security/nss/lib/libpkix/pkix/checker/pkix_revocationchecker.h@6474c204b198 (annotated)
security/nss/lib/libpkix/pkix/checker/pkix_revocationchecker.h
Wed, 31 Dec 2014 06:09:35 +0100
- author
- Michael Schloh von Bennewitz <michael@schloh.com>
- date
- Wed, 31 Dec 2014 06:09:35 +0100
- changeset 0
- 6474c204b198
- permissions
- -rwxr-xr-x
Cloned upstream origin tor-browser at tor-browser-31.3.0esr-4.5-1-build1
revision ID fc1c9ff7c1b2defdbc039f12214767608f46423f for hacking purpose.
| michael@0 | 1 | /* This Source Code Form is subject to the terms of the Mozilla Public |
| michael@0 | 2 | * License, v. 2.0. If a copy of the MPL was not distributed with this |
| michael@0 | 3 | * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ |
| michael@0 | 4 | /* |
| michael@0 | 5 | * pkix_revocationchecker.h |
| michael@0 | 6 | * |
| michael@0 | 7 | * RevocationChecker Object Type Definition |
| michael@0 | 8 | * |
| michael@0 | 9 | */ |
| michael@0 | 10 | |
| michael@0 | 11 | #ifndef _PKIX_REVOCATIONCHECKER_H |
| michael@0 | 12 | #define _PKIX_REVOCATIONCHECKER_H |
| michael@0 | 13 | |
| michael@0 | 14 | #include "pkixt.h" |
| michael@0 | 15 | |
| michael@0 | 16 | #ifdef __cplusplus |
| michael@0 | 17 | extern "C" { |
| michael@0 | 18 | #endif |
| michael@0 | 19 | |
| michael@0 | 20 | /* NOTE: nbio logistic removed. Will be replaced later. */ |
| michael@0 | 21 | |
| michael@0 | 22 | /* |
| michael@0 | 23 | * All Flags are prefixed by CERT_REV_M_, where _M_ indicates |
| michael@0 | 24 | * this is a method dependent flag. |
| michael@0 | 25 | */ |
| michael@0 | 26 | |
| michael@0 | 27 | /* |
| michael@0 | 28 | * Whether or not to use a method for revocation testing. |
| michael@0 | 29 | * If set to "do not test", then all other flags are ignored. |
| michael@0 | 30 | */ |
| michael@0 | 31 | #define PKIX_REV_M_DO_NOT_TEST_USING_THIS_METHOD 0x00L |
| michael@0 | 32 | #define PKIX_REV_M_TEST_USING_THIS_METHOD 0x01L |
| michael@0 | 33 | |
| michael@0 | 34 | /* |
| michael@0 | 35 | * Whether or not NSS is allowed to attempt to fetch fresh information |
| michael@0 | 36 | * from the network. |
| michael@0 | 37 | * (Although fetching will never happen if fresh information for the |
| michael@0 | 38 | * method is already locally available.) |
| michael@0 | 39 | */ |
| michael@0 | 40 | #define PKIX_REV_M_ALLOW_NETWORK_FETCHING 0x00L |
| michael@0 | 41 | #define PKIX_REV_M_FORBID_NETWORK_FETCHING 0x02L |
| michael@0 | 42 | |
| michael@0 | 43 | /* |
| michael@0 | 44 | * Example for an implicit default source: |
| michael@0 | 45 | * The globally configured default OCSP responder. |
| michael@0 | 46 | * IGNORE means: |
| michael@0 | 47 | * ignore the implicit default source, whether it's configured or not. |
| michael@0 | 48 | * ALLOW means: |
| michael@0 | 49 | * if an implicit default source is configured, |
| michael@0 | 50 | * then it overrides any available or missing source in the cert. |
| michael@0 | 51 | * if no implicit default source is configured, |
| michael@0 | 52 | * then we continue to use what's available (or not available) |
| michael@0 | 53 | * in the certs. |
| michael@0 | 54 | */ |
| michael@0 | 55 | #define PKIX_REV_M_ALLOW_IMPLICIT_DEFAULT_SOURCE 0x00L |
| michael@0 | 56 | #define PKIX_REV_M_IGNORE_IMPLICIT_DEFAULT_SOURCE 0x04L /* OCSP only */ |
| michael@0 | 57 | |
| michael@0 | 58 | /* |
| michael@0 | 59 | * Defines the behavior if no fresh information is available, |
| michael@0 | 60 | * fetching from the network is allowed, but the source of revocation |
| michael@0 | 61 | * information is unknown (even after considering implicit sources, |
| michael@0 | 62 | * if allowed by other flags). |
| michael@0 | 63 | * SKIPT_TEST means: |
| michael@0 | 64 | * We ignore that no fresh information is available and |
| michael@0 | 65 | * skip this test. |
| michael@0 | 66 | * REQUIRE_INFO means: |
| michael@0 | 67 | * We still require that fresh information is available. |
| michael@0 | 68 | * Other flags define what happens on missing fresh info. |
| michael@0 | 69 | */ |
| michael@0 | 70 | |
| michael@0 | 71 | #define PKIX_REV_M_SKIP_TEST_ON_MISSING_SOURCE 0x00L |
| michael@0 | 72 | #define PKIX_REV_M_REQUIRE_INFO_ON_MISSING_SOURCE 0x08L |
| michael@0 | 73 | |
| michael@0 | 74 | /* |
| michael@0 | 75 | * Defines the behavior if we are unable to obtain fresh information. |
| michael@0 | 76 | * INGORE means: |
| michael@0 | 77 | * Return "cert status unknown" |
| michael@0 | 78 | * FAIL means: |
| michael@0 | 79 | * Return "cert revoked". |
| michael@0 | 80 | */ |
| michael@0 | 81 | |
| michael@0 | 82 | #define PKIX_REV_M_IGNORE_MISSING_FRESH_INFO 0x00L |
| michael@0 | 83 | #define PKIX_REV_M_FAIL_ON_MISSING_FRESH_INFO 0x10L |
| michael@0 | 84 | |
| michael@0 | 85 | /* |
| michael@0 | 86 | * What should happen if we were able to find fresh information using |
| michael@0 | 87 | * this method, and the data indicated the cert is good? |
| michael@0 | 88 | * STOP_TESTING means: |
| michael@0 | 89 | * Our success is sufficient, do not continue testing |
| michael@0 | 90 | * other methods. |
| michael@0 | 91 | * CONTINUE_TESTING means: |
| michael@0 | 92 | * We will continue and test the next allowed |
| michael@0 | 93 | * specified method. |
| michael@0 | 94 | */ |
| michael@0 | 95 | |
| michael@0 | 96 | #define PKIX_REV_M_STOP_TESTING_ON_FRESH_INFO 0x00L |
| michael@0 | 97 | #define PKIX_REV_M_CONTINUE_TESTING_ON_FRESH_INFO 0x20L |
| michael@0 | 98 | |
| michael@0 | 99 | /* |
| michael@0 | 100 | * All Flags are prefixed by PKIX_REV_MI_, where _MI_ indicates |
| michael@0 | 101 | * this is a method independent flag. |
| michael@0 | 102 | */ |
| michael@0 | 103 | |
| michael@0 | 104 | /* |
| michael@0 | 105 | * This defines the order to checking. |
| michael@0 | 106 | * EACH_METHOD_SEPARATELY means: |
| michael@0 | 107 | * Do all tests related to a particular allowed method |
| michael@0 | 108 | * (both local information and network fetching) in a single step. |
| michael@0 | 109 | * Only after testing for a particular method is done, |
| michael@0 | 110 | * then switching to the next method will happen. |
| michael@0 | 111 | * ALL_LOCAL_INFORMATION_FIRST means: |
| michael@0 | 112 | * Start by testing the information for all allowed methods |
| michael@0 | 113 | * which are already locally available. Only after that is done |
| michael@0 | 114 | * consider to fetch from the network (as allowed by other flags). |
| michael@0 | 115 | */ |
| michael@0 | 116 | #define PKIX_REV_MI_TEST_EACH_METHOD_SEPARATELY 0x00L |
| michael@0 | 117 | #define PKIX_REV_MI_TEST_ALL_LOCAL_INFORMATION_FIRST 0x01L |
| michael@0 | 118 | |
| michael@0 | 119 | /* |
| michael@0 | 120 | * Use this flag to specify that it's necessary that fresh information |
| michael@0 | 121 | * is available for at least one of the allowed methods, but it's |
| michael@0 | 122 | * irrelevant which of the mechanisms succeeded. |
| michael@0 | 123 | * NO_OVERALL_INFO_REQUIREMENT means: |
| michael@0 | 124 | * We strictly follow the requirements for each individual method. |
| michael@0 | 125 | * REQUIRE_SOME_FRESH_INFO_AVAILABLE means: |
| michael@0 | 126 | * After the individual tests have been executed, we must have |
| michael@0 | 127 | * been able to find fresh information using at least one method. |
| michael@0 | 128 | * If we were unable to find fresh info, it's a failure. |
| michael@0 | 129 | */ |
| michael@0 | 130 | #define PKIX_REV_MI_NO_OVERALL_INFO_REQUIREMENT 0x00L |
| michael@0 | 131 | #define PKIX_REV_MI_REQUIRE_SOME_FRESH_INFO_AVAILABLE 0x02L |
| michael@0 | 132 | |
| michael@0 | 133 | /* Defines check time for the cert, revocation methods lists and |
| michael@0 | 134 | * flags for leaf and chain certs revocation tests. */ |
| michael@0 | 135 | struct PKIX_RevocationCheckerStruct { |
| michael@0 | 136 | PKIX_List *leafMethodList; |
| michael@0 | 137 | PKIX_List *chainMethodList; |
| michael@0 | 138 | PKIX_UInt32 leafMethodListFlags; |
| michael@0 | 139 | PKIX_UInt32 chainMethodListFlags; |
| michael@0 | 140 | }; |
| michael@0 | 141 | |
| michael@0 | 142 | /* see source file for function documentation */ |
| michael@0 | 143 | |
| michael@0 | 144 | PKIX_Error *pkix_RevocationChecker_RegisterSelf(void *plContext); |
| michael@0 | 145 | |
| michael@0 | 146 | #ifdef __cplusplus |
| michael@0 | 147 | } |
| michael@0 | 148 | #endif |
| michael@0 | 149 | |
| michael@0 | 150 | #endif /* _PKIX_REVOCATIONCHECKER_H */ |
