
||||
SECKEYEncryptedPrivateKeyInfo *PK11_ExportEncryptedPrivKeyInfo(
|
||||
PK11SlotInfo *slot, SECOidTag algTag, SECItem *pwitem,
|
||||
SECKEYPrivateKey *pk, int iteration, void *wincx);
|
||||
SECKEYPrivateKey *pk, int iteration, void *pwArg);
|
||||
SECKEYEncryptedPrivateKeyInfo *PK11_ExportEncryptedPrivateKeyInfo(
|
||||
PK11SlotInfo *slot, SECOidTag algTag, SECItem *pwitem,
|
||||
CERTCertificate *cert, int iteration, void *wincx);
|
||||
CERTCertificate *cert, int iteration, void *pwArg);
|
||||
/* V2 refers to PKCS #5 V2 here. If a PKCS #5 v1 or PKCS #12 pbe is passed
|
||||
* for pbeTag, then encTag and hashTag are ignored. If pbe is an encryption
|
||||
* algorithm, then PKCS #5 V2 is used with prfTag for the prf. If prfTag isn't
|
||||
* supplied prf will be SEC_OID_HMAC_SHA1 */
|
||||
SECKEYEncryptedPrivateKeyInfo *PK11_ExportEncryptedPrivKeyInfoV2(
|
||||
PK11SlotInfo *slot, SECOidTag pbeTag, SECOidTag encTag, SECOidTag prfTag,
|
||||
SECItem *pwitem, SECKEYPrivateKey *pk, int iteration, void *pwArg);
|
||||
SECKEYEncryptedPrivateKeyInfo *PK11_ExportEncryptedPrivateKeyInfoV2(
|
||||
PK11SlotInfo *slot, SECOidTag pbeTag, SECOidTag encTag, SECOidTag prfTag,
|
||||
SECItem *pwitem, CERTCertificate *cert, int iteration, void *pwArg);
|
||||
SECKEYPrivateKey *PK11_FindKeyByDERCert(PK11SlotInfo *slot,
|
||||
CERTCertificate *cert, void *wincx);
|
||||
SECKEYPublicKey *PK11_MakeKEAPubKey(unsigned char *data, int length);
|
||||
|
|
@ -678,6 +722,7 @@ SECStatus PK11_ImportCertForKeyToSlot(PK11SlotInfo *slot, CERTCertificate *cert,
|
|||
void *wincx);
|
||||
CERTCertificate *PK11_FindBestKEAMatch(CERTCertificate *serverCert, void *wincx);
|
||||
PRBool PK11_FortezzaHasKEA(CERTCertificate *cert);
|
||||
CK_OBJECT_HANDLE PK11_FindEncodedCertInSlot(PK11SlotInfo *slot, SECItem *derCert, void *wincx);
|
||||
CK_OBJECT_HANDLE PK11_FindCertInSlot(PK11SlotInfo *slot, CERTCertificate *cert,
|
||||
void *wincx);
|
||||
CK_OBJECT_HANDLE PK11_FindObjectForCert(CERTCertificate *cert,
|
||||
|
|
@ -694,6 +739,49 @@ CK_BBOOL PK11_HasAttributeSet(PK11SlotInfo *slot,
|
|||
CK_ATTRIBUTE_TYPE type,
|
||||
PRBool haslock /* must be set to PR_FALSE */);
|
||||
|
||||
/**********************************************************************
|
||||
* Hybrid Public Key Encryption
|
||||
**********************************************************************/
|
||||
|
||||
/* Some of the various HPKE arguments would ideally be const, but the
|
||||
* underlying PK11 functions take them as non-const. To avoid lying to
|
||||
* the application with a cast, this idiosyncrasy is exposed. */
|
||||
SECStatus PK11_HPKE_ValidateParameters(HpkeKemId kemId, HpkeKdfId kdfId, HpkeAeadId aeadId);
|
||||
HpkeContext *PK11_HPKE_NewContext(HpkeKemId kemId, HpkeKdfId kdfId, HpkeAeadId aeadId,
|
||||
PK11SymKey *psk, const SECItem *pskId);
|
||||
SECStatus PK11_HPKE_Deserialize(const HpkeContext *cx, const PRUint8 *enc,
|
||||
unsigned int encLen, SECKEYPublicKey **outPubKey);
|
||||
void PK11_HPKE_DestroyContext(HpkeContext *cx, PRBool freeit);
|
||||
|
||||
/* Serialize an initialized receiver context. This only retains the keys and
|
||||
* associated information necessary to resume Export and Open operations after
|
||||
* import. Serialization is currently supported for receiver contexts only.
|
||||
* This is done for two reasons: 1) it avoids having to move the encryption
|
||||
* sequence number outside of the token (or adding encryption context
|
||||
* serialization support to softoken), and 2) we don't have to worry about IV
|
||||
* reuse due to sequence number cloning.
|
||||
*
|
||||
* |wrapKey| is required when exporting in FIPS mode. If exported with a
|
||||
* wrapping key, that same key must be provided to the import function,
|
||||
* otherwise behavior is undefined.
|
||||
*
|
||||
* Even when exported with key wrap, HPKE expects the nonce to also be kept
|
||||
* secret and that value is not protected by wrapKey. Applications are
|
||||
* responsible for maintaining the confidentiality of the exported information.
|
||||
*/
|
||||
SECStatus PK11_HPKE_ExportContext(const HpkeContext *cx, PK11SymKey *wrapKey, SECItem **serialized);
|
||||
SECStatus PK11_HPKE_ExportSecret(const HpkeContext *cx, const SECItem *info, unsigned int L,
|
||||
PK11SymKey **outKey);
|
||||
const SECItem *PK11_HPKE_GetEncapPubKey(const HpkeContext *cx);
|
||||
HpkeContext *PK11_HPKE_ImportContext(const SECItem *serialized, PK11SymKey *wrapKey);
|
||||
SECStatus PK11_HPKE_Open(HpkeContext *cx, const SECItem *aad, const SECItem *ct, SECItem **outPt);
|
||||
SECStatus PK11_HPKE_Seal(HpkeContext *cx, const SECItem *aad, const SECItem *pt, SECItem **outCt);
|
||||
SECStatus PK11_HPKE_Serialize(const SECKEYPublicKey *pk, PRUint8 *buf, unsigned int *len, unsigned int maxLen);
|
||||
SECStatus PK11_HPKE_SetupS(HpkeContext *cx, const SECKEYPublicKey *pkE, SECKEYPrivateKey *skE,
|
||||
SECKEYPublicKey *pkR, const SECItem *info);
|
||||
SECStatus PK11_HPKE_SetupR(HpkeContext *cx, const SECKEYPublicKey *pkR, SECKEYPrivateKey *skR,
|
||||
const SECItem *enc, const SECItem *info);
|
||||
|
||||
/**********************************************************************
|
||||
* Sign/Verify
|
||||
**********************************************************************/
|
||||
|
|
@ -729,7 +817,17 @@ SECStatus PK11_VerifyWithMechanism(SECKEYPublicKey *key,
|
|||
**********************************************************************/
|
||||
void PK11_DestroyContext(PK11Context *context, PRBool freeit);
|
||||
PK11Context *PK11_CreateContextBySymKey(CK_MECHANISM_TYPE type,
|
||||
CK_ATTRIBUTE_TYPE operation, PK11SymKey *symKey, SECItem *param);
|
||||
CK_ATTRIBUTE_TYPE operation,
|
||||
PK11SymKey *symKey,
|
||||
const SECItem *param);
|
||||
PK11Context *PK11_CreateContextByPubKey(CK_MECHANISM_TYPE type,
|
||||
CK_ATTRIBUTE_TYPE operation,
|
||||
SECKEYPublicKey *pubKey,
|
||||
const SECItem *param, void *pwArg);
|
||||
PK11Context *PK11_CreateContextByPrivKey(CK_MECHANISM_TYPE type,
|
||||
CK_ATTRIBUTE_TYPE operation,
|
||||
SECKEYPrivateKey *privKey,
|
||||
const SECItem *param);
|
||||
PK11Context *PK11_CreateDigestContext(SECOidTag hashAlg);
|
||||
PK11Context *PK11_CloneContext(PK11Context *old);
|
||||
SECStatus PK11_DigestBegin(PK11Context *cx);
|
||||
|
|
@ -743,6 +841,19 @@ SECStatus PK11_DigestOp(PK11Context *context, const unsigned char *in,
|
|||
unsigned len);
|
||||
SECStatus PK11_CipherOp(PK11Context *context, unsigned char *out, int *outlen,
|
||||
int maxout, const unsigned char *in, int inlen);
|
||||
/* application builds the mechanism specific params */
|
||||
SECStatus PK11_AEADRawOp(PK11Context *context, void *params, int paramslen,
|
||||
const unsigned char *aad, int aadlen,
|
||||
unsigned char *out, int *outlen,
|
||||
int maxout, const unsigned char *in, int inlen);
|
||||
/* NSS builds the mechanism specific params */
|
||||
SECStatus PK11_AEADOp(PK11Context *context, CK_GENERATOR_FUNCTION ivGen,
|
||||
int fixedbits, unsigned char *iv, int ivlen,
|
||||
const unsigned char *aad, int aadlen,
|
||||
unsigned char *out, int *outlen,
|
||||
int maxout, unsigned char *tag, int taglen,
|
||||
const unsigned char *in, int inlen);
|
||||
|
||||
SECStatus PK11_Finalize(PK11Context *context);
|
||||
SECStatus PK11_DigestFinal(PK11Context *context, unsigned char *data,
|
||||
unsigned int *outLen, unsigned int length);
|
||||
|
|
@ -863,8 +974,13 @@ PK11GenericObject *PK11_CreateGenericObject(PK11SlotInfo *slot,
|
|||
*/
|
||||
SECStatus PK11_ReadRawAttribute(PK11ObjectType type, void *object,
|
||||
CK_ATTRIBUTE_TYPE attr, SECItem *item);
|
||||
SECStatus PK11_ReadRawAttributes(PLArenaPool *arena, PK11ObjectType type, void *object,
|
||||
CK_ATTRIBUTE *pTemplate, unsigned int count);
|
||||
SECStatus PK11_WriteRawAttribute(PK11ObjectType type, void *object,
|
||||
CK_ATTRIBUTE_TYPE attr, SECItem *item);
|
||||
/* get the PKCS #11 handle and slot for a generic object */
|
||||
CK_OBJECT_HANDLE PK11_GetObjectHandle(PK11ObjectType objType, void *objSpec,
|
||||
PK11SlotInfo **slotp);
|
||||
|
||||
/*
|
||||
* PK11_GetAllSlotsForCert returns all the slots that a given certificate
|
||||
|
|
@ -904,6 +1020,35 @@ PK11_GetLowLevelKeyIDForPrivateKey(SECKEYPrivateKey *key);
|
|||
|
||||
PRBool SECMOD_HasRootCerts(void);
|
||||
|
||||
/**********************************************************************
|
||||
* Other Utilities
|
||||
**********************************************************************/
|
||||
/*
|
||||
* Get the state of the system FIPS mode -
|
||||
* NSS uses this to force FIPS mode if the system bit is on. This returns
|
||||
* the system state independent of the database state and can be called
|
||||
* before NSS initializes.
|
||||
*/
|
||||
int SECMOD_GetSystemFIPSEnabled(void);
|
||||
|
||||
/* FIPS indicator functions. Some operations are physically allowed, but
|
||||
* are against the NSS FIPS security policy. This is because sometimes NSS
|
||||
* functions are used in non-security contexts. You can call these functions
|
||||
* to determine if you are operating inside or outside the the current vendor's
|
||||
* FIPS Security Policy for NSS. NOTE: if the current version of NSS is not
|
||||
* actually FIPS certified, then these functions will always return PR_FALSE */
|
||||
|
||||
/* This function tells if if the last single shot operation on the slot
|
||||
* was inside or outside the FIPS security policy */
|
||||
PRBool PK11_SlotGetLastFIPSStatus(PK11SlotInfo *slot);
|
||||
/* This tells you if the current operation is within the FIPS security policy. If
|
||||
* you have called finalize on the context, it tells you if the last operation
|
||||
* was within the FIPS security policy */
|
||||
PRBool PK11_ContextGetFIPSStatus(PK11Context *context);
|
||||
/* This tells you if the requested object was created in accordance to the
|
||||
* NSS FIPS security policy. */
|
||||
PRBool PK11_ObjectGetFIPSStatus(PK11ObjectType objType, void *objSpec);
|
||||
|
||||
SEC_END_PROTOS
|
||||
|
||||
#endif
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue