secmodt.h (16563B)
1 /* This Source Code Form is subject to the terms of the Mozilla Public 2 * License, v. 2.0. If a copy of the MPL was not distributed with this 3 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ 4 #ifndef _SECMODT_H_ 5 #define _SECMODT_H_ 1 6 7 #include "nssrwlkt.h" 8 #include "nssilckt.h" 9 #include "secoid.h" 10 #include "secasn1.h" 11 #include "pkcs11t.h" 12 #include "utilmodt.h" 13 14 SEC_BEGIN_PROTOS 15 16 /* find a better home for these... */ 17 extern const SEC_ASN1Template SECKEY_PointerToEncryptedPrivateKeyInfoTemplate[]; 18 SEC_ASN1_CHOOSER_DECLARE(SECKEY_PointerToEncryptedPrivateKeyInfoTemplate) 19 extern const SEC_ASN1Template SECKEY_EncryptedPrivateKeyInfoTemplate[]; 20 SEC_ASN1_CHOOSER_DECLARE(SECKEY_EncryptedPrivateKeyInfoTemplate) 21 extern const SEC_ASN1Template SECKEY_PrivateKeyInfoTemplate[]; 22 SEC_ASN1_CHOOSER_DECLARE(SECKEY_PrivateKeyInfoTemplate) 23 extern const SEC_ASN1Template SECKEY_PointerToPrivateKeyInfoTemplate[]; 24 SEC_ASN1_CHOOSER_DECLARE(SECKEY_PointerToPrivateKeyInfoTemplate) 25 26 SEC_END_PROTOS 27 28 /* PKCS11 needs to be included */ 29 typedef struct SECMODModuleStr SECMODModule; 30 typedef struct SECMODModuleListStr SECMODModuleList; 31 typedef NSSRWLock SECMODListLock; 32 typedef struct PK11SlotInfoStr PK11SlotInfo; /* defined in secmodti.h */ 33 typedef struct NSSUTILPreSlotInfoStr PK11PreSlotInfo; /* defined in secmodti.h */ 34 typedef struct PK11SymKeyStr PK11SymKey; /* defined in secmodti.h */ 35 typedef struct PK11ContextStr PK11Context; /* defined in secmodti.h */ 36 typedef struct PK11SlotListStr PK11SlotList; 37 typedef struct PK11SlotListElementStr PK11SlotListElement; 38 typedef struct PK11RSAGenParamsStr PK11RSAGenParams; 39 typedef unsigned long SECMODModuleID; 40 typedef struct PK11DefaultArrayEntryStr PK11DefaultArrayEntry; 41 typedef struct PK11GenericObjectStr PK11GenericObject; 42 typedef void (*PK11FreeDataFunc)(void *); 43 44 struct SECMODModuleStr { 45 PLArenaPool *arena; 46 PRBool internal; /* true of internally linked modules, false 47 * for the loaded modules */ 48 PRBool loaded; /* Set to true if module has been loaded */ 49 PRBool isFIPS; /* Set to true if module is finst internal */ 50 char *dllName; /* name of the shared library which implements 51 * this module */ 52 char *commonName; /* name of the module to display to the user */ 53 void *library; /* pointer to the library. opaque. used only by 54 * pk11load.c */ 55 void *functionList; /* The PKCS #11 function table */ 56 PZLock *refLock; /* only used pk11db.c */ 57 int refCount; /* Module reference count */ 58 PK11SlotInfo **slots; /* array of slot points attached to this mod*/ 59 int slotCount; /* count of slot in above array */ 60 PK11PreSlotInfo *slotInfo; /* special info about slots default settings */ 61 int slotInfoCount; /* count */ 62 SECMODModuleID moduleID; /* ID so we can find this module again */ 63 PRBool isThreadSafe; 64 unsigned long ssl[2]; /* SSL cipher enable flags */ 65 char *libraryParams; /* Module specific parameters */ 66 void *moduleDBFunc; /* function to return module configuration data*/ 67 SECMODModule *parent; /* module that loaded us */ 68 PRBool isCritical; /* This module must load successfully */ 69 PRBool isModuleDB; /* this module has lists of PKCS #11 modules */ 70 PRBool moduleDBOnly; /* this module only has lists of PKCS #11 modules */ 71 int trustOrder; /* order for this module's certificate trust rollup */ 72 int cipherOrder; /* order for cipher operations */ 73 unsigned long evControlMask; /* control the running and shutdown of slot 74 * events (SECMOD_WaitForAnyTokenEvent) */ 75 CK_VERSION cryptokiVersion; /* version of this library */ 76 CK_FLAGS flags; /* pkcs11 v3 flags */ 77 /* Warning this could go way in future versions of NSS 78 * when FIPS indicators wind up in the functionList */ 79 CK_NSS_GetFIPSStatus fipsIndicator; 80 }; 81 82 /* evControlMask flags */ 83 /* 84 * These bits tell the current state of a SECMOD_WaitForAnyTokenEvent. 85 * 86 * SECMOD_WAIT_PKCS11_EVENT - we're waiting in the PKCS #11 module in 87 * C_WaitForSlotEvent(). 88 * SECMOD_WAIT_SIMULATED_EVENT - we're waiting in the NSS simulation code 89 * which polls for token insertion and removal events. 90 * SECMOD_END_WAIT - SECMOD_CancelWait has been called while the module is 91 * waiting in SECMOD_WaitForAnyTokenEvent. SECMOD_WaitForAnyTokenEvent 92 * should return immediately to it's caller. 93 */ 94 #define SECMOD_END_WAIT 0x01 95 #define SECMOD_WAIT_SIMULATED_EVENT 0x02 96 #define SECMOD_WAIT_PKCS11_EVENT 0x04 97 98 struct SECMODModuleListStr { 99 SECMODModuleList *next; 100 SECMODModule *module; 101 }; 102 103 struct PK11SlotListStr { 104 PK11SlotListElement *head; 105 PK11SlotListElement *tail; 106 PZLock *lock; 107 }; 108 109 struct PK11SlotListElementStr { 110 PK11SlotListElement *next; 111 PK11SlotListElement *prev; 112 PK11SlotInfo *slot; 113 int refCount; 114 }; 115 116 struct PK11RSAGenParamsStr { 117 int keySizeInBits; 118 unsigned long pe; 119 }; 120 121 typedef enum { 122 PK11CertListUnique = 0, /* get one instance of all certs */ 123 PK11CertListUser = 1, /* get all instances of user certs */ 124 PK11CertListRootUnique = 2, /* get one instance of CA certs without a private key. 125 * deprecated. Use PK11CertListCAUnique 126 */ 127 PK11CertListCA = 3, /* get all instances of CA certs */ 128 PK11CertListCAUnique = 4, /* get one instance of CA certs */ 129 PK11CertListUserUnique = 5, /* get one instance of user certs */ 130 PK11CertListAll = 6 /* get all instances of all certs */ 131 } PK11CertListType; 132 133 /* 134 * Entry into the array which lists all the legal bits for the default flags 135 * in the slot, their definition, and the PKCS #11 mechanism they represent. 136 * Always statically allocated. 137 */ 138 struct PK11DefaultArrayEntryStr { 139 const char *name; 140 unsigned long flag; 141 unsigned long mechanism; /* this is a long so we don't include the 142 * whole pkcs 11 world to use this header */ 143 }; 144 145 /* 146 * PK11AttrFlags 147 * 148 * A 32-bit bitmask of PK11_ATTR_XXX flags 149 */ 150 typedef PRUint32 PK11AttrFlags; 151 152 /* 153 * PK11_ATTR_XXX 154 * 155 * The following PK11_ATTR_XXX bitflags are used to specify 156 * PKCS #11 object attributes that have Boolean values. Some NSS 157 * functions have a "PK11AttrFlags attrFlags" parameter whose value 158 * is the logical OR of these bitflags. NSS use these bitflags on 159 * private keys or secret keys. Some of these bitflags also apply 160 * to the public keys associated with the private keys. 161 * 162 * For each PKCS #11 object attribute, we need two bitflags to 163 * specify not only "true" and "false" but also "default". For 164 * example, PK11_ATTR_PRIVATE and PK11_ATTR_PUBLIC control the 165 * CKA_PRIVATE attribute. If PK11_ATTR_PRIVATE is set, we add 166 * { CKA_PRIVATE, &cktrue, sizeof(CK_BBOOL) } 167 * to the template. If PK11_ATTR_PUBLIC is set, we add 168 * { CKA_PRIVATE, &ckfalse, sizeof(CK_BBOOL) } 169 * to the template. If neither flag is set, we don't add any 170 * CKA_PRIVATE entry to the template. 171 */ 172 173 /* 174 * Attributes for PKCS #11 storage objects, which include not only 175 * keys but also certificates and domain parameters. 176 */ 177 178 /* 179 * PK11_ATTR_TOKEN 180 * PK11_ATTR_SESSION 181 * 182 * These two flags determine whether the object is a token or 183 * session object. 184 * 185 * These two flags are related and cannot both be set. 186 * If the PK11_ATTR_TOKEN flag is set, the object is a token 187 * object. If the PK11_ATTR_SESSION flag is set, the object is 188 * a session object. If neither flag is set, the object is *by 189 * default* a session object. 190 * 191 * These two flags specify the value of the PKCS #11 CKA_TOKEN 192 * attribute. 193 */ 194 #define PK11_ATTR_TOKEN 0x00000001L 195 #define PK11_ATTR_SESSION 0x00000002L 196 197 /* 198 * PK11_ATTR_PRIVATE 199 * PK11_ATTR_PUBLIC 200 * 201 * These two flags determine whether the object is a private or 202 * public object. A user may not access a private object until the 203 * user has authenticated to the token. 204 * 205 * These two flags are related and cannot both be set. 206 * If the PK11_ATTR_PRIVATE flag is set, the object is a private 207 * object. If the PK11_ATTR_PUBLIC flag is set, the object is a 208 * public object. If neither flag is set, it is token-specific 209 * whether the object is private or public. 210 * 211 * These two flags specify the value of the PKCS #11 CKA_PRIVATE 212 * attribute. NSS only uses this attribute on private and secret 213 * keys, so public keys created by NSS get the token-specific 214 * default value of the CKA_PRIVATE attribute. 215 */ 216 #define PK11_ATTR_PRIVATE 0x00000004L 217 #define PK11_ATTR_PUBLIC 0x00000008L 218 219 /* 220 * PK11_ATTR_MODIFIABLE 221 * PK11_ATTR_UNMODIFIABLE 222 * 223 * These two flags determine whether the object is modifiable or 224 * read-only. 225 * 226 * These two flags are related and cannot both be set. 227 * If the PK11_ATTR_MODIFIABLE flag is set, the object can be 228 * modified. If the PK11_ATTR_UNMODIFIABLE flag is set, the object 229 * is read-only. If neither flag is set, the object is *by default* 230 * modifiable. 231 * 232 * These two flags specify the value of the PKCS #11 CKA_MODIFIABLE 233 * attribute. 234 */ 235 #define PK11_ATTR_MODIFIABLE 0x00000010L 236 #define PK11_ATTR_UNMODIFIABLE 0x00000020L 237 238 /* Attributes for PKCS #11 key objects. */ 239 240 /* 241 * PK11_ATTR_SENSITIVE 242 * PK11_ATTR_INSENSITIVE 243 * 244 * These two flags are related and cannot both be set. 245 * If the PK11_ATTR_SENSITIVE flag is set, the key is sensitive. 246 * If the PK11_ATTR_INSENSITIVE flag is set, the key is not 247 * sensitive. If neither flag is set, it is token-specific whether 248 * the key is sensitive or not. 249 * 250 * If a key is sensitive, certain attributes of the key cannot be 251 * revealed in plaintext outside the token. 252 * 253 * This flag specifies the value of the PKCS #11 CKA_SENSITIVE 254 * attribute. Although the default value of the CKA_SENSITIVE 255 * attribute for secret keys is CK_FALSE per PKCS #11, some FIPS 256 * tokens set the default value to CK_TRUE because only CK_TRUE 257 * is allowed. So in practice the default value of this attribute 258 * is token-specific, hence the need for two bitflags. 259 */ 260 #define PK11_ATTR_SENSITIVE 0x00000040L 261 #define PK11_ATTR_INSENSITIVE 0x00000080L 262 263 /* 264 * PK11_ATTR_EXTRACTABLE 265 * PK11_ATTR_UNEXTRACTABLE 266 * 267 * These two flags are related and cannot both be set. 268 * If the PK11_ATTR_EXTRACTABLE flag is set, the key is extractable 269 * and can be wrapped. If the PK11_ATTR_UNEXTRACTABLE flag is set, 270 * the key is not extractable, and certain attributes of the key 271 * cannot be revealed in plaintext outside the token (just like a 272 * sensitive key). If neither flag is set, it is token-specific 273 * whether the key is extractable or not. 274 * 275 * These two flags specify the value of the PKCS #11 CKA_EXTRACTABLE 276 * attribute. 277 */ 278 #define PK11_ATTR_EXTRACTABLE 0x00000100L 279 #define PK11_ATTR_UNEXTRACTABLE 0x00000200L 280 281 /* Cryptographic module types */ 282 #define SECMOD_EXTERNAL 0 /* external module */ 283 #define SECMOD_INTERNAL 1 /* internal default module */ 284 #define SECMOD_FIPS 2 /* internal fips module */ 285 286 /* default module configuration strings */ 287 #define SECMOD_SLOT_FLAGS "slotFlags=[RSA,DSA,DH,RC2,RC4,DES,RANDOM,SHA1,MD5,MD2,SSL,TLS,AES,Camellia,SEED,SHA256,SHA512]" 288 289 #define SECMOD_MAKE_NSS_FLAGS(fips, slot) \ 290 "Flags=internal,critical" fips " slotparams=(" #slot "={" SECMOD_SLOT_FLAGS "})" 291 292 #define SECMOD_INT_NAME "NSS Internal PKCS #11 Module" 293 #define SECMOD_INT_FLAGS SECMOD_MAKE_NSS_FLAGS("", 1) 294 #define SECMOD_FIPS_NAME "NSS Internal FIPS PKCS #11 Module" 295 #define SECMOD_FIPS_FLAGS SECMOD_MAKE_NSS_FLAGS(",fips", 3) 296 297 /* 298 * What is the origin of a given Key. Normally this doesn't matter, but 299 * the fortezza code needs to know if it needs to invoke the SSL3 fortezza 300 * hack. 301 */ 302 typedef enum { 303 PK11_OriginNULL = 0, /* There is not key, it's a null SymKey */ 304 PK11_OriginDerive = 1, /* Key was derived from some other key */ 305 PK11_OriginGenerated = 2, /* Key was generated (also PBE keys) */ 306 PK11_OriginFortezzaHack = 3, /* Key was marked for fortezza hack */ 307 PK11_OriginUnwrap = 4 /* Key was unwrapped or decrypted */ 308 } PK11Origin; 309 310 /* PKCS #11 disable reasons */ 311 typedef enum { 312 PK11_DIS_NONE = 0, 313 PK11_DIS_USER_SELECTED = 1, 314 PK11_DIS_COULD_NOT_INIT_TOKEN = 2, 315 PK11_DIS_TOKEN_VERIFY_FAILED = 3, 316 PK11_DIS_TOKEN_NOT_PRESENT = 4 317 } PK11DisableReasons; 318 319 /* types of PKCS #11 objects 320 * used to identify which NSS data structure is 321 * passed to the PK11_Raw* functions. Types map as follows: 322 * PK11_TypeGeneric PK11GenericObject * 323 * PK11_TypePrivKey SECKEYPrivateKey * 324 * PK11_TypePubKey SECKEYPublicKey * 325 * PK11_TypeSymKey PK11SymKey * 326 * PK11_TypeCert CERTCertificate * (currently not used). 327 */ 328 typedef enum { 329 PK11_TypeGeneric = 0, 330 PK11_TypePrivKey = 1, 331 PK11_TypePubKey = 2, 332 PK11_TypeCert = 3, 333 PK11_TypeSymKey = 4 334 } PK11ObjectType; 335 336 /* function pointer type for password callback function. 337 * This type is passed in to PK11_SetPasswordFunc() 338 */ 339 typedef char *(PR_CALLBACK *PK11PasswordFunc)(PK11SlotInfo *slot, PRBool retry, void *arg); 340 typedef PRBool(PR_CALLBACK *PK11VerifyPasswordFunc)(PK11SlotInfo *slot, void *arg); 341 typedef PRBool(PR_CALLBACK *PK11IsLoggedInFunc)(PK11SlotInfo *slot, void *arg); 342 343 /* 344 * Special strings the password callback function can return only if 345 * the slot is an protected auth path slot. 346 */ 347 #define PK11_PW_RETRY "RETRY" /* an failed attempt to authenticate \ 348 * has already been made, just retry \ 349 * the operation */ 350 #define PK11_PW_AUTHENTICATED "AUTH" /* a successful attempt to authenticate \ 351 * has completed. Continue without \ 352 * another call to C_Login */ 353 /* All other non-null values mean that that NSS could call C_Login to force 354 * the authentication. The following define is to aid applications in 355 * documenting that is what it's trying to do */ 356 #define PK11_PW_TRY "TRY" /* Default: a prompt has been presented \ 357 * to the user, initiate a C_Login \ 358 * to authenticate the token */ 359 360 /* 361 * PKCS #11 key structures 362 */ 363 364 /* 365 ** Attributes 366 */ 367 struct SECKEYAttributeStr { 368 SECItem attrType; 369 SECItem **attrValue; 370 }; 371 typedef struct SECKEYAttributeStr SECKEYAttribute; 372 373 /* 374 ** A PKCS#8 private key info object 375 */ 376 struct SECKEYPrivateKeyInfoStr { 377 PLArenaPool *arena; 378 SECItem version; 379 SECAlgorithmID algorithm; 380 SECItem privateKey; 381 SECKEYAttribute **attributes; 382 }; 383 typedef struct SECKEYPrivateKeyInfoStr SECKEYPrivateKeyInfo; 384 385 /* 386 ** A PKCS#8 private key info object 387 */ 388 struct SECKEYEncryptedPrivateKeyInfoStr { 389 PLArenaPool *arena; 390 SECAlgorithmID algorithm; 391 SECItem encryptedData; 392 }; 393 typedef struct SECKEYEncryptedPrivateKeyInfoStr SECKEYEncryptedPrivateKeyInfo; 394 395 /* 396 * token removal detection 397 */ 398 typedef enum { 399 PK11TokenNotRemovable = 0, 400 PK11TokenPresent = 1, 401 PK11TokenChanged = 2, 402 PK11TokenRemoved = 3 403 } PK11TokenStatus; 404 405 typedef enum { 406 PK11TokenRemovedOrChangedEvent = 0, 407 PK11TokenPresentEvent = 1 408 } PK11TokenEvent; 409 410 /* 411 * CRL Import Flags 412 */ 413 #define CRL_IMPORT_DEFAULT_OPTIONS 0x00000000 414 #define CRL_IMPORT_BYPASS_CHECKS 0x00000001 415 416 /* 417 * Merge Error Log 418 */ 419 typedef struct PK11MergeLogStr PK11MergeLog; 420 typedef struct PK11MergeLogNodeStr PK11MergeLogNode; 421 422 /* These need to be global, leave some open fields so we can 'expand' 423 * these without breaking binary compatibility */ 424 struct PK11MergeLogNodeStr { 425 PK11MergeLogNode *next; /* next entry in the list */ 426 PK11MergeLogNode *prev; /* last entry in the list */ 427 PK11GenericObject *object; /* object that failed */ 428 int error; /* what the error was */ 429 CK_RV reserved1; 430 unsigned long reserved2; /* future flags */ 431 unsigned long reserved3; /* future scalar */ 432 void *reserved4; /* future pointer */ 433 void *reserved5; /* future expansion pointer */ 434 }; 435 436 struct PK11MergeLogStr { 437 PK11MergeLogNode *head; 438 PK11MergeLogNode *tail; 439 PLArenaPool *arena; 440 int version; 441 unsigned long reserved1; 442 unsigned long reserved2; 443 unsigned long reserved3; 444 void *reserverd4; 445 void *reserverd5; 446 }; 447 448 #endif /*_SECMODT_H_ */