andre@0: /* This Source Code Form is subject to the terms of the Mozilla Public
andre@0: * License, v. 2.0. If a copy of the MPL was not distributed with this
andre@0: * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
andre@0: #ifndef _SECMODT_H_
andre@0: #define _SECMODT_H_ 1
andre@0:
andre@0: #include "nssrwlkt.h"
andre@0: #include "nssilckt.h"
andre@0: #include "secoid.h"
andre@0: #include "secasn1.h"
andre@0: #include "pkcs11t.h"
andre@0: #include "utilmodt.h"
andre@0:
andre@0: SEC_BEGIN_PROTOS
andre@0:
andre@0: /* find a better home for these... */
andre@0: extern const SEC_ASN1Template SECKEY_PointerToEncryptedPrivateKeyInfoTemplate[];
andre@0: SEC_ASN1_CHOOSER_DECLARE(SECKEY_PointerToEncryptedPrivateKeyInfoTemplate)
andre@0: extern const SEC_ASN1Template SECKEY_EncryptedPrivateKeyInfoTemplate[];
andre@0: SEC_ASN1_CHOOSER_DECLARE(SECKEY_EncryptedPrivateKeyInfoTemplate)
andre@0: extern const SEC_ASN1Template SECKEY_PrivateKeyInfoTemplate[];
andre@0: SEC_ASN1_CHOOSER_DECLARE(SECKEY_PrivateKeyInfoTemplate)
andre@0: extern const SEC_ASN1Template SECKEY_PointerToPrivateKeyInfoTemplate[];
andre@0: SEC_ASN1_CHOOSER_DECLARE(SECKEY_PointerToPrivateKeyInfoTemplate)
andre@0:
andre@0: SEC_END_PROTOS
andre@0:
andre@0: /* PKCS11 needs to be included */
andre@0: typedef struct SECMODModuleStr SECMODModule;
andre@0: typedef struct SECMODModuleListStr SECMODModuleList;
andre@0: typedef NSSRWLock SECMODListLock;
andre@0: typedef struct PK11SlotInfoStr PK11SlotInfo; /* defined in secmodti.h */
andre@0: typedef struct NSSUTILPreSlotInfoStr PK11PreSlotInfo; /* defined in secmodti.h */
andre@0: typedef struct PK11SymKeyStr PK11SymKey; /* defined in secmodti.h */
andre@0: typedef struct PK11ContextStr PK11Context; /* defined in secmodti.h */
andre@0: typedef struct PK11SlotListStr PK11SlotList;
andre@0: typedef struct PK11SlotListElementStr PK11SlotListElement;
andre@0: typedef struct PK11RSAGenParamsStr PK11RSAGenParams;
andre@0: typedef unsigned long SECMODModuleID;
andre@0: typedef struct PK11DefaultArrayEntryStr PK11DefaultArrayEntry;
andre@0: typedef struct PK11GenericObjectStr PK11GenericObject;
andre@0: typedef void (*PK11FreeDataFunc)(void *);
andre@0:
andre@0: struct SECMODModuleStr {
andre@0: PLArenaPool *arena;
andre@0: PRBool internal; /* true of internally linked modules, false
andre@0: * for the loaded modules */
andre@0: PRBool loaded; /* Set to true if module has been loaded */
andre@0: PRBool isFIPS; /* Set to true if module is finst internal */
andre@0: char *dllName; /* name of the shared library which implements
andre@0: * this module */
andre@0: char *commonName; /* name of the module to display to the user */
andre@0: void *library; /* pointer to the library. opaque. used only by
andre@0: * pk11load.c */
andre@0: void *functionList; /* The PKCS #11 function table */
andre@0: PZLock *refLock; /* only used pk11db.c */
andre@0: int refCount; /* Module reference count */
andre@0: PK11SlotInfo **slots; /* array of slot points attached to this mod*/
andre@0: int slotCount; /* count of slot in above array */
andre@0: PK11PreSlotInfo *slotInfo; /* special info about slots default settings */
andre@0: int slotInfoCount; /* count */
andre@0: SECMODModuleID moduleID; /* ID so we can find this module again */
andre@0: PRBool isThreadSafe;
andre@0: unsigned long ssl[2]; /* SSL cipher enable flags */
andre@0: char *libraryParams; /* Module specific parameters */
andre@0: void *moduleDBFunc; /* function to return module configuration data*/
andre@0: SECMODModule *parent; /* module that loaded us */
andre@0: PRBool isCritical; /* This module must load successfully */
andre@0: PRBool isModuleDB; /* this module has lists of PKCS #11 modules */
andre@0: PRBool moduleDBOnly; /* this module only has lists of PKCS #11 modules */
andre@0: int trustOrder; /* order for this module's certificate trust rollup */
andre@0: int cipherOrder; /* order for cipher operations */
andre@0: unsigned long evControlMask; /* control the running and shutdown of slot
andre@0: * events (SECMOD_WaitForAnyTokenEvent) */
andre@0: CK_VERSION cryptokiVersion; /* version of this library */
andre@0: };
andre@0:
andre@0: /* evControlMask flags */
andre@0: /*
andre@0: * These bits tell the current state of a SECMOD_WaitForAnyTokenEvent.
andre@0: *
andre@0: * SECMOD_WAIT_PKCS11_EVENT - we're waiting in the PKCS #11 module in
andre@0: * C_WaitForSlotEvent().
andre@0: * SECMOD_WAIT_SIMULATED_EVENT - we're waiting in the NSS simulation code
andre@0: * which polls for token insertion and removal events.
andre@0: * SECMOD_END_WAIT - SECMOD_CancelWait has been called while the module is
andre@0: * waiting in SECMOD_WaitForAnyTokenEvent. SECMOD_WaitForAnyTokenEvent
andre@0: * should return immediately to it's caller.
andre@0: */
andre@0: #define SECMOD_END_WAIT 0x01
andre@0: #define SECMOD_WAIT_SIMULATED_EVENT 0x02
andre@0: #define SECMOD_WAIT_PKCS11_EVENT 0x04
andre@0:
andre@0: struct SECMODModuleListStr {
andre@0: SECMODModuleList *next;
andre@0: SECMODModule *module;
andre@0: };
andre@0:
andre@0: struct PK11SlotListStr {
andre@0: PK11SlotListElement *head;
andre@0: PK11SlotListElement *tail;
andre@0: PZLock *lock;
andre@0: };
andre@0:
andre@0: struct PK11SlotListElementStr {
andre@0: PK11SlotListElement *next;
andre@0: PK11SlotListElement *prev;
andre@0: PK11SlotInfo *slot;
andre@0: int refCount;
andre@0: };
andre@0:
andre@0: struct PK11RSAGenParamsStr {
andre@0: int keySizeInBits;
andre@0: unsigned long pe;
andre@0: };
andre@0:
andre@0: typedef enum {
andre@0: PK11CertListUnique = 0, /* get one instance of all certs */
andre@0: PK11CertListUser = 1, /* get all instances of user certs */
andre@0: PK11CertListRootUnique = 2, /* get one instance of CA certs without a private key.
andre@0: * deprecated. Use PK11CertListCAUnique
andre@0: */
andre@0: PK11CertListCA = 3, /* get all instances of CA certs */
andre@0: PK11CertListCAUnique = 4, /* get one instance of CA certs */
andre@0: PK11CertListUserUnique = 5, /* get one instance of user certs */
andre@0: PK11CertListAll = 6 /* get all instances of all certs */
andre@0: } PK11CertListType;
andre@0:
andre@0: /*
andre@0: * Entry into the array which lists all the legal bits for the default flags
andre@0: * in the slot, their definition, and the PKCS #11 mechanism they represent.
andre@0: * Always statically allocated.
andre@0: */
andre@0: struct PK11DefaultArrayEntryStr {
andre@0: const char *name;
andre@0: unsigned long flag;
andre@0: unsigned long mechanism; /* this is a long so we don't include the
andre@0: * whole pkcs 11 world to use this header */
andre@0: };
andre@0:
andre@0: /*
andre@0: * PK11AttrFlags
andre@0: *
andre@0: * A 32-bit bitmask of PK11_ATTR_XXX flags
andre@0: */
andre@0: typedef PRUint32 PK11AttrFlags;
andre@0:
andre@0: /*
andre@0: * PK11_ATTR_XXX
andre@0: *
andre@0: * The following PK11_ATTR_XXX bitflags are used to specify
andre@0: * PKCS #11 object attributes that have Boolean values. Some NSS
andre@0: * functions have a "PK11AttrFlags attrFlags" parameter whose value
andre@0: * is the logical OR of these bitflags. NSS use these bitflags on
andre@0: * private keys or secret keys. Some of these bitflags also apply
andre@0: * to the public keys associated with the private keys.
andre@0: *
andre@0: * For each PKCS #11 object attribute, we need two bitflags to
andre@0: * specify not only "true" and "false" but also "default". For
andre@0: * example, PK11_ATTR_PRIVATE and PK11_ATTR_PUBLIC control the
andre@0: * CKA_PRIVATE attribute. If PK11_ATTR_PRIVATE is set, we add
andre@0: * { CKA_PRIVATE, &cktrue, sizeof(CK_BBOOL) }
andre@0: * to the template. If PK11_ATTR_PUBLIC is set, we add
andre@0: * { CKA_PRIVATE, &ckfalse, sizeof(CK_BBOOL) }
andre@0: * to the template. If neither flag is set, we don't add any
andre@0: * CKA_PRIVATE entry to the template.
andre@0: */
andre@0:
andre@0: /*
andre@0: * Attributes for PKCS #11 storage objects, which include not only
andre@0: * keys but also certificates and domain parameters.
andre@0: */
andre@0:
andre@0: /*
andre@0: * PK11_ATTR_TOKEN
andre@0: * PK11_ATTR_SESSION
andre@0: *
andre@0: * These two flags determine whether the object is a token or
andre@0: * session object.
andre@0: *
andre@0: * These two flags are related and cannot both be set.
andre@0: * If the PK11_ATTR_TOKEN flag is set, the object is a token
andre@0: * object. If the PK11_ATTR_SESSION flag is set, the object is
andre@0: * a session object. If neither flag is set, the object is *by
andre@0: * default* a session object.
andre@0: *
andre@0: * These two flags specify the value of the PKCS #11 CKA_TOKEN
andre@0: * attribute.
andre@0: */
andre@0: #define PK11_ATTR_TOKEN 0x00000001L
andre@0: #define PK11_ATTR_SESSION 0x00000002L
andre@0:
andre@0: /*
andre@0: * PK11_ATTR_PRIVATE
andre@0: * PK11_ATTR_PUBLIC
andre@0: *
andre@0: * These two flags determine whether the object is a private or
andre@0: * public object. A user may not access a private object until the
andre@0: * user has authenticated to the token.
andre@0: *
andre@0: * These two flags are related and cannot both be set.
andre@0: * If the PK11_ATTR_PRIVATE flag is set, the object is a private
andre@0: * object. If the PK11_ATTR_PUBLIC flag is set, the object is a
andre@0: * public object. If neither flag is set, it is token-specific
andre@0: * whether the object is private or public.
andre@0: *
andre@0: * These two flags specify the value of the PKCS #11 CKA_PRIVATE
andre@0: * attribute. NSS only uses this attribute on private and secret
andre@0: * keys, so public keys created by NSS get the token-specific
andre@0: * default value of the CKA_PRIVATE attribute.
andre@0: */
andre@0: #define PK11_ATTR_PRIVATE 0x00000004L
andre@0: #define PK11_ATTR_PUBLIC 0x00000008L
andre@0:
andre@0: /*
andre@0: * PK11_ATTR_MODIFIABLE
andre@0: * PK11_ATTR_UNMODIFIABLE
andre@0: *
andre@0: * These two flags determine whether the object is modifiable or
andre@0: * read-only.
andre@0: *
andre@0: * These two flags are related and cannot both be set.
andre@0: * If the PK11_ATTR_MODIFIABLE flag is set, the object can be
andre@0: * modified. If the PK11_ATTR_UNMODIFIABLE flag is set, the object
andre@0: * is read-only. If neither flag is set, the object is *by default*
andre@0: * modifiable.
andre@0: *
andre@0: * These two flags specify the value of the PKCS #11 CKA_MODIFIABLE
andre@0: * attribute.
andre@0: */
andre@0: #define PK11_ATTR_MODIFIABLE 0x00000010L
andre@0: #define PK11_ATTR_UNMODIFIABLE 0x00000020L
andre@0:
andre@0: /* Attributes for PKCS #11 key objects. */
andre@0:
andre@0: /*
andre@0: * PK11_ATTR_SENSITIVE
andre@0: * PK11_ATTR_INSENSITIVE
andre@0: *
andre@0: * These two flags are related and cannot both be set.
andre@0: * If the PK11_ATTR_SENSITIVE flag is set, the key is sensitive.
andre@0: * If the PK11_ATTR_INSENSITIVE flag is set, the key is not
andre@0: * sensitive. If neither flag is set, it is token-specific whether
andre@0: * the key is sensitive or not.
andre@0: *
andre@0: * If a key is sensitive, certain attributes of the key cannot be
andre@0: * revealed in plaintext outside the token.
andre@0: *
andre@0: * This flag specifies the value of the PKCS #11 CKA_SENSITIVE
andre@0: * attribute. Although the default value of the CKA_SENSITIVE
andre@0: * attribute for secret keys is CK_FALSE per PKCS #11, some FIPS
andre@0: * tokens set the default value to CK_TRUE because only CK_TRUE
andre@0: * is allowed. So in practice the default value of this attribute
andre@0: * is token-specific, hence the need for two bitflags.
andre@0: */
andre@0: #define PK11_ATTR_SENSITIVE 0x00000040L
andre@0: #define PK11_ATTR_INSENSITIVE 0x00000080L
andre@0:
andre@0: /*
andre@0: * PK11_ATTR_EXTRACTABLE
andre@0: * PK11_ATTR_UNEXTRACTABLE
andre@0: *
andre@0: * These two flags are related and cannot both be set.
andre@0: * If the PK11_ATTR_EXTRACTABLE flag is set, the key is extractable
andre@0: * and can be wrapped. If the PK11_ATTR_UNEXTRACTABLE flag is set,
andre@0: * the key is not extractable, and certain attributes of the key
andre@0: * cannot be revealed in plaintext outside the token (just like a
andre@0: * sensitive key). If neither flag is set, it is token-specific
andre@0: * whether the key is extractable or not.
andre@0: *
andre@0: * These two flags specify the value of the PKCS #11 CKA_EXTRACTABLE
andre@0: * attribute.
andre@0: */
andre@0: #define PK11_ATTR_EXTRACTABLE 0x00000100L
andre@0: #define PK11_ATTR_UNEXTRACTABLE 0x00000200L
andre@0:
andre@0: /* Cryptographic module types */
andre@0: #define SECMOD_EXTERNAL 0 /* external module */
andre@0: #define SECMOD_INTERNAL 1 /* internal default module */
andre@0: #define SECMOD_FIPS 2 /* internal fips module */
andre@0:
andre@0: /* default module configuration strings */
andre@0: #define SECMOD_SLOT_FLAGS "slotFlags=[RSA,DSA,DH,RC2,RC4,DES,RANDOM,SHA1,MD5,MD2,SSL,TLS,AES,Camellia,SEED,SHA256,SHA512]"
andre@0:
andre@0: #define SECMOD_MAKE_NSS_FLAGS(fips,slot) \
andre@0: "Flags=internal,critical" fips " slotparams=(" #slot "={" SECMOD_SLOT_FLAGS "})"
andre@0:
andre@0: #define SECMOD_INT_NAME "NSS Internal PKCS #11 Module"
andre@0: #define SECMOD_INT_FLAGS SECMOD_MAKE_NSS_FLAGS("",1)
andre@0: #define SECMOD_FIPS_NAME "NSS Internal FIPS PKCS #11 Module"
andre@0: #define SECMOD_FIPS_FLAGS SECMOD_MAKE_NSS_FLAGS(",fips",3)
andre@0:
andre@0: /*
andre@0: * What is the origin of a given Key. Normally this doesn't matter, but
andre@0: * the fortezza code needs to know if it needs to invoke the SSL3 fortezza
andre@0: * hack.
andre@0: */
andre@0: typedef enum {
andre@0: PK11_OriginNULL = 0, /* There is not key, it's a null SymKey */
andre@0: PK11_OriginDerive = 1, /* Key was derived from some other key */
andre@0: PK11_OriginGenerated = 2, /* Key was generated (also PBE keys) */
andre@0: PK11_OriginFortezzaHack = 3,/* Key was marked for fortezza hack */
andre@0: PK11_OriginUnwrap = 4 /* Key was unwrapped or decrypted */
andre@0: } PK11Origin;
andre@0:
andre@0: /* PKCS #11 disable reasons */
andre@0: typedef enum {
andre@0: PK11_DIS_NONE = 0,
andre@0: PK11_DIS_USER_SELECTED = 1,
andre@0: PK11_DIS_COULD_NOT_INIT_TOKEN = 2,
andre@0: PK11_DIS_TOKEN_VERIFY_FAILED = 3,
andre@0: PK11_DIS_TOKEN_NOT_PRESENT = 4
andre@0: } PK11DisableReasons;
andre@0:
andre@0: /* types of PKCS #11 objects
andre@0: * used to identify which NSS data structure is
andre@0: * passed to the PK11_Raw* functions. Types map as follows:
andre@0: * PK11_TypeGeneric PK11GenericObject *
andre@0: * PK11_TypePrivKey SECKEYPrivateKey *
andre@0: * PK11_TypePubKey SECKEYPublicKey *
andre@0: * PK11_TypeSymKey PK11SymKey *
andre@0: * PK11_TypeCert CERTCertificate * (currently not used).
andre@0: */
andre@0: typedef enum {
andre@0: PK11_TypeGeneric = 0,
andre@0: PK11_TypePrivKey = 1,
andre@0: PK11_TypePubKey = 2,
andre@0: PK11_TypeCert = 3,
andre@0: PK11_TypeSymKey = 4
andre@0: } PK11ObjectType;
andre@0:
andre@0:
andre@0:
andre@0: /* function pointer type for password callback function.
andre@0: * This type is passed in to PK11_SetPasswordFunc()
andre@0: */
andre@0: typedef char *(PR_CALLBACK *PK11PasswordFunc)(PK11SlotInfo *slot, PRBool retry, void *arg);
andre@0: typedef PRBool (PR_CALLBACK *PK11VerifyPasswordFunc)(PK11SlotInfo *slot, void *arg);
andre@0: typedef PRBool (PR_CALLBACK *PK11IsLoggedInFunc)(PK11SlotInfo *slot, void *arg);
andre@0:
andre@0: /*
andre@0: * Special strings the password callback function can return only if
andre@0: * the slot is an protected auth path slot.
andre@0: */
andre@0: #define PK11_PW_RETRY "RETRY" /* an failed attempt to authenticate
andre@0: * has already been made, just retry
andre@0: * the operation */
andre@0: #define PK11_PW_AUTHENTICATED "AUTH" /* a successful attempt to authenticate
andre@0: * has completed. Continue without
andre@0: * another call to C_Login */
andre@0: /* All other non-null values mean that that NSS could call C_Login to force
andre@0: * the authentication. The following define is to aid applications in
andre@0: * documenting that is what it's trying to do */
andre@0: #define PK11_PW_TRY "TRY" /* Default: a prompt has been presented
andre@0: * to the user, initiate a C_Login
andre@0: * to authenticate the token */
andre@0:
andre@0: /*
andre@0: * PKCS #11 key structures
andre@0: */
andre@0:
andre@0: /*
andre@0: ** Attributes
andre@0: */
andre@0: struct SECKEYAttributeStr {
andre@0: SECItem attrType;
andre@0: SECItem **attrValue;
andre@0: };
andre@0: typedef struct SECKEYAttributeStr SECKEYAttribute;
andre@0:
andre@0: /*
andre@0: ** A PKCS#8 private key info object
andre@0: */
andre@0: struct SECKEYPrivateKeyInfoStr {
andre@0: PLArenaPool *arena;
andre@0: SECItem version;
andre@0: SECAlgorithmID algorithm;
andre@0: SECItem privateKey;
andre@0: SECKEYAttribute **attributes;
andre@0: };
andre@0: typedef struct SECKEYPrivateKeyInfoStr SECKEYPrivateKeyInfo;
andre@0:
andre@0: /*
andre@0: ** A PKCS#8 private key info object
andre@0: */
andre@0: struct SECKEYEncryptedPrivateKeyInfoStr {
andre@0: PLArenaPool *arena;
andre@0: SECAlgorithmID algorithm;
andre@0: SECItem encryptedData;
andre@0: };
andre@0: typedef struct SECKEYEncryptedPrivateKeyInfoStr SECKEYEncryptedPrivateKeyInfo;
andre@0:
andre@0: /*
andre@0: * token removal detection
andre@0: */
andre@0: typedef enum {
andre@0: PK11TokenNotRemovable = 0,
andre@0: PK11TokenPresent = 1,
andre@0: PK11TokenChanged = 2,
andre@0: PK11TokenRemoved = 3
andre@0: } PK11TokenStatus;
andre@0:
andre@0: typedef enum {
andre@0: PK11TokenRemovedOrChangedEvent = 0,
andre@0: PK11TokenPresentEvent = 1
andre@0: } PK11TokenEvent;
andre@0:
andre@0: /*
andre@0: * CRL Import Flags
andre@0: */
andre@0: #define CRL_IMPORT_DEFAULT_OPTIONS 0x00000000
andre@0: #define CRL_IMPORT_BYPASS_CHECKS 0x00000001
andre@0:
andre@0:
andre@0: /*
andre@0: * Merge Error Log
andre@0: */
andre@0: typedef struct PK11MergeLogStr PK11MergeLog;
andre@0: typedef struct PK11MergeLogNodeStr PK11MergeLogNode;
andre@0:
andre@0: /* These need to be global, leave some open fields so we can 'expand'
andre@0: * these without breaking binary compatibility */
andre@0: struct PK11MergeLogNodeStr {
andre@0: PK11MergeLogNode *next; /* next entry in the list */
andre@0: PK11MergeLogNode *prev; /* last entry in the list */
andre@0: PK11GenericObject *object; /* object that failed */
andre@0: int error; /* what the error was */
andre@0: CK_RV reserved1;
andre@0: unsigned long reserved2; /* future flags */
andre@0: unsigned long reserved3; /* future scalar */
andre@0: void *reserved4; /* future pointer */
andre@0: void *reserved5; /* future expansion pointer */
andre@0: };
andre@0:
andre@0: struct PK11MergeLogStr {
andre@0: PK11MergeLogNode *head;
andre@0: PK11MergeLogNode *tail;
andre@0: PLArenaPool *arena;
andre@0: int version;
andre@0: unsigned long reserved1;
andre@0: unsigned long reserved2;
andre@0: unsigned long reserved3;
andre@0: void *reserverd4;
andre@0: void *reserverd5;
andre@0: };
andre@0:
andre@0:
andre@0: #endif /*_SECMODT_H_ */