tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

pcertt.h (12004B)


      1 /* This Source Code Form is subject to the terms of the Mozilla Public
      2 * License, v. 2.0. If a copy of the MPL was not distributed with this
      3 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
      4 /*
      5 * certt.h - public data structures for the certificate library
      6 */
      7 #ifndef _PCERTT_H_
      8 #define _PCERTT_H_
      9 
     10 #include "prclist.h"
     11 #include "pkcs11t.h"
     12 #include "seccomon.h"
     13 #include "secoidt.h"
     14 #include "plarena.h"
     15 #include "prcvar.h"
     16 #include "nssilock.h"
     17 #include "prio.h"
     18 #include "prmon.h"
     19 
     20 /* Non-opaque objects */
     21 typedef struct NSSLOWCERTCertDBHandleStr NSSLOWCERTCertDBHandle;
     22 typedef struct NSSLOWCERTCertKeyStr NSSLOWCERTCertKey;
     23 
     24 typedef struct NSSLOWCERTTrustStr NSSLOWCERTTrust;
     25 typedef struct NSSLOWCERTCertTrustStr NSSLOWCERTCertTrust;
     26 typedef struct NSSLOWCERTCertificateStr NSSLOWCERTCertificate;
     27 typedef struct NSSLOWCERTCertificateListStr NSSLOWCERTCertificateList;
     28 typedef struct NSSLOWCERTIssuerAndSNStr NSSLOWCERTIssuerAndSN;
     29 typedef struct NSSLOWCERTSignedDataStr NSSLOWCERTSignedData;
     30 typedef struct NSSLOWCERTSubjectPublicKeyInfoStr NSSLOWCERTSubjectPublicKeyInfo;
     31 typedef struct NSSLOWCERTValidityStr NSSLOWCERTValidity;
     32 
     33 /*
     34 ** An X.509 validity object
     35 */
     36 struct NSSLOWCERTValidityStr {
     37    PLArenaPool *arena;
     38    SECItem notBefore;
     39    SECItem notAfter;
     40 };
     41 
     42 /*
     43 * A serial number and issuer name, which is used as a database key
     44 */
     45 struct NSSLOWCERTCertKeyStr {
     46    SECItem serialNumber;
     47    SECItem derIssuer;
     48 };
     49 
     50 /*
     51 ** A signed data object. Used to implement the "signed" macro used
     52 ** in the X.500 specs.
     53 */
     54 struct NSSLOWCERTSignedDataStr {
     55    SECItem data;
     56    SECAlgorithmID signatureAlgorithm;
     57    SECItem signature;
     58 };
     59 
     60 /*
     61 ** An X.509 subject-public-key-info object
     62 */
     63 struct NSSLOWCERTSubjectPublicKeyInfoStr {
     64    PLArenaPool *arena;
     65    SECAlgorithmID algorithm;
     66    SECItem subjectPublicKey;
     67 };
     68 
     69 typedef struct _certDBEntryCert certDBEntryCert;
     70 typedef struct _certDBEntryRevocation certDBEntryRevocation;
     71 
     72 struct NSSLOWCERTCertTrustStr {
     73    unsigned int sslFlags;
     74    unsigned int emailFlags;
     75    unsigned int objectSigningFlags;
     76 };
     77 
     78 /*
     79 ** PKCS11 Trust representation
     80 */
     81 struct NSSLOWCERTTrustStr {
     82    NSSLOWCERTTrust *next;
     83    NSSLOWCERTCertDBHandle *dbhandle;
     84    SECItem dbKey;            /* database key for this cert */
     85    certDBEntryCert *dbEntry; /* database entry struct */
     86    NSSLOWCERTCertTrust *trust;
     87    SECItem *derCert; /* original DER for the cert */
     88    unsigned char dbKeySpace[512];
     89 };
     90 
     91 /*
     92 ** An X.509 certificate object (the unsigned form)
     93 */
     94 struct NSSLOWCERTCertificateStr {
     95    /* the arena is used to allocate any data structures that have the same
     96     * lifetime as the cert.  This is all stuff that hangs off of the cert
     97     * structure, and is all freed at the same time.  I is used when the
     98     * cert is decoded, destroyed, and at some times when it changes
     99     * state
    100     */
    101    NSSLOWCERTCertificate *next;
    102    NSSLOWCERTCertDBHandle *dbhandle;
    103 
    104    SECItem derCert;   /* original DER for the cert */
    105    SECItem derIssuer; /* DER for issuer name */
    106    SECItem derSN;
    107    SECItem serialNumber;
    108    SECItem derSubject; /* DER for subject name */
    109    SECItem derSubjKeyInfo;
    110    NSSLOWCERTSubjectPublicKeyInfo *subjectPublicKeyInfo;
    111    SECItem certKey; /* database key for this cert */
    112    SECItem validity;
    113    certDBEntryCert *dbEntry; /* database entry struct */
    114    SECItem subjectKeyID;     /* x509v3 subject key identifier */
    115    SECItem extensions;
    116    char *nickname;
    117    char *emailAddr;
    118    NSSLOWCERTCertTrust *trust;
    119 
    120    /* the reference count is modified whenever someone looks up, dups
    121     * or destroys a certificate
    122     */
    123    int referenceCount;
    124 
    125    char nicknameSpace[200];
    126    char emailAddrSpace[200];
    127    unsigned char certKeySpace[512];
    128 };
    129 
    130 #define SEC_CERTIFICATE_VERSION_1 0 /* default created */
    131 #define SEC_CERTIFICATE_VERSION_2 1 /* v2 */
    132 #define SEC_CERTIFICATE_VERSION_3 2 /* v3 extensions */
    133 
    134 #define SEC_CRL_VERSION_1 0 /* default */
    135 #define SEC_CRL_VERSION_2 1 /* v2 extensions */
    136 
    137 #define NSS_MAX_LEGACY_DB_KEY_SIZE (60 * 1024)
    138 
    139 struct NSSLOWCERTIssuerAndSNStr {
    140    SECItem derIssuer;
    141    SECItem serialNumber;
    142 };
    143 
    144 typedef SECStatus (*NSSLOWCERTCertCallback)(NSSLOWCERTCertificate *cert, void *arg);
    145 
    146 /* This is the typedef for the callback passed to nsslowcert_OpenCertDB() */
    147 /* callback to return database name based on version number */
    148 typedef char *(*NSSLOWCERTDBNameFunc)(void *arg, int dbVersion);
    149 
    150 /* XXX Lisa thinks the template declarations belong in cert.h, not here? */
    151 
    152 #include "secasn1t.h" /* way down here because I expect template stuff to
    153             * move out of here anyway */
    154 
    155 /*
    156 * Certificate Database related definitions and data structures
    157 */
    158 
    159 /* version number of certificate database */
    160 #define CERT_DB_FILE_VERSION 8
    161 #define CERT_DB_V7_FILE_VERSION 7
    162 #define CERT_DB_CONTENT_VERSION 2
    163 
    164 #define SEC_DB_ENTRY_HEADER_LEN 3
    165 #define SEC_DB_KEY_HEADER_LEN 1
    166 
    167 /* All database entries have this form:
    168 *
    169 *  byte offset field
    170 *  ----------- -----
    171 *  0       version
    172 *  1       type
    173 *  2       flags
    174 */
    175 
    176 /* database entry types */
    177 typedef enum {
    178    certDBEntryTypeVersion = 0,
    179    certDBEntryTypeCert = 1,
    180    certDBEntryTypeNickname = 2,
    181    certDBEntryTypeSubject = 3,
    182    certDBEntryTypeRevocation = 4,
    183    certDBEntryTypeKeyRevocation = 5,
    184    certDBEntryTypeSMimeProfile = 6,
    185    certDBEntryTypeContentVersion = 7,
    186    certDBEntryTypeBlob = 8
    187 } certDBEntryType;
    188 
    189 typedef struct {
    190    certDBEntryType type;
    191    unsigned int version;
    192    unsigned int flags;
    193    PLArenaPool *arena;
    194 } certDBEntryCommon;
    195 
    196 /*
    197 * Certificate entry:
    198 *
    199 *  byte offset field
    200 *  ----------- -----
    201 *  0       sslFlags-msb
    202 *  1       sslFlags-lsb
    203 *  2       emailFlags-msb
    204 *  3       emailFlags-lsb
    205 *  4       objectSigningFlags-msb
    206 *  5       objectSigningFlags-lsb
    207 *  6       derCert-len-msb
    208 *  7       derCert-len-lsb
    209 *  8       nickname-len-msb
    210 *  9       nickname-len-lsb
    211 *  ...     derCert
    212 *  ...     nickname
    213 *
    214 * NOTE: the nickname string as stored in the database is null terminated,
    215 *      in other words, the last byte of the db entry is always 0
    216 *      if a nickname is present.
    217 * NOTE: if nickname is not present, then nickname-len-msb and
    218 *      nickname-len-lsb will both be zero.
    219 */
    220 struct _certDBEntryCert {
    221    certDBEntryCommon common;
    222    certDBEntryCert *next;
    223    NSSLOWCERTCertTrust trust;
    224    SECItem derCert;
    225    char *nickname;
    226    char nicknameSpace[200];
    227    unsigned char derCertSpace[2048];
    228 };
    229 
    230 /*
    231 * Certificate Nickname entry:
    232 *
    233 *  byte offset field
    234 *  ----------- -----
    235 *  0       subjectname-len-msb
    236 *  1           subjectname-len-lsb
    237 *  2...        subjectname
    238 *
    239 * The database key for this type of entry is a nickname string
    240 * The "subjectname" value is the DER encoded DN of the identity
    241 *   that matches this nickname.
    242 */
    243 typedef struct {
    244    certDBEntryCommon common;
    245    char *nickname;
    246    SECItem subjectName;
    247 } certDBEntryNickname;
    248 
    249 #define DB_NICKNAME_ENTRY_HEADER_LEN 2
    250 
    251 /*
    252 * Certificate Subject entry:
    253 *
    254 *  byte offset field
    255 *  ----------- -----
    256 *  0       ncerts-msb
    257 *  1       ncerts-lsb
    258 *  2       nickname-msb
    259 *  3       nickname-lsb
    260 *  4       emailAddr-msb
    261 *  5       emailAddr-lsb
    262 *  ...     nickname
    263 *  ...     emailAddr
    264 *  ...+2*i     certkey-len-msb
    265 *  ...+1+2*i       certkey-len-lsb
    266 *  ...+2*ncerts+2*i keyid-len-msb
    267 *  ...+1+2*ncerts+2*i keyid-len-lsb
    268 *  ...     certkeys
    269 *  ...     keyids
    270 *
    271 * The database key for this type of entry is the DER encoded subject name
    272 * The "certkey" value is an array of  certificate database lookup keys that
    273 *   points to the database entries for the certificates that matche
    274 *   this subject.
    275 *
    276 */
    277 typedef struct _certDBEntrySubject {
    278    certDBEntryCommon common;
    279    SECItem derSubject;
    280    unsigned int ncerts;
    281    char *nickname;
    282    SECItem *certKeys;
    283    SECItem *keyIDs;
    284    char **emailAddrs;
    285    unsigned int nemailAddrs;
    286 } certDBEntrySubject;
    287 
    288 #define DB_SUBJECT_ENTRY_HEADER_LEN 6
    289 
    290 /*
    291 * Certificate SMIME profile entry:
    292 *
    293 *  byte offset field
    294 *  ----------- -----
    295 *  0       subjectname-len-msb
    296 *  1           subjectname-len-lsb
    297 *  2       smimeoptions-len-msb
    298 *  3       smimeoptions-len-lsb
    299 *  4       options-date-len-msb
    300 *  5       options-date-len-lsb
    301 *  6...        subjectname
    302 *  ...     smimeoptions
    303 *  ...     options-date
    304 *
    305 * The database key for this type of entry is the email address string
    306 * The "subjectname" value is the DER encoded DN of the identity
    307 *   that matches this nickname.
    308 * The "smimeoptions" value is a string that represents the algorithm
    309 *   capabilities on the remote user.
    310 * The "options-date" is the date that the smime options value was created.
    311 *   This is generally the signing time of the signed message that contained
    312 *   the options.  It is a UTCTime value.
    313 */
    314 typedef struct {
    315    certDBEntryCommon common;
    316    char *emailAddr;
    317    SECItem subjectName;
    318    SECItem smimeOptions;
    319    SECItem optionsDate;
    320 } certDBEntrySMime;
    321 
    322 #define DB_SMIME_ENTRY_HEADER_LEN 6
    323 
    324 /*
    325 * Crl/krl entry:
    326 *
    327 *  byte offset field
    328 *  ----------- -----
    329 *  0       derCert-len-msb
    330 *  1       derCert-len-lsb
    331 *  2       url-len-msb
    332 *  3       url-len-lsb
    333 *  ...     derCert
    334 *  ...     url
    335 *
    336 * NOTE: the url string as stored in the database is null terminated,
    337 *      in other words, the last byte of the db entry is always 0
    338 *      if a nickname is present.
    339 * NOTE: if url is not present, then url-len-msb and
    340 *      url-len-lsb will both be zero.
    341 */
    342 #define DB_CRL_ENTRY_HEADER_LEN 4
    343 struct _certDBEntryRevocation {
    344    certDBEntryCommon common;
    345    SECItem derCrl;
    346    char *url; /* where to load the crl from */
    347 };
    348 
    349 /*
    350 * Database Version Entry:
    351 *
    352 *  byte offset field
    353 *  ----------- -----
    354 *  only the low level header...
    355 *
    356 * The database key for this type of entry is the string "Version"
    357 */
    358 typedef struct {
    359    certDBEntryCommon common;
    360 } certDBEntryVersion;
    361 
    362 #define SEC_DB_VERSION_KEY "Version"
    363 #define SEC_DB_VERSION_KEY_LEN sizeof(SEC_DB_VERSION_KEY)
    364 
    365 /*
    366 * Database Content Version Entry:
    367 *
    368 *  byte offset field
    369 *  ----------- -----
    370 *  0       contentVersion
    371 *
    372 * The database key for this type of entry is the string "ContentVersion"
    373 */
    374 typedef struct {
    375    certDBEntryCommon common;
    376    char contentVersion;
    377 } certDBEntryContentVersion;
    378 
    379 #define SEC_DB_CONTENT_VERSION_KEY "ContentVersion"
    380 #define SEC_DB_CONTENT_VERSION_KEY_LEN sizeof(SEC_DB_CONTENT_VERSION_KEY)
    381 
    382 typedef union {
    383    certDBEntryCommon common;
    384    certDBEntryCert cert;
    385    certDBEntryContentVersion content;
    386    certDBEntryNickname nickname;
    387    certDBEntryRevocation revocation;
    388    certDBEntrySMime smime;
    389    certDBEntrySubject subject;
    390    certDBEntryVersion version;
    391 } certDBEntry;
    392 
    393 /* length of the fixed part of a database entry */
    394 #define DBCERT_V4_HEADER_LEN 7
    395 #define DB_CERT_V5_ENTRY_HEADER_LEN 7
    396 #define DB_CERT_V6_ENTRY_HEADER_LEN 7
    397 #define DB_CERT_ENTRY_HEADER_LEN 10
    398 
    399 /* common flags for all types of certificates */
    400 #define CERTDB_TERMINAL_RECORD (1u << 0)
    401 #define CERTDB_TRUSTED (1u << 1)
    402 #define CERTDB_SEND_WARN (1u << 2)
    403 #define CERTDB_VALID_CA (1u << 3)
    404 #define CERTDB_TRUSTED_CA (1u << 4) /* trusted for issuing server certs */
    405 #define CERTDB_NS_TRUSTED_CA (1u << 5)
    406 #define CERTDB_USER (1u << 6)
    407 #define CERTDB_TRUSTED_CLIENT_CA (1u << 7) /* trusted for issuing client certs */
    408 #define CERTDB_INVISIBLE_CA (1u << 8)      /* don't show in UI */
    409 #define CERTDB_GOVT_APPROVED_CA (1u << 9)  /* can do strong crypto in export ver */
    410 #define CERTDB_MUST_VERIFY (1u << 10)      /* explicitly don't trust this cert */
    411 #define CERTDB_TRUSTED_UNKNOWN (1u << 11)  /* accept trust from another source */
    412 
    413 /* bits not affected by the CKO_NETSCAPE_TRUST object */
    414 #define CERTDB_PRESERVE_TRUST_BITS (CERTDB_USER |                                                  \
    415                                    CERTDB_NS_TRUSTED_CA | CERTDB_VALID_CA | CERTDB_INVISIBLE_CA | \
    416                                    CERTDB_GOVT_APPROVED_CA)
    417 
    418 #endif /* _PCERTT_H_ */