michael@0: /* This Source Code Form is subject to the terms of the Mozilla Public michael@0: * License, v. 2.0. If a copy of the MPL was not distributed with this michael@0: * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ michael@0: michael@0: #ifndef NSSCKMDT_H michael@0: #define NSSCKMDT_H michael@0: michael@0: /* michael@0: * nssckmdt.h michael@0: * michael@0: * This file specifies the basic types that must be implemented by michael@0: * any Module using the NSS Cryptoki Framework. michael@0: */ michael@0: michael@0: #ifndef NSSBASET_H michael@0: #include "nssbaset.h" michael@0: #endif /* NSSBASET_H */ michael@0: michael@0: #ifndef NSSCKT_H michael@0: #include "nssckt.h" michael@0: #endif /* NSSCKT_H */ michael@0: michael@0: #ifndef NSSCKFWT_H michael@0: #include "nssckfwt.h" michael@0: #endif /* NSSCKFWT_H */ michael@0: michael@0: typedef struct NSSCKMDInstanceStr NSSCKMDInstance; michael@0: typedef struct NSSCKMDSlotStr NSSCKMDSlot; michael@0: typedef struct NSSCKMDTokenStr NSSCKMDToken; michael@0: typedef struct NSSCKMDSessionStr NSSCKMDSession; michael@0: typedef struct NSSCKMDCryptoOperationStr NSSCKMDCryptoOperation; michael@0: typedef struct NSSCKMDFindObjectsStr NSSCKMDFindObjects; michael@0: typedef struct NSSCKMDMechanismStr NSSCKMDMechanism; michael@0: typedef struct NSSCKMDObjectStr NSSCKMDObject; michael@0: michael@0: /* michael@0: * NSSCKFWItem michael@0: * michael@0: * This is a structure used by modules to return object attributes. michael@0: * The needsFreeing bit indicates whether the object needs to be freed. michael@0: * If so, the framework will call the FreeAttribute function on the item michael@0: * after it is done using it. michael@0: * michael@0: */ michael@0: michael@0: typedef struct { michael@0: PRBool needsFreeing; michael@0: NSSItem* item; michael@0: } NSSCKFWItem ; michael@0: michael@0: /* michael@0: * NSSCKMDInstance michael@0: * michael@0: * This is the basic handle for an instance of a PKCS#11 Module. michael@0: * It is returned by the Module's CreateInstance routine, and michael@0: * may be obtained from the corresponding NSSCKFWInstance object. michael@0: * It contains a pointer for use by the Module, to store any michael@0: * instance-related data, and it contains the EPV for a set of michael@0: * routines which the Module may implement for use by the Framework. michael@0: * Some of these routines are optional; others are mandatory. michael@0: */ michael@0: michael@0: struct NSSCKMDInstanceStr { michael@0: /* michael@0: * The Module may use this pointer for its own purposes. michael@0: */ michael@0: void *etc; michael@0: michael@0: /* michael@0: * This routine is called by the Framework to initialize michael@0: * the Module. This routine is optional; if unimplemented, michael@0: * it won't be called. If this routine returns an error, michael@0: * then the initialization will fail. michael@0: */ michael@0: CK_RV (PR_CALLBACK *Initialize)( michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: NSSUTF8 *configurationData michael@0: ); michael@0: michael@0: /* michael@0: * This routine is called when the Framework is finalizing michael@0: * the PKCS#11 Module. It is the last thing called before michael@0: * the NSSCKFWInstance's NSSArena is destroyed. This routine michael@0: * is optional; if unimplemented, it merely won't be called. michael@0: */ michael@0: void (PR_CALLBACK *Finalize)( michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance michael@0: ); michael@0: michael@0: /* michael@0: * This routine gets the number of slots. This value must michael@0: * never change, once the instance is initialized. This michael@0: * routine must be implemented. It may return zero on error. michael@0: */ michael@0: CK_ULONG (PR_CALLBACK *GetNSlots)( michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: CK_RV *pError michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns the version of the Cryptoki standard michael@0: * to which this Module conforms. This routine is optional; michael@0: * if unimplemented, the Framework uses the version to which michael@0: * ~it~ was implemented. michael@0: */ michael@0: CK_VERSION (PR_CALLBACK *GetCryptokiVersion)( michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns a pointer to a UTF8-encoded string michael@0: * containing the manufacturer ID for this Module. Only michael@0: * the characters completely encoded in the first thirty- michael@0: * two bytes are significant. This routine is optional. michael@0: * The string returned is never freed; if dynamically generated, michael@0: * the space for it should be allocated from the NSSArena michael@0: * that may be obtained from the NSSCKFWInstance. This michael@0: * routine may return NULL upon error; however if *pError michael@0: * is CKR_OK, the NULL will be considered the valid response. michael@0: */ michael@0: NSSUTF8 *(PR_CALLBACK *GetManufacturerID)( michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: CK_RV *pError michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns a pointer to a UTF8-encoded string michael@0: * containing a description of this Module library. Only michael@0: * the characters completely encoded in the first thirty- michael@0: * two bytes are significant. This routine is optional. michael@0: * The string returned is never freed; if dynamically generated, michael@0: * the space for it should be allocated from the NSSArena michael@0: * that may be obtained from the NSSCKFWInstance. This michael@0: * routine may return NULL upon error; however if *pError michael@0: * is CKR_OK, the NULL will be considered the valid response. michael@0: */ michael@0: NSSUTF8 *(PR_CALLBACK *GetLibraryDescription)( michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: CK_RV *pError michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns the version of this Module library. michael@0: * This routine is optional; if unimplemented, the Framework michael@0: * will assume a Module library version of 0.1. michael@0: */ michael@0: CK_VERSION (PR_CALLBACK *GetLibraryVersion)( michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns CK_TRUE if the Module wishes to michael@0: * handle session objects. This routine is optional. michael@0: * If this routine is NULL, or if it exists but returns michael@0: * CK_FALSE, the Framework will assume responsibility michael@0: * for managing session objects. michael@0: */ michael@0: CK_BBOOL (PR_CALLBACK *ModuleHandlesSessionObjects)( michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance michael@0: ); michael@0: michael@0: /* michael@0: * This routine stuffs pointers to NSSCKMDSlot objects into michael@0: * the specified array; one for each slot supported by this michael@0: * instance. The Framework will determine the size needed michael@0: * for the array by calling GetNSlots. This routine is michael@0: * required. michael@0: */ michael@0: CK_RV (PR_CALLBACK *GetSlots)( michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: NSSCKMDSlot *slots[] michael@0: ); michael@0: michael@0: /* michael@0: * This call returns a pointer to the slot in which an event michael@0: * has occurred. If the block argument is CK_TRUE, the call michael@0: * should block until a slot event occurs; if CK_FALSE, it michael@0: * should check to see if an event has occurred, occurred, michael@0: * but return NULL (and set *pError to CK_NO_EVENT) if one michael@0: * hasn't. This routine is optional; if unimplemented, the michael@0: * Framework will assume that no event has happened. This michael@0: * routine may return NULL upon error. michael@0: */ michael@0: NSSCKMDSlot *(PR_CALLBACK *WaitForSlotEvent)( michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: CK_BBOOL block, michael@0: CK_RV *pError michael@0: ); michael@0: michael@0: /* michael@0: * This object may be extended in future versions of the michael@0: * NSS Cryptoki Framework. To allow for some flexibility michael@0: * in the area of binary compatibility, this field should michael@0: * be NULL. michael@0: */ michael@0: void *null; michael@0: }; michael@0: michael@0: michael@0: /* michael@0: * NSSCKMDSlot michael@0: * michael@0: * This is the basic handle for a PKCS#11 Module Slot. It is michael@0: * created by the NSSCKMDInstance->GetSlots call, and may be michael@0: * obtained from the Framework's corresponding NSSCKFWSlot michael@0: * object. It contains a pointer for use by the Module, to michael@0: * store any slot-related data, and it contains the EPV for michael@0: * a set of routines which the Module may implement for use michael@0: * by the Framework. Some of these routines are optional. michael@0: */ michael@0: michael@0: struct NSSCKMDSlotStr { michael@0: /* michael@0: * The Module may use this pointer for its own purposes. michael@0: */ michael@0: void *etc; michael@0: michael@0: /* michael@0: * This routine is called during the Framework initialization michael@0: * step, after the Framework Instance has obtained the list michael@0: * of slots (by calling NSSCKMDInstance->GetSlots). Any slot- michael@0: * specific initialization can be done here. This routine is michael@0: * optional; if unimplemented, it won't be called. Note that michael@0: * if this routine returns an error, the entire Framework michael@0: * initialization for this Module will fail. michael@0: */ michael@0: CK_RV (PR_CALLBACK *Initialize)( michael@0: NSSCKMDSlot *mdSlot, michael@0: NSSCKFWSlot *fwSlot, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance michael@0: ); michael@0: michael@0: /* michael@0: * This routine is called when the Framework is finalizing michael@0: * the PKCS#11 Module. This call (for each of the slots) michael@0: * is the last thing called before NSSCKMDInstance->Finalize. michael@0: * This routine is optional; if unimplemented, it merely michael@0: * won't be called. Note: In the rare circumstance that michael@0: * the Framework initialization cannot complete (due to, michael@0: * for example, memory limitations), this can be called with michael@0: * a NULL value for fwSlot. michael@0: */ michael@0: void (PR_CALLBACK *Destroy)( michael@0: NSSCKMDSlot *mdSlot, michael@0: NSSCKFWSlot *fwSlot, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns a pointer to a UTF8-encoded string michael@0: * containing a description of this slot. Only the characters michael@0: * completely encoded in the first sixty-four bytes are michael@0: * significant. This routine is optional. The string michael@0: * returned is never freed; if dynamically generated, michael@0: * the space for it should be allocated from the NSSArena michael@0: * that may be obtained from the NSSCKFWInstance. This michael@0: * routine may return NULL upon error; however if *pError michael@0: * is CKR_OK, the NULL will be considered the valid response. michael@0: */ michael@0: NSSUTF8 *(PR_CALLBACK *GetSlotDescription)( michael@0: NSSCKMDSlot *mdSlot, michael@0: NSSCKFWSlot *fwSlot, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: CK_RV *pError michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns a pointer to a UTF8-encoded string michael@0: * containing a description of the manufacturer of this slot. michael@0: * Only the characters completely encoded in the first thirty- michael@0: * two bytes are significant. This routine is optional. michael@0: * The string returned is never freed; if dynamically generated, michael@0: * the space for it should be allocated from the NSSArena michael@0: * that may be obtained from the NSSCKFWInstance. This michael@0: * routine may return NULL upon error; however if *pError michael@0: * is CKR_OK, the NULL will be considered the valid response. michael@0: */ michael@0: NSSUTF8 *(PR_CALLBACK *GetManufacturerID)( michael@0: NSSCKMDSlot *mdSlot, michael@0: NSSCKFWSlot *fwSlot, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: CK_RV *pError michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns CK_TRUE if a token is present in this michael@0: * slot. This routine is optional; if unimplemented, CK_TRUE michael@0: * is assumed. michael@0: */ michael@0: CK_BBOOL (PR_CALLBACK *GetTokenPresent)( michael@0: NSSCKMDSlot *mdSlot, michael@0: NSSCKFWSlot *fwSlot, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns CK_TRUE if the slot supports removable michael@0: * tokens. This routine is optional; if unimplemented, CK_FALSE michael@0: * is assumed. michael@0: */ michael@0: CK_BBOOL (PR_CALLBACK *GetRemovableDevice)( michael@0: NSSCKMDSlot *mdSlot, michael@0: NSSCKFWSlot *fwSlot, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns CK_TRUE if this slot is a hardware michael@0: * device, or CK_FALSE if this slot is a software device. This michael@0: * routine is optional; if unimplemented, CK_FALSE is assumed. michael@0: */ michael@0: CK_BBOOL (PR_CALLBACK *GetHardwareSlot)( michael@0: NSSCKMDSlot *mdSlot, michael@0: NSSCKFWSlot *fwSlot, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns the version of this slot's hardware. michael@0: * This routine is optional; if unimplemented, the Framework michael@0: * will assume a hardware version of 0.1. michael@0: */ michael@0: CK_VERSION (PR_CALLBACK *GetHardwareVersion)( michael@0: NSSCKMDSlot *mdSlot, michael@0: NSSCKFWSlot *fwSlot, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns the version of this slot's firmware. michael@0: * This routine is optional; if unimplemented, the Framework michael@0: * will assume a hardware version of 0.1. michael@0: */ michael@0: CK_VERSION (PR_CALLBACK *GetFirmwareVersion)( michael@0: NSSCKMDSlot *mdSlot, michael@0: NSSCKFWSlot *fwSlot, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance michael@0: ); michael@0: michael@0: /* michael@0: * This routine should return a pointer to an NSSCKMDToken michael@0: * object corresponding to the token in the specified slot. michael@0: * The NSSCKFWToken object passed in has an NSSArena michael@0: * available which is dedicated for this token. This routine michael@0: * must be implemented. This routine may return NULL upon michael@0: * error. michael@0: */ michael@0: NSSCKMDToken *(PR_CALLBACK *GetToken)( michael@0: NSSCKMDSlot *mdSlot, michael@0: NSSCKFWSlot *fwSlot, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: CK_RV *pError michael@0: ); michael@0: michael@0: /* michael@0: * This object may be extended in future versions of the michael@0: * NSS Cryptoki Framework. To allow for some flexibility michael@0: * in the area of binary compatibility, this field should michael@0: * be NULL. michael@0: */ michael@0: void *null; michael@0: }; michael@0: michael@0: /* michael@0: * NSSCKMDToken michael@0: * michael@0: * This is the basic handle for a PKCS#11 Token. It is created by michael@0: * the NSSCKMDSlot->GetToken call, and may be obtained from the michael@0: * Framework's corresponding NSSCKFWToken object. It contains a michael@0: * pointer for use by the Module, to store any token-related michael@0: * data, and it contains the EPV for a set of routines which the michael@0: * Module may implement for use by the Framework. Some of these michael@0: * routines are optional. michael@0: */ michael@0: michael@0: struct NSSCKMDTokenStr { michael@0: /* michael@0: * The Module may use this pointer for its own purposes. michael@0: */ michael@0: void *etc; michael@0: michael@0: /* michael@0: * This routine is used to prepare a Module token object for michael@0: * use. It is called after the NSSCKMDToken object is obtained michael@0: * from NSSCKMDSlot->GetToken. It is named "Setup" here because michael@0: * Cryptoki already defines "InitToken" to do the process of michael@0: * wiping out any existing state on a token and preparing it for michael@0: * a new use. This routine is optional; if unimplemented, it michael@0: * merely won't be called. michael@0: */ michael@0: CK_RV (PR_CALLBACK *Setup)( michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance michael@0: ); michael@0: michael@0: /* michael@0: * This routine is called by the Framework whenever it notices michael@0: * that the token object is invalid. (Typically this is when a michael@0: * routine indicates an error such as CKR_DEVICE_REMOVED). This michael@0: * call is the last thing called before the NSSArena in the michael@0: * corresponding NSSCKFWToken is destroyed. This routine is michael@0: * optional; if unimplemented, it merely won't be called. michael@0: */ michael@0: void (PR_CALLBACK *Invalidate)( michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance michael@0: ); michael@0: michael@0: /* michael@0: * This routine initialises the token in the specified slot. michael@0: * This routine is optional; if unimplemented, the Framework michael@0: * will fail this operation with an error of CKR_DEVICE_ERROR. michael@0: */ michael@0: michael@0: CK_RV (PR_CALLBACK *InitToken)( michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: NSSItem *pin, michael@0: NSSUTF8 *label michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns a pointer to a UTF8-encoded string michael@0: * containing this token's label. Only the characters michael@0: * completely encoded in the first thirty-two bytes are michael@0: * significant. This routine is optional. The string michael@0: * returned is never freed; if dynamically generated, michael@0: * the space for it should be allocated from the NSSArena michael@0: * that may be obtained from the NSSCKFWInstance. This michael@0: * routine may return NULL upon error; however if *pError michael@0: * is CKR_OK, the NULL will be considered the valid response. michael@0: */ michael@0: NSSUTF8 *(PR_CALLBACK *GetLabel)( michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: CK_RV *pError michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns a pointer to a UTF8-encoded string michael@0: * containing this token's manufacturer ID. Only the characters michael@0: * completely encoded in the first thirty-two bytes are michael@0: * significant. This routine is optional. The string michael@0: * returned is never freed; if dynamically generated, michael@0: * the space for it should be allocated from the NSSArena michael@0: * that may be obtained from the NSSCKFWInstance. This michael@0: * routine may return NULL upon error; however if *pError michael@0: * is CKR_OK, the NULL will be considered the valid response. michael@0: */ michael@0: NSSUTF8 *(PR_CALLBACK *GetManufacturerID)( michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: CK_RV *pError michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns a pointer to a UTF8-encoded string michael@0: * containing this token's model name. Only the characters michael@0: * completely encoded in the first thirty-two bytes are michael@0: * significant. This routine is optional. The string michael@0: * returned is never freed; if dynamically generated, michael@0: * the space for it should be allocated from the NSSArena michael@0: * that may be obtained from the NSSCKFWInstance. This michael@0: * routine may return NULL upon error; however if *pError michael@0: * is CKR_OK, the NULL will be considered the valid response. michael@0: */ michael@0: NSSUTF8 *(PR_CALLBACK *GetModel)( michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: CK_RV *pError michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns a pointer to a UTF8-encoded string michael@0: * containing this token's serial number. Only the characters michael@0: * completely encoded in the first thirty-two bytes are michael@0: * significant. This routine is optional. The string michael@0: * returned is never freed; if dynamically generated, michael@0: * the space for it should be allocated from the NSSArena michael@0: * that may be obtained from the NSSCKFWInstance. This michael@0: * routine may return NULL upon error; however if *pError michael@0: * is CKR_OK, the NULL will be considered the valid response. michael@0: */ michael@0: NSSUTF8 *(PR_CALLBACK *GetSerialNumber)( michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: CK_RV *pError michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns CK_TRUE if the token has its own michael@0: * random number generator. This routine is optional; if michael@0: * unimplemented, CK_FALSE is assumed. michael@0: */ michael@0: CK_BBOOL (PR_CALLBACK *GetHasRNG)( michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns CK_TRUE if this token is write-protected. michael@0: * This routine is optional; if unimplemented, CK_FALSE is michael@0: * assumed. michael@0: */ michael@0: CK_BBOOL (PR_CALLBACK *GetIsWriteProtected)( michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns CK_TRUE if this token requires a login. michael@0: * This routine is optional; if unimplemented, CK_FALSE is michael@0: * assumed. michael@0: */ michael@0: CK_BBOOL (PR_CALLBACK *GetLoginRequired)( michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns CK_TRUE if the normal user's PIN on this michael@0: * token has been initialised. This routine is optional; if michael@0: * unimplemented, CK_FALSE is assumed. michael@0: */ michael@0: CK_BBOOL (PR_CALLBACK *GetUserPinInitialized)( michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns CK_TRUE if a successful save of a michael@0: * session's cryptographic operations state ~always~ contains michael@0: * all keys needed to restore the state of the session. This michael@0: * routine is optional; if unimplemented, CK_FALSE is assumed. michael@0: */ michael@0: CK_BBOOL (PR_CALLBACK *GetRestoreKeyNotNeeded)( michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns CK_TRUE if the token has its own michael@0: * hardware clock. This routine is optional; if unimplemented, michael@0: * CK_FALSE is assumed. michael@0: */ michael@0: CK_BBOOL (PR_CALLBACK *GetHasClockOnToken)( michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns CK_TRUE if the token has a protected michael@0: * authentication path. This routine is optional; if michael@0: * unimplemented, CK_FALSE is assumed. michael@0: */ michael@0: CK_BBOOL (PR_CALLBACK *GetHasProtectedAuthenticationPath)( michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns CK_TRUE if the token supports dual michael@0: * cryptographic operations within a single session. This michael@0: * routine is optional; if unimplemented, CK_FALSE is assumed. michael@0: */ michael@0: CK_BBOOL (PR_CALLBACK *GetSupportsDualCryptoOperations)( michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance michael@0: ); michael@0: michael@0: /* michael@0: * XXX fgmr-- should we have a call to return all the flags michael@0: * at once, for folks who already know about Cryptoki? michael@0: */ michael@0: michael@0: /* michael@0: * This routine returns the maximum number of sessions that michael@0: * may be opened on this token. This routine is optional; michael@0: * if unimplemented, the special value CK_UNAVAILABLE_INFORMATION michael@0: * is assumed. XXX fgmr-- or CK_EFFECTIVELY_INFINITE? michael@0: */ michael@0: CK_ULONG (PR_CALLBACK *GetMaxSessionCount)( michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns the maximum number of read/write michael@0: * sesisons that may be opened on this token. This routine michael@0: * is optional; if unimplemented, the special value michael@0: * CK_UNAVAILABLE_INFORMATION is assumed. XXX fgmr-- or michael@0: * CK_EFFECTIVELY_INFINITE? michael@0: */ michael@0: CK_ULONG (PR_CALLBACK *GetMaxRwSessionCount)( michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns the maximum PIN code length that is michael@0: * supported on this token. This routine is optional; michael@0: * if unimplemented, the special value CK_UNAVAILABLE_INFORMATION michael@0: * is assumed. michael@0: */ michael@0: CK_ULONG (PR_CALLBACK *GetMaxPinLen)( michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns the minimum PIN code length that is michael@0: * supported on this token. This routine is optional; if michael@0: * unimplemented, the special value CK_UNAVAILABLE_INFORMATION michael@0: * is assumed. XXX fgmr-- or 0? michael@0: */ michael@0: CK_ULONG (PR_CALLBACK *GetMinPinLen)( michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns the total amount of memory on the token michael@0: * in which public objects may be stored. This routine is michael@0: * optional; if unimplemented, the special value michael@0: * CK_UNAVAILABLE_INFORMATION is assumed. michael@0: */ michael@0: CK_ULONG (PR_CALLBACK *GetTotalPublicMemory)( michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns the amount of unused memory on the michael@0: * token in which public objects may be stored. This routine michael@0: * is optional; if unimplemented, the special value michael@0: * CK_UNAVAILABLE_INFORMATION is assumed. michael@0: */ michael@0: CK_ULONG (PR_CALLBACK *GetFreePublicMemory)( michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns the total amount of memory on the token michael@0: * in which private objects may be stored. This routine is michael@0: * optional; if unimplemented, the special value michael@0: * CK_UNAVAILABLE_INFORMATION is assumed. michael@0: */ michael@0: CK_ULONG (PR_CALLBACK *GetTotalPrivateMemory)( michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns the amount of unused memory on the michael@0: * token in which private objects may be stored. This routine michael@0: * is optional; if unimplemented, the special value michael@0: * CK_UNAVAILABLE_INFORMATION is assumed. michael@0: */ michael@0: CK_ULONG (PR_CALLBACK *GetFreePrivateMemory)( michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns the version number of this token's michael@0: * hardware. This routine is optional; if unimplemented, michael@0: * the value 0.1 is assumed. michael@0: */ michael@0: CK_VERSION (PR_CALLBACK *GetHardwareVersion)( michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns the version number of this token's michael@0: * firmware. This routine is optional; if unimplemented, michael@0: * the value 0.1 is assumed. michael@0: */ michael@0: CK_VERSION (PR_CALLBACK *GetFirmwareVersion)( michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance michael@0: ); michael@0: michael@0: /* michael@0: * This routine stuffs the current UTC time, as obtained from michael@0: * the token, into the sixteen-byte buffer in the form michael@0: * YYYYMMDDhhmmss00. This routine need only be implemented michael@0: * by token which indicate that they have a real-time clock. michael@0: * XXX fgmr-- think about time formats. michael@0: */ michael@0: CK_RV (PR_CALLBACK *GetUTCTime)( michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: CK_CHAR utcTime[16] michael@0: ); michael@0: michael@0: /* michael@0: * This routine creates a session on the token, and returns michael@0: * the corresponding NSSCKMDSession object. The value of michael@0: * rw will be CK_TRUE if the session is to be a read/write michael@0: * session, or CK_FALSE otherwise. An NSSArena dedicated to michael@0: * the new session is available from the specified NSSCKFWSession. michael@0: * This routine may return NULL upon error. michael@0: */ michael@0: NSSCKMDSession *(PR_CALLBACK *OpenSession)( michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: NSSCKFWSession *fwSession, michael@0: CK_BBOOL rw, michael@0: CK_RV *pError michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns the number of PKCS#11 Mechanisms michael@0: * supported by this token. This routine is optional; if michael@0: * unimplemented, zero is assumed. michael@0: */ michael@0: CK_ULONG (PR_CALLBACK *GetMechanismCount)( michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance michael@0: ); michael@0: michael@0: /* michael@0: * This routine stuffs into the specified array the types michael@0: * of the mechanisms supported by this token. The Framework michael@0: * determines the size of the array by calling GetMechanismCount. michael@0: */ michael@0: CK_RV (PR_CALLBACK *GetMechanismTypes)( michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: CK_MECHANISM_TYPE types[] michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns a pointer to a Module mechanism michael@0: * object corresponding to a specified type. This routine michael@0: * need only exist for tokens implementing at least one michael@0: * mechanism. michael@0: */ michael@0: NSSCKMDMechanism *(PR_CALLBACK *GetMechanism)( michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: CK_MECHANISM_TYPE which, michael@0: CK_RV *pError michael@0: ); michael@0: michael@0: /* michael@0: * This object may be extended in future versions of the michael@0: * NSS Cryptoki Framework. To allow for some flexibility michael@0: * in the area of binary compatibility, this field should michael@0: * be NULL. michael@0: */ michael@0: void *null; michael@0: }; michael@0: michael@0: /* michael@0: * NSSCKMDSession michael@0: * michael@0: * This is the basic handle for a session on a PKCS#11 Token. It michael@0: * is created by NSSCKMDToken->OpenSession, and may be obtained michael@0: * from the Framework's corresponding NSSCKFWSession object. It michael@0: * contains a pointer for use by the Module, to store any session- michael@0: * realted data, and it contains the EPV for a set of routines michael@0: * which the Module may implement for use by the Framework. Some michael@0: * of these routines are optional. michael@0: */ michael@0: michael@0: struct NSSCKMDSessionStr { michael@0: /* michael@0: * The Module may use this pointer for its own purposes. michael@0: */ michael@0: void *etc; michael@0: michael@0: /* michael@0: * This routine is called by the Framework when a session is michael@0: * closed. This call is the last thing called before the michael@0: * NSSArena in the correspoinding NSSCKFWSession is destroyed. michael@0: * This routine is optional; if unimplemented, it merely won't michael@0: * be called. michael@0: */ michael@0: void (PR_CALLBACK *Close)( michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance michael@0: ); michael@0: michael@0: /* michael@0: * This routine is used to get any device-specific error. michael@0: * This routine is optional. michael@0: */ michael@0: CK_ULONG (PR_CALLBACK *GetDeviceError)( michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance michael@0: ); michael@0: michael@0: /* michael@0: * This routine is used to log in a user to the token. This michael@0: * routine is optional, since the Framework's NSSCKFWSession michael@0: * object keeps track of the login state. michael@0: */ michael@0: CK_RV (PR_CALLBACK *Login)( michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: CK_USER_TYPE userType, michael@0: NSSItem *pin, michael@0: CK_STATE oldState, michael@0: CK_STATE newState michael@0: ); michael@0: michael@0: /* michael@0: * This routine is used to log out a user from the token. This michael@0: * routine is optional, since the Framework's NSSCKFWSession michael@0: * object keeps track of the login state. michael@0: */ michael@0: CK_RV (PR_CALLBACK *Logout)( michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: CK_STATE oldState, michael@0: CK_STATE newState michael@0: ); michael@0: michael@0: /* michael@0: * This routine is used to initialize the normal user's PIN or michael@0: * password. This will only be called in the "read/write michael@0: * security officer functions" state. If this token has a michael@0: * protected authentication path, then the pin argument will michael@0: * be NULL. This routine is optional; if unimplemented, the michael@0: * Framework will return the error CKR_TOKEN_WRITE_PROTECTED. michael@0: */ michael@0: CK_RV (PR_CALLBACK *InitPIN)( michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: NSSItem *pin michael@0: ); michael@0: michael@0: /* michael@0: * This routine is used to modify a user's PIN or password. This michael@0: * routine will only be called in the "read/write security officer michael@0: * functions" or "read/write user functions" state. If this token michael@0: * has a protected authentication path, then the pin arguments michael@0: * will be NULL. This routine is optional; if unimplemented, the michael@0: * Framework will return the error CKR_TOKEN_WRITE_PROTECTED. michael@0: */ michael@0: CK_RV (PR_CALLBACK *SetPIN)( michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: NSSItem *oldPin, michael@0: NSSItem *newPin michael@0: ); michael@0: michael@0: /* michael@0: * This routine is used to find out how much space would be required michael@0: * to save the current operational state. This routine is optional; michael@0: * if unimplemented, the Framework will reject any attempts to save michael@0: * the operational state with the error CKR_STATE_UNSAVEABLE. This michael@0: * routine may return zero on error. michael@0: */ michael@0: CK_ULONG (PR_CALLBACK *GetOperationStateLen)( michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: CK_RV *pError michael@0: ); michael@0: michael@0: /* michael@0: * This routine is used to store the current operational state. This michael@0: * routine is only required if GetOperationStateLen is implemented michael@0: * and can return a nonzero value. The buffer in the specified item michael@0: * will be pre-allocated, and the length will specify the amount of michael@0: * space available (which may be more than GetOperationStateLen michael@0: * asked for, but which will not be smaller). michael@0: */ michael@0: CK_RV (PR_CALLBACK *GetOperationState)( michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: NSSItem *buffer michael@0: ); michael@0: michael@0: /* michael@0: * This routine is used to restore an operational state previously michael@0: * obtained with GetOperationState. The Framework will take pains michael@0: * to be sure that the state is (or was at one point) valid; if the michael@0: * Module notices that the state is invalid, it should return an michael@0: * error, but it is not required to be paranoid about the issue. michael@0: * [XXX fgmr-- should (can?) the framework verify the keys match up?] michael@0: * This routine is required only if GetOperationState is implemented. michael@0: */ michael@0: CK_RV (PR_CALLBACK *SetOperationState)( michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: NSSItem *state, michael@0: NSSCKMDObject *mdEncryptionKey, michael@0: NSSCKFWObject *fwEncryptionKey, michael@0: NSSCKMDObject *mdAuthenticationKey, michael@0: NSSCKFWObject *fwAuthenticationKey michael@0: ); michael@0: michael@0: /* michael@0: * This routine is used to create an object. The specified template michael@0: * will only specify a session object if the Module has indicated michael@0: * that it wishes to handle its own session objects. This routine michael@0: * is optional; if unimplemented, the Framework will reject the michael@0: * operation with the error CKR_TOKEN_WRITE_PROTECTED. Space for michael@0: * token objects should come from the NSSArena available from the michael@0: * NSSCKFWToken object; space for session objects (if supported) michael@0: * should come from the NSSArena available from the NSSCKFWSession michael@0: * object. The appropriate NSSArena pointer will, as a convenience, michael@0: * be passed as the handyArenaPointer argument. This routine may michael@0: * return NULL upon error. michael@0: */ michael@0: NSSCKMDObject *(PR_CALLBACK *CreateObject)( michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: NSSArena *handyArenaPointer, michael@0: CK_ATTRIBUTE_PTR pTemplate, michael@0: CK_ULONG ulAttributeCount, michael@0: CK_RV *pError michael@0: ); michael@0: michael@0: /* michael@0: * This routine is used to make a copy of an object. It is entirely michael@0: * optional; if unimplemented, the Framework will try to use michael@0: * CreateObject instead. If the Module has indicated that it does michael@0: * not wish to handle session objects, then this routine will only michael@0: * be called to copy a token object to another token object. michael@0: * Otherwise, either the original object or the new may be of michael@0: * either the token or session variety. As with CreateObject, the michael@0: * handyArenaPointer will point to the appropriate arena for the michael@0: * new object. This routine may return NULL upon error. michael@0: */ michael@0: NSSCKMDObject *(PR_CALLBACK *CopyObject)( michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: NSSCKMDObject *mdOldObject, michael@0: NSSCKFWObject *fwOldObject, michael@0: NSSArena *handyArenaPointer, michael@0: CK_ATTRIBUTE_PTR pTemplate, michael@0: CK_ULONG ulAttributeCount, michael@0: CK_RV *pError michael@0: ); michael@0: michael@0: /* michael@0: * This routine is used to begin an object search. This routine may michael@0: * be unimplemented only if the Module does not handle session michael@0: * objects, and if none of its tokens have token objects. The michael@0: * NSSCKFWFindObjects pointer has an NSSArena that may be used for michael@0: * storage for the life of this "find" operation. This routine may michael@0: * return NULL upon error. If the Module can determine immediately michael@0: * that the search will not find any matching objects, it may return michael@0: * NULL, and specify CKR_OK as the error. michael@0: */ michael@0: NSSCKMDFindObjects *(PR_CALLBACK *FindObjectsInit)( michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: CK_ATTRIBUTE_PTR pTemplate, michael@0: CK_ULONG ulAttributeCount, michael@0: CK_RV *pError michael@0: ); michael@0: michael@0: /* michael@0: * This routine seeds the random-number generator. It is michael@0: * optional, even if GetRandom is implemented. If unimplemented, michael@0: * the Framework will issue the error CKR_RANDOM_SEED_NOT_SUPPORTED. michael@0: */ michael@0: CK_RV (PR_CALLBACK *SeedRandom)( michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: NSSItem *seed michael@0: ); michael@0: michael@0: /* michael@0: * This routine gets random data. It is optional. If unimplemented, michael@0: * the Framework will issue the error CKR_RANDOM_NO_RNG. michael@0: */ michael@0: CK_RV (PR_CALLBACK *GetRandom)( michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: NSSItem *buffer michael@0: ); michael@0: michael@0: /* michael@0: * This object may be extended in future versions of the michael@0: * NSS Cryptoki Framework. To allow for some flexibility michael@0: * in the area of binary compatibility, this field should michael@0: * be NULL. michael@0: */ michael@0: void *null; michael@0: }; michael@0: michael@0: /* michael@0: * NSSCKMDFindObjects michael@0: * michael@0: * This is the basic handle for an object search. It is michael@0: * created by NSSCKMDSession->FindObjectsInit, and may be michael@0: * obtained from the Framework's corresponding object. michael@0: * It contains a pointer for use by the Module, to store michael@0: * any search-related data, and it contains the EPV for a michael@0: * set of routines which the Module may implement for use michael@0: * by the Framework. Some of these routines are optional. michael@0: */ michael@0: michael@0: struct NSSCKMDFindObjectsStr { michael@0: /* michael@0: * The Module may use this pointer for its own purposes. michael@0: */ michael@0: void *etc; michael@0: michael@0: /* michael@0: * This routine is called by the Framework to finish a michael@0: * search operation. Note that the Framework may finish michael@0: * a search before it has completed. This routine is michael@0: * optional; if unimplemented, it merely won't be called. michael@0: */ michael@0: void (PR_CALLBACK *Final)( michael@0: NSSCKMDFindObjects *mdFindObjects, michael@0: NSSCKFWFindObjects *fwFindObjects, michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance michael@0: ); michael@0: michael@0: /* michael@0: * This routine is used to obtain another pointer to an michael@0: * object matching the search criteria. This routine is michael@0: * required. If no (more) objects match the search, it michael@0: * should return NULL and set the error to CKR_OK. michael@0: */ michael@0: NSSCKMDObject *(PR_CALLBACK *Next)( michael@0: NSSCKMDFindObjects *mdFindObjects, michael@0: NSSCKFWFindObjects *fwFindObjects, michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: NSSArena *arena, michael@0: CK_RV *pError michael@0: ); michael@0: michael@0: /* michael@0: * This object may be extended in future versions of the michael@0: * NSS Cryptoki Framework. To allow for some flexibility michael@0: * in the area of binary compatibility, this field should michael@0: * be NULL. michael@0: */ michael@0: void *null; michael@0: }; michael@0: michael@0: /* michael@0: * NSSCKMDCryptoOperaion michael@0: * michael@0: * This is the basic handle for an encryption, decryption, michael@0: * sign, verify, or hash opertion. michael@0: * created by NSSCKMDMechanism->XXXXInit, and may be michael@0: * obtained from the Framework's corresponding object. michael@0: * It contains a pointer for use by the Module, to store michael@0: * any intermediate data, and it contains the EPV for a michael@0: * set of routines which the Module may implement for use michael@0: * by the Framework. Some of these routines are optional. michael@0: */ michael@0: michael@0: struct NSSCKMDCryptoOperationStr { michael@0: /* michael@0: * The Module may use this pointer for its own purposes. michael@0: */ michael@0: void *etc; michael@0: michael@0: /* michael@0: * This routine is called by the Framework clean up the mdCryptoOperation michael@0: * structure. michael@0: * This routine is optional; if unimplemented, it will be ignored. michael@0: */ michael@0: void (PR_CALLBACK *Destroy)( michael@0: NSSCKMDCryptoOperation *mdCryptoOperation, michael@0: NSSCKFWCryptoOperation *fwCryptoOperation, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance michael@0: ); michael@0: michael@0: michael@0: /* michael@0: * how many bytes do we need to finish this buffer? michael@0: * must be implemented if Final is implemented. michael@0: */ michael@0: CK_ULONG (PR_CALLBACK *GetFinalLength)( michael@0: NSSCKMDCryptoOperation *mdCryptoOperation, michael@0: NSSCKFWCryptoOperation *fwCryptoOperation, michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: CK_RV *pError michael@0: ); michael@0: michael@0: /* michael@0: * how many bytes do we need to complete the next operation. michael@0: * used in both Update and UpdateFinal. michael@0: */ michael@0: CK_ULONG (PR_CALLBACK *GetOperationLength)( michael@0: NSSCKMDCryptoOperation *mdCryptoOperation, michael@0: NSSCKFWCryptoOperation *fwCryptoOperation, michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: const NSSItem *inputBuffer, michael@0: CK_RV *pError michael@0: ); michael@0: michael@0: /* michael@0: * This routine is called by the Framework to finish a michael@0: * search operation. Note that the Framework may finish michael@0: * a search before it has completed. This routine is michael@0: * optional; if unimplemented, it merely won't be called. michael@0: * The respective final call with fail with CKR_FUNCTION_FAILED michael@0: * Final should not free the mdCryptoOperation. michael@0: */ michael@0: CK_RV(PR_CALLBACK *Final)( michael@0: NSSCKMDCryptoOperation *mdCryptoOperation, michael@0: NSSCKFWCryptoOperation *fwCryptoOperation, michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: NSSItem *outputBuffer michael@0: ); michael@0: michael@0: michael@0: /* michael@0: * This routine is called by the Framework to complete the michael@0: * next step in an encryption/decryption operation. michael@0: * This routine is optional; if unimplemented, the respective michael@0: * update call with fail with CKR_FUNCTION_FAILED. michael@0: * Update should not be implemented for signing/verification/digest michael@0: * mechanisms. michael@0: */ michael@0: CK_RV(PR_CALLBACK *Update)( michael@0: NSSCKMDCryptoOperation *mdCryptoOperation, michael@0: NSSCKFWCryptoOperation *fwCryptoOperation, michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: const NSSItem *inputBuffer, michael@0: NSSItem *outputBuffer michael@0: ); michael@0: michael@0: /* michael@0: * This routine is called by the Framework to complete the michael@0: * next step in a signing/verification/digest operation. michael@0: * This routine is optional; if unimplemented, the respective michael@0: * update call with fail with CKR_FUNCTION_FAILED michael@0: * Update should not be implemented for encryption/decryption michael@0: * mechanisms. michael@0: */ michael@0: CK_RV(PR_CALLBACK *DigestUpdate)( michael@0: NSSCKMDCryptoOperation *mdCryptoOperation, michael@0: NSSCKFWCryptoOperation *fwCryptoOperation, michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: const NSSItem *inputBuffer michael@0: ); michael@0: michael@0: /* michael@0: * This routine is called by the Framework to complete a michael@0: * single step operation. This routine is optional; if unimplemented, michael@0: * the framework will use the Update and Final functions to complete michael@0: * the operation. michael@0: */ michael@0: CK_RV(PR_CALLBACK *UpdateFinal)( michael@0: NSSCKMDCryptoOperation *mdCryptoOperation, michael@0: NSSCKFWCryptoOperation *fwCryptoOperation, michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: const NSSItem *inputBuffer, michael@0: NSSItem *outputBuffer michael@0: ); michael@0: michael@0: /* michael@0: * This routine is called by the Framework to complete next michael@0: * step in a combined operation. The Decrypt/Encrypt mechanism michael@0: * should define and drive the combo step. michael@0: * This routine is optional; if unimplemented, michael@0: * the framework will use the appropriate Update functions to complete michael@0: * the operation. michael@0: */ michael@0: CK_RV(PR_CALLBACK *UpdateCombo)( michael@0: NSSCKMDCryptoOperation *mdCryptoOperation, michael@0: NSSCKFWCryptoOperation *fwCryptoOperation, michael@0: NSSCKMDCryptoOperation *mdPeerCryptoOperation, michael@0: NSSCKFWCryptoOperation *fwPeerCryptoOperation, michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: const NSSItem *inputBuffer, michael@0: NSSItem *outputBuffer michael@0: ); michael@0: michael@0: /* michael@0: * Hash a key directly into the digest michael@0: */ michael@0: CK_RV(PR_CALLBACK *DigestKey)( michael@0: NSSCKMDCryptoOperation *mdCryptoOperation, michael@0: NSSCKFWCryptoOperation *fwCryptoOperation, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: NSSCKMDObject *mdKey, michael@0: NSSCKFWObject *fwKey michael@0: ); michael@0: michael@0: /* michael@0: * This object may be extended in future versions of the michael@0: * NSS Cryptoki Framework. To allow for some flexibility michael@0: * in the area of binary compatibility, this field should michael@0: * be NULL. michael@0: */ michael@0: void *null; michael@0: }; michael@0: michael@0: /* michael@0: * NSSCKMDMechanism michael@0: * michael@0: */ michael@0: michael@0: struct NSSCKMDMechanismStr { michael@0: /* michael@0: * The Module may use this pointer for its own purposes. michael@0: */ michael@0: void *etc; michael@0: michael@0: /* michael@0: * This also frees the fwMechanism if appropriate. michael@0: * If it is not supplied, the Framework will assume that the Token michael@0: * Manages a static list of mechanisms and the function will not be called. michael@0: */ michael@0: void (PR_CALLBACK *Destroy)( michael@0: NSSCKMDMechanism *mdMechanism, michael@0: NSSCKFWMechanism *fwMechanism, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance michael@0: ); michael@0: michael@0: michael@0: /* michael@0: * This routine returns the minimum key size allowed for michael@0: * this mechanism. This routine is optional; if unimplemented, michael@0: * zero will be assumed. This routine may return zero on michael@0: * error; if the error is CKR_OK, zero will be accepted as michael@0: * a valid response. michael@0: */ michael@0: CK_ULONG (PR_CALLBACK *GetMinKeySize)( michael@0: NSSCKMDMechanism *mdMechanism, michael@0: NSSCKFWMechanism *fwMechanism, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: CK_RV *pError michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns the maximum key size allowed for michael@0: * this mechanism. This routine is optional; if unimplemented, michael@0: * zero will be assumed. This routine may return zero on michael@0: * error; if the error is CKR_OK, zero will be accepted as michael@0: * a valid response. michael@0: */ michael@0: CK_ULONG (PR_CALLBACK *GetMaxKeySize)( michael@0: NSSCKMDMechanism *mdMechanism, michael@0: NSSCKFWMechanism *fwMechanism, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: CK_RV *pError michael@0: ); michael@0: michael@0: /* michael@0: * This routine is called to determine if the mechanism is michael@0: * implemented in hardware or software. It returns CK_TRUE michael@0: * if it is done in hardware. michael@0: */ michael@0: CK_BBOOL (PR_CALLBACK *GetInHardware)( michael@0: NSSCKMDMechanism *mdMechanism, michael@0: NSSCKFWMechanism *fwMechanism, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: CK_RV *pError michael@0: ); michael@0: michael@0: /* michael@0: * The crypto routines themselves. Most crypto operations may michael@0: * be performed in two ways, streaming and single-part. The michael@0: * streaming operations involve the use of (typically) three michael@0: * calls-- an Init method to set up the operation, an Update michael@0: * method to feed data to the operation, and a Final method to michael@0: * obtain the final result. Single-part operations involve michael@0: * one method, to perform the crypto operation all at once. michael@0: * michael@0: * The NSS Cryptoki Framework can implement the single-part michael@0: * operations in terms of the streaming operations on behalf michael@0: * of the Module. There are a few variances. michael@0: * michael@0: * Only the Init Functions are defined by the mechanism. Each michael@0: * init function will return a NSSCKFWCryptoOperation which michael@0: * can supply update, final, the single part updateFinal, and michael@0: * the combo updateCombo functions. michael@0: * michael@0: * For simplicity, the routines are listed in summary here: michael@0: * michael@0: * EncryptInit, michael@0: * DecryptInit, michael@0: * DigestInit, michael@0: * SignInit, michael@0: * SignRecoverInit; michael@0: * VerifyInit, michael@0: * VerifyRecoverInit; michael@0: * michael@0: * The key-management routines are michael@0: * michael@0: * GenerateKey michael@0: * GenerateKeyPair michael@0: * WrapKey michael@0: * UnwrapKey michael@0: * DeriveKey michael@0: * michael@0: * All of these routines based on the Cryptoki API; michael@0: * see PKCS#11 for further information. michael@0: */ michael@0: michael@0: /* michael@0: */ michael@0: NSSCKMDCryptoOperation * (PR_CALLBACK *EncryptInit)( michael@0: NSSCKMDMechanism *mdMechanism, michael@0: NSSCKFWMechanism *fwMechanism, michael@0: CK_MECHANISM_PTR pMechanism, michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: NSSCKMDObject *mdKey, michael@0: NSSCKFWObject *fwKey, michael@0: CK_RV *pError michael@0: ); michael@0: michael@0: /* michael@0: */ michael@0: NSSCKMDCryptoOperation * (PR_CALLBACK *DecryptInit)( michael@0: NSSCKMDMechanism *mdMechanism, michael@0: NSSCKFWMechanism *fwMechanism, michael@0: CK_MECHANISM_PTR pMechanism, michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: NSSCKMDObject *mdKey, michael@0: NSSCKFWObject *fwKey, michael@0: CK_RV *pError michael@0: ); michael@0: michael@0: /* michael@0: */ michael@0: NSSCKMDCryptoOperation * (PR_CALLBACK *DigestInit)( michael@0: NSSCKMDMechanism *mdMechanism, michael@0: NSSCKFWMechanism *fwMechanism, michael@0: CK_MECHANISM_PTR pMechanism, michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: CK_RV *pError michael@0: ); michael@0: michael@0: michael@0: /* michael@0: */ michael@0: NSSCKMDCryptoOperation * (PR_CALLBACK *SignInit)( michael@0: NSSCKMDMechanism *mdMechanism, michael@0: NSSCKFWMechanism *fwMechanism, michael@0: CK_MECHANISM_PTR pMechanism, michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: NSSCKMDObject *mdKey, michael@0: NSSCKFWObject *fwKey, michael@0: CK_RV *pError michael@0: ); michael@0: michael@0: /* michael@0: */ michael@0: NSSCKMDCryptoOperation * (PR_CALLBACK *VerifyInit)( michael@0: NSSCKMDMechanism *mdMechanism, michael@0: NSSCKFWMechanism *fwMechanism, michael@0: CK_MECHANISM_PTR pMechanism, michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: NSSCKMDObject *mdKey, michael@0: NSSCKFWObject *fwKey, michael@0: CK_RV *pError michael@0: ); michael@0: michael@0: /* michael@0: */ michael@0: NSSCKMDCryptoOperation * (PR_CALLBACK *SignRecoverInit)( michael@0: NSSCKMDMechanism *mdMechanism, michael@0: NSSCKFWMechanism *fwMechanism, michael@0: CK_MECHANISM_PTR pMechanism, michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: NSSCKMDObject *mdKey, michael@0: NSSCKFWObject *fwKey, michael@0: CK_RV *pError michael@0: ); michael@0: michael@0: /* michael@0: */ michael@0: NSSCKMDCryptoOperation * (PR_CALLBACK *VerifyRecoverInit)( michael@0: NSSCKMDMechanism *mdMechanism, michael@0: NSSCKFWMechanism *fwMechanism, michael@0: CK_MECHANISM_PTR pMechanism, michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: NSSCKMDObject *mdKey, michael@0: NSSCKFWObject *fwKey, michael@0: CK_RV *pError michael@0: ); michael@0: michael@0: /* michael@0: * Key management operations. michael@0: */ michael@0: michael@0: /* michael@0: * This routine generates a key. This routine may return NULL michael@0: * upon error. michael@0: */ michael@0: NSSCKMDObject *(PR_CALLBACK *GenerateKey)( michael@0: NSSCKMDMechanism *mdMechanism, michael@0: NSSCKFWMechanism *fwMechanism, michael@0: CK_MECHANISM_PTR pMechanism, michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: CK_ATTRIBUTE_PTR pTemplate, michael@0: CK_ULONG ulAttributeCount, michael@0: CK_RV *pError michael@0: ); michael@0: michael@0: /* michael@0: * This routine generates a key pair. michael@0: */ michael@0: CK_RV (PR_CALLBACK *GenerateKeyPair)( michael@0: NSSCKMDMechanism *mdMechanism, michael@0: NSSCKFWMechanism *fwMechanism, michael@0: CK_MECHANISM_PTR pMechanism, michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: CK_ATTRIBUTE_PTR pPublicKeyTemplate, michael@0: CK_ULONG ulPublicKeyAttributeCount, michael@0: CK_ATTRIBUTE_PTR pPrivateKeyTemplate, michael@0: CK_ULONG ulPrivateKeyAttributeCount, michael@0: NSSCKMDObject **pPublicKey, michael@0: NSSCKMDObject **pPrivateKey michael@0: ); michael@0: michael@0: /* michael@0: * This routine wraps a key. michael@0: */ michael@0: CK_ULONG (PR_CALLBACK *GetWrapKeyLength)( michael@0: NSSCKMDMechanism *mdMechanism, michael@0: NSSCKFWMechanism *fwMechanism, michael@0: CK_MECHANISM_PTR pMechanism, michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: NSSCKMDObject *mdWrappingKey, michael@0: NSSCKFWObject *fwWrappingKey, michael@0: NSSCKMDObject *mdWrappedKey, michael@0: NSSCKFWObject *fwWrappedKey, michael@0: CK_RV *pError michael@0: ); michael@0: michael@0: /* michael@0: * This routine wraps a key. michael@0: */ michael@0: CK_RV (PR_CALLBACK *WrapKey)( michael@0: NSSCKMDMechanism *mdMechanism, michael@0: NSSCKFWMechanism *fwMechanism, michael@0: CK_MECHANISM_PTR pMechanism, michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: NSSCKMDObject *mdWrappingKey, michael@0: NSSCKFWObject *fwWrappingKey, michael@0: NSSCKMDObject *mdKeyObject, michael@0: NSSCKFWObject *fwKeyObject, michael@0: NSSItem *wrappedKey michael@0: ); michael@0: michael@0: /* michael@0: * This routine unwraps a key. This routine may return NULL michael@0: * upon error. michael@0: */ michael@0: NSSCKMDObject *(PR_CALLBACK *UnwrapKey)( michael@0: NSSCKMDMechanism *mdMechanism, michael@0: NSSCKFWMechanism *fwMechanism, michael@0: CK_MECHANISM_PTR pMechanism, michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: NSSCKMDObject *mdWrappingKey, michael@0: NSSCKFWObject *fwWrappingKey, michael@0: NSSItem *wrappedKey, michael@0: CK_ATTRIBUTE_PTR pTemplate, michael@0: CK_ULONG ulAttributeCount, michael@0: CK_RV *pError michael@0: ); michael@0: michael@0: /* michael@0: * This routine derives a key. This routine may return NULL michael@0: * upon error. michael@0: */ michael@0: NSSCKMDObject *(PR_CALLBACK *DeriveKey)( michael@0: NSSCKMDMechanism *mdMechanism, michael@0: NSSCKFWMechanism *fwMechanism, michael@0: CK_MECHANISM_PTR pMechanism, michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: NSSCKMDObject *mdBaseKey, michael@0: NSSCKFWObject *fwBaseKey, michael@0: CK_ATTRIBUTE_PTR pTemplate, michael@0: CK_ULONG ulAttributeCount, michael@0: CK_RV *pError michael@0: ); michael@0: michael@0: /* michael@0: * This object may be extended in future versions of the michael@0: * NSS Cryptoki Framework. To allow for some flexibility michael@0: * in the area of binary compatibility, this field should michael@0: * be NULL. michael@0: */ michael@0: void *null; michael@0: }; michael@0: michael@0: /* michael@0: * NSSCKMDObject michael@0: * michael@0: * This is the basic handle for any object used by a PKCS#11 Module. michael@0: * Modules must implement it if they support their own objects, and michael@0: * the Framework supports it for Modules that do not handle session michael@0: * objects. This type contains a pointer for use by the implementor, michael@0: * to store any object-specific data, and it contains an EPV for a michael@0: * set of routines used to access the object. michael@0: */ michael@0: michael@0: struct NSSCKMDObjectStr { michael@0: /* michael@0: * The implementation my use this pointer for its own purposes. michael@0: */ michael@0: void *etc; michael@0: michael@0: /* michael@0: * This routine is called by the Framework when it is letting michael@0: * go of an object handle. It can be used by the Module to michael@0: * free any resources tied up by an object "in use." It is michael@0: * optional. michael@0: */ michael@0: void (PR_CALLBACK *Finalize)( michael@0: NSSCKMDObject *mdObject, michael@0: NSSCKFWObject *fwObject, michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance michael@0: ); michael@0: michael@0: /* michael@0: * This routine is used to completely destroy an object. michael@0: * It is optional. The parameter fwObject might be NULL michael@0: * if the framework runs out of memory at the wrong moment. michael@0: */ michael@0: CK_RV (PR_CALLBACK *Destroy)( michael@0: NSSCKMDObject *mdObject, michael@0: NSSCKFWObject *fwObject, michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance michael@0: ); michael@0: michael@0: /* michael@0: * This helper routine is used by the Framework, and is especially michael@0: * useful when it is managing session objects on behalf of the michael@0: * Module. This routine is optional; if unimplemented, the michael@0: * Framework will actually look up the CKA_TOKEN attribute. In the michael@0: * event of an error, just make something up-- the Framework will michael@0: * find out soon enough anyway. michael@0: */ michael@0: CK_BBOOL (PR_CALLBACK *IsTokenObject)( michael@0: NSSCKMDObject *mdObject, michael@0: NSSCKFWObject *fwObject, michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns the number of attributes of which this michael@0: * object consists. It is mandatory. It can return zero on michael@0: * error. michael@0: */ michael@0: CK_ULONG (PR_CALLBACK *GetAttributeCount)( michael@0: NSSCKMDObject *mdObject, michael@0: NSSCKFWObject *fwObject, michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: CK_RV *pError michael@0: ); michael@0: michael@0: /* michael@0: * This routine stuffs the attribute types into the provided array. michael@0: * The array size (as obtained from GetAttributeCount) is passed in michael@0: * as a check; return CKR_BUFFER_TOO_SMALL if the count is wrong michael@0: * (either too big or too small). michael@0: */ michael@0: CK_RV (PR_CALLBACK *GetAttributeTypes)( michael@0: NSSCKMDObject *mdObject, michael@0: NSSCKFWObject *fwObject, michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: CK_ATTRIBUTE_TYPE_PTR typeArray, michael@0: CK_ULONG ulCount michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns the size (in bytes) of the specified michael@0: * attribute. It can return zero on error. michael@0: */ michael@0: CK_ULONG (PR_CALLBACK *GetAttributeSize)( michael@0: NSSCKMDObject *mdObject, michael@0: NSSCKFWObject *fwObject, michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: CK_ATTRIBUTE_TYPE attribute, michael@0: CK_RV *pError michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns an NSSCKFWItem structure. michael@0: * The item pointer points to an NSSItem containing the attribute value. michael@0: * The needsFreeing bit tells the framework whether to call the michael@0: * FreeAttribute function . Upon error, an NSSCKFWItem structure michael@0: * with a NULL NSSItem item pointer will be returned michael@0: */ michael@0: NSSCKFWItem (PR_CALLBACK *GetAttribute)( michael@0: NSSCKMDObject *mdObject, michael@0: NSSCKFWObject *fwObject, michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: CK_ATTRIBUTE_TYPE attribute, michael@0: CK_RV *pError michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns CKR_OK if the attribute could be freed. michael@0: */ michael@0: CK_RV (PR_CALLBACK *FreeAttribute)( michael@0: NSSCKFWItem * item michael@0: ); michael@0: michael@0: /* michael@0: * This routine changes the specified attribute. If unimplemented, michael@0: * the object will be considered read-only. michael@0: */ michael@0: CK_RV (PR_CALLBACK *SetAttribute)( michael@0: NSSCKMDObject *mdObject, michael@0: NSSCKFWObject *fwObject, michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: CK_ATTRIBUTE_TYPE attribute, michael@0: NSSItem *value michael@0: ); michael@0: michael@0: /* michael@0: * This routine returns the storage requirements of this object, michael@0: * in bytes. Cryptoki doesn't strictly define the definition, michael@0: * but it should relate to the values returned by the "Get Memory" michael@0: * routines of the NSSCKMDToken. This routine is optional; if michael@0: * unimplemented, the Framework will consider this information michael@0: * sensitive. This routine may return zero on error. If the michael@0: * specified error is CKR_OK, zero will be accepted as a valid michael@0: * response. michael@0: */ michael@0: CK_ULONG (PR_CALLBACK *GetObjectSize)( michael@0: NSSCKMDObject *mdObject, michael@0: NSSCKFWObject *fwObject, michael@0: NSSCKMDSession *mdSession, michael@0: NSSCKFWSession *fwSession, michael@0: NSSCKMDToken *mdToken, michael@0: NSSCKFWToken *fwToken, michael@0: NSSCKMDInstance *mdInstance, michael@0: NSSCKFWInstance *fwInstance, michael@0: CK_RV *pError michael@0: ); michael@0: michael@0: /* michael@0: * This object may be extended in future versions of the michael@0: * NSS Cryptoki Framework. To allow for some flexibility michael@0: * in the area of binary compatibility, this field should michael@0: * be NULL. michael@0: */ michael@0: void *null; michael@0: }; michael@0: michael@0: michael@0: #endif /* NSSCKMDT_H */