andre@0: /* This Source Code Form is subject to the terms of the Mozilla Public andre@0: * License, v. 2.0. If a copy of the MPL was not distributed with this andre@0: * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ andre@0: /* andre@0: * pkix_revocationchecker.h andre@0: * andre@0: * RevocationChecker Object Type Definition andre@0: * andre@0: */ andre@0: andre@0: #ifndef _PKIX_REVOCATIONCHECKER_H andre@0: #define _PKIX_REVOCATIONCHECKER_H andre@0: andre@0: #include "pkixt.h" andre@0: andre@0: #ifdef __cplusplus andre@0: extern "C" { andre@0: #endif andre@0: andre@0: /* NOTE: nbio logistic removed. Will be replaced later. */ andre@0: andre@0: /* andre@0: * All Flags are prefixed by CERT_REV_M_, where _M_ indicates andre@0: * this is a method dependent flag. andre@0: */ andre@0: andre@0: /* andre@0: * Whether or not to use a method for revocation testing. andre@0: * If set to "do not test", then all other flags are ignored. andre@0: */ andre@0: #define PKIX_REV_M_DO_NOT_TEST_USING_THIS_METHOD 0x00L andre@0: #define PKIX_REV_M_TEST_USING_THIS_METHOD 0x01L andre@0: andre@0: /* andre@0: * Whether or not NSS is allowed to attempt to fetch fresh information andre@0: * from the network. andre@0: * (Although fetching will never happen if fresh information for the andre@0: * method is already locally available.) andre@0: */ andre@0: #define PKIX_REV_M_ALLOW_NETWORK_FETCHING 0x00L andre@0: #define PKIX_REV_M_FORBID_NETWORK_FETCHING 0x02L andre@0: andre@0: /* andre@0: * Example for an implicit default source: andre@0: * The globally configured default OCSP responder. andre@0: * IGNORE means: andre@0: * ignore the implicit default source, whether it's configured or not. andre@0: * ALLOW means: andre@0: * if an implicit default source is configured, andre@0: * then it overrides any available or missing source in the cert. andre@0: * if no implicit default source is configured, andre@0: * then we continue to use what's available (or not available) andre@0: * in the certs. andre@0: */ andre@0: #define PKIX_REV_M_ALLOW_IMPLICIT_DEFAULT_SOURCE 0x00L andre@0: #define PKIX_REV_M_IGNORE_IMPLICIT_DEFAULT_SOURCE 0x04L /* OCSP only */ andre@0: andre@0: /* andre@0: * Defines the behavior if no fresh information is available, andre@0: * fetching from the network is allowed, but the source of revocation andre@0: * information is unknown (even after considering implicit sources, andre@0: * if allowed by other flags). andre@0: * SKIPT_TEST means: andre@0: * We ignore that no fresh information is available and andre@0: * skip this test. andre@0: * REQUIRE_INFO means: andre@0: * We still require that fresh information is available. andre@0: * Other flags define what happens on missing fresh info. andre@0: */ andre@0: andre@0: #define PKIX_REV_M_SKIP_TEST_ON_MISSING_SOURCE 0x00L andre@0: #define PKIX_REV_M_REQUIRE_INFO_ON_MISSING_SOURCE 0x08L andre@0: andre@0: /* andre@0: * Defines the behavior if we are unable to obtain fresh information. andre@0: * INGORE means: andre@0: * Return "cert status unknown" andre@0: * FAIL means: andre@0: * Return "cert revoked". andre@0: */ andre@0: andre@0: #define PKIX_REV_M_IGNORE_MISSING_FRESH_INFO 0x00L andre@0: #define PKIX_REV_M_FAIL_ON_MISSING_FRESH_INFO 0x10L andre@0: andre@0: /* andre@0: * What should happen if we were able to find fresh information using andre@0: * this method, and the data indicated the cert is good? andre@0: * STOP_TESTING means: andre@0: * Our success is sufficient, do not continue testing andre@0: * other methods. andre@0: * CONTINUE_TESTING means: andre@0: * We will continue and test the next allowed andre@0: * specified method. andre@0: */ andre@0: andre@0: #define PKIX_REV_M_STOP_TESTING_ON_FRESH_INFO 0x00L andre@0: #define PKIX_REV_M_CONTINUE_TESTING_ON_FRESH_INFO 0x20L andre@0: andre@0: /* andre@0: * All Flags are prefixed by PKIX_REV_MI_, where _MI_ indicates andre@0: * this is a method independent flag. andre@0: */ andre@0: andre@0: /* andre@0: * This defines the order to checking. andre@0: * EACH_METHOD_SEPARATELY means: andre@0: * Do all tests related to a particular allowed method andre@0: * (both local information and network fetching) in a single step. andre@0: * Only after testing for a particular method is done, andre@0: * then switching to the next method will happen. andre@0: * ALL_LOCAL_INFORMATION_FIRST means: andre@0: * Start by testing the information for all allowed methods andre@0: * which are already locally available. Only after that is done andre@0: * consider to fetch from the network (as allowed by other flags). andre@0: */ andre@0: #define PKIX_REV_MI_TEST_EACH_METHOD_SEPARATELY 0x00L andre@0: #define PKIX_REV_MI_TEST_ALL_LOCAL_INFORMATION_FIRST 0x01L andre@0: andre@0: /* andre@0: * Use this flag to specify that it's necessary that fresh information andre@0: * is available for at least one of the allowed methods, but it's andre@0: * irrelevant which of the mechanisms succeeded. andre@0: * NO_OVERALL_INFO_REQUIREMENT means: andre@0: * We strictly follow the requirements for each individual method. andre@0: * REQUIRE_SOME_FRESH_INFO_AVAILABLE means: andre@0: * After the individual tests have been executed, we must have andre@0: * been able to find fresh information using at least one method. andre@0: * If we were unable to find fresh info, it's a failure. andre@0: */ andre@0: #define PKIX_REV_MI_NO_OVERALL_INFO_REQUIREMENT 0x00L andre@0: #define PKIX_REV_MI_REQUIRE_SOME_FRESH_INFO_AVAILABLE 0x02L andre@0: andre@0: /* Defines check time for the cert, revocation methods lists and andre@0: * flags for leaf and chain certs revocation tests. */ andre@0: struct PKIX_RevocationCheckerStruct { andre@0: PKIX_List *leafMethodList; andre@0: PKIX_List *chainMethodList; andre@0: PKIX_UInt32 leafMethodListFlags; andre@0: PKIX_UInt32 chainMethodListFlags; andre@0: }; andre@0: andre@0: /* see source file for function documentation */ andre@0: andre@0: PKIX_Error *pkix_RevocationChecker_RegisterSelf(void *plContext); andre@0: andre@0: #ifdef __cplusplus andre@0: } andre@0: #endif andre@0: andre@0: #endif /* _PKIX_REVOCATIONCHECKER_H */