wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-10-22 23:27:30 +09:00
Code Issues Projects Releases Packages Wiki Activity

import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo

Browse source
This commit is contained in:
Roy Tam 2018-01-19 03:59:58 +08:00
commit dcd9973243
150858 changed files with 23884658 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

48
security/nss/lib/libpkix/include/Makefile Normal file
View file

@ -0,0 +1,48 @@
#! gmake
#
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
#######################################################################
# (1) Include initial platform-independent assignments (MANDATORY). #
#######################################################################
include manifest.mn
#######################################################################
# (2) Include "global" configuration information. (OPTIONAL) #
#######################################################################
include $(CORE_DEPTH)/coreconf/config.mk
#######################################################################
# (3) Include "component" configuration information. (OPTIONAL) #
#######################################################################
#######################################################################
# (4) Include "local" platform-dependent assignments (OPTIONAL). #
#######################################################################
include config.mk
#######################################################################
# (5) Execute "global" rules. (OPTIONAL) #
#######################################################################
include $(CORE_DEPTH)/coreconf/rules.mk
#######################################################################
# (6) Execute "component" rules. (OPTIONAL) #
#######################################################################
#######################################################################
# (7) Execute "local" rules. (OPTIONAL). #
#######################################################################
export:: private_export

15
security/nss/lib/libpkix/include/config.mk Normal file
View file

@ -0,0 +1,15 @@
#
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
#
# Override TARGETS variable so that only static libraries
# are specifed as dependencies within rules.mk.
#
TARGETS = $(LIBRARY)
SHARED_LIBRARY =
IMPORT_LIBRARY =
PROGRAM =

38
security/nss/lib/libpkix/include/exports.gyp Normal file
View file

@ -0,0 +1,38 @@
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
{
'includes': [
'../../../coreconf/config.gypi'
],
'targets': [
{
'target_name': 'lib_libpkix_include_exports',
'type': 'none',
'copies': [
{
'files': [
'pkix.h',
'pkix_certsel.h',
'pkix_certstore.h',
'pkix_checker.h',
'pkix_crlsel.h',
'pkix_errorstrings.h',
'pkix_params.h',
'pkix_pl_pki.h',
'pkix_pl_system.h',
'pkix_results.h',
'pkix_revchecker.h',
'pkix_sample_modules.h',
'pkix_util.h',
'pkixt.h'
],
'destination': '<(nss_private_dist_dir)/<(module)'
}
]
}
],
'variables': {
'module': 'nss'
}
}

12
security/nss/lib/libpkix/include/include.gyp Normal file
View file

@ -0,0 +1,12 @@
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
{
'includes': [
'../../../coreconf/config.gypi'
],
'targets': [],
'variables': {
'module': 'nss'
}
}

32
security/nss/lib/libpkix/include/manifest.mn Normal file
View file

@ -0,0 +1,32 @@
#
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
CORE_DEPTH = ../../..
EXPORTS = \
$(NULL)
PRIVATE_EXPORTS = \
pkix.h \
pkix_crlsel.h \
pkix_errorstrings.h \
pkix_results.h \
pkixt.h \
pkix_certsel.h \
pkix_params.h \
pkix_revchecker.h \
pkix_certstore.h \
pkix_pl_pki.h \
pkix_sample_modules.h \
pkix_checker.h \
pkix_pl_system.h \
pkix_util.h \
$(NULL)
MODULE = nss
CSRCS = \
$(NULL)
REQUIRES = dbm

301
security/nss/lib/libpkix/include/pkix.h Normal file
View file

@ -0,0 +1,301 @@
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
/*
* This file defines the public API for libpkix. These are the top-level
* functions in the library. They perform the primary operations of this
* library: building and validating chains of X.509 certificates.
*
*/
#ifndef _PKIX_H
#define _PKIX_H
#include "pkixt.h"
#include "pkix_util.h"
#include "pkix_results.h"
#include "pkix_certstore.h"
#include "pkix_certsel.h"
#include "pkix_crlsel.h"
#include "pkix_checker.h"
#include "pkix_revchecker.h"
#include "pkix_pl_system.h"
#include "pkix_pl_pki.h"
#include "pkix_params.h"
#ifdef __cplusplus
extern "C" {
#endif
/* General
*
* Please refer to the libpkix Programmer's Guide for detailed information
* about how to use the libpkix library. Certain key warnings and notices from
* that document are repeated here for emphasis.
*
* All identifiers in this file (and all public identifiers defined in
* libpkix) begin with "PKIX_". Private identifiers only intended for use
* within the library begin with "pkix_".
*
* A function returns NULL upon success, and a PKIX_Error pointer upon failure.
*
* Unless otherwise noted, for all accessor (gettor) functions that return a
* PKIX_PL_Object pointer, callers should assume that this pointer refers to a
* shared object. Therefore, the caller should treat this shared object as
* read-only and should not modify this shared object. When done using the
* shared object, the caller should release the reference to the object by
* using the PKIX_PL_Object_DecRef function.
*
* While a function is executing, if its arguments (or anything referred to by
* its arguments) are modified, free'd, or destroyed, the function's behavior
* is undefined.
*
*/
/*
* FUNCTION: PKIX_Initialize
* DESCRIPTION:
*
* No PKIX_* types and functions should be used before this function is called
* and returns successfully. This function should only be called once. If it
* is called more than once, the behavior is undefined.
*
* NSS applications are expected to call NSS_Init, and need not know that
* NSS will call this function (with "platformInitNeeded" set to PKIX_FALSE).
* PKIX applications are expected instead to call this function with
* "platformInitNeeded" set to PKIX_TRUE.
*
* This function initializes data structures critical to the operation of
* libpkix. It also ensures that the API version (major.minor) desired by the
* caller (the "desiredMajorVersion", "minDesiredMinorVersion", and
* "maxDesiredMinorVersion") is compatible with the API version supported by
* the library. As such, the library must support the "desiredMajorVersion"
* of the API and must support a minor version that falls between
* "minDesiredMinorVersion" and "maxDesiredMinorVersion", inclusive. If
* compatibility exists, the function returns NULL and stores the library's
* actual minor version at "pActualMinorVersion" (which may be greater than
* "desiredMinorVersion"). If no compatibility exists, the function returns a
* PKIX_Error pointer. If the caller wishes to specify that the largest
* minor version available should be used, then maxDesiredMinorVersion should
* be set to the macro PKIX_MAX_MINOR_VERSION (defined in pkixt.h).
*
* PARAMETERS:
* "platformInitNeeded"
* Boolean indicating whether the platform layer initialization code
* has previously been run, or should be called from this function.
* "desiredMajorVersion"
* The major version of the libpkix API the application wishes to use.
* "minDesiredMinorVersion"
* The minimum minor version of the libpkix API the application wishes
* to use.
* "maxDesiredMinorVersion"
* The maximum minor version of the libpkix API the application wishes
* to use.
* "pActualMinorVersion"
* Address where PKIX_UInt32 will be stored. Must be non-NULL.
* "pPlContext"
* Address at which platform-specific context pointer is stored. Must
* be non-NULL.
* THREAD SAFETY:
* Not Thread Safe
* RETURNS:
* Returns NULL if the function succeeds.
* Returns an Initialize Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_Initialize(
PKIX_Boolean platformInitNeeded,
PKIX_UInt32 desiredMajorVersion,
PKIX_UInt32 minDesiredMinorVersion,
PKIX_UInt32 maxDesiredMinorVersion,
PKIX_UInt32 *pActualMinorVersion,
void **pPlContext);
/*
* FUNCTION: PKIX_Shutdown
* DESCRIPTION:
*
* This function deallocates any memory used by libpkix and shuts down any
* ongoing operations. This function should only be called once. If it is
* called more than once, the behavior is undefined.
*
* No PKIX_* types and functions should be used after this function is called
* and returns successfully.
* PARAMETERS:
* "plContext" - Platform-specific context pointer.
* THREAD SAFETY:
* Not Thread Safe
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_Shutdown(void *plContext);
/*
* FUNCTION: PKIX_ValidateChain
* DESCRIPTION:
*
* This function attempts to validate the CertChain that has been set in the
* ValidateParams pointed to by "params" using an RFC 3280-compliant
* algorithm. If successful, this function returns NULL and stores the
* ValidateResult at "pResult", which holds additional information, such as
* the policy tree and the target's public key. If unsuccessful, an Error is
* returned. Note: This function does not currently support non-blocking I/O.
*
* If "pVerifyTree" is non-NULL, a chain of VerifyNodes is created which
* tracks the results of the validation. That is, either each node in the
* chain has a NULL Error component, or the last node contains an Error
* which indicates why the validation failed.
*
* PARAMETERS:
* "params"
* Address of ValidateParams used to validate CertChain. Must be non-NULL.
* "pResult"
* Address where object pointer will be stored. Must be non-NULL.
* "pVerifyTree"
* Address where a VerifyTree is stored, if non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (See Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Validate Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_ValidateChain(
PKIX_ValidateParams *params,
PKIX_ValidateResult **pResult,
PKIX_VerifyNode **pVerifyTree,
void *plContext);
/*
* FUNCTION: PKIX_ValidateChain_NB
* DESCRIPTION:
*
* This function is the equivalent of PKIX_ValidateChain, except that it
* supports non-blocking I/O. When called with "pNBIOContext" pointing to NULL
* it initiates a new chain validation as in PKIX_ValidateChain, ignoring the
* value in all input variables except "params". If forced to suspend
* processing by a WOULDBLOCK return from some operation, such as a CertStore
* request, it stores the platform-dependent I/O context at "pNBIOContext" and
* stores other intermediate variables at "pCertIndex", "pAnchorIndex",
* "pCheckerIndex", "pRevChecking", and "pCheckers".
*
* When called subsequently with that non-NULL value at "pNBIOContext", it
* relies on those intermediate values to be untouched, and it resumes chain
* validation where it left off. Its behavior is undefined if any of the
* intermediate values was not preserved.
*
* PARAMETERS:
* "params"
* Address of ValidateParams used to validate CertChain. Must be non-NULL.
* "pCertIndex"
* The UInt32 value of the index to the Cert chain, indicating which Cert
* is currently being processed.
* "pAnchorIndex"
* The UInt32 value of the index to the Anchor chain, indicating which
* Trust Anchor is currently being processed.
* "pCheckerIndex"
* The UInt32 value of the index to the List of CertChainCheckers,
* indicating which Checker is currently processing.
* "pRevChecking"
* The Boolean flag indicating whether normal checking or revocation
* checking is occurring for the Cert indicated by "pCertIndex".
* "pCheckers"
* The address of the List of CertChainCheckers. Must be non-NULL.
* "pNBIOContext"
* The address of the platform-dependend I/O context. Must be a non-NULL
* pointer to a NULL value for the call to initiate chain validation.
* "pResult"
* Address where ValidateResult object pointer will be stored. Must be
* non-NULL.
* "pVerifyTree"
* Address where a VerifyTree is stored, if non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a VALIDATE Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/PKIX_Error *
PKIX_ValidateChain_NB(
PKIX_ValidateParams *params,
PKIX_UInt32 *pCertIndex,
PKIX_UInt32 *pAnchorIndex,
PKIX_UInt32 *pCheckerIndex,
PKIX_Boolean *pRevChecking,
PKIX_List **pCheckers,
void **pNBIOContext,
PKIX_ValidateResult **pResult,
PKIX_VerifyNode **pVerifyTree,
void *plContext);
/*
* FUNCTION: PKIX_BuildChain
* DESCRIPTION:
*
* If called with a NULL "state", this function attempts to build and validate
* a CertChain according to the ProcessingParams pointed to by "params", using
* an RFC 3280-compliant validation algorithm. If successful, this function
* returns NULL and stores the BuildResult at "pResult", which holds the built
* CertChain, as well as additional information, such as the policy tree and
* the target's public key. If unsuccessful, an Error is returned.
*
* If the chain building is blocked by a CertStore using non-blocking I/O, this
* function stores platform-dependent non-blocking I/O context at
* "pNBIOContext", its state at "pState", and NULL at "pResult". The caller
* may be able to determine, in a platform-dependent way, when the I/O has
* completed. In any case, calling the function again with "pState" containing
* the returned value will allow the chain building to resume.
*
* If chain building is completed, either successfully or unsuccessfully, NULL
* is stored at "pNBIOContext".
*
* If "pVerifyTree" is non-NULL, a tree of VerifyNodes is created which
* tracks the results of the building. That is, each node of the tree either
* has a NULL Error component, or it is a leaf node and it contains an Error
* which indicates why the chain building could not proceed on this branch.
*
* PARAMETERS:
* "params"
* Address of ProcessingParams used to build and validate CertChain.
* Must be non-NULL.
* "pNBIOContext"
* Address where platform-dependent information is store if the build
* is suspended waiting for non-blocking I/O. Must be non-NULL.
* "pState"
* Address of BuildChain state. Must be NULL on initial call, and the
* value previously returned on subsequent calls.
* "pResult"
* Address where object pointer will be stored. Must be non-NULL.
* "pVerifyTree"
* Address where a VerifyTree is stored, if non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (See Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Build Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_BuildChain(
PKIX_ProcessingParams *params,
void **pNBIOContext,
void **pState,
PKIX_BuildResult **pResult,
PKIX_VerifyNode **pVerifyNode,
void *plContext);
#ifdef __cplusplus
}
#endif
#endif /* _PKIX_H */

1826
security/nss/lib/libpkix/include/pkix_certsel.h Normal file
View file

File diff suppressed because it is too large Load diff

714
security/nss/lib/libpkix/include/pkix_certstore.h Normal file
View file

@ -0,0 +1,714 @@
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
/*
* This file defines functions associated with the PKIX_CertStore type.
*
*/
#ifndef _PKIX_CERTSTORE_H
#define _PKIX_CERTSTORE_H
#include "pkixt.h"
#include "certt.h"
#ifdef __cplusplus
extern "C" {
#endif
/* General
*
* Please refer to the libpkix Programmer's Guide for detailed information
* about how to use the libpkix library. Certain key warnings and notices from
* that document are repeated here for emphasis.
*
* All identifiers in this file (and all public identifiers defined in
* libpkix) begin with "PKIX_". Private identifiers only intended for use
* within the library begin with "pkix_".
*
* A function returns NULL upon success, and a PKIX_Error pointer upon failure.
*
* Unless otherwise noted, for all accessor (gettor) functions that return a
* PKIX_PL_Object pointer, callers should assume that this pointer refers to a
* shared object. Therefore, the caller should treat this shared object as
* read-only and should not modify this shared object. When done using the
* shared object, the caller should release the reference to the object by
* using the PKIX_PL_Object_DecRef function.
*
* While a function is executing, if its arguments (or anything referred to by
* its arguments) are modified, free'd, or destroyed, the function's behavior
* is undefined.
*
*/
/* PKIX_CertStore
*
* A PKIX_CertStore provides a standard way for the caller to retrieve
* certificates and CRLs from a particular repository (or "store") of
* certificates and CRLs, including LDAP directories, flat files, local
* databases, etc. The CertCallback allows custom certificate retrieval logic
* to be used while the CRLCallback allows custom CRL retrieval logic to be
* used. Additionally, a CertStore can be initialized with a certStoreContext,
* which is where the caller can specify configuration data such as the host
* name of an LDAP server. Note that this certStoreContext must be an
* Object (although any object type), allowing it to be reference-counted and
* allowing it to provide the standard Object functions (Equals, Hashcode,
* ToString, Compare, Duplicate). Please note that each certStoreContext must
* provide Equals and Hashcode functions in order for the caching (on Cert and
* CertChain) to work correctly. When providing those two functions, it is not
* required that all the components of the object be hashed or checked for
* equality, but merely that the functions distinguish between unique
* instances of the certStoreContext.
*
* Once the caller has created the CertStore object, the caller then specifies
* these CertStore objects in a ProcessingParams object and passes that object
* to PKIX_ValidateChain or PKIX_BuildChain, which uses the objects to call the
* user's callback functions as needed during the validation or building
* process.
*
* The order of CertStores stored (as a list) at ProcessingParams determines
* the order in which certificates are retrieved. Trusted CertStores should
* precede non-trusted ones on the list of CertStores so their certificates
* are evaluated ahead of other certificates selected on the basis of the same
* selector criteria.
*
* The CheckTrustCallback function is used when the CertStore object
* supports trust status, which means a Cert's trust status can be altered
* dynamically. When a CertStore object is created, if the
* CheckTrustCallback is initialized to be non-NULL, this CertStore is
* defaulted as supporting trust. Then whenever a Cert needs to (re)check its
* trust status, this callback can be invoked. When a Cert is retrieved by
* a CertStore supports trust, at its GetCertCallback, the CertStore
* information should be updated in Cert's data structure so the link between
* the Cert and CertStore exists.
*
*/
/*
* FUNCTION: PKIX_CertStore_CertCallback
* DESCRIPTION:
*
* This callback function retrieves from the CertStore pointed to by "store"
* all the certificates that match the CertSelector pointed to by "selector".
* It places these certificates in a List and stores a pointer to the List at
* "pCerts". If no certificates are found which match the CertSelector's
* criteria, this function stores an empty List at "pCerts". In either case, if
* the operation is completed, NULL is stored at "pNBIOContext".
*
* A CertStore which uses non-blocking I/O may store platform-dependent
* information at "pNBIOContext" and NULL at "pCerts" to indicate that I/O is
* pending. A subsequent call to PKIX_CertStore_CertContinue is required to
* finish the operation and to obtain the List of Certs.
*
* Note that the List returned by this function is immutable.
*
* PARAMETERS:
* "store"
* Address of CertStore from which Certs are to be retrieved.
* Must be non-NULL.
* "selector"
* Address of CertSelector whose criteria must be satisfied.
* Must be non-NULL.
* "verifyNode"
* Parent log node for tracking of filtered out certs.
* "pNBIOContext"
* Address at which platform-dependent information is stored if the
* operation is suspended for non-blocking I/O. Must be non-NULL.
* "pCerts"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe
*
* Multiple threads must be able to safely call this function without
* worrying about conflicts, even if they're operating on the same object.
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CertStore Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
typedef PKIX_Error *
(*PKIX_CertStore_CertCallback)(
PKIX_CertStore *store,
PKIX_CertSelector *selector,
PKIX_VerifyNode *verifyNode,
void **pNBIOContext,
PKIX_List **pCerts, /* list of PKIX_PL_Cert */
void *plContext);
/*
* FUNCTION: PKIX_CertStore_CertContinue
* DESCRIPTION:
*
* This function continues the non-blocking operation initiated by an earlier
* call to the CertCallback function, for the CertStore pointed to by "store".
* If an earlier call did not terminate with the WOULDBLOCK indication (non-NULL
* value returned in "pNBIOContext") calling this function will return a fatal
* error. If the operation is completed the certificates found are placed in a
* List, a pointer to which is stored at "pCerts". If no certificates are found
* which match the CertSelector's criteria, this function stores an empty List
* at "pCerts". In either case, if the operation is completed, NULL is stored
* at "pNBIOContext".
*
* If non-blocking I/O is still pending this function stores platform-dependent
* information at "pNBIOContext" and NULL at "pCerts". A subsequent call to
* PKIX_CertStore_CertContinue is required to finish the operation and to
* obtain the List of Certs.
*
* Note that the List returned by this function is immutable.
*
* PARAMETERS:
* "store"
* Address of CertStore from which Certs are to be retrieved.
* Must be non-NULL.
* "selector"
* Address of CertSelector whose criteria must be satisfied.
* Must be non-NULL.
* "verifyNode"
* Parent log node for tracking of filtered out certs.
* "pNBIOContext"
* Address at which platform-dependent information is stored if the
* operation is suspended for non-blocking I/O. Must be non-NULL.
* "pCerts"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe
*
* Multiple threads must be able to safely call this function without
* worrying about conflicts, even if they're operating on the same object.
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CertStore Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_CertStore_CertContinue(
PKIX_CertStore *store,
PKIX_CertSelector *selector,
PKIX_VerifyNode *verifyNode,
void **pNBIOContext,
PKIX_List **pCerts, /* list of PKIX_PL_Cert */
void *plContext);
typedef PKIX_Error *
(*PKIX_CertStore_CertContinueFunction)(
PKIX_CertStore *store,
PKIX_CertSelector *selector,
PKIX_VerifyNode *verifyNode,
void **pNBIOContext,
PKIX_List **pCerts, /* list of PKIX_PL_Cert */
void *plContext);
/*
* FUNCTION: PKIX_CertStore_CRLCallback
* DESCRIPTION:
*
* This callback function retrieves from the CertStore pointed to by "store"
* all the CRLs that match the CRLSelector pointed to by "selector". It
* places these CRLs in a List and stores a pointer to the List at "pCRLs".
* If no CRLs are found which match the CRLSelector's criteria, this function
* stores an empty List at "pCRLs". In either case, if the operation is
* completed, NULL is stored at "pNBIOContext".
*
* A CertStore which uses non-blocking I/O may store platform-dependent
* information at "pNBIOContext" and NULL at "pCrls" to indicate that I/O is
* pending. A subsequent call to PKIX_CertStore_CRLContinue is required to
* finish the operation and to obtain the List of Crls.
*
* Note that the List returned by this function is immutable.
*
* PARAMETERS:
* "store"
* Address of CertStore from which CRLs are to be retrieved.
* Must be non-NULL.
* "selector"
* Address of CRLSelector whose criteria must be satisfied.
* Must be non-NULL.
* "pCrls"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe
*
* Multiple threads must be able to safely call this function without
* worrying about conflicts, even if they're operating on the same object.
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CertStore Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
typedef PKIX_Error *
(*PKIX_CertStore_CRLCallback)(
PKIX_CertStore *store,
PKIX_CRLSelector *selector,
void **pNBIOContext,
PKIX_List **pCrls, /* list of PKIX_PL_CRL */
void *plContext);
/*
* FUNCTION: PKIX_CertStore_ImportCrlCallback
* DESCRIPTION:
*
* The function imports crl list into a cert store. Stores that
* have local cache may only have that function defined.
*
* PARAMETERS:
* "store"
* Address of CertStore from which CRLs are to be retrieved.
* Must be non-NULL.
* "issuerName"
* Name of the issuer that will be used to track bad der crls.
* "crlList"
* Address on the importing crl list.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe
*
* Multiple threads must be able to safely call this function without
* worrying about conflicts, even if they're operating on the same object.
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CertStore Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
typedef PKIX_Error *
(*PKIX_CertStore_ImportCrlCallback)(
PKIX_CertStore *store,
PKIX_PL_X500Name *issuerName,
PKIX_List *crlList,
void *plContext);
/*
* FUNCTION: PKIX_CertStore_CheckRevokationByCrlCallback
* DESCRIPTION:
*
* The function checks revocation status of a cert with specified
* issuer, date. It returns revocation status of a cert and
* a reason code(if any) if a cert was revoked.
*
* PARAMETERS:
* "store"
* Address of CertStore from which CRLs are to be retrieved.
* Must be non-NULL.
* "cert"
* Certificate which revocation status will be checked.
* "issuer"
* Issuer certificate of the "crl".
* "date"
* Date of the revocation check.
* "crlDownloadDone"
* Indicates, that all needed crl downloads are done by the time of
* the revocation check.
* "reasonCode"
* If cert is revoked, returned reason code for which a cert was revoked.
* "revStatus"
* Returned revocation status of the cert. See PKIX_RevocationStatus
* for more details
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe
*
* Multiple threads must be able to safely call this function without
* worrying about conflicts, even if they're operating on the same object.
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CertStore Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
typedef PKIX_Error *
(*PKIX_CertStore_CheckRevokationByCrlCallback)(
PKIX_CertStore *store,
PKIX_PL_Cert *cert,
PKIX_PL_Cert *issuer,
PKIX_PL_Date *date,
PKIX_Boolean crlDownloadDone,
CERTCRLEntryReasonCode *reasonCode,
PKIX_RevocationStatus *revStatus,
void *plContext);
/*
* FUNCTION: PKIX_CertStore_CrlContinue
* DESCRIPTION:
*
* This function continues the non-blocking operation initiated by an earlier
* call to the CRLCallback function, for the CertStore pointed to by "store".
* If an earlier call did not terminate with the WOULDBLOCK indication (non-NULL
* value returned in "pNBIOContext") calling this function will return a fatal
* error. If the operation is completed the crls found are placed in a List, a
* pointer to which is stored at "pCrls". If no crls are found which match the
* CRLSelector's criteria, this function stores an empty List at "pCrls". In
* either case, if the operation is completed, NULL is stored at "pNBIOContext".
*
* If non-blocking I/O is still pending this function stores platform-dependent
* information at "pNBIOContext" and NULL at "pCrls". A subsequent call to
* PKIX_CertStore_CrlContinue is required to finish the operation and to
* obtain the List of Crls.
*
* Note that the List returned by this function is immutable.
*
* PARAMETERS:
* "store"
* Address of CertStore from which Crls are to be retrieved.
* Must be non-NULL.
* "selector"
* Address of CRLSelector whose criteria must be satisfied.
* Must be non-NULL.
* "pNBIOContext"
* Address at which platform-dependent information is stored if the
* operation is suspended for non-blocking I/O. Must be non-NULL.
* "pCrls"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe
*
* Multiple threads must be able to safely call this function without
* worrying about conflicts, even if they're operating on the same object.
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CertStore Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_CertStore_CrlContinue(
PKIX_CertStore *store,
PKIX_CRLSelector *selector,
void **pNBIOContext,
PKIX_List **pCrls, /* list of PKIX_PL_CRL */
void *plContext);
typedef PKIX_Error *
(*PKIX_CertStore_CrlContinueFunction)(
PKIX_CertStore *store,
PKIX_CRLSelector *selector,
void **pNBIOContext,
PKIX_List **pCrls, /* list of PKIX_PL_CRL */
void *plContext);
/*
* FUNCTION: PKIX_CertStore_CheckTrustCallback
* DESCRIPTION:
*
* This callback function rechecks "cert's" trust status from the CertStore
* pointed to by "store".
*
* PARAMETERS:
* "store"
* Address of CertStore from which Certs are to be checked.
* Must be non-NULL.
* "cert"
* Address of Cert whose trust status needs to be rechecked.
* Must be non-NULL.
* "pTrusted"
* Address of PKIX_Boolean where the trust status is returned.
* Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe
*
* Multiple threads must be able to safely call this function without
* worrying about conflicts, even if they're operating on the same object.
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CertStore Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
typedef PKIX_Error *
(*PKIX_CertStore_CheckTrustCallback)(
PKIX_CertStore *store,
PKIX_PL_Cert *cert,
PKIX_Boolean *pTrusted,
void *plContext);
/*
* FUNCTION: PKIX_CertStore_Create
* DESCRIPTION:
*
* Creates a new CertStore and stores it at "pStore". The new CertStore uses
* the CertCallback pointed to by "certCallback" and the CRLCallback pointed
* to by "crlCallback" as its callback functions and uses the Object pointed
* to by "certStoreContext" as its context . Note that this certStoreContext
* must be an Object (although any object type), allowing it to be
* reference-counted and allowing it to provide the standard Object functions
* (Equals, Hashcode, ToString, Compare, Duplicate). Once created, a
* CertStore object is immutable, although the underlying repository can
* change. For example, a CertStore will often be a front-end for a database
* or directory. The contents of that directory can change after the
* CertStore object is created, but the CertStore object remains immutable.
*
* PARAMETERS:
* "certCallback"
* The CertCallback function to be used. Must be non-NULL.
* "crlCallback"
* The CRLCallback function to be used. Must be non-NULL.
* "certContinue"
* The function to be used to resume a certCallback that returned with a
* WOULDBLOCK condition. Must be non-NULL if certStore supports non-blocking
* I/O.
* "crlContinue"
* The function to be used to resume a crlCallback that returned with a
* WOULDBLOCK condition. Must be non-NULL if certStore supports non-blocking
* I/O.
* "trustCallback"
* Address of PKIX_CertStore_CheckTrustCallback which is called to
* verify the trust status of Certs in this CertStore.
* "certStoreContext"
* Address of Object representing the CertStore's context (if any).
* "cachedFlag"
* If TRUE indicates data retrieved from CertStore should be cached.
* "localFlag"
* Boolean value indicating whether this CertStore is local.
* "pStore"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CertStore Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_CertStore_Create(
PKIX_CertStore_CertCallback certCallback,
PKIX_CertStore_CRLCallback crlCallback,
PKIX_CertStore_CertContinueFunction certContinue,
PKIX_CertStore_CrlContinueFunction crlContinue,
PKIX_CertStore_CheckTrustCallback trustCallback,
PKIX_CertStore_ImportCrlCallback importCrlCallback,
PKIX_CertStore_CheckRevokationByCrlCallback checkRevByCrlCallback,
PKIX_PL_Object *certStoreContext,
PKIX_Boolean cachedFlag,
PKIX_Boolean localFlag,
PKIX_CertStore **pStore,
void *plContext);
/*
* FUNCTION: PKIX_CertStore_GetCertCallback
* DESCRIPTION:
*
* Retrieves a pointer to "store's" Cert callback function and put it in
* "pCallback".
*
* PARAMETERS:
* "store"
* The CertStore whose Cert callback is desired. Must be non-NULL.
* "pCallback"
* Address where Cert callback function pointer will be stored.
* Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_CertStore_GetCertCallback(
PKIX_CertStore *store,
PKIX_CertStore_CertCallback *pCallback,
void *plContext);
/*
* FUNCTION: PKIX_CertStore_GetCRLCallback
* DESCRIPTION:
*
* Retrieves a pointer to "store's" CRL callback function and put it in
* "pCallback".
*
* PARAMETERS:
* "store"
* The CertStore whose CRL callback is desired. Must be non-NULL.
* "pCallback"
* Address where CRL callback function pointer will be stored.
* Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_CertStore_GetCRLCallback(
PKIX_CertStore *store,
PKIX_CertStore_CRLCallback *pCallback,
void *plContext);
/*
* FUNCTION: PKIX_CertStore_GetImportCrlCallback
* DESCRIPTION:
*
* Retrieves a pointer to "store's" Import CRL callback function and put it in
* "pCallback".
*
* PARAMETERS:
* "store"
* The CertStore whose CRL callback is desired. Must be non-NULL.
* "pCallback"
* Address where CRL callback function pointer will be stored.
* Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_CertStore_GetImportCrlCallback(
PKIX_CertStore *store,
PKIX_CertStore_ImportCrlCallback *pCallback,
void *plContext);
/*
* FUNCTION: PKIX_CertStore_GetCheckRevByCrl
* DESCRIPTION:
*
* Retrieves a pointer to "store's" CRL revocation checker callback function
* and put it in "pCallback".
*
* PARAMETERS:
* "store"
* The CertStore whose CRL callback is desired. Must be non-NULL.
* "pCallback"
* Address where CRL callback function pointer will be stored.
* Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_CertStore_GetCrlCheckerFn(
PKIX_CertStore *store,
PKIX_CertStore_CheckRevokationByCrlCallback *pCallback,
void *plContext);
/*
* FUNCTION: PKIX_CertStore_GetTrustCallback
* DESCRIPTION:
*
* Retrieves the function pointer to the CheckTrust callback function of the
* CertStore pointed to by "store" and stores it at "pCallback".
*
* PARAMETERS:
* "store"
* The CertStore whose CheckTrust callback is desired. Must be non-NULL.
* "pCallback"
* Address where CheckTrust callback function pointer will be stored.
* Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_CertStore_GetTrustCallback(
PKIX_CertStore *store,
PKIX_CertStore_CheckTrustCallback *pCallback,
void *plContext);
/*
* FUNCTION: PKIX_CertStore_GetCertStoreContext
* DESCRIPTION:
*
* Retrieves a pointer to the Object representing the context (if any)
* of the CertStore pointed to by "store" and stores it at
* "pCertStoreContext".
*
* PARAMETERS:
* "store"
* Address of CertStore whose context is to be stored. Must be non-NULL.
* "pCertStoreContext"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_CertStore_GetCertStoreContext(
PKIX_CertStore *store,
PKIX_PL_Object **pCertStoreContext,
void *plContext);
/*
* FUNCTION: PKIX_CertStore_GetCertStoreCacheFlag
* DESCRIPTION:
*
* Retrieves the Boolean cache flag of the CertStore pointed to by "store" and
* stores it at "pCachedFlag".
*
* PARAMETERS:
* "store"
* Address of CertStore whose cache flag is to be stored. Must be non-NULL.
* "pCacheFlag"
* Address where the result will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_CertStore_GetCertStoreCacheFlag(
PKIX_CertStore *store,
PKIX_Boolean *pCacheFlag,
void *plContext);
/*
* FUNCTION: PKIX_CertStore_GetLocalFlag
* DESCRIPTION:
*
* Retrieves the Boolean localFlag for the CertStore pointed to by "store" and
* stores it at "pLocalFlag". The localFlag is TRUE if the CertStore can
* fulfill a request without performing network I/O.
*
* PARAMETERS:
* "store"
* The CertStore whose Local flag is desired. Must be non-NULL.
* "pCallback"
* Address where the Boolean LocalFlag will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_CertStore_GetLocalFlag(
PKIX_CertStore *store,
PKIX_Boolean *pLocalFlag,
void *plContext);
#ifdef __cplusplus
}
#endif
#endif /* _PKIX_CERTSTORE_H */

394
security/nss/lib/libpkix/include/pkix_checker.h Normal file
View file

@ -0,0 +1,394 @@
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
/*
* This file defines functions associated with the PKIX_CertChainChecker type.
*
*/
#ifndef _PKIX_CHECKER_H
#define _PKIX_CHECKER_H
#include "pkixt.h"
#ifdef __cplusplus
extern "C" {
#endif
/* General
*
* Please refer to the libpkix Programmer's Guide for detailed information
* about how to use the libpkix library. Certain key warnings and notices from
* that document are repeated here for emphasis.
*
* All identifiers in this file (and all public identifiers defined in
* libpkix) begin with "PKIX_". Private identifiers only intended for use
* within the library begin with "pkix_".
*
* A function returns NULL upon success, and a PKIX_Error pointer upon failure.
*
* Unless otherwise noted, for all accessor (gettor) functions that return a
* PKIX_PL_Object pointer, callers should assume that this pointer refers to a
* shared object. Therefore, the caller should treat this shared object as
* read-only and should not modify this shared object. When done using the
* shared object, the caller should release the reference to the object by
* using the PKIX_PL_Object_DecRef function.
*
* While a function is executing, if its arguments (or anything referred to by
* its arguments) are modified, free'd, or destroyed, the function's behavior
* is undefined.
*
*/
/* PKIX_CertChainChecker
*
* PKIX_CertChainCheckers provide a standard way for the caller to insert their
* own custom checks to validate certificates. This may be useful in many
* scenarios, including when the caller wishes to validate private certificate
* extensions. The CheckCallback allows custom certificate processing to take
* place. Additionally, a CertChainChecker can optionally maintain state
* between successive calls to the CheckCallback. This certChainCheckerState
* must be an Object (although any object type), allowing it to be
* reference-counted and allowing it to provide the standard Object functions
* (Equals, Hashcode, ToString, Compare, Duplicate). If the caller wishes
* their CertChainChecker to be used during chain building, their
* certChainCheckerState object must implement an appropriate Duplicate
* function. The builder uses this Duplicate function when backtracking.
*
* Once the caller has created a CertChainChecker object, the caller then
* specifies a CertChainChecker object in a ProcessingParams object
* and passes the ProcessingParams object to PKIX_ValidateChain or
* PKIX_BuildChain, which uses the objects to call the user's callback
* functions as needed during the validation or building process.
*
* A CertChainChecker may be presented certificates in the "reverse" direction
* (from trust anchor to target) or in the "forward" direction (from target to
* trust anchor). All CertChainCheckers must support "reverse checking", while
* support for "forward checking" is optional, but recommended. If "forward
* checking" is not supported, building chains may be much less efficient. The
* PKIX_CertChainChecker_IsForwardCheckingSupported function is used to
* determine whether forward checking is supported, and the
* PKIX_CertChainChecker_IsForwardDirectionExpected function is used to
* determine whether the CertChainChecker has been initialized to expect the
* certificates to be presented in the "forward" direction.
*/
/*
* FUNCTION: PKIX_CertChainChecker_CheckCallback
* DESCRIPTION:
*
* This callback function checks whether the specified Cert pointed to by
* "cert" is valid using "checker's" internal certChainCheckerState (if any)
* and removes the critical extensions that it processes (if any) from the
* List of OIDs (possibly empty) pointed to by "unresolvedCriticalExtensions".
* If the checker finds that the certificate is not valid, an Error pointer is
* returned.
*
* If the checker uses non-blocking I/O, the address of a platform-dependent
* non-blocking I/O context ("nbioContext") will be stored at "pNBIOContext",
* which the caller may use, in a platform-dependent way, to wait, poll, or
* otherwise determine when to try again. If the checker does not use
* non-blocking I/O, NULL will always be stored at "pNBIOContext". If a non-NULL
* value was stored, on a subsequent call the checker will attempt to complete
* the pending I/O and, if successful, NULL will be stored at "pNBIOContext".
*
* PARAMETERS:
* "checker"
* Address of CertChainChecker whose certChainCheckerState and
* CheckCallback logic is to be used. Must be non-NULL.
* "cert"
* Address of Cert that is to be validated using "checker".
* Must be non-NULL.
* "unresolvedCriticalExtensions"
* Address of List of OIDs that represents the critical certificate
* extensions that have yet to be resolved. This parameter may be
* modified during the function call. Must be non-NULL.
* "pNBIOContext"
* Address at which is stored a platform-dependent structure indicating
* whether checking was suspended for non-blocking I/O. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe
*
* Multiple threads must be able to safely call this function without
* worrying about conflicts, even if they're operating on the same object.
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CertChainChecker Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
typedef PKIX_Error *
(*PKIX_CertChainChecker_CheckCallback)(
PKIX_CertChainChecker *checker,
PKIX_PL_Cert *cert,
PKIX_List *unresolvedCriticalExtensions, /* list of PKIX_PL_OID */
void **pNBIOContext,
void *plContext);
/*
* FUNCTION: PKIX_CertChainChecker_Create
* DESCRIPTION:
*
* Creates a new CertChainChecker and stores it at "pChecker". The new
* CertChainChecker uses the CheckCallback pointed to by "callback" as its
* callback function. It uses the Object pointed to by "initialState" (if
* any) as its initial state. As noted above, the initial state Object must
* provide a custom implementation of PKIX_PL_Object_Duplicate if the
* CertChainChecker is to be used during certificate chain building.
*
* A CertChainChecker may be presented certificates in the "reverse"
* direction (from trust anchor to target) or in the "forward" direction
* (from target to trust anchor). All CertChainCheckers must support
* "reverse checking", while support for "forward checking" is optional. The
* CertChainChecker is initialized with two Boolean flags that deal with this
* distinction: "forwardCheckingSupported" and "forwardDirectionExpected".
* If the "forwardCheckingSupported" Boolean flag is TRUE, it indicates that
* this CertChainChecker is capable of checking certificates in the "forward"
* direction (as well as the "reverse" direction, which all CertChainCheckers
* MUST support). The "forwardDirectionExpected" Boolean flag indicates in
* which direction the CertChainChecker should expect the certificates to be
* presented. This is particularly useful for CertChainCheckers that are
* capable of checking in either the "forward" direction or the "reverse"
* direction, but have different processing steps depending on the direction.
*
* The CertChainChecker also uses the List of OIDs pointed to by "extensions"
* as the supported certificate extensions. All certificate extensions that
* the CertChainChecker might possibly recognize and be able to process
* should be included in the List of supported extensions. If "checker" does
* not recognize or process any certificate extensions, "extensions" should
* be set to NULL.
*
* PARAMETERS:
* "callback"
* The CheckCallback function to be used. Must be non-NULL.
* "forwardCheckingSupported"
* A Boolean value indicating whether or not this CertChainChecker is
* capable of checking certificates in the "forward" direction.
* "forwardDirectionExpected"
* A Boolean value indicating whether or not this CertChainChecker should
* be used to check in the "forward" direction.
* "extensions"
* Address of List of OIDs representing the supported extensions.
* "initialState"
* Address of Object representing the CertChainChecker's initial state
* (if any).
* "pChecker"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CertChainChecker Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_CertChainChecker_Create(
PKIX_CertChainChecker_CheckCallback callback,
PKIX_Boolean forwardCheckingSupported,
PKIX_Boolean forwardDirectionExpected,
PKIX_List *extensions, /* list of PKIX_PL_OID */
PKIX_PL_Object *initialState,
PKIX_CertChainChecker **pChecker,
void *plContext);
/*
* FUNCTION: PKIX_CertChainChecker_GetCheckCallback
* DESCRIPTION:
*
* Retrieves a pointer to "checker's" Check callback function and puts it in
* "pCallback".
*
* PARAMETERS:
* "checker"
* The CertChainChecker whose Check callback is desired. Must be non-NULL.
* "pCallback"
* Address where Check callback function pointer will be stored.
* Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CertChainChecker Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_CertChainChecker_GetCheckCallback(
PKIX_CertChainChecker *checker,
PKIX_CertChainChecker_CheckCallback *pCallback,
void *plContext);
/*
* FUNCTION: PKIX_CertChainChecker_IsForwardCheckingSupported
* DESCRIPTION:
*
* Checks whether forward checking is supported by the CertChainChecker
* pointed to by "checker" and stores the Boolean result at
* "pForwardCheckingSupported".
*
* A CertChainChecker may be presented certificates in the "reverse"
* direction (from trust anchor to target) or in the "forward" direction
* (from target to trust anchor). All CertChainCheckers must support
* "reverse checking", while support for "forward checking" is optional. This
* function is used to determine whether forward checking is supported.
*
* PARAMETERS:
* "checker"
* The CertChainChecker whose ability to validate certificates in the
* "forward" direction is to be checked. Must be non-NULL.
* "pForwardCheckingSupported"
* Destination of the Boolean result. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CertChainChecker Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_CertChainChecker_IsForwardCheckingSupported(
PKIX_CertChainChecker *checker,
PKIX_Boolean *pForwardCheckingSupported,
void *plContext);
/*
* FUNCTION: PKIX_CertChainChecker_IsForwardDirectionExpected
* DESCRIPTION:
*
* Checks whether the CertChainChecker pointed to by "checker" has been
* initialized to expect the certificates to be presented in the "forward"
* direction and stores the Boolean result at "pForwardDirectionExpected".
*
* A CertChainChecker may be presented certificates in the "reverse"
* direction (from trust anchor to target) or in the "forward" direction
* (from target to trust anchor). All CertChainCheckers must support
* "reverse checking", while support for "forward checking" is optional. This
* function is used to determine in which direction the CertChainChecker
* expects the certificates to be presented.
*
* PARAMETERS:
* "checker"
* The CertChainChecker that has been initialized to expect certificates
* in either the "forward" or "reverse" directions. Must be non-NULL.
* "pForwardDirectionExpected"
* Destination of the Boolean result. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CertChainChecker Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_CertChainChecker_IsForwardDirectionExpected(
PKIX_CertChainChecker *checker,
PKIX_Boolean *pForwardDirectionExpected,
void *plContext);
/*
* FUNCTION: PKIX_CertChainChecker_GetSupportedExtensions
* DESCRIPTION:
*
* Retrieves a pointer to a List of OIDs (each OID corresponding to a
* certificate extension supported by the CertChainChecker pointed to by
* "checker") and stores it at "pExtensions". All certificate extensions that
* the CertChainChecker might possibly recognize and be able to process
* should be included in the List of supported extensions. If "checker" does
* not recognize or process any certificate extensions, this function stores
* NULL at "pExtensions".
*
* Note that the List returned by this function is immutable.
*
* PARAMETERS:
* "checker"
* Address of CertChainChecker whose supported extension OIDs are to be
* stored. Must be non-NULL.
* "pExtensions"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CertChainChecker Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_CertChainChecker_GetSupportedExtensions(
PKIX_CertChainChecker *checker,
PKIX_List **pExtensions, /* list of PKIX_PL_OID */
void *plContext);
/*
* FUNCTION: PKIX_CertChainChecker_GetCertChainCheckerState
* DESCRIPTION:
*
* Retrieves a pointer to a PKIX_PL_Object representing the internal state
* (if any) of the CertChainChecker pointed to by "checker" and stores it at
* "pCertChainCheckerState".
*
* PARAMETERS:
* "checker"
* Address of CertChainChecker whose state is to be stored.
* Must be non-NULL.
* "pCertChainCheckerState"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Conditionally Thread Safe
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CertChainChecker Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_CertChainChecker_GetCertChainCheckerState(
PKIX_CertChainChecker *checker,
PKIX_PL_Object **pCertChainCheckerState,
void *plContext);
/*
* FUNCTION: PKIX_CertChainChecker_SetCertChainCheckerState
* DESCRIPTION:
*
* Sets the internal state of the CertChainChecker pointed to by "checker"
* using the Object pointed to by "certChainCheckerState". If "checker" needs
* a NULL internal state, "certChainCheckerState" should be set to NULL.
*
* PARAMETERS:
* "checker"
* Address of CertChainChecker whose state is to be set. Must be non-NULL.
* "certChainCheckerState"
* Address of Object representing internal state.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Not Thread Safe - assumes exclusive access to "checker"
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CertChainChecker Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_CertChainChecker_SetCertChainCheckerState(
PKIX_CertChainChecker *checker,
PKIX_PL_Object *certChainCheckerState,
void *plContext);
#ifdef __cplusplus
}
#endif
#endif /* _PKIX_CHECKER_H */

759
security/nss/lib/libpkix/include/pkix_crlsel.h Normal file
View file

@ -0,0 +1,759 @@
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
/*
* This file defines functions associated with the PKIX_CRLSelector and the
* PKIX_ComCRLSelParams types.
*
*/
#ifndef _PKIX_CRLSEL_H
#define _PKIX_CRLSEL_H
#include "pkixt.h"
#ifdef __cplusplus
extern "C" {
#endif
/* General
*
* Please refer to the libpkix Programmer's Guide for detailed information
* about how to use the libpkix library. Certain key warnings and notices from
* that document are repeated here for emphasis.
*
* All identifiers in this file (and all public identifiers defined in
* libpkix) begin with "PKIX_". Private identifiers only intended for use
* within the library begin with "pkix_".
*
* A function returns NULL upon success, and a PKIX_Error pointer upon failure.
*
* Unless otherwise noted, for all accessor (gettor) functions that return a
* PKIX_PL_Object pointer, callers should assume that this pointer refers to a
* shared object. Therefore, the caller should treat this shared object as
* read-only and should not modify this shared object. When done using the
* shared object, the caller should release the reference to the object by
* using the PKIX_PL_Object_DecRef function.
*
* While a function is executing, if its arguments (or anything referred to by
* its arguments) are modified, free'd, or destroyed, the function's behavior
* is undefined.
*
*/
/* PKIX_CRLSelector
*
* PKIX_CRLSelectors provide a standard way for the caller to select CRLs
* based on particular criteria. A CRLSelector is typically used by libpkix
* to retrieve CRLs from a CertStore during certificate chain validation or
* building. (see pkix_certstore.h) For example, the caller may wish to only
* select those CRLs that have a particular issuer or a particular value for a
* private CRL extension. The MatchCallback allows the caller to specify the
* custom matching logic to be used by a CRLSelector.
* By default, the MatchCallback is set to point to the default implementation
* provided by libpkix, which understands how to process the most common
* parameters. If the default implementation is used, the caller should set
* these common parameters using PKIX_CRLSelector_SetCommonCRLSelectorParams.
* Any common parameter that is not set is assumed to be disabled, which means
* the default MatchCallback implementation will select all CRLs without
* regard to that particular disabled parameter. For example, if the
* MaxCRLNumber parameter is not set, MatchCallback will not filter out any
* CRL based on its CRL number. As such, if no parameters are set, all are
* disabled and any CRL will match. If a parameter is disabled, its associated
* PKIX_ComCRLSelParams_Get* function returns a default value of NULL.
*
* If a custom implementation is desired, the default implementation can be
* overridden by calling PKIX_CRLSelector_SetMatchCallback. In this case, the
* CRLSelector can be initialized with a crlSelectorContext, which is where
* the caller can specify the desired parameters the caller wishes to match
* against. Note that this crlSelectorContext must be a PKIX_PL_Object,
* allowing it to be reference-counted and allowing it to provide the standard
* PKIX_PL_Object functions (Equals, Hashcode, ToString, Compare, Duplicate).
*
*/
/*
* FUNCTION: PKIX_CRLSelector_MatchCallback
* DESCRIPTION:
*
* This callback function determines whether the specified CRL pointed to by
* "crl" matches the criteria of the CRLSelector pointed to by "selector".
* If the CRL matches the CRLSelector's criteria, PKIX_TRUE is stored at
* "pMatch". Otherwise PKIX_FALSE is stored at "pMatch".
*
* PARAMETERS:
* "selector"
* Address of CRLSelector whose MatchCallback logic and parameters are
* to be used. Must be non-NULL.
* "crl"
* Address of CRL that is to be matched using "selector". Must be non-NULL.
* "pMatch"
* Address at which Boolean result is stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe
*
* Multiple threads must be able to safely call this function without
* worrying about conflicts, even if they're operating on the same objects.
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CRLSelector Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
typedef PKIX_Error *
(*PKIX_CRLSelector_MatchCallback)(
PKIX_CRLSelector *selector,
PKIX_PL_CRL *crl,
PKIX_Boolean *pMatch,
void *plContext);
/*
* FUNCTION: PKIX_CRLSelector_Create
* DESCRIPTION:
*
* Creates a new CRLSelector using the Object pointed to by
* "crlSelectorContext" (if any) and stores it at "pSelector". As noted
* above, by default, the MatchCallback is set to point to the default
* implementation provided by libpkix, which understands how to process
* ComCRLSelParams. This is overridden if the MatchCallback pointed to by
* "callback" is not NULL, in which case the parameters are specified using
* the Object pointed to by "crlSelectorContext".
*
* PARAMETERS:
* "issue"
* crl issuer.
* "crlDpList"
* distribution points list
* "callback"
* The MatchCallback function to be used.
* "pSelector"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CRLSelector Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_CRLSelector_Create(
PKIX_PL_Cert *issuer,
PKIX_List *crlDpList,
PKIX_PL_Date *date,
PKIX_CRLSelector **pSelector,
void *plContext);
/*
* FUNCTION: PKIX_CRLSelector_GetMatchCallback
* DESCRIPTION:
*
* Retrieves a pointer to "selector's" Match callback function and puts it in
* "pCallback".
*
* PARAMETERS:
* "selector"
* The CRLSelector whose Match callback is desired. Must be non-NULL.
* "pCallback"
* Address where Match callback function pointer will be stored.
* Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CRLSelector Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_CRLSelector_GetMatchCallback(
PKIX_CRLSelector *selector,
PKIX_CRLSelector_MatchCallback *pCallback,
void *plContext);
/*
* FUNCTION: PKIX_CRLSelector_GetCRLSelectorContext
* DESCRIPTION:
*
* Retrieves a pointer to a PKIX_PL_Object representing the context (if any)
* of the CRLSelector pointed to by "selector" and stores it at
* "pCRLSelectorContext".
*
* PARAMETERS:
* "selector"
* Address of CRLSelector whose context is to be stored. Must be non-NULL.
* "pCRLSelectorContext"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CRLSelector Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_CRLSelector_GetCRLSelectorContext(
PKIX_CRLSelector *selector,
void **pCRLSelectorContext,
void *plContext);
/*
* FUNCTION: PKIX_CRLSelector_GetCommonCRLSelectorParams
* DESCRIPTION:
*
* Retrieves a pointer to the ComCRLSelParams object that represent the common
* parameters of the CRLSelector pointed to by "selector" and stores it at
* "pCommonCRLSelectorParams". If there are no common parameters stored with
* the CRLSelector, this function stores NULL at "pCommonCRLSelectorParams".
*
* PARAMETERS:
* "selector"
* Address of CRLSelector whose ComCRLSelParams are to be stored.
* Must be non-NULL.
* "pCommonCRLSelectorParams"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Conditionally Thread Safe
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CRLSelector Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_CRLSelector_GetCommonCRLSelectorParams(
PKIX_CRLSelector *selector,
PKIX_ComCRLSelParams **pCommonCRLSelectorParams,
void *plContext);
/*
* FUNCTION: PKIX_CRLSelector_SetCommonCRLSelectorParams
* DESCRIPTION:
*
* Sets the common parameters for the CRLSelector pointed to by "selector"
* using the ComCRLSelParams pointed to by "commonCRLSelectorParams".
*
* PARAMETERS:
* "selector"
* Address of CRLSelector whose common parameters are to be set.
* Must be non-NULL.
* "commonCRLSelectorParams"
* Address of ComCRLSelParams representing the common parameters.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Not Thread Safe - assumes exclusive access to "selector"
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CRLSelector Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_CRLSelector_SetCommonCRLSelectorParams(
PKIX_CRLSelector *selector,
PKIX_ComCRLSelParams *commonCRLSelectorParams,
void *plContext);
/* PKIX_ComCRLSelParams
*
* PKIX_ComCRLSelParams are X.509 parameters commonly used with CRLSelectors,
* especially determining which CRLs to retrieve from a CertStore.
* PKIX_ComCRLSelParams are typically used with those CRLSelectors that use
* the default implementation of MatchCallback, which understands how to
* process ComCRLSelParams.
*/
/*
* FUNCTION: PKIX_ComCRLSelParams_Create
* DESCRIPTION:
*
* Creates a new ComCRLSelParams object and stores it at "pParams".
*
* PARAMETERS:
* "pParams"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CRLSelector Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_ComCRLSelParams_Create(
PKIX_ComCRLSelParams **pParams,
void *plContext);
/*
* FUNCTION: PKIX_ComCRLSelParams_GetIssuerNames
* DESCRIPTION:
*
* Retrieves a pointer to the List of X500Names (if any) representing the
* issuer names criterion that is set in the ComCRLSelParams pointed to by
* "params" and stores it at "pNames". In order to match against this
* criterion, a CRL's IssuerName must match at least one of the criterion's
* issuer names.
*
* If "params" does not have this criterion set, this function stores NULL at
* "pNames", in which case all CRLs are considered to match.
*
* Note that the List returned by this function is immutable.
*
* PARAMETERS:
* "params"
* Address of ComCRLSelParams whose issuer names criterion (if any) is to
* be stored. Must be non-NULL.
* "pNames"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Conditionally Thread Safe
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CRLSelector Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_ComCRLSelParams_GetIssuerNames(
PKIX_ComCRLSelParams *params,
PKIX_List **pNames, /* list of PKIX_PL_X500Name */
void *plContext);
/*
* FUNCTION: PKIX_ComCRLSelParams_SetIssuerNames
* DESCRIPTION:
*
* Sets the issuer names criterion of the ComCRLSelParams pointed to by
* "params" using a List of X500Names pointed to by "names". In order to match
* against this criterion, a CRL's IssuerName must match at least one of the
* criterion's issuer names.
*
* PARAMETERS:
* "params"
* Address of ComCRLSelParamsParams whose issuer names criterion is to be
* set. Must be non-NULL.
* "names"
* Address of List of X500Names used to set the criterion
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Not Thread Safe - assumes exclusive access to "params"
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CRLSelector Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_ComCRLSelParams_SetIssuerNames(
PKIX_ComCRLSelParams *params,
PKIX_List *names, /* list of PKIX_PL_X500Name */
void *plContext);
/*
* FUNCTION: PKIX_ComCRLSelParams_AddIssuerName
* DESCRIPTION:
*
* Adds to the issuer names criterion of the ComCRLSelParams pointed to by
* "params" using the X500Name pointed to by "name". In order to match
* against this criterion, a CRL's IssuerName must match at least one of the
* criterion's issuer names.
*
* PARAMETERS:
* "params"
* Address of ComCRLSelParams whose issuer names criterion is to be added
* to. Must be non-NULL.
* "name"
* Address of X500Name to be added.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Not Thread Safe - assumes exclusive access to "params"
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CRLSelector Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_ComCRLSelParams_AddIssuerName(
PKIX_ComCRLSelParams *params,
PKIX_PL_X500Name *name,
void *plContext);
/*
* FUNCTION: PKIX_ComCRLSelParams_GetCertificateChecking
* DESCRIPTION:
*
* Retrieves a pointer to the Cert (if any) representing the certificate whose
* revocation status is being checked. This is not a criterion. It is simply
* optional information that may help a CertStore find relevant CRLs.
*
* If "params" does not have a certificate set, this function stores NULL at
* "pCert", in which case there is no optional information to provide.
*
* PARAMETERS:
* "params"
* Address of ComCRLSelParams whose certificate being checked (if any) is
* to be stored. Must be non-NULL.
* "pCert"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Conditionally Thread Safe
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds
* Returns a CRLSelector Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_ComCRLSelParams_GetCertificateChecking(
PKIX_ComCRLSelParams *params,
PKIX_PL_Cert **pCert,
void *plContext);
/*
* FUNCTION: PKIX_ComCRLSelParams_SetCertificateChecking
* DESCRIPTION:
*
* Sets the ComCRLSelParams pointed to by "params" with the certificate
* (pointed to by "cert") whose revocation status is being checked. This is
* not a criterion. It is simply optional information that may help a
* CertStore find relevant CRLs.
*
* PARAMETERS:
* "params"
* Address of ComCRLSelParams whose certificate being checked is to be
* set. Must be non-NULL.
* "cert"
* Address of Cert whose revocation status is being checked
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Not Thread Safe - assumes exclusive access to "params"
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CRLSelector Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_ComCRLSelParams_SetCertificateChecking(
PKIX_ComCRLSelParams *params,
PKIX_PL_Cert *cert,
void *plContext);
/*
* FUNCTION: PKIX_ComCRLSelParams_GetDateAndTime
* DESCRIPTION:
*
* Retrieves a pointer to the Date (if any) representing the dateAndTime
* criterion that is set in the ComCRLSelParams pointed to by "params" and
* stores it at "pDate". In order to match against this criterion, a CRL's
* thisUpdate component must be less than or equal to the criterion's
* dateAndTime and the CRL's nextUpdate component must be later than the
* criterion's dateAndTime. There is no match if the CRL does not contain a
* nextUpdate component.
*
* If "params" does not have this criterion set, this function stores NULL at
* "pDate", in which case all CRLs are considered to match.
*
* PARAMETERS:
* "params"
* Address of ComCRLSelParams whose dateAndTime criterion (if any) is to
* be stored. Must be non-NULL.
* "pDate"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Conditionally Thread Safe
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CRLSelector Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_ComCRLSelParams_GetDateAndTime(
PKIX_ComCRLSelParams *params,
PKIX_PL_Date **pDate,
void *plContext);
/*
* FUNCTION: PKIX_ComCRLSelParams_SetDateAndTime
* DESCRIPTION:
*
* Sets the dateAndTime criterion of the ComCRLSelParams pointed to by
* "params" using a Date pointed to by "date". In order to match against this
* criterion, a CRL's thisUpdate component must be less than or equal to the
* criterion's dateAndTime and the CRL's nextUpdate component must be later
* than the criterion's dateAndTime. There is no match if the CRL does not
* contain a nextUpdate component.
*
* PARAMETERS:
* "params"
* Address of ComCRLSelParamsParams whose dateAndTime criterion is to be
* set. Must be non-NULL.
* "date"
* Address of Date used to set the criterion
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Not Thread Safe - assumes exclusive access to "params"
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CRLSelector Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_ComCRLSelParams_SetDateAndTime(
PKIX_ComCRLSelParams *params,
PKIX_PL_Date *date,
void *plContext);
/*
* FUNCTION: PKIX_ComCRLSelParams_GetNISTPolicyEnabled
* DESCRIPTION:
*
* Retrieves a pointer to the Boolean representing the NIST CRL policy
* activation flag that is set in the ComCRLSelParams pointed to by "params"
* and stores it at "enabled". If enabled, a CRL must have nextUpdate field.
*
* Default value for this flag is TRUE.
*
* PARAMETERS:
* "params"
* Address of ComCRLSelParams whose NIST CRL policy criterion is to
* be stored. Must be non-NULL.
* "pEnabled"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Conditionally Thread Safe
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CRLSelector Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_ComCRLSelParams_GetNISTPolicyEnabled(
PKIX_ComCRLSelParams *params,
PKIX_Boolean *pEnabled,
void *plContext);
/*
* FUNCTION: PKIX_ComCRLSelParams_SetNISTPolicyEnabled
* DESCRIPTION:
*
* Sets the NIST crl policy criterion of the ComCRLSelParams pointed to by
* "params" using a "enabled" flag. In order to match against this
* criterion, a CRL's nextUpdate must be available and criterion's
* dataAndTime must be within thisUpdate and nextUpdate time period.
*
* PARAMETERS:
* "params"
* Address of ComCRLSelParamsParams whose NIST CRL policy criterion
* is to be set. Must be non-NULL.
* "enabled"
* Address of Bollean used to set the criterion
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Not Thread Safe - assumes exclusive access to "params"
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CRLSelector Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_ComCRLSelParams_SetNISTPolicyEnabled(
PKIX_ComCRLSelParams *params,
PKIX_Boolean enabled,
void *plContext);
/*
* FUNCTION: PKIX_ComCRLSelParams_GetMaxCRLNumber
* DESCRIPTION:
*
* Retrieves a pointer to the BigInt (if any) representing the maxCRLNumber
* criterion that is set in the ComCRLSelParams pointed to by "params" and
* stores it at "pNumber". In order to match against this criterion, a CRL
* must have a CRL number extension whose value is less than or equal to the
* criterion's value.
*
* If "params" does not have this criterion set, this function stores NULL at
* "pNumber", in which case all CRLs are considered to match.
*
* PARAMETERS:
* "params"
* Address of ComCRLSelParams whose maxCRLNumber criterion (if any) is to
* be stored. Must be non-NULL.
* "pNumber"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Conditionally Thread Safe
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CRLSelector Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_ComCRLSelParams_GetMaxCRLNumber(
PKIX_ComCRLSelParams *params,
PKIX_PL_BigInt **pNumber,
void *plContext);
/*
* FUNCTION: PKIX_ComCRLSelParams_SetMaxCRLNumber
* DESCRIPTION:
*
* Sets the maxCRLNumber criterion of the ComCRLSelParams pointed to by
* "params" using a BigInt pointed to by "number". In order to match against
* this criterion, a CRL must have a CRL number extension whose value is less
* than or equal to the criterion's value.
*
* PARAMETERS:
* "params"
* Address of ComCRLSelParamsParams whose maxCRLNumber criterion is to be
* set. Must be non-NULL.
* "number"
* Address of BigInt used to set the criterion
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Not Thread Safe - assumes exclusive access to "params"
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CRLSelector Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_ComCRLSelParams_SetMaxCRLNumber(
PKIX_ComCRLSelParams *params,
PKIX_PL_BigInt *number,
void *plContext);
/*
* FUNCTION: PKIX_ComCRLSelParams_GetMinCRLNumber
* DESCRIPTION:
*
* Retrieves a pointer to the BigInt (if any) representing the minCRLNumber
* criterion that is set in the ComCRLSelParams pointed to by "params" and
* stores it at "pNumber". In order to match against this criterion, a CRL
* must have a CRL number extension whose value is greater than or equal to
* the criterion's value.
*
* If "params" does not have this criterion set, this function stores NULL at
* "pNumber", in which case all CRLs are considered to match.
*
* PARAMETERS:
* "params"
* Address of ComCRLSelParams whose minCRLNumber criterion (if any) is to
* be stored. Must be non-NULL.
* "pNumber"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Conditionally Thread Safe
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CRLSelector Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_ComCRLSelParams_GetMinCRLNumber(
PKIX_ComCRLSelParams *params,
PKIX_PL_BigInt **pNumber,
void *plContext);
/*
* FUNCTION: PKIX_ComCRLSelParams_SetMinCRLNumber
* DESCRIPTION:
*
* Sets the minCRLNumber criterion of the ComCRLSelParams pointed to by
* "params" using a BigInt pointed to by "number". In order to match against
* this criterion, a CRL must have a CRL number extension whose value is
* greater than or equal to the criterion's value.
*
* PARAMETERS:
* "params"
* Address of ComCRLSelParamsParams whose minCRLNumber criterion is to be
* set. Must be non-NULL.
* "number"
* Address of BigInt used to set the criterion
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Not Thread Safe - assumes exclusive access to "params"
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CRLSelector Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_ComCRLSelParams_SetMinCRLNumber(
PKIX_ComCRLSelParams *params,
PKIX_PL_BigInt *number,
void *plContext);
/*
* FUNCTION: PKIX_ComCRLSelParams_SetCrlDp
* DESCRIPTION:
*
* Sets crldp list that can be used to download a crls.
*
* PARAMETERS:
* "params"
* Address of ComCRLSelParamsParams whose minCRLNumber criterion is to be
* set. Must be non-NULL.
* "crldpList"
* A list of CRLDPs. Can be an emptry list.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Not Thread Safe - assumes exclusive access to "params"
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CRLSelector Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error*
PKIX_ComCRLSelParams_SetCrlDp(
PKIX_ComCRLSelParams *params,
PKIX_List *crldpList,
void *plContext);
#ifdef __cplusplus
}
#endif
#endif /* _PKIX_CRLSEL_H */

1099
security/nss/lib/libpkix/include/pkix_errorstrings.h Normal file
View file

File diff suppressed because it is too large Load diff

1793
security/nss/lib/libpkix/include/pkix_params.h Normal file
View file

File diff suppressed because it is too large Load diff

2735
security/nss/lib/libpkix/include/pkix_pl_pki.h Normal file
View file

File diff suppressed because it is too large Load diff

1545
security/nss/lib/libpkix/include/pkix_pl_system.h Normal file
View file

File diff suppressed because it is too large Load diff

425
security/nss/lib/libpkix/include/pkix_results.h Normal file
View file

@ -0,0 +1,425 @@
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
/*
* This file defines functions associated with the results used
* by the top-level functions.
*
*/
#ifndef _PKIX_RESULTS_H
#define _PKIX_RESULTS_H
#include "pkixt.h"
#ifdef __cplusplus
extern "C" {
#endif
/* General
*
* Please refer to the libpkix Programmer's Guide for detailed information
* about how to use the libpkix library. Certain key warnings and notices from
* that document are repeated here for emphasis.
*
* All identifiers in this file (and all public identifiers defined in
* libpkix) begin with "PKIX_". Private identifiers only intended for use
* within the library begin with "pkix_".
*
* A function returns NULL upon success, and a PKIX_Error pointer upon failure.
*
* Unless otherwise noted, for all accessor (gettor) functions that return a
* PKIX_PL_Object pointer, callers should assume that this pointer refers to a
* shared object. Therefore, the caller should treat this shared object as
* read-only and should not modify this shared object. When done using the
* shared object, the caller should release the reference to the object by
* using the PKIX_PL_Object_DecRef function.
*
* While a function is executing, if its arguments (or anything referred to by
* its arguments) are modified, free'd, or destroyed, the function's behavior
* is undefined.
*
*/
/* PKIX_ValidateResult
*
* PKIX_ValidateResult represents the result of a PKIX_ValidateChain call. It
* consists of the valid policy tree and public key resulting from validation,
* as well as the trust anchor used for this chain. Once created, a
* ValidateResult object is immutable.
*/
/*
* FUNCTION: PKIX_ValidateResult_GetPolicyTree
* DESCRIPTION:
*
* Retrieves the PolicyNode component (representing the valid_policy_tree)
* from the ValidateResult object pointed to by "result" and stores it at
* "pPolicyTree".
*
* PARAMETERS:
* "result"
* Address of ValidateResult whose policy tree is to be stored. Must be
* non-NULL.
* "pPolicyTree"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Result Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_ValidateResult_GetPolicyTree(
PKIX_ValidateResult *result,
PKIX_PolicyNode **pPolicyTree,
void *plContext);
/*
* FUNCTION: PKIX_ValidateResult_GetPublicKey
* DESCRIPTION:
*
* Retrieves the PublicKey component (representing the valid public_key) of
* the ValidateResult object pointed to by "result" and stores it at
* "pPublicKey".
*
* PARAMETERS:
* "result"
* Address of ValidateResult whose public key is to be stored.
* Must be non-NULL.
* "pPublicKey"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Result Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_ValidateResult_GetPublicKey(
PKIX_ValidateResult *result,
PKIX_PL_PublicKey **pPublicKey,
void *plContext);
/*
* FUNCTION: PKIX_ValidateResult_GetTrustAnchor
* DESCRIPTION:
*
* Retrieves the TrustAnchor component (representing the trust anchor used
* during chain validation) of the ValidateResult object pointed to by
* "result" and stores it at "pTrustAnchor".
*
* PARAMETERS:
* "result"
* Address of ValidateResult whose trust anchor is to be stored.
* Must be non-NULL.
* "pTrustAnchor"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Result Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_ValidateResult_GetTrustAnchor(
PKIX_ValidateResult *result,
PKIX_TrustAnchor **pTrustAnchor,
void *plContext);
/* PKIX_BuildResult
*
* PKIX_BuildResult represents the result of a PKIX_BuildChain call. It
* consists of a ValidateResult object, as well as the built and validated
* CertChain. Once created, a BuildResult object is immutable.
*/
/*
* FUNCTION: PKIX_BuildResult_GetValidateResult
* DESCRIPTION:
*
* Retrieves the ValidateResult component (representing the build's validate
* result) of the BuildResult object pointed to by "result" and stores it at
* "pResult".
*
* PARAMETERS:
* "result"
* Address of BuildResult whose ValidateResult component is to be stored.
* Must be non-NULL.
* "pResult"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Result Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_BuildResult_GetValidateResult(
PKIX_BuildResult *result,
PKIX_ValidateResult **pResult,
void *plContext);
/*
* FUNCTION: PKIX_BuildResult_GetCertChain
* DESCRIPTION:
*
* Retrieves the List of Certs (certChain) component (representing the built
* and validated CertChain) of the BuildResult object pointed to by "result"
* and stores it at "pChain".
*
* PARAMETERS:
* "result"
* Address of BuildResult whose CertChain component is to be stored.
* Must be non-NULL.
* "pChain"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Result Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_BuildResult_GetCertChain(
PKIX_BuildResult *result,
PKIX_List **pChain,
void *plContext);
/* PKIX_PolicyNode
*
* PKIX_PolicyNode represents a node in the policy tree returned in
* ValidateResult. The policy tree is the same length as the validated
* certificate chain and the nodes are associated with a particular depth
* (corresponding to a particular certificate in the chain).
* PKIX_ValidateResult_GetPolicyTree returns the root node of the valid policy
* tree. Other nodes can be accessed using the getChildren and getParents
* functions, and individual elements of a node can be accessed with the
* appropriate gettors. Once created, a PolicyNode is immutable.
*/
/*
* FUNCTION: PKIX_PolicyNode_GetChildren
* DESCRIPTION:
*
* Retrieves the List of PolicyNodes representing the child nodes of the
* Policy Node pointed to by "node" and stores it at "pChildren". If "node"
* has no child nodes, this function stores an empty List at "pChildren".
*
* Note that the List returned by this function is immutable.
*
* PARAMETERS:
* "node"
* Address of PolicyNode whose child nodes are to be stored.
* Must be non-NULL.
* "pChildren"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Result Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_PolicyNode_GetChildren(
PKIX_PolicyNode *node,
PKIX_List **pChildren, /* list of PKIX_PolicyNode */
void *plContext);
/*
* FUNCTION: PKIX_PolicyNode_GetParent
* DESCRIPTION:
*
* Retrieves the PolicyNode representing the parent node of the PolicyNode
* pointed to by "node" and stores it at "pParent". If "node" has no parent
* node, this function stores NULL at "pParent".
*
* PARAMETERS:
* "node"
* Address of PolicyNode whose parent node is to be stored.
* Must be non-NULL.
* "pParent"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Result Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_PolicyNode_GetParent(
PKIX_PolicyNode *node,
PKIX_PolicyNode **pParent,
void *plContext);
/*
* FUNCTION: PKIX_PolicyNode_GetValidPolicy
* DESCRIPTION:
*
* Retrieves the OID representing the valid policy of the PolicyNode pointed
* to by "node" and stores it at "pValidPolicy".
*
* PARAMETERS:
* "node"
* Address of PolicyNode whose valid policy is to be stored.
* Must be non-NULL.
* "pValidPolicy"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Result Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_PolicyNode_GetValidPolicy(
PKIX_PolicyNode *node,
PKIX_PL_OID **pValidPolicy,
void *plContext);
/*
* FUNCTION: PKIX_PolicyNode_GetPolicyQualifiers
* DESCRIPTION:
*
* Retrieves the List of CertPolicyQualifiers representing the policy
* qualifiers associated with the PolicyNode pointed to by "node" and stores
* it at "pQualifiers". If "node" has no policy qualifiers, this function
* stores an empty List at "pQualifiers".
*
* Note that the List returned by this function is immutable.
*
* PARAMETERS:
* "node"
* Address of PolicyNode whose policy qualifiers are to be stored.
* Must be non-NULL.
* "pQualifiers"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Result Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_PolicyNode_GetPolicyQualifiers(
PKIX_PolicyNode *node,
PKIX_List **pQualifiers, /* list of PKIX_PL_CertPolicyQualifier */
void *plContext);
/*
* FUNCTION: PKIX_PolicyNode_GetExpectedPolicies
* DESCRIPTION:
*
* Retrieves the List of OIDs representing the expected policies associated
* with the PolicyNode pointed to by "node" and stores it at "pExpPolicies".
*
* Note that the List returned by this function is immutable.
*
* PARAMETERS:
* "node"
* Address of PolicyNode whose expected policies are to be stored.
* Must be non-NULL.
* "pExpPolicies"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Result Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_PolicyNode_GetExpectedPolicies(
PKIX_PolicyNode *node,
PKIX_List **pExpPolicies, /* list of PKIX_PL_OID */
void *plContext);
/*
* FUNCTION: PKIX_PolicyNode_IsCritical
* DESCRIPTION:
*
* Checks the criticality field of the PolicyNode pointed to by "node" and
* stores the Boolean result at "pCritical".
*
* PARAMETERS:
* "node"
* Address of PolicyNode whose criticality field is examined.
* Must be non-NULL.
* "pCritical"
* Address where Boolean will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Result Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_PolicyNode_IsCritical(
PKIX_PolicyNode *node,
PKIX_Boolean *pCritical,
void *plContext);
/*
* FUNCTION: PKIX_PolicyNode_GetDepth
* DESCRIPTION:
*
* Retrieves the depth component of the PolicyNode pointed to by "node" and
* stores it at "pDepth".
*
* PARAMETERS:
* "node"
* Address of PolicyNode whose depth component is to be stored.
* Must be non-NULL.
* "pDepth"
* Address where PKIX_UInt32 will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Result Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_PolicyNode_GetDepth(
PKIX_PolicyNode *node,
PKIX_UInt32 *pDepth,
void *plContext);
#ifdef __cplusplus
}
#endif
#endif /* _PKIX_RESULTS_H */

215
security/nss/lib/libpkix/include/pkix_revchecker.h Normal file
View file

@ -0,0 +1,215 @@
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
/*
* This file defines functions associated with the PKIX_RevocationChecker
* type.
*
*/
#ifndef _PKIX_REVCHECKER_H
#define _PKIX_REVCHECKER_H
#include "pkixt.h"
#include "pkix_pl_pki.h"
#ifdef __cplusplus
extern "C" {
#endif
/* General
*
* Please refer to the libpkix Programmer's Guide for detailed information
* about how to use the libpkix library. Certain key warnings and notices from
* that document are repeated here for emphasis.
*
* All identifiers in this file (and all public identifiers defined in
* libpkix) begin with "PKIX_". Private identifiers only intended for use
* within the library begin with "pkix_".
*
* A function returns NULL upon success, and a PKIX_Error pointer upon failure.
*
* Unless otherwise noted, for all accessor (gettor) functions that return a
* PKIX_PL_Object pointer, callers should assume that this pointer refers to a
* shared object. Therefore, the caller should treat this shared object as
* read-only and should not modify this shared object. When done using the
* shared object, the caller should release the reference to the object by
* using the PKIX_PL_Object_DecRef function.
*
* While a function is executing, if its arguments (or anything referred to by
* its arguments) are modified, free'd, or destroyed, the function's behavior
* is undefined.
*
*/
/* PKIX_RevocationChecker
*
* PKIX_RevocationChecker provides a standard way of revocation checking.
* Caller should configure two set of tests(represented at lists of
* RevocationMethod objects) to be performed on the leaf and on the rest of
* the chain certificates.
*
* PKIX_RevocationMethods provide a standard way for the caller to insert
* their own custom revocation checks to verify the revocation status of
* certificates. This may be useful in many scenarios, including when the
* caller wishes to use their own revocation checking mechanism instead of (or
* in addition to) the default revocation checking mechanism provided by
* libpkix, which uses CRLs and OCSP.
*
* Once the caller has created the RevocationMethod object(s), the caller
* then specifies the RevocationMethod object(s) in a RevocationCheck object
* and sets it into a ProcessingParams.
*/
/*
* FUNCTION: PKIX_RevocationChecker_Create
* DESCRIPTION:
*
* Creates a revocation checker object with the given flags. Revocation will
* be checked at the current date.
*
* PARAMETERS:
* "leafMethodListFlags"
* Defines a set of method independent flags that will be used to check
* revocation of the leaf cert in the chain.
* "chainMethodListFlags"
* Defines a set of method independent flags that will be used to check
* revocation of the remaining certs in the chain.
* "pChecker"
* The return address of created checker.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe
*
* Multiple threads must be able to safely call this function without
* worrying about conflicts, even if they're operating on the same objects.
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a RevocationChecker Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_RevocationChecker_Create(
PKIX_UInt32 leafMethodListFlags,
PKIX_UInt32 chainMethodListFlags,
PKIX_RevocationChecker **pChecker,
void *plContext);
/*
* FUNCTION: PKIX_RevocationChecker_CreateAndAddMethod
* DESCRIPTION:
*
* Creates revocation method object with given parameters and adds it
* to revocation checker method list.
*
* PARAMETERS:
* "revChecker"
* Address of revocation checker structure.
* "procParams"
* Address of ProcessingParams used to initialize the checker.
* Must be non-NULL.
* "methodType"
* Type of the method. Currently only two types are
* supported: crl and ocsp. (See PKIX_RevocationMethodType enum).
* "methodFlags"
* Set of flags for the method.
* "methodPriority"
* Method priority. (0 corresponds to the highest priority)
* "verificationFn"
* User call back function that will perform validation of fetched
* revocation information(new crl or ocsp response)
* "isLeafMethod"
* Boolean flag that if set to true indicates that the method should
* should be used for leaf cert revocation test(false for chain set
* methods).
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe
*
* Multiple threads must be able to safely call this function without
* worrying about conflicts, even if they're operating on the same objects.
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a RevocationChecker Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_RevocationChecker_CreateAndAddMethod(
PKIX_RevocationChecker *revChecker,
PKIX_ProcessingParams *params,
PKIX_RevocationMethodType methodType,
PKIX_UInt32 methodFlags,
PKIX_UInt32 methodPriority,
PKIX_PL_VerifyCallback verificationFn,
PKIX_Boolean isLeafMethod,
void *plContext);
/*
* FUNCTION: PKIX_RevocationChecker_Check
* DESCRIPTION:
*
* Verifies revocation status of the certificate. Issuer cert is given to
* be used in verification of revocation information. Performed verification
* check depends on configured revocation methods(ocsp, crl. See
* PKIX_RevocationChecker_CreateAndAddMethod function) and a point of chain
* building process at which PKIX_RevocationChecker_Check was invoked.
* For security reasons, the cert status is checked only against cached
* revocation information during chain building stage(no trust anchor yes has
* been found). The fresh revocation information fetching is done only at chain
* verification stage after trust anchor was identified.
*
* PARAMETERS:
* "cert"
* Address of Cert whose revocation status is to be determined.
* Must be non-NULL.
* "issuer"
* Issuer cert that potentially holds public key that will be used
* to verify revocation info.
* "revChecker"
* Address of revocation checker structure.
* "procParams"
* Address of ProcessingParams used to initialize the checker.
* Must be non-NULL.
* "chainVerificationState"
* Need to be set to true, if the check was called during chain verification
* as an opposite to chain building.
* "testingLeafCert"
* Set to true if verifying revocation status of a leaf cert.
* "revStatus"
* Address of the returned revocation status of the cert.
* "pResultCode"
* Address where revocation status will be stored. Must be non-NULL.
* "pNBIOContext"
* Address at which platform-dependent non-blocking I/O context is stored.
* Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe
*
* Multiple threads must be able to safely call this function without
* worrying about conflicts, even if they're operating on the same objects.
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a RevocationChecker Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_RevocationChecker_Check(PKIX_PL_Cert *cert,
PKIX_PL_Cert *issuer,
PKIX_RevocationChecker *revChecker,
PKIX_ProcessingParams *procParams,
PKIX_Boolean chainVerificationState,
PKIX_Boolean testingLeafCert,
PKIX_RevocationStatus *revStatus,
PKIX_UInt32 *pReasonCode,
void **pNbioContext,
void *plContext);
#ifdef __cplusplus
}
#endif
#endif /* _PKIX_REVCHECKER_H */

420
security/nss/lib/libpkix/include/pkix_sample_modules.h Normal file
View file

@ -0,0 +1,420 @@
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
/*
* This file defines functions associated with CertStore types.
*
*/
#ifndef _PKIX_SAMPLEMODULES_H
#define _PKIX_SAMPLEMODULES_H
#include "pkix_pl_common.h"
#ifdef __cplusplus
extern "C" {
#endif
/* General
*
* Please refer to the libpkix Programmer's Guide for detailed information
* about how to use the libpkix library. Certain key warnings and notices from
* that document are repeated here for emphasis.
*
* All identifiers in this file (and all public identifiers defined in
* libpkix) begin with "PKIX_". Private identifiers only intended for use
* within the library begin with "pkix_".
*
* A function returns NULL upon success, and a PKIX_Error pointer upon failure.
*
* Unless otherwise noted, for all accessor (gettor) functions that return a
* PKIX_PL_Object pointer, callers should assume that this pointer refers to a
* shared object. Therefore, the caller should treat this shared object as
* read-only and should not modify this shared object. When done using the
* shared object, the caller should release the reference to the object by
* using the PKIX_PL_Object_DecRef function.
*
* While a function is executing, if its arguments (or anything referred to by
* its arguments) are modified, free'd, or destroyed, the function's behavior
* is undefined.
*
*/
/* PKIX_PL_CollectionCertStore
*
* A PKIX_CollectionCertStore provides an example for showing how to retrieve
* certificates and CRLs from a repository, such as a directory in the system.
* It is expected the directory is an absolute directory which contains CRL
* and Cert data files. CRL files are expected to have the suffix of .crl
* and Cert files are expected to have the suffix of .crt .
*
* Once the caller has created the CollectionCertStoreContext object, the caller
* then can call pkix_pl_CollectionCertStore_GetCert or
* pkix_pl_CollectionCertStore_GetCRL to obtain Lists of PKIX_PL_Cert or
* PKIX_PL_CRL objects, respectively.
*/
/*
* FUNCTION: PKIX_PL_CollectionCertStore_Create
* DESCRIPTION:
*
* Creates a new CollectionCertStore and returns it at
* "pColCertStore".
*
* PARAMETERS:
* "storeDir"
* The absolute path where *.crl files are located.
* "pColCertStoreContext"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CollectionCertStoreContext Error if the function fails in
* a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_PL_CollectionCertStore_Create(
PKIX_PL_String *storeDir,
PKIX_CertStore **pCertStore,
void *plContext);
/* PKIX_PL_PK11CertStore
*
* A PKIX_PL_PK11CertStore retrieves certificates and CRLs from a PKCS11
* database. The directory that contains the cert8.db, key3.db, and secmod.db
* files that comprise a PKCS11 database are specified in NSS initialization.
*
* Once the caller has created the Pk11CertStore object, the caller can call
* pkix_pl_Pk11CertStore_GetCert or pkix_pl_Pk11CertStore_GetCert to obtain
* a List of PKIX_PL_Certs or PKIX_PL_CRL objects, respectively.
*/
/*
* FUNCTION: PKIX_PL_Pk11CertStore_Create
* DESCRIPTION:
*
* Creates a new Pk11CertStore and returns it at "pPk11CertStore".
*
* PARAMETERS:
* "pPk11CertStore"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CertStore Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_PL_Pk11CertStore_Create(
PKIX_CertStore **pPk11CertStore,
void *plContext);
#ifndef NSS_PKIX_NO_LDAP
/* PKIX_PL_LdapCertStore
*
* A PKIX_PL_LdapCertStore retrieves certificates and CRLs from an LDAP server
* over a socket connection. It used the LDAP protocol as described in RFC1777.
*
* Once the caller has created the LdapCertStore object, the caller can call
* pkix_pl_LdapCertStore_GetCert or pkix_pl_LdapCertStore_GetCert to obtain
* a List of PKIX_PL_Certs or PKIX_PL_CRL objects, respectively.
*/
/*
* FUNCTION: PKIX_PL_LdapDefaultClient_Create
* DESCRIPTION:
*
* Creates an LdapDefaultClient using the PRNetAddr poined to by "sockaddr",
* with a timeout value of "timeout", and a BindAPI pointed to by "bindAPI";
* and stores the address of the default LdapClient at "pClient".
*
* At the time of this version, there are unresolved questions about the LDAP
* protocol. Although RFC1777 describes a BIND and UNBIND message, it is not
* clear whether they are appropriate to this application. We have tested only
* using servers that do not expect authentication, and that reject BIND
* messages. It is not clear what values might be appropriate for the bindname
* and authentication fields, which are currently implemented as char strings
* supplied by the caller. (If this changes, the API and possibly the templates
* will have to change.) Therefore the Client_Create API contains a BindAPI
* structure, a union, which will have to be revised and extended when this
* area of the protocol is better understood.
*
* PARAMETERS:
* "sockaddr"
* Address of the PRNetAddr to be used for the socket connection. Must be
* non-NULL.
* "timeout"
* The PRIntervalTime value to be used as a timeout value in socket calls;
* a zero value indicates non-blocking I/O is to be used.
* "bindAPI"
* The address of a BindAPI to be used if a BIND message is required. If
* this argument is NULL, no Bind (or Unbind) will be sent.
* "pClient"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CertStore Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_PL_LdapDefaultClient_Create(
PRNetAddr *sockaddr,
PRIntervalTime timeout,
LDAPBindAPI *bindAPI,
PKIX_PL_LdapDefaultClient **pClient,
void *plContext);
/*
* FUNCTION: PKIX_PL_LdapDefaultClient_CreateByName
* DESCRIPTION:
*
* Creates an LdapDefaultClient using the hostname poined to by "hostname",
* with a timeout value of "timeout", and a BindAPI pointed to by "bindAPI";
* and stores the address of the default LdapClient at "pClient".
*
* At the time of this version, there are unresolved questions about the LDAP
* protocol. Although RFC1777 describes a BIND and UNBIND message, it is not
* clear whether they are appropriate to this application. We have tested only
* using servers that do not expect authentication, and that reject BIND
* messages. It is not clear what values might be appropriate for the bindname
* and authentication fields, which are currently implemented as char strings
* supplied by the caller. (If this changes, the API and possibly the templates
* will have to change.) Therefore the Client_Create API contains a BindAPI
* structure, a union, which will have to be revised and extended when this
* area of the protocol is better understood.
*
* PARAMETERS:
* "hostname"
* Address of the hostname to be used for the socket connection. Must be
* non-NULL.
* "timeout"
* The PRIntervalTime value to be used as a timeout value in socket calls;
* a zero value indicates non-blocking I/O is to be used.
* "bindAPI"
* The address of a BindAPI to be used if a BIND message is required. If
* this argument is NULL, no Bind (or Unbind) will be sent.
* "pClient"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CertStore Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_PL_LdapDefaultClient_CreateByName(
char *hostname,
PRIntervalTime timeout,
LDAPBindAPI *bindAPI,
PKIX_PL_LdapDefaultClient **pClient,
void *plContext);
/*
* FUNCTION: PKIX_PL_LdapCertStore_Create
* DESCRIPTION:
*
* Creates a new LdapCertStore using the LdapClient pointed to by "client",
* and stores the address of the CertStore at "pCertStore".
*
* PARAMETERS:
* "client"
* Address of the LdapClient to be used. Must be non-NULL.
* "pCertStore"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CertStore Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_PL_LdapCertStore_Create(
PKIX_PL_LdapClient *client,
PKIX_CertStore **pCertStore,
void *plContext);
#endif /* !NSS_PKIX_NO_LDAP */
/* PKIX_PL_NssContext
*
* A PKIX_PL_NssContext provides an example showing how the "plContext"
* argument, that is part of every libpkix function call, can be used.
* The "plContext" is the Portability Layer Context, which can be used
* to communicate layer-specific information from the application to the
* underlying Portability Layer (while bypassing the Portable Code, which
* blindly passes the plContext on to every function call).
*
* In this case, NSS serves as both the application and the Portability Layer.
* We define an NSS-specific structure, which includes an arena and a number
* of SECCertificateUsage bit flags encoded as a PKIX_UInt32. A third argument,
* wincx, is used on Windows platforms for PKCS11 access, and should be set to
* NULL for other platforms.
* Before calling any of the libpkix functions, the caller should create the NSS
* context, by calling PKIX_PL_NssContext_Create, and provide that NSS context
* as the "plContext" argument in every libpkix function call the caller makes.
* When the caller is finished using the NSS context (usually just after he
* calls PKIX_Shutdown), the caller should call PKIX_PL_NssContext_Destroy to
* free the NSS context structure.
*/
/*
* FUNCTION: PKIX_PL_NssContext_Create
* DESCRIPTION:
*
* Creates a new NssContext using the certificate usage(s) specified by
* "certUsage" and stores it at "pNssContext". This function also internally
* creates an arena and stores it as part of the NssContext structure. Unlike
* most other libpkix API functions, this function does not take a "plContext"
* parameter.
*
* PARAMETERS:
* "certUsage"
* The desired SECCertificateUsage(s).
* "useNssArena"
* Boolean flag indicates NSS Arena is used for memory allocation.
* "wincx"
* A Windows-dependent pointer for PKCS11 token handling.
* "pNssContext"
* Address where object pointer will be stored. Must be non-NULL.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Context Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_PL_NssContext_Create(
PKIX_UInt32 certificateUsage,
PKIX_Boolean useNssArena,
void *wincx,
void **pNssContext);
/*
* FUNCTION: PKIX_PL_NssContext_Destroy
* DESCRIPTION:
*
* Frees the structure pointed to by "nssContext" along with any of its
* associated memory. Unlike most other libpkix API functions, this function
* does not take a "plContext" parameter.
*
* PARAMETERS:
* "nssContext"
* Address of NssContext to be destroyed. Must be non-NULL.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Context Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_PL_NssContext_Destroy(
void *nssContext);
/*
* FUNCTION: PKIX_PL_NssContext_SetTimeout
* DESCRIPTION:
*
* Sets IO timeout for network operations like OCSP response and cert
* fetching.
*
* PARAMETERS:
* "nssContext"
* Address of NssContext to be destroyed. Must be non-NULL.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Context Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_PL_NssContext_SetTimeout(PKIX_UInt32 timeout, PKIX_PL_NssContext *nssContext);
/*
* FUNCTION: PKIX_PL_NssContext_SetMaxResponseLen
* DESCRIPTION:
*
* Sets maximum responce length allowed during network IO operations.
*
* PARAMETERS:
* "nssContext"
* Address of NssContext to be destroyed. Must be non-NULL.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Context Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_PL_NssContext_SetMaxResponseLen(PKIX_UInt32 len, PKIX_PL_NssContext *nssContext);
/*
* FUNCTION: PKIX_PL_NssContext_SetCrlReloadDelay
* DESCRIPTION:
*
* Sets user defined timeout between attempts to load crl using
* CRLDP.
*
* PARAMETERS:
* "delaySeconds"
* Reload delay in seconds.
* "nssContext"
* Address of NssContext to be destroyed. Must be non-NULL.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Context Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_PL_NssContext_SetCrlReloadDelay(PKIX_UInt32 delaySeconds,
PKIX_PL_NssContext *nssContext);
/*
* FUNCTION: PKIX_PL_NssContext_SetBadDerCrlReloadDelay
* DESCRIPTION:
*
* Sets user defined timeout between attempts to load crls
* that failed to decode.
*
* PARAMETERS:
* "delaySeconds"
* Reload delay in seconds.
* "nssContext"
* Address of NssContext to be destroyed. Must be non-NULL.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Context Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_PL_NssContext_SetBadDerCrlReloadDelay(PKIX_UInt32 delaySeconds,
PKIX_PL_NssContext *nssContext);
#ifdef __cplusplus
}
#endif
#endif /* _PKIX_SAMPLEMODULES_H */

941
security/nss/lib/libpkix/include/pkix_util.h Normal file
View file

@ -0,0 +1,941 @@
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
/*
* These functions provide support for a number of other functions
* by creating and manipulating data structures used by those functions.
*
*/
#ifndef _PKIX_UTIL_H
#define _PKIX_UTIL_H
#include "pkixt.h"
#ifdef __cplusplus
extern "C" {
#endif
/* General
*
* Please refer to the libpkix Programmer's Guide for detailed information
* about how to use the libpkix library. Certain key warnings and notices from
* that document are repeated here for emphasis.
*
* All identifiers in this file (and all public identifiers defined in
* libpkix) begin with "PKIX_". Private identifiers only intended for use
* within the library begin with "pkix_".
*
* A function returns NULL upon success, and a PKIX_Error pointer upon failure.
*
* Unless otherwise noted, for all accessor (gettor) functions that return a
* PKIX_PL_Object pointer, callers should assume that this pointer refers to a
* shared object. Therefore, the caller should treat this shared object as
* read-only and should not modify this shared object. When done using the
* shared object, the caller should release the reference to the object by
* using the PKIX_PL_Object_DecRef function.
*
* While a function is executing, if its arguments (or anything referred to by
* its arguments) are modified, free'd, or destroyed, the function's behavior
* is undefined.
*
*/
/* PKIX_Logger
*
* PKIX_Loggers provide a standard way for the caller to insert custom logging
* facilities. These are used by libpkix to log errors, debug information,
* status, etc. The LogCallback allows custom logging to take place.
* Additionally, a Logger can be initialized with a loggerContext, which is
* where the caller can specify configuration data such as the name of a
* logfile or database. Note that this loggerContext must be a PKIX_PL_Object,
* allowing it to be reference-counted and allowing it to provide the standard
* PKIX_PL_Object functions (Equals, Hashcode, ToString, Compare, Duplicate).
*
* Once the caller has created the Logger object(s) (and set the loggerContext
* (if any) and the Log callback), the caller then registers these Loggers
* with the system by calling PKIX_SetLoggers or PKIX_AddLogger. All log
* entries will then be logged using the specified Loggers. If multiple
* Loggers are specified, every log entry will be logged with each of them.
*
* XXX Maybe give some guidance somewhere on how much detail each logging
* level should have and where component boundaries should be. Maybe in
* Implementor's Guide or Programmer's Guide.
*/
#define PKIX_LOGGER_LEVEL_TRACE 5
#define PKIX_LOGGER_LEVEL_DEBUG 4
#define PKIX_LOGGER_LEVEL_WARNING 3
#define PKIX_LOGGER_LEVEL_ERROR 2
#define PKIX_LOGGER_LEVEL_FATALERROR 1
#define PKIX_LOGGER_LEVEL_MAX 5
/*
* FUNCTION: PKIX_Logger_LogCallback
* DESCRIPTION:
*
* This callback function logs a log entry containing the String pointed to
* by "message", the integer value of logLevel, and the String pointed to by
* "logComponent". A log entry can be associated with a particular log
* level (i.e. level 3) and a particular log component (i.e. "CertStore").
* For example, someone reading the log may only be interested in very general
* log entries so they look only for log level 1. Similarly, they may only be
* interested in log entries pertaining to the CertStore component so they
* look only for that log component. This function can be used before calling
* PKIX_Initialize.
*
* PARAMETERS:
* "logger"
* Address of logger whose LogCallback is to be used. Must be non-NULL.
* "message"
* Address of String that is to be logged used "logger". Must be non-NULL.
* "logLevel"
* Integer value representing the log level for this entry. The higher the
* level, the more detail. Must be non-NULL.
* "logComponent"
* PKIXERRORNUM value (defined in pkixt.h) designating the log component
* for this entry.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe
*
* Multiple threads must be able to safely call this function without
* worrying about conflicts, even if they're operating on the same objects.
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Logger Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
typedef PKIX_Error *
(*PKIX_Logger_LogCallback)(
PKIX_Logger *logger,
PKIX_PL_String *message,
PKIX_UInt32 logLevel,
PKIX_ERRORCLASS logComponent,
void *plContext);
/*
* FUNCTION: PKIX_Logger_Create
* DESCRIPTION:
*
* Creates a new Logger using the Object pointed to by "loggerContext"
* (if any) and stores it at "pLogger". The new Logger uses the LogCallback
* pointed to by "callback". The Logger's maximum logging level is initially
* set to a very high level and its logging component is set to NULL (all
* components).
*
* PARAMETERS:
* "callback"
* The LogCallback function to be used. Must be non-NULL.
* "loggerContext"
* Address of Object representing the Logger's context (if any).
* "pLogger"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Logger Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_Logger_Create(
PKIX_Logger_LogCallback callback,
PKIX_PL_Object *loggerContext,
PKIX_Logger **pLogger,
void *plContext);
/*
* FUNCTION: PKIX_Logger_GetLogCallback
* DESCRIPTION:
*
* Retrieves a pointer to "logger's" Log callback function and puts it in
* "pCallback".
*
* PARAMETERS:
* "logger"
* Address of Logger whose Log callback is desired. Must be non-NULL.
* "pCallback"
* Address where Log callback function pointer will be stored.
* Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Logger Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_Logger_GetLogCallback(
PKIX_Logger *logger,
PKIX_Logger_LogCallback *pCallback,
void *plContext);
/*
* FUNCTION: PKIX_Logger_GetLoggerContext
* DESCRIPTION:
*
* Retrieves a pointer to a PKIX_PL_Object representing the context (if any)
* of the Logger pointed to by "logger" and stores it at "pLoggerContext".
*
* PARAMETERS:
* "logger"
* Address of Logger whose context is to be stored. Must be non-NULL.
* "pLoggerContext"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Logger Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_Logger_GetLoggerContext(
PKIX_Logger *logger,
PKIX_PL_Object **pLoggerContext,
void *plContext);
/*
* FUNCTION: PKIX_Logger_GetMaxLoggingLevel
* DESCRIPTION:
*
* Retrieves a pointer to a PKIX_UInt32 representing the maximum logging
* level of the Logger pointed to by "logger" and stores it at "pLevel". Only
* log entries whose log level is less than or equal to this maximum logging
* level will be logged.
*
* PARAMETERS:
* "logger"
* Address of Logger whose maximum logging level is to be stored.
* Must be non-NULL.
* "pLevel"
* Address where PKIX_UInt32 will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Conditionally Thread Safe
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Logger Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_Logger_GetMaxLoggingLevel(
PKIX_Logger *logger,
PKIX_UInt32 *pLevel,
void *plContext);
/*
* FUNCTION: PKIX_Logger_SetMaxLoggingLevel
* DESCRIPTION:
*
* Sets the maximum logging level of the Logger pointed to by "logger" with
* the integer value of "level".
*
* PARAMETERS:
* "logger"
* Address of Logger whose maximum logging level is to be set.
* Must be non-NULL.
* "level"
* Maximum logging level to be set
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Not Thread Safe - assumes exclusive access to "logger"
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Logger Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_Logger_SetMaxLoggingLevel(
PKIX_Logger *logger,
PKIX_UInt32 level,
void *plContext);
/*
* FUNCTION: PKIX_Logger_GetLoggingComponent
* DESCRIPTION:
*
* Retrieves a pointer to a String representing the logging component of the
* Logger pointed to by "logger" and stores it at "pComponent". Only log
* entries whose log component matches the specified logging component will
* be logged.
*
* PARAMETERS:
* "logger"
* Address of Logger whose logging component is to be stored.
* Must be non-NULL.
* "pComponent"
* Address where PKIXERRORNUM will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Conditionally Thread Safe
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Logger Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_Logger_GetLoggingComponent(
PKIX_Logger *logger,
PKIX_ERRORCLASS *pComponent,
void *plContext);
/*
* FUNCTION: PKIX_Logger_SetLoggingComponent
* DESCRIPTION:
*
* Sets the logging component of the Logger pointed to by "logger" with the
* PKIXERRORNUM pointed to by "component". To match a small set of components,
* create a Logger for each.
*
* PARAMETERS:
* "logger"
* Address of Logger whose logging component is to be set.
* Must be non-NULL.
* "component"
* PKIXERRORNUM value representing logging component to be set.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Not Thread Safe - assumes exclusive access to "logger"
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Logger Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_Logger_SetLoggingComponent(
PKIX_Logger *logger,
PKIX_ERRORCLASS component,
void *plContext);
/*
* FUNCTION: PKIX_GetLoggers
* DESCRIPTION:
*
* Retrieves a pointer to the List of Loggers (if any) being used for logging
* by libpkix and stores it at "pLoggers". If no loggers are being used, this
* function stores an empty List at "pLoggers".
*
* Note that the List returned by this function is immutable.
*
* PARAMETERS:
* "pLoggers"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Conditionally Thread Safe
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Logger Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_GetLoggers(
PKIX_List **pLoggers, /* list of PKIX_Logger */
void *plContext);
/*
* FUNCTION: PKIX_SetLoggers
* DESCRIPTION:
*
* Sets the Loggers to be used by libpkix to the List of Loggers pointed to
* by "loggers". If "loggers" is NULL, no Loggers will be used.
*
* PARAMETERS:
* "loggers"
* Address of List of Loggers to be set. NULL for no Loggers.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Not Thread Safe
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Logger Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_SetLoggers(
PKIX_List *loggers, /* list of PKIX_Logger */
void *plContext);
/*
* FUNCTION: PKIX_AddLogger
* DESCRIPTION:
*
* Adds the Logger pointed to by "logger" to the List of Loggers used by
* libpkix.
*
* PARAMETERS:
* "logger"
* Address of Logger to be added. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Not Thread Safe
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Logger Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_AddLogger(
PKIX_Logger *logger,
void *plContext);
/* Functions pertaining to the PKIX_Error type */
/* Error
*
* An Error object is returned by a function upon encountering some error
* condition. Each Error is associated with an errorCode specified in pkixt.h.
* The remaining components of an Error are optional. An Error's description
* specifies a text message describing the Error. An Error's supplementary info
* specifies additional information that might be useful. Finally, an Error's
* cause specifies the underlying Error (if any) that resulted in this Error
* being returned, thereby allowing Errors to be chained so that an entire
* "error stack trace" can be represented. Once created, an Error is immutable.
*
* Note that the Error's supplementary info must be an Object (although any
* object type), allowing it to be reference-counted and allowing it to
* provide the standard Object functions (Equals, Hashcode, ToString, Compare,
* Duplicate).
*
* Errors are classified as either being fatal or non-fatal. If a function
* fails in an unrecoverable way, it returns an Error whose errorCode is
* PKIX_FATAL_ERROR. If such an error is encountered, the caller should
* not attempt to recover since something seriously wrong has happened
* (e.g. corrupted memory, memory finished, etc.). All other errorCodes
* are considered non-fatal errors and can be handled by the caller as they
* see fit.
*/
/*
* FUNCTION: PKIX_Error_Create
* DESCRIPTION:
*
* Creates a new Error using the value of "errorCode", the Error pointed to by
* "cause" (if any), the Object pointed to by "info" (if any), and the String
* pointed to by "desc" and stores it at "pError". If any error occurs during
* error allocation, it will be returned without chaining, since new errors
* cannot be created. Once created, an Error is immutable.
*
* PARAMETERS:
* "errorCode"
* Value of error code.
* "cause"
* Address of Error representing error's cause.
* NULL if none or unspecified.
* "info"
* Address of Object representing error's supplementary information.
* NULL if none.
* "desc"
* Address of String representing error's description. NULL if none.
* "pError"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns an Error Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_Error_Create(
PKIX_ERRORCLASS errClass,
PKIX_Error *cause,
PKIX_PL_Object *info,
PKIX_ERRORCODE errCode,
PKIX_Error **pError,
void *plContext);
/*
* FUNCTION: PKIX_Error_GetErrorClass
* DESCRIPTION:
*
* Retrieves the error class of the Error pointed to by "error" and
* stores it at "pClass". Supported error codes are defined in pkixt.h.
*
* PARAMETERS:
* "error"
* Address of Error whose error code is desired. Must be non-NULL.
* "pClass"
* Address where PKIX_UInt32 will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns an Error Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_Error_GetErrorClass(
PKIX_Error *error,
PKIX_ERRORCLASS *pClass,
void *plContext);
/*
* FUNCTION: PKIX_Error_GetErrorCode
* DESCRIPTION:
*
* Retrieves the error code of the Error pointed to by "error" and
* stores it at "pCode". Supported error codes are defined in pkixt.h.
*
* PARAMETERS:
* "error"
* Address of Error whose error code is desired. Must be non-NULL.
* "pCode"
* Address where PKIX_UInt32 will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns an Error Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_Error_GetErrorCode(
PKIX_Error *error,
PKIX_ERRORCODE *pCode,
void *plContext);
/*
* FUNCTION: PKIX_Error_GetCause
* DESCRIPTION:
*
* Retrieves the cause of the Error pointed to by "error" and stores it at
* "pCause". If no cause was specified, NULL will be stored at "pCause".
*
* PARAMETERS:
* "error"
* Address of Error whose cause is desired. Must be non-NULL.
* "pCause"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns an Error Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_Error_GetCause(
PKIX_Error *error,
PKIX_Error **pCause,
void *plContext);
/*
* FUNCTION: PKIX_Error_GetSupplementaryInfo
* DESCRIPTION:
*
* Retrieves the supplementary info of the Error pointed to by "error" and
* stores it at "pInfo".
*
* PARAMETERS:
* "error"
* Address of Error whose info is desired. Must be non-NULL.
* "pInfo"
* Address where info pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns an Error Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_Error_GetSupplementaryInfo(
PKIX_Error *error,
PKIX_PL_Object **pInfo,
void *plContext);
/*
* FUNCTION: PKIX_Error_GetDescription
* DESCRIPTION:
*
* Retrieves the description of the Error pointed to by "error" and stores it
* at "pDesc". If no description was specified, NULL will be stored at
* "pDesc".
*
* PARAMETERS:
* "error"
* Address of Error whose description is desired. Must be non-NULL.
* "pDesc"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns an Error Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_Error_GetDescription(
PKIX_Error *error,
PKIX_PL_String **pDesc,
void *plContext);
/* PKIX_List
*
* Represents a collection of items. NULL is considered a valid item.
*/
/*
* FUNCTION: PKIX_List_Create
* DESCRIPTION:
*
* Creates a new List and stores it at "pList". The List is initially empty
* and holds no items. To initially add items to the List, use
* PKIX_List_AppendItem
*
* PARAMETERS:
* "pList"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_List_Create(
PKIX_List **pList,
void *plContext);
/*
* FUNCTION: PKIX_List_SetImmutable
* DESCRIPTION:
*
* Sets the List pointed to by "list" to be immutable. If a caller tries to
* change a List after it has been marked immutable (i.e. by calling
* PKIX_List_AppendItem, PKIX_List_InsertItem, PKIX_List_SetItem, or
* PKIX_List_DeleteItem), an Error is returned.
*
* PARAMETERS:
* "list"
* Address of List to be marked immutable. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Not Thread Safe - assumes exclusive access to "list"
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_List_SetImmutable(
PKIX_List *list,
void *plContext);
/*
* FUNCTION: PKIX_List_IsImmutable
* DESCRIPTION:
*
* Checks whether the List pointed to by "list" is immutable and stores
* the Boolean result at "pImmutable". If a caller tries to change a List
* after it has been marked immutable (i.e. by calling PKIX_List_AppendItem,
* PKIX_List_InsertItem, PKIX_List_SetItem, or PKIX_List_DeleteItem), an
* Error is returned.
*
* PARAMETERS:
* "list"
* Address of List whose immutability is to be determined.
* Must be non-NULL.
* "pImmutable"
* Address where PKIX_Boolean will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Conditionally Thread Safe
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_List_IsImmutable(
PKIX_List *list,
PKIX_Boolean *pImmutable,
void *plContext);
/*
* FUNCTION: PKIX_List_GetLength
* DESCRIPTION:
*
* Retrieves the length of the List pointed to by "list" and stores it at
* "pLength".
*
* PARAMETERS:
* "list"
* Address of List whose length is desired. Must be non-NULL.
* "pLength"
* Address where PKIX_UInt32 will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Conditionally Thread Safe
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_List_GetLength(
PKIX_List *list,
PKIX_UInt32 *pLength,
void *plContext);
/*
* FUNCTION: PKIX_List_IsEmpty
* DESCRIPTION:
*
* Checks whether the List pointed to by "list" is empty and stores
* the Boolean result at "pEmpty".
*
* PARAMETERS:
* "list"
* Address of List whose emptiness is to be determined. Must be non-NULL.
* "pEmpty"
* Address where PKIX_Boolean will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Conditionally Thread Safe
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_List_IsEmpty(
PKIX_List *list,
PKIX_Boolean *pEmpty,
void *plContext);
/*
* FUNCTION: PKIX_List_AppendItem
* DESCRIPTION:
*
* Appends the Object pointed to by "item" after the last non-NULL item in
* List pointed to by "list", if any. Note that a List may validly contain
* NULL items. Appending "c" into the List ("a", NULL, "b", NULL) will result
* in ("a", NULL, "b", "c").
*
* PARAMETERS:
* "list"
* Address of List to append to. Must be non-NULL.
* "item"
* Address of new item to append.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Not Thread Safe - assumes exclusive access to "list"
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_List_AppendItem(
PKIX_List *list,
PKIX_PL_Object *item,
void *plContext);
/*
* FUNCTION: PKIX_List_InsertItem
* DESCRIPTION:
*
* Inserts the Object pointed to by "item" into the List pointed to by "list"
* at the given "index". The index counts from zero and must be less than the
* List's length. Existing list entries at or after this index will be moved
* to the next highest index.
*
* XXX why not allow equal to length which would be equivalent to AppendItem?
*
* PARAMETERS:
* "list"
* Address of List to insert into. Must be non-NULL.
* "index"
* Position to insert into. Must be less than List's length.
* "item"
* Address of new item to append.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Not Thread Safe - assumes exclusive access to "list"
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_List_InsertItem(
PKIX_List *list,
PKIX_UInt32 index,
PKIX_PL_Object *item,
void *plContext);
/*
* FUNCTION: PKIX_List_GetItem
* DESCRIPTION:
*
* Copies the "list"'s item at "index" into "pItem". The index counts from
* zero and must be less than the list's length. Increments the reference
* count on the returned object, if non-NULL.
*
* PARAMETERS:
* "list"
* Address of List to get item from. Must be non-NULL.
* "index"
* Index of list to get item from. Must be less than List's length.
* "pItem"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Conditionally Thread Safe
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_List_GetItem(
PKIX_List *list,
PKIX_UInt32 index,
PKIX_PL_Object **pItem,
void *plContext);
/*
* FUNCTION: PKIX_List_SetItem
* DESCRIPTION:
*
* Sets the item at "index" of the List pointed to by "list" with the Object
* pointed to by "item". The index counts from zero and must be less than the
* List's length. The previous entry at this index will have its reference
* count decremented and the new entry will have its reference count
* incremented.
*
* PARAMETERS:
* "list"
* Address of List to modify. Must be non-NULL.
* "index"
* Position in List to set. Must be less than List's length.
* "item"
* Address of Object to set at "index".
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Not Thread Safe - assumes exclusive access to "list"
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_List_SetItem(
PKIX_List *list,
PKIX_UInt32 index,
PKIX_PL_Object *item,
void *plContext);
/*
* FUNCTION: PKIX_List_DeleteItem
*
* Deletes the item at "index" from the List pointed to by "list". The index
* counts from zero and must be less than the List's length. Note that this
* function does not destroy the List. It simply decrements the reference
* count of the item at "index" in the List, deletes that item from the list
* and moves all subsequent entries to a lower index in the list. If there is
* only a single element in the List and that element is deleted, then the
* List will be empty.
*
* PARAMETERS:
* "list"
* Address of List to delete from. Must be non-NULL.
* "index"
* Position in List to delete. Must be less than List's length.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Not Thread Safe - assumes exclusive access to "list"
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_List_DeleteItem(
PKIX_List *list,
PKIX_UInt32 index,
void *plContext);
/*
* FUNCTION: PKIX_List_ReverseList
* DESCRIPTION:
*
* Creates a new List whose elements are in the reverse order as the elements
* of the Object pointed to by "list" and stores the copy at "pReversedList".
* If "list" is empty, the new reversed List will be a copy of "list".
* Changes to the new object will not affect the original and vice versa.
*
* PARAMETERS:
* "list"
* Address of List whose elements are to be reversed. Must be non-NULL.
* "pReversedList"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Conditionally Thread Safe
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
PKIX_List_ReverseList(
PKIX_List *list,
PKIX_List **pReversedList,
void *plContext);
#ifdef __cplusplus
}
#endif
#endif /* _PKIX_UTIL_H */

485
security/nss/lib/libpkix/include/pkixt.h Normal file
View file

@ -0,0 +1,485 @@
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
/*
* This file defines the types in the libpkix API.
* XXX Maybe we should specify the API version number in all API header files
*
*/
#ifndef _PKIXT_H
#define _PKIXT_H
#ifdef __cplusplus
extern "C" {
#endif
#include "secerr.h"
/* Types
*
* This header file provides typedefs for the abstract types used by libpkix.
* It also provides several useful macros.
*
* Note that all these abstract types are typedef'd as opaque structures. This
* is intended to discourage the caller from looking at the contents directly,
* since the format of the contents may change from one version of the library
* to the next. Instead, callers should only access these types using the
* functions defined in the public header files.
*
* An instance of an abstract type defined in this file is called an "object"
* here, although C does not have real support for objects.
*
* Because C does not typically have automatic garbage collection, the caller
* is expected to release the reference to any object that they create or that
* is returned to them by a libpkix function. The caller should do this by
* using the PKIX_PL_Object_DecRef function. Note that the caller should not
* release the reference to an object if the object has been passed to a
* libpkix function and that function has not returned.
*
* Please refer to libpkix Programmer's Guide for more details.
*/
/* Version
*
* These macros specify the major and minor version of the libpkix API defined
* by this header file.
*/
#define PKIX_MAJOR_VERSION ((PKIX_UInt32) 0)
#define PKIX_MINOR_VERSION ((PKIX_UInt32) 3)
/* Maximum minor version
*
* This macro is used to specify that the caller wants the largest minor
* version available.
*/
#define PKIX_MAX_MINOR_VERSION ((PKIX_UInt32) 4000000000)
/* Define Cert Store type for database access */
#define PKIX_STORE_TYPE_NONE 0
#define PKIX_STORE_TYPE_PK11 1
/* Portable Code (PC) data types
*
* These types are used to perform the primary operations of this library:
* building and validating chains of X.509 certificates.
*/
typedef struct PKIX_ErrorStruct PKIX_Error;
typedef struct PKIX_ProcessingParamsStruct PKIX_ProcessingParams;
typedef struct PKIX_ValidateParamsStruct PKIX_ValidateParams;
typedef struct PKIX_ValidateResultStruct PKIX_ValidateResult;
typedef struct PKIX_ResourceLimitsStruct PKIX_ResourceLimits;
typedef struct PKIX_BuildResultStruct PKIX_BuildResult;
typedef struct PKIX_CertStoreStruct PKIX_CertStore;
typedef struct PKIX_CertChainCheckerStruct PKIX_CertChainChecker;
typedef struct PKIX_RevocationCheckerStruct PKIX_RevocationChecker;
typedef struct PKIX_CertSelectorStruct PKIX_CertSelector;
typedef struct PKIX_CRLSelectorStruct PKIX_CRLSelector;
typedef struct PKIX_ComCertSelParamsStruct PKIX_ComCertSelParams;
typedef struct PKIX_ComCRLSelParamsStruct PKIX_ComCRLSelParams;
typedef struct PKIX_TrustAnchorStruct PKIX_TrustAnchor;
typedef struct PKIX_PolicyNodeStruct PKIX_PolicyNode;
typedef struct PKIX_LoggerStruct PKIX_Logger;
typedef struct PKIX_ListStruct PKIX_List;
typedef struct PKIX_ForwardBuilderStateStruct PKIX_ForwardBuilderState;
typedef struct PKIX_DefaultRevocationCheckerStruct
PKIX_DefaultRevocationChecker;
typedef struct PKIX_VerifyNodeStruct PKIX_VerifyNode;
/* Portability Layer (PL) data types
*
* These types are used are used as portable data types that are defined
* consistently across platforms
*/
typedef struct PKIX_PL_NssContextStruct PKIX_PL_NssContext;
typedef struct PKIX_PL_ObjectStruct PKIX_PL_Object;
typedef struct PKIX_PL_ByteArrayStruct PKIX_PL_ByteArray;
typedef struct PKIX_PL_HashTableStruct PKIX_PL_HashTable;
typedef struct PKIX_PL_MutexStruct PKIX_PL_Mutex;
typedef struct PKIX_PL_RWLockStruct PKIX_PL_RWLock;
typedef struct PKIX_PL_MonitorLockStruct PKIX_PL_MonitorLock;
typedef struct PKIX_PL_BigIntStruct PKIX_PL_BigInt;
typedef struct PKIX_PL_StringStruct PKIX_PL_String;
typedef struct PKIX_PL_OIDStruct PKIX_PL_OID;
typedef struct PKIX_PL_CertStruct PKIX_PL_Cert;
typedef struct PKIX_PL_GeneralNameStruct PKIX_PL_GeneralName;
typedef struct PKIX_PL_X500NameStruct PKIX_PL_X500Name;
typedef struct PKIX_PL_PublicKeyStruct PKIX_PL_PublicKey;
typedef struct PKIX_PL_DateStruct PKIX_PL_Date;
typedef struct PKIX_PL_CertNameConstraintsStruct PKIX_PL_CertNameConstraints;
typedef struct PKIX_PL_CertBasicConstraintsStruct PKIX_PL_CertBasicConstraints;
typedef struct PKIX_PL_CertPoliciesStruct PKIX_PL_CertPolicies;
typedef struct PKIX_PL_CertPolicyInfoStruct PKIX_PL_CertPolicyInfo;
typedef struct PKIX_PL_CertPolicyQualifierStruct PKIX_PL_CertPolicyQualifier;
typedef struct PKIX_PL_CertPolicyMapStruct PKIX_PL_CertPolicyMap;
typedef struct PKIX_PL_CRLStruct PKIX_PL_CRL;
typedef struct PKIX_PL_CRLEntryStruct PKIX_PL_CRLEntry;
typedef struct PKIX_PL_CollectionCertStoreStruct PKIX_PL_CollectionCertStore;
typedef struct PKIX_PL_CollectionCertStoreContext
PKIX_PL_CollectionCertStoreContext;
typedef struct PKIX_PL_LdapCertStoreContext PKIX_PL_LdapCertStoreContext;
typedef struct PKIX_PL_LdapRequestStruct PKIX_PL_LdapRequest;
typedef struct PKIX_PL_LdapResponseStruct PKIX_PL_LdapResponse;
typedef struct PKIX_PL_LdapDefaultClientStruct PKIX_PL_LdapDefaultClient;
typedef struct PKIX_PL_SocketStruct PKIX_PL_Socket;
typedef struct PKIX_PL_InfoAccessStruct PKIX_PL_InfoAccess;
typedef struct PKIX_PL_AIAMgrStruct PKIX_PL_AIAMgr;
typedef struct PKIX_PL_OcspCertIDStruct PKIX_PL_OcspCertID;
typedef struct PKIX_PL_OcspRequestStruct PKIX_PL_OcspRequest;
typedef struct PKIX_PL_OcspResponseStruct PKIX_PL_OcspResponse;
typedef struct PKIX_PL_HttpClientStruct PKIX_PL_HttpClient;
typedef struct PKIX_PL_HttpDefaultClientStruct PKIX_PL_HttpDefaultClient;
typedef struct PKIX_PL_HttpCertStoreContextStruct PKIX_PL_HttpCertStoreContext;
/* Primitive types
*
* In order to guarantee desired behavior as well as platform-independence, we
* typedef these types depending on the platform. XXX This needs more work!
*/
/* XXX Try compiling these files (and maybe the whole libpkix-nss) on Win32.
* We don't know what type is at least 32 bits long. ISO C probably requires
* at least 32 bits for long. we could default to that and only list platforms
* where that's not true.
*
* #elif
* #error
* #endif
*/
/* currently, int is 32 bits on all our supported platforms */
typedef unsigned int PKIX_UInt32;
typedef int PKIX_Int32;
typedef int PKIX_Boolean;
/* Object Types
*
* Every reference-counted PKIX_PL_Object is associated with an integer type.
*/
#define PKIX_TYPES \
TYPEMACRO(AIAMGR), \
TYPEMACRO(BASICCONSTRAINTSCHECKERSTATE), \
TYPEMACRO(BIGINT), \
TYPEMACRO(BUILDRESULT), \
TYPEMACRO(BYTEARRAY), \
TYPEMACRO(CERT), \
TYPEMACRO(CERTBASICCONSTRAINTS), \
TYPEMACRO(CERTCHAINCHECKER), \
TYPEMACRO(CERTNAMECONSTRAINTS), \
TYPEMACRO(CERTNAMECONSTRAINTSCHECKERSTATE), \
TYPEMACRO(CERTPOLICYCHECKERSTATE), \
TYPEMACRO(CERTPOLICYINFO), \
TYPEMACRO(CERTPOLICYMAP), \
TYPEMACRO(CERTPOLICYNODE), \
TYPEMACRO(CERTPOLICYQUALIFIER), \
TYPEMACRO(CERTSELECTOR), \
TYPEMACRO(CERTSTORE), \
TYPEMACRO(COLLECTIONCERTSTORECONTEXT), \
TYPEMACRO(COMCERTSELPARAMS), \
TYPEMACRO(COMCRLSELPARAMS), \
TYPEMACRO(CRL), \
TYPEMACRO(CRLDP), \
TYPEMACRO(CRLENTRY), \
TYPEMACRO(CRLSELECTOR), \
TYPEMACRO(DATE), \
TYPEMACRO(CRLCHECKER), \
TYPEMACRO(EKUCHECKER), \
TYPEMACRO(ERROR), \
TYPEMACRO(FORWARDBUILDERSTATE), \
TYPEMACRO(GENERALNAME), \
TYPEMACRO(HASHTABLE), \
TYPEMACRO(HTTPCERTSTORECONTEXT), \
TYPEMACRO(HTTPDEFAULTCLIENT), \
TYPEMACRO(INFOACCESS), \
TYPEMACRO(LDAPDEFAULTCLIENT), \
TYPEMACRO(LDAPREQUEST), \
TYPEMACRO(LDAPRESPONSE), \
TYPEMACRO(LIST), \
TYPEMACRO(LOGGER), \
TYPEMACRO(MONITORLOCK), \
TYPEMACRO(MUTEX), \
TYPEMACRO(OBJECT), \
TYPEMACRO(OCSPCERTID), \
TYPEMACRO(OCSPCHECKER), \
TYPEMACRO(OCSPREQUEST), \
TYPEMACRO(OCSPRESPONSE), \
TYPEMACRO(OID), \
TYPEMACRO(REVOCATIONCHECKER), \
TYPEMACRO(PROCESSINGPARAMS), \
TYPEMACRO(PUBLICKEY), \
TYPEMACRO(RESOURCELIMITS), \
TYPEMACRO(RWLOCK), \
TYPEMACRO(SIGNATURECHECKERSTATE), \
TYPEMACRO(SOCKET), \
TYPEMACRO(STRING), \
TYPEMACRO(TARGETCERTCHECKERSTATE), \
TYPEMACRO(TRUSTANCHOR), \
TYPEMACRO(VALIDATEPARAMS), \
TYPEMACRO(VALIDATERESULT), \
TYPEMACRO(VERIFYNODE), \
TYPEMACRO(X500NAME)
#define TYPEMACRO(type) PKIX_ ## type ## _TYPE
typedef enum { /* Now invoke all those TYPEMACROs to assign the numbers */
PKIX_TYPES,
PKIX_NUMTYPES /* This gets PKIX_NUMTYPES defined as the total number */
} PKIX_TYPENUM;
#ifdef PKIX_USER_OBJECT_TYPE
/* User Define Object Types
*
* User may define their own object types offset from PKIX_USER_OBJECT_TYPE
*/
#define PKIX_USER_OBJECT_TYPEBASE 1000
#endif /* PKIX_USER_OBJECT_TYPE */
/* Error Codes
*
* This list is used to define a set of PKIX_Error exception class numbers.
* ERRMACRO is redefined to produce a corresponding set of
* strings in the table "const char *PKIX_ERRORCLASSNAMES[PKIX_NUMERRORCLASSES]" in
* pkix_error.c. For example, since the fifth ERRMACRO entry is MUTEX, then
* PKIX_MUTEX_ERROR is defined in pkixt.h as 4, and PKIX_ERRORCLASSNAMES[4] is
* initialized in pkix_error.c with the value "MUTEX".
*/
#define PKIX_ERRORCLASSES \
ERRMACRO(AIAMGR), \
ERRMACRO(BASICCONSTRAINTSCHECKERSTATE), \
ERRMACRO(BIGINT), \
ERRMACRO(BUILD), \
ERRMACRO(BUILDRESULT), \
ERRMACRO(BYTEARRAY), \
ERRMACRO(CERT), \
ERRMACRO(CERTBASICCONSTRAINTS), \
ERRMACRO(CERTCHAINCHECKER), \
ERRMACRO(CERTNAMECONSTRAINTS), \
ERRMACRO(CERTNAMECONSTRAINTSCHECKERSTATE), \
ERRMACRO(CERTPOLICYCHECKERSTATE), \
ERRMACRO(CERTPOLICYINFO), \
ERRMACRO(CERTPOLICYMAP), \
ERRMACRO(CERTPOLICYNODE), \
ERRMACRO(CERTPOLICYQUALIFIER), \
ERRMACRO(CERTSELECTOR), \
ERRMACRO(CERTSTORE), \
ERRMACRO(CERTVFYPKIX), \
ERRMACRO(COLLECTIONCERTSTORECONTEXT), \
ERRMACRO(COMCERTSELPARAMS), \
ERRMACRO(COMCRLSELPARAMS), \
ERRMACRO(CONTEXT), \
ERRMACRO(CRL), \
ERRMACRO(CRLDP), \
ERRMACRO(CRLENTRY), \
ERRMACRO(CRLSELECTOR), \
ERRMACRO(CRLCHECKER), \
ERRMACRO(DATE), \
ERRMACRO(EKUCHECKER), \
ERRMACRO(ERROR), \
ERRMACRO(FATAL), \
ERRMACRO(FORWARDBUILDERSTATE), \
ERRMACRO(GENERALNAME), \
ERRMACRO(HASHTABLE), \
ERRMACRO(HTTPCERTSTORECONTEXT), \
ERRMACRO(HTTPDEFAULTCLIENT), \
ERRMACRO(INFOACCESS), \
ERRMACRO(LDAPCLIENT), \
ERRMACRO(LDAPDEFAULTCLIENT), \
ERRMACRO(LDAPREQUEST), \
ERRMACRO(LDAPRESPONSE), \
ERRMACRO(LIFECYCLE), \
ERRMACRO(LIST), \
ERRMACRO(LOGGER), \
ERRMACRO(MEM), \
ERRMACRO(MONITORLOCK), \
ERRMACRO(MUTEX), \
ERRMACRO(OBJECT), \
ERRMACRO(OCSPCERTID), \
ERRMACRO(OCSPCHECKER), \
ERRMACRO(OCSPREQUEST), \
ERRMACRO(OCSPRESPONSE), \
ERRMACRO(OID), \
ERRMACRO(PROCESSINGPARAMS), \
ERRMACRO(PUBLICKEY), \
ERRMACRO(RESOURCELIMITS), \
ERRMACRO(REVOCATIONMETHOD), \
ERRMACRO(REVOCATIONCHECKER), \
ERRMACRO(RWLOCK), \
ERRMACRO(SIGNATURECHECKERSTATE), \
ERRMACRO(SOCKET), \
ERRMACRO(STRING), \
ERRMACRO(TARGETCERTCHECKERSTATE), \
ERRMACRO(TRUSTANCHOR), \
ERRMACRO(USERDEFINEDMODULES), \
ERRMACRO(VALIDATE), \
ERRMACRO(VALIDATEPARAMS), \
ERRMACRO(VALIDATERESULT), \
ERRMACRO(VERIFYNODE), \
ERRMACRO(X500NAME)
#define ERRMACRO(type) PKIX_ ## type ## _ERROR
typedef enum { /* Now invoke all those ERRMACROs to assign the numbers */
PKIX_ERRORCLASSES,
PKIX_NUMERRORCLASSES /* This gets PKIX_NUMERRORCLASSES defined as the total number */
} PKIX_ERRORCLASS;
/* Now define error strings (for internationalization) */
#define PKIX_ERRORENTRY(name,desc,plerr) PKIX_ ## name
/* Define all the error numbers */
typedef enum {
#include "pkix_errorstrings.h"
, PKIX_NUMERRORCODES
} PKIX_ERRORCODE;
extern const char * const PKIX_ErrorText[];
/* String Formats
*
* These formats specify supported encoding formats for Strings.
*/
#define PKIX_ESCASCII 0
#define PKIX_UTF8 1
#define PKIX_UTF16 2
#define PKIX_UTF8_NULL_TERM 3
#define PKIX_ESCASCII_DEBUG 4
/* Name Types
*
* These types specify supported formats for GeneralNames.
*/
#define PKIX_OTHER_NAME 1
#define PKIX_RFC822_NAME 2
#define PKIX_DNS_NAME 3
#define PKIX_X400_ADDRESS 4
#define PKIX_DIRECTORY_NAME 5
#define PKIX_EDIPARTY_NAME 6
#define PKIX_URI_NAME 7
#define PKIX_IP_NAME 8
#define PKIX_OID_NAME 9
/* Key Usages
*
* These types specify supported Key Usages
*/
#define PKIX_DIGITAL_SIGNATURE 0x001
#define PKIX_NON_REPUDIATION 0x002
#define PKIX_KEY_ENCIPHERMENT 0x004
#define PKIX_DATA_ENCIPHERMENT 0x008
#define PKIX_KEY_AGREEMENT 0x010
#define PKIX_KEY_CERT_SIGN 0x020
#define PKIX_CRL_SIGN 0x040
#define PKIX_ENCIPHER_ONLY 0x080
#define PKIX_DECIPHER_ONLY 0x100
/* Reason Flags
*
* These macros specify supported Reason Flags
*/
#define PKIX_UNUSED 0x001
#define PKIX_KEY_COMPROMISE 0x002
#define PKIX_CA_COMPROMISE 0x004
#define PKIX_AFFILIATION_CHANGED 0x008
#define PKIX_SUPERSEDED 0x010
#define PKIX_CESSATION_OF_OPERATION 0x020
#define PKIX_CERTIFICATE_HOLD 0x040
#define PKIX_PRIVILEGE_WITHDRAWN 0x080
#define PKIX_AA_COMPROMISE 0x100
/* Boolean values
*
* These macros specify the Boolean values of TRUE and FALSE
* XXX Is it the case that any non-zero value is actually considered TRUE
* and this is just a convenient mnemonic macro?
*/
#define PKIX_TRUE ((PKIX_Boolean) 1)
#define PKIX_FALSE ((PKIX_Boolean) 0)
/*
* Define constants for basic constraints selector
* (see comments in pkix_certsel.h)
*/
#define PKIX_CERTSEL_ENDENTITY_MIN_PATHLENGTH (-2)
#define PKIX_CERTSEL_ALL_MATCH_MIN_PATHLENGTH (-1)
/*
* PKIX_ALLOC_ERROR is a special error object hard-coded into the pkix_error.o
* object file. It is thrown if system memory cannot be allocated or may be
* thrown for other unrecoverable errors. PKIX_ALLOC_ERROR is immutable.
* IncRef, DecRef and all Settor functions cannot be called.
* XXX Does anyone actually need to know about this?
* XXX Why no DecRef? Would be good to handle it the same.
*/
PKIX_Error* PKIX_ALLOC_ERROR(void);
/*
* In a CertBasicConstraints extension, if the CA flag is set,
* indicating the certificate refers to a Certification
* Authority, then the pathLen field indicates how many intermediate
* certificates (not counting self-signed ones) can exist in a valid
* chain following this certificate. If the pathLen has the value
* of this constant, then the length of the chain is unlimited
*/
#define PKIX_UNLIMITED_PATH_CONSTRAINT ((PKIX_Int32) -1)
/*
* Define Certificate Extension hard-coded OID's
*/
#define PKIX_UNKNOWN_OID SEC_OID_UNKNOWN
#define PKIX_CERTKEYUSAGE_OID SEC_OID_X509_KEY_USAGE
#define PKIX_CERTSUBJALTNAME_OID SEC_OID_X509_SUBJECT_ALT_NAME
#define PKIX_BASICCONSTRAINTS_OID SEC_OID_X509_BASIC_CONSTRAINTS
#define PKIX_CRLREASONCODE_OID SEC_OID_X509_REASON_CODE
#define PKIX_NAMECONSTRAINTS_OID SEC_OID_X509_NAME_CONSTRAINTS
#define PKIX_CERTIFICATEPOLICIES_OID SEC_OID_X509_CERTIFICATE_POLICIES
#define PKIX_CERTIFICATEPOLICIES_ANYPOLICY_OID SEC_OID_X509_ANY_POLICY
#define PKIX_POLICYMAPPINGS_OID SEC_OID_X509_POLICY_MAPPINGS
#define PKIX_POLICYCONSTRAINTS_OID SEC_OID_X509_POLICY_CONSTRAINTS
#define PKIX_EXTENDEDKEYUSAGE_OID SEC_OID_X509_EXT_KEY_USAGE
#define PKIX_INHIBITANYPOLICY_OID SEC_OID_X509_INHIBIT_ANY_POLICY
#define PKIX_NSCERTTYPE_OID SEC_OID_NS_CERT_EXT_CERT_TYPE
#define PKIX_KEY_USAGE_SERVER_AUTH_OID SEC_OID_EXT_KEY_USAGE_SERVER_AUTH
#define PKIX_KEY_USAGE_CLIENT_AUTH_OID SEC_OID_EXT_KEY_USAGE_CLIENT_AUTH
#define PKIX_KEY_USAGE_CODE_SIGN_OID SEC_OID_EXT_KEY_USAGE_CODE_SIGN
#define PKIX_KEY_USAGE_EMAIL_PROTECT_OID SEC_OID_EXT_KEY_USAGE_EMAIL_PROTECT
#define PKIX_KEY_USAGE_TIME_STAMP_OID SEC_OID_EXT_KEY_USAGE_TIME_STAMP
#define PKIX_KEY_USAGE_OCSP_RESPONDER_OID SEC_OID_OCSP_RESPONDER
/* Available revocation method types. */
typedef enum PKIX_RevocationMethodTypeEnum {
PKIX_RevocationMethod_CRL = 0,
PKIX_RevocationMethod_OCSP,
PKIX_RevocationMethod_MAX
} PKIX_RevocationMethodType;
/* A set of statuses revocation checker operates on */
typedef enum PKIX_RevocationStatusEnum {
PKIX_RevStatus_NoInfo = 0,
PKIX_RevStatus_Revoked,
PKIX_RevStatus_Success
} PKIX_RevocationStatus;
#ifdef __cplusplus
}
#endif
#endif /* _PKIXT_H */