security/nss/lib/certdb/certi.h

   1 /* ***** BEGIN LICENSE BLOCK *****
   2  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
   3  *
   4  * The contents of this file are subject to the Mozilla Public License Version
   5  * 1.1 (the "License"); you may not use this file except in compliance with
   6  * the License. You may obtain a copy of the License at
   7  * http://www.mozilla.org/MPL/
   8  *
   9  * Software distributed under the License is distributed on an "AS IS" basis,
  10  * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
  11  * for the specific language governing rights and limitations under the
  12  * License.
  13  *
  14  * The Original Code is the Netscape security libraries.
  15  *
  16  * The Initial Developer of the Original Code is
  17  * Netscape Communications Corporation.
  18  * Portions created by the Initial Developer are Copyright (C) 1994-2000
  19  * the Initial Developer. All Rights Reserved.
  20  *
  21  * Contributor(s):
  22  *
  23  * Alternatively, the contents of this file may be used under the terms of
  24  * either the GNU General Public License Version 2 or later (the "GPL"), or
  25  * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
  26  * in which case the provisions of the GPL or the LGPL are applicable instead
  27  * of those above. If you wish to allow use of your version of this file only
  28  * under the terms of either the GPL or the LGPL, and not to allow others to
  29  * use your version of this file under the terms of the MPL, indicate your
  30  * decision by deleting the provisions above and replace them with the notice
  31  * and other provisions required by the GPL or the LGPL. If you do not delete
  32  * the provisions above, a recipient may use your version of this file under
  33  * the terms of any one of the MPL, the GPL or the LGPL.
  34  *
  35  * ***** END LICENSE BLOCK ***** */
  36 /*
  37  * certi.h - private data structures for the certificate library
  38  *
  39  * $Id: certi.h,v 1.26 2008/06/18 01:00:40 wtc%google.com Exp $
  40  */
  41 #ifndef _CERTI_H_
  42 #define _CERTI_H_
  43
  44 #include "certt.h"
  45 #include "nssrwlkt.h"
  46
  47 /*
  48 #define GLOBAL_RWLOCK 1
  49 */
  50
  51 #define DPC_RWLOCK 1
  52
  53 /* all definitions in this file are subject to change */
  54
  55 typedef struct OpaqueCRLFieldsStr OpaqueCRLFields;
  56 typedef struct CRLEntryCacheStr CRLEntryCache;
  57 typedef struct CRLDPCacheStr CRLDPCache;
  58 typedef struct CRLIssuerCacheStr CRLIssuerCache;
  59 typedef struct CRLCacheStr CRLCache;
  60 typedef struct CachedCrlStr CachedCrl;
  61
  62 struct OpaqueCRLFieldsStr {
  63     PRBool partial;
  64     PRBool decodingError;
  65     PRBool badEntries;
  66     PRBool badDER;
  67     PRBool badExtensions;
  68     PRBool heapDER;
  69 };
  70
  71 typedef struct PreAllocatorStr PreAllocator;
  72
  73 struct PreAllocatorStr
  74 {
  75     PRSize len;
  76     void* data;
  77     PRSize used;
  78     PRArenaPool* arena;
  79     PRSize extra;
  80 };
  81
  82 /*  CRL entry cache.
  83     This is the same as an entry plus the next/prev pointers for the hash table
  84 */
  85
  86 struct CRLEntryCacheStr {
  87     CERTCrlEntry entry;
  88     CRLEntryCache *prev, *next;
  89 };
  90
  91 #define CRL_CACHE_INVALID_CRLS              0x0001 /* this state will be set
  92         if we have CRL objects with an invalid DER or signature. Can be
  93         cleared if the invalid objects are deleted from the token */
  94 #define CRL_CACHE_LAST_FETCH_FAILED         0x0002 /* this state will be set
  95         if the last CRL fetch encountered an error. Can be cleared if a
  96         new fetch succeeds */
  97
  98 #define CRL_CACHE_OUT_OF_MEMORY             0x0004 /* this state will be set
  99         if we don't have enough memory to build the hash table of entries */
 100
 101 typedef enum {
 102     CRL_OriginToken = 0,    /* CRL came from PKCS#11 token */
 103     CRL_OriginExplicit = 1  /* CRL was explicitly added to the cache, from RAM */
 104 } CRLOrigin;
 105
 106 struct CachedCrlStr {
 107     CERTSignedCrl* crl;
 108     CRLOrigin origin;
 109     /* hash table of entries. We use a PLHashTable and pre-allocate the
 110        required amount of memory in one shot, so that our allocator can
 111        simply pass offsets into it when hashing.
 112
 113        This won't work anymore when we support delta CRLs and iCRLs, because
 114        the size of the hash table will vary over time. At that point, the best
 115        solution will be to allocate large CRLEntry structures by modifying
 116        the DER decoding template. The extra space would be for next/prev
 117        pointers. This would allow entries from different CRLs to be mixed in
 118        the same hash table.
 119     */
 120     PLHashTable* entries;
 121     PreAllocator* prebuffer; /* big pre-allocated buffer mentioned above */
 122     PRBool sigChecked; /* this CRL signature has already been checked */
 123     PRBool sigValid; /* signature verification status .
 124                         Only meaningful if checked is PR_TRUE . */
 125     PRBool unbuildable; /* Avoid using assosiated CRL is it fails
 126                          * a decoding step */
 127 };
 128
 129 /*  CRL distribution point cache object
 130     This is a cache of CRL entries for a given distribution point of an issuer
 131     It is built from a collection of one full and 0 or more delta CRLs.
 132 */
 133
 134 struct CRLDPCacheStr {
 135 #ifdef DPC_RWLOCK
 136     NSSRWLock* lock;
 137 #else
 138     PRLock* lock;
 139 #endif
 140     CERTCertificate* issuer;    /* cert issuer
 141                                    XXX there may be multiple issuer certs,
 142                                        with different validity dates. Also
 143                                        need to deal with SKID/AKID . See
 144                                        bugzilla 217387, 233118 */
 145     SECItem* subject;           /* DER of issuer subject */
 146     SECItem* distributionPoint; /* DER of distribution point. This may be
 147                                    NULL when distribution points aren't
 148                                    in use (ie. the CA has a single CRL).
 149                                    Currently not used. */
 150
 151     /* array of full CRLs matching this distribution point */
 152     PRUint32 ncrls;              /* total number of CRLs in crls */
 153     CachedCrl** crls;            /* array of all matching CRLs */
 154     /* XCRL With iCRLs and multiple DPs, the CRL can be shared accross several
 155        issuers. In the future, we'll need to globally recycle the CRL in a
 156        separate list in order to avoid extra lookups, decodes, and copies */
 157
 158     /* pointers to good decoded CRLs used to build the cache */
 159     CachedCrl* selected;    /* full CRL selected for use in the cache */
 160 #if 0
 161     /* for future use */
 162     PRInt32 numdeltas;      /* number of delta CRLs used for the cache */
 163     CachedCrl** deltas;     /* delta CRLs used for the cache */
 164 #endif
 165     /* cache invalidity bitflag */
 166     PRUint16 invalid;       /* this state will be set if either
 167              CRL_CACHE_INVALID_CRLS or CRL_CACHE_LAST_FETCH_FAILED is set.
 168              In those cases, all certs are considered revoked as a
 169              security precaution. The invalid state can only be cleared
 170              during an update if all error states are cleared */
 171     PRBool refresh;        /* manual refresh from tokens has been forced */
 172     PRBool mustchoose;     /* trigger reselection algorithm, for case when
 173                               RAM CRL objects are dropped from the cache */
 174     PRTime lastfetch;      /* time a CRL token fetch was last performed */
 175     PRTime lastcheck;      /* time CRL token objects were last checked for
 176                               existence */
 177 };
 178
 179 /*  CRL issuer cache object
 180     This object tracks all the distribution point caches for a given issuer.
 181     XCRL once we support multiple issuing distribution points, this object
 182     will be a hash table. For now, it just holds the single CRL distribution
 183     point cache structure.
 184 */
 185
 186 struct CRLIssuerCacheStr {
 187     SECItem* subject;           /* DER of issuer subject */
 188     CRLDPCache* dpp;
 189 #if 0
 190     /* XCRL for future use.
 191        We don't need to lock at the moment because we only have one DP,
 192        which gets created at the same time as this object */
 193     NSSRWLock* lock;
 194     CRLDPCache** dps;
 195     PLHashTable* distributionpoints;
 196     CERTCertificate* issuer;
 197 #endif
 198 };
 199
 200 /*  CRL revocation cache object
 201     This object tracks all the issuer caches
 202 */
 203
 204 struct CRLCacheStr {
 205 #ifdef GLOBAL_RWLOCK
 206     NSSRWLock* lock;
 207 #else
 208     PRLock* lock;
 209 #endif
 210     /* hash table of issuer to CRLIssuerCacheStr,
 211        indexed by issuer DER subject */
 212     PLHashTable* issuers;
 213 };
 214
 215 SECStatus InitCRLCache(void);
 216 SECStatus ShutdownCRLCache(void);
 217
 218 /* Returns a pointer to an environment-like string, a series of
 219 ** null-terminated strings, terminated by a zero-length string.
 220 ** This function is intended to be internal to NSS.
 221 */
 222 extern char * cert_GetCertificateEmailAddresses(CERTCertificate *cert);
 223
 224 /*
 225  * These functions are used to map subjectKeyID extension values to certs.
 226  */
 227 SECStatus
 228 cert_CreateSubjectKeyIDHashTable(void);
 229
 230 SECStatus
 231 cert_AddSubjectKeyIDMapping(SECItem *subjKeyID, CERTCertificate *cert);
 232
 233 /*
 234  * Call this function to remove an entry from the mapping table.
 235  */
 236 SECStatus
 237 cert_RemoveSubjectKeyIDMapping(SECItem *subjKeyID);
 238
 239 SECStatus
 240 cert_DestroySubjectKeyIDHashTable(void);
 241
 242 SECItem*
 243 cert_FindDERCertBySubjectKeyID(SECItem *subjKeyID);
 244
 245 /* return maximum length of AVA value based on its type OID tag. */
 246 extern int cert_AVAOidTagToMaxLen(SECOidTag tag);
 247
 248 /* Make an AVA, allocated from pool, from OID and DER encoded value */
 249 extern CERTAVA * CERT_CreateAVAFromRaw(PRArenaPool *pool,
 250                                const SECItem * OID, const SECItem * value);
 251
 252 /*
 253  * get a DPCache object for the given issuer subject and dp
 254  * Automatically creates the cache object if it doesn't exist yet.
 255  */
 256 SECStatus AcquireDPCache(CERTCertificate* issuer, SECItem* subject,
 257                          SECItem* dp, int64 t, void* wincx,
 258                          CRLDPCache** dpcache, PRBool* writeLocked);
 259
 260 /* release a DPCache object that was previously acquired */
 261 void ReleaseDPCache(CRLDPCache* dpcache, PRBool writeLocked);
 262
 263 /* this function assumes the caller holds a lock on the DPCache */
 264 SECStatus DPCache_GetAllCRLs(CRLDPCache* dpc, PRArenaPool* arena,
 265                              CERTSignedCrl*** crls, PRUint16* status);
 266
 267 /* this function assumes the caller holds a lock on the DPCache */
 268 SECStatus DPCache_GetCRLEntry(CRLDPCache* cache, PRBool readlocked,
 269                               CERTSignedCrl* crl, SECItem* sn,
 270                               CERTCrlEntry** returned);
 271
 272 /*
 273  * map Stan errors into NSS errors
 274  * This function examines the stan error stack and automatically sets
 275  * PORT_SetError(); to the appropriate SEC_ERROR value.
 276  */
 277 void CERT_MapStanError();
 278
 279 /* Interface function for libpkix cert validation engine:
 280  * cert_verify wrapper. */
 281 SECStatus
 282 cert_VerifyCertChainPkix(CERTCertificate *cert,
 283                          PRBool checkSig,
 284                          SECCertUsage     requiredUsage,
 285                          PRTime           time,
 286                          void            *wincx,
 287                          CERTVerifyLog   *log,
 288                          PRBool          *sigError,
 289                          PRBool          *revoked);
 290
 291 SECStatus cert_InitLocks(void);
 292
 293 SECStatus cert_DestroyLocks(void);
 294
 295 /*
 296  * fill in nsCertType field of the cert based on the cert extension
 297  */
 298 extern SECStatus cert_GetCertType(CERTCertificate *cert);
 299
 300 /*
 301  * compute and return the value of nsCertType for cert, but do not
 302  * update the CERTCertificate.
 303  */
 304 extern PRUint32 cert_ComputeCertType(CERTCertificate *cert);
 305
 306 void cert_AddToVerifyLog(CERTVerifyLog *log,CERTCertificate *cert,
 307                          unsigned long errorCode, unsigned int depth,
 308                          void *arg);
 309
 310 #endif /* _CERTI_H_ */
 311