The Tor Browser: security/nss/lib/smime/cmst.h@6474c204b198 (annotated)

security/nss/lib/smime/cmst.h@6474c204b198 (annotated)

security/nss/lib/smime/cmst.h

Wed, 31 Dec 2014 06:09:35 +0100

author: Michael Schloh von Bennewitz <michael@schloh.com>
date: Wed, 31 Dec 2014 06:09:35 +0100
changeset 0: 6474c204b198
permissions: -rw-r--r--

Cloned upstream origin tor-browser at tor-browser-31.3.0esr-4.5-1-build1
revision ID fc1c9ff7c1b2defdbc039f12214767608f46423f for hacking purpose.

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 /*
  * Header for CMS types.
  */
 #ifndef _CMST_H_
 #define _CMST_H_
 #include "seccomon.h"
 #include "secoidt.h"
 #include "certt.h"
 #include "secmodt.h"
 #include "secmodt.h"
 #include "plarena.h"
 /* Non-opaque objects.  NOTE, though: I want them to be treated as
  * opaque as much as possible.  If I could hide them completely,
  * I would.  (I tried, but ran into trouble that was taking me too
  * much time to get out of.)  I still intend to try to do so.
  * In fact, the only type that "outsiders" should even *name* is
  * NSSCMSMessage, and they should not reference its fields.
  */
 /* rjr: PKCS #11 cert handling (pk11cert.c) does use NSSCMSRecipientInfo's.
  * This is because when we search the recipient list for the cert and key we
  * want, we need to invert the order of the loops we used to have. The old
  * loops were:
  *
  *  For each recipient {
  *       find_cert = PK11_Find_AllCert(recipient->issuerSN);
  *       [which unrolls to... ]
  *       For each slot {
  *            Log into slot;
  *            search slot for cert;
  *      }
  *  }
  *
  *  the new loop searchs all the recipients at once on a slot. this allows
  *  PKCS #11 to order slots in such a way that logout slots don't get checked
  *  if we can find the cert on a logged in slot. This eliminates lots of
  *  spurious password prompts when smart cards are installed... so why this
  *  comment? If you make NSSCMSRecipientInfo completely opaque, you need
  *  to provide a non-opaque list of issuerSN's (the only field PKCS#11 needs
  *  and fix up pk11cert.c first. NOTE: Only S/MIME calls this special PKCS #11
  *  function.
  */
 typedef struct NSSCMSMessageStr NSSCMSMessage;
 typedef union NSSCMSContentUnion NSSCMSContent;
 typedef struct NSSCMSContentInfoStr NSSCMSContentInfo;
 typedef struct NSSCMSSignedDataStr NSSCMSSignedData;
 typedef struct NSSCMSSignerInfoStr NSSCMSSignerInfo;
 typedef struct NSSCMSSignerIdentifierStr NSSCMSSignerIdentifier;
 typedef struct NSSCMSEnvelopedDataStr NSSCMSEnvelopedData;
 typedef struct NSSCMSOriginatorInfoStr NSSCMSOriginatorInfo;
 typedef struct NSSCMSRecipientInfoStr NSSCMSRecipientInfo;
 typedef struct NSSCMSDigestedDataStr NSSCMSDigestedData;
 typedef struct NSSCMSEncryptedDataStr NSSCMSEncryptedData;
 typedef struct NSSCMSGenericWrapperDataStr NSSCMSGenericWrapperData;
 typedef struct NSSCMSAttributeStr NSSCMSAttribute;
 typedef struct NSSCMSDecoderContextStr NSSCMSDecoderContext;
 typedef struct NSSCMSEncoderContextStr NSSCMSEncoderContext;
 typedef struct NSSCMSCipherContextStr NSSCMSCipherContext;
 typedef struct NSSCMSDigestContextStr NSSCMSDigestContext;
 typedef struct NSSCMSContentInfoPrivateStr NSSCMSContentInfoPrivate;
 typedef SECStatus (*NSSCMSGenericWrapperDataCallback)
 						(NSSCMSGenericWrapperData *);
 typedef   void    (*NSSCMSGenericWrapperDataDestroy)
 						(NSSCMSGenericWrapperData *);
 extern const SEC_ASN1Template NSSCMSGenericWrapperDataTemplate[];
 extern const SEC_ASN1Template NSS_PointerToCMSGenericWrapperDataTemplate[];
 SEC_ASN1_CHOOSER_DECLARE(NSS_PointerToCMSGenericWrapperDataTemplate)
 SEC_ASN1_CHOOSER_DECLARE(NSSCMSGenericWrapperDataTemplate)
 /*
  * Type of function passed to NSSCMSDecode or NSSCMSDecoderStart.
  * If specified, this is where the content bytes (only) will be "sent"
  * as they are recovered during the decoding.
  * And:
  * Type of function passed to NSSCMSEncode or NSSCMSEncoderStart.
  * This is where the DER-encoded bytes will be "sent".
  *
  * XXX Should just combine this with NSSCMSEncoderContentCallback type
  * and use a simpler, common name.
  */
 typedef void (*NSSCMSContentCallback)(void *arg, const char *buf, unsigned long len);
 /*
  * Type of function passed to NSSCMSDecode or NSSCMSDecoderStart
  * to retrieve the decryption key.  This function is intended to be
  * used for EncryptedData content info's which do not have a key available
  * in a certificate, etc.
  */
 typedef PK11SymKey *(*NSSCMSGetDecryptKeyCallback)(void *arg, SECAlgorithmID *algid);
 /* =============================================================================
  * ENCAPSULATED CONTENTINFO & CONTENTINFO
  */
 union NSSCMSContentUnion {
     /* either unstructured */
     SECItem *			data;
     /* or structured data */
     NSSCMSDigestedData *	digestedData;
     NSSCMSEncryptedData	*	encryptedData;
     NSSCMSEnvelopedData	*	envelopedData;
     NSSCMSSignedData *		signedData;
     NSSCMSGenericWrapperData *	genericData;
     /* or anonymous pointer to something */
     void *			pointer;
 };
 struct NSSCMSContentInfoStr {
     SECItem			contentType;
     NSSCMSContent		content;
     /* --------- local; not part of encoding --------- */
     SECOidData *		contentTypeTag;
     /* additional info for encryptedData and envelopedData */
     /* we waste this space for signedData and digestedData. sue me. */
     SECAlgorithmID		contentEncAlg;
     SECItem *			rawContent;		/* encrypted DER, optional */
 							/* XXXX bytes not encrypted, but encoded? */
     /* --------- local; not part of encoding --------- */
     PK11SymKey *		bulkkey;		/* bulk encryption key */
     int				keysize;		/* size of bulk encryption key
 							 * (only used by creation code) */
     SECOidTag			contentEncAlgTag;	/* oid tag of encryption algorithm
 							 * (only used by creation code) */
     NSSCMSContentInfoPrivate	*privateInfo;		/* place for NSS private info */
     void		*reserved;			/* keep binary compatibility */
 };
 /* =============================================================================
  * MESSAGE
  */
 struct NSSCMSMessageStr {
     NSSCMSContentInfo	contentInfo;		/* "outer" cinfo */
     /* --------- local; not part of encoding --------- */
     PLArenaPool *	poolp;
     PRBool		poolp_is_ours;
     int			refCount;
     /* properties of the "inner" data */
     SECAlgorithmID **	detached_digestalgs;
     SECItem **		detached_digests;
     void *		pwfn_arg;
     NSSCMSGetDecryptKeyCallback decrypt_key_cb;
     void *		decrypt_key_cb_arg;
 };
 /* ============================================================================
  * GENERIC WRAPPER
  *
  * used for user defined types.
  */
 struct NSSCMSGenericWrapperDataStr {
     NSSCMSContentInfo	contentInfo;
     /* ---- local; not part of encoding ------ */
     NSSCMSMessage *	cmsg;
     /* wrapperspecific data starts here */
 };
 /* =============================================================================
  * SIGNEDDATA
  */
 struct NSSCMSSignedDataStr {
     SECItem			version;
     SECAlgorithmID **		digestAlgorithms;
     NSSCMSContentInfo		contentInfo;
     SECItem **			rawCerts;
     CERTSignedCrl **		crls;
     NSSCMSSignerInfo **		signerInfos;
     /* --------- local; not part of encoding --------- */
     NSSCMSMessage *		cmsg;			/* back pointer to message */
     SECItem **			digests;
     CERTCertificate **		certs;
     CERTCertificateList **	certLists;
     CERTCertificate **          tempCerts;              /* temporary certs, needed
                                                          * for example for signature
                                                          * verification */
 };
 #define NSS_CMS_SIGNED_DATA_VERSION_BASIC	1	/* what we *create* */
 #define NSS_CMS_SIGNED_DATA_VERSION_EXT		3	/* what we *create* */
 typedef enum {
     NSSCMSVS_Unverified = 0,
     NSSCMSVS_GoodSignature = 1,
     NSSCMSVS_BadSignature = 2,
     NSSCMSVS_DigestMismatch = 3,
     NSSCMSVS_SigningCertNotFound = 4,
     NSSCMSVS_SigningCertNotTrusted = 5,
     NSSCMSVS_SignatureAlgorithmUnknown = 6,
     NSSCMSVS_SignatureAlgorithmUnsupported = 7,
     NSSCMSVS_MalformedSignature = 8,
     NSSCMSVS_ProcessingError = 9
 } NSSCMSVerificationStatus;
 typedef enum {
     NSSCMSSignerID_IssuerSN = 0,
     NSSCMSSignerID_SubjectKeyID = 1
 } NSSCMSSignerIDSelector;
 struct NSSCMSSignerIdentifierStr {
     NSSCMSSignerIDSelector identifierType;
     union {
 	CERTIssuerAndSN *issuerAndSN;
 	SECItem *subjectKeyID;
     } id;
 };
 struct NSSCMSSignerInfoStr {
     SECItem			version;
     NSSCMSSignerIdentifier	signerIdentifier;
     SECAlgorithmID		digestAlg;
     NSSCMSAttribute **		authAttr;
     SECAlgorithmID		digestEncAlg;
     SECItem			encDigest;
     NSSCMSAttribute **		unAuthAttr;
     /* --------- local; not part of encoding --------- */
     NSSCMSMessage *		cmsg;			/* back pointer to message */
     CERTCertificate *		cert;
     CERTCertificateList *	certList;
     PRTime			signingTime;
     NSSCMSVerificationStatus	verificationStatus;
     SECKEYPrivateKey *          signingKey; /* Used if we're using subjKeyID*/
     SECKEYPublicKey *           pubKey;
 };
 #define NSS_CMS_SIGNER_INFO_VERSION_ISSUERSN	1	/* what we *create* */
 #define NSS_CMS_SIGNER_INFO_VERSION_SUBJKEY	3	/* what we *create* */
 typedef enum {
     NSSCMSCM_None = 0,
     NSSCMSCM_CertOnly = 1,
     NSSCMSCM_CertChain = 2,
     NSSCMSCM_CertChainWithRoot = 3
 } NSSCMSCertChainMode;
 /* =============================================================================
  * ENVELOPED DATA
  */
 struct NSSCMSEnvelopedDataStr {
     SECItem			version;
     NSSCMSOriginatorInfo *	originatorInfo;		/* optional */
     NSSCMSRecipientInfo **	recipientInfos;
     NSSCMSContentInfo		contentInfo;
     NSSCMSAttribute **		unprotectedAttr;
     /* --------- local; not part of encoding --------- */
     NSSCMSMessage *		cmsg;			/* back pointer to message */
 };
 #define NSS_CMS_ENVELOPED_DATA_VERSION_REG	0	/* what we *create* */
 #define NSS_CMS_ENVELOPED_DATA_VERSION_ADV	2	/* what we *create* */
 struct NSSCMSOriginatorInfoStr {
     SECItem **			rawCerts;
     CERTSignedCrl **		crls;
     /* --------- local; not part of encoding --------- */
     CERTCertificate **		certs;
 };
 /* -----------------------------------------------------------------------------
  * key transport recipient info
  */
 typedef enum {
     NSSCMSRecipientID_IssuerSN = 0,
     NSSCMSRecipientID_SubjectKeyID = 1,
     NSSCMSRecipientID_BrandNew = 2
 } NSSCMSRecipientIDSelector;
 struct NSSCMSRecipientIdentifierStr {
     NSSCMSRecipientIDSelector	identifierType;
     union {
 	CERTIssuerAndSN		*issuerAndSN;
 	SECItem 		*subjectKeyID;
     } id;
 };
 typedef struct NSSCMSRecipientIdentifierStr NSSCMSRecipientIdentifier;
 struct NSSCMSKeyTransRecipientInfoStr {
     SECItem			version;
     NSSCMSRecipientIdentifier	recipientIdentifier;
     SECAlgorithmID		keyEncAlg;
     SECItem			encKey;
 };
 typedef struct NSSCMSKeyTransRecipientInfoStr NSSCMSKeyTransRecipientInfo;
 /*
  * View comments before NSSCMSRecipientInfoStr for purpose of this
  * structure.
  */
 struct NSSCMSKeyTransRecipientInfoExStr {
     NSSCMSKeyTransRecipientInfo recipientInfo;
     int version;  /* version of this structure (0) */
     SECKEYPublicKey *pubKey;
 };
 typedef struct NSSCMSKeyTransRecipientInfoExStr NSSCMSKeyTransRecipientInfoEx;
 #define NSS_CMS_KEYTRANS_RECIPIENT_INFO_VERSION_ISSUERSN	0	/* what we *create* */
 #define NSS_CMS_KEYTRANS_RECIPIENT_INFO_VERSION_SUBJKEY		2	/* what we *create* */
 /* -----------------------------------------------------------------------------
  * key agreement recipient info
  */
 struct NSSCMSOriginatorPublicKeyStr {
     SECAlgorithmID			algorithmIdentifier;
     SECItem				publicKey;			/* bit string! */
 };
 typedef struct NSSCMSOriginatorPublicKeyStr NSSCMSOriginatorPublicKey;
 typedef enum {
     NSSCMSOriginatorIDOrKey_IssuerSN = 0,
     NSSCMSOriginatorIDOrKey_SubjectKeyID = 1,
     NSSCMSOriginatorIDOrKey_OriginatorPublicKey = 2
 } NSSCMSOriginatorIDOrKeySelector;
 struct NSSCMSOriginatorIdentifierOrKeyStr {
     NSSCMSOriginatorIDOrKeySelector identifierType;
     union {
 	CERTIssuerAndSN			*issuerAndSN;		/* static-static */
 	SECItem				*subjectKeyID;		/* static-static */
 	NSSCMSOriginatorPublicKey	originatorPublicKey;	/* ephemeral-static */
     } id;
 };
 typedef struct NSSCMSOriginatorIdentifierOrKeyStr NSSCMSOriginatorIdentifierOrKey;
 struct NSSCMSRecipientKeyIdentifierStr {
     SECItem *				subjectKeyIdentifier;
     SECItem *				date;			/* optional */
     SECItem *				other;			/* optional */
 };
 typedef struct NSSCMSRecipientKeyIdentifierStr NSSCMSRecipientKeyIdentifier;
 typedef enum {
     NSSCMSKeyAgreeRecipientID_IssuerSN = 0,
     NSSCMSKeyAgreeRecipientID_RKeyID = 1
 } NSSCMSKeyAgreeRecipientIDSelector;
 struct NSSCMSKeyAgreeRecipientIdentifierStr {
     NSSCMSKeyAgreeRecipientIDSelector	identifierType;
     union {
 	CERTIssuerAndSN			*issuerAndSN;
 	NSSCMSRecipientKeyIdentifier	recipientKeyIdentifier;
     } id;
 };
 typedef struct NSSCMSKeyAgreeRecipientIdentifierStr NSSCMSKeyAgreeRecipientIdentifier;
 struct NSSCMSRecipientEncryptedKeyStr {
     NSSCMSKeyAgreeRecipientIdentifier	recipientIdentifier;
     SECItem				encKey;
 };
 typedef struct NSSCMSRecipientEncryptedKeyStr NSSCMSRecipientEncryptedKey;
 struct NSSCMSKeyAgreeRecipientInfoStr {
     SECItem				version;
     NSSCMSOriginatorIdentifierOrKey	originatorIdentifierOrKey;
     SECItem *				ukm;				/* optional */
     SECAlgorithmID			keyEncAlg;
     NSSCMSRecipientEncryptedKey **	recipientEncryptedKeys;
 };
 typedef struct NSSCMSKeyAgreeRecipientInfoStr NSSCMSKeyAgreeRecipientInfo;
 #define NSS_CMS_KEYAGREE_RECIPIENT_INFO_VERSION	3	/* what we *create* */
 /* -----------------------------------------------------------------------------
  * KEK recipient info
  */
 struct NSSCMSKEKIdentifierStr {
     SECItem			keyIdentifier;
     SECItem *			date;			/* optional */
     SECItem *			other;			/* optional */
 };
 typedef struct NSSCMSKEKIdentifierStr NSSCMSKEKIdentifier;
 struct NSSCMSKEKRecipientInfoStr {
     SECItem			version;
     NSSCMSKEKIdentifier		kekIdentifier;
     SECAlgorithmID		keyEncAlg;
     SECItem			encKey;
 };
 typedef struct NSSCMSKEKRecipientInfoStr NSSCMSKEKRecipientInfo;
 #define NSS_CMS_KEK_RECIPIENT_INFO_VERSION	4	/* what we *create* */
 /* -----------------------------------------------------------------------------
  * recipient info
  */
 typedef enum {
     NSSCMSRecipientInfoID_KeyTrans = 0,
     NSSCMSRecipientInfoID_KeyAgree = 1,
     NSSCMSRecipientInfoID_KEK = 2
 } NSSCMSRecipientInfoIDSelector;
 /*
  * In order to preserve backwards binary compatibility when implementing
  * creation of Recipient Info's that uses subjectKeyID in the
  * keyTransRecipientInfo we need to stash a public key pointer in this
  * structure somewhere.  We figured out that NSSCMSKeyTransRecipientInfo
  * is the smallest member of the ri union.  We're in luck since that's
  * the very structure that would need to use the public key. So we created
  * a new structure NSSCMSKeyTransRecipientInfoEx which has a member
  * NSSCMSKeyTransRecipientInfo as the first member followed by a version
  * and a public key pointer.  This way we can keep backwards compatibility
  * without changing the size of this structure.
  *
  * BTW, size of structure:
  * NSSCMSKeyTransRecipientInfo:  9 ints, 4 pointers
  * NSSCMSKeyAgreeRecipientInfo: 12 ints, 8 pointers
  * NSSCMSKEKRecipientInfo:      10 ints, 7 pointers
  *
  * The new structure:
  * NSSCMSKeyTransRecipientInfoEx: sizeof(NSSCMSKeyTransRecipientInfo) +
  *                                1 int, 1 pointer
  */
 struct NSSCMSRecipientInfoStr {
     NSSCMSRecipientInfoIDSelector recipientInfoType;
     union {
 	NSSCMSKeyTransRecipientInfo keyTransRecipientInfo;
 	NSSCMSKeyAgreeRecipientInfo keyAgreeRecipientInfo;
 	NSSCMSKEKRecipientInfo kekRecipientInfo;
 	NSSCMSKeyTransRecipientInfoEx keyTransRecipientInfoEx;
     } ri;
     /* --------- local; not part of encoding --------- */
     NSSCMSMessage *		cmsg;			/* back pointer to message */
     CERTCertificate *		cert;			/* recipient's certificate */
 };
 /* =============================================================================
  * DIGESTED DATA
  */
 struct NSSCMSDigestedDataStr {
     SECItem			version;
     SECAlgorithmID		digestAlg;
     NSSCMSContentInfo		contentInfo;
     SECItem			digest;
     /* --------- local; not part of encoding --------- */
     NSSCMSMessage *		cmsg;		/* back pointer */
     SECItem			cdigest;	/* calculated digest */
 };
 #define NSS_CMS_DIGESTED_DATA_VERSION_DATA	0	/* what we *create* */
 #define NSS_CMS_DIGESTED_DATA_VERSION_ENCAP	2	/* what we *create* */
 /* =============================================================================
  * ENCRYPTED DATA
  */
 struct NSSCMSEncryptedDataStr {
     SECItem			version;
     NSSCMSContentInfo		contentInfo;
     NSSCMSAttribute **		unprotectedAttr;	/* optional */
     /* --------- local; not part of encoding --------- */
     NSSCMSMessage *		cmsg;		/* back pointer */
 };
 #define NSS_CMS_ENCRYPTED_DATA_VERSION		0	/* what we *create* */
 #define NSS_CMS_ENCRYPTED_DATA_VERSION_UPATTR	2	/* what we *create* */
 /*
  * *****************************************************************************
  * *****************************************************************************
  * *****************************************************************************
  */
 /*
  * See comment above about this type not really belonging to CMS.
  */
 struct NSSCMSAttributeStr {
     /* The following fields make up an encoded Attribute: */
     SECItem			type;
     SECItem **			values;	/* data may or may not be encoded */
     /* The following fields are not part of an encoded Attribute: */
     SECOidData *		typeTag;
     PRBool			encoded;	/* when true, values are encoded */
 };
 #endif /* _CMST_H_ */

The Tor Browser / annotate

security/nss/lib/smime/cmst.h@6474c204b198 (annotated)

security/nss/lib/smime/cmst.h