mirror of
https://gitlab.winehq.org/wine/wine-gecko.git
synced 2024-09-13 09:24:08 -07:00
300 lines
11 KiB
C
300 lines
11 KiB
C
/* ***** BEGIN LICENSE BLOCK *****
|
|
* Version: MPL 1.1/GPL 2.0/LGPL 2.1
|
|
*
|
|
* The contents of this file are subject to the Mozilla Public License Version
|
|
* 1.1 (the "License"); you may not use this file except in compliance with
|
|
* the License. You may obtain a copy of the License at
|
|
* http://www.mozilla.org/MPL/
|
|
*
|
|
* Software distributed under the License is distributed on an "AS IS" basis,
|
|
* WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
|
|
* for the specific language governing rights and limitations under the
|
|
* License.
|
|
*
|
|
* The Original Code is the Netscape security libraries.
|
|
*
|
|
* The Initial Developer of the Original Code is
|
|
* Netscape Communications Corporation.
|
|
* Portions created by the Initial Developer are Copyright (C) 1994-2000
|
|
* the Initial Developer. All Rights Reserved.
|
|
*
|
|
* Contributor(s):
|
|
*
|
|
* Alternatively, the contents of this file may be used under the terms of
|
|
* either the GNU General Public License Version 2 or later (the "GPL"), or
|
|
* the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
|
|
* in which case the provisions of the GPL or the LGPL are applicable instead
|
|
* of those above. If you wish to allow use of your version of this file only
|
|
* under the terms of either the GPL or the LGPL, and not to allow others to
|
|
* use your version of this file under the terms of the MPL, indicate your
|
|
* decision by deleting the provisions above and replace them with the notice
|
|
* and other provisions required by the GPL or the LGPL. If you do not delete
|
|
* the provisions above, a recipient may use your version of this file under
|
|
* the terms of any one of the MPL, the GPL or the LGPL.
|
|
*
|
|
* ***** END LICENSE BLOCK ***** */
|
|
|
|
/*
|
|
* Header for pkcs7 types.
|
|
*
|
|
* $Id: pkcs7t.h,v 1.6 2008/06/14 14:20:24 wtc%google.com Exp $
|
|
*/
|
|
|
|
#ifndef _PKCS7T_H_
|
|
#define _PKCS7T_H_
|
|
|
|
#include "plarena.h"
|
|
|
|
#include "seccomon.h"
|
|
#include "secoidt.h"
|
|
#include "certt.h"
|
|
#include "secmodt.h"
|
|
|
|
/* Opaque objects */
|
|
typedef struct SEC_PKCS7DecoderContextStr SEC_PKCS7DecoderContext;
|
|
typedef struct SEC_PKCS7EncoderContextStr SEC_PKCS7EncoderContext;
|
|
|
|
/* legacy defines that haven't been active for years */
|
|
typedef void *(*SECKEYGetPasswordKey)(void *arg, void *handle);
|
|
|
|
|
|
/* Non-opaque objects. NOTE, though: I want them to be treated as
|
|
* opaque as much as possible. If I could hide them completely,
|
|
* I would. (I tried, but ran into trouble that was taking me too
|
|
* much time to get out of.) I still intend to try to do so.
|
|
* In fact, the only type that "outsiders" should even *name* is
|
|
* SEC_PKCS7ContentInfo, and they should not reference its fields.
|
|
*/
|
|
/* rjr: PKCS #11 cert handling (pk11cert.c) does use SEC_PKCS7RecipientInfo's.
|
|
* This is because when we search the recipient list for the cert and key we
|
|
* want, we need to invert the order of the loops we used to have. The old
|
|
* loops were:
|
|
*
|
|
* For each recipient {
|
|
* find_cert = PK11_Find_AllCert(recipient->issuerSN);
|
|
* [which unrolls to... ]
|
|
* For each slot {
|
|
* Log into slot;
|
|
* search slot for cert;
|
|
* }
|
|
* }
|
|
*
|
|
* the new loop searchs all the recipients at once on a slot. this allows
|
|
* PKCS #11 to order slots in such a way that logout slots don't get checked
|
|
* if we can find the cert on a logged in slot. This eliminates lots of
|
|
* spurious password prompts when smart cards are installed... so why this
|
|
* comment? If you make SEC_PKCS7RecipientInfo completely opaque, you need
|
|
* to provide a non-opaque list of issuerSN's (the only field PKCS#11 needs
|
|
* and fix up pk11cert.c first. NOTE: Only S/MIME calls this special PKCS #11
|
|
* function.
|
|
*/
|
|
typedef struct SEC_PKCS7ContentInfoStr SEC_PKCS7ContentInfo;
|
|
typedef struct SEC_PKCS7SignedDataStr SEC_PKCS7SignedData;
|
|
typedef struct SEC_PKCS7EncryptedContentInfoStr SEC_PKCS7EncryptedContentInfo;
|
|
typedef struct SEC_PKCS7EnvelopedDataStr SEC_PKCS7EnvelopedData;
|
|
typedef struct SEC_PKCS7SignedAndEnvelopedDataStr
|
|
SEC_PKCS7SignedAndEnvelopedData;
|
|
typedef struct SEC_PKCS7SignerInfoStr SEC_PKCS7SignerInfo;
|
|
typedef struct SEC_PKCS7RecipientInfoStr SEC_PKCS7RecipientInfo;
|
|
typedef struct SEC_PKCS7DigestedDataStr SEC_PKCS7DigestedData;
|
|
typedef struct SEC_PKCS7EncryptedDataStr SEC_PKCS7EncryptedData;
|
|
typedef struct SEC_PKCS7SMIMEKEAParametersStr SEC_PKCS7SMIMEKEAParameters;
|
|
/*
|
|
* The following is not actually a PKCS7 type, but for now it is only
|
|
* used by PKCS7, so we have adopted it. If someone else *ever* needs
|
|
* it, its name should be changed and it should be moved out of here.
|
|
* Do not dare to use it without doing so!
|
|
*/
|
|
typedef struct SEC_PKCS7AttributeStr SEC_PKCS7Attribute;
|
|
|
|
struct SEC_PKCS7ContentInfoStr {
|
|
PLArenaPool *poolp; /* local; not part of encoding */
|
|
PRBool created; /* local; not part of encoding */
|
|
int refCount; /* local; not part of encoding */
|
|
SECOidData *contentTypeTag; /* local; not part of encoding */
|
|
SECKEYGetPasswordKey pwfn; /* local; not part of encoding */
|
|
void *pwfn_arg; /* local; not part of encoding */
|
|
SECItem contentType;
|
|
union {
|
|
SECItem *data;
|
|
SEC_PKCS7DigestedData *digestedData;
|
|
SEC_PKCS7EncryptedData *encryptedData;
|
|
SEC_PKCS7EnvelopedData *envelopedData;
|
|
SEC_PKCS7SignedData *signedData;
|
|
SEC_PKCS7SignedAndEnvelopedData *signedAndEnvelopedData;
|
|
} content;
|
|
};
|
|
|
|
struct SEC_PKCS7SignedDataStr {
|
|
SECItem version;
|
|
SECAlgorithmID **digestAlgorithms;
|
|
SEC_PKCS7ContentInfo contentInfo;
|
|
SECItem **rawCerts;
|
|
CERTSignedCrl **crls;
|
|
SEC_PKCS7SignerInfo **signerInfos;
|
|
SECItem **digests; /* local; not part of encoding */
|
|
CERTCertificate **certs; /* local; not part of encoding */
|
|
CERTCertificateList **certLists; /* local; not part of encoding */
|
|
};
|
|
#define SEC_PKCS7_SIGNED_DATA_VERSION 1 /* what we *create* */
|
|
|
|
struct SEC_PKCS7EncryptedContentInfoStr {
|
|
SECOidData *contentTypeTag; /* local; not part of encoding */
|
|
SECItem contentType;
|
|
SECAlgorithmID contentEncAlg;
|
|
SECItem encContent;
|
|
SECItem plainContent; /* local; not part of encoding */
|
|
/* bytes not encrypted, but encoded */
|
|
int keysize; /* local; not part of encoding */
|
|
/* size of bulk encryption key
|
|
* (only used by creation code) */
|
|
SECOidTag encalg; /* local; not part of encoding */
|
|
/* oid tag of encryption algorithm
|
|
* (only used by creation code) */
|
|
};
|
|
|
|
struct SEC_PKCS7EnvelopedDataStr {
|
|
SECItem version;
|
|
SEC_PKCS7RecipientInfo **recipientInfos;
|
|
SEC_PKCS7EncryptedContentInfo encContentInfo;
|
|
};
|
|
#define SEC_PKCS7_ENVELOPED_DATA_VERSION 0 /* what we *create* */
|
|
|
|
struct SEC_PKCS7SignedAndEnvelopedDataStr {
|
|
SECItem version;
|
|
SEC_PKCS7RecipientInfo **recipientInfos;
|
|
SECAlgorithmID **digestAlgorithms;
|
|
SEC_PKCS7EncryptedContentInfo encContentInfo;
|
|
SECItem **rawCerts;
|
|
CERTSignedCrl **crls;
|
|
SEC_PKCS7SignerInfo **signerInfos;
|
|
SECItem **digests; /* local; not part of encoding */
|
|
CERTCertificate **certs; /* local; not part of encoding */
|
|
CERTCertificateList **certLists; /* local; not part of encoding */
|
|
PK11SymKey *sigKey; /* local; not part of encoding */
|
|
};
|
|
#define SEC_PKCS7_SIGNED_AND_ENVELOPED_DATA_VERSION 1 /* what we *create* */
|
|
|
|
struct SEC_PKCS7SignerInfoStr {
|
|
SECItem version;
|
|
CERTIssuerAndSN *issuerAndSN;
|
|
SECAlgorithmID digestAlg;
|
|
SEC_PKCS7Attribute **authAttr;
|
|
SECAlgorithmID digestEncAlg;
|
|
SECItem encDigest;
|
|
SEC_PKCS7Attribute **unAuthAttr;
|
|
CERTCertificate *cert; /* local; not part of encoding */
|
|
CERTCertificateList *certList; /* local; not part of encoding */
|
|
};
|
|
#define SEC_PKCS7_SIGNER_INFO_VERSION 1 /* what we *create* */
|
|
|
|
struct SEC_PKCS7RecipientInfoStr {
|
|
SECItem version;
|
|
CERTIssuerAndSN *issuerAndSN;
|
|
SECAlgorithmID keyEncAlg;
|
|
SECItem encKey;
|
|
CERTCertificate *cert; /* local; not part of encoding */
|
|
};
|
|
#define SEC_PKCS7_RECIPIENT_INFO_VERSION 0 /* what we *create* */
|
|
|
|
struct SEC_PKCS7DigestedDataStr {
|
|
SECItem version;
|
|
SECAlgorithmID digestAlg;
|
|
SEC_PKCS7ContentInfo contentInfo;
|
|
SECItem digest;
|
|
};
|
|
#define SEC_PKCS7_DIGESTED_DATA_VERSION 0 /* what we *create* */
|
|
|
|
struct SEC_PKCS7EncryptedDataStr {
|
|
SECItem version;
|
|
SEC_PKCS7EncryptedContentInfo encContentInfo;
|
|
};
|
|
#define SEC_PKCS7_ENCRYPTED_DATA_VERSION 0 /* what we *create* */
|
|
|
|
/*
|
|
* See comment above about this type not really belonging to PKCS7.
|
|
*/
|
|
struct SEC_PKCS7AttributeStr {
|
|
/* The following fields make up an encoded Attribute: */
|
|
SECItem type;
|
|
SECItem **values; /* data may or may not be encoded */
|
|
/* The following fields are not part of an encoded Attribute: */
|
|
SECOidData *typeTag;
|
|
PRBool encoded; /* when true, values are encoded */
|
|
};
|
|
|
|
/* An enumerated type used to select templates based on the encryption
|
|
scenario and data specifics. */
|
|
typedef enum
|
|
{
|
|
SECKEAInvalid = -1,
|
|
SECKEAUsesSkipjack = 0,
|
|
SECKEAUsesNonSkipjack = 1,
|
|
SECKEAUsesNonSkipjackWithPaddedEncKey = 2
|
|
} SECKEATemplateSelector;
|
|
|
|
/* ### mwelch - S/MIME KEA parameters. These don't really fit here,
|
|
but I cannot think of a more appropriate place at this time. */
|
|
struct SEC_PKCS7SMIMEKEAParametersStr {
|
|
SECItem originatorKEAKey; /* sender KEA key (encrypted?) */
|
|
SECItem originatorRA; /* random number generated by sender */
|
|
SECItem nonSkipjackIV; /* init'n vector for SkipjackCBC64
|
|
decryption of KEA key if Skipjack
|
|
is not the bulk algorithm used on
|
|
the message */
|
|
SECItem bulkKeySize; /* if Skipjack is not the bulk
|
|
algorithm used on the message,
|
|
and the size of the bulk encryption
|
|
key is not the same as that of
|
|
originatorKEAKey (due to padding
|
|
perhaps), this field will contain
|
|
the real size of the bulk encryption
|
|
key. */
|
|
};
|
|
|
|
/*
|
|
* Type of function passed to SEC_PKCS7Decode or SEC_PKCS7DecoderStart.
|
|
* If specified, this is where the content bytes (only) will be "sent"
|
|
* as they are recovered during the decoding.
|
|
*
|
|
* XXX Should just combine this with SEC_PKCS7EncoderContentCallback type
|
|
* and use a simpler, common name.
|
|
*/
|
|
typedef void (* SEC_PKCS7DecoderContentCallback)(void *arg,
|
|
const char *buf,
|
|
unsigned long len);
|
|
|
|
/*
|
|
* Type of function passed to SEC_PKCS7Encode or SEC_PKCS7EncoderStart.
|
|
* This is where the encoded bytes will be "sent".
|
|
*
|
|
* XXX Should just combine this with SEC_PKCS7DecoderContentCallback type
|
|
* and use a simpler, common name.
|
|
*/
|
|
typedef void (* SEC_PKCS7EncoderOutputCallback)(void *arg,
|
|
const char *buf,
|
|
unsigned long len);
|
|
|
|
|
|
/*
|
|
* Type of function passed to SEC_PKCS7Decode or SEC_PKCS7DecoderStart
|
|
* to retrieve the decryption key. This function is inteded to be
|
|
* used for EncryptedData content info's which do not have a key available
|
|
* in a certificate, etc.
|
|
*/
|
|
typedef PK11SymKey * (* SEC_PKCS7GetDecryptKeyCallback)(void *arg,
|
|
SECAlgorithmID *algid);
|
|
|
|
/*
|
|
* Type of function passed to SEC_PKCS7Decode or SEC_PKCS7DecoderStart.
|
|
* This function in intended to be used to verify that decrypting a
|
|
* particular crypto algorithm is allowed. Content types which do not
|
|
* require decryption will not need the callback. If the callback
|
|
* is not specified for content types which require decryption, the
|
|
* decryption will be disallowed.
|
|
*/
|
|
typedef PRBool (* SEC_PKCS7DecryptionAllowedCallback)(SECAlgorithmID *algid,
|
|
PK11SymKey *bulkkey);
|
|
|
|
#endif /* _PKCS7T_H_ */
|