The Tor Browser: security/nss/lib/libpkix/include/pkix_revchecker.h@b8a032363ba2 (annotated)

security/nss/lib/libpkix/include/pkix_revchecker.h@b8a032363ba2 (annotated)

security/nss/lib/libpkix/include/pkix_revchecker.h

Thu, 22 Jan 2015 13:21:57 +0100

author: Michael Schloh von Bennewitz <michael@schloh.com>
date: Thu, 22 Jan 2015 13:21:57 +0100
branch: TOR_BUG_9701
changeset 15: b8a032363ba2
permissions: -rwxr-xr-x

Incorporate requested changes from Mozilla in review:
https://bugzilla.mozilla.org/show_bug.cgi?id=1123480#c6

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 /*
  * This file defines functions associated with the PKIX_RevocationChecker
  * type.
  *
  */
 #ifndef _PKIX_REVCHECKER_H
 #define _PKIX_REVCHECKER_H
 #include "pkixt.h"
 #include "pkix_pl_pki.h"
 #ifdef __cplusplus
 extern "C" {
 #endif
 /* General
  *
  * Please refer to the libpkix Programmer's Guide for detailed information
  * about how to use the libpkix library. Certain key warnings and notices from
  * that document are repeated here for emphasis.
  *
  * All identifiers in this file (and all public identifiers defined in
  * libpkix) begin with "PKIX_". Private identifiers only intended for use
  * within the library begin with "pkix_".
  *
  * A function returns NULL upon success, and a PKIX_Error pointer upon failure.
  *
  * Unless otherwise noted, for all accessor (gettor) functions that return a
  * PKIX_PL_Object pointer, callers should assume that this pointer refers to a
  * shared object. Therefore, the caller should treat this shared object as
  * read-only and should not modify this shared object. When done using the
  * shared object, the caller should release the reference to the object by
  * using the PKIX_PL_Object_DecRef function.
  *
  * While a function is executing, if its arguments (or anything referred to by
  * its arguments) are modified, free'd, or destroyed, the function's behavior
  * is undefined.
  *
  */
 /* PKIX_RevocationChecker
  *
  * PKIX_RevocationChecker provides a standard way of revocation checking.
  * Caller should configure two set of tests(represented at lists of
  * RevocationMethod objects) to be performed on the leaf and on the rest of
  * the chain certificates.
  *
  * PKIX_RevocationMethods provide a standard way for the caller to insert
  * their own custom revocation checks to verify the revocation status of
  * certificates. This may be useful in many scenarios, including when the
  * caller wishes to use their own revocation checking mechanism instead of (or
  * in addition to) the default revocation checking mechanism provided by
  * libpkix, which uses CRLs and OCSP.
  *
  * Once the caller has created the RevocationMethod object(s), the caller
  * then specifies the RevocationMethod object(s) in a RevocationCheck object
  * and sets it into a ProcessingParams.
  */
 /*
  * FUNCTION: PKIX_RevocationChecker_Create
  * DESCRIPTION:
  *
  * Creates revocation checker object with a given flags.
  *
  * PARAMETERS:
  *  "revDate"
  *      Revocation will be checked at this date. Current date is taken if the
  *      parameter is not specified.
  *  "leafMethodListFlags"
  *      Defines a set of method independent flags that will be used to check
  *      revocation of the leaf cert in the chain.
  *  "chainMethodListFlags"
  *      Defines a set of method independent flags that will be used to check
  *      revocation of the remaining certs in the chain.
  *  "pChecker"
  *      The return address of created checker.
  *  "plContext"
  *      Platform-specific context pointer.
  * THREAD SAFETY:
  *  Thread Safe
  *
  *  Multiple threads must be able to safely call this function without
  *  worrying about conflicts, even if they're operating on the same objects.
  * RETURNS:
  *  Returns NULL if the function succeeds.
  *  Returns a RevocationChecker Error if the function fails in a non-fatal way.
  *  Returns a Fatal Error if the function fails in an unrecoverable way.
  */
 PKIX_Error *
 PKIX_RevocationChecker_Create(
     PKIX_UInt32 leafMethodListFlags,
     PKIX_UInt32 chainMethodListFlags,
     PKIX_RevocationChecker **pChecker,
     void *plContext);
 /*
  * FUNCTION: PKIX_RevocationChecker_CreateAndAddMethod
  * DESCRIPTION:
  *
  * Creates revocation method object with given parameters and adds it
  * to revocation checker method list.
  *
  * PARAMETERS:
  *  "revChecker"
  *      Address of revocation checker structure.
  *  "procParams"
  *      Address of ProcessingParams used to initialize the checker.
  *      Must be non-NULL.
  *  "methodType"
  *      Type of the method. Currently only two types are
  *      supported: crl and ocsp. (See PKIX_RevocationMethodType enum).
  *  "methodFlags"
  *      Set of flags for the method.
  *  "methodPriority"
  *      Method priority. (0 corresponds to a highest priority)
  *  "verificationFn"
  *      User call back function that will perform validation of fetched
  *      revocation information(new crl or ocsp response)
  *  "isLeafMethod"
  *      Boolean flag that if set to true indicates that the method should
  *      should be used for leaf cert revocation test(false for chain set
  *      methods).
  *  "plContext"
  *      Platform-specific context pointer.
  * THREAD SAFETY:
  *  Thread Safe
  *
  *  Multiple threads must be able to safely call this function without
  *  worrying about conflicts, even if they're operating on the same objects.
  * RETURNS:
  *  Returns NULL if the function succeeds.
  *  Returns a RevocationChecker Error if the function fails in a non-fatal way.
  *  Returns a Fatal Error if the function fails in an unrecoverable way.
  */
 PKIX_Error *
 PKIX_RevocationChecker_CreateAndAddMethod(
     PKIX_RevocationChecker *revChecker,
     PKIX_ProcessingParams *params,
     PKIX_RevocationMethodType methodType,
     PKIX_UInt32 methodFlags,
     PKIX_UInt32 mathodPriority,
     PKIX_PL_VerifyCallback verificationFn,
     PKIX_Boolean isLeafMethod,
     void *plContext);
 /*
  * FUNCTION: PKIX_RevocationChecker_Check
  * DESCRIPTION:
  *
  * Verifies revocation status of the certificate. Issuer cert is given to
  * be used in verification of revocation information. Performed verification
  * check depends on configured revocation methods(ocsp, crl. See
  * PKIX_RevocationChecker_CreateAndAddMethod function) and a point of chain
  * building process at which PKIX_RevocationChecker_Check was invoked.
  * For security reasons, the cert status is checked only against cached
  * revocation information during chain building stage(no trust anchor yes has
  * been found). The fresh revocation information fetching is done only at chain
  * verification stage after trust anchor was identified.
  *
  * PARAMETERS:
  *  "cert"
  *      Address of Cert whose revocation status is to be determined.
  *      Must be non-NULL.
  *  "issuer"
  *      Issuer cert that potentially holds public key that will be used
  *      to verify revocation info.
  *  "revChecker"
  *      Address of revocation checker structure.
  *  "procParams"
  *      Address of ProcessingParams used to initialize the checker.
  *      Must be non-NULL.
  *  "chainVerificationState"
  *     Need to be set to true, if the check was called during chain verification
  *     as an opposite to chain building.
  *  "testingLeafCert"
  *     Set to true if verifying revocation status of a leaf cert.
  *  "revStatus"
  *     Address of the returned revocation status of the cert.
  *  "pResultCode"
  *      Address where revocation status will be stored. Must be non-NULL.
  *  "pNBIOContext"
  *      Address at which platform-dependent non-blocking I/O context is stored.
  *      Must be non-NULL.
  *  "plContext"
  *      Platform-specific context pointer.
  * THREAD SAFETY:
  *  Thread Safe
  *
  *  Multiple threads must be able to safely call this function without
  *  worrying about conflicts, even if they're operating on the same objects.
  * RETURNS:
  *  Returns NULL if the function succeeds.
  *  Returns a RevocationChecker Error if the function fails in a non-fatal way.
  *  Returns a Fatal Error if the function fails in an unrecoverable way.
  */
 PKIX_Error *
 PKIX_RevocationChecker_Check(PKIX_PL_Cert *cert,
                              PKIX_PL_Cert *issuer,
                              PKIX_RevocationChecker *revChecker,
                              PKIX_ProcessingParams *procParams,
                              PKIX_Boolean chainVerificationState,
                              PKIX_Boolean testingLeafCert,
                              PKIX_RevocationStatus *revStatus,
                              PKIX_UInt32 *pReasonCode,
                              void **pNbioContext,
                              void *plContext);
 #ifdef __cplusplus
 }
 #endif
 #endif /* _PKIX_REVCHECKER_H */

The Tor Browser / annotate

security/nss/lib/libpkix/include/pkix_revchecker.h@b8a032363ba2 (annotated)

security/nss/lib/libpkix/include/pkix_revchecker.h