pkixnss.h (5223B)
1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ 2 /* vim: set ts=8 sts=2 et sw=2 tw=80: */ 3 /* This code is made available to you under your choice of the following sets 4 * of licensing terms: 5 */ 6 /* This Source Code Form is subject to the terms of the Mozilla Public 7 * License, v. 2.0. If a copy of the MPL was not distributed with this 8 * file, You can obtain one at http://mozilla.org/MPL/2.0/. 9 */ 10 /* Copyright 2013 Mozilla Contributors 11 * 12 * Licensed under the Apache License, Version 2.0 (the "License"); 13 * you may not use this file except in compliance with the License. 14 * You may obtain a copy of the License at 15 * 16 * http://www.apache.org/licenses/LICENSE-2.0 17 * 18 * Unless required by applicable law or agreed to in writing, software 19 * distributed under the License is distributed on an "AS IS" BASIS, 20 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 21 * See the License for the specific language governing permissions and 22 * limitations under the License. 23 */ 24 25 #ifndef mozilla_pkix_pkixnss_h 26 #define mozilla_pkix_pkixnss_h 27 28 #include <seccomon.h> 29 #include "mozpkix/pkixtypes.h" 30 #include "prerror.h" 31 32 namespace mozilla { 33 namespace pkix { 34 35 // Verifies the PKCS#1.5 signature on the given data using the given RSA public 36 // key. 37 Result VerifyRSAPKCS1SignedDataNSS(Input data, DigestAlgorithm digestAlgorithm, 38 Input signature, Input subjectPublicKeyInfo, 39 void* pkcs11PinArg); 40 41 // Verifies the RSA-PSS signature on the given data using the given RSA 42 // public key. 43 Result VerifyRSAPSSSignedDataNSS(Input data, DigestAlgorithm digestAlgorithm, 44 Input signature, Input subjectPublicKeyInfo, 45 void* pkcs11PinArg); 46 47 // Verifies the ECDSA signature on the given data using the given ECC public 48 // key. 49 Result VerifyECDSASignedDataNSS(Input data, DigestAlgorithm digestAlgorithm, 50 Input signature, Input subjectPublicKeyInfo, 51 void* pkcs11PinArg); 52 53 // Computes the digest of the given data using the given digest algorithm. 54 // 55 // item contains the data to hash. 56 // digestBuf must point to a buffer to where the digest will be written. 57 // digestBufLen must be the size of the buffer, which must be exactly equal 58 // to the size of the digest output (20 for SHA-1, 32 for SHA-256, 59 // etc.) 60 // 61 // TODO: Taking the output buffer as (uint8_t*, size_t) is counter to our 62 // other, extensive, memory safety efforts in mozilla::pkix, and we should find 63 // a way to provide a more-obviously-safe interface. 64 Result DigestBufNSS(Input item, DigestAlgorithm digestAlg, 65 /*out*/ uint8_t* digestBuf, size_t digestBufLen); 66 67 Result MapPRErrorCodeToResult(PRErrorCode errorCode); 68 PRErrorCode MapResultToPRErrorCode(Result result); 69 70 // The error codes within each module must fit in 16 bits. We want these 71 // errors to fit in the same module as the NSS errors but not overlap with 72 // any of them. Converting an NSS SEC, NSS SSL, or PSM error to an NS error 73 // involves negating the value of the error and then synthesizing an error 74 // in the NS_ERROR_MODULE_SECURITY module. Hence, PSM errors will start at 75 // a negative value that both doesn't overlap with the current value 76 // ranges for NSS errors and that will fit in 16 bits when negated. 77 static const PRErrorCode ERROR_BASE = -0x4000; 78 static const PRErrorCode ERROR_LIMIT = ERROR_BASE + 1000; 79 80 enum ErrorCode { 81 MOZILLA_PKIX_ERROR_KEY_PINNING_FAILURE = ERROR_BASE + 0, 82 MOZILLA_PKIX_ERROR_CA_CERT_USED_AS_END_ENTITY = ERROR_BASE + 1, 83 MOZILLA_PKIX_ERROR_INADEQUATE_KEY_SIZE = ERROR_BASE + 2, 84 MOZILLA_PKIX_ERROR_V1_CERT_USED_AS_CA = ERROR_BASE + 3, 85 MOZILLA_PKIX_ERROR_NO_RFC822NAME_MATCH = ERROR_BASE + 4, 86 MOZILLA_PKIX_ERROR_NOT_YET_VALID_CERTIFICATE = ERROR_BASE + 5, 87 MOZILLA_PKIX_ERROR_NOT_YET_VALID_ISSUER_CERTIFICATE = ERROR_BASE + 6, 88 MOZILLA_PKIX_ERROR_SIGNATURE_ALGORITHM_MISMATCH = ERROR_BASE + 7, 89 MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING = ERROR_BASE + 8, 90 MOZILLA_PKIX_ERROR_VALIDITY_TOO_LONG = ERROR_BASE + 9, 91 MOZILLA_PKIX_ERROR_REQUIRED_TLS_FEATURE_MISSING = ERROR_BASE + 10, 92 MOZILLA_PKIX_ERROR_INVALID_INTEGER_ENCODING = ERROR_BASE + 11, 93 MOZILLA_PKIX_ERROR_EMPTY_ISSUER_NAME = ERROR_BASE + 12, 94 MOZILLA_PKIX_ERROR_ADDITIONAL_POLICY_CONSTRAINT_FAILED = ERROR_BASE + 13, 95 MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT = ERROR_BASE + 14, 96 MOZILLA_PKIX_ERROR_MITM_DETECTED = ERROR_BASE + 15, 97 MOZILLA_PKIX_ERROR_INSUFFICIENT_CERTIFICATE_TRANSPARENCY = ERROR_BASE + 16, 98 MOZILLA_PKIX_ERROR_ISSUER_NO_LONGER_TRUSTED = ERROR_BASE + 17, 99 MOZILLA_PKIX_ERROR_ONION_WITH_SELF_SIGNED_CERT = ERROR_BASE + 100, 100 END_OF_LIST 101 }; 102 103 void RegisterErrorTable(); 104 105 inline SECItem UnsafeMapInputToSECItem(Input input) { 106 SECItem result = {siBuffer, const_cast<uint8_t*>(input.UnsafeGetData()), 107 input.GetLength()}; 108 static_assert(sizeof(decltype(input.GetLength())) <= sizeof(result.len), 109 "input.GetLength() must fit in a SECItem"); 110 return result; 111 } 112 } // namespace pkix 113 } // namespace mozilla 114 115 #endif // mozilla_pkix_pkixnss_h