security/nss/lib/pki/pkit.h@7e26c7da4463 (annotated)
security/nss/lib/pki/pkit.h
Wed, 31 Dec 2014 06:55:50 +0100
- author
- Michael Schloh von Bennewitz <michael@schloh.com>
- date
- Wed, 31 Dec 2014 06:55:50 +0100
- changeset 2
- 7e26c7da4463
- permissions
- -rw-r--r--
Added tag UPSTREAM_283F7C6 for changeset ca08bd8f51b2
| michael@0 | 1 | /* This Source Code Form is subject to the terms of the Mozilla Public |
| michael@0 | 2 | * License, v. 2.0. If a copy of the MPL was not distributed with this |
| michael@0 | 3 | * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ |
| michael@0 | 4 | |
| michael@0 | 5 | #ifndef PKIT_H |
| michael@0 | 6 | #define PKIT_H |
| michael@0 | 7 | |
| michael@0 | 8 | /* |
| michael@0 | 9 | * pkit.h |
| michael@0 | 10 | * |
| michael@0 | 11 | * This file contains definitions for the types of the top-level PKI objects. |
| michael@0 | 12 | */ |
| michael@0 | 13 | |
| michael@0 | 14 | #ifndef NSSBASET_H |
| michael@0 | 15 | #include "nssbaset.h" |
| michael@0 | 16 | #endif /* NSSBASET_H */ |
| michael@0 | 17 | |
| michael@0 | 18 | #ifndef BASET_H |
| michael@0 | 19 | #include "baset.h" |
| michael@0 | 20 | #endif /* BASET_H */ |
| michael@0 | 21 | |
| michael@0 | 22 | #include "certt.h" |
| michael@0 | 23 | #include "pkcs11t.h" |
| michael@0 | 24 | |
| michael@0 | 25 | #ifndef NSSPKIT_H |
| michael@0 | 26 | #include "nsspkit.h" |
| michael@0 | 27 | #endif /* NSSPKIT_H */ |
| michael@0 | 28 | |
| michael@0 | 29 | #ifndef NSSDEVT_H |
| michael@0 | 30 | #include "nssdevt.h" |
| michael@0 | 31 | #endif /* NSSDEVT_H */ |
| michael@0 | 32 | |
| michael@0 | 33 | #ifndef DEVT_H |
| michael@0 | 34 | #include "devt.h" |
| michael@0 | 35 | #endif /* DEVT_H */ |
| michael@0 | 36 | |
| michael@0 | 37 | #ifndef nssrwlkt_h__ |
| michael@0 | 38 | #include "nssrwlkt.h" |
| michael@0 | 39 | #endif /* nssrwlkt_h__ */ |
| michael@0 | 40 | |
| michael@0 | 41 | PR_BEGIN_EXTERN_C |
| michael@0 | 42 | |
| michael@0 | 43 | /* |
| michael@0 | 44 | * A note on ephemeral certs |
| michael@0 | 45 | * |
| michael@0 | 46 | * The key objects defined here can only be created on tokens, and can only |
| michael@0 | 47 | * exist on tokens. Therefore, any instance of a key object must have |
| michael@0 | 48 | * a corresponding cryptoki instance. OTOH, certificates created in |
| michael@0 | 49 | * crypto contexts need not be stored as session objects on the token. |
| michael@0 | 50 | * There are good performance reasons for not doing so. The certificate |
| michael@0 | 51 | * and trust objects have been defined with a cryptoContext field to |
| michael@0 | 52 | * allow for ephemeral certs, which may have a single instance in a crypto |
| michael@0 | 53 | * context along with any number (including zero) of cryptoki instances. |
| michael@0 | 54 | * Since contexts may not share objects, there can be only one context |
| michael@0 | 55 | * for each object. |
| michael@0 | 56 | */ |
| michael@0 | 57 | |
| michael@0 | 58 | typedef enum { |
| michael@0 | 59 | nssPKILock = 1, |
| michael@0 | 60 | nssPKIMonitor = 2 |
| michael@0 | 61 | } nssPKILockType; |
| michael@0 | 62 | |
| michael@0 | 63 | /* nssPKIObject |
| michael@0 | 64 | * |
| michael@0 | 65 | * This is the base object class, common to all PKI objects defined in |
| michael@0 | 66 | * nsspkit.h |
| michael@0 | 67 | */ |
| michael@0 | 68 | struct nssPKIObjectStr |
| michael@0 | 69 | { |
| michael@0 | 70 | /* The arena for all object memory */ |
| michael@0 | 71 | NSSArena *arena; |
| michael@0 | 72 | /* Atomically incremented/decremented reference counting */ |
| michael@0 | 73 | PRInt32 refCount; |
| michael@0 | 74 | /* lock protects the array of nssCryptokiInstance's of the object */ |
| michael@0 | 75 | union { |
| michael@0 | 76 | PZLock* lock; |
| michael@0 | 77 | PZMonitor *mlock; |
| michael@0 | 78 | } sync; |
| michael@0 | 79 | nssPKILockType lockType; |
| michael@0 | 80 | /* XXX with LRU cache, this cannot be guaranteed up-to-date. It cannot |
| michael@0 | 81 | * be compared against the update level of the trust domain, since it is |
| michael@0 | 82 | * also affected by import/export. Where is this array needed? |
| michael@0 | 83 | */ |
| michael@0 | 84 | nssCryptokiObject **instances; |
| michael@0 | 85 | PRUint32 numInstances; |
| michael@0 | 86 | /* The object must live in a trust domain */ |
| michael@0 | 87 | NSSTrustDomain *trustDomain; |
| michael@0 | 88 | /* The object may live in a crypto context */ |
| michael@0 | 89 | NSSCryptoContext *cryptoContext; |
| michael@0 | 90 | /* XXX added so temp certs can have nickname, think more ... */ |
| michael@0 | 91 | NSSUTF8 *tempName; |
| michael@0 | 92 | }; |
| michael@0 | 93 | |
| michael@0 | 94 | typedef struct nssDecodedCertStr nssDecodedCert; |
| michael@0 | 95 | |
| michael@0 | 96 | typedef struct nssCertificateStoreStr nssCertificateStore; |
| michael@0 | 97 | |
| michael@0 | 98 | /* How wide is the scope of this? */ |
| michael@0 | 99 | typedef struct nssSMIMEProfileStr nssSMIMEProfile; |
| michael@0 | 100 | |
| michael@0 | 101 | typedef struct nssPKIObjectStr nssPKIObject; |
| michael@0 | 102 | |
| michael@0 | 103 | struct NSSTrustStr |
| michael@0 | 104 | { |
| michael@0 | 105 | nssPKIObject object; |
| michael@0 | 106 | NSSCertificate *certificate; |
| michael@0 | 107 | nssTrustLevel serverAuth; |
| michael@0 | 108 | nssTrustLevel clientAuth; |
| michael@0 | 109 | nssTrustLevel emailProtection; |
| michael@0 | 110 | nssTrustLevel codeSigning; |
| michael@0 | 111 | PRBool stepUpApproved; |
| michael@0 | 112 | }; |
| michael@0 | 113 | |
| michael@0 | 114 | struct nssSMIMEProfileStr |
| michael@0 | 115 | { |
| michael@0 | 116 | nssPKIObject object; |
| michael@0 | 117 | NSSCertificate *certificate; |
| michael@0 | 118 | NSSASCII7 *email; |
| michael@0 | 119 | NSSDER *subject; |
| michael@0 | 120 | NSSItem *profileTime; |
| michael@0 | 121 | NSSItem *profileData; |
| michael@0 | 122 | }; |
| michael@0 | 123 | |
| michael@0 | 124 | struct NSSCertificateStr |
| michael@0 | 125 | { |
| michael@0 | 126 | nssPKIObject object; |
| michael@0 | 127 | NSSCertificateType type; |
| michael@0 | 128 | NSSItem id; |
| michael@0 | 129 | NSSBER encoding; |
| michael@0 | 130 | NSSDER issuer; |
| michael@0 | 131 | NSSDER subject; |
| michael@0 | 132 | NSSDER serial; |
| michael@0 | 133 | NSSASCII7 *email; |
| michael@0 | 134 | nssDecodedCert *decoding; |
| michael@0 | 135 | }; |
| michael@0 | 136 | |
| michael@0 | 137 | struct NSSPrivateKeyStr; |
| michael@0 | 138 | |
| michael@0 | 139 | struct NSSPublicKeyStr; |
| michael@0 | 140 | |
| michael@0 | 141 | struct NSSSymmetricKeyStr; |
| michael@0 | 142 | |
| michael@0 | 143 | typedef struct nssTDCertificateCacheStr nssTDCertificateCache; |
| michael@0 | 144 | |
| michael@0 | 145 | struct NSSTrustDomainStr { |
| michael@0 | 146 | PRInt32 refCount; |
| michael@0 | 147 | NSSArena *arena; |
| michael@0 | 148 | NSSCallback *defaultCallback; |
| michael@0 | 149 | nssList *tokenList; |
| michael@0 | 150 | nssListIterator *tokens; |
| michael@0 | 151 | nssTDCertificateCache *cache; |
| michael@0 | 152 | NSSRWLock *tokensLock; |
| michael@0 | 153 | void *spkDigestInfo; |
| michael@0 | 154 | CERTStatusConfig *statusConfig; |
| michael@0 | 155 | }; |
| michael@0 | 156 | |
| michael@0 | 157 | struct NSSCryptoContextStr |
| michael@0 | 158 | { |
| michael@0 | 159 | PRInt32 refCount; |
| michael@0 | 160 | NSSArena *arena; |
| michael@0 | 161 | NSSTrustDomain *td; |
| michael@0 | 162 | NSSToken *token; |
| michael@0 | 163 | nssSession *session; |
| michael@0 | 164 | nssCertificateStore *certStore; |
| michael@0 | 165 | }; |
| michael@0 | 166 | |
| michael@0 | 167 | struct NSSTimeStr { |
| michael@0 | 168 | PRTime prTime; |
| michael@0 | 169 | }; |
| michael@0 | 170 | |
| michael@0 | 171 | struct NSSCRLStr { |
| michael@0 | 172 | nssPKIObject object; |
| michael@0 | 173 | NSSDER encoding; |
| michael@0 | 174 | NSSUTF8 *url; |
| michael@0 | 175 | PRBool isKRL; |
| michael@0 | 176 | }; |
| michael@0 | 177 | |
| michael@0 | 178 | typedef struct NSSCRLStr NSSCRL; |
| michael@0 | 179 | |
| michael@0 | 180 | struct NSSPoliciesStr; |
| michael@0 | 181 | |
| michael@0 | 182 | struct NSSAlgorithmAndParametersStr; |
| michael@0 | 183 | |
| michael@0 | 184 | struct NSSPKIXCertificateStr; |
| michael@0 | 185 | |
| michael@0 | 186 | PR_END_EXTERN_C |
| michael@0 | 187 | |
| michael@0 | 188 | #endif /* PKIT_H */ |
